@fabrika/app 0.8.2 → 0.9.0-cloudflare.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/app",
-	"version": "0.8.2",
+	"version": "0.9.0-cloudflare.1",
 	"type": "module",
 	"license": "MIT",
 	"repository": {
@@ -14,77 +14,93 @@
 	"files": [
 		"src",
 		"skill",
-		"!src/**/__tests__/**"
+		"!src/**/__tests__/**",
+		"types"
 	],
 	"exports": {
 		".": {
 			"bun": "./src/index.ts",
-			"types": "./src/index.ts",
+			"types": "./types/src/index.d.ts",
 			"default": "./src/index.ts"
 		},
 		"./bun": {
 			"bun": "./src/bun.ts",
-			"types": "./src/bun.ts",
+			"types": "./types/src/bun.d.ts",
 			"default": "./src/bun.ts"
 		},
 		"./cloudflare": {
 			"bun": "./src/cloudflare.ts",
-			"types": "./src/cloudflare.ts",
+			"types": "./types/src/cloudflare.d.ts",
 			"default": "./src/cloudflare.ts"
 		},
 		"./contract": {
 			"bun": "./src/contract/index.ts",
-			"types": "./src/contract/index.ts",
+			"types": "./types/src/contract/index.d.ts",
 			"default": "./src/contract/index.ts"
 		},
 		"./client": {
 			"bun": "./src/client/index.ts",
-			"types": "./src/client/index.ts",
+			"types": "./types/src/client/index.d.ts",
 			"default": "./src/client/index.ts"
 		},
 		"./react": {
 			"bun": "./src/react/index.ts",
-			"types": "./src/react/index.ts",
+			"types": "./types/src/react/index.d.ts",
 			"default": "./src/react/index.ts"
 		},
 		"./react/testing": {
 			"bun": "./src/react/testing.ts",
-			"types": "./src/react/testing.ts",
+			"types": "./types/src/react/testing.d.ts",
 			"default": "./src/react/testing.ts"
 		},
 		"./implement": {
 			"bun": "./src/implement/index.ts",
-			"types": "./src/implement/index.ts",
+			"types": "./types/src/implement/index.d.ts",
 			"default": "./src/implement/index.ts"
 		},
 		"./service": {
 			"bun": "./src/service/index.ts",
-			"types": "./src/service/index.ts",
+			"types": "./types/src/service/index.d.ts",
 			"default": "./src/service/index.ts"
 		},
 		"./build": {
 			"bun": "./src/build.ts",
-			"types": "./src/build.ts",
+			"types": "./types/src/build.d.ts",
 			"default": "./src/build.ts"
 		},
 		"./testing": {
 			"bun": "./src/testing/index.ts",
-			"types": "./src/testing/index.ts",
+			"types": "./types/src/testing/index.d.ts",
 			"default": "./src/testing/index.ts"
 		},
 		"./testing/isolation": {
 			"bun": "./src/testing/isolation.ts",
-			"types": "./src/testing/isolation.ts",
+			"types": "./types/src/testing/isolation.d.ts",
 			"default": "./src/testing/isolation.ts"
 		},
 		"./testing/preload": {
 			"bun": "./src/testing/preload.ts",
-			"types": "./src/testing/preload.ts",
+			"types": "./types/src/testing/preload.d.ts",
 			"default": "./src/testing/preload.ts"
 		},
+		"./dev": {
+			"bun": "./src/dev/index.ts",
+			"types": "./types/src/dev/index.d.ts",
+			"default": "./src/dev/index.ts"
+		},
+		"./dev/wire": {
+			"bun": "./src/dev/wire.ts",
+			"types": "./types/src/dev/wire.d.ts",
+			"default": "./src/dev/wire.ts"
+		},
+		"./dev/changes": {
+			"bun": "./src/dev/changes.ts",
+			"types": "./types/src/dev/changes.d.ts",
+			"default": "./src/dev/changes.ts"
+		},
 		"./agent-skill": {
 			"bun": "./src/agent-skill.ts",
-			"types": "./src/agent-skill.ts",
+			"types": "./types/src/agent-skill.d.ts",
 			"default": "./src/agent-skill.ts"
 		}
 	},
@@ -93,14 +109,14 @@
 		"test": "bun test --path-ignore-patterns='src/react/**' && bun test --isolate src/react"
 	},
 	"dependencies": {
-		"@fabrika/auth": "0.8.2",
-		"@fabrika/auth-core": "0.8.2",
-		"@fabrika/db": "0.8.2",
-		"@fabrika/email": "0.8.2",
-		"@fabrika/jwks": "0.8.2",
-		"@fabrika/platform": "0.8.2",
-		"@fabrika/platform-node": "0.8.2",
-		"@fabrika/proxy-core": "0.8.2",
+		"@fabrika/auth": "0.9.0-cloudflare.1",
+		"@fabrika/auth-core": "0.9.0-cloudflare.1",
+		"@fabrika/db": "0.9.0-cloudflare.1",
+		"@fabrika/email": "0.9.0-cloudflare.1",
+		"@fabrika/jwks": "0.9.0-cloudflare.1",
+		"@fabrika/platform": "0.9.0-cloudflare.1",
+		"@fabrika/platform-node": "0.9.0-cloudflare.1",
+		"@fabrika/proxy-core": "0.9.0-cloudflare.1",
 		"altcha-lib": "2.6.0",
 		"jose": "^5.9.0"
 	},

