@becklyn/deployment-protection 0.0.1 → 0.2.0

package/README.md

@@ -23,33 +23,34 @@ npm i @becklyn/deployment-protection
 
 ### 1. Middleware / proxy
 
+Next.js requires `config.matcher` to be a **string literal in the local middleware/proxy file**.
+It cannot be imported from a package (Next analyzes the matcher statically at build time).
+
 **Next.js 16+ (`proxy.ts`):**
 
 ```ts
-import {
-    deploymentProtectionMatcher,
-    withDeploymentProtection,
-} from "@becklyn/deployment-protection";
+import { withDeploymentProtection } from "@becklyn/deployment-protection";
 
 export const proxy = withDeploymentProtection();
 
 export const config = {
-    matcher: deploymentProtectionMatcher,
+    matcher: [
+        "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?)$).*)",
+    ],
 };
 ```
 
 **Next.js ≤15 (`middleware.ts`):**
 
 ```ts
-import {
-    deploymentProtectionMatcher,
-    withDeploymentProtection,
-} from "@becklyn/deployment-protection";
+import { withDeploymentProtection } from "@becklyn/deployment-protection";
 
 export default withDeploymentProtection();
 
 export const config = {
-    matcher: deploymentProtectionMatcher,
+    matcher: [
+        "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?)$).*)",
+    ],
 };
 ```
 
@@ -135,7 +136,6 @@ Redeploy. Middleware stays installed but is a no-op.
 
 ```ts
 import {
-    deploymentProtectionMatcher,
     handleDeploymentProtection,
     resolveConfig,
     withDeploymentProtection,
@@ -144,7 +144,12 @@ import {
 
 - `withDeploymentProtection(options?)` / `withDeploymentProtection(next, options?)` — middleware/proxy factory
 - `handleDeploymentProtection(request, options?)` — framework-agnostic core (`null` = continue)
-- `deploymentProtectionMatcher` — recommended matcher array
+
+Recommended matcher (must be pasted as a string literal in your middleware/proxy file — see above):
+
+```ts
+"/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?)$).*)";
+```
 
 ## Security notes
 

package/dist/cjs/constants.d.ts

@@ -10,6 +10,4 @@ export declare const VERCEL_CALLBACK_PATH = "/_becklyn/deployment-protection/ver
 export declare const BYPASS_HEADER = "x-vercel-protection-bypass";
 export declare const SET_BYPASS_COOKIE_HEADER = "x-vercel-set-bypass-cookie";
 export declare const DEFAULT_SESSION_TTL_SECONDS: number;
-/** Recommended Next.js matcher for full-site protection. */
-export declare const deploymentProtectionMatcher: string[];
 //# sourceMappingURL=constants.d.ts.map

package/dist/cjs/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AACxD,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAC7D,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAC7D,eAAO,MAAM,qBAAqB,gCAAgC,CAAC;AACnE,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AACtE,eAAO,MAAM,qBAAqB,2CAAmC,CAAC;AACtE,eAAO,MAAM,oBAAoB,oDAA4C,CAAC;AAE9E,eAAO,MAAM,aAAa,+BAA+B,CAAC;AAC1D,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAErE,eAAO,MAAM,2BAA2B,QAAoB,CAAC;AAE7D,4DAA4D;AAC5D,eAAO,MAAM,2BAA2B,UAEvC,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AACxD,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAC7D,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAC7D,eAAO,MAAM,qBAAqB,gCAAgC,CAAC;AACnE,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AACtE,eAAO,MAAM,qBAAqB,2CAAmC,CAAC;AACtE,eAAO,MAAM,oBAAoB,oDAA4C,CAAC;AAE9E,eAAO,MAAM,aAAa,+BAA+B,CAAC;AAC1D,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAErE,eAAO,MAAM,2BAA2B,QAAoB,CAAC"}

package/dist/cjs/constants.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deploymentProtectionMatcher = exports.DEFAULT_SESSION_TTL_SECONDS = exports.SET_BYPASS_COOKIE_HEADER = exports.BYPASS_HEADER = exports.VERCEL_CALLBACK_PATH = exports.VERCEL_AUTHORIZE_PATH = exports.INTERNAL_PATH_PREFIX = exports.OAUTH_RETURN_COOKIE = exports.OAUTH_VERIFIER_COOKIE = exports.OAUTH_NONCE_COOKIE = exports.OAUTH_STATE_COOKIE = exports.BYPASS_COOKIE_NAME = exports.SESSION_COOKIE_NAME = void 0;
+exports.DEFAULT_SESSION_TTL_SECONDS = exports.SET_BYPASS_COOKIE_HEADER = exports.BYPASS_HEADER = exports.VERCEL_CALLBACK_PATH = exports.VERCEL_AUTHORIZE_PATH = exports.INTERNAL_PATH_PREFIX = exports.OAUTH_RETURN_COOKIE = exports.OAUTH_VERIFIER_COOKIE = exports.OAUTH_NONCE_COOKIE = exports.OAUTH_STATE_COOKIE = exports.BYPASS_COOKIE_NAME = exports.SESSION_COOKIE_NAME = void 0;
