@cat-factory/gatekeeper-worker 0.5.0 → 0.6.0

package/dist/os/resource.js

@@ -29,7 +29,13 @@ export function createGatekeeperResource(options) {
         // ONE core for the object's lifetime, because the action ledger inside it is what a later
         // `applyAction` settles: a core rebuilt per call would have forgotten the action the decision
         // is about. Field initializers run after the base constructor, so `ctx` and `env` are set.
-        #core = new ResourceCore(this.env, policy, this.ctx.props);
+        //
+        // The exports bag is handed down because this shell is the only thing that has one: a hook's
+        // controller is one of the Worker's own named exports, resolved against the DEPLOYMENT's entry
+        // module, and the core is deliberately drivable without a Durable Object at all.
+        #core = new ResourceCore(this.env, policy, this.ctx.props, {
+            exports: this.ctx.exports,
+        });
         async describe() {
             return this.#core.describe();
         }

package/dist/os/resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../src/os/resource.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,4BAA4B;AAC5B,EAAE;AACF,kGAAkG;AAClG,8FAA8F;AAC9F,kGAAkG;AAClG,oGAAoG;AACpG,iGAAiG;AACjG,+FAA+F;AAC/F,wEAAwE;AACxE,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,6FAA6F;AAC7F,gFAAgF;AAEhF,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAIlD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAAE,YAAY,EAAsB,MAAM,oBAAoB,CAAA;AAIrE;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAExC;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAE1B,OAAO,MAAM,kBAAmB,SAAQ,aAA2C;QACjF,0FAA0F;QAC1F,8FAA8F;QAC9F,2FAA2F;QAClF,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAEnE,KAAK,CAAC,QAAQ;YACZ,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAA;QAC9B,CAAC;QAED,KAAK,CAAC,kBAAkB;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAA;QACxC,CAAC;QAED,6FAA6F;QAC7F,wFAAwF;QACxF,KAAK,CAAC,YAAY,CAAC,aAA4B;YAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAA;QAC1D,CAAC;QAED,KAAK,CAAC,wBAAwB;YAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAA;QAC9C,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAc;YAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACvC,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAc;YAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QACxC,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAc;YAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QACxC,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,IAAa;YACzC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACzC,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAU;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QACtC,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../src/os/resource.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,4BAA4B;AAC5B,EAAE;AACF,kGAAkG;AAClG,8FAA8F;AAC9F,kGAAkG;AAClG,oGAAoG;AACpG,iGAAiG;AACjG,+FAA+F;AAC/F,wEAAwE;AACxE,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,6FAA6F;AAC7F,gFAAgF;AAEhF,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAIlD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAAE,YAAY,EAAsB,MAAM,oBAAoB,CAAA;AAIrE;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAExC;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAE1B,OAAO,MAAM,kBAAmB,SAAQ,aAA2C;QACjF,0FAA0F;QAC1F,8FAA8F;QAC9F,2FAA2F;QAC3F,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,iFAAiF;QACxE,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE;YAClE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;SAC1B,CAAC,CAAA;QAEF,KAAK,CAAC,QAAQ;YACZ,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAA;QAC9B,CAAC;QAED,KAAK,CAAC,kBAAkB;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAA;QACxC,CAAC;QAED,6FAA6F;QAC7F,wFAAwF;QACxF,KAAK,CAAC,YAAY,CAAC,aAA4B;YAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAA;QAC1D,CAAC;QAED,KAAK,CAAC,wBAAwB;YAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAA;QAC9C,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAc;YAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACvC,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAc;YAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QACxC,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAc;YAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QACxC,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,IAAa;YACzC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACzC,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAU;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QACtC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/os/session-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-types.d.ts","sourceRoot":"","sources":["../../src/os/session-types.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,wBAAwB,CAAA;AA2D3D,wDAAwD;AACxD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAUjE"}
+{"version":3,"file":"session-types.d.ts","sourceRoot":"","sources":["../../src/os/session-types.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,wBAAwB,CAAA;AAuF3D,wDAAwD;AACxD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAUjE"}

