@agenticprimitives/fabric 0.0.0-alpha.10 → 0.0.0-alpha.12

package/CLAUDE.md

@@ -6,42 +6,11 @@ exec/case FSM. Decentralized (per-principal gateway + vault), tiered (T0/T1/T2),
 re-verified against the principal SA. Transport-agnostic core; the Cloudflare `PrincipalGatewayDO`
 adapter ships from `./cloudflare`.
 
-## Status (wave-by-wave build)
-- **W1 DONE:** exec/case FSM spine + absorbed messaging/interactions reducers (`./messaging`,
-  `./interactions` subpaths) + unified reducer + inbox projection. Golden-vectored.
-- **W2 DONE (`./cloudflare` adapter):** `PrincipalGatewayDO`, co-resident on one `state.storage.sql`
-  trust domain — `createDurableObjectSqlVault` (per-owner DEK, L2 envelope crypto); durable
-  single-writer `createDurableObjectExchangeStore` (fail-closed `applyExchangeEvent`); T0
-  `deliver`/`applyEvent`/`inbox`; T1 `AuthorityVerdictCache` + `RequestIdLedger` (§3a: cached verdict
-  A + single-use requestId); **co-resident MCP** (`invokeFast` runs the tool IN-PROCESS over the DO
-  vault after the A→B→requestId gate; heavy verify + KEK wrapper INJECTED via `GatewayDeps`); **T2
-  orchestration loop** (co-resident tools AS the `orchestration` ToolInvoker; only the LLM planner
-  injected); **signed `DeliveryReceiptV1`** (DO-local secp256k1). The ONLY subtree importing
-  `@cloudflare/workers-types`.
-- **W4 DONE:** `GatewaySurfaceCommitmentV1` (gatewayRoot preimage) + peer `DeliveryEnvelopeV1` +
-  `receiveDelivery` + `OutboxStore` store-and-forward.
-- **W6 DONE (spec 340 — the Agentic Interaction spine):** `apix:` is the canonical vocabulary
-  (`apfab:` RETIRED). `InteractionRecordV1` is the root aggregate; `ContextSnapshotV1` replaces
-  floating `contextRefs`; six state machines, never collapsed (delivery · inbox · interaction ·
-  decision · commitment · execution); versioned `InteractionProfile`s replace the `MessageKind`/
-  `CaseState` enums; `createDurableObjectInteractionStore` is their durable home on the gateway DO,
-  reachable as `do.interactions`. **The store exposes transitions, never state assignment** — the
-  creditor discharges, not the debtor, and persistence must not become a bypass.
-- **W10a DONE (spec 340):** the case flow EMITS. `caseTransitionEmissions` + `applyCaseEmissions` put
-  `approve`/`deny`/`expire` into the decision machine and `issue-credential`/`revoke` into the
-  commitment machine, applied THROUGH those machines (never state assignment), wired into the
-  interaction store the Home drives. `deliver-credential` deliberately emits nothing — completing the
-  work discharges no obligation (ADR-0058 §15).
-- **W10b DONE (spec 340):** `CaseState` is EXECUTION-ONLY (11 → 8). `approved`/`denied`/`expired`/
-  `revoked` removed, `closed` added. The transition VERBS are unchanged — which is why stored logs
-  replay untouched and no migration exists. `issue-credential`'s ordering is now a cross-machine
-  precondition (`requires-granted-decision`), projected onto `ExchangeRecordV1.decision` for the
-  reducer path, because that path had been getting the guarantee free from the FSM edge.
-- **Next:** `MessageEnvelopeV1.kind` — the LAST enum, and the hard one: it is inside the signed wire
-  hash, so removal is an `ap.message.v2` cutover with re-signing, not a cleanup (spec 340 §R.1/§R.3); an interaction-aware ingress that
-  opens/joins an Interaction rather than only writing an Exchange; on-chain `atl:gatewayRoot` record
-  (contracts, separate); `A2aTaskDO`/`SessionStoreDO` absorption + `alarm()` drain; `fetch`/`alarm`
-  e2e via vitest-pool-workers.
+## Status
+**W1–W10b DONE.** Wave-by-wave history + what each shipped:
+[`docs/architecture.md` §7a](docs/architecture.md). Next: `MessageEnvelopeV1.kind` — the last enum, and a
+re-signing cutover rather than a cleanup (it is inside the signed wire hash, spec 340 §R.1/§R.3);
+interaction-aware ingress; on-chain `atl:gatewayRoot`; `A2aTaskDO`/`SessionStoreDO` absorption.
 
 ## What this package owns
 - `ExchangeRecordV1` — the ONE canonical object (spine id `xch_`); two-level FSM: `ExecState`
@@ -53,6 +22,16 @@ adapter ships from `./cloudflare`.
   case reducer + typed payloads + runs (from `interactions`), delivery/admission/discovery.
 
 ## Hard rules
+- **DO-local is the serving plane; the vault is the RECORD** ([ADR-0055](../../docs/architecture/decisions/0055-vaults-are-the-canonical-system-of-record-for-content.md)
+  + amendment). `state.storage.sql` holds ordering, cursors, receipts, request-id ledgers, projections,
+  caches. Test for any new table: *if this DO were wiped, is the loss a rebuild or a bereavement?* A
+  projection must be rebuildable AND the rebuild tested (vault-first write · `rebuild()` in code · a test
+  that wipes and rebuilds) — `createVaultExchangeStore` / `createVaultInteractionStore` satisfy all three;
+  residency (**each party holds their own copy**) is [spec 316 §0b](../../specs/316-agentic-interaction-fabric.md).
+  `PrincipalGatewayDO` builds a DO-SQL vault INTERNALLY, so an adopting app MUST inject.
+- **Two serving planes; the transition is a LADDER** ([ADR-0060](../../docs/architecture/decisions/0060-incremental-gateway-adoption.md)).
+  `InteractionsDO` serves; this is the target. Ops climb `off → shadow → serving` one at a time. A clean
+  shadow proves the planes AGREE, never that either is right.
 - **Authority is never satisfied by the exchange.** A request carries an `authorityRef`; approving a
   case advances the lifecycle, it NEVER unlocks a resource (spec 316 §2, ADR-0041).
 - **`ExecState` is `fulfillment`'s `TaskState`, unmodified** — `fulfillment` stays a pure leaf.
@@ -60,6 +39,11 @@ adapter ships from `./cloudflare`.
 - **Transport-agnostic core.** No Cloudflare/MCP/A2A-SDK imports in `src/` — `./cloudflare` is the
   only adapter and the only `@cloudflare/workers-types` consumer.
