@cat-factory/gatekeeper-worker 0.3.1

package/dist/policy/decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.js","sourceRoot":"","sources":["../../src/policy/decisions.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,8FAA8F;AAC9F,gGAAgG;AAChG,iGAAiG;AACjG,2BAA2B;AAC3B,EAAE;AACF,8FAA8F;AAC9F,kGAAkG;AAClG,4FAA4F;AAC5F,+FAA+F;AAC/F,gFAAgF;AAChF,EAAE;AACF,8BAA8B;AAC9B,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,kFAAkF;AAClF,gGAAgG;AAChG,kGAAkG;AAClG,8FAA8F;AAC9F,gFAAgF;AAIhF,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AA6E9C,gGAAgG;AAEhG,SAAS,MAAM,CAAC,KAAa,EAAE,QAAgB;IAC7C,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,sBAAsB,KAAK,MAAM,QAAQ,wCAAwC;QAC/E,wFAAwF;QACxF,gCAAgC,CACnC,CAAA;AACH,CAAC;AAED,mCAAmC;AACnC,SAAS,IAAI,CAAC,KAAmB,EAAE,KAAa,EAAE,QAAgB;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACnF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,KAAmB,EAAE,KAAa;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AAChF,CAAC;AAED,yCAAyC;AACzC,SAAS,MAAM,CAAC,KAAmB,EAAE,KAAa,EAAE,OAA0B;IAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,KAAK,EAAE,UAAU,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,2FAA2F;AAC3F,SAAS,IAAI,CAAC,KAAmB,EAAE,KAAa,EAAE,IAAY;IAC5D,OAAO,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,iBAAiB,IAAI,wBAAwB,CAAC,CAAA;AAC1E,CAAC;AAED,+FAA+F;AAC/F,SAAS,YAAY,CAAC,QAAsB,EAAE,KAAa;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,eAAe,QAAQ,CAAC,IAAI,0BAA0B,KAAK,kCAAkC;YAC3F,2FAA2F;YAC3F,mDAAmD,CACtD,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,8FAA8F;AAE9F,MAAM,qBAAqB,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAU,CAAA;AAE/E,MAAM,UAAU,GAA6B;IAC3C;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,qBAAqB;QAC9B,MAAM,EACJ,uFAAuF;YACvF,4FAA4F;YAC5F,kCAAkC;KACrC;CACF,CAAA;AAED,MAAM,eAAe,GAA6B;IAChD;QACE,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,qFAAqF;KAC9F;CACF,CAAA;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,OAAe,EAAE,OAAe;IAC/D,OAAO;QACL,MAAM;QACN,OAAO;QACP,OAAO;QACP,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1B,OAAO;YACP,IAAI,EAAE;gBACJ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACnB,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,qBAAqB,CAAC,EAAE;aACjE;SACF,CAAC;KACH,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,MAAM,CAAC,QAAsB;IACpC,OAAO,QAAQ,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AACzF,CAAC;AAED,qGAAqG;AACrG,SAAS,WAAW,CAAC,QAQpB;IACC,OAAO;QACL;YACE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,OAAO,EAAE,cAAc,QAAQ,CAAC,IAAI,2CAA2C;YAC/E,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,QAAQ,CAAC,IAAI,eAAe,EAAE;gBAC/E,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE;aACnE;YACD,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC1B,OAAO,EAAE,QAAQ,CAAC,KAAK;gBACvB,IAAI,EAAE;oBACJ,GAAG,MAAM,CAAC,QAAQ,CAAC;oBACnB,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC;oBAC5C,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,CAAC,EAAE;iBAC/D;aACF,CAAC;SACH;QACD;YACE,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,QAAQ,CAAC,SAAS;YAC3B,OAAO,EAAE,aAAa,QAAQ,CAAC,IAAI,yDAAyD;YAC5F,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,QAAQ,CAAC,IAAI,eAAe,EAAE;gBAC/E;oBACE,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC;oBAC9B,MAAM,EAAE,iBAAiB;iBAC1B;aACF;YACD,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC1B,OAAO,EAAE,QAAQ,CAAC,SAAS;gBAC3B,IAAI,EAAE;oBACJ,GAAG,MAAM,CAAC,QAAQ,CAAC;oBACnB,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC;oBAC5C,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,EAAE;iBACjE;aACF,CAAC;SACH;QACD;YACE,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,QAAQ,CAAC,WAAW;YAC7B,OAAO,EACL,2FAA2F;gBAC3F,iDAAiD;YACnD,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE;aACrF;YACD,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC1B,OAAO,EAAE,QAAQ,CAAC,WAAW;gBAC7B,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE;aACrE,CAAC;SACH;QACD;YACE,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,QAAQ,CAAC,QAAQ;YAC1B,OAAO,EAAE,8DAA8D;YACvE,MAAM,EAAE,EAAE;YACV,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;SAC7E;QACD;YACE,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,0DAA0D;YACnE,MAAM,EAAE,EAAE;YACV,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;SAC5E;QACD,OAAO,CACL,kBAAkB,EAClB,QAAQ,CAAC,eAAe,EACxB,oDAAoD,CACrD;KACF,CAAA;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAS,aAAa,CAAC,QAAsB;IAC3C,OAAO,QAAQ,CAAC,MAAM,KAAK,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAA;AACtE,CAAC;AAED,gGAAgG;AAEhG;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG;IAChB,eAAe,EAAE;QACf,OAAO,EAAE,kFAAkF;QAC3F,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS;QACpD,KAAK,EAAE;YACL;gBACE,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,wBAAwB;gBACjC,OAAO,EAAE,0EAA0E;gBACnF,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,UAAU;wBAChB,QAAQ,EAAE,KAAK;wBACf,MAAM,EACJ,oFAAoF;qBACvF;iBACF;gBACD,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC1B,OAAO,EAAE,wBAAwB;oBACjC,IAAI,EAAE;wBACJ,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC;wBAChD,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC;qBACtC;iBACF,CAAC;aACH;YACD;gBACE,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE,gCAAgC;gBACzC,OAAO,EAAE,4DAA4D;gBACrE,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,UAAU;wBAChB,QAAQ,EAAE,IAAI;wBACd,MAAM,EAAE,uEAAuE;qBAChF;iBACF;gBACD,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC1B,OAAO,EAAE,gCAAgC;oBACzC,IAAI,EAAE;wBACJ,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC;wBAChD,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,oCAAoC,CAAC,EAAE;qBAClF;iBACF,CAAC;aACH;YACD;gBACE,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,uBAAuB;gBAChC,OAAO,EAAE,iEAAiE;gBAC1E,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;gBACtF,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC1B,OAAO,EAAE,uBAAuB;oBAChC,IAAI,EAAE;wBACJ,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC;wBAChD,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC;qBACpC;iBACF,CAAC;aACH;YACD;gBACE,MAAM,EAAE,kBAAkB;gBAC1B,OAAO,EAAE,iCAAiC;gBAC1C,OAAO,EAAE,6DAA6D;gBACtE,MAAM,EAAE,UAAU;gBAClB,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC1B,OAAO,EAAE,iCAAiC;oBAC1C,IAAI,EAAE;wBACJ,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC;wBAChD,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,qBAAqB,CAAC,EAAE;qBACjE;iBACF,CAAC;aACH;SACF;KACF;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE,2EAA2E;QACpF,8FAA8F;QAC9F,gDAAgD;QAChD,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;QACnB,KAAK,EAAE;YACL;gBACE,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,iCAAiC;gBAC1C,OAAO,EAAE,yEAAyE;gBAClF,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,IAAI;wBACd,MAAM,EACJ,gFAAgF;4BAChF,0DAA0D;qBAC7D;iBACF;gBACD,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC1B,OAAO,EAAE,iCAAiC;oBAC1C,IAAI,EAAE;wBACJ,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC;wBAChD,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,kCAAkC,CAAC,EAAE;qBAC5E;iBACF,CAAC;aACH;SACF;KACF;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,iFAAiF;QAC1F,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,iBAAiB;QAC5D,KAAK,EAAE;YACL;gBACE,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,uBAAuB;gBAChC,OAAO,EAAE,+CAA+C;gBACxD,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,qDAAqD;qBAC9D;oBACD;wBACE,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,uDAAuD;qBAChE;oBACD,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE;iBAC/E;gBACD,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;oBACzB,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;oBAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;oBAC5C,IAAI,QAAQ,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,EAAE,CAAC;wBAC9C,MAAM,CACJ,QAAQ,EACR,0EAA0E,CAC3E,CAAA;oBACH,CAAC;oBACD,OAAO;wBACL,OAAO,EAAE,uBAAuB;wBAChC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE;qBACzE,CAAA;gBACH,CAAC;aACF;SACF;KACF;IACD,KAAK