@agenticprimitives/fabric 0.0.0-alpha.39 → 0.0.0-alpha.40

package/CLAUDE.md

@@ -7,10 +7,8 @@ re-verified against the principal SA. Transport-agnostic core; the Cloudflare `P
 adapter ships from `./cloudflare`.
 
 ## Status
-**W1–W10b DONE.** Wave-by-wave history + what each shipped:
-[`docs/architecture.md` §7a](docs/architecture.md). Next: `MessageEnvelopeV1.kind` — the last enum, and a
-re-signing cutover rather than a cleanup (it is inside the signed wire hash, spec 340 §R.1/§R.3);
-interaction-aware ingress; on-chain `atl:gatewayRoot`; `A2aTaskDO`/`SessionStoreDO` absorption.
+**W1–W10b DONE** — history: [`docs/architecture.md` §7a](docs/architecture.md). Next: `MessageEnvelopeV1.kind`
+(a re-signing cutover, spec 340 §R.1/§R.3); on-chain `atl:gatewayRoot`; `A2aTaskDO`/`SessionStoreDO` absorption.
 
 ## What this package owns
 - `ExchangeRecordV1` — the ONE canonical object (spine id `xch_`); two-level FSM: `ExecState`
@@ -32,17 +30,19 @@ interaction-aware ingress; on-chain `atl:gatewayRoot`; `A2aTaskDO`/`SessionStore
 - **Two serving planes; the transition is a LADDER** ([ADR-0060](../../docs/architecture/decisions/0060-incremental-gateway-adoption.md)).
   `InteractionsDO` serves; this is the target. Ops climb `off → shadow → serving` one at a time. A clean
   shadow proves the planes AGREE, never that either is right.
+- **The gateway authenticates its own ingress** (spec 445 §3.4): `principal`/`tier`/`actor` come only from the
+  injected `GatewayDeps.authenticate` via `admitCaller` → `AuthenticatedCaller`; no authenticator ⇒ refused.
+  `orchestrate` = verdict + per-step caveat pass + request id. Only an `active` interaction takes exchanges;
+  `openInteraction` never overwrites. Consult eligibility = current member ∩ live grant (two inputs).
 - **Authority is never satisfied by the exchange.** A request carries an `authorityRef`; approving a
   case advances the lifecycle, it NEVER unlocks a resource (spec 316 §2, ADR-0041).
 - **`ExecState` is `fulfillment`'s `TaskState`, unmodified** — `fulfillment` stays a pure leaf.
 - **Fail-closed coupling.** An `(exec, case)` pair with no mapping is a typed rejection.
 - **Transport-agnostic core.** No Cloudflare/MCP/A2A-SDK imports in `src/` — `./cloudflare` is the
   only adapter and the only `@cloudflare/workers-types` consumer.
-
-- **The adoption ladder's mechanics are here** (`src/adoption.ts`, promoted in spec 399 §4): `AdoptionLedger`
-  types, `adoptionStage(ledger, op, env)` (the deployment's `GATEWAY_SHADOW` gates a shadow; `""` is unset),
-  `compareServed` / `classifyDivergence` (a race is not a divergence), `shouldShadow` sampling, the bounded
-  in-memory `recordDivergence`. The ledger VALUES — which op is on which rung, and why — stay with the product.
+- **The adoption ladder's mechanics are here** (`src/adoption.ts`, spec 399 §4): `adoptionStage(ledger, op, env)`
+  (`GATEWAY_SHADOW` gates a shadow; `""` is unset), `compareServed` / `classifyDivergence`, `shouldShadow`,
+  `recordDivergence`. The ledger VALUES — which op is on which rung, and why — stay with the product.
 
 ## Boundary
 `types`, `fulfillment`, `vault`, `audit`, `delegation`, `chain-state`, `tool-policy`, `agent-naming`
@@ -50,19 +50,11 @@ interaction-aware ingress; on-chain `atl:gatewayRoot`; `A2aTaskDO`/`SessionStore
 provenance` (the PROV-O projector). No back-edges; nothing imports `fabric` except `./cloudflare` + apps.
 
 ## Validate
-```bash
-pnpm --filter @agenticprimitives/fabric typecheck
-pnpm --filter @agenticprimitives/fabric test
-```
-
-## Capabilities
-- **Messaging + Interactions** ([spec 309](../../specs/309-messaging-and-interactions.md)) — fabric IS the
-  substrate both were absorbed into · [guide](../../apps/demo-sso-next/docs/messaging-interactions/guide.md).
-- **Home control plane + inbox** ([spec 310](../../specs/310-agentic-trust-home-control-plane-and-inbox.md))
-  · [guide](../../apps/demo-sso-next/docs/home-inbox/guide.md).
-- Index: [cross-cutting-capabilities.md](../../docs/architecture/cross-cutting-capabilities.md).
+`pnpm --filter @agenticprimitives/fabric typecheck && pnpm --filter @agenticprimitives/fabric test`
 
-## Spec + guides
-[spec 316](../../specs/316-agentic-interaction-fabric.md) (architect-of-record) ·
+## Capabilities, spec + guides
+Messaging + Interactions ([spec 309](../../specs/309-messaging-and-interactions.md)) · Home control plane +
+inbox ([spec 310](../../specs/310-agentic-trust-home-control-plane-and-inbox.md)) ·
+[index](../../docs/architecture/cross-cutting-capabilities.md) · [spec 316](../../specs/316-agentic-interaction-fabric.md) (architect-of-record) ·
 [target](../../docs/architecture/agentic-interaction-fabric-target.md) · ADR-0047 ·
 [fabric architecture](docs/architecture.md) (live wiring + build history).

