@cat-factory/gatekeeper-worker 0.4.3 → 0.6.0

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAcA,uEAAuE;AACvE,qBAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,mEAAmE;AACnE,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,cAAc,GACd,qBAAqB,GACrB,gBAAgB,GAChB,uBAAuB,GACvB,oBAAoB;AACtB,mFAAmF;GACjF,gBAAgB;AAClB,sEAAsE;GACpE,cAAc;AAChB,0EAA0E;GACxE,gBAAgB;AAClB,uFAAuF;GACrF,oBAAoB;AACtB,kFAAkF;GAChF,qBAAqB,CAAA;AAEzB,wEAAwE;AACxE,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IAEjC,YAAY,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAIpD;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAcA,uEAAuE;AACvE,qBAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,mEAAmE;AACnE,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,cAAc,GACd,qBAAqB,GACrB,gBAAgB,GAChB,uBAAuB,GACvB,oBAAoB;AACtB,mFAAmF;GACjF,gBAAgB;AAClB,sEAAsE;GACpE,cAAc;AAChB,0EAA0E;GACxE,gBAAgB;AAClB,uFAAuF;GACrF,oBAAoB;AACtB,kFAAkF;GAChF,qBAAqB;AACvB,mFAAmF;GACjF,iBAAiB;AACnB,gGAAgG;GAC9F,gBAAgB;AAClB,sFAAsF;GACpF,eAAe;AACjB,yEAAyE;GACvE,kBAAkB;AACpB,iGAAiG;GAC/F,iBAAiB;AACnB,+EAA+E;GAC7E,sBAAsB;AACxB,kGAAkG;GAChG,qBAAqB;AACvB,yDAAyD;GACvD,kBAAkB;AACpB,gFAAgF;GAC9E,mBAAmB;AACrB,0EAA0E;GACxE,mBAAmB;AACrB,yFAAyF;GACvF,gBAAgB,CAAA;AAEpB,wEAAwE;AACxE,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IAEjC,YAAY,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAIpD;CACF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD"}

package/dist/errors.js

@@ -27,4 +27,15 @@ export class GatekeeperError extends Error {
         this.reason = reason;
     }
 }
+/**
+ * A failure as a refusal or a record carries it: one line, never an object nothing can render.
+ *
+ * Here rather than beside each caller because three of them (a hook push, a bind the workspace did
+ * not take, a verifier that could not be questioned) fold a cause into prose a person reads, and
+ * three copies of the same two lines is how they drift into disagreeing about what an
+ * `AggregateError` or a thrown string looks like.
+ */
+export function describeError(error) {
+    return error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+}
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,EAAE;AACF,4FAA4F;AAC5F,+FAA+F;AAC/F,6FAA6F;AAC7F,mGAAmG;AACnG,mGAAmG;AACnG,2EAA2E;AAC3E,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,iGAAiG;AACjG,oEAAoE;AAEpE,uEAAuE;AACvE,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;IAC3B,CAAC;CACF;AAqBD,wEAAwE;AACxE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,MAAM,CAAkB;IAEjC,YAAY,MAAwB,EAAE,OAAe;QACnD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,EAAE;AACF,4FAA4F;AAC5F,+FAA+F;AAC/F,6FAA6F;AAC7F,mGAAmG;AACnG,mGAAmG;AACnG,2EAA2E;AAC3E,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,iGAAiG;AACjG,oEAAoE;AAEpE,uEAAuE;AACvE,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;IAC3B,CAAC;CACF;AA2CD,wEAAwE;AACxE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,MAAM,CAAkB;IAEjC,YAAY,MAAwB,EAAE,OAAe;QACnD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACnF,CAAC"}

