@becklyn/deployment-protection 0.4.0 → 0.4.2

package/dist/edge.mjs

@@ -0,0 +1,971 @@
+// src/constants.ts
+var SESSION_COOKIE_NAME = "__becklyn_dp_session";
+var BYPASS_COOKIE_NAME = "__becklyn_dp_bypass";
+var OAUTH_STATE_COOKIE = "__becklyn_dp_oauth_state";
+var OAUTH_NONCE_COOKIE = "__becklyn_dp_oauth_nonce";
+var OAUTH_VERIFIER_COOKIE = "__becklyn_dp_oauth_verifier";
+var OAUTH_RETURN_COOKIE = "__becklyn_dp_oauth_return";
+var OAUTH_RETURN_ORIGIN_COOKIE = "__becklyn_dp_oauth_return_origin";
+var INTERNAL_PATH_PREFIX = "/_becklyn/deployment-protection";
+var VERCEL_AUTHORIZE_PATH = `${INTERNAL_PATH_PREFIX}/vercel`;
+var VERCEL_CALLBACK_PATH = `${INTERNAL_PATH_PREFIX}/vercel/callback`;
+var BYPASS_HEADER = "x-vercel-protection-bypass";
+var SET_BYPASS_COOKIE_HEADER = "x-vercel-set-bypass-cookie";
+var DEFAULT_SESSION_TTL_SECONDS = 60 * 60 * 24 * 14;
+
+// src/crypto.ts
+var textEncoder = new TextEncoder();
+function bytesToBase64Url(bytes) {
+  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let binary = "";
+  for (const byte of view) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64UrlToBytes(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padLength = (4 - padded.length % 4) % 4;
+  const base64 = padded + "=".repeat(padLength);
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+async function sha256Base64Url(value) {
+  const digest = await crypto.subtle.digest("SHA-256", textEncoder.encode(value));
+  return bytesToBase64Url(digest);
+}
+async function hmacSign(secret, payload) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    textEncoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign("HMAC", key, textEncoder.encode(payload));
+  return bytesToBase64Url(signature);
+}
+async function timingSafeEqualString(a, b) {
+  const aBytes = textEncoder.encode(a);
+  const bBytes = textEncoder.encode(b);
+  if (aBytes.length !== bBytes.length) {
+    await crypto.subtle.digest("SHA-256", aBytes);
+    return false;
+  }
+  let mismatch = 0;
+  for (let i = 0; i < aBytes.length; i++) {
+    mismatch |= (aBytes[i] ?? 0) ^ (bBytes[i] ?? 0);
+  }
+  return mismatch === 0;
+}
+function randomToken(byteLength = 32) {
+  const bytes = new Uint8Array(byteLength);
+  crypto.getRandomValues(bytes);
+  return bytesToBase64Url(bytes);
+}
+
+// src/bypass.ts
+function readBypassToken(request) {
+  const header = request.headers.get(BYPASS_HEADER)?.trim();
+  if (header) {
+    return header;
+  }
+  const url = new URL(request.url);
+  const query = url.searchParams.get(BYPASS_HEADER)?.trim();
+  if (query) {
+    return query;
+  }
+  return null;
+}
+function readBypassCookie(request) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [rawName, ...rest] = part.trim().split("=");
+    if (rawName === BYPASS_COOKIE_NAME) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+async function isValidBypass(provided, secret) {
+  if (!provided || !secret) {
+    return false;
+  }
+  return timingSafeEqualString(provided, secret);
+}
+function shouldSetBypassCookie(request) {
+  const url = new URL(request.url);
+  const value = request.headers.get(SET_BYPASS_COOKIE_HEADER) ?? url.searchParams.get(SET_BYPASS_COOKIE_HEADER);
+  if (!value) {
+    return false;
+  }
+  if (value.toLowerCase() === "samesitenone") {
+    return "samesitenone";
+  }
+  return value === "true" || value === "1";
+}
+
+// src/safe-return-to.ts
+function hasUnsafeCharacters(value) {
+  for (let i = 0; i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (code <= 31 || code === 127 || /\s/.test(value[i])) {
+      return true;
+    }
+  }
+  return false;
+}
+function safeReturnTo(value, fallback = "/") {
+  if (typeof value !== "string" || value.length === 0 || value.length > 2048) {
+    return fallback;
+  }
