@fabrika/app 0.8.2 → 0.9.0-cloudflare.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/app",
-	"version": "0.8.2",
+	"version": "0.9.0-cloudflare.2",
 	"type": "module",
 	"license": "MIT",
 	"repository": {
@@ -14,77 +14,93 @@
 	"files": [
 		"src",
 		"skill",
-		"!src/**/__tests__/**"
+		"!src/**/__tests__/**",
+		"types"
 	],
 	"exports": {
 		".": {
 			"bun": "./src/index.ts",
-			"types": "./src/index.ts",
+			"types": "./types/src/index.d.ts",
 			"default": "./src/index.ts"
 		},
 		"./bun": {
 			"bun": "./src/bun.ts",
-			"types": "./src/bun.ts",
+			"types": "./types/src/bun.d.ts",
 			"default": "./src/bun.ts"
 		},
 		"./cloudflare": {
 			"bun": "./src/cloudflare.ts",
-			"types": "./src/cloudflare.ts",
+			"types": "./types/src/cloudflare.d.ts",
 			"default": "./src/cloudflare.ts"
 		},
 		"./contract": {
 			"bun": "./src/contract/index.ts",
-			"types": "./src/contract/index.ts",
+			"types": "./types/src/contract/index.d.ts",
 			"default": "./src/contract/index.ts"
 		},
 		"./client": {
 			"bun": "./src/client/index.ts",
-			"types": "./src/client/index.ts",
+			"types": "./types/src/client/index.d.ts",
 			"default": "./src/client/index.ts"
 		},
 		"./react": {
 			"bun": "./src/react/index.ts",
-			"types": "./src/react/index.ts",
+			"types": "./types/src/react/index.d.ts",
 			"default": "./src/react/index.ts"
 		},
 		"./react/testing": {
 			"bun": "./src/react/testing.ts",
-			"types": "./src/react/testing.ts",
+			"types": "./types/src/react/testing.d.ts",
 			"default": "./src/react/testing.ts"
 		},
 		"./implement": {
 			"bun": "./src/implement/index.ts",
-			"types": "./src/implement/index.ts",
+			"types": "./types/src/implement/index.d.ts",
 			"default": "./src/implement/index.ts"
 		},
 		"./service": {
 			"bun": "./src/service/index.ts",
-			"types": "./src/service/index.ts",
+			"types": "./types/src/service/index.d.ts",
 			"default": "./src/service/index.ts"
 		},
 		"./build": {
 			"bun": "./src/build.ts",
-			"types": "./src/build.ts",
+			"types": "./types/src/build.d.ts",
 			"default": "./src/build.ts"
 		},
 		"./testing": {
 			"bun": "./src/testing/index.ts",
-			"types": "./src/testing/index.ts",
+			"types": "./types/src/testing/index.d.ts",
 			"default": "./src/testing/index.ts"
 		},
 		"./testing/isolation": {
 			"bun": "./src/testing/isolation.ts",
-			"types": "./src/testing/isolation.ts",
+			"types": "./types/src/testing/isolation.d.ts",
 			"default": "./src/testing/isolation.ts"
 		},
 		"./testing/preload": {
 			"bun": "./src/testing/preload.ts",
-			"types": "./src/testing/preload.ts",
+			"types": "./types/src/testing/preload.d.ts",
 			"default": "./src/testing/preload.ts"
 		},
+		"./dev": {
+			"bun": "./src/dev/index.ts",
+			"types": "./types/src/dev/index.d.ts",
+			"default": "./src/dev/index.ts"
+		},
+		"./dev/wire": {
+			"bun": "./src/dev/wire.ts",
+			"types": "./types/src/dev/wire.d.ts",
+			"default": "./src/dev/wire.ts"
+		},
+		"./dev/changes": {
+			"bun": "./src/dev/changes.ts",
+			"types": "./types/src/dev/changes.d.ts",
+			"default": "./src/dev/changes.ts"
+		},
 		"./agent-skill": {
 			"bun": "./src/agent-skill.ts",
-			"types": "./src/agent-skill.ts",
+			"types": "./types/src/agent-skill.d.ts",
 			"default": "./src/agent-skill.ts"
 		}
 	},
@@ -93,14 +109,14 @@
 		"test": "bun test --path-ignore-patterns='src/react/**' && bun test --isolate src/react"
 	},
 	"dependencies": {
-		"@fabrika/auth": "0.8.2",
-		"@fabrika/auth-core": "0.8.2",
-		"@fabrika/db": "0.8.2",
-		"@fabrika/email": "0.8.2",
-		"@fabrika/jwks": "0.8.2",
-		"@fabrika/platform": "0.8.2",
-		"@fabrika/platform-node": "0.8.2",
-		"@fabrika/proxy-core": "0.8.2",
+		"@fabrika/auth": "0.9.0-cloudflare.2",
+		"@fabrika/auth-core": "0.9.0-cloudflare.2",
+		"@fabrika/db": "0.9.0-cloudflare.2",
+		"@fabrika/email": "0.9.0-cloudflare.2",
+		"@fabrika/jwks": "0.9.0-cloudflare.2",
+		"@fabrika/platform": "0.9.0-cloudflare.2",
+		"@fabrika/platform-node": "0.9.0-cloudflare.2",
+		"@fabrika/proxy-core": "0.9.0-cloudflare.2",
 		"altcha-lib": "2.6.0",
 		"jose": "^5.9.0"
 	},