,EAAE;QACL,OAAO,EAAE,0EAA0E;QACnF,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,mBAAmB;QAC9D,KAAK,EAAE;YACL;gBACE,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,yBAAyB;gBAClC,OAAO,EAAE,mEAAmE;gBAC5E,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC;wBACtC,MAAM,EAAE,8BAA8B;qBACvC;oBACD,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE;iBACnF;gBACD,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC3B,OAAO,EAAE,yBAAyB;oBAClC,IAAI,EAAE;wBACJ,IAAI,EAAE;4BACJ,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;4BAC9D,GAAG,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC;yBACnC;qBACF;iBACF,CAAC;aACH;SACF;KACF;IACD,YAAY,EAAE;QACZ,OAAO,EACL,2FAA2F;QAC7F,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS;QACpD,KAAK,EAAE;YACL;gBACE,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,8BAA8B;gBACvC,OAAO,EACL,6FAA6F;gBAC/F,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;wBAC/B,MAAM,EAAE,+EAA+E;qBACxF;iBACF;gBACD,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC3B,OAAO,EAAE,8BAA8B;oBACvC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE;iBAC5E,CAAC;aACH;SACF;KACF;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE,sFAAsF;QAC/F,OAAO,EAAE,aAAa;QACtB,KAAK,EAAE,WAAW,CAAC;YACjB,KAAK,EAAE,4BAA4B;YACnC,SAAS,EAAE,8BAA8B;YACzC,WAAW,EAAE,uBAAuB;YACpC,QAAQ,EAAE,qBAAqB;YAC/B,OAAO,EAAE,mBAAmB;YAC5B,eAAe,EAAE,4BAA4B;YAC7C,IAAI,EAAE,SAAS;SAChB,CAAC;KACH;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE,gEAAgE;QACzE,OAAO,EAAE,aAAa;QACtB,KAAK,EAAE,WAAW,CAAC;YACjB,KAAK,EAAE,oCAAoC;YAC3C,SAAS,EAAE,sCAAsC;YACjD,WAAW,EAAE,+BAA+B;YAC5C,QAAQ,EAAE,6BAA6B;YACvC,OAAO,EAAE,2BAA2B;YACpC,eAAe,EAAE,oCAAoC;YACrD,IAAI,EAAE,SAAS;SAChB,CAAC;KACH;IACD,UAAU,EAAE;QACV,OAAO,EAAE,qFAAqF;QAC9F,OAAO,EAAE,aAAa;QACtB,KAAK,EAAE,WAAW,CAAC;YACjB,KAAK,EAAE,sCAAsC;YAC7C,SAAS,EAAE,wCAAwC;YACnD,WAAW,EAAE,kCAAkC;YAC/C,QAAQ,EAAE,gCAAgC;YAC1C,OAAO,EAAE,8BAA8B;YACvC,eAAe,EAAE,uCAAuC;YACxD,IAAI,EAAE,QAAQ;SACf,CAAC;KACH;IACD,WAAW,EAAE;QACX,OAAO,EACL,0FAA0F;QAC5F,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,oBAAoB;QAC/D,KAAK,EAAE;YACL;gBACE,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,6BAA6B;gBACtC,OAAO,EACL,uFAAuF;gBACzF,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,+EAA+E;qBACxF;oBACD;wBACE,IAAI,EAAE,YAAY;wBAClB,QAAQ,EAAE,KAAK;wBACf,MAAM,EACJ,2FAA2F;qBAC9F;iBACF;gBACD,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;oBACzB,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAA;oBAC5B,OAAO;wBACL,OAAO,EAAE,6BAA6B;wBACtC,IAAI,EAAE;4BACJ,IAAI,EAAE;gCACJ,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC;gCAChC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BACnD;yBACF;qBACF,CAAA;gBACH,CAAC;aACF;YACD;gBACE,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE,qCAAqC;gBAC9C,OAAO,EAAE,sCAAsC;gBAC/C,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;gBACnF,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC3B,OAAO,EAAE,qCAAqC;oBAC9C,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE;iBACzD,CAAC;aACH;YACD;gBACE,MAAM,EAAE,mBAAmB;gBAC3B,OAAO,EAAE,uCAAuC;gBAChD,OAAO,EAAE,gFAAgF;gBACzF,MAAM,EAAE;oBACN,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE;oBACzE;wBACE,IAAI,EAAE,UAAU;wBAChB,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,iDAAiD;qBAC1D;iBACF;gBACD,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC3B,OAAO,EAAE,uCAAuC;oBAChD,IAAI,EAAE;wBACJ,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC;wBAC9C,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC;qBACtC;iBACF,CAAC;aACH;SACF;KACF;IACD,YAAY,EAAE;QACZ,OAAO,EACL,uFAAuF;QACzF,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,gBAAgB;QAC1D,KAAK,EAAE;YACL;gBACE,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,8BAA8B;gBACvC,OAAO,EAAE,qCAAqC;gBAC9C,MAAM,EAAE,EAAE;gBACV,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;aACpE;YACD;gBACE,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,kCAAkC;gBAC3C,OAAO,EAAE,qDAAqD;gBAC9D,MAAM,EAAE,eAAe;gBACvB,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC3B,OAAO,EAAE,kCAAkC;oBAC3C,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,2BAA2B,CAAC,EAAE,EAAE;iBACnF,CAAC;aACH;SACF;KACF;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE,gFAAgF;QACzF,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,gBAAgB;QAC1D,KAAK,EAAE;YACL;gBACE,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,uCAAuC;gBAChD,OAAO,EAAE,0CAA0C;gBACnD,MAAM,EAAE,EAAE;gBACV,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;aAC7E;YACD;gBACE,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,2CAA2C;gBACpD,OAAO,EAAE,sDAAsD;gBAC/D,MAAM,EAAE,eAAe;gBACvB,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC3B,OAAO,EAAE,2CAA2C;oBACpD,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,2BAA2B,CAAC,EAAE,EAAE;iBACnF,CAAC;aACH;SACF;KACF;IACD,YAAY,EAAE;QACZ,OAAO,EAAE,mFAAmF;QAC5F,yFAAyF;QACzF,8FAA8F;QAC9F,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC7B,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAE,IAA6B,CAAC,MAAM,KAAK,SAAS,CAAC;QACpF,KAAK,EAAE;YACL;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,0BAA0B;gBACnC,OAAO,EAAE,+BAA+B;gBACxC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;gBAC7E,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC3B,OAAO,EAAE,0BAA0B;oBACnC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;iBAChD,CAAC;aACH;YACD;gBACE,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,+BAA+B;gBACxC,OAAO,EAAE,2EAA2E;gBACpF,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;gBAC7E,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC3B,OAAO,EAAE,+BAA+B;oBACxC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;iBAChD,CAAC;aACH;YACD;gBACE,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,4BAA4B;gBACrC,OAAO,EAAE,2BAA2B;gBACpC,MAAM,EAAE;oBACN,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE;oBACnE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,sCAAsC,EAAE;iBACnF;gBACD,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC3B,OAAO,EAAE,4BAA4B;oBACrC,IAAI,EAAE;wBACJ,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;wBACrC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,qCAAqC,CAAC,EAAE;qBAC/E;iBACF,CAAC;aACH;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,6BAA6B;gBACtC,OAAO,EAAE,+BAA+B;gBACxC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;gBAC7E,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC3B,OAAO,EAAE,6BAA6B;oBACtC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;iBAChD,CAAC;aACH;SACF;KACF;IACD,SAAS,EAAE;QACT,OAAO,EACL,6FAA6F;QAC/F,yFAAyF;QACzF,mFAAmF;QACnF,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;QACnB,KAAK,EAAE;YACL;gBACE,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,qCAAqC;gBAC9C,OAAO,EAAE,oEAAoE;gBAC7E,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,YAAY;wBAClB,QAAQ,EAAE,IAAI;wBACd,MAAM,EACJ,iFAAiF;qBACpF;oBACD,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE;iBACtF;gBACD,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC3B,OAAO,EAAE,qCAAqC;oBAC9C,IAAI,EAAE;wBACJ,IAAI,EAAE;4BACJ,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC;4BACjD,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;yBAC7D;qBACF;iBACF,CAAC;aACH;YACD;gBACE,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,8BAA8B;gBACvC,OAAO,EAAE,4DAA4D;gBACrE,MAAM,EAAE,EAAE;gBACV,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;aACpE;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,6BAA6B;gBACtC,OAAO,EAAE,iDAAiD;gBAC1D,MAAM,EAAE,EAAE;gBACV,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;aACnE;SACF;KACF;CACqD,CAAA;AAExD,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAQ,SAA0D,CAAC,IAAI,CAAC,CAAA;AAC1E,CAAC;AAED,0CAA0C;AAC1C,MAAM,CAAC,MAAM,yBAAyB,GAAkC,MAAM,CAAC,IAAI,CACjF,SAAS,CACc,CAAA;AAEzB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,gBAAgB;IAChB,GAAG,IAAI,GAAG,CACR,MAAM,CAAC,MAAM,CAAC,SAA6C,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAChF,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAC3C,CACF;CACF,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAmB,QAAQ,CAAA"}