+  if (!value.startsWith("/") || value.startsWith("//") || value.includes("\\") || hasUnsafeCharacters(value) || /%5c/i.test(value) || // encoded backslash
+  /%00/i.test(value)) {
+    return fallback;
+  }
+  let decoded;
+  try {
+    decoded = decodeURIComponent(value);
+  } catch {
+    return fallback;
+  }
+  if (!decoded.startsWith("/") || decoded.startsWith("//") || decoded.includes("\\") || hasUnsafeCharacters(decoded)) {
+    return fallback;
+  }
+  try {
+    const base = "https://safe.invalid";
+    const url = new URL(decoded, base);
+    if (url.origin !== base || url.username || url.password) {
+      return fallback;
+    }
+    const sanitized = `${url.pathname}${url.search}${url.hash}`;
+    return sanitized.startsWith("/") && !sanitized.startsWith("//") ? sanitized : fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+// src/handoff.ts
+var PROXY_START_TTL_SECONDS = 5 * 60;
+function decodeJson(encoded) {
+  try {
+    const json = new TextDecoder().decode(base64UrlToBytes(encoded));
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+function canonicalProxyStartPayload(params) {
+  return `v1
+${params.returnOrigin}
+${params.returnPath}
+${params.exp}
+${params.nonce}`;
+}
+async function signProxyStart(secret, params) {
+  return hmacSign(secret, canonicalProxyStartPayload(params));
+}
+async function buildProxyStartUrl(options) {
+  const returnPath = safeReturnTo(options.returnPath);
+  const params = {
+    returnOrigin: options.returnOrigin.replace(/\/$/, ""),
+    returnPath,
+    exp: Math.floor(Date.now() / 1e3) + (options.ttlSeconds ?? PROXY_START_TTL_SECONDS),
+    nonce: randomToken(16)
+  };
+  const sig = await signProxyStart(options.secret, params);
+  const url = new URL("/start", ensureTrailingSlashBase(options.authProxyUrl));
+  url.searchParams.set("return_origin", params.returnOrigin);
+  url.searchParams.set("return_path", params.returnPath);
+  url.searchParams.set("exp", String(params.exp));
+  url.searchParams.set("nonce", params.nonce);
+  url.searchParams.set("sig", sig);
+  return url.toString();
+}
+function ensureTrailingSlashBase(value) {
+  try {
+    const url = new URL(value);
+    return url.toString().endsWith("/") ? url.toString() : `${url.toString()}/`;
+  } catch {
+    return value.endsWith("/") ? value : `${value}/`;
+  }
+}
+async function verifyHandoffToken(secret, token, expectedAudienceOrigin) {
+  if (!token) {
+    return null;
+  }
+  const [body, signature] = token.split(".");
+  if (!body || !signature) {
+    return null;
+  }
+  const expected = await hmacSign(secret, body);
+  if (!await timingSafeEqualString(signature, expected)) {
+    return null;
+  }
+  const payload = decodeJson(body);
+  if (!payload || typeof payload.exp !== "number" || typeof payload.aud !== "string" || typeof payload.subject !== "string" || payload.method !== "vercel") {
+    return null;
+  }
+  if (payload.exp < Math.floor(Date.now() / 1e3)) {
+    return null;
+  }
+  const expectedAud = expectedAudienceOrigin.replace(/\/$/, "");
+  if (!await timingSafeEqualString(payload.aud, expectedAud)) {
+    return null;
+  }
+  return payload;
+}
+function parseAllowlist(value) {
+  if (!value) {
+    return [];
+  }
+  return value.split(",").map((part) => part.trim()).filter(Boolean);
+}
+
+// src/config.ts
+var FALSEY = /* @__PURE__ */ new Set(["0", "false", "no", "off"]);
+function read(env, ...keys) {
+  for (const key of keys) {
+    const value = env[key]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  return null;
+}
+function isEnabled(env) {
+  const raw = read(env, "DEPLOYMENT_PROTECTION_ENABLED");
+  if (!raw) {
+    return true;
+  }
+  return !FALSEY.has(raw.toLowerCase());
+}
+function resolveConfig(options = {}) {
+  const env = {
