@fabrika/app 0.3.3 → 0.4.0

package/src/client/files.ts

@@ -0,0 +1,135 @@
+// The file collections of a typed client: `api.files.<name>` for a signed-in caller of an RPC mount, and
+// `<link client>.files.<name>` for a link holder, whose owner is the link's object. The paths come from
+// `fileCollectionPaths`, the code that gives the artifact its rows; every answer is parsed before the caller sees it.
+
+import { z } from 'zod/v4'
+import { fileCollectionPaths, FILES_PREFIX, joinPath, LINK_API_SEGMENT } from '../contract/defaults'
+import type { FileCollection } from '../contract/define'
+import { FileListOutput } from '../contract/file-schemas'
+import { type BounceConfig, exchange, exchangeFile, RpcError, type RpcFetch } from './transport'
+
+/** A page of an owner's files, oldest first, as `files.<name>.list` answers it. */
+export type FileList = z.output<typeof FileListOutput>
+
+export interface FilePage {
+	/** The id of the last file of the previous page. */
+	readonly after?: string
+	/** 1–100, 50 by default. */
+	readonly limit?: number
+}
+
+export interface UploadOptions {
+	/** The file's name, metadata only; a `File`'s own name by default. */
+	readonly name?: string
+}
+
+/** One collection, for a signed-in caller: the owner is a parameter, checked against the caller's grants. */
+export interface FileClient {
+	/** Uploads `file` (its `type` is the declared media type) to `owner`; answers the new file's id. */
+	upload(owner: string, file: Blob, options?: UploadOptions): Promise<{ readonly id: string }>
+	/** The owner's files, oldest first. */
+	list(input: { readonly owner: string } & FilePage): Promise<FileList>
+	/** The file `id`, named as it was uploaded. A refusal is an `RpcError`: 409 `quarantined` while it is being scanned. */
+	download(id: string): Promise<File>
+	remove(input: { readonly id: string }): Promise<{ readonly id: string }>
+}
+
+/** One collection, for a link holder: the owner is the object the key is bound to, never a parameter. */
+export interface LinkFileClient {
+	upload(file: Blob, options?: UploadOptions): Promise<{ readonly id: string }>
+	list(input?: FilePage): Promise<FileList>
+	download(id: string): Promise<File>
+}
+
+/** The collections the holders of link mount `M` reach: those with `link: true`, and those whose `link` names `M`. */
+export type LinkCollections<F, M> = {
+	[N in keyof F]: F[N] extends FileCollection<string, infer L>
+		? [L] extends [true] ? N : [L] extends [readonly (infer Named)[]] ? M extends Named ? N : never : never
+		: never
+}[keyof F]
+
+/** What a client sends with every request: its key as a bearer, or the page's session. */
+export interface FileTransport {
+	readonly origin: string
+	readonly fetch: RpcFetch
+	readonly key: string | undefined
+	readonly bounce: BounceConfig | null
+}
+
+const Uploaded = z.strictObject({ id: z.uuid() })
+
+/** The request, built inside the transport's guard: the key as a bearer and no cookie, or the page's session. */
+function init(transport: FileTransport, method: 'GET' | 'POST', contentType: string | null, body?: BodyInit): () => RequestInit {
+	return () => {
+		const headers = new Headers()
+		if (contentType !== null) {
+			headers.set('Content-Type', contentType)
+		}
+		if (transport.key !== undefined) {
+			headers.set('Authorization', `Bearer ${transport.key}`)
+		}
+		return { method, credentials: transport.key === undefined ? 'same-origin' : 'omit', headers, ...(body === undefined ? {} : { body }) }
