@cat-factory/gatekeeper-worker 0.4.2 → 0.5.0

package/dist/policy/compile.js

@@ -125,16 +125,27 @@ export function compilePolicy(policy) {
     for (const [name, tier] of Object.entries(policy.tiers)) {
         tiers.set(name, compileTier(name, tier));
     }
-    if (policy.defaultTier !== null && !tiers.has(policy.defaultTier)) {
-        throw new PolicyError(`defaultTier is '${policy.defaultTier}', which is not one of the declared tiers ` +
-            `(${[...tiers.keys()].join(', ')}).`);
+    const autoProvisionedTier = policy.autoProvisionedTier ?? null;
+    for (const [field, named] of [
+        ['defaultTier', policy.defaultTier],
+        ['autoProvisionedTier', autoProvisionedTier],
+    ]) {
+        if (named !== null && !tiers.has(named)) {
+            throw new PolicyError(`${field} is '${named}', which is not one of the declared tiers ` +
+                `(${[...tiers.keys()].join(', ')}).`);
+        }
     }
     for (const [actor, tierName] of Object.entries(policy.grants)) {
         if (!tiers.has(tierName)) {
             throw new PolicyError(`Actor '${actor}' is granted tier '${tierName}', which is not declared.`);
         }
     }
-    return { defaultTier: policy.defaultTier, tiers, grants: new Map(Object.entries(policy.grants)) };
+    return {
+        defaultTier: policy.defaultTier,
+        autoProvisionedTier,
+        tiers,
+        grants: new Map(Object.entries(policy.grants)),
+    };
 }
 /**
  * The tier an actor holds, or a refusal.
@@ -149,6 +160,33 @@ export function tierForActor(policy, actorId) {
         return null;
     return policy.tiers.get(name) ?? null;
 }
+/**
+ * The tier EVERY auto-provisioned account falls to, resolved without an account to ask about.
+ *
+ * Asked on its own because the vendor is questioned before any account exists: the session types
+ * it publishes are the ones a not-yet-created account will get. Answering that by minting a
+ * throwaway id and letting it miss `grants` produces the same tier and a refusal naming an id that
+ * exists nowhere in the operator's config, which is the wrong sentence for the one reader who has
+ * to act on it.
+ */
+export function autoProvisionedTier(policy) {
+    if (policy.autoProvisionedTier === null)
+        return null;
+    return policy.tiers.get(policy.autoProvisionedTier) ?? null;
+}
+/**
+ * The tier one auto-provisioned Cloudflare OS account holds, or a refusal.
+ *
+ * `grants` is consulted FIRST and by the account's own minted id, which is the whole affordance an
+ * operator has for raising one account above the rest: nothing else about such an account is
+ * nameable, because nothing about it was named when it was created.
+ */
+export function tierForAccount(policy, accountId) {
+    const granted = policy.grants.get(accountId);
+    if (granted !== undefined)
+        return policy.tiers.get(granted) ?? null;
+    return autoProvisionedTier(policy);
+}
 /**
  * What the OS needs to run its own approval governance over a call: the consequence the platform
  * annotates, with the cautious default already applied.

