@fabrika/app 0.5.5 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/app",
-	"version": "0.5.5",
+	"version": "0.7.0",
 	"type": "module",
 	"license": "MIT",
 	"repository": {
@@ -93,14 +93,14 @@
 		"test": "bun test --path-ignore-patterns='src/react/**' && bun test --isolate src/react"
 	},
 	"dependencies": {
-		"@fabrika/auth": "0.5.5",
-		"@fabrika/auth-core": "0.5.5",
-		"@fabrika/db": "0.5.5",
-		"@fabrika/email": "0.5.5",
-		"@fabrika/jwks": "0.5.5",
-		"@fabrika/platform": "0.5.5",
-		"@fabrika/platform-node": "0.5.5",
-		"@fabrika/proxy-core": "0.5.5",
+		"@fabrika/auth": "0.7.0",
+		"@fabrika/auth-core": "0.7.0",
+		"@fabrika/db": "0.7.0",
+		"@fabrika/email": "0.7.0",
+		"@fabrika/jwks": "0.7.0",
+		"@fabrika/platform": "0.7.0",
+		"@fabrika/platform-node": "0.7.0",
+		"@fabrika/proxy-core": "0.7.0",
 		"jose": "^5.9.0"
 	},
 	"peerDependencies": {

package/skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: fabrika-app
-version: 0.5.5
+version: 0.7.0
 description: >
   How to write and change a Fabrika application: src/vocabulary.ts, db/migrations/, src/db/tables.ts, the
   slices' endpoints.ts with their handlers, fabrika.contract.ts, jobs, files, webhooks, share links, connectors
@@ -204,7 +204,9 @@ export const tasks = app.group({ callers: ['human'] }, (r) => ({
   `@fabrika/app`. Any thrown value with a numeric `httpStatus` below 500, a `type` and a `message` answers that status
   (the framework's other errors are such values); any other throw is a 500.
 - One action per endpoint. A column that another action writes gets its own write action and its own endpoint
-  (`assign` above). Never check a second action inside a handler: split the endpoint.
+  (`assign` above). Never check a second action inside a handler: split the endpoint. An operation that reads one
+  object and writes another (a copy from one deal to another) declares both under
+  `access: { capabilities: { <name>: <form>, … } }` (`references/endpoint.md`).
 - Never take a user, owner or tenant id from the input, nor the caller's own address. The scope comes from the access
   form; `ctx.principal.id` is the caller, and `ctx.principal.email` its address. A person someone picks (`assign` above) is checked with `ctx.members.get(id)`, which answers `null` for
   anyone outside the org, and its label comes from that answer, never from the input.
@@ -220,15 +222,19 @@ the access check. `references/spa.md` shows the stack.
 
 ## Off the road: declare it
 
-| What the handler needs         | Declare on the endpoint                        | It gets                                             |
-| ------------------------------ | ---------------------------------------------- | --------------------------------------------------- |
-| a join, a report, a bulk write | `sql: 'read'` (or `'write'`)                   | `` ctx.sql(Row)`…` ``, scoped with `ctx.sql.scope`  |
-| rows outside its capability    | `unscoped: { <table>: 'read' }`                | `ctx.db.unscoped.<table>`                           |
-| another application's export   | `connect: ['<import>']`                        | `ctx.connect.<import>`                              |
-| a share link                   | `issues: '<link mount>'`                       | `ctx.links.issue`                                   |
-| e-mail (a cron job only)       | `mailer: 'installation'`                       | `ctx.mail.send`                                     |
-| a file with a public form      | `files: { photo: { collection } }` on `c.form` | the id in the inbox; the job's `tx.files(…).attach` |
-| a trigger, function or view    | its migration                                  | —                                                   |
+| What the handler needs         | Declare on the endpoint                                 | It gets                                            |
+| ------------------------------ | ------------------------------------------------------- | -------------------------------------------------- |
+| a join, a report, a bulk write | `sql: 'read'` (or `'write'`)                            | `` ctx.sql(Row)`…` ``, scoped with `ctx.sql.scope` |
+| rows outside its capability    | `unscoped: { <table>: 'read' }`                         | `ctx.db.unscoped.<table>`                          |
+| another application's export   | `connect: ['<import>']`                                 | `ctx.connect.<import>`                             |
+| a share link                   | `issues: '<link mount>'`                                | `ctx.links.issue`                                  |
+| e-mail (a cron job only)       | `mailer: 'installation'`                                | `ctx.mail.send`                                    |
+| a file from a public procedure | `file('<kind>')` input, `admission` with `bytesPerHour` | a reference the handler writes into a file column  |
+| an outside HTTPS API           | `egress: ['https://api.example.com']`                   | `fetch` to exactly those origins                   |
+| a signed link (unsubscribe)    | `signs: ['<purpose>']`                                  | `ctx.tokens.sign`                                  |
+| a webhook binding              | `binds: '<webhook>'`                                    | `ctx.webhooks('<webhook>').bind` and `.unbind`     |
+| a job run after the commit     | `kicks: ['<job>']`                                      | `ctx.kick('<job>')`                                |
+| a trigger, function or view    | its migration                                           | —                                                  |
 
