@agenticprimitives/fabric 0.0.0-alpha.3 → 0.0.0-alpha.30

package/dist/case-machine.d.ts

@@ -52,9 +52,19 @@ export interface CaseTransitionEventV1 {
     authorityRef?: AuthorityRef;
     signature?: SignatureProof;
 }
+/** W10b-3: `denied`/`expired`/`revoked` collapsed into `closed` — same terminality, and the verdict
+ *  that distinguished them now lives in the decision and commitment records. */
 export declare const TERMINAL_CASE_STATES: readonly CaseState[];
 export declare function isTerminalCaseState(state: CaseState): boolean;
-export type CaseRejection = 'wrong-case' | 'invalid-transition' | 'unauthorized-actor' | 'case-expired' | 'not-yet-due';
+/** The transitions that cannot land on the case machine alone. Exported so the set is a constant a
+ *  caller can read rather than a rule buried in a branch. */
+export declare const TRANSITIONS_REQUIRING_GRANTED_DECISION: readonly CaseTransition[];
+export declare function requiresGrantedDecision(transition: CaseTransition): boolean;
+export type CaseRejection = 'wrong-case' | 'invalid-transition' | 'unauthorized-actor' | 'case-expired' | 'not-yet-due'
+/** W10b-3: the transition needs a granted decision and none was supplied. Its own reason rather than
+ *  `invalid-transition`, because the case IS in a legal state — what is missing is the determination,
+ *  and a caller that cannot tell those apart will "fix" the wrong one. */
+ | 'requires-granted-decision';
 export type CaseResult = {
     ok: true;
     case: FabricCaseV1;
@@ -62,11 +72,27 @@ export type CaseResult = {
     ok: false;
     reason: CaseRejection;
 };
+/**
+ * What this machine cannot know on its own (spec 340 W10b-3).
+ *
+ * Until W10b-3, "you cannot issue before approving" was an FSM edge: `issue-credential` ran only
+ * `from: ['approved']`. With the determination moved to the decision machine, `triaged` is reachable by
+ * plain triage, so that ordering has to be re-established as a precondition or issuance could skip the
+ * determination entirely.
+ *
+ * Passed IN rather than looked up: this module is pure and has no store. The caller that holds the
+ * decision supplies it, and supplying nothing is a refusal, not a pass — a machine that treated
+ * "no decision provided" as "no decision required" would be exactly the fail-open this repo forbids.
+ */
+export interface CaseTransitionContext {
+    /** The state of the decision for this case, or `null`/absent when there is none. */
+    decisionState?: 'pending' | 'granted' | 'refused' | 'withdrawn' | 'expired' | 'superseded' | null;
+}
 /**
  * Pure, fail-closed (spec 316 §2). Generic over the concrete case type: preserves whatever extra fields
  * `T` carries beyond `CaseFsmFields`. Returns the next case or a typed rejection — never a silent no-op.
  */
-export declare function applyCaseTransition<T extends CaseFsmFields>(current: T, event: CaseTransitionEventV1): {
+export declare function applyCaseTransition<T extends CaseFsmFields>(current: T, event: CaseTransitionEventV1, ctx?: CaseTransitionContext): {
     ok: true;
     case: T;
 } | {

package/dist/case-machine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"case-machine.d.ts","sourceRoot":"","sources":["../src/case-machine.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD;uEACuE;AACvE,MAAM,WAAW,aAAa;IAC5B;;4DAEwD;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,gBAAgB,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,SAAS,CAAC;IAC5B,YAAY,EAAE,QAAQ,EAAE,CAAC;IACzB,aAAa,EAAE,YAAY,EAAE,CAAC;CAC/B;AAED,0GAA0G;AAC1G,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,OAAO,EAAE,YAAY,CAAC;IACtB,6DAA6D;IAC7D,EAAE,EAAE,UAAU,CAAC;IACf,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,SAAS,CAAC;IACzB,eAAe,EAAE,SAAS,CAAC;CAC5B;AAED,8GAA8G;AAC9G,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,aAAa,GACb,SAAS,GACT,kBAAkB,GAClB,oBAAoB,GACpB,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,MAAM,CAAC;AAEX,yGAAyG;AACzG,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,EAAE,gBAAgB,CAAC;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAED,eAAO,MAAM,oBAAoB,EAAE,SAAS,SAAS,EAA4D,CAAC;AAElH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAE7D;AA2BD,MAAM,MAAM,aAAa,GACrB,YAAY,GACZ,oBAAoB,GACpB,oBAAoB,GACpB,cAAc,GACd,aAAa,CAAC;AAElB,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC;AAcjG;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,aAAa,EACzD,OAAO,EAAE,CAAC,EACV,KAAK,EAAE,qBAAqB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CA4B9D"}
+{"version":3,"file":"case-machine.d.ts","sourceRoot":"","sources":["../src/case-machine.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD;uEACuE;AACvE,MAAM,WAAW,aAAa;IAC5B;;4DAEwD;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,gBAAgB,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,SAAS,CAAC;IAC5B,YAAY,EAAE,QAAQ,EAAE,CAAC;IACzB,aAAa,EAAE,YAAY,EAAE,CAAC;CAC/B;AAED,0GAA0G;AAC1G,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,OAAO,EAAE,YAAY,CAAC;IACtB,6DAA6D;IAC7D,EAAE,EAAE,UAAU,CAAC;IACf,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,SAAS,CAAC;IACzB,eAAe,EAAE,SAAS,CAAC;CAC5B;AAED,8GAA8G;AAC9G,MAAM,MAAM,cAAc,GACtB,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,aAAa,GACb,SAAS,GACT,kBAAkB,GAClB,oBAAoB,GACpB,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,MAAM,CAAC;AAEX,yGAAyG;AACzG,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,EAAE,gBAAgB,CAAC;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAED;gFACgF;AAChF,eAAO,MAAM,oBAAoB,EAAE,SAAS,SAAS,EAAsC,CAAC;AAE5F,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAE7D;AA2CD;6DAC6D;AAC7D,eAAO,MAAM,sCAAsC,EAAE,SAAS,cAAc,EAAyB,CAAC;AAEtG,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAE3E;AAED,MAAM,MAAM,aAAa,GACrB,YAAY,GACZ,oBAAoB,GACpB,oBAAoB,GACpB,cAAc,GACd,aAAa;AACf;;0EAE0E;GACxE,2BAA2B,CAAC;AAEhC,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC;AAcjG;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,aAAa,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CAAC;CACnG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,aAAa,EACzD,OAAO,EAAE,CAAC,EACV,KAAK,EAAE,qBAAqB,EAC5B,GAAG,GAAE,qBAA0B,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAgC9D"}