package/dist/policy/index.d.ts

@@ -0,0 +1,6 @@
+export { compilePolicy, describeBinding, tierForActor, type CompiledPolicy, type CompiledTier, type GatekeeperPolicy, type TierPolicy, type WithheldBinding, type WithheldReason, } from './compile.js';
+export { ANSWERABLE_DECISION_KINDS, answererFor, DECISION_BINDINGS, DECISION_KEY_SCOPE, type DecisionAnswerer, type DecisionCall, type DecisionField, type DecisionVerb, type LiveDecision, type ParkedDecisionKind, } from './decisions.js';
+export { GatekeeperError, PolicyError, type GatekeeperReason } from '../errors.js';
+export { applyMask, MASKED } from '../masking.js';
+export type { GatekeeperBinding, PublicApiScope } from '@cat-factory/gatekeeper-bindings';
+//# sourceMappingURL=index.d.ts.map

package/dist/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,aAAa,EACb,eAAe,EACf,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,yBAAyB,EACzB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAA;AAIvB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAKjD,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA"}

package/dist/policy/index.js

@@ -0,0 +1,17 @@
+// The POLICY surface: everything a deployment needs to WRITE its policy, and nothing that needs a
+// Worker runtime to import.
+//
+// It is a separate entry point (`@cat-factory/gatekeeper-worker/policy`) for one reason: the
+// package's main entry reaches `cloudflare:workers` for the Durable Object, so a policy file that
+// imported through it could only be loaded inside workerd. A policy is the one thing an operator
+// authors, reviews and tests, and none of those should need a Worker isolate to run.
+//
+// Everything here is re-exported from the main entry too, so a deployment that does not care can
+// import from one place.
+export { compilePolicy, describeBinding, tierForActor, } from './compile.js';
+export { ANSWERABLE_DECISION_KINDS, answererFor, DECISION_BINDINGS, DECISION_KEY_SCOPE, } from './decisions.js';
+// A policy is refused by a `PolicyError` and MASKED paths are the other half of a tier, so both
+// belong to the vocabulary a policy file and its tests speak.
+export { GatekeeperError, PolicyError } from '../errors.js';
+export { applyMask, MASKED } from '../masking.js';
+//# sourceMappingURL=index.js.map

package/dist/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,4BAA4B;AAC5B,EAAE;AACF,6FAA6F;AAC7F,kGAAkG;AAClG,iGAAiG;AACjG,qFAAqF;AACrF,EAAE;AACF,iGAAiG;AACjG,yBAAyB;AAEzB,OAAO,EACL,aAAa,EACb,eAAe,EACf,YAAY,GAOb,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,yBAAyB,EACzB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,GAOnB,MAAM,gBAAgB,CAAA;AAEvB,gGAAgG;AAChG,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAyB,MAAM,cAAc,CAAA;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA"}

package/dist/state.d.ts

@@ -0,0 +1,150 @@
+import { DurableObject } from 'cloudflare:workers';
+/** A parked cat-factory decision, as the OS shows it. */
+export interface ApprovalCard {
+    /** The delivery that raised it. Also the id the OS answers on. */
+    cardId: string;
+    runId: string;
+    taskId: string | null;
+    /** The notification type the platform raised (`merge_review`, `requirement_review`, …). */
+    type: string;
+    /**
+     * Whether this card can be ANSWERED from here, or only reported.
+     *
+     * Stamped at delivery time from the type, so an inbox can render the difference without asking
+     * this Gatekeeper anything else. A `notice` is not a lesser card: it is a run waiting on a
+     * person in the cat-factory app, and saying so is the whole point of separating it from a card
+     * whose first answer attempt would otherwise come back `stale`.
+     */
+    disposition: 'decision' | 'notice';
+    title: string;
+    body: string;
+    raisedAt: number;
+    /** Epoch ms when this Gatekeeper settled it, or null while it is open. */
+    resolvedAt: number | null;
+    /** What settled it: an action name, or `superseded` when the platform resolved the card. */
+    resolution: string | null;
+}
+/** The last lifecycle transition a delivery reported for one run. */
+export interface RunState {
+    runId: string;
+    /** `run.started` / `run.completed` / `run.failed`, as the platform spells it. */
+    event: string;
+    /** Whether the run has reached a terminal event. */
+    terminal: boolean;
+    /** The run projection the delivery carried, verbatim. */
+    run: Record<string, unknown>;
+    updatedAt: number;
+}
+/** A minted per-actor key, as it is held here. */
+export interface StoredKey {
+    keyId: string;
+    secret: string;
+    mintedAt: number;
+}
+/**
+ * A claim on the right to mint one actor+scope key.
+ *
+ * `POST /api/v1/keys` is a real, non-idempotent side effect that returns its secret exactly once,
+ * so two pipelined calls that both read "no key yet" would both mint and the loser's credential
+ * would stay live upstream with nothing here recording that it exists. The claim is taken BEFORE
+ * the mint, atomically, and it EXPIRES so a Worker that dies mid-mint does not wedge the actor
+ * out of the Gatekeeper forever.
+ */
+export interface MintClaim {
+    claimedAt: number;
+}
+/** What `claimKeyMint` answers: the key that already exists, or permission to make one. */
+export type MintTicket = {
+    outcome: 'existing';
+    key: StoredKey;
+} | {
+    outcome: 'claimed';
+} | {
+    outcome: 'in_flight';
+    retryAfterMs: number;
+};
+/** What one delivery asks this object to do, decided in the Worker from the delivery's shape. */
+export type DeliveryEffect = {
+    kind: 'open';
+    card: ApprovalCard;
+} | {
+    kind: 'supersede';
+    cardId: string;
+} | {
+    kind: 'run-event';
+    state: Omit<RunState, 'updatedAt'>;
+} | {
+    kind: 'none';
+};
+/** What taking one delivery did to durable state. */
+export type DeliveryApplication = {
+    applied: false;
+    reason: 'duplicate';
+} | {
+    applied: true;
+    effect: 'opened' | 'superseded' | 'run-event' | 'none';
+};
+export declare class GatekeeperState extends DurableObject {
+    #private;
+    /**
+     * Take one delivery: dedupe and act, as ONE durable write.
+     *
+     * The marker and the effect land in a single `put`, so there is no window in which the platform
+     * would see a duplicate for work that never happened. A delivery whose effect is `none` still
+     * records the marker: an unrecognised family is a message this Gatekeeper HAS handled, and
+     * re-deriving that on every replay would spend the platform's retry budget on it.
+     */
+    applyDelivery(deliveryId: string, effect: DeliveryEffect, now: number): Promise<DeliveryApplication>;
+    /** Settle a card this Gatekeeper answered. A card already settled keeps its first resolution. */
+    resolveCard(cardId: string, resolution: string, now: number): Promise<ApprovalCard | null>;
+    getCard(cardId: string): Promise<ApprovalCard | null>;
+    /** Every card, newest first. Resolved ones are included: the OS decides what it renders. */
+    listCards(): Promise<ApprovalCard[]>;
+    /** The latest lifecycle state of every run a delivery has mentioned, newest first. */
+    listRunStates(): Promise<RunState[]>;
+    /**
+     * Either the actor's existing key, or an exclusive claim on minting one.
+     *
+     * Read-and-claim in one turn, which is the whole point: the alternative (read here, mint in the
+     * Worker, write back) is a race two pipelined calls lose in the direction that leaks a live
+     * credential. `in_flight` is a real third answer rather than a wait, because a Durable Object
+     * that blocked on a peer's outbound HTTP call would serialise every actor behind the slowest.
+     */
+    claimKeyMint(actorId: string, scope: string, now: number): Promise<MintTicket>;
+    /**
+     * Record the key a claim produced, releasing the claim in the same turn.
+     *
+     * Both operations are ISSUED before either is awaited, so Durable Object storage commits them
+     * together: a crash cannot leave the key stored with the claim still held (which would cost the
+     * next caller the TTL for nothing) or the claim released with the key unstored (which would let
+     * a second caller mint a duplicate).
+     */
+    commitKeyMint(actorId: string, scope: string, key: StoredKey): Promise<void>;
+    /** Release a claim whose mint failed, so the next caller may take it without waiting out the TTL. */
+    releaseKeyMint(actorId: string, scope: string): Promise<void>;
+    /**
+     * Drop one stored key, so the next call mints a fresh one.
+     *
+     * Takes the key ID the caller was USING and drops the row only if it still holds that key. Two
+     * concurrent calls can both meet a 401 on the same stale secret, and a blind delete would have
+     * the second one throw away the replacement the first had just minted, which reads to a caller
+     * as a Gatekeeper that mints a key per call.
+     */
+    forgetKeyIfCurrent(actorId: string, scope: string, keyId: string): Promise<boolean>;
+    /** Every key minted for an actor, whatever scope it was minted at. */
+    listKeys(actorId: string): Promise<{
+        scope: string;
+        key: StoredKey;
+    }[]>;
+    /**
+     * Forget the NAMED keys, and only those.
+     *
+     * Named rather than "all this actor's", which is what it used to do: the caller revokes upstream
+     * first and then forgets, so forgetting a key it had not revoked would leave a live cat-factory
+     * credential with no record here that it exists. That is precisely the leak the revoke order
+     * exists to prevent, arriving through the other half of the pair.
+     */
+    forgetKeys(actorId: string, scopes: readonly string[]): Promise<void>;
+    alarm(): Promise<void>;
+}
+//# sourceMappingURL=state.d.ts.map