 Scope every scoped table a raw statement reads with `${ctx.sql.scope(<capability>, '<table>', '<alias>')}`, a conjunct
 of its WHERE or JOIN … ON (`where (<filter>) and ${…}`): `ctx.target` for `on` and `in`, `ctx.within` for `over`, a
@@ -246,7 +252,7 @@ Which promise the types, the checker, boot, the runtime or the approver keeps, a
 - Data work first, external calls after. The invocation's one transaction rolls back on a throw; IAM, object storage
   and connector calls do not. An endpoint the generated tests cover calls no outside service (a provider's API): it
   records an outbox row, and a job makes the call (`references/jobs.md`).
-- An endpoint never sends e-mail; it has no `ctx.mail`. It records an outbox row and declares `then: '<job>'`, which
+- An endpoint never sends e-mail; it has no `ctx.mail`. It records an outbox row, declares `kicks: ['<job>']` and calls `ctx.kick('<job>')`, which
   starts that job once its transaction committed. The job declares `mailer` and sends with `ctx.mail`, under a key
   derived from the row, and sends again only where `ctx.mail.mayRetry(error)` allows it (`references/jobs.md`).
 - No `as` (except `as const`), `any`, `@ts-ignore`, `@ts-expect-error`, `process.env` or `Bun.env`.
@@ -259,7 +265,7 @@ Which promise the types, the checker, boot, the runtime or the approver keeps, a
 - A 401, a 403 or a failing generated test: never loosen the contract, a role, a policy or a test to pass. Tell the
   human which action or role the caller lacks.
 - When the task does not already ask for it, before you add a role, a grant, an action, a declared deviation, an
-  anonymous endpoint (`c.form`, a form's `files`, a webhook, a link), an export or an import, or a job, or before you drop or rename a
+  anonymous endpoint (a public procedure, its file field, a webhook, a link), an export or an import, or a job, or before you drop or rename a
   column: say in one sentence what it lets someone do, and wait for a yes. A data repair goes to the operator, not
   into a job.
 - A file refused as protected: stop and ask. Do not move the change elsewhere.
@@ -308,19 +314,21 @@ and the application's jobs sent. Write the seed and use it as `references/dev.md
 Read the one you need before you write that part. Together they are one application to copy from: `app-setup.md`
 (`package.json`, `tsconfig.json`, the contract, `fabrika.config.ts`, the SPA's build), `spa.md` (the hooks, forms and
 their errors, the caller, the components, routing, theming, screen tests), `table-and-migration.md`, `endpoint.md`
-(access forms, which `over`, the caller's scopes, handles, lists and aggregates, `fromRow`, `ctx.sql`, audited CSV
-downloads, members and labels), `tests.md` (generated tests, seeds, `testKit`, a reused scope, a caller's label, confirming a file ran),
+(access forms, several capabilities, which `over`, the caller's scopes, handles, lists and aggregates, `fromRow`,
+`ctx.sql`, audited CSV downloads, `admission` and `limits`, the HTTP shape and `redirect()`, signed tokens, `egress`,
+`ctx.url`, a mount's `compatibility`, another origin, members and labels), `tests.md` (generated tests, seeds, `testKit`, a reused scope, a caller's label, confirming a file ran),
 `errors.md` (checker findings, type errors, runtime answers), `dev.md` (the seed and the preview), `jobs.md` (which dimension `ctx.within` names, the UTC
-day, e-mail through `ctx.mail`, the outbox and `then`), `files.md` and `webhooks-links-connectors.md`, all under `references/`. Two are applications of their own:
+day, queue tables and `claim`, e-mail through `ctx.mail` with attachments and unsubscribe, the outbox and `kicks`),
+`files.md` and `webhooks-links-connectors.md`, all under `references/`. Two are applications of their own:
 `start.md`, a new application before its first table (its first test, adding the first table, installing and updating
-this skill), and `public-intake.md`, a public page, a form, a job that issues links and e-mails them, a link holder's
-files, HR's review with its history.
+this skill), and `public-intake.md`, a public page, public procedures, a job that claims their rows, issues links and
+e-mails them, a link holder's files, HR's review with its history.
 
 ## Not built yet
 
 - The data layer runs on Bun and Postgres only (Zerops). On Cloudflare an application has no tables, jobs or files.
-- Jobs are cron only and app-wide: no `ctx.jobs.enqueue`, no job per scope. A mutation's `then` starts a run of its
-  job; it carries nothing. A list write is off the road (`sql`).
-- `ctx.mail` sends no attachments.
+- Jobs are cron only and app-wide: no `ctx.jobs.enqueue`, no job per scope. A `ctx.kick` starts a run of its job; it
+  carries nothing, and the job finds its work in a queue table with `claim`. A list write is off the road (`sql`).
+- A read across tables (a join, a filter over a related table, an aggregate over several) is off the road (`sql`).
 - An MCP workspace has no shell, so `codegen` and `test-scaffold` cannot run there. Tell the human; never write a
   generated file by hand.

