@fabrika/app 0.6.0 → 0.8.0

package/src/contract/declaration.ts

@@ -2,7 +2,7 @@
 // once described. `buildArtifact` reads only this shape, so a reader that produces it from source (B1) and
 // `compileContract` normalize through the same code.
 
-import type { ChallengeProvider, CspSource, MailTemplate, RpcCaller } from '@fabrika/auth-core'
+import type { CspSource, MailTemplate, RpcCaller } from '@fabrika/auth-core'
 
 export interface ContractDeclaration<S> {
 	readonly app: string
@@ -10,11 +10,13 @@ export interface ContractDeclaration<S> {
 	readonly actions: Readonly<Record<string, string>>
 	readonly roles: Readonly<Record<string, RoleDeclaration>>
 	readonly mounts: Readonly<Record<string, MountDeclaration<S>>>
-	readonly files: Readonly<Record<string, FilesDeclaration>>
+	readonly files: Readonly<Record<string, FileKindDeclaration>>
 	readonly jobs: Readonly<Record<string, CronDeclaration>>
 	readonly exports: Readonly<Record<string, ExportDeclaration<S>>>
 	readonly imports: Readonly<Record<string, ImportDeclaration>>
 	readonly csp: CspDeclaration
+	/** The token purposes of `defineApp`'s options, by purpose; absent without any. */
+	readonly tokens?: Readonly<Record<string, TokenDeclaration<S>>>
 	/** A language IAM speaks; `buildArtifact` refuses another value. */
 	readonly locale?: string
 	readonly displayName?: string
@@ -30,7 +32,7 @@ export interface ContractDeclaration<S> {
  * The keys of the object `defineContract`'s callback returns that are sections, not mounts. Every other key is a
  * mount. A reader of source splits the object the same way.
  */
-export const SURFACE_SECTIONS = ['files', 'jobs', 'exports', 'imports', 'csp'] as const
+export const SURFACE_SECTIONS = ['files', 'jobs', 'exports', 'imports', 'csp', 'tokens'] as const
 
 export type SurfaceSection = (typeof SURFACE_SECTIONS)[number]
 
@@ -39,7 +41,7 @@ export type SurfaceSection = (typeof SURFACE_SECTIONS)[number]
  * records every other key of its options in `unknownOptions`, so an option can never replace what the builder set;
  * `buildArtifact` refuses a non-empty `unknownOptions`. A reader of source fills it the same way.
  */
-export type Builder = 'procedure' | 'rpc' | 'link' | 'spa' | 'form' | 'webhook' | 'files' | 'cron' | 'export' | 'attachment'
+export type Builder = 'procedure' | 'rpc' | 'link' | 'spa' | 'webhook' | 'fileKind' | 'cron' | 'export' | 'attachment'
 
 export interface BuilderFields {
 	readonly options: readonly string[]
@@ -47,14 +49,13 @@ export interface BuilderFields {
 }
 
 export const BUILDER_FIELDS: Readonly<Record<Builder, BuilderFields>> = {
-	procedure: { options: ['input', 'output', 'access', 'crossOrigin'], owned: ['~kind', 'type'] },
+	procedure: { options: ['input', 'output', 'access', 'actions', 'admission', 'limits', 'http'], owned: ['~kind', 'type'] },
 	rpc: { options: ['callers'], owned: ['kind', 'prefix', 'procedures'] },
 	link: { options: ['spa', 'dimension', 'grants', 'issuedBy', 'maxDays', 'procedures'], owned: ['kind', 'prefix'] },
-	spa: { options: ['dir', 'access', 'public'], owned: ['kind', 'prefix'] },
-	form: { options: ['input', 'appendTo', 'maxBytes', 'rate', 'honeypot', 'challenge', 'then', 'crossOrigin', 'files'], owned: ['kind', 'path'] },
-	webhook: { options: ['scheme', 'boundTo', 'actions', 'input', 'maxBytes'], owned: ['kind', 'path'] },
-	files: { options: ['owner', 'read', 'write', 'delete', 'maxBytes', 'types', 'maxPerOwner', 'link', 'scan'], owned: ['kind'] },
-	cron: { options: ['actions', 'scope', 'timeout', 'retries'], owned: ['kind', 'schedule'] },
+	spa: { options: ['dir', 'access', 'browserConfig'], owned: ['kind', 'prefix'] },
+	webhook: { options: ['scheme', 'boundTo', 'actions', 'input', 'limits'], owned: ['kind', 'path'] },
+	fileKind: { options: ['types', 'maxBytes', 'scan'], owned: ['kind'] },
+	cron: { options: ['actions', 'limits', 'retries'], owned: ['kind', 'schedule'] },
 	export: { options: ['version', 'consumers', 'audience', 'procedures'], owned: ['kind'] },
 	attachment: { options: ['format', 'filename', 'row', 'maxBytes', 'maxRows'], owned: [] },
 }
@@ -69,7 +70,7 @@ export function unknownOptions(options: object, builder: Builder): string[] {
  * The off-road fields a site of the staged kit declares beside its builder's options. The kit copies them into
  * `declared`; `buildArtifact` checks which of them the site may carry.
  */
-export const DECLARED_FIELDS = ['sql', 'unscoped', 'connect', 'issues', 'then', 'mailer'] as const
+export const DECLARED_FIELDS = ['sql', 'unscoped', 'connect', 'issues', 'mailer', 'kicks', 'binds', 'signs', 'egress'] as const
 