package/dist/case-machine.js

@@ -14,10 +14,24 @@
 // are inbox read-receipt facts. So `admit`(submitted→delivered)/`view`(delivered→seen) are DROPPED (they
 // become `ExchangeEventV1` `kind:'message'` events), and the moves that referenced `seen`/`delivered`
 // re-anchor on `submitted`/`triaged`.
-export const TERMINAL_CASE_STATES = ['denied', 'completed', 'expired', 'revoked', 'failed'];
+/** W10b-3: `denied`/`expired`/`revoked` collapsed into `closed` — same terminality, and the verdict
+ *  that distinguished them now lives in the decision and commitment records. */
+export const TERMINAL_CASE_STATES = ['completed', 'closed', 'failed'];
 export function isTerminalCaseState(state) {
     return TERMINAL_CASE_STATES.includes(state);
 }
+/**
+ * spec 340 W10b-3. The VERBS are unchanged — that is deliberate and load-bearing. A stored v1 case-event
+ * log names transitions, not states, so keeping every verb is what lets history replay with no
+ * migration (W10b-1). What changed is where four of them LAND, because `approved`/`denied`/`expired`/
+ * `revoked` were never execution states (§R.2):
+ *
+ *   · `approve` now lands on `triaged` — the responder is working toward issuance. The DETERMINATION
+ *     goes to the decision machine via `caseTransitionEmissions`. "Approved" was never a description
+ *     of how far the work got; reading it as one is the "deciding is not doing" collapse.
+ *   · `deny`/`expire`/`revoke` land on `closed` — taken up, ended without issuance. The verdict is in
+ *     the decision record; the voided obligation is in the commitment record.
+ */
 const TRANSITIONS = {
     submit: { from: ['draft'], to: 'submitted', signers: ['requester'] },
     triage: { from: ['submitted'], to: 'triaged', signers: ['responder'] },
@@ -25,14 +39,24 @@ const TRANSITIONS = {
     // needs-info → triaged (NOT submitted): the requester supplied info, the responder RESUMES working
     // (couples to exec `working`), preserving the "responder engaged" phase across the info loop.
     'submit-info': { from: ['needs-info'], to: 'triaged', signers: ['requester'] },
-    approve: { from: ['submitted', 'triaged'], to: 'approved', signers: ['responder', 'resource-owner'] },
-    'issue-credential': { from: ['approved'], to: 'issued', signers: ['resource-owner', 'responder'] },
+    approve: { from: ['submitted', 'triaged'], to: 'triaged', signers: ['responder', 'resource-owner'] },
+    // `from: ['triaged']` plus a REQUIRED granted decision — see `requiresGrantedDecision`. The ordering
+    // "you cannot issue before approving" used to be an FSM edge (`from: ['approved']`); with the
+    // decision out of this enum it becomes a cross-machine precondition instead, because `triaged` is
+    // reachable by plain triage and would otherwise let issuance skip the determination entirely.
+    'issue-credential': { from: ['triaged'], to: 'issued', signers: ['resource-owner', 'responder'] },
     'deliver-credential': { from: ['issued'], to: 'completed', signers: ['resource-owner', 'responder'] },
-    deny: { from: 'any-non-terminal', to: 'denied', signers: ['responder', 'resource-owner'] },
-    expire: { from: 'any-non-terminal', to: 'expired', signers: ['any'] },
-    revoke: { from: 'any-non-terminal', to: 'revoked', signers: ['responder', 'resource-owner'] },
+    deny: { from: 'any-non-terminal', to: 'closed', signers: ['responder', 'resource-owner'] },
+    expire: { from: 'any-non-terminal', to: 'closed', signers: ['any'] },
+    revoke: { from: 'any-non-terminal', to: 'closed', signers: ['responder', 'resource-owner'] },
     fail: { from: 'any-non-terminal', to: 'failed', signers: ['any'] },
 };
+/** The transitions that cannot land on the case machine alone. Exported so the set is a constant a
+ *  caller can read rather than a rule buried in a branch. */
+export const TRANSITIONS_REQUIRING_GRANTED_DECISION = ['issue-credential'];
+export function requiresGrantedDecision(transition) {
+    return TRANSITIONS_REQUIRING_GRANTED_DECISION.includes(transition);
+}
 function actorRoles(c, actor) {
     const roles = new Set(['any']);
     if (actor === c.requester)
@@ -50,7 +74,7 @@ function isPastExpiry(c, atIso) {
  * Pure, fail-closed (spec 316 §2). Generic over the concrete case type: preserves whatever extra fields
  * `T` carries beyond `CaseFsmFields`. Returns the next case or a typed rejection — never a silent no-op.
  */
-export function applyCaseTransition(current, event) {
+export function applyCaseTransition(current, event, ctx = {}) {
     if (event.caseId !== current.id)
         return { ok: false, reason: 'wrong-case' };
     const spec = TRANSITIONS[event.transition];
@@ -59,6 +83,9 @@ export function applyCaseTransition(current, event) {
     const fromOk = spec.from === 'any-non-terminal' ? !isTerminalCaseState(current.state) : spec.from.includes(current.state);
     if (!fromOk)
         return { ok: false, reason: 'invalid-transition' };
+    if (requiresGrantedDecision(event.transition) && ctx.decisionState !== 'granted') {
+        return { ok: false, reason: 'requires-granted-decision' };
+    }
     // `expire` only lands once the deadline passed; everything else (except `fail`) rejects on an expired case.
     if (event.transition === 'expire') {
         if (current.expiresAt === undefined || !isPastExpiry(current, event.at))

