Each entry links to the page that owns it: what a capability is, verification strategies, entitlements, and the reference for everything with a table behind it.
Capability
A package that composes into your Worker. Its name is one segment doing five jobs: the pithy add argument, the migration namespace, the pithy_<name>_* table prefix, the error-code domain and the audit-action domain.
Your own app is a capability too, and it composes last.
Seam
A point on the request where one capability’s contribution can replace a default.
A seam is present and inert, never absent. With no audit capability composed, c.var.emit is a no-op recorder — not undefined, so nothing null-checks it.
One seam’s default denies: the entitlement resolver, because a missing audit write cannot grant access and a missing entitlement check can.
Entitlement
The key your code checks — pro. Not a product, and never a SKU.
Many products across many rails may grant one key, which is the whole point of the indirection.
Subject
Who holds an entitlement, as a pair: (subjectType, subjectId).
Both halves travel together, because nothing makes a user id space and an organization id space disjoint.
Rail
One store you sell through — Apple, Google, Stripe, Lemon Squeezy, Paddle.
A rail is a listing on a product, not a product.
Verification strategy
How a route verifies its caller. Five: bearer, session, signed-webhook, control-plane, public.
There is no implicit auth. A route declares one.
Control plane — two meanings
Cloudflare’s is outbound: the REST API the CLI calls to create resources, with your token. Failures carry cloudflare/*.
The seam is inbound: how a management client calls your Worker, with a key you registered. Failures carry controlplane/*.
They share a name and nothing else.
Scope
A named permission on one management operation, matched exactly — no prefix rule, no wildcard.
Scopes name operations, not credential holders.
Manifest
What a Worker declares about itself to a management client: which capabilities it composes, and how to call each one’s admin routes — path, method, required scope.
Discovery over configuration.
Environment
A deployment target you declare. dev is local and always exists and can never be declared.
Every declared environment is managed — there is no second, narrower list.
Window
A leaderboard board’s period, expressed as CRON so a calendar month is expressible.
Each window carries its own aggregation state rather than being a filter over an append log.
Pool
What a rating is of. Defaults to the game key; name one to share a ladder.
Rated by exactly one algorithm, because the stored state is that algorithm’s own.
Hold
A reservation on a balance. It raises held and lowers available without moving the balance — so a stake is unspendable without having been spent.
Ref
An idempotency key on a ledger movement, unique across the whole ledger.
It names the event — buyin:table-7:hand-3 — never a clock or a random value.
Game model
A pluggable implementation of a game’s rules over the shared session lifecycle, resolved by kind.
Its logic is imported into the bundle; only its state lives in storage.
Redaction
The hidden-state boundary. One function decides what a given viewer may see, and reveals everything once the session is terminal.
Provenance
How a support thread came to name an account — a proved session, an unproved From: header, or nothing.
Not a boolean, because the same operator action follows from very different evidence.
Estimate
A number the kit computed from its own records because the authority exposes none.
Every field derived from one is named estimated, and a disclaimer naming the authority is required on the response.