@becklyn/deployment-protection 0.0.1

package/dist/cjs/vercel-oauth.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildVercelAuthorizeRedirect = buildVercelAuthorizeRedirect;
+exports.exchangeVercelCode = exchangeVercelCode;
+exports.fetchVercelUserInfo = fetchVercelUserInfo;
+exports.readCookie = readCookie;
+exports.assertOAuthState = assertOAuthState;
+exports.decodeIdTokenNonce = decodeIdTokenNonce;
+exports.clearOAuthCookies = clearOAuthCookies;
+exports.appendSetCookie = appendSetCookie;
+const constants_1 = require("./constants");
+const crypto_1 = require("./crypto");
+function cookieOptions(secure) {
+    return {
+        httpOnly: true,
+        sameSite: "lax",
+        secure,
+        path: "/",
+        maxAge: 10 * 60,
+    };
+}
+async function buildVercelAuthorizeRedirect(request, config, returnTo) {
+    if (!config.vercelClientId) {
+        return new Response("Vercel OAuth is not configured", { status: 500 });
+    }
+    const state = (0, crypto_1.randomToken)(32);
+    const nonce = (0, crypto_1.randomToken)(32);
+    const codeVerifier = (0, crypto_1.randomToken)(48);
+    const codeChallenge = await (0, crypto_1.sha256Base64Url)(codeVerifier);
+    const origin = new URL(request.url).origin;
+    const redirectUri = `${origin}${constants_1.VERCEL_CALLBACK_PATH}`;
+    const secure = origin.startsWith("https://");
+    const params = new URLSearchParams({
+        client_id: config.vercelClientId,
+        redirect_uri: redirectUri,
+        state,
+        nonce,
+        code_challenge: codeChallenge,
+        code_challenge_method: "S256",
+        response_type: "code",
+        scope: "openid email profile",
+    });
+    const response = new Response(null, {
+        status: 302,
+        headers: {
+            Location: `https://vercel.com/oauth/authorize?${params.toString()}`,
+        },
+    });
+    const opts = cookieOptions(secure);
+    appendSetCookie(response, constants_1.OAUTH_STATE_COOKIE, state, opts);
+    appendSetCookie(response, constants_1.OAUTH_NONCE_COOKIE, nonce, opts);
+    appendSetCookie(response, constants_1.OAUTH_VERIFIER_COOKIE, codeVerifier, opts);
+    appendSetCookie(response, constants_1.OAUTH_RETURN_COOKIE, returnTo || "/", opts);
+    return response;
+}
+async function exchangeVercelCode(request, config, code, codeVerifier) {
+    if (!config.vercelClientId || !config.vercelClientSecret) {
+        throw new Error("Vercel OAuth is not configured");
+    }
+    const origin = new URL(request.url).origin;
+    const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        client_id: config.vercelClientId,
+        client_secret: config.vercelClientSecret,
+        code,
+        code_verifier: codeVerifier,
+        redirect_uri: `${origin}${constants_1.VERCEL_CALLBACK_PATH}`,
+    });
+    const response = await fetch("https://api.vercel.com/login/oauth/token", {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body,
+    });
+    if (!response.ok) {
+        const errorText = await response.text();
+        throw new Error(`Token exchange failed: ${errorText}`);
+    }
+    return (await response.json());
+}
+async function fetchVercelUserInfo(accessToken) {
+    const response = await fetch("https://api.vercel.com/login/oauth/userinfo", {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+        },
+    });
+    if (!response.ok) {
+        throw new Error("Failed to load Vercel user info");
+    }
+    return (await response.json());
+}
+function readCookie(request, name) {
+    const cookieHeader = request.headers.get("cookie");
+    if (!cookieHeader) {
+        return null;
+    }
+    for (const part of cookieHeader.split(";")) {
+        const [rawName, ...rest] = part.trim().split("=");
+        if (rawName === name) {
+            return decodeURIComponent(rest.join("="));
+        }
+    }
+    return null;
+}
+async function assertOAuthState(request, state) {
+    const stored = readCookie(request, constants_1.OAUTH_STATE_COOKIE);
+    if (!state || !stored) {
+        return false;
+    }
+    return (0, crypto_1.timingSafeEqualString)(state, stored);
+}
+function decodeIdTokenNonce(idToken) {
+    if (!idToken) {
+        return null;
+    }
+    const parts = idToken.split(".");
+    const payload = parts[1];
+    if (!payload) {
+        return null;
+    }
+    try {
+        const padded = payload.replace(/-/g, "+").replace(/_/g, "/");
+        const padLength = (4 - (padded.length % 4)) % 4;
+        const json = atob(padded + "=".repeat(padLength));
+        const data = JSON.parse(json);
+        return data.nonce ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function clearOAuthCookies(response, secure) {
+    const expired = {
+        httpOnly: true,
+        sameSite: "lax",
+        secure,
+        path: "/",
+        maxAge: 0,
+    };
+    for (const name of [
+        constants_1.OAUTH_STATE_COOKIE,
+        constants_1.OAUTH_NONCE_COOKIE,
+        constants_1.OAUTH_VERIFIER_COOKIE,
+        constants_1.OAUTH_RETURN_COOKIE,
+    ]) {
+        appendSetCookie(response, name, "", expired);
+    }
+}
+function appendSetCookie(response, name, value, options) {
+    const parts = [`${name}=${encodeURIComponent(value)}`];
+    if (options.maxAge !== undefined) {
+        parts.push(`Max-Age=${options.maxAge}`);
+    }
+    parts.push(`Path=${options.path ?? "/"}`);
+    if (options.httpOnly) {
+        parts.push("HttpOnly");
+    }
+    if (options.secure) {
+        parts.push("Secure");
+    }
+    if (options.sameSite) {
+        parts.push(`SameSite=${options.sameSite === "none" ? "None" : options.sameSite[0].toUpperCase()}${options.sameSite.slice(1)}`);
+    }
+    response.headers.append("Set-Cookie", parts.join("; "));
+}