package/dist/gatekeeper.d.ts

@@ -1,11 +1,28 @@
+import { type SessionGovernance } from './capability.js';
 import { type GatekeeperEnv } from './env.js';
 import { type Actor } from './keys.js';
-import { type GatekeeperPolicy } from './policy/compile.js';
+import type { HookTopic } from './os/hooks.js';
+import { type CompiledTier, type GatekeeperPolicy } from './policy/compile.js';
 import { type VerificationResult } from './webhook/signature.js';
 /** Why a delivery was refused, drawn from the verifier so the two cannot drift. */
 type RejectionReason = Extract<VerificationResult, {
     ok: false;
 }>['reason'];
+/**
+ * What the receiver handed to the hook fan-out, which is DISPATCH and never delivery.
+ *
+ * The distinction is the whole reason this shape changed. The fan-out runs behind the
+ * acknowledgement, so at the moment this is reported no push has been made and any count of them
+ * would be a zero standing in for a number nobody has yet: the one reading a receiver must never
+ * offer, because it is indistinguishable from a delivery no hook took. What each push DID land on
+ * its own registration's counters, which `hooks_bound()` publishes.
+ */
+export interface HookDispatchReceipt {
+    /** How many payloads this delivery produced. Zero when no topic covers it. */
+    pushes: number;
+    /** The distinct topics they carry, so the platform's delivery log names what was dispatched. */
+    topics: HookTopic[];
+}
 /** What taking delivery of one webhook POST did. */
 export type DeliveryOutcome = {
     handled: 'rejected';
@@ -19,6 +36,7 @@ export type DeliveryOutcome = {
     handled: 'accepted';
     deliveryId: string;
     effect: 'opened' | 'superseded' | 'run-event' | 'none';
+    hooks: HookDispatchReceipt;
 };
 export declare class Gatekeeper {
     #private;
@@ -40,7 +58,60 @@ export declare class Gatekeeper {
      * The tier is resolved from the Gatekeeper's OWN policy, never from anything the caller sent:
      * an agent that could name its tier would be its own authorization.
      */
-    capabilityFor(actor: Actor): import("capnweb").RpcTarget;
+    capabilityFor(actor: Actor, governance?: SessionGovernance): import("capnweb").RpcTarget;
+    /**
+     * The capability for an auto-provisioned Cloudflare OS account.
+     *
+     * A sibling of `capabilityFor` rather than a flag on it, because the two doors resolve a tier
+     * from different halves of the policy: `/rpc` names a person the OS asserts, and an account was
+     * minted here with no name at all. Everything after the resolution is the one implementation.
+     */
+    capabilityForAccount(accountId: string, governance: SessionGovernance): import("capnweb").RpcTarget;
+    /**
+     * The compiled tier an actor holds, or a refusal naming what an operator has to change.
+     *
+     * Exposed beside `capabilityFor` because the OS object model asks about a tier without building
+     * a session from it: the resource's TypeScript types and its auto-approvable action kinds are
+     * both projections of the tier, and both are read before any session exists.
+     */
+    tierFor(actorId: string): CompiledTier;
+    /**
+     * The tier an auto-provisioned Cloudflare OS account holds, or a refusal naming the knob.
+     *
+     * Separate from {@link tierFor} because the refusal has to name the right thing: a deployment
+     * that has not opted into OS discovery has not misconfigured anything, and telling its operator
+     * to add an actor to `grants` would be telling them to write a line for an id that did not exist
+     * when they were reading.
+     */
+    tierForAccount(accountId: string): CompiledTier;
+    /**
+     * The tier EVERY auto-provisioned account falls to, asked without an account.
+     *
+     * The vendor is questioned before any account exists (its published session types are the ones a
+     * new account will get), and that question has an answer of its own. Asking it by minting a
+     * throwaway id would resolve the same tier and, when there is none, refuse by naming an
+     * `acct_…` that appears nowhere in the operator's policy.
+     */
+    tierForNewAccount(): CompiledTier;
+    /**
+     * The tier NAME a policy nominates for auto-provisioned accounts, or `null`.
+     *
+     * The raw knob rather than the compiled tier, because the one caller that wants it is `/health`,
+     * reporting whether this deployment has opted into Cloudflare OS discovery at all. A refusal
+     * would be the wrong shape there: not having opted in is a state, not a fault.
+     */
+    get autoProvisionedTierName(): string | null;
+    /**
+     * Whether this deployment minted the named account.
+     *
+     * Asked by the ONE caller that is handed an account id from outside (`addObserver`, over an
+     * observer's verifier) and has to resolve a tier for it. Every other account id in this package
+     * arrives on `ctx.props` of a stub this Gatekeeper handed the workspace, so it was minted here
+     * by construction and asking again would be a lookup with no question behind it.
+     */
+    recognizesAccount(accountId: string): Promise<boolean>;
+    /** The origin of the cat-factory deployment this Gatekeeper is paired with. */
+    get deployment(): string;
     /**
      * Retire an actor: revoke every key this Gatekeeper minted for them, upstream and here.
      *
@@ -71,8 +142,12 @@ export declare class Gatekeeper {
      * Deduping in a call of its own would be worse than useless: a marker committed before the card
      * write turns a failed write into a `duplicate` on the platform's retry, so the approval never
      * reaches the inbox and nothing anywhere reports that it did not.
+     *
+     * `defer` is how the fan-out is kept OFF that path, and it is a parameter rather than something
+     * read here because the lifetime being extended is the Worker invocation's, which only the
+     * handler holds.
      */
-    takeDelivery(request: Request, now: number): Promise<DeliveryOutcome>;
+    takeDelivery(request: Request, now: number, defer: (work: Promise<unknown>) => void): Promise<DeliveryOutcome>;
 }
 export {};
 //# sourceMappingURL=gatekeeper.d.ts.map

package/dist/gatekeeper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gatekeeper.d.ts","sourceRoot":"","sources":["../src/gatekeeper.ts"],"names":[],"mappings":"AAYA,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,UAAU,CAAA;AAEzD,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,WAAW,CAAA;AACjD,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAKhF,mFAAmF;AACnF,KAAK,eAAe,GAAG,OAAO,CAAC,kBAAkB,EAAE;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC,QAAQ,CAAC,CAAA;AAE3E,oDAAoD;AACpD,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GAChD;IAAE,OAAO,EAAE,aAAa,CAAA;CAAE,GAC1B;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC5C;IACE,OAAO,EAAE,UAAU,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,QAAQ,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,CAAA;CACvD,CAAA;AAEL,qBAAa,UAAU;;IAMrB,OAAO,eAiBN;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAEtE;IAED,mEAAmE;IACnE,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAIxC;IAED;;;;;OAKG;IACH,aAAa,CAAC,KAAK,EAAE,KAAK,+BAUzB;IAED;;;;;OAKG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAEjF;IAED;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CA2B1D;IAED;;;;;;;;;OASG;IACG,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA0B1E;CACF"}
+{"version":3,"file":"gatekeeper.d.ts","sourceRoot":"","sources":["../src/gatekeeper.ts"],"names":[],"mappings":"AAWA,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,UAAU,CAAA;AAEnE,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,WAAW,CAAA;AACjD,OAAO,KAAK,EAAkB,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,EAML,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAgBhF,mFAAmF;AACnF,KAAK,eAAe,GAAG,OAAO,CAAC,kBAAkB,EAAE;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC,QAAQ,CAAC,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAA;IACd,gGAAgG;IAChG,MAAM,EAAE,SAAS,EAAE,CAAA;CACpB;AAED,oDAAoD;AACpD,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GAChD;IAAE,OAAO,EAAE,aAAa,CAAA;CAAE,GAC1B;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC5C;IACE,OAAO,EAAE,UAAU,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,QAAQ,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,CAAA;IACtD,KAAK,EAAE,mBAAmB,CAAA;CAC3B,CAAA;AAEL,qBAAa,UAAU;;IAMrB,OAAO,eAcN;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAEtE;IAED,mEAAmE;IACnE,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAIxC;IAED;;;;;OAKG;IACH,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,iBAAiB,+BAEzD;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,+BAMpE;IAYD;;;;;;OAMG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAUrC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,CAU9C;IAED;;;;;;;OAOG;IACH,iBAAiB,IAAI,YAAY,CAUhC;IAED;;;;;;OAMG;IACH,IAAI,uBAAuB,IAAI,MAAM,GAAG,IAAI,CAE3C;IAED;;;;;;;OAOG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3D;IAED,+EAA+E;IAC/E,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;;;;;OAKG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAEjF;IAED;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CA2B1D;IAED;;;;;;;;;;;;;OAaG;IACG,YAAY,CAChB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,GACtC,OAAO,CAAC,eAAe,CAAC,CAoC1B;CACF"}