 
+- **The adoption ladder's mechanics are here** (`src/adoption.ts`, promoted in spec 399 §4): `AdoptionLedger`
+  types, `adoptionStage(ledger, op, env)` (the deployment's `GATEWAY_SHADOW` gates a shadow; `""` is unset),
+  `compareServed` / `classifyDivergence` (a race is not a divergence), `shouldShadow` sampling, the bounded
+  in-memory `recordDivergence`. The ledger VALUES — which op is on which rung, and why — stay with the product.
+
 ## Boundary
 `types`, `fulfillment`, `vault`, `audit`, `delegation`, `chain-state`, `tool-policy`, `agent-naming`
 (injected resolver) ← `fabric`; `fabric/cloudflare → orchestration` (adapter-only); `fabric →
@@ -71,17 +55,14 @@ pnpm --filter @agenticprimitives/fabric typecheck
 pnpm --filter @agenticprimitives/fabric test
 ```
 
-## Capabilities this package participates in
-- **Messaging + Interactions** ([`specs/309`](../../specs/309-messaging-and-interactions.md)) — fabric IS
-  the substrate the messaging (envelope/inbox) + interactions (case/run) capability was absorbed into
-  (spec 316 W1); demo guide: [`apps/demo-sso-next/docs/messaging-interactions/guide.md`](../../apps/demo-sso-next/docs/messaging-interactions/guide.md).
-- **Home / agentic control plane + inbox** ([`specs/310`](../../specs/310-agentic-trust-home-control-plane-and-inbox.md)) —
-  the vault-resident inbox + control-plane projections read fabric wire types; demo guide:
-  [`apps/demo-sso-next/docs/home-inbox/guide.md`](../../apps/demo-sso-next/docs/home-inbox/guide.md).
-- Index: [`docs/architecture/cross-cutting-capabilities.md`](../../docs/architecture/cross-cutting-capabilities.md).
+## Capabilities
+- **Messaging + Interactions** ([spec 309](../../specs/309-messaging-and-interactions.md)) — fabric IS the
+  substrate both were absorbed into · [guide](../../apps/demo-sso-next/docs/messaging-interactions/guide.md).
+- **Home control plane + inbox** ([spec 310](../../specs/310-agentic-trust-home-control-plane-and-inbox.md))
+  · [guide](../../apps/demo-sso-next/docs/home-inbox/guide.md).
+- Index: [cross-cutting-capabilities.md](../../docs/architecture/cross-cutting-capabilities.md).
 
-## Spec + demo guides
-`../../specs/316-agentic-interaction-fabric.md` (architect-of-record) +
-`../../docs/architecture/agentic-interaction-fabric-target.md` + ADR-0047. Demo guides: spec 309
-`../../apps/demo-sso-next/docs/messaging-interactions/guide.md` · spec 310
-`../../apps/demo-sso-next/docs/home-inbox/guide.md`.
+## Spec + guides
+[spec 316](../../specs/316-agentic-interaction-fabric.md) (architect-of-record) ·
+[target](../../docs/architecture/agentic-interaction-fabric-target.md) · ADR-0047 ·
+[fabric architecture](docs/architecture.md) (live wiring + build history).

package/dist/adoption.d.ts

@@ -0,0 +1,79 @@
+/** Which of the five candidate causes an op's move actually exercises. Naming it per op is the point of
+ *  moving one at a time: if an op diverges, its concerns say where to look, and where not to. */
+export type AdoptionConcern = 'auth' | 'projection' | 'ordering' | 'data-shape' | 'assistant';
+export type AdoptionStage = 'off' | 'shadow' | 'serving';
+export interface AdoptionEntry {
+    stage: AdoptionStage;
+    /** What moving this op puts at risk — read this first when its shadow diverges. */
+    concerns: readonly AdoptionConcern[];
+    /** Why this op is at this rung. Prose, because "it's next" and "it's blocked" look identical in a stage
+     *  field, and the difference is the whole state of the migration. */
+    note: string;
+    /**
+     * Fields that legitimately differ between the two planes because each computes them at its own instant.
+     * Declared PER OP and BEFORE evidence arrives — classifying noise after seeing a report is how a real
+     * divergence gets explained away as expected. An EMPTY list is a claim, not an omission: it asserts this
+     * op has no per-read computation, so any difference is either a race or a defect. Say why in `note`.
+     */
+    volatileFields: readonly string[];
+}
+/** The ledger: one place that says which plane serves what, so adoption is data rather than conditionals
+ *  spread across a serving object. An op absent from it is `off`: adoption is opt-in, because the failure
+ *  mode of opt-out is an op that moved because nobody remembered to stop it. */
+export type AdoptionLedger = Readonly<Record<string, AdoptionEntry>>;
+/**
+ * The stage an op runs at IN THIS DEPLOYMENT. The ledger says how far an op has climbed in the code; the
+ * deployment's `GATEWAY_SHADOW` says whether it is running the comparison at all. Both are required, and the
+ * env one defaults to OFF — constructing the gateway creates its tables, and an ungated shadow on a hot op
+ * would make that storage decision for every principal at once. Empty string is unset, not enabled
+ * (`wrangler`'s `VAR = ""` binds an empty string that `??` sails straight past).
+ */
+export declare function adoptionStage(ledger: AdoptionLedger, op: string, env?: {
+    GATEWAY_SHADOW?: string;
+}): AdoptionStage;
+export interface Divergence {
+    op: string;
+    at: string;
+    /** `equal` is recorded too. A shadow that only reports differences cannot distinguish "the planes agree"
+     *  from "the shadow never ran", and those justify opposite decisions about promoting. */
+    kind: 'equal' | 'value' | 'raced' | 'gateway-error' | 'shadow-skipped';
+    detail?: string;
+}
+/**
+ * Compare the two planes' answers. Canonical JSON with sorted keys: key ORDER is not a difference worth
+ * blocking a promotion on. Everything else counts, including `undefined` vs absent — a field that vanished
+ * is exactly the data-shape drift being watched for.
+ */
+export declare function compareServed(op: string, served: unknown, shadow: unknown, at: string): Divergence;
+/**
+ * Was an apparent divergence just the document moving between the two reads? After the shadow read, take
+ * the serving read AGAIN: `servedAgain` matches the shadow ⇒ the document moved — RACED, benign, evidence of
+ * nothing; `servedAgain` still matches the original and differs from the shadow ⇒ the planes really
+ * disagree. DELIBERATELY CONSERVATIVE: anything not provably a race stays `value`.
