@becklyn/deployment-protection 0.3.0 → 0.4.1

package/README.md

@@ -1,6 +1,6 @@
 # `@becklyn/deployment-protection`
 
-Simple, shared deployment gate for Next.js apps on Vercel.
+Simple, shared deployment gate for Next.js apps and static Storybook deploys on Vercel.
 
 Use this instead of (or after disabling) Vercel platform Deployment Protection when you need:
 
@@ -9,7 +9,10 @@ Use this instead of (or after disabling) Vercel platform Deployment Protection w
 - always-on **automation bypass** via `x-vercel-protection-bypass` / `VERCEL_AUTOMATION_BYPASS_SECRET`
 - a kill switch (`DEPLOYMENT_PROTECTION_ENABLED`, on by default)
 
-Protection runs in Next.js **middleware** (Next ≤15) or **proxy** (Next 16+).
+Protection runs in:
+
+- Next.js **middleware** (Next ≤15) or **proxy** (Next 16+)
+- **Vercel Edge Middleware** for static Storybook (`@becklyn/deployment-protection/storybook`)
 
 > **Note:** Vercel Connect is unrelated (third-party API tokens). Platform Vercel Authentication cookies are not visible to your app once platform protection is off — team members use the **Sign in with Vercel** button instead.
 
@@ -21,7 +24,47 @@ npm i @becklyn/deployment-protection
 
 ## Quick setup
 
-### 1. Middleware / proxy
+### Storybook (static on Vercel)
+
+Built Storybook is static (`storybook-static`), so protection is **Vercel Routing Middleware** — not a Storybook addon.
+
+1. Install the package in the project that deploys Storybook (published build, or workspace package after `npm run build`).
+2. Add `middleware.ts` at the **Vercel project root** (same level Vercel uses for `vercel.json` / output):
+
+```ts
+import { withStorybookDeploymentProtection } from "@becklyn/deployment-protection/storybook";
+
+export default withStorybookDeploymentProtection();
+
+export const config = {
+    matcher: ["/((?!.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?|mjs)$).*)"],
+};
+```
+
+3. Set the same environment variables as for Next.js (below).
+4. `vercel.json` for a Storybook-only project — **`framework` must be `null`** (Other). Do **not** use the Vercel “Storybook” framework preset; it sets `disableRootMiddleware` and skips middleware entirely:
+
+```json
+{
+    "buildCommand": "npm run build-storybook",
+    "outputDirectory": "storybook-static",
+    "framework": null
+}
+```
+
+`withStorybookDeploymentProtection` does **not** require the `next` package. The matcher must stay a **string literal** in `middleware.ts` (same static-analysis rule as Next.js).
+
+Prefer the default **edge** runtime. `runtime: "nodejs"` is supported as well — both resolve to a self-contained ESM bundle (`dist/storybook.mjs` / `dist/edge.mjs`) so Vercel does not need to trace the multi-file tsc graph.
+
+Framework-agnostic alias (same implementation):
+
+```ts
+import { withEdgeDeploymentProtection } from "@becklyn/deployment-protection/edge";
+
+export default withEdgeDeploymentProtection();
+```
+
+### 1. Next.js middleware / proxy
 
