@voltro/protocol 0.85.0 → 0.87.0

package/dist/index.d.ts

@@ -1,13 +1,23 @@
+import { ConnectionKind as ConnectionKind_2 } from '@voltro/kv/connection';
+import { ConnectionRef } from '@voltro/kv/connection';
+import { ConnectionRegistryShape } from '@voltro/kv/connection';
+import { ConnectionUnavailablePolicy } from '@voltro/kv/connection';
 import { Context } from 'effect';
 import { DataStore } from '@voltro/database';
 import { Effect } from 'effect';
+import { HotStoreShape } from '@voltro/kv/hot/contract';
 import { Layer } from 'effect';
 import { Option } from 'effect';
 import { Rpc } from 'effect/rpc';
 import { RpcMiddleware } from 'effect/rpc';
 import { Schema } from 'effect';
 import { SchemaAST } from 'effect';
+import { Scope } from 'effect';
 import { SqlClient } from 'effect/sql';
+import { StorageAddress } from '@voltro/kv/storage';
+import { StorageDestinationRouter } from '@voltro/kv/storage';
+import { StorageError } from '@voltro/kv/storage';
+import { StorageProvider } from '@voltro/kv/storage';
 import { Stream } from 'effect/rpc/RpcSchema';
 import { VersionConflict } from '@voltro/database/wire';
 import { YieldableError } from 'effect/Cause';
@@ -137,7 +147,7 @@ export declare interface AnyApprovalPolicy {
 
 /** A guard entry is a scope check, a relationship check, an identity check, a
  *  declared no-check-needed decision, or a service-only decision. */
-export declare type AnyCheckSpec = GuardCheckSpec | PolicyCheckSpec | AuthenticatedCheckSpec | OpenAccessSpec | ServiceAccessSpec;
+export declare type AnyCheckSpec = GuardCheckSpec | PolicyCheckSpec | AuthenticatedCheckSpec | UpgradedCheckSpec | OpenAccessSpec | ServiceAccessSpec;
 
 /** Any declared event, with the generics erased — for registries and audits. */
 /** The erased descriptor every registry holds. `guards` reads the key type
@@ -147,7 +157,10 @@ export declare type AnyCheckSpec = GuardCheckSpec | PolicyCheckSpec | Authentica
 export declare type AnyEventDescriptor = EventDescriptor<string, Schema.Top, Schema.Top, DeclaredAccess<never>>;
 
 /** A guard is a scope check, a relationship check, or an identity check. */
-export declare type AnyGuardSpec<Input = unknown> = GuardSpec<Input> | PolicyGuardSpec<Input> | AuthenticatedGuardSpec;
+export declare type AnyGuardSpec<Input = unknown> = GuardSpec<Input> | PolicyGuardSpec<Input> | AuthenticatedGuardSpec | UpgradedGuardSpec;
+
+/** Work performed by an API process; schema and descriptor loading is separate. */
+export declare const API_WORKLOADS: readonly ["rpc", "subscriptions", "events", "presence", "workflows", "schedules", "directors", "drainers", "reapers", "retention", "rest", "webhooks", "inspect", "cdc"];
 
 export declare const APIKEY_ISSUE_ORG_SCOPE = "apikeys:issue:org";
 
@@ -180,6 +193,118 @@ export declare const APIKEY_ISSUE_OTHER_SCOPE = "apikeys:issue:other";
  */
 export declare const APIKEY_ISSUE_SELF_SCOPE = "apikeys:issue:self";
 
