@voltro/protocol 0.81.0 → 0.83.0

package/dist/index.d.ts

@@ -8,6 +8,7 @@ import { RpcMiddleware } from '@effect/rpc';
 import { Schema } from 'effect';
 import { SqlClient } from '@effect/sql';
 import { Stream } from '@effect/rpc/RpcSchema';
+import { VersionConflict } from '@voltro/database/wire';
 
 export declare interface ActionProcedureDescriptor<Name extends string, Input extends Schema.Schema.Any, Output extends Schema.Schema.Any, Error extends Schema.Schema.All> {
     readonly kind: 'action';
@@ -83,6 +84,46 @@ export declare const ADMIN_SCOPE = "admin:full";
  *  so the wording lives beside the semantics it describes. */
 export declare const advisoryResourceGuardWarning: (tags: ReadonlyArray<string>) => string;
 
+/**
+ * What an UNAUTHENTICATED caller is — the app's decision, never the request's.
+ *
+ * A request that matches no auth strategy still resolves to a Subject, and
+ * that Subject's `tenantId` decides what every tenant-scoped table and every
+ * `openAccess` procedure answers. Left to the request, the `x-tenant` header
+ * would choose it: any client could read any tenant's public-per-tenant data,
+ * and a procedure that was `openAccess` for the tenant's MEMBERS would answer
+ * for whichever tenant the header named. So the policy is declared once, in
+ * `app.config.ts` (`auth.anonymous`), and `voltro serve` refuses to boot
+ * without it.
+ *
+ * - `'refuse'` — no unauthenticated callers at all: `Unauthenticated`.
+ * - `'no-tenant'` — the caller carries the empty tenant `''`: every
+ *   tenant-scoped read is empty (fails closed), tables without `tenant()` and
+ *   procedures that need no tenant answer. The default of the composer, and
+ *   the right choice for an api whose public surface is token-shaped (an
+ *   invite preview, a signed link).
+ * - `'header'` — the tenant is what the request's `x-tenant` header names; a
+ *   request without it is refused. For public-per-tenant data (a marketing
+ *   site per tenant, public listings by slug) — and ONLY that: every
+ *   `openAccess` procedure and every table without `tenant()` is then public
+ *   for a client-chosen tenant.
+ * - `{ tenantId }` — every unauthenticated caller is that ONE tenant, chosen
+ *   here; the header is not consulted.
+ *
+ * NEVER `null`: a null tenant is a SYSTEM subject to the store and reads
+ * unscoped, across every tenant.
+ */
+export declare type AnonymousPolicy = 'refuse' | 'no-tenant' | 'header' | {
+    readonly tenantId: string;
+};
+
+/** The development boot's convenience, which no app config can name: the
+ *  header's tenant, else the dev tenant. `voltro dev` runs an undecided app
+ *  with it and says so; `voltro serve` refuses instead. */
+export declare type AnonymousPolicyOrDevTenant = AnonymousPolicy | {
+    readonly headerOrTenant: string;
+};
+
 export declare const anonymousSubject: (tenantId: string | null, credentialRejected?: string) => Subject;
 
 /** The erased policy a descriptor carries (input generic dropped). */
@@ -155,6 +196,9 @@ export declare interface AppliedScopes {
     readonly removed: ReadonlyArray<string>;
 }
 
+/** Keep a pairing for the next boot; the app reads it when it builds its api config. */
+export declare const applyPairing: (storage: PairingStorage, pairing: Pairing) => Promise<void>;
+
 export declare const applyRowPatch: (prev: ReadonlyArray<PatchRow>, patch: RowPatch, options?: ApplyRowPatchOptions) => ReadonlyArray<PatchRow>;
 
 /**
@@ -574,7 +618,7 @@ export declare interface AuthStrategy {
     readonly resolve: (input: AuthStrategyInput) => Promise<StrategyResolution> | StrategyResolution;
     /**
      * The bearer-token PREFIX this strategy claims, when it gates on one
-     * (`'sk_'`, `'awb_'`). Declared so a collision is DETECTABLE.
+     * (`'sk_'`, `'acme_'`). Declared so a collision is DETECTABLE.
      *
      * Two strategies claiming the same prefix is not a harmless duplicate: the
      * chain is first-match-wins, so whichever runs first decides the Subject —
@@ -772,9 +816,14 @@ export declare const checkGuards: (subject: Subject, guards: ReadonlyArray<AnyCh
  *
  * Returns a typed `ScopeError` naming the first unmet scope, or `null` when
  * every guard passes. The runtime calls this in the dispatch spine BEFORE the
- * executor (mutations: before the transaction opens).
+ * executor (mutations: before the transaction opens). A resolver or tuple
+ * source that answers `'missing'` turns the refusal into `NoSuchResource` for
+ * a signed-in caller — the first failing guard decides, so a scope refusal
+ * ahead of it is never upgraded into a disclosure.
  */
-export declare const checkGuardsEffect: (subject: Subject, guards: ReadonlyArray<AnyCheckSpec> | undefined, input: unknown, options?: GuardCheckOptions) => Effect.Effect<ScopeError | Unauthenticated | null>;
+export declare const checkGuardsEffect: (subject: Subject, guards: ReadonlyArray<AnyCheckSpec> | undefined, input: unknown, options?: GuardCheckOptions) => Effect.Effect<ScopeError | Unauthenticated | NoSuchResource | null>;
+
+export declare const clearPairing: (storage: PairingStorage) => Promise<void>;
 
 export declare interface ClientDescriptor {
     readonly kind: 'query' | 'mutation' | 'action' | 'stream' | 'workflow';
@@ -835,42 +884,17 @@ export declare interface ClientTarget {
 export declare const compareSurfaces: (mine: Readonly<Record<string, string>>, theirs: Readonly<Record<string, string>>) => SurfaceMismatch;
 
