vpndetection-next 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mslm Dev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,170 @@
+# [<img src="https://s3.vpndetection.io/vpndetection-public/brand/mark.svg" alt="VPNDetection" width="24"/>](https://vpndetection.io/) VPNDetection Next.js Middleware
+
+[![npm](https://img.shields.io/npm/v/vpndetection-next.svg)](https://www.npmjs.com/package/vpndetection-next)
+[![license](https://img.shields.io/npm/l/vpndetection-next.svg)](LICENSE)
+
+The official [Next.js](https://nextjs.org) proxy middleware for the [VPNDetection](https://vpndetection.io) API.
+
+It classifies the visitor behind each request — VPN, residential proxy, Tor, hosting, CDN, relay — and forwards the answer to your app, where Server Components and Route Handlers can read it. Blocking is opt-in.
+
+## Getting Started
+
+```bash
+npm install vpndetection-next
+```
+
+Requires Node.js 22 or newer and Next.js 15 or newer.
+
+You need an API key. Create one in the [console](https://app.vpndetection.io); the free tier's allowance is counted per source address, and a deployment is a single source address, so a key is what makes this usable in production rather than optional.
+
+Next 16 renamed the file convention from `middleware.ts` to `proxy.ts`, and the export from `middleware` to `proxy`. Both work on 16 — `middleware.ts` logs a deprecation — so use whichever your version supports.
+
+```ts
+// proxy.ts  (middleware.ts on Next 15)
+import { createProxy } from 'vpndetection-next';
+
+export const proxy = createProxy({ apiKey: process.env.VPNDETECTION_API_KEY });
+
+export const config = { matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'] };
+```
+
+Then read the answer anywhere downstream:
+
+```tsx
+// app/page.tsx
+import { headers } from 'next/headers';
+import { readLookup } from 'vpndetection-next';
+
+export default async function Page() {
+    const lookup = readLookup(await headers());
+    return <main>{lookup?.isVpn ? 'Hello, VPN user' : 'Hello'}</main>;
+}
+```
+
+By default nothing is blocked. Your own code decides what the answer means — which is usually what you want, because whether a VPN visitor is a problem depends entirely on what they are doing.
+
+**Set a `matcher`.** Without one the proxy runs on every request including static assets, which costs a lookup each.
+
+## Blocking
+
+Pass a `blockCondition` and a matching request is answered with `403` and never reaches your app.
+
+```ts
+export const proxy = createProxy({
+    apiKey: process.env.VPNDETECTION_API_KEY,
+    blockCondition: { isVpn: true },
+});
+```
+
+A condition is written in the shape of a result, and only the members you name are considered. That lets it reach the evidence, not just the flags:
+
+```ts
+blockCondition: { isVpn: true, vpn: { provider: 'nordvpn' } }         // one provider
+blockCondition: { isResproxy: true, resproxy: { hits: { gte: 5 } } }  // a numeric threshold
+blockCondition: { vpn: { confidence: ['high', 'medium'] } }           // any of these
+blockCondition: [{ isTor: true }, { isResproxy: true }]               // a list is OR
+```
+
+Values are matched by equality, strings without regard to case. An array means any-of. `{ gte, gt, lte, lt }` compares numbers, and every bound you give must hold, so two of them are a range. Members you set to `false` or `null` are ignored, so a condition states the signals you act on; one that constrains nothing would match every request, and is refused when the proxy is created rather than silently blocking all your traffic.
+
+Replace the refusal with `onBlocked` — a redirect is usually friendlier than a 403:
+
+```ts
+onBlocked: (request) => NextResponse.redirect(new URL('/no-vpn', request.url)),
+```
+
+## Doing other work in the same proxy
+
+Most apps already have a proxy. Use `createGuard` and call it from yours:
+
+```ts
+import { NextResponse } from 'next/server';
+import { createGuard } from 'vpndetection-next';
+
+const guard = createGuard({ apiKey: process.env.VPNDETECTION_API_KEY });
+
+export async function proxy(request: NextRequest) {
+    const lookup = await guard(request);
+    if (lookup?.result?.isTor) {
+        return NextResponse.redirect(new URL('/verify', request.url));
+    }
+    return guard.forward(request, lookup);
+}
+```
+
+`guard.forward` continues to your app carrying the answer. Return it rather than a bare `NextResponse.next()`, or nothing downstream can read the lookup.
