@fabrika/app 0.9.0-dev.1 → 0.9.0-dev.2

package/types/src/contract/declaration.d.ts

@@ -0,0 +1,303 @@
+import type { CspSource, MailTemplate, RpcCaller } from '@fabrika/auth-core';
+export interface ContractDeclaration<S> {
+    readonly app: string;
+    readonly dimensions: Readonly<Record<string, DimensionDeclaration>>;
+    readonly actions: Readonly<Record<string, string>>;
+    readonly roles: Readonly<Record<string, RoleDeclaration>>;
+    readonly mounts: Readonly<Record<string, MountDeclaration<S>>>;
+    readonly files: Readonly<Record<string, FileKindDeclaration>>;
+    readonly jobs: Readonly<Record<string, CronDeclaration>>;
+    readonly exports: Readonly<Record<string, ExportDeclaration<S>>>;
+    readonly imports: Readonly<Record<string, ImportDeclaration>>;
+    readonly csp: CspDeclaration;
+    /** The token purposes of `defineApp`'s options, by purpose; absent without any. */
+    readonly tokens?: Readonly<Record<string, TokenDeclaration<S>>>;
+    /** A language IAM speaks; `buildArtifact` refuses another value. */
+    readonly locale?: string;
+    readonly displayName?: string;
+    /** Message kind → locale → template; `buildArtifact` refuses an unknown kind or locale and a bad template. */
+    readonly mail?: Readonly<Record<string, Readonly<Record<string, MailTemplate>>>>;
+    /** The actions that manage and list the application's own people. */
+    readonly members?: {
+        readonly manage: string;
+        readonly list: string;
+    };
+    /** `'labels'` only; `buildArtifact` refuses another value, and refuses it without `members`. */
+    readonly directory?: string;
+}
+/**
+ * The keys of the object `defineContract`'s callback returns that are sections, not mounts. Every other key is a
+ * mount. A reader of source splits the object the same way.
+ */
+export declare const SURFACE_SECTIONS: readonly ["files", "jobs", "exports", "imports", "csp", "tokens"];
+export type SurfaceSection = (typeof SURFACE_SECTIONS)[number];
+/**
+ * The option fields each builder takes, and the fields it sets itself. A builder copies only its option fields and
+ * records every other key of its options in `unknownOptions`, so an option can never replace what the builder set;
+ * `buildArtifact` refuses a non-empty `unknownOptions`. A reader of source fills it the same way.
+ */
+export type Builder = 'procedure' | 'rpc' | 'link' | 'spa' | 'webhook' | 'fileKind' | 'cron' | 'export' | 'attachment';
+export interface BuilderFields {
+    readonly options: readonly string[];
+    readonly owned: readonly string[];
+}
+export declare const BUILDER_FIELDS: Readonly<Record<Builder, BuilderFields>>;
+/** The keys of `options` that are not `builder`'s option fields. */
+export declare function unknownOptions(options: object, builder: Builder): string[];
+/**
+ * The off-road fields a site of the staged kit declares beside its builder's options. The kit copies them into
+ * `declared`; `buildArtifact` checks which of them the site may carry.
+ */
+export declare const DECLARED_FIELDS: readonly ["sql", "unscoped", "connect", "issues", "mailer", "kicks", "binds", "signs", "egress"];
+/** The keys of a kit site's `options` that are neither `builder`'s option fields nor a declared field. */
+export declare function kitUnknownOptions(options: object, builder: Builder): string[];
+/**
+ * The reach a site of the staged kit declares, as written (`sql`, `unscoped`, `connect`, `issues`, `mailer`, `kicks`, `binds`, `signs`, `egress`): only the fields
+ * its options carry. Unchecked here: the static reader copies what the source holds, and `buildArtifact` parses it.