package/dist/cloudflare/exchange-store.d.ts

@@ -1,9 +1,28 @@
 import type { ExchangeRecordV1, ExchangeEventV1, ExchangeId } from '../exchange-record.js';
 import { type ExchangeApplyResult } from '../exchange-reducer.js';
+/** The outcome of an insert-only write: stored, or refused with the record that was already there. */
+export type ExchangeInsertResult = {
+    inserted: true;
+} | {
+    inserted: false;
+    existing: ExchangeRecordV1;
+};
 /** Durable, single-writer store of `ExchangeRecordV1` snapshots for one principal's gateway DO. */
 export interface ExchangeStore {
-    /** Seed / overwrite an exchange (e.g. T0 delivery persisting a freshly-built record). Single-writer. */
+    /**
+     * OVERWRITE by exchange id. Reserved for the single writer's OWN path — a reducer result, a rebuild, a
+     * migration — where the caller already holds the record it is replacing. It MUST NOT be reachable from
+     * anything a counterparty supplies: an exchange id is shared with every party to the exchange and is not
+     * a secret, so an overwrite keyed by one lets any peer replace the owner's history (spec 445 §3.4,
+     * audit H-10 / DATA-1). A delivery uses `insert`.
+     */
     put(record: ExchangeRecordV1): Promise<void>;
+    /**
+     * INSERT-ONLY (spec 445 §3.4). Stores `record` iff nothing is held under its exchange id; otherwise
+     * writes NOTHING and returns what is already there, so the caller can tell an idempotent redelivery
+     * from an attempt to replace. This is the only write a delivery may make.
+     */
+    insert(record: ExchangeRecordV1): Promise<ExchangeInsertResult>;
     /** The current record, or `null`. */
     get(exchangeId: ExchangeId | string): Promise<ExchangeRecordV1 | null>;
     /** Append one event: load → `applyExchangeEvent` → persist on success; the reducer's result is returned

package/dist/cloudflare/exchange-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exchange-store.d.ts","sourceRoot":"","sources":["../../src/cloudflare/exchange-store.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAiBtF,mGAAmG;AACnG,MAAM,WAAW,aAAa;IAC5B,wGAAwG;IACxG,GAAG,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,qCAAqC;IACrC,GAAG,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACvE;kGAC8F;IAC9F,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACrG,0EAA0E;IAC1E,IAAI,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CACrC;AAED,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,UAAU,GAAG,aAAa,CAyC/E"}
+{"version":3,"file":"exchange-store.d.ts","sourceRoot":"","sources":["../../src/cloudflare/exchange-store.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAiBtF,sGAAsG;AACtG,MAAM,MAAM,oBAAoB,GAAG;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAExG,mGAAmG;AACnG,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,GAAG,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAChE,qCAAqC;IACrC,GAAG,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACvE;kGAC8F;IAC9F,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACrG,0EAA0E;IAC1E,IAAI,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CACrC;AAED,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,UAAU,GAAG,aAAa,CAoE/E"}

package/dist/cloudflare/exchange-store.js

@@ -15,15 +15,37 @@ export function createDurableObjectExchangeStore(sql) {
        ON CONFLICT(exchange_id) DO UPDATE SET
          record_json = excluded.record_json, rev = excluded.rev, updated_at = excluded.updated_at`, record.exchangeId, JSON.stringify(record), record.rev, record.updatedAt);
     };
+    const read = (exchangeId) => {
+        const rows = sql
+            .exec('SELECT record_json FROM exchange_records WHERE exchange_id = ?', String(exchangeId))
+            .toArray();
+        return rows[0] ? JSON.parse(rows[0].record_json) : null;
+    };
     return {
         async put(record) {
             save(record);
         },
-        async get(exchangeId) {
-            const rows = sql
-                .exec('SELECT record_json FROM exchange_records WHERE exchange_id = ?', String(exchangeId))
+        async insert(record) {
+            // ONE statement decides: `ON CONFLICT DO NOTHING` cannot replace a row, and `RETURNING` reports
+            // whether this call was the one that wrote it. No read-then-write window, so the answer does not
+            // depend on the DO's single-writer execution to be right (spec 445 §3.4).
+            const wrote = sql
+                .exec(`INSERT INTO exchange_records (exchange_id, record_json, rev, updated_at)
+           VALUES (?, ?, ?, ?)
+           ON CONFLICT(exchange_id) DO NOTHING
+           RETURNING exchange_id`, record.exchangeId, JSON.stringify(record), record.rev, record.updatedAt)
                 .toArray();
-            return rows[0] ? JSON.parse(rows[0].record_json) : null;
+            if (wrote.length > 0)
+                return { inserted: true };
+            const existing = read(record.exchangeId);
+            // A conflict with no row behind it cannot happen in one isolate; throwing says so rather than
+            // reporting an insert that did not occur.
+            if (!existing)
+                throw new Error(`exchange-store: insert conflicted but ${record.exchangeId} is not readable`);
+            return { inserted: false, existing };
+        },
+        async get(exchangeId) {
+            return read(exchangeId);
         },
         async append(exchangeId, event) {
             const current = await this.get(exchangeId);

package/dist/cloudflare/exchange-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"exchange-store.js","sourceRoot":"","sources":["../../src/cloudflare/exchange-store.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,kBAAkB,EAA4B,MAAM,wBAAwB,CAAC;AAEtF,MAAM,YAAY,GAAG;;;;;EAKnB,CAAC;AACH,MAAM,YAAY,GAAG,+FAA+F,CAAC;AAsBrH,MAAM,UAAU,gCAAgC,CAAC,GAAe;IAC9D,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEvB,MAAM,IAAI,GAAG,CAAC,MAAwB,EAAQ,EAAE;QAC9C,GAAG,CAAC,IAAI,CACN;;;kGAG4F,EAC5F,MAAM,CAAC,UAAU,EACjB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,SAAS,CACjB,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,IAAI,CAAC,MAAM,CAAC,CAAC;QACf,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,UAAU;YAClB,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CAAc,gEAAgE,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;iBACvG,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAsB,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK;YAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,EAAE;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CAAc,mEAAmE,CAAC;iBACtF,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAqB,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"exchange-store.js","sourceRoot":"","sources":["../../src/cloudflare/exchange-store.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,kBAAkB,EAA4B,MAAM,wBAAwB,CAAC;AAEtF,MAAM,YAAY,GAAG;;;;;EAKnB,CAAC;AACH,MAAM,YAAY,GAAG,+FAA+F,CAAC;AAqCrH,MAAM,UAAU,gCAAgC,CAAC,GAAe;IAC9D,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEvB,MAAM,IAAI,GAAG,CAAC,MAAwB,EAAQ,EAAE;QAC9C,GAAG,CAAC,IAAI,CACN;;;kGAG4F,EAC5F,MAAM,CAAC,UAAU,EACjB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,SAAS,CACjB,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,UAA+B,EAA2B,EAAE;QACxE,MAAM,IAAI,GAAG,GAAG;aACb,IAAI,CAAc,gEAAgE,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;aACvG,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAsB,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,IAAI,CAAC,MAAM,CAAC,CAAC;QACf,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,gGAAgG;YAChG,iGAAiG;YACjG,0EAA0E;YAC1E,MAAM,KAAK,GAAG,GAAG;iBACd,IAAI,CACH;;;iCAGuB,EACvB,MAAM,CAAC,UAAU,EACjB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,SAAS,CACjB;iBACA,OAAO,EAAE,CAAC;YACb,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACzC,8FAA8F;YAC9F,0CAA0C;YAC1C,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,UAAU,kBAAkB,CAAC,CAAC;YAC7G,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACvC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,UAAU;YAClB,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK;YAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,EAAE;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CAAc,mEAAmE,CAAC;iBACtF,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAqB,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cloudflare/index.d.ts