package/dist/os/session-types.js

@@ -66,6 +66,34 @@ const RESERVED_MEMBERS = [
 `,
     `  /** Every run this Gatekeeper has been pushed lifecycle events for. */
   runs_watched(): Promise<unknown[]>
+`,
+    `  /**
+   * Be pushed each approval card as it is raised or settled, instead of polling
+   * \`approvals_list()\`. The callback needs one method:
+   * \`onApprovalCard(card): Promise<void>\`.
+   *
+   * The workspace holds the registration and may ask a person before enabling it, so binding is
+   * not receiving: nothing arrives until it is enabled, and \`hooks_bound()\` is where that shows.
+   */
+  approvals_subscribe(callback: unknown): Promise<void>
+`,
+    `  /**
+   * Be pushed each run lifecycle transition, instead of polling \`runs_watched()\`. The callback
+   * needs one method: \`onRunEvent(state): Promise<void>\`.
+   */
+  runs_subscribe(callback: unknown): Promise<void>
+`,
+    `  /**
+   * Every hook this account has enabled, with what each has been pushed (\`deliveries\`), what it
+   * could not be pushed (\`missed\`), what the workspace's own side refused (\`failures\`) and
+   * whether it is still \`live\`.
+   *
+   * A hook goes quiet when this Gatekeeper's durable object is evicted between deliveries, since
+   * the workspace's callback source cannot be stored. That reads as \`live: false\` with a rising
+   * \`missed\`, and the remedy is to bind again; what was missed is still in
+   * \`approvals_list()\` and \`runs_watched()\`, which is why they remain the truth.
+   */
+  hooks_bound(): Promise<unknown[]>
 `,
 ];
 /** Render the session `.d.ts` for one compiled tier. */

package/dist/os/session-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-types.js","sourceRoot":"","sources":["../../src/os/session-types.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,EAAE;AACF,mFAAmF;AACnF,gGAAgG;AAChG,iGAAiG;AACjG,iGAAiG;AACjG,iGAAiG;AACjG,oCAAoC;AACpC,EAAE;AACF,mGAAmG;AACnG,6EAA6E;AAE7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAGrE,gGAAgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAA;AAE3D;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAsB;IAC1C;;CAED;IACC;;;;;;;;;;;;;;;;CAgBD;IACC;;;;;;CAMD;IACC;;CAED;IACC;;;;;CAKD;IACC;;;;;;CAMD;IACC;;CAED;CACA,CAAA;AAED,wDAAwD;AACxD,MAAM,UAAU,sBAAsB,CAAC,IAAkB;IACvD,OAAO,kBAAkB,CAAC;QACxB,aAAa,EAAE,sBAAsB;QACrC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACrD,YAAY,EAAE,gBAAgB;QAC9B,QAAQ,EACN,oCAAoC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,WAAW,IAAI;YACxE,2DAA2D,IAAI,CAAC,QAAQ,wBAAwB;YAChG,yDAAyD;KAC5D,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"session-types.js","sourceRoot":"","sources":["../../src/os/session-types.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,EAAE;AACF,mFAAmF;AACnF,gGAAgG;AAChG,iGAAiG;AACjG,iGAAiG;AACjG,iGAAiG;AACjG,oCAAoC;AACpC,EAAE;AACF,mGAAmG;AACnG,6EAA6E;AAE7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAGrE,gGAAgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAA;AAE3D;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAsB;IAC1C;;CAED;IACC;;;;;;;;;;;;;;;;CAgBD;IACC;;;;;;CAMD;IACC;;CAED;IACC;;;;;CAKD;IACC;;;;;;CAMD;IACC;;CAED;IACC;;;;;;;;;CASD;IACC;;;;;CAKD;IACC;;;;;;;;;;;CAWD;CACA,CAAA;AAED,wDAAwD;AACxD,MAAM,UAAU,sBAAsB,CAAC,IAAkB;IACvD,OAAO,kBAAkB,CAAC;QACxB,aAAa,EAAE,sBAAsB;QACrC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACrD,YAAY,EAAE,gBAAgB;QAC9B,QAAQ,EACN,oCAAoC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,WAAW,IAAI;YACxE,2DAA2D,IAAI,CAAC,QAAQ,wBAAwB;YAChG,yDAAyD;KAC5D,CAAC,CAAA;AACJ,CAAC"}

package/dist/os/sharing.d.ts

@@ -0,0 +1,35 @@
+import type { CompiledTier } from '../policy/compile.js';
+/** What the caller supplies so a claimed account can be checked against the ones this Gatekeeper made. */
+export interface ObserverRecognition {
+    /** Whether this deployment minted the named account. Never a guess: an unknown id is refused. */
+    recognize: (accountId: string) => Promise<boolean>;
+}
+/**
+ * Resolve the account behind an observer's verifier, or refuse.
+ *
+ * The verifier is the contract's own identity token: another vendor's gatekeeper is handed one,
+ * and the only thing it carries is who its holder is. Ours answers `{ accountId }`, so a stub that
+ * answers anything else did not come from this vendor and cannot be resolved against this
+ * deployment's policy. Answering the right SHAPE is not the same as being one of ours, which is
+ * why the id is then checked against the accounts this deployment actually minted.
+ *
+ * What that does NOT establish is worth stating, because the rule above is only as strong as this:
+ * a verifier that names an account of ours is taken at its word. The stub is reached over RPC from
+ * whoever the workspace handed us, so proving the holder IS that account would take a challenge
+ * the published contract does not carry. What is closed here is the case that needs no
+ * impersonation at all, which was every honest viewer from every other vendor.
+ */
+export declare function identifyObserver(user: unknown, deps: ObserverRecognition): Promise<string>;
+/**
+ * Refuse the share unless the observer could have read all of it themselves.
+ *
+ * Takes the two COMPILED tiers rather than resolving them, so the rule is testable without a
+ * policy, a Worker or an account: what it decides is a comparison, and everything else is lookup.
+ */
+export declare function assertObserverMaySee(deps: {
+    observerId: string;
+    observerAccount: string;
+    owner: CompiledTier;
+    observer: CompiledTier;
+}): void;
+//# sourceMappingURL=sharing.d.ts.map