package/dist/es/bypass.d.ts

@@ -0,0 +1,5 @@
+export declare function readBypassToken(request: Request): string | null;
+export declare function readBypassCookie(request: Request): string | null;
+export declare function isValidBypass(provided: string | null | undefined, secret: string | null): Promise<boolean>;
+export declare function shouldSetBypassCookie(request: Request): boolean | "samesitenone";
+//# sourceMappingURL=bypass.d.ts.map

package/dist/es/bypass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bypass.d.ts","sourceRoot":"","sources":["../../src/bypass.ts"],"names":[],"mappings":"AAGA,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAe/D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAehE;AAED,wBAAsB,aAAa,CAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,MAAM,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,cAAc,CAehF"}

package/dist/es/bypass.js

@@ -0,0 +1,45 @@
+import { BYPASS_COOKIE_NAME, BYPASS_HEADER, SET_BYPASS_COOKIE_HEADER } from "./constants";
+import { timingSafeEqualString } from "./crypto";
+export function readBypassToken(request) {
+    const header = request.headers.get(BYPASS_HEADER)?.trim();
+    if (header) {
+        return header;
+    }
+    const url = new URL(request.url);
+    const query = url.searchParams.get(BYPASS_HEADER)?.trim();
+    if (query) {
+        return query;
+    }
+    return null;
+}
+export function readBypassCookie(request) {
+    const cookieHeader = request.headers.get("cookie");
+    if (!cookieHeader) {
+        return null;
+    }
+    for (const part of cookieHeader.split(";")) {
+        const [rawName, ...rest] = part.trim().split("=");
+        if (rawName === BYPASS_COOKIE_NAME) {
+            return decodeURIComponent(rest.join("="));
+        }
+    }
+    return null;
+}
+export async function isValidBypass(provided, secret) {
+    if (!provided || !secret) {
+        return false;
+    }
+    return timingSafeEqualString(provided, secret);
+}
+export function shouldSetBypassCookie(request) {
+    const url = new URL(request.url);
+    const value = request.headers.get(SET_BYPASS_COOKIE_HEADER) ??
+        url.searchParams.get(SET_BYPASS_COOKIE_HEADER);
+    if (!value) {
+        return false;
+    }
+    if (value.toLowerCase() === "samesitenone") {
+        return "samesitenone";
+    }
+    return value === "true" || value === "1";
+}

