Edge Middleware (npm)

Edge middleware is the modern advanced deployment path for JavaScript sites. You install the @lobsterhoney/edge package into your app, and it serves trap content directly from your own edge -- making trap paths indistinguishable from real routes on your domain. Instead of pointing to a beacon domain or wiring up a reverse proxy, protection runs as a middleware inside the platform you already deploy to.

How It Works

The middleware fetches a signed manifest from your control-plane origin and serves the server-authored trap content it contains. Every trap body is constructed server-side and delivered pre-built -- the package ships no content generators of its own. When an agent hits a trap path, the middleware reports the request back so it can be scored and correlated in your dashboard.

• Zero runtime dependencies. It uses only the Web Crypto API, so it runs on Vercel Edge, Cloudflare (Workers runtime), Netlify Edge (Deno), and Node 18+ without a bundler shim.
• Pinned trust, fail closed. You pin a trust bundle issued to you at onboarding. The manifest is verified with an ECDSA-P256 signature against that pinned bundle before any content is served. If verification fails, nothing is served.
• Minimal reporting. Reported events carry request metadata only (method, host, client IP, and the ordered list of request header names) -- never header values and never the request body.

Setting Up Edge Middleware

Platform Snippets

Each platform imports a small factory from its own entrypoint. These are short skeletons that read the three environment variables above -- the Deploy page generates the copy-ready version scoped to your site.

// middleware.ts
import { createMiddleware } from '@lobsterhoney/edge/vercel';

export default createMiddleware({
  apiKey: process.env.LOBSTERHONEY_KEY!,
  orgSlug: 'your-org',
  manifestUrl: process.env.LOBSTERHONEY_URL!, // origin only
  trustBundle: JSON.parse(process.env.LOBSTERHONEY_TRUST_BUNDLE!),
});

// middleware.ts
import { createMiddleware } from '@lobsterhoney/edge/vercel';

export default createMiddleware({
  apiKey: process.env.LOBSTERHONEY_KEY!,
  orgSlug: 'your-org',
  manifestUrl: process.env.LOBSTERHONEY_URL!, // origin only
  trustBundle: JSON.parse(process.env.LOBSTERHONEY_TRUST_BUNDLE!),
});

import { createNetlifyHandler } from '@lobsterhoney/edge/netlify';

export default createNetlifyHandler({
  apiKey: Deno.env.get('LOBSTERHONEY_KEY')!,
  orgSlug: 'your-org',
  manifestUrl: Deno.env.get('LOBSTERHONEY_URL')!, // origin only
  trustBundle: JSON.parse(Deno.env.get('LOBSTERHONEY_TRUST_BUNDLE')!),
});

import { createCloudflareHandler } from '@lobsterhoney/edge/cloudflare';

export default {
  async fetch(request, env, ctx) {
    const handler = createCloudflareHandler({
      apiKey: env.LOBSTERHONEY_KEY,
      orgSlug: 'your-org',
      manifestUrl: env.LOBSTERHONEY_URL, // origin only
      trustBundle: JSON.parse(env.LOBSTERHONEY_TRUST_BUNDLE),
    });
    const res = await handler(request, env, ctx);
    return res ?? fetch(request); // null => no match, serve the real origin
  },
};

Environment Variables

The snippet reads these three variables. The Deploy page shows the exact value for each -- store them as secrets, never commit them to your repository.

manifestUrl is an origin, not a full path -- the client derives its endpoints from it. Keeping the origin in LOBSTERHONEY_URL lets you switch hosts without editing code. Your exact origin is shown on the Deploy page.

import trustBundle from './lobsterhoney-trust-bundle.json';
// ...pass `trustBundle` to the config above instead of JSON.parse(...)

Trust Bundle & Key

Your API key and trust bundle are issued in the dashboard on the Deploy page. The trust bundle is the sole root of trust the middleware pins -- there is no remote trust fetch, so the client fails closed if a bundle is not supplied. Manifests are ECDSA-P256 verified against the pinned bundle before any content is served: the signing key is selected by key id, checked against the bundle's validity window, and the manifest's own expiry is enforced.

Treat both the key and the trust bundle as secrets. Copy their exact values from the Deploy page -- this documentation never contains real values.

What Gets Protected

Edge middleware serves your static file and page traps -- the portable subset that can be precomputed and delivered in the signed manifest. For a typical organization, that's around 9 of 16 active traps. Your interactive traps -- the ones that need live request handling, such as API and login flows -- continue to be served by the control plane, so your full trap surface stays active across both.

This split is by design: the edge handles the traps that benefit most from living on your own domain, while the control plane keeps serving the ones that require server-side logic. You don't lose coverage by deploying at the edge -- you add the on-domain layer on top.

Verifying

After deploying, run the edge verification check from the Deploy page. It confirms the manifest loads, its signature verifies, and trap paths respond at your edge. If verification fails, the report tells you which check did not pass. See Verifying Deployment for details and common fixes.

See Also

• Beacon Setup -- simpler deployment via script tag
• Proxy Mode -- reverse-proxy deployment for non-JS stacks
• Verifying Deployment -- confirming your setup