@fabrika/app 0.6.0 → 0.7.0

package/src/implement/anonymous.ts

@@ -1,21 +1,34 @@
 // What the anonymous kinds need beyond the request pipeline: a body read under its limit (the proxy never sees a
-// body, so the framework enforces it), the share SPA's fragment bootstrap and GitHub's delivery signature. A form's
-// admission is `form-admission.ts`.
+// body, so the framework enforces it) and the share SPA's fragment bootstrap. A form's admission is
+// `form-admission.ts`, a webhook's signature `verifiers.ts`.
 
 import { LINK_BOOTSTRAP_FILE, SHARE_KEY_GLOBAL } from '../contract/defaults'
 import { HttpError } from '../errors'
 import { readBoundedBytes } from './bounded'
 
+/** The slowest body a procedure waits for, in bytes per second: its deadline is `maxBytes` at this rate, 30 s at least. */
+export const BODY_RATE_FLOOR = 16 * 1024
+const MIN_BODY_DEADLINE_MS = 30_000
+
+/** How long a body of at most `maxBytes` may take to arrive. */
+export function bodyDeadlineMs(maxBytes: number): number {
+	return Math.max(MIN_BODY_DEADLINE_MS, Math.ceil((maxBytes / BODY_RATE_FLOOR) * 1000))
+}
+
 /**
  * The body as bytes, read until `maxBytes`; a longer one stops the read and is a 413. A body whose stream fails before
  * its end (the client closed the connection) is the sender's 400 `aborted`, never a failure of the application.
  */
-export async function readBoundedBody(request: Request, maxBytes: number): Promise<Uint8Array<ArrayBuffer>> {
+export async function readBoundedBody(request: Request, maxBytes: number, deadline?: AbortSignal): Promise<Uint8Array<ArrayBuffer>> {
 	let body: Uint8Array<ArrayBuffer> | null
 	try {
-		body = await readBoundedBytes(request.body, { maxBytes, declaredLength: request.headers.get('Content-Length') })
+		body = await readBoundedBytes(request.body, {
+			maxBytes,
+			declaredLength: request.headers.get('Content-Length'),
+			...(deadline === undefined ? {} : { signal: deadline }),
+		})
 	} catch {
-		throw abortedBody()
+		throw deadline?.aborted === true ? new HttpError(408, 'body_timeout', 'The body did not arrive within its deadline') : abortedBody()
 	}
 	if (body === null) {
 		throw new HttpError(413, 'too_large', `The body is larger than ${maxBytes} bytes`)
@@ -76,40 +89,3 @@ export async function withBootstrap(response: Response, prefix: string): Promise
 	headers.delete('Content-Length')
 	return new Response(injected, { status: response.status, statusText: response.statusText, headers })
 }
-
-const SIGNATURE_PREFIX = 'sha256='
-const HEX = /^[0-9a-f]{64}$/
-
-/** Whether `X-Hub-Signature-256` is GitHub's HMAC-SHA256 of the raw body under `secret`, compared in constant time. */
-export async function verifyGithubSignature(header: string | null, secret: string, body: Uint8Array<ArrayBuffer>): Promise<boolean> {
-	if (header === null || !header.startsWith(SIGNATURE_PREFIX)) {
-		return false
-	}
-	const hex = header.slice(SIGNATURE_PREFIX.length).toLowerCase()
-	if (!HEX.test(hex)) {
-		return false
-	}
-	const signature = new Uint8Array(32)
-	for (let index = 0; index < 32; index++) {
-		signature[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16)
-	}
-	const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['verify'])
-	return crypto.subtle.verify('HMAC', key, signature, body)
-}
-
-/** The GitHub account a payload names, as a binding records it: `installation:<id>` or `repository:<id>`. */
-export function githubAccounts(payload: unknown): readonly string[] {
-	const accounts: string[] = []
-	for (const kind of ['installation', 'repository'] as const) {
-		const holder = ownField(payload, kind)
-		const id = ownField(holder, 'id')
-		if (typeof id === 'number' && Number.isSafeInteger(id) && id > 0) {
-			accounts.push(`${kind}:${id}`)
-		}
-	}
-	return accounts
-}
-
-function ownField(value: unknown, name: string): unknown {
-	return typeof value === 'object' && value !== null && Object.hasOwn(value, name) ? Reflect.get(value, name) : undefined
-}

package/src/implement/boot.ts

@@ -16,7 +16,6 @@ import {
 	FABRIKA_CONTRACT_DIGEST,
 	FABRIKA_IAM_APP_ID,
 	FABRIKA_PROXY_SECRET,
-	type FormMountArtifact,
 	type IamMembershipRpc,
 	isLoopbackHost,
 	type Jwks,
@@ -24,15 +23,7 @@ import {