package/dist/policy/compile.js.map

@@ -1 +1 @@
-{"version":3,"file":"compile.js","sourceRoot":"","sources":["../../src/policy/compile.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,0EAA0E;AAC1E,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,iDAAiD;AACjD,EAAE;AACF,0FAA0F;AAC1F,kBAAkB;AAElB,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GAInB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAsE1C;;;;;;;;;GASG;AACH,MAAM,eAAe,GAA8B,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;AAE9E;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,OAA0B;IAC3C,OAAO,OAAO,CAAC,MAAM,KAAK,OAAO,CAAA;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAgB;IACjD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,WAAW,CACnB,SAAS,IAAI,wBAAwB,IAAI,CAAC,QAAQ,yCAAyC;YACzF,aAAa,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD;YACzF,8FAA8F,CACjG,CAAA;IACH,CAAC;IAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAErC,0FAA0F;IAC1F,0FAA0F;IAC1F,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;QAC3B,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QAC/C,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;KACjB,EAAE,CAAC;QACX,KAAK,MAAM,WAAW,IAAI,KAAK,EAAE,CAAC;YAChC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,WAAW,CACnB,SAAS,IAAI,YAAY,WAAW,QAAQ,KAAK,sCAAsC;oBACrF,wFAAwF;oBACxF,8CAA8C,CACjD,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjE,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,CAAA;gBAC1C,MAAM,IAAI,WAAW,CACnB,SAAS,IAAI,aAAa,WAAW,4BAA4B,OAAO,EAAE,QAAQ,SAAS;oBACzF,2BAA2B,IAAI,CAAC,QAAQ,2CAA2C;oBACnF,6EAA6E,CAChF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAwB,EAAE,CAAA;IACvC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IAEtC,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,SAAS,IAAI,cAAc;aACpC,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,SAAS,IAAI,sBAAsB;aAC5C,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,mBAAmB,OAAO,CAAC,MAAM,wCAAwC;aAClF,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,iBAAiB,OAAO,CAAC,QAAQ,0BAA0B,IAAI,CAAC,QAAQ,IAAI;SACrF,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO;QACP,QAAQ;QACR,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;KACtB,CAAA;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,WAAgC;IACzD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;AACzF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAwB;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAA;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAC1C,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,WAAW,CACnB,mBAAmB,MAAM,CAAC,WAAW,4CAA4C;YAC/E,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACvC,CAAA;IACH,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,CACnB,UAAU,KAAK,sBAAsB,QAAQ,2BAA2B,CACzE,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAA;AACnG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,MAAsB,EAAE,OAAe;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,WAAW,CAAA;IAC7D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,OAA0B;IAWxD,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC/C,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC"}
+{"version":3,"file":"compile.js","sourceRoot":"","sources":["../../src/policy/compile.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,0EAA0E;AAC1E,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,4FAA4F;AAC5F,iGAAiG;AACjG,+FAA+F;AAC/F,iDAAiD;AACjD,EAAE;AACF,0FAA0F;AAC1F,kBAAkB;AAElB,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GAInB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AA0F1C;;;;;;;;;GASG;AACH,MAAM,eAAe,GAA8B,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;AAE9E;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,OAA0B;IAC3C,OAAO,OAAO,CAAC,MAAM,KAAK,OAAO,CAAA;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAgB;IACjD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,WAAW,CACnB,SAAS,IAAI,wBAAwB,IAAI,CAAC,QAAQ,yCAAyC;YACzF,aAAa,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD;YACzF,8FAA8F,CACjG,CAAA;IACH,CAAC;IAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAErC,0FAA0F;IAC1F,0FAA0F;IAC1F,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;QAC3B,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QAC/C,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;KACjB,EAAE,CAAC;QACX,KAAK,MAAM,WAAW,IAAI,KAAK,EAAE,CAAC;YAChC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,WAAW,CACnB,SAAS,IAAI,YAAY,WAAW,QAAQ,KAAK,sCAAsC;oBACrF,wFAAwF;oBACxF,8CAA8C,CACjD,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjE,MAAM,OAAO,GAAG,aAAa,CAAC,WAAW,CAAC,CAAA;gBAC1C,MAAM,IAAI,WAAW,CACnB,SAAS,IAAI,aAAa,WAAW,4BAA4B,OAAO,EAAE,QAAQ,SAAS;oBACzF,2BAA2B,IAAI,CAAC,QAAQ,2CAA2C;oBACnF,6EAA6E,CAChF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAwB,EAAE,CAAA;IACvC,MAAM,QAAQ,GAAsB,EAAE,CAAA;IAEtC,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,SAAS,IAAI,cAAc;aACpC,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,SAAS,IAAI,sBAAsB;aAC5C,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,mBAAmB,OAAO,CAAC,MAAM,wCAAwC;aAClF,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,iBAAiB,OAAO,CAAC,QAAQ,0BAA0B,IAAI,CAAC,QAAQ,IAAI;SACrF,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO;QACP,QAAQ;QACR,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;KACtB,CAAA;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,WAAgC;IACzD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;AACzF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAwB;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAA;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,IAAI,IAAI,CAAA;IAC9D,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;QAC3B,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC;QACnC,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;KACpC,EAAE,CAAC;QACX,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,WAAW,CACnB,GAAG,KAAK,QAAQ,KAAK,4CAA4C;gBAC/D,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACvC,CAAA;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,CACnB,UAAU,KAAK,sBAAsB,QAAQ,2BAA2B,CACzE,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,mBAAmB;QACnB,KAAK;QACL,MAAM,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;KAC/C,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,MAAsB,EAAE,OAAe;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,WAAW,CAAA;IAC7D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAsB;IACxD,IAAI,MAAM,CAAC,mBAAmB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACpD,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAA;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAsB,EAAE,SAAiB;IACtE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;IACnE,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,OAA0B;IAWxD,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC/C,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC"}

