@substrat-run/adapter-cloudflare 0.159.0 → 0.161.0

package/dist/host.d.ts

@@ -1,12 +1,756 @@
 import type { EntityGrantShape } from '@substrat-run/contracts';
-import { type ExportedBatch, type ExportReadInput, type ImportBatch, type ImportResult, type ImportState, type ManifestImports, type ManifestConnectionLandings, type ImportCursorMoveAt, type ImportCursorMoved, type AttachmentRecord, type UploadLinkView, type BlobStoreHandle, type ImpersonationSessionId, type ConnectionId, type ModuleId, type SystemSwitchOutcome, type SystemScheduleEntry, type PeerGrantsEntry, type EntityHistoryInput, type EventCauseInput, type EventEffectsInput, type EffectsTree, type InvocationEventsInput, type InvocationEvents, type DeadLettersInput, type DeadLetter, type LifecycleFlowInput, type LifecycleFlowResult, type OperationSeriesInput, type OperationSeriesResult, type CauseChain, type EventFacetInput, type EventFacetResult, type HistoryEntry, type Page, type SweepRunsPayload, type DomainEvent, type EntitlementGrant, type EntityRef, type ProjectedConnectionGrant, type ProjectedConnectionKey, type ProjectedIdentityLink, type PermissionKey, type PlatformActorId, type OnBehalfOf, type BecomeCapabilityInput, type BoundedBecomeMint, type BoundedBecomeRevoke, type BoundedUnbind, type BecomeLinkState, type PrincipalBecomeCapabilityInput, type CapabilityExchange, type CapabilityId, type CapabilityFilter, type CapabilityPage, type CapabilityRecord, type MintedCapability, type PrincipalId, type ResolvedIdentity, type QueryScopeInput, type ReadScopeTableInput, type RoleDefinition, type ScopeDumpInput, type ScopeDumpTable, type ScopeDumpPage, type ScopeLineage, type ScopeId, type PlatformRequestEntry, type PlatformRequestFilter, type PlatformRequestId, type ScopeTable, type DenialFilter, type DenialSummary, type PermissionDenial, type ScopeQueryResult, type ScopeTablePage, type TenantId, type TenantStoreHandle, type Coverage, type PeerCoverage, type PeerSwitchOutcome, type VerticalCaller, type LifecycleDelivery, type ScopeLifecycle } from '@substrat-run/contracts';
-import { type RedeemedUploadLink, type UploadLinkRedeemInput, type CarriedAway, type KeptCopy, type LoadMarker, type AppliedMigration, type BlobStoreProvisionInput, type ScopeAttachments, type AttachmentUploadInput, type OpenedAttachment, type ExecutorDeadLetter, type ExecutorDrainReport, type ExecutorHandler, type ExecutorRetryPolicy, type MigrateScopeOutcome, type MigrationFrontier, type ConnectorHandler, type ConnectorOptions, type FetchLike, type SecretBox, type HostAdmin, type ModuleRegistration, type OperationHandler, type PermissionChecker, type ProvisionScopeInput, type ScheduleRegistration, type ScheduleRunReport, type ScopeHost, type ScopeStub, type ScopeStubOptions, type InvokeOptions, type TenantRelationalStore, type TenantStoreProvisionInput, type FreshnessRegistration, type FreshnessReport, type AttachmentExtractor, type AttachmentTextBounds, type JobDriveReport, type JobHandler, type JobRun, type JobRunFilter, type StartJobRunInput, type LiveReadSurface, type SubjectRedactionCounts, type UndrainedEvents, type SwitchOutcome, type SwitchedOff, type SwitchCarryWire, type ConnectorCallRecorder, type ScopeRoleHolder, type DeclaredPermissions } from '@substrat-run/kernel';
+import type { TenantVerdict } from './scope-do.js';
+import { type SystemDoorMoved } from './system-door.js';
+import { type WireFailure, type ExportedBatch, type ExportReadInput, type ImportBatch, type ImportResult, type ImportState, type ManifestImports, type ManifestConnectionLandings, type ImportCursorMoveAt, type ImportCursorMoved, type AttachmentRecord, type UploadLinkView, type BlobStoreHandle, type ImpersonationSession, type ImpersonationSessionId, type ConnectionId, type ModuleId, type SystemSwitchOutcome, type SystemScheduleEntry, type PeerGrantsEntry, type EntityHistoryInput, type EventCauseInput, type EventEffectsInput, type EffectsTree, type InvocationEventsInput, type InvocationEvents, type DeadLettersInput, type DeadLetter, type LifecycleFlowInput, type LifecycleFlowResult, type OperationSeriesInput, type OperationSeriesResult, type CauseChain, type EventFacetInput, type EventFacetResult, type HistoryEntry, type Page, type SweepRunsPayload, type DomainEvent, type EntitlementGrant, type EntityRef, type ProjectedConnectionGrant, type ProjectedConnectionKey, type ProjectedIdentityLink, type PermissionKey, type PlatformActorId, type OnBehalfOf, type BecomeCapabilityInput, type BoundedBecomeMint, type BoundedBecomeRevoke, type BoundedUnbind, type BecomeLinkState, type PrincipalBecomeCapabilityInput, type CapabilityExchange, type CapabilityId, type CapabilityFilter, type CapabilityPage, type CapabilityRecord, type MintedCapability, type PrincipalId, type ResolvedIdentity, type QueryScopeInput, type ReadScopeTableInput, type RoleDefinition, type ScopeDumpInput, type ScopeDumpTable, type ScopeDumpPage, type ScopeLineage, type ScopeId, type PlatformRequestEntry, type PlatformRequestFilter, type PlatformRequestId, type ScopeTable, type DenialFilter, type DenialSummary, type PermissionDenial, type RefusalFilter, type RefusalRecord, type ScopeQueryResult, type ScopeTablePage, type TenantId, type TenantStoreHandle, type Coverage, type PeerCoverage, type PeerSwitchOutcome, type VerticalCaller, type LifecycleDelivery, type ScopeLifecycle, type StoredScopeLifecycle } from '@substrat-run/contracts';
+import { type RedeemedUploadLink, type UploadLinkInspection, type UploadLinkRedeemInput, type CarriedAway, type KeptCopy, type LoadMarker, type AppliedMigration, type BlobStoreProvisionInput, type ScopeAttachments, type AttachmentUploadInput, type OpenedAttachment, type OpenedAttachmentStream, type ExecutorDeadLetter, type ExecutorDrainReport, type ExecutorHandler, type ExecutorRetryPolicy, type MigrateScopeOutcome, type MigrationFrontier, type ConnectorHandler, type ConnectorOptions, type FetchLike, type SecretBox, type HostAdmin, type ModuleRegistration, type OperationHandler, type PermissionChecker, type ProvisionScopeInput, type ScheduleRegistration, type ScheduleRunReport, type ScheduleTick, type ScheduleStateKind, type ScopeHost, type ScopeStub, type ScopeStubOptions, type InvokeOptions, type TenantRelationalStore, type TenantStoreProvisionInput, type FreshnessRegistration, type FreshnessReport, type AttachmentExtractor, type AttachmentTextBackfillBatch, type AttachmentTextBounds, type ExtractionOutcome, type JobDriveReport, type JobDueKey, type JobHandler, type JobRun, type JobRunClaim, type JobRunFilter, type JobRunPatch, type JobRunRow, type JobStepRow, type StartJobRunInput, type LiveReadSurface, type SubjectRedactionCounts, type LegacySubjectRedactionCounts, type PlatformRequestRawRow, type UndrainedEvents, type UndrainedRead, type SwitchOutcome, type SwitchedOff, type RecordedOffCarry, type SwitchCarryWire, type SystemScheduleState, type PeerGrantsRow, type SystemGrantsEntry, type ConnectorCallRecorder, type ScopeRoleHolder, type DumpTable, type RoleState, type DeclaredPermissions, type PurgePass } from '@substrat-run/kernel';
 import { type OrphanSweepReport, type OrphanSweepRequest } from '@substrat-run/kernel';
 import { type CopyRestoreFence } from '@substrat-run/kernel';
 import { type ScopeStoreHostOptions, type ScopeStoreStubOptions, type StoreErasureReplay, type StoreStub } from '@substrat-run/kernel';
-import type { PlatformRequestSettle } from '@substrat-run/kernel';
+import type { PlatformRequestSettle, ShapeCursor } from '@substrat-run/kernel';
 import { type D1TenantStores } from './d1.js';
 import { type R2BlobStores } from './r2.js';
+import { type DoReply } from './do-reply.js';
+interface ScopeStubRpc {
+    /** The applied-migration count if this call applied any, else null (nothing changed). */
+    migrate(): Promise<number | null>;
+    /**
+     * A FRESH attempt of whatever is pending — clears the DO's memoised migration
+     * promise first, so a warm instance's cached rejection is defeated (#49).