 } from '@fabrika/auth-core'
 import type { Database } from '@fabrika/db'
 import type { CapabilityAuthority } from '@fabrika/db/capability'
-import {
-	bindScopedDatabase,
-	type DataAccess,
-	dataAccessOf,
-	type FrameworkTables,
-	frameworkTablesOf,
-	isScopedDatabase,
-	type WebhookTables,
-} from '@fabrika/db/framework'
+import { bindScopedDatabase, type DataAccess, dataAccessOf, type FrameworkTables, frameworkTablesOf, isScopedDatabase } from '@fabrika/db/framework'
 import type { DataKind } from '@fabrika/db/tables'
 import type { EmailProviderRegistry } from '@fabrika/email'
 import { builtinEmailProviders } from '@fabrika/email/providers'
@@ -41,11 +32,12 @@ import type { FileObjectStore } from '@fabrika/platform'
 import { compileContract } from '../contract/compile'
 import { exportDescription } from '../contract/connect'
 import { isProcedure, type ProcedureDeclaration, type ProcedureTreeDeclaration, SURFACE_SECTIONS } from '../contract/declaration'
-import { exportBase, FORM_CHALLENGE_FIELD, FORM_FILE_LIMITS, FORM_LIMITS, spaPrefixRowId } from '../contract/defaults'
-import type { Schema } from '../contract/define'
+import { exportBase, spaPrefixRowId } from '../contract/defaults'
+import type { AnyContract, Schema } from '../contract/define'
 import { kitOriginOf } from '../contract/handled'
+import { schemaFromShape } from '../contract/schema-from-shape'
 import type { RequestExecutionContext } from '../fetch'
-import { FILE_SWEEP_JOB, FILE_SWEEP_SCHEDULE, FILE_SWEEP_TIMEOUT_MS, type FileCollections, fileCollections } from '../files/collections'
+import { FILE_SWEEP_JOB, FILE_SWEEP_SCHEDULE, FILE_SWEEP_TIMEOUT_MS, storedFileKinds } from '../files/kinds'
 import { FILE_SCAN_JOB, FILE_SCAN_SCHEDULE, type FileScanner, SCAN_LIMITS } from '../files/scan'
 import { type MailStandIn, resolveMailTransports } from '../jobs/mail'
 import { logReporter, type OperationsReporter, operationsReporter, operationsSettings, type ReportSource } from '../jobs/report'
@@ -53,28 +45,30 @@ import { bindJobs, type ContractJobs, type HandlerErrorSink } from '../jobs/runn
 import { environmentScrubber } from '../jobs/scrub'
 import { browserConfigs } from './browser-config'
 import { createCapabilityIssuer, requestIsReadOnly } from './capability'
-import { type ChallengeFetch, type ChallengeVerifier, turnstileVerifier } from './challenge'
+import type { ChallengeFetch } from './challenge'
 import { type ConnectFetch, wireImports } from './connect'
 import {
 	ContractRuntime,
 	type Facilities,
-	type FormAdmission,
 	NO_FACILITIES,
+	type ProcedureQuery,
 	proxySecretDigest,
 	type ServedEndpoint,
 	type ServedSite,
 	type SpaAssets,
 } from './dispatch'
+import { installEgressGuard, platformCall, platformFacility } from './egress'
 import type { CapturedEnvironment } from './environment'
 import { FailureReports } from './failures'
-import { ServerFault } from './faults'
-import type { SubmissionFields } from './form-admission'
 import { applicationPolicy } from './headers'
 import type { ContractDatabase, ContractImplementation, ImplementationDatabase } from './implement'
 import { approvedDeclaration, approvedReach, isSiteHandler, type SiteDeclaration } from './invocation'
 import type { ReadDirectory } from './membership'
-import { bindingHandlers, webhookBindInput, webhookBindOutput, webhookUnbindInput, webhookUnbindOutput } from './webhook'
-import { type WorkloadCredential, workloadCredentials, type WorkloadTokenSource } from './workload'
+import { type AdmissionOptions, InFlightShare, type ProcedureAdmission, procedureAdmission, publicShareOf } from './public'
+import { readTokenKeys, type RuntimePurpose, SignedTokens } from './tokens'
+import { appUrl, readAppOrigin } from './urls'
+import type { BindableWebhook } from './webhook'
+import { type WorkloadCredential, workloadCredentials, workloadSite, type WorkloadTokenSource } from './workload'
 
 /** Where the token verifier gets IAM's public keys: the IAM binding on Cloudflare, the issuer's JWKS elsewhere. */
 export interface IamKeySource {
@@ -95,10 +89,10 @@ export interface BootOptions {
 	 * authenticated hop (ADR-0022 rule 1). A secret that is set is checked either way.
