@fabrika/app 0.6.0 → 0.8.0

package/src/implement/boot.ts

@@ -16,7 +16,6 @@ import {
 	FABRIKA_CONTRACT_DIGEST,
 	FABRIKA_IAM_APP_ID,
 	FABRIKA_PROXY_SECRET,
-	type FormMountArtifact,
 	type IamMembershipRpc,
 	isLoopbackHost,
 	type Jwks,
@@ -24,15 +23,7 @@ import {
 } from '@fabrika/auth-core'
 import type { Database } from '@fabrika/db'
 import type { CapabilityAuthority } from '@fabrika/db/capability'
-import {
-	bindScopedDatabase,
-	type DataAccess,
-	dataAccessOf,
-	type FrameworkTables,
-	frameworkTablesOf,
-	isScopedDatabase,
-	type WebhookTables,
-} from '@fabrika/db/framework'
+import { bindScopedDatabase, type DataAccess, dataAccessOf, type FrameworkTables, frameworkTablesOf, isScopedDatabase } from '@fabrika/db/framework'
 import type { DataKind } from '@fabrika/db/tables'
 import type { EmailProviderRegistry } from '@fabrika/email'
 import { builtinEmailProviders } from '@fabrika/email/providers'
@@ -41,11 +32,12 @@ import type { FileObjectStore } from '@fabrika/platform'
 import { compileContract } from '../contract/compile'
 import { exportDescription } from '../contract/connect'
 import { isProcedure, type ProcedureDeclaration, type ProcedureTreeDeclaration, SURFACE_SECTIONS } from '../contract/declaration'
-import { exportBase, FORM_CHALLENGE_FIELD, FORM_FILE_LIMITS, FORM_LIMITS, spaPrefixRowId } from '../contract/defaults'
-import type { Schema } from '../contract/define'
+import { challengeRowId, exportBase, spaPrefixRowId } from '../contract/defaults'
+import type { AnyContract, Schema } from '../contract/define'
 import { kitOriginOf } from '../contract/handled'
+import { schemaFromShape } from '../contract/schema-from-shape'
 import type { RequestExecutionContext } from '../fetch'
-import { FILE_SWEEP_JOB, FILE_SWEEP_SCHEDULE, FILE_SWEEP_TIMEOUT_MS, type FileCollections, fileCollections } from '../files/collections'
+import { FILE_SWEEP_JOB, FILE_SWEEP_SCHEDULE, FILE_SWEEP_TIMEOUT_MS, storedFileKinds } from '../files/kinds'
 import { FILE_SCAN_JOB, FILE_SCAN_SCHEDULE, type FileScanner, SCAN_LIMITS } from '../files/scan'
 import { type MailStandIn, resolveMailTransports } from '../jobs/mail'
 import { logReporter, type OperationsReporter, operationsReporter, operationsSettings, type ReportSource } from '../jobs/report'
@@ -53,28 +45,30 @@ import { bindJobs, type ContractJobs, type HandlerErrorSink } from '../jobs/runn
 import { environmentScrubber } from '../jobs/scrub'
 import { browserConfigs } from './browser-config'
 import { createCapabilityIssuer, requestIsReadOnly } from './capability'
-import { type ChallengeFetch, type ChallengeVerifier, turnstileVerifier } from './challenge'
+import type { ChallengeFetch, ChallengeWork } from './challenge'
 import { type ConnectFetch, wireImports } from './connect'
 import {
 	ContractRuntime,
 	type Facilities,
-	type FormAdmission,
 	NO_FACILITIES,
+	type ProcedureQuery,
 	proxySecretDigest,
 	type ServedEndpoint,
 	type ServedSite,
 	type SpaAssets,
 } from './dispatch'
+import { installEgressGuard, platformCall, platformFacility } from './egress'
 import type { CapturedEnvironment } from './environment'
 import { FailureReports } from './failures'
-import { ServerFault } from './faults'
-import type { SubmissionFields } from './form-admission'
 import { applicationPolicy } from './headers'
 import type { ContractDatabase, ContractImplementation, ImplementationDatabase } from './implement'
 import { approvedDeclaration, approvedReach, isSiteHandler, type SiteDeclaration } from './invocation'
 import type { ReadDirectory } from './membership'
-import { bindingHandlers, webhookBindInput, webhookBindOutput, webhookUnbindInput, webhookUnbindOutput } from './webhook'
-import { type WorkloadCredential, workloadCredentials, type WorkloadTokenSource } from './workload'
+import { type AdmissionOptions, InFlightShare, type ProcedureAdmission, procedureAdmission, publicShareOf } from './public'
+import { readTokenKeys, type RuntimePurpose, SignedTokens } from './tokens'
+import { appUrl, readAppOrigin } from './urls'
+import type { BindableWebhook } from './webhook'
+import { type WorkloadCredential, workloadCredentials, workloadSite, type WorkloadTokenSource } from './workload'
 