 export declare const composeAuthStrategies: (strategies: ReadonlyArray<AuthStrategy>, options?: {
-    /** Fallback when no strategy matched. Default: returns the input's
-     *  tenant from `x-tenant` header or null. */
+    /** Fallback when no strategy matched. Replaces `anonymous` entirely: the
+     *  function owns the anonymous subject AND the rejected-credential decision. */
     readonly fallback?: (input: AuthStrategyInput) => Subject;
     /** Hook for logging — called on every `failed` resolution. */
     readonly onStrategyFailed?: (event: {
         strategyId: string;
         reason: string;
     }) => void;
-    /**
-     * Reject anonymous callers that carry no tenant. When `true` and no
-     * strategy matched AND no `x-tenant` header is present, the resolver
-     * throws `Unauthenticated` instead of returning a null-tenant
-     * anonymous Subject. Use it on multi-tenant apps where every call —
-     * even an anonymous one — must be scoped to a tenant; without it a
-     * tenant-less anonymous Subject can read across the whole DB on
-     * tables that aren't `tenant()`-scoped. Ignored when a custom
-     * `fallback` is supplied (the fallback owns that decision).
-     */
-    readonly anonymousTenantRequired?: boolean;
-    /**
-     * The ONE tenant every anonymous caller resolves to — chosen by the server,
-     * never by the request. When set, the `x-tenant` header is not consulted:
-     * a client naming its own tenant is exactly the thing a fixed anonymous
-     * tenant exists to rule out. Ignored when `fallback` is supplied (that
-     * function owns the anonymous subject).
-     */
-    readonly anonymousTenantId?: string;
-    /**
-     * The tenant an anonymous caller resolves to when its request names none
-     * in `x-tenant`. The header still wins when present — this only replaces
-     * the `null` tenant. It exists so a boot path can supply a default tenant
-     * without a `fallback`: a `fallback` owns the rejected-credential decision,
-     * this does not, so a presented-and-rejected credential is still refused.
-     * Ignored when `anonymousTenantId` or `fallback` is set.
-     */
-    readonly anonymousTenantDefault?: string;
+    /** What an unauthenticated caller is — see {@link AnonymousPolicy}.
+     *  Default `'no-tenant'`. Ignored when `fallback` is supplied. */
+    readonly anonymous?: AnonymousPolicyOrDevTenant;
     /**
      * The subject's memberships — the ONE source, strategy-independent. Read
      * only when a stored tenant selection exists for the subject and names a
@@ -1366,8 +1390,8 @@ export declare interface CoordinatedScheduleHandle {
  */
 export declare interface CoordinatedTaskOptions {
     /**
-     * Stop ticking entirely on an idle tick with no pending deadline, and come
-     * back only on `wake()`. Default `false`.
+     * Stop ticking entirely on an idle tick that reports `nextDueInMs: null`
+     * (nothing scheduled), and come back only on `wake()`. Default `false`.
      *
      * Pass `true` only when an arrival is GUARANTEED to call `wake()` — a change
      * subscription on the table your task drains, on a deployment where remote
@@ -1381,10 +1405,17 @@ export declare interface CoordinatedTaskOptions {
 export declare interface CoordinatedTickOutcome {
     /** `true` when the tick found nothing to do. Only an idle tick backs off. */
     readonly idle: boolean;
-    /** Milliseconds until the earliest deadline this task already knows about.
-     *  Caps the backoff, so a task that is idle now but has something due in
-     *  400 ms is armed for 400 ms rather than for the idle ceiling. */
-    readonly nextDueInMs?: number;
+    /** Milliseconds until the earliest deadline this task already knows about —
+     *  a retry, a re-poll, a lease running out. Caps the backoff, so a task that
+     *  is idle now but has something due in 400 ms is armed for 400 ms rather
+     *  than for the idle ceiling.
+     *
+     *  `null` says "nothing is scheduled; new work can only arrive as a write",
+     *  and is the ONLY idle report that lets a `disarmWhenIdle` task stop
+     *  ticking. Leaving the field out backs off instead: work that comes due on
+     *  a clock writes nothing, so nothing would ever wake a task that disarmed
+     *  while holding it. */
+    readonly nextDueInMs?: number | null;
 }
 
 /**
@@ -1402,6 +1433,14 @@ export declare type DeclaredAccess<Input = unknown> = ReadonlyArray<AnyGuardSpec
 /** Every channel declared in this process, by routing key. */
 export declare const declaredReactivityChannelKeys: () => ReadonlySet<string>;
 
+/**
+ * Does this guard list name a resource — a relationship guard, or a scope guard
+ * with a `resource` extractor? Exactly the guards whose resolver may answer
+ * `'missing'`, so exactly the procedures whose wire union carries
+ * {@link NoSuchResource}.
+ */
+export declare const declaresResourceGuard: (guards: ReadonlyArray<AnyCheckSpec> | undefined) => boolean;
+
 /**
  * How long a RUNNING claim holds without renewal.
  *
@@ -2025,6 +2064,20 @@ export declare const encodeRestError: (format: RestFormat, error: RestFormatErro
  */
 export declare const encodeRestSuccess: (format: RestFormat, value: unknown, ctx: RestFormatContext) => RestFormatResponse;
 
+/**
+ * The text to SHOW for a failure value — its `message`, else its `_tag`, else
+ * `String(value)`.
+ *
+ * Its partner above, for the same reason: every client surface hands over the
+ * declared error as the plain `{ _tag, …fields, message }` object the wire
+ * carries, and `String()` of a plain object is `[object Object]`. A
+ * subscription used to hand over an Effect `Cause`, whose `String()` happened
+ * to read, so `String(error)` in an error banner or an `error.tsx` looked right
+ * until the value became what the docs always said it was. Works on an `Error`,
+ * a `Schema.TaggedError` instance, the wire object and a bare string alike.
+ */
+export declare const errorMessage: (err: unknown) => string;
+
 /**
  * Read the `_tag` off a thrown error value, or `undefined` when it has none.
  *
@@ -2400,9 +2453,10 @@ export declare const finishIdempotent: (store: IdempotencyStore, scope: string,
  *
  * A query's success type is the three-member union above, and a one-shot read
  * takes only its first event: a `snapshot` resolves to its `data`; an `error`
- * REJECTS — with the typed error on `cause` and `voltroError`, so a caller can
- * still branch on its `_tag` — exactly as a failed exit would; a `delta` cannot
- * be first and says so. Anything else is a mutation or action's own result and
+ * REJECTS with the typed error ITSELF — exactly as a failed exit does, and the
+ * same value a live subscription's `error` and the api's error bus hand over,
+ * so one `_tag` switch serves every surface; a `delta` cannot be first and says
+ * so. Anything else is a mutation or action's own result and
  * passes through, which may legitimately be a tagged object of the app's.
  *
  * Shared because there are two such reads — the server loader's `ctx.query`
@@ -2418,6 +2472,27 @@ export declare const firstEventValue: (tag: string, value: unknown, label: strin
 /** A route rendered for humans — logs, the inspect surface, the dashboard. */
 export declare const formatEventRoute: (route: string) => string;
 
