cdk-nextjs 0.7.12 → 0.7.13

package/README.md

@@ -36,6 +36,17 @@ Deploy [Next.js](https://nextjs.org/) apps on [AWS](https://aws.amazon.com/) wit
 - [Bring Your Own Resources](#bring-your-own-resources) — import existing AWS resources (CloudFront distributions, ECS clusters, ALBs, S3 buckets, DynamoDB tables).
 - [AWS GovCloud (US)](https://aws.amazon.com/govcloud-us) compatible with `NextjsRegionalFunctions` and `NextjsRegionalContainers`.
 
+## Why
+
+The simplest path to deploy Next.js is on [Vercel](https://vercel.com/) - the Platform-as-a-Service company behind Next.js. However, deploying to Vercel can be expensive and some developers want all of their workloads running _directly_ on AWS. Developers can deploy Next.js on AWS through [AWS Amplify Hosting](https://docs.aws.amazon.com/amplify/latest/userguide/ssr-Amplifysupport.html), but Amplify does not support all Next.js features and manages AWS resources for you so they cannot be customized. If Amplify meets your requirements we recommend you use it, but if you want to use all Next.js features or want more visibility into the AWS resources then this construct is for you.
+
+## Design Principles
+
+- Integrate through Next.js's official interfaces. Build on the [Deployment Adapter](https://nextjs.org/docs/app/guides/deployment-adapters) API and [`@next/routing`](https://www.npmjs.com/package/@next/routing) rather than Next.js internals, so new Next.js versions rarely break this construct. Where no public interface exists yet, the dependency is listed in [Next.js private APIs](docs/nextjs-private-apis.md).
+- Security first.
+- One architecture does not fit all.
+- Enable customization everywhere.
+
 ## Prerequisites
 
 - Next.js app running v16.3 or higher (`next build` fails on older versions). If you don't have one yet - follow [these steps](https://nextjs.org/docs/getting-started) to create one.
@@ -102,6 +113,34 @@ new WebStack(app, "web-stack");
 
 See [examples/](./examples/) for more usage examples.
 
+## Architecture
+
+How requests are served inside the compute — the adapter runtime, and where it deliberately differs from `next start` — is in [docs/adapter-runtime.md](./docs/adapter-runtime.md).
+
+### `NextjsGlobalFunctions`
+
+Architecture includes [AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html) Functions to respond to dynamic requests and [CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html) Distribution to globally serve requests and distribute static assets. Use this construct when you have unpredictable traffic, can afford occasional latency (i.e. cold starts - [typically 1% of production traffic](https://aws.amazon.com/blogs/compute/operating-lambda-performance-optimization-part-1/)), and/or want the most granular pricing model. ([code](./src/root-constructs/nextjs-global-functions.ts))
+
+![NextjsGlobalFunctions architecture: User to CloudFront, which serves S3 static assets and forwards to a Lambda function backed by a DynamoDB table and S3 cache bucket](https://raw.githubusercontent.com/cdklabs/cdk-nextjs/main/docs/diagrams/nextjs-global-functions.svg)
+
+### `NextjsGlobalContainers`
+
+Architecture includes [ECS Fargate](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/AWS_Fargate.html) containers to respond to dynamic requests and [CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html) Distribution to globally serve requests and distribute static assets. Use this option when you have predictable traffic, need the lowest latency, and/or can afford a less granular pricing model. ([code](./src/root-constructs/nextjs-global-containers.ts))
+
+![NextjsGlobalContainers architecture: User to CloudFront, which serves S3 static assets and forwards to an Application Load Balancer and ECS Fargate containers in a VPC, backed by a DynamoDB table and S3 cache bucket](https://raw.githubusercontent.com/cdklabs/cdk-nextjs/main/docs/diagrams/nextjs-global-containers.svg)
+
+### `NextjsRegionalContainers`
+
+Architecture includes [ECS Fargate](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/AWS_Fargate.html) containers to respond to dynamic requests and [Application Load Balancer](https://aws.amazon.com/elasticloadbalancing/application-load-balancer/) to regionally serve requests. Use this options when you cannot use Amazon CloudFront (i.e. [AWS GovCloud](https://aws.amazon.com/govcloud-us/?whats-new.sort-by=item.additionalFields.postDateTime&whats-new.sort-order=desc)). ([code](./src/root-constructs/nextjs-regional-containers.ts#L41))
+
+![NextjsRegionalContainers architecture: User to an Application Load Balancer and ECS Fargate containers in a VPC, backed by a DynamoDB table and S3 cache bucket](https://raw.githubusercontent.com/cdklabs/cdk-nextjs/main/docs/diagrams/nextjs-regional-containers.svg)
+
+### `NextjsRegionalFunctions`
+
+Architecture includes [AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html) Functions to respond to dynamic requests and [API Gateway REST API](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-rest-api.html) to regionally serve requests and distribute static assets. Use this options when you cannot use Amazon CloudFront (i.e. [AWS GovCloud](https://aws.amazon.com/govcloud-us/?whats-new.sort-by=item.additionalFields.postDateTime&whats-new.sort-order=desc)). ([code](./src/root-constructs/nextjs-regional-functions.ts))
+
+![NextjsRegionalFunctions architecture: User to an API Gateway REST API, which serves S3 static assets and forwards to a Lambda function backed by a DynamoDB table and S3 cache bucket](https://raw.githubusercontent.com/cdklabs/cdk-nextjs/main/docs/diagrams/nextjs-regional-functions.svg)
+
 ## Configuration
 
 The variables below are read at runtime by the cache handler inside your deployed
@@ -415,114 +454,90 @@ Notes:
 - Per-group `overrides` let you size each function independently:
   `{ name: "reports", routes: [...], overrides: { functionProps: { memorySize: 2048 } } }`.
 