 /** Where the token verifier gets IAM's public keys: the IAM binding on Cloudflare, the issuer's JWKS elsewhere. */
 export interface IamKeySource {
@@ -95,10 +89,10 @@ export interface BootOptions {
 	 * authenticated hop (ADR-0022 rule 1). A secret that is set is checked either way.
 	 */
 	readonly requireProxySecret?: boolean
-	/** The object storage of the file collections, which the Bun adapter opens. Without it, a contract with files does not boot. */
+	/** The object storage of the stored files, which the Bun adapter opens. Without it, a contract with file kinds does not boot. */
 	readonly files?: FileObjectStore
 	/**
-	 * The malware scanner of the scan job of `scan: true` collections, which the Bun adapter supplies to a job run
+	 * The malware scanner of the scan job of `scan: true` file kinds, which the Bun adapter supplies to a job run
 	 * (`clamscanScanner`). Without it the scan job leaves every quarantined file quarantined and reports.
 	 */
 	readonly scanner?: FileScanner
@@ -119,15 +113,18 @@ export interface BootOptions {
 	readonly workloadTokens?: WorkloadTokenSource
 	/** What posts a report to Operations' ingest; `fetch` by default. */
 	readonly operationsFetch?: (request: Request) => Promise<Response>
-	/** What asks a form's challenge provider to verify a token; `fetch` by default. */
+	/** What asks a public procedure's challenge provider to verify a token; `fetch` by default. */
 	readonly challengeFetch?: ChallengeFetch
 	/**
-	 * The developer's own machine only (`fabrika app dev`): the token a form's challenge admits more than once, which
-	 * Turnstile's always-passing test widget hands out for every submission. Every other token stays single use.
+	 * The developer's own machine only (`fabrika app dev`): the token a challenge admits more than once, which
+	 * Turnstile's always-passing test widget hands out for every call. Every other token stays single use.
 	 */
 	readonly repeatableChallengeToken?: string
-	/** How long a form's multipart body may take to arrive; `FORM_FILE_LIMITS.timeoutMs` unless a framework test shortens it. */
-	readonly formFileTimeoutMs?: number
+	/**
+	 * The work of every ALTCHA challenge in place of the contract's `cost`: the test kit's and `fabrika app dev`'s
+	 * (`MINIMAL_CHALLENGE_WORK`), so a test solves one in milliseconds. A deployed application never sets it.
+	 */
+	readonly challengeWork?: ChallengeWork
 	/**
 	 * The developer's own machine only (`fabrika app dev`): what a job's handler threw, which every log of a deployed
 	 * application withholds because it may carry a credential.
@@ -145,8 +142,19 @@ export interface BootOptions {
 	 * `FABRIKA_EMAIL_*` nor `serve`'s `mail`.
 	 */
 	readonly mailStandIn?: MailStandIn
+	/** The connections the application's pool holds: a quarter of them, at least one, is the public procedures' share. */
+	readonly connections?: number
+	/**
+	 * `'vouched'` where the proxy's `X-Fabrika-Client-Ip` is the visitor's own address, so `ctx.client.ip` reads it. A
+	 * runtime behind a balancer whose range the platform does not trust (Zerops, until it does) leaves it unset: the ip is
+	 * then `null`.
+	 */
+	readonly clientAddress?: 'vouched'
 }
 