+export declare interface ApiRoleEndpoint {
+    readonly role: string;
+    readonly routes: ReadonlyArray<string> | null;
+    readonly workloads: ReadonlyArray<string>;
+    readonly httpPath: string | null;
+    readonly webSocketPath: string;
+}
+
+export declare interface ApiRoleEndpoints {
+    readonly version: 1;
+    readonly transport: 'compose-nginx' | 'kubernetes-nginx';
+    readonly roles: ReadonlyArray<ApiRoleEndpoint>;
+}
+
+export declare const apiRoleEndpointUrl: (baseUrl: string, endpoint: ApiRoleEndpoint, transport: "http" | "websocket") => string;
+
+export declare interface ApiRoleObservationReport {
+    readonly replicaId: string;
+    readonly startedAt: number;
+    readonly role: string;
+    readonly workloads: ReadonlyArray<ApiWorkload>;
+    readonly capturedAt: number;
+    readonly publisher: {
+        readonly ready: boolean;
+        readonly stopped: boolean;
+        readonly pendingBuckets: number;
+        readonly droppedBuckets: number;
+        readonly rejectedSegments: number;
+        readonly writeFailures: number;
+        readonly observationErrors: number;
+    };
+    readonly currentMeasuredSeconds: ReadonlyArray<{
+        readonly role: string;
+        readonly workload: ApiWorkload;
+        readonly seconds: number;
+    }>;
+    readonly history: {
+        readonly state: 'pending' | 'available' | 'unavailable';
+        readonly assessment: ApiRoleWindowAssessment | null;
+        /** Measured portions only; no share is inferred from incomplete coverage. */
+        readonly measuredSeconds: ReadonlyArray<{
+            readonly workload: ApiWorkload;
+            readonly seconds: number;
+        }>;
+    };
+}
+
+/** Browser-safe wire contract; no runtime or database imports. */
+export declare const ApiRoleObservationSchema: Schema.Struct<{
+    readonly replicaId: Schema.NonEmptyString;
+    readonly startedAt: Schema.Number;
+    readonly role: Schema.NonEmptyString;
+    readonly workloads: Schema.$Array<Schema.Literals<readonly ["rpc", "subscriptions", "events", "presence", "workflows", "schedules", "directors", "drainers", "reapers", "retention", "rest", "webhooks", "inspect", "cdc"]>>;
+    readonly capturedAt: Schema.Number;
+    readonly publisher: Schema.Struct<{
+        readonly ready: Schema.Boolean;
+        readonly stopped: Schema.Boolean;
+        readonly pendingBuckets: Schema.Number;
+        readonly droppedBuckets: Schema.Number;
+        readonly rejectedSegments: Schema.Number;
+        readonly writeFailures: Schema.Number;
+        readonly observationErrors: Schema.Number;
+    }>;
+    readonly currentMeasuredSeconds: Schema.$Array<Schema.Struct<{
+        readonly role: Schema.NonEmptyString;
+        readonly workload: Schema.Literals<readonly ["rpc", "subscriptions", "events", "presence", "workflows", "schedules", "directors", "drainers", "reapers", "retention", "rest", "webhooks", "inspect", "cdc"]>;
+        readonly seconds: Schema.Number;
+    }>>;
+    readonly history: Schema.Struct<{
+        readonly state: Schema.Literals<readonly ["pending", "available", "unavailable"]>;
+        readonly measuredSeconds: Schema.$Array<Schema.Struct<{
+            readonly workload: Schema.Literals<readonly ["rpc", "subscriptions", "events", "presence", "workflows", "schedules", "directors", "drainers", "reapers", "retention", "rest", "webhooks", "inspect", "cdc"]>;
+            readonly seconds: Schema.Number;
+        }>>;
+        readonly assessment: Schema.NullOr<Schema.Struct<{
+            readonly from: Schema.Number;
+            readonly until: Schema.Number;
+            readonly complete: Schema.Boolean;
+            readonly missingBuckets: Schema.Number;
+            readonly incompleteWorkloads: Schema.$Array<Schema.Literals<readonly ["rpc", "subscriptions", "events", "presence", "workflows", "schedules", "directors", "drainers", "reapers", "retention", "rest", "webhooks", "inspect", "cdc"]>>;
+            readonly reason: Schema.Literals<readonly ["invalid-observation", "incomplete", "idle", "observed"]>;
+            readonly totals: Schema.$Array<Schema.Struct<{
+                readonly workload: Schema.Literals<readonly ["rpc", "subscriptions", "events", "presence", "workflows", "schedules", "directors", "drainers", "reapers", "retention", "rest", "webhooks", "inspect", "cdc"]>;
+                readonly seconds: Schema.Number;
+                readonly share: Schema.Number;
+            }>>;
+            readonly splitCandidates: Schema.$Array<Schema.Literals<readonly ["rpc", "subscriptions", "events", "presence", "workflows", "schedules", "directors", "drainers", "reapers", "retention", "rest", "webhooks", "inspect", "cdc"]>>;
+        }>>;
+    }>;
+}>;
+
+/** Reserved web proxy base; the API name isolates identical role names. */
+export declare const apiRoleProxyBasePath: (apiName: string) => string;
+
+export declare type ApiRoleRpcWorkload = 'rpc' | 'subscriptions' | 'events';
+
+export declare interface ApiRoleWindowAssessment {
+    readonly from: number;
+    readonly until: number;
+    readonly complete: boolean;
+    readonly missingBuckets: number;
+    readonly incompleteWorkloads: ReadonlyArray<ApiWorkload>;
+    readonly reason: 'invalid-observation' | 'incomplete' | 'idle' | 'observed';
+    readonly totals: ReadonlyArray<{
+        readonly workload: ApiWorkload;
+        readonly seconds: number;
+        readonly share: number;
+    }>;
+    /** Advisory evidence only: no topology mutation and no acceptance claim. */
+    readonly splitCandidates: ReadonlyArray<ApiWorkload>;
+}
+
 export declare class ApiUnavailable extends ApiUnavailable_base {
 }
 
@@ -193,6 +318,8 @@ declare const ApiUnavailable_base: Schema.Class<ApiUnavailable, Schema.TaggedStr
     readonly message: Schema.String;
 }>, YieldableError>;
 
+export declare type ApiWorkload = typeof API_WORKLOADS[number];
+
 /** The subject a decision produces, plus what the decision took away. `removed`
  *  is never non-empty for a `grant`. */
 export declare interface AppliedScopes {
@@ -546,7 +673,7 @@ export declare interface AuthenticatedGuardSpec {
  * an auth resolver before reaching its handler. The application provides
  * the resolver via `Layer.succeed(AuthMiddleware, AuthMiddleware.of(fn))`,
  * where `fn` receives `{headers, payload, rpc, clientId}` and returns an
- * `Effect<Subject, Unauthenticated>` — typically by inspecting headers / Bearer token and
+ * `Effect<Subject, Unauthenticated | RequestedTenantRefused>` — typically by inspecting headers / Bearer token and
  * looking the caller up.
  *
  * `provides: SubjectService` means the resolver's return value is placed
@@ -562,7 +689,7 @@ export declare interface AuthenticatedGuardSpec {
 export declare class AuthMiddleware extends AuthMiddleware_base {
 }
 
-declare const AuthMiddleware_base: RpcMiddleware.ServiceClass<AuthMiddleware, "@voltro/AuthMiddleware", SubjectService, typeof Unauthenticated, never, never, false>;
+declare const AuthMiddleware_base: RpcMiddleware.ServiceClass<AuthMiddleware, "@voltro/AuthMiddleware", SubjectService, Schema.Union<readonly [typeof Unauthenticated, typeof RequestedTenantRefused]>, never, never, false>;
 
 export declare type AuthRouteHandler = (req: AuthRouteRequest) => Promise<AuthRouteResponse>;
 
@@ -625,6 +752,13 @@ export declare interface AuthStrategy {
 export declare interface AuthStrategyInput {
     readonly headers: Readonly<Record<string, string | undefined>>;
     readonly clientId: number;
+    /** HTTP request target, supplied by REST transports. Request selectors may
+     * read an explicit tenant hint here; it is never authentication or authority.
+     * Absent for connection transports and non-HTTP callers. */
+    readonly http?: {
+        readonly path: string;
+        readonly query: string;
+    };
     /**
      * The app's DataStore, for a strategy that must READ to identify the caller.
      *
@@ -673,8 +807,9 @@ export declare interface AuthStrategyWithCallback extends AuthStrategy {
 export declare type AuthSubjectGuard = (subject: Subject, ctx: AuthSubjectGuardContext) => Promise<AuthSubjectGuardVerdict> | AuthSubjectGuardVerdict;
 