+/**
+ * The framework errors EVERY procedure of a kind carries on its wire union —
+ * the unconditional members `wireErrorUnion` adds. The conditional ones (a
+ * resource guard's `NoSuchResource`, `requiresApproval`'s refusals,
+ * `MutationConnectionRequired`) are left out on purpose: a type that cannot see
+ * the condition must not promise them.
+ *
+ * It exists for the TYPE-level reader, `defineExecutor`, which checks an
+ * executor's failure channel against the union the server will judge it by. A
+ * test pins it against `wireErrorUnion` per kind, so the two cannot drift.
+ */
+export declare const FRAMEWORK_WIRE_ERRORS: {
+    readonly query: readonly [typeof ScopeError, typeof Unauthenticated];
+    readonly stream: readonly [typeof ScopeError, typeof Unauthenticated];
+    readonly action: readonly [typeof ScopeError, typeof Unauthenticated, typeof ValidationError, typeof ValidationErrors];
+    readonly mutation: readonly [typeof ScopeError, typeof Unauthenticated, typeof BusinessRuleViolation, typeof MutationInFlight, typeof VersionConflict, typeof ValidationError, typeof ValidationErrors];
+};
+
+/** The error values {@link FRAMEWORK_WIRE_ERRORS} admits for `Kind`. */
+export declare type FrameworkWireError<Kind extends WireProcedureKind> = Schema.Schema.Type<(typeof FRAMEWORK_WIRE_ERRORS)[Kind][number]>;
+
 /** How long a record of this status stays fresh — the replay window for a
  *  completed response, the lease for a running one (never longer than the window). */
 export declare const freshFor: (status: IdempotencyRecord["status"], ttlMs: number, inFlightLeaseMs: number) => number;
@@ -3008,7 +3083,7 @@ export declare interface NestedTargetFields<Input = unknown> {
     /** Guard WHICH cached query entries this target patches: only entries whose
      *  CURRENT value satisfies the predicate. Pure + browser-safe. Prevents a
      *  patch from bleeding across sibling subscriptions that share a source table
-     *  (the guard AWB hand-writes as `roadmap.id === input.roadmapId`). Absent →
+     *  (the guard an app would otherwise hand-write as `roadmap.id === input.roadmapId`). Absent →
      *  every entry matching the target `table` is patched. */
     readonly match?: ((value: unknown, input: Input) => boolean) | undefined;
 }
@@ -3063,6 +3138,32 @@ declare const NoRowFound_base: Schema.TaggedErrorClass<NoRowFound, "NoRowFound",
     found: typeof Schema.Number;
 }>;
 
+/**
+ * A resource guard's refusal when the resource it names does not exist — as
+ * far as THIS caller may know.
+ *
+ * Only an app can say that. The guard never infers absence from an empty tuple
+ * set or a `false` answer: "no relation" and "no row" look identical from the
+ * outside, and telling them apart is an existence oracle. So this is raised
+ * only when a tuple source or resolver answers `'missing'`
+ * ({@link ResourceMissing}), and only for a signed-in caller — an anonymous one
+ * gets the ordinary refusal whatever the source said.
+ *
+ * `resourceType` is the relationship guard's type, or `null` for a scope guard
+ * with a `resource` extractor (which names no type). Merged into the wire union
+ * of every procedure that declares a resource-bearing guard.
+ */
+export declare class NoSuchResource extends NoSuchResource_base {
+}
+
+declare const NoSuchResource_base: Schema.TaggedErrorClass<NoSuchResource, "NoSuchResource", {
+    readonly _tag: Schema.tag<"NoSuchResource">;
+} & {
+    resourceType: Schema.NullOr<typeof Schema.String>;
+    resourceId: typeof Schema.String;
+    message: typeof Schema.String;
+}>;
+
 /**
  * What a plugin contributes to the OTel layer via `contributeObservability`.
  * The OTel types are intentionally `unknown` so this browser-safe protocol
@@ -3147,6 +3248,38 @@ export declare const openAccessSpec: (reason: string) => OpenAccessSpec;
  */
 export declare const orderByBearerPrefix: (strategies: ReadonlyArray<AuthStrategy>, headers: Readonly<Record<string, string | undefined>>) => ReadonlyArray<AuthStrategy>;
 
+export declare interface Pairing {
+    /** The api's base url as the DEVICE reaches it — a LAN address, never `localhost`. */
+    readonly api: string;
+    /** The api process name (`main`), for the client's api binding. */
+    readonly name: string;
+    /** The dev inspect token, when the CLI knows it. */
+    readonly token?: string;
+}
+
+export declare const PAIRING_HOST = "pair";
+
+export declare const PAIRING_SCHEME = "voltro-dev";
+
+/** Where `applyPairing` keeps the record — the platform's plain storage. */
+export declare const PAIRING_STORAGE_KEY = "voltro:pairing";
+
+/** The link text. Refuses a loopback api: a phone cannot reach the laptop's `localhost`. */
+export declare const pairingLink: (pairing: Pairing) => string;
+
+/** A key/value store in either spelling: the platform's `StoreStorage`
+ *  (`getItem`/`setItem`, what `platform.storage('local')` returns) or a
+ *  `get`/`set` pair (a secure store, a test fake). */
+export declare type PairingStorage = {
+    readonly get: (key: string) => Promise<string | null> | string | null;
+    readonly set: (key: string, value: string) => Promise<void> | void;
+    readonly remove?: (key: string) => Promise<void> | void;
+} | {
+    readonly getItem: (key: string) => Promise<string | null> | string | null;
+    readonly setItem: (key: string, value: string) => Promise<void> | void;
+    readonly removeItem?: (key: string) => Promise<void> | void;
+};
+
 /** Split a route back into its three parts. */
 export declare const parseEventRoute: (route: string) => {
     readonly tenantId: string | null;
@@ -3154,6 +3287,11 @@ export declare const parseEventRoute: (route: string) => {
     readonly key: string;
 };
 
+/** The record from a link, or `null` for anything that is not a pairing link. */
+export declare const parsePairingLink: (url: string) => Pairing | null;
+
+export declare const patchCellSchema: Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>;
+
 /** A single row in a subscription result. Must carry an `id`; everything
  *  else is opaque to the patch layer. */
 export declare type PatchRow = Readonly<Record<string, unknown>> & {
@@ -3267,10 +3405,12 @@ export declare interface PluginBindContext {
     readonly cache?: PluginCacheHandle;
     /**
      * The framework's already-open `SqlClient` (from `@effect/sql`) — the
-     * SAME pool the app's store uses. A plugin runs raw SQL through this
-     * instead of standing up its OWN `ManagedRuntime` + pool from env. Only
-     * present for SQL-backed stores; `undefined` on the in-memory store
-     * (there is no SQL engine) — guard with `if (ctx.sql)`.
+     * SAME pool the app's store uses, with its TLS, credentials and schema.
+     * For SQL the store's methods cannot express, against tables that are
+     * DECLARED (`extendSchema.tables`, or the app's own schema): it never
+     * creates, alters or drops a table, and a plugin never opens a connection
+     * of its own instead. Prefer the bound `store` — it works on every
+     * dialect. `undefined` on the in-memory store (no SQL engine).
      */
     readonly sql?: SqlClient.SqlClient;
     /**
@@ -3524,16 +3664,29 @@ export declare interface PluginDashboardMount {
 export declare type PluginDeactivateHook = (ctx: PluginLifecycleContext) => Effect.Effect<void, unknown> | Promise<void> | void;
 
