Set an EDGE_SIGNING_SECRET on the site-middleware Worker and every request
it forwards carries a signed X-LinkSell-Edge header over the method, the
decoded path and a timestamp. Your origin can then refuse paid paths that
reached it directly, around the Worker. Leave the secret unset and nothing
changes.
This note records shipped behavior as of . Planned work remains on the public roadmap until release.