package/skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: fabrika-app
-version: 0.8.2
+version: 0.9.0-cloudflare.2
 description: >
   How to write and change a Fabrika application: src/vocabulary.ts, db/migrations/, src/db/tables.ts, the
   slices' endpoints.ts with their handlers, fabrika.contract.ts, jobs, files, webhooks, share links, connectors
@@ -231,6 +231,7 @@ the access check. `references/spa.md` shows the stack.
 | e-mail (a cron job only)       | `mailer: 'installation'`                                | `ctx.mail.send`                                    |
 | a file from a public procedure | `file('<kind>')` input, `admission` with `bytesPerHour` | a reference the handler writes into a file column  |
 | an outside HTTPS API           | `egress: ['https://api.example.com']`                   | `fetch` to exactly those origins                   |
+| any public website (a job)     | `egress: 'public'`                                      | `fetch` to public hosts, never the installation    |
 | a signed link (unsubscribe)    | `signs: ['<purpose>']`                                  | `ctx.tokens.sign`                                  |
 | a webhook binding              | `binds: '<webhook>'`                                    | `ctx.webhooks('<webhook>').bind` and `.unbind`     |
 | a job run after the commit     | `kicks: ['<job>']`                                      | `ctx.kick('<job>')`                                |
@@ -258,7 +259,7 @@ Which promise the types, the checker, boot, the runtime or the approver keeps, a
 - No `as` (except `as const`), `any`, `@ts-ignore`, `@ts-expect-error`, `process.env` or `Bun.env`.
 - Never log an error object, a request, headers or the environment.
 - Never edit a generated file (`src/db/schema.generated.ts`, the generated tests, `fabrika/entry.generated.ts`,
-  `fabrika/connect/`) or a committed migration. Regenerate the file; write a new migration.
+  `fabrika/migrations.generated.ts`, `fabrika/connect/`) or a committed migration. Regenerate the file; write a new migration.
 