+     * Same return contract as `migrate()`.
+     */
+    retryMigrations(): Promise<number | null>;
+    /** Whether the scope is classified a copy (#2005, #2009): what a CP-less coordinator reads for primacy. */
+    isCopy(): Promise<boolean>;
+    /** Mark the scope a copy (#2005); whether this call stamped it. */
+    markCopy(): Promise<boolean>;
+    /** The lifecycle the platform last delivered to this scope (#1713), or null for none. */
+    lifecycle(): Promise<StoredScopeLifecycle | null>;
+    /** #2016: how `tenantId` reads against the scope's record, and its lifecycle — one door's read. */
+    admission(tenantId: TenantId): Promise<{
+        verdict: TenantVerdict;
+        lifecycle: StoredScopeLifecycle | null;
+    }>;
+    /** Store a delivered lifecycle unless a newer one is held (#1713, `writeLifecycle`); #2016: a
+     *  scope `tenantId` is foreign to refuses it, a legacy one records its receipt. */
+    setLifecycle(next: ScopeLifecycle, tenantId?: TenantId): Promise<LifecycleDelivery | {
+        refused: 'tenant';
+        message: string;
+    }>;
+    /** Clear a mistaken copy classification (#2005); a load's copied-events mark is kept (#2009). */
+    clearCopyMark(expect?: LoadMarker): Promise<'cleared' | 'absent' | 'changed'>;
+    /**
+     * The executor's due events, decoded per row (#1636): a row that will not decode is in
+     * `undecodable`, for the coordinator to dead-letter, and never in `events`.
+     */
+    pendingExecutorDeliveries(deliveryId: string, eventType: string): Promise<{
+        events: DomainEvent[];
+        undecodable: {
+            eventId: string;
+            error: string;
+        }[];
+    }>;
+    recordExecutorAttempt(eventId: string, deliveryId: string, error: string | null, nextAttemptAt: string | null, 
+    /**
+     * #1525: the call THIS attempt ran in, or null. LAST, like every argument added
+     * to an RPC on this interface (see `recordScheduleRun` below for what a leading
+     * one costs). Defaulted in the DO, so an old coordinator that sends none records
+     * null — the honest value, since that coordinator knew of no call.
+     */
+    invocationId?: string | null): Promise<number>;
+    executorAttempts(eventId: string, deliveryId: string): Promise<number>;
+    executorDeadLetters(): Promise<ExecutorDeadLetter[]>;
+    pendingPlatformRequests(): Promise<PlatformRequestRawRow[]>;
+    /** #618: the intent JOURNAL (every status, newest first), where the read above is pending-only. */
+    platformRequestHistory(filter?: PlatformRequestFilter): Promise<PlatformRequestRawRow[]>;
+    settlePlatformRequest(id: string, status: 'pending' | 'done' | 'failed', result: string | null, lastError: string | null, 
+    /** #841 attribution, JSON-encoded. Defaulted in the DO so an older stub still binds. */
+    lastFailure?: string | null): Promise<void>;
+    /** #2102: a settle that writes an outcome event, in the settle's transaction. */
+    settlePlatformRequestWithEvent(tenantId: TenantId, scopeId: ScopeId, id: PlatformRequestId, outcome: PlatformRequestSettle): Promise<void>;
+    /** #574 phase 3: enqueue a `connector:<provider>` intent + journal the delivery, atomically. */
+    routeExecutorEventToPlatform(eventId: string, deliveryId: string, kind: string, payload: string, requestedBy: string, 
+    /** #1525: the call this routing ran in, or null. LAST and defaulted, as above. */
+    invocationId?: string | null): Promise<PlatformRequestId>;
+    /** #1232: a CP-less pass's schedule outcomes as one batched intent. Null = dropped (backpressure). */
+    enqueueSweepRuns(payload: string, requestedBy: string): Promise<PlatformRequestId | null>;
+    /** The migration that failed on this instance, read on `migrate()`'s reject path. */
+    migrationFailure(): Promise<{
+        version: string;
+        error: string;
+        applied: number;
+    } | null>;
+    invoke(operation: string, input: unknown, principal: PrincipalId, tenantId: TenantId, scopeId: ScopeId, connectionId?: string, 
+    /** The SKU the operation requires (#304) — enforced DO-side for a scope-local scope. */
+    requiredEntitlement?: string, 
+    /** Set when the caller is a MODULE's system principal on a timer (#383). */
+    systemModuleId?: string, 
+    /**
+     * #113 phase 3: ask for failures as a value rather than a throw. A ScopeDO still
+     * running older code ignores the argument and throws, which the caller handles —
+     * so this is safe to deploy in either direction (see `scope-do.ts`).
+     */
+    failureEnvelope?: boolean, 
+    /**
+     * #129, #116: the request preconditions to evaluate INSIDE the operation's
+     * transaction. A ScopeDO running older code ignores the argument — which is
+     * why the reply must say whether it honoured one; see `concurrency` and
+     * `idempotency` below.
+     */
+    options?: InvokeOptions, 
+    /**
+     * K-42 (#868): the impersonation session, resolved by the coordinator against
+     * the directory and passed WHOLE. The DO cannot read the directory, and the
+     * alternative — sending an id and having the DO trust it — would make a
+     * session forgeable by anyone who can call the RPC. An older DO ignores the
+     * argument, which is the SAFE direction here: it would run the operation as
+     * the impersonated principal with no stamp, and the coordinator refuses that
+     * outcome rather than accepting an unrecorded one (see `getImpersonatedScope`).
+     */
+    impersonation?: ImpersonationSession, 
+    /**
+     * #1672: the HASH of a capability session token (the plaintext never crosses). The DO
+     * resolves it to its capability inside its queue on every call. An older DO ignores the
+     * argument and runs the call as the fresh placeholder principal the coordinator sent,
+     * who holds nothing — and the coordinator refuses any success without `capability`.
+     */
+    capabilitySession?: string, 
+    /**
+     * #1706: the calling PEER vertical, as the platform named it. The DO admits it inside its
+     * queue on every call (`admitPeer`). An older DO ignores the argument and runs the call as
+     * the fresh placeholder principal the coordinator sent, who holds nothing — and the
+     * coordinator refuses any success without `vertical`.
+     */
+    verticalCaller?: VerticalCaller, 
+    /**
+     * #1834: the instance the system door's gate read. The DO refuses the call on any other
+     * instance (`SYSTEM_DOOR_MOVED`), and acknowledges with `systemDoor`.
+     */
+    systemDoorInstance?: string): Promise<{
+        result: unknown;
+        /** #458: platform intents this invoke enqueued — the coordinator's drain-hint feed. */
+        platformRequests: number;
+        /** Present iff the operation failed and the DO understood `failureEnvelope`. */
+        failure?: WireFailure;
+        /**
+         * K-42: present iff the DO understood `impersonation` — the acknowledgement the
+         * coordinator refuses a success without. Unlike every other argument on this
+         * RPC, one an old DO silently drops fails OPEN: the operation would run as the
+         * impersonated principal with nothing stamped and no read-only bound.
+         */
+        impersonation?: {
+            honoured: boolean;
+        };
+        /**
+         * Present iff the DO understood `preconditions` and the operation declares
+         * `concurrency` (#129).
+         *
+         * **Its absence is what makes version skew safe.** Every other argument added
+         * to this RPC has been safe to ignore: an old DO that drops `failureEnvelope`
+         * throws instead of returning a value, and the coordinator handles a throw. An
+         * old DO that drops `ifMatch` would COMMIT THE WRITE and return 200 — the
+         * caller's precondition silently unenforced, which is the exact lost update
+         * the header was sent to prevent, now with a success telling the client it
+         * did not happen.
+         *
+         * So the DO acknowledges rather than the coordinator assuming, and a
+         * coordinator that sent `ifMatch` and got no acknowledgement refuses instead
+         * of returning. Fail closed, in the one direction that would otherwise fail
+         * open silently.
+         */
+        concurrency?: {
+            version: string | null;
+            ifMatchChecked: boolean;
+        };
+        /**
+         * Present iff the DO understood `idempotencyKey` (#116).
+         *
+         * Absent for the same reason and with a sharper consequence than
+         * `concurrency` above: an old DO that drops the key does not skip a
+         * comparison, it RUNS THE OPERATION — a second work order, on the retry the
+         * header was sent to make free. So the acknowledgement is what the
+         * coordinator refuses on, not something it infers.