 Next.js requires `config.matcher` to be a **string literal in the local middleware/proxy file**.
 It cannot be imported from a package (Next analyzes the matcher statically at build time).
@@ -205,10 +248,13 @@ import {
     handleDeploymentProtection,
     resolveConfig,
     withDeploymentProtection,
+    withEdgeDeploymentProtection,
 } from "@becklyn/deployment-protection";
+import { withStorybookDeploymentProtection } from "@becklyn/deployment-protection/storybook";
 ```
 
-- `withDeploymentProtection(options?)` / `withDeploymentProtection(next, options?)` — middleware/proxy factory
+- `withDeploymentProtection(options?)` / `withDeploymentProtection(next, options?)` — Next.js middleware/proxy factory
+- `withStorybookDeploymentProtection(options?)` / `withEdgeDeploymentProtection(options?)` — Vercel Edge Middleware for Storybook / static deploys (no Next.js)
 - `handleDeploymentProtection(request, options?)` — framework-agnostic core (`null` = continue)
 - `handleAuthProxyStart` / `handleAuthProxyCallback` — central auth-proxy routes
 

package/dist/cjs/edge.d.ts

@@ -0,0 +1,14 @@
+import type { DeploymentProtectionOptions } from "./types";
+/**
+ * Tell Vercel Edge Middleware to continue to the upstream / static asset.
+ * Same signal as `NextResponse.next()` without depending on the Next.js runtime.
+ */
+export declare function middlewarePassThrough(): Response;
+/**
+ * Framework-agnostic Vercel Edge Middleware factory (no Next.js runtime).
+ *
+ * Intended for static deployments such as Storybook `storybook-static` on Vercel.
+ * Reuses the same env vars and auth behaviour as {@link withDeploymentProtection}.
+ */
+export declare function withEdgeDeploymentProtection(options?: DeploymentProtectionOptions): (request: Request) => Promise<Response>;
+//# sourceMappingURL=edge.d.ts.map

package/dist/cjs/edge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge.d.ts","sourceRoot":"","sources":["../../src/edge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC;AAE3D;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,QAAQ,CAOhD;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,GAAE,2BAAgC,IACzB,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAShG"}

package/dist/cjs/edge.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.middlewarePassThrough = middlewarePassThrough;
+exports.withEdgeDeploymentProtection = withEdgeDeploymentProtection;
+const handler_1 = require("./handler");
+/**
+ * Tell Vercel Edge Middleware to continue to the upstream / static asset.
+ * Same signal as `NextResponse.next()` without depending on the Next.js runtime.
+ */
+function middlewarePassThrough() {
+    return new Response(null, {
+        status: 200,
+        headers: {
+            "x-middleware-next": "1",
+        },
+    });
+}
+/**
+ * Framework-agnostic Vercel Edge Middleware factory (no Next.js runtime).
+ *
+ * Intended for static deployments such as Storybook `storybook-static` on Vercel.
+ * Reuses the same env vars and auth behaviour as {@link withDeploymentProtection}.
+ */
+function withEdgeDeploymentProtection(options = {}) {
+    return async function deploymentProtectionEdgeMiddleware(request) {
+        const protectionResponse = await (0, handler_1.handleDeploymentProtection)(request, options);
+        if (protectionResponse) {
+            return protectionResponse;
+        }
+        return middlewarePassThrough();
+    };
+}

package/dist/cjs/index.d.ts

@@ -2,6 +2,7 @@ export { INTERNAL_PATH_PREFIX, VERCEL_AUTHORIZE_PATH, VERCEL_CALLBACK_PATH } fro
 export { AUTH_PROXY_CALLBACK_PATH, AUTH_PROXY_START_PATH, handleAuthProxyCallback, handleAuthProxyStart, } from "./auth-proxy";
 export { handleDeploymentProtection } from "./handler";
 export { withDeploymentProtection } from "./middleware";
+export { middlewarePassThrough, withEdgeDeploymentProtection } from "./edge";
 export { resolveConfig, hasPasswordAuth, hasVercelAuth, hasVercelDirectAuth, hasVercelProxyAuth, isProtectionActive, } from "./config";
 export type { AuthMethod, DeploymentProtectionConfig, DeploymentProtectionOptions, FormOptions, SessionPayload, } from "./types";
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EACH,wBAAwB,EACxB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EACH,aAAa,EACb,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,GACrB,MAAM,UAAU,CAAC;AAClB,YAAY,EACR,UAAU,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,cAAc,GACjB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EACH,wBAAwB,EACxB,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,QAAQ,CAAC;AAC7E,OAAO,EACH,aAAa,EACb,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,GACrB,MAAM,UAAU,CAAC;AAClB,YAAY,EACR,UAAU,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,WAAW,EACX,cAAc,GACjB,MAAM,SAAS,CAAC"}

package/dist/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isProtectionActive = exports.hasVercelProxyAuth = exports.hasVercelDirectAuth = exports.hasVercelAuth = exports.hasPasswordAuth = exports.resolveConfig = exports.withDeploymentProtection = exports.handleDeploymentProtection = exports.handleAuthProxyStart = exports.handleAuthProxyCallback = exports.AUTH_PROXY_START_PATH = exports.AUTH_PROXY_CALLBACK_PATH = exports.VERCEL_CALLBACK_PATH = exports.VERCEL_AUTHORIZE_PATH = exports.INTERNAL_PATH_PREFIX = void 0;