package/dist/policy/index.d.ts

@@ -1,4 +1,4 @@
-export { compilePolicy, describeBinding, tierForActor, type CompiledPolicy, type CompiledTier, type GatekeeperPolicy, type TierPolicy, type WithheldBinding, type WithheldReason, } from './compile.js';
+export { autoProvisionedTier, compilePolicy, describeBinding, tierForAccount, tierForActor, type CompiledPolicy, type CompiledTier, type GatekeeperPolicy, type TierPolicy, type WithheldBinding, type WithheldReason, } from './compile.js';
 export { ANSWERABLE_DECISION_KINDS, answererFor, DECISION_BINDINGS, DECISION_KEY_SCOPE, type DecisionAnswerer, type DecisionCall, type DecisionField, type DecisionVerb, type LiveDecision, type ParkedDecisionKind, } from './decisions.js';
 export { GatekeeperError, PolicyError, type GatekeeperReason } from '../errors.js';
 export { applyMask, MASKED } from '../masking.js';

package/dist/policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,aAAa,EACb,eAAe,EACf,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,yBAAyB,EACzB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAA;AAIvB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAKjD,YAAY,EACV,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,aAAa,GACd,MAAM,kCAAkC,CAAA;AAMzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,cAAc,EACd,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,yBAAyB,EACzB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAA;AAIvB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAKjD,YAAY,EACV,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,aAAa,GACd,MAAM,kCAAkC,CAAA;AAMzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA"}

package/dist/policy/index.js

@@ -8,7 +8,7 @@
 //
 // Everything here is re-exported from the main entry too, so a deployment that does not care can
 // import from one place.
-export { compilePolicy, describeBinding, tierForActor, } from './compile.js';
+export { autoProvisionedTier, compilePolicy, describeBinding, tierForAccount, tierForActor, } from './compile.js';
 export { ANSWERABLE_DECISION_KINDS, answererFor, DECISION_BINDINGS, DECISION_KEY_SCOPE, } from './decisions.js';
 // A policy is refused by a `PolicyError` and MASKED paths are the other half of a tier, so both
 // belong to the vocabulary a policy file and its tests speak.

package/dist/policy/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,4BAA4B;AAC5B,EAAE;AACF,6FAA6F;AAC7F,kGAAkG;AAClG,iGAAiG;AACjG,qFAAqF;AACrF,EAAE;AACF,iGAAiG;AACjG,yBAAyB;AAEzB,OAAO,EACL,aAAa,EACb,eAAe,EACf,YAAY,GAOb,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,yBAAyB,EACzB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,GAOnB,MAAM,gBAAgB,CAAA;AAEvB,gGAAgG;AAChG,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAyB,MAAM,cAAc,CAAA;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAYjD,+FAA+F;AAC/F,gGAAgG;AAChG,iGAAiG;AACjG,yDAAyD;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy/index.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,4BAA4B;AAC5B,EAAE;AACF,6FAA6F;AAC7F,kGAAkG;AAClG,iGAAiG;AACjG,qFAAqF;AACrF,EAAE;AACF,iGAAiG;AACjG,yBAAyB;AAEzB,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,cAAc,EACd,YAAY,GAOb,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,yBAAyB,EACzB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,GAOnB,MAAM,gBAAgB,CAAA;AAEvB,gGAAgG;AAChG,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAyB,MAAM,cAAc,CAAA;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAYjD,+FAA+F;AAC/F,gGAAgG;AAChG,iGAAiG;AACjG,yDAAyD;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA"}

package/dist/worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAyD,KAAK,aAAa,EAAE,MAAM,UAAU,CAAA;AAIpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAE3D,kDAAkD;AAClD,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,MAAM,EAAE,gBAAgB,CAAA;CACzB;AAwDD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,eAAe,CAAC,aAAa,CAAC,CAqGhC"}
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAyD,KAAK,aAAa,EAAE,MAAM,UAAU,CAAA;AAKpG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAE3D,kDAAkD;AAClD,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,MAAM,EAAE,gBAAgB,CAAA;CACzB;AAwDD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,eAAe,CAAC,aAAa,CAAC,CAiHhC"}