package/dist/es/config.d.ts

@@ -0,0 +1,13 @@
+import type { DeploymentProtectionConfig, DeploymentProtectionOptions } from "./types";
+/**
+ * Resolve runtime configuration from env (+ optional overrides).
+ */
+export declare function resolveConfig(options?: DeploymentProtectionOptions): DeploymentProtectionConfig;
+export declare function hasPasswordAuth(config: DeploymentProtectionConfig): boolean;
+export declare function hasVercelAuth(config: DeploymentProtectionConfig): boolean;
+/**
+ * Protection only runs when enabled and at least one auth method is configured.
+ * Misconfigured+enabled is treated as inactive (fail-open) so local/dev isn't bricked.
+ */
+export declare function isProtectionActive(config: DeploymentProtectionConfig): boolean;
+//# sourceMappingURL=config.d.ts.map

package/dist/es/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,2BAA2B,EAAU,MAAM,SAAS,CAAC;AA0B/F;;GAEG;AACH,wBAAgB,aAAa,CACzB,OAAO,GAAE,2BAAgC,GAC1C,0BAA0B,CA6C5B;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAE3E;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAEzE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAK9E"}

package/dist/es/config.js

@@ -0,0 +1,62 @@
+const FALSEY = new Set(["0", "false", "no", "off"]);
+function read(env, ...keys) {
+    for (const key of keys) {
+        const value = env[key]?.trim();
+        if (value) {
+            return value;
+        }
+    }
+    return null;
+}
+function isEnabled(env) {
+    const raw = read(env, "DEPLOYMENT_PROTECTION_ENABLED");
+    if (!raw) {
+        return true;
+    }
+    return !FALSEY.has(raw.toLowerCase());
+}
+/**
+ * Resolve runtime configuration from env (+ optional overrides).
+ */
+export function resolveConfig(options = {}) {
+    const env = {
+        ...(typeof process !== "undefined" ? process.env : {}),
+        ...options.env,
+    };
+    const username = read(env, "DEPLOYMENT_PROTECTION_USERNAME");
+    const password = read(env, "DEPLOYMENT_PROTECTION_PASSWORD");
+    const explicitSecret = read(env, "DEPLOYMENT_PROTECTION_SECRET");
+    // Prefer an explicit secret; otherwise derive a stable key from credentials so
+    // projects can stay zero-config beyond username/password.
+    const secret = explicitSecret ?? (username && password ? `dp:${username}:${password}` : null);
+    return {
+        enabled: isEnabled(env),
+        username,
+        password,
+        secret,
+        bypassSecret: read(env, "VERCEL_AUTOMATION_BYPASS_SECRET", "DEPLOYMENT_PROTECTION_BYPASS_SECRET"),
+        vercelClientId: read(env, "DEPLOYMENT_PROTECTION_VERCEL_CLIENT_ID", "NEXT_PUBLIC_VERCEL_APP_CLIENT_ID", "VERCEL_APP_CLIENT_ID"),
+        vercelClientSecret: read(env, "DEPLOYMENT_PROTECTION_VERCEL_CLIENT_SECRET", "VERCEL_APP_CLIENT_SECRET"),
+        sessionTtlSeconds: options.sessionTtlSeconds ?? 60 * 60 * 24 * 14,
+        formTitle: options.form?.title ??
+            read(env, "DEPLOYMENT_PROTECTION_FORM_TITLE") ??
+            "Authentication required",
+        formDescription: options.form?.description ??
+            read(env, "DEPLOYMENT_PROTECTION_FORM_DESCRIPTION") ??
+            "Enter the shared credentials to continue.",
+    };
+}
+export function hasPasswordAuth(config) {
+    return Boolean(config.username && config.password && config.secret);
+}
+export function hasVercelAuth(config) {
+    return Boolean(config.vercelClientId && config.vercelClientSecret && config.secret);
+}
+/**
+ * Protection only runs when enabled and at least one auth method is configured.
+ * Misconfigured+enabled is treated as inactive (fail-open) so local/dev isn't bricked.
+ */
+export function isProtectionActive(config) {
+    return (config.enabled &&
+        (hasPasswordAuth(config) || hasVercelAuth(config) || Boolean(config.bypassSecret)));
+}