+	}
+}
+
+async function call<S extends z.ZodType>(transport: FileTransport, url: string, input: unknown, output: S, id: string): Promise<z.output<S>> {
+	const request = init(transport, 'POST', 'application/json', JSON.stringify(input ?? {}))
+	const parsed = z.safeParse(output, await exchange(transport.fetch, url, request, transport.bounce))
+	if (!parsed.success) {
+		throw new RpcError({ type: 'invalid-response', message: `'${id}' answered a value its output schema refuses`, httpStatus: 200 })
+	}
+	return parsed.data
+}
+
+async function upload(transport: FileTransport, path: string, file: Blob, options: UploadOptions, id: string): Promise<{ readonly id: string }> {
+	const name = options.name ?? (file instanceof File ? file.name : '')
+	const url = `${transport.origin}${path}${name === '' ? '' : `?${new URLSearchParams({ name })}`}`
+	const parsed = z.safeParse(Uploaded, await exchange(transport.fetch, url, init(transport, 'POST', file.type, file), transport.bounce))
+	if (!parsed.success) {
+		throw new RpcError({ type: 'invalid-response', message: `'${id}' answered a value its output schema refuses`, httpStatus: 200 })
+	}
+	return parsed.data
+}
+
+/** `filename*=UTF-8''…` of a download's `Content-Disposition`, as `files/treatment.ts` writes it. */
+function nameOf(disposition: string | null, fallback: string): string {
+	const encoded = disposition?.match(/filename\*=UTF-8''([^;]+)/)?.[1]
+	if (encoded === undefined) {
+		return fallback
+	}
+	try {
+		return decodeURIComponent(encoded)
+	} catch {
+		return fallback
+	}
+}
+
+async function download(transport: FileTransport, path: string, file: string): Promise<File> {
+	const url = `${transport.origin}${path}/${encodeURIComponent(file)}`
+	const answer = await exchangeFile(transport.fetch, url, init(transport, 'GET', null), transport.bounce)
+	return new File([answer.body], nameOf(answer.disposition, file), { type: answer.body.type })
+}
+
+/** The collection `name` for a signed-in caller. */
+export function sessionFiles(transport: FileTransport, name: string): FileClient {
+	const paths = fileCollectionPaths(FILES_PREFIX, name)
+	const id = `files.${name}`
+	return Object.freeze({
+		upload: (owner: string, file: Blob, options: UploadOptions = {}) =>
+			upload(transport, `${paths.upload}/${encodeURIComponent(owner)}`, file, options, `${id}.upload`),
+		list: (input: { readonly owner: string } & FilePage) => call(transport, `${transport.origin}${paths.list}`, input, FileListOutput, `${id}.list`),
+		download: (file: string) => download(transport, paths.download, file),
+		remove: (input: { readonly id: string }) => call(transport, `${transport.origin}${paths.remove}`, input, Uploaded, `${id}.remove`),
+	})
+}
+
+/** The collection `name` for a holder of a key of the link mount at `prefix`. */
+export function linkFiles(transport: FileTransport, prefix: string, mount: string, name: string): LinkFileClient {
+	const paths = fileCollectionPaths(joinPath(prefix, LINK_API_SEGMENT), name)
+	const id = `${mount}.files.${name}`
+	return Object.freeze({
+		upload: (file: Blob, options: UploadOptions = {}) => upload(transport, paths.upload, file, options, `${id}.upload`),
+		list: (input: FilePage = {}) => call(transport, `${transport.origin}${paths.list}`, input, FileListOutput, `${id}.list`),
+		download: (file: string) => download(transport, paths.download, file),
+	})
+}

