@voltro/protocol 0.80.0 → 0.82.0

package/dist/index.d.ts

@@ -8,6 +8,7 @@ import { RpcMiddleware } from '@effect/rpc';
 import { Schema } from 'effect';
 import { SqlClient } from '@effect/sql';
 import { Stream } from '@effect/rpc/RpcSchema';
+import { VersionConflict } from '@voltro/database/wire';
 
 export declare interface ActionProcedureDescriptor<Name extends string, Input extends Schema.Schema.Any, Output extends Schema.Schema.Any, Error extends Schema.Schema.All> {
     readonly kind: 'action';
@@ -37,6 +38,9 @@ export declare interface ActionProcedureDescriptor<Name extends string, Input ex
      *  `openAccess: '<why>'`. Mutually exclusive with `guards`; together they are
      *  the only two shapes `security.defaultDeny` accepts. */
     readonly openAccess: string | undefined;
+    /** Only these apps of the project may call this procedure — see `service` on
+     *  the definer's options. Absent → the app's own clients call it. */
+    readonly service: ServiceSpec | undefined;
     /** Opt this action into a public REST endpoint (innovation/11). */
     readonly publicApi: PublicApiSpec | undefined;
     /** Opt this action into the auto-synthesized agent toolset (innovation/07). */
@@ -80,6 +84,46 @@ export declare const ADMIN_SCOPE = "admin:full";
  *  so the wording lives beside the semantics it describes. */
 export declare const advisoryResourceGuardWarning: (tags: ReadonlyArray<string>) => string;
 
+/**
+ * What an UNAUTHENTICATED caller is — the app's decision, never the request's.
+ *
+ * A request that matches no auth strategy still resolves to a Subject, and
+ * that Subject's `tenantId` decides what every tenant-scoped table and every
+ * `openAccess` procedure answers. Left to the request, the `x-tenant` header
+ * would choose it: any client could read any tenant's public-per-tenant data,
+ * and a procedure that was `openAccess` for the tenant's MEMBERS would answer
+ * for whichever tenant the header named. So the policy is declared once, in
+ * `app.config.ts` (`auth.anonymous`), and `voltro serve` refuses to boot
+ * without it.
+ *
+ * - `'refuse'` — no unauthenticated callers at all: `Unauthenticated`.
+ * - `'no-tenant'` — the caller carries the empty tenant `''`: every
+ *   tenant-scoped read is empty (fails closed), tables without `tenant()` and
+ *   procedures that need no tenant answer. The default of the composer, and
+ *   the right choice for an api whose public surface is token-shaped (an
+ *   invite preview, a signed link).
+ * - `'header'` — the tenant is what the request's `x-tenant` header names; a
+ *   request without it is refused. For public-per-tenant data (a marketing
+ *   site per tenant, public listings by slug) — and ONLY that: every
+ *   `openAccess` procedure and every table without `tenant()` is then public
+ *   for a client-chosen tenant.
+ * - `{ tenantId }` — every unauthenticated caller is that ONE tenant, chosen
+ *   here; the header is not consulted.
+ *
+ * NEVER `null`: a null tenant is a SYSTEM subject to the store and reads
+ * unscoped, across every tenant.
+ */
+export declare type AnonymousPolicy = 'refuse' | 'no-tenant' | 'header' | {
+    readonly tenantId: string;
+};
+
+/** The development boot's convenience, which no app config can name: the
+ *  header's tenant, else the dev tenant. `voltro dev` runs an undecided app
+ *  with it and says so; `voltro serve` refuses instead. */
+export declare type AnonymousPolicyOrDevTenant = AnonymousPolicy | {
+    readonly headerOrTenant: string;
+};
+
 export declare const anonymousSubject: (tenantId: string | null, credentialRejected?: string) => Subject;
 
 /** The erased policy a descriptor carries (input generic dropped). */
@@ -89,9 +133,9 @@ export declare interface AnyApprovalPolicy {
     readonly reason?: string;
 }
 
-/** A guard entry is a scope check, a relationship check, an identity check, or
- *  a declared no-check-needed decision. */
-export declare type AnyCheckSpec = GuardCheckSpec | PolicyCheckSpec | AuthenticatedCheckSpec | OpenAccessSpec;
+/** A guard entry is a scope check, a relationship check, an identity check, a
+ *  declared no-check-needed decision, or a service-only decision. */
+export declare type AnyCheckSpec = GuardCheckSpec | PolicyCheckSpec | AuthenticatedCheckSpec | OpenAccessSpec | ServiceAccessSpec;
 
 /** Any declared event, with the generics erased — for registries and audits. */
 export declare type AnyEventDescriptor = EventDescriptor<string, Schema.Schema.Any, Schema.Schema.Any>;
@@ -130,6 +174,21 @@ export declare const APIKEY_ISSUE_OTHER_SCOPE = "apikeys:issue:other";
  */
 export declare const APIKEY_ISSUE_SELF_SCOPE = "apikeys:issue:self";
 
+export declare class ApiUnavailable extends ApiUnavailable_base {
+}
+
+declare const ApiUnavailable_base: Schema.TaggedErrorClass<ApiUnavailable, "ApiUnavailable", {
+    readonly _tag: Schema.tag<"ApiUnavailable">;
+} & {
+    /** The binding name on the caller (`apis.<name>`). */
+    api: typeof Schema.String;
+    /** The rpc tag that was called. */
+    tag: typeof Schema.String;
+    /** Why no answer arrived. */
+    reason: Schema.Literal<["timeout", "transport", "closed"]>;
+    message: typeof Schema.String;
+}>;
+
 /** The subject a decision produces, plus what the decision took away. `removed`
  *  is never non-empty for a `grant`. */
 export declare interface AppliedScopes {
@@ -137,6 +196,9 @@ export declare interface AppliedScopes {
     readonly removed: ReadonlyArray<string>;
 }
 
+/** Keep a pairing for the next boot; the app reads it when it builds its api config. */
+export declare const applyPairing: (storage: PairingStorage, pairing: Pairing) => Promise<void>;
+
 export declare const applyRowPatch: (prev: ReadonlyArray<PatchRow>, patch: RowPatch, options?: ApplyRowPatchOptions) => ReadonlyArray<PatchRow>;
 
 /**
@@ -556,7 +618,7 @@ export declare interface AuthStrategy {
     readonly resolve: (input: AuthStrategyInput) => Promise<StrategyResolution> | StrategyResolution;
     /**
      * The bearer-token PREFIX this strategy claims, when it gates on one
-     * (`'sk_'`, `'awb_'`). Declared so a collision is DETECTABLE.
+     * (`'sk_'`, `'acme_'`). Declared so a collision is DETECTABLE.
      *
      * Two strategies claiming the same prefix is not a harmless duplicate: the
      * chain is first-match-wins, so whichever runs first decides the Subject —
@@ -677,7 +739,7 @@ export declare type AuthSubjectGuardVerdict = {
  * `fresh` the caller runs the handler then calls `finish`/`fail`; on
  * `replay`/`conflict` it returns immediately without touching the handler.
  */
-export declare const beginIdempotent: (store: IdempotencyStore, scope: string, key: string, ttlMs: number, now: number) => Promise<IdempotencyOutcome>;
+export declare const beginIdempotent: (store: IdempotencyStore, scope: string, key: string, ttlMs: number, now: number, inFlightLeaseMs?: number) => Promise<IdempotencyOutcome>;
 
 /**
  * A cross-table business rule was violated inside a mutation's transaction; the
@@ -754,9 +816,14 @@ export declare const checkGuards: (subject: Subject, guards: ReadonlyArray<AnyCh
  *
  * Returns a typed `ScopeError` naming the first unmet scope, or `null` when
  * every guard passes. The runtime calls this in the dispatch spine BEFORE the
- * executor (mutations: before the transaction opens).
+ * executor (mutations: before the transaction opens). A resolver or tuple
+ * source that answers `'missing'` turns the refusal into `NoSuchResource` for
+ * a signed-in caller — the first failing guard decides, so a scope refusal
+ * ahead of it is never upgraded into a disclosure.
  */
-export declare const checkGuardsEffect: (subject: Subject, guards: ReadonlyArray<AnyCheckSpec> | undefined, input: unknown, options?: GuardCheckOptions) => Effect.Effect<ScopeError | Unauthenticated | null>;
+export declare const checkGuardsEffect: (subject: Subject, guards: ReadonlyArray<AnyCheckSpec> | undefined, input: unknown, options?: GuardCheckOptions) => Effect.Effect<ScopeError | Unauthenticated | NoSuchResource | null>;
+
+export declare const clearPairing: (storage: PairingStorage) => Promise<void>;
 
 export declare interface ClientDescriptor {
     readonly kind: 'query' | 'mutation' | 'action' | 'stream' | 'workflow';
@@ -817,42 +884,17 @@ export declare interface ClientTarget {
 export declare const compareSurfaces: (mine: Readonly<Record<string, string>>, theirs: Readonly<Record<string, string>>) => SurfaceMismatch;
 
