@fabrika/db 0.6.0 → 0.7.0

package/src/policy.ts

@@ -4,6 +4,7 @@ import {
 	hasOwn,
 	inSet,
 	isArray,
+	isSafeInteger,
 	type NameSet,
 	nameSet,
 	namesOf,
@@ -46,16 +47,24 @@ export interface ApplicationScope<Col extends string> {
 	readonly key?: Col
 }
 
-export interface InboxScope<A extends string> {
-	readonly inbox: string
-	readonly read: A
-}
+/** One action, or a list of them: a table that staff and a public procedure both read names both actions. */
+export type TableAction<A extends string> = A | readonly A[]
 
 export interface TableActions<A extends string> {
-	readonly read: A
-	readonly insert?: A
-	readonly update?: A
-	readonly delete?: A
+	readonly read: TableAction<A>
+	readonly insert?: TableAction<A>
+	readonly update?: TableAction<A>
+	readonly delete?: TableAction<A>
+}
+
+/**
+ * A queue table's columns (ADR-0060's drain): `due` is when a row is next claimed, `null` once it is done; `attempts`
+ * counts its claims, and a row with `maxAttempts` (default 10) of them is no longer claimed.
+ */
+export interface QueuePolicy<Col extends string> {
+	readonly attempts: Col
+	readonly due: Col
+	readonly maxAttempts?: number
 }
 
 /**
@@ -75,8 +84,18 @@ interface WritablePolicy<Col extends string, A extends string, V extends Col, Ac
 	readonly version?: V
 	readonly createdBy?: Col
 	readonly columns?: ColumnPolicies<Col, A>
+	/** A queue table: its rows are claimed (`claim`) and finished through `row.ref`; it needs `version` and an update action. */
+	readonly queue?: QueuePolicy<Col>
+	/**
+	 * The file columns, each with the file kind it holds: a `uuid` foreign key to `fabrika_files`, written only with a
+	 * file reference. The table's actions are the file's authority.
+	 */
+	readonly files?: FilePolicies<Col>
 }
 
+/** A table's file columns: column → the name of a file kind of the contract (`c.files`). */
+export type FilePolicies<Col extends string> = { readonly [C in Col]?: string }
+
 /**
  * A column's own actions. `read`: only a capability of exactly that action reads, filters or sorts by the column;
  * without one it falls back to the table's read action. `write`: only a capability of that action updates the column,
@@ -90,7 +109,7 @@ export interface ColumnPolicy<A extends string> {
 	readonly write?: A
 }
 
-/** A table no handler writes (a reference or an inbox) declares column read actions only. */
+/** A table no handler writes (a reference table) declares column read actions only. */
 export type ColumnReadPolicies<Col extends string, A extends string> = { readonly [C in Col]?: { readonly read: A } }
 
 export interface DimensionPolicy<Col extends string, A extends string, V extends Col = Col> extends WritablePolicy<Col, A, V, RecordActions<A>> {
@@ -113,17 +132,14 @@ interface ReadOnlyPolicy<Col extends string, A extends string> {
 	readonly update?: never
 	readonly version?: never
 	readonly createdBy?: never
+	readonly queue?: never
+	readonly files?: never
 	readonly columns?: ColumnReadPolicies<Col, A>
 }
 
 export interface ReferencePolicy<Col extends string, A extends string> extends ReadOnlyPolicy<Col, A> {
 	readonly scope: ReferenceScope
-	readonly actions: { readonly read: A }
-}
-
-export interface InboxPolicy<Col extends string, A extends string> extends ReadOnlyPolicy<Col, A> {
-	readonly scope: InboxScope<A>
-	readonly actions?: never
+	readonly actions: { readonly read: TableAction<A> }
 }
 
 /** The columns a version can live in: those whose generated select type is `number`, an INTEGER (int4). */
@@ -158,20 +174,29 @@ export type ScopeModel =
 	| { readonly mode: 'dimension'; readonly dimension: string; readonly key: string; readonly container: Container | undefined }
 	| { readonly mode: 'child'; readonly parent: string; readonly key: string; readonly column: string; readonly inherit: readonly string[] }
 	| { readonly mode: 'reference'; readonly reason: string }
-	| { readonly mode: 'inbox'; readonly form: string }
 	| { readonly mode: 'app'; readonly reason: string; readonly key: string }
 