@@ -1,15 +1,15 @@
 export { createDurableObjectSqlVault } from './sql-vault.js';
-export { createDurableObjectExchangeStore, type ExchangeStore } from './exchange-store.js';
-export { createDurableObjectInteractionStore, type InteractionStore, type SnapshotPutResult, } from './interaction-store.js';
+export { createDurableObjectExchangeStore, type ExchangeStore, type ExchangeInsertResult } from './exchange-store.js';
+export { createDurableObjectInteractionStore, TerminalRecordError, type InteractionStore, type SnapshotPutResult, } from './interaction-store.js';
 export { createDurableObjectOutboxStore, type OutboxStore, type OutboxEntry } from './outbox-store.js';
 export { createDurableObjectProvenanceStore, type ProvenanceStore } from './provenance-store.js';
 export { createDurableObjectChannelStore, projectionAuthorizes, type ChannelStore, type ChannelV1, type ConversationRoleProjection, type ConversationRoleAction, } from './channel-store.js';
 export { createDurableObjectAuthorityVerdictCache, VERDICT_TTL_MS, type VerdictCacheOptions, type AuthorityVerdictCache, type AuthorityVerdict, type AuthorityVerdictKey, } from './authority-verdict-cache.js';
 export { createDurableObjectRequestIdLedger, type RequestIdLedger, type RequestIdReservation } from './request-id-ledger.js';
 export { createDurableObjectReceiptSigner, verifyDeliveryReceipt, type DeliveryReceiptSigner, type DeliveryReceiptInput, type SignedDeliveryReceiptV1, } from './receipt-signer.js';
-export { PrincipalGatewayDO, type PrincipalGatewayEnv, type GatewayDeps } from './principal-gateway-do.js';
+export { PrincipalGatewayDO, GatewayAuthError, InteractionExistsError, type PrincipalGatewayEnv, type GatewayDeps, type GatewayAuthenticator, type GatewayCallerIdentity, type AuthenticatedCaller, type GatewayOrchestrationResult, type DeliveryOutcome, type DeliveryNote, } from './principal-gateway-do.js';
 export { buildVaultTools, createToolRegistry, type GatewayTool, type GatewayToolContext, type GatewayToolRegistry, } from './gateway-tools.js';
-export { runGatewayOrchestration, gatewayToolSpecs, bindGatewayToolInvoker } from './orchestration-runtime.js';
+export { runGatewayOrchestration, gatewayToolSpecs, bindGatewayToolInvoker, type GatewayStepGate } from './orchestration-runtime.js';
 export { createVaultExchangeStore, exchangeResource, EXCHANGE_INDEX_RESOURCE, type VaultExchangeStore, type ExchangeIndexV1, } from './vault-exchange-store.js';
 export { createVaultInteractionStore, interactionResource, decisionResource, commitmentResource, snapshotResource, inboxEntryResource, INTERACTION_INDEX_RESOURCE, type VaultInteractionStore, type InteractionIndexV1, } from './vault-interaction-store.js';
 export declare const FABRIC_CLOUDFLARE_ADAPTER_STATUS: "w2-coresident-mcp";

package/dist/cloudflare/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gCAAgC,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAI3F,OAAO,EACL,mCAAmC,EACnC,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,8BAA8B,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,EACL,+BAA+B,EAAE,oBAAoB,EACrD,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,KAAK,0BAA0B,EAAE,KAAK,sBAAsB,GAChG,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wCAAwC,EACxC,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC3G,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAC/G,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,8BAA8B,CAAC;AAEtC,eAAO,MAAM,gCAAgC,EAAG,mBAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gCAAgC,EAAE,KAAK,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAItH,OAAO,EACL,mCAAmC,EACnC,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,8BAA8B,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,EACL,+BAA+B,EAAE,oBAAoB,EACrD,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,KAAK,0BAA0B,EAAE,KAAK,sBAAsB,GAChG,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wCAAwC,EACxC,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EACL,gCAAgC,EAChC,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,YAAY,GAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,KAAK,eAAe,EAAE,MAAM,4BAA4B,CAAC;AACrI,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,8BAA8B,CAAC;AAEtC,eAAO,MAAM,gCAAgC,EAAG,mBAA4B,CAAC"}

package/dist/cloudflare/index.js

@@ -10,14 +10,14 @@ export { createDurableObjectExchangeStore } from './exchange-store.js';
 // The interaction spine's durable home (spec 340 W6) — interactions, context snapshots, decisions,
 // commitments and per-viewer inbox state. Five tables, because the six machines answer to different
 // parties at different times and one row would make them one write.
-export { createDurableObjectInteractionStore, } from './interaction-store.js';
+export { createDurableObjectInteractionStore, TerminalRecordError, } from './interaction-store.js';
 export { createDurableObjectOutboxStore } from './outbox-store.js';
 export { createDurableObjectProvenanceStore } from './provenance-store.js';
 export { createDurableObjectChannelStore, projectionAuthorizes, } from './channel-store.js';
 export { createDurableObjectAuthorityVerdictCache, VERDICT_TTL_MS, } from './authority-verdict-cache.js';
 export { createDurableObjectRequestIdLedger } from './request-id-ledger.js';
 export { createDurableObjectReceiptSigner, verifyDeliveryReceipt, } from './receipt-signer.js';
-export { PrincipalGatewayDO } from './principal-gateway-do.js';
+export { PrincipalGatewayDO, GatewayAuthError, InteractionExistsError, } from './principal-gateway-do.js';
 export { buildVaultTools, createToolRegistry, } from './gateway-tools.js';
 export { runGatewayOrchestration, gatewayToolSpecs, bindGatewayToolInvoker } from './orchestration-runtime.js';
 export { createVaultExchangeStore, exchangeResource, EXCHANGE_INDEX_RESOURCE, } from './vault-exchange-store.js';