+
+## Where the client address comes from
+
+This is the setting that decides whether any of the above works, and Next makes it more your problem than most frameworks do.
+
+**Next has no socket peer to offer.** `NextRequest.ip` was removed in Next 15, and a proxy runs ahead of the server, so a forwarded header is the only address available — this is the one place where the default is a header rather than a connection.
+
+The default reads the left-most `X-Forwarded-For` entry. That is correct when the platform in front of you **overwrites** the header, which Vercel does and any ingress you control can be configured to. Behind something that **appends**, the left-most entry is whatever the visitor sent, and detection silently does nothing.
+
+For a platform that writes its own header, name it:
+
+```ts
+import { headerIpSelector } from 'vpndetection-next';
+
+createProxy({
+    apiKey: process.env.VPNDETECTION_API_KEY,
+    ipSelector: headerIpSelector('CF-Connecting-IP'),  // or True-Client-IP, or your own
+});
+```
+
+If you know how many proxies sit in front, count from the right: `xffIpSelector({ depth: 1 })` is the address your nearest proxy saw. Anything else, pass your own function — it receives the `NextRequest` and returns an address.
+
+If the address resolves to a private one, or to nothing at all, the proxy says so once on `console.warn`. That is expected running locally and is the signal to fix your configuration anywhere else.
+
+## The forwarded header
+
+The answer travels to your app on `x-vpndetection`, because a proxy runs in its own context and a request header is the only thing that crosses into it.
+
+**Any copy the caller sent is deleted before ours is written.** That overwrite is the entire basis of trusting it downstream — without it a visitor could set the header themselves and tell your app whatever they liked about their own address. It is the same rule an ingress follows for a real-IP header, and it holds even when the request was skipped.
+
+Turn it off with `forward: false` if you only ever block and never read the answer.
+
+## When a lookup fails
+
+The request is let through, and the reason is on `lookup.error`. Our outage should not become yours, so a network failure, an exhausted quota or a rejected key all fail open. Pass `failClosed: true` to block instead.
+
+## Cost and latency
+
+Answers are cached for an hour per proxy instance, so a returning visitor costs nothing, and private addresses never leave the process. A cache miss is one request to our API, bounded at 2500 ms by default and not retried — on a request path, failing open quickly beats holding a visitor while we try again.
+
+```ts
+createProxy({ apiKey: KEY, timeoutMs: 1000, retries: 1, cache: { max: 50000, ttlMs: 600000 } })
+```
+
+A serverless deployment gets less from the cache than a long-running one, because the instance holding it is short-lived. Narrow the `matcher`, or `skip` what you do not care about:
+
+```ts
+skip: (request) => request.nextUrl.pathname.startsWith('/api/health'),
+```
+
+Beyond a few million distinct visitors a day, stop calling the API per request: [download the dataset](https://vpndetection.io/databases) and look addresses up locally instead.
+
+## Absent is not false
+
+Only `ip` and `isVpn` come back on every plan. A field your plan does not include is absent, which means "not in your plan" rather than "checked, and no".
+
+```ts
+lookup.result?.is_hosting ?? false   // when you only want the flag
+```
+
+A `blockCondition` naming a member your plan does not serve can never match, so the proxy warns once instead of failing silently. Set `onMissingField: 'throw'` to make it an error.
+
+## Other Libraries
+
+There are official VPNDetection client libraries available for many languages including PHP, Python, Go, Java, Ruby, and many popular frameworks such as Django, Rails, and Laravel. See our GitHub at https://github.com/vpndetection-io for more.
+
+## About VPNDetection
+
+VPN Detection API: Accurate anonymity detection identifying VPNs, residential proxies, hosting servers, Tor nodes, CDNs, relays and more.
+
+[<img src="https://s3.vpndetection.io/vpndetection-public/brand/mark.svg" alt="VPNDetection" width="96"/>](https://vpndetection.io/)
+
+## License
+
+This project is licensed under the [MIT License](LICENSE).