package/dist/es/constants.d.ts

@@ -0,0 +1,15 @@
+export declare const SESSION_COOKIE_NAME = "__becklyn_dp_session";
+export declare const BYPASS_COOKIE_NAME = "__becklyn_dp_bypass";
+export declare const OAUTH_STATE_COOKIE = "__becklyn_dp_oauth_state";
+export declare const OAUTH_NONCE_COOKIE = "__becklyn_dp_oauth_nonce";
+export declare const OAUTH_VERIFIER_COOKIE = "__becklyn_dp_oauth_verifier";
+export declare const OAUTH_RETURN_COOKIE = "__becklyn_dp_oauth_return";
+export declare const INTERNAL_PATH_PREFIX = "/_becklyn/deployment-protection";
+export declare const VERCEL_AUTHORIZE_PATH = "/_becklyn/deployment-protection/vercel";
+export declare const VERCEL_CALLBACK_PATH = "/_becklyn/deployment-protection/vercel/callback";
+export declare const BYPASS_HEADER = "x-vercel-protection-bypass";
+export declare const SET_BYPASS_COOKIE_HEADER = "x-vercel-set-bypass-cookie";
+export declare const DEFAULT_SESSION_TTL_SECONDS: number;
+/** Recommended Next.js matcher for full-site protection. */
+export declare const deploymentProtectionMatcher: string[];
+//# sourceMappingURL=constants.d.ts.map

package/dist/es/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AACxD,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAC7D,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAC7D,eAAO,MAAM,qBAAqB,gCAAgC,CAAC;AACnE,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AACtE,eAAO,MAAM,qBAAqB,2CAAmC,CAAC;AACtE,eAAO,MAAM,oBAAoB,oDAA4C,CAAC;AAE9E,eAAO,MAAM,aAAa,+BAA+B,CAAC;AAC1D,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AAErE,eAAO,MAAM,2BAA2B,QAAoB,CAAC;AAE7D,4DAA4D;AAC5D,eAAO,MAAM,2BAA2B,UAEvC,CAAC"}

package/dist/es/constants.js

@@ -0,0 +1,16 @@
+export const SESSION_COOKIE_NAME = "__becklyn_dp_session";
+export const BYPASS_COOKIE_NAME = "__becklyn_dp_bypass";
+export const OAUTH_STATE_COOKIE = "__becklyn_dp_oauth_state";
+export const OAUTH_NONCE_COOKIE = "__becklyn_dp_oauth_nonce";
+export const OAUTH_VERIFIER_COOKIE = "__becklyn_dp_oauth_verifier";
+export const OAUTH_RETURN_COOKIE = "__becklyn_dp_oauth_return";
+export const INTERNAL_PATH_PREFIX = "/_becklyn/deployment-protection";
+export const VERCEL_AUTHORIZE_PATH = `${INTERNAL_PATH_PREFIX}/vercel`;
+export const VERCEL_CALLBACK_PATH = `${INTERNAL_PATH_PREFIX}/vercel/callback`;
+export const BYPASS_HEADER = "x-vercel-protection-bypass";
+export const SET_BYPASS_COOKIE_HEADER = "x-vercel-set-bypass-cookie";
+export const DEFAULT_SESSION_TTL_SECONDS = 60 * 60 * 24 * 14; // 14 days
+/** Recommended Next.js matcher for full-site protection. */
+export const deploymentProtectionMatcher = [
+    "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?)$).*)",
+];

package/dist/es/crypto.d.ts

@@ -0,0 +1,7 @@
+export declare function bytesToBase64Url(bytes: ArrayBuffer | Uint8Array): string;
+export declare function base64UrlToBytes(value: string): Uint8Array;
+export declare function sha256Base64Url(value: string): Promise<string>;
+export declare function hmacSign(secret: string, payload: string): Promise<string>;
+export declare function timingSafeEqualString(a: string, b: string): Promise<boolean>;
+export declare function randomToken(byteLength?: number): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/es/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/crypto.ts"],"names":[],"mappings":"AAEA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CASxE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAY1D;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGpE;AAED,wBAAsB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAU/E;AAED,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBlF;AAED,wBAAgB,WAAW,CAAC,UAAU,SAAK,GAAG,MAAM,CAInD"}