 	 */
 	readonly requireProxySecret?: boolean
-	/** The object storage of the file collections, which the Bun adapter opens. Without it, a contract with files does not boot. */
+	/** The object storage of the stored files, which the Bun adapter opens. Without it, a contract with file kinds does not boot. */
 	readonly files?: FileObjectStore
 	/**
-	 * The malware scanner of the scan job of `scan: true` collections, which the Bun adapter supplies to a job run
+	 * The malware scanner of the scan job of `scan: true` file kinds, which the Bun adapter supplies to a job run
 	 * (`clamscanScanner`). Without it the scan job leaves every quarantined file quarantined and reports.
 	 */
 	readonly scanner?: FileScanner
@@ -119,15 +113,13 @@ export interface BootOptions {
 	readonly workloadTokens?: WorkloadTokenSource
 	/** What posts a report to Operations' ingest; `fetch` by default. */
 	readonly operationsFetch?: (request: Request) => Promise<Response>
-	/** What asks a form's challenge provider to verify a token; `fetch` by default. */
+	/** What asks a public procedure's challenge provider to verify a token; `fetch` by default. */
 	readonly challengeFetch?: ChallengeFetch
 	/**
-	 * The developer's own machine only (`fabrika app dev`): the token a form's challenge admits more than once, which
-	 * Turnstile's always-passing test widget hands out for every submission. Every other token stays single use.
+	 * The developer's own machine only (`fabrika app dev`): the token a challenge admits more than once, which
+	 * Turnstile's always-passing test widget hands out for every call. Every other token stays single use.
 	 */
 	readonly repeatableChallengeToken?: string
-	/** How long a form's multipart body may take to arrive; `FORM_FILE_LIMITS.timeoutMs` unless a framework test shortens it. */
-	readonly formFileTimeoutMs?: number
 	/**
 	 * The developer's own machine only (`fabrika app dev`): what a job's handler threw, which every log of a deployed
 	 * application withholds because it may carry a credential.
@@ -145,8 +137,19 @@ export interface BootOptions {
 	 * `FABRIKA_EMAIL_*` nor `serve`'s `mail`.
 	 */
 	readonly mailStandIn?: MailStandIn
+	/** The connections the application's pool holds: a quarter of them, at least one, is the public procedures' share. */
+	readonly connections?: number
+	/**
+	 * `'vouched'` where the proxy's `X-Fabrika-Client-Ip` is the visitor's own address, so `ctx.client.ip` reads it. A
+	 * runtime behind a balancer whose range the platform does not trust (Zerops, until it does) leaves it unset: the ip is
+	 * then `null`.
+	 */
+	readonly clientAddress?: 'vouched'
 }
 
+/** The pool size a runtime adapter that names none is assumed to have: the Bun adapter's default. */
+const DEFAULT_CONNECTIONS = 10
+
 export interface ContractApp {
 	/** `exec` keeps a failure's report to Operations alive past the response (a Worker's `waitUntil`). */
 	fetch(request: Request, exec?: RequestExecutionContext): Promise<Response>
@@ -270,9 +273,6 @@ function unservable(
 			// Every link request re-reads where the object lies; without the table that records it, nothing could.