 ## Ask the human first
 
@@ -295,6 +296,30 @@ bunx tsc --noEmit                                           # once, at the end
 bunx fabrika-check .                                        # once, after tsc; refusals fail; hints print below them
 ```
 
+**On Cloudflare** (`fabrika.config.ts` imports `defineApp` from `@fabrika/provider-cloudflare`) the application runs in
+one Durable Object over SQLite. Its `db/migrations/*.sql` are SQLite (`references/table-and-migration.md`), and the
+object applies them when it boots, so there is no `migrate` and no command needs a database URL or `FABRIKA_APP_ID`.
+The tests run on `@fabrika/db/testing-sqlite` (`references/tests.md`), in memory, and never skip. A handler holds the
+object's transaction, so its `limits.timeoutMs` is at most 25 s. No `sql` (`ctx.sql`) and no `scan: true`: the
+checker, the deploy and the boot refuse both. The deploy serves each SPA mount's built `dir` itself; declare no
+`assets` on the Worker (`references/app-setup.md`).
+
+The object runs one transaction at a time, so every `await` in a handler that may write holds the whole environment:
+IAM, R2, a `fetch`, a `ctx.connect` call, a binding. One 2 s call caps the environment at half a request a second. A
+query holds no transaction: each of its statements runs on its own, so two of its reads may see different committed
+states. Inside a
+mutation keep I/O to the framework's own: IAM, and the file it writes. A slow outside call goes into a row, the
+mutation calls `ctx.kick('<job>')`, and the job makes the call outside `ctx.transaction` (`references/jobs.md`). The
+checker hints on a mutation that declares `egress` or `connect` (`cloudflare-held-call`), and refuses
+`DEFAULT CURRENT_TIMESTAMP` in a migration (`cloudflare-current-timestamp`).
+
+```bash
+bunx fabrika db new <slug>                                  # a new SQLite migration file
+bunx fabrika db codegen                                     # applies the migrations in memory; writes src/db/schema.generated.ts
+bunx fabrika db test-scaffold                               # the generated tests, on @fabrika/db/testing-sqlite
+bun test --isolate                                          # no database URL; then tsc and fabrika-check as above
+```
+
 A generated file changes only through its command (`codegen`, `test-scaffold`); running it is the loop, not an edit.
 Format and lint only the files you wrote, with the repository's own tools: in the fabrika-platform repository
 `bunx dprint fmt <files>` and `bunx biome lint <files>`, never `biome check` (its formatter fights dprint), and never a
@@ -326,7 +351,8 @@ e-mails them, a link holder's files, HR's review with its history.
 
 ## Not built yet
 
-- The data layer runs on Bun and Postgres only (Zerops). On Cloudflare an application has no tables, jobs or files.
+- On Cloudflare, where the application runs in one Durable Object over its SQLite and its `db/migrations/*.sql` are
+  SQLite, `sql` (`ctx.sql`) and a file kind with `scan: true` are refused. Everything else on the road runs there.
 - Jobs are cron only and app-wide: no `ctx.jobs.enqueue`, no job per scope. A `ctx.kick` starts a run of its job; it
   carries nothing, and the job finds its work in a queue table with `claim`. A list write is off the road (`sql`).
 - A read across tables (a join, a filter over a related table, an aggregate over several) is off the road (`sql`).

package/skill/references/app-setup.md

@@ -19,20 +19,20 @@ the SPA is added with it.
 		"test": "bun test --isolate"
 	},
 	"dependencies": {
-		"@fabrika/app": "0.8.2",
-		"@fabrika/db": "0.8.2",
-		"@fabrika/provider-zerops": "0.8.2",
-		"@fabrika/proxy-core": "0.8.2",
-		"@fabrika/ui": "0.8.2",
+		"@fabrika/app": "0.9.0-cloudflare.2",
+		"@fabrika/db": "0.9.0-cloudflare.2",
+		"@fabrika/provider-zerops": "0.9.0-cloudflare.2",
+		"@fabrika/proxy-core": "0.9.0-cloudflare.2",
+		"@fabrika/ui": "0.9.0-cloudflare.2",
 		"kysely": "0.29.6",
 		"react": "^19.0.0",
 		"react-dom": "^19.0.0",
 		"zod": "^3.25.76"
 	},
 	"devDependencies": {
-		"@fabrika/check": "0.8.2",
-		"@fabrika/cli": "0.8.2",
-		"@fabrika/platform": "0.8.2",
+		"@fabrika/check": "0.9.0-cloudflare.2",
+		"@fabrika/cli": "0.9.0-cloudflare.2",
+		"@fabrika/platform": "0.9.0-cloudflare.2",
 		"@happy-dom/global-registrator": "^20.11.2",
 		"@types/bun": "^1.4.3",
 		"@types/react": "^19.0.0",
@@ -249,6 +249,22 @@ The platform's build runs the tests, writes the entrypoint, runs `fabrika-check`
 run `fabrika db migrate`, `fabrika db codegen --verify` and `fabrika db test-isolation` before the server starts: a
 version does not go live until every generated test passes. It writes every `FABRIKA_*` variable; never set one.
 
+## The deploy surface (Cloudflare)
+
+On Cloudflare `fabrika.config.ts` imports `defineApp`, `Worker` and `iamServiceReference` from
+`@fabrika/provider-cloudflare`, and `resources` returns the application Worker: `main: './fabrika/entry.generated.ts'`,
+`workers_dev: false`, `preview_urls: false`, `routes: []` and `bindings: { IAM: iamServiceReference() }`, with
+`pipeline: { workerDir: '.', build: 'bun run build:web' }` when the application has an SPA. The deploy adds the
+Durable Object, the files bucket, the minute tick, every `FABRIKA_*` variable and the proxy Worker.
+
+It also serves the SPA: when the Worker declares no `assets`, the deploy copies the build directory of each SPA and
+link mount (`dir`, a link's `spa`) into `fabrika/assets/` at the mount's prefix (`/admin` into `fabrika/assets/admin/`)
+after `pipeline.build`, and binds it as `ASSETS`. A deploy whose mount directory the build did not write fails and
+names the mount. Do not declare `assets` yourself. A Worker that declares them keeps them, and the object reads each
+request path from that directory as it is (`/admin/app.js` is `admin/app.js` there), so a hand-written `assets` works
+only for a root mount, or for mounts whose directories nest like their prefixes; it needs `binding: 'ASSETS'` and
+`run_worker_first: true`.
+
 ## The SPA (added when the application has one)
 
 The SPA is React, built from the screens and hooks of the framework: `@fabrika/app/react` runs the typed client's
@@ -379,8 +395,9 @@ await Bun.write(
   `src/schemas.ts`, `src/shared/` and its own modules; never a slice, `src/db/` or a Bun or Node module. The plugin loads the
   contract without its handlers. A row type the screen declares (`Task` above) is checked against the answer where
   the rows are passed in.
-- The last step points the page's assets at the SPA's prefix (`/`): the mount answers `index.html` for every path
-  under it, so a deep link such as `/tasks/<id>` renders. `define` gives React's production build.
+- The last step points the page's assets at the SPA's prefix (`/`): the mount answers `index.html` for every page
+  route under it (a path without an extension, or a navigation), so a deep link such as `/tasks/<id>` renders; a
+  missing asset such as an old `chunk-….js` is 404. `define` gives React's production build.
 - `sourcemap: 'external'` writes each script's map beside it, and the page names none. The platform build uploads the
   maps to Operations for the release the page reports, so an error's frames show the original source; the mount
   never serves a `.map` file (404). Keep the maps external: `inline` would ship the source to every visitor.
@@ -397,4 +414,5 @@ await Bun.write(
 
 ## Ignored files
 
-`.gitignore`: `node_modules/`, `fabrika.manifest.json`, `/fabrika/entry.generated.ts`, `/dist/`.
+`.gitignore`: `node_modules/`, `fabrika.manifest.json`, `/fabrika/entry.generated.ts`, `/dist/`, and on Cloudflare
+`/fabrika/assets/`, where a deploy stages the SPA's files.

package/skill/references/dev.md

@@ -1,7 +1,8 @@
 # references/dev.md — previewing the application with `fabrika app dev`
 
 `bunx fabrika app dev` serves the application on `http://127.0.0.1:3000/` through its test kit: the proxy decision,
-the stand-in IAM, a throwaway schema of `FABRIKA_TEST_POSTGRES_URL`, and each SPA from its build (run
+the stand-in IAM, a throwaway schema of `FABRIKA_TEST_POSTGRES_URL` (on Cloudflare an in-memory SQLite database,
+without a URL), and each SPA from its build (run
 `bun run build:web` first). Use it to look at the screens, never in place of a test.
 
 ## The seed

package/skill/references/endpoint.md

@@ -421,7 +421,7 @@ export const workloadRows = (
 ## Raw SQL: `sql: 'read'`
 
 Raw SQL is legitimate for a join, a report, an `OR` or `IS NULL` filter, or a bulk write. Declare it on the endpoint;
-`ctx.sql` exists only there.
+`ctx.sql` exists only there. It runs on Postgres only: on Cloudflare a site that declares `sql` is refused.
 
