@agenticprimitives/edge-runtime

The vendor-neutral edge admission layer. The edge is the only public surface; it admits or rejects requests cheaply, then forwards to the A2A/MCP origin behind a Service Binding. It owns admission only — it never owns authority (delegation, revocation, entitlement, KAS, signing, decryption all run behind the binding, never imported here — ADR-0043).

See spec 288 §4.

What's in the box (W1)

• EdgeAdapter — the interface Cloudflare / Zuplo / API Shield implement. The admission protocol doesn't change when the gateway does.
• Trusted-header hygiene — TRUSTED_HEADERS + sanitizeTrustedHeaders(headers, { authenticated }) strip internal headers (x-agent-subdomain, x-agentic-principal, …) from an unauthenticated caller so they can't be spoofed.
• GatewayAssertion verification port — verifyGatewayAssertion(...) proves, issuer-agnostically, that a gateway admitted these exact bytes for this route. It proves admission only — never SA authorization (the native pipeline still does that). The signature check is injected, so the default issuer and a future Zuplo lane are the same code path.
• Admission pipeline — runAdmission(req, opts): resolve route (from a surface-catalog) → sanitize headers → body-size / JSON-depth / envelope checks → Stage-1 abuse limit (an injected rate-control SoftRateLimiter, fail-soft) → correlation id.

import { runAdmission } from '@agenticprimitives/edge-runtime';

const result = await runAdmission(extractedRequest, {
  resolveRoute: (r) => registry.get(routeToId(r.path)),
  softLimiter,                       // from @agenticprimitives/rate-control (fail-soft)
  authenticated: false,              // direct public caller → strip trusted headers
});
if (!result.ok) return reject(result.status);   // single generic error; reason is internal-only
forwardToOrigin(result.descriptor, result.headers, result.correlationId);  // origin still validates authoritatively

Not in the core

• The Cloudflare adapter (Worker rate-limiter binding, Service-Binding dispatch, cf-connecting-ip) and the deployed agentic-edge Worker — ship separately (spec 288 §5); the production edge is external (ADR-0037).
• Any authority logic — forbidden imports; reached via Service Binding.

License

MIT