+ */
+export interface DeclaredDeclaration {
+    readonly sql?: unknown;
+    readonly unscoped?: unknown;
+    readonly connect?: unknown;
+    readonly issues?: unknown;
+    readonly mailer?: unknown;
+    readonly kicks?: unknown;
+    readonly binds?: unknown;
+    readonly signs?: unknown;
+    readonly egress?: unknown;
+}
+/** The declared fields of a kit site's options, each one only when the options carry it. */
+export declare function declaredOf(options: DeclaredDeclaration): DeclaredDeclaration;
+/** One token purpose as written: its claims schema and its longest lifetime; `buildArtifact` checks both. */
+export interface TokenDeclaration<S> {
+    readonly claims: S;
+    readonly maxDays: unknown;
+}
+/** Option keys outside the builder's option fields; `buildArtifact` refuses any. */
+interface OptionsRecord {
+    readonly unknownOptions?: readonly string[];
+}
+export interface DimensionDeclaration {
+    readonly in?: string;
+    readonly creator?: string;
+    readonly members?: {
+        readonly manage: string;
+        readonly list: string;
+    };
+    /** `'labels'` only; `buildArtifact` refuses another value. */
+    readonly directory?: string;
+}
+export interface RoleDeclaration {
+    readonly grants: readonly string[];
+    readonly member?: {
+        readonly scope: string;
+        readonly assignableBy: readonly string[];
+    };
+    /** `true` only; `buildArtifact` refuses another value, and refuses it on a role without `member`. */
+    readonly external?: boolean;
+}
+export type AccessDeclaration = {
+    readonly member: true;
+} | {
+    readonly action: string;
+    readonly over: string;
+} | {
+    readonly action: string;
+    readonly in: string;
+    readonly from: string;
+} | {
+    readonly action: string;
+    readonly on: string;
+    readonly from: string;
+} | {
+    readonly action: string;
+    readonly creates: string;
+} | {
+    readonly action: string;
+    readonly app: true;
+} | {
+    readonly capabilities: Readonly<Record<string, CapabilityDeclaration>>;
+}
+/** Anyone calls it; its handler runs as the procedure's own workload, with its top-level `actions`. RPC only. */
+ | {
+    readonly public: true;
+};
+/** One of several capabilities: an action in a dimension, listed `over` it or read from an input field. */
+export type CapabilityDeclaration = {
+    readonly action: string;
+    readonly over: string;
+} | {
+    readonly action: string;
+    readonly in: string;
+    readonly from: string;
+} | {
+    readonly action: string;
+    readonly on: string;
+    readonly from: string;
+};
+/**
+ * An export procedure's access: an action in a dimension, never `member`, because the consumer's key holds exactly the
+ * actions, never `app`, because a v1 export declares one dimension, and never several capabilities.
+ */
+export type ExportAccessDeclaration = Exclude<AccessDeclaration, {
+    readonly member: true;
+} | {
+    readonly app: true;
+} | {
+    readonly capabilities: Readonly<Record<string, CapabilityDeclaration>>;
+} | {
+    readonly public: true;
+}>;
+export interface LinkAccessDeclaration {
+    readonly action: string;
+}
+/** `{ public: true }` serves the SPA to anyone, with no session: an anonymous `public-spa` row. */
+export type SpaAccessDeclaration = {
+    readonly member: true;
+} | {
+    readonly action: string;
+    readonly over: string;
+} | {
+    readonly action: string;
+    readonly app: true;
+} | {
+    readonly public: true;
+};
+export type ProcedureType = 'query' | 'mutation';
+export interface ProcedureDeclaration<S, Access = AccessDeclaration> extends OptionsRecord {
+    readonly '~kind': 'procedure';
+    readonly type: ProcedureType;
+    /** `null` when the procedure takes no input. */
+    readonly input: S | null;
+    readonly output: S;
+    readonly access: Access;
+    /** A public procedure's workload actions, as written: all its handler holds. Required there, refused elsewhere. */
+    readonly actions?: unknown;
+    /** `{ origins?, rate?, challenge? }`, as written; `buildArtifact` merges it into the defaults. */
+    readonly admission?: unknown;
+    /** `{ maxBytes?, timeoutMs? }`, as written; `buildArtifact` checks each against its ceiling. */
+    readonly limits?: unknown;
+    /** `{ method?, query?, body?, cache? }`, as written; `buildArtifact` checks the HTTP shape's rules. */
+    readonly http?: unknown;
+    /** What a procedure of the staged kit declares off the paved road; a `defineContract` procedure has none. */
+    readonly declared?: unknown;
+    /**
+     * Set by `describeContract` when the output is an `attachment()`: the procedure answers a file, and its described
+     * `output` is the array of rows the handler returns.