 exports.SESSION_COOKIE_NAME = "__becklyn_dp_session";
 exports.BYPASS_COOKIE_NAME = "__becklyn_dp_bypass";
 exports.OAUTH_STATE_COOKIE = "__becklyn_dp_oauth_state";
@@ -13,7 +13,3 @@ exports.VERCEL_CALLBACK_PATH = `${exports.INTERNAL_PATH_PREFIX}/vercel/callback`
 exports.BYPASS_HEADER = "x-vercel-protection-bypass";
 exports.SET_BYPASS_COOKIE_HEADER = "x-vercel-set-bypass-cookie";
 exports.DEFAULT_SESSION_TTL_SECONDS = 60 * 60 * 24 * 14; // 14 days
-/** Recommended Next.js matcher for full-site protection. */
-exports.deploymentProtectionMatcher = [
-    "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?)$).*)",
-];

package/dist/cjs/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA2OvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA6OvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}

package/dist/cjs/handler.js

@@ -25,11 +25,13 @@ function htmlResponse(html, status = 401) {
         },
     });
 }
-function redirect(location, status = 302) {
+function redirect(request, location, status = 302) {
+    // Next.js middleware/proxy requires an absolute Location; relative values throw ERR_INVALID_URL.
+    const absoluteLocation = new URL(location, request.url).toString();
     return new Response(null, {
         status,
         headers: {
-            Location: location,
+            Location: absoluteLocation,
             "Cache-Control": "no-store",
         },
     });
@@ -58,7 +60,7 @@ async function handleBypass(request, config) {
     if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
         url.searchParams.delete(constants_1.BYPASS_HEADER);
         url.searchParams.delete("x-vercel-set-bypass-cookie");
-        const response = redirect(url.pathname + url.search + url.hash);
+        const response = redirect(request, url.pathname + url.search + url.hash);
         const secure = isSecureRequest(request);
         if (setCookieMode || hadSetCookieQuery) {
             (0, vercel_oauth_1.appendSetCookie)(response, constants_1.BYPASS_COOKIE_NAME, config.bypassSecret, {
@@ -104,7 +106,7 @@ async function handlePasswordPost(request, config) {
             showVercel: (0, config_1.hasVercelAuth)(config),
         }));
     }
-    const response = redirect(returnTo);
+    const response = redirect(request, returnTo);
     return attachSession(response, config, "password", username, isSecureRequest(request));
 }
 async function handleVercelAuthorize(request, config) {
@@ -152,7 +154,7 @@ async function handleVercelCallback(request, config) {
         }
         const user = await (0, vercel_oauth_1.fetchVercelUserInfo)(tokenData.access_token);
         const subject = user.preferred_username || user.email || user.sub || "vercel-user";
-        const response = redirect(returnTo);
+        const response = redirect(request, returnTo);
         (0, vercel_oauth_1.clearOAuthCookies)(response, secure);
         return attachSession(response, config, "vercel", subject, secure);
     }

package/dist/cjs/index.d.ts

@@ -1,4 +1,4 @@
-export { deploymentProtectionMatcher, INTERNAL_PATH_PREFIX, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH, } from "./constants";
+export { INTERNAL_PATH_PREFIX, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH } from "./constants";
 export { handleDeploymentProtection } from "./handler";
 export { withDeploymentProtection } from "./middleware";
 export { resolveConfig, hasPasswordAuth, hasVercelAuth, isProtectionActive } from "./config";

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,YAAY,EACR,UAAU,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,cAAc,GACjB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,YAAY,EACR,UAAU,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,cAAc,GACjB,MAAM,SAAS,CAAC"}

package/dist/cjs/index.js

@@ -1,8 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isProtectionActive = exports.hasVercelAuth = exports.hasPasswordAuth = exports.resolveConfig = exports.withDeploymentProtection = exports.handleDeploymentProtection = exports.VERCEL_CALLBACK_PATH = exports.VERCEL_AUTHORIZE_PATH = exports.INTERNAL_PATH_PREFIX = exports.deploymentProtectionMatcher = void 0;