package/dist/os/sharing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharing.d.ts","sourceRoot":"","sources":["../../src/os/sharing.ts"],"names":[],"mappings":"AAgDA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAUxD,0GAA0G;AAC1G,MAAM,WAAW,mBAAmB;IAClC,iGAAiG;IACjG,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACnD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsChG;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,KAAK,EAAE,YAAY,CAAA;IACnB,QAAQ,EAAE,YAAY,CAAA;CACvB,GAAG,IAAI,CAqCP"}

package/dist/os/sharing.js

@@ -0,0 +1,135 @@
+// Whether one account may be shown what another has already read through this resource.
+//
+// The contract's requirement is exact and it is not "is this person trusted": `addObserver` must
+// verify that the new viewer could DIRECTLY READ everything historically observed through the
+// resource, and throw to block the share otherwise. Slice 8 shipped the blanket refusal, which was
+// the right default while there was no rule worth writing down. This is the rule.
+//
+// It rests on one fact about this Gatekeeper that makes the question answerable at all: a resource
+// object is bound FOR ONE ACCOUNT (`ResourceProps.accountId`), so every observation ever made
+// through it was made at that account's tier. There is no observation log and there does not need
+// to be one, because the tier is an upper bound on what any of those reads could have returned.
+// So the test is a comparison of two compiled tiers:
+//
+//   1. The observer's tier GRANTS every operation the owner's tier grants. An operation the
+//      observer does not hold is one they could not have made themselves, whatever they are shown.
+//   2. The observer's MASK hides nothing the owner's does not. Masking is redaction on the way
+//      out, so a field the observer's tier blanks is a field they cannot read directly, even
+//      through an operation they hold.
+//   3. The owner's tier reaches NO TELEMETRY SINK. Those reads serve captured agent text and are
+//      described with `prohibitAllSharing`, which says the data may not be shared onward with any
+//      observer whatever their own access is. Since nothing here records which reads were actually
+//      made, a tier that COULD have made one is a tier whose observations may include it.
+//
+// Every failure is a refusal that names which of the three it is, because they need different
+// answers: a grant an operator can widen, a mask they can align, and one they must not "fix" at
+// all. And an observer this Gatekeeper cannot identify is refused separately again, because
+// "unknown" and "not permitted" are the same outcome and opposite facts.
+//
+// WHICH IS WHY IDENTIFYING ONE IS TWO QUESTIONS, not one. Reading an account id off the verifier
+// answers what the observer CLAIMS; it does not answer whether this deployment has ever heard of
+// them, and the tier lookup behind the comparison cannot tell the difference on its own. It
+// resolves an unknown id to the auto-provisioned tier, which is the tier nearly every account
+// here holds, so a viewer from an entirely different vendor (whose verifier honestly names an
+// account of THEIRS) resolved to the same tier as the owner and passed all three tests without
+// holding a single one of the operations they were being shown. The comparison was answering
+// "would an account like this be able to read it", which is not a question anyone asked.
+//
+// So an observer must be an account this Gatekeeper MINTED. That is a fact only the deployment's
+// own state knows, so the caller supplies the recogniser and this module supplies the refusal:
+// the message it already carried ("Observers must hold an account on this same Gatekeeper") is
+// now enforced rather than asserted.
+//
+// The rule is deliberately conservative in the one direction that costs nothing but a share:
+// every accepted observer can read everything the owner's tier can, so no observation ever needs
+// excluding afterwards and `ObservationDescription.excludeObservers` stays unused rather than
+// being a second, weaker gate on the same question.
+import { describeError, GatekeeperError } from '../errors.js';
+/** How many withheld operations a refusal names before it stops listing them. */
+const NAMED_OPERATIONS = 5;
+/**
+ * Resolve the account behind an observer's verifier, or refuse.
+ *
+ * The verifier is the contract's own identity token: another vendor's gatekeeper is handed one,
+ * and the only thing it carries is who its holder is. Ours answers `{ accountId }`, so a stub that
+ * answers anything else did not come from this vendor and cannot be resolved against this
+ * deployment's policy. Answering the right SHAPE is not the same as being one of ours, which is
+ * why the id is then checked against the accounts this deployment actually minted.