 export declare interface AuthSubjectGuardContext {
-    /** `'request'` for a live call, `'workflow'` for a durable run being executed. */
-    readonly origin: 'request' | 'workflow';
+    /** `'request'` for a live call, `'workflow'` for a durable run being executed,
+     *  `'room'` for a Room seat redeemed on a Room host (no request headers). */
+    readonly origin: 'request' | 'workflow' | 'room';
     /** The request's headers. EMPTY for `origin: 'workflow'`. */
     readonly headers: Readonly<Record<string, string | undefined>>;
     /** `undefined` for `origin: 'workflow'` and for transports with no connection. */
@@ -724,7 +859,12 @@ export declare type AuthSubjectGuardVerdict = {
  * `fresh` the caller runs the handler then calls `finish`/`fail`; on
  * `replay`/`conflict` it returns immediately without touching the handler.
  */
-export declare const beginIdempotent: (store: IdempotencyStore, scope: string, key: string, ttlMs: number, now: number, inFlightLeaseMs?: number) => Promise<IdempotencyOutcome>;
+export declare const beginIdempotent: (store: IdempotencyStore, scope: string, key: string, inputHash: string, ttlMs: number, now: number, inFlightLeaseMs?: number) => Promise<IdempotencyOutcome>;
+
+/** Bind a process-local authority refresh to an independent subject snapshot.
+ * Neither the resolver nor its credentials become serializable subject fields.
+ * Request and durable-execution hosts use the same identity-preserving refresh. */
+export declare const bindSubjectAuthority: (subject: Subject, resolve: () => Promise<Subject>) => Subject;
 
 /** Bounded insertion-order storage. Appending overwrites one slot when full;
  * reads never expose its circular physical order or retained array. */
@@ -771,6 +911,24 @@ export declare interface CachedScopeDecision {
     readonly fresh: boolean;
 }
 
+/**
+ * Canonical JSON — object keys sorted recursively, so two structurally equal
+ * inputs that differ only in key order digest identically. A retry from a
+ * different client build must not mint a second approval.
+ * Preserve own JSON fields such as `__proto__`; a prototype setter must never
+ * discard part of the content that an approval identity binds.
+ *
+ * Lives here, not in `@voltro/runtime`, so identity digests in modules that
+ * must not load the server runtime (storage metadata, browser-safe code) use
+ * the same encoding.
+ */
+export declare const canonicalJson: (value: unknown) => string;
+
+export declare const captureApiRoleEndpoints: (value: unknown) => ApiRoleEndpoints;
+
+/** Capture optional integration observations without changing reactive triggers. */
+export declare const captureOptionalQuerySources: (name: string, source: string | ReadonlyArray<string> | undefined, optional: unknown) => ReadonlyArray<string> | undefined;
+
 /**
  * Validate `plugin.framework` (npm-semver range) against the running
  * voltro version. Returns either `{ ok: true }` or
@@ -809,7 +967,10 @@ export declare const checkGuards: (subject: Subject, guards: ReadonlyArray<AnyCh
  * guard has a `resource`, it extracts the resource id from `input` and asks the
  * resolver whether the caller holds each scope on THAT resource. A globally-held
  * scope (or the `admin:full` bypass) still satisfies without a resolver call;
- * only the gap ("no global grant") falls through to the resolver. A failed
+ * only the gap ("no global grant") falls through to the resolver. A guard with
+ * `resourceOnly: true` always requires the resource resolver's verdict, even
+ * for globally-held scopes or `admin:full`, and refuses if its resource or
+ * resolver is unavailable. A failed
  * resolver Effect is treated as a denial (fail-closed).
  *
  * Returns a typed `ScopeError` naming the first unmet scope, or `null` when
@@ -842,6 +1003,9 @@ export declare interface ClientDescriptor {
      *  (`<DataTable>` derives its columns from it) + the capability map can
      *  introspect it. Same browser-safety rationale as `input`. */
     readonly output?: Schema.Top | undefined;
+    /** The procedure's own declared error schema, by reference like input/output.
+     *  This is not the widened framework/plugin wire error union. */
+    readonly error?: Schema.Top | undefined;
 }
 
 /**
@@ -893,15 +1057,15 @@ export declare const composeAuthStrategies: (strategies: ReadonlyArray<AuthStrat
     /** What an unauthenticated caller is — see {@link AnonymousPolicy}.
      *  Default `'no-tenant'`. Ignored when `fallback` is supplied. */
     readonly anonymous?: AnonymousPolicyOrDevTenant;
-    /**
-     * The subject's memberships — the ONE source, strategy-independent. Read
-     * only when a stored tenant selection exists for the subject and names a
-     * tenant other than the credential's, and then on every such request: a
-     * membership revoked a moment ago must not keep a selection alive, and a
-     * switch made a moment ago must be visible on the next call, so there is
-     * no staleness window to configure here. Requires `tenantSelection`.
-     */
+    /** Fresh strategy-independent memberships. Explicit requested tenants are
+     * checked on every resolution, including the credential tenant. Stored
+     * selections read memberships only when they differ from the credential.
+     * Requires `tenantSelection` or `requestedTenant`. */
     readonly memberships?: MembershipsSource;
+    /** Request-local tenant hint, checked against fresh `memberships` before
+     * scopes and guards. Explicit targets bypass the stored selection without
+     * changing it. Invalid hints fail closed, never fall back. */
+    readonly requestedTenant?: RequestedTenantSource;
     /**
      * Where a subject's tenant selection is stored. Read for every matched
      * user / apiKey / serviceAccount subject (one point lookup); a stored
@@ -1012,6 +1176,8 @@ export declare const composeAuthStrategies: (strategies: ReadonlyArray<AuthStrat
     readonly getStore?: () => unknown;
 }) => ((input: AuthStrategyInput) => Promise<SubjectResolution>);
 