-## Architecture
+## Running Code on Every Viewer Request
 
-How requests are served inside the compute — the adapter runtime, and where it deliberately differs from `next start` — is in [docs/adapter-runtime.md](./docs/adapter-runtime.md).
-
-### `NextjsGlobalFunctions`
-
-Architecture includes [AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html) Functions to respond to dynamic requests and [CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html) Distribution to globally serve requests and distribute static assets. Use this construct when you have unpredictable traffic, can afford occasional latency (i.e. cold starts - [typically 1% of production traffic](https://aws.amazon.com/blogs/compute/operating-lambda-performance-optimization-part-1/)), and/or want the most granular pricing model. ([code](./src/root-constructs/nextjs-global-functions.ts))
-
-```mermaid
-architecture-beta
-    group aws(cloud)[AWS Cloud]
-    group cache[Cache Layer] in aws
-
-    service user(internet)[User]
-    service cloudfront(server)[CloudFront Distribution] in aws
-    service s3static(disk)[S3 Static Assets] in aws
-    service lambda(server)[Lambda Function] in aws
-    service dynamodb(database)[DynamoDB Table] in cache
-    service s3cache(disk)[S3 Cache Bucket] in cache
-
-    user:R --> L:cloudfront
-    cloudfront:R --> L:s3static
-    cloudfront:R --> L:lambda
-    lambda:R --> L:dynamodb
-    lambda:R --> L:s3cache
-```
-
-### `NextjsGlobalContainers`
-
-Architecture includes [ECS Fargate](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/AWS_Fargate.html) containers to respond to dynamic requests and [CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html) Distribution to globally serve requests and distribute static assets. Use this option when you have predictable traffic, need the lowest latency, and/or can afford a less granular pricing model. ([code](./src/root-constructs/nextjs-global-containers.ts))
-
-```mermaid
-architecture-beta
-    group aws(cloud)[AWS Cloud]
-    group vpc[VPC] in aws
-    group cache[Cache Layer] in aws
-
-    service user(internet)[User]
-    service cloudfront(server)[CloudFront Distribution] in aws
-    service s3static(disk)[S3 Static Assets] in aws
-    service alb(server)[Application Load Balancer] in vpc
-    service fargate(server)[ECS Fargate Containers] in vpc
-    service dynamodb(database)[DynamoDB Table] in cache
-    service s3cache(disk)[S3 Cache Bucket] in cache
-
-    user:R --> L:cloudfront
-    cloudfront:R --> L:s3static
-    cloudfront:R --> L:alb
-    alb:R --> L:fargate
-    fargate:R --> L:dynamodb
-    fargate:R --> L:s3cache
-```
-
-### `NextjsRegionalContainers`
+`NextjsGlobalFunctions` and `NextjsGlobalContainers` take a
+`viewerRequestFunctionCode` prop: CloudFront Function code that runs first on
+every request, on every behavior cdk-nextjs adds — pages, API routes,
+`_next/image`, `_next/static` and `public/` files alike. It's the place for a
+gate the whole site has to pass, such as HTTP Basic auth before launch:
 
-Architecture includes [ECS Fargate](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/AWS_Fargate.html) containers to respond to dynamic requests and [Application Load Balancer](https://aws.amazon.com/elasticloadbalancing/application-load-balancer/) to regionally serve requests. Use this options when you cannot use Amazon CloudFront (i.e. [AWS GovCloud](https://aws.amazon.com/govcloud-us/?whats-new.sort-by=item.additionalFields.postDateTime&whats-new.sort-order=desc)). ([code](./src/root-constructs/nextjs-regional-containers.ts#L41))
+```ts
+import { FunctionCode, KeyValueStore } from "aws-cdk-lib/aws-cloudfront";
 
-```mermaid
-architecture-beta
-    group aws(cloud)[AWS Cloud]
-    group vpc[VPC] in aws
-    group cache[Cache Layer] in aws
-
-    service user(internet)[User]
-    service alb(server)[Application Load Balancer] in vpc
-    service fargate(server)[ECS Fargate Containers] in vpc
-    service dynamodb(database)[DynamoDB Table] in cache
-    service s3cache(disk)[S3 Cache Bucket] in cache
-
-    user:R --> L:alb
-    alb:R --> L:fargate
-    fargate:R --> L:dynamodb
-    fargate:R --> L:s3cache
+const credentials = new KeyValueStore(this, "Credentials");
+new NextjsGlobalFunctions(this, "Nextjs", {
+  buildDirectory: join(import.meta.dirname),
+  viewerRequestKeyValueStore: credentials,
+  viewerRequestFunctionCode: FunctionCode.fromInline(`
+    import cf from "cloudfront";
+    const kvs = cf.kvs();
+    async function viewerRequest(event) {
+      const auth = event.request.headers.authorization;
+      try {
+        if (auth && auth.value === "Basic " + (await kvs.get("basic-auth"))) {
+          // verified: don't pass the site's credentials on to the origin
+          delete event.request.headers.authorization;
+          return;
+        }
+      } catch (e) {
+        // no "basic-auth" key yet: stay locked
+      }
+      return {
+        statusCode: 401,
+        statusDescription: "Unauthorized",
+        headers: { "www-authenticate": { value: 'Basic realm="preview"' } },
+      };
+    }
+  `),
+});
 ```
 
-### `NextjsRegionalFunctions`
+Then put the credentials in the store, outside the template:
 
-Architecture includes [AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html) Functions to respond to dynamic requests and [API Gateway REST API](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-rest-api.html) to regionally serve requests and distribute static assets. Use this options when you cannot use Amazon CloudFront (i.e. [AWS GovCloud](https://aws.amazon.com/govcloud-us/?whats-new.sort-by=item.additionalFields.postDateTime&whats-new.sort-order=desc)). ([code](./src/root-constructs/nextjs-regional-functions.ts))
-
-```mermaid
-architecture-beta
-    group aws(cloud)[AWS Cloud]
-    group cache[Cache Layer] in aws
-
-    service user(internet)[User]
-    service apigateway(server)[API Gateway REST API] in aws
-    service s3static(disk)[S3 Static Assets] in aws
-    service lambda(server)[Lambda Function] in aws
-    service dynamodb(database)[DynamoDB Table] in cache
-    service s3cache(disk)[S3 Cache Bucket] in cache
-
-    user:R --> L:apigateway
-    apigateway:R --> L:s3static
-    apigateway:R --> L:lambda
-    lambda:R --> L:dynamodb
-    lambda:R --> L:s3cache
+```sh
+KVS_ARN=... # the store's ARN
+aws cloudfront-keyvaluestore put-key --kvs-arn "$KVS_ARN" \
+  --key basic-auth --value "$(printf 'user:pass' | base64 | tr -d '\n')" \
+  --if-match "$(aws cloudfront-keyvaluestore describe-key-value-store \
+    --kvs-arn "$KVS_ARN" --query ETag --output text)"
 ```
 