+exports.isProtectionActive = exports.hasVercelAuth = exports.hasPasswordAuth = exports.resolveConfig = exports.withDeploymentProtection = exports.handleDeploymentProtection = exports.VERCEL_CALLBACK_PATH = exports.VERCEL_AUTHORIZE_PATH = exports.INTERNAL_PATH_PREFIX = void 0;
 var constants_1 = require("./constants");
-Object.defineProperty(exports, "deploymentProtectionMatcher", { enumerable: true, get: function () { return constants_1.deploymentProtectionMatcher; } });
 Object.defineProperty(exports, "INTERNAL_PATH_PREFIX", { enumerable: true, get: function () { return constants_1.INTERNAL_PATH_PREFIX; } });
 Object.defineProperty(exports, "VERCEL_AUTHORIZE_PATH", { enumerable: true, get: function () { return constants_1.VERCEL_AUTHORIZE_PATH; } });
 Object.defineProperty(exports, "VERCEL_CALLBACK_PATH", { enumerable: true, get: function () { return constants_1.VERCEL_CALLBACK_PATH; } });

package/dist/cjs/middleware.d.ts

@@ -1,25 +1,36 @@
 import { type NextRequest, NextResponse } from "next/server";
-import { deploymentProtectionMatcher } from "./constants";
 import type { DeploymentProtectionOptions } from "./types";
 type NextMiddleware = (request: NextRequest, event?: unknown) => Response | NextResponse | Promise<Response | NextResponse | undefined | void> | undefined | void;
 export type WithDeploymentProtectionArgs = [] | [DeploymentProtectionOptions] | [NextMiddleware] | [NextMiddleware, DeploymentProtectionOptions];
 /**
  * Next.js middleware / proxy wrapper.
  *
+ * Next.js only accepts a statically analyzable `config.matcher` in the local
+ * middleware/proxy file. Do not import a matcher from this package — paste the
+ * recommended pattern inline (see README).
+ *
  * @example middleware.ts (Next ≤15)
  * ```ts
- * import {withDeploymentProtection, deploymentProtectionMatcher} from "@becklyn/deployment-protection";
+ * import {withDeploymentProtection} from "@becklyn/deployment-protection";
  * export default withDeploymentProtection();
- * export const config = { matcher: deploymentProtectionMatcher };
+ * export const config = {
+ *   matcher: [
+ *     "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?)$).*)",
+ *   ],
+ * };
  * ```
  *
  * @example proxy.ts (Next 16+)
  * ```ts
- * import {withDeploymentProtection, deploymentProtectionMatcher} from "@becklyn/deployment-protection";
+ * import {withDeploymentProtection} from "@becklyn/deployment-protection";
  * export const proxy = withDeploymentProtection();
- * export const config = { matcher: deploymentProtectionMatcher };
+ * export const config = {
+ *   matcher: [
+ *     "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?)$).*)",
+ *   ],
+ * };
  * ```
  */
 export declare function withDeploymentProtection(...args: WithDeploymentProtectionArgs): (request: NextRequest, event?: unknown) => Promise<Response | NextResponse>;
-export { deploymentProtectionMatcher };
+export {};
 //# sourceMappingURL=middleware.d.ts.map

package/dist/cjs/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AAWpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CAmBtC;AAED,OAAO,EAAE,2BAA2B,EAAE,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8DpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC"}

package/dist/cjs/middleware.js

@@ -1,10 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deploymentProtectionMatcher = void 0;
 exports.withDeploymentProtection = withDeploymentProtection;
 const server_1 = require("next/server");
-const constants_1 = require("./constants");
-Object.defineProperty(exports, "deploymentProtectionMatcher", { enumerable: true, get: function () { return constants_1.deploymentProtectionMatcher; } });
 const handler_1 = require("./handler");
 function isOptions(value) {
     return (typeof value === "object" &&
@@ -12,21 +9,70 @@ function isOptions(value) {
         !Array.isArray(value) &&
         typeof value !== "function");
 }
+function toNextResponse(request, response) {
+    const location = response.headers.get("Location");
+    if (location && response.status >= 300 && response.status < 400) {
+        // Always resolve against the incoming request so relative Locations never reach Next.