package/skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: fabrika-app
-version: 0.8.2
+version: 0.9.0-cloudflare.1
 description: >
   How to write and change a Fabrika application: src/vocabulary.ts, db/migrations/, src/db/tables.ts, the
   slices' endpoints.ts with their handlers, fabrika.contract.ts, jobs, files, webhooks, share links, connectors
@@ -258,7 +258,7 @@ Which promise the types, the checker, boot, the runtime or the approver keeps, a
 - No `as` (except `as const`), `any`, `@ts-ignore`, `@ts-expect-error`, `process.env` or `Bun.env`.
 - Never log an error object, a request, headers or the environment.
 - Never edit a generated file (`src/db/schema.generated.ts`, the generated tests, `fabrika/entry.generated.ts`,
-  `fabrika/connect/`) or a committed migration. Regenerate the file; write a new migration.
+  `fabrika/migrations.generated.ts`, `fabrika/connect/`) or a committed migration. Regenerate the file; write a new migration.
 
 ## Ask the human first
 
@@ -295,6 +295,29 @@ bunx tsc --noEmit                                           # once, at the end
 bunx fabrika-check .                                        # once, after tsc; refusals fail; hints print below them
 ```
 
+**On Cloudflare** (`fabrika.config.ts` imports `defineApp` from `@fabrika/provider-cloudflare`) the application runs in
+one Durable Object over SQLite. Its `db/migrations/*.sql` are SQLite (`references/table-and-migration.md`), and the
+object applies them when it boots, so there is no `migrate` and no command needs a database URL or `FABRIKA_APP_ID`.
+The tests run on `@fabrika/db/testing-sqlite` (`references/tests.md`), in memory, and never skip. A handler holds the
+object's transaction, so its `limits.timeoutMs` is at most 25 s. No `sql` (`ctx.sql`) and no `scan: true`: the
+checker, the deploy and the boot refuse both.
+
+The object runs one transaction at a time, so every `await` in a handler that may write holds the whole environment:
+IAM, R2, a `fetch`, a `ctx.connect` call, a binding. One 2 s call caps the environment at half a request a second. A
+query holds no transaction: each of its statements runs on its own, so two of its reads may see different committed
+states. Inside a
+mutation keep I/O to the framework's own: IAM, and the file it writes. A slow outside call goes into a row, the
+mutation calls `ctx.kick('<job>')`, and the job makes the call outside `ctx.transaction` (`references/jobs.md`). The
+checker hints on a mutation that declares `egress` or `connect` (`cloudflare-held-call`), and refuses
+`DEFAULT CURRENT_TIMESTAMP` in a migration (`cloudflare-current-timestamp`).
+
+```bash
+bunx fabrika db new <slug>                                  # a new SQLite migration file
+bunx fabrika db codegen                                     # applies the migrations in memory; writes src/db/schema.generated.ts
+bunx fabrika db test-scaffold                               # the generated tests, on @fabrika/db/testing-sqlite
+bun test --isolate                                          # no database URL; then tsc and fabrika-check as above
+```
+
 A generated file changes only through its command (`codegen`, `test-scaffold`); running it is the loop, not an edit.
 Format and lint only the files you wrote, with the repository's own tools: in the fabrika-platform repository
 `bunx dprint fmt <files>` and `bunx biome lint <files>`, never `biome check` (its formatter fights dprint), and never a
@@ -326,7 +349,8 @@ e-mails them, a link holder's files, HR's review with its history.
 
 ## Not built yet
 
-- The data layer runs on Bun and Postgres only (Zerops). On Cloudflare an application has no tables, jobs or files.
+- On Cloudflare, where the application runs in one Durable Object over its SQLite and its `db/migrations/*.sql` are
+  SQLite, `sql` (`ctx.sql`) and a file kind with `scan: true` are refused. Everything else on the road runs there.
 - Jobs are cron only and app-wide: no `ctx.jobs.enqueue`, no job per scope. A `ctx.kick` starts a run of its job; it
   carries nothing, and the job finds its work in a queue table with `claim`. A list write is off the road (`sql`).
 - A read across tables (a join, a filter over a related table, an aggregate over several) is off the road (`sql`).

package/skill/references/app-setup.md

@@ -19,20 +19,20 @@ the SPA is added with it.
 		"test": "bun test --isolate"
 	},
 	"dependencies": {
-		"@fabrika/app": "0.8.2",
-		"@fabrika/db": "0.8.2",
-		"@fabrika/provider-zerops": "0.8.2",
-		"@fabrika/proxy-core": "0.8.2",
-		"@fabrika/ui": "0.8.2",
+		"@fabrika/app": "0.9.0-cloudflare.1",
+		"@fabrika/db": "0.9.0-cloudflare.1",
+		"@fabrika/provider-zerops": "0.9.0-cloudflare.1",
+		"@fabrika/proxy-core": "0.9.0-cloudflare.1",
+		"@fabrika/ui": "0.9.0-cloudflare.1",
 		"kysely": "0.29.6",
 		"react": "^19.0.0",
 		"react-dom": "^19.0.0",
 		"zod": "^3.25.76"
 	},
 	"devDependencies": {
-		"@fabrika/check": "0.8.2",
-		"@fabrika/cli": "0.8.2",
-		"@fabrika/platform": "0.8.2",
+		"@fabrika/check": "0.9.0-cloudflare.1",
+		"@fabrika/cli": "0.9.0-cloudflare.1",
+		"@fabrika/platform": "0.9.0-cloudflare.1",
 		"@happy-dom/global-registrator": "^20.11.2",
 		"@types/bun": "^1.4.3",
 		"@types/react": "^19.0.0",

package/skill/references/dev.md

@@ -1,7 +1,8 @@
 # references/dev.md — previewing the application with `fabrika app dev`
 
 `bunx fabrika app dev` serves the application on `http://127.0.0.1:3000/` through its test kit: the proxy decision,
-the stand-in IAM, a throwaway schema of `FABRIKA_TEST_POSTGRES_URL`, and each SPA from its build (run
+the stand-in IAM, a throwaway schema of `FABRIKA_TEST_POSTGRES_URL` (on Cloudflare an in-memory SQLite database,
+without a URL), and each SPA from its build (run
 `bun run build:web` first). Use it to look at the screens, never in place of a test.
 
 ## The seed

package/skill/references/endpoint.md

@@ -421,7 +421,7 @@ export const workloadRows = (
 ## Raw SQL: `sql: 'read'`
 
 Raw SQL is legitimate for a join, a report, an `OR` or `IS NULL` filter, or a bulk write. Declare it on the endpoint;
-`ctx.sql` exists only there.
+`ctx.sql` exists only there. It runs on Postgres only: on Cloudflare a site that declares `sql` is refused.
 
 ```ts src/reports/endpoints.ts
 import { attachment } from '@fabrika/app/contract'
@@ -564,7 +564,7 @@ Every procedure takes `admission` (who may send it, how often) and `limits` (how
 | `admission.origins`                 | `'same-origin'` (default) or `'listed'`                                                                | `'same-origin'`, `'listed'` or `'any'`                                                                                |
 | `admission.challenge`               | none                                                                                                   | `{ provider: 'altcha', secret, action?, cost?, maxAgeMs? }`, or `{ provider: 'turnstile', secret, siteKey, action? }` |
 | `limits.maxBytes`                   | 64 KiB, at most 1 MiB; with file fields 64 KiB plus each file at its kind's `maxBytes`, at most 48 MiB | the same                                                                                                              |
-| `limits.timeoutMs`                  | 10 s, at most 60 s                                                                                     | the same                                                                                                              |
+| `limits.timeoutMs`                  | 10 s, at most 60 s; at most 25 s on Cloudflare                                                         | the same                                                                                                              |
 
