[droplister]

Summary

• preserve Counterparty public cache TTLs in the first-party compatibility gateway
• reject external browser origins and cap callers at 300 requests per minute
• keep mempool/no-store responses live while canonicalizing safe cache keys
• expose gateway HIT/MISS status and keep every request behind admission control

Evidence

• production traffic: at least 849,500 /node/v2 calls in the trailing 30 days
• focused gateway tests: 94 passed
• full repository suite: 1,484 passed across 117 files
• API typecheck and lint passed
• production probe: first blocks/last request MISS, following requests HIT; outside Origin returns 403

Deployed API Worker version: 73db5334-38b7-43e4-a28b-c99ae1be1e13