+        const redirectResponse = server_1.NextResponse.redirect(new URL(location, request.url), response.status);
+        copyHeaders(response, redirectResponse, /* skipLocation */ true);
+        return redirectResponse;
+    }
+    const nextResponse = new server_1.NextResponse(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+    });
+    copyHeaders(response, nextResponse, false);
+    return nextResponse;
+}
+function copyHeaders(from, to, skipLocation) {
+    const setCookies = typeof from.headers.getSetCookie === "function" ? from.headers.getSetCookie() : [];
+    if (setCookies.length > 0) {
+        for (const cookie of setCookies) {
+            to.headers.append("Set-Cookie", cookie);
+        }
+    }
+    from.headers.forEach((value, key) => {
+        const lower = key.toLowerCase();
+        if (lower === "set-cookie") {
+            // Already copied via getSetCookie when available; fall back otherwise.
+            if (setCookies.length === 0) {
+                to.headers.append("Set-Cookie", value);
+            }
+            return;
+        }
+        if (skipLocation && lower === "location") {
+            return;
+        }
+        to.headers.set(key, value);
+    });
+}
 /**
  * Next.js middleware / proxy wrapper.
  *
+ * Next.js only accepts a statically analyzable `config.matcher` in the local
+ * middleware/proxy file. Do not import a matcher from this package — paste the
+ * recommended pattern inline (see README).
+ *
  * @example middleware.ts (Next ≤15)
  * ```ts
- * import {withDeploymentProtection, deploymentProtectionMatcher} from "@becklyn/deployment-protection";
+ * import {withDeploymentProtection} from "@becklyn/deployment-protection";
  * export default withDeploymentProtection();
- * export const config = { matcher: deploymentProtectionMatcher };
+ * export const config = {
+ *   matcher: [
+ *     "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?)$).*)",
+ *   ],
+ * };
  * ```
  *
  * @example proxy.ts (Next 16+)
  * ```ts
- * import {withDeploymentProtection, deploymentProtectionMatcher} from "@becklyn/deployment-protection";
+ * import {withDeploymentProtection} from "@becklyn/deployment-protection";
  * export const proxy = withDeploymentProtection();
- * export const config = { matcher: deploymentProtectionMatcher };
+ * export const config = {
+ *   matcher: [
+ *     "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?)$).*)",
+ *   ],
+ * };
  * ```
  */
 function withDeploymentProtection(...args) {
@@ -47,12 +93,7 @@ function withDeploymentProtection(...args) {
     return async function deploymentProtectionMiddleware(request, event) {
         const protectionResponse = await (0, handler_1.handleDeploymentProtection)(request, options);
         if (protectionResponse) {
-            // Preserve NextResponse subclass when possible
-            return new server_1.NextResponse(protectionResponse.body, {
-                status: protectionResponse.status,
-                statusText: protectionResponse.statusText,
-                headers: protectionResponse.headers,
-            });
+            return toNextResponse(request, protectionResponse);
         }
         if (next) {
             const result = await next(request, event);

package/dist/es/constants.d.ts

@@ -10,6 +10,4 @@ export declare const VERCEL_CALLBACK_PATH = "/_becklyn/deployment-protection/ver
 export declare const BYPASS_HEADER = "x-vercel-protection-bypass";
 export declare const SET_BYPASS_COOKIE_HEADER = "x-vercel-set-bypass-cookie";
 export declare const DEFAULT_SESSION_TTL_SECONDS: number;
-/** Recommended Next.js matcher for full-site protection. */
-export declare const deploymentProtectionMatcher: string[];
 //# sourceMappingURL=constants.d.ts.map