-## Why
-
-The simplest path to deploy Next.js is on [Vercel](https://vercel.com/) - the Platform-as-a-Service company behind Next.js. However, deploying to Vercel can be expensive and some developers want all of their workloads running _directly_ on AWS. Developers can deploy Next.js on AWS through [AWS Amplify Hosting](https://docs.aws.amazon.com/amplify/latest/userguide/ssr-Amplifysupport.html), but Amplify does not support all Next.js features and manages AWS resources for you so they cannot be customized. If Amplify meets your requirements we recommend you use it, but if you want to use all Next.js features or want more visibility into the AWS resources then this construct is for you.
-
-## Design Principles
-
-- Integrate through Next.js's official interfaces. Build on the [Deployment Adapter](https://nextjs.org/docs/app/guides/deployment-adapters) API and [`@next/routing`](https://www.npmjs.com/package/@next/routing) rather than Next.js internals, so new Next.js versions rarely break this construct. Where no public interface exists yet, the dependency is listed in [Next.js private APIs](docs/nextjs-private-apis.md).
-- Security first.
-- One architecture does not fit all.
-- Enable customization everywhere.
+The code must define `viewerRequest(event)`, as a function (`async` or not)
+or a `var`/`let`/`const`. It's a CloudFront Function handler in all but name:
+return a response to answer the viewer, or the request (or nothing) to carry
+on.
+
+Why not a function of your own on viewer-request? CloudFront allows one per
+event type per behavior, and on Global Functions cdk-nextjs's own one
+overwrites `X-Forwarded-Host` and redirects repeated slashes. So your code is
+spliced into that function, ahead of cdk-nextjs's logic, which still runs after
+it, so your code can't undo the `X-Forwarded-Host` overwrite. Middleware can't
+do this instead: on Global Functions CloudFront signs the request to the
+Function URL with the `Authorization` header, and static assets never reach the
+server at all.
+
+- cdk-nextjs's CloudFront Functions run on `cloudfront-js-2.0`, so your code
+  can be `async`, and `import cf from "cloudfront"` works when it comes first,
+  as it does above.
+- `viewerRequestKeyValueStore` is associated with every viewer-request function
+  your code is copied into (up to three, one per kind of behavior), so
+  `cf.kvs()` reads it with no ID wherever the code runs. Credentials written
+  inline in the code instead end up in the CloudFormation template.
+- The combined function, cdk-nextjs's code included, must fit CloudFront's
+  10 KB limit; synth fails if it doesn't (or warns, if the code contains a
+  CDK token, whose size isn't known until deploy).
+- Your code shares the file with cdk-nextjs's `handler`, so it can't use the
+  name `handler` at all, even in a comment or a string; synth refuses it.
+- A viewer-request association in `overrides.*BehaviorOptions.functionAssociations`
+  on a behavior this covers is refused at synth; put that logic in
+  `viewerRequestFunctionCode` instead. So is
+  `overrides.distributionProps.defaultBehavior` without a `basePath`, since it
+  would replace the default behavior the code runs on; customize it through
+  `overrides.dynamicBehaviorOptions`.
+- A bring-your-own `distribution`'s default behavior is yours, so it isn't
+  covered. Only the behaviors cdk-nextjs adds are; under a `basePath`, those
+  include the ones that stand in for the default behavior.
 
 ## Bring Your Own Resources
 

package/docs/breaking-changes.md

@@ -447,8 +447,10 @@ absolute URLs, cached for other viewers). Now:
 
 - associations on other event types (viewer-response, say) are added next to it;
 - an association on viewer-request throws at synth, since CloudFront allows one
-  function per event type per behavior. Move that logic to viewer-response or
-  into middleware.
+  function per event type per behavior. Move that logic into the
+  `viewerRequestFunctionCode` prop, which runs it inside cdk-nextjs's own
+  viewer-request function on every behavior, static assets included (see
+  [Running Code on Every Viewer Request](../README.md#running-code-on-every-viewer-request)).
 
 The runtime trusts `X-Forwarded-Host` only on a request Lambda reports as
 IAM-authenticated, so a Function URL overridden to `authType: NONE` builds its

package/docs/development-guide.md

@@ -66,3 +66,13 @@ Both `build` and `dev` chain it explicitly (`npm run sync-cdk-nextjs && next …
 For iterative development, just run `pnpm build` from the root to rebuild the adapter, then `pnpm build` in the example app—the sync step will copy the latest version.
 
 Note that `pnpm install` recreates the `link:../..` symlink, so always go through `pnpm build` / `pnpm dev`. Invoking `next build` or `next dev` directly skips the sync and Turbopack then fails on the symlinked path, e.g. `FileSystemPath("app-playground").join("./../../lib/adapter/cache-handler.mjs") leaves the filesystem root`.
+
+## Architecture Diagrams
+
+The README's architecture diagrams are Mermaid [`architecture-beta`](https://mermaid.js.org/syntax/architecture.html) sources in [`docs/diagrams/`](./diagrams/), rendered to SVG with AWS icons from the Iconify [`logos`](https://icon-sets.iconify.design/logos/?keyword=aws) set (`logos:aws-lambda`, `logos:aws-cloudfront`, ...). After editing a `.mmd` file:
+
+```bash
+pnpm diagrams
+```
+
+Commit the `.mmd` and the regenerated `.svg` together. `pnpm test` fails if an SVG is stale against its source. The README links the SVGs on `main`, so a PR's README preview shows the old diagrams until it merges; open the SVG in the PR's files view to see the new one.

package/lib/adapter/adapter.mjs

@@ -829,6 +829,8 @@ var require_package = __commonJS({
         compat: "pnpm dlx projen compat",
         compile: "pnpm dlx projen compile",
         default: "pnpm dlx projen default",
+        diagrams: "pnpm dlx projen diagrams",
+        "diagrams:check": "pnpm dlx projen diagrams:check",
         docgen: "pnpm dlx projen docgen",
         eject: "pnpm dlx projen eject",
         eslint: "pnpm dlx projen eslint",
@@ -866,6 +868,7 @@ var require_package = __commonJS({
         "@aws-sdk/client-s3": "^3.1141.0",
         "@aws-sdk/client-ssm": "^3.1141.0",
         "@aws-sdk/lib-storage": "^3.1141.0",
+        "@iconify-json/logos": "1.2.16",
         "@mrgrain/jsii-struct-builder": "^0.7.64",
         "@next/routing": "16.4.0",
         "@smithy/signature-v4": "^2.3.0",
@@ -948,7 +951,7 @@ var require_package = __commonJS({
       publishConfig: {
         access: "public"
       },
-      version: "0.7.12",
+      version: "0.7.13",
       packageManager: "pnpm@10.32.1",
       jest: {
         coverageProvider: "v8",