+export declare const composeReplayAuthorityBindings: (plugins: ReadonlyArray<unknown>) => RpcReplayAuthorityBinding | undefined;
+
 /**
  * Compose a list of Effect-native interceptors into ONE function the
  * runtime calls. Reduces right-to-left so the array order reads
@@ -1082,6 +1248,11 @@ export declare class ConnectionInfoMiddleware extends ConnectionInfoMiddleware_b
 declare const ConnectionInfoMiddleware_base: RpcMiddleware.ServiceClass<ConnectionInfoMiddleware, "@voltro/ConnectionInfoMiddleware", ConnectionInfo, Schema.Never, never, never, false>;
 
 export declare interface ConnectionInfoValue {
+    /** The effective per-call Cookie header, including current connection
+     * credential patches. Server-only input for app-specific signed-cookie
+     * verification; not a verified identity. Never serialize it into responses
+     * or public page state. Absent when the caller presented no cookies. */
+    readonly cookieHeader?: string;
     /** Per-connection identifier assigned by the rpc transport. Stable for the
      *  lifetime of the underlying WebSocket connection; reused as the key for
      *  the per-connection subject override map. */
@@ -1345,8 +1516,9 @@ declare const ConstraintViolation_base: Schema.Class<ConstraintViolation, Schema
  * plugin wants to cancel EARLY (before shutdown).
  */
 export declare interface CoordinatedScheduleHandle {
-    /** Stop the periodic task. Idempotent. */
-    readonly stop: () => void;
+    /** Stop future admission immediately; await completion before releasing the
+     * task dependencies. Idempotent; synchronous handles finish immediately. */
+    readonly stop: () => void | Promise<void>;
     /** The task name (for logging / dedup diagnostics). */
     readonly name: string;
     /**
@@ -1405,6 +1577,13 @@ export declare interface CoordinatedTickOutcome {
     readonly nextDueInMs?: number | null;
 }
 
+/** Capture the complete participant list once. Undeclared SQL tables refuse
+ * before any hook; erasure and merge are distinct policies and never substitute. */
+export declare const createPluginAccountMergeRegistry: (plugins: ReadonlyArray<VoltroPlugin>) => PluginAccountMergeRegistry;
+
+/** Captures hooks once. Does not read a store, schedule work, retry or grant authority. */
+export declare const createPluginPrivacyRegistry: (plugins: ReadonlyArray<VoltroPlugin>) => PluginPrivacyRegistry;
+
 /** Index reuse for one subscription's immutable snapshots and returned rows.
  * Arbitrary mutable input must use applyRowPatch. A different base rebuilds
  * the index; reset releases it on snapshot replacement or owner disposal. */
@@ -1413,6 +1592,9 @@ export declare const createRowPatchApplier: () => {
     readonly reset: () => void;
 };
 
+/** The latest authenticated authority for a request or live subscription. */
+export declare const currentSubjectAuthority: (subject: Subject) => Subject;
+
 /**
  * What a descriptor CARRIES: the author's guards, or the erased form of their
  * `openAccess:` decision — never both.
@@ -1425,6 +1607,9 @@ export declare const createRowPatchApplier: () => {
  */
 export declare type DeclaredAccess<Input = unknown> = ReadonlyArray<AnyGuardSpec<Input> | OpenAccessSpec | ServiceAccessSpec>;
 
+/** The `_tag` literals a descriptor's `error:` union declares (empty for none). */
+export declare const declaredErrorTags: (error: Schema.Top | undefined) => ReadonlySet<string>;
+
 /** Every channel declared in this process, by routing key. */
 export declare const declaredReactivityChannelKeys: () => ReadonlySet<string>;
 
@@ -1597,10 +1782,9 @@ export declare const defineEvent: <const Name extends string, Key extends Schema
      * resource-scoped rule ("may this terminal watch this arena") stays
      * declarative. `ScopeError` is merged into the wire error union automatically.
      *
-     * Re-checked when the SUBJECT changes (a revoked role ends the stream), not on
-     * every delivery. Per-delivery authorization is the design a comparable
-     * product measured into a scaling wall: one check per subscriber per message
-     * makes throughput scale with the audience instead of the publish rate.
+     * Checked before subscription and each delivery. Resource resolvers can observe
+     * live revocation; captured subject scopes remain bounded by credential expiry.
+     * Additional private payload filtering uses the app-owned clientPolicy.
      */
     readonly guards?: Guards<Schema.Schema.Type<Key>>;
     /**
@@ -1661,6 +1845,8 @@ export declare const defineEvent: <const Name extends string, Key extends Schema
      * to miss one?" — not "is this event frequent?".
      */
     readonly delivery?: EventDeliverySemantics;
+    /** Required private-client policy ID, resolved from the installing app. */
+    readonly clientPolicy?: string;
 }) => EventDescriptor<Name, Key, Payload>;
 
 export declare const defineMutation: <const Name extends string, Input extends Schema.Top, Output extends Schema.Top, Error extends Schema.Top = typeof Schema.Never>(options: {
@@ -1693,6 +1879,13 @@ export declare const defineMutation: <const Name extends string, Input extends S
      * same way. Not a durable outbox, a distributed lock or a cross-tab merge.
      */
     readonly serialize?: MutationSerialization<Schema.Schema.Type<Input>>;
+    /** Exclude mutations without a valid row-image inverse (for example a
+     * derived-index rebuild) from automatic undo. Omitted means the normal
+     * environment-controlled capture. Transactions, guards and audit still run. */
+    readonly undo?: {
+        readonly capture: false;
+        readonly reason: string;
+    };
     /** Optional declarative target(s) — drives auto-optimistic. */
     readonly target?: Target<Schema.Schema.Type<Input>, Schema.Schema.Type<Output>>;
     /** Declarative authorization guard(s) — the caller must hold the named
@@ -1846,6 +2039,9 @@ export declare const defineQuery: <const Name extends string, Input extends Sche
      *  import edge is what makes a channel `source:` impossible to leave stale,
      *  which a table name (a bare string) can always be. */
     readonly source?: ReactivitySource | ReadonlyArray<ReactivitySource>;
+    /** Names in source that observe an optional integration. These remain in
+     *  the complete trigger set; unavailable optional tables warn in check. */
+    readonly optionalSource?: ReadonlyArray<string>;
     /** Opt into server-side snapshot caching with auto-invalidation. */
     readonly cache?: QueryCacheConfig;
     /** Declarative authorization guard(s) — the caller must hold the named
@@ -1990,6 +2186,38 @@ export declare interface DeleteTarget<Input = unknown> extends NestedTargetField
     readonly identify?: ((input: Input) => string | ReadonlyArray<string>) | undefined;
 }
 