 			problems.push(`link mount '${name}' shares a '${mount.dimension}', but no table in src/db/tables.ts owns that dimension to locate it`)
 		}
-		if (mount.kind === 'webhook' && mount.boundTo.kind === 'app') {
-			problems.push(`webhook '${name}' is bound to the whole application; this version serves a webhook bound to a dimension (boundTo: '<dimension>')`)
-		}
 	}
 	for (const row of artifact.endpoints) {
 		if (row.requirement?.kind !== 'action') {
@@ -422,6 +422,11 @@ function boundHandler(
 	return null
 }
 
+/** The origins a staged-kit site's handler reaches, a kit without tables included; nothing for a bare handler. */
+function egressOf(bound: BoundHandler): { readonly egress?: readonly string[] } {
+	return !bound.site || bound.declaration === null ? {} : { egress: bound.declaration.egress }
+}
+
 /** A staged-kit contract's endpoint gets `ctx.links` only for the link mount it declares it `issues`. */
 function siteFacilities(facilities: Facilities, declaration: SiteDeclaration | null): Facilities {
 	if (declaration === null) {
@@ -504,24 +509,17 @@ function asksIam(served: ServedEndpoint): boolean {
 	return creates || served.facilities.members === 'manage' || served.facilities.links.length > 0
 }
 
-/** A form and a webhook write the framework's own tables, which only `@fabrika/db`'s `scoped(tables)` reaches. */
+/** A webhook and a procedure's buckets write the framework's own tables, which only `@fabrika/db`'s `scoped(tables)` reaches. */
 function frameworkProblems(artifact: ContractArtifact, framework: FrameworkTables | null, problems: string[]): void {
+	const counted = Object.entries(artifact.procedures ?? {}).find(([, rules]) => Object.values(rules.rate).some((bucket) => bucket !== null))
+	if (counted !== undefined && framework === null) {
+		problems.push(
+			`procedure '${counted[0]}' counts its calls in buckets, which live in @fabrika/db: pass serve(contract, { database: scoped(tables) })`,
+		)
+	}
 	for (const [name, mount] of Object.entries(artifact.mounts)) {
-		if (mount.kind !== 'form' && mount.kind !== 'webhook') {
-			continue
-		}
-		if (framework === null) {
-			problems.push(`mount '${name}' is a ${mount.kind}, which writes through @fabrika/db: pass serve(contract, { database: scoped(tables) })`)
-			continue
-		}
-		if (mount.kind === 'form') {
-			const input = artifact.endpoints.find((row) => row.id === name)?.input
-			const submitted = submissionFieldsOf(mount)
-			const fields = (input?.type === 'object' ? Object.keys(input.fields) : []).filter((field) =>
-				field !== submitted.honeypot && !(submitted.challenge && field === FORM_CHALLENGE_FIELD)
-			)
-			// A file field's column receives the id of the file the submission carried.
-			problems.push(...framework.inboxProblems(name, [...fields, ...Object.keys(mount.files ?? {})]))
+		if (mount.kind === 'webhook' && framework === null) {
+			problems.push(`mount '${name}' is a webhook, which writes through @fabrika/db: pass serve(contract, { database: scoped(tables) })`)
 		}
 	}
 }
@@ -530,108 +528,111 @@ function isCredentialed(row: EndpointRow | undefined): row is CredentialedEndpoi
 	return row !== undefined && row.requirement !== null
 }
 
-function submissionFieldsOf(mount: FormMountArtifact): SubmissionFields {
-	return { honeypot: mount.honeypot ?? null, challenge: mount.challenge !== undefined }
+/** A POST procedure's `http.query`, as the field its served endpoint carries: parsed by the approved shape. */
+function queryOf(id: string, artifact: ContractArtifact): { readonly query?: ProcedureQuery } {
+	const shape = artifact.procedures !== undefined && Object.hasOwn(artifact.procedures, id) ? artifact.procedures[id]?.query : undefined
+	return shape === undefined ? {} : { query: { schema: schemaFromShape(shape), shape } }
+}
+
+/** A procedure's admission, as the field its served endpoint carries; none after a problem. */
+function admissionOf(id: string, artifact: ContractArtifact, options: BootOptions, problems: string[]): { readonly admission?: ProcedureAdmission } {
+	const admission = procedureAdmission(id, artifact, admissionOptions(options), problems)
+	return admission === null ? {} : { admission }
+}
+
+function admissionOptions(options: BootOptions): AdmissionOptions {
+	return {
+		application: options.environment.application,
+		...(options.challengeFetch === undefined ? {} : { challengeFetch: options.challengeFetch }),
+		...(options.repeatableChallengeToken === undefined ? {} : { repeatableChallengeToken: options.repeatableChallengeToken }),
+	}
 }
 
 /**
- * A form's admission from its approved mount: the declared rate or the defaults, and a challenge verified with the
- * secret the application variable it names holds. Without that variable the application does not boot.