package/src/client/index.ts

@@ -0,0 +1,19 @@
+// @fabrika/app/client — the typed client of a contract application, for its SPA and for scripts. Browser-safe.
+export { type PageCaller, parsePageCaller } from './caller'
+export {
+	type AttachmentProcedure,
+	type ClientMount,
+	type ClientOptions,
+	type ClientTree,
+	type ContractClient,
+	createClient,
+	download,
+	type DownloadInput,
+	type InputOf,
+	type LinkClientOptions,
+	type ProcedureCall,
+	type ResultOf,
+} from './contract'
+export type { FileClient, FileList, FilePage, LinkFileClient, UploadOptions } from './files'
+export { shareKey } from './share'
+export { type BounceOption, RpcError, type RpcFetch } from './transport'

package/src/client/rpc.ts

@@ -0,0 +1,47 @@
+// The RPC client of the `{ method, input }` wire protocol that `dispatchRpcRequest` serves, a typed proxy:
+// `client.a.b.c(input)` POSTs `{ method: 'a.b.c', input }` to the configured endpoint and unwraps `{ result }` /
+// `{ error }`. Errors surface as `RpcError` (carrying `type`, `loginUrl`, … off the error envelope).
+
+import type { InferRpcClient } from '../rpc/contract.js'
+import { type BounceConfig, type BounceOption, exchange, resolveBounce, type RpcFetch } from './transport.js'
+
+export interface RpcClientOptions {
+	/** Endpoint the RPC proxy POSTs to (e.g. `/rpc`). */
+	readonly baseUrl: string
+	/**
+	 * Auto-redirect to SSO on a sign-in 401 (`type: 'auth'` + `loginUrl`) instead of throwing.
+	 * `true` uses sane defaults; pass `{ sessionKey, windowMs }` to tune the re-entry guard.
+	 */
+	readonly bounceOnAuth?: BounceOption
+	/** Override `fetch` (tests / non-browser). Defaults to the global `fetch`. */
+	readonly fetch?: RpcFetch
+}
+
+function callRpc(opts: RpcClientOptions, bounce: BounceConfig | null, method: string, input: unknown): Promise<unknown> {
+	return exchange(opts.fetch ?? fetch, opts.baseUrl, () => ({
+		method: 'POST',
+		credentials: 'include',
+		headers: { 'content-type': 'application/json' },
+		body: JSON.stringify({ method, input: input ?? null }),
+	}), bounce)
+}
+
+function makeProxy(opts: RpcClientOptions, bounce: BounceConfig | null, path: string): unknown {
+	const fn = (input: unknown) => callRpc(opts, bounce, path, input)
+	return new Proxy(fn, {
+		get(_target, prop) {
+			if (typeof prop !== 'string') return undefined
+			return makeProxy(opts, bounce, path ? `${path}.${prop}` : prop)
+		},
+	})
+}
+
+function isClient<TApi>(value: unknown): value is InferRpcClient<TApi> {
+	return typeof value === 'function'
+}
+
+export function createRpcClient<TApi>(opts: RpcClientOptions): InferRpcClient<TApi> {
+	const proxy = makeProxy(opts, resolveBounce(opts.baseUrl, opts.bounceOnAuth), '')
+	if (!isClient<TApi>(proxy)) throw new Error('unreachable')
+	return proxy
+}

package/src/client/share.ts

@@ -0,0 +1,14 @@
+// The share SPA's key. The framework serves the SPA's document with a bootstrap that runs before any other script:
+// it takes the key out of the URL fragment (`/s/#<key>`), removes the fragment, and keeps the key in a closure.
+
+import { SHARE_KEY_GLOBAL } from '../contract/defaults'
+
+/** The key the share link carried, or `null` outside a share SPA or when the link had none. */
+export function shareKey(): string | null {
+	const read: unknown = Reflect.get(globalThis, SHARE_KEY_GLOBAL)
+	if (typeof read !== 'function') {
+		return null
+	}
+	const key: unknown = read()
+	return typeof key === 'string' && key !== '' ? key : null
+}

package/src/{client.ts → client/transport.ts}

@@ -1,15 +1,9 @@
-// ─── RPC client ──────────────────────────────────────────────────────
+// What both browser clients share: the error type, the login bounce, and reading the `{ result }` / `{ error }`
+// envelope off a response.
 //
-// A typed proxy: `client.a.b.c(input)` POSTs `{ method: 'a.b.c', input }` to the
-// configured endpoint and unwraps `{ result }` / `{ error }`. Errors surface as
-// `RpcError` (carrying `type`, `loginUrl`, … off the error envelope).
-//
-// `bounceOnAuth` folds the SSO redirect every SPA needs into the client: on a
-// human-gated 401 (`type: 'auth'` + `loginUrl`) it redirects the browser to the
-// login URL (returning the current page) instead of throwing, with a short
-// re-entry guard so an unprovisioned identity can't loop forever.
-
-import type { InferRpcClient } from './rpc/contract.js'
+// `bounceOnAuth` folds the SSO redirect every SPA needs into the client: on a 401 for a person who must sign in (`type: 'auth'` +
+// `loginUrl`) it redirects the browser to the login URL (returning the current page) instead of throwing, with a
+// short re-entry guard so an unprovisioned identity can't loop forever.
 
 export class RpcError extends Error {
 	readonly type: string
@@ -29,27 +23,21 @@ export class RpcError extends Error {
 /** Minimal Fetch API surface required by the RPC client. */
 export type RpcFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>
 
-interface BounceConfig {
+/**
+ * Auto-redirect to SSO on a sign-in 401 (`type: 'auth'` + `loginUrl`) instead of throwing.
+ * `true` uses sane defaults; pass `{ sessionKey, windowMs }` to tune the re-entry guard.
+ */
+export type BounceOption = boolean | { sessionKey?: string; windowMs?: number }
+
+export interface BounceConfig {
 	readonly sessionKey: string
 	readonly windowMs: number
 }
 