+    ...typeof process !== "undefined" ? process.env : {},
+    ...options.env
+  };
+  const username = read(env, "DEPLOYMENT_PROTECTION_USERNAME");
+  const password = read(env, "DEPLOYMENT_PROTECTION_PASSWORD");
+  const explicitSecret = read(env, "DEPLOYMENT_PROTECTION_SECRET");
+  const secret = explicitSecret ?? (username && password ? `dp:${username}:${password}` : null);
+  const handoffSecret = read(env, "DEPLOYMENT_PROTECTION_HANDOFF_SECRET") ?? explicitSecret ?? secret;
+  const authProxyUrl = read(env, "DEPLOYMENT_PROTECTION_AUTH_PROXY_URL")?.replace(/\/$/, "") ?? null;
+  return {
+    enabled: isEnabled(env),
+    username,
+    password,
+    secret,
+    handoffSecret,
+    bypassSecret: read(
+      env,
+      "VERCEL_AUTOMATION_BYPASS_SECRET",
+      "DEPLOYMENT_PROTECTION_BYPASS_SECRET"
+    ),
+    authProxyUrl,
+    allowedReturnOrigins: parseAllowlist(
+      read(
+        env,
+        "DEPLOYMENT_PROTECTION_ALLOWED_ORIGINS",
+        "DEPLOYMENT_PROTECTION_AUTH_PROXY_ALLOWED_ORIGINS"
+      )
+    ),
+    vercelClientId: read(
+      env,
+      "DEPLOYMENT_PROTECTION_VERCEL_CLIENT_ID",
+      "NEXT_PUBLIC_VERCEL_APP_CLIENT_ID",
+      "VERCEL_APP_CLIENT_ID"
+    ),
+    vercelClientSecret: read(
+      env,
+      "DEPLOYMENT_PROTECTION_VERCEL_CLIENT_SECRET",
+      "VERCEL_APP_CLIENT_SECRET"
+    ),
+    sessionTtlSeconds: options.sessionTtlSeconds ?? 60 * 60 * 24 * 14,
+    formTitle: options.form?.title ?? read(env, "DEPLOYMENT_PROTECTION_FORM_TITLE") ?? "Authentication required",
+    formDescription: options.form?.description ?? read(env, "DEPLOYMENT_PROTECTION_FORM_DESCRIPTION") ?? "Enter the shared credentials to continue."
+  };
+}
+function hasPasswordAuth(config) {
+  return Boolean(config.username && config.password && config.secret);
+}
+function hasVercelDirectAuth(config) {
+  return Boolean(config.vercelClientId && config.vercelClientSecret && config.secret);
+}
+function hasVercelProxyAuth(config) {
+  return Boolean(config.authProxyUrl && config.handoffSecret && config.secret);
+}
+function hasVercelAuth(config) {
+  return hasVercelDirectAuth(config) || hasVercelProxyAuth(config);
+}
+function isProtectionActive(config) {
+  return config.enabled && (hasPasswordAuth(config) || hasVercelAuth(config) || Boolean(config.bypassSecret));
+}
+
+// src/login-page.ts
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function renderLoginPage(config, options = {}) {
+  const returnTo = options.returnTo ?? "/";
+  const showPassword = options.showPassword ?? true;
+  const showVercel = options.showVercel ?? false;
+  const error = options.error ? `<p class="error">${escapeHtml(options.error)}</p>` : "";
+  const vercelButton = showVercel ? `<a class="secondary" href="${VERCEL_AUTHORIZE_PATH}?return_to=${encodeURIComponent(returnTo)}">Sign in with Vercel</a>` : "";
+  const passwordForm = showPassword ? `
+      <form method="post" action="${escapeHtml(returnTo)}">
+        <input type="hidden" name="__becklyn_dp" value="1" />
+        <input type="hidden" name="return_to" value="${escapeHtml(returnTo)}" />
+        <label>
+          Username
+          <input name="username" type="text" autocomplete="username" required autofocus />
+        </label>
+        <label>
+          Password
+          <input name="password" type="password" autocomplete="current-password" required />
+        </label>
+        <button type="submit">Continue</button>
+      </form>` : "";
+  const divider = showPassword && showVercel ? `<div class="divider"><span>or</span></div>` : "";
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${escapeHtml(config.formTitle)}</title>
+  <style>
+    :root {
+      color-scheme: light dark;
+      --bg: #0b0f19;
+      --card: #121826;
+      --text: #e8eefc;
+      --muted: #9aa8c7;