package/dist/es/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AACxD,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAC7D,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAC7D,eAAO,MAAM,qBAAqB,gCAAgC,CAAC;AACnE,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AACtE,eAAO,MAAM,qBAAqB,2CAAmC,CAAC;AACtE,eAAO,MAAM,oBAAoB,oDAA4C,CAAC;AAE9E,eAAO,MAAM,aAAa,+BAA+B,CAAC;AAC1D,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAErE,eAAO,MAAM,2BAA2B,QAAoB,CAAC;AAE7D,4DAA4D;AAC5D,eAAO,MAAM,2BAA2B,UAEvC,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AACxD,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAC7D,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAC7D,eAAO,MAAM,qBAAqB,gCAAgC,CAAC;AACnE,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AACtE,eAAO,MAAM,qBAAqB,2CAAmC,CAAC;AACtE,eAAO,MAAM,oBAAoB,oDAA4C,CAAC;AAE9E,eAAO,MAAM,aAAa,+BAA+B,CAAC;AAC1D,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAErE,eAAO,MAAM,2BAA2B,QAAoB,CAAC"}

package/dist/es/constants.js

@@ -10,7 +10,3 @@ export const VERCEL_CALLBACK_PATH = `${INTERNAL_PATH_PREFIX}/vercel/callback`;
 export const BYPASS_HEADER = "x-vercel-protection-bypass";
 export const SET_BYPASS_COOKIE_HEADER = "x-vercel-set-bypass-cookie";
 export const DEFAULT_SESSION_TTL_SECONDS = 60 * 60 * 24 * 14; // 14 days
-/** Recommended Next.js matcher for full-site protection. */
-export const deploymentProtectionMatcher = [
-    "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?)$).*)",
-];

package/dist/es/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA2OvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA6OvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}

package/dist/es/handler.js

@@ -22,11 +22,13 @@ function htmlResponse(html, status = 401) {
         },
     });
 }
-function redirect(location, status = 302) {
+function redirect(request, location, status = 302) {
+    // Next.js middleware/proxy requires an absolute Location; relative values throw ERR_INVALID_URL.
+    const absoluteLocation = new URL(location, request.url).toString();
     return new Response(null, {
         status,
         headers: {
-            Location: location,
+            Location: absoluteLocation,
             "Cache-Control": "no-store",
         },
     });
@@ -55,7 +57,7 @@ async function handleBypass(request, config) {
     if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
         url.searchParams.delete(BYPASS_HEADER);
         url.searchParams.delete("x-vercel-set-bypass-cookie");
-        const response = redirect(url.pathname + url.search + url.hash);
+        const response = redirect(request, url.pathname + url.search + url.hash);
         const secure = isSecureRequest(request);
         if (setCookieMode || hadSetCookieQuery) {
             appendSetCookie(response, BYPASS_COOKIE_NAME, config.bypassSecret, {
@@ -101,7 +103,7 @@ async function handlePasswordPost(request, config) {
             showVercel: hasVercelAuth(config),
         }));
     }
-    const response = redirect(returnTo);
+    const response = redirect(request, returnTo);
     return attachSession(response, config, "password", username, isSecureRequest(request));
 }
 async function handleVercelAuthorize(request, config) {
@@ -149,7 +151,7 @@ async function handleVercelCallback(request, config) {
         }
         const user = await fetchVercelUserInfo(tokenData.access_token);
         const subject = user.preferred_username || user.email || user.sub || "vercel-user";
-        const response = redirect(returnTo);
+        const response = redirect(request, returnTo);
         clearOAuthCookies(response, secure);
         return attachSession(response, config, "vercel", subject, secure);
     }

package/dist/es/index.d.ts

@@ -1,4 +1,4 @@
-export { deploymentProtectionMatcher, INTERNAL_PATH_PREFIX, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH, } from "./constants";
+export { INTERNAL_PATH_PREFIX, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH } from "./constants";
 export { handleDeploymentProtection } from "./handler";
 export { withDeploymentProtection } from "./middleware";
 export { resolveConfig, hasPasswordAuth, hasVercelAuth, isProtectionActive } from "./config";

package/dist/es/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,YAAY,EACR,UAAU,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,cAAc,GACjB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,YAAY,EACR,UAAU,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,cAAc,GACjB,MAAM,SAAS,CAAC"}