 export declare const composeAuthStrategies: (strategies: ReadonlyArray<AuthStrategy>, options?: {
-    /** Fallback when no strategy matched. Default: returns the input's
-     *  tenant from `x-tenant` header or null. */
+    /** Fallback when no strategy matched. Replaces `anonymous` entirely: the
+     *  function owns the anonymous subject AND the rejected-credential decision. */
     readonly fallback?: (input: AuthStrategyInput) => Subject;
     /** Hook for logging — called on every `failed` resolution. */
     readonly onStrategyFailed?: (event: {
         strategyId: string;
         reason: string;
     }) => void;
-    /**
-     * Reject anonymous callers that carry no tenant. When `true` and no
-     * strategy matched AND no `x-tenant` header is present, the resolver
-     * throws `Unauthenticated` instead of returning a null-tenant
-     * anonymous Subject. Use it on multi-tenant apps where every call —
-     * even an anonymous one — must be scoped to a tenant; without it a
-     * tenant-less anonymous Subject can read across the whole DB on
-     * tables that aren't `tenant()`-scoped. Ignored when a custom
-     * `fallback` is supplied (the fallback owns that decision).
-     */
-    readonly anonymousTenantRequired?: boolean;
-    /**
-     * The ONE tenant every anonymous caller resolves to — chosen by the server,
-     * never by the request. When set, the `x-tenant` header is not consulted:
-     * a client naming its own tenant is exactly the thing a fixed anonymous
-     * tenant exists to rule out. Ignored when `fallback` is supplied (that
-     * function owns the anonymous subject).
-     */
-    readonly anonymousTenantId?: string;
-    /**
-     * The tenant an anonymous caller resolves to when its request names none
-     * in `x-tenant`. The header still wins when present — this only replaces
-     * the `null` tenant. It exists so a boot path can supply a default tenant
-     * without a `fallback`: a `fallback` owns the rejected-credential decision,
-     * this does not, so a presented-and-rejected credential is still refused.
-     * Ignored when `anonymousTenantId` or `fallback` is set.
-     */
-    readonly anonymousTenantDefault?: string;
+    /** What an unauthenticated caller is — see {@link AnonymousPolicy}.
+     *  Default `'no-tenant'`. Ignored when `fallback` is supplied. */
+    readonly anonymous?: AnonymousPolicyOrDevTenant;
     /**
      * The subject's memberships — the ONE source, strategy-independent. Read
      * only when a stored tenant selection exists for the subject and names a
@@ -1348,8 +1390,8 @@ export declare interface CoordinatedScheduleHandle {
  */
 export declare interface CoordinatedTaskOptions {
     /**
-     * Stop ticking entirely on an idle tick with no pending deadline, and come
-     * back only on `wake()`. Default `false`.
+     * Stop ticking entirely on an idle tick that reports `nextDueInMs: null`
+     * (nothing scheduled), and come back only on `wake()`. Default `false`.
      *
      * Pass `true` only when an arrival is GUARANTEED to call `wake()` — a change
      * subscription on the table your task drains, on a deployment where remote
@@ -1363,10 +1405,17 @@ export declare interface CoordinatedTaskOptions {
 export declare interface CoordinatedTickOutcome {
     /** `true` when the tick found nothing to do. Only an idle tick backs off. */
     readonly idle: boolean;
-    /** Milliseconds until the earliest deadline this task already knows about.
-     *  Caps the backoff, so a task that is idle now but has something due in
-     *  400 ms is armed for 400 ms rather than for the idle ceiling. */
-    readonly nextDueInMs?: number;
+    /** Milliseconds until the earliest deadline this task already knows about —
+     *  a retry, a re-poll, a lease running out. Caps the backoff, so a task that
+     *  is idle now but has something due in 400 ms is armed for 400 ms rather
+     *  than for the idle ceiling.
+     *
+     *  `null` says "nothing is scheduled; new work can only arrive as a write",
+     *  and is the ONLY idle report that lets a `disarmWhenIdle` task stop
+     *  ticking. Leaving the field out backs off instead: work that comes due on
+     *  a clock writes nothing, so nothing would ever wake a task that disarmed
+     *  while holding it. */
+    readonly nextDueInMs?: number | null;
 }
 
 /**
@@ -1379,11 +1428,33 @@ export declare interface CoordinatedTickOutcome {
  * because that is where the normalised decision lands, and because every
  * enforcement path reads the descriptor's array and nothing else.
  */
-export declare type DeclaredAccess<Input = unknown> = ReadonlyArray<AnyGuardSpec<Input> | OpenAccessSpec>;
+export declare type DeclaredAccess<Input = unknown> = ReadonlyArray<AnyGuardSpec<Input> | OpenAccessSpec | ServiceAccessSpec>;
 
 /** Every channel declared in this process, by routing key. */
 export declare const declaredReactivityChannelKeys: () => ReadonlySet<string>;
 
+/**
+ * Does this guard list name a resource — a relationship guard, or a scope guard
+ * with a `resource` extractor? Exactly the guards whose resolver may answer
+ * `'missing'`, so exactly the procedures whose wire union carries
+ * {@link NoSuchResource}.
+ */
+export declare const declaresResourceGuard: (guards: ReadonlyArray<AnyCheckSpec> | undefined) => boolean;
+
+/**
+ * How long a RUNNING claim holds without renewal.
+ *
+ * A claim used to go stale only after the replay window — 24 hours by default —
+ * so a process that died inside a handler left its key `in_flight` for a day:
+ * every retry was refused as "still in flight", including the retry of a
+ * workflow step whose callee had simply restarted. A live handler renews its
+ * claim every third of this (`holdIdempotentClaim`); a dead one stops, and the
+ * next retry takes over after at most this long. A handler that blocks its event
+ * loop longer than this can be taken over while still running — the same bound
+ * every lease has.
+ */
+export declare const DEFAULT_IN_FLIGHT_LEASE_MS = 30000;
+
 /** Default cap on cached subjects before the cache sweeps + trims. */
 export declare const DEFAULT_SCOPE_CACHE_MAX_ENTRIES = 10000;
 
@@ -1418,6 +1489,26 @@ export declare const defineAction: <const Name extends string, Input extends Sch
      *     openAccess: 'public pricing page — reads no caller data'
      */
     readonly openAccess?: string;
+    /**
+     * Make this a SERVICE procedure: callable only by the listed apps of this
+     * project, and by nobody else — no browser session, no API key, no admin.
+     *
+     *     service: { callers: ['worker'] }
+     *
+     * The caller is another app that binds this one under `apis:` and calls it as
+     * `ctx.apis.<name>.<tag>(input)`; it authenticates with the service credential
+     * this app accepts under `serviceCallers`. It is its own access decision, so it
+     * satisfies `security.defaultDeny` and cannot sit beside `guards:` or
+     * `openAccess:`.
+     *
+     * The handler runs as the calling SERVICE: it reads across tenants and must
+     * name a tenant to write into one — `ctx.storeForTenant(input.tenantId)` is the
+     * shape for per-tenant work.
+     *
+     * Codegen emits it into `serviceGroup.generated.ts`, never into the browser's
+     * `rpcGroup.generated.ts`.
+     */
+    readonly service?: ServiceSpec;
     /** Table(s) this action READS. Declaring it is what lets `voltro check` know
      *  the table is alive — without it, a table only an action touches reads as
      *  an orphan. See `ActionProcedureDescriptor.source`. */
@@ -1631,6 +1722,26 @@ export declare const defineMutation: <const Name extends string, Input extends S
      *     openAccess: 'public pricing page — reads no caller data'
      */
     readonly openAccess?: string;
+    /**
+     * Make this a SERVICE procedure: callable only by the listed apps of this
+     * project, and by nobody else — no browser session, no API key, no admin.
+     *
+     *     service: { callers: ['worker'] }
+     *
+     * The caller is another app that binds this one under `apis:` and calls it as
+     * `ctx.apis.<name>.<tag>(input)`; it authenticates with the service credential
+     * this app accepts under `serviceCallers`. It is its own access decision, so it
+     * satisfies `security.defaultDeny` and cannot sit beside `guards:` or
+     * `openAccess:`.
+     *
+     * The handler runs as the calling SERVICE: it reads across tenants and must
+     * name a tenant to write into one — `ctx.storeForTenant(input.tenantId)` is the
+     * shape for per-tenant work.
+     *
+     * Codegen emits it into `serviceGroup.generated.ts`, never into the browser's
+     * `rpcGroup.generated.ts`.
+     */
+    readonly service?: ServiceSpec;
     /** Project this mutation as a public REST endpoint (innovation/11). */
     readonly publicApi?: PublicApiSpec;
     /** Expose this mutation as an agent tool (innovation/07). */
@@ -1764,6 +1875,26 @@ export declare const defineQuery: <const Name extends string, Input extends Sche
      *     openAccess: 'public pricing page — reads no caller data'
      */
     readonly openAccess?: string;
+    /**
+     * Make this a SERVICE procedure: callable only by the listed apps of this
+     * project, and by nobody else — no browser session, no API key, no admin.
+     *
+     *     service: { callers: ['worker'] }
+     *
+     * The caller is another app that binds this one under `apis:` and calls it as
+     * `ctx.apis.<name>.<tag>(input)`; it authenticates with the service credential
+     * this app accepts under `serviceCallers`. It is its own access decision, so it
+     * satisfies `security.defaultDeny` and cannot sit beside `guards:` or
+     * `openAccess:`.
+     *
+     * The handler runs as the calling SERVICE: it reads across tenants and must
+     * name a tenant to write into one — `ctx.storeForTenant(input.tenantId)` is the
+     * shape for per-tenant work.
+     *
+     * Codegen emits it into `serviceGroup.generated.ts`, never into the browser's
+     * `rpcGroup.generated.ts`.
+     */
+    readonly service?: ServiceSpec;
     /** Project this query as a public REST endpoint (innovation/11). */
     readonly publicApi?: PublicApiSpec;
     /** Expose this query as an agent tool (innovation/07). */
@@ -1933,6 +2064,20 @@ export declare const encodeRestError: (format: RestFormat, error: RestFormatErro
  */
 export declare const encodeRestSuccess: (format: RestFormat, value: unknown, ctx: RestFormatContext) => RestFormatResponse;
 