+ * A public procedure: its staged-kit handler, its key, and its admission. Without the key's credential (no token
+ * exchange, or the variable unset) `workloadCredentials` already reported why.
  */
-function formAdmission(
-	name: string,
+function publicEndpoint(
+	row: EndpointRow,
+	procedure: ProcedureDeclaration<Schema, unknown>,
+	bound: BoundHandler | null,
 	artifact: ContractArtifact,
+	workloads: ReadonlyMap<string, WorkloadCredential>,
 	options: BootOptions,
-	files: FileCollections | null,
 	problems: string[],
-): FormAdmission | null {
-	const mount = artifact.mounts[name]
-	if (mount?.kind !== 'form') {
+): ServedEndpoint | null {
+	const where = `public procedure '${row.id}'`
+	const site = bound === null ? undefined : servedSite(procedure.type, bound)
+	if (bound === null || site === undefined) {
+		problems.push(`${where} has no handler of the staged kit; declare it with .handle(…) beside its declaration`)
 		return null
 	}
-	const fileFields = new Map(Object.entries(mount.files ?? {}))
-	for (const [field, file] of fileFields) {
-		if (files === null || !files.has(file.collection)) {
-			problems.push(`form '${name}' takes its file '${field}' into files '${file.collection}', which this runtime does not serve`)
-		}
-	}
-	if (fileFields.size > 0 && mount.challenge === undefined) {
-		problems.push(`form '${name}' takes files and declares no challenge; an anonymous upload needs a solved one`)
+	const actions = artifact.declared?.[row.id]?.actions ?? []
+	const credential = workloads.get(workloadSite('public', row.id))
+	const admission = procedureAdmission(row.id, artifact, admissionOptions(options), problems)
+	if (credential === undefined || admission === null) {
+		return null
 	}
-	let challenge: ChallengeVerifier | null = null
-	if (mount.challenge !== undefined) {
-		const secret: unknown = options.environment.application[mount.challenge.secret]
-		if (typeof secret !== 'string' || secret.trim() === '') {
-			problems.push(
-				`form '${name}' verifies its ${mount.challenge.provider} challenge with the application variable ${mount.challenge.secret}, which is not set`,
-			)
-			return null
-		}
-		challenge = turnstileVerifier(secret.trim(), options.challengeFetch ?? ((request) => fetch(request)))
+	return {
+		kind: 'public',
+		row,
+		input: procedure.input,
+		output: procedure.output,
+		handler: bound.handler,
+		actions,
+		credential,
+		admission,
+		site,
+		...queryOf(row.id, artifact),
 	}
-	return Object.freeze({
-		perClient: mount.rate?.perClient ?? FORM_LIMITS.perClient,
-		// A form with files accepts fewer submissions by default: each may write its collections' maxBytes.
-		perForm: mount.rate?.perForm ?? (fileFields.size === 0 ? FORM_LIMITS.perForm : FORM_FILE_LIMITS.perForm),
-		fields: Object.freeze(submissionFieldsOf(mount)),
-		files: fileFields.size === 0 || files === null ? null : {
-			fields: fileFields,
-			collections: files,
-			bytesPerHour: mount.rate?.bytesPerHour ?? FORM_FILE_LIMITS.bytesPerHour,
-			timeoutMs: options.formFileTimeoutMs ?? FORM_FILE_LIMITS.timeoutMs,
-		},
-		challenge,
-		repeatableToken: challenge === null ? null : (options.repeatableChallengeToken ?? null),
-	})
 }
 
-/** `frameworkProblems` refused a webhook without the framework tables, so this answers only after a bug. */
-function frameworkOf(framework: FrameworkTables | null): FrameworkTables {
-	if (framework === null) {
-		throw new ServerFault('facility_unbound', 'a webhook was served without the framework tables')
-	}
-	return framework
-}
-
-/** The generated `webhooks.<name>.bind` and `.unbind` endpoints, served by the framework's own handlers. */
-function bindWebhookBindings(
-	name: string,
-	path: string,
-	rows: ReadonlyMap<string, EndpointRow>,
-	endpoints: Map<string, ServedEndpoint>,