package/dist/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;;OAOG;IACH,WAAW,EAAE,UAAU,GAAG,QAAQ,CAAA;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,4FAA4F;IAC5F,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAA;IACb,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;IACjB,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,kDAAkD;AAClD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,2FAA2F;AAC3F,MAAM,MAAM,UAAU,GAClB;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GACvC;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,GACtB;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAA;AAElD,iGAAiG;AACjG,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpB,qDAAqD;AACrD,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACvC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,CAAA;CAAE,CAAA;AAkC7E,qBAAa,eAAgB,SAAQ,aAAa;;IAChD;;;;;;;OAOG;IACG,aAAa,CACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,mBAAmB,CAAC,CA+B9B;IAED,iGAAiG;IAC3F,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAO/F;IAEK,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAE1D;IAED,4FAA4F;IACtF,SAAS,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAGzC;IAED,sFAAsF;IAChF,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAGzC;IAED;;;;;;;OAOG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAYnF;IAED;;;;;;;OAOG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAIjF;IAED,qGAAqG;IAC/F,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;IAED;;;;;;;OAOG;IACG,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMxF;IAED,sEAAsE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,SAAS,CAAA;KAAE,EAAE,CAAC,CAM5E;IAED;;;;;;;OAOG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1E;IAEc,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAepC;CA2BF"}