package/dist/cloudflare/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,EAAE;AACF,wGAAwG;AACxG,wGAAwG;AACxG,yGAAyG;AACzG,yGAAyG;AACzG,4CAA4C;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gCAAgC,EAAsB,MAAM,qBAAqB,CAAC;AAC3F,mGAAmG;AACnG,oGAAoG;AACpG,oEAAoE;AACpE,OAAO,EACL,mCAAmC,GAGpC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,8BAA8B,EAAsC,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAwB,MAAM,uBAAuB,CAAC;AACjG,OAAO,EACL,+BAA+B,EAAE,oBAAoB,GAEtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wCAAwC,EACxC,cAAc,GAKf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAmD,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EACL,gCAAgC,EAChC,qBAAqB,GAItB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAA8C,MAAM,2BAA2B,CAAC;AAC3G,OAAO,EACL,eAAe,EACf,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAC/G,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,uBAAuB,GAGxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,GAG3B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,CAAC,MAAM,gCAAgC,GAAG,mBAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,EAAE;AACF,wGAAwG;AACxG,wGAAwG;AACxG,yGAAyG;AACzG,yGAAyG;AACzG,4CAA4C;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,gCAAgC,EAAiD,MAAM,qBAAqB,CAAC;AACtH,mGAAmG;AACnG,oGAAoG;AACpG,oEAAoE;AACpE,OAAO,EACL,mCAAmC,EACnC,mBAAmB,GAGpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,8BAA8B,EAAsC,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,kCAAkC,EAAwB,MAAM,uBAAuB,CAAC;AACjG,OAAO,EACL,+BAA+B,EAAE,oBAAoB,GAEtD,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wCAAwC,EACxC,cAAc,GAKf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAmD,MAAM,wBAAwB,CAAC;AAC7H,OAAO,EACL,gCAAgC,EAChC,qBAAqB,GAItB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,GASvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,EACf,kBAAkB,GAInB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,sBAAsB,EAAwB,MAAM,4BAA4B,CAAC;AACrI,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,uBAAuB,GAGxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,GAG3B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,CAAC,MAAM,gCAAgC,GAAG,mBAA4B,CAAC"}

package/dist/cloudflare/interaction-store.d.ts

@@ -9,7 +9,33 @@ export type SnapshotPutResult = {
     ok: false;
     reason: 'digest-mismatch';
 };
+/**
+ * A `put*` was offered over a record that has already ENDED (spec 445 §3.4, audit DATB-6).
+ *
+ * THE RULE: a put creates a record or replaces one that is still live; it never replaces one in a
+ * terminal state. A concluded interaction, a refused decision and a discharged commitment are facts
+ * about how something ended, and the machines refuse every transition out of them — a put that could
+ * write `active` over `discharged` would make that refusal a convention rather than a property.
+ *
+ * Thrown, not returned: the port's `put*` return `void`, and a refusal a caller can ignore by not
+ * looking is the silent overwrite again. Re-putting the IDENTICAL record is a no-op, not an error —
+ * a replayed import says nothing new. The reducers are unaffected: a transition is only ever applied
+ * to a non-terminal record, so their own writes never meet this guard.
+ */
+export declare class TerminalRecordError extends Error {
+    readonly family: 'interaction' | 'decision' | 'commitment';
+    readonly id: string;
+    readonly state: string;
+    readonly reason: "terminal-state";
+    constructor(family: 'interaction' | 'decision' | 'commitment', id: string, state: string);
+}
+/** The guard both stores share, so "terminal" cannot mean one thing over DO-SQL and another over the
+ *  vault. Returns `'skip'` when the offered record is identical to the stored terminal one. */
+export declare function guardPutOverTerminal<T>(family: 'interaction' | 'decision' | 'commitment', id: string, existing: T | null, incoming: T, stateOf: (r: T) => string): 'write' | 'skip';
 export interface InteractionStore {
+    /** Create, or replace while still live. Throws {@link TerminalRecordError} over an ended record —
+     *  the same holds for `putDecision` and `putCommitment` (spec 445 §3.4). Inbox entries have no
+     *  terminal state (`deleted` is restorable), so `putInboxEntry` is not guarded. */
     putInteraction(record: InteractionRecordV1): Promise<void>;
     getInteraction(id: InteractionId | string): Promise<InteractionRecordV1 | null>;
     listInteractions(): Promise<InteractionRecordV1[]>;

package/dist/cloudflare/interaction-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interaction-store.d.ts","sourceRoot":"","sources":["../../src/cloudflare/interaction-store.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAEtG,OAAO,EAKL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AA8CjE,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,WAAW,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAE7C,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,cAAc,CAAC,EAAE,EAAE,aAAa,GAAG,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAChF,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACnD,mGAAmG;IACnG,qBAAqB,CACnB,EAAE,EAAE,aAAa,GAAG,MAAM,EAC1B,KAAK,EAAE;QAAE,UAAU,EAAE,qBAAqB,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAChF,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,CAAC;IAEzD,mGAAmG;IACnG,cAAc,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAE7F;4FACwF;IACxF,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC5E,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAEtE,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC1D,kBAAkB,CAChB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,UAAU,EAAE,kBAAkB,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/F,OAAO,CAAC,aAAa,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC;IAEnD,aAAa,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC9D,qGAAqG;IACrG,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACrD,oBAAoB,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,UAAU,EAAE,oBAAoB,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC/E,OAAO,CAAC,aAAa,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC;IAErD,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1F,eAAe,CACb,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QAAE,UAAU,EAAE,eAAe,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC1E,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;CAChD;AAKD,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,UAAU,GAAG,gBAAgB,CA4LrF"}
+{"version":3,"file":"interaction-store.d.ts","sourceRoot":"","sources":["../../src/cloudflare/interaction-store.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAEtG,OAAO,EAQL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AA+CjE,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,WAAW,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAEhC,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,UAAU,GAAG,YAAY;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM;IADnH,QAAQ,CAAC,MAAM,EAAG,gBAAgB,CAAU;gBACvB,MAAM,EAAE,aAAa,GAAG,UAAU,GAAG,YAAY,EAAW,EAAE,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM;CAIpH;AAED;+FAC+F;AAC/F,wBAAgB,oBAAoB,CAAC,CAAC,EACpC,MAAM,EAAE,aAAa,GAAG,UAAU,GAAG,YAAY,EACjD,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,CAAC,GAAG,IAAI,EAClB,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,GACxB,OAAO,GAAG,MAAM,CAUlB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;uFAEmF;IACnF,cAAc,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,cAAc,CAAC,EAAE,EAAE,aAAa,GAAG,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAChF,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACnD,mGAAmG;IACnG,qBAAqB,CACnB,EAAE,EAAE,aAAa,GAAG,MAAM,EAC1B,KAAK,EAAE;QAAE,UAAU,EAAE,qBAAqB,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAChF,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,CAAC;IAEzD,mGAAmG;IACnG,cAAc,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAE7F;4FACwF;IACxF,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC5E,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAEtE,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC1D,kBAAkB,CAChB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,UAAU,EAAE,kBAAkB,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/F,OAAO,CAAC,aAAa,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC;IAEnD,aAAa,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC9D,qGAAqG;IACrG,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACrD,oBAAoB,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,UAAU,EAAE,oBAAoB,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC/E,OAAO,CAAC,aAAa,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC;IAErD,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,aAAa,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1F,eAAe,CACb,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QAAE,UAAU,EAAE,eAAe,CAAC;QAAC,KAAK,EAAE,gBAAgB,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC1E,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;CAChD;AAKD,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,UAAU,GAAG,gBAAgB,CAkMrF"}