 - A declared `rate` merges into the default; `null` turns one bucket off. Past a bucket the answer is 429.
 - Every bucket is charged before the body is read and stays charged whatever the handler does. A bucket is a database
@@ -642,7 +642,7 @@ export const app = defineApp(vocabulary, tables, {
 - A public procedure updates or removes a row only by an id a verified token of its request carries, with
   `expectVersion`.
 - Single use and revocation are your state (a row the token names). The keys are the platform's: Control generates
-  and rotates them, and an old key verifies until its last token expires. Cloudflare has no signed tokens.
+  and rotates them, and an old key verifies until its last token expires.
 
 ## Outside calls: `egress`
 
@@ -652,6 +652,10 @@ refused while the site runs (`capability_refused: undeclared_egress`). A public,
 none. The checker's `cross-app-fetch` accepts an absolute URL only under an origin some site declares. The approver
 sees every origin. The guard stops mistakes; it is no sandbox.
 
+On Cloudflare a procedure waits for its outside call inside the object's transaction, so the whole environment waits
+with it (`SKILL.md`). A mutation records a row and kicks a job, which declares the `egress` and calls outside
+`ctx.transaction` (`references/jobs.md`).
+
 ## Links to your own procedures: `ctx.url`
 
 `ctx.url('<endpoint id>', { input?, query? })` builds an absolute URL of one of the application's own procedures, on

package/skill/references/errors.md

@@ -8,39 +8,43 @@ architecture, and a refusal's allowed form is the one fix that passes. There is
 
 The refusals agents meet most, and their fix:
 