package/dist/gatekeeper.js

@@ -9,14 +9,23 @@
 // forking it.
 import { CatFactoryClient } from '@cat-factory/sdk';
 import { buildCapability } from './capability.js';
-import { requireVar } from './env.js';
+import { requireVar, stateFor } from './env.js';
 import { GatekeeperError } from './errors.js';
 import { KeyBroker } from './keys.js';
-import { compilePolicy, tierForActor, } from './policy/compile.js';
+import { autoProvisionedTier, compilePolicy, tierForAccount, tierForActor, } from './policy/compile.js';
 import { cardEffectOf, readDelivery, SUBSCRIBED_CARD_TYPES } from './webhook/delivery.js';
 import { verifyDelivery } from './webhook/signature.js';
 /** Identifies this integration in the deployment's logs, beside the SDK's own version. */
 const USER_AGENT = 'cat-factory-gatekeeper';
+/**
+ * The one remedy both auto-provisioning refusals end on.
+ *
+ * Stated once because the two refusals differ only in what they could not do (open a session for a
+ * named account, describe the session a new one would get) and never in the fix.
+ */
+const AUTO_PROVISIONED_TIER_REMEDY = "Name a tier as the policy's autoProvisionedTier to turn Cloudflare OS discovery on; it is " +
+    'deliberately separate from defaultTier, because an account the workspace minted carries no ' +
+    'identity your grants could have named.';
 export class Gatekeeper {
     #env;
     #policy;
@@ -27,10 +36,7 @@ export class Gatekeeper {
         this.#policy = policy;
         const baseUrl = requireVar(env, 'CAT_FACTORY_BASE_URL');
         const clientFor = (apiKey) => new CatFactoryClient({ baseUrl, apiKey, userAgent: USER_AGENT });
-        // One durable object per PAIRED DEPLOYMENT, named for the origin it is paired with. The name
-        // is the pairing's own identity, so pointing this Worker at a different cat-factory gets a
-        // different object rather than inheriting the previous one's cards and minted keys.
-        this.#state = env.STATE.get(env.STATE.idFromName(baseUrl));
+        this.#state = stateFor(env);
         this.#keys = new KeyBroker({
             state: this.#state,
             provisioning: clientFor(requireVar(env, 'PROVISIONING_KEY')),
@@ -61,13 +67,99 @@ export class Gatekeeper {
      * The tier is resolved from the Gatekeeper's OWN policy, never from anything the caller sent:
      * an agent that could name its tier would be its own authorization.
      */
-    capabilityFor(actor) {
-        const tier = tierForActor(this.#policy, actor.id);
+    capabilityFor(actor, governance) {
+        return this.#capability(actor, this.tierFor(actor.id), governance);
+    }
+    /**
+     * The capability for an auto-provisioned Cloudflare OS account.
+     *
+     * A sibling of `capabilityFor` rather than a flag on it, because the two doors resolve a tier
+     * from different halves of the policy: `/rpc` names a person the OS asserts, and an account was
+     * minted here with no name at all. Everything after the resolution is the one implementation.
+     */
+    capabilityForAccount(accountId, governance) {
+        return this.#capability({ id: accountId, label: accountId }, this.tierForAccount(accountId), governance);
+    }
+    #capability(actor, tier, governance) {
+        return buildCapability({
+            actor,
+            tier,
+            keys: this.#keys,
+            state: this.#state,
+            ...(governance ? { governance } : {}),
+        });
+    }
+    /**
+     * The compiled tier an actor holds, or a refusal naming what an operator has to change.
+     *
+     * Exposed beside `capabilityFor` because the OS object model asks about a tier without building
+     * a session from it: the resource's TypeScript types and its auto-approvable action kinds are
+     * both projections of the tier, and both are read before any session exists.
+     */
+    tierFor(actorId) {
+        const tier = tierForActor(this.#policy, actorId);
         if (tier === null) {
-            throw new GatekeeperError('unknown_actor', `No tier is granted to '${actor.id}'. Add them to this Gatekeeper's policy under ` +
+            throw new GatekeeperError('unknown_actor', `No tier is granted to '${actorId}'. Add them to this Gatekeeper's policy under ` +
                 'grants, or set a defaultTier if this deployment means every OS user to have one.');
         }
-        return buildCapability({ actor, tier, keys: this.#keys, state: this.#state });
+        return tier;
+    }
+    /**
+     * The tier an auto-provisioned Cloudflare OS account holds, or a refusal naming the knob.
+     *
+     * Separate from {@link tierFor} because the refusal has to name the right thing: a deployment
+     * that has not opted into OS discovery has not misconfigured anything, and telling its operator
+     * to add an actor to `grants` would be telling them to write a line for an id that did not exist
+     * when they were reading.
+     */
+    tierForAccount(accountId) {
+        const tier = tierForAccount(this.#policy, accountId);
+        if (tier === null) {