package/dist/cloudflare/interaction-store.js

@@ -26,8 +26,9 @@
 // authorize anything. Authority is `delegation` + `entitlements` + `tool-policy` at the moment of
 // acting (ADR-0041, ADR-0043).
 import { verifyContextSnapshot } from '../interaction-record.js';
-import { applyInteractionTransition, applyDecisionTransition, applyCommitmentTransition, applyInboxTransition, } from '../interaction-machines.js';
+import { applyInteractionTransition, applyDecisionTransition, applyCommitmentTransition, applyInboxTransition, TERMINAL_INTERACTION_STATES, TERMINAL_DECISION_STATES, TERMINAL_COMMITMENT_STATES, } from '../interaction-machines.js';
 import { bindingKey, resolveInteractionByBinding, } from '../protocol-binding.js';
+import { canonicalizeJson } from '@agenticprimitives/types';
 const CREATE_TABLES = [
     `CREATE TABLE IF NOT EXISTS interaction_records (
      interaction_id TEXT PRIMARY KEY,
@@ -67,6 +68,47 @@ const CREATE_TABLES = [
      PRIMARY KEY (viewer, exchange_id)
    )`,
 ];
+/**
+ * A `put*` was offered over a record that has already ENDED (spec 445 §3.4, audit DATB-6).
+ *
+ * THE RULE: a put creates a record or replaces one that is still live; it never replaces one in a
+ * terminal state. A concluded interaction, a refused decision and a discharged commitment are facts
+ * about how something ended, and the machines refuse every transition out of them — a put that could
+ * write `active` over `discharged` would make that refusal a convention rather than a property.
+ *
+ * Thrown, not returned: the port's `put*` return `void`, and a refusal a caller can ignore by not
+ * looking is the silent overwrite again. Re-putting the IDENTICAL record is a no-op, not an error —
+ * a replayed import says nothing new. The reducers are unaffected: a transition is only ever applied
+ * to a non-terminal record, so their own writes never meet this guard.
+ */
+export class TerminalRecordError extends Error {
+    family;
+    id;
+    state;
+    reason = 'terminal-state';
+    constructor(family, id, state) {
+        super(`interaction-store: ${family} ${id} is ${state} (terminal); a put may not replace it`);
+        this.family = family;
+        this.id = id;
+        this.state = state;
+        this.name = 'TerminalRecordError';
+    }
+}
+/** The guard both stores share, so "terminal" cannot mean one thing over DO-SQL and another over the
+ *  vault. Returns `'skip'` when the offered record is identical to the stored terminal one. */
+export function guardPutOverTerminal(family, id, existing, incoming, stateOf) {
+    if (!existing)
+        return 'write';
+    const terminal = family === 'interaction' ? TERMINAL_INTERACTION_STATES
+        : family === 'decision' ? TERMINAL_DECISION_STATES
+            : TERMINAL_COMMITMENT_STATES;
+    const state = stateOf(existing);
+    if (!terminal.includes(state))
+        return 'write';
+    if (canonicalizeJson(existing) === canonicalizeJson(incoming))
+        return 'skip';
+    throw new TerminalRecordError(family, id, state);
+}
 /** States an obligation is still live in. `discharged`/`breached`/`void` are ended, differently. */
 const OPEN_COMMITMENT_STATES = ['proposed', 'active', 'fulfilment-claimed'];
 export function createDurableObjectInteractionStore(sql) {
@@ -91,6 +133,9 @@ export function createDurableObjectInteractionStore(sql) {
     };
     const store = {
         async putInteraction(record) {
+            const existing = await this.getInteraction(record.interactionId);
+            if (guardPutOverTerminal('interaction', String(record.interactionId), existing, record, lifecycleStateOf) === 'skip')
+                return;
             saveInteraction(record);
             for (const b of record.protocolBindings ?? []) {
                 sql.exec(`INSERT INTO interaction_bindings (binding_key, interaction_id, binding_json) VALUES (?, ?, ?)
@@ -159,6 +204,9 @@ export function createDurableObjectInteractionStore(sql) {
             return rows[0] ? JSON.parse(rows[0].snapshot_json) : null;
         },
         async putDecision(record) {
+            const existing = await this.getDecision(record.decisionId);
+            if (guardPutOverTerminal('decision', record.decisionId, existing, record, (r) => r.state) === 'skip')
+                return;
             sql.exec(`INSERT INTO decision_records (decision_id, record_json, updated_at) VALUES (?, ?, ?)
          ON CONFLICT(decision_id) DO UPDATE SET record_json = excluded.record_json, updated_at = excluded.updated_at`, record.decisionId, JSON.stringify(record), record.updatedAt);
         },
@@ -175,6 +223,9 @@ export function createDurableObjectInteractionStore(sql) {
             return result;
         },
         async putCommitment(record) {
+            const existing = await this.getCommitment(record.commitmentId);
+            if (guardPutOverTerminal('commitment', record.commitmentId, existing, record, (r) => r.state) === 'skip')
+                return;
             saveCommitment(record);
         },
         async getCommitment(id) {