package/dist/es/crypto.js

@@ -0,0 +1,48 @@
+const textEncoder = new TextEncoder();
+export function bytesToBase64Url(bytes) {
+    const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    let binary = "";
+    for (const byte of view) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+export function base64UrlToBytes(value) {
+    const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+    const padLength = (4 - (padded.length % 4)) % 4;
+    const base64 = padded + "=".repeat(padLength);
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+export async function sha256Base64Url(value) {
+    const digest = await crypto.subtle.digest("SHA-256", textEncoder.encode(value));
+    return bytesToBase64Url(digest);
+}
+export async function hmacSign(secret, payload) {
+    const key = await crypto.subtle.importKey("raw", textEncoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const signature = await crypto.subtle.sign("HMAC", key, textEncoder.encode(payload));
+    return bytesToBase64Url(signature);
+}
+export async function timingSafeEqualString(a, b) {
+    const aBytes = textEncoder.encode(a);
+    const bBytes = textEncoder.encode(b);
+    if (aBytes.length !== bBytes.length) {
+        // Compare against itself to keep runtime roughly constant on length mismatch.
+        await crypto.subtle.digest("SHA-256", aBytes);
+        return false;
+    }
+    let mismatch = 0;
+    for (let i = 0; i < aBytes.length; i++) {
+        mismatch |= (aBytes[i] ?? 0) ^ (bBytes[i] ?? 0);
+    }
+    return mismatch === 0;
+}
+export function randomToken(byteLength = 32) {
+    const bytes = new Uint8Array(byteLength);
+    crypto.getRandomValues(bytes);
+    return bytesToBase64Url(bytes);
+}

package/dist/es/handler.d.ts

@@ -0,0 +1,6 @@
+import type { DeploymentProtectionOptions } from "./types";
+/**
+ * Core request handler. Returns `null` when the request may continue to the app.
+ */
+export declare function handleDeploymentProtection(request: Request, options?: DeploymentProtectionOptions): Promise<Response | null>;
+//# sourceMappingURL=handler.d.ts.map

package/dist/es/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/handler.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAA8B,2BAA2B,EAAE,MAAM,SAAS,CAAC;AA2OvF;;GAEG;AACH,wBAAsB,0BAA0B,CAC5C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,2BAAgC,GAC1C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqD1B"}