-| Rule                    | Means                                                                                                                                                            | Fix                                                                                       |
-| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
-| `literal`               | the shell (contract, vocabulary, tables, groups, schemas) holds a computed value or call                                                                         | literal objects, `z.*` calls and imported literal consts; move logic into `.handle(…)`    |
-| `contract`              | the contract does not compile (a reserved role, an unknown action, a wrong field)                                                                                | the message names the field                                                               |
-| `package-replacement`   | `package.json` names the app under `@fabrika/*`, or a dependency is `workspace:*`                                                                                | another name; a registry range such as `^0.0.4`                                           |
-| `generated-test-hash`   | a generated test is missing, edited or stale                                                                                                                     | `bunx fabrika db test-scaffold`, and commit what it writes                                |
-| `endpoint-fixture`      | an endpoint's input cannot be sampled, a fixture or seed names no endpoint, or a member, invitation or link field no endpoint that reads, cancels or revokes one | a literal in `src/__tests__/endpoint-access.fixtures.ts` (`references/tests.md`)          |
-| `raw-sql`               | a driver's `sql` (imported from `bun`, Kysely, `postgres`)                                                                                                       | the handles, or `sql: 'read'` and `ctx.sql`                                               |
-| `forbidden-import`      | a driver, an S3 client, `jose`, `node:http`, `child_process`                                                                                                     | the handles, a file column with `ctx.files`, a connector                                  |
-| `forbidden-global`      | `Bun.sql`, `Bun.serve`, `Bun.spawn`; `globalThis`, `window`, `self`, `global` or `Bun` in a server module                                                        | the handles; state lives in a table, not in a global; `crypto.randomUUID()` for an id     |
-| `env-read`              | `process.env`, `Bun.env`                                                                                                                                         | `defineDeps(build)`, which receives the application's variables                           |
-| `client-identity`       | an input field `userId`, `ownerId`, `createdBy`, `tenantId`, `workspaceId`                                                                                       | the access form's `from`, `ctx.principal.id`, or `createdBy` in the policy                |
-| `type-assertion`        | `as T` (other than `as const`), `<T>x`                                                                                                                           | fix the type; `fromRow` parses a row into a schema's type                                 |
-| `sensitive-log`         | a log of an error object, a request, headers or the environment                                                                                                  | log a short fixed message                                                                 |
-| `migration-name`        | a migration not named `YYYYMMDDHHMMSS_slug.sql` (UTC)                                                                                                            | `bunx fabrika db new <slug>`                                                              |
-| `test-only-import`      | `@fabrika/app/testing`, `@fabrika/app/react/testing` or `@fabrika/db/testing` outside a test file                                                                | import them only from `*.test.ts` or `__tests__/`                                         |
-| `spa-server-import`     | the SPA loads a server module                                                                                                                                    | the SPA imports `@fabrika/app/client`, the contract, `src/schemas.ts` and `src/shared/`   |
-| `shared-import`         | a module under `src/shared/` loads a slice, `src/db/`, `@fabrika/*` or a builtin                                                                                 | a shared module imports `zod/v4` and other shared modules only                            |
-| `skipped-test`          | `.skip`, `.only`, `.todo`                                                                                                                                        | run the test                                                                              |
-| `file-column-migration` | a file column without `REFERENCES fabrika_files (id)` or without an index it leads                                                                               | both, in a new migration (`references/table-and-migration.md`)                            |
-| `on-conflict-index`     | `insert(…, { onConflict: { columns } })` whose columns are no unique index the migrations create                                                                 | a `UNIQUE` constraint or a `CREATE UNIQUE INDEX` without `WHERE` on exactly those columns |
-| `cross-app-fetch`       | a `fetch` of an absolute URL under no origin a site declares in `egress`                                                                                         | `egress: ['https://…']` on the site that calls it (`references/endpoint.md`)              |
-| `url-endpoint`          | `ctx.url('<id>')` names no procedure of the contract                                                                                                             | the endpoint id `<mount>.<group>.<procedure>`                                             |
+| Rule                           | Means                                                                                                                                                            | Fix                                                                                       |
+| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
+| `literal`                      | the shell (contract, vocabulary, tables, groups, schemas) holds a computed value or call                                                                         | literal objects, `z.*` calls and imported literal consts; move logic into `.handle(…)`    |