package/dist/case-machine.js.map

@@ -1 +1 @@
-{"version":3,"file":"case-machine.js","sourceRoot":"","sources":["../src/case-machine.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,wGAAwG;AACxG,kCAAkC;AAClC,+GAA+G;AAC/G,4EAA4E;AAC5E,sGAAsG;AACtG,8BAA8B;AAC9B,EAAE;AACF,4GAA4G;AAC5G,6GAA6G;AAC7G,2FAA2F;AAC3F,EAAE;AACF,2GAA2G;AAC3G,yGAAyG;AACzG,sGAAsG;AACtG,sCAAsC;AAwEtC,MAAM,CAAC,MAAM,oBAAoB,GAAyB,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAElH,MAAM,UAAU,mBAAmB,CAAC,KAAgB;IAClD,OAAO,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAWD,MAAM,WAAW,GAA2C;IAC1D,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;IACpE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;IACtE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;IACxF,mGAAmG;IACnG,8FAA8F;IAC9F,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;IAC9E,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE;IACrG,kBAAkB,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAAE;IAClG,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAAE;IACrG,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE;IAC1F,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE;IACrE,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE;IAC7F,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE;CACnE,CAAC;AAWF,SAAS,UAAU,CAAC,CAAgB,EAAE,KAAa;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,CAAC,CAAC,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,CAAC,CAAC,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC,CAAC,aAAa;QAAE,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,CAAgB,EAAE,KAAa;IACnD,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAU,EACV,KAA4B;IAE5B,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAE5E,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1H,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAEhE,4GAA4G;IAC5G,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACvH,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAEhG,MAAM,IAAI,GAAM;QACd,GAAG,OAAO;QACV,KAAK,EAAE,IAAI,CAAC,EAAE;QACd,SAAS,EAAE,KAAK,CAAC,EAAE;QACnB,eAAe,EAAE,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,eAAe;QAC3D,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY;QACrG,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;KAC3G,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"case-machine.js","sourceRoot":"","sources":["../src/case-machine.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,wGAAwG;AACxG,kCAAkC;AAClC,+GAA+G;AAC/G,4EAA4E;AAC5E,sGAAsG;AACtG,8BAA8B;AAC9B,EAAE;AACF,4GAA4G;AAC5G,6GAA6G;AAC7G,2FAA2F;AAC3F,EAAE;AACF,2GAA2G;AAC3G,yGAAyG;AACzG,sGAAsG;AACtG,sCAAsC;AAwEtC;gFACgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAyB,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE5F,MAAM,UAAU,mBAAmB,CAAC,KAAgB;IAClD,OAAO,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAWD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,GAA2C;IAC1D,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;IACpE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;IACtE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;IACxF,mGAAmG;IACnG,8FAA8F;IAC9F,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;IAC9E,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE;IACpG,qGAAqG;IACrG,8FAA8F;IAC9F,kGAAkG;IAClG,8FAA8F;IAC9F,kBAAkB,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAAE;IACjG,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAAE;IACrG,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE;IAC1F,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE;IACpE,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE;IAC5F,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE;CACnE,CAAC;AAEF;6DAC6D;AAC7D,MAAM,CAAC,MAAM,sCAAsC,GAA8B,CAAC,kBAAkB,CAAC,CAAC;AAEtG,MAAM,UAAU,uBAAuB,CAAC,UAA0B;IAChE,OAAO,sCAAsC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACrE,CAAC;AAeD,SAAS,UAAU,CAAC,CAAgB,EAAE,KAAa;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,CAAC,CAAC,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,CAAC,CAAC,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC,CAAC,aAAa;QAAE,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,CAAgB,EAAE,KAAa;IACnD,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACnF,CAAC;AAmBD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAU,EACV,KAA4B,EAC5B,MAA6B,EAAE;IAE/B,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAE5E,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1H,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAEhE,IAAI,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IAED,4GAA4G;IAC5G,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACvH,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAEhG,MAAM,IAAI,GAAM;QACd,GAAG,OAAO;QACV,KAAK,EAAE,IAAI,CAAC,EAAE;QACd,SAAS,EAAE,KAAK,CAAC,EAAE;QACnB,eAAe,EAAE,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,eAAe;QAC3D,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY;QACrG,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa;KAC3G,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC"}

package/dist/cloudflare/authority-verdict-cache.d.ts

@@ -23,5 +23,32 @@ export interface AuthorityVerdictCache {
     /** Deployment-epoch change (spec 311): drop every verdict NOT on `currentEpoch`. */
     sweepEpoch(currentEpoch: string): Promise<void>;
 }
-export declare function createDurableObjectAuthorityVerdictCache(sql: SqlStorage): AuthorityVerdictCache;
+/**
+ * How long a cached verdict may be reused before the cold path must run again.
+ *
+ * 60s mirrors `InteractionsDO`'s existing positive-verdict cache (NEW-H4/FAB-A2A-1), which was sized as
+ * an RPC-429 mitigation for high-frequency non-sensitive reads. Matching it keeps ONE number in the
+ * deployment rather than two that drift.
+ */
+export declare const VERDICT_TTL_MS = 60000;
+export interface VerdictCacheOptions {
+    /** Bounded reuse window. `0` disables caching entirely (every get misses ⇒ cold path every call). */
+    ttlMs?: number;
+    now?: () => number;
+}
+/**
+ * BOUNDED REUSE IS PART OF THE VERDICT, NOT AN OPTIMISATION KNOB.
+ *
+ * Verdict (A) asserts "this delegation was valid AND UNREVOKED at `verifiedAt`". Serving it later without
+ * regard to age silently upgrades that into "is valid and unrevoked", which is a claim the cold path never
+ * made. Before this, `verified_at` was written and never read: a verdict cached once stayed warm forever,
+ * and a revoked delegation kept passing (A) until something called `invalidateDelegation` — a revocation
+ * NOTICE that has to be delivered by a second mechanism and may simply never arrive. Revocation that only
+ * works when someone remembers to push it is not revocation.
+ *
+ * Expiry is a MISS, not an error: `invokeFast` refuses on a miss and the caller re-runs `verifyAndCache`,
+ * which re-checks the signature and `isRevoked` on-chain. So the ceiling on serving a revoked delegation
+ * is `ttlMs`, and the mechanism is the same one throughout (ADR-0013) — the cold path, run again.
+ */
+export declare function createDurableObjectAuthorityVerdictCache(sql: SqlStorage, opts?: VerdictCacheOptions): AuthorityVerdictCache;
 //# sourceMappingURL=authority-verdict-cache.d.ts.map