+/**
+ * The text to SHOW for a failure value — its `message`, else its `_tag`, else
+ * `String(value)`.
+ *
+ * Its partner above, for the same reason: every client surface hands over the
+ * declared error as the plain `{ _tag, …fields, message }` object the wire
+ * carries, and `String()` of a plain object is `[object Object]`. A
+ * subscription used to hand over an Effect `Cause`, whose `String()` happened
+ * to read, so `String(error)` in an error banner or an `error.tsx` looked right
+ * until the value became what the docs always said it was. Works on an `Error`,
+ * a `Schema.TaggedError` instance, the wire object and a bare string alike.
+ */
+export declare const errorMessage: (err: unknown) => string;
+
 /**
  * Read the `_tag` off a thrown error value, or `undefined` when it has none.
  *
@@ -2308,9 +2453,10 @@ export declare const finishIdempotent: (store: IdempotencyStore, scope: string,
  *
  * A query's success type is the three-member union above, and a one-shot read
  * takes only its first event: a `snapshot` resolves to its `data`; an `error`
- * REJECTS — with the typed error on `cause` and `voltroError`, so a caller can
- * still branch on its `_tag` — exactly as a failed exit would; a `delta` cannot
- * be first and says so. Anything else is a mutation or action's own result and
+ * REJECTS with the typed error ITSELF — exactly as a failed exit does, and the
+ * same value a live subscription's `error` and the api's error bus hand over,
+ * so one `_tag` switch serves every surface; a `delta` cannot be first and says
+ * so. Anything else is a mutation or action's own result and
  * passes through, which may legitimately be a tagged object of the app's.
  *
  * Shared because there are two such reads — the server loader's `ctx.query`
@@ -2326,6 +2472,31 @@ export declare const firstEventValue: (tag: string, value: unknown, label: strin
 /** A route rendered for humans — logs, the inspect surface, the dashboard. */
 export declare const formatEventRoute: (route: string) => string;
 
+/**
+ * The framework errors EVERY procedure of a kind carries on its wire union —
+ * the unconditional members `wireErrorUnion` adds. The conditional ones (a
+ * resource guard's `NoSuchResource`, `requiresApproval`'s refusals,
+ * `MutationConnectionRequired`) are left out on purpose: a type that cannot see
+ * the condition must not promise them.
+ *
+ * It exists for the TYPE-level reader, `defineExecutor`, which checks an
+ * executor's failure channel against the union the server will judge it by. A
+ * test pins it against `wireErrorUnion` per kind, so the two cannot drift.
+ */
+export declare const FRAMEWORK_WIRE_ERRORS: {
+    readonly query: readonly [typeof ScopeError, typeof Unauthenticated];
+    readonly stream: readonly [typeof ScopeError, typeof Unauthenticated];
+    readonly action: readonly [typeof ScopeError, typeof Unauthenticated, typeof ValidationError, typeof ValidationErrors];
+    readonly mutation: readonly [typeof ScopeError, typeof Unauthenticated, typeof BusinessRuleViolation, typeof MutationInFlight, typeof VersionConflict, typeof ValidationError, typeof ValidationErrors];
+};
+
+/** The error values {@link FRAMEWORK_WIRE_ERRORS} admits for `Kind`. */
+export declare type FrameworkWireError<Kind extends WireProcedureKind> = Schema.Schema.Type<(typeof FRAMEWORK_WIRE_ERRORS)[Kind][number]>;
+
+/** How long a record of this status stays fresh — the replay window for a
+ *  completed response, the lease for a running one (never longer than the window). */
+export declare const freshFor: (status: IdempotencyRecord["status"], ttlMs: number, inFlightLeaseMs: number) => number;
+
 /** Close code a gateway connection receives when its credential expires —
  *  the same session-expiry contract the rpc socket has (SEC-16), spelled as
  *  an application close code so foreign clients can reauth + reconnect. */
@@ -2448,6 +2619,9 @@ export declare const hasEnforcedGuard: (guards: DeclaredAccess | undefined) => b
  *  the RAW subject scopes — use `hasEffectiveScope` to include rbac roles. */
 export declare const hasScope: (subject: Subject, scope: string) => boolean;
 
+/** Renew a fresh claim's lease while its handler runs; returns the stop. */
+export declare const holdIdempotentClaim: (store: IdempotencyStore, scope: string, key: string, inFlightLeaseMs?: number, now?: () => number) => (() => void);
+
 /**
  * Short-circuit response shape. Returning a `HttpInterceptResponse`
  * from the interceptor halts the pipeline — the framework sends the
@@ -2547,14 +2721,24 @@ export declare interface IdempotencyStore {
     /** Current record for (scope, key), or null. Read-side (inspect/dashboard). */
     readonly get: (scope: string, key: string) => Promise<IdempotencyRecord | null>;
     /**
-     * Atomically claim (scope, key) IF absent OR stale (older than `ttlMs`):
+     * Atomically claim (scope, key) IF absent OR stale — a COMPLETED record older
+     * than `ttlMs` (the replay window), or an IN-FLIGHT one whose lease
+     * (`inFlightLeaseMs`, renewed by the live handler) lapsed:
      * write a fresh `in_flight` row and return `'claimed'`. Otherwise return the
      * EXISTING (still-fresh) record. The atomicity here is the whole game — two
      * concurrent same-key requests both hit this, exactly one gets `'claimed'`,
      * the loser reads the winner's record. In SQL this is one
      * `INSERT … ON CONFLICT DO UPDATE … WHERE existing.createdAt < now - ttl`.
      */
-    readonly claim: (scope: string, key: string, now: number, ttlMs: number) => Promise<'claimed' | IdempotencyRecord>;
+    readonly claim: (scope: string, key: string, now: number, ttlMs: number, inFlightLeaseMs: number) => Promise<'claimed' | IdempotencyRecord>;
+    /**
+     * Extend a RUNNING claim's lease: bump its timestamp while it is still
+     * `in_flight` (a completed or released claim is left alone). The server calls
+     * it while the handler runs; a process that dies stops calling it, and its
+     * claim goes stale after `inFlightLeaseMs` instead of after the whole replay
+     * window.
+     */
+    readonly renew: (scope: string, key: string, now: number) => Promise<void>;
     /** Flip the claim to `completed` and store the response. */
     readonly complete: (scope: string, key: string, response: IdempotencyResponse, now: number) => Promise<void>;
     /** Drop the claim (handler errored → a retry may re-process). */
@@ -2637,12 +2821,21 @@ export declare interface InsertTarget<Input = unknown, Row = unknown, Item = Rec
     readonly shapeItem?: ((input: Input, optimisticId: string) => Item) | undefined;
 }
 
+/** Is this failure a missing answer (retry it) rather than an answer (do not)? */
+export declare const isApiUnavailable: (error: unknown) => error is ApiUnavailable;
+
 /** Runtime narrowing for the identity variant. */
 export declare const isAuthenticatedCheck: (g: AnyCheckSpec) => g is AuthenticatedCheckSpec;
 
 /** Narrow a guard entry to the identity variant. */
 export declare const isAuthenticatedGuard: <I>(g: AnyGuardSpec<I>) => g is AuthenticatedGuardSpec;
 
+/** Belongs in the app's own client group (`rpcGroup.generated.ts`). */
+export declare const isClientReachable: (descriptor: {
+    readonly internal?: boolean | undefined;
+    readonly service?: ServiceSpec | undefined;
+}) => boolean;
+
 export declare const isEventDescriptor: (value: unknown) => value is AnyEventDescriptor;
 
 /** True when every row in the set carries an `id`. The dispatcher uses
@@ -2651,6 +2844,17 @@ export declare const isEventDescriptor: (value: unknown) => value is AnyEventDes
  *  diffed by id and falls back to shipping the full data. */
 export declare const isIdKeyed: (rows: ReadonlyArray<Readonly<Record<string, unknown>>>) => rows is ReadonlyArray<PatchRow>;
 
+/**
+ * A machine actor that works ACROSS tenants: the framework acting as itself
+ * (`system`) or another app of the project calling in (`service`).
+ *
+ * This is a statement about DATA placement only — no row filter, no implicit
+ * tenant, an explicit tenant for writes. It says nothing about authority: a
+ * service holds no scopes, and every place that lets `system` bypass a check
+ * keeps asking `isSystemSubject`.
+ */
+export declare const isMachineSubject: (subject: Subject) => boolean;
+
 /** Runtime narrowing for the declared-open variant. */
 export declare const isOpenAccess: (g: AnyCheckSpec) => g is OpenAccessSpec;
 
@@ -2676,6 +2880,20 @@ export declare const isReactivityChannel: (value: unknown) => value is Reactivit
  */
 export declare const isReactivityChannelKey: (key: string) => boolean;
 