+ *
+ * What that does NOT establish is worth stating, because the rule above is only as strong as this:
+ * a verifier that names an account of ours is taken at its word. The stub is reached over RPC from
+ * whoever the workspace handed us, so proving the holder IS that account would take a challenge
+ * the published contract does not carry. What is closed here is the case that needs no
+ * impersonation at all, which was every honest viewer from every other vendor.
+ */
+export async function identifyObserver(user, deps) {
+    const verifier = user;
+    if (typeof verifier?.describe !== 'function') {
+        throw new GatekeeperError('sharing_unverifiable', 'The observer offered no verifier this Gatekeeper can question, so there is no account to ' +
+            'resolve a tier for. A share is refused rather than granted to an identity nobody stated.');
+    }
+    let identity;
+    try {
+        identity = await verifier.describe();
+    }
+    catch (error) {
+        throw new GatekeeperError('sharing_unverifiable', `The observer's verifier could not be questioned (${describeError(error)}), so the share ` +
+            'is refused: an identity this Gatekeeper failed to read is not an identity it may assume.');
+    }
+    if (typeof identity?.accountId !== 'string' || identity.accountId.length === 0) {
+        throw new GatekeeperError('sharing_unverifiable', "The observer's verifier named no account, so this deployment's policy has nothing to " +
+            'resolve a tier against. Observers must hold an account on this same Gatekeeper.');
+    }
+    if (!(await deps.recognize(identity.accountId))) {
+        throw new GatekeeperError('sharing_unverifiable', `This Gatekeeper did not mint account '${identity.accountId}', so it holds no tier for it ` +
+            'and cannot judge what its holder could read for themselves. A viewer connected to some ' +
+            'other vendor is refused here rather than measured against the tier an account of ours ' +
+            'would have had: that comparison would pass for a viewer holding none of these ' +
+            'operations. Connect this deployment as a vendor from that workspace and share with the ' +
+            'account it mints.');
+    }
+    return identity.accountId;
+}
+/**
+ * Refuse the share unless the observer could have read all of it themselves.
+ *
+ * Takes the two COMPILED tiers rather than resolving them, so the rule is testable without a
+ * policy, a Worker or an account: what it decides is a comparison, and everything else is lookup.
+ */
+export function assertObserverMaySee(deps) {
+    const { owner, observer } = deps;
+    const captured = owner.granted.filter((binding) => binding.telemetrySink !== undefined);
+    if (captured.length > 0) {
+        throw new GatekeeperError('sharing_refused', `This resource is bound at tier '${owner.name}', which can read captured agent text ` +
+            `(${names(captured.map((binding) => binding.name))}). Those reads are marked as not ` +
+            'shareable onward whatever the viewer holds, and nothing here records which of them were ' +
+            `actually made, so the share to '${deps.observerId}' is refused. A tier without the ` +
+            'telemetry operations can be shared.');
+    }
+    const held = new Set(observer.granted.map((binding) => binding.name));
+    const unreachable = owner.granted.filter((binding) => !held.has(binding.name));
+    if (unreachable.length > 0) {
+        throw new GatekeeperError('sharing_refused', `Account '${deps.observerAccount}' holds tier '${observer.name}', which does not grant ` +
+            `${names(unreachable.map((binding) => binding.name))}. This resource is bound at tier ` +
+            `'${owner.name}', so it may already have read those, and the share would show them what ` +
+            'they cannot read for themselves.');
+    }
+    const ownerMask = new Set(owner.mask);
+    const extraMask = observer.mask.filter((path) => !ownerMask.has(path));
+    if (extraMask.length > 0) {
+        throw new GatekeeperError('sharing_refused', `Tier '${observer.name}' masks ${names(extraMask)}, which tier '${owner.name}' does not. A ` +
+            'masked field is one this observer cannot read directly even through an operation they ' +
+            'hold, so the share is refused rather than served with the redaction undone.');
+    }
+}
+/** A bounded list: enough to act on, never the whole surface pasted into a refusal. */
+function names(all) {
+    const shown = all
+        .slice(0, NAMED_OPERATIONS)
+        .map((name) => `'${name}'`)
+        .join(', ');
+    return all.length > NAMED_OPERATIONS
+        ? `${shown} and ${all.length - NAMED_OPERATIONS} more`
+        : shown;
+}
+//# sourceMappingURL=sharing.js.map