+/** The pool size a runtime adapter that names none is assumed to have: the Bun adapter's default. */
+const DEFAULT_CONNECTIONS = 10
+
 export interface ContractApp {
 	/** `exec` keeps a failure's report to Operations alive past the response (a Worker's `waitUntil`). */
 	fetch(request: Request, exec?: RequestExecutionContext): Promise<Response>
@@ -270,9 +278,6 @@ function unservable(
 			// Every link request re-reads where the object lies; without the table that records it, nothing could.
 			problems.push(`link mount '${name}' shares a '${mount.dimension}', but no table in src/db/tables.ts owns that dimension to locate it`)
 		}
-		if (mount.kind === 'webhook' && mount.boundTo.kind === 'app') {
-			problems.push(`webhook '${name}' is bound to the whole application; this version serves a webhook bound to a dimension (boundTo: '<dimension>')`)
-		}
 	}
 	for (const row of artifact.endpoints) {
 		if (row.requirement?.kind !== 'action') {
@@ -422,6 +427,11 @@ function boundHandler(
 	return null
 }
 
+/** The origins a staged-kit site's handler reaches, a kit without tables included; nothing for a bare handler. */
+function egressOf(bound: BoundHandler): { readonly egress?: readonly string[] } {
+	return !bound.site || bound.declaration === null ? {} : { egress: bound.declaration.egress }
+}
+
 /** A staged-kit contract's endpoint gets `ctx.links` only for the link mount it declares it `issues`. */
 function siteFacilities(facilities: Facilities, declaration: SiteDeclaration | null): Facilities {
 	if (declaration === null) {
@@ -504,24 +514,17 @@ function asksIam(served: ServedEndpoint): boolean {
 	return creates || served.facilities.members === 'manage' || served.facilities.links.length > 0
 }
 
-/** A form and a webhook write the framework's own tables, which only `@fabrika/db`'s `scoped(tables)` reaches. */
+/** A webhook and a procedure's buckets write the framework's own tables, which only `@fabrika/db`'s `scoped(tables)` reaches. */
 function frameworkProblems(artifact: ContractArtifact, framework: FrameworkTables | null, problems: string[]): void {
+	const counted = Object.entries(artifact.procedures ?? {}).find(([, rules]) => Object.values(rules.rate).some((bucket) => bucket !== null))
+	if (counted !== undefined && framework === null) {
+		problems.push(
+			`procedure '${counted[0]}' counts its calls in buckets, which live in @fabrika/db: pass serve(contract, { database: scoped(tables) })`,
+		)
+	}
 	for (const [name, mount] of Object.entries(artifact.mounts)) {
-		if (mount.kind !== 'form' && mount.kind !== 'webhook') {
-			continue
-		}
-		if (framework === null) {
-			problems.push(`mount '${name}' is a ${mount.kind}, which writes through @fabrika/db: pass serve(contract, { database: scoped(tables) })`)
-			continue
-		}
-		if (mount.kind === 'form') {
-			const input = artifact.endpoints.find((row) => row.id === name)?.input
-			const submitted = submissionFieldsOf(mount)
-			const fields = (input?.type === 'object' ? Object.keys(input.fields) : []).filter((field) =>
-				field !== submitted.honeypot && !(submitted.challenge && field === FORM_CHALLENGE_FIELD)
-			)
-			// A file field's column receives the id of the file the submission carried.
-			problems.push(...framework.inboxProblems(name, [...fields, ...Object.keys(mount.files ?? {})]))
+		if (mount.kind === 'webhook' && framework === null) {
+			problems.push(`mount '${name}' is a webhook, which writes through @fabrika/db: pass serve(contract, { database: scoped(tables) })`)
 		}
 	}
 }
@@ -530,108 +533,137 @@ function isCredentialed(row: EndpointRow | undefined): row is CredentialedEndpoi
 	return row !== undefined && row.requirement !== null
 }
 
-function submissionFieldsOf(mount: FormMountArtifact): SubmissionFields {
-	return { honeypot: mount.honeypot ?? null, challenge: mount.challenge !== undefined }
+/** A POST procedure's `http.query`, as the field its served endpoint carries: parsed by the approved shape. */
+function queryOf(id: string, artifact: ContractArtifact): { readonly query?: ProcedureQuery } {
+	const shape = artifact.procedures !== undefined && Object.hasOwn(artifact.procedures, id) ? artifact.procedures[id]?.query : undefined
+	return shape === undefined ? {} : { query: { schema: schemaFromShape(shape), shape } }
+}
+
+/** A procedure's admission, as the field its served endpoint carries; none after a problem. */
+function admissionOf(id: string, artifact: ContractArtifact, options: BootOptions, problems: string[]): { readonly admission?: ProcedureAdmission } {
+	const admission = procedureAdmission(id, artifact, admissionOptions(options), problems)
+	return admission === null ? {} : { admission }
+}
+
+function admissionOptions(options: BootOptions): AdmissionOptions {
+	return {
+		application: options.environment.application,
+		...(options.challengeFetch === undefined ? {} : { challengeFetch: options.challengeFetch }),
+		...(options.repeatableChallengeToken === undefined ? {} : { repeatableChallengeToken: options.repeatableChallengeToken }),
+		...(options.challengeWork === undefined ? {} : { challengeWork: options.challengeWork }),
+	}
 }
 