+/** Runtime narrowing for the service-only variant. */
+export declare const isServiceAccess: (g: AnyCheckSpec) => g is ServiceAccessSpec;
+
+/** Belongs in the group other apps call (`serviceGroup.generated.ts`). */
+export declare const isServiceReachable: (descriptor: {
+    readonly internal?: boolean | undefined;
+    readonly service?: ServiceSpec | undefined;
+}) => boolean;
+
+/** Is this caller another app of the project, and which one? */
+export declare const isServiceSubject: (subject: Subject) => subject is Extract<Subject, {
+    readonly type: "service";
+}>;
+
 export declare const isSystemSubject: (subject: Subject) => boolean;
 
 export declare const isTenantSelectable: (subject: Subject) => subject is TenantSelectableSubject;
@@ -2807,6 +3025,9 @@ export declare interface MutationProcedureDescriptor<Name extends string, Input
      *  `openAccess: '<why>'`. Mutually exclusive with `guards`; together they are
      *  the only two shapes `security.defaultDeny` accepts. */
     readonly openAccess: string | undefined;
+    /** Only these apps of the project may call this procedure — see `service` on
+     *  the definer's options. Absent → the app's own clients call it. */
+    readonly service: ServiceSpec | undefined;
     /** Opt this mutation into a public REST endpoint (innovation/11). */
     readonly publicApi: PublicApiSpec | undefined;
     /** Opt this mutation into the auto-synthesized agent toolset (innovation/07). */
@@ -2862,7 +3083,7 @@ export declare interface NestedTargetFields<Input = unknown> {
     /** Guard WHICH cached query entries this target patches: only entries whose
      *  CURRENT value satisfies the predicate. Pure + browser-safe. Prevents a
      *  patch from bleeding across sibling subscriptions that share a source table
-     *  (the guard AWB hand-writes as `roadmap.id === input.roadmapId`). Absent →
+     *  (the guard an app would otherwise hand-write as `roadmap.id === input.roadmapId`). Absent →
      *  every entry matching the target `table` is patched. */
     readonly match?: ((value: unknown, input: Input) => boolean) | undefined;
 }
@@ -2917,6 +3138,32 @@ declare const NoRowFound_base: Schema.TaggedErrorClass<NoRowFound, "NoRowFound",
     found: typeof Schema.Number;
 }>;
 
+/**
+ * A resource guard's refusal when the resource it names does not exist — as
+ * far as THIS caller may know.
+ *
+ * Only an app can say that. The guard never infers absence from an empty tuple
+ * set or a `false` answer: "no relation" and "no row" look identical from the
+ * outside, and telling them apart is an existence oracle. So this is raised
+ * only when a tuple source or resolver answers `'missing'`
+ * ({@link ResourceMissing}), and only for a signed-in caller — an anonymous one
+ * gets the ordinary refusal whatever the source said.
+ *
+ * `resourceType` is the relationship guard's type, or `null` for a scope guard
+ * with a `resource` extractor (which names no type). Merged into the wire union
+ * of every procedure that declares a resource-bearing guard.
+ */
+export declare class NoSuchResource extends NoSuchResource_base {
+}
+
+declare const NoSuchResource_base: Schema.TaggedErrorClass<NoSuchResource, "NoSuchResource", {
+    readonly _tag: Schema.tag<"NoSuchResource">;
+} & {
+    resourceType: Schema.NullOr<typeof Schema.String>;
+    resourceId: typeof Schema.String;
+    message: typeof Schema.String;
+}>;
+
 /**
  * What a plugin contributes to the OTel layer via `contributeObservability`.
  * The OTel types are intentionally `unknown` so this browser-safe protocol
@@ -3001,6 +3248,38 @@ export declare const openAccessSpec: (reason: string) => OpenAccessSpec;
  */
 export declare const orderByBearerPrefix: (strategies: ReadonlyArray<AuthStrategy>, headers: Readonly<Record<string, string | undefined>>) => ReadonlyArray<AuthStrategy>;
 
+export declare interface Pairing {
+    /** The api's base url as the DEVICE reaches it — a LAN address, never `localhost`. */
+    readonly api: string;
+    /** The api process name (`main`), for the client's api binding. */
+    readonly name: string;
+    /** The dev inspect token, when the CLI knows it. */
+    readonly token?: string;
+}
+
+export declare const PAIRING_HOST = "pair";
+
+export declare const PAIRING_SCHEME = "voltro-dev";
+
+/** Where `applyPairing` keeps the record — the platform's plain storage. */
+export declare const PAIRING_STORAGE_KEY = "voltro:pairing";
+
+/** The link text. Refuses a loopback api: a phone cannot reach the laptop's `localhost`. */
+export declare const pairingLink: (pairing: Pairing) => string;
+
+/** A key/value store in either spelling: the platform's `StoreStorage`
+ *  (`getItem`/`setItem`, what `platform.storage('local')` returns) or a
+ *  `get`/`set` pair (a secure store, a test fake). */
+export declare type PairingStorage = {
+    readonly get: (key: string) => Promise<string | null> | string | null;
+    readonly set: (key: string, value: string) => Promise<void> | void;
+    readonly remove?: (key: string) => Promise<void> | void;
+} | {
+    readonly getItem: (key: string) => Promise<string | null> | string | null;
+    readonly setItem: (key: string, value: string) => Promise<void> | void;
+    readonly removeItem?: (key: string) => Promise<void> | void;
+};
+
 /** Split a route back into its three parts. */
 export declare const parseEventRoute: (route: string) => {
     readonly tenantId: string | null;
@@ -3008,6 +3287,11 @@ export declare const parseEventRoute: (route: string) => {
     readonly key: string;
 };
 
+/** The record from a link, or `null` for anything that is not a pairing link. */
+export declare const parsePairingLink: (url: string) => Pairing | null;
+
+export declare const patchCellSchema: Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>;
+
 /** A single row in a subscription result. Must carry an `id`; everything
  *  else is opaque to the patch layer. */
 export declare type PatchRow = Readonly<Record<string, unknown>> & {
@@ -3378,16 +3662,29 @@ export declare interface PluginDashboardMount {
 export declare type PluginDeactivateHook = (ctx: PluginLifecycleContext) => Effect.Effect<void, unknown> | Promise<void> | void;
 
 /**
- * An environment variable a plugin reads. DECLARATION ONLY — metadata, not a
- * read path: the plugin still reads the value itself (typically
- * `options.X ?? process.env.X`). Declaring it makes the plugin's env needs
- * visible to the env manifest (`/_voltro/inspect/env`), the generated
- * `.env.example`, and the dashboard Env panel — so an operator can see, before
- * running, exactly what each plugin expects.
- *
- * Structurally identical to `@voltro/env`'s `DeclaredEnvVar` (kept local here
- * to avoid a protocol → env package dependency).
+ * One place a plugin sends data outside the installation — folded by
+ * `voltro compliance generate` into `egress.json`, the machine-readable list an
+ * operator reviews before opening a firewall, and answers an air-gap question
+ * from. Declare what the plugin CAN reach with the options it was given: a
+ * storage plugin on the database provider reaches nothing; on s3 it reaches
+ * the bucket's endpoint.
  */
+export declare interface PluginEgressDeclaration {
+    /**
+     * Where: a host (`api.example.com`), a URL, or — when the address is data,
+     * not configuration — what decides it, prefixed `runtime:`
+     * (`runtime:webhook targets`).
+     */
+    readonly destination: string;
+    /** Why the data goes there, in one line. */
+    readonly purpose: string;
+    /** What leaves: `content` (what users write), `personal` (who someone is),
+     *  `files`, `metadata` (ids, names, timestamps), `telemetry`, `credentials`. */
+    readonly data: ReadonlyArray<'content' | 'personal' | 'files' | 'metadata' | 'telemetry' | 'credentials'>;
+    /** How an operator turns it off, and what the installation does then. */
+    readonly disable: string;
+}
+
 export declare interface PluginEnvVar {
     /** The env var name, e.g. `DD_API_KEY`. */
     readonly name: string;
@@ -3452,11 +3749,17 @@ export declare interface PluginErrorSchema {
 
 /** A public raw-HTTP route a plugin serves on the framework listener. */
 export declare interface PluginHttpRoute {
-    /** HTTP method, or `'*'` for any (the handler decides). PATCH/HEAD/OPTIONS
-     *  are first-class — the REST desugar used to mount `'*'` partly BECAUSE
-     *  this union lacked PATCH; that reason is gone (the `'*'` mount remains
-     *  for its other job: one dispatcher per shared path + a precise 405). */
+    /** HTTP method, or `'*'` for any (the handler decides). The server mounts the
+     *  path for exactly the methods its routes declare; `'*'` mounts it for every
+     *  method the router knows (34), so keep that for a route that really serves
+     *  them — see `answersOtherMethods` for one that only wants to refuse them. */
     readonly method: '*' | 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS';
+    /** `true`: the handler gates its own method, so a request with a method the
+     *  path does not declare is still handed to it — to answer with a precise
+     *  `405` and `Allow` instead of the router's `404`. The path is still mounted
+     *  only for `method`. A REST route sets it. Without it, a route that declares
+     *  one method never sees another. */
+    readonly answersOtherMethods?: boolean | undefined;
     /** Absolute path, e.g. `/_voltro/storage`. Matched byte for byte: the
      *  router folds case and a trailing slash to FIND the route, the dispatcher
      *  then asks whether the request's path is one the route declared — so
@@ -3947,6 +4250,14 @@ export declare type PluginMigrationSqlClient = SqlClient.SqlClient;
  */
 export declare type PluginPermission = 'rpc:intercept:mutation' | 'rpc:intercept:query' | 'rpc:intercept:action' | 'rpc:intercept:workflow' | 'schedule:fire' | 'schedule:read' | 'workflow:step' | 'http:intercept' | 'inspect:read' | 'inspect:write' | 'dashboard:mount' | 'store:write' | 'migration:run' | 'store:changes:read' | `secrets:read:${string}` | `network:outbound:${string}` | `plugin:hook:${string}`;
 