+         */
+        idempotency?: {
+            keyHonoured: boolean;
+            replayed: boolean;
+        };
+        /** #1672: present iff the DO understood `capabilitySession`, on `impersonation`'s reasoning. */
+        capability?: {
+            honoured: boolean;
+        };
+        /** #1706: present iff the DO understood `verticalCaller`, on the same reasoning. */
+        vertical?: {
+            honoured: boolean;
+        };
+        /** #1834: present iff the DO understood `systemDoorInstance`, on the same reasoning. */
+        systemDoor?: {
+            honoured: boolean;
+        };
+        /**
+         * #1834: the pin missed — this instance is not the one the door's gate read — so nothing ran.
+         * Set only by the DO's pin check, never from an operation's failure: a handler cannot reach it.
+         */
+        systemDoorMoved?: true;
+        /** #1705 PR 2: exported-type rows the commit added; absent means none (or an older DO). */
+        exported?: number;
+        /**
+         * #1746: the events the call itself emitted, when `onEmitted` asked. Advisory, so an
+         * older DO that drops it is safe: the invocation line reads "not recorded".
+         */
+        emitted?: {
+            events: {
+                type: string;
+                entity: string;
+            }[];
+            total: number;
+        };
+    }>;
+    /** Trade a capability secret for a session or a principal (#1672) — the kernel's
+     *  `exchangeCapability`, run in this scope's own storage. */
+    exchangeCapability(secret: string, tenantId: TenantId, scopeId: ScopeId, mode?: 'act' | 'become'): Promise<CapabilityExchange | null>;
+    /** The platform's `become` mint (#1672), serialized in this scope's own storage. */
+    mintBecomeCapability(input: BecomeCapabilityInput, actor: PlatformActorId): Promise<MintedCapability>;
+    /** The platform's revoke (#1672) — the record as it stood before, or null. */
+    revokeCapabilityAsPlatform(id: string, actor: PlatformActorId): Promise<CapabilityRecord | null>;
+    /** A principal's bounded `become` mint (#1686) — a member invite's link. */
+    mintBecomeCapabilityBoundedFor(tenantId: TenantId, scopeId: ScopeId, caller: PrincipalId, input: PrincipalBecomeCapabilityInput): Promise<BoundedBecomeMint>;
+    /** Revoke a `become` a principal minted (#1686); false for any other capability. */
+    revokeBecomeCapabilityFor(tenantId: TenantId, scopeId: ScopeId, id: string, by: PrincipalId): Promise<BoundedBecomeRevoke>;
+    /** A principal's bounded unbind of a binding shape's record (#1686). */
+    unbindEntityHolderBoundedFor(tenantId: TenantId, scopeId: ScopeId, caller: PrincipalId, entity: EntityRef): Promise<BoundedUnbind>;
+    /** Where each named `become` link stands (#1686). */
+    becomeLinkStatesFor(tenantId: TenantId, scopeId: ScopeId, ids: string[]): Promise<BecomeLinkState[]>;
+    /** The operator's read of this scope's capabilities (#1686) — records, never a hash. */
+    listCapabilities(filter?: CapabilityFilter): Promise<CapabilityPage>;
+    /** #1834: the system door's state read — where a module's schedules stand on this scope
+     *  (#383, #1666), the kernel's `systemScheduleState` — and the instance that answered it. */
+    systemDoorState(moduleId: string): Promise<{
+        state: SystemScheduleState;
+        instance: string;
+    }>;
+    /** #2029: the peer door's state read — where one peer stands on this scope (`subjectGrantState`
+     *  over `vertical:<slug>`, `admitPeer`'s predicate) — and the instance that answered it. */
+    peerDoorState(vertical: string): Promise<{
+        state: SystemScheduleState;
+        instance: string;
+    }>;
+    /** Move a module's schedule switch on this scope (#1666) — the kernel's
+     *  `switchSystemSchedules`, as one serialized unit. */
+    switchSystemSchedules(moduleId: string, scopeId: string, to: 'on' | 'off', at: string, 
+    /** #1823: the directory holds a live tenant-level grant for the module. */
+    tenantHeld?: boolean, 
+    /** #2045: the switch call's fence — a move older than the one the scope applied is refused. */
+    fence?: string): Promise<SwitchOutcome & {
+        instance: string;
+    }>;
+    /** Move one peer's kill switch on this scope (#1706) — the kernel's `switchPeer`. The
+     *  instance that applied it rides along (#2029), for the rewind hold's release, as for
+     *  `switchSystemSchedules`. The host and this object ship in one bundle. */
+    switchPeer(vertical: string, scopeId: string, to: 'on' | 'off', at: string, 
+    /** #2030: the directory holds a live tenant-level grant for the peer. */
+    tenantHeld?: boolean, 
+    /** #2045: as on `switchSystemSchedules`. */
+    fence?: string): Promise<SwitchOutcome & {
+        instance: string;
+    }>;
+    /** Does a peer hold each key here now (#1706) — the checker's own `covers`. #2029: pinned to
+     *  the instance the peer door's gate read; on any other the answer is `SystemDoorMoved`. */
+    peerCovers(tenantId: TenantId, scopeId: ScopeId, vertical: string, permissions: PermissionKey[], doorInstance: string): Promise<PeerCoverage[] | SystemDoorMoved>;
+    /** `ctx.canAssign`'s bound for a named principal (#1931); `null` for a role the tenant lacks. */
+    canAssignFor(tenantId: TenantId, scopeId: ScopeId, principal: PrincipalId, roleKey: string, atTenant?: boolean): Promise<Coverage | null>;
+    assignScopeRoleBoundedFor(tenantId: TenantId, scopeId: ScopeId, caller: PrincipalId, assignee: PrincipalId, roleKey: string): Promise<Coverage | null | {
+        refused: string;
+    }>;
+    /** #1150: the scope's role roster, and the two bounded writes over it — see `scope-do.ts`. */
+    scopeRoleHoldersFor(scopeId: ScopeId, principal?: PrincipalId): Promise<ScopeRoleHolder[]>;
+    changeScopeRoleBoundedFor(tenantId: TenantId, scopeId: ScopeId, caller: PrincipalId, principal: PrincipalId, from: string, to: string): Promise<Coverage | 'not-held' | 'unknown-to' | {
+        refused: string;
+    }>;
+    /** #2430: why a role may not be conferred through a door here, or null — see `scope-do.ts`. */
+    reservedRoleRefusalFor(tenantId: TenantId, roleKey: string, door: 'person' | 'platform'): Promise<string | null>;
+    /** #2430: the same for `assignScopeRole`, which names no tenant — see `scope-do.ts`. */
+    reservedRoleRefusalHere(roleKey: string, door: 'person' | 'platform'): Promise<string | null>;
+    /** #2430: why a raw grant of these keys is refused against the scope class's reservations, or null. */
+    reservedGrantRefusalFor(permissions: string[]): Promise<string | null>;
+    /** #2430: why a reconcile of these declared shapes is refused against the scope class's reservations, or null. */
+    reservedShapeRefusalFor(shapes: {
+        entityType: string;
+        permissions: string[];
+    }[]): Promise<string | null>;
+    /** #2430: which of these keys the scope class's modules reserve to a system principal. */
+    reservedAmong(permissions: string[]): Promise<string[]>;
+    /** #2447: what the scope class's modules reserve and declare. */
+    reservationHere(): Promise<{
+        reserved: string[];
+        declared: string[];
+    }>;
+    /** #2447: the tenant's roles as the scope stores them, and the keys of those seated there. */
+    /** `dropped` (#2531): the tombstones of the roles a projection dropped; absent from an older ScopeDO. */
+    roleStateHere(tenantId: TenantId): Promise<RoleState>;
+    revokeScopeRolesBoundedFor(tenantId: TenantId, scopeId: ScopeId, caller: PrincipalId, principal: PrincipalId): Promise<{
+        coverage: Coverage;
+        revoked: string[];
+    }>;
+    /** Every module this scope holds or has held system authority for, and where each
+     *  stands (#1674) — the kernel's `systemGrantsStatus`, run in the scope's own storage. */
+    systemGrantsStatus(): Promise<SystemGrantsEntry[]>;
+    /** #1819: the rewind hold, on the `SWITCH_HOLDS_NAME` object only — see `scope-do.ts`. */
+    switchHoldToken(): Promise<number>;
+    switchHoldClaim(scopeId: string, moduleIds: string[], claimId: string, token: number): Promise<void>;
+    switchHoldOn(scopeId: string, moduleId: string, claimIds: string[]): Promise<void>;
+    switchHoldJoin(scopeId: string, moduleId: string, claimIds: string[]): Promise<void>;
+    switchHoldYoungestMs(scopeId: string, claimId: string): Promise<number | null>;
+    switchHoldArm(scopeId: string, claimId: string, doomed: string | null): Promise<void>;
+    switchHoldDrop(scopeId: string, claimId: string): Promise<void>;
+    switchHoldsAll(): Promise<{
+        scopeId: string;
+        moduleId: string;
+    }[]>;
+    switchHoldClaims(scopeId: string): Promise<SwitchHoldClaim[]>;
+    switchHoldRelease(scopeId: string, moduleId: string | null, claimIds: string[] | null): Promise<void>;
+    /** #1819: which instance is serving this scope, and whether it armed a rewind. */
+    rewindProbe(): Promise<{
+        instance: string;
+        armed: boolean;
+    }>;
+    /** Where every peer this scope holds or has held grants for stands (#1706) — the kernel's
+     *  `peerGrantsStatus`, run in the scope's own storage. */
+    peerGrantsStatus(): Promise<PeerGrantsRow[]>;
+    /** `grantToSystem`'s scope-level write (#1666): `false`, and nothing written, while the
+     *  module's schedule kill switch is off on this scope. */
+    writeSystemGrant(moduleId: string, relation: string, object: string, expiresAt: string | null): Promise<boolean>;
+    /** The last time a schedule's operation ran on this scope (#383), or null if never. */
+    scheduleLastRun(operation: string): Promise<string | null>;
+    /**
+     * #119: one pass of a purge schedule — the DO picks what is due by its own clock and the declared
+     * horizon, and purges it as the module's system principal. See the DO.