package/dist/es/index.js

@@ -1,4 +1,4 @@
-export { deploymentProtectionMatcher, INTERNAL_PATH_PREFIX, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH, } from "./constants";
+export { INTERNAL_PATH_PREFIX, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH } from "./constants";
 export { handleDeploymentProtection } from "./handler";
 export { withDeploymentProtection } from "./middleware";
 export { resolveConfig, hasPasswordAuth, hasVercelAuth, isProtectionActive } from "./config";

package/dist/es/middleware.d.ts

@@ -1,25 +1,36 @@
 import { type NextRequest, NextResponse } from "next/server";
-import { deploymentProtectionMatcher } from "./constants";
 import type { DeploymentProtectionOptions } from "./types";
 type NextMiddleware = (request: NextRequest, event?: unknown) => Response | NextResponse | Promise<Response | NextResponse | undefined | void> | undefined | void;
 export type WithDeploymentProtectionArgs = [] | [DeploymentProtectionOptions] | [NextMiddleware] | [NextMiddleware, DeploymentProtectionOptions];
 /**
  * Next.js middleware / proxy wrapper.
  *
+ * Next.js only accepts a statically analyzable `config.matcher` in the local
+ * middleware/proxy file. Do not import a matcher from this package — paste the
+ * recommended pattern inline (see README).
+ *
  * @example middleware.ts (Next ≤15)
  * ```ts
- * import {withDeploymentProtection, deploymentProtectionMatcher} from "@becklyn/deployment-protection";
+ * import {withDeploymentProtection} from "@becklyn/deployment-protection";
  * export default withDeploymentProtection();
- * export const config = { matcher: deploymentProtectionMatcher };
+ * export const config = {
+ *   matcher: [
+ *     "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?)$).*)",
+ *   ],
+ * };
  * ```
  *
  * @example proxy.ts (Next 16+)
  * ```ts
- * import {withDeploymentProtection, deploymentProtectionMatcher} from "@becklyn/deployment-protection";
+ * import {withDeploymentProtection} from "@becklyn/deployment-protection";
  * export const proxy = withDeploymentProtection();
- * export const config = { matcher: deploymentProtectionMatcher };
+ * export const config = {
+ *   matcher: [
+ *     "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?)$).*)",
+ *   ],
+ * };
  * ```
  */
 export declare function withDeploymentProtection(...args: WithDeploymentProtectionArgs): (request: NextRequest, event?: unknown) => Promise<Response | NextResponse>;
-export { deploymentProtectionMatcher };
+export {};
 //# sourceMappingURL=middleware.d.ts.map

package/dist/es/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AAWpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CAmBtC;AAED,OAAO,EAAE,2BAA2B,EAAE,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D,KAAK,cAAc,GAAG,CAClB,OAAO,EAAE,WAAW,EACpB,KAAK,CAAC,EAAE,OAAO,KAEb,QAAQ,GACR,YAAY,GACZ,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GACnD,SAAS,GACT,IAAI,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAClC,EAAE,GACF,CAAC,2BAA2B,CAAC,GAC7B,CAAC,cAAc,CAAC,GAChB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AA8DpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,IAAI,EAAE,4BAA4B,IAgBtE,SAAS,WAAW,EACpB,QAAQ,OAAO,KAChB,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,CActC"}

package/dist/es/middleware.js

@@ -1,5 +1,4 @@
 import { NextResponse } from "next/server";
-import { deploymentProtectionMatcher } from "./constants";
 import { handleDeploymentProtection } from "./handler";
 function isOptions(value) {
     return (typeof value === "object" &&
@@ -7,21 +6,70 @@ function isOptions(value) {
         !Array.isArray(value) &&
         typeof value !== "function");
 }
+function toNextResponse(request, response) {
+    const location = response.headers.get("Location");
+    if (location && response.status >= 300 && response.status < 400) {
+        // Always resolve against the incoming request so relative Locations never reach Next.