+/** The HMR custom event `voltro dev` publishes its activity on. */
+export declare const DEV_ACTIVITY_EVENT = "voltro:dev-activity";
+
+/** What `voltro dev` reports over {@link DEV_ACTIVITY_EVENT}. A `document`
+ *  message describes ONE document request (`id` is per server process); a
+ *  `compile` message says whether Vite is transforming browser modules. */
+export declare type DevActivityMessage = {
+    readonly type: 'document';
+    readonly id: number;
+    /** Path + search exactly as the browser asked for it. */
+    readonly url: string;
+    /** `start` once, when the request arrives; then whichever the server
+     *  is doing as it changes — `compiling` while Vite transforms modules
+     *  for it, `rendering` once a server render runs, `waiting` for
+     *  anything else (Vite's own html, a middleware). */
+    readonly phase: 'start' | 'waiting' | 'compiling' | 'rendering';
+} | {
+    readonly type: 'document';
+    readonly id: number;
+    readonly url: string;
+    readonly phase: 'end';
+    /** `document`: the browser got a page to show. `redirect`: it will ask
+     *  for `location` next. `no-document`: nothing will replace this page
+     *  (204/205, an attachment). `aborted`: the browser went away first. */
+    readonly outcome: 'document' | 'redirect' | 'no-document' | 'aborted';
+    readonly location?: string;
+} | {
+    readonly type: 'compile';
+    readonly consumer: 'client';
+    readonly active: boolean;
+};
+
 /** Pair, list and revoke devices (`devices: true`) for the caller's tenant.
  *  One scope, not three: a device always acts as itself, in the pairer's
  *  tenant, so there is no self / org / other distinction to draw.
@@ -2048,6 +2276,8 @@ export declare const effectiveScopes: (subject: Subject) => ReadonlyArray<string
  */
 export declare const encodeEventKey: (key: unknown) => string;
 
+export declare const encodeNativeFormCapture: (selector: string, presentationDigest: string) => string;
+
 /** Encode a failure under `format`: the tagged body the desugar always wrote
  *  (`{ error, …fields }`), Problem Details, or the format's own encoder. */
 export declare const encodeRestError: (format: RestFormat, error: RestFormatError, ctx: RestFormatContext) => RestFormatResponse;
@@ -2059,6 +2289,17 @@ export declare const encodeRestError: (format: RestFormat, error: RestFormatErro
  */
 export declare const encodeRestSuccess: (format: RestFormat, value: unknown, ctx: RestFormatContext) => RestFormatResponse;
 
+export declare interface EnqueueOptions {
+    /** Deduplicate while an earlier intent is still pending, not permanently. */
+    readonly idempotencyKey?: string;
+    readonly maxAttempts?: number;
+    readonly delayMs?: number;
+}
+
+/** The member of an error union that declares `tag`, as a schema of its own —
+ *  for the spec's per-status responses. */
+export declare const errorMemberSchema: (error: Schema.Top | undefined, tag: string) => Schema.Top | undefined;
+
 /**
  * The text to SHOW for a failure value — its `message`, else its `_tag`, else
  * `String(value)`.
@@ -2076,8 +2317,8 @@ export declare const errorMessage: (err: unknown) => string;
 /**
  * Read the `_tag` off a thrown error value, or `undefined` when it has none.
  *
- * It lives here, beside `toRpc`, because `toRpc` is what puts the tag on the
- * wire — one file owns both ends of that contract. It used to live in
+ * It lives in protocol because `toRpc` (procedure.ts) is what puts the tag on
+ * the wire — one package owns both ends of that contract. It used to live in
  * `@voltro/client`, and being there had a cost nobody could see from inside the
  * framework: an app's shared error handler lived in a package that pulled only
  * `@voltro/i18n`, so reading a tag meant taking a dependency on the whole client
@@ -2119,6 +2360,34 @@ export declare const eventAttached: Schema.Struct<{
     readonly _tag: Schema.Literal<"attached">;
 }>;
 
+/** App-owned, server-only callbacks. Descriptors carry only the policy ID. */
+export declare interface EventClientPolicy {
+    readonly id: string;
+    /** Before bus subscription, including reattachment/resume. Only true admits. */
+    readonly admit: (input: {
+        readonly subject: Subject;
+        readonly event: string;
+        readonly key: unknown;
+    }) => Effect.Effect<boolean, unknown>;
+    /** Recheck current membership AND payload visibility. Deny ends the stream;
+     * drop withholds this payload but keeps the subscription. No client filtering. */
+    /** Register revocation before initial admission. The returned effect ends when
+     * access may have changed; completion or failure ends the client stream.
+     * Acquire resources in the supplied Scope; no detached background owner. */
+    readonly monitor?: (input: {
+        readonly subject: Subject;
+        readonly event: string;
+        readonly key: unknown;
+    }) => Effect.Effect<Effect.Effect<void, unknown>, unknown, Scope.Scope>;
+    readonly deliver: (input: {
+        readonly subject: Subject;
+        readonly event: string;
+        readonly key: unknown;
+        readonly payload: unknown;
+        readonly emittedAt: number;
+    }) => Effect.Effect<'allow' | 'drop' | 'deny', unknown>;
+}
+
 /**
  * What it means for a subscriber to fall behind.
  *
@@ -2155,9 +2424,8 @@ export declare interface EventDescriptor<Name extends string, Key extends Schema
     readonly key: Key;
     readonly payload: Payload;
     /** Who may LISTEN — the author's guards, or the erased form of their
-     *  `openAccess:` decision, never both (see `DeclaredAccess`). Re-checked when
-     *  the subject changes, not per delivery — see `EventDefinition.guards` for
-     *  why that distinction is deliberate. */
+     *  `openAccess:` decision, never both (see `DeclaredAccess`). Resource guards are checked before subscription and delivery; credential
+     *  expiry bounds captured subject authority. */
     readonly guards: Guards | undefined;
     /** The declared `openAccess:` reason, when there is one — what the boot gate
      *  and `voltro doctor` read. The enforcement paths read `guards`. */
@@ -2168,6 +2436,8 @@ export declare interface EventDescriptor<Name extends string, Key extends Schema
     readonly delivery: EventDeliverySemantics | undefined;
     /** Opt this event into outbound HTTP delivery. See `EventWebhookSpec`. */
     readonly webhook: EventWebhookSpec | undefined;
+    /** Required app-owned server policy, in addition to guards. No server imports in descriptors. */
+    readonly clientPolicy?: string;
 }
 