+/** Each operation's actions: any one of them allows it. `read` names at least one; an empty list allows no operation. */
 export interface ActionModel {
-	readonly read: string
-	readonly insert: string | undefined
-	readonly update: string | undefined
-	readonly delete: string | undefined
+	readonly read: readonly string[]
+	readonly insert: readonly string[]
+	readonly update: readonly string[]
+	readonly delete: readonly string[]
 	/** A dimension or child table's actions besides `read` with which an `app` endpoint reads every row, read-only. */
 	readonly appRead: readonly string[]
 	/** A dimension or child table's actions with which an `app` endpoint counts and aggregates every row, and reads none. */
 	readonly appCount: readonly string[]
 }
 
+export interface QueueModel {
+	readonly attempts: string
+	readonly due: string
+	readonly maxAttempts: number
+}
+
+/** How many claims a queue row takes before it is no longer claimed, unless its policy states `maxAttempts`. */
+export const DEFAULT_MAX_ATTEMPTS = 10
+
 /** One table's policy, checked against its column list. */
 export interface TableModel {
 	readonly name: string
@@ -179,12 +204,15 @@ export interface TableModel {
 	readonly actions: ActionModel
 	/** Every column the table has. */
 	readonly columns: NameSet
-	/** The columns the table's read action reads, in column-list order. */
+	/** The columns every read action of the table reads, in column-list order. */
 	readonly visible: readonly string[]
 	readonly insert: NameSet
 	readonly update: NameSet
 	readonly version: string | undefined
 	readonly createdBy: string | undefined
+	readonly queue: QueueModel | undefined
+	/** The file columns, each with its file kind: a reference to `fabrika_files`, written only with a file reference. */
+	readonly files: Readonly<Record<string, string>>
 	/** The columns that declare their own read action, as declared (also those equal to the table's). */
 	readonly columnReads: Readonly<Record<string, string>>
 	/** The columns that declare their own write action: only a capability of it updates them. */
@@ -241,15 +269,6 @@ export function tableModels<DB, P>(tables: Tables<DB, P>): TableModels {
 	return readModels(tables)
 }
 
-/**
- * The same policies without the forms' inbox tables: what a contract that serves no form compiles against. A form's
- * inbox is reached by its form only, so no other table's policy names one.
- */
-export function withoutInboxes<DB, P>(tables: Tables<DB, P>): Tables<DB, P> {
-	const models = readModels(tables)
-	return new Tables(Object.freeze(Object.fromEntries(Object.entries(models).filter(([, model]) => model.scope.mode !== 'inbox'))))
-}
-
 /** Whether `value` is what `defineTables` returned, rather than another form of the same policies. */
 export function isTables<DB, P, Other extends object>(value: Tables<DB, P> | Other): value is Tables<DB, P> {
 	return hasModels(value)
@@ -325,14 +344,14 @@ function parseVocabulary(input: unknown): VocabularyModel {
 
 const COLUMN_LIST_FIELDS = nameSet(['columns', 'foreignKeys', 'dates', 'timestamps'])
 const FOREIGN_KEY_FIELDS = nameSet(['columns', 'table', 'references'])
-const POLICY_FIELDS = nameSet(['scope', 'actions', 'insert', 'update', 'version', 'createdBy', 'columns'])
+const POLICY_FIELDS = nameSet(['scope', 'actions', 'insert', 'update', 'version', 'createdBy', 'columns', 'queue', 'files'])
+const QUEUE_FIELDS = nameSet(['attempts', 'due', 'maxAttempts'])
 const ACTION_FIELDS = nameSet(['read', 'insert', 'update', 'delete', 'appRead', 'appCount'])
 const DIMENSION_FIELDS = nameSet(['dimension', 'key', 'in'])
 const CONTAINER_FIELDS = nameSet(['dimension', 'column'])
 const CHILD_FIELDS = nameSet(['child', 'key', 'column', 'inherit'])
 const REFERENCE_FIELDS = nameSet(['reference'])
 const APPLICATION_FIELDS = nameSet(['app', 'key'])
-const INBOX_FIELDS = nameSet(['inbox', 'read'])
 const COLUMN_FIELDS = nameSet(['read', 'write'])
 