-	tables: () => WebhookTables,
-): void {
-	const handlers = bindingHandlers(name, path, tables)
-	const bind = rows.get(`webhooks.${name}.bind`)
-	const unbind = rows.get(`webhooks.${name}.unbind`)
-	if (isCredentialed(bind)) {
-		endpoints.set(bind.id, {
-			kind: 'procedure',
-			row: bind,
-			input: webhookBindInput,
-			output: webhookBindOutput,
-			handler: handlers.bind,
-			facilities: NO_FACILITIES,
-		})
-	}
-	if (isCredentialed(unbind)) {
-		endpoints.set(unbind.id, {
-			kind: 'procedure',
-			row: unbind,
-			input: webhookUnbindInput,
-			output: webhookUnbindOutput,
-			handler: handlers.unbind,
-			facilities: NO_FACILITIES,
-		})
+/** The webhook a procedure binds (`binds`), as the approved artifact declares it. */
+function bindsOf(
+	id: string,
+	declaration: SiteDeclaration | null,
+	artifact: ContractArtifact,
+	problems: string[],
+): { readonly binds?: BindableWebhook } {
+	const name = declaration?.binds ?? null
+	if (name === null) {
+		return {}
+	}
+	const mount = Object.hasOwn(artifact.mounts, name) ? artifact.mounts[name] : undefined
+	if (mount?.kind !== 'webhook') {
+		problems.push(`procedure '${id}' binds '${name}', which is not a webhook of the contract`)
+		return {}
+	}
+	return { binds: { name, path: mount.path, scheme: mount.scheme, boundTo: mount.boundTo } }
+}
+
+/** Each approved token purpose with the claims schema the application declared for it. */
+function runtimePurposes(contract: AnyContract, artifact: ContractArtifact): ReadonlyMap<string, RuntimePurpose> {
+	const declared = contract.surface.tokens ?? {}
+	const purposes = new Map<string, RuntimePurpose>()
+	for (const [purpose, approved] of Object.entries(artifact.tokens ?? {})) {
+		const own = Object.hasOwn(declared, purpose) ? declared[purpose] : undefined
+		if (own !== undefined) {
+			purposes.set(purpose, { claims: own.claims, maxDays: approved.maxDays })
+		}
 	}
+	return purposes
 }
 
 export function boot(app: ContractImplementation, options: BootOptions): ContractApp {
 	const problems: string[] = []
+	installEgressGuard()
+	// What a handler reaches through these is the platform's own request, which no site's egress covers.
+	const objects = options.files === undefined ? undefined : platformFacility(options.files)
+	const membershipRpc = options.membership === undefined ? undefined : platformFacility(options.membership)
+	const workloadTokens = options.workloadTokens === undefined ? undefined : platformFacility(options.workloadTokens)
 	const variables = readFramework(options.environment.framework, app.contract.vocabulary.app, problems)
 	const artifact = compileContract(app.contract, app.database?.tables ?? {})
 	checkContractDigest(options.environment.framework, artifact, problems)
 	const proxySecret = readProxySecret(options.environment.framework, options.requireProxySecret === true, problems)
+	const tokens = new SignedTokens(runtimePurposes(app.contract, artifact), readTokenKeys(options.environment.framework, artifact, problems))
+	const origin = readAppOrigin(options.environment.framework, problems)
+	const url = appUrl(artifact, origin)
 	const operations = operationsSettings(options.environment.framework, problems)
 	const scrubber = environmentScrubber(options.environment)
 	const reporterFor = (source: ReportSource): OperationsReporter | null =>
@@ -639,33 +640,33 @@ export function boot(app: ContractImplementation, options: BootOptions): Contrac
 			? null
 			: operationsReporter({ ...operations, source, scrubber, ...(options.operationsFetch === undefined ? {} : { fetch: options.operationsFetch }) })
 	const owned = new Set(Object.values(artifact.tables).flatMap((table) => table.scope.mode === 'dimension' ? [table.scope.dimension] : []))
-	// A file collection's dimension is located through its own table and its owner's.
