@cat-factory/gatekeeper-worker 0.4.3 → 0.6.0

package/README.md

@@ -3,10 +3,23 @@
 ## What it is
 
 The Cloudflare Worker machinery behind a cat-factory **Gatekeeper**: a credential-holding front
-end that lets a [Cloudflare OS](https://github.com/cloudflare/cloudflare-os) workspace (or any
-agent runtime speaking Cap'n Web) drive cat-factory without an agent ever seeing a credential.
-Agents hold an object-capability whose methods are exactly what policy granted; the keys stay in
-Worker secrets and Durable Object storage.
+end that lets a [Cloudflare OS](https://github.com/cloudflare/cloudflare-os) workspace drive
+cat-factory without an agent ever seeing a credential. Agents hold an object-capability whose
+methods are exactly what policy granted; the keys stay in Worker secrets and Durable Object
+storage.
+
+It serves TWO doors onto the same rooms, and which one a caller comes in by decides how it is
+authorized:
+
+| Door                              | Who comes in by it                                               | Authorization       |
+| --------------------------------- | ---------------------------------------------------------------- | ------------------- |
+| The `GatekeeperVendor` entrypoint | A Cloudflare OS workspace, over a `GATEKEEPER_*` service binding | Holding the binding |
+| `ALL /rpc` (Cap'n Web over HTTP)  | Any other agent runtime that speaks Cap'n Web                    | `OS_SHARED_TOKEN`   |
+
+The published Cloudflare OS contract reaches a gatekeeper over native Workers RPC to a
+`WorkerEntrypoint` export named `GatekeeperVendor`; Cap'n Web is that workspace's browser-to-backend
+and gadget-side protocol, which shares the semantics and not the wire. So `/rpc` is the door for
+everything that is NOT a Cloudflare OS deployment, and nothing here is Cloudflare-OS-only.
 
 It is the machinery half of the Gatekeeper family:
 
@@ -83,9 +96,20 @@ version has to be the consumer's.
 
 ## What it does
 
-- **Object-capability bindings over Cap'n Web.** An agent holds an object whose METHODS are the
-  operations policy granted it. There is no allow-list consulted per call, because there is nothing
-  to consult: an operation the tier does not carry is not a method that refuses, it is absent.
+- **Object-capability bindings.** An agent holds an object whose METHODS are the operations policy
+  granted it. There is no allow-list consulted per call, because there is nothing to consult: an
+  operation the tier does not carry is not a method that refuses, it is absent.
+- **The Cloudflare OS object model, as a facade over all of it.** `GatekeeperVendor` →
+  `CatFactoryAccount` → `CatFactoryResource` → session, with `describe()`,
+  `getSupportedResources()` and `getTypeScriptTypes()` all PROJECTIONS of the operation table
+  rather than transcriptions of it. A resource is the paired cat-factory workspace, named by a
+  URLPattern over the deployment origin: one Gatekeeper serves one workspace, because the
+  provisioning key it holds is scoped to one.
+- **The workspace's approval queue, in front of every call.** On the entrypoint path each read is
+  authorized before it is MADE, and each write is SUBMITTED and performed only when
+  the workspace applies it. Reads that serve captured agent text are marked unshareable, actions
+  carry the consequence the table states, and nothing is offered for unattended auto-approval while
+  the surface annotates no write as safe. The tier policy underneath stays the floor.
 - **Per-actor credentials.** Each caller gets their own cat-factory key, minted through
   `POST /api/v1/keys` at the tier's scope and stamped with your identity for that person
   (`externalIdentity`), so a run traces back to a human and role-scoped merge policy stays real.
@@ -99,6 +123,26 @@ version has to be the consumer's.
   caller's own key.
 - **Run lifecycle without polling.** `run.started` / `run.completed` / `run.failed` land as a
   `runs_watched()` projection, and a terminal event settles that run's open cards.
+- **Hooks, so the workspace is pushed rather than asked.** A session binds a callback through the
+  workspace's own `bindHook`, the workspace enables it when it is ready to, and each card or run
+  transition is then pushed: a fresh callback per delivery, authorized as the observation it is.
+  What a hook pushes is exactly what `approvals_list()` and `runs_watched()` answer, which stay the
+  truth: a delivery a hook missed is still readable there, and `hooks_bound()` reports the miss
+  rather than leaving it to be inferred from a quiet inbox. The fan-out runs BEHIND the delivery's
+  acknowledgement and each push is bounded by its own deadline, so a workspace that hangs costs a
+  notification and never the platform's retry budget.
+- **Sharing that is verified, not assumed.** A workspace user shared onto a bound resource is
+  admitted only when their OWN account's tier reaches everything the resource's tier reaches, and
+  masks no more; a tier that can read captured agent text is never shareable at all. The observer
+  has to hold an account THIS deployment minted, checked before any tier is resolved: an unknown id
+  would otherwise resolve to the auto-provisioned tier, which is the tier every account here holds,
+  so a viewer from another vendor entirely measured up as identical to the owner. Anything the
+  Gatekeeper cannot answer (an observer with no verifier, an account it never minted) is a refusal
+  that says which it is.
+- **Arguments checked against what each operation declares.** An argument no operation reads used
+  to be dropped on the way through, so a filter nobody applied came back as an answer shaped like a
+  filtered one. It is now a refusal naming what the operation does take, made before a key is
+  minted or an approval is spent.
 - **Self-enrolment and offboarding.** The endpoint registers itself under a caller-chosen webhook
   id, hourly and idempotently. `POST /admin/retire?actorId=…` revokes every key minted for one
   person, upstream first and then here.
@@ -138,14 +182,41 @@ The Worker serves five routes:
 | Route                          | Auth              | What it is                                                    |
 | ------------------------------ | ----------------- | ------------------------------------------------------------- |
 | `POST /webhook`                | delivery HMAC     | The platform's outbound deliveries. Verified over raw bytes.  |
-| `ALL /rpc`                     | `OS_SHARED_TOKEN` | The Cap'n Web endpoint the OS deployment talks to.            |
+| `ALL /rpc`                     | `OS_SHARED_TOKEN` | Cap'n Web, for an agent runtime that is not a Cloudflare OS.  |
 | `POST /admin/enroll`           | `OS_SHARED_TOKEN` | Re-assert the webhook registration. Also runs hourly on cron. |
 | `POST /admin/retire?actorId=…` | `OS_SHARED_TOKEN` | Offboarding: revoke every key minted for one OS user.         |
-| `GET /health`                  | none              | Green only when every binding is set and the policy compiles. |
+| `GET /health`                  | none              | Green when every binding is set and the policy compiles.      |
+
+`/rpc` is bearer-gated because a Worker with a route attached is reachable by anyone who finds it,
+and a capability surface whose only defence is obscurity is not one. The Cloudflare OS path does not
+come through here at all: it arrives on a service binding, which never traverses the internet and
+which only that deployment's operator can write, so holding it IS the authorization and a second
+secret in front of it would protect nothing.
+
+### `/health` also reports whether a Cloudflare OS could install this
+
+Two things decide that, and neither has a request path of its own: the entry module must export the
+four names the object model resolves (`GatekeeperVendor`, `CatFactoryAccount`,
+`CatFactoryResource`, `CatFactoryVerifier`), and the policy must name an `autoProvisionedTier`. A
+workspace that finds either missing does not get an error anyone monitors; it never finishes
+installing. So a green response carries the answer beside `ok`:
+
+```json
+{ "ok": true, "os": { "discoverable": true, "blockers": [], "limitations": [] } }
+```
+
+`limitations` is the same report for what does NOT stop an install. `CatFactoryHookController` is
+reached only when a session binds a hook, so a deployment missing it installs, serves and answers
+exactly as before and refuses `approvals_subscribe()`; calling that a blocker would turn a working
+deployment red, and omitting it would leave the gap to be discovered from an agent's failed call.
 