 /**
- * An environment variable a plugin reads. DECLARATION ONLY — metadata, not a
- * read path: the plugin still reads the value itself (typically
- * `options.X ?? process.env.X`). Declaring it makes the plugin's env needs
- * visible to the env manifest (`/_voltro/inspect/env`), the generated
- * `.env.example`, and the dashboard Env panel — so an operator can see, before
- * running, exactly what each plugin expects.
- *
- * Structurally identical to `@voltro/env`'s `DeclaredEnvVar` (kept local here
- * to avoid a protocol → env package dependency).
+ * One place a plugin sends data outside the installation — folded by
+ * `voltro compliance generate` into `egress.json`, the machine-readable list an
+ * operator reviews before opening a firewall, and answers an air-gap question
+ * from. Declare what the plugin CAN reach with the options it was given: a
+ * storage plugin on the database provider reaches nothing; on s3 it reaches
+ * the bucket's endpoint.
  */
+export declare interface PluginEgressDeclaration {
+    /**
+     * Where: a host (`api.example.com`), a URL, or — when the address is data,
+     * not configuration — what decides it, prefixed `runtime:`
+     * (`runtime:webhook targets`).
+     */
+    readonly destination: string;
+    /** Why the data goes there, in one line. */
+    readonly purpose: string;
+    /** What leaves: `content` (what users write), `personal` (who someone is),
+     *  `files`, `metadata` (ids, names, timestamps), `telemetry`, `credentials`. */
+    readonly data: ReadonlyArray<'content' | 'personal' | 'files' | 'metadata' | 'telemetry' | 'credentials'>;
+    /** How an operator turns it off, and what the installation does then. */
+    readonly disable: string;
+}
+
 export declare interface PluginEnvVar {
     /** The env var name, e.g. `DD_API_KEY`. */
     readonly name: string;
@@ -4099,6 +4252,14 @@ export declare type PluginMigrationSqlClient = SqlClient.SqlClient;
  */
 export declare type PluginPermission = 'rpc:intercept:mutation' | 'rpc:intercept:query' | 'rpc:intercept:action' | 'rpc:intercept:workflow' | 'schedule:fire' | 'schedule:read' | 'workflow:step' | 'http:intercept' | 'inspect:read' | 'inspect:write' | 'dashboard:mount' | 'store:write' | 'migration:run' | 'store:changes:read' | `secrets:read:${string}` | `network:outbound:${string}` | `plugin:hook:${string}`;
 
+/** What a plugin collects and uses — folded by `voltro compliance generate`
+ *  into PrivacyInfo.xcprivacy and the Play Data-safety answers. A plugin that
+ *  moves data (routes, tables) and declares nothing is listed by name. */
+export declare interface PluginPrivacyDeclaration {
+    readonly collects?: ReadonlyArray<PrivacyCollectedData>;
+    readonly requiredReasonApis?: ReadonlyArray<PrivacyRequiredReasonApi>;
+}
+
 /**
  * Per-call context handed to a plugin-contributed rpc route's
  * executor. Mirror of the user-handler `AppContext` shape but typed
@@ -4373,9 +4534,10 @@ export declare interface PolicyGuardRequest {
  * Answers "does `subject` have `action` on `<resourceType>:<resourceId>`".
  * Registered once at boot via `setPolicyGuardResolver`. A failed Effect is
  * treated as a DENIAL — a resolver wanting another posture catches its own
- * errors.
+ * errors. Only `true` allows; `'missing'` refuses with {@link NoSuchResource}
+ * for a signed-in caller.
  */
-export declare type PolicyGuardResolver = (req: PolicyGuardRequest) => Effect.Effect<boolean, unknown>;
+export declare type PolicyGuardResolver = (req: PolicyGuardRequest) => Effect.Effect<ResourceVerdict, unknown>;
 
 /**
  * A relationship (ReBAC) guard — "may this subject perform ACTION on THIS row?"
@@ -4407,6 +4569,38 @@ export declare interface PolicyGuardSpec<Input = unknown> {
     readonly resource: (input: Input) => string | undefined;
 }
 
+/**
+ * An environment variable a plugin reads. DECLARATION ONLY — metadata, not a
+ * read path: the plugin still reads the value itself (typically
+ * `options.X ?? process.env.X`). Declaring it makes the plugin's env needs
+ * visible to the env manifest (`/_voltro/inspect/env`), the generated
+ * `.env.example`, and the dashboard Env panel — so an operator can see, before
+ * running, exactly what each plugin expects.
+ *
+ * Structurally identical to `@voltro/env`'s `DeclaredEnvVar` (kept local here
+ * to avoid a protocol → env package dependency).
+ */
+/** One kind of data an app or plugin collects, in the vocabulary both stores
+ *  understand (`voltro compliance generate` maps it to Apple's and Google's). */
+export declare interface PrivacyCollectedData {
+    readonly category: 'name' | 'email' | 'phone' | 'physical-address' | 'identifiers' | 'device-id' | 'payment-info' | 'purchase-history' | 'precise-location' | 'coarse-location' | 'photos-or-videos' | 'audio' | 'user-content' | 'browsing-history' | 'search-history' | 'product-interaction' | 'crash-data' | 'performance-data' | 'other-diagnostic-data' | 'other-data';
+    /** Linked to the user's identity. */
+    readonly linked: boolean;
+    /** Used to track the user across apps or sites (advertising). */
+    readonly tracking: boolean;
+    readonly purposes: ReadonlyArray<'app-functionality' | 'analytics' | 'product-personalization' | 'developer-advertising' | 'third-party-advertising' | 'other'>;
+    /** Play: shared with third parties. Default false. */
+    readonly shared?: boolean;
+    /** Play: the user can decline it. Default false. */
+    readonly optional?: boolean;
+}
+
+/** Apple's required-reason API use (`NSPrivacyAccessedAPICategory…` + reason codes). */
+export declare interface PrivacyRequiredReasonApi {
+    readonly api: string;
+    readonly reasons: ReadonlyArray<string>;
+}
+
 export declare const PROBLEM_JSON = "application/problem+json; charset=utf-8";
 
