{"owner":"docs","repo":"deployment","hasSkills":true,"totalSkillsCount":4,"totalTokensCount":2281,"categories":["mcp-config","marketplace","plugin-manifest","cursor-rule"],"hasMcp":true,"mcpConfig":{"mcpServers":{"deployment":{"command":"npx","args":["-y","@modelcontextprotocol/server-deployment"]}}},"found":[".cursor/mcp.json",".claude-plugin/marketplace.json",".claude-plugin/plugin.json",".cursorrules (vercel-deployment-cursorrules-prompt-file.mdc)"],"skills":{".cursor/mcp.json":"# Model Context Protocol (MCP) Configuration\n\nPath: `.cursor/mcp.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/docs/deployment/HEAD/.cursor/mcp.json)",".claude-plugin/marketplace.json":"# Claude Plugin Marketplace Catalog\n\nPath: `.claude-plugin/marketplace.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/docs/deployment/HEAD/.claude-plugin/marketplace.json)",".claude-plugin/plugin.json":"# claude-plugin Plugin Manifest\n\nPath: `.claude-plugin/plugin.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/docs/deployment/HEAD/.claude-plugin/plugin.json)",".cursorrules (vercel-deployment-cursorrules-prompt-file.mdc)":"---\ndescription: \"Cursor rules for Vercel deployment including serverless functions, Edge Runtime, middleware, caching, CI/CD, and production-ready configuration.\"\nglobs: **/*\nalwaysApply: false\n---\nYou are an expert in Vercel deployments, serverless architecture, and modern web application hosting.\n\n# Vercel Deployment Guidelines\n\n## Core Principles\n- Always optimize for Vercel's edge network and serverless model\n- Prefer Edge Runtime for globally distributed, low-latency responses\n- Use Vercel's built-in environment variable management for secrets\n- Structure projects to leverage Vercel's zero-config deployment detection\n- Always use `vercel.json` for advanced routing, headers, and redirects configuration\n\n## Project Structure\n- Place API routes in `/api` directory for automatic serverless function detection (Pages Router) or `/app/api` for App Router\n- Use `public/` for static assets that should be served via Vercel's CDN\n- Keep serverless functions small and focused — cold start time matters\n- Separate long-running tasks to background jobs or external queues (Vercel has a 10s default timeout on Hobby, 60s on Pro)\n\n## Environment Variables\n- Never hard-code secrets; always use `process.env.VARIABLE_NAME`\n- Prefix client-side env vars with `NEXT_PUBLIC_` (Next.js) or expose explicitly per framework\n- Use Vercel's Environment Variable UI or CLI (`vercel env add`) to manage per-environment values (Development, Preview, Production)\n- Use `.env.local` for local development; never commit it\n- Reference `vercel.json` `env` field only for build-time non-secret values\n\n## vercel.json Configuration\n- Use `rewrites` for proxying API calls or SPA fallback routing\n- Use `redirects` for permanent (308) or temporary (307) URL changes\n- Use `headers` to set security headers (CSP, HSTS, X-Frame-Options) globally\n- Use `regions` to pin serverless functions to specific regions when data locality matters\n- Example security headers block:\n  ```json\n  {\n    \"headers\": [\n      {\n        \"source\": \"/(.*)\",\n        \"headers\": [\n          { \"key\": \"X-Content-Type-Options\", \"value\": \"nosniff\" },\n          { \"key\": \"X-Frame-Options\", \"value\": \"DENY\" },\n          { \"key\": \"X-XSS-Protection\", \"value\": \"1; mode=block\" },\n          { \"key\": \"Referrer-Policy\", \"value\": \"strict-origin-when-cross-origin\" }\n        ]\n      }\n    ]\n  }\n  ```\n\n## Serverless Functions\n- Keep dependencies minimal — bundle size directly impacts cold starts\n- Use Edge Functions (`export const runtime = 'edge'`) for auth checks, redirects, and A/B testing\n- Use Node.js runtime for database connections, heavy computation, or Node-only packages\n- Always handle errors gracefully and return proper HTTP status codes\n- Use streaming responses for LLM or large data outputs\n\n## Edge Middleware\n- Place middleware in `middleware.ts` at the project root\n- Use middleware for: authentication