-export interface RpcClientOptions {
-	/** Endpoint the RPC proxy POSTs to (e.g. `/rpc`). */
-	readonly baseUrl: string
-	/**
-	 * Auto-redirect to SSO on a human-gated 401 (`type: 'auth'` + `loginUrl`) instead of throwing.
-	 * `true` uses sane defaults; pass `{ sessionKey, windowMs }` to tune the re-entry guard.
-	 */
-	readonly bounceOnAuth?: boolean | { sessionKey?: string; windowMs?: number }
-	/** Override `fetch` (tests / non-browser). Defaults to the global `fetch`. */
-	readonly fetch?: RpcFetch
-}
-
-function resolveBounce(baseUrl: string, opt: RpcClientOptions['bounceOnAuth']): BounceConfig | null {
+export function resolveBounce(scope: string, opt: BounceOption | undefined): BounceConfig | null {
 	if (!opt) return null
 	const tuning = opt === true ? {} : opt
-	return { sessionKey: tuning.sessionKey ?? `fabrika:login-bounce:${baseUrl}`, windowMs: tuning.windowMs ?? 10_000 }
+	return { sessionKey: tuning.sessionKey ?? `fabrika:login-bounce:${scope}`, windowMs: tuning.windowMs ?? 10_000 }
 }
 
 /** Guarded SSO redirect. Returns true if it navigated (caller should hang), false if guarded/non-browser. */
@@ -90,54 +78,63 @@ function normalizeError(
 	return { type: 'error', message: `HTTP ${httpStatus}`, httpStatus }
 }
 
-async function callRpc(opts: RpcClientOptions, bounce: BounceConfig | null, method: string, input: unknown): Promise<unknown> {
-	const doFetch = opts.fetch ?? fetch
-	let response: Response
+/** Sends one request; a network failure, or an input `init` cannot serialize, is an `RpcError`. */
+async function send(doFetch: RpcFetch, url: string, init: () => RequestInit): Promise<Response> {
 	try {
-		response = await doFetch(opts.baseUrl, {
-			method: 'POST',
-			credentials: 'include',
-			headers: { 'content-type': 'application/json' },
-			body: JSON.stringify({ method, input: input ?? null }),
-		})
+		return await doFetch(url, init())
 	} catch {
 		throw new RpcError({ type: 'transport', message: 'Network request failed', httpStatus: 0 })
 	}
-	let data: { result?: unknown; error?: unknown }
+}
+
+/** The `{ error }` envelope as an `RpcError`, or a sign-in redirect that never settles. */
+function refused(raw: unknown, response: Response, bounce: BounceConfig | null): Promise<never> {
+	const normalized = normalizeError(raw, response.status)
+	if (bounce && normalized.type === 'auth' && normalized.loginUrl !== undefined && bounceToLogin(normalized.loginUrl, bounce)) {
+		// Navigation is in flight — never resolve, so the caller (a route loader) stays pending.
+		return new Promise<never>(() => {})
+	}
+	throw new RpcError(normalized)
+}
+
+async function envelope(response: Response): Promise<{ result?: unknown; error?: unknown }> {
 	try {
-		data = await response.json()
+		return await response.json()
 	} catch {
 		// Non-JSON response (proxy error, HTML error page, etc.) — surface the HTTP status.
 		throw new RpcError({ type: 'transport', message: `${response.status} ${response.statusText}`, httpStatus: response.status })
 	}
+}
+
+/**
+ * Sends one request and answers the envelope's `result`; every failure is an `RpcError`. `init` builds the request
+ * inside the guard, so an input that does not serialize rejects like a failed request instead of throwing.
+ */
+export async function exchange(doFetch: RpcFetch, url: string, init: () => RequestInit, bounce: BounceConfig | null): Promise<unknown> {
+	const response = await send(doFetch, url, init)
+	const data = await envelope(response)
 	if (data.error !== undefined) {
-		const normalized = normalizeError(data.error, response.status)
-		if (bounce && normalized.type === 'auth' && normalized.loginUrl !== undefined && bounceToLogin(normalized.loginUrl, bounce)) {
-			// Navigation is in flight — never resolve, so the caller (a route loader) stays pending.
-			return new Promise<never>(() => {})
-		}
-		throw new RpcError(normalized)
+		return await refused(data.error, response, bounce)
 	}
 	clearBounce(bounce)
 	return data.result
 }
 