+| `contract`                     | the contract does not compile (a reserved role, an unknown action, a wrong field)                                                                                | the message names the field                                                               |
+| `package-replacement`          | `package.json` names the app under `@fabrika/*`, or a dependency is `workspace:*`                                                                                | another name; a registry range such as `^0.0.4`                                           |
+| `generated-test-hash`          | a generated test is missing, edited or stale                                                                                                                     | `bunx fabrika db test-scaffold`, and commit what it writes                                |
+| `endpoint-fixture`             | an endpoint's input cannot be sampled, a fixture or seed names no endpoint, or a member, invitation or link field no endpoint that reads, cancels or revokes one | a literal in `src/__tests__/endpoint-access.fixtures.ts` (`references/tests.md`)          |
+| `raw-sql`                      | a driver's `sql` (imported from `bun`, Kysely, `postgres`)                                                                                                       | the handles, or `sql: 'read'` and `ctx.sql`                                               |
+| `forbidden-import`             | a driver, an S3 client, `jose`, `node:http`, `child_process`                                                                                                     | the handles, a file column with `ctx.files`, a connector                                  |
+| `forbidden-global`             | `Bun.sql`, `Bun.serve`, `Bun.spawn`; `globalThis`, `window`, `self`, `global` or `Bun` in a server module                                                        | the handles; state lives in a table, not in a global; `crypto.randomUUID()` for an id     |
+| `env-read`                     | `process.env`, `Bun.env`                                                                                                                                         | `defineDeps(build)`, which receives the application's variables                           |
+| `client-identity`              | an input field `userId`, `ownerId`, `createdBy`, `tenantId`, `workspaceId`                                                                                       | the access form's `from`, `ctx.principal.id`, or `createdBy` in the policy                |
+| `type-assertion`               | `as T` (other than `as const`), `<T>x`                                                                                                                           | fix the type; `fromRow` parses a row into a schema's type                                 |
+| `sensitive-log`                | a log of an error object, a request, headers or the environment                                                                                                  | log a short fixed message                                                                 |
+| `migration-name`               | a migration not named `YYYYMMDDHHMMSS_slug.sql` (UTC)                                                                                                            | `bunx fabrika db new <slug>`                                                              |
+| `test-only-import`             | `@fabrika/app/testing`, `@fabrika/app/react/testing`, `@fabrika/db/testing` or `@fabrika/db/testing-sqlite` outside a test file                                  | import them only from `*.test.ts` or `__tests__/`                                         |
+| `spa-server-import`            | the SPA loads a server module                                                                                                                                    | the SPA imports `@fabrika/app/client`, the contract, `src/schemas.ts` and `src/shared/`   |
+| `shared-import`                | a module under `src/shared/` loads a slice, `src/db/`, `@fabrika/*` or a builtin                                                                                 | a shared module imports `zod/v4` and other shared modules only                            |
+| `skipped-test`                 | `.skip`, `.only`, `.todo`                                                                                                                                        | run the test                                                                              |
+| `file-column-migration`        | a file column without `REFERENCES fabrika_files (id)` or without an index it leads                                                                               | both, in a new migration (`references/table-and-migration.md`)                            |
+| `on-conflict-index`            | `insert(…, { onConflict: { columns } })` whose columns are no unique index the migrations create                                                                 | a `UNIQUE` constraint or a `CREATE UNIQUE INDEX` without `WHERE` on exactly those columns |
+| `cross-app-fetch`              | a `fetch` of an absolute URL under no origin a site declares in `egress`                                                                                         | `egress: ['https://…']` on the site that calls it (`references/endpoint.md`)              |
+| `url-endpoint`                 | `ctx.url('<id>')` names no procedure of the contract                                                                                                             | the endpoint id `<mount>.<group>.<procedure>`                                             |
+| `cloudflare-sql`               | on Cloudflare, a site that declares `sql`                                                                                                                        | the handles (`ctx.db`), without `sql`                                                     |
+| `cloudflare-scan`              | on Cloudflare, a file kind with `scan: true`                                                                                                                     | the kind without `scan`, and no public procedure that takes its files                     |
+| `cloudflare-current-timestamp` | on Cloudflare, `DEFAULT CURRENT_TIMESTAMP` in a migration: SQLite stores `YYYY-MM-DD HH:MM:SS`, which every read of the table refuses                            | `DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))`, in a new migration                     |
 