package/lib/generated-structs/OptionalNextjsDistributionProps.d.ts

@@ -4,6 +4,27 @@ import type { NextjsType, PublicDirEntry } from '../';
  * OptionalNextjsDistributionProps
  */
 export interface OptionalNextjsDistributionProps {
+    /**
+     * A CloudFront KeyValueStore associated with every viewer-request function {@link viewerRequestFunctionCode} is copied into (up to three, one per kind of behavior), so values it reads — Basic auth credentials, an allowlist — live outside the CloudFormation template and change without a deploy.
+     * Read it with `cf.kvs()`, no ID needed.
+     * @default - none
+     * @stability stable
+     */
+    readonly viewerRequestKeyValueStore?: aws_cloudfront.IKeyValueStore;
+    /**
+     * CloudFront Function code run first on every viewer request, on every behavior cdk-nextjs adds, static assets included — HTTP Basic auth on a pre-launch site, geo-gating.
+     * It must define `viewerRequest(event)` (a function, sync or async, or a
+     * `var`/`let`/`const`): return a response to answer the viewer, or the
+     * request (or nothing) to carry on. It is spliced into cdk-nextjs's own
+     * viewer-request functions, ahead of their logic, so it may not use the
+     * name `handler`, and the combined function must fit CloudFront's 10 KB.
+     * It runs on `cloudfront-js-2.0`, so it may be async and read
+     * {@link viewerRequestKeyValueStore} with `cf.kvs()`. A bring-your-own
+     * {@link distribution}'s default behavior isn't covered.
+     * @default - none
+     * @stability stable
+     */
+    readonly viewerRequestFunctionCode?: aws_cloudfront.FunctionCode;
     /**
      * The most cache behaviors the distribution may have, the default one included.
      * cdk-nextjs counts what it adds against this at synth, so running