 /**
@@ -2248,6 +2518,9 @@ export declare const eventResumePoint: Schema.Struct<{
 
 export declare const eventRoute: (tenantId: string | null, event: string, key: unknown) => string;
 
+/** Browser-safe execution ownership marker; wire schemas remain unchanged. */
+export declare const EventRpcWorkload: Context.Service<true, true>;
+
 export declare type EventStreamEvent<P> = {
     readonly _tag: 'attached';
 } | {
@@ -2303,15 +2576,6 @@ export declare const eventSubscribeInput: <K extends Schema.Top>(key: K) => Sche
     }>>>;
 }>;
 
-/**
- * Lift an event descriptor into its rpc.
- *
- * A `stream: true` rpc, like a query — the framework's push transport is the
- * WebSocket a subscription already holds open, and reusing it is why `useEvent`
- * shares one connection lifecycle, one reconnect policy and one devtools view
- * with `useSubscription` instead of being a second realtime concept in the same
- * app.
- */
 export declare const eventToRpc: <Name extends string, Key extends Schema.Top, Payload extends Schema.Top>(descriptor: EventDescriptor<Name, Key, Payload, ReadonlyArray<unknown>>, extraErrors?: ReadonlyArray<Schema.Top>) => Rpc.Rpc<Name, Schema.Struct<{
     readonly key: Key;
     readonly resume: Schema.optional<Schema.$Array<Schema.Struct<{
@@ -2394,8 +2658,8 @@ export declare interface ExposeAsToolSpec {
  */
 export declare type ExtraErrors = ReadonlyArray<Schema.Top>;
 
-/** Release a claim after the handler errored, so a retry can re-process. */
-export declare const failIdempotent: (store: IdempotencyStore, scope: string, key: string) => Promise<void>;
+/** Release this failed execution's running claim without deleting a successor. */
+export declare const failIdempotent: (store: IdempotencyStore, claim: IdempotencyClaim) => Promise<boolean>;
 
 /**
  * The field-addressed issues carried by a wire error, or `[]` when the error
@@ -2433,8 +2697,8 @@ export declare const findAdvisoryResourceGuards: (procedures: ReadonlyArray<{
     readonly guards?: ReadonlyArray<AnyCheckSpec>;
 }>) => ReadonlyArray<string>;
 
-/** Record a completed response for replay. */
-export declare const finishIdempotent: (store: IdempotencyStore, scope: string, key: string, response: IdempotencyResponse, now: number) => Promise<void>;
+/** Record a response only while this original execution owns the claim. */
+export declare const finishIdempotent: (store: IdempotencyStore, claim: IdempotencyClaim, response: IdempotencyResponse, now: number) => Promise<boolean>;
 
 /**
  * The schema as the generator should see it: every `Number` node checked
@@ -2466,9 +2730,16 @@ export declare const finiteNumberView: (ast: SchemaAST.AST, memo?: Map<SchemaAST
  */
 export declare const firstEventValue: (tag: string, value: unknown, label: string) => unknown;
 
+export declare const FORM_CAPTURE_FIELD = "__voltro_capture";
+
+export declare const FORM_CAPTURE_META_NAME = "voltro:form-source";
+
 /** A route rendered for humans — logs, the inspect surface, the dashboard. */
 export declare const formatEventRoute: (route: string) => string;
 
+/** Build selector (snapshot/input/execution) followed by its public class digest. */
+export declare const formCaptureSource: (value: unknown) => string | undefined;
+
 /**
  * The framework errors EVERY procedure of a kind carries on its wire union —
  * the unconditional members `wireErrorUnion` adds. The conditional ones (a
@@ -2481,10 +2752,10 @@ export declare const formatEventRoute: (route: string) => string;
  * test pins it against `wireErrorUnion` per kind, so the two cannot drift.
  */
 export declare const FRAMEWORK_WIRE_ERRORS: {
-    readonly query: readonly [typeof ScopeError, typeof Unauthenticated];
-    readonly stream: readonly [typeof ScopeError, typeof Unauthenticated];
-    readonly action: readonly [typeof ScopeError, typeof Unauthenticated, typeof ValidationError, typeof ValidationErrors];
-    readonly mutation: readonly [typeof ScopeError, typeof Unauthenticated, typeof BusinessRuleViolation, typeof MutationInFlight, typeof VersionConflict, typeof ValidationError, typeof ValidationErrors];
+    readonly query: readonly [typeof ScopeError, typeof Unauthenticated, typeof RequestedTenantRefused];
+    readonly stream: readonly [typeof ScopeError, typeof Unauthenticated, typeof RequestedTenantRefused];
+    readonly action: readonly [typeof ScopeError, typeof Unauthenticated, typeof RequestedTenantRefused, typeof MutationInFlight, typeof MutationIdempotencyRefused, typeof ValidationError, typeof ValidationErrors];
+    readonly mutation: readonly [typeof ScopeError, typeof Unauthenticated, typeof RequestedTenantRefused, typeof BusinessRuleViolation, typeof MutationInFlight, typeof MutationIdempotencyRefused, typeof VersionConflict, typeof ValidationError, typeof ValidationErrors];
 };
 
 /** The error values {@link FRAMEWORK_WIRE_ERRORS} admits for `Kind`. */
@@ -2545,6 +2816,9 @@ export declare interface GuardCheckSpec {
      * global-scope check (the extractor is advisory), exactly as before.
      */
     readonly resource?: (input: unknown) => string | undefined;
+    /** Require an explicit resource resolver verdict, even for globally held
+     * scopes and `admin:full`. Missing resolver/resource refuses access. */
+    readonly resourceOnly?: boolean;
 }
 
