@fabrika/app 0.6.0 → 0.8.0

package/src/react/provider.tsx

@@ -6,7 +6,7 @@
 import { createContext, type ReactNode, useContext, useEffect, useState } from 'react'
 import { z } from 'zod/v4'
 import { type PageCaller, parsePageCaller } from '../client/caller'
-import { attachmentAt, type ClientNode, clientNodeOf, downloadFile } from '../client/contract'
+import { attachmentAt, type ClientNode, clientNodeOf, type DownloadedFile, downloadFile } from '../client/contract'
 import { startErrorReporting } from '../client/error-reporting'
 import { RpcError, type RpcFetch } from '../client/transport'
 import { BROWSER_CONFIG_FILE, joinPath, PAGE_CALLER_FILE } from '../contract/defaults'
@@ -62,7 +62,7 @@ export interface Fabrika {
 	/** The call of `procedure` on the provider's client of its mount. */
 	target(procedure: unknown, hook: string): ResolvedProcedure
 	/** The download of attachment `procedure` on the provider's client of its mount. */
-	attachment(procedure: unknown, hook: string): (input: unknown) => Promise<File>
+	attachment(procedure: unknown, hook: string): (input: unknown) => Promise<DownloadedFile>
 }
 
 export interface ResolvedProcedure extends StoreTarget {

package/src/testing/challenge.ts

@@ -1,5 +1,10 @@
-// A stand-in for a form challenge's provider, for a test kit and for `fabrika app dev`.
+// A stand-in for a form challenge's provider, for a test kit and for `fabrika app dev`; and the solver of an ALTCHA
+// challenge, which needs no stand-in: the application issues and verifies it itself.
 
+import { type Challenge, solveChallenge } from 'altcha-lib'
+import { deriveKey } from 'altcha-lib/algorithms/web/pbkdf2'
+import { z } from 'zod/v4'
+import type { RpcFetch } from '../client/transport'
 import type { ChallengeFetch } from '../implement/challenge'
 
 /** The token Turnstile's always-passing test widget (site key `1x00000000000000000000AA`) hands out every time. */
@@ -8,3 +13,32 @@ export const TURNSTILE_TEST_TOKEN = 'XXXX.DUMMY.TOKEN.XXXX'
 /** Turnstile's siteverify that passes every token: a fresh answer for the host and the form the check expects. */
 export const passingChallenge: ChallengeFetch = (_request, check) =>
 	Promise.resolve(Response.json({ success: true, challenge_ts: new Date().toISOString(), hostname: check.hostname, action: check.action }))
+
+// Read as loosely as the widget reads it: the verification is what holds a challenge to its shape.
+const issuedChallenge = z.object({
+	parameters: z.object({ algorithm: z.string(), nonce: z.string(), salt: z.string(), cost: z.number(), keyLength: z.number(), keyPrefix: z.string() })
+		.catchall(z.unknown()),
+	signature: z.string().optional(),
+})
+
+/**
+ * Fetches a challenge from `url` through `fetch` and solves it as the widget does, answering the payload the page puts
+ * into `challengeToken`. The kit issues the cheapest challenge, so this takes milliseconds.
+ */
+export async function solveChallengeAt(fetch: RpcFetch, url: string): Promise<string> {
+	const response = await fetch(url, { headers: { Accept: 'application/json' } })
+	if (response.status !== 200) {
+		throw new Error(`the challenge at ${url} answered ${response.status}: ${await response.text()}`)
+	}
+	const parsed = issuedChallenge.safeParse(await response.json())
+	if (!parsed.success) {
+		throw new Error(`the challenge at ${url} is no ALTCHA challenge`)
+	}
+	const { parameters, signature } = parsed.data
+	const challenge: Challenge = { parameters: { ...parameters }, ...(signature === undefined ? {} : { signature }) }
+	const solution = await solveChallenge({ challenge, deriveKey, timeout: 10_000 })
+	if (solution === null) {
+		throw new Error(`the challenge at ${url} was not solved in time`)
+	}
+	return btoa(JSON.stringify({ challenge, solution }))
+}

package/src/testing/dev.ts

@@ -106,9 +106,9 @@ export interface DevKit<C extends AnyContract> {
 const isPerson = (caller: TestCaller): caller is PersonTestCaller => caller.kind === 'human' && caller.email !== null
 