+ */
+export declare function classifyDivergence(input: {
+    op: string;
+    served: unknown;
+    shadow: unknown;
+    servedAgain: unknown;
+    at: string;
+}): Divergence;
+/**
+ * Should this call run its shadow? Shadowing doubles the delegated reads on the path being shadowed, so it
+ * is SAMPLED: at most one shadow per principal per `intervalMs`. Time-based rather than 1-in-N because it
+ * bounds the ADDED LOAD directly; a ratio bounds a proportion of a rate that varies with how many clients a
+ * principal has open. The first call always samples — a low-traffic principal must still contribute.
+ */
+export declare function shouldShadow(input: {
+    lastShadowAt: number | undefined;
+    now: number;
+    intervalMs: number;
+}): boolean;
+/** One shadow per principal per minute: enough to catch a systematic difference within a session, far below
+ *  a per-principal read limiter's budget even with several clients open. */
+export declare const SHADOW_INTERVAL_MS = 60000;
+/** How many divergences to keep — in MEMORY, not durable storage: diagnostics with a shelf life of one
+ *  investigation. Losing them on isolate recycle is the correct trade. */
+export declare const DIVERGENCE_BUFFER = 20;
+export declare function recordDivergence(buf: Divergence[], d: Divergence): Divergence[];
+//# sourceMappingURL=adoption.d.ts.map

package/dist/adoption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adoption.d.ts","sourceRoot":"","sources":["../src/adoption.ts"],"names":[],"mappings":"AAiBA;iGACiG;AACjG,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,YAAY,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,CAAC;AAE9F,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,mFAAmF;IACnF,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IACrC;yEACqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;gFAEgF;AAChF,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAIlH;AAID,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX;6FACyF;IACzF,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,eAAe,GAAG,gBAAgB,CAAC;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU,CAKlG;AAoBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAQxI;AAID;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAGlH;AAED;4EAC4E;AAC5E,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC;0EAC0E;AAC1E,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,UAAU,GAAG,UAAU,EAAE,CAG/E"}

package/dist/adoption.js

@@ -0,0 +1,95 @@
+// INCREMENTAL SERVING-PLANE ADOPTION — the LADDER (ADR-0060; ADR-0055 amendment). Promoted from the runtime
+// app in spec 399 W0 (§4): the ledger TYPES, the rung rule and the divergence/sampling mechanics are the
+// contract every product adopting `PrincipalGatewayDO` needs; the ledger VALUES (which op sits on which rung,
+// and why) stay with the product that owns those ops.
+//
+// THE LADDER. Every op climbs the same three rungs, and never skips one:
+//   `off`     — the incumbent plane serves. The gateway is not consulted.
+//   `shadow`  — the incumbent serves AND ITS ANSWER IS THE RESPONSE. The gateway runs alongside and the
+//               two are compared. Divergence is recorded; it never reaches the caller and never fails the
+//               request. This is the rung that converts "we think it matches" into evidence.
+//   `serving` — the gateway serves. Promotion is earned by a shadow run with no unexplained divergence,
+//               not by the code being finished.
+//
+// WHAT A RUNG DOES NOT DO. Shadowing proves the two planes AGREE; it does not prove either is right. An op
+// whose incumbent implementation is wrong will shadow perfectly clean while the gateway faithfully
+// reproduces the bug. Promotion is evidence of equivalence, not of correctness.
+/**
+ * The stage an op runs at IN THIS DEPLOYMENT. The ledger says how far an op has climbed in the code; the
+ * deployment's `GATEWAY_SHADOW` says whether it is running the comparison at all. Both are required, and the
+ * env one defaults to OFF — constructing the gateway creates its tables, and an ungated shadow on a hot op
+ * would make that storage decision for every principal at once. Empty string is unset, not enabled
+ * (`wrangler`'s `VAR = ""` binds an empty string that `??` sails straight past).
+ */
+export function adoptionStage(ledger, op, env) {
+    const stage = ledger[op]?.stage ?? 'off';
+    if (stage === 'shadow' && (env?.GATEWAY_SHADOW ?? '').trim().toLowerCase() !== 'on')
+        return 'off';
+    return stage;
+}
+/**
+ * Compare the two planes' answers. Canonical JSON with sorted keys: key ORDER is not a difference worth
+ * blocking a promotion on. Everything else counts, including `undefined` vs absent — a field that vanished
+ * is exactly the data-shape drift being watched for.
+ */
+export function compareServed(op, served, shadow, at) {
+    const a = canonical(served);
+    const b = canonical(shadow);
+    if (a === b)
+        return { op, at, kind: 'equal' };
+    return { op, at, kind: 'value', detail: firstDifference(a, b) };
+}
+function canonical(v) {
+    return JSON.stringify(v, (_k, val) => val && typeof val === 'object' && !Array.isArray(val)
+        ? Object.fromEntries(Object.entries(val).sort(([x], [y]) => x.localeCompare(y)))
+        : val) ?? 'undefined';
+}
+/** A bounded excerpt around the first difference. Bounded because a divergence report that embeds two whole
+ *  documents is a copy of the person's records in a diagnostic buffer — the thing the vault doctrine exists
+ *  to prevent, arrived at through the back door. */
+function firstDifference(a, b) {
+    let i = 0;
+    while (i < a.length && i < b.length && a[i] === b[i])
+        i++;
+    const w = 40;
+    return `@${i}: served=${JSON.stringify(a.slice(Math.max(0, i - 8), i + w))} shadow=${JSON.stringify(b.slice(Math.max(0, i - 8), i + w))}`;
+}
+/**
+ * Was an apparent divergence just the document moving between the two reads? After the shadow read, take
+ * the serving read AGAIN: `servedAgain` matches the shadow ⇒ the document moved — RACED, benign, evidence of
+ * nothing; `servedAgain` still matches the original and differs from the shadow ⇒ the planes really
+ * disagree. DELIBERATELY CONSERVATIVE: anything not provably a race stays `value`.
+ */
+export function classifyDivergence(input) {
+    const first = compareServed(input.op, input.served, input.shadow, input.at);
+    if (first.kind === 'equal')
+        return first;
+    const settled = compareServed(input.op, input.servedAgain, input.shadow, input.at);
+    if (settled.kind === 'equal') {
+        return { op: input.op, at: input.at, kind: 'raced', detail: 'document changed between the serving read and the shadow read' };
+    }
+    return first;
+}
+// ── Sampling ──────────────────────────────────────────────────────────────────────────────────────────
+/**
+ * Should this call run its shadow? Shadowing doubles the delegated reads on the path being shadowed, so it
+ * is SAMPLED: at most one shadow per principal per `intervalMs`. Time-based rather than 1-in-N because it
+ * bounds the ADDED LOAD directly; a ratio bounds a proportion of a rate that varies with how many clients a
+ * principal has open. The first call always samples — a low-traffic principal must still contribute.