 /** The keys of a kit site's `options` that are neither `builder`'s option fields nor a declared field. */
 export function kitUnknownOptions(options: object, builder: Builder): string[] {
@@ -77,7 +78,7 @@ export function kitUnknownOptions(options: object, builder: Builder): string[] {
 }
 
 /**
- * The reach a site of the staged kit declares, as written (`sql`, `unscoped`, `connect`, `issues`, `then`, `mailer`): only the fields
+ * The reach a site of the staged kit declares, as written (`sql`, `unscoped`, `connect`, `issues`, `mailer`, `kicks`, `binds`, `signs`, `egress`): only the fields
  * its options carry. Unchecked here: the static reader copies what the source holds, and `buildArtifact` parses it.
  */
 export interface DeclaredDeclaration {
@@ -85,8 +86,11 @@ export interface DeclaredDeclaration {
 	readonly unscoped?: unknown
 	readonly connect?: unknown
 	readonly issues?: unknown
-	readonly then?: unknown
 	readonly mailer?: unknown
+	readonly kicks?: unknown
+	readonly binds?: unknown
+	readonly signs?: unknown
+	readonly egress?: unknown
 }
 
 /** The declared fields of a kit site's options, each one only when the options carry it. */
@@ -96,11 +100,20 @@ export function declaredOf(options: DeclaredDeclaration): DeclaredDeclaration {
 		...(options.unscoped === undefined ? {} : { unscoped: options.unscoped }),
 		...(options.connect === undefined ? {} : { connect: options.connect }),
 		...(options.issues === undefined ? {} : { issues: options.issues }),
-		...(options.then === undefined ? {} : { then: options.then }),
 		...(options.mailer === undefined ? {} : { mailer: options.mailer }),
+		...(options.kicks === undefined ? {} : { kicks: options.kicks }),
+		...(options.binds === undefined ? {} : { binds: options.binds }),
+		...(options.signs === undefined ? {} : { signs: options.signs }),
+		...(options.egress === undefined ? {} : { egress: options.egress }),
 	}
 }
 
+/** One token purpose as written: its claims schema and its longest lifetime; `buildArtifact` checks both. */
+export interface TokenDeclaration<S> {
+	readonly claims: S
+	readonly maxDays: unknown
+}
+
 /** Option keys outside the builder's option fields; `buildArtifact` refuses any. */
 interface OptionsRecord {
 	readonly unknownOptions?: readonly string[]
@@ -128,12 +141,27 @@ export type AccessDeclaration =
 	| { readonly action: string; readonly on: string; readonly from: string }
 	| { readonly action: string; readonly creates: string }
 	| { readonly action: string; readonly app: true }
+	| { readonly capabilities: Readonly<Record<string, CapabilityDeclaration>> }
+	/** Anyone calls it; its handler runs as the procedure's own workload, with its top-level `actions`. RPC only. */
+	| { readonly public: true }
+
+/** One of several capabilities: an action in a dimension, listed `over` it or read from an input field. */
+export type CapabilityDeclaration =
+	| { readonly action: string; readonly over: string }
+	| { readonly action: string; readonly in: string; readonly from: string }
+	| { readonly action: string; readonly on: string; readonly from: string }
 