package/dist/cloudflare/authority-verdict-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authority-verdict-cache.d.ts","sourceRoot":"","sources":["../../src/cloudflare/authority-verdict-cache.ts"],"names":[],"mappings":"AA6BA;4GAC4G;AAC5G,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,gBAAgB,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;AAYhH,MAAM,WAAW,qBAAqB;IACpC,yDAAyD;IACzD,GAAG,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;mGAC+F;IAC/F,GAAG,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAChE,uFAAuF;IACvF,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,oFAAoF;IACpF,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAKD,wBAAgB,wCAAwC,CAAC,GAAG,EAAE,UAAU,GAAG,qBAAqB,CA6C/F"}
+{"version":3,"file":"authority-verdict-cache.d.ts","sourceRoot":"","sources":["../../src/cloudflare/authority-verdict-cache.ts"],"names":[],"mappings":"AA6BA;4GAC4G;AAC5G,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,gBAAgB,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;AAYhH,MAAM,WAAW,qBAAqB;IACpC,yDAAyD;IACzD,GAAG,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;mGAC+F;IAC/F,GAAG,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAChE,uFAAuF;IACvF,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,oFAAoF;IACpF,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAKD;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,QAAS,CAAC;AAErC,MAAM,WAAW,mBAAmB;IAClC,qGAAqG;IACrG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,GAAG,EAAE,UAAU,EACf,IAAI,CAAC,EAAE,mBAAmB,GACzB,qBAAqB,CAsDvB"}

package/dist/cloudflare/authority-verdict-cache.js

@@ -26,10 +26,34 @@ const CREATE_TABLE = `CREATE TABLE IF NOT EXISTS authority_verdicts (
 const CREATE_IDX_DELEG = `CREATE INDEX IF NOT EXISTS idx_authority_verdicts_deleg ON authority_verdicts (delegation_hash)`;
 const CREATE_IDX_EPOCH = `CREATE INDEX IF NOT EXISTS idx_authority_verdicts_epoch ON authority_verdicts (epoch)`;
 const keyOf = (k) => `${k.sessionKey.toLowerCase()}|${k.delegationHash.toLowerCase()}|${k.epoch}|${k.manager.toLowerCase()}`;
-export function createDurableObjectAuthorityVerdictCache(sql) {
+/**
+ * How long a cached verdict may be reused before the cold path must run again.
+ *
+ * 60s mirrors `InteractionsDO`'s existing positive-verdict cache (NEW-H4/FAB-A2A-1), which was sized as
+ * an RPC-429 mitigation for high-frequency non-sensitive reads. Matching it keeps ONE number in the
+ * deployment rather than two that drift.
+ */
+export const VERDICT_TTL_MS = 60_000;
+/**
+ * BOUNDED REUSE IS PART OF THE VERDICT, NOT AN OPTIMISATION KNOB.
+ *
+ * Verdict (A) asserts "this delegation was valid AND UNREVOKED at `verifiedAt`". Serving it later without
+ * regard to age silently upgrades that into "is valid and unrevoked", which is a claim the cold path never
+ * made. Before this, `verified_at` was written and never read: a verdict cached once stayed warm forever,
+ * and a revoked delegation kept passing (A) until something called `invalidateDelegation` — a revocation
+ * NOTICE that has to be delivered by a second mechanism and may simply never arrive. Revocation that only
+ * works when someone remembers to push it is not revocation.
+ *
+ * Expiry is a MISS, not an error: `invokeFast` refuses on a miss and the caller re-runs `verifyAndCache`,
+ * which re-checks the signature and `isRevoked` on-chain. So the ceiling on serving a revoked delegation
+ * is `ttlMs`, and the mechanism is the same one throughout (ADR-0013) — the cold path, run again.
+ */
+export function createDurableObjectAuthorityVerdictCache(sql, opts) {
     sql.exec(CREATE_TABLE);
     sql.exec(CREATE_IDX_DELEG);
     sql.exec(CREATE_IDX_EPOCH);
+    const ttlMs = opts?.ttlMs ?? VERDICT_TTL_MS;
+    const now = opts?.now ?? (() => Date.now());
     return {
         async put(v) {
             sql.exec(`INSERT INTO authority_verdicts (cache_key, principal, session_key, delegation_hash, epoch, manager, verified_at)
@@ -46,6 +70,13 @@ export function createDurableObjectAuthorityVerdictCache(sql) {
             const r = rows[0];
             if (!r)
                 return null;
+            // Age it out. An unparseable `verified_at` counts as EXPIRED: a row whose age cannot be established
+            // is one whose freshness cannot be established, and the safe reading of "I don't know" is a miss.
+            const verifiedAtMs = Date.parse(r.verified_at);
+            if (!Number.isFinite(verifiedAtMs) || now() - verifiedAtMs >= ttlMs) {
+                sql.exec('DELETE FROM authority_verdicts WHERE cache_key = ?', keyOf(key));
+                return null;
+            }
             return {
                 principal: r.principal,
                 sessionKey: r.session_key,