package/skill/references/app-setup.md

@@ -19,20 +19,20 @@ the SPA is added with it.
 		"test": "bun test --isolate"
 	},
 	"dependencies": {
-		"@fabrika/app": "0.5.5",
-		"@fabrika/db": "0.5.5",
-		"@fabrika/provider-zerops": "0.5.5",
-		"@fabrika/proxy-core": "0.5.5",
-		"@fabrika/ui": "0.5.5",
+		"@fabrika/app": "0.7.0",
+		"@fabrika/db": "0.7.0",
+		"@fabrika/provider-zerops": "0.7.0",
+		"@fabrika/proxy-core": "0.7.0",
+		"@fabrika/ui": "0.7.0",
 		"kysely": "0.29.6",
 		"react": "^19.0.0",
 		"react-dom": "^19.0.0",
 		"zod": "^3.25.76"
 	},
 	"devDependencies": {
-		"@fabrika/check": "0.5.5",
-		"@fabrika/cli": "0.5.5",
-		"@fabrika/platform": "0.5.5",
+		"@fabrika/check": "0.7.0",
+		"@fabrika/cli": "0.7.0",
+		"@fabrika/platform": "0.7.0",
 		"@happy-dom/global-registrator": "^20.11.2",
 		"@types/bun": "latest",
 		"@types/react": "^19.0.0",
@@ -50,25 +50,38 @@ the SPA is added with it.
 - `kysely` is there for the generated schema's types. The SPA reports its errors to Operations by itself:
   `FabrikaProvider` reads the DSN, release and environment the framework serves at `<prefix>/__fabrika-config.json`
   and sends every uncaught error and unhandled rejection there; add no error-reporting SDK. The same file carries
-  `public: { <VARIABLE>: <value> }`: each form challenge's `siteKey`, and the variables the SPA mount lists in
-  `c.spa(prefix, { …, public: ['SIGNUP_URL'] })`. A page reads a per-environment public value (a site key, a link
+  `public: { <VARIABLE>: <value> }`: each public procedure's challenge `siteKey`, and the variables the SPA mount lists in
+  `c.spa(prefix, { …, browserConfig: ['SIGNUP_URL'] })`. A page reads a per-environment public value (a site key, a link
   target) there, never as a build-time constant; it holds no other variable, and the contract refuses a secret in it.
   `react`, `react-dom` and `@fabrika/ui` (with `@types/react`, `@types/react-dom` and `@happy-dom/global-registrator`
   for the screen tests) are the SPA's: add them with it.
 - After you create a new workspace in a monorepo, run `bun install` at the repository root. Until then every
   `@fabrika/*` import fails and tsc reports a cascade of implicit `any`s that are not your bugs.
 - To try unreleased packages outside the fabrika-platform repository, run `bun scripts/release.ts pack --local
-  --artifacts=<dir>` there. It writes the tarballs, `release-manifest.json` and `install.json`. Copy the tarballs into
-  the application's `vendor/`, replace every `@fabrika/*` entry of `dependencies` and `devDependencies` with the
-  `dependencies` of `install.json`, add its `overrides`, and run `bun install`. Then run the checker as
-  `fabrika-check --packed <dir>/release-manifest.json`: without the flag it refuses the tarballs. A deployed
-  application never takes this form; the platform build installs from the registry.
+  --artifacts=<dir>` there. It writes the tarballs, `release-manifest.json` and `install.json`.
+  1. Copy the tarballs into the application's `vendor/`.
+  2. Give each `@fabrika/*` entry the application already lists its `file:vendor/…` value from the `dependencies` of
+     `install.json`, in the field where it is: `@fabrika/check`, `@fabrika/cli` and `@fabrika/platform` stay in
+     `devDependencies`, the rest in `dependencies`. Add no other package of that list; `agent-canvas` and
+     `@fabrika/builder` are commands the application does not need.
+  3. Add the `overrides` of `install.json` whole: each packed package names its `@fabrika/*` dependencies by a version
+     only the pack has.
+  4. Run `bun install`, then `fabrika-check --packed <dir>/release-manifest.json`: without the flag the checker refuses
+     the tarballs.
+
+  Put `vendor/` in `.gitignore`, and commit neither the tarballs nor the `file:` form of `package.json` and `bun.lock`
+  to a branch that deploys. The platform build installs from the registry and runs the checker without `--packed`, so
+  it refuses that form.
 - The local pack is the one way to run a platform checkout's packages in an application. Never `bun link` a
   `@fabrika/*` package: a linked package resolves its dependencies and peers from the checkout, so the application
   runs a second React (every hook fails), a second zod and a second kysely. Installed from `vendor/`, the packages
   resolve `react`, `zod` and `kysely` from the application's own `node_modules`. The pack's version names the
-  checkout's commit: after a change in the platform, commit it, pack again, and replace the block with the new
-  `install.json`.
+  checkout's commit: after a change in the platform, commit it, pack again, replace the tarballs in `vendor/`, and
+  replace the block with the new `install.json`. `bun.lock` still names the old tarballs, and `bun install` then fails
+  with `ENOENT extracting tarball`. Before it, delete each line of `bun.lock` that names `vendor/`
+  (`grep -v 'vendor/' bun.lock > bun.lock.next && mv bun.lock.next bun.lock`): each is one entry of a packed package,
+  and `bun install` writes them again from `package.json`. Deleting the whole `bun.lock` also works, but it resolves
+  every other package again.
 
 ```json tsconfig.json
 {
@@ -138,30 +151,35 @@ export default serve(contract, { database: scoped(tables) })
 ```
 