+      --accent: #3b82f6;
+      --border: #243044;
+      --error: #f87171;
+    }
+    @media (prefers-color-scheme: light) {
+      :root {
+        --bg: #f4f7fb;
+        --card: #ffffff;
+        --text: #0f172a;
+        --muted: #64748b;
+        --border: #e2e8f0;
+      }
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: grid;
+      place-items: center;
+      font-family: ui-sans-serif, system-ui, -apple-system, Segoe UI, sans-serif;
+      background:
+        radial-gradient(1200px 600px at 10% -10%, rgba(59,130,246,.25), transparent 60%),
+        radial-gradient(900px 500px at 100% 0%, rgba(14,165,233,.18), transparent 55%),
+        var(--bg);
+      color: var(--text);
+      padding: 24px;
+    }
+    .card {
+      width: min(100%, 420px);
+      background: color-mix(in srgb, var(--card) 92%, transparent);
+      border: 1px solid var(--border);
+      border-radius: 16px;
+      padding: 28px;
+      box-shadow: 0 20px 50px rgba(0,0,0,.25);
+      backdrop-filter: blur(8px);
+    }
+    h1 {
+      margin: 0 0 8px;
+      font-size: 1.35rem;
+      letter-spacing: -0.02em;
+    }
+    p {
+      margin: 0 0 20px;
+      color: var(--muted);
+      line-height: 1.5;
+      font-size: .95rem;
+    }
+    form { display: grid; gap: 14px; }
+    label {
+      display: grid;
+      gap: 6px;
+      font-size: .85rem;
+      color: var(--muted);
+    }
+    input {
+      width: 100%;
+      border: 1px solid var(--border);
+      border-radius: 10px;
+      padding: 12px 14px;
+      font: inherit;
+      color: var(--text);
+      background: transparent;
+    }
+    input:focus {
+      outline: 2px solid color-mix(in srgb, var(--accent) 55%, transparent);
+      border-color: var(--accent);
+    }
+    button, .secondary {
+      appearance: none;
+      border: 0;
+      border-radius: 10px;
+      padding: 12px 14px;
+      font: inherit;
+      font-weight: 600;
+      cursor: pointer;
+      text-align: center;
+      text-decoration: none;
+    }
+    button {
+      background: var(--accent);
+      color: white;
+    }
+    .secondary {
+      display: block;
+      background: transparent;
+      color: var(--text);
+      border: 1px solid var(--border);
+    }
+    .divider {
+      display: grid;
+      grid-template-columns: 1fr auto 1fr;
+      gap: 12px;
+      align-items: center;
+      margin: 18px 0;
+      color: var(--muted);
+      font-size: .8rem;
+      text-transform: uppercase;
+      letter-spacing: .08em;
+    }
+    .divider::before, .divider::after {
+      content: "";
+      height: 1px;
+      background: var(--border);
+    }
+    .error {
+      color: var(--error);
+      background: color-mix(in srgb, var(--error) 12%, transparent);
+      border: 1px solid color-mix(in srgb, var(--error) 35%, transparent);
+      border-radius: 10px;
+      padding: 10px 12px;
+      margin: 0 0 16px;
+    }
+  </style>
+</head>
+<body>
+  <main class="card">
+    <h1>${escapeHtml(config.formTitle)}</h1>
+    <p>${escapeHtml(config.formDescription)}</p>
+    ${error}
+    ${passwordForm}
+    ${divider}
+    ${vercelButton}
+  </main>
+</body>
+</html>`;
+}
+
+// src/password.ts
+async function validatePasswordCredentials(config, username, password) {
+  if (!config.username || !config.password) {
+    return false;
+  }
+  const userOk = await timingSafeEqualString(username, config.username);
+  const passOk = await timingSafeEqualString(password, config.password);
+  return userOk && passOk;
+}
+
+// src/session.ts
+function encodePayload(payload) {
+  return bytesToBase64Url(new TextEncoder().encode(JSON.stringify(payload)));
+}
+function decodePayload(encoded) {
+  try {
+    const json = new TextDecoder().decode(base64UrlToBytes(encoded));