-function makeProxy(opts: RpcClientOptions, bounce: BounceConfig | null, path: string): unknown {
-	const fn = (input: unknown) => callRpc(opts, bounce, path, input)
-	return new Proxy(fn, {
-		get(_target, prop) {
-			if (typeof prop !== 'string') return undefined
-			return makeProxy(opts, bounce, path ? `${path}.${prop}` : prop)
-		},
-	})
-}
-
-function isClient<TApi>(value: unknown): value is InferRpcClient<TApi> {
-	return typeof value === 'function'
-}
-
-export function createRpcClient<TApi>(opts: RpcClientOptions): InferRpcClient<TApi> {
-	const proxy = makeProxy(opts, resolveBounce(opts.baseUrl, opts.bounceOnAuth), '')
-	if (!isClient<TApi>(proxy)) throw new Error('unreachable')
-	return proxy
+/**
+ * Sends one request whose success is a file and answers its bytes and its `Content-Disposition`; a failure is read from
+ * its `{ error }` envelope.
+ */
+export async function exchangeFile(
+	doFetch: RpcFetch,
+	url: string,
+	init: () => RequestInit,
+	bounce: BounceConfig | null,
+): Promise<{ readonly body: Blob; readonly disposition: string | null }> {
+	const response = await send(doFetch, url, init)
+	if (!response.ok) {
+		const data = await envelope(response)
+		return await refused(data.error ?? `HTTP ${response.status}`, response, bounce)
+	}
+	clearBounce(bounce)
+	return { body: await response.blob(), disposition: response.headers.get('Content-Disposition') }
 }

package/src/cloudflare.ts

@@ -1,6 +1,16 @@
 // ─── Cloudflare Workers adapter ──────────────────────────────────────
 
-import type { FabrikaApp, RequestExecutionContext } from './app.js'
+import { DecodedIamMembership } from '@fabrika/auth'
+import type { IamMembershipRpc } from '@fabrika/auth-core'
+import { parseJwks } from '@fabrika/jwks'
+import type { FetchService, RequestExecutionContext } from './fetch.js'
+import { boot, type ContractApp, type IamKeySource } from './implement/boot.js'
+import { CONNECT_BINDING_PREFIX, type ConnectFetch } from './implement/connect.js'
+import type { SpaAssets } from './implement/dispatch.js'
+import { captureEnvironment } from './implement/environment.js'
+import type { ContractImplementation } from './implement/implement.js'
+
+export { markProductionProcess } from '@fabrika/db/production'
 
 /** Minimal structural view of a Workers `ExecutionContext`. */
 export interface CloudflareExecutionContext extends RequestExecutionContext {
@@ -31,9 +41,9 @@ export interface CloudflareWorker<Env> {
 	queue?(batch: CloudflareMessageBatch, env: Env, exec: CloudflareExecutionContext): Promise<void>
 }
 