-`/rpc` is bearer-gated even though the intended path is a Worker service binding, which never
-traverses the internet: a Worker with a route attached is reachable by anyone who finds it, and a
-capability surface whose only defence is obscurity is not one.
+It is REPORTED, never folded into the status, because a Gatekeeper serving `/rpc` and nothing else
+is a supported deployment: this package promises that door to consumers that are not a Cloudflare
+OS, and turning their liveness red on a version bump would be this route answering a question
+nobody asked it. A deployment that wants discovery keys a monitor on `os.discoverable`; each entry
+in `blockers` carries a `reason` (`missing_exports`, `no_auto_provisioned_tier`) and a `detail`
+naming the fix, and both are reported in one pass so a half-wired deployment is not wired one
+redeploy at a time.
 
 ## What to customize: the policy
 
@@ -191,7 +262,7 @@ path that matches nothing is not an error, because result shapes legitimately va
 `connect({ actorId, label? })` on the `/rpc` session resolves the actor's tier and returns the
 capability. `actorId` is the OS's own authenticated identity for the person, and it is the ONLY
 claim the Gatekeeper trusts: nothing the caller sends picks a tier. Beyond the granted operation
-methods, every capability carries seven reserved methods:
+methods, every capability carries ten reserved methods:
 
 - `tier()`: who the caller is acting as (actor, tier name, description, key scope).
 - `bindings()`: the granted operations, each with its scope floor, consequence (cautious default
@@ -205,6 +276,22 @@ methods, every capability carries seven reserved methods:
 - `approvals_list()`, `approvals_inspect(cardId)`, `approvals_answer(cardId, input)`: the
   approval inbox; see the template README for the flow and the three answer outcomes.
 - `runs_watched()`: the run-lifecycle projection built from the `run.*` webhook events.
+- `approvals_subscribe(callback)`, `runs_subscribe(callback)`: bind a hook, so the two projections
+  above are PUSHED. The callback needs one method (`onApprovalCard(card)` / `onRunEvent(state)`),
+  and a card is pushed on every transition it makes, settlement by a terminal run event included.
+  Both refuse on the `/rpc` door, which brings no approval queue to register a hook with and
+  nothing to authorize a delivery against; the refusal names the two reads that answer the same
+  question. A workspace that does not take the binding (its queue serves no hooks, or a person
+  declined) is a `hook_bind_refused` carrying the cause verbatim, because those two need opposite
+  fixes and nothing at this seam can tell them apart.
+- `hooks_bound()`: what this account has enabled, with what each hook has been pushed
+  (`deliveries`), what it could not be pushed (`missed`), what the workspace refused (`failures`)
+  and whether it is still `live`. A hook goes quiet when the durable object is evicted between
+  deliveries, because the workspace's callback source is a stub and cannot be stored; that reads as
+  `live: false` with a rising `missed`, and the remedy is to bind again. Re-binding from the same
+  gadget RE-ARMS the same registration rather than adding a second: a hook is identified by where
+  its deliveries land, and its counters carry over, since they are the history that prompted the
+  re-arm.
 
 Refusals from a live Gatekeeper are `GatekeeperError`s carrying a machine-readable `reason`
 (`unknown_actor`, `card_not_found`, `ambiguous_park`, …), the same role the platform's own

package/dist/arguments.d.ts

@@ -0,0 +1,18 @@
+import type { GatekeeperBinding } from '@cat-factory/gatekeeper-bindings';
+/**
+ * Every argument name an operation reads, in the order a caller would learn them.
+ *
+ * Exported because `approvals_inspect` and the session types describe the same set from the same
+ * binding, and a second derivation of "what may I pass" is how a published shape and an enforced
+ * one drift.
+ */
+export declare function declaredArguments(binding: GatekeeperBinding): string[];
+/**
+ * Refuse a call whose arguments the operation does not declare, or that omits one it requires.
+ *
+ * Returns the bag so the call site reads as a narrowing rather than as a statement with a side
+ * effect. An `undefined` value is treated as absent throughout, which is what a caller building a
+ * bag from optional fields produces and what the SDK's own forwarding already does with it.
+ */
+export declare function checkedArguments(binding: GatekeeperBinding, args: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=arguments.d.ts.map

package/dist/arguments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arguments.d.ts","sourceRoot":"","sources":["../src/arguments.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AAMzE;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAMtE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,iBAAiB,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmCzB"}