 /**
  * An export procedure's access: an action in a dimension, never `member`, because the consumer's key holds exactly the
- * actions, and never `app`, because a v1 export declares one dimension.
+ * actions, never `app`, because a v1 export declares one dimension, and never several capabilities.
  */
-export type ExportAccessDeclaration = Exclude<AccessDeclaration, { readonly member: true } | { readonly app: true }>
+export type ExportAccessDeclaration = Exclude<
+	AccessDeclaration,
+	| { readonly member: true }
+	| { readonly app: true }
+	| { readonly capabilities: Readonly<Record<string, CapabilityDeclaration>> }
+	| { readonly public: true }
+>
 
 export interface LinkAccessDeclaration {
 	readonly action: string
@@ -155,8 +183,14 @@ export interface ProcedureDeclaration<S, Access = AccessDeclaration> extends Opt
 	readonly input: S | null
 	readonly output: S
 	readonly access: Access
-	/** `true` opens the procedure to the environment's listed origins, as written; `buildArtifact` refuses anything else. */
-	readonly crossOrigin?: unknown
+	/** A public procedure's workload actions, as written: all its handler holds. Required there, refused elsewhere. */
+	readonly actions?: unknown
+	/** `{ origins?, rate?, challenge? }`, as written; `buildArtifact` merges it into the defaults. */
+	readonly admission?: unknown
+	/** `{ maxBytes?, timeoutMs? }`, as written; `buildArtifact` checks each against its ceiling. */
+	readonly limits?: unknown
+	/** `{ method?, query?, body?, cache? }`, as written; `buildArtifact` checks the HTTP shape's rules. */
+	readonly http?: unknown
 	/** What a procedure of the staged kit declares off the paved road; a `defineContract` procedure has none. */
 	readonly declared?: unknown
 	/**
@@ -164,6 +198,13 @@ export interface ProcedureDeclaration<S, Access = AccessDeclaration> extends Opt
 	 * `output` is the array of rows the handler returns.
 	 */
 	readonly attachment?: AttachmentDeclaration
+	/** Set by `describeContract` when the output is a `redirect()`: the procedure answers a redirect to `{ to }`. */
+	readonly redirect?: RedirectDeclaration
+}
+
+/** The origins a `redirect()` output lists, as written; `buildArtifact` checks each. */
+export interface RedirectDeclaration {
+	readonly origins: readonly string[]
 }
 
 /**
@@ -187,14 +228,16 @@ export type MountDeclaration<S> =
 	| LinkMountDeclaration<S>
 	| SpaMountDeclaration
 	| HealthMountDeclaration
-	| FormMountDeclaration<S>
 	| WebhookMountDeclaration<S>
 
 export interface RpcMountDeclaration<S> extends OptionsRecord {
 	readonly kind: 'rpc'
 	readonly prefix: string
-	readonly callers: readonly [RpcCaller, ...RpcCaller[]]
+	/** The callers of its credentialed procedures; none when every procedure is public. */
+	readonly callers: readonly RpcCaller[]
 	readonly procedures: ProcedureTreeDeclaration<S>
+	/** The kit's `c.rpc` options, as written; `buildArtifact` takes `'backward'` and `'unchecked'`. */
+	readonly compatibility?: unknown
 }
 
 export interface LinkMountDeclaration<S> extends OptionsRecord {
@@ -214,7 +257,7 @@ export interface SpaMountDeclaration extends OptionsRecord {
 	readonly dir: string
 	readonly access: SpaAccessDeclaration
 	/** Application variables whose values the mount's pages read from `<prefix>/__fabrika-config.json`. */
-	readonly public?: readonly string[]
+	readonly browserConfig?: readonly string[]
 }
 
 export interface HealthMountDeclaration {
@@ -222,57 +265,30 @@ export interface HealthMountDeclaration {
 	readonly path: string
 }
 