guards, geo-based redirects, bot protection, and A/B flags\n- Keep middleware lightweight — it runs on every request before the cache\n- Use `matcher` config to scope middleware only to needed routes\n  ```ts\n  export const config = {\n    matcher: ['/dashboard/:path*', '/api/:path*'],\n  }\n  ```\n\n## Performance & Caching\n- Use `Cache-Control` headers to control Vercel's CDN caching behavior\n- Use `stale-while-revalidate` for ISR-like behavior in non-Next.js apps\n- Set `s-maxage` for CDN cache TTL and `max-age` for browser cache\n- Avoid over-fetching in serverless functions — reuse DB connections with connection pooling (PgBouncer, Prisma Accelerate)\n- Use `vercel/og` for dynamic OG image generation at the edge\n\n## CI/CD & Preview Deployments\n- Use Vercel's GitHub/GitLab/Bitbucket integration for automatic preview deployments per PR\n- Use `vercel pull` + `vercel build` + `vercel deploy --prebuilt` in custom CI pipelines\n- Set branch protection rules to require passing preview deployment checks\n- Use `VERCEL_ENV` environment variable to differentiate behavior across preview/production\n\n## Domain & DNS\n- Use Vercel Domains or point external DNS to Vercel's nameservers for automatic SSL\n- Always redirect `www` to apex or vice versa — never serve both\n- Use `vercel domains add` CLI command for custom domain management\n\n## Monorepo Support\n- Set `rootDirectory` in project settings to point to the correct app within a monorepo\n- Use Turborepo with Vercel Remote Cache for fast CI builds (`turbo build --filter=...`)\n- Scope environment variables per project even in shared monorepos\n\n## Databases & Storage\n- Prefer Vercel-native storage (Vercel KV, Vercel Postgres, Vercel Blob) for zero-config integration\n- For external databases, always use connection pooling — serverless functions do not maintain persistent connections\n- Store large files in Vercel Blob or S3-compatible storage, not in the function bundle\n\n## Logging & Observability\n- Use `console.log` / `console.error` — Vercel captures these as function logs\n- Integrate with Vercel Log Drains to stream logs to Datadog, Sentry, or other observability tools\n- Use Vercel Speed Insights and Web Analytics for real-user performance monitoring\n- Set up alerts on error rate spikes via Vercel's integrations marketplace\n\n## Security Best Practices\n- Enable Vercel's DDoS protection (included on all plans)\n- Use Vercel Firewall rules to block malicious IPs and patterns\n- Rotate secrets regularly using Vercel's environment variable versioning\n- Never log sensitive data (tokens, passwords, PII) in serverless function output\n- Use `VERCEL_OIDC_TOKEN` for secure machine-to-machine auth between Vercel and cloud providers\n\n## Deployment Workflow\n- Run `vercel --prod` only from protected branches (main/master)\n- Use `vercel deploy` (without `--prod`) for staging/preview deployments\n- Alias stable preview URLs with `vercel alias` for QA sign-off\n- Use deployment protection (password or Vercel Access) on preview deployments for private projects\n"},"files":{".cursor/mcp.json":"# Model Context Protocol (MCP) Configuration\n\nPath: `.cursor/mcp.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/docs/deployment/HEAD/.cursor/mcp.json)",".claude-plugin/marketplace.json":"# Claude Plugin Marketplace Catalog\n\nPath: `.claude-plugin/marketplace.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/docs/deployment/HEAD/.claude-plugin/marketplace.json)",".claude-plugin/plugin.json":"# claude-plugin Plugin Manifest\n\nPath: `.claude-plugin/plugin.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/docs/deployment/HEAD/.claude-plugin/plugin.json)",".cursorrules (vercel-deployment-cursorrules-prompt-file.mdc)":"---\ndescription: \"Cursor rules for Vercel deployment including serverless functions, Edge Runtime, middleware, caching, CI/CD, and production-ready configuration.\"\nglobs: **/*\nalwaysApply: false\n---\nYou are an expert in Vercel deployments, serverless architecture, and modern web application hosting.