 /**
@@ -2566,35 +2840,17 @@ export declare interface GuardSpec<Input = unknown> {
     /** How an array of scopes combines. `'all'` (default) = AND (hold every
      *  scope); `'any'` = OR (hold at least one). Ignored for a single scope. */
     readonly mode?: 'all' | 'any';
-    /**
-     * PURE `input → resource id` extractor. Browser-safe (no DB, no server
-     * import) — exactly like `target.identify`. Omit for a plain subject-scope
-     * guard.
-     *
-     * **On a `GuardSpec` this id is ADVISORY.** A scope guard answers "what may
-     * this subject do at all", against the subject's global scope set; the id is
-     * carried for logging and for a future subject-scope resolver that narrows by
-     * resource. It does not, on its own, make the check per-resource.
-     *
-     * **If your authority is per-resource, you want {@link PolicyGuardSpec}, not
-     * this field** — `guards: [{ action, resourceType, resource }]`, backed by
-     * `defineResourcePolicy` + a tuple source you register. That is built, wired
-     * on both boot paths, fail-closed without a resolver, and documented under
-     * *Authentication → Authorization*. An app whose relationships already live
-     * in its own tables (a `teamMembers` row, say) registers its own tuple source
-     * rather than copying data across; see `policyGuardResolver.ts`.
-     *
-     * That paragraph is here because its absence cost a deployment their access
-     * gate. This comment used to describe the resolver as "a future ReBAC /
-     * `accessPolicy()` resolver" — written before the ReBAC path shipped and
-     * never updated. They read the type, quoted the sentence, concluded there was
-     * "nothing in between" declaring an untruth and turning the gate off, and set
-     * `security: { defaultDeny: false }` on an app with 565 undecided procedures.
-     * The capability they needed was two fields away. A doc comment that says
-     * "future" about something shipped is not a small inaccuracy: it is the only
-     * thing a careful reader has, and it argued them out of a feature.
-     */
+    /** Pure browser-safe input → target resource id selector. With a registered
+     * setResourceScopeResolver, scopes can be checked on this resource. Without
+     * resourceOnly, an existing global scope or admin:full may satisfy the guard
+     * without consulting that resolver. For per-resource authority over relationships use
+     * PolicyGuardSpec: `defineResourcePolicy` plus a registered tuple source. That is built, wired
+     * on both boot paths and fail-closed without a resolver — an earlier comment called it "future"
+     * and argued a deployment out of its access gate. */
     readonly resource?: (input: Input) => string | undefined;
+    /** Require an explicit current resource verdict, including for globally held
+     * scopes or admin:full. Missing resolver/resource refuses access. */
+    readonly resourceOnly?: boolean;
 }
 
 /** Does this descriptor declare an access decision — a guard, or a deliberate
@@ -2624,8 +2880,9 @@ export declare const hasEnforcedGuard: (guards: DeclaredAccess | undefined) => b
  *  the RAW subject scopes — use `hasEffectiveScope` to include rbac roles. */
 export declare const hasScope: (subject: Subject, scope: string) => boolean;
 
-/** Renew a fresh claim's lease while its handler runs; returns the stop. */
-export declare const holdIdempotentClaim: (store: IdempotencyStore, scope: string, key: string, inFlightLeaseMs?: number, now?: () => number) => (() => void);
+/** Renew only the captured execution identity; ownership loss stops renewal.
+ * Stopping this timer never proves a remote business operation has stopped. */
+export declare const holdIdempotentClaim: (store: IdempotencyStore, claim: IdempotencyClaim, inFlightLeaseMs?: number, now?: () => number) => (() => void);
 
 /**
  * Short-circuit response shape. Returning a `HttpInterceptResponse`
@@ -2696,11 +2953,35 @@ export declare type HttpRequestInterceptor = (next: () => Promise<HttpInterceptR
 /** Fire-and-forget observer of plugin HTTP route calls — see {@link PluginHttpRouteEvent}. */
 export declare type HttpRouteObserver = (event: PluginHttpRouteEvent) => void;
 
+/** Identity of one acquired execution, never reused when a key is reclaimed.
+ * This is receipt ownership, not authority to perform a business side effect. */
+export declare interface IdempotencyClaim {
+    readonly scope: string;
+    readonly key: string;
+    readonly id: string;
+    readonly inputHash: string;
+}
+
+export declare type IdempotencyClaimResult = {
+    readonly kind: 'claimed';
+    readonly claim: IdempotencyClaim;
+} | {
+    readonly kind: 'existing';
+    readonly record: IdempotencyRecord;
+} | {
+    readonly kind: 'conflict';
+};
+
 export declare type IdempotencyOutcome = {
     readonly kind: 'fresh';
+    readonly claim: IdempotencyClaim;
 } | {
     readonly kind: 'replay';
     readonly response: IdempotencyResponse;
+} | {
+    readonly kind: 'input-conflict';
+} | {
+    readonly kind: 'input-unbound';
 } | {
     readonly kind: 'conflict';
 };
@@ -2708,6 +2989,8 @@ export declare type IdempotencyOutcome = {
 export declare interface IdempotencyRecord {
     readonly scope: string;
     readonly key: string;
+    /** Null means a retained receipt predates declared-input binding. */
+    readonly inputHash: string | null;
     readonly status: 'in_flight' | 'completed';
     readonly response: IdempotencyResponse | null;
     /** epoch ms */
@@ -2717,38 +3000,41 @@ export declare interface IdempotencyRecord {
 export declare interface IdempotencyResponse {
     readonly status: number;
     readonly body: unknown;
+    /** Framework-owned REST qualification metadata. Custom stores preserve it
+     * unchanged, separately from the arbitrary application output in body. */
+    readonly rest?: unknown;
 }
 