+/** What a plugin collects and uses — folded by `voltro compliance generate`
+ *  into PrivacyInfo.xcprivacy and the Play Data-safety answers. A plugin that
+ *  moves data (routes, tables) and declares nothing is listed by name. */
+export declare interface PluginPrivacyDeclaration {
+    readonly collects?: ReadonlyArray<PrivacyCollectedData>;
+    readonly requiredReasonApis?: ReadonlyArray<PrivacyRequiredReasonApi>;
+}
+
 /**
  * Per-call context handed to a plugin-contributed rpc route's
  * executor. Mirror of the user-handler `AppContext` shape but typed
@@ -4221,9 +4532,10 @@ export declare interface PolicyGuardRequest {
  * Answers "does `subject` have `action` on `<resourceType>:<resourceId>`".
  * Registered once at boot via `setPolicyGuardResolver`. A failed Effect is
  * treated as a DENIAL — a resolver wanting another posture catches its own
- * errors.
+ * errors. Only `true` allows; `'missing'` refuses with {@link NoSuchResource}
+ * for a signed-in caller.
  */
-export declare type PolicyGuardResolver = (req: PolicyGuardRequest) => Effect.Effect<boolean, unknown>;
+export declare type PolicyGuardResolver = (req: PolicyGuardRequest) => Effect.Effect<ResourceVerdict, unknown>;
 
 /**
  * A relationship (ReBAC) guard — "may this subject perform ACTION on THIS row?"
@@ -4255,6 +4567,38 @@ export declare interface PolicyGuardSpec<Input = unknown> {
     readonly resource: (input: Input) => string | undefined;
 }
 
+/**
+ * An environment variable a plugin reads. DECLARATION ONLY — metadata, not a
+ * read path: the plugin still reads the value itself (typically
+ * `options.X ?? process.env.X`). Declaring it makes the plugin's env needs
+ * visible to the env manifest (`/_voltro/inspect/env`), the generated
+ * `.env.example`, and the dashboard Env panel — so an operator can see, before
+ * running, exactly what each plugin expects.
+ *
+ * Structurally identical to `@voltro/env`'s `DeclaredEnvVar` (kept local here
+ * to avoid a protocol → env package dependency).
+ */
+/** One kind of data an app or plugin collects, in the vocabulary both stores
+ *  understand (`voltro compliance generate` maps it to Apple's and Google's). */
+export declare interface PrivacyCollectedData {
+    readonly category: 'name' | 'email' | 'phone' | 'physical-address' | 'identifiers' | 'device-id' | 'payment-info' | 'purchase-history' | 'precise-location' | 'coarse-location' | 'photos-or-videos' | 'audio' | 'user-content' | 'browsing-history' | 'search-history' | 'product-interaction' | 'crash-data' | 'performance-data' | 'other-diagnostic-data' | 'other-data';
+    /** Linked to the user's identity. */
+    readonly linked: boolean;
+    /** Used to track the user across apps or sites (advertising). */
+    readonly tracking: boolean;
+    readonly purposes: ReadonlyArray<'app-functionality' | 'analytics' | 'product-personalization' | 'developer-advertising' | 'third-party-advertising' | 'other'>;
+    /** Play: shared with third parties. Default false. */
+    readonly shared?: boolean;
+    /** Play: the user can decline it. Default false. */
+    readonly optional?: boolean;
+}
+
+/** Apple's required-reason API use (`NSPrivacyAccessedAPICategory…` + reason codes). */
+export declare interface PrivacyRequiredReasonApi {
+    readonly api: string;
+    readonly reasons: ReadonlyArray<string>;
+}
+
 export declare const PROBLEM_JSON = "application/problem+json; charset=utf-8";
 
 /** RFC 9457 Problem Details for one failure: `type` from the tag, `title` from
@@ -4283,6 +4627,16 @@ export declare interface ProcedureLike {
 
 export declare const procedureShapeDigest: (rpc: ProcedureLike) => string;
 
+/**
+ * The error values a procedure's wire union can carry, as far as types can
+ * tell: its own `error:`, the framework's unconditional members for its kind,
+ * and every plugin-registered error.
+ */
+export declare type ProcedureWireError<D extends {
+    readonly kind: WireProcedureKind;
+    readonly error: Schema.Schema.All;
+}> = Schema.Schema.Type<D['error']> | FrameworkWireError<D['kind']> | RegisteredPluginError;
+
 export declare const PROTOCOL_VERSION: 1;
 
 export declare type ProtocolVersion = typeof PROTOCOL_VERSION;
@@ -4425,6 +4779,13 @@ export declare interface PublicApiSpec {
      * optional, the rest inherited. See `PublicApiProfileConfig`.
      */
     readonly format?: PublicApiProfileConfig;
+    /**
+     * GET only: how long a CDN may keep a successful answer, and the tags it can
+     * purge it by (`Cache-Tag`, `Surrogate-Key`). A request with a credential is
+     * always answered `private` — see `RestCache`. `tags` receives the answer as
+     * it goes on the wire.
+     */
+    readonly cache?: RestCache;
 }
 
 /**
@@ -4512,6 +4873,9 @@ export declare interface QueryProcedureDescriptor<Name extends string, Input ext
      *  `openAccess: '<why>'`. Mutually exclusive with `guards`; together they are
      *  the only two shapes `security.defaultDeny` accepts. */
     readonly openAccess: string | undefined;
+    /** Only these apps of the project may call this procedure — see `service` on
+     *  the definer's options. Absent → the app's own clients call it. */
+    readonly service: ServiceSpec | undefined;
     /** Opt this query into a public REST endpoint (innovation/11). */
     readonly publicApi: PublicApiSpec | undefined;
     /** Opt this query into the auto-synthesized agent toolset (innovation/07). */
@@ -4584,7 +4948,7 @@ export declare const queryToRpc: <Name extends string, Input extends Schema.Sche
         }>, Schema.Struct<{
             op: Schema.Literal<["mergeCells"]>;
             path: typeof Schema.String;
-            value: Schema.Record$<typeof Schema.String, typeof Schema.Unknown>;
+            value: Schema.Record$<typeof Schema.String, Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>>;
         }>]>>;
         order: Schema.Array$<Schema.Union<[typeof Schema.String, typeof Schema.Number]>>;
     }>;
@@ -4669,6 +5033,11 @@ export declare type ReactivitySource = TableName | ReactivityChannel;
  */
 export declare type ReactivitySourceValue = string | ReactivityChannel;
 
+export declare const readPairing: (storage: PairingStorage) => Promise<Pairing | null>;
+
+/** Every error a plugin registers, as one union (`never` before codegen). */
+export declare type RegisteredPluginError = VoltroPluginErrors[keyof VoltroPluginErrors];
+
 /**
  * Declare, for this realm, what namespace each installed plugin actually
  * answers to. Emitted into `rpcGroup.generated.ts` by the codegen — one call
@@ -4685,6 +5054,19 @@ export declare type ReactivitySourceValue = string | ReactivityChannel;
  */
 export declare const registerPluginAliases: (aliases: Readonly<Record<string, string>>) => void;
 
+/**
+ * The failure value as an `Error`, for a reporter that needs one — the value
+ * itself when it already is one, else an `Error` named by its `_tag` (or
+ * `NonErrorThrown`) with `errorMessage(value)` as its message and the value as
+ * its `cause`.
+ *
+ * A loader that does not catch a refusal throws the declared error, which in a
+ * web process is the plain object decoded from the wire. Handed to an error
+ * reporter as it is, that becomes "Object captured as exception": no name to
+ * group by, no stack, no message.
+ */
+export declare const reportableError: (err: unknown) => Error;
+
 /** Gate a handler on a scope; fails with a typed `ScopeError` if missing.
  *  Checks the EFFECTIVE set so role-derived scopes count. */
 export declare const requireScope: (subject: Subject, scope: string) => Effect.Effect<void, ScopeError>;
@@ -4713,6 +5095,14 @@ export declare const resolveRestFormat: (config: PublicApiProfileConfig | undefi
  */
 export declare const resolveWorkflowAccess: (name: string, options: WorkflowAccessOptions<never>) => WorkflowAccess;
 
+/**
+ * The answer a tuple source or resolver gives when the resource a guard names
+ * does not exist for this caller. Return it only when disclosing that is
+ * acceptable — typically after a TENANT-SCOPED read, so a row in another tenant
+ * reads as missing rather than as "exists, not yours".
+ */
+export declare type ResourceMissing = 'missing';
+
 /** The question the runtime asks a registered resource-scope resolver. */
 export declare interface ResourceScopeRequest {
     /** The authenticated caller. */
@@ -4729,11 +5119,53 @@ export declare interface ResourceScopeRequest {
  * an Effect so it can read the app's role tables. It should NOT leak errors —
  * `checkGuardsEffect` treats a failed resolver as a DENIAL (fail-closed), so a
  * resolver that wants a different posture must catch its own errors.
+ *
+ * Only `true` allows. `'missing'` refuses with {@link NoSuchResource} (for a
+ * signed-in caller); anything else refuses with `ScopeError`.
  */
-export declare type ResourceScopeResolver = (req: ResourceScopeRequest) => Effect.Effect<boolean, unknown>;
+export declare type ResourceScopeResolver = (req: ResourceScopeRequest) => Effect.Effect<ResourceVerdict, unknown>;
+
+/** A resource resolver's verdict: allowed, refused, or no such resource. */
+export declare type ResourceVerdict = boolean | ResourceMissing;
 
 export declare const REST_PROFILE_NAMES: ReadonlyArray<PublicApiProfileName>;
 