+ */
+export function shouldShadow(input) {
+    if (input.lastShadowAt === undefined)
+        return true;
+    return input.now - input.lastShadowAt >= input.intervalMs;
+}
+/** One shadow per principal per minute: enough to catch a systematic difference within a session, far below
+ *  a per-principal read limiter's budget even with several clients open. */
+export const SHADOW_INTERVAL_MS = 60_000;
+/** How many divergences to keep — in MEMORY, not durable storage: diagnostics with a shelf life of one
+ *  investigation. Losing them on isolate recycle is the correct trade. */
+export const DIVERGENCE_BUFFER = 20;
+export function recordDivergence(buf, d) {
+    buf.push(d);
+    return buf.length > DIVERGENCE_BUFFER ? buf.slice(-DIVERGENCE_BUFFER) : buf;
+}
+//# sourceMappingURL=adoption.js.map

package/dist/adoption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adoption.js","sourceRoot":"","sources":["../src/adoption.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,yGAAyG;AACzG,8GAA8G;AAC9G,sDAAsD;AACtD,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,wGAAwG;AACxG,0GAA0G;AAC1G,6FAA6F;AAC7F,wGAAwG;AACxG,gDAAgD;AAChD,EAAE;AACF,2GAA2G;AAC3G,mGAAmG;AACnG,gFAAgF;AA6BhF;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,MAAsB,EAAE,EAAU,EAAE,GAAiC;IACjG,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC;IACzC,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClG,OAAO,KAAK,CAAC;AACf,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,EAAU,EAAE,MAAe,EAAE,MAAe,EAAE,EAAU;IACpF,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9C,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CACnC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3G,CAAC,CAAC,GAAG,CACR,IAAI,WAAW,CAAC;AACnB,CAAC;AAED;;oDAEoD;AACpD,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,CAAC,EAAE,CAAC;IAC1D,MAAM,CAAC,GAAG,EAAE,CAAC;IACb,OAAO,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5I,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAyF;IAC1H,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;IAChI,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yGAAyG;AAEzG;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAA4E;IACvG,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,CAAC;AAC5D,CAAC;AAED;4EAC4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC;0EAC0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,UAAU,gBAAgB,CAAC,GAAiB,EAAE,CAAa;IAC/D,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9E,CAAC"}

package/dist/cloudflare/authority-verdict-cache.d.ts

@@ -23,5 +23,32 @@ export interface AuthorityVerdictCache {
     /** Deployment-epoch change (spec 311): drop every verdict NOT on `currentEpoch`. */
     sweepEpoch(currentEpoch: string): Promise<void>;
 }
-export declare function createDurableObjectAuthorityVerdictCache(sql: SqlStorage): AuthorityVerdictCache;
+/**
+ * How long a cached verdict may be reused before the cold path must run again.
+ *
+ * 60s mirrors `InteractionsDO`'s existing positive-verdict cache (NEW-H4/FAB-A2A-1), which was sized as
+ * an RPC-429 mitigation for high-frequency non-sensitive reads. Matching it keeps ONE number in the
+ * deployment rather than two that drift.
+ */
+export declare const VERDICT_TTL_MS = 60000;
+export interface VerdictCacheOptions {
+    /** Bounded reuse window. `0` disables caching entirely (every get misses ⇒ cold path every call). */
+    ttlMs?: number;
+    now?: () => number;
+}
+/**
+ * BOUNDED REUSE IS PART OF THE VERDICT, NOT AN OPTIMISATION KNOB.
+ *
+ * Verdict (A) asserts "this delegation was valid AND UNREVOKED at `verifiedAt`". Serving it later without
+ * regard to age silently upgrades that into "is valid and unrevoked", which is a claim the cold path never
+ * made. Before this, `verified_at` was written and never read: a verdict cached once stayed warm forever,
+ * and a revoked delegation kept passing (A) until something called `invalidateDelegation` — a revocation
+ * NOTICE that has to be delivered by a second mechanism and may simply never arrive. Revocation that only
+ * works when someone remembers to push it is not revocation.
+ *
+ * Expiry is a MISS, not an error: `invokeFast` refuses on a miss and the caller re-runs `verifyAndCache`,
+ * which re-checks the signature and `isRevoked` on-chain. So the ceiling on serving a revoked delegation
+ * is `ttlMs`, and the mechanism is the same one throughout (ADR-0013) — the cold path, run again.
+ */
+export declare function createDurableObjectAuthorityVerdictCache(sql: SqlStorage, opts?: VerdictCacheOptions): AuthorityVerdictCache;
 //# sourceMappingURL=authority-verdict-cache.d.ts.map

package/dist/cloudflare/authority-verdict-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authority-verdict-cache.d.ts","sourceRoot":"","sources":["../../src/cloudflare/authority-verdict-cache.ts"],"names":[],"mappings":"AA6BA;4GAC4G;AAC5G,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,gBAAgB,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;AAYhH,MAAM,WAAW,qBAAqB;IACpC,yDAAyD;IACzD,GAAG,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;mGAC+F;IAC/F,GAAG,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAChE,uFAAuF;IACvF,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,oFAAoF;IACpF,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAKD,wBAAgB,wCAAwC,CAAC,GAAG,EAAE,UAAU,GAAG,qBAAqB,CA6C/F"}
+{"version":3,"file":"authority-verdict-cache.d.ts","sourceRoot":"","sources":["../../src/cloudflare/authority-verdict-cache.ts"],"names":[],"mappings":"AA6BA;4GAC4G;AAC5G,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,gBAAgB,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;AAYhH,MAAM,WAAW,qBAAqB;IACpC,yDAAyD;IACzD,GAAG,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;mGAC+F;IAC/F,GAAG,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAChE,uFAAuF;IACvF,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,oFAAoF;IACpF,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAKD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,QAAS,CAAC;AAErC,MAAM,WAAW,mBAAmB;IAClC,qGAAqG;IACrG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,GAAG,EAAE,UAAU,EACf,IAAI,CAAC,EAAE,mBAAmB,GACzB,qBAAqB,CAsDvB"}

package/dist/cloudflare/authority-verdict-cache.js

@@ -26,10 +26,34 @@ const CREATE_TABLE = `CREATE TABLE IF NOT EXISTS authority_verdicts (
 const CREATE_IDX_DELEG = `CREATE INDEX IF NOT EXISTS idx_authority_verdicts_deleg ON authority_verdicts (delegation_hash)`;
 const CREATE_IDX_EPOCH = `CREATE INDEX IF NOT EXISTS idx_authority_verdicts_epoch ON authority_verdicts (epoch)`;
 const keyOf = (k) => `${k.sessionKey.toLowerCase()}|${k.delegationHash.toLowerCase()}|${k.epoch}|${k.manager.toLowerCase()}`;
-export function createDurableObjectAuthorityVerdictCache(sql) {
+/**
+ * How long a cached verdict may be reused before the cold path must run again.