 /**
- * The test kit of `app` with its stand-in IAM, and what `fabrika app dev` shows of it. A form's challenge passes
+ * The test kit of `app` with its stand-in IAM, and what `fabrika app dev` shows of it. A challenge passes
  * (`passingChallenge`) unless `options.challengeFetch` answers it, and admits the test widget's token
- * (`TURNSTILE_TEST_TOKEN`) at every submission; any other token is single use, as deployed.
+ * (`TURNSTILE_TEST_TOKEN`) at every call; any other token is single use, as deployed.
  */
 export function devKit<C extends AnyContract>(app: ContractImplementation<C>, options: Omit<TestKitOptions, 'membership'> = {}): DevKit<C> {
 	const { kit, standIn, callerOf } = bootTestKit(app, { challengeFetch: passingChallenge, ...options }, {

package/src/testing/endpoint-access.ts

@@ -12,24 +12,32 @@ import {
 	endpointDirectory,
 	endpointMembers,
 	type EndpointMethod,
-	type FileCollectionArtifact,
+	type ProcedureChallenge,
 	type SchemaShape,
 	type Scope,
 } from '@fabrika/auth-core'
 import type { Tables } from '@fabrika/db'
 import { tablePolicies } from '@fabrika/db/tables'
-import type { IsolationWorlds, SampleValue, TestDatabase, WorldRow } from '@fabrika/db/testing'
+import { type IsolationWorlds, type SampleValue, SEEDED_OBJECT_VERSION, type TestDatabase, type WorldRow } from '@fabrika/db/testing'
 import { MemoryFileObjects } from '@fabrika/platform/testing'
 import { z } from 'zod/v4'
 import type { RpcFetch } from '../client/transport'
 import { compileContract } from '../contract/compile'
-import { GENERATED_INVITATION, GENERATED_LINK, GENERATED_MEMBER, GENERATED_ROW_PREFIX } from '../contract/defaults'
+import {
+	FILE_INPUT_PART,
+	GENERATED_FILE_PREFIX,
+	GENERATED_INVITATION,
+	GENERATED_LINK,
+	GENERATED_MEMBER,
+	GENERATED_ROW_PREFIX,
+} from '../contract/defaults'
 import type { AnyContract } from '../contract/define'
-import { FILE_SCAN_JOB, type FileScanner, type ScanVerdict } from '../files/scan'
+import type { FileScanner, ScanVerdict } from '../files/scan'
 import type { ApplicationEnvironment, ContractImplementation } from '../implement/implement'
 import type { TestCaller, TestGrant } from './caller'
 import { standInIamKit } from './kit'
 import { scopeTypeOf } from './policy-isolation'
+import { sampleFile } from './sample-file'
 