\n\n# Vercel Deployment Guidelines\n\n## Core Principles\n- Always optimize for Vercel's edge network and serverless model\n- Prefer Edge Runtime for globally distributed, low-latency responses\n- Use Vercel's built-in environment variable management for secrets\n- Structure projects to leverage Vercel's zero-config deployment detection\n- Always use `vercel.json` for advanced routing, headers, and redirects configuration\n\n## Project Structure\n- Place API routes in `/api` directory for automatic serverless function detection (Pages Router) or `/app/api` for App Router\n- Use `public/` for static assets that should be served via Vercel's CDN\n- Keep serverless functions small and focused — cold start time matters\n- Separate long-running tasks to background jobs or external queues (Vercel has a 10s default timeout on Hobby, 60s on Pro)\n\n## Environment Variables\n- Never hard-code secrets; always use `process.env.VARIABLE_NAME`\n- Prefix client-side env vars with `NEXT_PUBLIC_` (Next.js) or expose explicitly per framework\n- Use Vercel's Environment Variable UI or CLI (`vercel env add`) to manage per-environment values (Development, Preview, Production)\n- Use `.env.local` for local development; never commit it\n- Reference `vercel.json` `env` field only for build-time non-secret values\n\n## vercel.json Configuration\n- Use `rewrites` for proxying API calls or SPA fallback routing\n- Use `redirects` for permanent (308) or temporary (307) URL changes\n- Use `headers` to set security headers (CSP, HSTS, X-Frame-Options) globally\n- Use `regions` to pin serverless functions to specific regions when data locality matters\n- Example security headers block:\n  ```json\n  {\n    \"headers\": [\n      {\n        \"source\": \"/(.*)\",\n        \"headers\": [\n          { \"key\": \"X-Content-Type-Options\", \"value\": \"nosniff\" },\n          { \"key\": \"X-Frame-Options\", \"value\": \"DENY\" },\n          { \"key\": \"X-XSS-Protection\", \"value\": \"1; mode=block\" },\n          { \"key\": \"Referrer-Policy\", \"value\": \"strict-origin-when-cross-origin\" }\n        ]\n      }\n    ]\n  }\n  ```\n\n## Serverless Functions\n- Keep dependencies minimal — bundle size directly impacts cold starts\n- Use Edge Functions (`export const runtime = 'edge'`) for auth checks, redirects, and A/B testing\n- Use Node.js runtime for database connections, heavy computation, or Node-only packages\n- Always handle errors gracefully and return proper HTTP status codes\n- Use streaming responses for LLM or large data outputs\n\n## Edge Middleware\n- Place middleware in `middleware.ts` at the project root\n- Use middleware for: authentication guards, geo-based redirects, bot protection, and A/B flags\n- Keep middleware lightweight — it runs on every request before the cache\n- Use `matcher` config to scope middleware only to needed routes\n  ```ts\n  export const config = {\n    matcher: ['/dashboard/:path*', '/api/:path*'],\n  }\n  ```\n\n## Performance & Caching\n- Use `Cache-Control` headers to control Vercel's CDN caching behavior\n- Use `stale-while-revalidate` for ISR-like behavior in non-Next.js apps\n- Set `s-maxage` for CDN cache TTL and `max-age` for browser cache\n- Avoid over-fetching in serverless functions — reuse DB connections with connection pooling (PgBouncer, Prisma Accelerate)\n- Use `vercel/og` for dynamic OG image generation at the edge\n\n## CI/CD & Preview Deployments\n- Use Vercel's GitHub/GitLab/Bitbucket integration for automatic preview deployments per PR\n- Use `vercel pull` + `vercel build` + `vercel deploy --prebuilt` in custom CI pipelines\n- Set branch protection rules to require passing preview deployment checks\n- Use `VERCEL_ENV` environment variable to differentiate behavior across preview/production\n\n## Domain & DNS\n- Use Vercel Domains or point external DNS to Vercel's nameservers for automatic SSL\n- Always redirect `www` to apex or vice versa — never serve both\n- Use `vercel domains add` CLI command for custom domain management\n\n## Monorepo Support\n- Set `rootDirectory` in project settings to point to the correct app within a monorepo\n- Use Turborepo with Vercel Remote Cache for fast CI builds (`turbo build --filter=...