 /** RFC 9457 Problem Details for one failure: `type` from the tag, `title` from
@@ -4435,6 +4629,16 @@ export declare interface ProcedureLike {
 
 export declare const procedureShapeDigest: (rpc: ProcedureLike) => string;
 
+/**
+ * The error values a procedure's wire union can carry, as far as types can
+ * tell: its own `error:`, the framework's unconditional members for its kind,
+ * and every plugin-registered error.
+ */
+export declare type ProcedureWireError<D extends {
+    readonly kind: WireProcedureKind;
+    readonly error: Schema.Schema.All;
+}> = Schema.Schema.Type<D['error']> | FrameworkWireError<D['kind']> | RegisteredPluginError;
+
 export declare const PROTOCOL_VERSION: 1;
 
 export declare type ProtocolVersion = typeof PROTOCOL_VERSION;
@@ -4577,6 +4781,13 @@ export declare interface PublicApiSpec {
      * optional, the rest inherited. See `PublicApiProfileConfig`.
      */
     readonly format?: PublicApiProfileConfig;
+    /**
+     * GET only: how long a CDN may keep a successful answer, and the tags it can
+     * purge it by (`Cache-Tag`, `Surrogate-Key`). A request with a credential is
+     * always answered `private` — see `RestCache`. `tags` receives the answer as
+     * it goes on the wire.
+     */
+    readonly cache?: RestCache;
 }
 
 /**
@@ -4739,7 +4950,7 @@ export declare const queryToRpc: <Name extends string, Input extends Schema.Sche
         }>, Schema.Struct<{
             op: Schema.Literal<["mergeCells"]>;
             path: typeof Schema.String;
-            value: Schema.Record$<typeof Schema.String, typeof Schema.Unknown>;
+            value: Schema.Record$<typeof Schema.String, Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>>;
         }>]>>;
         order: Schema.Array$<Schema.Union<[typeof Schema.String, typeof Schema.Number]>>;
     }>;
@@ -4824,6 +5035,11 @@ export declare type ReactivitySource = TableName | ReactivityChannel;
  */
 export declare type ReactivitySourceValue = string | ReactivityChannel;
 
+export declare const readPairing: (storage: PairingStorage) => Promise<Pairing | null>;
+
+/** Every error a plugin registers, as one union (`never` before codegen). */
+export declare type RegisteredPluginError = VoltroPluginErrors[keyof VoltroPluginErrors];
+
 /**
  * Declare, for this realm, what namespace each installed plugin actually
  * answers to. Emitted into `rpcGroup.generated.ts` by the codegen — one call
@@ -4840,6 +5056,19 @@ export declare type ReactivitySourceValue = string | ReactivityChannel;
  */
 export declare const registerPluginAliases: (aliases: Readonly<Record<string, string>>) => void;
 
+/**
+ * The failure value as an `Error`, for a reporter that needs one — the value
+ * itself when it already is one, else an `Error` named by its `_tag` (or
+ * `NonErrorThrown`) with `errorMessage(value)` as its message and the value as
+ * its `cause`.
+ *
+ * A loader that does not catch a refusal throws the declared error, which in a
+ * web process is the plain object decoded from the wire. Handed to an error
+ * reporter as it is, that becomes "Object captured as exception": no name to
+ * group by, no stack, no message.
+ */
+export declare const reportableError: (err: unknown) => Error;
+
 /** Gate a handler on a scope; fails with a typed `ScopeError` if missing.
  *  Checks the EFFECTIVE set so role-derived scopes count. */
 export declare const requireScope: (subject: Subject, scope: string) => Effect.Effect<void, ScopeError>;
@@ -4868,6 +5097,14 @@ export declare const resolveRestFormat: (config: PublicApiProfileConfig | undefi
  */
 export declare const resolveWorkflowAccess: (name: string, options: WorkflowAccessOptions<never>) => WorkflowAccess;
 
+/**
+ * The answer a tuple source or resolver gives when the resource a guard names
+ * does not exist for this caller. Return it only when disclosing that is
+ * acceptable — typically after a TENANT-SCOPED read, so a row in another tenant
+ * reads as missing rather than as "exists, not yours".
+ */
+export declare type ResourceMissing = 'missing';
+
 /** The question the runtime asks a registered resource-scope resolver. */
 export declare interface ResourceScopeRequest {
     /** The authenticated caller. */
@@ -4884,11 +5121,53 @@ export declare interface ResourceScopeRequest {
  * an Effect so it can read the app's role tables. It should NOT leak errors —
  * `checkGuardsEffect` treats a failed resolver as a DENIAL (fail-closed), so a
  * resolver that wants a different posture must catch its own errors.
+ *
+ * Only `true` allows. `'missing'` refuses with {@link NoSuchResource} (for a
+ * signed-in caller); anything else refuses with `ScopeError`.
  */
-export declare type ResourceScopeResolver = (req: ResourceScopeRequest) => Effect.Effect<boolean, unknown>;
+export declare type ResourceScopeResolver = (req: ResourceScopeRequest) => Effect.Effect<ResourceVerdict, unknown>;
+
+/** A resource resolver's verdict: allowed, refused, or no such resource. */
+export declare type ResourceVerdict = boolean | ResourceMissing;
 
 export declare const REST_PROFILE_NAMES: ReadonlyArray<PublicApiProfileName>;
 
+/** A BINARY streaming response (download/export). The serve layer pipes the
+ *  ReadableStream without buffering — a body larger than the heap is fine.
+ *  The LAZY thunk form defers opening the source until the response streams. */
+declare interface RestByteResponse {
+    readonly __voltroRestBytes: true;
+    readonly byteStream: {
+        readonly stream: ReadableStream<Uint8Array> | (() => ReadableStream<Uint8Array>);
+        readonly contentLength?: number;
+        readonly contentDisposition?: string;
+    };
+    readonly contentType?: string;
+    readonly status?: number;
+    readonly headers?: Readonly<Record<string, string | ReadonlyArray<string>>>;
+}
+
+/**
+ * Caching for a GET route's successful (200) answers.
+ *
+ * An anonymous request's answer is `public` for `maxAge` seconds (`max-age`
+ * and `s-maxage`), `stale-while-revalidate` when set, and carries `tags` as
+ * `Cache-Tag` (comma-separated) and `Surrogate-Key` (space-separated) — the
+ * headers CDNs purge by. A request that carries a credential (`Authorization`
+ * or a cookie) gets `private, no-cache` and no tags, whatever is declared:
+ * what a key or a session may see must never land in a shared cache. Every
+ * such answer says `Vary: Authorization, Cookie`. Errors are not affected.
+ */
+declare interface RestCache {
+    /** Seconds a cache may serve the answer without asking again. */
+    readonly maxAge: number;
+    /** Seconds after that a stale answer may still be served while the cache refetches. */
+    readonly staleWhileRevalidate?: number;
+    /** Purge tags from the answer as it goes on the wire, and the input.
+     *  A tag with whitespace or a comma is dropped (no header can carry it). */
+    readonly tags?: (output: unknown, input: unknown) => ReadonlyArray<string>;
+}
+
 export declare type RestDates = 'iso' | 'epoch-ms';
 