package/dist/arguments.js

@@ -0,0 +1,75 @@
+// Checking a call's arguments against what the operation DECLARES, before anything happens.
+//
+// The published contract asks a gatekeeper to validate RPC arguments against the declared
+// signature and reject a call carrying one the receiver does not declare. The reference
+// implementations generate that check from their own signatures; ours is generated already, one
+// layer down: every binding in `@cat-factory/gatekeeper-bindings` carries its path parameters, its
+// query parameters with which are required, and whether it takes a body. So the check is derived
+// from the same table the session's `.d.ts` and the policy compiler read, and an operation whose
+// shape changes brings its own validation with it.
+//
+// The reason to have it at all is the SILENT DROP. `invoke` forwards the arguments it recognises
+// and ignores the rest, so an agent asking `tasks_list_by_service` to filter by a parameter that
+// operation does not take used to get an unfiltered list and no word about it: a wrong answer
+// shaped exactly like a right one. A near-miss spelling is the same failure with a plainer cause.
+//
+// It runs on BOTH doors, ahead of the approval queue and ahead of the key broker. That order is
+// the point: a call that cannot succeed should not mint a credential, should not spend a
+// workspace's approval on an action that would 400, and should not reach the deployment at all.
+// Refusing it is a behaviour change for a caller that was sending an argument nothing read, which
+// is exactly the caller this check exists for.
+//
+// What it does NOT check is what a value may BE. That is the deployment's judgement, it is stated
+// in the spec these bindings are generated from, and its refusal already names the field; a second
+// copy of it here would be free to disagree with the first.
+import { GatekeeperError } from './errors.js';
+/** The one argument key that is never a parameter: the request body `invoke` forwards. */
+const BODY = 'body';
+/**
+ * Every argument name an operation reads, in the order a caller would learn them.
+ *
+ * Exported because `approvals_inspect` and the session types describe the same set from the same
+ * binding, and a second derivation of "what may I pass" is how a published shape and an enforced
+ * one drift.
+ */
+export function declaredArguments(binding) {
+    return [
+        ...binding.pathParams,
+        ...binding.queryParams.map((param) => param.name),
+        ...(binding.hasBody ? [BODY] : []),
+    ];
+}
+/**
+ * Refuse a call whose arguments the operation does not declare, or that omits one it requires.
+ *
+ * Returns the bag so the call site reads as a narrowing rather than as a statement with a side
+ * effect. An `undefined` value is treated as absent throughout, which is what a caller building a
+ * bag from optional fields produces and what the SDK's own forwarding already does with it.
+ */
+export function checkedArguments(binding, args) {
+    const declared = declaredArguments(binding);
+    const supplied = Object.entries(args).filter(([, value]) => value !== undefined);
+    const undeclared = supplied.map(([name]) => name).filter((name) => !declared.includes(name));
+    if (undeclared.length > 0) {
+        throw new GatekeeperError('undeclared_argument', `'${binding.name}' does not take ${quoted(undeclared)}, so ${undeclared.length === 1 ? 'it would be' : 'they would be'} ` +
+            `dropped rather than sent. It takes ${declared.length === 0 ? 'no arguments' : quoted(declared)}.`);
+    }
+    for (const name of binding.pathParams) {
+        const value = args[name];
+        if (typeof value !== 'string' || value.length === 0) {
+            throw new GatekeeperError('missing_argument', `'${binding.name}' needs '${name}': it is part of the route (\`${binding.path}\`), so ` +
+                'there is no call to make without it.');
+        }
+    }
+    for (const param of binding.queryParams) {
+        if (param.required && args[param.name] === undefined) {
+            throw new GatekeeperError('missing_argument', `'${binding.name}' needs '${param.name}': the deployment refuses the call without it, ` +
+                'because it says which question is being asked rather than narrowing the answer.');
+        }
+    }
+    return args;
+}
+function quoted(names) {
+    return names.map((name) => `'${name}'`).join(', ');
+}
+//# sourceMappingURL=arguments.js.map

package/dist/arguments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arguments.js","sourceRoot":"","sources":["../src/arguments.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,EAAE;AACF,0FAA0F;AAC1F,wFAAwF;AACxF,gGAAgG;AAChG,mGAAmG;AACnG,iGAAiG;AACjG,iGAAiG;AACjG,mDAAmD;AACnD,EAAE;AACF,iGAAiG;AACjG,iGAAiG;AACjG,8FAA8F;AAC9F,kGAAkG;AAClG,EAAE;AACF,gGAAgG;AAChG,yFAAyF;AACzF,gGAAgG;AAChG,kGAAkG;AAClG,+CAA+C;AAC/C,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,4DAA4D;AAG5D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C,0FAA0F;AAC1F,MAAM,IAAI,GAAG,MAAM,CAAA;AAEnB;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA0B;IAC1D,OAAO;QACL,GAAG,OAAO,CAAC,UAAU;QACrB,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACnC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA0B,EAC1B,IAA6B;IAE7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;IAEhF,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5F,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,IAAI,OAAO,CAAC,IAAI,mBAAmB,MAAM,CAAC,UAAU,CAAC,QAAQ,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,GAAG;YACvH,sCAAsC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CACrG,CAAA;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,IAAI,OAAO,CAAC,IAAI,YAAY,IAAI,iCAAiC,OAAO,CAAC,IAAI,UAAU;gBACrF,sCAAsC,CACzC,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,IAAI,OAAO,CAAC,IAAI,YAAY,KAAK,CAAC,IAAI,iDAAiD;gBACrF,iFAAiF,CACpF,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,MAAM,CAAC,KAAwB;IACtC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpD,CAAC"}