 ```ts src/reports/endpoints.ts
 import { attachment } from '@fabrika/app/contract'
@@ -564,7 +564,7 @@ Every procedure takes `admission` (who may send it, how often) and `limits` (how
 | `admission.origins`                 | `'same-origin'` (default) or `'listed'`                                                                | `'same-origin'`, `'listed'` or `'any'`                                                                                |
 | `admission.challenge`               | none                                                                                                   | `{ provider: 'altcha', secret, action?, cost?, maxAgeMs? }`, or `{ provider: 'turnstile', secret, siteKey, action? }` |
 | `limits.maxBytes`                   | 64 KiB, at most 1 MiB; with file fields 64 KiB plus each file at its kind's `maxBytes`, at most 48 MiB | the same                                                                                                              |
-| `limits.timeoutMs`                  | 10 s, at most 60 s                                                                                     | the same                                                                                                              |
+| `limits.timeoutMs`                  | 10 s, at most 60 s; at most 25 s on Cloudflare                                                         | the same                                                                                                              |
 
 - A declared `rate` merges into the default; `null` turns one bucket off. Past a bucket the answer is 429.
 - Every bucket is charged before the body is read and stays charged whatever the handler does. A bucket is a database
@@ -642,7 +642,7 @@ export const app = defineApp(vocabulary, tables, {
 - A public procedure updates or removes a row only by an id a verified token of its request carries, with
   `expectVersion`.
 - Single use and revocation are your state (a row the token names). The keys are the platform's: Control generates
-  and rotates them, and an old key verifies until its last token expires. Cloudflare has no signed tokens.
+  and rotates them, and an old key verifies until its last token expires.
 
 ## Outside calls: `egress`
 
@@ -652,6 +652,15 @@ refused while the site runs (`capability_refused: undeclared_egress`). A public,
 none. The checker's `cross-app-fetch` accepts an absolute URL only under an origin some site declares. The approver
 sees every origin. The guard stops mistakes; it is no sandbox.
 
+On Cloudflare a procedure waits for its outside call inside the object's transaction, so the whole environment waits
+with it (`SKILL.md`). A mutation records a row and kicks a job, which declares the `egress` and calls outside
+`ctx.transaction` (`references/jobs.md`).
+
+A cron job that calls hosts nobody knows when the contract is written (the websites its operators enter: a crawler, an
+auditor, a link checker) declares `egress: 'public'` instead of a list (`references/jobs.md`). Only a cron job may: a
+procedure, a mutation and a webhook name their origins. Never keep `fetch` from before boot or open sockets to get past
+the list; that is hidden reach.
+
 ## Links to your own procedures: `ctx.url`
 
 `ctx.url('<endpoint id>', { input?, query? })` builds an absolute URL of one of the application's own procedures, on

package/skill/references/errors.md

@@ -8,39 +8,43 @@ architecture, and a refusal's allowed form is the one fix that passes. There is
 
 The refusals agents meet most, and their fix:
 