 The hints:
 
-| Hint                   | Means                                                         | Fix                                                         |
-| ---------------------- | ------------------------------------------------------------- | ----------------------------------------------------------- |
-| `handler-location`     | a `.handle(…)` outside a slice's `endpoints.ts`               | move the endpoint into `src/<slice>/endpoints.ts`           |
-| `data-access-location` | `ctx.db` or `ctx.sql` outside `endpoints.ts` and `queries.ts` | pass the handle into a function of the slice's `queries.ts` |
-| `logic-data-access`    | `logic.ts` reaches data                                       | keep `logic.ts` pure; pass it plain values                  |
-| `cross-slice-queries`  | a slice loads another slice's `queries.ts`                    | move the function, or call that slice's endpoint            |
-| `sql-undeclared`       | `ctx.sql` in a handler whose endpoint declares no `sql`       | add `sql: 'read'` (or `'write'`) to that endpoint           |
+| Hint                   | Means                                                                                                    | Fix                                                                                    |
+| ---------------------- | -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
+| `handler-location`     | a `.handle(…)` outside a slice's `endpoints.ts`                                                          | move the endpoint into `src/<slice>/endpoints.ts`                                      |
+| `data-access-location` | `ctx.db` or `ctx.sql` outside `endpoints.ts` and `queries.ts`                                            | pass the handle into a function of the slice's `queries.ts`                            |
+| `logic-data-access`    | `logic.ts` reaches data                                                                                  | keep `logic.ts` pure; pass it plain values                                             |
+| `cross-slice-queries`  | a slice loads another slice's `queries.ts`                                                               | move the function, or call that slice's endpoint                                       |
+| `sql-undeclared`       | `ctx.sql` in a handler whose endpoint declares no `sql`                                                  | add `sql: 'read'` (or `'write'`) to that endpoint                                      |
+| `cloudflare-held-call` | on Cloudflare, a mutation that declares `egress` or `connect` holds the whole environment while it waits | record a row and `ctx.kick('<job>')`; the job makes the call outside `ctx.transaction` |
 
 The first run may report only the contract's refusals: the generated-test findings appear once the contract compiles.
 