package/dist/worker.js

@@ -7,10 +7,16 @@
 // is a dependency bump instead of a re-merge against a file the operator has edited.
 //
 //   POST /webhook        the platform's outbound delivery receiver
-//   ALL  /rpc            the Cap'n Web endpoint the paired Cloudflare OS talks to
+//   ALL  /rpc            a Cap'n Web capability endpoint, for an agent runtime that speaks it
 //   POST /admin/enroll   re-assert this Worker's webhook registration on demand
 //   POST /admin/retire   revoke every key minted for one OS user, for offboarding
-//   GET  /health         liveness plus whether this deployment could serve at all
+//   GET  /health         liveness, plus a report on whether a Cloudflare OS could install this
+//
+// A Cloudflare OS deployment does NOT come in here. It reaches the `GatekeeperVendor` entrypoint
+// over a service binding, using native Workers RPC (`src/os/`); Cap'n Web is the workspace's
+// browser-to-backend and gadget-side protocol, which shares the semantics and not the wire. `/rpc`
+// is the door for everything else: an agent runtime that speaks Cap'n Web, or a consumer that
+// wants this Worker's capabilities without a Cloudflare OS at all.
 //
 // Two conventions are worth stating because they look like sloppiness and are not.
 //
@@ -28,6 +34,7 @@ import { newWorkersRpcResponse, RpcTarget } from 'capnweb';
 import { ConfigError, describeMissingBindings, missingBindings } from './env.js';
 import { GatekeeperError, PolicyError } from './errors.js';
 import { Gatekeeper } from './gatekeeper.js';
+import { describeDiscoverability } from './os/discoverability.js';
 /** The root capability: the only thing reachable before an actor is named. */
 class GatekeeperApi extends RpcTarget {
     #gatekeeper;
@@ -74,7 +81,7 @@ function refuseSetup(error) {
 export function createGatekeeperWorker(options) {
     const { policy } = options;
     return {
-        async fetch(request, env) {
+        async fetch(request, env, ctx) {
             const url = new URL(request.url);
             try {
                 // Health runs BEFORE the assembly below, and asks the whole configuration rather than the
@@ -90,8 +97,20 @@ export function createGatekeeperWorker(options) {
                     }
                     // Assembling IS the rest of the check: it compiles the policy against the live operation
                     // table, and a policy that does not compile is a Gatekeeper that serves nothing.
-                    Gatekeeper.create(env, policy);
-                    return Response.json({ ok: true });
+                    const assembled = Gatekeeper.create(env, policy);
+                    // Whether a Cloudflare OS deployment could discover and install this Worker is REPORTED,
+                    // never folded into the status. Both halves of it (the four exports resolved by name, a
+                    // policy naming an autoProvisionedTier) are things an operator can half-finish with no
+                    // request path to notice on, so they belong in this one pass. But a Gatekeeper serving
+                    // `/rpc` and nothing else is a supported deployment, and answering 503 for it would turn
+                    // a version bump into a red monitor over a Worker whose every route works.
+                    return Response.json({
+                        ok: true,
+                        os: describeDiscoverability({
+                            exports: ctx.exports,
+                            autoProvisionedTier: assembled.autoProvisionedTierName,
+                        }),
+                    });
                 }
                 const gatekeeper = Gatekeeper.create(env, policy);
                 if (url.pathname === '/webhook') {