+     */
+    runPurgeSweep(operation: string, tenantId: TenantId, scopeId: ScopeId, systemDoorInstance: string, 
+    /** #2192: the schedule run's id, which every purge in the pass runs under. */
+    runInvocationId?: string, 
+    /**
+     * #2517: the platform requests the purge runs before this one in the tick enqueued. LAST and
+     * optional for the positional-RPC reason above; a scope without it fails a refused head.
+     */
+    earlierPurgeRequests?: number): Promise<PurgePass | SystemDoorMoved>;
+    /** #1232: the freshness evaluator's one-round-trip read — evidence + evaluator state per type. */
+    freshnessProbe(types: string[]): Promise<Record<string, {
+        observedAt: string | null;
+        stateAt: string | null;
+        stateOutcome: string | null;
+    }>>;
+    /** Write one `_substrat_schedule_state` row (#383) — `unit` is either a schedule
+     *  operation (`module/verb`: when it ran, how it ended) or a freshness key
+     *  (`freshness:<eventType>`: when the verdict was recorded, and what it was).
+     *  `kind` says which, and is passed rather than read off the key's shape (#1288):
+     *  an operation may legally be spelled `freshness:…`, and only the caller knows.
+     *
+     *  **LAST, like every argument added to an RPC on this interface**, and for the
+     *  reason `invoke`'s `concurrency` acknowledgement spells out above: an old DO
+     *  drops a trailing argument it does not know, but binds a LEADING one positionally
+     *  — `kind` would land in `unit`, `unit` in `at`, `at` in `status`, and the row
+     *  written would be three values in the wrong columns with no error anywhere. The
+     *  schedule's real key is then never written, so its cadence gate finds nothing and
+     *  the operation runs again on every pass. Appended, an old DO simply records what
+     *  it always recorded. The reverse skew — a new DO, an old coordinator sending no
+     *  kind — hits `kind TEXT NOT NULL` and throws, which is the loud half and is left
+     *  loud deliberately: a default here would be the derived-from-the-key guess #1288
+     *  exists to remove.
+     *
+     *  `invocationId` (#1525) is appended for the same positional reason and defaulted
+     *  in the DO, so an old coordinator that sends none records null — honestly, since
+     *  that coordinator minted no id to send. The coordinator passes one only for a
+     *  fired or failed schedule; a freshness verdict invokes nothing, so it has none. */
+    recordScheduleRun(unit: string, at: string, status: 'ok' | 'failed' | 'skipped', kind: ScheduleStateKind, invocationId?: string | null): Promise<void>;
+    jobRunStartOrJoin(moduleId: string, job: string, instance: string, row: JobRunRow): Promise<JobRunRow>;
+    jobRunInsert(row: JobRunRow): Promise<void>;
+    jobRunsDueKeys(now: string, max: number): Promise<JobDueKey[]>;
+    jobRunList(filter: JobRunFilter): Promise<JobRunRow[]>;
+    jobRunClaim(id: string, owner: string, leaseMs: number): Promise<JobRunClaim | null>;
+    jobRunBegin(id: string, owner: string, marginMs: number): Promise<boolean>;
+    jobRunMiss(id: string, owner: string, note: string): Promise<{
+        misses: number;
+        failed: boolean;
+    } | null>;
+    jobRunPatch(id: string, patch: JobRunPatch, owner?: string): Promise<boolean>;
+    jobCommitPass(id: string, patch: JobRunPatch, owner?: string): Promise<boolean>;
+    jobStepBegin(runId: string, step: string, owner: string, leaseMs: number): Promise<{
+        held: boolean;
+        row: JobStepRow | null;
+    }>;
+    jobStepRecord(runId: string, step: string, result: string | null, attempts: number, lastError: string | null, at: string, owner?: string, leaseMs?: number): Promise<boolean>;
+    /** This scope's live `connection:<id>` grant tuples (#726 gap 1) — the read-back.
+     *  Unions the scope's own tuples with the projected tenant-level ones, because a
+     *  scope check consults both (rule 2 inheritance). */
+    listConnectionGrants(now: string): Promise<{
+        subject: string;
+        relation: string;
+        expires_at: string | null;
+    }[]>;
+    /** A declared entity-grant shape's grant: marker plus keys, one unit (#2071). */
+    grantEntityShape(principal: PrincipalId, entity: EntityRef, permissions: readonly string[]): Promise<void>;
+    /**
+     * One bounded pass of the shape reconcile with its events (#2071, retirements #2082), resuming
+     * at `after` (#2083). A DO from before the cursor ignores `after`, answers `done` and no `next`.
+     */
+    topUpEntityGrantShapes(tenantId: string, scopeId: string, shapes: readonly EntityGrantShape[], limit: number, after: ShapeCursor | null): Promise<{
+        toppedUp: number;
+        retired: number;
+        retirementsLeftOpen?: number;
+        next?: ShapeCursor | null;
+        done: boolean;
+        boundEver?: string[];
+    }>;
+    /** The EXPLICIT grant: `INSERT OR REPLACE`, so it clears a tombstone. */
+    writeTuple(subject: string, relation: string, object: string, expiresAt: string | null): Promise<DoReply<null>>;
+    /** Provisioning's write (#1659): creates a missing tuple, never un-revokes one. */
+    seatTuple(subject: string, relation: string, object: string, expiresAt: string | null): Promise<void>;
+    /** Provisioning's seat as one unit, then the recorded-off modules switched off in it (#1742). */
+    seatTuples(tuples: {
+        subject: string;
+        relation: string;
+        object: string;
+        expires_at: string | null;
+    }[], switchOff?: RecordedOffCarry & {
+        scopeId: string;
+        at: string;
+    }): Promise<SwitchedOff[]>;
+    /** Tombstone a scope tuple by exact (subject, relation, object). Idempotent. */
+    revokeTuple(subject: string, relation: string, object: string, at: string): Promise<boolean>;
+    hasEffectiveRoleGrantFor(tenantId: string, subject: string): Promise<boolean>;
+    /** Attachment surface, metadata half (#473) — see the ScopeDO methods of the same names.
+     *  `connectionId` (#476) gates as a connection instead of `principal` when set. Each answers
+     *  its refusal as data (#113), so its code survives the hop. */
+    attachmentAddReply(record: AttachmentRecord, principal: PrincipalId, tenantId: TenantId, scopeId: ScopeId, connectionId?: string): Promise<DoReply<AttachmentRecord>>;
+    /** The add's write gate alone (#2516): asked before a streamed body is read, so a refusal costs no
+     *  object. Writes nothing; a refusal is recorded as the upload's own would be. */
+    attachmentCheckWriteReply(entity: EntityRef, principal: PrincipalId, tenantId: TenantId, scopeId: ScopeId, connectionId?: string): Promise<DoReply<null>>;
+    /** An upload-link redemption's metadata half: the add above, with the link spent in the same
+     *  transaction. Its own verb so a DO that predates links refuses rather than ignores the secret. */
+    attachmentRedeemUploadLinkReply(record: AttachmentRecord, secret: string, tenantId: TenantId, scopeId: ScopeId, 
+    /** #2315: recorded (as its hash) beside the spend, so a retry carrying it is a replay. */
+    idempotencyKey?: string): Promise<DoReply<AttachmentRecord>>;
+    /** #2314: the scope side of an orphan-sweep pass — condemn (or, dry, only read) the rowless ids. */
+    orphanAttachmentsReply(ids: string[], now: string, tenantId: TenantId, condemn: boolean, vouched?: boolean, expectedVersionId?: string): Promise<DoReply<string[]>>;
+    /** #2350: the licence half of a pass — record what a dry run listed, read it, or take ids out of it. */
+    orphanSweepLicenceReply(op: 'record' | 'read' | 'consume', ids: string[], now: string, tenantId: TenantId, vouched?: boolean, expectedVersionId?: string): Promise<DoReply<string[]>>;
+    /** #2314: the receipt's tenant (or null) and whether any attachment row is held; read without migrating. */
+    sweepFenceFacts(): Promise<{
+        tenant: string | null;
+        holdsAttachments: boolean;
+    }>;
+    /**
+     * Look an upload link up without spending it; `target` is judged before its state. With
+     * `idempotencyKey`, a link spent by a redemption that carried it answers `replay` (#2315).