package/lib/generated-structs/OptionalNextjsDistributionProps.js

@@ -1,3 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiT3B0aW9uYWxOZXh0anNEaXN0cmlidXRpb25Qcm9wcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9nZW5lcmF0ZWQtc3RydWN0cy9PcHRpb25hbE5leHRqc0Rpc3RyaWJ1dGlvblByb3BzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIiLCJzb3VyY2VzQ29udGVudCI6WyIvLyB+fiBHZW5lcmF0ZWQgYnkgcHJvamVuLiBUbyBtb2RpZnksIGVkaXQgLnByb2plbnJjLnRzIGFuZCBydW4gXCJwbnBtIGRseCBwcm9qZW5cIi5cbmltcG9ydCB0eXBlIHsgYXdzX2NlcnRpZmljYXRlbWFuYWdlciwgYXdzX2Nsb3VkZnJvbnQsIGF3c19lbGFzdGljbG9hZGJhbGFuY2luZ3YyLCBhd3NfbGFtYmRhLCBhd3NfczMgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgdHlwZSB7IE5leHRqc1R5cGUsIFB1YmxpY0RpckVudHJ5IH0gZnJvbSAnLi4vJztcblxuLyoqXG4gKiBPcHRpb25hbE5leHRqc0Rpc3RyaWJ1dGlvblByb3BzXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgT3B0aW9uYWxOZXh0anNEaXN0cmlidXRpb25Qcm9wcyB7XG4gIC8qKlxuICAgKiBUaGUgbW9zdCBjYWNoZSBiZWhhdmlvcnMgdGhlIGRpc3RyaWJ1dGlvbiBtYXkgaGF2ZSwgdGhlIGRlZmF1bHQgb25lIGluY2x1ZGVkLlxuICAgKiBjZGstbmV4dGpzIGNvdW50cyB3aGF0IGl0IGFkZHMgYWdhaW5zdCB0aGlzIGF0IHN5bnRoLCBzbyBydW5uaW5nXG4gICAqIG91dCBpcyBhIHN5bnRoIGVycm9yIG5hbWluZyB3aGF0IHVzZWQgdGhlbSByYXRoZXIgdGhhbiBhIGZhaWxlZCBkZXBsb3kuXG4gICAqXG4gICAqIFJhaXNlIGl0IGFmdGVyIHJhaXNpbmcgdGhlIFwiQ2FjaGUgYmVoYXZpb3JzIHBlciBkaXN0cmlidXRpb25cIiBxdW90YSBmb3JcbiAgICogeW91ciBhY2NvdW50LiBMb3dlciBpdCBieSB0aGUgYmVoYXZpb3JzIGEgc3VwcGxpZWQge0BsaW5rIGRpc3RyaWJ1dGlvbn1cbiAgICogKG9yIGBvdmVycmlkZXMuZGlzdHJpYnV0aW9uUHJvcHNgKSBhbHJlYWR5IGhhcywgd2hpY2ggYXJlIG5vdCBjb3VudGVkLlxuICAgKiBAZGVmYXVsdCA3NSAtIENsb3VkRnJvbnQncyBkZWZhdWx0IHF1b3RhXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBtYXhDYWNoZUJlaGF2aW9ycz86IG51bWJlcjtcbiAgLyoqXG4gICAqIFJlcXVpcmVkIGlmIGBOZXh0anNUeXBlLkdMT0JBTF9DT05UQUlORVJTYCBvciBgTmV4dGpzVHlwZS5SRUdJT05BTF9DT05UQUlORVJTYC5cbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IGxvYWRCYWxhbmNlcj86IGF3c19lbGFzdGljbG9hZGJhbGFuY2luZ3YyLklBcHBsaWNhdGlvbkxvYWRCYWxhbmNlcjtcbiAgLyoqXG4gICAqIFJlcXVpcmVkIGlmIGBOZXh0anNUeXBlLkdMT0JBTF9GVU5DVElPTlNgLlxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgZnVuY3Rpb25Vcmw/OiBhd3NfbGFtYmRhLklGdW5jdGlvblVybDtcbiAgLyoqXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBkaXN0cmlidXRpb24/OiBhd3NfY2xvdWRmcm9udC5EaXN0cmlidXRpb247XG4gIC8qKlxuICAgKiBPcHRpb25hbCBidXQgb25seSBhcHBsaWNhYmxlIGZvciBgTmV4dGpzVHlwZS5HTE9CQUxfQ09OVEFJTkVSU2AuXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBjZXJ0aWZpY2F0ZT86IGF3c19jZXJ0aWZpY2F0ZW1hbmFnZXIuSUNlcnRpZmljYXRlO1xuICAvKipcbiAgICogVVJJIHBhdGggcHJlZml4IHRoZSBhcHAgaXMgc2VydmVkIGF0LlxuICAgKiBTdXJyb3VuZGluZyBzbGFzaGVzIGFyZSBub3JtYWxpemVkXG4gICAqIGF3YXksIHNvIFwiL2Jhc2VcIiwgXCJiYXNlXCIgYW5kIFwiL2Jhc2UvXCIgYWxsIHByb2R1Y2UgdGhlIHNhbWUgY2FjaGUgYmVoYXZpb3JzLlxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgYmFzZVBhdGg/OiBzdHJpbmc7XG4gIC8qKlxuICAgKiBUaGUgYXBwJ3Mgb3duIGBhc3NldFByZWZpeGAuXG4gICAqIE5leHQuanMgZW1pdHMgYDxhc3NldFByZWZpeD4vX25leHQvc3RhdGljLy4uLmBcbiAgICogZm9yIGV2ZXJ5IGJ1bmRsZSB3aGlsZSB0aGUgb2JqZWN0cyBzdGF5IGF0IGA8YmFzZVBhdGg+L19uZXh0L3N0YXRpYy8uLi5gIGluXG4gICAqIFMzLCBzbyB0aGUgcHJlZml4J3MgcGF0aCBnZXRzIGEgY2FjaGUgYmVoYXZpb3Igb2YgaXRzIG93biB0aGF0IHJld3JpdGVzIGl0XG4gICAqIGF3YXkuXG4gICAqXG4gICAqIEVpdGhlciBmb3JtIGlzIGFjY2VwdGVkOiBhIHBhdGggKFwiL2NkblwiKSwgb3IgYW4gYWJzb2x1dGUgVVJMLCBpbiB3aGljaCBjYXNlXG4gICAqIG9ubHkgaXRzIHBhdGggY291bnRzIChcImh0dHBzOi8vY2RuLmV4YW1wbGUuY29tL2NkblwiIGJlaGF2ZXMgYXMgXCIvY2RuXCIsIGFuZFxuICAgKiBcImh0dHBzOi8vY2RuLmV4YW1wbGUuY29tXCIgbmVlZHMgbm8gYmVoYXZpb3IgYXQgYWxsKS4gQW4gYWJzb2x1dGUgcHJlZml4J3MgcGF0aFxuICAgKiBtYXR0ZXJzIGJlY2F1c2UgYG5leHQgYnVpbGRgIGNvbXBpbGVzIGEgYC9jZG4vX25leHQvOnBhdGgrYCByZXdyaXRlIG9mIGl0c1xuICAgKiBvd24sIHNvIGBuZXh0IHN0YXJ0YCBzZXJ2ZXMgZXZlcnkgYnVuZGxlIHVuZGVyIGl0IOKAlCBhIENETiBmcm9udGluZyB0aGlzXG4gICAqIGRpc3RyaWJ1dGlvbiB0aGVyZSBoYXMgdG8gYmUgYW5zd2VyZWQgdG9vLlxuICAgKlxuICAgKiBBcHBsaWVkIG9uIHRvcCBvZiBgYmFzZVBhdGhgLCBub3QgdW5kZXIgaXQsIGJlY2F1c2UgdGhhdCBpcyBob3cgTmV4dC5qc1xuICAgKiBidWlsZHMgdGhlIFVSTC5cbiAgICogQGRlZmF1bHQgLSBub25lOyBwYXNzIGBOZXh0anNCdWlsZC5uZXh0Q29uZmlnQXNzZXRQcmVmaXhQYXRoYFxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgYXNzZXRQcmVmaXg/OiBzdHJpbmc7XG4gIC8qKlxuICAgKiBFbnRyaWVzIChmaWxlcy9kaXJlY3Rvcmllcykgd2l0aGluIE5leHQuanMgYXBwJ3MgcHVibGljIGRpcmVjdG9yeS4gVXNlZCB0byBhZGQgc3RhdGljIGJlaGF2aW9ycyB0byBkaXN0cmlidXRpb24uXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBwdWJsaWNEaXJFbnRyaWVzPzogQXJyYXk8UHVibGljRGlyRW50cnk+O1xuICAvKipcbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IG5leHRqc1R5cGU/OiBOZXh0anNUeXBlO1xuICAvKipcbiAgICogQnVja2V0IGNvbnRhaW5pbmcgc3RhdGljIGFzc2V0cy5cbiAgICogTXVzdCBiZSBwcm92aWRlZCBpZiB5b3Ugd2FudCB0byBzZXJ2ZSBzdGF0aWMgZmlsZXMuXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBhc3NldHNCdWNrZXQ/OiBhd3NfczMuSUJ1Y2tldDtcbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiT3B0aW9uYWxOZXh0anNEaXN0cmlidXRpb25Qcm9wcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9nZW5lcmF0ZWQtc3RydWN0cy9PcHRpb25hbE5leHRqc0Rpc3RyaWJ1dGlvblByb3BzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIiLCJzb3VyY2VzQ29udGVudCI6WyIvLyB+fiBHZW5lcmF0ZWQgYnkgcHJvamVuLiBUbyBtb2RpZnksIGVkaXQgLnByb2plbnJjLnRzIGFuZCBydW4gXCJwbnBtIGRseCBwcm9qZW5cIi5cbmltcG9ydCB0eXBlIHsgYXdzX2NlcnRpZmljYXRlbWFuYWdlciwgYXdzX2Nsb3VkZnJvbnQsIGF3c19lbGFzdGljbG9hZGJhbGFuY2luZ3YyLCBhd3NfbGFtYmRhLCBhd3NfczMgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgdHlwZSB7IE5leHRqc1R5cGUsIFB1YmxpY0RpckVudHJ5IH0gZnJvbSAnLi4vJztcblxuLyoqXG4gKiBPcHRpb25hbE5leHRqc0Rpc3RyaWJ1dGlvblByb3BzXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgT3B0aW9uYWxOZXh0anNEaXN0cmlidXRpb25Qcm9wcyB7XG4gIC8qKlxuICAgKiBBIENsb3VkRnJvbnQgS2V5VmFsdWVTdG9yZSBhc3NvY2lhdGVkIHdpdGggZXZlcnkgdmlld2VyLXJlcXVlc3QgZnVuY3Rpb24ge0BsaW5rIHZpZXdlclJlcXVlc3RGdW5jdGlvbkNvZGV9IGlzIGNvcGllZCBpbnRvICh1cCB0byB0aHJlZSwgb25lIHBlciBraW5kIG9mIGJlaGF2aW9yKSwgc28gdmFsdWVzIGl0IHJlYWRzIOKAlCBCYXNpYyBhdXRoIGNyZWRlbnRpYWxzLCBhbiBhbGxvd2xpc3Qg4oCUIGxpdmUgb3V0c2lkZSB0aGUgQ2xvdWRGb3JtYXRpb24gdGVtcGxhdGUgYW5kIGNoYW5nZSB3aXRob3V0IGEgZGVwbG95LlxuICAgKiBSZWFkIGl0IHdpdGggYGNmLmt2cygpYCwgbm8gSUQgbmVlZGVkLlxuICAgKiBAZGVmYXVsdCAtIG5vbmVcbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IHZpZXdlclJlcXVlc3RLZXlWYWx1ZVN0b3JlPzogYXdzX2Nsb3VkZnJvbnQuSUtleVZhbHVlU3RvcmU7XG4gIC8qKlxuICAgKiBDbG91ZEZyb250IEZ1bmN0aW9uIGNvZGUgcnVuIGZpcnN0IG9uIGV2ZXJ5IHZpZXdlciByZXF1ZXN0LCBvbiBldmVyeSBiZWhhdmlvciBjZGstbmV4dGpzIGFkZHMsIHN0YXRpYyBhc3NldHMgaW5jbHVkZWQg4oCUIEhUVFAgQmFzaWMgYXV0aCBvbiBhIHByZS1sYXVuY2ggc2l0ZSwgZ2VvLWdhdGluZy5cbiAgICogSXQgbXVzdCBkZWZpbmUgYHZpZXdlclJlcXVlc3QoZXZlbnQpYCAoYSBmdW5jdGlvbiwgc3luYyBvciBhc3luYywgb3IgYVxuICAgKiBgdmFyYC9gbGV0YC9gY29uc3RgKTogcmV0dXJuIGEgcmVzcG9uc2UgdG8gYW5zd2VyIHRoZSB2aWV3ZXIsIG9yIHRoZVxuICAgKiByZXF1ZXN0IChvciBub3RoaW5nKSB0byBjYXJyeSBvbi4gSXQgaXMgc3BsaWNlZCBpbnRvIGNkay1uZXh0anMncyBvd25cbiAgICogdmlld2VyLXJlcXVlc3QgZnVuY3Rpb25zLCBhaGVhZCBvZiB0aGVpciBsb2dpYywgc28gaXQgbWF5IG5vdCB1c2UgdGhlXG4gICAqIG5hbWUgYGhhbmRsZXJgLCBhbmQgdGhlIGNvbWJpbmVkIGZ1bmN0aW9uIG11c3QgZml0IENsb3VkRnJvbnQncyAxMCBLQi5cbiAgICogSXQgcnVucyBvbiBgY2xvdWRmcm9udC1qcy0yLjBgLCBzbyBpdCBtYXkgYmUgYXN5bmMgYW5kIHJlYWRcbiAgICoge0BsaW5rIHZpZXdlclJlcXVlc3RLZXlWYWx1ZVN0b3JlfSB3aXRoIGBjZi5rdnMoKWAuIEEgYnJpbmcteW91ci1vd25cbiAgICoge0BsaW5rIGRpc3RyaWJ1dGlvbn0ncyBkZWZhdWx0IGJlaGF2aW9yIGlzbid0IGNvdmVyZWQuXG4gICAqIEBkZWZhdWx0IC0gbm9uZVxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgdmlld2VyUmVxdWVzdEZ1bmN0aW9uQ29kZT86IGF3c19jbG91ZGZyb250LkZ1bmN0aW9uQ29kZTtcbiAgLyoqXG4gICAqIFRoZSBtb3N0IGNhY2hlIGJlaGF2aW9ycyB0aGUgZGlzdHJpYnV0aW9uIG1heSBoYXZlLCB0aGUgZGVmYXVsdCBvbmUgaW5jbHVkZWQuXG4gICAqIGNkay1uZXh0anMgY291bnRzIHdoYXQgaXQgYWRkcyBhZ2FpbnN0IHRoaXMgYXQgc3ludGgsIHNvIHJ1bm5pbmdcbiAgICogb3V0IGlzIGEgc3ludGggZXJyb3IgbmFtaW5nIHdoYXQgdXNlZCB0aGVtIHJhdGhlciB0aGFuIGEgZmFpbGVkIGRlcGxveS5cbiAgICpcbiAgICogUmFpc2UgaXQgYWZ0ZXIgcmFpc2luZyB0aGUgXCJDYWNoZSBiZWhhdmlvcnMgcGVyIGRpc3RyaWJ1dGlvblwiIHF1b3RhIGZvclxuICAgKiB5b3VyIGFjY291bnQuIExvd2VyIGl0IGJ5IHRoZSBiZWhhdmlvcnMgYSBzdXBwbGllZCB7QGxpbmsgZGlzdHJpYnV0aW9ufVxuICAgKiAob3IgYG92ZXJyaWRlcy5kaXN0cmlidXRpb25Qcm9wc2ApIGFscmVhZHkgaGFzLCB3aGljaCBhcmUgbm90IGNvdW50ZWQuXG4gICAqIEBkZWZhdWx0IDc1IC0gQ2xvdWRGcm9udCdzIGRlZmF1bHQgcXVvdGFcbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IG1heENhY2hlQmVoYXZpb3JzPzogbnVtYmVyO1xuICAvKipcbiAgICogUmVxdWlyZWQgaWYgYE5leHRqc1R5cGUuR0xPQkFMX0NPTlRBSU5FUlNgIG9yIGBOZXh0anNUeXBlLlJFR0lPTkFMX0NPTlRBSU5FUlNgLlxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgbG9hZEJhbGFuY2VyPzogYXdzX2VsYXN0aWNsb2FkYmFsYW5jaW5ndjIuSUFwcGxpY2F0aW9uTG9hZEJhbGFuY2VyO1xuICAvKipcbiAgICogUmVxdWlyZWQgaWYgYE5leHRqc1R5cGUuR0xPQkFMX0ZVTkNUSU9OU2AuXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBmdW5jdGlvblVybD86IGF3c19sYW1iZGEuSUZ1bmN0aW9uVXJsO1xuICAvKipcbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IGRpc3RyaWJ1dGlvbj86IGF3c19jbG91ZGZyb250LkRpc3RyaWJ1dGlvbjtcbiAgLyoqXG4gICAqIE9wdGlvbmFsIGJ1dCBvbmx5IGFwcGxpY2FibGUgZm9yIGBOZXh0anNUeXBlLkdMT0JBTF9DT05UQUlORVJTYC5cbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IGNlcnRpZmljYXRlPzogYXdzX2NlcnRpZmljYXRlbWFuYWdlci5JQ2VydGlmaWNhdGU7XG4gIC8qKlxuICAgKiBVUkkgcGF0aCBwcmVmaXggdGhlIGFwcCBpcyBzZXJ2ZWQgYXQuXG4gICAqIFN1cnJvdW5kaW5nIHNsYXNoZXMgYXJlIG5vcm1hbGl6ZWRcbiAgICogYXdheSwgc28gXCIvYmFzZVwiLCBcImJhc2VcIiBhbmQgXCIvYmFzZS9cIiBhbGwgcHJvZHVjZSB0aGUgc2FtZSBjYWNoZSBiZWhhdmlvcnMuXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBiYXNlUGF0aD86IHN0cmluZztcbiAgLyoqXG4gICAqIFRoZSBhcHAncyBvd24gYGFzc2V0UHJlZml4YC5cbiAgICogTmV4dC5qcyBlbWl0cyBgPGFzc2V0UHJlZml4Pi9fbmV4dC9zdGF0aWMvLi4uYFxuICAgKiBmb3IgZXZlcnkgYnVuZGxlIHdoaWxlIHRoZSBvYmplY3RzIHN0YXkgYXQgYDxiYXNlUGF0aD4vX25leHQvc3RhdGljLy4uLmAgaW5cbiAgICogUzMsIHNvIHRoZSBwcmVmaXgncyBwYXRoIGdldHMgYSBjYWNoZSBiZWhhdmlvciBvZiBpdHMgb3duIHRoYXQgcmV3cml0ZXMgaXRcbiAgICogYXdheS5cbiAgICpcbiAgICogRWl0aGVyIGZvcm0gaXMgYWNjZXB0ZWQ6IGEgcGF0aCAoXCIvY2RuXCIpLCBvciBhbiBhYnNvbHV0ZSBVUkwsIGluIHdoaWNoIGNhc2VcbiAgICogb25seSBpdHMgcGF0aCBjb3VudHMgKFwiaHR0cHM6Ly9jZG4uZXhhbXBsZS5jb20vY2RuXCIgYmVoYXZlcyBhcyBcIi9jZG5cIiwgYW5kXG4gICAqIFwiaHR0cHM6Ly9jZG4uZXhhbXBsZS5jb21cIiBuZWVkcyBubyBiZWhhdmlvciBhdCBhbGwpLiBBbiBhYnNvbHV0ZSBwcmVmaXgncyBwYXRoXG4gICAqIG1hdHRlcnMgYmVjYXVzZSBgbmV4dCBidWlsZGAgY29tcGlsZXMgYSBgL2Nkbi9fbmV4dC86cGF0aCtgIHJld3JpdGUgb2YgaXRzXG4gICAqIG93biwgc28gYG5leHQgc3RhcnRgIHNlcnZlcyBldmVyeSBidW5kbGUgdW5kZXIgaXQg4oCUIGEgQ0ROIGZyb250aW5nIHRoaXNcbiAgICogZGlzdHJpYnV0aW9uIHRoZXJlIGhhcyB0byBiZSBhbnN3ZXJlZCB0b28uXG4gICAqXG4gICAqIEFwcGxpZWQgb24gdG9wIG9mIGBiYXNlUGF0aGAsIG5vdCB1bmRlciBpdCwgYmVjYXVzZSB0aGF0IGlzIGhvdyBOZXh0LmpzXG4gICAqIGJ1aWxkcyB0aGUgVVJMLlxuICAgKiBAZGVmYXVsdCAtIG5vbmU7IHBhc3MgYE5leHRqc0J1aWxkLm5leHRDb25maWdBc3NldFByZWZpeFBhdGhgXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBhc3NldFByZWZpeD86IHN0cmluZztcbiAgLyoqXG4gICAqIEVudHJpZXMgKGZpbGVzL2RpcmVjdG9yaWVzKSB3aXRoaW4gTmV4dC5qcyBhcHAncyBwdWJsaWMgZGlyZWN0b3J5LiBVc2VkIHRvIGFkZCBzdGF0aWMgYmVoYXZpb3JzIHRvIGRpc3RyaWJ1dGlvbi5cbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IHB1YmxpY0RpckVudHJpZXM/OiBBcnJheTxQdWJsaWNEaXJFbnRyeT47XG4gIC8qKlxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgbmV4dGpzVHlwZT86IE5leHRqc1R5cGU7XG4gIC8qKlxuICAgKiBCdWNrZXQgY29udGFpbmluZyBzdGF0aWMgYXNzZXRzLlxuICAgKiBNdXN0IGJlIHByb3ZpZGVkIGlmIHlvdSB3YW50IHRvIHNlcnZlIHN0YXRpYyBmaWxlcy5cbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IGFzc2V0c0J1Y2tldD86IGF3c19zMy5JQnVja2V0O1xufVxuIl19