 /** A copy of a plain object's own data properties; anything else (an instance, a symbol key, an accessor) is refused. */
@@ -475,7 +494,8 @@ function parseTable(table: string, columnList: unknown, policyInput: unknown, vo
 		if (readInput !== undefined) {
 			const read = action(readInput, `columns.${name}.read`)
 			setOwn(columnReads, name, read)
-			if (read !== actions.read) {
+			// With several read actions, a column of one of them is hidden from the others.
+			if (actions.read.length > 1 || !includes(actions.read, read)) {
 				restricted[restricted.length] = name
 			}
 		}
@@ -493,15 +513,21 @@ function parseTable(table: string, columnList: unknown, policyInput: unknown, vo
 		throw new PolicyError(`${table}: the version ${version} takes no action of its own`)
 	}
 	const writable = scope.mode === 'dimension' || scope.mode === 'child' || scope.mode === 'app'
+	const queueInput = ownEntry(policy, 'queue')
+	const filesInput = ownEntry(policy, 'files')
 	if (
 		!writable
 		&& (namesOf(insert).length > 0 || namesOf(update).length > 0 || version !== undefined || createdBy !== undefined
-			|| ownKeys(columnWrites).length > 0)
+			|| ownKeys(columnWrites).length > 0 || queueInput !== undefined || filesInput !== undefined)
 	) {
 		throw new PolicyError(`${table}: a ${scope.mode} table is never written by a handler`)
 	}
 	const dates = parseColumnSet(table, ownEntry(entry, 'dates'), column, 'dates')
 	const timestamps = parseColumnSet(table, ownEntry(entry, 'timestamps'), column, 'timestamps')
+	const queue = queueInput === undefined
+		? undefined
+		: parseQueue(table, queueInput, column, { columns, timestamps, version, actions, update, columnWrites })
+	const files = filesInput === undefined ? freeze({}) : parseFileColumns(table, filesInput, column, { scope, version, createdBy, queue })
 	const visible: string[] = []
 	for (let index = 0; index < columnNames.length; index++) {
 		const name = columnNames[index] ?? ''
@@ -519,6 +545,8 @@ function parseTable(table: string, columnList: unknown, policyInput: unknown, vo
 		update,
 		version,
 		createdBy,
+		queue,
+		files,
 		columnReads: freeze(columnReads),
 		columnWrites: freeze(columnWrites),
 		dates,
@@ -527,6 +555,57 @@ function parseTable(table: string, columnList: unknown, policyInput: unknown, vo
 	}
 }
 
+/**
+ * The file columns: each names a column that holds data, never one the layer stamps (the key, the version, the
+ * creator, a queue's), with a file kind's name. The kind is the contract's, which the contract's build checks.
+ */
+function parseFileColumns(
+	table: string,
+	input: unknown,
+	column: (name: unknown, field: string) => string,
+	stamped: {
+		readonly scope: ParsedScope
+		readonly version: string | undefined
+		readonly createdBy: string | undefined
+		readonly queue: QueueModel | undefined
+	},
+): Readonly<Record<string, string>> {
+	const files = plainRecord(input, `${table}: files`)
+	const names = ownKeys(files)
+	if (names.length === 0) {
+		throw new PolicyError(`${table}: files declares no column; remove it or name a column and its file kind`)
+	}
+	const scope = stamped.scope
+	const layerColumns: string[] = []
+	if (scope.mode === 'dimension' || scope.mode === 'child' || scope.mode === 'app') {
+		layerColumns[layerColumns.length] = scope.key
+	}
+	if (scope.mode === 'dimension' && scope.container !== undefined) {
+		layerColumns[layerColumns.length] = scope.container.column
+	}
+	if (scope.mode === 'child' && scope.column !== undefined) {
+		layerColumns[layerColumns.length] = scope.column
+	}
+	for (const name of [stamped.version, stamped.createdBy, stamped.queue?.attempts, stamped.queue?.due]) {
+		if (name !== undefined) {
+			layerColumns[layerColumns.length] = name
+		}
+	}
+	const parsed: Record<string, string> = {}
+	for (let index = 0; index < names.length; index++) {
+		const name = column(names[index], 'files')
+		if (includes(layerColumns, name)) {
+			throw new PolicyError(`${table}: files names ${name}, which the layer writes itself; a file column holds a file reference`)
+		}
+		const kind = ownEntry(files, name)
+		if (typeof kind !== 'string' || !isPlainIdentifier(kind)) {
+			throw new PolicyError(`${table}: files.${name} names no file kind (allowed: the name of a c.files({ … }) kind of the contract)`)
+		}
+		setOwn(parsed, name, kind)
+	}
+	return freeze(parsed)
+}
+
 /**
  * A column's own write action takes the column away from the table's update action: one action writes a column, so
  * the column is not in `update`, and the action is not the update action (that one lists the column in `update`).
@@ -537,12 +616,63 @@ function columnWrite(table: string, name: string, write: string, actions: Action
 			`${table}: ${name} is in update, which the table's update action writes, and declares its own write action ${write}; remove it from update`,
 		)
 	}
-	if (write === actions.update) {
+	if (includes(actions.update, write)) {
 		throw new PolicyError(`${table}: columns.${name}.write names ${write}, the table's update action; list ${name} in update instead`)
 	}
 	return write
 }
 