 export interface DeniedOutcome {
 	readonly status: number
@@ -68,12 +76,6 @@ export interface EndpointAccessKit {
 	 * issuer the actions the link grants.
 	 */
 	own(endpoint: string, input: Readonly<Record<string, unknown>>, seed?: Seed): Promise<DeniedOutcome>
-	/**
-	 * One file endpoint of `collection`, over a file seeded in each scope through the upload endpoint. `own` holds the
-	 * operation's action in one scope and addresses its own owner row or file, `other` holds it there and addresses
-	 * the other scope's, `reader` holds only the collection's read action and addresses its own.
-	 */
-	file(collection: string, operation: FileOperation, caller: 'own' | 'other' | 'reader'): Promise<DeniedOutcome>
 	/**
 	 * An `app` or a `creates` endpoint asked by a caller who holds its action in one value of a dimension only, never
 	 * globally: refused (403), by the proxy for `app` and by IAM for `creates`, since both need a global grant.
@@ -84,10 +86,21 @@ export interface EndpointAccessKit {
 	 * `answered` unless the answer is a 401, a 403 or a 5xx.
 	 */
 	global(endpoint: string, input: Readonly<Record<string, unknown>>): Promise<ReachOutcome>
+	/**
+	 * One capability of an endpoint of several, refused while every other one passes: the caller holds each other one's
+	 * action in a scope of its own and addresses its object or value there (or, for `over`, holds the action globally).
+	 * For an `on` or `in` capability it also holds the named one's action in its own scope and addresses the other's
+	 * object (404) or value (403); for `over` it holds the named action nowhere (403). `seed` is the named one's.
+	 */
+	capability(endpoint: string, capability: string, input: Readonly<Record<string, unknown>>, seed?: Seed): Promise<DeniedOutcome>
+	/**
+	 * A public procedure asked by anyone, with no credential, from a page of its own origin: `answered` unless the answer
+	 * is a 401, a 403, a 5xx or a failed challenge. A procedure with a challenge is a 400 `challenge_failed`: the kit's
+	 * challenge never passes.
+	 */
+	anyone(endpoint: string, input: Readonly<Record<string, unknown>>): Promise<ReachOutcome>
 }
 
-export type FileOperation = 'upload' | 'download' | 'remove'
-
 interface ActionEndpoint {
 	readonly id: string
 	/** The link mount of a link procedure; `null` for every other endpoint. */
@@ -151,35 +164,19 @@ export type Grant =
 
 const randomHex = (): string => crypto.randomUUID().replaceAll('-', '').slice(0, 8)
 
-const ascii = (text: string): number[] => [...text].map((char) => char.charCodeAt(0))
-const ZIP_HEAD = [0x50, 0x4b, 0x03, 0x04]
-
-/** The leading bytes `files/sniff.ts` accepts for each binary type it verifies; a text type needs none. */
-const SAMPLE_HEADS: Readonly<Record<string, readonly number[]>> = {
-	'image/png': [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a],
-	'image/jpeg': [0xff, 0xd8, 0xff, 0xe0],
-	'image/gif': ascii('GIF89a'),
-	'image/webp': [...ascii('RIFF'), 0, 0, 0, 0, ...ascii('WEBP')],
-	'application/pdf': ascii('%PDF-1.7\n'),
-	'application/gzip': [0x1f, 0x8b, 0x08],
-	'application/zip': ZIP_HEAD,
-	'application/vnd.openxmlformats-officedocument.wordprocessingml.document': ZIP_HEAD,
-	'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': ZIP_HEAD,
-	'application/vnd.openxmlformats-officedocument.presentationml.presentation': ZIP_HEAD,
-}
-const TEXT_TYPES: ReadonlySet<string> = new Set(['text/plain', 'text/csv', 'text/markdown', 'application/json', 'image/svg+xml'])
+const errorSchema = z.object({ error: z.object({ type: z.string() }) })
 
-/** A small file of the collection's first type the kit can write: the type's leading bytes, then a text marker. */
-function sampleFile(name: string, types: readonly string[]): { readonly type: string; readonly bytes: Uint8Array<ArrayBuffer> } {
-	for (const type of types) {
-		const head = SAMPLE_HEADS[type] ?? (TEXT_TYPES.has(type) ? [] : undefined)
-		if (head !== undefined) return { type, bytes: new Uint8Array([...head, ...ascii(`fabrika endpoint access file ${randomHex()}`)]) }
-	}
-	throw new Error(`files.${name}: none of its types is one the endpoint access kit can write a file of`)
+/** The file fields of a procedure's input: a file, an optional one, or an array of them, each sent as a part of its own. */
+function fileFields(input: SchemaShape | null): ReadonlySet<string> {
+	const isFile = (shape: SchemaShape): boolean =>
+		shape.type === 'file' || ((shape.type === 'optional' || shape.type === 'array') && isFile(shape.type === 'array' ? shape.items : shape.inner))
+	return new Set(input?.type === 'object' ? Object.entries(input.fields).filter(([, shape]) => isFile(shape)).map(([name]) => name) : [])
 }
 