+    const parsed = JSON.parse(json);
+    if (typeof parsed.exp !== "number" || typeof parsed.method !== "string" || typeof parsed.subject !== "string") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+async function createSessionToken(secret, method, subject, ttlSeconds) {
+  const payload = {
+    exp: Math.floor(Date.now() / 1e3) + ttlSeconds,
+    method,
+    subject
+  };
+  const body = encodePayload(payload);
+  const signature = await hmacSign(secret, body);
+  return `${body}.${signature}`;
+}
+async function verifySessionToken(secret, token) {
+  if (!token) {
+    return null;
+  }
+  const [body, signature] = token.split(".");
+  if (!body || !signature) {
+    return null;
+  }
+  const expected = await hmacSign(secret, body);
+  if (!await timingSafeEqualString(signature, expected)) {
+    return null;
+  }
+  const payload = decodePayload(body);
+  if (!payload) {
+    return null;
+  }
+  if (payload.exp < Math.floor(Date.now() / 1e3)) {
+    return null;
+  }
+  return payload;
+}
+function sessionCookieOptions(maxAge, secure) {
+  return {
+    httpOnly: true,
+    sameSite: "lax",
+    secure,
+    path: "/",
+    maxAge
+  };
+}
+
+// src/vercel-oauth.ts
+function cookieOptions(secure) {
+  return {
+    httpOnly: true,
+    sameSite: "lax",
+    secure,
+    path: "/",
+    maxAge: 10 * 60
+  };
+}
+function resolveCallbackPath(options) {
+  return options?.callbackPath ?? VERCEL_CALLBACK_PATH;
+}
+async function buildVercelAuthorizeRedirect(request, config, returnTo, options) {
+  if (!config.vercelClientId) {
+    return new Response("Vercel OAuth is not configured", { status: 500 });
+  }
+  const state = randomToken(32);
+  const nonce = randomToken(32);
+  const codeVerifier = randomToken(48);
+  const codeChallenge = await sha256Base64Url(codeVerifier);
+  const origin = new URL(request.url).origin;
+  const redirectUri = `${origin}${resolveCallbackPath(options)}`;
+  const secure = origin.startsWith("https://");
+  const params = new URLSearchParams({
+    client_id: config.vercelClientId,
+    redirect_uri: redirectUri,
+    state,
+    nonce,
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    response_type: "code",
+    scope: "openid email profile"
+  });
+  const response = new Response(null, {
+    status: 302,
+    headers: {
+      Location: `https://vercel.com/oauth/authorize?${params.toString()}`
+    }
+  });
+  const opts = cookieOptions(secure);
+  appendSetCookie(response, OAUTH_STATE_COOKIE, state, opts);
+  appendSetCookie(response, OAUTH_NONCE_COOKIE, nonce, opts);
+  appendSetCookie(response, OAUTH_VERIFIER_COOKIE, codeVerifier, opts);
+  appendSetCookie(response, OAUTH_RETURN_COOKIE, returnTo || "/", opts);
+  return response;
+}
+async function exchangeVercelCode(request, config, code, codeVerifier, options) {
+  if (!config.vercelClientId || !config.vercelClientSecret) {
+    throw new Error("Vercel OAuth is not configured");
+  }
+  const origin = new URL(request.url).origin;
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: config.vercelClientId,
+    client_secret: config.vercelClientSecret,
+    code,
+    code_verifier: codeVerifier,
+    redirect_uri: `${origin}${resolveCallbackPath(options)}`
+  });
+  const response = await fetch("https://api.vercel.com/login/oauth/token", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(`Token exchange failed: ${errorText}`);
+  }
+  return await response.json();
+}
+async function fetchVercelUserInfo(accessToken) {
+  const response = await fetch("https://api.vercel.com/login/oauth/userinfo", {
+    headers: {
+      Authorization: `Bearer ${accessToken}`
+    }
+  });
+  if (!response.ok) {
+    throw new Error("Failed to load Vercel user info");
+  }
+  return await response.json();
+}
+function readCookie(request, name) {