 /**
- * A form's admission from its approved mount: the declared rate or the defaults, and a challenge verified with the
- * secret the application variable it names holds. Without that variable the application does not boot.
+ * The framework's own endpoint that issues the ALTCHA challenge of a served public procedure, with its own buckets;
+ * `null` for a procedure without one.
  */
-function formAdmission(
-	name: string,
+function challengeIssuerEndpoint(
+	procedure: Extract<ServedEndpoint, { kind: 'public' }>,
+	rows: ReadonlyMap<string, EndpointRow>,
 	artifact: ContractArtifact,
 	options: BootOptions,
-	files: FileCollections | null,
 	problems: string[],
-): FormAdmission | null {
-	const mount = artifact.mounts[name]
-	if (mount?.kind !== 'form') {
+): ServedEndpoint | null {
+	const issuer = procedure.admission.challenge?.issuer ?? null
+	if (issuer === null) {
 		return null
 	}
-	const fileFields = new Map(Object.entries(mount.files ?? {}))
-	for (const [field, file] of fileFields) {
-		if (files === null || !files.has(file.collection)) {
-			problems.push(`form '${name}' takes its file '${field}' into files '${file.collection}', which this runtime does not serve`)
-		}
-	}
-	if (fileFields.size > 0 && mount.challenge === undefined) {
-		problems.push(`form '${name}' takes files and declares no challenge; an anonymous upload needs a solved one`)
-	}
-	let challenge: ChallengeVerifier | null = null
-	if (mount.challenge !== undefined) {
-		const secret: unknown = options.environment.application[mount.challenge.secret]
-		if (typeof secret !== 'string' || secret.trim() === '') {
-			problems.push(
-				`form '${name}' verifies its ${mount.challenge.provider} challenge with the application variable ${mount.challenge.secret}, which is not set`,
-			)
-			return null
-		}
-		challenge = turnstileVerifier(secret.trim(), options.challengeFetch ?? ((request) => fetch(request)))
+	const id = challengeRowId(procedure.row.id)
+	const row = rows.get(id)
+	if (row === undefined || row.source.kind !== 'challenge') {
+		problems.push(`public procedure '${procedure.row.id}' has no endpoint that issues its challenge`)
+		return null
 	}
-	return Object.freeze({
-		perClient: mount.rate?.perClient ?? FORM_LIMITS.perClient,
-		// A form with files accepts fewer submissions by default: each may write its collections' maxBytes.
-		perForm: mount.rate?.perForm ?? (fileFields.size === 0 ? FORM_LIMITS.perForm : FORM_FILE_LIMITS.perForm),
-		fields: Object.freeze(submissionFieldsOf(mount)),
-		files: fileFields.size === 0 || files === null ? null : {
-			fields: fileFields,
-			collections: files,
-			bytesPerHour: mount.rate?.bytesPerHour ?? FORM_FILE_LIMITS.bytesPerHour,
-			timeoutMs: options.formFileTimeoutMs ?? FORM_FILE_LIMITS.timeoutMs,
-		},
-		challenge,
-		repeatableToken: challenge === null ? null : (options.repeatableChallengeToken ?? null),
-	})
+	const admission = procedureAdmission(id, artifact, admissionOptions(options), problems)
+	return admission === null ? null : { kind: 'challenge', row, issuer, admission }
 }
 