+     */
+    readonly attachment?: AttachmentDeclaration;
+    /** Set by `describeContract` when the output is a `redirect()`: the procedure answers a redirect to `{ to }`. */
+    readonly redirect?: RedirectDeclaration;
+}
+/** The origins a `redirect()` output lists, as written; `buildArtifact` checks each. */
+export interface RedirectDeclaration {
+    readonly origins: readonly string[];
+}
+/**
+ * The file an `attachment()` output declares beside its row schema, as written; `buildArtifact` checks each field and
+ * applies the default `maxRows`.
+ */
+export interface AttachmentDeclaration extends OptionsRecord {
+    readonly format: string;
+    readonly filename: string;
+    readonly maxBytes: number;
+    readonly maxRows?: number;
+}
+/** Procedures by name; a nested object groups them, and the path joins the names with `.`. */
+export interface ProcedureTreeDeclaration<S, Access = AccessDeclaration> {
+    readonly [name: string]: ProcedureDeclaration<S, Access> | ProcedureTreeDeclaration<S, Access>;
+}
+export type MountDeclaration<S> = RpcMountDeclaration<S> | LinkMountDeclaration<S> | SpaMountDeclaration | HealthMountDeclaration | WebhookMountDeclaration<S>;
+export interface RpcMountDeclaration<S> extends OptionsRecord {
+    readonly kind: 'rpc';
+    readonly prefix: string;
+    /** The callers of its credentialed procedures; none when every procedure is public. */
+    readonly callers: readonly RpcCaller[];
+    readonly procedures: ProcedureTreeDeclaration<S>;
+    /** The kit's `c.rpc` options, as written; `buildArtifact` takes `'backward'` and `'unchecked'`. */
+    readonly compatibility?: unknown;
+}
+export interface LinkMountDeclaration<S> extends OptionsRecord {
+    readonly kind: 'link';
+    readonly prefix: string;
+    readonly spa: string;
+    readonly dimension: string;
+    readonly grants: readonly string[];
+    readonly issuedBy: string;
+    readonly maxDays: number;
+    readonly procedures: ProcedureTreeDeclaration<S, LinkAccessDeclaration>;
+}
+export interface SpaMountDeclaration extends OptionsRecord {
+    readonly kind: 'spa';
+    readonly prefix: string;
+    readonly dir: string;
+    readonly access: SpaAccessDeclaration;
+    /** Application variables whose values the mount's pages read from `<prefix>/__fabrika-config.json`. */
+    readonly browserConfig?: readonly string[];
+}
+export interface HealthMountDeclaration {
+    readonly kind: 'health';
+    readonly path: string;
+}
+export interface WebhookMountDeclaration<S> extends OptionsRecord {
+    readonly kind: 'webhook';
+    readonly path: string;
+    /** A preset or a verifier shape, as written; `buildArtifact` checks it. */
+    readonly scheme: unknown;
+    /** A dimension, or `app` for the whole application. */
+    readonly boundTo: string;
+    readonly actions: readonly string[];
+    readonly input: S;
+    /** `{ maxBytes?, timeoutMs? }`, as written; `buildArtifact` checks each against its ceiling. */
+    readonly limits?: unknown;
+    /** What a webhook of the staged kit declares off the paved road. */
+    readonly declared?: unknown;
+}
+/**
+ * A file kind (`c.files({ types, maxBytes, scan? })`, no `owner`): a class of stored files a table's file column holds.
+ * It has no owner, no actions and no endpoint.