 - Mounts: `c.rpc(prefix, groups)` once per prefix, `c.spa(prefix, { dir, access })`, `c.health('/healthz')` (required
-  on Zerops), `c.form(path, { input, appendTo, then? })` (an anonymous form that appends one row and runs no handler), a
-  webhook, a link mount. An SPA's `access` is `{ member: true }`, `{ action, over }`, or `{ public: true }` for a page
+  on Zerops), a webhook, a link mount. An anonymous visitor reaches a public procedure of an `c.rpc` mount
+  (`access: { public: true }`, `references/public-intake.md`). An SPA's `access` is `{ member: true }`, `{ action, over }`, or `{ public: true }` for a page
   anyone opens without signing in (a landing page, a public form): the approver sees it as "for anyone". A public SPA
   at `/` answers every `GET` no more specific endpoint serves; give a member SPA its own prefix (`/app`). Sections:
   `files`, `jobs`, `exports`, `csp` (`connectSrc`, `imgSrc`, `frameAncestors`, `scriptSrc`, `frameSrc`, `styleSrc`,
   `fontSrc`: exact `https://` origins, each with a `purpose`, at most 16 each). A hosted typeface needs both its
   stylesheet origin in `styleSrc` and its font origin in `fontSrc`; font files under the SPA's `dir` need neither. No path under `/__fabrika`.
-- A public form's abuse control, all optional on `c.form`: `rate: { perClient, perForm }` (per minute, shared by
-  every instance; 10 and 100 by default; 429 past either), `honeypot: '<field>'` (a `z.optional(z.string())` input
-  field the page hides; a filled one gets the same answer and writes nothing) and
-  `challenge: { provider: 'turnstile', secret: 'TURNSTILE_SECRET', siteKey: 'TURNSTILE_SITE_KEY' }`. A challenge needs the input field
-  `challengeToken: z.string()`, which the page fills from the Turnstile widget rendered with `action` set to the
-  form's mount name; the framework verifies it on the server (a failed token 400, an unreachable provider 503, no
-  row either way) and adds Turnstile's origin to the CSP. `secret` names an application variable the human sets,
-  never the value; without it the application does not boot. `siteKey` names the variable with the widget's public
-  site key, which every SPA mount serves its pages (below). Neither field reaches the inbox, so neither is a
-  column. On Zerops every visitor still shares one client address (the balancer), so `perClient` acts as a second
-  per-form limit: raise it, and use the challenge. `references/public-intake.md` builds a whole public intake on it.
-- `then: '<job>'` on `c.form` names a cron job of the same contract (`jobs`), which each accepted submission kicks
-  once its row committed: a run starts within seconds, under the job's own key, and the answer stays the same constant
-  and never waits for it. A mutation declares the same `then` for the outbox row it records (`references/jobs.md`). Kicks coalesce on the job's lease (at most one run and one pending, however many visitors
-  submit), so the job still drains its inbox in batches under its own budgets. Keep its schedule: it is the recovery
-  path for a kicked run that died. A kick carries nothing; the job reads its inbox. `kit.runJob` first waits for the
-  kicked runs.
+- A public procedure's abuse control is its `admission`: `rate: { perClient, perEndpoint }` (per minute, shared by
+  every instance; 10 and 100 by default for a public mutation; 429 past either) and
+  `challenge: { provider: 'turnstile', secret: 'TURNSTILE_SECRET', siteKey: 'TURNSTILE_SITE_KEY' }`. `honeypot(value)`
+  of `@fabrika/app` is true for a filled field the page hides: answer the same and write nothing. A challenge needs the
+  input field `challengeToken: z.string()`, which the page fills from the Turnstile widget rendered with `action` set
+  to the endpoint id with `_` for `.` (`api_visitors_register`), or to the challenge's own `action: 'register'` (at most
+  32 letters, digits, `_` and `-`, one per procedure); the framework verifies it on the server (a failed or replayed
+  token 400 `challenge_failed`, an unreachable provider 503, no row either way) and adds Turnstile's origin to the CSP. `secret` names an
+  application variable the human sets, never the value; without it the application does not boot. `siteKey` names
+  the variable with the widget's public site key, which every SPA mount serves its pages (below). On Zerops every
+  visitor still shares one client address (the balancer), so `perClient` acts as a second per-endpoint limit: raise
+  it, and use the challenge. `references/public-intake.md` builds a whole public intake on it.
+- `defineApp(vocabulary, tables, { imports?, tokens? })`: `imports` names other applications' exports
+  (`references/webhooks-links-connectors.md`), `tokens` the purposes of signed tokens (`references/endpoint.md`).
+- `c.rpc('/api/v1', groups, { compatibility: 'backward' })` promises a mount's callers a stable API
+  (`references/endpoint.md`).
+- `kicks: ['<job>']` on a mutation names cron jobs of the same contract (`jobs`), and `ctx.kick('<job>')` in its
+  handler starts one once its transaction committed: a run starts within seconds, under the job's own key, and the
+  answer never waits for it (`references/jobs.md`). Kicks coalesce on the job's lease (at most one run and one
+  pending, however many calls arrive), so the job still works in batches under its own budgets. Keep its schedule: it
+  is the recovery path for a kicked run that died. A kick carries nothing; the job reads its rows. `kit.runJob` first
+  waits for the kicked runs.
 - `src/app.ts` composes and does nothing else. A dependency built from the application's own variables is
   `defineDeps(build)`, passed as `serve(contract, { database, deps })` and read in a handler with `get()`. Never read
   `process.env`. `build` runs at every boot, the generated tests' too, which pass no variable: read a variable when