package/dist/worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,2BAA2B;AAC3B,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,mGAAmG;AACnG,qFAAqF;AACrF,EAAE;AACF,mEAAmE;AACnE,kFAAkF;AAClF,gFAAgF;AAChF,kFAAkF;AAClF,kFAAkF;AAClF,EAAE;AACF,mFAAmF;AACnF,EAAE;AACF,gGAAgG;AAChG,gGAAgG;AAChG,+FAA+F;AAC/F,gGAAgG;AAChG,gGAAgG;AAChG,wFAAwF;AACxF,EAAE;AACF,iGAAiG;AACjG,gGAAgG;AAChG,2EAA2E;AAE3E,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC1D,OAAO,EAAE,WAAW,EAAE,uBAAuB,EAAE,eAAe,EAAsB,MAAM,UAAU,CAAA;AACpG,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AA2B5C,8EAA8E;AAC9E,MAAM,aAAc,SAAQ,SAAS;IAC1B,WAAW,CAAY;IAEhC,YAAY,UAAsB;QAChC,KAAK,EAAE,CAAA;QACP,IAAI,CAAC,WAAW,GAAG,UAAU,CAAA;IAC/B,CAAC;IAED,OAAO,CAAC,OAAuB;QAC7B,MAAM,OAAO,GAAG,OAAO,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;QAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,yFAAyF;gBACvF,wDAAwD,CAC3D,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAU;YACnB,EAAE,EAAE,OAAO;YACX,GAAG,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAA;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IAC9C,CAAC;CACF;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACtF,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACtF,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgC;IAEhC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAE1B,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAkB;YAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAEhC,IAAI,CAAC;gBACH,0FAA0F;gBAC1F,sFAAsF;gBACtF,oFAAoF;gBACpF,0FAA0F;gBAC1F,yFAAyF;gBACzF,cAAc;gBACd,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;oBACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAA;oBACzE,CAAC;oBACD,yFAAyF;oBACzF,iFAAiF;oBACjF,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;oBAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;gBACpC,CAAC;gBAED,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;gBAEjD,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;oBAChC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;wBAAE,OAAO,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAA;oBACtF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;oBAClE,IAAI,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;wBACnC,OAAO,OAAO,CACZ,GAAG,EACH,OAAO,CAAC,MAAM,EACd,2DAA2D,CAC5D,CAAA;oBACH,CAAC;oBACD,IAAI,OAAO,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;wBACtC,OAAO,OAAO,CACZ,GAAG,EACH,sBAAsB,EACtB,6CAA6C,CAC9C,CAAA;oBACH,CAAC;oBACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBAChD,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;oBAChE,OAAO,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,+CAA+C,CAAC,CAAA;gBACtF,CAAC;gBAED,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;oBACrC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;wBAAE,OAAO,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAA;oBACtF,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;gBACjD,CAAC;gBAED,wFAAwF;gBACxF,2FAA2F;gBAC3F,yCAAyC;gBACzC,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;oBACrC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;wBAAE,OAAO,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAA;oBACtF,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;oBACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACzB,OAAO,OAAO,CACZ,GAAG,EACH,eAAe,EACf,qFAAqF;4BACnF,iEAAiE,CACpE,CAAA;oBACH,CAAC;oBACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;gBACxD,CAAC;gBAED,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;oBAC5B,OAAO,MAAM,qBAAqB,CAAC,OAAO,EAAE,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC,CAAA;gBAC5E,CAAC;gBAED,OAAO,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,wBAAwB,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAA;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBAClC,IAAI,OAAO,KAAK,IAAI;oBAAE,OAAO,OAAO,CAAA;gBACpC,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,SAAS,CACb,WAAgC,EAChC,GAAkB,EAClB,GAAqB;YAErB,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;QACxD,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,2BAA2B;AAC3B,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,mGAAmG;AACnG,qFAAqF;AACrF,EAAE;AACF,mEAAmE;AACnE,8FAA8F;AAC9F,gFAAgF;AAChF,kFAAkF;AAClF,+FAA+F;AAC/F,EAAE;AACF,iGAAiG;AACjG,6FAA6F;AAC7F,mGAAmG;AACnG,8FAA8F;AAC9F,mEAAmE;AACnE,EAAE;AACF,mFAAmF;AACnF,EAAE;AACF,gGAAgG;AAChG,gGAAgG;AAChG,+FAA+F;AAC/F,gGAAgG;AAChG,gGAAgG;AAChG,wFAAwF;AACxF,EAAE;AACF,iGAAiG;AACjG,gGAAgG;AAChG,2EAA2E;AAE3E,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC1D,OAAO,EAAE,WAAW,EAAE,uBAAuB,EAAE,eAAe,EAAsB,MAAM,UAAU,CAAA;AACpG,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAE5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AA0BjE,8EAA