 export declare type RestEnvelope = 'none' | 'data' | 'jsonapi';
@@ -4978,6 +5257,11 @@ declare interface RestGuardRejection {
     readonly message: string;
 }
 
+/** What a REST handler may return: the decoded output, a `response(...)` with
+ *  its own status and headers, an `sse(...)` stream, or `bytes(...)` for a
+ *  non-JSON body (a file, an export, an XML document). */
+declare type RestHandlerResult<O> = O | RestResponse<O> | RestStreamResponse | RestByteResponse;
+
 declare type RestMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'HEAD' | 'OPTIONS';
 
 export declare type RestNaming = 'camelCase' | 'snake_case';
@@ -5041,7 +5325,7 @@ declare interface RestRouteDescriptor<I, O> {
     /** Output schema. The handler returns the decoded `Type`; the desugar
      *  encodes it to JSON for the `200` response. */
     readonly output: Schema.Schema<O, any, never>;
-    readonly handler: (input: I, ctx: RestRouteContext) => Promise<O | RestResponse<O>> | O | RestResponse<O>;
+    readonly handler: (input: I, ctx: RestRouteContext) => Promise<RestHandlerResult<O>> | RestHandlerResult<O>;
     readonly summary?: string;
     readonly description?: string;
     readonly example?: RestRouteExample;
@@ -5098,6 +5382,9 @@ declare interface RestRouteDescriptor<I, O> {
      *  of the JSON), so it is correct across content-encodings — the
      *  transport's compression varies the bytes, not the representation. */
     readonly etag?: boolean;
+    /** GET only: how long a shared cache (a CDN) may keep a successful answer,
+     *  and the tags it can be purged by. See {@link RestCache}. */
+    readonly cache?: RestCache;
 }
 
 declare interface RestRouteExample {
@@ -5138,6 +5425,18 @@ declare interface RestRouteProjection {
     readonly format: RestFormat;
 }
 
+/**
+ * What a REST handler returns to stream its response instead of resolving one
+ * value: `sse((emit) => unsubscribe)`. The route's schema `output` is not used
+ * for a stream (each frame is framed as it is produced), and everything the
+ * desugar does BEFORE the handler — method gate, sunset, input decode, guards,
+ * subject resolution — still applies.
+ */
+declare interface RestStreamResponse {
+    readonly __voltroRestStream: true;
+    readonly stream: PluginHttpRouteStream;
+}
+
 /**
  * Rewrite a descriptor's schema into the shape the profile puts on the wire:
  * `timestampMs` (`DateFromNumber`) becomes an RFC 3339 string under
@@ -5227,7 +5526,7 @@ export declare const rowPatchOpSchema: Schema.Union<[Schema.Struct<{
 }>, Schema.Struct<{
     op: Schema.Literal<["mergeCells"]>;
     path: typeof Schema.String;
-    value: Schema.Record$<typeof Schema.String, typeof Schema.Unknown>;
+    value: Schema.Record$<typeof Schema.String, Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>>;
 }>]>;
 
 export declare const rowPatchSchema: Schema.Struct<{
@@ -5261,7 +5560,7 @@ export declare const rowPatchSchema: Schema.Struct<{
     }>, Schema.Struct<{
         op: Schema.Literal<["mergeCells"]>;
         path: typeof Schema.String;
-        value: Schema.Record$<typeof Schema.String, typeof Schema.Unknown>;
+        value: Schema.Record$<typeof Schema.String, Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>>;
     }>]>>;
     order: Schema.Array$<Schema.Union<[typeof Schema.String, typeof Schema.Number]>>;
 }>;
@@ -5525,8 +5824,18 @@ export declare interface ServerErrorEvent {
     readonly name?: string;
     /** Distributed-trace id when one is in scope (workflows carry it). */
     readonly traceId?: string;
-    /** Extra context — op, runId, executionId, http status, etc. */
+    /** Extra context — op, runId, executionId, http status, etc. Identity only:
+     *  never the primitive's data. */
     readonly fields?: Record<string, unknown>;
+    /**
+     * The error's CONTENT may carry data of a primitive declared encrypted
+     * (`workflow({ encrypted: true })`): its message, its cause, a typed
+     * failure's fields. A reporter that sends the event out of the process sends
+     * {@link withheldServerError} instead — the class, the stack frames and the
+     * identity fields, not the text. Encrypted at rest and then mailed to a
+     * third party in plaintext would make the declaration decorative.
+     */
+    readonly contentSensitive?: boolean;
 }
 
 declare type ServerErrorListener = (event: ServerErrorEvent) => void;
@@ -5672,6 +5981,20 @@ export declare interface ServiceSubscription {
 /** The first segment of a dotted rpc tag. */
 export declare type ServiceTagHead<K extends string> = K extends `${infer H}.${string}` ? H : K;
 
+/** The request header carrying a framework session value outside a cookie. */
+export declare const SESSION_HEADER_NAME: "x-voltro-session";
+
+/**
+ * The session value a request presents: the dedicated header when set,
+ * otherwise the named cookie. Pure — no verification, no IO.
+ *
+ * The header wins when both are present. A client that sets the header did so
+ * deliberately; a cookie is ambient and may belong to a different app on the
+ * same host (the reason `sessionExpiryFromHeaders` tolerates one that does
+ * not verify). Explicit beats ambient.
+ */
+export declare const sessionValueFromHeaders: (headers: Readonly<Record<string, string | undefined>>, cookieName: string, readCookie: (header: string | undefined, name: string) => string | undefined) => string | undefined;
+
 /**
  * Publish the caller's fully-resolved scope set for this request (raw subject
  * scopes ∪ role-derived scopes ∪ any extra grants). Called by the rbac
@@ -5709,6 +6032,12 @@ export declare const shapeDigest: (text: string) => string;
  */
 export declare const sourceKeys: (source: ReactivitySourceValue | ReadonlyArray<ReactivitySourceValue> | undefined) => ReadonlyArray<string>;
 