+            throw new GatekeeperError('unknown_actor', 'This Gatekeeper serves no auto-provisioned accounts, so it cannot open a session for ' +
+                `'${accountId}'. ${AUTO_PROVISIONED_TIER_REMEDY}`);
+        }
+        return tier;
+    }
+    /**
+     * The tier EVERY auto-provisioned account falls to, asked without an account.
+     *
+     * The vendor is questioned before any account exists (its published session types are the ones a
+     * new account will get), and that question has an answer of its own. Asking it by minting a
+     * throwaway id would resolve the same tier and, when there is none, refuse by naming an
+     * `acct_…` that appears nowhere in the operator's policy.
+     */
+    tierForNewAccount() {
+        const tier = autoProvisionedTier(this.#policy);
+        if (tier === null) {
+            throw new GatekeeperError('unknown_actor', 'This Gatekeeper serves no auto-provisioned accounts, so there is no session for it to ' +
+                `describe. ${AUTO_PROVISIONED_TIER_REMEDY}`);
+        }
+        return tier;
+    }
+    /**
+     * The tier NAME a policy nominates for auto-provisioned accounts, or `null`.
+     *
+     * The raw knob rather than the compiled tier, because the one caller that wants it is `/health`,
+     * reporting whether this deployment has opted into Cloudflare OS discovery at all. A refusal
+     * would be the wrong shape there: not having opted in is a state, not a fault.
+     */
+    get autoProvisionedTierName() {
+        return this.#policy.autoProvisionedTier;
+    }
+    /**
+     * Whether this deployment minted the named account.
+     *
+     * Asked by the ONE caller that is handed an account id from outside (`addObserver`, over an
+     * observer's verifier) and has to resolve a tier for it. Every other account id in this package
+     * arrives on `ctx.props` of a stub this Gatekeeper handed the workspace, so it was minted here
+     * by construction and asking again would be a lookup with no question behind it.
+     */
+    async recognizesAccount(accountId) {
+        return await this.#state.hasAccount(accountId);
+    }
+    /** The origin of the cat-factory deployment this Gatekeeper is paired with. */
+    get deployment() {
+        return requireVar(this.#env, 'CAT_FACTORY_BASE_URL');
     }
     /**
      * Retire an actor: revoke every key this Gatekeeper minted for them, upstream and here.
@@ -122,8 +214,12 @@ export class Gatekeeper {
      * Deduping in a call of its own would be worse than useless: a marker committed before the card
      * write turns a failed write into a `duplicate` on the platform's retry, so the approval never
      * reaches the inbox and nothing anywhere reports that it did not.
+     *
+     * `defer` is how the fan-out is kept OFF that path, and it is a parameter rather than something
+     * read here because the lifetime being extended is the Worker invocation's, which only the
+     * handler holds.
      */
-    async takeDelivery(request, now) {
+    async takeDelivery(request, now, defer) {
         const rawBody = await request.text();
         const verdict = await verifyDelivery(request.headers, rawBody, requireVar(this.#env, 'WEBHOOK_SECRET'), now);
         if (!verdict.ok)
@@ -138,12 +234,30 @@ export class Gatekeeper {
         const delivery = readDelivery(parsed);
         if (delivery === null)
             return { handled: 'unparseable' };
-        const applied = await this.#state.applyDelivery(delivery.deliveryId, cardEffectOf(delivery), now);
+        const effect = cardEffectOf(delivery);
+        const applied = await this.#state.applyDelivery(delivery.deliveryId, effect, now);
         if (!applied.applied)
             return { handled: 'duplicate', deliveryId: delivery.deliveryId };
-        return { handled: 'accepted', deliveryId: delivery.deliveryId, effect: applied.effect };
+        // AFTER the write and BESIDE the acknowledgement, never in front of it. The card is the
+        // durable truth and the push is the accelerator over it, so a workspace that hangs or refuses
+        // must cost a notification and never the record. Awaiting the fan-out here made it cost both:
+        // one slow workspace times the delivery out, the platform retries to protect a write that had
+        // already committed, and the retry is deduped into pushing nothing at all, so the notification
+        // the wait was supposed to guarantee is the one thing certain to be lost.
+        if (applied.pushes.length > 0)
+            defer(this.#state.dispatchHooks(applied.pushes, now));
+        return {
+            handled: 'accepted',
+            deliveryId: delivery.deliveryId,
+            effect: applied.effect,
+            hooks: receiptFor(applied.pushes),
+        };
     }
 }
+/** What was handed to the fan-out, summarised for the platform's own delivery log. */
+function receiptFor(pushes) {
+    return { pushes: pushes.length, topics: [...new Set(pushes.map((push) => push.topic))] };
+}
 /**
  * Compare two secrets without an early exit on the first differing character.
  *