`)\n- Scope environment variables per project even in shared monorepos\n\n## Databases & Storage\n- Prefer Vercel-native storage (Vercel KV, Vercel Postgres, Vercel Blob) for zero-config integration\n- For external databases, always use connection pooling — serverless functions do not maintain persistent connections\n- Store large files in Vercel Blob or S3-compatible storage, not in the function bundle\n\n## Logging & Observability\n- Use `console.log` / `console.error` — Vercel captures these as function logs\n- Integrate with Vercel Log Drains to stream logs to Datadog, Sentry, or other observability tools\n- Use Vercel Speed Insights and Web Analytics for real-user performance monitoring\n- Set up alerts on error rate spikes via Vercel's integrations marketplace\n\n## Security Best Practices\n- Enable Vercel's DDoS protection (included on all plans)\n- Use Vercel Firewall rules to block malicious IPs and patterns\n- Rotate secrets regularly using Vercel's environment variable versioning\n- Never log sensitive data (tokens, passwords, PII) in serverless function output\n- Use `VERCEL_OIDC_TOKEN` for secure machine-to-machine auth between Vercel and cloud providers\n\n## Deployment Workflow\n- Run `vercel --prod` only from protected branches (main/master)\n- Use `vercel deploy` (without `--prod`) for staging/preview deployments\n- Alias stable preview URLs with `vercel alias` for QA sign-off\n- Use deployment protection (password or Vercel Access) on preview deployments for private projects\n"},"items":[{"name":"marketplace.json","path":".claude-plugin/marketplace.json","rawUrl":"https://raw.githubusercontent.com/docs/deployment/HEAD/.claude-plugin/marketplace.json","title":"Claude Plugin Marketplace Catalog","category":"marketplace","format":"json","content":"# Claude Plugin Marketplace Catalog\n\nPath: `.claude-plugin/marketplace.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/docs/deployment/HEAD/.claude-plugin/marketplace.json)","tokens":300,"sizeBytes":194},{"name":"plugin.json","path":".claude-plugin/plugin.json","rawUrl":"https://raw.githubusercontent.com/docs/deployment/HEAD/.claude-plugin/plugin.json","title":"claude-plugin Plugin Manifest","category":"plugin-manifest","format":"json","content":"# claude-plugin Plugin Manifest\n\nPath: `.claude-plugin/plugin.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/docs/deployment/HEAD/.claude-plugin/plugin.json)","tokens":300,"sizeBytes":180},{"name":"mcp.json","path":".cursor/mcp.json","rawUrl":"https://raw.githubusercontent.com/docs/deployment/HEAD/.cursor/mcp.json","title":"Model Context Protocol (MCP) Configuration","category":"mcp-config","format":"json","content":"# Model Context Protocol (MCP) Configuration\n\nPath: `.cursor/mcp.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/docs/deployment/HEAD/.cursor/mcp.json)","tokens":300,"sizeBytes":173},{"name":".cursorrules","path":".cursorrules (vercel-deployment-cursorrules-prompt-file.mdc)","rawUrl":"https://raw.githubusercontent.com/PatrickJS/awesome-cursorrules/main/rules/vercel-deployment-cursorrules-prompt-file.mdc","title":"Awesome Cursorrules: vercel deployment","category":"cursor-rule","format":"markdown","content":"---\ndescription: \"Cursor rules for Vercel deployment including serverless functions, Edge Runtime, middleware, caching, CI/CD, and production-ready configuration.\"\nglobs: **/*\nalwaysApply: false\n---\nYou are an expert in Vercel deployments, serverless architecture, and modern web application hosting.