+     */
+    uploadLinkInspectReply(secret: string, tenantId: TenantId, scopeId: ScopeId, target?: EntityRef, idempotencyKey?: string): Promise<DoReply<UploadLinkInspection>>;
+    attachmentListReply(entity: EntityRef, principal: PrincipalId, tenantId: TenantId, scopeId: ScopeId, connectionId?: string): Promise<DoReply<AttachmentRecord[]>>;
+    attachmentAuthorizeReply(attachmentId: string, mode: 'read' | 'write', principal: PrincipalId, tenantId: TenantId, scopeId: ScopeId, connectionId?: string, 
+    /** #726 remedy B: admit by ownership of THIS delivery's entity, resolved here. */
+    forEventId?: string): Promise<DoReply<AttachmentRecord | null>>;
+    /** Read-only attachment gate for a registered module's system principal. */
+    systemAttachmentAuthorizeReply(attachmentId: string, moduleId: ModuleId, tenantId: TenantId, scopeId: ScopeId, 
+    /** #1834: the instance the system door's gate read; on any other it answers `SystemDoorMoved`. */
+    systemDoorInstance?: string): Promise<DoReply<AttachmentRecord | null | SystemDoorMoved>>;
+    attachmentRemoveReply(attachmentId: string, principal: PrincipalId, tenantId: TenantId, scopeId: ScopeId, connectionId?: string): Promise<DoReply<AttachmentRecord | null>>;
+    /**
+     * #1686: the capability session's reads — `sessionHash` resolved inside the DO's queue.
+     * Each answers an envelope whose failure is DATA (`invoke`'s discipline): a throw across
+     * this boundary would keep its message and lose its code.
+     */
+    capabilityAttachmentList(entity: EntityRef, sessionHash: string, tenantId: TenantId, scopeId: ScopeId): Promise<DoReply<AttachmentRecord[]>>;
+    capabilityAttachmentOpen(attachmentId: string, sessionHash: string, tenantId: TenantId, scopeId: ScopeId): Promise<DoReply<AttachmentRecord | null>>;
+    /** #1686: always a failure — the refusal of a write through a capability, recorded (K-35). */
+    capabilityAttachmentRefuseWrite(sessionHash: string, tenantId: TenantId, scopeId: ScopeId, operation: 'attachments.upload' | 'attachments.remove', target: {
+        entityType: string;
+    } | {
+        attachmentId: string;
+    }): Promise<DoReply<never>>;
+    /** #1575: extracted-text search as `principal` (or the connection), its failure as data. */
+    attachmentSearch(term: string, limit: number, principal: PrincipalId, tenantId: TenantId, scopeId: ScopeId, connectionId?: string): Promise<DoReply<AttachmentRecord[]>>;
+    /** #1575: the same search through a capability session, as an envelope. */
+    capabilityAttachmentSearch(term: string, limit: number, sessionHash: string, tenantId: TenantId, scopeId: ScopeId): Promise<DoReply<AttachmentRecord[]>>;
+    /** #1575: the extraction job's record read — no gate, the kernel's own derivation. */
+    attachmentTextSource(attachmentId: string): Promise<AttachmentRecord | null>;
+    /** #1575: write an extraction outcome; false when the attachment was removed meanwhile. */
+    attachmentTextRecord(attachmentId: string, outcome: ExtractionOutcome): Promise<boolean>;
+    /** #1575: start the one-shot backfill unless the scope is marked or holds no attachments. */
+    attachmentTextBackfillStart(): Promise<void>;
+    /** #1575: one backfill batch after `after`, in one transaction. */
+    attachmentTextBackfillBatch(after: string | null): Promise<AttachmentTextBackfillBatch>;
+    /** Scope-local projection (scope-local-permissions.md): replace the tenant's roles + tuples and flip to local.
+     *  `entitlements` (#304) rides the same snapshot — preserve-on-undefined, so a role-only re-projection
+     *  leaves projected entitlements untouched. */
+    applyProjection(tenantId: string, roles: {
+        role_key: string;
+        permissions: string;
+        source: string;
+        holder?: 'person' | 'system' | null;
+    }[], tuples: {
+        subject: string;
+        relation: string;
+        object: string;
+        expires_at: string | null;
+        revoked_at: string | null;
+    }[], entitlements?: {
+        entitlement_key: string;
+        expires_at: string | null;
+        quota: number | null;
+        plan: string | null;
+    }[], 
+    /** Scope-level tuples (e.g. the owner grant) seated in the same unit as the flip (#332) —
+     *  never un-revoked, except a `lockout_reseat` one on a scope with no effective role grant (#1659). */
+    scopeTuples?: {
+        subject: string;
+        relation: string;
+        object: string;
+        expires_at: string | null;
+        lockout_reseat?: boolean;
+    }[], 
+    /** The tenant's identity links (#406) — same preserve-on-undefined convention as entitlements. */
+    identities?: {
+        provider: string;
+        external_id: string;
+        principal_id: string;
+        scope_id: string | null;
+    }[], 
+    /** Live connections' PUBLIC sealing keys (#687) — same preserve-on-undefined convention. */
+    connectionKeys?: {
+        connection_id: string;
+        provider: string;
+        key_id: string;
+        public_key: string;
+    }[], 
+    /** The recorded-off modules switched off after the seat, in the same unit (#1742). */
+    switchOff?: RecordedOffCarry & {
+        scopeId: string;
+        at: string;
+    }, serviceSubjects?: readonly string[]): Promise<SwitchedOff[]>;
+    /** #113: `applyProjection`, its refusal answered as data. */
+    applyProjectionReply(...args: Parameters<ScopeStubRpc['applyProjection']>): Promise<DoReply<SwitchedOff[]>>;
+    /** Resolve an external identity from this scope's projected links (#406) — the CP-less auth read. */
+    resolveProjectedIdentity(tenantId: string, provider: string, externalId: string): Promise<{
+        principal: string;
+        scopeId: string | null;
+    } | undefined>;
+    /** Read-only introspection of this scope's DB (§5.4 admin-query RPC). */
+    introspectTables(): Promise<ScopeTable[]>;
+    introspectTable(table: string, limit: number, offset: number): Promise<ScopeTablePage>;
+    /** #113: `introspectTable`, its refusal answered as data. */
+    introspectTableReply(table: string, limit: number, offset: number): Promise<DoReply<ScopeTablePage>>;
+    /** One read-only SQL statement, gated + rolled back inside the DO (#219). */
+    introspectQuery(sql: string): Promise<ScopeQueryResult>;
+    /** #113: `introspectQuery`, its refusal answered as data. */
+    introspectQueryReply(sql: string): Promise<DoReply<ScopeQueryResult>>;
+    /** The K-35 denial log, read back (#867) — raw rows and the bucketed view. */
+    listDenials(filter?: DenialFilter): Promise<PermissionDenial[]>;
+    summarizeDenials(filter?: DenialFilter): Promise<DenialSummary>;
+    /** #1745: the refusal log, read back — refused lifecycle moves, newest first. */
+    listRefusals(filter?: RefusalFilter): Promise<RefusalRecord[]>;
+    /** Complete logical dump of this scope's DB (preview-and-snapshots.md §3). */
+    exportDump(): Promise<ScopeDumpTable[]>;
+    /**
+     * Load a dump into this (freshly-provisioned) scope — the fork write side.
+     * `destScopeId` re-points the dump's scope-level grants at the destination.
