Edge Middleware

edge-middleware-recipes

Vercel's Edge Middleware examples — thirteen small Next.js apps whose whole point is a middleware.ts — ported as one Cloudflare Worker of recipes: each middleware.ts becomes a module under apps/recipes/src/recipes/ with its behaviour intact, mounted by a Hono router under its own path, with the demo pages it rewrites to and a test that proves the upstream behaviour — and packaged as an Orun baseline: one command takes a new product from nothing to live on stage and prod, in its own repository, under its own name, in ONE landing.

The middleware logic is the upstream's wherever it is plain web-standard code, comments included. What changes is the Vercel-only primitive underneath — geolocation(req) is request.cf, Edge Config is a var, Upstash is the Workers Rate Limiting binding, NextResponse.rewrite is an in-process dispatch. What the baseline adds is everything needed to make a copy of it somebody else's — built the way cirrus-baseline is (its v22 one-landing shape). See specs/epics/edge-middleware-recipes for the design (the full primitive map), the milestones and the as-built status.

Instantiating a product

git clone --depth 1 --branch <baseline-tag> https://github.com/sourceplane/edge-middleware-recipes
cd edge-middleware-recipes
orun new --blueprint repo-blueprint.yaml --out ~/products/acme-recipes --run-hooks --resume \
  --set reponame=acme-recipes --set productname="Acme Recipes" \
  --set githuborg=acme-inc --set subdomain=<workers-dev-subdomain>

Or, once the platform's registry lists it, from the Orun console (Baselines → edge-middleware-recipes → Build). Two phases — 01-product (the repository, then the whole product in one pull request, deployed to stage and prod by one convergence and smoke-tested) and 02-docs (the live deployment recorded, the promotion gate put back). BOOTSTRAP.md is the operator guide; docs/phases/ has a page per phase.

The new repository receives the product only — the Worker, its tests, its CI, its tooling, a README of its own and its operating contract — renamed throughout to the product's name, repository and Cloudflare Worker. None of this repository's machinery ships. The product deploys and serves every recipe with no secret but the two the platform brokers; the basic-auth recipe answers a setup page until its owner sets BASIC_AUTH_USER / BASIC_AUTH_PASSWORD (orun secrets set, pushed by the next deploy).

The recipes

/ lists them with curl lines to try. Each route is the upstream directory's name.

What is here

Getting started

pnpm install
pnpm typecheck
pnpm lint
pnpm test             # 28 tests: every recipe's upstream behaviour and the site identity, in-process (no workerd)
pnpm build            # wrangler deploy --dry-run → apps/recipes/dist (the bundle, no upload)

Run the Worker locally under workerd and try the recipes:

cp apps/recipes/.dev.vars.example apps/recipes/.dev.vars   # the basic-auth pair
pnpm --filter @app/recipes dev                             # http://localhost:8787

curl -s http://localhost:8787/                             # the index, with a curl line per recipe
curl -s -H 'Accept-Language: fr' http://localhost:8787/i18n | grep Bonjour
curl -si -u 4dmin:testpwd123 http://localhost:8787/basic-auth-password | head -1
for i in 1 2 3 4 5 6; do curl -s -o /dev/null -w '%{http_code} ' http://localhost:8787/rate-limit-any-framework; done
curl -si 'http://localhost:8787/query-params-filter?a=b&allowed=test' | grep -i location
curl -si http://localhost:8787/redirects-bloom-filter/blog/should-redirect-to-google | grep -i location

request.cf (geolocation, i18n) is real under wrangler dev — wrangler fetches the machine's own. To see the maintenance page: pnpm --filter @app/recipes dev -- --var MAINTENANCE_MODE:true.

Add a recipe: a module in apps/recipes/src/recipes/ that exports a Hono app on its own base path and a meta entry, registered in src/recipes/index.ts; its app.use(<matcher>, …) is the upstream's export const config = { matcher }.

How it maps to Vercel

CI

Deploying this repository by hand

A product built from the baseline is deployed by its own bootstrap. To deploy THIS repository instead: set execution.state.workspace in intent.yaml to an Orun workspace (orun cloud link) with a Cloudflare connection, and ci.yml turns on — a merge to main deploys the Worker to stage, then prod. The basic-auth pair is optional: until it is set per environment (orun secrets set BASIC_AUTH_USER --env stage, or wrangler secret put), that recipe answers its setup page. The rate limiting binding needs no resource: wrangler creates the namespace from wrangler.jsonc on deploy (one namespace_id per environment).