package/dist/capability.d.ts

@@ -1,12 +1,67 @@
 import { RpcTarget } from 'capnweb';
+import type { GatekeeperBinding } from '@cat-factory/gatekeeper-bindings';
 import type { Actor, KeyBroker } from './keys.js';
+import { type HookTopic } from './os/hooks.js';
 import { type CompiledTier } from './policy/compile.js';
 import type { ApprovalCard, GatekeeperState } from './state.js';
+/**
+ * The governance a session's calls pass through, when the door it arrived by has one.
+ *
+ * This is the ONE seam the Cloudflare OS approval queue is threaded onto, and it is one seam
+ * because `invoke` below is one closure: every granted operation, and every reserved method that
+ * reads platform data, funnels through it. A door with no governance passes `undefined` and gets
+ * byte-for-byte the prior behaviour, which is what keeps the `/rpc` surface a promise this package
+ * can go on making.
+ *
+ * The tier policy is the FLOOR underneath it, never a substitute for it: an operation policy never
+ * granted is absent from the object, so governance is only ever asked about calls that exist.
+ */
+export interface SessionGovernance {
+    /**
+     * Authorize a read, BEFORE it is made. Throws to refuse, and a refusal means the upstream call
+     * never happened rather than happening and being withheld.
+     */
+    observe(binding: GatekeeperBinding, args: Record<string, unknown>): Promise<void>;
+    /**
+     * Authorize a read served from this Gatekeeper's own durable projection of delivered data.
+     *
+     * Separate from {@link observe} because there is no binding behind it, not because it is a
+     * lesser read: the cards and run states came from the paired deployment over the webhook, so
+     * showing them is an observation of that deployment.
+     */
+    observeLocal(title: string, detail: string): Promise<void>;
+    /**
+     * Submit a side effect and perform it only if it is approved.
+     *
+     * `perform` is the real call, invoked at most once and only after approval; a refusal throws
+     * instead of returning, so a refused action cannot read as a call that returned nothing.
+     */
+    act<T>(binding: GatekeeperBinding, args: Record<string, unknown>, perform: () => Promise<T>): Promise<T>;
+    /**
+     * Register a callback the workspace will be pushed to, once it has approved the registration.
+     *
+     * On the seam rather than beside it because binding a hook is a request to the SAME queue every
+     * call passes through, and because the door with no queue is exactly the door with no hooks: a
+     * `/rpc` session has nowhere to hand a callback and nothing to authorize the deliveries against,
+     * so it refuses and names the projection it would have been accelerating.
+     */
+    subscribe(topic: HookTopic, callback: unknown): Promise<void>;
+    /**
+     * The session is gone: release everything it was holding on the workspace's behalf.
+     *
+     * Called from the capability's own disposer, which the runtime runs when the last stub pointing
+     * at it is dropped. Without it a session's undecided actions and its hold on the workspace's
+     * queue would both outlive the only thing that could ever settle them.
+     */
+    close(): void;
+}
 export interface SessionDependencies {
     actor: Actor;
     tier: CompiledTier;
     keys: KeyBroker;
     state: DurableObjectStub<GatekeeperState>;
+    /** Present on the OS entrypoint path; absent on `/rpc`, which governs by tier alone. */
+    governance?: SessionGovernance;
 }
 /** What `tier()` answers: enough for an OS Gadget to render who the caller is acting as. */
 export interface TierSummary {

package/dist/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAYnC,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAEjD,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAY,MAAM,YAAY,CAAA;AAoBzE,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,KAAK,CAAA;IACZ,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,SAAS,CAAA;IACf,KAAK,EAAE,iBAAiB,CAAC,eAAe,CAAC,CAAA;CAC1C;AAED,4FAA4F;AAC5F,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,YAAY,CAAA;IAClB,2FAA2F;IAC3F,SAAS,EAAE,OAAO,CAAA;IAClB,0FAA0F;IAC1F,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE;YACP,MAAM,EAAE,MAAM,CAAA;YACd,OAAO,EAAE,MAAM,CAAA;YACf,OAAO,EAAE,MAAM,CAAA;YACf,oGAAoG;YACpG,OAAO,EAAE,OAAO,CAAA;YAChB,MAAM,EAAE,SAAS;gBACf,IAAI,EAAE,MAAM,CAAA;gBACZ,QAAQ,EAAE,OAAO,CAAA;gBACjB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;gBAC3B,MAAM,EAAE,MAAM,CAAA;aACf,EAAE,CAAA;SACJ,EAAE,CAAA;KACJ,EAAE,CAAA;IACH,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,CAwGpE"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AAYzE,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAEjD,OAAO,EAAsC,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AAElF,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAY,MAAM,YAAY,CAAA;AAuBzE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,OAAO,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjF;;;;;;OAMG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1D;;;;;OAKG;IACH,GAAG,CAAC,CAAC,EACH,OAAO,EAAE,iBAAiB,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACxB,OAAO,CAAC,CAAC,CAAC,CAAA;IACb;;;;;;;OAOG;IACH,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7D;;;;;;OAMG;IACH,KAAK,IAAI,IAAI,CAAA;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,KAAK,CAAA;IACZ,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,SAAS,CAAA;IACf,KAAK,EAAE,iBAAiB,CAAC,eAAe,CAAC,CAAA;IACzC,wFAAwF;IACxF,UAAU,CAAC,EAAE,iBAAiB,CAAA;CAC/B;AAED,4FAA4F;AAC5F,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,YAAY,CAAA;IAClB,2FAA2F;IAC3F,SAAS,EAAE,OAAO,CAAA;IAClB,0FAA0F;IAC1F,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE;YACP,MAAM,EAAE,MAAM,CAAA;YACd,OAAO,EAAE,MAAM,CAAA;YACf,OAAO,EAAE,MAAM,CAAA;YACf,oGAAoG;YACpG,OAAO,EAAE,OAAO,CAAA;YAChB,MAAM,EAAE,SAAS;gBACf,IAAI,EAAE,MAAM,CAAA;gBACZ,QAAQ,EAAE,OAAO,CAAA;gBACjB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;gBAC3B,MAAM,EAAE,MAAM,CAAA;aACf,EAAE,CAAA;SACJ,EAAE,CAAA;KACJ,EAAE,CAAA;IACH,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,CAgNpE"}