-const uploadedSchema = z.strictObject({ result: z.strictObject({ id: z.string() }) })
-const errorSchema = z.object({ error: z.object({ type: z.string() }) })
+/** The file kind a generated file field's marker names, or `undefined` for any other value. */
+function fileKindOf(value: unknown): string | undefined {
+	return typeof value === 'string' && value.startsWith(GENERATED_FILE_PREFIX) ? value.slice(GENERATED_FILE_PREFIX.length) : undefined
+}
 
 /** The `type` of an error envelope, or `undefined` for any other body. */
 function errorType(text: string): string | undefined {
@@ -227,19 +224,20 @@ const cleanScanner: FileScanner = {
 }
 
 /**
- * The variables `boot` requires of `app` that a generated case never uses: each form challenge's secret and site key,
- * since no case submits a form, and each SPA mount's `public` variables, since no case reads a page's config. The
- * kit's challenge stand-in refuses every token, so no verification leaves the process.
+ * The variables `boot` requires of `app` that a generated case never uses: each challenge's secret and site key, since
+ * no case solves a challenge, and each SPA mount's `public` variables, since no case reads a page's config. The kit's
+ * challenge stand-in refuses every token, so no verification leaves the process.
  */
 function unusedVariables(app: ContractImplementation<AnyContract>): ApplicationEnvironment {
 	const artifact = compileContract(app.contract, app.database?.tables ?? {})
-	const names = Object.values(artifact.mounts).flatMap((mount): readonly string[] => {
-		if (mount.kind === 'form' && mount.challenge !== undefined) {
-			return mount.challenge.siteKey === undefined ? [mount.challenge.secret] : [mount.challenge.secret, mount.challenge.siteKey]
-		}
-		return mount.kind === 'spa' ? (mount.public ?? []) : []
-	})
-	return Object.fromEntries(names.map((name) => [name, 'unused']))
+	const challengeVariables = (challenge: ProcedureChallenge): readonly string[] =>
+		challenge.provider === 'altcha' || challenge.siteKey === undefined ? [challenge.secret] : [challenge.secret, challenge.siteKey]
+	const names = Object.values(artifact.mounts).flatMap((mount): readonly string[] => mount.kind === 'spa' ? (mount.public ?? []) : [])
+	const procedures = Object.values(artifact.procedures ?? {}).flatMap((procedure) =>
+		procedure.challenge === null ? [] : challengeVariables(procedure.challenge)
+	)
+	// Long enough for an ALTCHA key, which boot refuses under 32 characters.
+	return Object.fromEntries([...names, ...procedures].map((name) => [name, 'unused-by-every-generated-case-of-the-kit']))
 }
 
 /**
@@ -280,9 +278,10 @@ export const managerGrants = (
  */
 export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract>, tables: Tables<DB, P>, postgres: TestDatabase): EndpointAccessKit {
 	// The objects of the files the cases seed live in memory; their rows are the application's own tables.
+	const objects = new MemoryFileObjects()
 	const { kit, standIn } = standInIamKit(app, {
 		database: postgres.database,
-		files: new MemoryFileObjects(),
+		files: objects,
 		scanner: cleanScanner,
 		env: unusedVariables(app),
 		challengeFetch: () => Promise.resolve(Response.json({ success: false, 'error-codes': ['invalid-input-response'] })),
@@ -328,6 +327,30 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 		)
 	}
 
+	/** An endpoint of several capabilities, as one `ActionEndpoint` per capability, by its name. */
+	const capabilitiesEndpointOf = (id: string): ReadonlyMap<string, ActionEndpoint> => {
+		const row = kit.artifact.endpoints.find((candidate) => candidate.id === id)
+		const requirement = row?.requirement
+		if (row === undefined || requirement?.kind !== 'capabilities') {
+			throw new Error(`${id} is not an endpoint of the contract with several capabilities`)
+		}
+		return new Map(
+			Object.entries(requirement.capabilities).map(([name, capability]) => [name, {
+				id: row.id,
+				link: null,
+				method: row.method,
+				path: row.path,
+				callers: row.callers,
+				action: capability.action,
+				access: capability.access,
+				input: row.input,
+				directory: null,
+				manages: null,
+				links: [],
+			}]),
+		)
+	}
+
 	const globalEndpointOf = (id: string): ActionEndpoint => {
 		const row = endpointOf(id)
 		if (row.access.form !== 'app' && row.access.form !== 'creates') {
@@ -384,11 +407,58 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 		return { ...(await askAs(row, asker.fetch, asked.input)), marks: asked.marks }
 	}
 