-| Rule                    | Means                                                                                                                                                            | Fix                                                                                       |
-| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
-| `literal`               | the shell (contract, vocabulary, tables, groups, schemas) holds a computed value or call                                                                         | literal objects, `z.*` calls and imported literal consts; move logic into `.handle(…)`    |
-| `contract`              | the contract does not compile (a reserved role, an unknown action, a wrong field)                                                                                | the message names the field                                                               |
-| `package-replacement`   | `package.json` names the app under `@fabrika/*`, or a dependency is `workspace:*`                                                                                | another name; a registry range such as `^0.0.4`                                           |
-| `generated-test-hash`   | a generated test is missing, edited or stale                                                                                                                     | `bunx fabrika db test-scaffold`, and commit what it writes                                |
-| `endpoint-fixture`      | an endpoint's input cannot be sampled, a fixture or seed names no endpoint, or a member, invitation or link field no endpoint that reads, cancels or revokes one | a literal in `src/__tests__/endpoint-access.fixtures.ts` (`references/tests.md`)          |
-| `raw-sql`               | a driver's `sql` (imported from `bun`, Kysely, `postgres`)                                                                                                       | the handles, or `sql: 'read'` and `ctx.sql`                                               |
-| `forbidden-import`      | a driver, an S3 client, `jose`, `node:http`, `child_process`                                                                                                     | the handles, a file column with `ctx.files`, a connector                                  |
-| `forbidden-global`      | `Bun.sql`, `Bun.serve`, `Bun.spawn`; `globalThis`, `window`, `self`, `global` or `Bun` in a server module                                                        | the handles; state lives in a table, not in a global; `crypto.randomUUID()` for an id     |
-| `env-read`              | `process.env`, `Bun.env`                                                                                                                                         | `defineDeps(build)`, which receives the application's variables                           |
-| `client-identity`       | an input field `userId`, `ownerId`, `createdBy`, `tenantId`, `workspaceId`                                                                                       | the access form's `from`, `ctx.principal.id`, or `createdBy` in the policy                |
-| `type-assertion`        | `as T` (other than `as const`), `<T>x`                                                                                                                           | fix the type; `fromRow` parses a row into a schema's type                                 |
-| `sensitive-log`         | a log of an error object, a request, headers or the environment                                                                                                  | log a short fixed message                                                                 |
-| `migration-name`        | a migration not named `YYYYMMDDHHMMSS_slug.sql` (UTC)                                                                                                            | `bunx fabrika db new <slug>`                                                              |
-| `test-only-import`      | `@fabrika/app/testing`, `@fabrika/app/react/testing` or `@fabrika/db/testing` outside a test file                                                                | import them only from `*.test.ts` or `__tests__/`                                         |
-| `spa-server-import`     | the SPA loads a server module                                                                                                                                    | the SPA imports `@fabrika/app/client`, the contract, `src/schemas.ts` and `src/shared/`   |
-| `shared-import`         | a module under `src/shared/` loads a slice, `src/db/`, `@fabrika/*` or a builtin                                                                                 | a shared module imports `zod/v4` and other shared modules only                            |
-| `skipped-test`          | `.skip`, `.only`, `.todo`                                                                                                                                        | run the test                                                                              |
-| `file-column-migration` | a file column without `REFERENCES fabrika_files (id)` or without an index it leads                                                                               | both, in a new migration (`references/table-and-migration.md`)                            |
-| `on-conflict-index`     | `insert(…, { onConflict: { columns } })` whose columns are no unique index the migrations create                                                                 | a `UNIQUE` constraint or a `CREATE UNIQUE INDEX` without `WHERE` on exactly those columns |
-| `cross-app-fetch`       | a `fetch` of an absolute URL under no origin a site declares in `egress`                                                                                         | `egress: ['https://…']` on the site that calls it (`references/endpoint.md`)              |
-| `url-endpoint`          | `ctx.url('<id>')` names no procedure of the contract                                                                                                             | the endpoint id `<mount>.<group>.<procedure>`                                             |
+| Rule                           | Means                                                                                                                                                                                                                                                     | Fix                                                                                       |
+| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
+| `literal`                      | the shell (contract, vocabulary, tables, groups, schemas) holds a computed value or call                                                                                                                                                                  | literal objects, `z.*` calls and imported literal consts; move logic into `.handle(…)`    |
+| `contract`                     | the contract does not compile (a reserved role, an unknown action, a wrong field)                                                                                                                                                                         | the message names the field                                                               |
+| `package-replacement`          | `package.json` names the app under `@fabrika/*`, or a dependency is `workspace:*`                                                                                                                                                                         | another name; a registry range such as `^0.0.4`                                           |
+| `generated-test-hash`          | a generated test is missing, edited or stale                                                                                                                                                                                                              | `bunx fabrika db test-scaffold`, and commit what it writes                                |
+| `endpoint-fixture`             | an endpoint's input cannot be sampled, a fixture or seed names no endpoint, a member, invitation or link field no endpoint that reads, cancels or revokes one, a file names no file field or a path outside the application, or a refusal is `validation` | a literal in `src/__tests__/endpoint-access.fixtures.ts` (`references/tests.md`)          |
+| `raw-sql`                      | a driver's `sql` (imported from `bun`, Kysely, `postgres`)                                                                                                                                                                                                | the handles, or `sql: 'read'` and `ctx.sql`                                               |
+| `forbidden-import`             | a driver, an S3 client, `jose`, `node:http`, `child_process`                                                                                                                                                                                              | the handles, a file column with `ctx.files`, a connector                                  |
+| `forbidden-global`             | `Bun.sql`, `Bun.serve`, `Bun.spawn`; `globalThis`, `window`, `self`, `global` or `Bun` in a server module                                                                                                                                                 | the handles; state lives in a table, not in a global; `crypto.randomUUID()` for an id     |
+| `env-read`                     | `process.env`, `Bun.env`                                                                                                                                                                                                                                  | `defineDeps(build)`, which receives the application's variables                           |
+| `client-identity`              | an input field `userId`, `ownerId`, `createdBy`, `tenantId`, `workspaceId`                                                                                                                                                                                | the access form's `from`, `ctx.principal.id`, or `createdBy` in the policy                |
+| `type-assertion`               | `as T` (other than `as const`), `<T>x`                                                                                                                                                                                                                    | fix the type; `fromRow` parses a row into a schema's type                                 |
+| `sensitive-log`                | a log of an error object, a request, headers or the environment                                                                                                                                                                                           | log a short fixed message                                                                 |
+| `migration-name`               | a migration not named `YYYYMMDDHHMMSS_slug.sql` (UTC)                                                                                                                                                                                                     | `bunx fabrika db new <slug>`                                                              |
+| `test-only-import`             | `@fabrika/app/testing`, `@fabrika/app/react/testing`, `@fabrika/db/testing` or `@fabrika/db/testing-sqlite` outside a test file                                                                                                                           | import them only from `*.test.ts` or `__tests__/`                                         |
+| `spa-server-import`            | the SPA loads a server module                                                                                                                                                                                                                             | the SPA imports `@fabrika/app/client`, the contract, `src/schemas.ts` and `src/shared/`   |
+| `shared-import`                | a module under `src/shared/` loads a slice, `src/db/`, `@fabrika/*` or a builtin                                                                                                                                                                          | a shared module imports `zod/v4` and other shared modules only                            |
+| `skipped-test`                 | `.skip`, `.only`, `.todo`                                                                                                                                                                                                                                 | run the test                                                                              |
+| `file-column-migration`        | a file column without `REFERENCES fabrika_files (id)` or without an index it leads                                                                                                                                                                        | both, in a new migration (`references/table-and-migration.md`)                            |
+| `on-conflict-index`            | `insert(…, { onConflict: { columns } })` whose columns are no unique index the migrations create                                                                                                                                                          | a `UNIQUE` constraint or a `CREATE UNIQUE INDEX` without `WHERE` on exactly those columns |
+| `cross-app-fetch`              | a `fetch` of an absolute URL under no origin a site declares in `egress`, or one a job's `egress: 'public'` refuses (an IP address, `localhost`)                                                                                                          | `egress: ['https://…']` on the site that calls it (`references/endpoint.md`)              |
+| `url-endpoint`                 | `ctx.url('<id>')` names no procedure of the contract                                                                                                                                                                                                      | the endpoint id `<mount>.<group>.<procedure>`                                             |
+| `cloudflare-sql`               | on Cloudflare, a site that declares `sql`                                                                                                                                                                                                                 | the handles (`ctx.db`), without `sql`                                                     |
+| `cloudflare-scan`              | on Cloudflare, a file kind with `scan: true`                                                                                                                                                                                                              | the kind without `scan`, and no public procedure that takes its files                     |
+| `cloudflare-current-timestamp` | on Cloudflare, `DEFAULT CURRENT_TIMESTAMP` in a migration: SQLite stores `YYYY-MM-DD HH:MM:SS`, which every read of the table refuses                                                                                                                     | `DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))`, in a new migration                     |
 