package/skill/references/dev.md

@@ -59,8 +59,8 @@ export default seed
 - `dev/dev.env` holds the application's variables for `app dev`, one `NAME=value` per line (`#` comments, quotes
   optional). They win over the shell's; a `FABRIKA_*` name is refused. Commit it: it holds stand-in values, never a
   real secret.
-- A form's challenge passes in `app dev`: the stand-in answers Turnstile's siteverify for any token. Set the form's
-  `secret` variable to any value in `dev/dev.env`, and send a fresh `challengeToken` with each submission, as a test
+- A public procedure's challenge passes in `app dev`: the stand-in answers Turnstile's siteverify for any token. Set the
+  challenge's `secret` variable to any value in `dev/dev.env`, and send a fresh `challengeToken` with each submission, as a test
   does: a token is single use. For the widget on a page, set the `siteKey` variable to Turnstile's always-passing test
   key `1x00000000000000000000AA`. Its token is the same every time, and `app dev` admits that one token again at each
   submission; a deployed application records it like any other, so there it passes once.
@@ -72,7 +72,7 @@ export default seed
 - The seed's second argument reads what left the application: `outside.mails()` is every message a job handed to the
   stand-in, oldest first (`{ id, at, to, subject, text, html, key, transportKey, answer, outcome, delivered, … }`), so
   the seed can open a link the application mailed. Run the job first (`dev.runJob('<job>')`), or let a mutation's
-  `then` kick it and `await dev.drain()`.
+  `ctx.kick` start it and `await dev.drain()`.
 - Point another outside service at the dev outbox: `app dev` captures every request the process sends to
   `https://outbox.invalid` (`DEV_OUTBOX_ORIGIN` of `@fabrika/app/testing`) and answers `200 {"id": …}`. A section of
   its own lists each one, by the `to` and `subject` of a JSON body, and opens its body; its headers are not kept.
@@ -95,5 +95,5 @@ ARCHIVE_KEY=dev
   is the invited person from then on. A job's message opens at `/__fabrika/dev/mail/<id>`.
 - The choice stays in a cookie the application never sees. The data is gone when the command stops.
 - It serves this machine only (`--host` is a loopback address, `--port=0` picks a free port), answers no request
-  addressed to another host name, and runs no cron job on its schedule: the seed runs one with `dev.runJob`, a test with `kit.runJob`. A form's or a
-  mutation's `then` still starts its job, as deployed.
+  addressed to another host name, and runs no cron job on its schedule: the seed runs one with `dev.runJob`, a test with `kit.runJob`. A mutation's
+  `ctx.kick` still starts its job, as deployed.