-/** `frameworkProblems` refused a webhook without the framework tables, so this answers only after a bug. */
-function frameworkOf(framework: FrameworkTables | null): FrameworkTables {
-	if (framework === null) {
-		throw new ServerFault('facility_unbound', 'a webhook was served without the framework tables')
+/**
+ * A public procedure: its staged-kit handler, its key, and its admission. Without the key's credential (no token
+ * exchange, or the variable unset) `workloadCredentials` already reported why.
+ */
+function publicEndpoint(
+	row: EndpointRow,
+	procedure: ProcedureDeclaration<Schema, unknown>,
+	bound: BoundHandler | null,
+	artifact: ContractArtifact,
+	workloads: ReadonlyMap<string, WorkloadCredential>,
+	options: BootOptions,
+	problems: string[],
+): Extract<ServedEndpoint, { kind: 'public' }> | null {
+	const where = `public procedure '${row.id}'`
+	const site = bound === null ? undefined : servedSite(procedure.type, bound)
+	if (bound === null || site === undefined) {
+		problems.push(`${where} has no handler of the staged kit; declare it with .handle(…) beside its declaration`)
+		return null
+	}
+	const actions = artifact.declared?.[row.id]?.actions ?? []
+	const credential = workloads.get(workloadSite('public', row.id))
+	const admission = procedureAdmission(row.id, artifact, admissionOptions(options), problems)
+	if (credential === undefined || admission === null) {
+		return null
+	}
+	return {
+		kind: 'public',
+		row,
+		input: procedure.input,
+		output: procedure.output,
+		handler: bound.handler,
+		actions,
+		credential,
+		admission,
+		site,
+		...queryOf(row.id, artifact),
 	}
-	return framework
 }
 
-/** The generated `webhooks.<name>.bind` and `.unbind` endpoints, served by the framework's own handlers. */
-function bindWebhookBindings(
-	name: string,
-	path: string,
-	rows: ReadonlyMap<string, EndpointRow>,
-	endpoints: Map<string, ServedEndpoint>,
-	tables: () => WebhookTables,
-): void {
-	const handlers = bindingHandlers(name, path, tables)
-	const bind = rows.get(`webhooks.${name}.bind`)
-	const unbind = rows.get(`webhooks.${name}.unbind`)
-	if (isCredentialed(bind)) {
-		endpoints.set(bind.id, {
-			kind: 'procedure',
-			row: bind,
-			input: webhookBindInput,
-			output: webhookBindOutput,
-			handler: handlers.bind,
-			facilities: NO_FACILITIES,
-		})
-	}
-	if (isCredentialed(unbind)) {
-		endpoints.set(unbind.id, {
-			kind: 'procedure',
-			row: unbind,
-			input: webhookUnbindInput,
-			output: webhookUnbindOutput,
-			handler: handlers.unbind,
-			facilities: NO_FACILITIES,
-		})
+/** The webhook a procedure binds (`binds`), as the approved artifact declares it. */
+function bindsOf(
+	id: string,
+	declaration: SiteDeclaration | null,
+	artifact: ContractArtifact,
+	problems: string[],
+): { readonly binds?: BindableWebhook } {
+	const name = declaration?.binds ?? null
+	if (name === null) {
+		return {}
+	}
+	const mount = Object.hasOwn(artifact.mounts, name) ? artifact.mounts[name] : undefined
+	if (mount?.kind !== 'webhook') {
+		problems.push(`procedure '${id}' binds '${name}', which is not a webhook of the contract`)
+		return {}
+	}
+	return { binds: { name, path: mount.path, scheme: mount.scheme, boundTo: mount.boundTo } }
+}
+
+/** Each approved token purpose with the claims schema the application declared for it. */
+function runtimePurposes(contract: AnyContract, artifact: ContractArtifact): ReadonlyMap<string, RuntimePurpose> {
+	const declared = contract.surface.tokens ?? {}
+	const purposes = new Map<string, RuntimePurpose>()
+	for (const [purpose, approved] of Object.entries(artifact.tokens ?? {})) {
+		const own = Object.hasOwn(declared, purpose) ? declared[purpose] : undefined
+		if (own !== undefined) {
+			purposes.set(purpose, { claims: own.claims, maxDays: approved.maxDays })
+		}
 	}
+	return purposes
 }
 