package/dist/cloudflare/authority-verdict-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"authority-verdict-cache.js","sourceRoot":"","sources":["../../src/cloudflare/authority-verdict-cache.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,uEAAuE;AACvE,EAAE;AACF,0FAA0F;AAC1F,2GAA2G;AAC3G,oGAAoG;AACpG,iGAAiG;AACjG,4GAA4G;AAC5G,qDAAqD;AACrD,wGAAwG;AACxG,yGAAyG;AACzG,wGAAwG;AACxG,4GAA4G;AAC5G,oGAAoG;AACpG,EAAE;AACF,0GAA0G;AAE1G,MAAM,YAAY,GAAG;;;;;;;;EAQnB,CAAC;AACH,MAAM,gBAAgB,GAAG,iGAAiG,CAAC;AAC3H,MAAM,gBAAgB,GAAG,uFAAuF,CAAC;AAwCjH,MAAM,KAAK,GAAG,CAAC,CAAsB,EAAU,EAAE,CAC/C,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;AAE1G,MAAM,UAAU,wCAAwC,CAAC,GAAe;IACtE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE3B,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,CAAC;YACT,GAAG,CAAC,IAAI,CACN;;;;;0EAKkE,EAClE,KAAK,CAAC,CAAC,CAAC,EACR,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,EACzB,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,EAC1B,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,EAC9B,CAAC,CAAC,KAAK,EACP,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EACvB,CAAC,CAAC,UAAU,CACb,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CAAa,sDAAsD,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;iBACpF,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpB,OAAO;gBACL,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,CAAC,CAAC,WAAW;gBACzB,cAAc,EAAE,CAAC,CAAC,eAAe;gBACjC,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,UAAU,EAAE,CAAC,CAAC,WAAW;aAC1B,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,oBAAoB,CAAC,cAAc;YACvC,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,YAAY;YAC3B,GAAG,CAAC,IAAI,CAAC,iDAAiD,EAAE,YAAY,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authority-verdict-cache.js","sourceRoot":"","sources":["../../src/cloudflare/authority-verdict-cache.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,uEAAuE;AACvE,EAAE;AACF,0FAA0F;AAC1F,2GAA2G;AAC3G,oGAAoG;AACpG,iGAAiG;AACjG,4GAA4G;AAC5G,qDAAqD;AACrD,wGAAwG;AACxG,yGAAyG;AACzG,wGAAwG;AACxG,4GAA4G;AAC5G,oGAAoG;AACpG,EAAE;AACF,0GAA0G;AAE1G,MAAM,YAAY,GAAG;;;;;;;;EAQnB,CAAC;AACH,MAAM,gBAAgB,GAAG,iGAAiG,CAAC;AAC3H,MAAM,gBAAgB,GAAG,uFAAuF,CAAC;AAwCjH,MAAM,KAAK,GAAG,CAAC,CAAsB,EAAU,EAAE,CAC/C,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;AAE1G;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAQrC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wCAAwC,CACtD,GAAe,EACf,IAA0B;IAE1B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,cAAc,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE5C,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,CAAC;YACT,GAAG,CAAC,IAAI,CACN;;;;;0EAKkE,EAClE,KAAK,CAAC,CAAC,CAAC,EACR,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,EACzB,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,EAC1B,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,EAC9B,CAAC,CAAC,KAAK,EACP,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EACvB,CAAC,CAAC,UAAU,CACb,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CAAa,sDAAsD,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;iBACpF,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpB,oGAAoG;YACpG,kGAAkG;YAClG,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,GAAG,YAAY,IAAI,KAAK,EAAE,CAAC;gBACpE,GAAG,CAAC,IAAI,CAAC,oDAAoD,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO;gBACL,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,CAAC,CAAC,WAAW;gBACzB,cAAc,EAAE,CAAC,CAAC,eAAe;gBACjC,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,UAAU,EAAE,CAAC,CAAC,WAAW;aAC1B,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,oBAAoB,CAAC,cAAc;YACvC,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,YAAY;YAC3B,GAAG,CAAC,IAAI,CAAC,iDAAiD,EAAE,YAAY,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cloudflare/index.d.ts

@@ -1,13 +1,16 @@
 export { createDurableObjectSqlVault } from './sql-vault.js';
 export { createDurableObjectExchangeStore, type ExchangeStore } from './exchange-store.js';
+export { createDurableObjectInteractionStore, type InteractionStore, type SnapshotPutResult, } from './interaction-store.js';
 export { createDurableObjectOutboxStore, type OutboxStore, type OutboxEntry } from './outbox-store.js';
 export { createDurableObjectProvenanceStore, type ProvenanceStore } from './provenance-store.js';
 export { createDurableObjectChannelStore, projectionAuthorizes, type ChannelStore, type ChannelV1, type ConversationRoleProjection, type ConversationRoleAction, } from './channel-store.js';
-export { createDurableObjectAuthorityVerdictCache, type AuthorityVerdictCache, type AuthorityVerdict, type AuthorityVerdictKey, } from './authority-verdict-cache.js';
+export { createDurableObjectAuthorityVerdictCache, VERDICT_TTL_MS, type VerdictCacheOptions, type AuthorityVerdictCache, type AuthorityVerdict, type AuthorityVerdictKey, } from './authority-verdict-cache.js';
 export { createDurableObjectRequestIdLedger, type RequestIdLedger, type RequestIdReservation } from './request-id-ledger.js';
 export { createDurableObjectReceiptSigner, verifyDeliveryReceipt, type DeliveryReceiptSigner, type DeliveryReceiptInput, type SignedDeliveryReceiptV1, } from './receipt-signer.js';
 export { PrincipalGatewayDO, type PrincipalGatewayEnv, type GatewayDeps } from './principal-gateway-do.js';
 export { buildVaultTools, createToolRegistry, type GatewayTool, type GatewayToolContext, type GatewayToolRegistry, } from './gateway-tools.js';
 export { runGatewayOrchestration, gatewayToolSpecs, bindGatewayToolInvoker } from './orchestration-runtime.js';
+export { createVaultExchangeStore, exchangeResource, EXCHANGE_INDEX_RESOURCE, type VaultExchangeStore, type ExchangeIndexV1, } from './vault-exchange-store.js';
+export { createVaultInteractionStore, interactionResource, decisionResource, commitmentResource, snapshotResource, inboxEntryResource, INTERACTION_INDEX_RESOURCE, type VaultInteractionStore, type InteractionIndexV1, } from './vault-interaction-store.js';
 export declare const FABRIC_CLOUDFLARE_ADAPTER_STATUS: "w2-coresident-mcp";
 //# sourceMappingURL=index.d.ts.map

package/dist/cloudflare/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gCAAgC,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,EACL,+BAA+B,EAAE,oBAAoB,EACrD,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,KAAK,0BAA0B,EAAE,KAAK,sBAAsB,GAChG,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wCAAwC,EACxC,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC3G,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAE/G,eAAO,MAAM,gCAAgC,EAAG,mBAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gCAAgC,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAI3F,OAAO,EACL,mCAAmC,EACnC,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,8BAA8B,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,EACL,+BAA+B,EAAE,oBAAoB,EACrD,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,KAAK,0BAA0B,EAAE,KAAK,sBAAsB,GAChG,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wCAAwC,EACxC,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC3G,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAC/G,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,8BAA8B,CAAC;AAEtC,eAAO,MAAM,gCAAgC,EAAG,mBAA4B,CAAC"}

package/dist/cloudflare/index.js

@@ -7,14 +7,20 @@
 // absorption follow in subsequent W2 steps.
 export { createDurableObjectSqlVault } from './sql-vault.js';
 export { createDurableObjectExchangeStore } from './exchange-store.js';
+// The interaction spine's durable home (spec 340 W6) — interactions, context snapshots, decisions,
+// commitments and per-viewer inbox state. Five tables, because the six machines answer to different
+// parties at different times and one row would make them one write.
+export { createDurableObjectInteractionStore, } from './interaction-store.js';
 export { createDurableObjectOutboxStore } from './outbox-store.js';
 export { createDurableObjectProvenanceStore } from './provenance-store.js';
 export { createDurableObjectChannelStore, projectionAuthorizes, } from './channel-store.js';
-export { createDurableObjectAuthorityVerdictCache, } from './authority-verdict-cache.js';
+export { createDurableObjectAuthorityVerdictCache, VERDICT_TTL_MS, } from './authority-verdict-cache.js';
 export { createDurableObjectRequestIdLedger } from './request-id-ledger.js';
 export { createDurableObjectReceiptSigner, verifyDeliveryReceipt, } from './receipt-signer.js';
 export { PrincipalGatewayDO } from './principal-gateway-do.js';
 export { buildVaultTools, createToolRegistry, } from './gateway-tools.js';
 export { runGatewayOrchestration, gatewayToolSpecs, bindGatewayToolInvoker } from './orchestration-runtime.js';
+export { createVaultExchangeStore, exchangeResource, EXCHANGE_INDEX_RESOURCE, } from './vault-exchange-store.js';
+export { createVaultInteractionStore, interactionResource, decisionResource, commitmentResource, snapshotResource, inboxEntryResource, INTERACTION_INDEX_RESOURCE, } from './vault-interaction-store.js';
 export const FABRIC_CLOUDFLARE_ADAPTER_STATUS = 'w2-coresident-mcp';
 //# sourceMappingURL=index.js.map