package/skill/references/endpoint.md

@@ -19,6 +19,11 @@ export const Versioned = z.strictObject({
 })
 export const Cursor = z.string().max(500)
 export const OrgInput = z.strictObject({ orgId: z.string().min(1).max(100) })
+export const WorkloadRow = z.strictObject({
+	assignee: z.nullable(z.string()),
+	open: z.int(),
+	overdue: z.int(),
+})
 ```
 
 - `z` comes from `zod/v4`. Objects are `z.strictObject`, never `z.object`. No `transform`, `refine`, `pipe`,
@@ -50,9 +55,11 @@ export const OrgInput = z.strictObject({ orgId: z.string().min(1).max(100) })
 | `{ member: true }`                             | any member, no application data   | nothing                                                     | nothing                                                                                     |
 
 - Every endpoint also has `ctx.db.reference.<table>` (reference tables), `ctx.principal`
-  (`{ kind: 'user', id, label, email }` for a `human` caller), `ctx.requestId` and `ctx.signal`, which aborts when
-  the client leaves or the request runs past its budget (10 s); its transaction then rolls back. Pass it to every
-  outbound call. An `on`, `in` or `over` endpoint also reads `ctx.db.app.<table>`: each application table whose read
+  (`{ kind: 'user', id, label, email }` for a `human` caller), `ctx.requestId`, `ctx.client` and `ctx.signal`, which
+  aborts when the client leaves or the request runs past its time limit (`limits.timeoutMs`, 10 s by default); its
+  transaction then rolls back. Pass it to every outbound call. `ctx.client` is `{ ip, userAgent }` as the proxy saw
+  them: record it (consent evidence), never decide on it. `ip` is `null` where the platform cannot vouch for the
+  address (behind the Zerops balancer), and `userAgent` is cut to 256 characters. An `on`, `in` or `over` endpoint also reads `ctx.db.app.<table>`: each application table whose read
   action is the endpoint's action, every row, read-only (below).
 - `ctx.principal.email` is the mailbox IAM recorded for the person, lower-cased, from the token: the address to mail,
   not a proof that the person controls it. Mail "send it to me"
@@ -64,8 +71,8 @@ export const OrgInput = z.strictObject({ orgId: z.string().min(1).max(100) })
   key (`references/jobs.md`). A call that is the request's whole purpose lives in a `{ member: true }` endpoint, which
   they do not cover. The framework's own calls (IAM, the file store, `ctx.connect`) are not outside.
 - **An endpoint never sends e-mail**, covered or not: it has no `ctx.mail`. It records the message in an outbox row
-  and declares `then: '<job>'` on the mutation, so the job that declares `mailer` sends it within seconds of the
-  commit (`references/jobs.md`; the test e-mail in `references/public-intake.md`). Only a mutation declares `then`.
+  and declares `kicks: ['<job>']` on the mutation and calls `ctx.kick('<job>')`, so the job that declares `mailer`
+  sends it within seconds of the commit (`references/jobs.md`; the test e-mail in `references/public-intake.md`).
 - `ctx.principal.label` is a `string`, never `null`: the label IAM holds for the person (the one its directory
   shows), or the id when the token carries none. When the caller owns what it writes (the creator of a deal, the
   assignee of a task nobody was picked for), store `ctx.principal.id` and `ctx.principal.label`, never a
@@ -110,6 +117,35 @@ dimension value takes `access: { action, app: true }`.
   keep their own forms.
 - The approver sees it as "app-wide: a global grant", and a change of an endpoint to or from `app: true` widens.
 
+### Several capabilities: `capabilities`
+
+An operation that reads one object and writes another (a copy from one deal to another, a handover between two
+records) needs two capabilities. Declare each by name instead of reaching off the road with `sql` or `unscoped`:
+
+```text
+copyToTask: r.mutation({
+	input: z.strictObject({ id: z.uuid(), fromTaskId: z.uuid(), toTaskId: z.uuid() }),
+	output: Saved,
+	access: {
+		capabilities: {
+			from: { action: 'tasks.read', on: 'task', from: 'fromTaskId' },
+			to: { action: 'tasks.write', on: 'task', from: 'toTaskId' },
+		},
+	},
+}).handle(async ({ input, ctx }) => {
+	const source = await ctx.db.on(ctx.capabilities.from).task_attachments.get(input.id)
+	return ctx.db.on(ctx.capabilities.to).task_attachments.insert({ file: source.file, name: source.name })
+})
+```
+
+- At least two, each `{ action, on, from }`, `{ action, in, from }` or `{ action, over }`. `creates`, `app` and
+  `member` are single forms only.
+- The proxy checks every requirement. The framework mints them in the declared order, and the first refusal answers
+  (`on` 404, `in` and `over` 403).
+- The handler binds each with `ctx.db.on(…)`, `ctx.db.in(…)` or `ctx.db.over(…)`. It has no `ctx.target`,
+  `ctx.within`, `ctx.db.app`, `ctx.members` or `ctx.links`.
+- The generated tests add a denied case per capability. A join or a lock over many rows still needs `sql`.
+
 ### The methods of each handle
 
 | Handle                                                 | Methods                                                                                                                                                                                         |
@@ -122,7 +158,7 @@ dimension value takes `access: { action, app: true }`.
 | `app.<table>` (`app: true`), an application table      | `list(options)`, `count({ where })`, `aggregate(spec)`, `get(id)`; in a mutation `getForUpdate(id)`, `insert(values)`, `update(id, values, { expectVersion })`, `remove(id, { expectVersion })` |
 | `app.<table>` (`app: true`), a scoped table            | `list(options)` (read action or `appRead`), `count({ where })` (also `appCount`), `aggregate(spec)`                                                                                             |
 | `app.<table>` (`on`, `in`, `over`)                     | an application table whose read action is the endpoint's: `list(options)`, `count({ where })`, `aggregate(spec)`, `get(id)`; no write                                                           |
-| `unscoped.<table>` (declared)                          | `list`, `count`, `aggregate`, `get(id)` (not of a reference table or an inbox, which have no key); with `'write'` also `insert`, `update`, `remove`                                             |
+| `unscoped.<table>` (declared)                          | `list`, `count`, `aggregate`, `get(id)` (not of a reference table, which has no key); with `'write'` also `insert`, `update`, `remove`                                                          |
 
 `{ expectVersion }` is taken only on a table with `version`.
 
@@ -341,13 +377,15 @@ Mount every group in `fabrika.contract.ts`:
 ## Shared data access: `queries.ts`
 
 A function of the slice's `queries.ts` takes the handle as a parameter typed with `DbHandle` and returns plain values.
-It decides no authorization: the capability already bounds the handle.
+It decides no authorization: the capability already bounds the handle. `queries.ts` exports only functions: a schema
+that the contract also reads (`WorkloadRow`, an output) lives in `src/schemas.ts`, or the contract would load
+`queries.ts` and refuse its functions (`literal`).
 