 export function boot(app: ContractImplementation, options: BootOptions): ContractApp {
 	const problems: string[] = []
+	installEgressGuard()
+	// What a handler reaches through these is the platform's own request, which no site's egress covers.
+	const objects = options.files === undefined ? undefined : platformFacility(options.files)
+	const membershipRpc = options.membership === undefined ? undefined : platformFacility(options.membership)
+	const workloadTokens = options.workloadTokens === undefined ? undefined : platformFacility(options.workloadTokens)
 	const variables = readFramework(options.environment.framework, app.contract.vocabulary.app, problems)
 	const artifact = compileContract(app.contract, app.database?.tables ?? {})
 	checkContractDigest(options.environment.framework, artifact, problems)
 	const proxySecret = readProxySecret(options.environment.framework, options.requireProxySecret === true, problems)
+	const tokens = new SignedTokens(runtimePurposes(app.contract, artifact), readTokenKeys(options.environment.framework, artifact, problems))
+	const origin = readAppOrigin(options.environment.framework, problems)
+	const url = appUrl(artifact, origin)
 	const operations = operationsSettings(options.environment.framework, problems)
 	const scrubber = environmentScrubber(options.environment)
 	const reporterFor = (source: ReportSource): OperationsReporter | null =>
@@ -639,33 +671,33 @@ export function boot(app: ContractImplementation, options: BootOptions): Contrac
 			? null
 			: operationsReporter({ ...operations, source, scrubber, ...(options.operationsFetch === undefined ? {} : { fetch: options.operationsFetch }) })
 	const owned = new Set(Object.values(artifact.tables).flatMap((table) => table.scope.mode === 'dimension' ? [table.scope.dimension] : []))
-	// A file collection's dimension is located through its own table and its owner's.
-	for (const name of Object.keys(artifact.files)) {
-		owned.add(`file:${name}`)
-	}
 	const containers = containersOf(artifact)
 	unservable(artifact, options.assets, owned, containers, problems)
 	// This runtime's own: what another `boot` call mints, application code's included, its stores refuse.
 	const issuer = createCapabilityIssuer()
-	const files = fileCollections(artifact, app.database, options.files, issuer.authority, issuer.mint, problems)
+	const fileKinds = storedFileKinds(artifact, app.database, objects, problems)
 	const bound = contractDatabase(app.database, options.database, issuer.authority, problems)
 	const framework = bound?.framework ?? null
 	frameworkProblems(artifact, framework, problems)
-	const database = files === null || bound === null ? (bound?.database ?? null) : files.locating(bound.database)
-	const verifier = new TokenVerifier({ getJwks: () => options.iam.getJwks(), issuer: variables.issuer })
+	const database = bound?.database ?? null
+	const verifier = new TokenVerifier({ getJwks: () => platformCall(() => options.iam.getJwks()), issuer: variables.issuer })
 	const workloads = workloadCredentials({
 		artifact,
 		framework: options.environment.framework,
 		audience: variables.iamAppId,
-		source: options.workloadTokens,
+		source: workloadTokens,
 		verifier,
 	}, problems)
 	const connect = wireImports({
 		artifact,
 		snapshots: app.connect ?? {},
 		framework: options.environment.framework,
-		bindings: options.connectBindings ?? {},
-		fallback: (request) => fetch(request),
+		bindings: Object.fromEntries(
+			Object.entries(options.connectBindings ?? {}).map((
+				[name, binding],
+			): [string, ConnectFetch] => [name, (request) => platformCall(() => binding(request))]),
+		),
+		fallback: (request) => platformCall(() => fetch(request)),
 	}, problems)
 	const configs = browserConfigs(artifact, options.environment, {
 		dsn: operations === null ? null : (options.environment.framework['FABRIKA_OPERATIONS_DSN'] ?? '').trim(),
@@ -724,6 +756,17 @@ export function boot(app: ContractImplementation, options: BootOptions): Contrac
 				declared.add(id)
 				const row = rows.get(id)
 				const bound = boundHandler(path.reduce<unknown>(childAt, handlers), id, `procedure '${id}'`, procedure.type, artifact, problems)
+				if (row?.kind === 'public') {
+					const served = publicEndpoint(row, procedure, bound, artifact, workloads, options, problems)
+					if (served !== null) {
+						endpoints.set(id, served)
+						const issuer = challengeIssuerEndpoint(served, rows, artifact, options, problems)
+						if (issuer !== null) {
+							endpoints.set(issuer.row.id, issuer)
+						}
+					}
+					continue
+				}
 				if (!isCredentialed(row)) {
 					problems.push(`procedure '${id}' has no endpoint row`)
 				} else if (bound === null) {
@@ -738,45 +781,39 @@ export function boot(app: ContractImplementation, options: BootOptions): Contrac
 						facilities: siteFacilities(facilitiesOf(artifact, row), bound.declaration),
 						connect: siteConnect(connect.get(id), bound.declaration),
 						site: servedSite(procedure.type, bound),
-						...(bound.declaration?.then == null ? {} : { then: bound.declaration.then }),
+						...egressOf(bound),
+						...bindsOf(id, bound.declaration, artifact, problems),