+  const cookieHeader = request.headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const part of cookieHeader.split(";")) {
+    const [rawName, ...rest] = part.trim().split("=");
+    if (rawName === name) {
+      return decodeURIComponent(rest.join("="));
+    }
+  }
+  return null;
+}
+async function assertOAuthState(request, state) {
+  const stored = readCookie(request, OAUTH_STATE_COOKIE);
+  if (!state || !stored) {
+    return false;
+  }
+  return timingSafeEqualString(state, stored);
+}
+function decodeIdTokenNonce(idToken) {
+  if (!idToken) {
+    return null;
+  }
+  const parts = idToken.split(".");
+  const payload = parts[1];
+  if (!payload) {
+    return null;
+  }
+  try {
+    const padded = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padLength = (4 - padded.length % 4) % 4;
+    const json = atob(padded + "=".repeat(padLength));
+    const data = JSON.parse(json);
+    return data.nonce ?? null;
+  } catch {
+    return null;
+  }
+}
+function clearOAuthCookies(response, secure) {
+  const expired = {
+    httpOnly: true,
+    sameSite: "lax",
+    secure,
+    path: "/",
+    maxAge: 0
+  };
+  for (const name of [
+    OAUTH_STATE_COOKIE,
+    OAUTH_NONCE_COOKIE,
+    OAUTH_VERIFIER_COOKIE,
+    OAUTH_RETURN_COOKIE,
+    OAUTH_RETURN_ORIGIN_COOKIE
+  ]) {
+    appendSetCookie(response, name, "", expired);
+  }
+}
+function appendSetCookie(response, name, value, options) {
+  const parts = [`${name}=${encodeURIComponent(value)}`];
+  if (options.maxAge !== void 0) {
+    parts.push(`Max-Age=${options.maxAge}`);
+  }
+  parts.push(`Path=${options.path ?? "/"}`);
+  if (options.httpOnly) {
+    parts.push("HttpOnly");
+  }
+  if (options.secure) {
+    parts.push("Secure");
+  }
+  if (options.sameSite) {
+    parts.push(
+      `SameSite=${options.sameSite === "none" ? "None" : options.sameSite[0].toUpperCase()}${options.sameSite.slice(1)}`
+    );
+  }
+  response.headers.append("Set-Cookie", parts.join("; "));
+}
+
+// src/handler.ts
+function isSecureRequest(request) {
+  return new URL(request.url).protocol === "https:";
+}
+function getPathname(request) {
+  return new URL(request.url).pathname;
+}
+function htmlResponse(html, status = 401) {
+  return new Response(html, {
+    status,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8",
+      "Cache-Control": "no-store"
+    }
+  });
+}
+function redirect(request, location, status = 302) {
+  const absoluteLocation = new URL(location, request.url).toString();
+  return new Response(null, {
+    status,
+    headers: {
+      Location: absoluteLocation,
+      "Cache-Control": "no-store"
+    }
+  });
+}
+function signingSecret(config) {
+  return config.secret ?? config.bypassSecret;
+}
+async function attachSession(response, config, method, subject, secure) {
+  const secret = signingSecret(config);
+  if (!secret) {
+    return response;
+  }
+  const token = await createSessionToken(secret, method, subject, config.sessionTtlSeconds);
+  const opts = sessionCookieOptions(config.sessionTtlSeconds, secure);
+  appendSetCookie(response, SESSION_COOKIE_NAME, token, opts);
+  return response;
+}
+async function handleBypass(request, config) {
+  if (!config.bypassSecret) {
+    return { kind: "miss" };
+  }
+  const token = readBypassToken(request) ?? readBypassCookie(request);
+  if (!await isValidBypass(token, config.bypassSecret)) {
+    return { kind: "miss" };
+  }
+  const setCookieMode = shouldSetBypassCookie(request);
+  const url = new URL(request.url);
+  const hadQueryBypass = url.searchParams.has(BYPASS_HEADER);
+  const hadSetCookieQuery = url.searchParams.has(SET_BYPASS_COOKIE_HEADER);
+  if (hadQueryBypass || hadSetCookieQuery || setCookieMode) {
+    url.searchParams.delete(BYPASS_HEADER);