package/dist/cloudflare/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,EAAE;AACF,wGAAwG;AACxG,wGAAwG;AACxG,yGAAyG;AACzG,yGAAyG;AACzG,4CAA4C;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gCAAgC,EAAsB,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAsC,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAwB,MAAM,uBAAuB,CAAC;AACjG,OAAO,EACL,+BAA+B,EAAE,oBAAoB,GAEtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wCAAwC,GAIzC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAmD,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EACL,gCAAgC,EAChC,qBAAqB,GAItB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAA8C,MAAM,2BAA2B,CAAC;AAC3G,OAAO,EACL,eAAe,EACf,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAE/G,MAAM,CAAC,MAAM,gCAAgC,GAAG,mBAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,EAAE;AACF,wGAAwG;AACxG,wGAAwG;AACxG,yGAAyG;AACzG,yGAAyG;AACzG,4CAA4C;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gCAAgC,EAAsB,MAAM,qBAAqB,CAAC;AAC3F,mGAAmG;AACnG,oGAAoG;AACpG,oEAAoE;AACpE,OAAO,EACL,mCAAmC,GAGpC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,8BAA8B,EAAsC,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAwB,MAAM,uBAAuB,CAAC;AACjG,OAAO,EACL,+BAA+B,EAAE,oBAAoB,GAEtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wCAAwC,EACxC,cAAc,GAKf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAmD,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EACL,gCAAgC,EAChC,qBAAqB,GAItB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAA8C,MAAM,2BAA2B,CAAC;AAC3G,OAAO,EACL,eAAe,EACf,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAC/G,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,uBAAuB,GAGxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,GAG3B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,CAAC,MAAM,gCAAgC,GAAG,mBAA4B,CAAC"}

package/dist/cloudflare/interaction-store.d.ts

@@ -0,0 +1,55 @@
+import type { InteractionRecordV1, InteractionId, ContextSnapshotV1 } from '../interaction-record.js';
+import { type InteractionLifecycleV1, type InteractionTransition, type DecisionRecordV1, type DecisionTransition, type CommitmentRecordV1, type CommitmentTransition, type InboxEntryV1, type InboxTransition, type MachineResult } from '../interaction-machines.js';
+import { type ProtocolBindingV1, type BindingResolution } from '../protocol-binding.js';
+import type { CanonicalAgentId } from '@agenticprimitives/types';
+export type SnapshotPutResult = {
+    ok: true;
+    stored: 'new' | 'identical';
+} | {
+    ok: false;
+    reason: 'digest-mismatch';
+};
+export interface InteractionStore {
+    putInteraction(record: InteractionRecordV1): Promise<void>;
+    getInteraction(id: InteractionId | string): Promise<InteractionRecordV1 | null>;
+    listInteractions(): Promise<InteractionRecordV1[]>;
+    /** Drive the interaction lifecycle THROUGH its machine. `null` when the interaction is unknown. */
+    transitionInteraction(id: InteractionId | string, event: {
+        transition: InteractionTransition;
+        actor: CanonicalAgentId;
+        at: string;
+    }): Promise<MachineResult<InteractionLifecycleV1> | null>;
+    /** Index a foreign correlator. Duplicates across interactions are KEPT — that is the ambiguity. */
+    bindProtocolTo(id: InteractionId, binding: ProtocolBindingV1): Promise<void>;
+    resolveByBinding(protocol: string, field: string, value: string): Promise<BindingResolution>;
+    /** Content-addressed. Verifies the digest against the bytes before storing — which IS the
+     *  immutability guarantee: forged content cannot reach a digest it does not hash to. */
+    putContextSnapshot(snapshot: ContextSnapshotV1): Promise<SnapshotPutResult>;
+    getContextSnapshot(digest: string): Promise<ContextSnapshotV1 | null>;
+    putDecision(record: DecisionRecordV1): Promise<void>;
+    getDecision(id: string): Promise<DecisionRecordV1 | null>;
+    transitionDecision(id: string, event: {
+        transition: DecisionTransition;
+        actor: CanonicalAgentId;
+        at: string;
+        subject?: string;
+    }): Promise<MachineResult<DecisionRecordV1> | null>;
+    putCommitment(record: CommitmentRecordV1): Promise<void>;
+    getCommitment(id: string): Promise<CommitmentRecordV1 | null>;
+    /** Open obligations — the query "what is still owed" that a single `case` field could not answer. */
+    listOpenCommitments(): Promise<CommitmentRecordV1[]>;
+    transitionCommitment(id: string, event: {
+        transition: CommitmentTransition;
+        actor: CanonicalAgentId;
+        at: string;
+    }): Promise<MachineResult<CommitmentRecordV1> | null>;
+    putInboxEntry(entry: InboxEntryV1): Promise<void>;
+    getInboxEntry(viewer: CanonicalAgentId, exchangeId: string): Promise<InboxEntryV1 | null>;
+    transitionInbox(viewer: CanonicalAgentId, exchangeId: string, event: {
+        transition: InboxTransition;
+        actor: CanonicalAgentId;
+        at: string;
+    }): Promise<MachineResult<InboxEntryV1> | null>;
+}
+export declare function createDurableObjectInteractionStore(sql: SqlStorage): InteractionStore;
+//# sourceMappingURL=interaction-store.d.ts.map