package/dist/gatekeeper.js.map

@@ -1 +1 @@
-{"version":3,"file":"gatekeeper.js","sourceRoot":"","sources":["../src/gatekeeper.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,EAAE;AACF,0FAA0F;AAC1F,6FAA6F;AAC7F,EAAE;AACF,+FAA+F;AAC/F,6FAA6F;AAC7F,2FAA2F;AAC3F,cAAc;AAEd,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAsB,MAAM,UAAU,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAc,MAAM,WAAW,CAAA;AACjD,OAAO,EACL,aAAa,EACb,YAAY,GAGb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AACzF,OAAO,EAAE,cAAc,EAA2B,MAAM,wBAAwB,CAAA;AAEhF,0FAA0F;AAC1F,MAAM,UAAU,GAAG,wBAAwB,CAAA;AAgB3C,MAAM,OAAO,UAAU;IACZ,IAAI,CAAe;IACnB,OAAO,CAAgB;IACvB,MAAM,CAAoC;IAC1C,KAAK,CAAW;IAEzB,YAAoB,GAAkB,EAAE,MAAsB;QAC5D,IAAI,CAAC,IAAI,GAAG,GAAG,CAAA;QACf,IAAI,CAAC,OAAO,GAAG,MAAM,CAAA;QACrB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAA;QACvD,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,EAAE,CACnC,IAAI,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAA;QAElE,6FAA6F;QAC7F,2FAA2F;QAC3F,oFAAoF;QACpF,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;QAC1D,IAAI,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC;YACzB,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,YAAY,EAAE,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC5D,SAAS;YACT,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,CAAC,GAAkB,EAAE,MAAwB;QACxD,OAAO,IAAI,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IACnD,CAAC;IAED,mEAAmE;IACnE,SAAS,CAAC,MAAqB;QAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;QACzD,MAAM,SAAS,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC9F,OAAO,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,KAAY;QACxB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,0BAA0B,KAAK,CAAC,EAAE,gDAAgD;gBAChF,kFAAkF,CACrF,CAAA;QACH,CAAC;QACD,OAAO,eAAe,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACjD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC/E,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC;YACxC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC;YACtD,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC;YACjD,SAAS,EAAE,UAAU;SACtB,CAAC,CAAA;QACF,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE;YAC7C,GAAG;YACH,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC;YAC/C,OAAO,EAAE,IAAI;YACb,0FAA0F;YAC1F,6FAA6F;YAC7F,4FAA4F;YAC5F,yFAAyF;YACzF,yFAAyF;YACzF,+BAA+B;YAC/B,KAAK,EAAE,CAAC,GAAG,qBAAqB,CAAC;YACjC,wFAAwF;YACxF,4FAA4F;YAC5F,kFAAkF;YAClF,sDAAsD;YACtD,SAAS,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,YAAY,CAAC;SAC1D,CAAC,CAAA;QACF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;IAC3B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAAC,OAAgB,EAAE,GAAW;QAC9C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;QACpC,MAAM,OAAO,GAAG,MAAM,cAAc,CAClC,OAAO,CAAC,OAAO,EACf,OAAO,EACP,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EACvC,GAAG,CACJ,CAAA;QACD,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;QAEvE,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;QACnC,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;QAExD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAC7C,QAAQ,CAAC,UAAU,EACnB,YAAY,CAAC,QAAQ,CAAC,EACtB,GAAG,CACJ,CAAA;QACD,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAA;QACtF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;IACzF,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,CAAS,EAAE,CAAS;IAClD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC5E,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC"}
+{"version":3,"file":"gatekeeper.js","sourceRoot":"","sources":["../src/gatekeeper.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,EAAE;AACF,0FAA0F;AAC1F,6FAA6F;AAC7F,EAAE;AACF,+FAA+F;AAC/F,6FAA6F;AAC7F,2FAA2F;AAC3F,cAAc;AAEd,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,eAAe,EAA0B,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAsB,MAAM,UAAU,CAAA;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAc,MAAM,WAAW,CAAA;AAEjD,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,cAAc,EACd,YAAY,GAIb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AACzF,OAAO,EAAE,cAAc,EAA2B,MAAM,wBAAwB,CAAA;AAEhF,0FAA0F;AAC1F,MAAM,UAAU,GAAG,wBAAwB,CAAA;AAE3C;;;;;GAKG;AACH,MAAM,4BAA4B,GAChC,4FAA4F;IAC5F,6FAA6F;IAC7F,wCAAwC,CAAA;AAiC1C,MAAM,OAAO,UAAU;IACZ,IAAI,CAAe;IACnB,OAAO,CAAgB;IACvB,MAAM,CAAoC;IAC1C,KAAK,CAAW;IAEzB,YAAoB,GAAkB,EAAE,MAAsB;QAC5D,IAAI,CAAC,IAAI,GAAG,GAAG,CAAA;QACf,IAAI,CAAC,OAAO,GAAG,MAAM,CAAA;QACrB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAA;QACvD,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,EAAE,CACnC,IAAI,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAA;QAElE,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC;YACzB,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,YAAY,EAAE,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC5D,SAAS;YACT,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,CAAC,GAAkB,EAAE,MAAwB;QACxD,OAAO,IAAI,UAAU,CAAC,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IACnD,CAAC;IAED,mEAAmE;IACnE,SAAS,CAAC,MAAqB;QAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;QACzD,MAAM,SAAS,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC9F,OAAO,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,KAAY,EAAE,UAA8B;QACxD,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAA;IACpE,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,SAAiB,EAAE,UAA6B;QACnE,OAAO,IAAI,CAAC,WAAW,CACrB,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,EACnC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAC9B,UAAU,CACX,CAAA;IACH,CAAC;IAED,WAAW,CAAC,KAAY,EAAE,IAAkB,EAAE,UAA8B;QAC1E,OAAO,eAAe,CAAC;YACrB,KAAK;YACL,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,OAAe;QACrB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAChD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,0BAA0B,OAAO,gDAAgD;gBAC/E,kFAAkF,CACrF,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,SAAiB;QAC9B,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,uFAAuF;gBACrF,IAAI,SAAS,MAAM,4BAA4B,EAAE,CACpD,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;OAOG;IACH,iBAAiB;QACf,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC9C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,wFAAwF;gBACtF,aAAa,4BAA4B,EAAE,CAC9C,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;OAMG;IACH,IAAI,uBAAuB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAA;IACzC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;IAChD,CAAC;IAED,+EAA+E;IAC/E,IAAI,UAAU;QACZ,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAA;IACtD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACjD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;QACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC/E,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC;YACxC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC;YACtD,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC;YACjD,SAAS,EAAE,UAAU;SACtB,CAAC,CAAA;QACF,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE;YAC7C,GAAG;YACH,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC;YAC/C,OAAO,EAAE,IAAI;YACb,0FAA0F;YAC1F,6FAA6F;YAC7F,4FAA4F;YAC5F,yFAAyF;YACzF,yFAAyF;YACzF,+BAA+B;YAC/B,KAAK,EAAE,CAAC,GAAG,qBAAqB,CAAC;YACjC,wFAAwF;YACxF,4FAA4F;YAC5F,kFAAkF;YAClF,sDAAsD;YACtD,SAAS,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,YAAY,CAAC;SAC1D,CAAC,CAAA;QACF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;IAC3B,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,YAAY,CAChB,OAAgB,EAChB,GAAW,EACX,KAAuC;QAEvC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;QACpC,MAAM,OAAO,GAAG,MAAM,cAAc,CAClC,OAAO,CAAC,OAAO,EACf,OAAO,EACP,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EACvC,GAAG,CACJ,CAAA;QACD,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;QAEvE,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;QACnC,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;QAExD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QACjF,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAA;QAEtF,wFAAwF;QACxF,8FAA8F;QAC9F,8FAA8F;QAC9F,8FAA8F;QAC9F,+FAA+F;QAC/F,0EAA0E;QAC1E,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;QACpF,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;SAClC,CAAA;IACH,CAAC;CACF;AAED,sFAAsF;AACtF,SAAS,UAAU,CAAC,MAAiC;IACnD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAC1F,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,CAAS,EAAE,CAAS;IAClD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC5E,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { createGatekeeperWorker, type GatekeeperWorkerOptions } from './worker.js';
-export { Gatekeeper, type DeliveryOutcome } from './gatekeeper.js';
+export { Gatekeeper, type DeliveryOutcome, type HookDispatchReceipt } from './gatekeeper.js';
 export { GatekeeperState, type ApprovalCard, type DeliveryApplication, type DeliveryEffect, type MintClaim, type MintTicket, type RunState, type StoredKey, } from './state.js';
 export { ConfigError, type GatekeeperEnv } from './env.js';
 export { buildCapability, type CardInspection, type SessionDependencies, type TierSummary, } from './capability.js';
@@ -7,5 +7,22 @@ export { KeyBroker, type Actor, type KeyBrokerDependencies, type LeasedClient }
 export { answerCard, assertAnswerable, describeStale, pendingParks, type AnswerInput, type AnswerOutcome, type BindingInvoker, type DecisionListShape, type PendingPark, } from './approvals.js';
 export { cardEffectOf, dispositionOf, PARKED_DECISION_CARD_TYPES, readDelivery, SUBSCRIBED_CARD_TYPES, type CardDisposition, type Delivery, } from './webhook/delivery.js';
 export { DEFAULT_MAX_SKEW_MS, verifyDelivery, type VerificationResult, } from './webhook/signature.js';
+export { createGatekeeperVendor } from './os/vendor.js';
+export { createGatekeeperAccount, createGatekeeperVerifier, type AccountProps, } from './os/account.js';
+export { createGatekeeperResource } from './os/resource.js';
+export { ResourceCore, type ResourceDependencies, type ResourceProps } from './os/resource-core.js';
+export { createGatekeeperHookController, type HookControllerProps } from './os/hook-controller.js';
+export { applyPushOutcome, describeHook, describeHookDelivery, holdInitiator, HOOK_TOPICS, HOOK_TOPIC_NAMES, pushToHook, registrationKey, type HookDispatchReport, type HookPayload, type HookPushOutcome, type HookPushTarget, type HookRecord, type HookRegistration, type HookTopic, } from './os/hooks.js';
+export { assertObserverMaySee, identifyObserver, type ObserverRecognition } from './os/sharing.js';
+export { checkedArguments, declaredArguments } from './arguments.js';
+export { OS_EXPORTS, OS_EXPORT_REQUIREMENT, missingOsExports, type OsExportRequirement, type OsExportRole, } from './os/exports.js';
+export { describeDiscoverability, type DiscoverabilityReport, type DiscoveryBlocker, type DiscoveryBlockerReason, } from './os/discoverability.js';
+export { supportedResourceFor } from './os/resources.js';
+export { SESSION_INTERFACE_NAME, renderTierSessionTypes } from './os/session-types.js';
+export { ActionLedger, holdQueue, queueGovernance, type LedgerSession } from './os/queue.js';
+export { actionKindOf, describeAction, describeObservation, type CallSubject, } from './os/descriptions.js';
+export { fenced } from './markdown.js';
+export type { AccountDescription, AccountEntrypoint, ActionDescription, ActionKind, ApprovalQueue, AvatarImage, HookController, HookDescription, HookInitiator, HookTargetMetadata, ObservationAuthorizer, ObservationDescription, ResourceDescription, ResourceObject, SupportedResource, VendorDescription, VendorEntrypoint, VerifierEntrypoint, } from './os/protocol.js';
+export type { SessionGovernance } from './capability.js';
 export * from './policy/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAIlE,OAAO,EACL,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,SAAS,GACf,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAA;AAC1D,OAAO,EACL,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,SAAS,EAAE,KAAK,KAAK,EAAE,KAAK,qBAAqB,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAA;AAEhG,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,0BAA0B,EAC1B,YAAY,EACZ,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,QAAQ,GACd,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,KAAK,kBAAkB,GACxB,MAAM,wBAAwB,CAAA;AAI/B,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAI5F,OAAO,EACL,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,SAAS,GACf,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAA;AAC1D,OAAO,EACL,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,SAAS,EAAE,KAAK,KAAK,EAAE,KAAK,qBAAqB,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAA;AAEhG,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,0BAA0B,EAC1B,YAAY,EACZ,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,QAAQ,GACd,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,KAAK,kBAAkB,GACxB,MAAM,wBAAwB,CAAA;AAM/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,YAAY,GAClB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,KAAK,oBAAoB,EAAE,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACnG,OAAO,EAAE,8BAA8B,EAAE,KAAK,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAClG,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAClG,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,uBAAuB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAA;AAC5F,OAAO,EACL,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,KAAK,WAAW,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,UAAU,EACV,aAAa,EACb,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAIxD,cAAc,mBAAmB,CAAA"}