package/dist/state.js

@@ -0,0 +1,229 @@
+// The Gatekeeper's durable state: one object per paired workspace, holding the four things a
+// stateless Worker cannot.
+//
+//   1. WHICH DELIVERIES HAVE BEEN SEEN. The platform's terminal run events are at-least-once and
+//      a replay re-stamps `sentAt`, so two deliveries of one transition are not byte-identical
+//      and only `deliveryId` collapses them. Dedupe has to be durable, and it has to be shared
+//      across isolates, which is what makes it a Durable Object rather than a per-isolate Map.
+//   2. THE OPEN APPROVAL CARDS. A parked run waits indefinitely, so the card outlives every
+//      invocation that could have held it in memory.
+//   3. THE LATEST LIFECYCLE STATE OF EACH RUN a delivery has mentioned, so a status Gadget reads
+//      what happened without polling, and a card whose run has ended stops standing in an inbox
+//      demanding an answer nobody can give.
+//   4. THE MINTED PER-ACTOR KEYS. `POST /api/v1/keys` returns a raw secret EXACTLY ONCE; a
+//      Gatekeeper that forgets it has minted one mints another on the next call and leaves a
+//      trail of live credentials nobody revokes.
+//
+// The dedupe marker and the effect it guards are written TOGETHER, in one multi-key `put`, which
+// is the reason `applyDelivery` lives here rather than being composed from two calls in the
+// Worker. Durable Object storage commits the writes of one turn atomically, and only that makes
+// the pair safe: committing the marker first turns a failed card write into a `duplicate` on the
+// platform's retry, so the approval never reaches the inbox and nothing reports that it did not.
+//
+// Custody note, because it is the reason this design is defensible at all: the provisioning key
+// is a Worker SECRET and never leaves the platform's secret store, while the per-actor keys it
+// mints live here, in this object's storage. Both are outside every agent's reach; what an agent
+// holds is a capability whose methods are the ones policy granted. Storage is the narrowest place
+// a minted secret can live and still be reusable, but it IS at rest in your account: if that is
+// not acceptable for your deployment, mint per call and revoke after, at the cost of a key row
+// per operation.
+import { DurableObject } from 'cloudflare:workers';
+const DELIVERY_PREFIX = 'delivery:';
+const CARD_PREFIX = 'card:';
+const KEY_PREFIX = 'key:';
+const CLAIM_PREFIX = 'mint:';
+const RUN_PREFIX = 'run:';
+/**
+ * How long a `deliveryId` is remembered for dedupe purposes.
+ *
+ * Long enough to cover a durable replay (the platform re-drives a settled run from a sweeper, not
+ * from a queue that gives up in minutes) and short enough that the object does not accumulate one
+ * row per event forever. Cards are NOT pruned on this schedule: an open card is live state, and a
+ * resolved one is the record of an answer this Gatekeeper gave.
+ */
+const DELIVERY_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
+/** How long the record of a finished run is kept for a status Gadget to read. */
+const RUN_STATE_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
+/**
+ * How long a mint claim holds before another caller may take it.
+ *
+ * Sized against the one call it covers (`POST /api/v1/keys` behind the SDK's own retries), not
+ * against a request budget: shorter and two callers mint anyway, which is the leak; longer and a
+ * Worker that died mid-mint locks the actor out for that long. A caller that meets a live claim
+ * is told to retry rather than served a key, because serving one would mean minting a second.
+ */
+const MINT_CLAIM_TTL_MS = 30_000;
+/** How often the prune alarm runs. */
+const PRUNE_INTERVAL_MS = 24 * 60 * 60 * 1000;
+export class GatekeeperState extends DurableObject {
+    /**
+     * Take one delivery: dedupe and act, as ONE durable write.
+     *
+     * The marker and the effect land in a single `put`, so there is no window in which the platform
+     * would see a duplicate for work that never happened. A delivery whose effect is `none` still
+     * records the marker: an unrecognised family is a message this Gatekeeper HAS handled, and
+     * re-deriving that on every replay would spend the platform's retry budget on it.
+     */
+    async applyDelivery(deliveryId, effect, now) {
+        const marker = `${DELIVERY_PREFIX}${deliveryId}`;
+        if ((await this.ctx.storage.get(marker)) !== undefined) {
+            return { applied: false, reason: 'duplicate' };
+        }
+        const writes = { [marker]: now };
+        if (effect.kind === 'open') {
+            writes[`${CARD_PREFIX}${effect.card.cardId}`] = effect.card;
+        }
+        else if (effect.kind === 'supersede') {
+            const key = `${CARD_PREFIX}${effect.cardId}`;
+            const card = await this.ctx.storage.get(key);
+            if (card !== undefined && card.resolvedAt === null) {
+                writes[key] = { ...card, resolvedAt: now, resolution: 'superseded' };
+            }
+        }
+        else if (effect.kind === 'run-event') {
+            writes[`${RUN_PREFIX}${effect.state.runId}`] = { ...effect.state, updatedAt: now };
+            // A run that ended answers nothing more, so its open cards stop asking. Doing it here rather
+            // than lazily at read time is what keeps the inbox honest for an OS that renders the list
+            // without asking this Gatekeeper anything else.
+            if (effect.state.terminal) {
+                for (const [key, card] of await this.#openCardsFor(effect.state.runId)) {
+                    writes[key] = { ...card, resolvedAt: now, resolution: `run_${effect.state.event}` };
+                }
+            }
+        }
+        await this.ctx.storage.put(writes);
+        await this.#ensureAlarm(now);
+        return { applied: true, effect: effect.kind === 'none' ? 'none' : effectName(effect.kind) };
+    }
+    /** Settle a card this Gatekeeper answered. A card already settled keeps its first resolution. */
+    async resolveCard(cardId, resolution, now) {
+        const key = `${CARD_PREFIX}${cardId}`;
+        const card = await this.ctx.storage.get(key);