package/dist/cloudflare/interaction-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction-store.d.ts","sourceRoot":"","sources":["../../src/cloudflare/interaction-store.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAEtG,OAAO,EAKL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AA8CjE,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,WAAW,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAE7C,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,cAAc,CAAC,EAAE,EAAE,aAAa,GAAG,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAChF,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACnD,mGAAmG;IACnG,qBAAqB,CACnB,EAAE,EAAE,aAAa,GAAG,MAAM,EAC1B,KAAK,EAAE;QAAE,UAAU,EAAE,qBAAqB,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAChF,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,CAAC;IAEzD,mGAAmG;IACnG,cAAc,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAE7F;4FACwF;IACxF,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC5E,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAEtE,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC1D,kBAAkB,CAChB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,UAAU,EAAE,kBAAkB,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/F,OAAO,CAAC,aAAa,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC;IAEnD,aAAa,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC9D,qGAAqG;IACrG,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACrD,oBAAoB,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,UAAU,EAAE,oBAAoB,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC/E,OAAO,CAAC,aAAa,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC;IAErD,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1F,eAAe,CACb,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QAAE,UAAU,EAAE,eAAe,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC1E,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;CAChD;AAKD,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,UAAU,GAAG,gBAAgB,CA4LrF"}

package/dist/cloudflare/interaction-store.js

@@ -0,0 +1,230 @@
+/// <reference types="@cloudflare/workers-types" />
+// DO-local InteractionStore (spec 340 W6) — durable homes for the records W2–W5 defined and nothing
+// wrote. The `PrincipalGatewayDO` is the single writer for its principal, so no cross-writer races.
+//
+// Five tables, and the reason they are five rather than one wide row is the reason there are six state
+// machines: an interaction's lifecycle, a decision, a commitment and a viewer's inbox state are
+// answered by different parties at different times, and one row would make them one write.
+//
+// TWO INVARIANTS THIS LAYER OWNS, both about immutability rather than authority:
+//
+//   1. A ContextSnapshot is CONTENT-ADDRESSED, and the digest check IS the immutability guarantee.
+//      `putContextSnapshot` verifies the digest against the bytes before storing, so a party cannot
+//      rewrite what an evaluator saw while every Exchange still pins the same hash — the forged
+//      snapshot is refused at the door, not detected later.
+//
+//      There is deliberately no separate `immutable-conflict` outcome. It was written first and was
+//      BOTH dead and wrong: dead, because content that differs necessarily fails the digest check
+//      already; and wrong, because it compared `JSON.stringify` output, so the same snapshot re-put
+//      with a different key insertion order would have been rejected as a conflicting overwrite. A
+//      verified digest with a row already at it means the content is the same — that is what
+//      content-addressing means — so the re-put is a no-op.
+//   2. Every transition goes through its machine. The store never sets a state directly, so "the
+//      creditor discharges, not the debtor" cannot be bypassed by writing the row.
+//
+// It confers nothing. Persisting a commitment does not make it owed; persisting a decision does not
+// authorize anything. Authority is `delegation` + `entitlements` + `tool-policy` at the moment of
+// acting (ADR-0041, ADR-0043).
+import { verifyContextSnapshot } from '../interaction-record.js';
+import { applyInteractionTransition, applyDecisionTransition, applyCommitmentTransition, applyInboxTransition, } from '../interaction-machines.js';
+import { bindingKey, resolveInteractionByBinding, } from '../protocol-binding.js';
+const CREATE_TABLES = [
+    `CREATE TABLE IF NOT EXISTS interaction_records (
+     interaction_id TEXT PRIMARY KEY,
+     record_json    TEXT NOT NULL,
+     state          TEXT NOT NULL,
+     rev            INTEGER NOT NULL,
+     updated_at     TEXT NOT NULL
+   )`,
+    // Keyed by the binding, not by the interaction: the lookup direction is foreign → ours, and a
+    // duplicate key across two interactions is the AMBIGUITY the resolver must be able to see. A UNIQUE
+    // constraint here would silently drop the second one and manufacture a confident wrong answer.
+    `CREATE TABLE IF NOT EXISTS interaction_bindings (
+     binding_key    TEXT NOT NULL,
+     interaction_id TEXT NOT NULL,
+     binding_json   TEXT NOT NULL,
+     PRIMARY KEY (binding_key, interaction_id)
+   )`,
+    `CREATE TABLE IF NOT EXISTS context_snapshots (
+     digest        TEXT PRIMARY KEY,
+     snapshot_json TEXT NOT NULL
+   )`,
+    `CREATE TABLE IF NOT EXISTS decision_records (
+     decision_id  TEXT PRIMARY KEY,
+     record_json  TEXT NOT NULL,
+     updated_at   TEXT NOT NULL
+   )`,
+    `CREATE TABLE IF NOT EXISTS commitment_records (
+     commitment_id TEXT PRIMARY KEY,
+     record_json   TEXT NOT NULL,
+     state         TEXT NOT NULL,
+     updated_at    TEXT NOT NULL
+   )`,
+    `CREATE TABLE IF NOT EXISTS inbox_entries (
+     viewer      TEXT NOT NULL,
+     exchange_id TEXT NOT NULL,
+     record_json TEXT NOT NULL,
+     PRIMARY KEY (viewer, exchange_id)
+   )`,
+];
+/** States an obligation is still live in. `discharged`/`breached`/`void` are ended, differently. */
+const OPEN_COMMITMENT_STATES = ['proposed', 'active', 'fulfilment-claimed'];
+export function createDurableObjectInteractionStore(sql) {
+    for (const ddl of CREATE_TABLES)
+        sql.exec(ddl);
+    const one = (query, ...binds) => {
+        const rows = sql.exec(query, ...binds).toArray();
+        return rows[0] ? JSON.parse(rows[0].record_json) : null;
+    };
+    const saveInteraction = (record) => {
+        sql.exec(`INSERT INTO interaction_records (interaction_id, record_json, state, rev, updated_at)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(interaction_id) DO UPDATE SET
+         record_json = excluded.record_json, state = excluded.state,
+         rev = excluded.rev, updated_at = excluded.updated_at`, record.interactionId, JSON.stringify(record), lifecycleStateOf(record), record.rev, record.updatedAt);
+    };
+    const saveCommitment = (record) => {
+        sql.exec(`INSERT INTO commitment_records (commitment_id, record_json, state, updated_at)
+       VALUES (?, ?, ?, ?)
+       ON CONFLICT(commitment_id) DO UPDATE SET
+         record_json = excluded.record_json, state = excluded.state, updated_at = excluded.updated_at`, record.commitmentId, JSON.stringify(record), record.state, record.updatedAt);