-/** Adapt a runtime-neutral Fabrika application to a Workers module export. */
+/** Adapt a runtime-neutral `{ fetch }` service to a Workers module export. */
 export function createCloudflareWorker<Env>(
-	app: FabrikaApp<Env>,
+	app: FetchService<Env>,
 	options: CloudflareWorkerOptions<Env> = {},
 ): CloudflareWorker<Env> {
 	const scheduled = options.scheduled
@@ -44,3 +54,129 @@ export function createCloudflareWorker<Env>(
 		...(queue ? { queue } : {}),
 	}
 }
+
+// ─── Contract applications ───────────────────────────────────────────
+
+/** The framework's bindings: IAM's application entrypoint and the Workers Assets of the SPA. No handler sees them. */
+const FRAMEWORK_BINDINGS: ReadonlySet<string> = new Set(['IAM', 'ASSETS'])
+
+function method(target: unknown, name: string): ((...args: unknown[]) => unknown) | null {
+	if (typeof target !== 'object' || target === null || !(name in target)) {
+		return null
+	}
+	const found: unknown = Reflect.get(target, name)
+	return typeof found === 'function' ? (...args) => Reflect.apply(found, target, args) : null
+}
+
+function bindingKeySource(binding: unknown): IamKeySource {
+	const getJwks = method(binding, 'getJwks')
+	if (getJwks === null) {
+		throw new Error('the IAM binding is missing (env.IAM); the platform binds it to every application Worker')
+	}
+	return {
+		async getJwks() {
+			const jwks = parseJwks(await getJwks())
+			if (jwks === null) {
+				throw new Error('IAM returned no usable key set')
+			}
+			return jwks
+		},
+	}
+}
+
+/**
+ * IAM's membership operations on the `IAM` binding (`PropustkaApplication`), every answer decoded like the HTTP
+ * transport's. A binding without them is no membership transport, and `boot` refuses a contract that needs one.
+ */
+function bindingMembership(binding: unknown): IamMembershipRpc | undefined {
+	const methods = ['requestDelegation', 'createScope', 'assignMember', 'revokeMember', 'listMembers', 'issueLink', 'revokeLink'] as const
+	if (!methods.every((name) => method(binding, name) !== null)) {
+		return undefined
+	}
+	return new DecodedIamMembership(async (name, input) => {
+		const call = method(binding, name)
+		if (call === null) {
+			throw new Error(`the IAM binding has no ${name}`)
+		}
+		return await call(input)
+	})
+}
+
+function bindingAssets(binding: unknown): SpaAssets | undefined {
+	const fetchAsset = method(binding, 'fetch')
+	if (fetchAsset === null) {
+		return undefined
+	}
+	return {
+		async serve(_mount, request) {
+			const response: unknown = await fetchAsset(request)
+			if (!(response instanceof Response)) {
+				throw new Error('the ASSETS binding answered something that is not a Response')
+			}
+			return response
+		},
+	}
+}
+
+/**
+ * The service bindings to owners' proxy Workers (`FABRIKA_CONNECT_<IMPORT>`), which `captureEnvironment` keeps from
+ * the application because no `FABRIKA_*` value reaches it. A binding routes by itself: the URL it is called with
+ * carries the owner's host, which the proxy Worker selects the application by.
+ */
+function connectBindings(env: Readonly<Record<string, unknown>>): Record<string, ConnectFetch> {
+	const bindings: Record<string, ConnectFetch> = {}
+	for (const [name, binding] of Object.entries(env)) {
+		// Read, not tested with `in`: a binding stub may answer `fetch` without owning the property (Lopata's does not).
+		const fetchOwner: unknown = name.startsWith(CONNECT_BINDING_PREFIX) && typeof binding === 'object' && binding !== null
+			? Reflect.get(binding, 'fetch')
+			: undefined
+		if (typeof fetchOwner === 'function') {
+			bindings[name] = async (request) => {
+				const response: unknown = await Reflect.apply(fetchOwner, binding, [request])
+				if (!(response instanceof Response)) {
+					throw new Error(`the ${name} binding answered something that is not a Response`)
+				}
+				return response
+			}
+		}
+	}
+	return bindings
+}
+
+/** The application module, imported only after the environment was captured: the generated entrypoint's `import()`. */
+export type ImplementationLoader = () => Promise<{ readonly default: ContractImplementation }>
+
+/**
+ * A Worker module for a contract application, called only by the generated entrypoint. A Worker receives its
+ * environment with the first request, so the framework captures it, scrubs the process environment and only then
+ * imports the application and boots it, once per environment object.
+ */
+export function createContractWorker(load: ImplementationLoader): {
+	fetch(request: Request, env: Readonly<Record<string, unknown>>, exec: CloudflareExecutionContext): Promise<Response>
+} {
+	const booted = new WeakMap<object, Promise<ContractApp>>()
+	const bootFor = async (env: Readonly<Record<string, unknown>>): Promise<ContractApp> => {
+		const variables = Object.fromEntries(Object.entries(env).filter(([name]) => !FRAMEWORK_BINDINGS.has(name)))
+		const environment = captureEnvironment(variables)
+		const { default: app } = await load()
+		return boot(app, {
+			environment,
+			iam: bindingKeySource(env['IAM']),
+			assets: bindingAssets(env['ASSETS']),
+			membership: bindingMembership(env['IAM']),
+			connectBindings: connectBindings(env),
+		})
+	}
+	return {
+		async fetch(request, env, exec) {
+			let contractApp = booted.get(env)
+			if (contractApp === undefined) {
+				contractApp = bootFor(env)
+				booted.set(env, contractApp)
+				// A failed boot is not cached: the next request boots again and fails with the same problems.
+				contractApp.catch(() => booted.delete(env))
+			}
+			return (await contractApp).fetch(request, exec)
+		},
+	}
+}