+/** A BINARY streaming response (download/export). The serve layer pipes the
+ *  ReadableStream without buffering — a body larger than the heap is fine.
+ *  The LAZY thunk form defers opening the source until the response streams. */
+declare interface RestByteResponse {
+    readonly __voltroRestBytes: true;
+    readonly byteStream: {
+        readonly stream: ReadableStream<Uint8Array> | (() => ReadableStream<Uint8Array>);
+        readonly contentLength?: number;
+        readonly contentDisposition?: string;
+    };
+    readonly contentType?: string;
+    readonly status?: number;
+    readonly headers?: Readonly<Record<string, string | ReadonlyArray<string>>>;
+}
+
+/**
+ * Caching for a GET route's successful (200) answers.
+ *
+ * An anonymous request's answer is `public` for `maxAge` seconds (`max-age`
+ * and `s-maxage`), `stale-while-revalidate` when set, and carries `tags` as
+ * `Cache-Tag` (comma-separated) and `Surrogate-Key` (space-separated) — the
+ * headers CDNs purge by. A request that carries a credential (`Authorization`
+ * or a cookie) gets `private, no-cache` and no tags, whatever is declared:
+ * what a key or a session may see must never land in a shared cache. Every
+ * such answer says `Vary: Authorization, Cookie`. Errors are not affected.
+ */
+declare interface RestCache {
+    /** Seconds a cache may serve the answer without asking again. */
+    readonly maxAge: number;
+    /** Seconds after that a stale answer may still be served while the cache refetches. */
+    readonly staleWhileRevalidate?: number;
+    /** Purge tags from the answer as it goes on the wire, and the input.
+     *  A tag with whitespace or a comma is dropped (no header can carry it). */
+    readonly tags?: (output: unknown, input: unknown) => ReadonlyArray<string>;
+}
+
 export declare type RestDates = 'iso' | 'epoch-ms';
 
 export declare type RestEnvelope = 'none' | 'data' | 'jsonapi';
@@ -4823,6 +5255,11 @@ declare interface RestGuardRejection {
     readonly message: string;
 }
 
+/** What a REST handler may return: the decoded output, a `response(...)` with
+ *  its own status and headers, an `sse(...)` stream, or `bytes(...)` for a
+ *  non-JSON body (a file, an export, an XML document). */
+declare type RestHandlerResult<O> = O | RestResponse<O> | RestStreamResponse | RestByteResponse;
+
 declare type RestMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS';
 
 export declare type RestNaming = 'camelCase' | 'snake_case';
@@ -4886,7 +5323,7 @@ declare interface RestRouteDescriptor<I, O> {
     /** Output schema. The handler returns the decoded `Type`; the desugar
      *  encodes it to JSON for the `200` response. */
     readonly output: Schema.Schema<O, any, never>;
-    readonly handler: (input: I, ctx: RestRouteContext) => Promise<O | RestResponse<O>> | O | RestResponse<O>;
+    readonly handler: (input: I, ctx: RestRouteContext) => Promise<RestHandlerResult<O>> | RestHandlerResult<O>;
     readonly summary?: string;
     readonly description?: string;
     readonly example?: RestRouteExample;
@@ -4943,6 +5380,9 @@ declare interface RestRouteDescriptor<I, O> {
      *  of the JSON), so it is correct across content-encodings — the
      *  transport's compression varies the bytes, not the representation. */
     readonly etag?: boolean;
+    /** GET only: how long a shared cache (a CDN) may keep a successful answer,
+     *  and the tags it can be purged by. See {@link RestCache}. */
+    readonly cache?: RestCache;
 }
 
 declare interface RestRouteExample {
@@ -4983,6 +5423,18 @@ declare interface RestRouteProjection {
     readonly format: RestFormat;
 }
 
+/**
+ * What a REST handler returns to stream its response instead of resolving one
+ * value: `sse((emit) => unsubscribe)`. The route's schema `output` is not used
+ * for a stream (each frame is framed as it is produced), and everything the
+ * desugar does BEFORE the handler — method gate, sunset, input decode, guards,
+ * subject resolution — still applies.
+ */
+declare interface RestStreamResponse {
+    readonly __voltroRestStream: true;
+    readonly stream: PluginHttpRouteStream;
+}
+
 /**
  * Rewrite a descriptor's schema into the shape the profile puts on the wire:
  * `timestampMs` (`DateFromNumber`) becomes an RFC 3339 string under
@@ -5072,7 +5524,7 @@ export declare const rowPatchOpSchema: Schema.Union<[Schema.Struct<{
 }>, Schema.Struct<{
     op: Schema.Literal<["mergeCells"]>;
     path: typeof Schema.String;
-    value: Schema.Record$<typeof Schema.String, typeof Schema.Unknown>;
+    value: Schema.Record$<typeof Schema.String, Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>>;
 }>]>;
 
 export declare const rowPatchSchema: Schema.Struct<{
@@ -5106,7 +5558,7 @@ export declare const rowPatchSchema: Schema.Struct<{
     }>, Schema.Struct<{
         op: Schema.Literal<["mergeCells"]>;
         path: typeof Schema.String;
-        value: Schema.Record$<typeof Schema.String, typeof Schema.Unknown>;
+        value: Schema.Record$<typeof Schema.String, Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>>;
     }>]>>;
     order: Schema.Array$<Schema.Union<[typeof Schema.String, typeof Schema.Number]>>;
 }>;
@@ -5370,8 +5822,18 @@ export declare interface ServerErrorEvent {
     readonly name?: string;
     /** Distributed-trace id when one is in scope (workflows carry it). */
     readonly traceId?: string;
-    /** Extra context — op, runId, executionId, http status, etc. */
+    /** Extra context — op, runId, executionId, http status, etc. Identity only:
+     *  never the primitive's data. */
     readonly fields?: Record<string, unknown>;
+    /**
+     * The error's CONTENT may carry data of a primitive declared encrypted
+     * (`workflow({ encrypted: true })`): its message, its cause, a typed
+     * failure's fields. A reporter that sends the event out of the process sends
+     * {@link withheldServerError} instead — the class, the stack frames and the
+     * identity fields, not the text. Encrypted at rest and then mailed to a
+     * third party in plaintext would make the declaration decorative.
+     */
+    readonly contentSensitive?: boolean;
 }
 
 declare type ServerErrorListener = (event: ServerErrorEvent) => void;
@@ -5405,6 +5867,132 @@ declare const ServerOnlyColumnWrite_base: Schema.TaggedErrorClass<ServerOnlyColu
     columns: Schema.Array$<typeof Schema.String>;
 }>;
 
+/** A service (app) name: what `serviceCallers`, `service.callers` and a service
+ *  credential all spell the same way. At most 56 characters: the caller writes
+ *  as `service:<name>`, which is an `actors.id` — an `id()` column, VARCHAR(64)
+ *  on three dialects — so a longer name would fail its first audited write. */
+export declare const SERVICE_NAME_PATTERN: RegExp;
+
+/**
+ * The runtime-erased form of a procedure's `service: { callers }` — "only these
+ * apps of the project may call this, and nobody else".
+ *
+ * A guard entry for the reason `OpenAccessSpec` is one: every enforcement path
+ * is handed the `guards` array and nothing else, so a decision that lived on a
+ * separate descriptor field would be enforced by the paths somebody remembered
+ * and skipped by the rest.
+ *
+ * It admits exactly a `service` subject whose name is listed. `admin:full` does
+ * NOT bypass it: a service procedure is a machine contract between two apps,
+ * and a browser session holding the admin scope is not one of the parties.
+ */
+export declare interface ServiceAccessSpec {
+    /** The calling apps' names, as the callee declares them in `serviceCallers`.
+     *  Non-empty by construction — the definers refuse an empty list. */
+    readonly service: ReadonlyArray<string>;
+}
+
+/** Build the erased `service:` entry. The definers call this. */
+export declare const serviceAccessSpec: (callers: ReadonlyArray<string>) => ServiceAccessSpec;
+
+/**
+ * A procedure map (`ServiceProcedures`) turned into the nested object a caller
+ * writes: `'deployments.activate'` becomes `.deployments.activate(...)`. A tag
+ * that is both a procedure and a namespace prefix is both.
+ */
+export declare type ServiceApi<P> = 0 extends (1 & P) ? any : ServiceApiOf<P>;
+
+declare type ServiceApiOf<P> = {
+    readonly [H in ServiceTagHead<keyof P & string>]: (H extends keyof P ? ServiceCall<P[H]> : unknown) & ServiceApiOf<{
+        [K in keyof P & string as K extends `${H}.${infer R}` ? R : never]: P[K];
+    }>;
+};
+
+/** One procedure as the caller sees it — callable, `.effect`, and `.subscribe` for a query. */
+export declare type ServiceCall<D> = D extends ServiceDescriptorShape ? ((input: ServiceDecoded<D['input']>, options?: ServiceCallOptions) => Promise<ServiceDecoded<D['output']>>) & {
+    /** The same call as an Effect. Inside a workflow step its write key is
+     *  derived from the step, so a re-sent step replays instead of writing twice. */
+    readonly effect: (input: ServiceDecoded<D['input']>, options?: ServiceCallOptions) => Effect.Effect<ServiceDecoded<D['output']>, unknown>;
+} & (D extends {
+    readonly kind: 'query';
+} ? {
+    /** Hold the live query open; `onValue` gets each materialized value. */
+    readonly subscribe: (input: ServiceDecoded<D['input']>, handlers: ServiceSubscribeHandlers<ServiceDecoded<D['output']>>) => ServiceSubscription;
+} : unknown) : never;
+
+/** The apps a guard array admits as service callers, or `undefined` when the
+ *  procedure is not a service procedure. */
+export declare const serviceCallersOf: (guards: ReadonlyArray<AnyCheckSpec> | undefined) => ReadonlyArray<string> | undefined;
+
+export declare interface ServiceCallOptions {
+    /** Deadline for this call. Default 10 seconds. */
+    readonly timeoutMs?: number;
+    /** Explicit idempotency key for a write. Overrides the ambient and the fresh one. */
+    readonly idempotencyKey?: string;
+    /** Interrupts the call when aborted. */
+    readonly signal?: AbortSignal;
+}
+
+/** The decoded (application-side) type of a schema slot. */
+export declare type ServiceDecoded<S> = S extends {
+    readonly Type: infer T;
+} ? T : never;
+
+/** What a service procedure's descriptor type carries that the facade reads. */
+export declare interface ServiceDescriptorShape {
+    readonly kind: string;
+    readonly input: unknown;
+    readonly output: unknown;
+}
+
+/**
+ * A service procedure's declaration: which apps of the project may call it.
+ *
+ *     service: { callers: ['worker'] }
+ *
+ * The names are the CALLING apps' names as this app lists them in
+ * `serviceCallers` — the same name the caller's credential resolves to.
+ */
+export declare interface ServiceSpec {
+    readonly callers: ReadonlyArray<string>;
+}
+
+/**
+ * The subject a verified service credential resolves to. Built by the service
+ * strategy only — an app never constructs one, and nothing grants it scopes.
+ */
+export declare const serviceSubject: (service: string) => Extract<Subject, {
+    readonly type: "service";
+}>;
+
+export declare interface ServiceSubscribeHandlers<T> {
+    /** Every materialized value of the live query, starting with the first snapshot. */
+    readonly onValue: (value: T) => void;
+    /** The subscription's own in-band error (e.g. an access refusal). */
+    readonly onError?: (error: unknown) => void;
+}
+
+export declare interface ServiceSubscription {
+    readonly unsubscribe: () => void;
+}
+
+/** The first segment of a dotted rpc tag. */
+export declare type ServiceTagHead<K extends string> = K extends `${infer H}.${string}` ? H : K;
+
+/** The request header carrying a framework session value outside a cookie. */
+export declare const SESSION_HEADER_NAME: "x-voltro-session";
+
+/**
+ * The session value a request presents: the dedicated header when set,
+ * otherwise the named cookie. Pure — no verification, no IO.
+ *
+ * The header wins when both are present. A client that sets the header did so
+ * deliberately; a cookie is ambient and may belong to a different app on the
+ * same host (the reason `sessionExpiryFromHeaders` tolerates one that does
+ * not verify). Explicit beats ambient.
+ */
+export declare const sessionValueFromHeaders: (headers: Readonly<Record<string, string | undefined>>, cookieName: string, readCookie: (header: string | undefined, name: string) => string | undefined) => string | undefined;
+
 /**
  * Publish the caller's fully-resolved scope set for this request (raw subject
  * scopes ∪ role-derived scopes ∪ any extra grants). Called by the rbac
@@ -5442,6 +6030,12 @@ export declare const shapeDigest: (text: string) => string;
  */
 export declare const sourceKeys: (source: ReactivitySourceValue | ReadonlyArray<ReactivitySourceValue> | undefined) => ReadonlyArray<string>;
 