+/**
+ * The queue's columns are written by the layer only: a claim counts `attempts` and moves `due`, `done: true` clears
+ * `due`, and `requeue` sets both. An insert may set `due` (a reminder's time); nothing else names either.
+ */
+function parseQueue(
+	table: string,
+	input: unknown,
+	column: (name: unknown, field: string) => string,
+	policy: {
+		readonly columns: NameSet
+		readonly timestamps: NameSet
+		readonly version: string | undefined
+		readonly actions: ActionModel
+		readonly update: NameSet
+		readonly columnWrites: Readonly<Record<string, string>>
+	},
+): QueueModel {
+	const queue = plainRecord(input, `${table}: queue`)
+	onlyFields(queue, QUEUE_FIELDS, `${table}: queue`)
+	const attempts = column(ownEntry(queue, 'attempts'), 'queue.attempts')
+	const due = column(ownEntry(queue, 'due'), 'queue.due')
+	if (attempts === due) {
+		throw new PolicyError(`${table}: queue.attempts and queue.due name one column, ${due}; they need two`)
+	}
+	if (!inSet(policy.timestamps, due)) {
+		throw new PolicyError(`${table}: queue.due names ${due}, which is not a timestamp column; a claim moves it by the backoff`)
+	}
+	const maxInput = ownEntry(queue, 'maxAttempts')
+	if (maxInput !== undefined && (typeof maxInput !== 'number' || !isSafeInteger(maxInput) || maxInput < 1)) {
+		throw new PolicyError(`${table}: queue.maxAttempts must be a positive integer`)
+	}
+	if (policy.version === undefined) {
+		throw new PolicyError(`${table}: a queue table needs a version column; a claimed row is finished with expectVersion`)
+	}
+	if (policy.actions.update.length === 0) {
+		throw new PolicyError(`${table}: a queue table needs an update action; claim and requeue need it`)
+	}
+	// A claimed row answers its new version as `version` and its capability as `ref`, beside its columns.
+	if (inSet(policy.columns, 'ref') || (inSet(policy.columns, 'version') && policy.version !== 'version')) {
+		throw new PolicyError(`${table}: a queue table has no column named ref, nor version unless it is the version column; a claimed row carries both`)
+	}
+	const owned: readonly (readonly [string, string])[] = [[attempts, 'queue.attempts'], [due, 'queue.due']]
+	for (let index = 0; index < owned.length; index++) {
+		const [name, field] = owned[index] ?? ['', '']
+		if (inSet(policy.update, name) || hasOwn(policy.columnWrites, name)) {
+			throw new PolicyError(`${table}: ${name} is ${field}, which the layer writes; remove it from update and its write action`)
+		}
+	}
+	return freeze({ attempts, due, maxAttempts: maxInput === undefined ? DEFAULT_MAX_ATTEMPTS : maxInput })
+}
+
 /** The column list's `date` (`dates`) or timestamp (`timestamps`) columns, each one of the table's. */
 function parseColumnSet(table: string, input: unknown, column: (name: unknown, field: string) => string, field: string): NameSet {
 	if (input === undefined) {
@@ -560,7 +690,7 @@ function parseColumnSet(table: string, input: unknown, column: (name: unknown, f
  * columns that declare it as their own write action for any other; none for an action that writes nothing here.
  */
 export function updatableBy(model: TableModel, action: string): NameSet {
-	if (action === model.actions.update) {
+	if (includes(model.actions.update, action)) {
 		return model.update
 	}
 	const names = ownKeys(model.columnWrites)
@@ -577,7 +707,7 @@ export function updatableBy(model: TableModel, action: string): NameSet {
 /** Whether the table names `action`: one of its table actions, or a column's own write action. */
 export function namesAction(model: TableModel, action: string): boolean {
 	const { read, insert, update, delete: remove } = model.actions
-	if (action === read || action === insert || action === update || action === remove) {
+	if (includes(read, action) || includes(insert, action) || includes(update, action) || includes(remove, action)) {
 		return true
 	}
 	const columns = ownKeys(model.columnWrites)
@@ -608,7 +738,10 @@ export function visibleFor(model: TableModel, action: string): readonly string[]
 