package/dist/es/handler.js

@@ -0,0 +1,209 @@
+import { isValidBypass, readBypassCookie, readBypassToken, shouldSetBypassCookie } from "./bypass";
+import { hasPasswordAuth, hasVercelAuth, isProtectionActive, resolveConfig } from "./config";
+import { BYPASS_COOKIE_NAME, BYPASS_HEADER, OAUTH_NONCE_COOKIE, OAUTH_RETURN_COOKIE, OAUTH_VERIFIER_COOKIE, SESSION_COOKIE_NAME, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH, } from "./constants";
+import { timingSafeEqualString } from "./crypto";
+import { renderLoginPage } from "./login-page";
+import { validatePasswordCredentials } from "./password";
+import { safeReturnTo } from "./safe-return-to";
+import { createSessionToken, sessionCookieOptions, verifySessionToken } from "./session";
+import { appendSetCookie, assertOAuthState, buildVercelAuthorizeRedirect, clearOAuthCookies, decodeIdTokenNonce, exchangeVercelCode, fetchVercelUserInfo, readCookie, } from "./vercel-oauth";
+function isSecureRequest(request) {
+    return new URL(request.url).protocol === "https:";
+}
+function getPathname(request) {
+    return new URL(request.url).pathname;
+}
+function htmlResponse(html, status = 401) {
+    return new Response(html, {
+        status,
+        headers: {
+            "Content-Type": "text/html; charset=utf-8",
+            "Cache-Control": "no-store",
+        },
+    });
+}
+function redirect(location, status = 302) {
+    return new Response(null, {
+        status,
+        headers: {
+            Location: location,
+            "Cache-Control": "no-store",
+        },
+    });
+}
+async function attachSession(response, config, method, subject, secure) {
+    if (!config.secret) {
+        return response;
+    }
+    const token = await createSessionToken(config.secret, method, subject, config.sessionTtlSeconds);
+    const opts = sessionCookieOptions(config.sessionTtlSeconds, secure);
+    appendSetCookie(response, SESSION_COOKIE_NAME, token, opts);
+    return response;
+}
+async function handleBypass(request, config) {
+    if (!config.bypassSecret) {
+        return { kind: "miss" };
+    }
+    const token = readBypassToken(request) ?? readBypassCookie(request);
+    if (!(await isValidBypass(token, config.bypassSecret))) {
+        return { kind: "miss" };
+    }
+    const setCookieMode = shouldSetBypassCookie(request);
+    const url = new URL(request.url);
+    const hadQueryBypass = url.searchParams.has(BYPASS_HEADER);
+    const hadSetCookieQuery = url.searchParams.has("x-vercel-set-bypass-cookie");
+    if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
+        url.searchParams.delete(BYPASS_HEADER);
+        url.searchParams.delete("x-vercel-set-bypass-cookie");
+        const response = redirect(url.pathname + url.search + url.hash);
+        const secure = isSecureRequest(request);
+        if (setCookieMode || hadSetCookieQuery) {
+            appendSetCookie(response, BYPASS_COOKIE_NAME, config.bypassSecret, {
+                httpOnly: true,
+                secure,
+                path: "/",
+                maxAge: config.sessionTtlSeconds,
+                sameSite: setCookieMode === "samesitenone" ? "none" : "lax",
+            });
+        }
+        await attachSession(response, config, "bypass", "automation", secure);
+        return { kind: "respond", response };
+    }
+    return { kind: "allow" };
+}
+async function handlePasswordPost(request, config) {
+    if (request.method !== "POST" || !hasPasswordAuth(config)) {
+        return null;
+    }
+    const contentType = request.headers.get("content-type") ?? "";
+    if (!contentType.includes("application/x-www-form-urlencoded") &&
+        !contentType.includes("multipart/form-data")) {
+        return null;
+    }
+    let form;
+    try {
+        form = await request.formData();
+    }
+    catch {
+        return null;
+    }
+    if (form.get("__becklyn_dp") !== "1") {
+        return null;
+    }
+    const username = String(form.get("username") ?? "");
+    const password = String(form.get("password") ?? "");
+    const returnTo = safeReturnTo(String(form.get("return_to") ?? getPathname(request)));
+    if (!(await validatePasswordCredentials(config, username, password))) {
+        return htmlResponse(renderLoginPage(config, {
+            error: "Invalid username or password.",
+            returnTo,
+            showPassword: true,
+            showVercel: hasVercelAuth(config),
+        }));
+    }
+    const response = redirect(returnTo);
+    return attachSession(response, config, "password", username, isSecureRequest(request));
+}
+async function handleVercelAuthorize(request, config) {
+    if (getPathname(request) !== VERCEL_AUTHORIZE_PATH) {
+        return null;
+    }
+    if (!hasVercelAuth(config)) {
+        return new Response("Sign in with Vercel is not configured", { status: 500 });
+    }
+    const returnTo = safeReturnTo(new URL(request.url).searchParams.get("return_to"));
+    return buildVercelAuthorizeRedirect(request, config, returnTo);
+}
+async function handleVercelCallback(request, config) {
+    if (getPathname(request) !== VERCEL_CALLBACK_PATH) {
+        return null;
+    }
+    if (!hasVercelAuth(config) || !config.secret) {
+        return new Response("Sign in with Vercel is not configured", { status: 500 });
+    }
+    const url = new URL(request.url);
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    const secure = isSecureRequest(request);
+    const returnTo = safeReturnTo(readCookie(request, OAUTH_RETURN_COOKIE));
+    if (!code || !(await assertOAuthState(request, state))) {
+        const response = htmlResponse(renderLoginPage(config, {
+            error: "Vercel sign-in failed (invalid state).",
+            returnTo,
+            showPassword: hasPasswordAuth(config),
+            showVercel: true,
+        }));
+        clearOAuthCookies(response, secure);
+        return response;
+    }
+    try {
+        const codeVerifier = readCookie(request, OAUTH_VERIFIER_COOKIE);
+        if (!codeVerifier) {
+            throw new Error("Missing PKCE verifier");
+        }
+        const tokenData = await exchangeVercelCode(request, config, code, codeVerifier);
+        const storedNonce = readCookie(request, OAUTH_NONCE_COOKIE);
+        const tokenNonce = decodeIdTokenNonce(tokenData.id_token);
+        if (storedNonce && tokenNonce && !(await timingSafeEqualString(storedNonce, tokenNonce))) {
+            throw new Error("Nonce mismatch");
+        }
+        const user = await fetchVercelUserInfo(tokenData.access_token);
+        const subject = user.preferred_username || user.email || user.sub || "vercel-user";
+        const response = redirect(returnTo);
+        clearOAuthCookies(response, secure);
+        return attachSession(response, config, "vercel", subject, secure);
+    }
+    catch {
+        const response = htmlResponse(renderLoginPage(config, {
+            error: "Vercel sign-in failed.",
+            returnTo,
+            showPassword: hasPasswordAuth(config),
+            showVercel: true,
+        }));
+        clearOAuthCookies(response, secure);
+        return response;
+    }
+}
+/**
+ * Core request handler. Returns `null` when the request may continue to the app.
+ */
+export async function handleDeploymentProtection(request, options = {}) {
+    const config = resolveConfig(options);
+    if (!isProtectionActive(config)) {
+        return null;
+    }
+    const vercelAuthorize = await handleVercelAuthorize(request, config);
+    if (vercelAuthorize) {
+        return vercelAuthorize;
+    }
+    const vercelCallback = await handleVercelCallback(request, config);
+    if (vercelCallback) {
+        return vercelCallback;
+    }
+    const passwordResponse = await handlePasswordPost(request, config);
+    if (passwordResponse) {
+        return passwordResponse;
+    }
+    const bypass = await handleBypass(request, config);
+    if (bypass.kind === "respond") {
+        return bypass.response;
+    }
+    if (bypass.kind === "allow") {
+        return null;
+    }
+    if (config.secret) {
+        const session = await verifySessionToken(config.secret, readCookie(request, SESSION_COOKIE_NAME));
+        if (session) {
+            return null;
+        }
+    }
+    if (!hasPasswordAuth(config) && !hasVercelAuth(config)) {
+        return new Response("Unauthorized", { status: 401 });
+    }
+    const returnTo = safeReturnTo(getPathname(request) + new URL(request.url).search);
+    return htmlResponse(renderLoginPage(config, {
+        returnTo,
+        showPassword: hasPasswordAuth(config),
+        showVercel: hasVercelAuth(config),
+    }));
+}