-	const askAs = async (row: ActionEndpoint, fetch: RpcFetch, body: unknown): Promise<{ readonly status: number; readonly text: string }> => {
-		if (row.method !== 'POST') {
-			throw new Error(`${row.id} is not a procedure`)
+	// A seeded file column references an empty object, which a handler that serves or opens the file reads here.
+	let stocked = 0
+	const stockSeededObjects = (): void => {
+		const seeded = postgres.seededObjects()
+		for (const key of seeded.slice(stocked)) {
+			objects.objects.set(key, { bytes: new Uint8Array(0), contentType: 'application/octet-stream', version: SEEDED_OBJECT_VERSION })
 		}
-		const response = await fetch(row.path, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) })
+		stocked = seeded.length
+	}
+
+	/** The request of a case: a GET's input in its URL, a file field's marker as a file of its kind in a multipart body. */
+	const requestOf = (row: ActionEndpoint, body: Readonly<Record<string, unknown>>): readonly [string, RequestInit] => {
+		if (row.method === 'GET') {
+			const params = new URLSearchParams(Object.entries(body).map(([name, value]) => [name, value === null ? 'null' : String(value)]))
+			return [params.size === 0 ? row.path : `${row.path}?${params}`, { method: 'GET' }]
+		}
+		const fields = fileFields(row.input)
+		if (fields.size === 0) {
+			return [row.path, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) }]
+		}
+		const json: Record<string, unknown> = {}
+		const files: [string, File][] = []
+		for (const [name, value] of Object.entries(body)) {
+			if (!fields.has(name)) {
+				json[name] = value
+				continue
+			}
+			for (const item of Array.isArray(value) ? value : [value]) {
+				const kind = fileKindOf(item)
+				if (kind === undefined) throw new Error(`${row.id}: the file field ${name} holds ${JSON.stringify(item)}, not a generated file`)
+				files.push([name, generatedFile(kind)])
+			}
+		}
+		const form = new FormData()
+		form.append(FILE_INPUT_PART, JSON.stringify(json))
+		for (const [name, file] of files) form.append(name, file)
+		return [row.path, { method: 'POST', body: form }]
+	}
+
+	const generatedFile = (kind: string): File => {
+		const sample = sampleFile(kind, kit.artifact.fileKinds?.[kind]?.types ?? [])
+		return new File([sample.bytes], `generated-${kind}`, { type: sample.type })
+	}
+
+	const askAs = async (
+		row: ActionEndpoint,
+		fetch: RpcFetch,
+		body: Readonly<Record<string, unknown>>,
+	): Promise<{ readonly status: number; readonly text: string }> => {
+		stockSeededObjects()
+		const [url, init] = requestOf(row, body)
+		const response = await fetch(url, init)
 		const text = await response.text()
 		// A 400 hides what the case is about: input is parsed before the access form runs, and a handler's refusal of
 		// the input it was given is no answer to another scope. Either is what the generator could not build.
@@ -405,39 +475,6 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 		return { status: response.status, text }
 	}
 