 /** Every action that updates a column of `model`: its update action and each column's own write action. */
 export function updateActions(model: TableModel): readonly string[] {
-	const actions: string[] = model.actions.update === undefined ? [] : [model.actions.update]
+	const actions: string[] = []
+	for (let index = 0; index < model.actions.update.length; index++) {
+		actions[actions.length] = model.actions.update[index] ?? ''
+	}
 	const names = ownKeys(model.columnWrites)
 	for (let index = 0; index < names.length; index++) {
 		const write = model.columnWrites[names[index] ?? '']
@@ -672,15 +805,16 @@ function parseScope(table: string, scope: Readonly<Record<string, unknown>>, col
 		return freeze({ mode: 'reference', reason: nonEmpty(table, ownEntry(scope, 'reference'), 'scope.reference') })
 	}
 	if (hasOwn(scope, 'inbox')) {
-		onlyFields(scope, INBOX_FIELDS, what)
-		return freeze({ mode: 'inbox', form: nonEmpty(table, ownEntry(scope, 'inbox'), 'scope.inbox') })
+		throw new PolicyError(
+			`${table}: the inbox scope was removed; declare an application table, scope: { app: '<why>' }, that a public procedure inserts into`,
+		)
 	}
 	if (hasOwn(scope, 'app')) {
 		onlyFields(scope, APPLICATION_FIELDS, what)
 		return freeze({ mode: 'app', reason: nonEmpty(table, ownEntry(scope, 'app'), 'scope.app'), key: key() })
 	}
 	throw new PolicyError(
-		`${what} takes one mode: { dimension, key?, in? }, { child, key?, column?, inherit? }, { app, key? }, { reference } or { inbox, read }`,
+		`${what} takes one mode: { dimension, key?, in? }, { child, key?, column?, inherit? }, { app, key? } or { reference }`,
 	)
 }
 
