Compose Cloudflare Notifications with generic webhooks

[Ankcorn]

Gadget composition

This is a one-commit follow-up to cloudflare/cloudflare-os#537. It gives Gadget code the missing provider-side operation needed to compose the two gatekeepers:

const destination = await env.INCOMING_WEBHOOK.issueCredential({
  headerName: "cf-webhook-auth",
});

await env.CLOUDFLARE_NOTIFICATIONS.provisionNotificationInstallation({
  ...destination,
  name: "Real-Time Issues Investigator",
});

await env.INCOMING_WEBHOOK.subscribe(callback);

The generic webhook gatekeeper owns the endpoint, secret validation, and Gadget callback. The Cloudflare gatekeeper keeps the OAuth token private and, after approval, registers that endpoint and secret with the Cloudflare Notifications API. The blueprint only composes their typed capabilities; neither gatekeeper depends on the other.

Scope

• adds an account-scoped Cloudflare Notifications destination resource
• exposes approval-gated provisionNotificationInstallation(destination)
• requests notifications.write only when this resource is connected
• reconciles the destination by its exact callback URL

It intentionally adds no Cloudflare-specific receiver, subscription fan-out, payload parser, filtering, or delivery storage. Those responsibilities remain with the generic webhook gatekeeper and Gadget. This replaces the coupled design from closed PR cloudflare#467.

Validation

• 117 Cloudflare gatekeeper tests
• TypeScript check
• Wrangler deploy dry-run
• repository lint
• git diff --check

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}