+     */
+    importDump(tables: ScopeDumpTable[], destScopeId?: ScopeId, opts?: {
+        /** The recorded-off modules switched off on `destScopeId` after the replay, in its event (#1742). */
+        switchOff?: RecordedOffCarry & {
+            at: string;
+        };
+        /** The scope the dump was captured from (#1869): only its node grants are re-pointed. */
+        sourceScopeId?: ScopeId;
+        /** The platform exported the dump itself: no fallback (`RepointSource.exact`). */
+        exact?: boolean;
+        /** #1722: the stamp this load leaves; without one it leaves none. */
+        loadStamp?: string;
+        /** #2005: the directory says the scope is not primary — mark it a copy. */
+        markCopy?: boolean;
+        /** #2016: the tenant the platform says the scope belongs to, recorded as its receipt. */
+        provisionedFor?: TenantId;
+    }): Promise<SwitchedOff[]>;
+    /** #1722: what a carry's restore into this store expects to find unchanged. */
+    loadMarker(): Promise<LoadMarker>;
+    /** #1722: `importDump` with its refusals (`changed` under `expect`, `kept`) answered as values. */
+    importDumpChecked(tables: ScopeDumpTable[], destScopeId: ScopeId, opts: {
+        switchOff?: RecordedOffCarry & {
+            at: string;
+        };
+        sourceScopeId?: ScopeId;
+        exact?: boolean;
+        loadStamp?: string;
+        expect?: LoadMarker;
+        markCopy?: boolean;
+        provisionedFor?: TenantId;
+        /** #1722: the copy move's lease; `lapsed` once `notAfter` has passed. */
+        fence?: CopyRestoreFence;
+    }): Promise<{
+        refused: 'changed' | 'kept' | 'lapsed';
+    } | {
+        refused: 'tenant';
+        message: string;
+    } | {
+        refused: false;
+        switchedOff: SwitchedOff[];
+    }>;
+    /** #1722: the kept-copy marker, or null. */
+    keptCopy(): Promise<KeptCopy | null>;
+    /** #1722: discard a kept copy at the revision the operator acted on. */
+    discardKeptCopy(scopeId: ScopeId, revision: string | null, carriedAway: CarriedAway, markCopy?: boolean, loadStamp?: string | null): Promise<{
+        discarded: true;
+    } | {
+        refused: 'changed' | 'not-kept';
+    }>;
+    /** #1722: `exportDump` and the store's load stamp, read in one call. */
+    exportDumpStamped(): Promise<{
+        tables: ScopeDumpTable[];
+        loadStamp: string | null;
+        revision: string | null;
+    }>;
+    /** #2450: one page of `exportDumpStamped`; the first (`cursor` null) mints the load stamp. */
+    exportDumpPage(cursor: string | null, opts?: {
+        stamp?: boolean;
+        maxBytes?: number;
+    }): Promise<DoReply<ScopeDumpPage>>;
+    /** #2450: stage one page for `commitStagedDumpChecked`; page 0 starts (and replaces) a stage. */
+    stageDumpPage(stageId: string, seq: number, tables: ScopeDumpTable[]): Promise<DoReply<{
+        staged: boolean;
+    }>>;
+    /** #2450: `importDumpChecked`, the rows read from the stage named. */
+    commitStagedDumpChecked(stageId: string, destScopeId: ScopeId, opts: Parameters<ScopeStubRpc['importDumpChecked']>[2]): Promise<Awaited<ReturnType<ScopeStubRpc['importDumpChecked']>> & {
+        tables?: number;
+    }>;
+    /** #2450: drop the stage, if it is still this one. */
+    discardStagedDump(stageId: string): Promise<{
+        discarded: boolean;
+    }>;
+    /** #1722: wipe a carried copy if nothing was loaded since `expectLoadStamp`; false when refused. */
+    wipeCarried(scopeId: ScopeId, expectLoadStamp: string | null, carriedAway: CarriedAway, opts?: {
+        expectRevision?: string | null;
+        protectIfChanged?: boolean;
+        markCopy?: boolean;
+    }): Promise<boolean>;
+    /** #1722: clear a kept copy's marker where it is the live store, at the revision read. */
+    releaseKeptCopy(revision: string | null, markCopy?: boolean, loadStamp?: string | null): Promise<{
+        released: true;
+    } | {
+        refused: 'changed' | 'not-kept';
+    }>;
+    /** Wipe this scope's storage — the reap half of deleteSnapshot (§9). */
+    destroyStorage(): Promise<void>;
+    /**
+     * Redact the spine payloads keyed to one data subject (#37); returns how many moved,
+     * per table. Both spine copies of an event go in this one RPC (#1600) — the outbox row
+     * and any platform intent this CP-less host routed the event into.
+     *
+     * **The `number` arm is version skew, not an alternative contract.** This RPC answered
+     * with a bare outbox count until #1600, and an old DO on the other end of a new
+     * coordinator still does — the skew this interface's own `recordScheduleRun` note
+     * spells out, in the direction a RETURN type can carry it. The caller MUST fail on it
+     * rather than read it as a count: an old DO redacts the outbox and leaves the intent
+     * journal, which is precisely the defect #1600 exists to close, so treating its reply
+     * as `{ events, intents: 0 }` would mint a receipt claiming an erasure that did not
+     * happen. Typed as a union rather than cast at the call site so the skew has to be
+     * handled to compile.
+     *
+     * **The `LegacySubjectRedactionCounts` arm is the same skew, one release later
+     * (#1632).** A DO from after #1600 answers `{ events, intents }` and never looked at
+     * the job-run tables, so it is refused the same way rather than read as `jobRuns: 0`.
+     * And one from before the free-text half answers the job-run count without
+     * `idempotencyResults` or `intentIds`, and is refused for the same reason.
+     */
+    redactSubject(subjectId: string): Promise<SubjectRedactionCounts | LegacySubjectRedactionCounts | number | {
+        failure: WireFailure;
+    }>;
+    /** PITR bookmarks recorded before migration passes (#286), newest first. */
+    migrationBookmarks(limit?: number): Promise<{
+        bookmark: string;
+        takenAt: string;
+        pending: string[];
+    }[]>;
+    appliedMigrations(): Promise<AppliedMigration[]>;
+    /** `SqlStorage.databaseSize` of this scope (#1524). */
+    databaseSize(): Promise<number>;
+    /** What this scope's attachment rows sum to (#2501). */
+    attachmentBytes(): Promise<number>;
+    entityHistory(input: {
+        entityType: string;
+        entityId: string;
+        limit?: number;
+        cursor?: string;
+    }): Promise<Page<HistoryEntry>>;
+    /** The Tier-2 read, and what it stepped over (#1636) — an object, because it crosses the RPC. */
+    undrainedEventsRead(limit: number): Promise<UndrainedRead>;
+    markEventsDrained(eventIds: readonly string[], at: string): Promise<number>;
+    /** #1705: the producer's release, decided by the DO's own registered exports. */
+    /** #2029: `door`, the consumer peer's door — pinned to its gate's instance, or held off. */
+    exportedEventsRead(input: ExportReadInput, tenantId: TenantId, scopeId: ScopeId, door: {
+        instance: string;
+    } | {
+        held: true;
+    }): Promise<ExportedBatch | SystemDoorMoved>;
+    /** #1705: what the DO's modules import, and its watermark per producer. */
+    importStateRead(): Promise<ImportState>;
+    /** #1705: apply a batch another vertical exported, under the watermark's compare-and-set.
+     *  #2029: `doorInstance`, the instance the peer door's gate read; on any other the answer is
+     *  `SystemDoorMoved` and nothing is applied. */
+    importApply(batch: ImportBatch, tenantId: TenantId, scopeId: ScopeId, doorInstance: string): Promise<ImportResult | SystemDoorMoved>;
+    /** #1705 PR 2: was this scope provisioned here for this tenant — read without migrating. */
+    servesTenant(tenantId: TenantId): Promise<boolean>;
+    /** #2541: the size, or null when this deployment does not hold the scope — held check and read in one call. */
+    databaseSizeIfHeld(): Promise<number | null>;
+    /** #2541: the attachment bytes, or null when this deployment does not hold the scope — one call, as the size is. */
+    attachmentBytesIfHeld(): Promise<number | null>;
+    /**
+     * #2544: the introspection reads that name only a scope id, each `null` when this deployment does
+     * not hold the scope: the held check and the read in ONE call, as the two size reads are.