@@ -720,29 +854,22 @@ function parseActions(
 	actionsInput: unknown,
 	action: (value: unknown, field: string) => string,
 ): ActionModel {
-	if (hasOwn(scope, 'inbox')) {
-		if (actionsInput !== undefined) {
-			throw new PolicyError(`${table}: an inbox table takes its read action as scope.read and no actions; only its form appends`)
-		}
-		return freeze({
-			read: action(ownEntry(scope, 'read'), 'scope.read'),
-			insert: undefined,
-			update: undefined,
-			delete: undefined,
-			appRead: freeze([]),
-			appCount: freeze([]),
-		})
-	}
 	if (actionsInput === undefined) {
 		throw new PolicyError(`${table}: the policy needs actions`)
 	}
 	const actions = plainRecord(actionsInput, `${table}: actions`)
 	onlyFields(actions, ACTION_FIELDS, `${table}: actions`)
-	const optional = (field: 'insert' | 'update' | 'delete') => {
+	const operation = (field: 'read' | 'insert' | 'update' | 'delete'): readonly string[] => {
 		const value = ownEntry(actions, field)
-		return value === undefined ? undefined : action(value, `actions.${field}`)
+		if (value === undefined && field !== 'read') {
+			return freeze([])
+		}
+		if (!isArray(value)) {
+			return freeze([action(value, `actions.${field}`)])
+		}
+		return distinctActions(table, value, `actions.${field}`, action)
 	}
-	const read = action(ownEntry(actions, 'read'), 'actions.read')
+	const read = operation('read')
 	const records = hasOwn(scope, 'dimension') || hasOwn(scope, 'child')
 	const kind = hasOwn(scope, 'app') ? 'an application table' : 'a reference table'
 	const reach = (field: 'appRead' | 'appCount'): readonly string[] => {
@@ -753,25 +880,17 @@ function parseActions(
 		if (!records) {
 			throw new PolicyError(`${table}: actions.${field} is for a dimension or child table; ${kind} takes none`)
 		}
-		const names = parseList(input, (value) => action(value, `actions.${field}`))
-		if (names === undefined) {
+		if (!isArray(input)) {
 			throw new PolicyError(`${table}: actions.${field} takes a plain array of actions`)
 		}
-		if (names.length === 0) {
-			throw new PolicyError(`${table}: actions.${field} lists no action; leave it out`)
-		}
+		const names = distinctActions(table, input, `actions.${field}`, action)
 		for (let index = 0; index < names.length; index++) {
 			const name = names[index] ?? ''
-			if (name === read) {
+			if (includes(read, name)) {
 				throw new PolicyError(`${table}: actions.${field} names ${name}, its read action, which reads every row app-wide already`)
 			}
-			for (let earlier = 0; earlier < index; earlier++) {
-				if (names[earlier] === name) {
-					throw new PolicyError(`${table}: actions.${field} names ${name} twice`)
-				}
-			}
 		}
-		return freeze(names)
+		return names
 	}
 	const appRead = reach('appRead')
 	const appCount = reach('appCount')
@@ -781,7 +900,26 @@ function parseActions(
 			throw new PolicyError(`${table}: actions.appRead and actions.appCount both name ${name}`)
 		}
 	}
-	return freeze({ read, insert: optional('insert'), update: optional('update'), delete: optional('delete'), appRead, appCount })
+	return freeze({ read, insert: operation('insert'), update: operation('update'), delete: operation('delete'), appRead, appCount })
+}
+
+/** A plain array of distinct actions of the vocabulary, at least one. */
+function distinctActions(table: string, input: unknown, field: string, action: (value: unknown, field: string) => string): readonly string[] {
+	const names = parseList(input, (value) => action(value, field))
+	if (names === undefined) {
+		throw new PolicyError(`${table}: ${field} takes an action or a plain array of actions`)
+	}
+	if (names.length === 0) {
+		throw new PolicyError(`${table}: ${field} lists no action; leave it out`)
+	}
+	for (let index = 0; index < names.length; index++) {
+		for (let earlier = 0; earlier < index; earlier++) {
+			if (names[earlier] === names[index]) {
+				throw new PolicyError(`${table}: ${field} names ${names[index]} twice`)
+			}
+		}
+	}
+	return freeze(names)
 }
 
 function nonEmpty(table: string, value: unknown, field: string): string {
@@ -794,6 +932,8 @@ function nonEmpty(table: string, value: unknown, field: string): string {
 interface Stamp {
 	readonly column: string
 	readonly role: string
+	/** An insert may set it: a queue row's first due time. */
+	readonly insertable?: true
 }
 
 /** The columns the layer writes itself: the key, every containment link, the version and the creator. */
@@ -814,6 +954,10 @@ function stampsOf(table: ParsedTable, chain: readonly Container[]): readonly Sta
 	if (table.createdBy !== undefined) {
 		stamps[stamps.length] = { column: table.createdBy, role: 'createdBy' }
 	}
+	if (table.queue !== undefined) {
+		stamps[stamps.length] = { column: table.queue.attempts, role: 'queue.attempts' }
+		stamps[stamps.length] = { column: table.queue.due, role: 'queue.due', insertable: true }
+	}
 	return stamps
 }
 
@@ -837,7 +981,7 @@ function checkStamps(table: ParsedTable, chain: readonly Container[]): void {
 				)
 			}
 		}
-		if (inSet(table.insert, stamp.column) || inSet(table.update, stamp.column)) {
+		if ((stamp.insertable !== true && inSet(table.insert, stamp.column)) || inSet(table.update, stamp.column)) {
 			throw new PolicyError(`${table.name}: ${stamp.column} is stamped by the layer; remove it from insert and update`)
 		}
 		if (hasOwn(table.columnWrites, stamp.column)) {
@@ -857,7 +1001,8 @@ function prepend(first: Container, rest: readonly Container[]): readonly Contain
 	return freeze(chain)
 }
 
-function includes(names: readonly string[], name: string): boolean {
+/** Whether `names` holds `name`: an operation's actions, the one way a policy check reads a list. */
+export function includes(names: readonly string[], name: unknown): boolean {
 	for (let index = 0; index < names.length; index++) {
 		if (names[index] === name) {
 			return true
@@ -1132,8 +1277,9 @@ type ScopeOf<P, T> = PolicyOf<P, T> extends { readonly scope: infer S } ? S : ne
 
 export type Operation = 'read' | 'insert' | 'update' | 'delete'
 