+    url.searchParams.delete(SET_BYPASS_COOKIE_HEADER);
+    const response = redirect(request, url.pathname + url.search + url.hash);
+    const secure = isSecureRequest(request);
+    if (setCookieMode || hadSetCookieQuery) {
+      appendSetCookie(response, BYPASS_COOKIE_NAME, config.bypassSecret, {
+        httpOnly: true,
+        secure,
+        path: "/",
+        maxAge: config.sessionTtlSeconds,
+        sameSite: setCookieMode === "samesitenone" ? "none" : "lax"
+      });
+    }
+    await attachSession(response, config, "bypass", "automation", secure);
+    return { kind: "respond", response };
+  }
+  return { kind: "allow" };
+}
+async function handlePasswordPost(request, config) {
+  if (request.method !== "POST" || !hasPasswordAuth(config)) {
+    return null;
+  }
+  const contentType = request.headers.get("content-type") ?? "";
+  if (!contentType.includes("application/x-www-form-urlencoded") && !contentType.includes("multipart/form-data")) {
+    return null;
+  }
+  let form;
+  try {
+    form = await request.formData();
+  } catch {
+    return null;
+  }
+  if (form.get("__becklyn_dp") !== "1") {
+    return null;
+  }
+  const username = String(form.get("username") ?? "");
+  const password = String(form.get("password") ?? "");
+  const returnTo = safeReturnTo(String(form.get("return_to") ?? getPathname(request)));
+  if (!await validatePasswordCredentials(config, username, password)) {
+    return htmlResponse(
+      renderLoginPage(config, {
+        error: "Invalid username or password.",
+        returnTo,
+        showPassword: true,
+        showVercel: hasVercelAuth(config)
+      })
+    );
+  }
+  const response = redirect(request, returnTo);
+  return attachSession(response, config, "password", username, isSecureRequest(request));
+}
+async function handleVercelAuthorize(request, config) {
+  if (getPathname(request) !== VERCEL_AUTHORIZE_PATH) {
+    return null;
+  }
+  if (!hasVercelAuth(config)) {
+    return new Response("Sign in with Vercel is not configured", { status: 500 });
+  }
+  const returnTo = safeReturnTo(new URL(request.url).searchParams.get("return_to"));
+  if (hasVercelProxyAuth(config) && config.authProxyUrl && config.handoffSecret) {
+    const startUrl = await buildProxyStartUrl({
+      authProxyUrl: config.authProxyUrl,
+      secret: config.handoffSecret,
+      returnOrigin: new URL(request.url).origin,
+      returnPath: returnTo
+    });
+    return redirect(request, startUrl);
+  }
+  if (!hasVercelDirectAuth(config)) {
+    return new Response("Sign in with Vercel is not configured", { status: 500 });
+  }
+  return buildVercelAuthorizeRedirect(request, config, returnTo);
+}
+async function handleVercelCallback(request, config) {
+  if (getPathname(request) !== VERCEL_CALLBACK_PATH) {
+    return null;
+  }
+  if (!hasVercelAuth(config) || !config.secret) {
+    return new Response("Sign in with Vercel is not configured", { status: 500 });
+  }
+  const url = new URL(request.url);
+  const handoff = url.searchParams.get("handoff");
+  const secure = isSecureRequest(request);
+  if (handoff) {
+    if (!config.handoffSecret) {
+      return new Response("Sign in with Vercel is not configured", { status: 500 });
+    }
+    const returnTo2 = safeReturnTo(url.searchParams.get("return_to"));
+    const payload = await verifyHandoffToken(config.handoffSecret, handoff, url.origin);
+    if (!payload) {
+      return htmlResponse(
+        renderLoginPage(config, {
+          error: "Vercel sign-in failed (invalid handoff).",
+          returnTo: returnTo2,
+          showPassword: hasPasswordAuth(config),
+          showVercel: true
+        })
+      );
+    }
+    const response = redirect(request, returnTo2);