package/dist/index.js

@@ -17,6 +17,25 @@ export { KeyBroker } from './keys.js';
 export { answerCard, assertAnswerable, describeStale, pendingParks, } from './approvals.js';
 export { cardEffectOf, dispositionOf, PARKED_DECISION_CARD_TYPES, readDelivery, SUBSCRIBED_CARD_TYPES, } from './webhook/delivery.js';
 export { DEFAULT_MAX_SKEW_MS, verifyDelivery, } from './webhook/signature.js';
+// The Cloudflare OS object model: a second door onto the rooms above, never a fork of them. The
+// workspace discovers a `GatekeeperVendor` entrypoint over a service binding, mints an account,
+// binds the paired workspace as a resource, and opens a session whose every call passes through the
+// approval queue it supplied. `/rpc` and the admin routes are unchanged and still bearer-gated.
+export { createGatekeeperVendor } from './os/vendor.js';
+export { createGatekeeperAccount, createGatekeeperVerifier, } from './os/account.js';
+export { createGatekeeperResource } from './os/resource.js';
+export { ResourceCore } from './os/resource-core.js';
+export { createGatekeeperHookController } from './os/hook-controller.js';
+export { applyPushOutcome, describeHook, describeHookDelivery, holdInitiator, HOOK_TOPICS, HOOK_TOPIC_NAMES, pushToHook, registrationKey, } from './os/hooks.js';
+export { assertObserverMaySee, identifyObserver } from './os/sharing.js';
+export { checkedArguments, declaredArguments } from './arguments.js';
+export { OS_EXPORTS, OS_EXPORT_REQUIREMENT, missingOsExports, } from './os/exports.js';
+export { describeDiscoverability, } from './os/discoverability.js';
+export { supportedResourceFor } from './os/resources.js';
+export { SESSION_INTERFACE_NAME, renderTierSessionTypes } from './os/session-types.js';
+export { ActionLedger, holdQueue, queueGovernance } from './os/queue.js';
+export { actionKindOf, describeAction, describeObservation, } from './os/descriptions.js';
+export { fenced } from './markdown.js';
 // The policy vocabulary, also reachable on its own at `@cat-factory/gatekeeper-worker/policy` for
 // a policy file that should not have to load a Worker runtime to be read or tested.
 export * from './policy/index.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,uFAAuF;AACvF,EAAE;AACF,mGAAmG;AACnG,kGAAkG;AAClG,kGAAkG;AAClG,iGAAiG;AACjG,wCAAwC;AAExC,OAAO,EAAE,sBAAsB,EAAgC,MAAM,aAAa,CAAA;AAClF,OAAO,EAAE,UAAU,EAAwB,MAAM,iBAAiB,CAAA;AAElE,0FAA0F;AAC1F,6FAA6F;AAC7F,OAAO,EACL,eAAe,GAQhB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,WAAW,EAAsB,MAAM,UAAU,CAAA;AAC1D,OAAO,EACL,eAAe,GAIhB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,SAAS,EAA6D,MAAM,WAAW,CAAA;AAEhG,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,YAAY,GAMb,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,0BAA0B,EAC1B,YAAY,EACZ,qBAAqB,GAGtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,mBAAmB,EACnB,cAAc,GAEf,MAAM,wBAAwB,CAAA;AAE/B,kGAAkG;AAClG,oFAAoF;AACpF,cAAc,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,uFAAuF;AACvF,EAAE;AACF,mGAAmG;AACnG,kGAAkG;AAClG,kGAAkG;AAClG,iGAAiG;AACjG,wCAAwC;AAExC,OAAO,EAAE,sBAAsB,EAAgC,MAAM,aAAa,CAAA;AAClF,OAAO,EAAE,UAAU,EAAkD,MAAM,iBAAiB,CAAA;AAE5F,0FAA0F;AAC1F,6FAA6F;AAC7F,OAAO,EACL,eAAe,GAQhB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,WAAW,EAAsB,MAAM,UAAU,CAAA;AAC1D,OAAO,EACL,eAAe,GAIhB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,SAAS,EAA6D,MAAM,WAAW,CAAA;AAEhG,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,YAAY,GAMb,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,0BAA0B,EAC1B,YAAY,EACZ,qBAAqB,GAGtB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,mBAAmB,EACnB,cAAc,GAEf,MAAM,wBAAwB,CAAA;AAE/B,gGAAgG;AAChG,gGAAgG;AAChG,oGAAoG;AACpG,gGAAgG;AAChG,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GAEzB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAiD,MAAM,uBAAuB,CAAA;AACnG,OAAO,EAAE,8BAA8B,EAA4B,MAAM,yBAAyB,CAAA;AAClG,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,UAAU,EACV,eAAe,GAQhB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAA4B,MAAM,iBAAiB,CAAA;AAClG,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,gBAAgB,GAGjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,uBAAuB,GAIxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAsB,MAAM,eAAe,CAAA;AAC5F,OAAO,EACL,YAAY,EACZ,cAAc,EACd,mBAAmB,GAEpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAuBtC,kGAAkG;AAClG,oFAAoF;AACpF,cAAc,mBAAmB,CAAA"}