package/dist/os/sharing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sharing.js","sourceRoot":"","sources":["../../src/os/sharing.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,EAAE;AACF,iGAAiG;AACjG,8FAA8F;AAC9F,mGAAmG;AACnG,kFAAkF;AAClF,EAAE;AACF,mGAAmG;AACnG,8FAA8F;AAC9F,kGAAkG;AAClG,gGAAgG;AAChG,qDAAqD;AACrD,EAAE;AACF,4FAA4F;AAC5F,mGAAmG;AACnG,+FAA+F;AAC/F,6FAA6F;AAC7F,uCAAuC;AACvC,iGAAiG;AACjG,kGAAkG;AAClG,mGAAmG;AACnG,0FAA0F;AAC1F,EAAE;AACF,8FAA8F;AAC9F,gGAAgG;AAChG,4FAA4F;AAC5F,yEAAyE;AACzE,EAAE;AACF,iGAAiG;AACjG,iGAAiG;AACjG,4FAA4F;AAC5F,8FAA8F;AAC9F,8FAA8F;AAC9F,+FAA+F;AAC/F,6FAA6F;AAC7F,yFAAyF;AACzF,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,+FAA+F;AAC/F,qCAAqC;AACrC,EAAE;AACF,6FAA6F;AAC7F,iGAAiG;AACjG,8FAA8F;AAC9F,oDAAoD;AAEpD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAG7D,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAa1B;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAa,EAAE,IAAyB;IAC7E,MAAM,QAAQ,GAAG,IAA8D,CAAA;IAC/E,IAAI,OAAO,QAAQ,EAAE,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC7C,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,2FAA2F;YACzF,0FAA0F,CAC7F,CAAA;IACH,CAAC;IACD,IAAI,QAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAA;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,oDAAoD,aAAa,CAAC,KAAK,CAAC,kBAAkB;YACxF,0FAA0F,CAC7F,CAAA;IACH,CAAC;IACD,IAAI,OAAO,QAAQ,EAAE,SAAS,KAAK,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,uFAAuF;YACrF,iFAAiF,CACpF,CAAA;IACH,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,yCAAyC,QAAQ,CAAC,SAAS,gCAAgC;YACzF,yFAAyF;YACzF,wFAAwF;YACxF,gFAAgF;YAChF,yFAAyF;YACzF,mBAAmB,CACtB,CAAA;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,SAAS,CAAA;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAKpC;IACC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAA;IAEhC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAA;IACvF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,mCAAmC,KAAK,CAAC,IAAI,wCAAwC;YACnF,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,mCAAmC;YACrF,0FAA0F;YAC1F,mCAAmC,IAAI,CAAC,UAAU,mCAAmC;YACrF,qCAAqC,CACxC,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC9E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,YAAY,IAAI,CAAC,eAAe,iBAAiB,QAAQ,CAAC,IAAI,0BAA0B;YACtF,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,mCAAmC;YACvF,IAAI,KAAK,CAAC,IAAI,2EAA2E;YACzF,kCAAkC,CACrC,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IACtE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,SAAS,QAAQ,CAAC,IAAI,WAAW,KAAK,CAAC,SAAS,CAAC,iBAAiB,KAAK,CAAC,IAAI,gBAAgB;YAC1F,wFAAwF;YACxF,6EAA6E,CAChF,CAAA;IACH,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,KAAK,CAAC,GAAsB;IACnC,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC;SAC1B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;SAC1B,IAAI,CAAC,IAAI,CAAC,CAAA;IACb,OAAO,GAAG,CAAC,MAAM,GAAG,gBAAgB;QAClC,CAAC,CAAC,GAAG,KAAK,QAAQ,GAAG,CAAC,MAAM,GAAG,gBAAgB,OAAO;QACtD,CAAC,CAAC,KAAK,CAAA;AACX,CAAC"}

package/dist/os/vendor.d.ts

@@ -1,4 +1,4 @@
-import type { GatekeeperEnv } from '../env.js';
+import { type GatekeeperEnv } from '../env.js';
 import type { GatekeeperPolicy } from '../policy/compile.js';
 import type { VendorEntrypoint } from './protocol.js';
 /**

package/dist/os/vendor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vendor.d.ts","sourceRoot":"","sources":["../../src/os/vendor.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAG5D,OAAO,KAAK,EAAwC,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAe3F;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,MAAM,EAAE,gBAAgB,CAAA;CACzB,GAAG,KAAK,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,aAAa,KAAK,gBAAgB,CA4DtE"}
+{"version":3,"file":"vendor.d.ts","sourceRoot":"","sources":["../../src/os/vendor.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAExD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAG5D,OAAO,KAAK,EAAwC,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAe3F;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,MAAM,EAAE,gBAAgB,CAAA;CACzB,GAAG,KAAK,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,aAAa,KAAK,gBAAgB,CAkEtE"}