+     */
+    facetEventsIfHeld(input: EventFacetInput): Promise<EventFacetResult | null>;
+    eventEffectsIfHeld(input: EventEffectsInput): Promise<EffectsTree | null>;
+    invocationEventsIfHeld(input: InvocationEventsInput): Promise<InvocationEvents | null>;
+    deadLettersIfHeld(input: DeadLettersInput): Promise<Page<DeadLetter> | null>;
+    lifecycleFlowIfHeld(input: LifecycleFlowInput): Promise<LifecycleFlowResult | null>;
+    operationSeriesIfHeld(input: OperationSeriesInput): Promise<OperationSeriesResult | null>;
+    eventCauseIfHeld(input: EventCauseInput): Promise<CauseChain | null>;
+    entityHistoryIfHeld(input: {
+        entityType: string;
+        entityId: string;
+        limit?: number;
+        cursor?: string;
+    }): Promise<Page<HistoryEntry> | null>;
+    appliedMigrationsIfHeld(): Promise<AppliedMigration[] | null>;
+    migrationBookmarksIfHeld(): Promise<{
+        bookmark: string;
+        takenAt: string;
+        pending: string[];
+    }[] | null>;
+    introspectTablesIfHeld(): Promise<ScopeTable[] | null>;
+    introspectTableIfHeld(table: string, limit: number, offset: number): Promise<DoReply<ScopeTablePage> | null>;
+    introspectQueryIfHeld(sql: string): Promise<DoReply<ScopeQueryResult> | null>;
+    undrainedEventsReadIfHeld(limit: number): Promise<UndrainedRead | null>;
+    redrainCountIfHeld(drainedBefore: string): Promise<number | null>;
+    /** #1705 PR 3: the replay lever, on the scope's queue, in one transaction. */
+    importCursorMove(input: ImportCursorMoveAt & {
+        now: number;
+    }): Promise<ImportCursorMoved>;
+    redrainEvents(drainedBefore: string): Promise<number>;
+    /** How many rows that reopen WOULD touch, touching none of them (#1545). */
+    redrainCount(drainedBefore: string): Promise<number>;
+    facetEvents(input: EventFacetInput): Promise<EventFacetResult>;
+    eventCause(input: EventCauseInput): Promise<CauseChain>;
+    eventEffects(input: EventEffectsInput): Promise<EffectsTree>;
+    invocationEvents(input: InvocationEventsInput): Promise<InvocationEvents>;
+    deadLetters(input: DeadLettersInput): Promise<Page<DeadLetter>>;
+    lifecycleFlow(input: LifecycleFlowInput): Promise<LifecycleFlowResult>;
+    operationSeries(input: OperationSeriesInput): Promise<OperationSeriesResult>;
+    /** Rewind storage to a bookmark (#286's backout) — completes on the DO's restart. */
+    rewindToBookmark(bookmark: string, opts?: {
+        force?: boolean;
+    }): Promise<{
+        rewindingTo: string;
+        instance?: string;
+    }>;
+}
 /**
  * Where a connector's scope-side effects land when the scope is served by ANOTHER
  * deployment (#574). Set only on the shared control plane's host — its own SCOPE
@@ -71,6 +815,12 @@ export interface ConnectorDelegation {
          */
         eventId?: string;
     }): Promise<OpenedAttachment | null>;
+    /**
+     * `openAttachment`, with the bytes streamed across the seam and handed on as they arrive (#2514).
+     * Optional for older embedders: without it a streamed open falls back to `openAttachment` and hands
+     * the buffer on as a stream, which works and holds the file whole, as it always did.
+     */
+    openAttachmentStream?(args: Parameters<ConnectorDelegation['openAttachment']>[0]): Promise<OpenedAttachmentStream | null>;
     /** Write the scope-local `connection:<id>` grant tuple in the serving deployment. */
     grant(args: {
         connectionId: ConnectionId;
@@ -361,6 +1111,12 @@ export interface CloudflareScopeHostOptions {
      * provider can be stood up in memory for tests and dev.
      */
     fetch?: FetchLike;
+    /**
+     * How long a streamed connector response body may go without a byte before it errors (#2518).
+     * Defaults to `STREAM_IDLE_TIMEOUT_MS`. A buffered read stays under the connector's `timeoutMs`.
+     * Here so a test can use a short window.
+     */
+    streamIdleTimeoutMs?: number;
     /**
      * #1691: where each connector call's data point goes, beside the health line
      * `recordConnectionUse` settles — on the platform, the control plane's Analytics
@@ -557,6 +1313,12 @@ export declare const SWITCH_HOLD_EXTRA_WAITS = 3;
  * clock, against the releasing host's clock: minutes, not seconds.
  */
 export declare const SWITCH_HOLD_PENDING_MAX_MS: number;
+/**
+ * Ask the scope's write gate before a streamed body is read (#2516). A scope DO from before the
+ * verb exists cannot answer it, and a missing answer is never a pass: the call fails closed with a
+ * retryable `unavailable` that says to redeploy, rather than skipping the gate and reading the body.
+ */
+export declare function askAttachmentWriteGate(stub: Pick<ScopeStubRpc, 'attachmentCheckWriteReply'>, entity: EntityRef, principal: PrincipalId, tenantId: TenantId, scopeId: ScopeId, connectionId?: string): Promise<void>;
 /** #1819: one rewind's claim on one held module, as the hold object stores it. */
 export interface SwitchHoldClaim {
     claimId: string;
@@ -584,6 +1346,8 @@ export declare class CloudflareScopeHost implements ScopeHost {
     private readonly moduleIds;
     /** #2430: what a registered module declares `holder: 'system'` — `assignRole`'s refusal reads it. */
     private readonly reservedKeys;
+    /** #2447: every key a registered or listed module declares, marked or not — a role definition reads it. */
+    private readonly declaredKeys;
     /** #2430: the declared permission surface `registerModule` holds each module to, when given. */
     private readonly permissions;
     /**
@@ -608,6 +1372,7 @@ export declare class CloudflareScopeHost implements ScopeHost {
     /** Executor id → {eventType, handler} (K-22 §4.2). Coordinator-side, not in the DO. */
     private readonly secretBox;
     private readonly fetchImpl;
+    private readonly streamIdleMs;
     private readonly connectorCalls;
     /** The live D1 client for per-tenant stores (#301); undefined ⇒ refuse loudly. */
     private readonly tenantStores?;
@@ -782,8 +1547,20 @@ export declare class CloudflareScopeHost implements ScopeHost {
      * gate (the caller is the control plane, which did the K-3 check + audit on its side).
      */
     introspectScopeTables(scopeId: ScopeId): Promise<ScopeTable[]>;
+    /**
+     * The Data view's table page (#2563): refused `conflict` with the shared sentence for a scope the
+     * deployment does not hold, as the reads above are, never answered as an empty store. The carry
+     * and its cleanup read a wiped copy's tombstone, which is not held by design: they use
+     * `readTombstoneTable`.
+     */
     introspectScopeTable(scopeId: ScopeId, input: ReadScopeTableInput): Promise<ScopeTablePage>;
-    /** The SQL console's CP-less path (#219) — same trust line as the pair above. */
+    /**
+     * A table of a store this deployment may no longer HOLD, for the carry and its cleanup, which ask
+     * a wiped copy whether it carries the `carried_away` tombstone (#2563). Not guarded: a wiped copy
+     * answers nothing else. Not for a screen or a console; those use `introspectScopeTable`.
+     */
+    readTombstoneTable(scopeId: ScopeId, input: ReadScopeTableInput): Promise<ScopeTablePage>;
+    /** The SQL console's CP-less path (#219): guarded as the table page is (#2563). */
     introspectScopeQuery(scopeId: ScopeId, input: QueryScopeInput): Promise<ScopeQueryResult>;
     /**
      * The K-35 denial log's CP-less path (#867) — same trust line as the reads above.
@@ -1033,8 +1810,13 @@ export declare class CloudflareScopeHost implements ScopeHost {
     entityHistoryLocal(scopeId: ScopeId, input: EntityHistoryInput): Promise<Page<HistoryEntry>>;
     /** When this host's own scope applied each migration (#1236) — the vertical-host read. */
     appliedMigrationsLocal(scopeId: ScopeId): Promise<AppliedMigration[]>;
-    /** This host's own scope's database size in bytes (#1524), the vertical-host read. */
+    /**
+     * This host's own scope's database size in bytes (#1524), the vertical-host read. A scope this
+     * deployment does not hold is refused (#2541), not read as 0.
+     */
     databaseSizeLocal(scopeId: ScopeId): Promise<number>;
+    /** This host's own scope's attachment bytes (#2501), the vertical-host read; refused as the size is. */
+    attachmentSizeLocal(scopeId: ScopeId): Promise<number>;
     /**
      * Each scope store's size in this deployment (#2207). The control plane already
      * audited the ask; this end does not write the access log again.
@@ -1180,6 +1962,12 @@ export declare class CloudflareScopeHost implements ScopeHost {
      */
     private openAttachmentBytes;
     importScope(actor: PlatformActorId, input: ProvisionScopeInput, dump: ScopeDumpInput): Promise<void>;
+    /**
+     * `importScope`, with its role judgement (#2555) when `judge`, made before the scope is created so a
+     * refused import leaves nothing behind. A snapshot passes false: it is the platform's copy of a live
+     * scope of this host, made at once, so its seats are the ones that scope holds now (K-55).