+        if (card === undefined || card.resolvedAt !== null)
+            return card ?? null;
+        const resolved = { ...card, resolvedAt: now, resolution };
+        await this.ctx.storage.put(key, resolved);
+        return resolved;
+    }
+    async getCard(cardId) {
+        return (await this.ctx.storage.get(`${CARD_PREFIX}${cardId}`)) ?? null;
+    }
+    /** Every card, newest first. Resolved ones are included: the OS decides what it renders. */
+    async listCards() {
+        const rows = await this.ctx.storage.list({ prefix: CARD_PREFIX });
+        return [...rows.values()].sort((a, b) => b.raisedAt - a.raisedAt);
+    }
+    /** The latest lifecycle state of every run a delivery has mentioned, newest first. */
+    async listRunStates() {
+        const rows = await this.ctx.storage.list({ prefix: RUN_PREFIX });
+        return [...rows.values()].sort((a, b) => b.updatedAt - a.updatedAt);
+    }
+    /**
+     * Either the actor's existing key, or an exclusive claim on minting one.
+     *
+     * Read-and-claim in one turn, which is the whole point: the alternative (read here, mint in the
+     * Worker, write back) is a race two pipelined calls lose in the direction that leaks a live
+     * credential. `in_flight` is a real third answer rather than a wait, because a Durable Object
+     * that blocked on a peer's outbound HTTP call would serialise every actor behind the slowest.
+     */
+    async claimKeyMint(actorId, scope, now) {
+        const existing = await this.ctx.storage.get(keyRow(actorId, scope));
+        if (existing !== undefined)
+            return { outcome: 'existing', key: existing };
+        const claimKey = `${CLAIM_PREFIX}${actorId}:${scope}`;
+        const claim = await this.ctx.storage.get(claimKey);
+        if (claim !== undefined && now - claim.claimedAt < MINT_CLAIM_TTL_MS) {
+            return { outcome: 'in_flight', retryAfterMs: MINT_CLAIM_TTL_MS - (now - claim.claimedAt) };
+        }
+        await this.ctx.storage.put(claimKey, { claimedAt: now });
+        return { outcome: 'claimed' };
+    }
+    /**
+     * Record the key a claim produced, releasing the claim in the same turn.
+     *
+     * Both operations are ISSUED before either is awaited, so Durable Object storage commits them
+     * together: a crash cannot leave the key stored with the claim still held (which would cost the
+     * next caller the TTL for nothing) or the claim released with the key unstored (which would let
+     * a second caller mint a duplicate).
+     */
+    async commitKeyMint(actorId, scope, key) {
+        const stored = this.ctx.storage.put(keyRow(actorId, scope), key);
+        const released = this.ctx.storage.delete(`${CLAIM_PREFIX}${actorId}:${scope}`);
+        await Promise.all([stored, released]);
+    }
+    /** Release a claim whose mint failed, so the next caller may take it without waiting out the TTL. */
+    async releaseKeyMint(actorId, scope) {
+        await this.ctx.storage.delete(`${CLAIM_PREFIX}${actorId}:${scope}`);
+    }
+    /**
+     * Drop one stored key, so the next call mints a fresh one.
+     *
+     * Takes the key ID the caller was USING and drops the row only if it still holds that key. Two
+     * concurrent calls can both meet a 401 on the same stale secret, and a blind delete would have
+     * the second one throw away the replacement the first had just minted, which reads to a caller
+     * as a Gatekeeper that mints a key per call.
+     */
+    async forgetKeyIfCurrent(actorId, scope, keyId) {
+        const row = keyRow(actorId, scope);
+        const stored = await this.ctx.storage.get(row);
+        if (stored === undefined || stored.keyId !== keyId)
+            return false;
+        await this.ctx.storage.delete(row);
+        return true;
+    }
+    /** Every key minted for an actor, whatever scope it was minted at. */
+    async listKeys(actorId) {
+        const rows = await this.ctx.storage.list({ prefix: `${KEY_PREFIX}${actorId}:` });
+        return [...rows.entries()].map(([row, key]) => ({
+            scope: row.slice(`${KEY_PREFIX}${actorId}:`.length),
+            key,
+        }));
+    }
+    /**
+     * Forget the NAMED keys, and only those.
+     *
+     * Named rather than "all this actor's", which is what it used to do: the caller revokes upstream
+     * first and then forgets, so forgetting a key it had not revoked would leave a live cat-factory
+     * credential with no record here that it exists. That is precisely the leak the revoke order
+     * exists to prevent, arriving through the other half of the pair.
+     */
+    async forgetKeys(actorId, scopes) {
+        if (scopes.length === 0)
+            return;
+        await this.ctx.storage.delete(scopes.map((scope) => keyRow(actorId, scope)));
+    }
+    async alarm() {
+        const now = Date.now();
+        await this.#pruneOlderThan(DELIVERY_PREFIX, DELIVERY_RETENTION_MS, now, (seenAt) => seenAt);
+        await this.#pruneOlderThan(RUN_PREFIX, RUN_STATE_RETENTION_MS, now, (state) => state.updatedAt);
+        await this.ctx.storage.setAlarm(now + PRUNE_INTERVAL_MS);
+    }
+    async #openCardsFor(runId) {
+        const rows = await this.ctx.storage.list({ prefix: CARD_PREFIX });
+        return [...rows.entries()].filter(([, card]) => card.runId === runId && card.resolvedAt === null);
+    }
+    async #ensureAlarm(now) {
+        if ((await this.ctx.storage.getAlarm()) === null) {
+            await this.ctx.storage.setAlarm(now + PRUNE_INTERVAL_MS);
+        }
+    }
+    async #pruneOlderThan(prefix, retentionMs, now, stampOf) {
+        const rows = await this.ctx.storage.list({ prefix });
+        const stale = [...rows.entries()]
+            .filter(([, value]) => now - stampOf(value) > retentionMs)
+            .map(([key]) => key);
+        if (stale.length > 0)
+            await this.ctx.storage.delete(stale);
+    }
+}
+function effectName(kind) {
+    if (kind === 'open')
+        return 'opened';
+    if (kind === 'supersede')
+        return 'superseded';
+    return 'run-event';
+}
+function keyRow(actorId, scope) {
+    return `${KEY_PREFIX}${actorId}:${scope}`;
+}
+//# sourceMappingURL=state.js.map