package/dist/capability.js

@@ -10,10 +10,20 @@
 // Methods live on a per-session PROTOTYPE, never on the instance. Cap'n Web deliberately refuses
 // to serve an RpcTarget's own instance properties (they would leak private internals), so an
 // instance-property capability would be a set of methods no caller can reach.
+//
+// ONE object serves both doors, which looks like it should not work and does. `RpcTarget` is
+// imported from `capnweb` while the Cloudflare OS door returns this across NATIVE Workers RPC,
+// which serializes only `cloudflare:workers` targets. They are the same class: inside workerd
+// capnweb re-exports the runtime's own `RpcTarget` rather than declaring one, which is what lets a
+// session cross either wire. It is stated here because the alternative reading (two incompatible
+// base classes, a `DataCloneError` on the first bind) is the more obvious one.
 import { RpcTarget } from 'capnweb';
 import { answerCard, assertAnswerable, pendingParks, describeStale, } from './approvals.js';
+import { checkedArguments } from './arguments.js';
 import { GatekeeperError, PolicyError } from './errors.js';
 import { applyMask } from './masking.js';
+import { HOOK_TOPICS } from './os/hooks.js';
+import { fenced } from './markdown.js';
 import { describeBinding } from './policy/compile.js';
 /**
  * The methods a capability carries beyond its granted bindings.
@@ -30,7 +40,10 @@ const RESERVED_METHODS = [
     'approvals_list',
     'approvals_inspect',
     'approvals_answer',
+    'approvals_subscribe',
     'runs_watched',
+    'runs_subscribe',
+    'hooks_bound',
 ];
 /**
  * Build the capability for one connected actor.
@@ -49,17 +62,56 @@ export function buildCapability(deps) {
                 'method in capability.ts; a granted operation must never be shadowed by one.');
         }
     }
-    const invoke = async (name, args) => {
+    const invoke = async (name, bag) => {
         const binding = granted.get(name);
         if (binding === undefined) {
             throw new GatekeeperError('binding_not_granted', `Tier '${tier.name}' does not grant '${name}'.`);
         }
-        const result = await deps.keys.run(deps.actor, tier.keyScope, (client) => binding.invoke(client, args));
-        return applyMask(result, tier.mask);
+        // Ahead of the key broker and ahead of the queue, because a call that cannot succeed should
+        // mint no credential and spend no approval. An argument the operation does not declare is a
+        // REFUSAL rather than a drop: forwarded silently, it is a filter nobody applied and an answer
+        // that looks exactly like the right one.
+        const args = checkedArguments(binding, bag);
+        const perform = async () => await deps.keys.run(deps.actor, tier.keyScope, (client) => binding.invoke(client, args));
+        const governance = deps.governance;
+        if (governance === undefined)
+            return applyMask(await perform(), tier.mask);
+        // A read is authorized BEFORE it is performed. The contract permits the other order (the
+        // result may be in hand when the authorizer is asked), and it buys nothing here while costing
+        // something real. It buys nothing because the description is DERIVED from the operation table:
+        // the route, the scope floor, the argument bag and whether the read serves captured agent text
+        // are all known before the call, and handing an approver the rows themselves would put the
+        // very bytes `prohibitAllSharing` exists to withhold into an approval prompt. It costs
+        // something because performing first means a refused read has already been made: a real
+        // request, with a key minted for the occasion, pulling a telemetry sink's captured prompts into
+        // this Worker in order to ask whether the workspace wanted them read.
+        if (binding.readOnly) {
+            await governance.observe(binding, args);
+            return applyMask(await perform(), tier.mask);
+        }
+        return applyMask(await governance.act(binding, args, perform), tier.mask);
+    };
+    /**
+     * Authorize a read this Gatekeeper serves from its OWN durable projection.
+     *
+     * The cards and the run states were delivered by the platform, so serving them is an observation
+     * of the paired deployment exactly as a live read is; that the bytes are local is an
+     * implementation detail of how they arrived. Governing them keeps "everything the session shows
+     * you passed the authorizer" true, which is the property the OS is relying on.
+     */
+    const observeLocal = async (title, detail) => {
+        await deps.governance?.observeLocal(title, detail);
     };
     class Capability extends RpcTarget {
     }
     const proto = Capability.prototype;
+    // The end of the session, in the one place the runtime signals it. Both doors dispose an
+    // `RpcTarget` whose stubs have all been dropped, and both call this on the way; a `/rpc` session
+    // brings no governance and so has nothing to release. It is keyed by SYMBOL, which is also why
+    // it cannot collide with a binding or be reached over RPC as a method.
+    proto[Symbol.dispose] = () => {
+        deps.governance?.close();
+    };
     for (const binding of tier.granted) {
         proto[binding.name] = (args = {}) => invoke(binding.name, args);
     }
@@ -76,17 +128,59 @@ export function buildCapability(deps) {
     // `withheld()` is the degrade-loudly half: an agent that cannot tell "your policy hides this"
     // from "this deployment does not have it" reports the wrong one to whoever has to fix it.
     proto.withheld = () => tier.withheld;
-    proto.approvals_list = () => deps.state.listCards();
+    /**
+     * Bind a callback for one topic, or refuse in the terms of the door the caller came in by.
+     *
+     * The refusal is the interesting half. `/rpc` brings no approval queue, so there is nothing to
+     * register a hook with and nothing to authorize its deliveries against; answering with a
+     * silently-never-fires registration would be the worst available outcome, and answering
+     * "unsupported" without naming `approvals_list()` would send a caller looking for a feature
+     * rather than for the two methods that already answer the same question.
+     */
+    const subscribe = async (topic, callback) => {
+        const governance = deps.governance;
+        if (governance === undefined) {
+            throw new GatekeeperError('hooks_unavailable', `This session was opened on a door with no approval queue, so ${HOOK_TOPICS[topic].sessionMethod}() ` +
+                'has nowhere to register a callback and no way to authorize what it would push. Read ' +
+                '`approvals_list()` and `runs_watched()` instead: they carry exactly what a hook pushes.');
+        }
+        await governance.subscribe(topic, callback);
+    };
+    proto.approvals_subscribe = async (callback) => subscribe('approval_card', callback);
+    proto.runs_subscribe = async (callback) => subscribe('run_event', callback);
+    // What this account has enabled, and whether each one's live half survived. A hook that stopped
+    // firing is otherwise indistinguishable from a deployment where nothing happened, which is the
+    // reading a workspace must never be left to make on its own.
+    proto.hooks_bound = async () => {
+        const hooks = await deps.state.listHooks(deps.actor.id);
+        await observeLocal('List the hooks bound for this account', `${hooks.length} hook(s) this workspace enabled, with what each has been pushed and what it missed.`);
+        return hooks;
+    };
+    proto.approvals_list = async () => {
+        const cards = await deps.state.listCards();
+        await observeLocal('List the open approval cards', `${cards.length} card(s) the paired deployment raised and delivered to this Gatekeeper.`);
+        return cards;
+    };
     // The lifecycle projection the `run.*` subscription feeds. Without it those deliveries would be
     // verified, deduped and dropped, and a status Gadget would be back to polling `tasks_get_run`
     // for a transition the platform already pushed.
-    proto.runs_watched = () => deps.state.listRunStates();
+    proto.runs_watched = async () => {
+        // Annotated rather than inferred: the Durable Object stub's serialization type narrows a
+        // `Record<string, unknown>` field to `never`, so the inferred result carries no `length`.
+        const runs = await deps.state.listRunStates();
+        await observeLocal('List the watched runs', `${runs.length} run(s) the paired deployment has pushed lifecycle events for.`);
+        return runs;
+    };
     proto.approvals_inspect = async (cardId) => {
         const card = await deps.state.getCard(cardId);
         if (card === null) {
             throw new GatekeeperError('card_not_found', `No approval card '${cardId}'. It may have been raised against a different paired ` +
                 'workspace, or predate this Gatekeeper.');
         }
+        // The card's own title is agent- and user-authored: it came off a task somebody filed, rode
+        // the delivery in, and is about to be interpolated into Markdown a person reads in order to
+        // decide something. It gets the same fence the argument bag gets, for the same reason.
+        await observeLocal(`Inspect approval card ${cardId}`, `The card raised for run ${card.runId}, titled:\n\n${fenced(card.title, '')}`);
         const list = (await invoke('decisions_list', { runId: card.runId }));
         const parks = pendingParks(list).map((park) => ({
             kind: park.kind,