-	for (const name of Object.keys(artifact.files)) {
-		owned.add(`file:${name}`)
-	}
 	const containers = containersOf(artifact)
 	unservable(artifact, options.assets, owned, containers, problems)
 	// This runtime's own: what another `boot` call mints, application code's included, its stores refuse.
 	const issuer = createCapabilityIssuer()
-	const files = fileCollections(artifact, app.database, options.files, issuer.authority, issuer.mint, problems)
+	const fileKinds = storedFileKinds(artifact, app.database, objects, problems)
 	const bound = contractDatabase(app.database, options.database, issuer.authority, problems)
 	const framework = bound?.framework ?? null
 	frameworkProblems(artifact, framework, problems)
-	const database = files === null || bound === null ? (bound?.database ?? null) : files.locating(bound.database)
-	const verifier = new TokenVerifier({ getJwks: () => options.iam.getJwks(), issuer: variables.issuer })
+	const database = bound?.database ?? null
+	const verifier = new TokenVerifier({ getJwks: () => platformCall(() => options.iam.getJwks()), issuer: variables.issuer })
 	const workloads = workloadCredentials({
 		artifact,
 		framework: options.environment.framework,
 		audience: variables.iamAppId,
-		source: options.workloadTokens,
+		source: workloadTokens,
 		verifier,
 	}, problems)
 	const connect = wireImports({
 		artifact,
 		snapshots: app.connect ?? {},
 		framework: options.environment.framework,
-		bindings: options.connectBindings ?? {},
-		fallback: (request) => fetch(request),
+		bindings: Object.fromEntries(
+			Object.entries(options.connectBindings ?? {}).map((
+				[name, binding],
+			): [string, ConnectFetch] => [name, (request) => platformCall(() => binding(request))]),
+		),
+		fallback: (request) => platformCall(() => fetch(request)),
 	}, problems)
 	const configs = browserConfigs(artifact, options.environment, {
 		dsn: operations === null ? null : (options.environment.framework['FABRIKA_OPERATIONS_DSN'] ?? '').trim(),
@@ -724,6 +725,13 @@ export function boot(app: ContractImplementation, options: BootOptions): Contrac
 				declared.add(id)
 				const row = rows.get(id)
 				const bound = boundHandler(path.reduce<unknown>(childAt, handlers), id, `procedure '${id}'`, procedure.type, artifact, problems)
+				if (row?.kind === 'public') {
+					const served = publicEndpoint(row, procedure, bound, artifact, workloads, options, problems)
+					if (served !== null) {
+						endpoints.set(id, served)
+					}
+					continue
+				}
 				if (!isCredentialed(row)) {
 					problems.push(`procedure '${id}' has no endpoint row`)
 				} else if (bound === null) {
@@ -738,45 +746,39 @@ export function boot(app: ContractImplementation, options: BootOptions): Contrac
 						facilities: siteFacilities(facilitiesOf(artifact, row), bound.declaration),
 						connect: siteConnect(connect.get(id), bound.declaration),
 						site: servedSite(procedure.type, bound),
-						...(bound.declaration?.then == null ? {} : { then: bound.declaration.then }),
+						...egressOf(bound),
+						...bindsOf(id, bound.declaration, artifact, problems),
+						...admissionOf(id, artifact, options, problems),
+						...queryOf(id, artifact),
 					})
 				}
 			}
-		} else if (mount.kind === 'form') {
-			const row = rows.get(name)
-			const admission = formAdmission(name, artifact, options, files, problems)
-			const approved = artifact.mounts[name]
-			const then = approved?.kind === 'form' ? (approved.then ?? null) : null
-			if (row !== undefined && admission !== null) {
-				endpoints.set(name, { kind: 'form', row, form: name, input: mount.input, admission, then })
-			}
 		} else if (mount.kind === 'webhook') {
 			declared.add(name)
 			const row = rows.get(name)
 			const bound = boundHandler(childAt(handlers, name), name, `webhook '${name}'`, 'mutation', artifact, problems)
-			const credential: WorkloadCredential | undefined = workloads.get(`webhook:${name}`)
+			const credential: WorkloadCredential | undefined = workloads.get(workloadSite('webhook', name))
+			const approved = artifact.mounts[name]
 			if (row === undefined || bound === null) {