 ```ts src/reports/queries.ts
 import type { DbHandle, SqlHandle } from '@fabrika/app/contract'
 import type { Ref } from '@fabrika/app/implement'
-import { z } from 'zod/v4'
 import type { app } from '../app-kit'
+import { WorkloadRow } from '../schemas'
 
 export const statusCounts = async (
 	within: DbHandle<typeof app, 'over', 'project', 'tasks.read'>,
@@ -358,12 +396,6 @@ export const statusCounts = async (
 	return { open: count('open'), doing: count('doing'), done: count('done') }
 }
 
-export const WorkloadRow = z.strictObject({
-	assignee: z.nullable(z.string()),
-	open: z.int(),
-	overdue: z.int(),
-})
-
 export const workloadRows = (
 	sql: SqlHandle<typeof app, 'read'>,
 	org: Ref<'org', 'tasks.read'>,
@@ -395,8 +427,8 @@ Raw SQL is legitimate for a join, a report, an `OR` or `IS NULL` filter, or a bu
 import { attachment } from '@fabrika/app/contract'
 import { z } from 'zod/v4'
 import { app } from '../app-kit'
-import { TaskStatus } from '../schemas'
-import { statusCounts, WorkloadRow, workloadRows } from './queries'
+import { TaskStatus, WorkloadRow } from '../schemas'
+import { statusCounts, workloadRows } from './queries'
 
 const Workload = z.strictObject({
 	orgId: z.string().min(1).max(100),
@@ -461,8 +493,8 @@ export const reports = app.group({ callers: ['human'] }, (r) => ({
   values, each container grant on its own column, every row for a global grant and none for an empty one. The
   capability is the access form's: `ctx.target` for `on` and `in`, `ctx.within` for `over`; a job passes the `Ref` or
   `Within` it minted to `tx.sql.scope`. A table the capability does not reach is a type error at the table name. A
-  reference table is shared by every scope and needs no fragment, and no statement writes it. A form's inbox needs none either; read it from a site that holds the inbox's
-  `read` action (the intake job of `references/public-intake.md`).
+  reference table is shared by every scope and needs no fragment, and no statement writes it. An application table
+  needs none either (the intake job of `references/public-intake.md`).
 - **A fragment carries its action into the statement.** On the table an `update` or `delete` writes it needs the
   table's own update or delete action (`ctx.within('tasks.write', 'project')` for `update tasks`), so a read action
   never scopes a write. A column's own write action (`columns: { assignee: { write: 'tasks.assign' } }`) scopes an
@@ -522,22 +554,117 @@ the invocation's transaction. `'write'` (a mutation, a job, a webhook) also inse
 then names the chain columns itself. Use it for an operator's cross-scope view, never to dodge a capability the caller
 should hold. The generated tests skip the other-scope leak case for such an endpoint.
 
-## Another origin: `crossOrigin`
+## Admission and limits
+
+Every procedure takes `admission` (who may send it, how often) and `limits` (how large, how long):
+
+| Option                              | Credentialed and link procedures                                                                       | Public procedures (`references/public-intake.md`)                 |
+| ----------------------------------- | ------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------- |
+| `admission.rate` (calls per minute) | `perCaller`, `perEndpoint`; none by default                                                            | `perClient`, `perEndpoint`, `bytesPerHour`; a mutation 10 and 100 |
+| `admission.origins`                 | `'same-origin'` (default) or `'listed'`                                                                | `'same-origin'`, `'listed'` or `'any'`                            |
+| `admission.challenge`               | —                                                                                                      | `{ provider: 'turnstile', secret, siteKey, action? }`             |
+| `limits.maxBytes`                   | 64 KiB, at most 1 MiB; with file fields 64 KiB plus each file at its kind's `maxBytes`, at most 48 MiB | the same                                                          |
+| `limits.timeoutMs`                  | 10 s, at most 60 s                                                                                     | the same                                                          |
+
+- A declared `rate` merges into the default; `null` turns one bucket off. Past a bucket the answer is 429.
+- Every bucket is charged before the body is read and stays charged whatever the handler does. A bucket is a database
+  write per call, so a query declares one only where it needs one.
+- The body must arrive within `max(30 s, maxBytes at 16 KiB/s)`: a stalled body is 408. The handler's time starts
+  after the last byte, so a slow upload still commits.
+- The approver sees every effective value. A higher bucket, a dropped challenge or a longer time limit widens.
+
+## Another origin: `admission.origins: 'listed'`
 
 A page on another site (a partner's page, a separate marketing site, another application in the browser) calls an RPC
-endpoint only when the endpoint says `crossOrigin: true` beside its `access`, and an operator lists that page's origin
-for the environment in Control (`--cross-origin=https://partner.example` on `fabrika control apps environments put`). Both halves are
-needed: the contract says which endpoints, the environment says from where, so staging and production can list
-different pages. The approver sees the flag like any other access change.
+procedure only when it declares `admission: { origins: 'listed' }`, and an operator lists that page's origin for the
+environment in Control (`--cross-origin=https://partner.example` on `fabrika control apps environments put`). Both
+halves are needed: the contract says which procedures, the environment says from where, so staging and production can
+list different pages. The approver sees the change like any other access change.
 
 - **A key, never a session.** The page sends `Authorization: Bearer px_…` (a machine key, or a person's own key). A
   person's session is never read for a request from a listed origin: the answer is 401 without a login bounce.
 - **The proxy answers CORS, the handler never does.** The proxy answers the preflight and sets
   `Access-Control-Allow-Origin` on the answer; it deletes every `Access-Control-*` header a handler sets.
-- **Only RPC procedures.** A link procedure, an export, an SPA, a download and an upload refuse `crossOrigin`. A form
-  takes it too (`references/public-intake.md`).
+- **Only RPC procedures.** A link procedure, an export, an SPA and a webhook have no other origin. A public procedure
+  may also declare `'any'` (`references/public-intake.md`).
 - **Test it** with `testKit(app, { crossOrigins: ['https://partner.example'] })` and a request carrying that `Origin`.
 
