Writing a Gatekeeper

A Gatekeeper is a Cloudflare Worker that mediates all access between a Gadget and an external service. It implements a three-tier hierarchy:

• Vendor (GatekeeperVendor, a WorkerEntrypoint) — top-level entry for the service. One per service.
• User (GatekeeperUser, a WorkerEntrypoint with ctx.props) — a human user's authenticated connection.
• Instance (Gatekeeper<Session>, a DO facet of the Overseer) — per-resource, per-Gadget binding that provides the Session API.

Read packages/workshop-shared/src/gatekeeper.ts for the canonical interfaces and detailed JSDoc.

New-gatekeeper observer contract

Write new gatekeepers to this observer contract:

• Every read that returns information to its caller (provider data, anything derived from it, or simulated state) explicitly reports subresources: every resource whose access rules govern that information. A simulated read reports every real resource its data came from. All observer authorization goes through verifyObserverAccess(); no requirement may live only in a binding-wide admission check.
• subresources: [] adds no requirement. It does not clear requirements already recorded, and it never means "the binding already checked it." Private-only provider data reports a real resource ID and denies collaborators through verifyObserverAccess(). Report and verify any required workspace or tenant membership explicitly.
• Implement getHistoricalSubresources(): Promise<string[]> as a read-only method returning [], with no legacy tracker. It is required even though the current Gatekeeper interface does not declare it, so type-checking will not catch its absence. Do not omit or remove it.
• Implement addObserver(id, verifier) and removeObserver(id), which the current interface requires, as compatibility-only no-ops. Do not introduce observer rosters, observed-set logs, stored observer verifiers, excludeObservers, or new legacy trackers.
• Require subresources in your read helper's type; the shared type still makes it optional. Type-checking does not enforce the whole contract; use the review checklist.