-export interface FormMountDeclaration<S> extends OptionsRecord {
-	readonly kind: 'form'
-	readonly path: string
-	readonly input: S
-	readonly appendTo: string
-	readonly maxBytes?: number
-	/**
-	 * Submissions per minute from one client and accepted in all, and the bytes a form with files writes per hour;
-	 * `FORM_LIMITS` and `FORM_FILE_LIMITS` hold the defaults.
-	 */
-	readonly rate?: { readonly perClient?: number; readonly perForm?: number; readonly bytesPerHour?: number }
-	/** An input field that must stay empty. */
-	readonly honeypot?: string
-	/**
-	 * A challenge verified on the server; `secret` names the application variable that holds the provider's secret,
-	 * `siteKey` the one that holds the widget's public site key.
-	 */
-	readonly challenge?: { readonly provider: ChallengeProvider; readonly secret: string; readonly siteKey?: string }
-	/** The cron job of the contract that each accepted submission kicks. */
-	readonly then?: string
-	/** `true` (the environment's listed origins) or `'*'` (any origin), as written; `buildArtifact` refuses anything else. */
-	readonly crossOrigin?: unknown
-	/** The file fields, by name: `{ collection, required? }` each, as written; `buildArtifact` checks them. */
-	readonly files?: unknown
-}
-
 export interface WebhookMountDeclaration<S> extends OptionsRecord {
 	readonly kind: 'webhook'
 	readonly path: string
-	readonly scheme: 'github-sha256'
+	/** A preset or a verifier shape, as written; `buildArtifact` checks it. */
+	readonly scheme: unknown
 	/** A dimension, or `app` for the whole application. */
 	readonly boundTo: string
 	readonly actions: readonly string[]
 	readonly input: S
-	readonly maxBytes?: number
+	/** `{ maxBytes?, timeoutMs? }`, as written; `buildArtifact` checks each against its ceiling. */
+	readonly limits?: unknown
 	/** What a webhook of the staged kit declares off the paved road. */
 	readonly declared?: unknown
 }
 
-export interface FilesDeclaration extends OptionsRecord {
-	readonly kind: 'files'
-	readonly owner: string
-	readonly read: string
-	readonly write: string
-	readonly delete: string
-	readonly maxBytes: number
+/**
+ * A file kind (`c.files({ types, maxBytes, scan? })`, no `owner`): a class of stored files a table's file column holds.
+ * It has no owner, no actions and no endpoint.
+ */
+export interface FileKindDeclaration extends OptionsRecord {
+	readonly kind: 'file-kind'
 	readonly types: readonly string[]
-	readonly maxPerOwner?: number
-	/** `true`: every link mount bound to the owner's dimension serves the files; a list: the named link mounts only. */
-	readonly link?: boolean | readonly string[]
-	/** Every upload waits `quarantined` until the scan pass gives it a clean verdict. */
+	readonly maxBytes: number
+	/** Every file waits `quarantined` until the scan gives it a clean verdict; a byte consumer answers 409 until then. */
 	readonly scan?: boolean
 }
 
@@ -280,9 +296,8 @@ export interface CronDeclaration extends OptionsRecord {
 	readonly kind: 'cron'
 	readonly schedule: string
 	readonly actions: readonly string[]
-	/** A dimension, or `app` for the whole application. */
-	readonly scope: string
-	readonly timeout?: string
+	/** `{ timeoutMs? }`, as written; `buildArtifact` checks it against its ceiling. */
+	readonly limits?: unknown
 	readonly retries?: number
 	/** What a job of the staged kit declares off the paved road. */
 	readonly declared?: unknown

package/src/contract/defaults.ts

@@ -2,77 +2,165 @@
 // source reaches them only through `buildArtifact`, so both producers emit the same artifact.
 
 import type { BodyAdmission, ChallengeProvider } from '@fabrika/auth-core'
+import { WORKER_BLOB_SOURCE } from '@fabrika/proxy-core/headers'
 
 export const CONTRACT_DEFAULTS = {
 	/** A failed job run is not retried unless the job asks for it: a retry repeats work. */
 	jobRetries: 0,
-	formMaxBytes: 16 * 1024,
-	webhookMaxBytes: 1024 * 1024,
-	fileMaxPerOwner: null,
-	fileLink: false,
 	importTimeoutMs: null,
 } as const
 