+     */
+    private importScopeFrom;
     restoreScope(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId, dump: ScopeDumpInput, opts?: {
         sourceScopeId?: ScopeId;
     }): Promise<StoreErasureReplay | void>;
@@ -1537,7 +2325,9 @@ export declare class CloudflareScopeHost implements ScopeHost {
      * grant — see the kernel interface doc.
      */
     checkFreshness(moduleId: ModuleId, tenantId: TenantId, scopeId: ScopeId): Promise<FreshnessReport>;
-    runDueSchedules(moduleId: ModuleId, tenantId: TenantId, scopeId: ScopeId): Promise<ScheduleRunReport>;
+    runDueSchedules(moduleId: ModuleId, tenantId: TenantId, scopeId: ScopeId, 
+    /** #2517: what the sweep tick's earlier calls did to this scope (`ScopeHost.runDueSchedules`). */
+    tick?: ScheduleTick): Promise<ScheduleRunReport>;
     /** The stub body, shared by the principal, connection, system and impersonation doors. */
     private buildStub;
     close(): Promise<void>;
@@ -1908,6 +2698,78 @@ export declare class CloudflareScopeHost implements ScopeHost {
         /** #2430: delivered connection grants not seated because they name a reserved key; absent when none. */
         skippedConnectionGrants?: SkippedConnectionGrant[];
     }>;
+    /**
+     * #2447: what a tenant's role definition is judged with, beyond the stored roles the ControlPlaneDO
+     * reads in its own unit:
+     * - the reservations of this host's modules, joined with the scope class's. Every scope on this
+     *   binding is one class, so one of the tenant's scopes answers for all, and the fan-out after
+     *   the write projects into exactly those scopes. A tenant with no scope yet is judged by this
+     *   host's modules alone (a stated residual: its first scope's projection is not judged again);
+     * - for a `holder: 'system'` definition of a key with no system-held definition stored (none at
+     *   all included: a seat can outlive its role's row), whether anyone but a system principal holds a
+     *   live scope-level seat in it in one of those scopes (the ControlPlaneDO reads the tenant-level
+     *   seats). No scope is asked for seats otherwise.
+     *
+     * Every scope that is not reaped is read, a scope archived straight from `provisioning` included:
+     * the platform's door seats into a provisioning scope, and unarchive brings the seat back. A DO
+     * cannot be asked anything without waking it, and waking one that never ran would create storage it
+     * never had (#1524), so such a scope is read only when its directory row records a migration
+     * (`schema_version` past `'0'`). That is not a mark of instantiation: it counts the module
+     * migrations applied, and is written only when a pass applied one, so a scope of a class with no
+     * module migrations reads `'0'` though it holds a seat. One that records none is not read, and the
+     * definition fails closed where that scope could decide it: `unreadable` names it, and the caller
+     * refuses a definition its seats, or its class's reservations when no other scope gives them, would
+     * decide. So while such a scope is the tenant's only one, every definition is refused until it is
+     * unarchived or reaped. No product path reaches this today: the dashboard is the one Cloudflare
+     * caller of `defineRole`, and its class has migrations.
+     *
+     * A stated residual: this half is read before the ControlPlaneDO's unit, not in it, so a scope-level
+     * seat made in between is not seen. The tenant-level seats and the stored roles are read in the unit.
+     */
+    private definitionContext;
+    /**
+     * #2447: why `roles` may not be defined on `scopeId`, judged as a set against this host's
+     * reservations joined with the scope class's, or null. A restore asks it before it imports a dump,
+     * which replaces whatever the scope stores now, so what the set is judged against is the DUMP's
+     * roles and seats for `dump.tenantId` (`dumpRoleState`), when the caller has the dump in hand. A
+     * staged restore has not (its pages are already in the scope), so it is judged as a set alone
+     * here, and `projectRolesLocal` judges again after the import, against what the dump brought.
+     */
+    roleSetRefusalLocal(scopeId: ScopeId, roles: RoleDefinition[], dump?: {
+        tenantId: TenantId;
+        tables: readonly DumpTable[];
+    }): Promise<string | null>;
+    /**
+     * #2555: refuse loading `dump` into a scope of `tenantId` (`dumpRoleRefusal`): the tenant's roles as
+     * the directory stores them now, against the dump's role rows and seats, with this host's
+     * reservations joined with the scope class's. The class is read at `scopeId` when the scope exists
+     * (a restore), else at a live scope of the tenant (an import, whose scope is not created yet: asking
+     * its object would create storage for a scope a refusal leaves unmade).
+     *
+     * Two stated residuals. The directory is read here and the dump is loaded in the scope's own call,
+     * so a role defined between the two is not judged against the dump's seats. And an import for a
+     * tenant with no live scope reads no class, so it is judged with this host's reservations alone: the
+     * seat rule holds without them, and a key only the class reserves is not counted.
+     */
+    private refuseDumpRoles;
+    /**
+     * #2446: the roles `scopeId` stores for `tenantId` and the role keys anyone but a system principal
+     * holds a live seat in there: what `refuseReservedRoleSet` judges a reconcile's role set against
+     * (`roleStateHere`), read for a promote to judge the incoming version's set with
+     * (`releaseRoleSetRefusal`) before it moves the scope. Read-only, and names no principal.
+     */
+    roleStateLocal(tenantId: TenantId, scopeId: ScopeId): Promise<RoleState>;
+    /**
+     * #2447: refuse a role set a CP-less provision or restore defines on `scopeId` for `tenantId`
+     * (`reservedRoleSetRefusal`), against this host's reservations joined with the scope class's,
+     * and the roles the scope stores for the tenant now with their seats there. Answers the reserved
+     * keys it judged with, for the seats the same call makes.
+     *
+     * A stated residual: the scope state is read in one RPC (`roleStateHere`) and written in another
+     * (`applyProjectionReply`), so a seat made between the two is not seen. The window is one call
+     * wide, and a reconcile runs again every pass.
+     */
+    private refuseReservedRoleSet;
     /**
      * #2430: the delivered connection grants a provision or reconcile may seat, and those it skips. A
      * connection acts for the external provider holding its token, so a grant naming a key reserved
@@ -1968,7 +2830,15 @@ export declare class CloudflareScopeHost implements ScopeHost {
      * storage. Idempotent (writeTuple is INSERT OR REPLACE). `roleKey` must be one the scope
      * already projected (via `provisionScopeLocal`), or the local checker expands it to nothing.
      */
-    assignScopeRole(scopeId: ScopeId, principal: PrincipalId, roleKey: string): Promise<void>;
+    assignScopeRole(scopeId: ScopeId, principal: PrincipalId, roleKey: string, 
+    /** #2447: `person` when the caller knows it seats a person (the owner hand-over); the platform's door otherwise. */
+    door?: 'person' | 'platform'): Promise<void>;
+    /**
+     * #2447: why `roleKey` may not be seated at scope level through `door`, or null — the question
+     * `assignScopeRole` asks before it writes, for a caller (the owner hand-over) that must ask it
+     * before anything else moves.
+     */
+    scopeRoleRefusal(scopeId: ScopeId, roleKey: string, door: 'person' | 'platform'): Promise<string | null>;
     /**
      * Take a scope-level role back — the counterpart `assignScopeRole` went without (#1161).
      * A tombstone, exactly as `HostAdmin.unassignRole` writes for a scope-level assignment:
@@ -2068,6 +2938,13 @@ export declare class CloudflareScopeHost implements ScopeHost {
      * so a caller falls back rather than failing a dispatch over a missing file.
      */
     connectorAttachmentOpenLocal(connectionId: ConnectionId, tenantId: TenantId, scopeId: ScopeId, attachmentId: string, eventId?: string): Promise<OpenedAttachment | null>;
+    /**
+     * `connectorAttachmentOpenLocal`, with the bytes as a stream read from R2 as the platform reads
+     * the response (#2514). The same gates, in the same order, before the bucket is touched.
+     */
+    connectorAttachmentOpenStreamLocal(connectionId: ConnectionId, tenantId: TenantId, scopeId: ScopeId, attachmentId: string, eventId?: string): Promise<OpenedAttachmentStream | null>;
+    /** The attachment surface the platform's reads as a connection go through, behind their gates. */
+    private connectorReadSurface;
     /**
      * The delivery half of `grantToConnection` for a scope served HERE (#574): write
      * the scope-local `connection:<id>` grant tuple the permission checker reads.
@@ -2215,4 +3092,5 @@ export declare class CloudflareScopeHost implements ScopeHost {
      */
     versionConnectionLandings(verticalSlug: string, versionId: string): Promise<ManifestConnectionLandings>;
 }
+export {};
 //# sourceMappingURL=host.d.ts.map