+						...admissionOf(id, artifact, options, problems),
+						...queryOf(id, artifact),
 					})
 				}
 			}
-		} else if (mount.kind === 'form') {
-			const row = rows.get(name)
-			const admission = formAdmission(name, artifact, options, files, problems)
-			const approved = artifact.mounts[name]
-			const then = approved?.kind === 'form' ? (approved.then ?? null) : null
-			if (row !== undefined && admission !== null) {
-				endpoints.set(name, { kind: 'form', row, form: name, input: mount.input, admission, then })
-			}
 		} else if (mount.kind === 'webhook') {
 			declared.add(name)
 			const row = rows.get(name)
 			const bound = boundHandler(childAt(handlers, name), name, `webhook '${name}'`, 'mutation', artifact, problems)
-			const credential: WorkloadCredential | undefined = workloads.get(`webhook:${name}`)
+			const credential: WorkloadCredential | undefined = workloads.get(workloadSite('webhook', name))
+			const approved = artifact.mounts[name]
 			if (row === undefined || bound === null) {
 				problems.push(`webhook '${name}' has no handler; add handlers.${name}: ({ input, ctx }) => …`)
-			} else if (credential !== undefined) {
+			} else if (credential !== undefined && approved?.kind === 'webhook') {
 				endpoints.set(name, {
 					kind: 'webhook',
 					row,
 					webhook: name,
-					dimension: mount.boundTo,
+					scheme: approved.scheme,
+					boundTo: approved.boundTo,
+					timeoutMs: approved.timeoutMs,
 					actions: mount.actions,
 					input: mount.input,
 					handler: bound.handler,
 					credential,
 					site: bound.site ? (bound.declaration ?? undefined) : undefined,
 				})
-				bindWebhookBindings(name, mount.path, rows, endpoints, () => frameworkOf(framework).webhooks)
 			}
 		}
 	}
-	for (const [id, served] of files?.endpoints(rows, problems) ?? []) {
-		endpoints.set(id, served)
-	}
-	const membership = options.membership === undefined ? null : new IamMembership(options.membership, variables.iamAppId)
+	const membership = membershipRpc === undefined ? null : new IamMembership(membershipRpc, variables.iamAppId)
 	const jobs = bindJobs({
 		artifact,
 		handlers,
@@ -787,23 +824,30 @@ export function boot(app: ContractImplementation, options: BootOptions): Contrac
 		credentials: workloads,
 		mint: issuer.mint,
 		data: bound?.data ?? null,
-		files,
-		frameworkJobs: files === null ? [] : [
-			...(files.scans
+		fileKinds,
+		frameworkJobs: fileKinds === null ? [] : [
+			...(fileKinds.scans
 				? [{
 					name: FILE_SCAN_JOB,
 					schedule: FILE_SCAN_SCHEDULE,
 					timeoutMs: SCAN_LIMITS.jobTimeoutMs,
-					run: (reporter: OperationsReporter, signal: AbortSignal) => files.scanPass(options.scanner ?? null, reporter, signal),
+					run: (reporter: OperationsReporter, signal: AbortSignal) => fileKinds.scanPass(options.scanner ?? null, reporter, signal),
 				}]
 				: []),
-			{ name: FILE_SWEEP_JOB, schedule: FILE_SWEEP_SCHEDULE, timeoutMs: FILE_SWEEP_TIMEOUT_MS, run: (_reporter, signal) => files.sweep(signal) },
+			{
+				name: FILE_SWEEP_JOB,
+				schedule: FILE_SWEEP_SCHEDULE,
+				timeoutMs: FILE_SWEEP_TIMEOUT_MS,
+				run: (_reporter, signal) => fileKinds.sweep(signal),
+			},
 		],
 		membership,
 		capabilities: issuer.authority,
 		containers,
 		...(options.revealHandlerErrors === undefined ? {} : { revealHandlerErrors: options.revealHandlerErrors }),
 		mail,
+		tokens,
+		url,
 	}, problems)
 	for (const id of jobs.declared) {
 		declared.add(id)
@@ -830,6 +874,8 @@ export function boot(app: ContractImplementation, options: BootOptions): Contrac
 					facilities: NO_FACILITIES,
 					readOnly: true,
 					site: servedSite('query', bound),
+					...egressOf(bound),
+					...admissionOf(id, artifact, options, problems),
 				})
 			}
 		}
@@ -844,7 +890,9 @@ export function boot(app: ContractImplementation, options: BootOptions): Contrac
 	if (data === null && kitOriginOf(app.contract) === 'tableless') {
 		servedWithoutData(endpoints, problems)
 	}
-	const site = [...endpoints.values()].find((served) => (served.kind === 'procedure' || served.kind === 'webhook') && served.site !== undefined)
+	const site = [...endpoints.values()].find((served) =>
+		served.kind === 'public' || ((served.kind === 'procedure' || served.kind === 'webhook') && served.site !== undefined)
+	)
 	if (site !== undefined && data === null) {
 		problems.push(`'${site.row.id}' reaches data through ctx.db, which runs on @fabrika/db: pass serve(contract, { database: scoped(tables) })`)
 	}
@@ -875,10 +923,15 @@ export function boot(app: ContractImplementation, options: BootOptions): Contrac
 		mint: issuer.mint,
 		capabilities: issuer.authority,
 		data,
-		files,
+		fileKinds,
 		failures: new FailureReports(reporterFor('fabrika.requests')),
 		kick: jobs.kick,
 		actions: Object.freeze(Object.keys(artifact.actions).sort()),
+		publicShare: new InFlightShare(publicShareOf(options.connections ?? DEFAULT_CONNECTIONS)),
+		clientVouched: options.clientAddress === 'vouched',
+		tokens,
+		url,
+		origin,
 	})
 	return Object.freeze({
 		fetch: (request: Request, exec?: RequestExecutionContext) => runtime.fetch(request, exec),