+export declare const STORE_SCREENSHOT_PRESET_NAMES: [string, ...string[]];
+
+export declare const STORE_SCREENSHOT_PRESETS: ReadonlyArray<StoreScreenshotPreset>;
+
+export declare const STORE_SCREENSHOT_STORES: readonly ["app-store", "play", "mac-app-store", "microsoft-store"];
+
 /**
  * Discriminated union of all framework-owned store errors. Use it on
  * a mutation's `error:` schema when you want every kind surfaced
@@ -5762,6 +6091,33 @@ declare const StoreOperationFailed_base: Schema.TaggedErrorClass<StoreOperationF
     cause: typeof Schema.String;
 }>;
 
+/** The PNG size the store receives: viewport × scale factor. */
+export declare const storeScreenshotPixels: (preset: StoreScreenshotPreset) => {
+    readonly width: number;
+    readonly height: number;
+};
+
+export declare interface StoreScreenshotPreset {
+    readonly name: string;
+    readonly label: string;
+    readonly kind: 'phone' | 'tablet' | 'desktop';
+    /** The CSS viewport the page is laid out in. */
+    readonly viewport: {
+        readonly width: number;
+        readonly height: number;
+    };
+    readonly deviceScaleFactor: number;
+    /** Which stores accept this size. */
+    readonly stores: ReadonlyArray<StoreScreenshotStore>;
+}
+
+export declare const storeScreenshotPreset: (name: string) => StoreScreenshotPreset | undefined;
+
+/** The presets a store takes, in table order. */
+export declare const storeScreenshotPresetsFor: (store: StoreScreenshotStore) => ReadonlyArray<StoreScreenshotPreset>;
+
+export declare type StoreScreenshotStore = (typeof STORE_SCREENSHOT_STORES)[number];
+
 export declare type StrategyResolution = {
     readonly kind: 'matched';
     readonly subject: Subject;
@@ -6095,7 +6451,7 @@ export declare const subscriptionEvent: <D extends Schema.Schema.Any>(data: D) =
         }>, Schema.Struct<{
             op: Schema.Literal<["mergeCells"]>;
             path: typeof Schema.String;
-            value: Schema.Record$<typeof Schema.String, typeof Schema.Unknown>;
+            value: Schema.Record$<typeof Schema.String, Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>>;
         }>]>>;
         order: Schema.Array$<Schema.Union<[typeof Schema.String, typeof Schema.Number]>>;
     }>;
@@ -6398,7 +6754,7 @@ export declare const toRpc: <Name extends string, Input extends Schema.Schema.An
         }>, Schema.Struct<{
             op: Schema.Literal<["mergeCells"]>;
             path: typeof Schema.String;
-            value: Schema.Record$<typeof Schema.String, typeof Schema.Unknown>;
+            value: Schema.Record$<typeof Schema.String, Schema.transform<typeof Schema.Unknown, typeof Schema.Unknown>>;
         }>]>>;
         order: Schema.Array$<Schema.Union<[typeof Schema.String, typeof Schema.Number]>>;
     }>;
@@ -6709,6 +7065,10 @@ export declare interface VoltroPlugin {
      * merge to the stricter `required` and the safer `secret`.
      */
     readonly declaredEnv?: ReadonlyArray<PluginEnvVar>;
+    /** What this plugin collects and uses — see `PluginPrivacyDeclaration`. */
+    readonly privacy?: PluginPrivacyDeclaration;
+    /** Where this plugin sends data outside the installation — see `PluginEgressDeclaration`. Omit when it sends nothing. */
+    readonly egress?: ReadonlyArray<PluginEgressDeclaration>;
     /**
      * The authorization scopes this plugin DEFINES for the app — its scope
      * vocabulary. Distinct from `permissions` above, which is what the plugin
@@ -6844,8 +7204,10 @@ export declare interface VoltroPlugin {
      * that wants the enablers declares `(store, ctx)` and reads
      * `ctx?.sql` / `ctx?.scheduleCoordinated(...)`; one that ignores `ctx`
      * keeps working unchanged.
+     * A returned Promise is awaited before the app begins serving requests.
+     * Store-dependent initialization may run here when activation happened first.
      */
-    readonly bindDataStore?: (store: DataStore, ctx?: PluginBindContext) => void;
+    readonly bindDataStore?: (store: DataStore, ctx?: PluginBindContext) => void | Promise<void>;
     /**
      * Capabilities this plugin offers to OTHER framework machinery, by name.
      *
@@ -7055,6 +7417,26 @@ export declare interface VoltroPlugin {
     readonly onProcedureSurface?: (procedures: ReadonlyArray<ProcedureDescriptor>) => void;
 }
 
+/**
+ * The plugins' cross-cutting errors, at the TYPE level.
+ *
+ * A plugin's `errorSchemas` reach every procedure's wire union at boot — a
+ * runtime fact the type system cannot see. The codegen closes that gap: it
+ * augments this interface in `rpcGroup.generated.ts` with one entry per
+ * registered schema, so `defineExecutor` accepts a failure a plugin registers
+ * exactly where the server will deliver it typed. Empty until the first
+ * codegen run, which makes an unregistered plugin error a compile error rather
+ * than a silent `InternalError`.
+ *
+ *     declare module '@voltro/protocol' {
+ *       interface VoltroPluginErrors {
+ *         readonly '@acme/errors#NotFoundError': NotFoundError
+ *       }
+ *     }
+ */
+export declare interface VoltroPluginErrors {
+}
+
 /**
  * The table names THIS app declares — filled in by codegen, empty here.
  *
@@ -7168,7 +7550,7 @@ export declare const wireAudienceOf: (descriptor: {
 /**
  * The error union a procedure ACTUALLY puts on the wire — `descriptor.error`
  * plus everything the framework can produce for it before or around the
- * executor.
+ * executor, plus the plugins' cross-cutting errors (`extraErrors`).
  *
  * ── Why this is exported rather than inlined in the lifters ────────────────
  *
@@ -7198,13 +7580,34 @@ export declare const wireAudienceOf: (descriptor: {
  * `ScopeError` themselves — is what made the two sets agree by hand.
  *
  * One function now, so they cannot disagree again.
+ *
+ * The plugins' errors are part of that answer for the same reason. A plugin's
+ * `errorSchemas` entry is on every lifted union, and the judgement above was
+ * handed the union WITHOUT them — so an interceptor's `RateLimited`, or an
+ * app-wide error a local plugin registers, decoded typed on a query and was
+ * collapsed to `InternalError` on every mutation and action, on both boot
+ * paths. Pass the same `extraErrors` the lifter receives.
  */
 export declare const wireErrorUnion: (descriptor: {
     readonly error: Schema.Schema.All;
     readonly guards?: DeclaredAccess | undefined;
     readonly requiresApproval?: AnyApprovalPolicy | undefined;
     readonly idempotencyScope?: MutationIdempotencyScope | undefined;
-}, kind: "query" | "mutation" | "action" | "stream") => Schema.Schema.All;
+}, kind: "query" | "mutation" | "action" | "stream", extraErrors?: ExtraErrors) => Schema.Schema.All;
+
+/** A procedure kind that has a wire error union. */
+export declare type WireProcedureKind = keyof typeof FRAMEWORK_WIRE_ERRORS;
+
+/**
+ * The error of a {@link ServerErrorEvent} with its content withheld: same
+ * `name` (the class, or a typed failure's tag), the original stack FRAMES —
+ * code locations, which carry no data — and a message saying where the full
+ * error can be read by someone allowed to. No `cause`, no own properties.
+ *
+ * The stack's first line repeats the message, so it is rebuilt from the frames
+ * rather than copied.
+ */
+export declare const withheldServerError: (event: ServerErrorEvent) => Error;
 