package/dist/index.d.ts

@@ -0,0 +1,104 @@
+import type { IpSelector, Lookup, MiddlewareOptions } from 'vpndetection/middleware';
+import { NextResponse } from 'next/server.js';
+import type { NextRequest } from 'next/server.js';
+export type { BlockCondition, IpSelector, Lookup, NumericBound } from 'vpndetection/middleware';
+/**
+ * The header the answer is forwarded on, so a Server Component or Route
+ * Handler can read what the proxy already looked up.
+ */
+export declare const LOOKUP_HEADER = "x-vpndetection";
+/** What `readLookup` gives back. The detail objects are carried through as served. */
+export interface ForwardedLookup {
+    ip?: string;
+    isVpn?: boolean;
+    blocked: boolean;
+    error?: string;
+    result?: Record<string, unknown>;
+}
+export interface Options extends MiddlewareOptions<NextRequest> {
+    /**
+     * How a blocked request is answered. Defaults to `403` with a short JSON
+     * body. Return a `NextResponse`.
+     */
+    onBlocked?: (request: NextRequest, lookup: Lookup) => NextResponse | Promise<NextResponse>;
+    /**
+     * Forward the answer to your app on {@link LOOKUP_HEADER}, so a Server
+     * Component or Route Handler can read it with `readLookup`. Defaults to
+     * true. The proxy runs in its own context, so a header is the only way the
+     * answer reaches the rest of your app.
+     */
+    forward?: boolean;
+}
+/**
+ * A ready-made `proxy` export.
+ *
+ * ```ts
+ * // proxy.ts
+ * export const proxy = createProxy({ apiKey: process.env.VPNDETECTION_API_KEY });
+ * ```
+ *
+ * If your proxy already does other work, use {@link createGuard} instead and
+ * call it from your own function.
+ */
+export declare function createProxy(options?: Options): (request: NextRequest) => Promise<NextResponse>;
+/**
+ * Classify the visitor, for a proxy that does other work too.
+ *
+ * ```ts
+ * const guard = createGuard({ apiKey: process.env.VPNDETECTION_API_KEY });
+ *
+ * export async function proxy(request: NextRequest) {
+ *     const lookup = await guard(request);
+ *     if (lookup?.result?.isVpn) {
+ *         return NextResponse.redirect(new URL('/no-vpn', request.url));
+ *     }
+ *     return guard.forward(request, lookup);
+ * }
+ * ```
+ */
+export declare function createGuard(options?: Options): {
+    (request: NextRequest): Promise<Lookup | undefined>;
+    forward(request: NextRequest, lookup: Lookup | undefined): NextResponse;
+};
+/**
+ * Read what the proxy found, from a Server Component or Route Handler.
+ *
+ * ```ts
+ * import { headers } from 'next/headers';
+ * const lookup = readLookup(await headers());
+ * ```
+ *
+ * Answers `undefined` when the proxy did not run for this route, when `skip`
+ * claimed the request, or when `forward` was turned off.
+ */
+export declare function readLookup(source: Headers | {
+    get(name: string): string | null;
+}): ForwardedLookup | undefined;
+/**
+ * The left-most `X-Forwarded-For` entry.
+ *
+ * **Next has no socket peer to offer.** `NextRequest.ip` was removed in Next
+ * 15, and a proxy runs ahead of the server, so a forwarded header is the only
+ * address available - which makes this the one adapter whose default is a
+ * header rather than a connection.
+ *
+ * That is safe exactly when the platform in front of you OVERWRITES the header
+ * (Vercel does, and so does any ingress you control that is configured to).
+ * Behind something that APPENDS, the left-most entry is whatever the visitor
+ * sent: use `headerIpSelector` for your platform's own header, or
+ * `xffIpSelector({ depth })` to count from the right.
+ */
+export declare const defaultIpSelector: IpSelector<NextRequest>;
+/**
+ * An address from `X-Forwarded-For`, left-most by default. `depth: 1` is the
+ * address your nearest proxy saw, for a known number of trusted hops.
+ */
+export declare const xffIpSelector: (options?: {
+    depth?: number;
+}) => IpSelector<NextRequest>;
+/**
+ * An address from a single-value header your platform writes -
+ * `headerIpSelector('CF-Connecting-IP')` behind Cloudflare,
+ * `headerIpSelector('True-Client-IP')` behind Akamai.