package/dist/capability.js.map

@@ -1 +1 @@
-{"version":3,"file":"capability.js","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,gGAAgG;AAChG,8FAA8F;AAC9F,+FAA+F;AAC/F,4DAA4D;AAC5D,EAAE;AACF,iGAAiG;AACjG,6FAA6F;AAC7F,8EAA8E;AAE9E,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAEnC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,aAAa,GAId,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAA;AAGxE;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG;IACvB,MAAM;IACN,UAAU;IACV,UAAU;IACV,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,cAAc;CACN,CAAA;AAoDV;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAAyB;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAA;IACrB,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CACvD,CAAA;IAED,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,WAAW,CACnB,YAAY,QAAQ,oEAAoE;gBACtF,6EAA6E,CAChF,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAE,IAA6B,EAAoB,EAAE;QACrF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,SAAS,IAAI,CAAC,IAAI,qBAAqB,IAAI,IAAI,CAChD,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CACvE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAC7B,CAAA;QACD,OAAO,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC,CAAA;IAED,MAAM,UAAW,SAAQ,SAAS;KAAG;IACrC,MAAM,KAAK,GAAG,UAAU,CAAC,SAA+C,CAAA;IAExE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAA4B,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC1F,CAAC;IAED,KAAK,CAAC,IAAI,GAAG,GAAgB,EAAE,CAAC,CAAC;QAC/B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;QACtB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAA;IAEF,+FAA+F;IAC/F,2FAA2F;IAC3F,gFAAgF;IAChF,KAAK,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAExD,8FAA8F;IAC9F,0FAA0F;IAC1F,KAAK,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAA;IAEpC,KAAK,CAAC,cAAc,GAAG,GAA4B,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAA;IAE5E,gGAAgG;IAChG,8FAA8F;IAC9F,gDAAgD;IAChD,KAAK,CAAC,YAAY,GAAG,GAAwB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAA;IAE1E,KAAK,CAAC,iBAAiB,GAAG,KAAK,EAAE,MAAc,EAA2B,EAAE;QAC1E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC7C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,qBAAqB,MAAM,wDAAwD;gBACjF,wCAAwC,CAC3C,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAsB,CAAA;QACzF,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACjC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;gBAClC,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;SACJ,CAAC,CAAC,CAAA;QACH,OAAO;YACL,IAAI;YACJ,SAAS,EAAE,IAAI;YACf,KAAK;YACL,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAA;IACH,CAAC,CAAA;IAED,KAAK,CAAC,gBAAgB,GAAG,KAAK,EAAE,MAAc,EAAE,KAAkB,EAA0B,EAAE;QAC5F,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;QACvE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACrD,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,8FAA8F;QAC9F,wFAAwF;QACxF,0CAA0C;QAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACvF,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IAED,OAAO,IAAI,UAAU,EAAE,CAAA;AACzB,CAAC"}
+{"version":3,"file":"capability.js","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,gGAAgG;AAChG,8FAA8F;AAC9F,+FAA+F;AAC/F,4DAA4D;AAC5D,EAAE;AACF,iGAAiG;AACjG,6FAA6F;AAC7F,8EAA8E;AAC9E,EAAE;AACF,6FAA6F;AAC7F,+FAA+F;AAC/F,8FAA8F;AAC9F,mGAAmG;AACnG,iGAAiG;AACjG,+EAA+E;AAE/E,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAEnC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,aAAa,GAId,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,WAAW,EAAyC,MAAM,eAAe,CAAA;AAClF,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAA;AAGxE;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG;IACvB,MAAM;IACN,UAAU;IACV,UAAU;IACV,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,qBAAqB;IACrB,cAAc;IACd,gBAAgB;IAChB,aAAa;CACL,CAAA;AA8GV;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAAyB;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAA;IACrB,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CACvD,CAAA;IAED,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,WAAW,CACnB,YAAY,QAAQ,oEAAoE;gBACtF,6EAA6E,CAChF,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAE,GAA4B,EAAoB,EAAE;QACpF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,SAAS,IAAI,CAAC,IAAI,qBAAqB,IAAI,IAAI,CAChD,CAAA;QACH,CAAC;QACD,4FAA4F;QAC5F,4FAA4F;QAC5F,8FAA8F;QAC9F,yCAAyC;QACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CACzB,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAE1F,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAClC,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC,MAAM,OAAO,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAE1E,yFAAyF;QACzF,8FAA8F;QAC9F,+FAA+F;QAC/F,+FAA+F;QAC/F,2FAA2F;QAC3F,uFAAuF;QACvF,wFAAwF;QACxF,gGAAgG;QAChG,sEAAsE;QACtE,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACvC,OAAO,SAAS,CAAC,MAAM,OAAO,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9C,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3E,CAAC,CAAA;IAED;;;;;;;OAOG;IACH,MAAM,YAAY,GAAG,KAAK,EAAE,KAAa,EAAE,MAAc,EAAiB,EAAE;QAC1E,MAAM,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACpD,CAAC,CAAA;IAED,MAAM,UAAW,SAAQ,SAAS;KAAG;IACrC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAwD,CAAA;IAEjF,yFAAyF;IACzF,iGAAiG;IACjG,+FAA+F;IAC/F,uEAAuE;IACvE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,GAAS,EAAE;QACjC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAA;IAC1B,CAAC,CAAA;IAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAA4B,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC1F,CAAC;IAED,KAAK,CAAC,IAAI,GAAG,GAAgB,EAAE,CAAC,CAAC;QAC/B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;QACtB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAA;IAEF,+FAA+F;IAC/F,2FAA2F;IAC3F,gFAAgF;IAChF,KAAK,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAExD,8FAA8F;IAC9F,0FAA0F;IAC1F,KAAK,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAA;IAEpC;;;;;;;;OAQG;IACH,MAAM,SAAS,GAAG,KAAK,EAAE,KAAgB,EAAE,QAAiB,EAAiB,EAAE;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAClC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,gEAAgE,WAAW,CAAC,KAAK,CAAC,CAAC,aAAa,KAAK;gBACnG,sFAAsF;gBACtF,yFAAyF,CAC5F,CAAA;QACH,CAAC;QACD,MAAM,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC7C,CAAC,CAAA;IAED,KAAK,CAAC,mBAAmB,GAAG,KAAK,EAAE,QAAiB,EAAiB,EAAE,CACrE,SAAS,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAA;IAEtC,KAAK,CAAC,cAAc,GAAG,KAAK,EAAE,QAAiB,EAAiB,EAAE,CAChE,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAElC,gGAAgG;IAChG,+FAA+F;IAC/F,6DAA6D;IAC7D,KAAK,CAAC,WAAW,GAAG,KAAK,IAAiC,EAAE;QAC1D,MAAM,KAAK,GAAuB,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC3E,MAAM,YAAY,CAChB,uCAAuC,EACvC,GAAG,KAAK,CAAC,MAAM,qFAAqF,CACrG,CAAA;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,KAAK,CAAC,cAAc,GAAG,KAAK,IAA6B,EAAE;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAA;QAC1C,MAAM,YAAY,CAChB,8BAA8B,EAC9B,GAAG,KAAK,CAAC,MAAM,yEAAyE,CACzF,CAAA;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,gGAAgG;IAChG,8FAA8F;IAC9F,gDAAgD;IAChD,KAAK,CAAC,YAAY,GAAG,KAAK,IAAyB,EAAE;QACnD,yFAAyF;QACzF,0FAA0F;QAC1F,MAAM,IAAI,GAAe,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAA;QACzD,MAAM,YAAY,CAChB,uBAAuB,EACvB,GAAG,IAAI,CAAC,MAAM,gEAAgE,CAC/E,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,KAAK,CAAC,iBAAiB,GAAG,KAAK,EAAE,MAAc,EAA2B,EAAE;QAC1E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC7C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,eAAe,CACvB,gBAAgB,EAChB,qBAAqB,MAAM,wDAAwD;gBACjF,wCAAwC,CAC3C,CAAA;QACH,CAAC;QACD,4FAA4F;QAC5F,4FAA4F;QAC5F,uFAAuF;QACvF,MAAM,YAAY,CAChB,yBAAyB,MAAM,EAAE,EACjC,2BAA2B,IAAI,CAAC,KAAK,gBAAgB,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAC9E,CAAA;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAsB,CAAA;QACzF,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACjC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;gBAClC,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;SACJ,CAAC,CAAC,CAAA;QACH,OAAO;YACL,IAAI;YACJ,SAAS,EAAE,IAAI;YACf,KAAK;YACL,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAA;IACH,CAAC,CAAA;IAED,KAAK,CAAC,gBAAgB,GAAG,KAAK,EAAE,MAAc,EAAE,KAAkB,EAA0B,EAAE;QAC5F,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;QACvE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACrD,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,8FAA8F;QAC9F,wFAAwF;QACxF,0CAA0C;QAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACvF,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IAED,OAAO,IAAI,UAAU,EAAE,CAAA;AACzB,CAAC"}