+ *
+ * 60s mirrors `InteractionsDO`'s existing positive-verdict cache (NEW-H4/FAB-A2A-1), which was sized as
+ * an RPC-429 mitigation for high-frequency non-sensitive reads. Matching it keeps ONE number in the
+ * deployment rather than two that drift.
+ */
+export const VERDICT_TTL_MS = 60_000;
+/**
+ * BOUNDED REUSE IS PART OF THE VERDICT, NOT AN OPTIMISATION KNOB.
+ *
+ * Verdict (A) asserts "this delegation was valid AND UNREVOKED at `verifiedAt`". Serving it later without
+ * regard to age silently upgrades that into "is valid and unrevoked", which is a claim the cold path never
+ * made. Before this, `verified_at` was written and never read: a verdict cached once stayed warm forever,
+ * and a revoked delegation kept passing (A) until something called `invalidateDelegation` — a revocation
+ * NOTICE that has to be delivered by a second mechanism and may simply never arrive. Revocation that only
+ * works when someone remembers to push it is not revocation.
+ *
+ * Expiry is a MISS, not an error: `invokeFast` refuses on a miss and the caller re-runs `verifyAndCache`,
+ * which re-checks the signature and `isRevoked` on-chain. So the ceiling on serving a revoked delegation
+ * is `ttlMs`, and the mechanism is the same one throughout (ADR-0013) — the cold path, run again.
+ */
+export function createDurableObjectAuthorityVerdictCache(sql, opts) {
     sql.exec(CREATE_TABLE);
     sql.exec(CREATE_IDX_DELEG);
     sql.exec(CREATE_IDX_EPOCH);
+    const ttlMs = opts?.ttlMs ?? VERDICT_TTL_MS;
+    const now = opts?.now ?? (() => Date.now());
     return {
         async put(v) {
             sql.exec(`INSERT INTO authority_verdicts (cache_key, principal, session_key, delegation_hash, epoch, manager, verified_at)
@@ -46,6 +70,13 @@ export function createDurableObjectAuthorityVerdictCache(sql) {
             const r = rows[0];
             if (!r)
                 return null;
+            // Age it out. An unparseable `verified_at` counts as EXPIRED: a row whose age cannot be established
+            // is one whose freshness cannot be established, and the safe reading of "I don't know" is a miss.
+            const verifiedAtMs = Date.parse(r.verified_at);
+            if (!Number.isFinite(verifiedAtMs) || now() - verifiedAtMs >= ttlMs) {
+                sql.exec('DELETE FROM authority_verdicts WHERE cache_key = ?', keyOf(key));
+                return null;
+            }
             return {
                 principal: r.principal,
                 sessionKey: r.session_key,

package/dist/cloudflare/authority-verdict-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"authority-verdict-cache.js","sourceRoot":"","sources":["../../src/cloudflare/authority-verdict-cache.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,uEAAuE;AACvE,EAAE;AACF,0FAA0F;AAC1F,2GAA2G;AAC3G,oGAAoG;AACpG,iGAAiG;AACjG,4GAA4G;AAC5G,qDAAqD;AACrD,wGAAwG;AACxG,yGAAyG;AACzG,wGAAwG;AACxG,4GAA4G;AAC5G,oGAAoG;AACpG,EAAE;AACF,0GAA0G;AAE1G,MAAM,YAAY,GAAG;;;;;;;;EAQnB,CAAC;AACH,MAAM,gBAAgB,GAAG,iGAAiG,CAAC;AAC3H,MAAM,gBAAgB,GAAG,uFAAuF,CAAC;AAwCjH,MAAM,KAAK,GAAG,CAAC,CAAsB,EAAU,EAAE,CAC/C,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;AAE1G,MAAM,UAAU,wCAAwC,CAAC,GAAe;IACtE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE3B,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,CAAC;YACT,GAAG,CAAC,IAAI,CACN;;;;;0EAKkE,EAClE,KAAK,CAAC,CAAC,CAAC,EACR,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,EACzB,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,EAC1B,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,EAC9B,CAAC,CAAC,KAAK,EACP,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EACvB,CAAC,CAAC,UAAU,CACb,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CAAa,sDAAsD,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;iBACpF,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpB,OAAO;gBACL,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,CAAC,CAAC,WAAW;gBACzB,cAAc,EAAE,CAAC,CAAC,eAAe;gBACjC,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,UAAU,EAAE,CAAC,CAAC,WAAW;aAC1B,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,oBAAoB,CAAC,cAAc;YACvC,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,YAAY;YAC3B,GAAG,CAAC,IAAI,CAAC,iDAAiD,EAAE,YAAY,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authority-verdict-cache.js","sourceRoot":"","sources":["../../src/cloudflare/authority-verdict-cache.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,uEAAuE;AACvE,EAAE;AACF,0FAA0F;AAC1F,2GAA2G;AAC3G,oGAAoG;AACpG,iGAAiG;AACjG,4GAA4G;AAC5G,qDAAqD;AACrD,wGAAwG;AACxG,yGAAyG;AACzG,wGAAwG;AACxG,4GAA4G;AAC5G,oGAAoG;AACpG,EAAE;AACF,0GAA0G;AAE1G,MAAM,YAAY,GAAG;;;;;;;;EAQnB,CAAC;AACH,MAAM,gBAAgB,GAAG,iGAAiG,CAAC;AAC3H,MAAM,gBAAgB,GAAG,uFAAuF,CAAC;AAwCjH,MAAM,KAAK,GAAG,CAAC,CAAsB,EAAU,EAAE,CAC/C,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;AAE1G;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAQrC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wCAAwC,CACtD,GAAe,EACf,IAA0B;IAE1B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,cAAc,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE5C,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,CAAC;YACT,GAAG,CAAC,IAAI,CACN;;;;;0EAKkE,EAClE,KAAK,CAAC,CAAC,CAAC,EACR,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,EACzB,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,EAC1B,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,EAC9B,CAAC,CAAC,KAAK,EACP,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EACvB,CAAC,CAAC,UAAU,CACb,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CAAa,sDAAsD,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;iBACpF,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpB,oGAAoG;YACpG,kGAAkG;YAClG,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,GAAG,YAAY,IAAI,KAAK,EAAE,CAAC;gBACpE,GAAG,CAAC,IAAI,CAAC,oDAAoD,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO;gBACL,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,CAAC,CAAC,WAAW;gBACzB,cAAc,EAAE,CAAC,CAAC,eAAe;gBACjC,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,UAAU,EAAE,CAAC,CAAC,WAAW;aAC1B,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,oBAAoB,CAAC,cAAc;YACvC,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,YAAY;YAC3B,GAAG,CAAC,IAAI,CAAC,iDAAiD,EAAE,YAAY,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cloudflare/index.d.ts

@@ -4,11 +4,13 @@ export { createDurableObjectInteractionStore, type InteractionStore, type Snapsh
 export { createDurableObjectOutboxStore, type OutboxStore, type OutboxEntry } from './outbox-store.js';
 export { createDurableObjectProvenanceStore, type ProvenanceStore } from './provenance-store.js';
 export { createDurableObjectChannelStore, projectionAuthorizes, type ChannelStore, type ChannelV1, type ConversationRoleProjection, type ConversationRoleAction, } from './channel-store.js';
