edge/

Package authn is the edge authentication PEP (ADR-0113, F77): for a data-plane request whose target has an `authenticated` stance, it extracts a bearer token, resolves it to a connection-scoped Identity (never client-asserted), and DELEGATES the allow/deny decision to the existing auth.Authorizer (RBAC namespace-scope in V1; fine-grained Cedar edge policy in V2).

Package limit is the ingress protection of the data plane (ADR-0112, F75): it refuses abusive traffic before the activator can wake a scaled-to-zero sandbox.

Package observ is the edge observability middleware (ADR-0114, F76): RED metrics (request rate / errors / duration by function+status) off the OTel meter, an edge span that mints or adopts a W3C traceparent so the downstream invocation span parents under it (the ingress hop joins the one-run-one-trace waterfall, ADR-0101/0102), and a structured access log correlated by X-Request-Id.

Package router is the edge request matcher (ADR-0110, F79): it compiles the Ready Route set into a host/path/method table and resolves a public data-plane request to a target (namespace, function).

Package shape is the edge shaping middleware (ADR-0114, F78): CORS (preflight + ACAO), response header inject/strip, and gzip compression that SKIPS streaming (text/event-stream) and upgrades (Connection: Upgrade / 101) and FORWARDS http.Flusher + http.Hijacker so SSE/WebSocket pass through unbroken.

Package static is the edge static-asset handler (ADR-0120, F82): it serves a Bucket-prefix static site directly through the FEAT-0006 edge — index resolution, content-types, a weak (ModTime,Size) ETag + conditional GET (304), HTTP Range (206), an optional SPA fallback, and a pinned three-tier Cache-Control — with no function code and no activator hop.

Package edgetls is the TLS termination provider port (ADR-0111, F74): it builds the *tls.Config funcd attaches to its own http.Servers (no listener handover — the caller drives ServeTLS).