package/src/implement/bounded.ts

@@ -70,3 +70,26 @@ export async function readBoundedBytes(stream: ReadableStream<Uint8Array> | null
 		signal?.removeEventListener('abort', cancel)
 	}
 }
+
+/** `body` passed on as it streams, failed once more than `maxBytes` went through; `exceeded` tells that failure apart. */
+export function boundedStream(body: ReadableStream<Uint8Array>, maxBytes: number): {
+	readonly stream: ReadableStream<Uint8Array>
+	exceeded(): boolean
+} {
+	let size = 0
+	let over = false
+	const stream = body.pipeThrough(
+		new TransformStream<Uint8Array, Uint8Array>({
+			transform(chunk, controller) {
+				size += chunk.byteLength
+				if (size > maxBytes) {
+					over = true
+					controller.error(new Error(`the body is longer than ${maxBytes} bytes`))
+					return
+				}
+				controller.enqueue(chunk)
+			},
+		}),
+	)
+	return { stream, exceeded: () => over }
+}

package/src/implement/browser-config.ts

@@ -11,7 +11,7 @@ export interface BrowserConfig {
 	/** `FABRIKA_ENVIRONMENT`, which the page's error reports carry, or `null` when unset. */
 	readonly environment: string | null
 	/**
-	 * Every form challenge's site key, and the variables the mount lists in `public`, by variable name. Absent when
+	 * Every public procedure challenge's site key, and the variables the mount lists in `public`, by variable name. Absent when
 	 * there is none, so the file of an application without them holds the three Operations values only.
 	 */
 	readonly public?: Readonly<Record<string, string>>
@@ -33,11 +33,12 @@ export function browserConfigs(
 		return typeof value === 'string' && value.trim() !== '' ? value : null
 	}
 	const siteKeys: Record<string, string> = {}
-	for (const [form, mount] of Object.entries(artifact.mounts)) {
-		const challenge = mount.kind === 'form' ? mount.challenge : undefined
-		if (challenge?.siteKey === undefined) continue
+	for (const [id, procedure] of Object.entries(artifact.procedures ?? {})) {
+		const challenge = procedure.challenge
+		// Only Turnstile's widget needs a key in the page; ALTCHA's fetches its challenge from the application.
+		if (challenge?.provider !== 'turnstile' || challenge.siteKey === undefined) continue
 		const value = valueOf(challenge.siteKey)
-		if (value === null) problems.push(`form '${form}' names its ${challenge.provider} site key in ${challenge.siteKey}, which is not set`)
+		if (value === null) problems.push(`procedure '${id}' names its ${challenge.provider} site key in ${challenge.siteKey}, which is not set`)
 		else siteKeys[challenge.siteKey] = value
 	}
 	const configs = new Map<string, BrowserConfig>()