+## The HTTP shape: `http`
+
+A procedure is `POST <prefix>/<group>.<procedure>` with a JSON body by default. `http: { method?, query?, body?,
+cache?, path? }` changes the wire, never what the handler does:
+
+- `method: 'GET'` on a query reads its input from flat scalar URL parameters (a number as written, `true`/`false`,
+  `null`; a name twice is refused). A query whose output is a file is `GET` by default. A session mutation is never
+  `GET`.
+- `query: z.strictObject({ … })` on a `POST` reads a flat schema from the URL beside the body; the handler gets it as
+  `query`, beside `input`.
+- `body: 'urlencoded'` takes a native `<form>` post of flat scalar fields. A file field makes the body multipart by
+  itself: its JSON input part first, then the files.
+- `cache: { maxAgeSeconds }` or `cache: 'immutable'` on a public `GET` query lets a browser or a CDN reuse a
+  successful answer (`Cache-Control: public, …`). Every other answer is `no-store`. `'immutable'` needs an input that
+  names a value that never changes (a file id), so a new value changes the URL.
+- `path: '/register'` on a public procedure serves it at that literal path instead, for a caller you do not ship: a
+  page on another origin, or a URL published elsewhere (a 0.5 form's). It lies outside every mount's prefix (the root
+  SPA's excepted) and under no `/__fabrika`; the endpoint id and the typed client's call stay the same. Any other
+  procedure takes no `path`: its caller is your own page, through the typed client.
+- `api.<group>.<procedure>.url(input)` is the URL of a `GET` procedure for a same-origin page.
+
+**A redirect.** `output: redirect({ origins? })` (`@fabrika/app/contract`): the handler returns `{ to }`, and the
+framework answers 303 after a `POST` and 302 after a `GET`. A target is a path of the application's own origin, a URL
+of an origin `origins` lists, or a URL a verified signed token of this request carries; anything else is a 500 and a
+log line, never an open redirect. A native form then posts, redirects and loads the next page. The typed client gets
+`{ to }` instead and decides whether to navigate.
+
+## Signed tokens: `signs` and `signedToken`
+
+A token is a signed, single-purpose value in a URL: an unsubscribe link, a tracked click, the link that manages one
+booking. It is no credential and opens no mount. Declare each purpose once, in the kit:
+
+```text
+export const app = defineApp(vocabulary, tables, {
+	tokens: { unsubscribe: token(Recipient, { maxDays: 400 }) },
+})
+```
+
+- `token(Claims, { maxDays })` (`@fabrika/app/contract`): the claims are a strict object, `maxDays` the longest
+  lifetime.
+- A site that issues tokens declares `signs: ['<purpose>']` and calls
+  `ctx.tokens.sign('<purpose>', claims, { days })`, `days` at most `maxDays`. An RPC procedure, a job and a webhook
+  sign; an export and a link procedure never do.
+- `signedToken('<purpose>')` is a top-level field of an input or of `http.query`. The framework verifies it as it
+  parses the input (a bad or expired token is 400), and the handler gets the typed claims.
+- A public mutation whose input holds a required `signedToken` may be `http: { method: 'GET' }` and answer
+  `redirect()` or a schema. The approver reads "changes state on GET; link scanners may trigger it". A page that
+  needs certainty keeps a `POST` behind a button.
+- A public procedure updates or removes a row only by an id a verified token of its request carries, with
+  `expectVersion`.
+- Single use and revocation are your state (a row the token names). The keys are the platform's: Control generates
+  and rotates them, and an old key verifies until its last token expires. Cloudflare has no signed tokens.
+
+## Outside calls: `egress`
+
+A credentialed procedure, a webhook or a job that calls an outside HTTPS API declares its origins:
+`egress: ['https://api.example.com']`, exact origins, no path or wildcard, at most 16. `fetch` to any other origin is
+refused while the site runs (`capability_refused: undeclared_egress`). A public, link or export procedure declares
+none. The checker's `cross-app-fetch` accepts an absolute URL only under an origin some site declares. The approver
+sees every origin. The guard stops mistakes; it is no sandbox.
+
+## Links to your own procedures: `ctx.url`
+
+`ctx.url('<endpoint id>', { input?, query? })` builds an absolute URL of one of the application's own procedures, on
+every site: the environment's public origin, the procedure's path, and the parameters its HTTP shape reads from the
+URL (the input of a `GET`, the `query` of a `POST`). The endpoint id is `<mount>.<group>.<procedure>`
+(`'api.mail.unsubscribe'`). The checker's `url-endpoint` refuses a literal id that names no procedure. Never build an
+origin from a variable of your own.
+
+## A promise to integrations: `compatibility`
+
+An integration calls RPC procedures with a service key (caller `machine`). Promise it a stable API with
+`c.rpc('/api/v1', groups, { compatibility: 'backward' })`: Control then refuses a deploy that removes a procedure,
+narrows its input, changes its output, its HTTP shape, its file answer or its access. A breaking change is a new mount
+(`/api/v2`) beside the old one. The default is `'unchecked'`.
+
 ## Members
 
 `ctx.members` of an endpoint `on` or `in` a dimension reads the members of the nearest dimension, its own or one