@@ -99,11 +103,11 @@ A 500 answers a fixed message; the server log has one line, `fabrika: <endpoint>
 fixed failure code and, for a framework refusal, its reason and the reason's fixed text, never a value or your error's
 message. The codes you meet most:
 
-| Code                 | Means                                                                                                                                                                                 |
-| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `query_refused`      | the data layer refused a statement or an operation: `undeclared_reach`, `sql_read_only`, `unknown_column`, `read_only`, `sql_outside_transaction` …; the reason's text names the rule |
-| `capability_refused` | a capability of another kind, dimension or action than the call takes (`wrong_capability`, `wrong_action`, `out_of_reach`), or one kept past its request (`ended`, `foreign_work`)    |
-| `handler_failed`     | your handler threw something else; the log has no more: the Operations issue has the stack, or test the handler                                                                       |
+| Code                 | Means                                                                                                                                                                                                                                  |
+| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `query_refused`      | the data layer refused a statement or an operation: `undeclared_reach`, `sql_read_only`, `unknown_column`, `read_only`, `sql_outside_transaction`, `sql_dialect` (`ctx.sql` on SQLite, Cloudflare) …; the reason's text names the rule |
+| `capability_refused` | a capability of another kind, dimension or action than the call takes (`wrong_capability`, `wrong_action`, `out_of_reach`), or one kept past its request (`ended`, `foreign_work`)                                                     |
+| `handler_failed`     | your handler threw something else; the log has no more: the Operations issue has the stack, or test the handler                                                                                                                        |
 
 With an Operations DSN the same 500 is a `RequestFailed` issue in Operations. Its event also carries what your handler
 threw: the error's type, its message, its stack and its `cause` chain. Read the stack there, not in the log. A crash

package/skill/references/files.md

@@ -363,7 +363,8 @@ export const erase = app.cron('30 2 * * *', {
 ## Malware scan
 
 `scan: true` on a kind holds every file of it `quarantined` until ClamAV answers clean; on Zerops the platform
-installs ClamAV and runs the scan job. A file answer is 409 `file_not_ready` until then and 409 `file_rejected` once
+installs ClamAV and runs the scan job. No scanner runs on Cloudflare: the deploy and the boot refuse a kind with
+`scan: true` there, and so a public procedure with a file field. A file answer is 409 `file_not_ready` until then and 409 `file_rejected` once
 the file is `rejected`; a list shows each file's `status`, so show it rather than a broken link. In a test, the scan runs with
 `kit.runJob(FILE_SCAN_JOB)` and a `scanner` passed to `testKit` (`references/tests.md`); the generated tests pass their
 own seeded files.
@@ -401,7 +402,8 @@ the transaction that deletes the row. The file is never copied; the sweep delete
 ## Storage
 