package/dist/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,2BAA2B;AAC3B,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,+FAA+F;AAC/F,+FAA+F;AAC/F,4FAA4F;AAC5F,qDAAqD;AACrD,iGAAiG;AACjG,gGAAgG;AAChG,4CAA4C;AAC5C,2FAA2F;AAC3F,6FAA6F;AAC7F,iDAAiD;AACjD,EAAE;AACF,iGAAiG;AACjG,4FAA4F;AAC5F,gGAAgG;AAChG,iGAAiG;AACjG,iGAAiG;AACjG,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,iGAAiG;AACjG,kGAAkG;AAClG,gGAAgG;AAChG,+FAA+F;AAC/F,iBAAiB;AAEjB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AA8ElD,MAAM,eAAe,GAAG,WAAW,CAAA;AACnC,MAAM,WAAW,GAAG,OAAO,CAAA;AAC3B,MAAM,UAAU,GAAG,MAAM,CAAA;AACzB,MAAM,YAAY,GAAG,OAAO,CAAA;AAC5B,MAAM,UAAU,GAAG,MAAM,CAAA;AAEzB;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEtD,iFAAiF;AACjF,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEvD;;;;;;;GAOG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAEhC,sCAAsC;AACtC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE7C,MAAM,OAAO,eAAgB,SAAQ,aAAa;IAChD;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,UAAkB,EAClB,MAAsB,EACtB,GAAW;QAEX,MAAM,MAAM,GAAG,GAAG,eAAe,GAAG,UAAU,EAAE,CAAA;QAChD,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAS,MAAM,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;QAChD,CAAC;QAED,MAAM,MAAM,GAA4B,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAA;QAEzD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAA;QAC7D,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,GAAG,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,CAAA;YAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAe,GAAG,CAAC,CAAA;YAC1D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACnD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,CAAA;YACtE,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;YAClF,6FAA6F;YAC7F,0FAA0F;YAC1F,gDAAgD;YAChD,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAClC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;QAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAA;IAC7F,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,UAAkB,EAAE,GAAW;QAC/D,MAAM,GAAG,GAAG,GAAG,WAAW,GAAG,MAAM,EAAE,CAAA;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAe,GAAG,CAAC,CAAA;QAC1D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,IAAI,IAAI,CAAA;QACvE,MAAM,QAAQ,GAAiB,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAA;QACvE,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACzC,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAe,GAAG,WAAW,GAAG,MAAM,EAAE,CAAC,CAAC,IAAI,IAAI,CAAA;IACtF,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAe,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;QAC/E,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IACnE,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;QAC1E,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAA;IACrE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,KAAa,EAAE,GAAW;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAY,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;QAC9E,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAA;QAEzE,MAAM,QAAQ,GAAG,GAAG,YAAY,GAAG,OAAO,IAAI,KAAK,EAAE,CAAA;QACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAY,QAAQ,CAAC,CAAA;QAC7D,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,iBAAiB,EAAE,CAAC;YACrE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,CAAA;QAC5F,CAAC;QAED,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,GAAG,EAAsB,CAAC,CAAA;QAC5E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,KAAa,EAAE,GAAc;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,CAAA;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC,CAAA;QAC9E,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,KAAa;QACjD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC,CAAA;IACrE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAAE,KAAa,EAAE,KAAa;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAY,GAAG,CAAC,CAAA;QACzD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,KAAK,CAAA;QAChE,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAClC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAY,EAAE,MAAM,EAAE,GAAG,UAAU,GAAG,OAAO,GAAG,EAAE,CAAC,CAAA;QAC3F,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9C,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,UAAU,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC;YACnD,GAAG;SACJ,CAAC,CAAC,CAAA;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,MAAyB;QACzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAC/B,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;IAC9E,CAAC;IAEQ,KAAK,CAAC,KAAK;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,IAAI,CAAC,eAAe,CACxB,eAAe,EACf,qBAAqB,EACrB,GAAG,EACH,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CACnB,CAAA;QACD,MAAM,IAAI,CAAC,eAAe,CACxB,UAAU,EACV,sBAAsB,EACtB,GAAG,EACH,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAC3B,CAAA;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,iBAAiB,CAAC,CAAA;IAC1D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAe,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;QAC/E,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAC/D,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,GAAG,iBAAiB,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,WAAmB,EACnB,GAAW,EACX,OAA6B;QAE7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QACvD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;aAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC;aACzD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;QACtB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5D,CAAC;CACF;AAED,SAAS,UAAU,CACjB,IAAwC;IAExC,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAA;IACpC,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,YAAY,CAAA;IAC7C,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,KAAa;IAC5C,OAAO,GAAG,UAAU,GAAG,OAAO,IAAI,KAAK,EAAE,CAAA;AAC3C,CAAC"}