+ */
+export interface FileKindDeclaration extends OptionsRecord {
+    readonly kind: 'file-kind';
+    readonly types: readonly string[];
+    readonly maxBytes: number;
+    /** Every file waits `quarantined` until the scan gives it a clean verdict; a byte consumer answers 409 until then. */
+    readonly scan?: boolean;
+}
+export interface CronDeclaration extends OptionsRecord {
+    readonly kind: 'cron';
+    readonly schedule: string;
+    readonly actions: readonly string[];
+    /** `{ timeoutMs? }`, as written; `buildArtifact` checks it against its ceiling. */
+    readonly limits?: unknown;
+    readonly retries?: number;
+    /** What a job of the staged kit declares off the paved road. */
+    readonly declared?: unknown;
+}
+export interface ExportDeclaration<S> extends OptionsRecord {
+    readonly kind: 'export';
+    readonly version: number;
+    readonly consumers: readonly string[];
+    readonly audience: string;
+    readonly procedures: ProcedureTreeDeclaration<S, ExportAccessDeclaration>;
+}
+export interface ImportDeclaration {
+    readonly app: string;
+    readonly export: string;
+    readonly version: number;
+    readonly digest: string;
+    readonly procedures: readonly string[];
+    readonly usedBy: readonly string[];
+    readonly timeoutMs?: number;
+}
+export interface CspDeclaration {
+    readonly connectSrc?: readonly CspSource[];
+    readonly imgSrc?: readonly CspSource[];
+    readonly frameAncestors?: readonly CspSource[];
+    readonly scriptSrc?: readonly CspSource[];
+    readonly frameSrc?: readonly CspSource[];
+    readonly styleSrc?: readonly CspSource[];
+    readonly fontSrc?: readonly CspSource[];
+}
+export declare function isProcedure<S, Access>(node: ProcedureDeclaration<S, Access> | ProcedureTreeDeclaration<S, Access>): node is ProcedureDeclaration<S, Access>;
+export {};

package/types/src/contract/defaults.d.ts

@@ -0,0 +1,208 @@
+import type { BodyAdmission, ChallengeProvider } from '@fabrika/auth-core';
+export declare const CONTRACT_DEFAULTS: {
+    /** A failed job run is not retried unless the job asks for it: a retry repeats work. */
+    readonly jobRetries: 0;
+    readonly importTimeoutMs: null;
+};
+/**
+ * A procedure's bounds: its body (`maxBytes`, without files) and its handler's time (`timeoutMs`, counted after the last
+ * body byte), each with its default and its ceiling, and the most calls a bucket admits per minute.
+ */
+export declare const PROCEDURE_LIMITS: {
+    readonly maxBytes: number;
+    readonly maxMaxBytes: number;
+    readonly timeoutMs: 10000;
+    readonly maxTimeoutMs: 60000;
+    readonly maxPerMinute: 10000;
+    readonly maxBytesPerHour: number;
+    /** The body of a procedure with file fields: its default adds each field's files at its kind's `maxBytes`. */
+    readonly maxFileBodyBytes: number;
+    /** The files one request carries, at most: each field's `.max(n)` together. */
+    readonly maxFiles: 20;
+    /** The headers of one part of a multipart body, at most. */
+    readonly maxPartHeaderBytes: number;
+};
+/**
+ * A procedure with file fields is `multipart/form-data`: its JSON input travels in the first part, named `input`, and
+ * each file in a part named after its field. A field of several files sends one part per file, under its name.
+ */
+export declare const FILE_INPUT_PART = "input";
+/**
+ * A webhook's bounds: a provider's body, by default the most a procedure without files takes, since providers send
+ * whole objects; up to what a procedure with file fields takes, since an inbound e-mail carries its attachments in the
+ * body for the handler to `put`; and its handler's time, a procedure's.
+ */
+export declare const WEBHOOK_LIMITS: {
+    readonly maxBytes: number;
+    readonly maxMaxBytes: number;
+    readonly timeoutMs: 10000;
+};
+/** A job attempt's time limit (`limits.timeoutMs`) and its ceiling, which keeps a lease and a timer within a day. */
+export declare const JOB_LIMITS: {
+    readonly timeoutMs: number;
+    readonly maxTimeoutMs: number;
+};
+/** A public mutation's buckets per minute unless it declares its own: per client and for the endpoint. */
+export declare const PUBLIC_MUTATION_RATE: {
+    readonly perClient: 10;
+    readonly perEndpoint: 100;
+};
+/** What a widget's `action` may be: at most 32 letters, digits, `_` and `-`, what Turnstile admits, and a path segment. */
+export declare const CHALLENGE_ACTION: RegExp;
+/**
+ * The challenge widget's `action` of a public procedure that declares none (`challenge.action`): its endpoint id with
+ * `_` for `.`.
+ */
+export declare function challengeAction(endpoint: string): string;
+/** The input field that carries a challenge token; a procedure with a challenge declares it as a string. */
+export declare const CHALLENGE_FIELD = "challengeToken";
+/** A procedure with file fields reads `multipart/form-data`; the proxy admits that type for its row. */
+export { FORM_MULTIPART_TYPE } from '@fabrika/auth-core';
+/**
+ * Each challenge provider's fixed browser sources: the origins of its widget's script and frame, and `blob:` for workers
+ * when the widget starts its own. ALTCHA's widget is bundled with the page and solves in workers built from `Blob`s.