+    return attachSession(response, config, "vercel", payload.subject, secure);
+  }
+  if (!hasVercelDirectAuth(config)) {
+    return new Response("Sign in with Vercel is not configured", { status: 500 });
+  }
+  const code = url.searchParams.get("code");
+  const state = url.searchParams.get("state");
+  const returnTo = safeReturnTo(readCookie(request, OAUTH_RETURN_COOKIE));
+  if (!code || !await assertOAuthState(request, state)) {
+    const response = htmlResponse(
+      renderLoginPage(config, {
+        error: "Vercel sign-in failed (invalid state).",
+        returnTo,
+        showPassword: hasPasswordAuth(config),
+        showVercel: true
+      })
+    );
+    clearOAuthCookies(response, secure);
+    return response;
+  }
+  try {
+    const codeVerifier = readCookie(request, OAUTH_VERIFIER_COOKIE);
+    if (!codeVerifier) {
+      throw new Error("Missing PKCE verifier");
+    }
+    const tokenData = await exchangeVercelCode(request, config, code, codeVerifier);
+    const storedNonce = readCookie(request, OAUTH_NONCE_COOKIE);
+    const tokenNonce = decodeIdTokenNonce(tokenData.id_token);
+    if (storedNonce && tokenNonce && !await timingSafeEqualString(storedNonce, tokenNonce)) {
+      throw new Error("Nonce mismatch");
+    }
+    const user = await fetchVercelUserInfo(tokenData.access_token);
+    const subject = user.preferred_username || user.email || user.sub || "vercel-user";
+    const response = redirect(request, returnTo);
+    clearOAuthCookies(response, secure);
+    return attachSession(response, config, "vercel", subject, secure);
+  } catch {
+    const response = htmlResponse(
+      renderLoginPage(config, {
+        error: "Vercel sign-in failed.",
+        returnTo,
+        showPassword: hasPasswordAuth(config),
+        showVercel: true
+      })
+    );
+    clearOAuthCookies(response, secure);
+    return response;
+  }
+}
+async function handleDeploymentProtection(request, options = {}) {
+  const config = resolveConfig(options);
+  if (!isProtectionActive(config)) {
+    return null;
+  }
+  const vercelAuthorize = await handleVercelAuthorize(request, config);
+  if (vercelAuthorize) {
+    return vercelAuthorize;
+  }
+  const vercelCallback = await handleVercelCallback(request, config);
+  if (vercelCallback) {
+    return vercelCallback;
+  }
+  const passwordResponse = await handlePasswordPost(request, config);
+  if (passwordResponse) {
+    return passwordResponse;
+  }
+  const bypass = await handleBypass(request, config);
+  if (bypass.kind === "respond") {
+    return bypass.response;
+  }
+  if (bypass.kind === "allow") {
+    return null;
+  }
+  const secret = signingSecret(config);
+  if (secret) {
+    const session = await verifySessionToken(secret, readCookie(request, SESSION_COOKIE_NAME));
+    if (session) {
+      return null;
+    }
+  }
+  if (!hasPasswordAuth(config) && !hasVercelAuth(config)) {
+    return new Response("Unauthorized", { status: 401 });
+  }
+  const returnTo = safeReturnTo(getPathname(request) + new URL(request.url).search);
+  return htmlResponse(
+    renderLoginPage(config, {
+      returnTo,
+      showPassword: hasPasswordAuth(config),
+      showVercel: hasVercelAuth(config)
+    })
+  );
+}
+
+// src/edge.ts
+function middlewarePassThrough() {
+  return new Response(null, {
+    status: 200,
+    headers: {
+      "x-middleware-next": "1"
+    }
+  });
+}
+function withEdgeDeploymentProtection(options = {}) {
+  return async function deploymentProtectionEdgeMiddleware(request) {
+    const protectionResponse = await handleDeploymentProtection(request, options);
+    if (protectionResponse) {
+      return protectionResponse;
+    }
+    return middlewarePassThrough();
+  };
+}
+export {
+  middlewarePassThrough,
+  withEdgeDeploymentProtection
+};