package/dist/webhook/delivery.d.ts

@@ -0,0 +1,102 @@
+import type { NotificationType } from '@cat-factory/sdk';
+import type { DeliveryEffect } from '../state.js';
+/** One delivery, classified. `unrecognised` is a real outcome, not an error. */
+export type Delivery = {
+    family: 'notification';
+    deliveryId: string;
+    sentAt: number;
+    runId: string | null;
+    taskId: string | null;
+    notification: DeliveredNotification;
+} | {
+    family: 'run';
+    deliveryId: string;
+    sentAt: number;
+    event: string;
+    run: Record<string, unknown>;
+} | {
+    family: 'alert';
+    deliveryId: string;
+    sentAt: number;
+    event: string;
+    alert: Record<string, unknown>;
+} | {
+    family: 'unrecognised';
+    deliveryId: string;
+    sentAt: number;
+};
+/** The card fields this Gatekeeper reads. Everything else on the card stays on the platform. */
+interface DeliveredNotification {
+    id: string;
+    type: string;
+    status: string;
+    title: string;
+    body: string;
+}
+/**
+ * What raising a card of a given type actually offers the person who opens it.
+ *
+ * The distinction is load-bearing and it used to be missing. Every subscribed type raised a card
+ * that looked answerable, but `merge_review` is settled by an actual MERGE (`notifications_act`),
+ * which this Gatekeeper deliberately does not grant to any tier: the merge policy wants a person
+ * the platform can name (ADR 0037/0039). Presenting that as an answerable approval is the reverse
+ * of the error the type list was written to prevent (a card nobody can answer), and it arrived
+ * anyway, as a card that reported `stale` on the first attempt.
+ *
+ *  - `decision`: the run parks on a `/runs/:runId/decisions` entry, which `approvals_answer`
+ *    settles through the caller's own granted bindings.
+ *  - `notice`: the run is waiting on something no `/api/v1` verb this Gatekeeper holds can do.
+ *    The card is worth raising (somebody has to know) and is worth saying so on.
+ */
+export type CardDisposition = 'decision' | 'notice';
+/**
+ * The card types that mean "a run is parked and a person has to answer", with what answering one
+ * would take.
+ *
+ * Deliberately a SMALL map rather than "anything with a runId": `pipeline_complete` and
+ * `ci_failed` also carry one and are reports, not questions. Raising an approval card for a report
+ * trains people to dismiss cards, which is how a real one gets missed. A deployment that registers
+ * its own gate and wants its card here adds the type; that is an edit to this constant, in review,
+ * rather than a behaviour that widens on its own.
+ *
+ * It is keyed by the SDK's own `NotificationType`, so a type this deployment retires fails the
+ * build here rather than becoming a card that silently stops arriving. Its keys are also the list
+ * `enroll()` SUBSCRIBES to, so what a Gatekeeper asks for and what it can act on are one value.
+ */
+export declare const PARKED_DECISION_CARD_TYPES: Readonly<Partial<Record<NotificationType, CardDisposition>>>;
+/** Every type this Gatekeeper subscribes to, answerable or not. */
+export declare const SUBSCRIBED_CARD_TYPES: readonly NotificationType[];
+/**
+ * How a delivered card type is dispositioned, or `null` for one this Gatekeeper raises nothing for.
+ *
+ * Takes a plain `string` because the wire vocabulary grows additively: a deployment one release
+ * ahead of this package delivers a type the SDK's union has never heard of, and narrowing the
+ * ARGUMENT would make that a type error at the one place that must instead answer "no, not one of
+ * mine" and pass the delivery through.
+ */
+export declare function dispositionOf(type: string): CardDisposition | null;
+/**
+ * Classify a parsed delivery body.
+ *
+ * Returns `null` only when the envelope itself is unusable (no `deliveryId`), which is the one
+ * case where nothing can be done with it at all: the id is what dedupe keys on, so a delivery
+ * without one cannot be admitted safely even as unrecognised.
+ */
+export declare function readDelivery(body: unknown): Delivery | null;
+/**
+ * Decide what a delivery asks durable state to do.
+ *
+ * A card is keyed on the NOTIFICATION id rather than the delivery id, because the platform
+ * re-delivers the same card as it resolves (`ntf_123-open` then `ntf_123-acted`) and those two
+ * deliveries are one question with an answer, not two questions. Dedupe still runs on the delivery
+ * id upstream of this: the two ids do different jobs and collapsing them would either drop the
+ * resolution or re-raise the card.
+ *
+ * A `run` delivery lands as a lifecycle record rather than nothing. That leg is why the
+ * subscription asks for all three run events: a status Gadget reads `runs_watched()` instead of
+ * polling, and a terminal event settles the run's open cards, so an inbox never holds a question
+ * about a run that has ended.
+ */
+export declare function cardEffectOf(delivery: Delivery): DeliveryEffect;
+export {};
+//# sourceMappingURL=delivery.d.ts.map

package/dist/webhook/delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.d.ts","sourceRoot":"","sources":["../../src/webhook/delivery.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,KAAK,EAAgB,cAAc,EAAE,MAAM,aAAa,CAAA;AAE/D,gFAAgF;AAChF,MAAM,MAAM,QAAQ,GAChB;IACE,MAAM,EAAE,cAAc,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,YAAY,EAAE,qBAAqB,CAAA;CACpC,GACD;IACE,MAAM,EAAE,KAAK,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC7B,GACD;IACE,MAAM,EAAE,OAAO,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAElE,gGAAgG;AAChG,UAAU,qBAAqB;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEnD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAC/C,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAenD,CAAA;AAED,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,EAAE,SAAS,gBAAgB,EAEtC,CAAA;AAEvB;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAElE;AAeD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAiC3D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,cAAc,CAsC/D"}