+ */
+export declare const CHALLENGE_ORIGINS: Readonly<Record<ChallengeProvider, {
+    readonly scriptSrc: readonly string[];
+    readonly frameSrc: readonly string[];
+    readonly workerSrc: readonly string[];
+}>>;
+/**
+ * An ALTCHA challenge: PBKDF2/SHA-256 attempts of `cost` iterations each, counted up to a number drawn per challenge
+ * between `minCounter` and `maxCounter`, so a browser makes that many attempts, about half of `maxCounter` on average.
+ * The draw starts at 1: a solver that knew a higher floor would skip the attempts below it, which the widget makes.
+ * `cost` and `maxAgeMs` are the contract's (`challenge.cost`, `challenge.maxAgeMs`), each with its default and its
+ * bounds, and together they must leave a slow phone time to solve (`altchaSolvable`). The HMAC key is at least
+ * `minKeyLength` characters: every issued challenge publishes a signature a short key could be guessed from. A solved
+ * payload is base64 JSON of the challenge and its solution, at most `maxTokenLength` characters.
+ */
+export declare const ALTCHA_LIMITS: {
+    readonly algorithm: "PBKDF2/SHA-256";
+    readonly cost: 5000;
+    readonly minCost: 1000;
+    readonly maxCost: 18000;
+    readonly minCounter: 1;
+    readonly maxCounter: 10000;
+    readonly maxAgeMs: number;
+    readonly minMaxAgeMs: 60000;
+    readonly maxMaxAgeMs: number;
+    readonly maxTokenLength: 4096;
+    readonly minKeyLength: 32;
+    /** What a slow phone's widget runs over its workers, PBKDF2 iterations a second: the rate the worst case is sized by. */
+    readonly slowIterationsPerSecond: 2000000;
+    /** How long the widget tries before it gives up. */
+    readonly solveTimeoutMs: 90000;
+};
+/** How long a slow phone takes for the worst draw of a challenge of `cost`, in ms. */
+export declare function altchaWorstSolveMs(cost: number): number;
+/** Whether a slow phone solves the worst draw before the widget gives up and within half the challenge's lifetime. */
+export declare function altchaSolvable(cost: number, maxAgeMs: number): boolean;
+/**
+ * The `action` a procedure's challenge expects back: the declared one, else the endpoint id with `_` for `.`. The build
+ * and the typed client both read it here, so the client's challenge path is the artifact's.
+ */
+export declare function declaredChallengeAction(endpoint: string, declared: unknown): string;
+/** Where an ALTCHA challenge is issued: one path per procedure, under its action. */
+export declare const CHALLENGE_PREFIX = "/__fabrika/challenge";
+export declare function challengePath(action: string): string;
+/** The endpoint id of the row that issues the challenge of public procedure `endpoint`. */
+export declare function challengeRowId(endpoint: string): string;
+/**
+ * The buckets per minute of the endpoint that issues a challenge: a visitor fetches one per form shown and one more per
+ * expiry, and every issue costs the server one attempt's work. Each is at least this, and at least twice the
+ * procedure's own bucket, so the issuer never admits fewer submissions than the procedure declares. A bucket the
+ * procedure turns off (`null`) is this one on the issuer: the procedure's handler may be cheap, the issue never is.
+ */
+export declare const CHALLENGE_ISSUE_RATE: {
+    readonly perClient: 30;
+    readonly perEndpoint: 600;
+};
+/** The issuer's bucket for the procedure's `own`, within the ceiling of every bucket. */
+export declare function challengeIssueBucket(own: number | null, floor: number): number;
+/**
+ * The bounds of a file kind: the largest file a `scan: true` kind admits (the scanner reads at most this much of one
+ * file, so a larger one could never be given a clean verdict).
+ */
+export declare const FILE_LIMITS: {
+    readonly maxScannedBytes: number;
+    /** Sniffable types a `scan: true` kind refuses: archives other than ZIP, whose contents the framework does not check. */
+    readonly unscannedTypes: readonly string[];
+};
+/**
+ * The bounds of an `attachment()` output. `maxBytes` and `maxRows` are each attachment's own, at most these; a cell holds
+ * at most `maxCellLength` UTF-16 code units, the most a spreadsheet cell keeps.