 /**
  * Re-tag a procedure descriptor for the wire.
@@ -7698,6 +8101,147 @@ export declare const WorkflowQueuedControlTargetSchema: Schema.Struct<{
     requestId: typeof Schema.NonEmptyString;
 }>;
 
+export declare type WorkflowRestartCommand = typeof WorkflowRestartCommandSchema.Type;
+
+export declare const WorkflowRestartCommandSchema: Schema.Struct<{
+    selection: Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["failed-steps"]>;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["from-step"]>;
+        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    }>]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>;
+
+export declare type WorkflowRestartObservation = typeof WorkflowRestartObservationSchema.Type;
+
+/** Pending is a durable reservation, not proof of reset or engine entry.
+ * Entered confirms this command's generation; it does not claim run success. */
+export declare const WorkflowRestartObservationSchema: Schema.Union<[Schema.Struct<{
+    kind: Schema.Literal<["not-found"]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["withdrawn"]>;
+    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
+    withdrawnAt: Schema.filter<typeof Schema.Number>;
+    selection: Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["failed-steps"]>;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["from-step"]>;
+        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    }>]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["pending"]>;
+    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
+    executionId: Schema.filter<typeof Schema.NonEmptyString>;
+    originalGeneration: Schema.filter<typeof Schema.NonEmptyString>;
+    requestedAt: Schema.filter<typeof Schema.Number>;
+    dispatchAttempts: Schema.refine<number, typeof Schema.NonNegative>;
+    selection: Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["failed-steps"]>;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["from-step"]>;
+        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    }>]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>, Schema.filter<Schema.Struct<{
+    kind: Schema.Literal<["entered"]>;
+    enteredGeneration: Schema.filter<typeof Schema.NonEmptyString>;
+    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
+    executionId: Schema.filter<typeof Schema.NonEmptyString>;
+    originalGeneration: Schema.filter<typeof Schema.NonEmptyString>;
+    requestedAt: Schema.filter<typeof Schema.Number>;
+    dispatchAttempts: Schema.refine<number, typeof Schema.NonNegative>;
+    selection: Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["failed-steps"]>;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["from-step"]>;
+        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    }>]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>>]>;
+
+export declare type WorkflowRestartResult = typeof WorkflowRestartResultSchema.Type;
+
+/** A refused reservation never reset the journal. Transport failures instead
+ * require reading the original target; they are not proof of refusal. */
+export declare const WorkflowRestartResultSchema: Schema.Union<[Schema.Union<[Schema.Struct<{
+    kind: Schema.Literal<["not-found"]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["withdrawn"]>;
+    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
+    withdrawnAt: Schema.filter<typeof Schema.Number>;
+    selection: Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["failed-steps"]>;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["from-step"]>;
+        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    }>]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["pending"]>;
+    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
+    executionId: Schema.filter<typeof Schema.NonEmptyString>;
+    originalGeneration: Schema.filter<typeof Schema.NonEmptyString>;
+    requestedAt: Schema.filter<typeof Schema.Number>;
+    dispatchAttempts: Schema.refine<number, typeof Schema.NonNegative>;
+    selection: Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["failed-steps"]>;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["from-step"]>;
+        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    }>]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>, Schema.filter<Schema.Struct<{
+    kind: Schema.Literal<["entered"]>;
+    enteredGeneration: Schema.filter<typeof Schema.NonEmptyString>;
+    workflowName: Schema.filter<typeof Schema.NonEmptyString>;
+    executionId: Schema.filter<typeof Schema.NonEmptyString>;
+    originalGeneration: Schema.filter<typeof Schema.NonEmptyString>;
+    requestedAt: Schema.filter<typeof Schema.Number>;
+    dispatchAttempts: Schema.refine<number, typeof Schema.NonNegative>;
+    selection: Schema.Union<[Schema.Struct<{
+        kind: Schema.Literal<["failed-steps"]>;
+    }>, Schema.Struct<{
+        kind: Schema.Literal<["from-step"]>;
+        stepName: Schema.filter<typeof Schema.NonEmptyString>;
+    }>]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>>]>, Schema.Struct<{
+    kind: Schema.Literal<["not-reserved"]>;
+    reason: Schema.Literal<["admission", "journal"]>;
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>]>;
+
+export declare type WorkflowRestartSelection = typeof WorkflowRestartSelectionSchema.Type;
+
+export declare const WorkflowRestartSelectionSchema: Schema.Union<[Schema.Struct<{
+    kind: Schema.Literal<["failed-steps"]>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["from-step"]>;
+    stepName: Schema.filter<typeof Schema.NonEmptyString>;
+}>]>;
+
+export declare type WorkflowRestartTarget = typeof WorkflowRestartTargetSchema.Type;
+
+/** Persist before submitting; read this same target after an uncertain reply. */
+export declare const WorkflowRestartTargetSchema: Schema.Struct<{
+    requestId: Schema.filter<Schema.filter<typeof Schema.NonEmptyString>>;
+    runId: Schema.filter<typeof Schema.NonEmptyString>;
+}>;
+
 export declare const workflowResumeDescriptor: ActionProcedureDescriptor<"__voltro.workflow.resume", Schema.Struct<{
     workflowName: typeof Schema.String;
     executionId: typeof Schema.String;