-export { createDurableObjectAuthorityVerdictCache, type AuthorityVerdictCache, type AuthorityVerdict, type AuthorityVerdictKey, } from './authority-verdict-cache.js';
+export { createDurableObjectAuthorityVerdictCache, VERDICT_TTL_MS, type VerdictCacheOptions, type AuthorityVerdictCache, type AuthorityVerdict, type AuthorityVerdictKey, } from './authority-verdict-cache.js';
 export { createDurableObjectRequestIdLedger, type RequestIdLedger, type RequestIdReservation } from './request-id-ledger.js';
 export { createDurableObjectReceiptSigner, verifyDeliveryReceipt, type DeliveryReceiptSigner, type DeliveryReceiptInput, type SignedDeliveryReceiptV1, } from './receipt-signer.js';
 export { PrincipalGatewayDO, type PrincipalGatewayEnv, type GatewayDeps } from './principal-gateway-do.js';
 export { buildVaultTools, createToolRegistry, type GatewayTool, type GatewayToolContext, type GatewayToolRegistry, } from './gateway-tools.js';
 export { runGatewayOrchestration, gatewayToolSpecs, bindGatewayToolInvoker } from './orchestration-runtime.js';
+export { createVaultExchangeStore, exchangeResource, EXCHANGE_INDEX_RESOURCE, type VaultExchangeStore, type ExchangeIndexV1, } from './vault-exchange-store.js';
+export { createVaultInteractionStore, interactionResource, decisionResource, commitmentResource, snapshotResource, inboxEntryResource, INTERACTION_INDEX_RESOURCE, type VaultInteractionStore, type InteractionIndexV1, } from './vault-interaction-store.js';
 export declare const FABRIC_CLOUDFLARE_ADAPTER_STATUS: "w2-coresident-mcp";
 //# sourceMappingURL=index.d.ts.map

package/dist/cloudflare/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gCAAgC,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAI3F,OAAO,EACL,mCAAmC,EACnC,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,8BAA8B,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,EACL,+BAA+B,EAAE,oBAAoB,EACrD,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,KAAK,0BAA0B,EAAE,KAAK,sBAAsB,GAChG,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wCAAwC,EACxC,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC3G,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAE/G,eAAO,MAAM,gCAAgC,EAAG,mBAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gCAAgC,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAI3F,OAAO,EACL,mCAAmC,EACnC,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,8BAA8B,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,EACL,+BAA+B,EAAE,oBAAoB,EACrD,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,KAAK,0BAA0B,EAAE,KAAK,sBAAsB,GAChG,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wCAAwC,EACxC,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC3G,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAC/G,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,8BAA8B,CAAC;AAEtC,eAAO,MAAM,gCAAgC,EAAG,mBAA4B,CAAC"}

package/dist/cloudflare/index.js

@@ -14,11 +14,13 @@ export { createDurableObjectInteractionStore, } from './interaction-store.js';
 export { createDurableObjectOutboxStore } from './outbox-store.js';
 export { createDurableObjectProvenanceStore } from './provenance-store.js';
 export { createDurableObjectChannelStore, projectionAuthorizes, } from './channel-store.js';
-export { createDurableObjectAuthorityVerdictCache, } from './authority-verdict-cache.js';
+export { createDurableObjectAuthorityVerdictCache, VERDICT_TTL_MS, } from './authority-verdict-cache.js';
 export { createDurableObjectRequestIdLedger } from './request-id-ledger.js';
 export { createDurableObjectReceiptSigner, verifyDeliveryReceipt, } from './receipt-signer.js';
 export { PrincipalGatewayDO } from './principal-gateway-do.js';
 export { buildVaultTools, createToolRegistry, } from './gateway-tools.js';
 export { runGatewayOrchestration, gatewayToolSpecs, bindGatewayToolInvoker } from './orchestration-runtime.js';
+export { createVaultExchangeStore, exchangeResource, EXCHANGE_INDEX_RESOURCE, } from './vault-exchange-store.js';
+export { createVaultInteractionStore, interactionResource, decisionResource, commitmentResource, snapshotResource, inboxEntryResource, INTERACTION_INDEX_RESOURCE, } from './vault-interaction-store.js';
 export const FABRIC_CLOUDFLARE_ADAPTER_STATUS = 'w2-coresident-mcp';
 //# sourceMappingURL=index.js.map

package/dist/cloudflare/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,EAAE;AACF,wGAAwG;AACxG,wGAAwG;AACxG,yGAAyG;AACzG,yGAAyG;AACzG,4CAA4C;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gCAAgC,EAAsB,MAAM,qBAAqB,CAAC;AAC3F,mGAAmG;AACnG,oGAAoG;AACpG,oEAAoE;AACpE,OAAO,EACL,mCAAmC,GAGpC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,8BAA8B,EAAsC,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAwB,MAAM,uBAAuB,CAAC;AACjG,OAAO,EACL,+BAA+B,EAAE,oBAAoB,GAEtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wCAAwC,GAIzC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAmD,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EACL,gCAAgC,EAChC,qBAAqB,GAItB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAA8C,MAAM,2BAA2B,CAAC;AAC3G,OAAO,EACL,eAAe,EACf,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAE/G,MAAM,CAAC,MAAM,gCAAgC,GAAG,mBAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,EAAE;AACF,wGAAwG;AACxG,wGAAwG;AACxG,yGAAyG;AACzG,yGAAyG;AACzG,4CAA4C;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gCAAgC,EAAsB,MAAM,qBAAqB,CAAC;AAC3F,mGAAmG;AACnG,oGAAoG;AACpG,oEAAoE;AACpE,OAAO,EACL,mCAAmC,GAGpC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,8BAA8B,EAAsC,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAwB,MAAM,uBAAuB,CAAC;AACjG,OAAO,EACL,+BAA+B,EAAE,oBAAoB,GAEtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wCAAwC,EACxC,cAAc,GAKf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAmD,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EACL,gCAAgC,EAChC,qBAAqB,GAItB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAA8C,MAAM,2BAA2B,CAAC;AAC3G,OAAO,EACL,eAAe,EACf,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAC/G,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,uBAAuB,GAGxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,GAG3B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,CAAC,MAAM,gCAAgC,GAAG,mBAA4B,CAAC"}

package/dist/cloudflare/principal-gateway-do.d.ts

@@ -4,6 +4,7 @@ import type { AuthorityTier } from '@agenticprimitives/tool-policy';
 import type { ExchangeRecordV1, ExchangeEventV1, ExchangeId } from '../exchange-record.js';
 import { type DeliveryEnvelopeV1 } from '../delivery-envelope.js';
 import { type OutboxEntry } from './outbox-store.js';
+import { type ExchangeStore } from './exchange-store.js';
 import { type InteractionStore } from './interaction-store.js';