+ */
+export declare const headerIpSelector: (name: string) => IpSelector<NextRequest>;

package/dist/index.js

@@ -0,0 +1,149 @@
+import { bindSelectors, createCore } from 'vpndetection/middleware';
+import { NextResponse } from 'next/server.js';
+/**
+ * The header the answer is forwarded on, so a Server Component or Route
+ * Handler can read what the proxy already looked up.
+ */
+export const LOOKUP_HEADER = 'x-vpndetection';
+/**
+ * A ready-made `proxy` export.
+ *
+ * ```ts
+ * // proxy.ts
+ * export const proxy = createProxy({ apiKey: process.env.VPNDETECTION_API_KEY });
+ * ```
+ *
+ * If your proxy already does other work, use {@link createGuard} instead and
+ * call it from your own function.
+ */
+export function createProxy(options = {}) {
+    const guard = createGuard(options);
+    const onBlocked = options.onBlocked ?? refuse;
+    return async function proxy(request) {
+        const lookup = await guard(request);
+        if (lookup?.blocked) {
+            return onBlocked(request, lookup);
+        }
+        return guard.forward(request, lookup);
+    };
+}
+/**
+ * Classify the visitor, for a proxy that does other work too.
+ *
+ * ```ts
+ * const guard = createGuard({ apiKey: process.env.VPNDETECTION_API_KEY });
+ *
+ * export async function proxy(request: NextRequest) {
+ *     const lookup = await guard(request);
+ *     if (lookup?.result?.isVpn) {
+ *         return NextResponse.redirect(new URL('/no-vpn', request.url));
+ *     }
+ *     return guard.forward(request, lookup);
+ * }
+ * ```
+ */
+export function createGuard(options = {}) {
+    const core = createCore(options, defaultIpSelector);
+    const forwarding = options.forward !== false;
+    const guard = async (request) => core.evaluate(request);
+    /**
+     * Continue to your app, carrying the answer on {@link LOOKUP_HEADER}.
+     *
+     * **Any copy the caller sent is deleted first**, which is the entire basis
+     * of trusting it downstream: without that overwrite a visitor could set the
+     * header themselves and tell your app whatever they liked about their own
+     * address.
+     */
+    guard.forward = (request, lookup) => {
+        const headers = new Headers(request.headers);
+        headers.delete(LOOKUP_HEADER);
+        if (forwarding && lookup !== undefined) {
+            headers.set(LOOKUP_HEADER, JSON.stringify(toForwarded(lookup)));
+        }
+        return NextResponse.next({ request: { headers: headers } });
+    };
+    return guard;
+}
+/**
+ * Read what the proxy found, from a Server Component or Route Handler.
+ *
+ * ```ts
+ * import { headers } from 'next/headers';
+ * const lookup = readLookup(await headers());
+ * ```
+ *
+ * Answers `undefined` when the proxy did not run for this route, when `skip`
+ * claimed the request, or when `forward` was turned off.
+ */
+export function readLookup(source) {
+    const raw = source.get(LOOKUP_HEADER);
+    if (raw === null || raw === '') {
+        return undefined;
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+const view = (request) => ({
+    header: (name) => request.headers.get(name) ?? undefined,
+    frameworkIp: () => firstForwarded(request),
+});
+// Each of these is annotated rather than inferred: the inferred shape reaches
+// through `next`'s own types into its transitive ones, which TypeScript refuses
+// to name in a declaration file a consumer would have to resolve.
+const selectors = bindSelectors(view);
+/**
+ * The left-most `X-Forwarded-For` entry.
+ *
+ * **Next has no socket peer to offer.** `NextRequest.ip` was removed in Next
+ * 15, and a proxy runs ahead of the server, so a forwarded header is the only
+ * address available - which makes this the one adapter whose default is a
+ * header rather than a connection.
+ *
+ * That is safe exactly when the platform in front of you OVERWRITES the header
+ * (Vercel does, and so does any ingress you control that is configured to).
+ * Behind something that APPENDS, the left-most entry is whatever the visitor
+ * sent: use `headerIpSelector` for your platform's own header, or
+ * `xffIpSelector({ depth })` to count from the right.