 The hints:
 
-| Hint                   | Means                                                         | Fix                                                         |
-| ---------------------- | ------------------------------------------------------------- | ----------------------------------------------------------- |
-| `handler-location`     | a `.handle(…)` outside a slice's `endpoints.ts`               | move the endpoint into `src/<slice>/endpoints.ts`           |
-| `data-access-location` | `ctx.db` or `ctx.sql` outside `endpoints.ts` and `queries.ts` | pass the handle into a function of the slice's `queries.ts` |
-| `logic-data-access`    | `logic.ts` reaches data                                       | keep `logic.ts` pure; pass it plain values                  |
-| `cross-slice-queries`  | a slice loads another slice's `queries.ts`                    | move the function, or call that slice's endpoint            |
-| `sql-undeclared`       | `ctx.sql` in a handler whose endpoint declares no `sql`       | add `sql: 'read'` (or `'write'`) to that endpoint           |
+| Hint                   | Means                                                                                                    | Fix                                                                                    |
+| ---------------------- | -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
+| `handler-location`     | a `.handle(…)` outside a slice's `endpoints.ts`                                                          | move the endpoint into `src/<slice>/endpoints.ts`                                      |
+| `data-access-location` | `ctx.db` or `ctx.sql` outside `endpoints.ts` and `queries.ts`                                            | pass the handle into a function of the slice's `queries.ts`                            |
+| `logic-data-access`    | `logic.ts` reaches data                                                                                  | keep `logic.ts` pure; pass it plain values                                             |
+| `cross-slice-queries`  | a slice loads another slice's `queries.ts`                                                               | move the function, or call that slice's endpoint                                       |
+| `sql-undeclared`       | `ctx.sql` in a handler whose endpoint declares no `sql`                                                  | add `sql: 'read'` (or `'write'`) to that endpoint                                      |
+| `cloudflare-held-call` | on Cloudflare, a mutation that declares `egress` or `connect` holds the whole environment while it waits | record a row and `ctx.kick('<job>')`; the job makes the call outside `ctx.transaction` |
 
 The first run may report only the contract's refusals: the generated-test findings appear once the contract compiles.
 
@@ -99,11 +103,11 @@ A 500 answers a fixed message; the server log has one line, `fabrika: <endpoint>
 fixed failure code and, for a framework refusal, its reason and the reason's fixed text, never a value or your error's
 message. The codes you meet most:
 
-| Code                 | Means                                                                                                                                                                                 |
-| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `query_refused`      | the data layer refused a statement or an operation: `undeclared_reach`, `sql_read_only`, `unknown_column`, `read_only`, `sql_outside_transaction` …; the reason's text names the rule |
-| `capability_refused` | a capability of another kind, dimension or action than the call takes (`wrong_capability`, `wrong_action`, `out_of_reach`), or one kept past its request (`ended`, `foreign_work`)    |
-| `handler_failed`     | your handler threw something else; the log has no more: the Operations issue has the stack, or test the handler                                                                       |
+| Code                 | Means                                                                                                                                                                                                                                                                          |
+| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `query_refused`      | the data layer refused a statement or an operation: `undeclared_reach`, `sql_read_only`, `unknown_column`, `read_only`, `sql_outside_transaction`, `sql_dialect` (`ctx.sql` on SQLite, Cloudflare) …; the reason's text names the rule                                         |
+| `capability_refused` | a capability of another kind, dimension or action than the call takes (`wrong_capability`, `wrong_action`, `out_of_reach`), one kept past its request (`ended`, `foreign_work`), or a `fetch` its `egress` refuses (`undeclared_egress`, `refused_egress`, `oversized_egress`) |
+| `handler_failed`     | your handler threw something else; the log has no more: the Operations issue has the stack, or test the handler                                                                                                                                                                |
 
 With an Operations DSN the same 500 is a `RequestFailed` issue in Operations. Its event also carries what your handler
 threw: the error's type, its message, its stack and its `cause` chain. Read the stack there, not in the log. A crash

package/skill/references/files.md

@@ -363,7 +363,8 @@ export const erase = app.cron('30 2 * * *', {
 ## Malware scan
 
 `scan: true` on a kind holds every file of it `quarantined` until ClamAV answers clean; on Zerops the platform
-installs ClamAV and runs the scan job. A file answer is 409 `file_not_ready` until then and 409 `file_rejected` once
+installs ClamAV and runs the scan job. No scanner runs on Cloudflare: the deploy and the boot refuse a kind with
+`scan: true` there, and so a public procedure with a file field. A file answer is 409 `file_not_ready` until then and 409 `file_rejected` once
 the file is `rejected`; a list shows each file's `status`, so show it rather than a broken link. In a test, the scan runs with
 `kit.runJob(FILE_SCAN_JOB)` and a `scanner` passed to `testKit` (`references/tests.md`); the generated tests pass their
 own seeded files.
@@ -401,7 +402,8 @@ the transaction that deletes the row. The file is never copied; the sweep delete
 ## Storage
 