 				problems.push(`webhook '${name}' has no handler; add handlers.${name}: ({ input, ctx }) => …`)
-			} else if (credential !== undefined) {
+			} else if (credential !== undefined && approved?.kind === 'webhook') {
 				endpoints.set(name, {
 					kind: 'webhook',
 					row,
 					webhook: name,
-					dimension: mount.boundTo,
+					scheme: approved.scheme,
+					boundTo: approved.boundTo,
+					timeoutMs: approved.timeoutMs,
 					actions: mount.actions,
 					input: mount.input,
 					handler: bound.handler,
 					credential,
 					site: bound.site ? (bound.declaration ?? undefined) : undefined,
 				})
-				bindWebhookBindings(name, mount.path, rows, endpoints, () => frameworkOf(framework).webhooks)
 			}
 		}
 	}
-	for (const [id, served] of files?.endpoints(rows, problems) ?? []) {
-		endpoints.set(id, served)
-	}
-	const membership = options.membership === undefined ? null : new IamMembership(options.membership, variables.iamAppId)
+	const membership = membershipRpc === undefined ? null : new IamMembership(membershipRpc, variables.iamAppId)
 	const jobs = bindJobs({
 		artifact,
 		handlers,
@@ -787,23 +789,30 @@ export function boot(app: ContractImplementation, options: BootOptions): Contrac
 		credentials: workloads,
 		mint: issuer.mint,
 		data: bound?.data ?? null,
-		files,
-		frameworkJobs: files === null ? [] : [
-			...(files.scans
+		fileKinds,
+		frameworkJobs: fileKinds === null ? [] : [
+			...(fileKinds.scans
 				? [{
 					name: FILE_SCAN_JOB,
 					schedule: FILE_SCAN_SCHEDULE,
 					timeoutMs: SCAN_LIMITS.jobTimeoutMs,
-					run: (reporter: OperationsReporter, signal: AbortSignal) => files.scanPass(options.scanner ?? null, reporter, signal),
+					run: (reporter: OperationsReporter, signal: AbortSignal) => fileKinds.scanPass(options.scanner ?? null, reporter, signal),
 				}]
 				: []),
-			{ name: FILE_SWEEP_JOB, schedule: FILE_SWEEP_SCHEDULE, timeoutMs: FILE_SWEEP_TIMEOUT_MS, run: (_reporter, signal) => files.sweep(signal) },
+			{
+				name: FILE_SWEEP_JOB,
+				schedule: FILE_SWEEP_SCHEDULE,
+				timeoutMs: FILE_SWEEP_TIMEOUT_MS,
+				run: (_reporter, signal) => fileKinds.sweep(signal),
+			},
 		],
 		membership,
 		capabilities: issuer.authority,
 		containers,
 		...(options.revealHandlerErrors === undefined ? {} : { revealHandlerErrors: options.revealHandlerErrors }),
 		mail,
+		tokens,
+		url,
 	}, problems)
 	for (const id of jobs.declared) {
 		declared.add(id)
@@ -830,6 +839,8 @@ export function boot(app: ContractImplementation, options: BootOptions): Contrac
 					facilities: NO_FACILITIES,
 					readOnly: true,
 					site: servedSite('query', bound),
+					...egressOf(bound),
+					...admissionOf(id, artifact, options, problems),
 				})
 			}
 		}
@@ -844,7 +855,9 @@ export function boot(app: ContractImplementation, options: BootOptions): Contrac
 	if (data === null && kitOriginOf(app.contract) === 'tableless') {
 		servedWithoutData(endpoints, problems)
 	}
-	const site = [...endpoints.values()].find((served) => (served.kind === 'procedure' || served.kind === 'webhook') && served.site !== undefined)
+	const site = [...endpoints.values()].find((served) =>
+		served.kind === 'public' || ((served.kind === 'procedure' || served.kind === 'webhook') && served.site !== undefined)
+	)
 	if (site !== undefined && data === null) {
 		problems.push(`'${site.row.id}' reaches data through ctx.db, which runs on @fabrika/db: pass serve(contract, { database: scoped(tables) })`)
 	}
@@ -875,10 +888,15 @@ export function boot(app: ContractImplementation, options: BootOptions): Contrac
 		mint: issuer.mint,
 		capabilities: issuer.authority,
 		data,
-		files,
+		fileKinds,
 		failures: new FailureReports(reporterFor('fabrika.requests')),
 		kick: jobs.kick,
 		actions: Object.freeze(Object.keys(artifact.actions).sort()),
+		publicShare: new InFlightShare(publicShareOf(options.connections ?? DEFAULT_CONNECTIONS)),
+		clientVouched: options.clientAddress === 'vouched',
+		tokens,
+		url,
+		origin,
 	})
 	return Object.freeze({
 		fetch: (request: Request, exec?: RequestExecutionContext) => runtime.fetch(request, exec),