+        const redirectResponse = NextResponse.redirect(new URL(location, request.url), response.status);
+        copyHeaders(response, redirectResponse, /* skipLocation */ true);
+        return redirectResponse;
+    }
+    const nextResponse = new NextResponse(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+    });
+    copyHeaders(response, nextResponse, false);
+    return nextResponse;
+}
+function copyHeaders(from, to, skipLocation) {
+    const setCookies = typeof from.headers.getSetCookie === "function" ? from.headers.getSetCookie() : [];
+    if (setCookies.length > 0) {
+        for (const cookie of setCookies) {
+            to.headers.append("Set-Cookie", cookie);
+        }
+    }
+    from.headers.forEach((value, key) => {
+        const lower = key.toLowerCase();
+        if (lower === "set-cookie") {
+            // Already copied via getSetCookie when available; fall back otherwise.
+            if (setCookies.length === 0) {
+                to.headers.append("Set-Cookie", value);
+            }
+            return;
+        }
+        if (skipLocation && lower === "location") {
+            return;
+        }
+        to.headers.set(key, value);
+    });
+}
 /**
  * Next.js middleware / proxy wrapper.
  *
+ * Next.js only accepts a statically analyzable `config.matcher` in the local
+ * middleware/proxy file. Do not import a matcher from this package — paste the
+ * recommended pattern inline (see README).
+ *
  * @example middleware.ts (Next ≤15)
  * ```ts
- * import {withDeploymentProtection, deploymentProtectionMatcher} from "@becklyn/deployment-protection";
+ * import {withDeploymentProtection} from "@becklyn/deployment-protection";
  * export default withDeploymentProtection();
- * export const config = { matcher: deploymentProtectionMatcher };
+ * export const config = {
+ *   matcher: [
+ *     "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?)$).*)",
+ *   ],
+ * };
  * ```
  *
  * @example proxy.ts (Next 16+)
  * ```ts
- * import {withDeploymentProtection, deploymentProtectionMatcher} from "@becklyn/deployment-protection";
+ * import {withDeploymentProtection} from "@becklyn/deployment-protection";
  * export const proxy = withDeploymentProtection();
- * export const config = { matcher: deploymentProtectionMatcher };
+ * export const config = {
+ *   matcher: [
+ *     "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?)$).*)",
+ *   ],
+ * };
  * ```
  */
 export function withDeploymentProtection(...args) {
@@ -42,12 +90,7 @@ export function withDeploymentProtection(...args) {
     return async function deploymentProtectionMiddleware(request, event) {
         const protectionResponse = await handleDeploymentProtection(request, options);
         if (protectionResponse) {
-            // Preserve NextResponse subclass when possible
-            return new NextResponse(protectionResponse.body, {
-                status: protectionResponse.status,
-                statusText: protectionResponse.statusText,
-                headers: protectionResponse.headers,
-            });
+            return toNextResponse(request, protectionResponse);
         }
         if (next) {
             const result = await next(request, event);
@@ -56,4 +99,3 @@ export function withDeploymentProtection(...args) {
         return NextResponse.next();
     };
 }
-export { deploymentProtectionMatcher };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@becklyn/deployment-protection",
-    "version": "0.0.1",
+    "version": "0.2.0",
     "license": "MIT",
     "description": "Simple shared username/password + Sign in with Vercel gate for Next.js deployments",
     "homepage": "https://github.com/Becklyn-Studios/ts-libs/tree/main/packages/deployment-protection",
@@ -18,10 +18,10 @@
     "devDependencies": {
         "@becklyn/eslint": "*",
         "@becklyn/tsconfig": "*",
-        "@types/node": "^26.2.0",
-        "next": "^16.3.1",
+        "@types/node": "^25.9.5",
+        "next": "^16.3.0",
         "typescript": "^5.9.3",
-        "vitest": "^4.1.11"
+        "vitest": "^3.2.4"
     },
     "peerDependencies": {
         "next": "^14.0.0 || ^15.0.0 || ^16.0.0"