\n\n# Vercel Deployment Guidelines\n\n## Core Principles\n- Always optimize for Vercel's edge network and serverless model\n- Prefer Edge Runtime for globally distributed, low-latency responses\n- Use Vercel's built-in environment variable management for secrets\n- Structure projects to leverage Vercel's zero-config deployment detection\n- Always use `vercel.json` for advanced routing, headers, and redirects configuration\n\n## Project Structure\n- Place API routes in `/api` directory for automatic serverless function detection (Pages Router) or `/app/api` for App Router\n- Use `public/` for static assets that should be served via Vercel's CDN\n- Keep serverless functions small and focused — cold start time matters\n- Separate long-running tasks to background jobs or external queues (Vercel has a 10s default timeout on Hobby, 60s on Pro)\n\n## Environment Variables\n- Never hard-code secrets; always use `process.env.VARIABLE_NAME`\n- Prefix client-side env vars with `NEXT_PUBLIC_` (Next.js) or expose explicitly per framework\n- Use Vercel's Environment Variable UI or CLI (`vercel env add`) to manage per-environment values (Development, Preview, Production)\n- Use `.env.local` for local development; never commit it\n- Reference `vercel.json` `env` field only for build-time non-secret values\n\n## vercel.json Configuration\n- Use `rewrites` for proxying API calls or SPA fallback routing\n- Use `redirects` for permanent (308) or temporary (307) URL changes\n- Use `headers` to set security headers (CSP, HSTS, X-Frame-Options) globally\n- Use `regions` to pin serverless functions to specific regions when data locality matters\n- Example security headers block:\n  ```json\n  {\n    \"headers\": [\n      {\n        \"source\": \"/(.*)\",\n        \"headers\": [\n          { \"key\": \"X-Content-Type-Options\", \"value\": \"nosniff\" },\n          { \"key\": \"X-Frame-Options\", \"value\": \"DENY\" },\n          { \"key\": \"X-XSS-Protection\", \"value\": \"1; mode=block\" },\n          { \"key\": \"Referrer-Policy\", \"value\": \"strict-origin-when-cross-origin\" }\n        ]\n      }\n    ]\n  }\n  ```\n\n## Serverless Functions\n- Keep dependencies minimal — bundle size directly impacts cold starts\n- Use Edge Functions (`export const runtime = 'edge'`) for auth checks, redirects, and A/B testing\n- Use Node.js runtime for database connections, heavy computation, or Node-only packages\n- Always handle errors gracefully and return proper HTTP status codes\n- Use streaming responses for LLM or large data outputs\n\n## Edge Middleware\n- Place middleware in `middleware.ts` at the project root\n- Use middleware for: authentication guards, geo-based redirects, bot protection, and A/B flags\n- Keep middleware lightweight — it runs on every request before the cache\n- Use `matcher` config to scope middleware only to needed routes\n  ```ts\n  export const config = {\n    matcher: ['/dashboard/:path*', '/api/:path*'],\n  }\n  ```\n\n## Performance & Caching\n- Use `Cache-Control` headers to control Vercel's CDN caching behavior\n- Use `stale-while-revalidate` for ISR-like behavior in non-Next.js apps\n- Set `s-maxage` for CDN cache TTL and `max-age` for browser cache\n- Avoid over-fetching in serverless functions — reuse DB connections with connection pooling (PgBouncer, Prisma Accelerate)\n- Use `vercel/og` for dynamic OG image generation at the edge\n\n## CI/CD & Preview Deployments\n- Use Vercel's GitHub/GitLab/Bitbucket integration for automatic preview deployments per PR\n- Use `vercel pull` + `vercel build` + `vercel deploy --prebuilt` in custom CI pipelines\n- Set branch protection rules to require passing preview deployment checks\n- Use `VERCEL_ENV` environment variable to differentiate behavior across preview/production\n\n## Domain & DNS\n- Use Vercel Domains or point external DNS to Vercel's nameservers for automatic SSL\n- Always redirect `www` to apex or vice versa — never serve both\n- Use `vercel domains add` CLI command for custom domain management\n\n## Monorepo Support\n- Set `rootDirectory` in project settings to point to the correct app within a monorepo\n- Use Turborepo with Vercel Remote Cache for fast CI builds (`turbo build --filter=...