 On Zerops, declare one `object-storage` service in `fabrika.config.ts`; the platform writes `FABRIKA_APP_STORAGE_*`
-from it. Never read those variables, build a storage URL or import an S3 client.
+from it. Never read those variables, build a storage URL or import an S3 client. On Cloudflare the platform binds the
+environment's R2 bucket itself; declare nothing.
 
 ```text
 // in the services of fabrika.config.ts

package/skill/references/table-and-migration.md

@@ -1,7 +1,7 @@
 # references/table-and-migration.md — the vocabulary, migrations and table policies
 
-The order is fixed: the vocabulary, then the migration, then `fabrika db migrate` and `fabrika db codegen`, then the
-table policies, which take the generated `columns`.
+The order is fixed: the vocabulary, then the migration, then `fabrika db migrate` and `fabrika db codegen` (on
+Cloudflare `codegen` only), then the table policies, which take the generated `columns`.
 
 ## The vocabulary
 
@@ -155,6 +155,23 @@ INSERT INTO priorities (code, label, rank) VALUES ('low', 'Low', 1), ('normal',
 - Never edit, rename or delete a committed migration; add a new one. Change a schema by expand, switch, contract, and
   ask before you drop or rename anything.
 
+## On Cloudflare: SQLite migrations
+
+An application on Cloudflare (its `fabrika.config.ts` imports `defineApp` from `@fabrika/provider-cloudflare`) writes
+its migrations in SQLite. Its Durable Object applies them when it boots, each file once in name order, in a transaction
+of its own, so there is no `fabrika db migrate`; `fabrika db codegen` applies them to an in-memory database and needs
+no URL. The rules above for keys, chains, composite foreign keys, `version` and `created_by` hold unchanged, and the
+database enforces foreign keys.
+
+- The declared types codegen reads: `TEXT` (a UUID too), `INTEGER`, `REAL`, `BLOB`; `BOOLEAN`, stored as 0 or 1 and
+  read as a boolean; `TIMESTAMP`, stored as UTC ISO text and read as a `Date`; `DATE`, `YYYY-MM-DD` text. Any other
+  declared type is refused. A `STRICT` table admits only `INTEGER`, `REAL`, `TEXT` and `BLOB`, so a table with a
+  `BOOLEAN`, `TIMESTAMP` or `DATE` column is not `STRICT`.
+- SQLite has no `ENUM`: a column with a fixed set of values is `TEXT` with `CHECK (<column> IN ('a', 'b'))`. The
+  generated tests write its first value.
+- No transaction control (`BEGIN`, `COMMIT`, `SAVEPOINT`) and no Postgres syntax (`timestamptz`, `::` casts,
+  `GENERATED ALWAYS AS IDENTITY`, `CREATE TYPE`).
+
 ## Database code is a declared deviation
 
 A function, trigger, view, rule, policy or `DO` block in a migration is allowed. The migration file declares it, and

package/skill/references/tests.md

@@ -59,6 +59,14 @@ export const members = { 'api.tasks.assign': ['assignee'] }
   table of the table that owns it, or a table it contains; the checker refuses a row further down
   (`endpoint-fixture`). Without it they send a sample, the handler
   finds no row (404), and the case fails.
+- `appRows['<endpoint id>']` gives the rows of application tables (`scope: { app }`) that the endpoint's handler reads
+  for the caller's own scope, by table, with the columns they need: `export const appRows = { 'portal.guide': { guides:
+  { active: true } } }`. Each of its leak and own-object cases seeds one row of each before it asks and removes them
+  once it is over, with every row that refers to them (a download the handler logged), so a handler that reads the
+  newest guide answers 200 instead of 404, and no other endpoint's case finds the row. A foreign key from one given row
+  to another holds that row's key. A text column may be given; the key, the version, the creator and a file column may
+  not (a file column holds a live, scanned file). Only application tables, and only for an endpoint with a leak or an
+  own-object case: the checker refuses a table in a scope, which `rows` and `seeds` address (`endpoint-fixture`).
 - The endpoint id is `<mount>.<group>.<endpoint>` (`api.tasks.close`).
 - The seed of the tests fills every text column with a marker and every other required column with a sample of its
   type: an enum's first label, `1`, `false`, today. A column with a `DEFAULT` keeps it (`status` is `open`). A column
@@ -196,6 +204,9 @@ if (postgres !== null) {
   `<label> skipped: set FABRIKA_TEST_POSTGRES_URL to run the Postgres-backed tests`, and the file registers no test.
   A skip proves nothing. To confirm a file ran, run it alone (`bun test --isolate src/tasks`) and check that the pass
   count is its number of tests, or set `FABRIKA_TEST_POSTGRES_REQUIRED=1`: a missing URL then fails the file.
+- On Cloudflare import `testDatabase` from `@fabrika/db/testing-sqlite` instead, with the same options: it migrates a
+  fresh in-memory SQLite database as the Durable Object does, needs no URL and never answers `null`. The generated tests
+  already use it.
 - `statusOf(call)` answers 200 when the call resolves and the status of the application's refusal otherwise; any other
   failure (no answer, a bug in the test) is rethrown. Import it beside `testKit`; do not write your own.
 - `kit.testCaller(grants, { kind })` makes a caller: a grant is a role or an action, in one scope or global. A

package/skill/references/webhooks-links-connectors.md

@@ -89,7 +89,7 @@ export const integrations = app.group({ callers: ['human'] }, (r) => ({
   that binds it takes an `app` capability: `access: { action, app: true }`, `binds`, and
   `ctx.webhooks('<webhook>').bind(ctx.app, account)`.
 - `limits: { maxBytes?, timeoutMs? }`: the body is 1 MiB by default and at most 48 MiB; the handler runs 10 s by
-  default, at most 60 s. A webhook may declare `kicks`, `signs`, `egress`, `sql` and `unscoped`, and `ctx.files.put`
+  default, at most 60 s (25 s on Cloudflare). A webhook may declare `kicks`, `signs`, `egress`, `sql` and `unscoped`, and `ctx.files.put`
   stores a file a provider sends (an inbound e-mail's attachment) for a file column: raise `limits.maxBytes` to the
   mail you accept.
 - Not covered: a provider that validates its URL with a `GET`, or that needs a custom answer body.