+ */
+export declare const ATTACHMENT_LIMITS: {
+    readonly maxBytes: number;
+    readonly maxRows: 100000;
+    readonly defaultMaxRows: 10000;
+    readonly maxCellLength: 32767;
+};
+/** The type each attachment format answers with. */
+export declare const CSV_CONTENT_TYPE = "text/csv; charset=utf-8";
+export declare const XLSX_CONTENT_TYPE = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
+/** Export procedures are served here, one path per procedure, and each export's description at its own path. */
+export { CONNECT_PREFIX } from '@fabrika/auth-core';
+/**
+ * Every connector call has a deadline; it bounds the retries too. Queries are safe to retry. An answer and a
+ * description are read under a byte budget, so another application cannot make the consumer buffer without bound.
+ */
+export declare const CONNECT_LIMITS: {
+    readonly defaultTimeoutMs: 3000;
+    readonly maxTimeoutMs: 10000;
+    readonly retries: 2;
+    readonly maxAnswerBytes: number;
+    readonly maxDescriptionBytes: number;
+};
+/** `products` version 1 → `products.v1`: the description's endpoint id, and the prefix of each procedure's. */
+export declare function exportBase(name: string, version: number): string;
+/** A link mount serves its procedures under `<prefix>/api`; everything else under the prefix is its SPA. */
+export declare const LINK_API_SEGMENT = "api";
+/** The path segment a webhook appends for the binding a delivery addresses. */
+export declare const WEBHOOK_BINDING_PARAMETER = "bindingId";
+/**
+ * The share SPA's bootstrap, served by the framework under the link prefix and loaded before any other script: it
+ * takes the key out of the URL fragment and keeps it in a closure behind `SHARE_KEY_GLOBAL`.
+ */
+export declare const LINK_BOOTSTRAP_FILE = "__fabrika-share.js";
+export declare const SHARE_KEY_GLOBAL = "__fabrikaShareKey";
+/** What every `c.spa` mount serves under its prefix: the browser's Operations DSN and the release, as JSON. */
+export declare const BROWSER_CONFIG_FILE = "__fabrika-config.json";
+/** What every `c.spa` mount serves under its prefix to the person its access admitted: label, mailbox and actions. */
+export declare const PAGE_CALLER_FILE = "__fabrika-me.json";
+/** The row of an SPA mount's bare prefix (`GET /admin`), which redirects to the mount (`/admin/`). */
+export declare function spaPrefixRowId(mount: string): string;
+/**
+ * The value a generated endpoint access case sends in an input field that names a member the handler looks up
+ * (`members` of `endpoint-access.fixtures.ts`); the endpoint access kit replaces it with a real member of the directory.
+ */
+export declare const GENERATED_MEMBER = "fabrika:member";
+/**
+ * The value a generated endpoint access case sends in an input field that names an invitation the handler cancels
+ * (`invitations` of `endpoint-access.fixtures.ts`); the endpoint access kit replaces it with one open in the target's value.
+ */
+export declare const GENERATED_INVITATION = "fabrika:invitation";
+/**
+ * The value a generated endpoint access case sends in an input field that names a share link the handler revokes
+ * (`links` of `endpoint-access.fixtures.ts`); the endpoint access kit replaces it with one the case's caller issued.
+ */
+export declare const GENERATED_LINK = "fabrika:link";
+/**
+ * The prefix of the value a generated endpoint access case sends in an input field that names a row lying in its object
+ * (`rows` of `endpoint-access.fixtures.ts`), followed by the row's table: `fabrika:row:note_comments`. The endpoint
+ * access kit seeds one such row in each scope's object and sends that scope's key.
+ */
+export declare const GENERATED_ROW_PREFIX = "fabrika:row:";
+/**
+ * The prefix of the value a generated endpoint access case sends in a file field, followed by the field's file kind:
+ * `fabrika:file:attachments`. The endpoint access kit sends a small file of the kind's first type it can write in its place.
+ */
+export declare const GENERATED_FILE_PREFIX = "fabrika:file:";
+export declare const JSON_ADMISSION: BodyAdmission;
+/** `/api` + `notes.list` → `/api/notes.list`; a root prefix does not double the `/`. */
+export declare function joinPath(prefix: string, rest: string): string;
+/**
+ * The path of an RPC mount's procedure: its own `http.path` when it declares one (a public procedure only, which
+ * `buildArtifact` checks), else `<prefix>/<dotted.path>`. The typed client calls the path the artifact's row carries.
+ */
+export declare function procedurePath(prefix: string, dotted: string, http: unknown): string;