 /**
- * A form's admission, per minute and shared by every instance of the application: the requests it admits from one
- * client (`X-Fabrika-Client-Ip`) and the submissions it accepts in all. A form may declare its own `rate`, up to
- * `maxPerMinute` each.
+ * A procedure's bounds: its body (`maxBytes`, without files) and its handler's time (`timeoutMs`, counted after the last
+ * body byte), each with its default and its ceiling, and the most calls a bucket admits per minute.
  */
-export const FORM_LIMITS = {
-	perClient: 10,
-	perForm: 100,
+export const PROCEDURE_LIMITS = {
+	maxBytes: 64 * 1024,
+	maxMaxBytes: 1024 * 1024,
+	timeoutMs: 10_000,
+	maxTimeoutMs: 60_000,
 	maxPerMinute: 10_000,
+	maxBytesPerHour: 64 * 1024 * 1024 * 1024,
+	/** The body of a procedure with file fields: its default adds each field's files at its kind's `maxBytes`. */
+	maxFileBodyBytes: 48 * 1024 * 1024,
+	/** The files one request carries, at most: each field's `.max(n)` together. */
+	maxFiles: 20,
+	/** The headers of one part of a multipart body, at most. */
+	maxPartHeaderBytes: 8 * 1024,
+} as const
+
+/**
+ * A procedure with file fields is `multipart/form-data`: its JSON input travels in the first part, named `input`, and
+ * each file in a part named after its field. A field of several files sends one part per file, under its name.
+ */
+export const FILE_INPUT_PART = 'input'
+
+/**
+ * A webhook's bounds: a provider's body, by default the most a procedure without files takes, since providers send
+ * whole objects; up to what a procedure with file fields takes, since an inbound e-mail carries its attachments in the
+ * body for the handler to `put`; and its handler's time, a procedure's.
+ */
+export const WEBHOOK_LIMITS = {
+	maxBytes: PROCEDURE_LIMITS.maxMaxBytes,
+	maxMaxBytes: PROCEDURE_LIMITS.maxFileBodyBytes,
+	timeoutMs: PROCEDURE_LIMITS.timeoutMs,
+} as const
+
+/** A job attempt's time limit (`limits.timeoutMs`) and its ceiling, which keeps a lease and a timer within a day. */
+export const JOB_LIMITS = {
+	timeoutMs: 15 * 60_000,
+	maxTimeoutMs: 24 * 60 * 60_000,
 } as const
 
-/** The input field that carries a form's challenge token; a form with a challenge declares it as a string. */
-export const FORM_CHALLENGE_FIELD = 'challengeToken'
+/** A public mutation's buckets per minute unless it declares its own: per client and for the endpoint. */
+export const PUBLIC_MUTATION_RATE = { perClient: 10, perEndpoint: 100 } as const
+
+/** What a widget's `action` may be: at most 32 letters, digits, `_` and `-`, what Turnstile admits, and a path segment. */
+export const CHALLENGE_ACTION = /^[A-Za-z0-9_-]{1,32}$/
 
 /**
- * A form that takes files is `multipart/form-data`: its input travels as JSON in the first part, named `input`, and each
- * file in a part named after its field. The proxy admits only that type for such a form.
+ * The challenge widget's `action` of a public procedure that declares none (`challenge.action`): its endpoint id with
+ * `_` for `.`.
  */
+export function challengeAction(endpoint: string): string {
+	return endpoint.replaceAll('.', '_')
+}
+
+/** The input field that carries a challenge token; a procedure with a challenge declares it as a string. */
+export const CHALLENGE_FIELD = 'challengeToken'
+
+/** A procedure with file fields reads `multipart/form-data`; the proxy admits that type for its row. */
 export { FORM_MULTIPART_TYPE } from '@fabrika/auth-core'
-export const FORM_INPUT_PART = 'input'
 