package/dist/cloudflare/interaction-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"interaction-store.js","sourceRoot":"","sources":["../../src/cloudflare/interaction-store.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,oGAAoG;AACpG,oGAAoG;AACpG,EAAE;AACF,uGAAuG;AACvG,gGAAgG;AAChG,2FAA2F;AAC3F,EAAE;AACF,iFAAiF;AACjF,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,gGAAgG;AAChG,4DAA4D;AAC5D,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,oGAAoG;AACpG,mGAAmG;AACnG,6FAA6F;AAC7F,4DAA4D;AAC5D,iGAAiG;AACjG,mFAAmF;AACnF,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,+BAA+B;AAG/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,GAUrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,UAAU,EACV,2BAA2B,GAG5B,MAAM,wBAAwB,CAAC;AAGhC,MAAM,aAAa,GAAG;IACpB;;;;;;KAMG;IACH,8FAA8F;IAC9F,oGAAoG;IACpG,+FAA+F;IAC/F;;;;;KAKG;IACH;;;KAGG;IACH;;;;KAIG;IACH;;;;;KAKG;IACH;;;;;KAKG;CACJ,CAAC;AAsDF,oGAAoG;AACpG,MAAM,sBAAsB,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,oBAAoB,CAAU,CAAC;AAErF,MAAM,UAAU,mCAAmC,CAAC,GAAe;IACjE,KAAK,MAAM,GAAG,IAAI,aAAa;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE/C,MAAM,GAAG,GAAG,CAAI,KAAa,EAAE,GAAG,KAAgB,EAAY,EAAE;QAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAU,KAAK,EAAE,GAAI,KAA2B,CAAC,CAAC,OAAO,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,CAAC,MAA2B,EAAQ,EAAE;QAC5D,GAAG,CAAC,IAAI,CACN;;;;8DAIwD,EACxD,MAAM,CAAC,aAAa,EACpB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,gBAAgB,CAAC,MAAM,CAAC,EACxB,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,SAAS,CACjB,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,CAAC,MAA0B,EAAQ,EAAE;QAC1D,GAAG,CAAC,IAAI,CACN;;;sGAGgG,EAChG,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAC5E,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,KAAK,GAAqB;QAC9B,KAAK,CAAC,cAAc,CAAC,MAAM;YACzB,eAAe,CAAC,MAAM,CAAC,CAAC;YACxB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CACN;uGAC6F,EAC7F,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAClF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE;YACrB,OAAO,GAAG,CACR,sEAAsE,EAAE,MAAM,CAAC,EAAE,CAAC,CACnF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,gBAAgB;YACpB,OAAO,GAAG;iBACP,IAAI,CAAU,sEAAsE,CAAC;iBACrF,OAAO,EAAE;iBACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAwB,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,EAAE,EAAE,KAAK;YACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,MAAM,GAAG,0BAA0B,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACtE,gGAAgG;YAChG,+EAA+E;YAC/E,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,eAAe,CAAC;oBACd,GAAG,MAAM;oBACT,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;oBACjC,SAAS,EAAE,KAAK,CAAC,EAAE;oBACnB,GAAG,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO;YAC9B,GAAG,CAAC,IAAI,CACN;qGAC6F,EAC7F,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK;YAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,GAAG;iBACZ,IAAI,CAAa,uEAAuE,EAAE,GAAG,CAAC;iBAC9F,OAAO,EAAE;iBACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAA+B,CAAC,CAAC;YACjD,gGAAgG;YAChG,qEAAqE;YACrE,OAAO,2BAA2B,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpF,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,QAAQ;YAC/B,+FAA+F;YAC/F,gGAAgG;YAChG,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YAC9F,MAAM,QAAQ,GAAG,GAAG;iBACjB,IAAI,CAAc,8DAA8D,EAAE,QAAQ,CAAC,MAAM,CAAC;iBAClG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAChB,0FAA0F;YAC1F,wFAAwF;YACxF,IAAI,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CACN,qEAAqE,EACrE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC1C,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,MAAM;YAC7B,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CAAc,8DAA8D,EAAE,MAAM,CAAC;iBACzF,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAuB,CAAC,CAAC,CAAC,IAAI,CAAC;QACnF,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,GAAG,CAAC,IAAI,CACN;qHAC6G,EAC7G,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,CAC5D,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE;YAClB,OAAO,GAAG,CAAmB,gEAAgE,EAAE,EAAE,CAAC,CAAC;QACrG,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK;YAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACtD,IAAI,MAAM,CAAC,EAAE;gBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,MAAM;YACxB,cAAc,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE;YACpB,OAAO,GAAG,CAAqB,oEAAoE,EAAE,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,KAAK,CAAC,mBAAmB;YACvB,OAAO,GAAG;iBACP,IAAI,CACH,8FAA8F,EAC9F,GAAG,sBAAsB,CAC1B;iBACA,OAAO,EAAE;iBACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAuB,CAAC,CAAC;QACjE,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,KAAK;YAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,EAAE;gBAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAK;YACvB,GAAG,CAAC,IAAI,CACN;2FACmF,EACnF,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CACtD,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU;YACpC,OAAO,GAAG,CACR,4EAA4E,EAAE,MAAM,EAAE,UAAU,CACjG,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK;YAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,EAAE;gBAAE,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,SAAS,WAAW,CAAC,MAA2B;IAC9C,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA2B;IACnD,OAAO,MAAM,CAAC,cAAc,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"interaction-store.js","sourceRoot":"","sources":["../../src/cloudflare/interaction-store.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,oGAAoG;AACpG,oGAAoG;AACpG,EAAE;AACF,uGAAuG;AACvG,gGAAgG;AAChG,2FAA2F;AAC3F,EAAE;AACF,iFAAiF;AACjF,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,gGAAgG;AAChG,4DAA4D;AAC5D,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,oGAAoG;AACpG,mGAAmG;AACnG,6FAA6F;AAC7F,4DAA4D;AAC5D,iGAAiG;AACjG,mFAAmF;AACnF,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,+BAA+B;AAG/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,2BAA2B,EAC3B,wBAAwB,EACxB,0BAA0B,GAU3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,UAAU,EACV,2BAA2B,GAG5B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,MAAM,aAAa,GAAG;IACpB;;;;;;KAMG;IACH,8FAA8F;IAC9F,oGAAoG;IACpG,+FAA+F;IAC/F;;;;;KAKG;IACH;;;KAGG;IACH;;;;KAIG;IACH;;;;;KAKG;IACH;;;;;KAKG;CACJ,CAAC;AAUF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEvB;IAA4D;IAAqB;IAD7F,MAAM,GAAG,gBAAyB,CAAC;IAC5C,YAAqB,MAAiD,EAAW,EAAU,EAAW,KAAa;QACjH,KAAK,CAAC,sBAAsB,MAAM,IAAI,EAAE,OAAO,KAAK,uCAAuC,CAAC,CAAC;QAD1E,WAAM,GAAN,MAAM,CAA2C;QAAW,OAAE,GAAF,EAAE,CAAQ;QAAW,UAAK,GAAL,KAAK,CAAQ;QAEjH,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;+FAC+F;AAC/F,MAAM,UAAU,oBAAoB,CAClC,MAAiD,EACjD,EAAU,EACV,QAAkB,EAClB,QAAW,EACX,OAAyB;IAEzB,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9B,MAAM,QAAQ,GACZ,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,2BAA2B;QACpD,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,wBAAwB;YAChD,CAAC,CAAC,0BAA0B,CAAC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9C,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,gBAAgB,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7E,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAiDD,oGAAoG;AACpG,MAAM,sBAAsB,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,oBAAoB,CAAU,CAAC;AAErF,MAAM,UAAU,mCAAmC,CAAC,GAAe;IACjE,KAAK,MAAM,GAAG,IAAI,aAAa;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE/C,MAAM,GAAG,GAAG,CAAI,KAAa,EAAE,GAAG,KAAgB,EAAY,EAAE;QAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAU,KAAK,EAAE,GAAI,KAA2B,CAAC,CAAC,OAAO,EAAE,CAAC;QACjF,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,CAAC,MAA2B,EAAQ,EAAE;QAC5D,GAAG,CAAC,IAAI,CACN;;;;8DAIwD,EACxD,MAAM,CAAC,aAAa,EACpB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,gBAAgB,CAAC,MAAM,CAAC,EACxB,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,SAAS,CACjB,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,CAAC,MAA0B,EAAQ,EAAE;QAC1D,GAAG,CAAC,IAAI,CACN;;;sGAGgG,EAChG,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAC5E,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,KAAK,GAAqB;QAC9B,KAAK,CAAC,cAAc,CAAC,MAAM;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACjE,IAAI,oBAAoB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAC,KAAK,MAAM;gBAAE,OAAO;YAC7H,eAAe,CAAC,MAAM,CAAC,CAAC;YACxB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CACN;uGAC6F,EAC7F,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAClF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE;YACrB,OAAO,GAAG,CACR,sEAAsE,EAAE,MAAM,CAAC,EAAE,CAAC,CACnF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,gBAAgB;YACpB,OAAO,GAAG;iBACP,IAAI,CAAU,sEAAsE,CAAC;iBACrF,OAAO,EAAE;iBACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAwB,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,EAAE,EAAE,KAAK;YACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,MAAM,GAAG,0BAA0B,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACtE,gGAAgG;YAChG,+EAA+E;YAC/E,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,eAAe,CAAC;oBACd,GAAG,MAAM;oBACT,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;oBACjC,SAAS,EAAE,KAAK,CAAC,EAAE;oBACnB,GAAG,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO;YAC9B,GAAG,CAAC,IAAI,CACN;qGAC6F,EAC7F,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK;YAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,GAAG;iBACZ,IAAI,CAAa,uEAAuE,EAAE,GAAG,CAAC;iBAC9F,OAAO,EAAE;iBACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAA+B,CAAC,CAAC;YACjD,gGAAgG;YAChG,qEAAqE;YACrE,OAAO,2BAA2B,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpF,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,QAAQ;YAC/B,+FAA+F;YAC/F,gGAAgG;YAChG,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YAC9F,MAAM,QAAQ,GAAG,GAAG;iBACjB,IAAI,CAAc,8DAA8D,EAAE,QAAQ,CAAC,MAAM,CAAC;iBAClG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAChB,0FAA0F;YAC1F,wFAAwF;YACxF,IAAI,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CACN,qEAAqE,EACrE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAC1C,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,MAAM;YAC7B,MAAM,IAAI,GAAG,GAAG;iBACb,IAAI,CAAc,8DAA8D,EAAE,MAAM,CAAC;iBACzF,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAuB,CAAC,CAAC,CAAC,IAAI,CAAC;QACnF,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,MAAM;gBAAE,OAAO;YAC7G,GAAG,CAAC,IAAI,CACN;qHAC6G,EAC7G,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,CAC5D,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE;YAClB,OAAO,GAAG,CAAmB,gEAAgE,EAAE,EAAE,CAAC,CAAC;QACrG,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK;YAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACtD,IAAI,MAAM,CAAC,EAAE;gBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,MAAM;YACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC/D,IAAI,oBAAoB,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,MAAM;gBAAE,OAAO;YACjH,cAAc,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE;YACpB,OAAO,GAAG,CAAqB,oEAAoE,EAAE,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,KAAK,CAAC,mBAAmB;YACvB,OAAO,GAAG;iBACP,IAAI,CACH,8FAA8F,EAC9F,GAAG,sBAAsB,CAC1B;iBACA,OAAO,EAAE;iBACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAuB,CAAC,CAAC;QACjE,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,KAAK;YAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,EAAE;gBAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAK;YACvB,GAAG,CAAC,IAAI,CACN;2FACmF,EACnF,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CACtD,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU;YACpC,OAAO,GAAG,CACR,4EAA4E,EAAE,MAAM,EAAE,UAAU,CACjG,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK;YAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,EAAE;gBAAE,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,SAAS,WAAW,CAAC,MAA2B;IAC9C,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA2B;IACnD,OAAO,MAAM,CAAC,cAAc,CAAC;AAC/B,CAAC"}