package/dist/env.d.ts

@@ -39,6 +39,16 @@ export declare function requireVar(env: GatekeeperEnv, binding: StringBinding):
  * reads as a healthy Gatekeeper.
  */
 export declare function missingBindings(env: GatekeeperEnv): Binding[];
+/**
+ * The durable object holding everything this pairing knows, addressed the ONE way.
+ *
+ * Named for the deployment it is paired with, so pointing this Worker at a different cat-factory
+ * gets a different object rather than inheriting the previous one's cards, hooks and minted keys.
+ * It is a function rather than a line inside `Gatekeeper` because the hook controller reaches the
+ * same object without assembling a Gatekeeper at all, and a second spelling of the name would be
+ * a second object holding half the state.
+ */
+export declare function stateFor(env: GatekeeperEnv): DurableObjectStub<GatekeeperState>;
 /** The refusal an operator can act on: every unset binding, each with how to set it. */
 export declare function describeMissingBindings(missing: readonly Binding[]): string;
 export {};

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,oBAAoB,EAAE,MAAM,CAAA;IAC5B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAA;IAClB,kGAAkG;IAClG,gBAAgB,EAAE,MAAM,CAAA;IACxB,yFAAyF;IACzF,cAAc,EAAE,MAAM,CAAA;IACtB,uFAAuF;IACvF,eAAe,EAAE,MAAM,CAAA;IACvB,KAAK,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAA;CAC/C;AAED,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,QAAQ,GAAG,gBAAgB,CAAA;AAsB7D,KAAK,OAAO,GAAG,MAAM,aAAa,CAAA;AAgBlC,2DAA2D;AAC3D,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IAEzB,YAAY,OAAO,EAAE,OAAO,EAI3B;CACF;AAED,KAAK,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AAE9C,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAI7E;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,EAAE,CAG7D;AAYD,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,CAG3E"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,oBAAoB,EAAE,MAAM,CAAA;IAC5B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAA;IAClB,kGAAkG;IAClG,gBAAgB,EAAE,MAAM,CAAA;IACxB,yFAAyF;IACzF,cAAc,EAAE,MAAM,CAAA;IACtB,uFAAuF;IACvF,eAAe,EAAE,MAAM,CAAA;IACvB,KAAK,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAA;CAC/C;AAED,4CAA4C;AAC5C,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,QAAQ,GAAG,gBAAgB,CAAA;AAsB7D,KAAK,OAAO,GAAG,MAAM,aAAa,CAAA;AAgBlC,2DAA2D;AAC3D,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IAEzB,YAAY,OAAO,EAAE,OAAO,EAI3B;CACF;AAED,KAAK,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AAE9C,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAI7E;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,EAAE,CAG7D;AAYD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAE/E;AAED,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,CAG3E"}

package/dist/env.js

@@ -82,6 +82,18 @@ function isSet(env, binding) {
     const value = env[binding];
     return typeof value === 'string' && value.length > 0;
 }
+/**
+ * The durable object holding everything this pairing knows, addressed the ONE way.
+ *
+ * Named for the deployment it is paired with, so pointing this Worker at a different cat-factory
+ * gets a different object rather than inheriting the previous one's cards, hooks and minted keys.
+ * It is a function rather than a line inside `Gatekeeper` because the hook controller reaches the
+ * same object without assembling a Gatekeeper at all, and a second spelling of the name would be
+ * a second object holding half the state.
+ */
+export function stateFor(env) {
+    return env.STATE.get(env.STATE.idFromName(requireVar(env, 'CAT_FACTORY_BASE_URL')));
+}
 /** The refusal an operator can act on: every unset binding, each with how to set it. */
 export function describeMissingBindings(missing) {
     const remedies = missing.map((binding) => `${binding} (${howToSet(binding)})`).join('; ');