 /**
- * The bounds of a form's files: at most `maxFields` file fields, a file each; a received file waits `holdMs` for the
- * job that drains the inbox to attach it, then the sweep deletes it; a submission's body must arrive within
- * `timeoutMs`; a part's headers hold at most `maxPartHeaderBytes`.
+ * Each challenge provider's fixed browser sources: the origins of its widget's script and frame, and `blob:` for workers
+ * when the widget starts its own. ALTCHA's widget is bundled with the page and solves in workers built from `Blob`s.
  */
-export const FORM_FILE_LIMITS = {
-	maxFields: 4,
-	holdMs: 7 * 24 * 60 * 60 * 1000,
-	timeoutMs: 5 * 60 * 1000,
-	maxPartHeaderBytes: 8 * 1024,
-	/**
-	 * A form with files accepts this many submissions per minute unless it declares `rate.perForm`, and its files write
-	 * at most `bytesPerHour` per hour unless it declares `rate.bytesPerHour` (at most `maxBytesPerHour`). Each file
-	 * reserves its collection's `maxBytes` before its first byte is written, and gives back what it did not use.
-	 */
-	perForm: 20,
-	bytesPerHour: 512 * 1024 * 1024,
-	maxBytesPerHour: 64 * 1024 * 1024 * 1024,
+export const CHALLENGE_ORIGINS: Readonly<
+	Record<ChallengeProvider, { readonly scriptSrc: readonly string[]; readonly frameSrc: readonly string[]; readonly workerSrc: readonly string[] }>
+> = {
+	turnstile: { scriptSrc: ['https://challenges.cloudflare.com'], frameSrc: ['https://challenges.cloudflare.com'], workerSrc: [] },
+	altcha: { scriptSrc: [], frameSrc: [], workerSrc: [WORKER_BLOB_SOURCE] },
+}
+
+/**
+ * An ALTCHA challenge: PBKDF2/SHA-256 attempts of `cost` iterations each, counted up to a number drawn per challenge
+ * between `minCounter` and `maxCounter`, so a browser makes that many attempts, about half of `maxCounter` on average.
+ * The draw starts at 1: a solver that knew a higher floor would skip the attempts below it, which the widget makes.
+ * `cost` and `maxAgeMs` are the contract's (`challenge.cost`, `challenge.maxAgeMs`), each with its default and its
+ * bounds, and together they must leave a slow phone time to solve (`altchaSolvable`). The HMAC key is at least
+ * `minKeyLength` characters: every issued challenge publishes a signature a short key could be guessed from. A solved
+ * payload is base64 JSON of the challenge and its solution, at most `maxTokenLength` characters.
+ */
+export const ALTCHA_LIMITS = {
+	algorithm: 'PBKDF2/SHA-256',
+	cost: 5000,
+	minCost: 1000,
+	maxCost: 18_000,
+	minCounter: 1,
+	maxCounter: 10_000,
+	maxAgeMs: 10 * 60_000,
+	minMaxAgeMs: 60_000,
+	maxMaxAgeMs: 60 * 60_000,
+	maxTokenLength: 4096,
+	minKeyLength: 32,
+	/** What a slow phone's widget runs over its workers, PBKDF2 iterations a second: the rate the worst case is sized by. */
+	slowIterationsPerSecond: 2_000_000,
+	/** How long the widget tries before it gives up. */
+	solveTimeoutMs: 90_000,
 } as const
 
-/** Each challenge provider's fixed browser origins: its widget's script and its frame. */
-export const CHALLENGE_ORIGINS: Readonly<Record<ChallengeProvider, { readonly scriptSrc: readonly string[]; readonly frameSrc: readonly string[] }>> =
-	{
-		turnstile: { scriptSrc: ['https://challenges.cloudflare.com'], frameSrc: ['https://challenges.cloudflare.com'] },
-	}
+/** How long a slow phone takes for the worst draw of a challenge of `cost`, in ms. */
+export function altchaWorstSolveMs(cost: number): number {
+	return Math.ceil((cost * ALTCHA_LIMITS.maxCounter * 1000) / ALTCHA_LIMITS.slowIterationsPerSecond)
+}
 
-/** Generated file endpoints live under this prefix, for signed-in people. */
-export const FILES_PREFIX = '/api'
+/** Whether a slow phone solves the worst draw before the widget gives up and within half the challenge's lifetime. */
+export function altchaSolvable(cost: number, maxAgeMs: number): boolean {
+	return altchaWorstSolveMs(cost) <= Math.min(ALTCHA_LIMITS.solveTimeoutMs, maxAgeMs / 2)
+}
 