+exports.isProtectionActive = exports.hasVercelProxyAuth = exports.hasVercelDirectAuth = exports.hasVercelAuth = exports.hasPasswordAuth = exports.resolveConfig = exports.withEdgeDeploymentProtection = exports.middlewarePassThrough = exports.withDeploymentProtection = exports.handleDeploymentProtection = exports.handleAuthProxyStart = exports.handleAuthProxyCallback = exports.AUTH_PROXY_START_PATH = exports.AUTH_PROXY_CALLBACK_PATH = exports.VERCEL_CALLBACK_PATH = exports.VERCEL_AUTHORIZE_PATH = exports.INTERNAL_PATH_PREFIX = void 0;
 var constants_1 = require("./constants");
 Object.defineProperty(exports, "INTERNAL_PATH_PREFIX", { enumerable: true, get: function () { return constants_1.INTERNAL_PATH_PREFIX; } });
 Object.defineProperty(exports, "VERCEL_AUTHORIZE_PATH", { enumerable: true, get: function () { return constants_1.VERCEL_AUTHORIZE_PATH; } });
@@ -14,6 +14,9 @@ var handler_1 = require("./handler");
 Object.defineProperty(exports, "handleDeploymentProtection", { enumerable: true, get: function () { return handler_1.handleDeploymentProtection; } });
 var middleware_1 = require("./middleware");
 Object.defineProperty(exports, "withDeploymentProtection", { enumerable: true, get: function () { return middleware_1.withDeploymentProtection; } });
+var edge_1 = require("./edge");
+Object.defineProperty(exports, "middlewarePassThrough", { enumerable: true, get: function () { return edge_1.middlewarePassThrough; } });
+Object.defineProperty(exports, "withEdgeDeploymentProtection", { enumerable: true, get: function () { return edge_1.withEdgeDeploymentProtection; } });
 var config_1 = require("./config");
 Object.defineProperty(exports, "resolveConfig", { enumerable: true, get: function () { return config_1.resolveConfig; } });
 Object.defineProperty(exports, "hasPasswordAuth", { enumerable: true, get: function () { return config_1.hasPasswordAuth; } });

package/dist/cjs/storybook.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Storybook deployment protection for Vercel.
+ *
+ * Built Storybooks are static sites, so protection runs as **Vercel Routing Middleware**
+ * (not Storybook config). Drop a `middleware.ts` next to the Vercel project root that
+ * serves `storybook-static` and set the same env vars as the Next.js integration.
+ *
+ * The published `./storybook` and `./edge` entry points resolve to self-contained ESM
+ * bundles so Vercel edge/nodejs middleware can load them without tracing multi-file
+ * package internals.
+ *
+ * @example middleware.ts
+ * ```ts
+ * import { withStorybookDeploymentProtection } from "@becklyn/deployment-protection/storybook";
+ *
+ * export default withStorybookDeploymentProtection();
+ *
+ * // Matcher must be a string literal in this file (Vercel/Next static analysis).
+ * export const config = {
+ *   matcher: [
+ *     "/((?!.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?|mjs)$).*)",
+ *   ],
+ * };
+ * ```
+ *
+ * Optional `vercel.json` for a Storybook-only project (`framework` must be `null`):
+ * ```json
+ * {
+ *   "buildCommand": "npm run build-storybook",
+ *   "outputDirectory": "storybook-static",
+ *   "framework": null
+ * }
+ * ```
+ */
+export { middlewarePassThrough, withEdgeDeploymentProtection as withStorybookDeploymentProtection, } from "./edge";
+export type { DeploymentProtectionOptions } from "./types";
+//# sourceMappingURL=storybook.d.ts.map

package/dist/cjs/storybook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storybook.d.ts","sourceRoot":"","sources":["../../src/storybook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACH,qBAAqB,EACrB,4BAA4B,IAAI,iCAAiC,GACpE,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,2BAA2B,EAAE,MAAM,SAAS,CAAC"}

package/dist/cjs/storybook.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withStorybookDeploymentProtection = exports.middlewarePassThrough = void 0;
+/**
+ * Storybook deployment protection for Vercel.
+ *
+ * Built Storybooks are static sites, so protection runs as **Vercel Routing Middleware**
+ * (not Storybook config). Drop a `middleware.ts` next to the Vercel project root that
+ * serves `storybook-static` and set the same env vars as the Next.js integration.
+ *
+ * The published `./storybook` and `./edge` entry points resolve to self-contained ESM
+ * bundles so Vercel edge/nodejs middleware can load them without tracing multi-file
+ * package internals.
+ *
+ * @example middleware.ts
+ * ```ts
+ * import { withStorybookDeploymentProtection } from "@becklyn/deployment-protection/storybook";
+ *
+ * export default withStorybookDeploymentProtection();
+ *
+ * // Matcher must be a string literal in this file (Vercel/Next static analysis).
+ * export const config = {
+ *   matcher: [
+ *     "/((?!.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|txt|xml|woff2?|mjs)$).*)",
+ *   ],
+ * };
+ * ```
+ *
+ * Optional `vercel.json` for a Storybook-only project (`framework` must be `null`):
+ * ```json
+ * {
+ *   "buildCommand": "npm run build-storybook",
+ *   "outputDirectory": "storybook-static",
+ *   "framework": null
+ * }
+ * ```
+ */
+var edge_1 = require("./edge");
+Object.defineProperty(exports, "middlewarePassThrough", { enumerable: true, get: function () { return edge_1.middlewarePassThrough; } });
+Object.defineProperty(exports, "withStorybookDeploymentProtection", { enumerable: true, get: function () { return edge_1.withEdgeDeploymentProtection; } });

package/dist/edge-bundles.json

@@ -0,0 +1,7 @@
+{
+    "format": "esm",
+    "entries": [
+        "dist/edge.mjs",
+        "dist/storybook.mjs"
+    ]
+}