+    };
+    const store = {
+        async putInteraction(record) {
+            saveInteraction(record);
+            for (const b of record.protocolBindings ?? []) {
+                sql.exec(`INSERT INTO interaction_bindings (binding_key, interaction_id, binding_json) VALUES (?, ?, ?)
+           ON CONFLICT(binding_key, interaction_id) DO UPDATE SET binding_json = excluded.binding_json`, bindingKey(b.protocol, b.field, b.value), record.interactionId, JSON.stringify(b));
+            }
+        },
+        async getInteraction(id) {
+            return one('SELECT record_json FROM interaction_records WHERE interaction_id = ?', String(id));
+        },
+        async listInteractions() {
+            return sql
+                .exec('SELECT record_json FROM interaction_records ORDER BY updated_at DESC')
+                .toArray()
+                .map((r) => JSON.parse(r.record_json));
+        },
+        async transitionInteraction(id, event) {
+            const record = await this.getInteraction(id);
+            if (!record)
+                return null;
+            const result = applyInteractionTransition(lifecycleOf(record), event);
+            // Fail-closed: a rejection leaves the row exactly as it was. The store never sets state itself,
+            // so "concluding is custodial" cannot be bypassed by writing the row directly.
+            if (result.ok) {
+                saveInteraction({
+                    ...record,
+                    lifecycleState: result.next.state,
+                    updatedAt: event.at,
+                    rev: record.rev + 1,
+                });
+            }
+            return result;
+        },
+        async bindProtocolTo(id, binding) {
+            sql.exec(`INSERT INTO interaction_bindings (binding_key, interaction_id, binding_json) VALUES (?, ?, ?)
+         ON CONFLICT(binding_key, interaction_id) DO UPDATE SET binding_json = excluded.binding_json`, bindingKey(binding.protocol, binding.field, binding.value), id, JSON.stringify(binding));
+        },
+        async resolveByBinding(protocol, field, value) {
+            const key = bindingKey(protocol, field, value);
+            const ids = sql
+                .exec('SELECT interaction_id FROM interaction_bindings WHERE binding_key = ?', key)
+                .toArray()
+                .map((r) => r.interaction_id);
+            // Reuses the in-memory resolver over a one-key index so SQL and non-SQL callers cannot disagree
+            // about what "ambiguous" means — one definition, two backing stores.
+            return resolveInteractionByBinding(new Map([[key, ids]]), protocol, field, value);
+        },
+        async putContextSnapshot(snapshot) {
+            // A snapshot whose digest does not match its bytes is not evidence, and storing it would let a
+            // later `verifyContextSnapshot` fail on a record that arrived corrupt rather than was tampered.
+            if (!(await verifyContextSnapshot(snapshot)))
+                return { ok: false, reason: 'digest-mismatch' };
+            const existing = sql
+                .exec('SELECT snapshot_json FROM context_snapshots WHERE digest = ?', snapshot.digest)
+                .toArray()[0];
+            // The digest verified and a row is already here, so the content is the same — two parties
+            // observing one context legitimately store it twice. A no-op, and the stored bytes win.
+            if (existing)
+                return { ok: true, stored: 'identical' };
+            sql.exec('INSERT INTO context_snapshots (digest, snapshot_json) VALUES (?, ?)', snapshot.digest, JSON.stringify(snapshot));
+            return { ok: true, stored: 'new' };
+        },
+        async getContextSnapshot(digest) {
+            const rows = sql
+                .exec('SELECT snapshot_json FROM context_snapshots WHERE digest = ?', digest)
+                .toArray();
+            return rows[0] ? JSON.parse(rows[0].snapshot_json) : null;
+        },
+        async putDecision(record) {
+            sql.exec(`INSERT INTO decision_records (decision_id, record_json, updated_at) VALUES (?, ?, ?)
+         ON CONFLICT(decision_id) DO UPDATE SET record_json = excluded.record_json, updated_at = excluded.updated_at`, record.decisionId, JSON.stringify(record), record.updatedAt);
+        },
+        async getDecision(id) {
+            return one('SELECT record_json FROM decision_records WHERE decision_id = ?', id);
+        },
+        async transitionDecision(id, event) {
+            const record = await this.getDecision(id);
+            if (!record)
+                return null;
+            const result = applyDecisionTransition(record, event);
+            if (result.ok)
+                await this.putDecision(result.next);
+            return result;
+        },
+        async putCommitment(record) {
+            saveCommitment(record);
+        },
+        async getCommitment(id) {
+            return one('SELECT record_json FROM commitment_records WHERE commitment_id = ?', id);
+        },
+        async listOpenCommitments() {
+            return sql
+                .exec(`SELECT record_json FROM commitment_records WHERE state IN (?, ?, ?) ORDER BY updated_at DESC`, ...OPEN_COMMITMENT_STATES)
+                .toArray()
+                .map((r) => JSON.parse(r.record_json));
+        },
+        async transitionCommitment(id, event) {
+            const record = await this.getCommitment(id);
+            if (!record)
+                return null;
+            const result = applyCommitmentTransition(record, event);
+            if (result.ok)
+                saveCommitment(result.next);
+            return result;
+        },
+        async putInboxEntry(entry) {
+            sql.exec(`INSERT INTO inbox_entries (viewer, exchange_id, record_json) VALUES (?, ?, ?)
+         ON CONFLICT(viewer, exchange_id) DO UPDATE SET record_json = excluded.record_json`, entry.viewer, entry.exchangeId, JSON.stringify(entry));
+        },
+        async getInboxEntry(viewer, exchangeId) {
+            return one('SELECT record_json FROM inbox_entries WHERE viewer = ? AND exchange_id = ?', viewer, exchangeId);
+        },
+        async transitionInbox(viewer, exchangeId, event) {
+            const entry = await this.getInboxEntry(viewer, exchangeId);
+            if (!entry)
+                return null;
+            const result = applyInboxTransition(entry, event);
+            if (result.ok)
+                await this.putInboxEntry(result.next);
+            return result;
+        },
+    };
+    return store;
+}
+/** The lifecycle facet of a stored interaction, for the machine to operate on. */
+function lifecycleOf(record) {
+    return {
+        interactionId: record.interactionId,
+        state: lifecycleStateOf(record),
+        principal: record.principal,
+        participations: record.participations,
+        updatedAt: record.updatedAt,
+    };
+}
+function lifecycleStateOf(record) {
+    return record.lifecycleState;
+}
+//# sourceMappingURL=interaction-store.js.map