 /**
- * The bounds of a file collection: the largest file a `scan: true` collection admits (the scanner reads at most this
- * much of one file, so a larger one could never be given a clean verdict), and the pages of `files.<name>.list`.
+ * The `action` a procedure's challenge expects back: the declared one, else the endpoint id with `_` for `.`. The build
+ * and the typed client both read it here, so the client's challenge path is the artifact's.
+ */
+export function declaredChallengeAction(endpoint: string, declared: unknown): string {
+	return typeof declared === 'string' ? declared : challengeAction(endpoint)
+}
+
+/** Where an ALTCHA challenge is issued: one path per procedure, under its action. */
+export const CHALLENGE_PREFIX = '/__fabrika/challenge'
+
+export function challengePath(action: string): string {
+	return `${CHALLENGE_PREFIX}/${action}`
+}
+
+/** The endpoint id of the row that issues the challenge of public procedure `endpoint`. */
+export function challengeRowId(endpoint: string): string {
+	return `${endpoint}.challenge`
+}
+
+/**
+ * The buckets per minute of the endpoint that issues a challenge: a visitor fetches one per form shown and one more per
+ * expiry, and every issue costs the server one attempt's work. Each is at least this, and at least twice the
+ * procedure's own bucket, so the issuer never admits fewer submissions than the procedure declares. A bucket the
+ * procedure turns off (`null`) is this one on the issuer: the procedure's handler may be cheap, the issue never is.
+ */
+export const CHALLENGE_ISSUE_RATE = { perClient: 30, perEndpoint: 600 } as const
+
+/** The issuer's bucket for the procedure's `own`, within the ceiling of every bucket. */
+export function challengeIssueBucket(own: number | null, floor: number): number {
+	return Math.min(PROCEDURE_LIMITS.maxPerMinute, Math.max(floor, 2 * (own ?? 0)))
+}
+
+/**
+ * The bounds of a file kind: the largest file a `scan: true` kind admits (the scanner reads at most this much of one
+ * file, so a larger one could never be given a clean verdict).
  */
 export const FILE_LIMITS = {
 	maxScannedBytes: 100 * 1024 * 1024,
-	/** Sniffable types a `scan: true` collection refuses: archives other than ZIP, whose contents the framework does not check. */
+	/** Sniffable types a `scan: true` kind refuses: archives other than ZIP, whose contents the framework does not check. */
 	unscannedTypes: ['application/gzip'] as readonly string[],
-	listPageDefault: 50,
-	listPageMax: 100,
 } as const
 
 /**
@@ -116,15 +204,6 @@ export const LINK_API_SEGMENT = 'api'
 /** The path segment a webhook appends for the binding a delivery addresses. */
 export const WEBHOOK_BINDING_PARAMETER = 'bindingId'
 
-/** Generated webhook binding endpoints (`webhooks.<name>.bind`, `.unbind`) live under this prefix, for signed-in people. */
-export const WEBHOOKS_PREFIX = '/api'
-
-/** The input field of a binding endpoint that names the scope value the binding reaches. */
-export const WEBHOOK_SCOPE_FIELD = 'scope'
-
-/** A GitHub account a binding accepts: an App installation or a repository, by numeric id. */
-export const WEBHOOK_ACCOUNT_PATTERN = '^(?:installation|repository):[1-9][0-9]{0,19}$'
-
 /**
  * The share SPA's bootstrap, served by the framework under the link prefix and loaded before any other script: it
  * takes the key out of the URL fragment and keeps it in a closure behind `SHARE_KEY_GLOBAL`.
@@ -168,6 +247,12 @@ export const GENERATED_LINK = 'fabrika:link'
  */
 export const GENERATED_ROW_PREFIX = 'fabrika:row:'
 
+/**
+ * The prefix of the value a generated endpoint access case sends in a file field, followed by the field's file kind:
+ * `fabrika:file:attachments`. The endpoint access kit sends a small file of the kind's first type it can write in its place.
+ */
+export const GENERATED_FILE_PREFIX = 'fabrika:file:'
+
 export const JSON_ADMISSION: BodyAdmission = { contentTypes: ['application/json'], maxBytes: null }
 
 /** `/api` + `notes.list` → `/api/notes.list`; a root prefix does not double the `/`. */
@@ -176,13 +261,10 @@ export function joinPath(prefix: string, rest: string): string {
 }
 
 /**
- * The paths of the endpoints of collection `name` under `base` (`FILES_PREFIX`, or a link mount's API prefix): the
- * upload takes `/:owner` after its path for a signed-in caller, and the download `/:fileId`.
+ * The path of an RPC mount's procedure: its own `http.path` when it declares one (a public procedure only, which
+ * `buildArtifact` checks), else `<prefix>/<dotted.path>`. The typed client calls the path the artifact's row carries.
  */
-export function fileCollectionPaths(
-	base: string,
-	name: string,
-): { readonly upload: string; readonly download: string; readonly list: string; readonly remove: string } {
-	const at = joinPath(base, `files.${name}`)
-	return { upload: `${at}.upload`, download: at, list: `${at}.list`, remove: `${at}.remove` }
+export function procedurePath(prefix: string, dotted: string, http: unknown): string {
+	const own: unknown = typeof http === 'object' && http !== null ? Reflect.get(http, 'path') : undefined
+	return typeof own === 'string' ? own : joinPath(prefix, dotted)
 }