-	const collectionOf = (name: string): FileCollectionArtifact => {
-		const collection = kit.artifact.files[name]
-		if (collection === undefined) throw new Error(`${name} is not a file collection of the contract`)
-		return collection
-	}
-
-	const fileRow = (name: string, operation: FileOperation): { readonly method: EndpointMethod; readonly path: string } => {
-		const row = kit.artifact.endpoints.find((candidate) => candidate.id === `files.${name}.${operation}`)
-		if (row === undefined) throw new Error(`files.${name}.${operation} is not an endpoint of the contract`)
-		return { method: row.method, path: row.path }
-	}
-
-	/** One owner row in each scope, and one file of each, written through the upload endpoint as a person of that scope. */
-	const seedFiles = async (name: string) => {
-		const collection = collectionOf(name)
-		const worlds = await postgres.seedWorlds(tables, collection.owner)
-		const upload = fileRow(name, 'upload')
-		const put = async (world: 'own' | 'other'): Promise<string> => {
-			const caller = kit.testCaller([{ action: collection.write, scope: { type: worlds.dimension, value: worlds[world].scope } }])
-			const file = sampleFile(name, collection.types)
-			const response = await kit.browser(caller)(upload.path.replace(':owner', encodeURIComponent(worlds[world].key)), {
-				method: 'POST',
-				headers: { 'Content-Type': file.type },
-				body: file.bytes,
-			})
-			if (response.status !== 200) throw new Error(`files.${name}.upload: seeding a file of the ${world} scope answered ${response.status}`)
-			return uploadedSchema.parse(await response.json()).result.id
-		}
-		const seeded = { collection, worlds, own: await put('own'), other: await put('other') }
-		if (collection.scan === true) await kit.runJob(FILE_SCAN_JOB)
-		return seeded
-	}
-
 	/**
 	 * Two scopes of `dimension`: rows of the table that owns it when one does, with `seed`, otherwise two fresh scope
 	 * values. Each row `input` names in the object (`rows`) is seeded in each scope's row.
@@ -450,25 +487,10 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 		input: Readonly<Record<string, unknown>>,
 	): Promise<Scopes> => {
 		const named = rowFields(input)
-		const collection = Object.keys(kit.artifact.files).find((name) => dimension === `file:${name}`)
 		const owner = ownerOf(dimension)
-		if (named.length > 0 && (collection !== undefined || owner === undefined)) {
+		if (named.length > 0 && owner === undefined) {
 			throw new Error(`no table owns ${dimension}, so the kit seeds no ${named.map((row) => row.table).join(', ')} row in one`)
 		}
-		if (collection !== undefined) {
-			const seeded = await seedFiles(collection)
-			const grant = (world: 'own' | 'other'): Grant[] => [{ action, scope: { type: seeded.worlds.dimension, value: seeded.worlds[world].scope } }]
-			return {
-				own: { target: seeded.own, grants: grant('own'), chain: seeded.worlds.own.chain, rows: {} },
-				other: {
-					target: seeded.other,
-					grants: grant('other'),
-					values: [...worldValues(seeded.worlds, 'other'), seeded.other],
-					chain: seeded.worlds.other.chain,
-					rows: {},
-				},
-			}
-		}
 		if (owner === undefined) {
 			const own = freshValue(dimension, 'own', field)
 			const other = freshValue(dimension, 'other', field)
@@ -773,43 +795,60 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 			)
 			return { status }
 		},
-		async file(name, operation, caller) {
-			if (operation === 'upload') {
-				// An upload needs owners only: a seeded file would hold the owner's place, and a collection of
-				// `maxPerOwner: 1` could never take the probe's.
-				const collection = collectionOf(name)
-				const worlds = await postgres.seedWorlds(tables, collection.owner)
-				const grants = [{ action: caller === 'reader' ? collection.read : collection.write, scope: { type: worlds.dimension, value: worlds.own.scope } }]
-				const file = sampleFile(name, collection.types)
-				const path = fileRow(name, 'upload').path.replace(':owner', encodeURIComponent(worlds[caller === 'other' ? 'other' : 'own'].key))
-				const fetch = kit.browser(kit.testCaller(grants))
-				return { status: (await fetch(path, { method: 'POST', headers: { 'Content-Type': file.type }, body: file.bytes })).status }
-			}