+export declare const STORE_SCREENSHOT_PRESET_NAMES: [string, ...string[]];
+
+export declare const STORE_SCREENSHOT_PRESETS: ReadonlyArray<StoreScreenshotPreset>;
+
+export declare const STORE_SCREENSHOT_STORES: readonly ["app-store", "play", "mac-app-store", "microsoft-store"];
+
 /**
  * Discriminated union of all framework-owned store errors. Use it on
  * a mutation's `error:` schema when you want every kind surfaced
@@ -5495,6 +6089,33 @@ declare const StoreOperationFailed_base: Schema.TaggedErrorClass<StoreOperationF
     cause: typeof Schema.String;
 }>;
 
+/** The PNG size the store receives: viewport × scale factor. */
+export declare const storeScreenshotPixels: (preset: StoreScreenshotPreset) => {
+    readonly width: number;
+    readonly height: number;
+};
+
+export declare interface StoreScreenshotPreset {
+    readonly name: string;
+    readonly label: string;
+    readonly kind: 'phone' | 'tablet' | 'desktop';
+    /** The CSS viewport the page is laid out in. */
+    readonly viewport: {
+        readonly width: number;
+        readonly height: number;
+    };
+    readonly deviceScaleFactor: number;
+    /** Which stores accept this size. */
+    readonly stores: ReadonlyArray<StoreScreenshotStore>;
+}
+
+export declare const storeScreenshotPreset: (name: string) => StoreScreenshotPreset | undefined;
+
+/** The presets a store takes, in table order. */
+export declare const storeScreenshotPresetsFor: (store: StoreScreenshotStore) => ReadonlyArray<StoreScreenshotPreset>;
+
+export declare type StoreScreenshotStore = (typeof STORE_SCREENSHOT_STORES)[number];
+
 export declare type StrategyResolution = {
     readonly kind: 'matched';
     readonly subject: Subject;
@@ -5617,6 +6238,14 @@ export declare const Subject: Schema.Union<[Schema.Struct<{
     tenantId: typeof Schema.Null;
     scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
     metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+}>, Schema.Struct<{
+    type: Schema.Literal<["service"]>;
+    id: typeof Schema.String;
+    /** The calling app's name, as the callee lists it in `serviceCallers`. */
+    service: typeof Schema.String;
+    tenantId: typeof Schema.Null;
+    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
+    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
 }>]>;
 
 export declare type Subject = typeof Subject.Type;
@@ -5670,6 +6299,12 @@ export declare const SubjectIdentity: Schema.Union<[Schema.Struct<{
     id: typeof Schema.String;
     tenantId: typeof Schema.Null;
     metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+}>, Schema.Struct<{
+    type: Schema.Literal<["service"]>;
+    id: typeof Schema.String;
+    tenantId: typeof Schema.Null;
+    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    service: typeof Schema.String;
 }>]>;
 
 export declare type SubjectIdentity = typeof SubjectIdentity.Type;
@@ -5742,6 +6377,15 @@ declare const SubjectService_base: Context.TagClass<SubjectService, "@voltro/Sub
     readonly metadata?: {
         readonly [x: string]: unknown;
     } | undefined;
+} | {
+    readonly type: "service";
+    readonly id: string;
+    readonly tenantId: null;
+    readonly scopes?: readonly string[] | undefined;
+    readonly metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
+    readonly service: string;
 }>;
 
 /** Subscribe to server-primitive errors. Returns an unsubscribe fn. */
@@ -5805,7 +6449,7 @@ export declare const subscriptionEvent: <D extends Schema.Schema.Any>(data: D) =
         }>, Schema.Struct<{
             op: Schema.Literal<["mergeCells"]>;
             path: typeof Schema.String;
-            value: Schema.Record$<typeof Schema.String, typeof Schema.Unknown>;
+            value: Schema.Record$<typeof Schema.String, Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>>;
         }>]>>;
         order: Schema.Array$<Schema.Union<[typeof Schema.String, typeof Schema.Number]>>;
     }>;
@@ -6108,7 +6752,7 @@ export declare const toRpc: <Name extends string, Input extends Schema.Schema.An
         }>, Schema.Struct<{
             op: Schema.Literal<["mergeCells"]>;
             path: typeof Schema.String;
-            value: Schema.Record$<typeof Schema.String, typeof Schema.Unknown>;
+            value: Schema.Record$<typeof Schema.String, Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>>;
         }>]>>;
         order: Schema.Array$<Schema.Union<[typeof Schema.String, typeof Schema.Number]>>;
     }>;
@@ -6419,6 +7063,10 @@ export declare interface VoltroPlugin {
      * merge to the stricter `required` and the safer `secret`.
      */
     readonly declaredEnv?: ReadonlyArray<PluginEnvVar>;
+    /** What this plugin collects and uses — see `PluginPrivacyDeclaration`. */
+    readonly privacy?: PluginPrivacyDeclaration;
+    /** Where this plugin sends data outside the installation — see `PluginEgressDeclaration`. Omit when it sends nothing. */
+    readonly egress?: ReadonlyArray<PluginEgressDeclaration>;
     /**
      * The authorization scopes this plugin DEFINES for the app — its scope
      * vocabulary. Distinct from `permissions` above, which is what the plugin
@@ -6554,8 +7202,10 @@ export declare interface VoltroPlugin {
      * that wants the enablers declares `(store, ctx)` and reads
      * `ctx?.sql` / `ctx?.scheduleCoordinated(...)`; one that ignores `ctx`
      * keeps working unchanged.
+     * A returned Promise is awaited before the app begins serving requests.
+     * Store-dependent initialization may run here when activation happened first.
      */
-    readonly bindDataStore?: (store: DataStore, ctx?: PluginBindContext) => void;
+    readonly bindDataStore?: (store: DataStore, ctx?: PluginBindContext) => void | Promise<void>;
     /**
      * Capabilities this plugin offers to OTHER framework machinery, by name.
      *
@@ -6666,6 +7316,29 @@ export declare interface VoltroPlugin {
      * specific permission name in the error.
      */
     readonly extendSchema?: PluginSchemaContribution;
+    /**
+     * A directory of APP-SHAPED primitives this plugin brings with it — the same
+     * file conventions an app uses (`*.query.ts` + `.server.ts`, `*.mutation.ts`,
+     * `*.workflow.tsx`, `*.cron.tsx`, `*.subscribe.ts`, `*.reaction.ts`,
+     * `schema.ts` / `*.entity.ts`, …).
+     *
+     *     sources: fileURLToPath(new URL('./app', import.meta.url))
+     *
+     * Every app that installs the plugin discovers those files exactly as it
+     * discovers its own: the same codegen, browser-safety guard, access gate,
+     * migrations and boot paths. That is what makes a reusable BUILDING BLOCK — a
+     * ledger, an approval flow, an audit trail — shareable between apps of a
+     * project without copying it.
+     *
+     * It shares CODE, never data: each installing app gets its own copy of the
+     * block's tables, in its own database. Two apps that need each other's data
+     * call each other (`apis:` + `service:` procedures).
+     *
+     * The block's procedures keep the names their descriptors declare; a name
+     * that collides with the app's own is refused at codegen, as any collision is.
+     * An absolute path to a directory; a missing one refuses the boot.
+     */
+    readonly sources?: string;
     /**
      * Cross-cutting error schemas merged into every procedure's wire error
      * union. Lets a plugin interceptor fail with a typed error (e.g.
@@ -6742,6 +7415,26 @@ export declare interface VoltroPlugin {
     readonly onProcedureSurface?: (procedures: ReadonlyArray<ProcedureDescriptor>) => void;
 }
 