package/dist/cloudflare/orchestration-runtime.d.ts

@@ -1,20 +1,31 @@
 import type { Vault } from '@agenticprimitives/vault';
 import { type Intent, type Planner, type RunResult, type ToolInvoker, type ToolSpec } from '@agenticprimitives/orchestration';
-import type { GatewayToolRegistry } from './gateway-tools.js';
+import type { GatewayTool, GatewayToolRegistry } from './gateway-tools.js';
 /** The co-resident tools as the planner's tool catalog (id + description; the plan may only reference these). */
 export declare function gatewayToolSpecs(registry: GatewayToolRegistry): ToolSpec[];
+/**
+ * The per-step gate (spec 445 §3.4, audit DATA-4). Called for EVERY planned step, with the concrete tool
+ * and the resolved arguments, BEFORE the tool runs; it throws to refuse. REQUIRED — the planner's input
+ * is by design a peer's text, so a step is authorized where it is used, never by having been planned.
+ * `PrincipalGatewayDO.orchestrate` supplies the §3a gate here (caveat pass B per step, request id for a
+ * write); a caller with no gate to offer has no business binding vault tools to a planner.
+ */
+export type GatewayStepGate = (tool: GatewayTool, args: Record<string, unknown>) => Promise<void>;
 /** Bind the co-resident tool registry as an orchestration `ToolInvoker`: each planned step dispatches to a
- *  DO tool, run over `vault` under `principal`. Fail-closed on an unknown tool (the plan is validated against
- *  the tool catalog too, but this is the last line). */
+ *  DO tool, run over `vault` under `principal` — after `authorizeStep` has passed it. Fail-closed on an
+ *  unknown tool (the plan is validated against the tool catalog too, but this is the last line). */
 export declare function bindGatewayToolInvoker(opts: {
     registry: GatewayToolRegistry;
     vault: Vault;
     principal: string;
+    authorizeStep: GatewayStepGate;
 }): ToolInvoker;
 /**
  * Run a T2 intent to completion over the co-resident tools. `planner` is injected (LLM adapter in prod, the
- * deterministic rule-based planner in tests). The loop is bounded (`maxSteps`); authority is NOT the loop's
- * concern — the tools run under the already-verified `principal` (ADR-0041). Returns the orchestration
+ * deterministic rule-based planner in tests). The loop is bounded (`maxSteps`). The loop itself decides no
+ * authority — `principal` is the VERIFIED verdict's principal and every step passes `authorizeStep`
+ * (ADR-0041; spec 445 §3.4). `tools` narrows the catalog the planner is shown (e.g. read tools only when
+ * the run carries no request id); the invoker's gate still stands behind it. Returns the orchestration
  * `RunResult` (outcome + observations + composed result) the DO records onto the exchange stream.
  */
 export declare function runGatewayOrchestration(intent: Intent, opts: {
@@ -22,6 +33,9 @@ export declare function runGatewayOrchestration(intent: Intent, opts: {
     registry: GatewayToolRegistry;
     vault: Vault;
     principal: string;
+    authorizeStep: GatewayStepGate;
+    /** The subset of the registry offered to the planner. Default: all of it. */
+    tools?: ToolSpec[];
     maxSteps?: number;
     maxReplans?: number;
 }): Promise<RunResult>;