package/dist/os/vendor.js

@@ -16,6 +16,7 @@
 // against it. Nothing here is transcribed, so a surface change cannot leave the description of it
 // behind.
 import { WorkerEntrypoint } from 'cloudflare:workers';
+import { stateFor } from '../env.js';
 import { Gatekeeper } from '../gatekeeper.js';
 import { loopbackExport } from './exports.js';
 import { supportedResourceFor } from './resources.js';
@@ -88,7 +89,13 @@ export function createGatekeeperVendor(options) {
             const props = { accountId: mintAccountId() };
             // Resolved before the account is handed back, so a deployment missing the export is refused
             // at the call that would have created the account rather than at the first use of it.
-            return loopbackExport(this.ctx.exports, 'account', props);
+            const account = loopbackExport(this.ctx.exports, 'account', props);
+            // The one thing recorded about an account, and it is recorded HERE because this is the only
+            // moment the fact exists: minting is what makes an id one of ours, and `addObserver` has no
+            // other way to tell a viewer holding one from a viewer naming one. It lands before the stub
+            // does, so an account the workspace can use is never one this Gatekeeper would disown.
+            await stateFor(this.env).recordAccount(props.accountId, Date.now());
+            return account;
         }
     };
 }

package/dist/os/vendor.js.map

@@ -1 +1 @@
-{"version":3,"file":"vendor.js","sourceRoot":"","sources":["../../src/os/vendor.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mGAAmG;AACnG,kGAAkG;AAClG,yFAAyF;AACzF,EAAE;AACF,iGAAiG;AACjG,8FAA8F;AAC9F,mGAAmG;AACnG,uFAAuF;AACvF,gGAAgG;AAChG,6FAA6F;AAC7F,+FAA+F;AAC/F,EAAE;AACF,iGAAiG;AACjG,kGAAkG;AAClG,UAAU;AAEV,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAG7C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAE3D;;;;;;GAMG;AACH,SAAS,aAAa;IACpB,OAAO,QAAQ,MAAM,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAA;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAEtC;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAE1B,OAAO,MAAM,gBAAiB,SAAQ,gBAA+B;QACnE,WAAW;YACT,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAC5C,CAAC;QAED,KAAK,CAAC,QAAQ;YACZ,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAA;YAChD,OAAO;gBACL,WAAW,EAAE,aAAa;gBAC1B,GAAG,EAAE,UAAU;gBACf,OAAO,EAAE,oCAAoC;gBAC7C,WAAW,EACT,yFAAyF;oBACzF,uFAAuF;oBACvF,kCAAkC;gBACpC,wFAAwF;gBACxF,oEAAoE;gBACpE,YAAY,EAAE,KAAK;gBACnB,oFAAoF;gBACpF,2EAA2E;gBAC3E,qBAAqB,EAAE,IAAI;aAC5B,CAAA;QACH,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,QAA8B;YACxD,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QAC9D,CAAC;QAED;;;;;;;;;;WAUG;QACH,KAAK,CAAC,kBAAkB;YACtB,OAAO,sBAAsB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAA;QACvE,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,aAAa;YACjB,MAAM,KAAK,GAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,CAAA;YAC1D,4FAA4F;YAC5F,sFAAsF;YACtF,OAAO,cAAc,CAAU,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;QACpE,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"vendor.js","sourceRoot":"","sources":["../../src/os/vendor.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mGAAmG;AACnG,kGAAkG;AAClG,yFAAyF;AACzF,EAAE;AACF,iGAAiG;AACjG,8FAA8F;AAC9F,mGAAmG;AACnG,uFAAuF;AACvF,gGAAgG;AAChG,6FAA6F;AAC7F,+FAA+F;AAC/F,EAAE;AACF,iGAAiG;AACjG,kGAAkG;AAClG,UAAU;AAEV,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,QAAQ,EAAsB,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAG7C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAE3D;;;;;;GAMG;AACH,SAAS,aAAa;IACpB,OAAO,QAAQ,MAAM,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAA;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAEtC;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAE1B,OAAO,MAAM,gBAAiB,SAAQ,gBAA+B;QACnE,WAAW;YACT,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAC5C,CAAC;QAED,KAAK,CAAC,QAAQ;YACZ,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAA;YAChD,OAAO;gBACL,WAAW,EAAE,aAAa;gBAC1B,GAAG,EAAE,UAAU;gBACf,OAAO,EAAE,oCAAoC;gBAC7C,WAAW,EACT,yFAAyF;oBACzF,uFAAuF;oBACvF,kCAAkC;gBACpC,wFAAwF;gBACxF,oEAAoE;gBACpE,YAAY,EAAE,KAAK;gBACnB,oFAAoF;gBACpF,2EAA2E;gBAC3E,qBAAqB,EAAE,IAAI;aAC5B,CAAA;QACH,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,QAA8B;YACxD,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;QAC9D,CAAC;QAED;;;;;;;;;;WAUG;QACH,KAAK,CAAC,kBAAkB;YACtB,OAAO,sBAAsB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAA;QACvE,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,aAAa;YACjB,MAAM,KAAK,GAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,CAAA;YAC1D,4FAA4F;YAC5F,sFAAsF;YACtF,MAAM,OAAO,GAAG,cAAc,CAAU,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;YAC3E,4FAA4F;YAC5F,4FAA4F;YAC5F,4FAA4F;YAC5F,uFAAuF;YACvF,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;YACnE,OAAO,OAAO,CAAA;QAChB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/state.d.ts