8E;AAC9E,MAAM,aAAc,SAAQ,SAAS;IAC1B,WAAW,CAAY;IAEhC,YAAY,UAAsB;QAChC,KAAK,EAAE,CAAA;QACP,IAAI,CAAC,WAAW,GAAG,UAAU,CAAA;IAC/B,CAAC;IAED,OAAO,CAAC,OAAuB;QAC7B,MAAM,OAAO,GAAG,OAAO,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;QAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,yFAAyF;gBACvF,wDAAwD,CAC3D,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAU;YACnB,EAAE,EAAE,OAAO;YACX,GAAG,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAA;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IAC9C,CAAC;CACF;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACtF,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACtF,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgC;IAEhC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAE1B,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAkB,EAAE,GAAqB;YACrE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAEhC,IAAI,CAAC;gBACH,0FAA0F;gBAC1F,sFAAsF;gBACtF,oFAAoF;gBACpF,0FAA0F;gBAC1F,yFAAyF;gBACzF,cAAc;gBACd,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;oBACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAA;oBACzE,CAAC;oBACD,yFAAyF;oBACzF,iFAAiF;oBACjF,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;oBAChD,yFAAyF;oBACzF,wFAAwF;oBACxF,uFAAuF;oBACvF,uFAAuF;oBACvF,yFAAyF;oBACzF,2EAA2E;oBAC3E,OAAO,QAAQ,CAAC,IAAI,CAAC;wBACnB,EAAE,EAAE,IAAI;wBACR,EAAE,EAAE,uBAAuB,CAAC;4BAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;4BACpB,mBAAmB,EAAE,SAAS,CAAC,uBAAuB;yBACvD,CAAC;qBACH,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;gBAEjD,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;oBAChC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;wBAAE,OAAO,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAA;oBACtF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;oBAClE,IAAI,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;wBACnC,OAAO,OAAO,CACZ,GAAG,EACH,OAAO,CAAC,MAAM,EACd,2DAA2D,CAC5D,CAAA;oBACH,CAAC;oBACD,IAAI,OAAO,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;wBACtC,OAAO,OAAO,CACZ,GAAG,EACH,sBAAsB,EACtB,6CAA6C,CAC9C,CAAA;oBACH,CAAC;oBACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBAChD,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;oBAChE,OAAO,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,+CAA+C,CAAC,CAAA;gBACtF,CAAC;gBAED,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;oBACrC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;wBAAE,OAAO,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAA;oBACtF,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;gBACjD,CAAC;gBAED,wFAAwF;gBACxF,2FAA2F;gBAC3F,yCAAyC;gBACzC,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;oBACrC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;wBAAE,OAAO,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAA;oBACtF,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;oBACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACzB,OAAO,OAAO,CACZ,GAAG,EACH,eAAe,EACf,qFAAqF;4BACnF,iEAAiE,CACpE,CAAA;oBACH,CAAC;oBACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;gBACxD,CAAC;gBAED,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;oBAC5B,OAAO,MAAM,qBAAqB,CAAC,OAAO,EAAE,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC,CAAA;gBAC5E,CAAC;gBAED,OAAO,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,wBAAwB,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAA;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;gBAClC,IAAI,OAAO,KAAK,IAAI;oBAAE,OAAO,OAAO,CAAA;gBACpC,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,SAAS,CACb,WAAgC,EAChC,GAAkB,EAClB,GAAqB;YAErB,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;QACxD,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/gatekeeper-worker",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "The Cloudflare OS Gatekeeper machinery for cat-factory as an installable library: policy-compiled Cap'n Web capabilities over the /api/v1 operation table, per-actor API-key minting, a verified outbound-webhook receiver and the approval inbox that answers every park a run stops on. A deployment supplies only its policy; deploy/gatekeeper is the template it copies.",
   "keywords": [
     "capnweb",
@@ -37,12 +37,12 @@
   },
   "dependencies": {
     "capnweb": "^0.10.0",
-    "@cat-factory/gatekeeper-bindings": "0.9.0",
-    "@cat-factory/sdk": "0.28.0"
+    "@cat-factory/gatekeeper-bindings": "0.10.0",
+    "@cat-factory/sdk": "0.28.1"
   },
   "devDependencies": {
-    "@cloudflare/vitest-pool-workers": "^0.20.1",
-    "@cloudflare/workers-types": "^5.20260804.1",
+    "@cloudflare/vitest-pool-workers": "^0.20.3",
+    "@cloudflare/workers-types": "^5.20260808.1",
     "typescript": "7.0.2",
     "vitest": "^4.1.10"
   },