 import type { CommitmentRecordV1 } from '../interaction-machines.js';
 import type { InteractionRecordV1, InteractionId, ProfileVersion, ParticipationV1 } from '../interaction-record.js';
@@ -40,6 +41,23 @@ export interface GatewayDeps {
     /** The injected planner for the T2 orchestration loop (§15) — the LLM adapter in prod, the rule-based
      *  planner in tests. Absent ⇒ `orchestrate()` throws (T2 unavailable), but T0/T1 still work. */
     planner?: Planner;
+    /**
+     * THE THREE STORAGE SEAMS (ADR-0055 amendment). Omit them and this DO constructs its own DO-SQL
+     * stores, which is right for tests and for a self-hosted single-tenant gateway. A deployment whose
+     * records already live in an owner's vault MUST inject instead — because otherwise adopting this DO
+     * moves person data out of the vault as a SIDE EFFECT of a runtime change, decided by a constructor
+     * rather than by anyone.
+     *
+     * `vault` is the one that carries durable private records, so it is the one that matters most.
+     * `exchangeStore` / `interactionStore` may stay DO-local ONLY as ordering + index over exchanges
+     * whose records live in the vault — and only if they are genuinely rebuildable from it: the durable
+     * fact written to the vault first, an explicit rebuild in code, and a test that wipes the DO and
+     * rebuilds. An untested rebuild path is indistinguishable from an absent one, which is how a
+     * projection silently becomes the only copy.
+     */
+    vault?(wrapper: DekWrapper): Vault;
+    exchangeStore?: ExchangeStore;
+    interactionStore?: InteractionStore;
     /** Token-gated channel join (spec 318 C3): verify a `member`'s `credential` satisfies a channel's
      *  `joinGate` requirement. Injected (the `entitlements`/`verifiable-credentials` resolver in prod, a fake in
      *  tests) — the fabric core stays credential-mechanism-free. Absent ⇒ a gated channel cannot be joined. */

package/dist/cloudflare/principal-gateway-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"principal-gateway-do.d.ts","sourceRoot":"","sources":["../../src/cloudflare/principal-gateway-do.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAoD,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEvG,OAAO,EAAuC,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACpH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAGhE,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAA4E,KAAK,SAAS,EAAE,KAAK,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAE/J,kHAAkH;AAClH,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;4GAEwG;IACxG,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B;oGACgG;IAChG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC7D,4EAA4E;IAC5E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C,wFAAwF;IACxF,KAAK,EAAE,mBAAmB,CAAC;IAC3B;oGACgG;IAChG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;+GAE2G;IAC3G,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACpG;AAMD,6FAA6F;AAC7F,MAAM,MAAM,YAAY;AACtB,gGAAgG;AAC9F;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE;AAC/B;6EAC6E;GAC3E;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAChE;uFACuF;GACrF;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,GAC3E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,qBAAqB,GAAG,mBAAmB,CAAA;CAAE,CAAC;AAEvE,qBAAa,kBAAkB;IAY3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IAbxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;gBAGrB,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,mBAAmB,EACxB,IAAI,CAAC,EAAE,WAAW,YAAA;IAoBrC;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtD;;;;;OAKG;IACG,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GAClC,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAcxD,6EAA6E;IACvE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAI1D,oGAAoG;IAC9F,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAIzG;;kHAE8G;IACxG,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvG;;mHAE+G;IACzG,6BAA6B,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,0BAA0B,EACtC,EAAE,EAAE,MAAM,EACV,EAAE,CAAC,EAAE,MAAM,GACV,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAMxD,+GAA+G;IACzG,+BAA+B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAMxJ;;0CAEsC;IAChC,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAM9I;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IA6BvH,+FAA+F;IACzF,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,uDAAuD;IACjD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIvD,oFAAoF;IAC9E,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAUjE;;qHAEiH;IACjH,OAAO,CAAC,yBAAyB;IAiBjC,6FAA6F;IACvF,aAAa,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAIxF,oGAAoG;IAC9F,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAItC;qHACiH;IAC3G,mBAAmB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAIxF;;;;;OAKG;IACG,eAAe,CACnB,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE;QAAE,SAAS,EAAE,gBAAgB,CAAC;QAAC,IAAI,EAAE,aAAa,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GACrE,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,uBAAuB,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAiB1F;;;;;;OAMG;IACG,WAAW,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAoBxI;uGACmG;IAC7F,eAAe,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/G,sEAAsE;IAChE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIpD,oGAAoG;IAC9F,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,KAAK;IAIjC;;;;;;OAMG;IACG,OAAO,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAWjE;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,oBAAoB;IA2BlC;;;;;;;;;;OAUG;YACW,2BAA2B;IAMzC;;;;OAIG;IACG,eAAe,CAAC,KAAK,EAAE;QAC3B,aAAa,EAAE,aAAa,CAAC;QAC7B,cAAc,EAAE,cAAc,CAAC;QAC/B,sFAAsF;QACtF,cAAc,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC5C,iBAAiB,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QAC3C,EAAE,EAAE,MAAM,CAAC;QACX,gBAAgB,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;KACjD,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAwBhC,0GAA0G;IACpG,UAAU,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,EAAE,KAAK,EAAE,eAAe;IAYxE,uFAAuF;IACvF,IAAI,YAAY,IAAI,gBAAgB,CAEnC;IAED;;;;;;;OAOG;IACG,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAItD;;mEAE+D;IAC/D,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,WAAW;IAKnB,uEAAuE;IACvE,IAAI,SAAS,IAAI,qBAAqB,CAErC;IAED;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAMrE;;;;;;;;;OASG;IACG,UAAU,CAAC,KAAK,EAAE;QACtB,GAAG,EAAE,mBAAmB,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,aAAa,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KAC7G,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAoB7F;oFACgF;IAC1E,KAAK,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAIpC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IA8BhD;;;;qDAIiD;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}