package/lib/nextjs-api.js

@@ -22,7 +22,7 @@ const API_PATH_PART = /^[a-zA-Z0-9:._\-$]+$/;
  * Creates an API Gateway REST API for Next.js applications
  */
 class NextjsApi extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-nextjs.NextjsApi", version: "0.7.12" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-nextjs.NextjsApi", version: "0.7.13" };
     /**
      * The API Gateway REST API
      */

package/lib/nextjs-build/nextjs-build.js

@@ -66,7 +66,7 @@ function deploymentArchitecture(props) {
  * @link https://nextjs.org/docs/pages/api-reference/next-config-js/output
  */
 class NextjsBuild extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-nextjs.NextjsBuild", version: "0.7.12" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-nextjs.NextjsBuild", version: "0.7.13" };
     /**
      * Unique id for this deployment. Used to partition cache storage and as
      * metadata for static assets in S3 bucket.

package/lib/nextjs-cache.js

@@ -86,7 +86,7 @@ function sizeOfDirectory(dir) {
  * Next.js Cache construct providing unified S3 and DynamoDB cache management.
  */
 class NextjsCache extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-nextjs.NextjsCache", version: "0.7.12" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-nextjs.NextjsCache", version: "0.7.13" };
     cacheBucket;
     revalidationTable;
     buildId;

package/lib/nextjs-compute/nextjs-containers.js

@@ -19,7 +19,7 @@ const constants_1 = require("../constants");
  * Fargate.
  */
 class NextjsContainers extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-nextjs.NextjsContainers", version: "0.7.12" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-nextjs.NextjsContainers", version: "0.7.13" };
     albFargateService;
     ecsCluster;
     url;

package/lib/nextjs-compute/nextjs-functions.js

@@ -23,7 +23,7 @@ const zip_directory_1 = require("../utils/zip-directory");
  * `awslambda.streamifyResponse` directly.
  */
 class NextjsFunctions extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-nextjs.NextjsFunctions", version: "0.7.12" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-nextjs.NextjsFunctions", version: "0.7.13" };
     /**
      * The `default` group's function: the one the distribution's default behavior
      * targets, and the only one at all unless `functionGroups` is used.

package/lib/nextjs-distribution.d.ts

@@ -1,5 +1,5 @@
 import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
-import { AddBehaviorOptions, CachePolicyProps, Distribution, ResponseHeadersPolicyProps } from "aws-cdk-lib/aws-cloudfront";
+import { AddBehaviorOptions, CachePolicyProps, Distribution, FunctionCode, IKeyValueStore, ResponseHeadersPolicyProps } from "aws-cdk-lib/aws-cloudfront";
 import { FunctionUrlOriginWithOACProps, VpcOriginWithEndpointProps } from "aws-cdk-lib/aws-cloudfront-origins";
 import { IApplicationLoadBalancer } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { IFunctionUrl } from "aws-cdk-lib/aws-lambda";
@@ -101,6 +101,34 @@ export interface NextjsDistributionProps {
      * @see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-limits.html#limits-web-distributions
      */
     readonly maxCacheBehaviors?: number;
+    /**
+     * CloudFront Function code run first on every viewer request, on every
+     * behavior cdk-nextjs adds, static assets included — HTTP Basic auth on a
+     * pre-launch site, geo-gating.
+     *
+     * It must define `viewerRequest(event)` (a function, sync or async, or a
+     * `var`/`let`/`const`): return a response to answer the viewer, or the
+     * request (or nothing) to carry on. It is spliced into cdk-nextjs's own
+     * viewer-request functions, ahead of their logic, so it may not use the
+     * name `handler`, and the combined function must fit CloudFront's 10 KB.
+     * It runs on `cloudfront-js-2.0`, so it may be async and read
+     * {@link viewerRequestKeyValueStore} with `cf.kvs()`. A bring-your-own
+     * {@link distribution}'s default behavior isn't covered.
+     *
+     * @default - none
+     * @see https://github.com/cdklabs/cdk-nextjs#running-code-on-every-viewer-request
+     */
+    readonly viewerRequestFunctionCode?: FunctionCode;
+    /**
+     * A CloudFront KeyValueStore associated with every viewer-request function
+     * {@link viewerRequestFunctionCode} is copied into (up to three, one per kind
+     * of behavior), so values it reads — Basic auth credentials, an allowlist —
+     * live outside the CloudFormation template and change without a deploy.
+     * Read it with `cf.kvs()`, no ID needed.
+     * @default - none
+     * @see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/functions-custom-methods.html
+     */
+    readonly viewerRequestKeyValueStore?: IKeyValueStore;
 }
 /** A non-default function group and the origin its routes must reach. */
 export interface NextjsDistributionFunctionGroup {
@@ -134,6 +162,18 @@ export declare class NextjsDistribution extends Construct {
     private dynamicOrigin;
     private dynamicOriginResponsePolicy;
     private dynamicCloudFrontFunctionAssociations;
+    /**
+     * `viewerRequestFunctionCode`, rendered and checked once, since
+     * `FunctionCode.fromFile` reads the file on every render.
+     */
+    private viewerRequestCode?;
+    /**
+     * The viewer-request function `viewerRequestFunctionCode` adds to behaviors
+     * with no viewer-request logic of their own, shared by all of them, so the
+     * `assetPrefix` behavior, which has a viewer-request function of its own,
+     * can tell it from an override's.
+     */
+    private passThroughFunction?;
     private isFunctionCompute;
     private staticBehaviorOptions;
     private dynamicBehaviorOptions;
@@ -168,11 +208,40 @@ export declare class NextjsDistribution extends Construct {
      * @see https://open-next.js.org/advanced/workaround#workaround-set-x-forwarded-host-header-aws-specific
      */
     private createDynamicCloudFrontFunctionAssociations;
+    /**
+     * The function a behavior with no viewer-request logic of its own gets when
+     * `viewerRequestFunctionCode` is set, created on first use.
+     */
+    private getPassThroughFunction;
+    /**
+     * The code, runtime and KeyValueStore of a function whose `handler` is
+     * cdk-nextjs's, with `viewerRequestFunctionCode` spliced in
+     * ({@link spliceViewerRequest}) and checked against CloudFront's size limit.
+     *
+     * Every one runs on `cloudfront-js-2.0`, the runtime AWS recommends and the
+     * one with `async` and KeyValueStores, so the handlers are all `async`
+     * whether or not there is user code to await.
+     */
+    private viewerRequestFunctionProps;
+    /**
+     * `viewerRequestFunctionCode`, rendered once, since `FunctionCode.fromFile`
+     * reads the file on every render, and checked
+     * ({@link checkViewerRequestCode}).
+     */
+    private renderViewerRequestCode;
+    /**
+     * CloudFront allows one function per event type per behavior, so an
+     * override's viewer-request association and one cdk-nextjs needs can't both
+     * be kept. Thrown at synth, where both halves are known, rather than left to
+     * a deploy that names neither.
+     */
+    private assertViewerRequestUnclaimed;
     private createStaticBehaviorOptions;
     private createDynamicBehaviorOptions;
     /**
      * The behavior's function associations: an override's, plus the viewer-request
-     * function Global Functions depends on.
+     * function Global Functions depends on, or the one `viewerRequestFunctionCode`
+     * adds on Global Containers.
      *
      * Spreading the override's `functionAssociations` over ours would silently
      * drop that function, and with it the only thing standing between a viewer's