`)\n- Scope environment variables per project even in shared monorepos\n\n## Databases & Storage\n- Prefer Vercel-native storage (Vercel KV, Vercel Postgres, Vercel Blob) for zero-config integration\n- For external databases, always use connection pooling — serverless functions do not maintain persistent connections\n- Store large files in Vercel Blob or S3-compatible storage, not in the function bundle\n\n## Logging & Observability\n- Use `console.log` / `console.error` — Vercel captures these as function logs\n- Integrate with Vercel Log Drains to stream logs to Datadog, Sentry, or other observability tools\n- Use Vercel Speed Insights and Web Analytics for real-user performance monitoring\n- Set up alerts on error rate spikes via Vercel's integrations marketplace\n\n## Security Best Practices\n- Enable Vercel's DDoS protection (included on all plans)\n- Use Vercel Firewall rules to block malicious IPs and patterns\n- Rotate secrets regularly using Vercel's environment variable versioning\n- Never log sensitive data (tokens, passwords, PII) in serverless function output\n- Use `VERCEL_OIDC_TOKEN` for secure machine-to-machine auth between Vercel and cloud providers\n\n## Deployment Workflow\n- Run `vercel --prod` only from protected branches (main/master)\n- Use `vercel deploy` (without `--prod`) for staging/preview deployments\n- Alias stable preview URLs with `vercel alias` for QA sign-off\n- Use deployment protection (password or Vercel Access) on preview deployments for private projects\n","tokens":1381,"sizeBytes":5908}],"systemPromptSnippet":"<yakaai_skills repo=\"docs/deployment\">\n<!-- File: .claude-plugin/marketplace.json (Tokens: ~300 | Category: marketplace) -->\n# Claude Plugin Marketplace Catalog\n\nPath: `.claude-plugin/marketplace.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/docs/deployment/HEAD/.claude-plugin/marketplace.json)\n\n<!-- File: .claude-plugin/plugin.json (Tokens: ~300 | Category: plugin-manifest) -->\n# claude-plugin Plugin Manifest\n\nPath: `.claude-plugin/plugin.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/docs/deployment/HEAD/.claude-plugin/plugin.json)\n\n<!-- File: .cursor/mcp.json (Tokens: ~300 | Category: mcp-config) -->\n# Model Context Protocol (MCP) Configuration\n\nPath: `.cursor/mcp.json`\n\n[View Raw Content on GitHub](https://raw.githubusercontent.com/docs/deployment/HEAD/.cursor/mcp.json)\n\n<!-- File: .cursorrules (vercel-deployment-cursorrules-prompt-file.mdc) (Tokens: ~1381 | Category: cursor-rule) -->\n---\ndescription: \"Cursor rules for Vercel deployment including serverless functions, Edge Runtime, middleware, caching, CI/CD, and production-ready configuration.\"\nglobs: **/*\nalwaysApply: false\n---\nYou are an expert in Vercel deployments, serverless architecture, and modern web application hosting.\n\n# Vercel Deployment Guidelines\n\n## Core Principles\n- Always optimize for Vercel's edge network and serverless model\n- Prefer Edge Runtime for globally distributed, low-latency responses\n- Use Vercel's built-in environment variable management for secrets\n- Structure projects to leverage Vercel's zero-config deployment detection\n- Always use `vercel.json` for advanced routing, headers, and redirects configuration\n\n## Project Structure\n- Place API routes in `/api` directory for automatic serverless function detection (Pages Router) or `/app/api` for App Router\n- Use `public/` for static assets that should be served via Vercel's CDN\n- Keep serverless functions small and focused — cold start time matters\n- Separate long-running tasks to background jobs or external queues (Vercel has a 10s default timeout on Hobby, 60s on Pro)\n\n## Environment Variables\n- Never hard-code secrets; always use `process.env.VARIABLE_NAME`\n- Prefix client-side env vars with `NEXT_PUBLIC_` (Next.js) or expose explicitly per framework\n- Use Vercel's Environment Variable UI or CLI (`vercel env add`) to manage per-environment values (Development, Preview, Production)\n- Use `.env.local` for local development; never commit it\n- Reference `vercel.json` `env` field only for build-time non-secret values\n\n## vercel.json Configuration\n- Use `rewrites` for proxying API calls or SPA fallback routing\n- Use `redirects` for permanent (308) or temporary (307) URL changes\n- Use `headers` to set security headers (CSP, HSTS, X-Frame-Options) globally\n- Use `regions` to pin serverless functions to specific regions when data locality matters\n- Example security headers block:\n  ```json\n  {\n    \"headers\": [\n      {\n        \"source\": \"/(.