package/dist/es/index.d.ts

@@ -0,0 +1,6 @@
+export { deploymentProtectionMatcher, INTERNAL_PATH_PREFIX, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH, } from "./constants";
+export { handleDeploymentProtection } from "./handler";
+export { withDeploymentProtection } from "./middleware";
+export { resolveConfig, hasPasswordAuth, hasVercelAuth, isProtectionActive } from "./config";
+export type { AuthMethod, DeploymentProtectionConfig, DeploymentProtectionOptions, FormOptions, SessionPayload, } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/es/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,YAAY,EACR,UAAU,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,cAAc,GACjB,MAAM,SAAS,CAAC"}

package/dist/es/index.js

@@ -0,0 +1,4 @@
+export { deploymentProtectionMatcher, INTERNAL_PATH_PREFIX, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH, } from "./constants";
+export { handleDeploymentProtection } from "./handler";
+export { withDeploymentProtection } from "./middleware";
+export { resolveConfig, hasPasswordAuth, hasVercelAuth, isProtectionActive } from "./config";

package/dist/es/login-page.d.ts

@@ -0,0 +1,8 @@
+import type { DeploymentProtectionConfig } from "./types";
+export declare function renderLoginPage(config: DeploymentProtectionConfig, options?: {
+    error?: string | null;
+    returnTo?: string;
+    showPassword?: boolean;
+    showVercel?: boolean;
+}): string;
+//# sourceMappingURL=login-page.d.ts.map

package/dist/es/login-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-page.d.ts","sourceRoot":"","sources":["../../src/login-page.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAW1D,wBAAgB,eAAe,CAC3B,MAAM,EAAE,0BAA0B,EAClC,OAAO,GAAE;IACL,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;CACnB,GACP,MAAM,CAsKR"}