+{"version":3,"file":"principal-gateway-do.d.ts","sourceRoot":"","sources":["../../src/cloudflare/principal-gateway-do.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAoD,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAuC,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACpH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAGhE,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAA4E,KAAK,SAAS,EAAE,KAAK,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAE/J,kHAAkH;AAClH,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;4GAEwG;IACxG,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B;oGACgG;IAChG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC7D,4EAA4E;IAC5E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C,wFAAwF;IACxF,KAAK,EAAE,mBAAmB,CAAC;IAC3B;oGACgG;IAChG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,CAAC,OAAO,EAAE,UAAU,GAAG,KAAK,CAAC;IACnC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;+GAE2G;IAC3G,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACpG;AAMD,6FAA6F;AAC7F,MAAM,MAAM,YAAY;AACtB,gGAAgG;AAC9F;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE;AAC/B;6EAC6E;GAC3E;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAChE;uFACuF;GACrF;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,GAC3E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,qBAAqB,GAAG,mBAAmB,CAAA;CAAE,CAAC;AAEvE,qBAAa,kBAAkB;IAY3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IAbxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;gBAGrB,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,mBAAmB,EACxB,IAAI,CAAC,EAAE,WAAW,YAAA;IAqBrC;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtD;;;;;OAKG;IACG,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GAClC,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAcxD,6EAA6E;IACvE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAI1D,oGAAoG;IAC9F,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAIzG;;kHAE8G;IACxG,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvG;;mHAE+G;IACzG,6BAA6B,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,0BAA0B,EACtC,EAAE,EAAE,MAAM,EACV,EAAE,CAAC,EAAE,MAAM,GACV,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAMxD,+GAA+G;IACzG,+BAA+B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAMxJ;;0CAEsC;IAChC,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAM9I;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IA6BvH,+FAA+F;IACzF,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,uDAAuD;IACjD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIvD,oFAAoF;IAC9E,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAUjE;;qHAEiH;IACjH,OAAO,CAAC,yBAAyB;IAiBjC,6FAA6F;IACvF,aAAa,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAIxF,oGAAoG;IAC9F,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAItC;qHACiH;IAC3G,mBAAmB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAIxF;;;;;OAKG;IACG,eAAe,CACnB,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE;QAAE,SAAS,EAAE,gBAAgB,CAAC;QAAC,IAAI,EAAE,aAAa,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GACrE,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,uBAAuB,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAiB1F;;;;;;OAMG;IACG,WAAW,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAoBxI;uGACmG;IAC7F,eAAe,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/G,sEAAsE;IAChE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIpD,oGAAoG;IAC9F,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,KAAK;IASjC;;;;;;OAMG;IACG,OAAO,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAWjE;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,oBAAoB;IA2BlC;;;;;;;;;;OAUG;YACW,2BAA2B;IAMzC;;;;OAIG;IACG,eAAe,CAAC,KAAK,EAAE;QAC3B,aAAa,EAAE,aAAa,CAAC;QAC7B,cAAc,EAAE,cAAc,CAAC;QAC/B,sFAAsF;QACtF,cAAc,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC5C,iBAAiB,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QAC3C,EAAE,EAAE,MAAM,CAAC;QACX,gBAAgB,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;KACjD,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAwBhC,0GAA0G;IACpG,UAAU,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,EAAE,KAAK,EAAE,eAAe;IAYxE,uFAAuF;IACvF,IAAI,YAAY,IAAI,gBAAgB,CAEnC;IAED;;;;;;;OAOG;IACG,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAItD;;mEAE+D;IAC/D,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,WAAW;IAKnB,uEAAuE;IACvE,IAAI,SAAS,IAAI,qBAAqB,CAErC;IAED;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAMrE;;;;;;;;;OASG;IACG,UAAU,CAAC,KAAK,EAAE;QACtB,GAAG,EAAE,mBAAmB,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,aAAa,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KAC7G,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAoB7F;oFACgF;IAC1E,KAAK,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAIpC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IA8BhD;;;;qDAIiD;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/cloudflare/principal-gateway-do.js

@@ -35,8 +35,9 @@ export class PrincipalGatewayDO {
         this.sql = state.storage.sql;
         // Co-resident, DO-local: exchange stream + vault + T1 verdict cache + request-id ledger all share the
         // one SQLite trust domain (L2, §4.0). The receipt signer holds a DO-local software key in DO KV storage.
-        this.exchanges = createDurableObjectExchangeStore(this.sql);
-        this.interactionStore = createDurableObjectInteractionStore(this.sql);
+        // Injected when the deployment's records live elsewhere (ADR-0055); DO-local otherwise.
+        this.exchanges = deps?.exchangeStore ?? createDurableObjectExchangeStore(this.sql);
+        this.interactionStore = deps?.interactionStore ?? createDurableObjectInteractionStore(this.sql);
         this.verdicts = createDurableObjectAuthorityVerdictCache(this.sql);
         this.requestIds = createDurableObjectRequestIdLedger(this.sql);
         this.receipts = createDurableObjectReceiptSigner(state.storage);
@@ -290,6 +291,12 @@ export class PrincipalGatewayDO {
      * accessor stays key-material-free. Same `state.storage.sql` as the exchange stream — one trust domain.
      */
     vault(wrapper) {
+        // INJECTED WINS. A deployment whose records live in the owner's vault passes `deps.vault`; the
+        // DO-SQL construction below is the fallback for tests and single-tenant self-hosting. Inheriting
+        // the fallback in production is exactly the drift ADR-0055's amendment refuses: a custody change
+        // arriving as a side effect of a runtime change.
+        if (this.deps?.vault)
+            return this.deps.vault(wrapper);
         return createDurableObjectSqlVault(this.sql, wrapper);
     }
     /**