+ */
+export const defaultIpSelector = selectors.defaultIpSelector;
+/**
+ * An address from `X-Forwarded-For`, left-most by default. `depth: 1` is the
+ * address your nearest proxy saw, for a known number of trusted hops.
+ */
+export const xffIpSelector = selectors.xffIpSelector;
+/**
+ * An address from a single-value header your platform writes -
+ * `headerIpSelector('CF-Connecting-IP')` behind Cloudflare,
+ * `headerIpSelector('True-Client-IP')` behind Akamai.
+ */
+export const headerIpSelector = selectors.headerIpSelector;
+function firstForwarded(request) {
+    const chain = request.headers.get('x-forwarded-for');
+    if (chain === null) {
+        return undefined;
+    }
+    const first = chain.split(',')[0]?.trim();
+    return first === '' ? undefined : first;
+}
+// Deliberately compact. This rides on a request header, which has a size limit
+// every proxy in front of you enforces, so it carries the decision and the
+// served body rather than a second copy of the idiomatic view.
+function toForwarded(lookup) {
+    return {
+        ...(lookup.ip === undefined ? {} : { ip: lookup.ip }),
+        ...(lookup.result === undefined ? {} : {
+            isVpn: lookup.result.isVpn,
+            result: lookup.result.raw,
+        }),
+        ...(lookup.error === undefined ? {} : { error: lookup.error.kind }),
+        blocked: lookup.blocked,
+    };
+}
+function refuse() {
+    return NextResponse.json({ error: 'access denied' }, { status: 403 });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGpE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAK9C;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AA0B9C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,UAAmB,EAAE;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAE9C,OAAO,KAAK,UAAU,KAAK,CAAC,OAAoB;QAC5C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,UAAmB,EAAE;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAc,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC;IAE7C,MAAM,KAAK,GAAG,KAAK,EAAE,OAAoB,EAA+B,EAAE,CACtE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE3B;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,GAAG,CAAC,OAAoB,EAAE,MAA0B,EAAgB,EAAE;QAC/E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9B,IAAI,UAAU,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,MAAsD;IAE7E,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACtC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,OAAoB,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS;IAChE,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC;CAC7C,CAAC,CAAC;AAEH,8EAA8E;AAC9E,gFAAgF;AAChF,kEAAkE;AAClE,MAAM,SAAS,GAAG,aAAa,CAAc,IAAI,CAAC,CAAC;AAEnD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA4B,SAAS,CAAC,iBAAiB,CAAC;AAEtF;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GACpB,SAAS,CAAC,aAAa,CAAC;AAE9B;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GACvB,SAAS,CAAC,gBAAgB,CAAC;AAEjC,SAAS,cAAc,CAAC,OAAoB;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1C,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,2EAA2E;AAC3E,+DAA+D;AAC/D,SAAS,WAAW,CAAC,MAAc;IAC/B,OAAO;QACH,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QACrD,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;YAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAyC;SAClE,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,CAAC,OAAO;KAC1B,CAAC;AACN,CAAC;AAED,SAAS,MAAM;IACX,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC1E,CAAC"}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "vpndetection-next",
+  "version": "1.0.0",
+  "description": "Official Next.js proxy/middleware for the VPNDetection API. Detect VPNs, proxies, Tor, hosting and CDN visitors on every request.",
+  "type": "module",
+  "license": "MIT",
+  "homepage": "https://vpndetection.io",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vpndetection-io/sdk-nodejs-nextjs.git"
+  },
+  "bugs": {
+    "url": "https://github.com/vpndetection-io/sdk-nodejs-nextjs/issues"
+  },
+  "keywords": [
+    "nextjs",
+    "next",
+    "proxy",
+    "middleware",
+    "vpn",
+    "vpn-detection",
+    "proxy-detection",
+    "tor",
+    "ip-intelligence",
+    "fraud-prevention",
+    "bot-detection",
+    "hosting"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "dependencies": {
+    "vpndetection": "^1.8.0"
+  },
+  "peerDependencies": {
+    "next": ">=15"
+  },
+  "devDependencies": {
+    "@types/node": "^26.2.0",
+    "next": "16.3.4",
+    "react": "19.2.0",
+    "typescript": "^5.9.3"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc",
+    "test": "pnpm run build && node --test test/*.test.mjs"
+  }
+}