package/dist/cloudflare/orchestration-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestration-runtime.d.ts","sourceRoot":"","sources":["../../src/cloudflare/orchestration-runtime.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAa,KAAK,MAAM,EAAE,KAAK,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACzI,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,QAAQ,EAAE,CAK1E;AAED;;wDAEwD;AACxD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAM5H;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACjI,OAAO,CAAC,SAAS,CAAC,CAQpB"}
+{"version":3,"file":"orchestration-runtime.d.ts","sourceRoot":"","sources":["../../src/cloudflare/orchestration-runtime.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAa,KAAK,MAAM,EAAE,KAAK,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACzI,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE3E,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,QAAQ,EAAE,CAK1E;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAElG;;oGAEoG;AACpG,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,eAAe,CAAC;CAChC,GAAG,WAAW,CAQd;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IACJ,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,eAAe,CAAC;IAC/B,6EAA6E;IAC7E,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,SAAS,CAAC,CAQpB"}

package/dist/cloudflare/orchestration-runtime.js

@@ -7,27 +7,32 @@ export function gatewayToolSpecs(registry) {
     }));
 }
 /** Bind the co-resident tool registry as an orchestration `ToolInvoker`: each planned step dispatches to a
- *  DO tool, run over `vault` under `principal`. Fail-closed on an unknown tool (the plan is validated against
- *  the tool catalog too, but this is the last line). */
+ *  DO tool, run over `vault` under `principal` — after `authorizeStep` has passed it. Fail-closed on an
+ *  unknown tool (the plan is validated against the tool catalog too, but this is the last line). */
 export function bindGatewayToolInvoker(opts) {
+    if (typeof opts.authorizeStep !== 'function')
+        throw new Error('orchestration: authorizeStep is required (no gate ⇒ no tools)');
     return async (toolId, args) => {
         const tool = opts.registry.get(toolId);
         if (!tool)
             throw new Error(`orchestration: unknown tool ${toolId}`);
+        await opts.authorizeStep(tool, args);
         return tool.run({ principal: opts.principal, vault: opts.vault, args });
     };
 }
 /**
  * Run a T2 intent to completion over the co-resident tools. `planner` is injected (LLM adapter in prod, the
- * deterministic rule-based planner in tests). The loop is bounded (`maxSteps`); authority is NOT the loop's
- * concern — the tools run under the already-verified `principal` (ADR-0041). Returns the orchestration
+ * deterministic rule-based planner in tests). The loop is bounded (`maxSteps`). The loop itself decides no
+ * authority — `principal` is the VERIFIED verdict's principal and every step passes `authorizeStep`
+ * (ADR-0041; spec 445 §3.4). `tools` narrows the catalog the planner is shown (e.g. read tools only when
+ * the run carries no request id); the invoker's gate still stands behind it. Returns the orchestration
  * `RunResult` (outcome + observations + composed result) the DO records onto the exchange stream.
  */
 export function runGatewayOrchestration(intent, opts) {
     return runIntent(intent, {
         planner: opts.planner,
-        tools: gatewayToolSpecs(opts.registry),
-        invoke: bindGatewayToolInvoker({ registry: opts.registry, vault: opts.vault, principal: opts.principal }),
+        tools: opts.tools ?? gatewayToolSpecs(opts.registry),
+        invoke: bindGatewayToolInvoker({ registry: opts.registry, vault: opts.vault, principal: opts.principal, authorizeStep: opts.authorizeStep }),
         maxSteps: opts.maxSteps,
         maxReplans: opts.maxReplans,
     });

package/dist/cloudflare/orchestration-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"orchestration-runtime.js","sourceRoot":"","sources":["../../src/cloudflare/orchestration-runtime.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAA8E,MAAM,kCAAkC,CAAC;AAGzI,iHAAiH;AACjH,MAAM,UAAU,gBAAgB,CAAC,QAA6B;IAC5D,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,EAAE,EAAE,CAAC,CAAC,IAAI;QACV,WAAW,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,2BAA2B,CAAC,CAAC,IAAI,GAAG;KAC3F,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;wDAEwD;AACxD,MAAM,UAAU,sBAAsB,CAAC,IAAwE;IAC7G,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,IAAkI;IAElI,OAAO,SAAS,CAAC,MAAM,EAAE;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtC,MAAM,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACzG,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"orchestration-runtime.js","sourceRoot":"","sources":["../../src/cloudflare/orchestration-runtime.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,SAAS,EAA8E,MAAM,kCAAkC,CAAC;AAGzI,iHAAiH;AACjH,MAAM,UAAU,gBAAgB,CAAC,QAA6B;IAC5D,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,EAAE,EAAE,CAAC,CAAC,IAAI;QACV,WAAW,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,2BAA2B,CAAC,CAAC,IAAI,GAAG;KAC3F,CAAC,CAAC,CAAC;AACN,CAAC;AAWD;;oGAEoG;AACpG,MAAM,UAAU,sBAAsB,CAAC,IAKtC;IACC,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAC/H,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,IAUC;IAED,OAAO,SAAS,CAAC,MAAM,EAAE;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpD,MAAM,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;QAC5I,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;AACL,CAAC"}