 On Zerops, declare one `object-storage` service in `fabrika.config.ts`; the platform writes `FABRIKA_APP_STORAGE_*`
-from it. Never read those variables, build a storage URL or import an S3 client.
+from it. Never read those variables, build a storage URL or import an S3 client. On Cloudflare the platform binds the
+environment's R2 bucket itself; declare nothing.
 
 ```text
 // in the services of fabrika.config.ts

package/skill/references/jobs.md

@@ -144,6 +144,15 @@ export const contract = app.contract((c) => ({
 - A job may also declare `kicks` (another job; the edges never form a cycle), `signs` (`ctx.tokens.sign`),
   `egress` (the HTTPS origins its `fetch` calls) and `issues` (`references/endpoint.md`). `ctx.url('<endpoint id>', …)`
   builds an absolute link to one of the application's procedures, for an e-mail.
+- A job that calls the websites its operators enter (a crawler, an auditor) declares `egress: 'public'`:
+  `app.cron('*/5 * * * *', { actions: ['sites.read'], egress: 'public' })`. Its `fetch` reaches any public host over
+  HTTPS or HTTP on the default port. It is refused (`capability_refused: refused_egress`) for an IP address, a name of
+  one label (`localhost`, an internal service), a name under `.local`, `.internal`, `.workers.dev`, `.zerops.app` and similar, a port,
+  the installation's own hosts (IAM, Control, Operations, every application's domain) and, on Bun (Zerops), a name
+  that resolves to a private address. Every redirect is checked again: `redirect: 'manual'` gets the redirect, the default
+  follows at most 10. A request has 60 s, a response body at most 16 MiB (`oversized_egress`); pass `ctx.signal`, or
+  `AbortSignal.any([ctx.signal, AbortSignal.timeout(8_000)])` for a shorter bound per page. The approver reviews it
+  closely, as reach to anywhere public. Keep the sites operators enter in a table the job reads.
 - `ctx.signal` aborts when the attempt ends (its timeout, a lost lease). Call `ctx.signal.throwIfAborted()` before
   each external effect and pass the signal to `fetch`, so a stale attempt starts nothing after its replacement.
 - A failed attempt names its failure in `kit.runJob`'s answer and the log: `handler_failed`, a framework refusal

package/skill/references/table-and-migration.md

@@ -1,7 +1,7 @@
 # references/table-and-migration.md — the vocabulary, migrations and table policies
 
-The order is fixed: the vocabulary, then the migration, then `fabrika db migrate` and `fabrika db codegen`, then the
-table policies, which take the generated `columns`.
+The order is fixed: the vocabulary, then the migration, then `fabrika db migrate` and `fabrika db codegen` (on
+Cloudflare `codegen` only), then the table policies, which take the generated `columns`.
 
 ## The vocabulary
 
@@ -155,6 +155,23 @@ INSERT INTO priorities (code, label, rank) VALUES ('low', 'Low', 1), ('normal',
 - Never edit, rename or delete a committed migration; add a new one. Change a schema by expand, switch, contract, and
   ask before you drop or rename anything.
 
+## On Cloudflare: SQLite migrations
+
+An application on Cloudflare (its `fabrika.config.ts` imports `defineApp` from `@fabrika/provider-cloudflare`) writes
+its migrations in SQLite. Its Durable Object applies them when it boots, each file once in name order, in a transaction
+of its own, so there is no `fabrika db migrate`; `fabrika db codegen` applies them to an in-memory database and needs
+no URL. The rules above for keys, chains, composite foreign keys, `version` and `created_by` hold unchanged, and the
+database enforces foreign keys.
+
+- The declared types codegen reads: `TEXT` (a UUID too), `INTEGER`, `REAL`, `BLOB`; `BOOLEAN`, stored as 0 or 1 and
+  read as a boolean; `TIMESTAMP`, stored as UTC ISO text and read as a `Date`; `DATE`, `YYYY-MM-DD` text. Any other
+  declared type is refused. A `STRICT` table admits only `INTEGER`, `REAL`, `TEXT` and `BLOB`, so a table with a
+  `BOOLEAN`, `TIMESTAMP` or `DATE` column is not `STRICT`.
+- SQLite has no `ENUM`: a column with a fixed set of values is `TEXT` with `CHECK (<column> IN ('a', 'b'))`. The
+  generated tests write its first value.
+- No transaction control (`BEGIN`, `COMMIT`, `SAVEPOINT`) and no Postgres syntax (`timestamptz`, `::` casts,
+  `GENERATED ALWAYS AS IDENTITY`, `CREATE TYPE`).
+
 ## Database code is a declared deviation
 
 A function, trigger, view, rule, policy or `DO` block in a migration is allowed. The migration file declares it, and

package/skill/references/tests.md

@@ -12,7 +12,7 @@ longer writes. Commit them; never edit, format or import them (`generated-test-h
   `app` or `creates` endpoint refuses a holder of its action in one scope only (403) and answers a global holder. An
   endpoint of several `capabilities` adds a denied case per capability. A public procedure answers anyone without a
   credential, or, behind a challenge, refuses a caller without a solved one. A file input is sent as a generated file
-  of its kind; a `GET` procedure's input goes in its URL.
+  of its kind, or as the file the fixtures name (`files`, below); a `GET` procedure's input goes in its URL.
 - Their kit stands in for IAM, as `testKit` does (below): it creates a scope, assigns or invites a member and issues a
   link under IAM's rules for the caller's grants. A repeated invitation answers the open one, `resend` restarts its
   7 days, and an organization's address is refused for an external role (`internal_mailbox`). So the caller of an endpoint with the dimension's `members.manage`
@@ -59,6 +59,35 @@ export const members = { 'api.tasks.assign': ['assignee'] }
   table of the table that owns it, or a table it contains; the checker refuses a row further down