-			const { collection, worlds, own, other } = await seedFiles(name)
-			const operationAction = operation === 'download' ? collection.read : collection.delete
-			const grants = [{ action: caller === 'reader' ? collection.read : operationAction, scope: { type: worlds.dimension, value: worlds.own.scope } }]
-			const world = caller === 'other' ? 'other' : 'own'
-			const fetch = kit.browser(kit.testCaller(grants))
-			const row = fileRow(name, operation)
-			const fileId = world === 'own' ? own : other
-			if (operation === 'download') {
-				return { status: (await fetch(row.path.replace(':fileId', encodeURIComponent(fileId)))).status }
-			}
-			const body = JSON.stringify({ id: fileId })
-			return { status: (await fetch(row.path, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body })).status }
-		},
 		async scoped(endpoint, input) {
 			const row = globalEndpointOf(endpoint)
 			const dimension = row.access.form === 'creates' ? row.access.dimension : scopeTypeOf(kit.artifact.dimensions)
 			const { status } = await ask(row, [{ action: row.action, scope: { type: dimension, value: freshValue(dimension, 'own', undefined) } }], input, [])
 			return { status }
 		},
+		async anyone(endpoint, input) {
+			const row = kit.artifact.endpoints.find((candidate) => candidate.id === endpoint)
+			if (row?.kind !== 'public') {
+				throw new Error(`${endpoint} is not a public procedure of the contract`)
+			}
+			const response = await kit.fetch(row.path, {
+				method: row.method,
+				headers: { 'Content-Type': 'application/json', Origin: kit.origin, 'Sec-Fetch-Site': 'same-origin' },
+				body: JSON.stringify(input),
+			})
+			const status = response.status
+			const challenged = status === 400 && errorType(await response.text()) === 'challenge_failed'
+			return status >= 500 || status === 401 || status === 403 || challenged ? { answered: false, status } : { answered: true }
+		},
 		async global(endpoint, input) {
 			const row = globalEndpointOf(endpoint)
 			const { status } = await askAs(row, callerFor(row, [], [{ action: row.action }]).fetch, input)
 			// Neither form refuses with 404, so a 404 is the handler's own answer (a row the sampled input names is missing).
 			return status >= 500 || status === 401 || status === 403 ? { answered: false, status } : { answered: true }
 		},
+		async capability(endpoint, capability, input, seed = {}) {
+			const capabilities = capabilitiesEndpointOf(endpoint)
+			const named = capabilities.get(capability)
+			if (named === undefined) {
+				throw new Error(`${endpoint} has no capability '${capability}' (capabilities: ${[...capabilities.keys()].join(', ')})`)
+			}
+			const grants: Grant[] = []
+			const global: { readonly action: string }[] = []
+			let asked = input
+			for (const [name, other] of capabilities) {
+				if (name === capability) continue
+				if (other.access.form === 'over') {
+					global.push({ action: other.action })
+				} else if (other.access.form === 'on' || other.access.form === 'in') {
+					const { own } = await scopesOf(other.action, other.access.dimension, fieldOf(other.input, other.access.from), {}, input)
+					asked = addressing(asked, other.access.from, own)
+					grants.push(...own.grants)
+				}
+			}
+			const { access } = named
+			if (access.form === 'on' || access.form === 'in') {
+				const scopes = await scopesOf(named.action, access.dimension, fieldOf(named.input, access.from), seed, input)
+				asked = addressing(asked, access.from, scopes.other)
+				grants.push(...scopes.own.grants)
+			}
+			const { status } = await askAs(named, callerFor(named, grants, global).fetch, asked)
+			return { status }
+		},
 	}
 	// Each case waits for the runs its requests kicked, so the suite's teardown never closes the database under one.
 	const drained = <A extends readonly unknown[], R>(method: (...args: A) => Promise<R>) => async (...args: A): Promise<R> => {
@@ -823,8 +862,9 @@ export function endpointAccessKit<DB, P>(app: ContractImplementation<AnyContract
 		denied: drained(accessKit.denied),
 		leaked: drained(accessKit.leaked),
 		own: drained(accessKit.own),
-		file: drained(accessKit.file),
 		scoped: drained(accessKit.scoped),
 		global: drained(accessKit.global),
+		anyone: drained(accessKit.anyone),
+		capability: drained(accessKit.capability),
 	})
 }