+/** The action, or the union of the actions, of operation `Op` on table `T`; `never` when the policy names none. */
 export type ActionOf<P, T, Op extends Operation> = PolicyOf<P, T> extends { readonly actions: infer Acts }
-	? Acts extends { readonly [K in Op]: infer A extends string } ? A
+	? Acts extends { readonly [K in Op]: infer A } ? A extends string ? A : A extends readonly (infer L extends string)[] ? L : never
 	: never
 	: never
 
@@ -1158,7 +1304,8 @@ type TableReadAction<P, T> = PolicyOf<P, T> extends { readonly scope: { readonly
 /** Columns whose own read action is not the table's: no read by the table's read action returns them. */
 type RestrictedColumns<P, T> = [ColumnPoliciesOf<P, T>] extends [never] ? never
 	: {
-		[K in keyof ColumnPoliciesOf<P, T>]: ColumnPoliciesOf<P, T>[K] extends { readonly read: infer R } ? (R extends TableReadAction<P, T> ? never : K)
+		[K in keyof ColumnPoliciesOf<P, T>]: ColumnPoliciesOf<P, T>[K] extends { readonly read: infer R }
+			? ([TableReadAction<P, T>] extends [R] ? never : K)
 			: never
 	}[keyof ColumnPoliciesOf<P, T>]
 

package/src/registry.ts

@@ -2,14 +2,13 @@
 // `store.ts`, which registers and builds the framework's stores, `framework.ts`, which `@fabrika/app` alone imports, and `testing.ts`, which only test
 // files may import.
 
+import type { Admissions } from './admissions'
 import type { Session } from './database'
-import type { FileTables } from './file-tables'
-import type { FormAdmissions, InboxQuota } from './form-admissions'
-import type { FormFiles, HeldFormFiles } from './form-files'
 import type { WebhookTables } from './framework-tables'
 import type { JobLeases } from './job-leases'
 import type { DataAccess } from './orm'
 import type { DataLayerRuntime, TableContext, TableProbe } from './store'
+import type { StoredFiles } from './stored-files'
 
 /**
  * Answers what the framework's access check reads from the database: an object's containers, by dimension. `using` is
@@ -17,29 +16,19 @@ import type { DataLayerRuntime, TableContext, TableProbe } from './store'
  */
 export type Locator = (dimension: string, id: string, using?: Session) => Promise<ReadonlyMap<string, string> | null>
 
-/** What the framework writes itself: a form's inbox row and its own `fabrika_*` tables. Usable once bound. */
+/** What the framework writes itself: its own `fabrika_*` tables. Usable once bound. */
 export interface FrameworkTables {
-	/** Why `fields` of form `form` cannot be appended to an inbox table of this layer; empty when they can. */
-	inboxProblems(form: string, fields: readonly string[]): readonly string[]
-	/**
-	 * Appends one row of `values` (column → value) to the inbox table of `form`, taking one from `quota` in the same
-	 * transaction, and makes the submission's `held` files held in it too; `false`, with nothing written, when the
-	 * bucket is full.
-	 */
-	appendToInbox(form: string, values: Readonly<Record<string, unknown>>, quota: InboxQuota, held?: HeldFormFiles): Promise<boolean>
 	readonly webhooks: WebhookTables
 	readonly jobs: JobLeases
-	/** A form's admission counters and the challenge tokens it accepted. */
-	readonly forms: FormAdmissions
-	/** The files forms received, until the job that drains each inbox attaches them to their owner. */
-	readonly formFiles: FormFiles
+	/** A procedure's admission buckets, the challenge tokens it accepted and its byte budget. */
+	readonly admissions: Admissions
+	/** Every stored file (`fabrika_files`): staged before its object, claimed at its first reference, swept unreferenced. */
+	readonly files: StoredFiles
 }
 
 export interface FrameworkSide {
 	/** Connects the layer once and answers its locator; a second call throws. */
 	bind(runtime: DataLayerRuntime): Locator
-	/** The rows of the file collections' tables; usable once bound. */
-	readonly files: FileTables
 	readonly framework: FrameworkTables
 	/** The untyped handle over one table that `@fabrika/db/testing` hands the isolation tests. */
 	probe(table: string): TableProbe