@@ -1,4 +1,6 @@
 import { DurableObject } from 'cloudflare:workers';
+import { type HookDispatchReport, type HookPushTarget, type HookRecord, type HookRegistration } from './os/hooks.js';
+import type { HookInitiator } from './os/protocol.js';
 /** A parked cat-factory decision, as the OS shows it. */
 export interface ApprovalCard {
     /** The delivery that raised it. Also the id the OS answers on. */
@@ -83,6 +85,18 @@ export type DeliveryApplication = {
 } | {
     applied: true;
     effect: 'opened' | 'superseded' | 'run-event' | 'none';
+    /**
+     * What this delivery CHANGED, for the hooks registered on each topic to be pushed about.
+     *
+     * Named here rather than re-derived by the dispatcher, for two reasons that are really one.
+     * A terminal run event both records the transition and settles the run's open cards, so it
+     * changes two topics' worth of state, and a dispatcher handed only the effect could see just
+     * the first: a card-subscribed gadget went on rendering settled cards as answerable, which
+     * is exactly what `HOOK_TOPICS.approval_card` tells an approver it will not do. And what the
+     * write actually changed is knowable only here, so a supersede that met a card already
+     * settled pushes nothing rather than re-announcing a transition that did not happen.
+     */
+    pushes: HookPushTarget[];
 };
 export declare class GatekeeperState extends DurableObject {
     #private;
@@ -95,13 +109,78 @@ export declare class GatekeeperState extends DurableObject {
      * re-deriving that on every replay would spend the platform's retry budget on it.
      */
     applyDelivery(deliveryId: string, effect: DeliveryEffect, now: number): Promise<DeliveryApplication>;
-    /** Settle a card this Gatekeeper answered. A card already settled keeps its first resolution. */
+    /**
+     * Settle a card this Gatekeeper answered. A card already settled keeps its first resolution.
+     *
+     * The settlement is pushed before this returns, which is the opposite disposition from the
+     * webhook receiver's and for the reason that separates the two callers. There the fan-out is
+     * deferred because the platform's retry is waiting on the acknowledgement and would re-drive a
+     * delivery this Gatekeeper has already committed; here the caller is the session that just
+     * answered the card, nothing is retrying it, and a push bounded by its own per-hook deadline
+     * costs that one call rather than the record.
+     */
     resolveCard(cardId: string, resolution: string, now: number): Promise<ApprovalCard | null>;
     getCard(cardId: string): Promise<ApprovalCard | null>;
     /** Every card, newest first. Resolved ones are included: the OS decides what it renders. */
     listCards(): Promise<ApprovalCard[]>;
     /** The latest lifecycle state of every run a delivery has mentioned, newest first. */
     listRunStates(): Promise<RunState[]>;
+    /**
+     * The workspace enabled a hook: store the registration, and hold the live half beside it.
+     *
+     * The counters of an existing registration SURVIVE a re-enable. A workspace re-arms a hook
+     * exactly when it noticed one had gone quiet, and the number that told it so is `missed`;
+     * zeroing it on the way back up would delete the evidence at the one moment it is being acted
+     * on. What is replaced is the initiator, which the contract asks for by name.
+     */
+    enableHook(record: HookRecord, initiator: HookInitiator): Promise<void>;
+    /**
+     * The workspace withdrew a hook: both halves go, which is the permanent clean-up asked for.
+     *
+     * Found BY HOOK ID rather than addressed by it, because the row is keyed on the target while the
+     * controller a workspace persisted names the id it was bound under. A controller whose row was
+     * replaced by a later bind from the same gadget finds nothing and settles for releasing its own
+     * half, which is the right answer: it is being asked to withdraw a registration that a re-arm
+     * has already superseded, and deleting the successor's row would silence a live hook.
+     */
+    disableHook(hookId: string): Promise<void>;
+    /**
+     * The hooks enabled for one account, newest first, each with whether its live half survives.
+     *
+     * Scoped to the account rather than answering the object's whole set: a session reads this, and
+     * one account's gadget bindings are not another's to enumerate.
+     */
+    listHooks(accountId: string): Promise<HookRegistration[]>;
+    /**
+     * Push what a change produced to every hook registered for each payload's topic.
+     *
+     * Called AFTER the write it reports has committed, never as part of it: the card is the durable
+     * truth and the push is the accelerator over it, so an outbound call that hangs or refuses costs
+     * a notification and never the record of what the deployment reported. Each registration is
+     * pushed independently and concurrently, and every outcome lands on that registration's own
+     * counters, because one workspace's broken gadget must not decide whether another's hook fires
+     * or how long it waits to.
+     */
+    dispatchHooks(pushes: readonly HookPushTarget[], now: number): Promise<HookDispatchReport>;
+    /**
+     * Remember that this deployment minted an account.
+     *
+     * The one thing an account id has to be checkable for, and the reason it is the only account
+     * state here: `addObserver` is handed an id by a verifier and has to decide whether this
+     * Gatekeeper has ever heard of it. Nothing else consults this, because nothing else needs to. A
+     * session's account id rides `ctx.props` on a stub the workspace holds, so it was minted here by
+     * construction, and re-deriving that on every call would be a lookup with no question behind it.
+     */
+    recordAccount(accountId: string, now: number): Promise<void>;
+    /**
+     * Whether this deployment minted the named account.
+     *
+     * Never pruned, and that is deliberate rather than an omission: the workspace holds the account
+     * stub for as long as it likes, and an id whose row expired would read as an account this
+     * Gatekeeper never made. Revoking an account's keys does not remove it either, because what was
+     * revoked is a credential and what is asked here is a fact about who exists.
+     */
+    hasAccount(accountId: string): Promise<boolean>;
     /**
      * Either the actor's existing key, or an exclusive claim on minting one.
      *