+/**
+ * The plugins' cross-cutting errors, at the TYPE level.
+ *
+ * A plugin's `errorSchemas` reach every procedure's wire union at boot — a
+ * runtime fact the type system cannot see. The codegen closes that gap: it
+ * augments this interface in `rpcGroup.generated.ts` with one entry per
+ * registered schema, so `defineExecutor` accepts a failure a plugin registers
+ * exactly where the server will deliver it typed. Empty until the first
+ * codegen run, which makes an unregistered plugin error a compile error rather
+ * than a silent `InternalError`.
+ *
+ *     declare module '@voltro/protocol' {
+ *       interface VoltroPluginErrors {
+ *         readonly '@acme/errors#NotFoundError': NotFoundError
+ *       }
+ *     }
+ */
+export declare interface VoltroPluginErrors {
+}
+
 /**
  * The table names THIS app declares — filled in by codegen, empty here.
  *
@@ -6834,10 +7527,28 @@ export declare interface WebSocketGatewayRoute {
     readonly onConnection: (connection: WebSocketGatewayConnection) => void | (() => void) | Promise<void | (() => void)>;
 }
 
+/**
+ * Who may call a procedure over the wire: the app's own clients, or only other
+ * apps of the project.
+ *
+ * A `service:` procedure IS on the wire — the server routes it on the same
+ * socket — but it belongs to a different client group. Codegen emits it into
+ * `serviceGroup.generated.ts` (imported by server processes of other apps) and
+ * never into `rpcGroup.generated.ts` (imported by browsers), so no browser
+ * bundle names a machine contract. The server refuses every non-service caller
+ * regardless; keeping it out of the browser group is what keeps it out of the
+ * code people ship.
+ */
+export declare type WireAudience = 'client' | 'service';
+
+export declare const wireAudienceOf: (descriptor: {
+    readonly service?: ServiceSpec | undefined;
+}) => WireAudience;
+
 /**
  * The error union a procedure ACTUALLY puts on the wire — `descriptor.error`
  * plus everything the framework can produce for it before or around the
- * executor.
+ * executor, plus the plugins' cross-cutting errors (`extraErrors`).
  *
  * ── Why this is exported rather than inlined in the lifters ────────────────
  *
@@ -6867,13 +7578,34 @@ export declare interface WebSocketGatewayRoute {
  * `ScopeError` themselves — is what made the two sets agree by hand.
  *
  * One function now, so they cannot disagree again.
+ *
+ * The plugins' errors are part of that answer for the same reason. A plugin's
+ * `errorSchemas` entry is on every lifted union, and the judgement above was
+ * handed the union WITHOUT them — so an interceptor's `RateLimited`, or an
+ * app-wide error a local plugin registers, decoded typed on a query and was
+ * collapsed to `InternalError` on every mutation and action, on both boot
+ * paths. Pass the same `extraErrors` the lifter receives.
  */
 export declare const wireErrorUnion: (descriptor: {
     readonly error: Schema.Schema.All;
     readonly guards?: DeclaredAccess | undefined;
     readonly requiresApproval?: AnyApprovalPolicy | undefined;
     readonly idempotencyScope?: MutationIdempotencyScope | undefined;
-}, kind: "query" | "mutation" | "action" | "stream") => Schema.Schema.All;
+}, kind: "query" | "mutation" | "action" | "stream", extraErrors?: ExtraErrors) => Schema.Schema.All;
+
+/** A procedure kind that has a wire error union. */
+export declare type WireProcedureKind = keyof typeof FRAMEWORK_WIRE_ERRORS;
+
+/**
+ * The error of a {@link ServerErrorEvent} with its content withheld: same
+ * `name` (the class, or a typed failure's tag), the original stack FRAMES —
+ * code locations, which carry no data — and a message saying where the full
+ * error can be read by someone allowed to. No `cause`, no own properties.
+ *
+ * The stack's first line repeats the message, so it is rebuilt from the frames
+ * rather than copied.
+ */
+export declare const withheldServerError: (event: ServerErrorEvent) => Error;
 
 /**
  * Re-tag a procedure descriptor for the wire.
@@ -7367,6 +8099,147 @@ export declare const WorkflowQueuedControlTargetSchema: Schema.Struct<{
     requestId: typeof Schema.NonEmptyString;
 }>;
 
+export declare type WorkflowRestartCommand = typeof WorkflowRestartCommandSchema.Type;
+
+export declare const WorkflowRestartCommandSchema: Schema.Struct<{
+    selection: Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["failed-steps"]>;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["from-step"]>;
+        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    }>]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>;
+
+export declare type WorkflowRestartObservation = typeof WorkflowRestartObservationSchema.Type;
+
+/** Pending is a durable reservation, not proof of reset or engine entry.
+ * Entered confirms this command's generation; it does not claim run success. */
+export declare const WorkflowRestartObservationSchema: Schema.Union<[Schema.Struct<{
+    kind: Schema.Literal<["not-found"]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["withdrawn"]>;
+    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
+    withdrawnAt: Schema.filter<typeof Schema.Number>;
+    selection: Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["failed-steps"]>;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["from-step"]>;
+        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    }>]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["pending"]>;
+    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
+    executionId: Schema.filter<typeof Schema.NonEmptyString>;
+    originalGeneration: Schema.filter<typeof Schema.NonEmptyString>;
+    requestedAt: Schema.filter<typeof Schema.Number>;
+    dispatchAttempts: Schema.refine<number, typeof Schema.NonNegative>;
+    selection: Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["failed-steps"]>;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["from-step"]>;
+        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    }>]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>, Schema.filter<Schema.Struct<{
+    kind: Schema.Literal<["entered"]>;
+    enteredGeneration: Schema.filter<typeof Schema.NonEmptyString>;
+    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
+    executionId: Schema.filter<typeof Schema.NonEmptyString>;
+    originalGeneration: Schema.filter<typeof Schema.NonEmptyString>;
+    requestedAt: Schema.filter<typeof Schema.Number>;
+    dispatchAttempts: Schema.refine<number, typeof Schema.NonNegative>;
+    selection: Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["failed-steps"]>;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["from-step"]>;
+        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    }>]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>>]>;
+
+export declare type WorkflowRestartResult = typeof WorkflowRestartResultSchema.Type;
+
+/** A refused reservation never reset the journal. Transport failures instead
+ * require reading the original target; they are not proof of refusal. */
+export declare const WorkflowRestartResultSchema: Schema.Union<[Schema.Union<[Schema.Struct<{
+    kind: Schema.Literal<["not-found"]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["withdrawn"]>;
+    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
+    withdrawnAt: Schema.filter<typeof Schema.Number>;
+    selection: Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["failed-steps"]>;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["from-step"]>;
+        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    }>]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["pending"]>;
+    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
+    executionId: Schema.filter<typeof Schema.NonEmptyString>;
+    originalGeneration: Schema.filter<typeof Schema.NonEmptyString>;
+    requestedAt: Schema.filter<typeof Schema.Number>;
+    dispatchAttempts: Schema.refine<number, typeof Schema.NonNegative>;
+    selection: Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["failed-steps"]>;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["from-step"]>;
+        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    }>]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>, Schema.filter<Schema.Struct<{
+    kind: Schema.Literal<["entered"]>;
+    enteredGeneration: Schema.filter<typeof Schema.NonEmptyString>;
+    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
+    executionId: Schema.filter<typeof Schema.NonEmptyString>;
+    originalGeneration: Schema.filter<typeof Schema.NonEmptyString>;
+    requestedAt: Schema.filter<typeof Schema.Number>;
+    dispatchAttempts: Schema.refine<number, typeof Schema.NonNegative>;
+    selection: Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["failed-steps"]>;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["from-step"]>;
+        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    }>]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>>]>, Schema.Struct<{
+    kind: Schema.Literal<["not-reserved"]>;
+    reason: Schema.Literal<["admission", "journal"]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>]>;
+
+export declare type WorkflowRestartSelection = typeof WorkflowRestartSelectionSchema.Type;
+
+export declare const WorkflowRestartSelectionSchema: Schema.Union<[Schema.Struct<{
+    kind: Schema.Literal<["failed-steps"]>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["from-step"]>;
+    stepName: Schema.filter<typeof Schema.NonEmptyString>;
+}>]>;
+
+export declare type WorkflowRestartTarget = typeof WorkflowRestartTargetSchema.Type;
+
+/** Persist before submitting; read this same target after an uncertain reply. */
+export declare const WorkflowRestartTargetSchema: Schema.Struct<{
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>;
+
 export declare const workflowResumeDescriptor: ActionProcedureDescriptor<"__voltro.workflow.resume", Schema.Struct<{
     workflowName: typeof Schema.String;
     executionId: typeof Schema.String;