Summary

• add D1-backed, digest-only principal credential versions with scoped grants, expiry, revocation, rotation overlap, quotas, and optional site restrictions
• enforce durable credential decisions before the existing WORDPRESS_API_TOKENS compatibility adapter so known revoked or expired credentials fail closed
• record bounded, redacted audit evidence with coalesced denial writes and atomic registration/revocation evidence
• include credential repository and provisioning integration coverage in the standard Cloudflare runtime gate

Scope

This is the reusable enforcement slice of #2082. Credential issuer and delivery UX, administrator credential-root rotation, Homeboy deployment preflight, and production mutation remain separate caller/operator work.

Verification

• npm run build
• npm run test:cloudflare-principal-credentials (36 tests)
• npm run test:cloudflare-runtime
• npm run cloudflare:dry-run:d1 (23,331.81 KiB raw / 8,378.73 KiB gzip)
• npm run cloudflare:dry-run:public-reader (468.68 KiB raw / 115.52 KiB gzip)
• git diff --check

No production deployment or mutation was performed.

Refs #2082

AI assistance

OpenAI GPT-5.6 Terra and GPT-5.6 Sol via OpenCode drafted and hardened the durable credential repository, provisioning integration, and deterministic tests with Chris Huber.