   (`endpoint-fixture`). Without it they send a sample, the handler
   finds no row (404), and the case fails.
+- `appRows['<endpoint id>']` gives the rows of application tables (`scope: { app }`) that the endpoint's handler reads
+  for the caller's own scope, by table, with the columns they need: `export const appRows = { 'portal.guide': { guides:
+  { active: true } } }`. Each of its leak and own-object cases seeds one row of each before it asks and removes them
+  once it is over, with every row that refers to them (a download the handler logged), so a handler that reads the
+  newest guide answers 200 instead of 404, and no other endpoint's case finds the row. A foreign key from one given row
+  to another holds that row's key. A text column may be given; the key, the version, the creator and a file column may
+  not (a file column holds a live, scanned file). Only application tables, and only for an endpoint with a leak or an
+  own-object case: the checker refuses a table in a scope, which `rows` and `seeds` address (`endpoint-fixture`).
+- `files['<endpoint id>']` names, by file field, a file of the repository that every case of the endpoint sends there
+  instead of the generated one, a path from the application's root:
+  `export const files = { 'api.skills.publish': { package: 'src/__tests__/fixtures/skill.zip' } }`. Give one when the
+  handler inspects the content (a package it unpacks, a document it parses) and answers 400 to the generated file, which
+  has only the leading bytes of its type. Commit the file; keep it small and free of real data. The kit sends it with the
+  first type of the field's kind its bytes are, and a file it cannot read, or of none of those types, fails the case. The
+  checker refuses a field that holds no file and a path that leaves the application, starts with `.` or has characters
+  other than letters, digits, `_`, `-`, `.` and `/` (`endpoint-fixture`).
+- `pins['<endpoint id>']` gives text columns of the row the endpoint addresses (the row of the table that owns its
+  dimension) a known value instead of the seed's marker: `export const pins = { 'api.skills.publish': { slug:
+  'published-skill' } }`, when the handler ties the column to the input or to the file in `files` (a package whose
+  `SKILL.md` names the skill's slug). The own scope's row holds the value, the other scope's `<value>-other`, which a
+  leak case still looks for in the own scope's answer. A pin of a column that places the row, or of no text column,
+  fails the case; the checker refuses one of an endpoint without an addressed row (`endpoint-fixture`).
+- `refusals['<endpoint id>']` lists the error types of the 400s the endpoint's handler answers with when its rule ties
+  the row to the input and the scope is the other one: `export const refusals = { 'api.skills.publish':
+  ['skill_frontmatter'] }`, beside the pin above. A leak case asks from the other scope first, whose pinned value the
+  package does not name; that request may answer one of them. The own case passes on 200 or one of them, and the
+  denial cases still expect 404 or 403. The answer a leak case checks, the own scope's, still fails on it, because an
+  answer that holds nothing proves no isolation: pin the row and give the file so that the own scope succeeds. Any
+  other 400 fails the case, and the checker refuses `validation`, an input the schema refuses (`endpoint-fixture`).
 - The endpoint id is `<mount>.<group>.<endpoint>` (`api.tasks.close`).
 - The seed of the tests fills every text column with a marker and every other required column with a sample of its
   type: an enum's first label, `1`, `false`, today. A column with a `DEFAULT` keeps it (`status` is `open`). A column
@@ -196,6 +225,9 @@ if (postgres !== null) {
   `<label> skipped: set FABRIKA_TEST_POSTGRES_URL to run the Postgres-backed tests`, and the file registers no test.
   A skip proves nothing. To confirm a file ran, run it alone (`bun test --isolate src/tasks`) and check that the pass
   count is its number of tests, or set `FABRIKA_TEST_POSTGRES_REQUIRED=1`: a missing URL then fails the file.
+- On Cloudflare import `testDatabase` from `@fabrika/db/testing-sqlite` instead, with the same options: it migrates a
+  fresh in-memory SQLite database as the Durable Object does, needs no URL and never answers `null`. The generated tests
+  already use it.
 - `statusOf(call)` answers 200 when the call resolves and the status of the application's refusal otherwise; any other
   failure (no answer, a bug in the test) is rethrown. Import it beside `testKit`; do not write your own.
 - `kit.testCaller(grants, { kind })` makes a caller: a grant is a role or an action, in one scope or global. A

package/skill/references/webhooks-links-connectors.md

@@ -89,7 +89,7 @@ export const integrations = app.group({ callers: ['human'] }, (r) => ({
   that binds it takes an `app` capability: `access: { action, app: true }`, `binds`, and
   `ctx.webhooks('<webhook>').bind(ctx.app, account)`.
 - `limits: { maxBytes?, timeoutMs? }`: the body is 1 MiB by default and at most 48 MiB; the handler runs 10 s by
-  default, at most 60 s. A webhook may declare `kicks`, `signs`, `egress`, `sql` and `unscoped`, and `ctx.files.put`
+  default, at most 60 s (25 s on Cloudflare). A webhook may declare `kicks`, `signs`, `egress`, `sql` and `unscoped`, and `ctx.files.put`
   stores a file a provider sends (an inbound e-mail's attachment) for a file column: raise `limits.maxBytes` to the
   mail you accept.
 - Not covered: a provider that validates its URL with a `GET`, or that needs a custom answer body.