package/dist/markdown.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Fence a payload so it cannot break out of the code block that holds it.
+ *
+ * Sized one backtick longer than the longest run the payload contains, which is what makes it
+ * total: a payload holding ```` closes a ``` fence and everything after it, including the rest of
+ * the description, renders as prose the reader takes for ours.
+ *
+ * The language tag is the caller's, because a JSON argument bag and a free-text title are both
+ * fenced and only one of them is JSON.
+ */
+export declare function fenced(payload: string, language?: string): string;
+//# sourceMappingURL=markdown.d.ts.map

package/dist/markdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../src/markdown.ts"],"names":[],"mappings":"AAaA;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,GAAG,MAAM,CAOjE"}

package/dist/markdown.js

@@ -0,0 +1,28 @@
+// The one Markdown-safety primitive this Worker needs.
+//
+// Every description this Gatekeeper composes is MARKDOWN rendered to a person who is about to
+// decide something, and several of the holes in it carry text an agent or a task author wrote: the
+// argument bag of a call, the title of an approval card. Those are parsed surfaces, not inert
+// string sinks, and the failure is not cosmetic: an unbalanced fence swallows everything after it,
+// so a payload closing the block early makes the rest of OUR prose render as the payload's, right
+// where "here is what you are approving" is being said.
+//
+// It sits beside `masking.ts` rather than inside `os/` because both doors compose descriptions and
+// neither owns the rule. It is the same sizing rule the platform's own `fencedOutput` uses for
+// captured command output reaching a model.
+/**
+ * Fence a payload so it cannot break out of the code block that holds it.
+ *
+ * Sized one backtick longer than the longest run the payload contains, which is what makes it
+ * total: a payload holding ```` closes a ``` fence and everything after it, including the rest of
+ * the description, renders as prose the reader takes for ours.
+ *
+ * The language tag is the caller's, because a JSON argument bag and a free-text title are both
+ * fenced and only one of them is JSON.
+ */
+export function fenced(payload, language = 'json') {
+    const longestRun = [...payload.matchAll(/`+/g)].reduce((longest, match) => Math.max(longest, match[0].length), 0);
+    const fence = '`'.repeat(Math.max(3, longestRun + 1));
+    return `${fence}${language}\n${payload}\n${fence}`;
+}
+//# sourceMappingURL=markdown.js.map

package/dist/markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.js","sourceRoot":"","sources":["../src/markdown.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,8FAA8F;AAC9F,mGAAmG;AACnG,8FAA8F;AAC9F,mGAAmG;AACnG,kGAAkG;AAClG,wDAAwD;AACxD,EAAE;AACF,mGAAmG;AACnG,+FAA+F;AAC/F,4CAA4C;AAE5C;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CAAC,OAAe,EAAE,QAAQ,GAAG,MAAM;IACvD,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CACpD,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EACtD,CAAC,CACF,CAAA;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAA;IACrD,OAAO,GAAG,KAAK,GAAG,QAAQ,KAAK,OAAO,KAAK,KAAK,EAAE,CAAA;AACpD,CAAC"}

package/dist/os/account.d.ts

@@ -0,0 +1,27 @@
+import type { GatekeeperEnv } from '../env.js';
+import type { GatekeeperPolicy } from '../policy/compile.js';
+import type { AccountEntrypoint, VerifierEntrypoint } from './protocol.js';
+/** What the vendor imbues an account with. The id IS the account; nothing else is stored. */
+export interface AccountProps {
+    accountId: string;
+}
+/**
+ * The account entrypoint over a deployment's policy.
+ *
+ * Stateless by construction: the workspace holds the stub, the stub holds the id, and everything
+ * else is resolved from the policy and the paired deployment on each call. There is no account
+ * table to fall out of step with the workspace's own.
+ */
+export declare function createGatekeeperAccount(options: {
+    policy: GatekeeperPolicy;
+}): new (ctx: ExecutionContext<AccountProps>, env: GatekeeperEnv) => AccountEntrypoint;
+/**
+ * The verifier: an identity token with no authority.
+ *
+ * The contract's own interface is empty, because what is being passed IS the identity: another
+ * gatekeeper asks the workspace whether the holder of this stub may see something, and never calls
+ * a method on it. `describe()` is here so a human looking at a share prompt sees which account is
+ * being named rather than an opaque stub.
+ */
+export declare function createGatekeeperVerifier(): new (ctx: ExecutionContext<AccountProps>, env: GatekeeperEnv) => VerifierEntrypoint;
+//# sourceMappingURL=account.d.ts.map

package/dist/os/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../src/os/account.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAG9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAE5D,OAAO,KAAK,EAEV,iBAAiB,EAEjB,kBAAkB,EACnB,MAAM,eAAe,CAAA;AAItB,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,MAAM,EAAE,gBAAgB,CAAA;CACzB,GAAG,KAAK,GAAG,EAAE,gBAAgB,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,aAAa,KAAK,iBAAiB,CA8FrF;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,IAAI,KAC1C,GAAG,EAAE,gBAAgB,CAAC,YAAY,CAAC,EACnC,GAAG,EAAE,aAAa,KACf,kBAAkB,CAMtB"}