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,mDAAmD;AACnD,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,8FAA8F;AAC9F,6FAA6F;AAC7F,2FAA2F;AAC3F,mDAAmD;AACnD,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,+EAA+E;AA0B/E;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAG;IACpB,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE,KAAK;IACjB,UAAU,EAAE,KAAK;IACjB,gBAAgB,EAAE,QAAQ;IAC1B,cAAc,EAAE,QAAQ;IACxB,eAAe,EAAE,QAAQ;IACzB,KAAK,EAAE,gBAAgB;CACoC,CAAA;AAI7D,mFAAmF;AACnF,SAAS,QAAQ,CAAC,OAAgB;IAChC,gGAAgG;IAChG,2DAA2D;IAC3D,QAAQ,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,KAAK,KAAK;YACR,OAAO,kCAAkC,CAAA;QAC3C,KAAK,QAAQ;YACX,OAAO,qCAAqC,OAAO,4BAA4B,CAAA;QACjF,KAAK,gBAAgB;YACnB,OAAO,oFAAoF,CAAA;IAC/F,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,OAAO,CAAS;IAEzB,YAAY,OAAgB;QAC1B,KAAK,CAAC,GAAG,OAAO,0CAA0C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/E,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF;AAID,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,GAAkB,EAAE,OAAsB;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAA;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,CAAA;IACnF,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,GAAkB;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAc,CAAA;IACxD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,SAAS,KAAK,CAAC,GAAkB,EAAE,OAAgB;IACjD,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,gBAAgB,EAAE,CAAC;QAChD,sFAAsF;QACtF,+FAA+F;QAC/F,OAAO,OAAO,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,UAAU,CAAA;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAA;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;AACtD,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzF,OAAO,gFAAgF,QAAQ,GAAG,CAAA;AACpG,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,mDAAmD;AACnD,EAAE;AACF,kGAAkG;AAClG,kGAAkG;AAClG,8FAA8F;AAC9F,6FAA6F;AAC7F,2FAA2F;AAC3F,mDAAmD;AACnD,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,+EAA+E;AA0B/E;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAG;IACpB,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE,KAAK;IACjB,UAAU,EAAE,KAAK;IACjB,gBAAgB,EAAE,QAAQ;IAC1B,cAAc,EAAE,QAAQ;IACxB,eAAe,EAAE,QAAQ;IACzB,KAAK,EAAE,gBAAgB;CACoC,CAAA;AAI7D,mFAAmF;AACnF,SAAS,QAAQ,CAAC,OAAgB;IAChC,gGAAgG;IAChG,2DAA2D;IAC3D,QAAQ,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,KAAK,KAAK;YACR,OAAO,kCAAkC,CAAA;QAC3C,KAAK,QAAQ;YACX,OAAO,qCAAqC,OAAO,4BAA4B,CAAA;QACjF,KAAK,gBAAgB;YACnB,OAAO,oFAAoF,CAAA;IAC/F,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,OAAO,CAAS;IAEzB,YAAY,OAAgB;QAC1B,KAAK,CAAC,GAAG,OAAO,0CAA0C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/E,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF;AAID,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,GAAkB,EAAE,OAAsB;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAA;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,CAAA;IACnF,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,GAAkB;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAc,CAAA;IACxD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,SAAS,KAAK,CAAC,GAAkB,EAAE,OAAgB;IACjD,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,gBAAgB,EAAE,CAAC;QAChD,sFAAsF;QACtF,+FAA+F;QAC/F,OAAO,OAAO,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,UAAU,CAAA;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAA;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAkB;IACzC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAA;AACrF,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzF,OAAO,gFAAgF,QAAQ,GAAG,CAAA;AACpG,CAAC"}

package/dist/errors.d.ts

@@ -13,10 +13,41 @@ export type GatekeeperReason = 'unknown_actor' | 'unknown_tier' | 'binding_not_g
 /** The platform sent a parked decision without the id every answer to it addresses. */
  | 'malformed_decision'
 /** A minted credential was refused upstream and re-minting it was refused too. */
- | 'credential_rejected';
+ | 'credential_rejected'
+/** The workspace decided against a submitted action, so it was never performed. */
+ | 'action_rejected'
+/** A decision named an action id this resource is not holding: already settled, or not ours. */
+ | 'unknown_action'
+/** The session that submitted an action went away before the workspace decided it. */
+ | 'session_ended'
+/** The URL the workspace asked for is not one this Gatekeeper serves. */
+ | 'no_such_resource'
+/** Sharing an observation onward was refused: the observer could not read all of it directly. */
+ | 'sharing_refused'
+/** Sharing was refused because the observer could not be identified at all. */
+ | 'sharing_unverifiable'
+/** The call carries an argument the operation does not declare, so it would have been dropped. */
+ | 'undeclared_argument'
+/** The call omits an argument the operation requires. */
+ | 'missing_argument'
+/** This door serves no hooks: it has no approval queue to register one with. */
+ | 'hooks_unavailable'
+/** The workspace's own side did not take a hook binding, and said why. */
+ | 'hook_bind_refused'
+/** The deployment's entry module does not export something the OS object model needs. */
+ | 'missing_export';
 /** A refusal the caller (or the OS deployment operating it) acts on. */
 export declare class GatekeeperError extends Error {
     readonly reason: GatekeeperReason;
     constructor(reason: GatekeeperReason, message: string);
 }
+/**
+ * A failure as a refusal or a record carries it: one line, never an object nothing can render.
+ *
+ * Here rather than beside each caller because three of them (a hook push, a bind the workspace did
+ * not take, a verifier that could not be questioned) fold a cause into prose a person reads, and
+ * three copies of the same two lines is how they drift into disagreeing about what an
+ * `AggregateError` or a thrown string looks like.
+ */
+export declare function describeError(error: unknown): string;
 //# sourceMappingURL=errors.d.ts.map