package/dist/state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;;OAOG;IACH,WAAW,EAAE,UAAU,GAAG,QAAQ,CAAA;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,4FAA4F;IAC5F,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAA;IACb,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;IACjB,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,kDAAkD;AAClD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,2FAA2F;AAC3F,MAAM,MAAM,UAAU,GAClB;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GACvC;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,GACtB;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAA;AAElD,iGAAiG;AACjG,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpB,qDAAqD;AACrD,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACvC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,CAAA;CAAE,CAAA;AAkC7E,qBAAa,eAAgB,SAAQ,aAAa;;IAChD;;;;;;;OAOG;IACG,aAAa,CACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,mBAAmB,CAAC,CA+B9B;IAED,iGAAiG;IAC3F,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAO/F;IAEK,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAE1D;IAED,4FAA4F;IACtF,SAAS,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAGzC;IAED,sFAAsF;IAChF,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAGzC;IAED;;;;;;;OAOG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAYnF;IAED;;;;;;;OAOG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAIjF;IAED,qGAAqG;IAC/F,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;IAED;;;;;;;OAOG;IACG,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMxF;IAED,sEAAsE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,SAAS,CAAA;KAAE,EAAE,CAAC,CAM5E;IAED;;;;;;;OAOG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1E;IAEc,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAepC;CA2BF"}
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAML,KAAK,kBAAkB,EAGvB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,gBAAgB,EAEtB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAErD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;;;OAOG;IACH,WAAW,EAAE,UAAU,GAAG,QAAQ,CAAA;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,4FAA4F;IAC5F,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAA;IACb,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;IACjB,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,kDAAkD;AAClD,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,2FAA2F;AAC3F,MAAM,MAAM,UAAU,GAClB;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GACvC;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,GACtB;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAA;AAElD,iGAAiG;AACjG,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpB,qDAAqD;AACrD,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACvC;IACE,OAAO,EAAE,IAAI,CAAA;IACb,MAAM,EAAE,QAAQ,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,CAAA;IACtD;;;;;;;;;;OAUG;IACH,MAAM,EAAE,cAAc,EAAE,CAAA;CACzB,CAAA;AAoCL,qBAAa,eAAgB,SAAQ,aAAa;;IAahD;;;;;;;OAOG;IACG,aAAa,CACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,mBAAmB,CAAC,CA8C9B;IAED;;;;;;;;;OASG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAQ/F;IAEK,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAE1D;IAED,4FAA4F;IACtF,SAAS,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAGzC;IAED,sFAAsF;IAChF,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAGzC;IAED;;;;;;;OAOG;IACG,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB5E;IAED;;;;;;;;OAQG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM/C;IAED;;;;;OAKG;IACG,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAM9D;IAED;;;;;;;;;OASG;IACG,aAAa,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA2B/F;IA8BD;;;;;;;;OAQG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjE;IAED;;;;;;;OAOG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEpD;IAED;;;;;;;OAOG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAYnF;IAED;;;;;;;OAOG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAIjF;IAED,qGAAqG;IAC/F,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElE;IAED;;;;;;;OAOG;IACG,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMxF;IAED,sEAAsE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,SAAS,CAAA;KAAE,EAAE,CAAC,CAM5E;IAED;;;;;;;OAOG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1E;IAEc,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAepC;CA0DF"}