*)\",\n        \"headers\": [\n          { \"key\": \"X-Content-Type-Options\", \"value\": \"nosniff\" },\n          { \"key\": \"X-Frame-Options\", \"value\": \"DENY\" },\n          { \"key\": \"X-XSS-Protection\", \"value\": \"1; mode=block\" },\n          { \"key\": \"Referrer-Policy\", \"value\": \"strict-origin-when-cross-origin\" }\n        ]\n      }\n    ]\n  }\n  ```\n\n## Serverless Functions\n- Keep dependencies minimal — bundle size directly impacts cold starts\n- Use Edge Functions (`export const runtime = 'edge'`) for auth checks, redirects, and A/B testing\n- Use Node.js runtime for database connections, heavy computation, or Node-only packages\n- Always handle errors gracefully and return proper HTTP status codes\n- Use streaming responses for LLM or large data outputs\n\n## Edge Middleware\n- Place middleware in `middleware.ts` at the project root\n- Use middleware for: authentication guards, geo-based redirects, bot protection, and A/B flags\n- Keep middleware lightweight — it runs on every request before the cache\n- Use `matcher` config to scope middleware only to needed routes\n  ```ts\n  export const config = {\n    matcher: ['/dashboard/:path*', '/api/:path*'],\n  }\n  ```\n\n## Performance & Caching\n- Use `Cache-Control` headers to control Vercel's CDN caching behavior\n- Use `stale-while-revalidate` for ISR-like behavior in non-Next.js apps\n- Set `s-maxage` for CDN cache TTL and `max-age` for browser cache\n- Avoid over-fetching in serverless functions — reuse DB connections with connection pooling (PgBouncer, Prisma Accelerate)\n- Use `vercel/og` for dynamic OG image generation at the edge\n\n## CI/CD & Preview Deployments\n- Use Vercel's GitHub/GitLab/Bitbucket integration for automatic preview deployments per PR\n- Use `vercel pull` + `vercel build` + `vercel deploy --prebuilt` in custom CI pipelines\n- Set branch protection rules to require passing preview deployment checks\n- Use `VERCEL_ENV` environment variable to differentiate behavior across preview/production\n\n## Domain & DNS\n- Use Vercel Domains or point external DNS to Vercel's nameservers for automatic SSL\n- Always redirect `www` to apex or vice versa — never serve both\n- Use `vercel domains add` CLI command for custom domain management\n\n## Monorepo Support\n- Set `rootDirectory` in project settings to point to the correct app within a monorepo\n- Use Turborepo with Vercel Remote Cache for fast CI builds (`turbo build --filter=...`)\n- Scope environment variables per project even in shared monorepos\n\n## Databases & Storage\n- Prefer Vercel-native storage (Vercel KV, Vercel Postgres, Vercel Blob) for zero-config integration\n- For external databases, always use connection pooling — serverless functions do not maintain persistent connections\n- Store large files in Vercel Blob or S3-compatible storage, not in the function bundle\n\n## Logging & Observability\n- Use `console.log` / `console.error` — Vercel captures these as function logs\n- Integrate with Vercel Log Drains to stream logs to Datadog, Sentry, or other observability tools\n- Use Vercel Speed Insights and Web Analytics for real-user performance monitoring\n- Set up alerts on error rate spikes via Vercel's integrations marketplace\n\n## Security Best Practices\n- Enable Vercel's DDoS protection (included on all plans)\n- Use Vercel Firewall rules to block malicious IPs and patterns\n- Rotate secrets regularly using Vercel's environment variable versioning\n- Never log sensitive data (tokens, passwords, PII) in serverless function output\n- Use `VERCEL_OIDC_TOKEN` for secure machine-to-machine auth between Vercel and cloud providers\n\n## Deployment Workflow\n- Run `vercel --prod` only from protected branches (main/master)\n- Use `vercel deploy` (without `--prod`) for staging/preview deployments\n- Alias stable preview URLs with `vercel alias` for QA sign-off\n- Use deployment protection (password or Vercel Access) on preview deployments for private projects\n</yakaai_skills>"}