 /** Build the scope key — keep keys from colliding across tenants + endpoints. */
 export declare const idempotencyScope: (tenantId: string | null | undefined, method: string, path: string) => string;
 
 export declare interface IdempotencyStore {
-    /** Current record for (scope, key), or null. Read-side (inspect/dashboard). */
     readonly get: (scope: string, key: string) => Promise<IdempotencyRecord | null>;
-    /**
-     * Atomically claim (scope, key) IF absent OR stale — a COMPLETED record older
-     * than `ttlMs` (the replay window), or an IN-FLIGHT one whose lease
-     * (`inFlightLeaseMs`, renewed by the live handler) lapsed:
-     * write a fresh `in_flight` row and return `'claimed'`. Otherwise return the
-     * EXISTING (still-fresh) record. The atomicity here is the whole game — two
-     * concurrent same-key requests both hit this, exactly one gets `'claimed'`,
-     * the loser reads the winner's record. In SQL this is one
-     * `INSERT … ON CONFLICT DO UPDATE … WHERE existing.createdAt < now - ttl`.
-     */
-    readonly claim: (scope: string, key: string, now: number, ttlMs: number, inFlightLeaseMs: number) => Promise<'claimed' | IdempotencyRecord>;
-    /**
-     * Extend a RUNNING claim's lease: bump its timestamp while it is still
-     * `in_flight` (a completed or released claim is left alone). The server calls
-     * it while the handler runs; a process that dies stops calling it, and its
-     * claim goes stale after `inFlightLeaseMs` instead of after the whole replay
-     * window.
-     */
-    readonly renew: (scope: string, key: string, now: number) => Promise<void>;
-    /** Flip the claim to `completed` and store the response. */
-    readonly complete: (scope: string, key: string, response: IdempotencyResponse, now: number) => Promise<void>;
-    /** Drop the claim (handler errored → a retry may re-process). */
-    readonly release: (scope: string, key: string) => Promise<void>;
-}
+    /** Atomically acquire an absent/stale key with a new, never-reused identity.
+     * Otherwise return the existing receipt, or conflict if contention prevents
+     * observing a stable record. Expiry does not prove an old executor stopped. */
+    readonly claim: (scope: string, key: string, inputHash: string, now: number, ttlMs: number, inFlightLeaseMs: number) => Promise<IdempotencyClaimResult>;
+    /** Atomically match original scope/key/id AND in_flight status. False means
+     * this execution no longer owns a running receipt; never touch its successor. */
+    readonly renew: (claim: IdempotencyClaim, now: number) => Promise<boolean>;
+    /** Complete only the original running claim and start its replay window now. */
+    readonly complete: (claim: IdempotencyClaim, response: IdempotencyResponse, now: number) => Promise<boolean>;
+    /** Release only the original running claim. Completed receipts are retained. */
+    readonly release: (claim: IdempotencyClaim) => Promise<boolean>;
+}
+
+/** What an identity's authority resolved to: the subject to run as, or why not. */
+export declare type IdentityAuthorityOutcome = {
+    readonly kind: 'resolved';
+    readonly subject: Subject;
+} | {
+    readonly kind: 'unavailable';
+    readonly reason: string;
+} | {
+    readonly kind: 'vetoed';
+    readonly code: string;
+    readonly message: string;
+};
 
 /** `/<id>` — the op path for a row id. Ids are JSON-pointer-escaped
  *  (`~` → `~0`, `/` → `~1`) so a slash or tilde inside a string id can't
@@ -2894,6 +3180,10 @@ export declare const isSystemSubject: (subject: Subject) => boolean;
 
 export declare const isTenantSelectable: (subject: Subject) => subject is TenantSelectableSubject;
 
+export declare const isUpgradedCheck: (g: AnyCheckSpec) => g is UpgradedCheckSpec;
+
+export declare const isUpgradedGuard: <I>(g: AnyGuardSpec<I>) => g is UpgradedGuardSpec;
+
 /**
  * Is this descriptor allowed on the wire at all?
  *
@@ -2971,7 +3261,7 @@ export declare interface Membership {
  *  project from wherever it keeps them. `input.store` is the app's DataStore. */
 export declare type MembershipsSource = (subject: Subject, input: AuthStrategyInput) => Promise<ReadonlyArray<Membership>> | ReadonlyArray<Membership>;
 
-/** In-memory store — the default for single-process dev + the test double. */
+/** In-memory store — one process only, with unique ownership per acquisition. */
 export declare const memoryIdempotencyStore: () => IdempotencyStore;
 
 /** The refusal a missing access decision produces. Exported so the boot gate
@@ -2983,6 +3273,25 @@ export declare const missingAccessDecision: (procedure?: string) => ScopeError;
  *  fits several tries. */
 export declare const MUTATION_IN_FLIGHT_RETRY_AFTER_MS = 1000;
 
+/** Transaction-bound context for a plugin's required database contribution.
+ * The executor result is available before the business transaction commits. */
+export declare interface MutationCommitContext extends RpcInterceptorContext {
+    readonly kind: 'mutation';
+    readonly store: DataStore;
+    readonly output: unknown;
+    /** Same enqueue facade as the executor, bound to this replay attempt. */
+    readonly outbox?: OutboxEnqueueFacade;
+    /** Runner invocation time, including guards and rolled-back retries. */
+    readonly startedAt?: number;
+    /** Elapsed milliseconds before required contribution work. */
+    readonly durationMs?: number;
+}
+
+/** Required transactional work, not an external side effect. A failure rolls
+ * back the mutation. The hook may run again after a rolled-back contention
+ * attempt, so all effects must remain on the supplied transaction store. */
+export declare type MutationCommitHook = (context: MutationCommitContext) => Effect.Effect<void, unknown>;
+
 /** A connection-scoped RPC cannot execute or replay without a live WebSocket.
  * This is a transport precondition, not an authorization or membership grant. */
 export declare class MutationConnectionRequired extends MutationConnectionRequired_base {
@@ -2993,6 +3302,18 @@ declare const MutationConnectionRequired_base: Schema.Class<MutationConnectionRe
     readonly traceId: Schema.String;
 }>, YieldableError>;
 
+/** Input refusal is terminal for this key, not an in-flight retry invitation.
+ * No stored hash, input or response is disclosed. Check the original operation
+ * before deliberately starting another business action. */
+export declare class MutationIdempotencyRefused extends MutationIdempotencyRefused_base {
+    get message(): string;
+}
+
+declare const MutationIdempotencyRefused_base: Schema.Class<MutationIdempotencyRefused, Schema.TaggedStruct<"MutationIdempotencyRefused", {
+    readonly traceId: Schema.String;
+    readonly reason: Schema.Literals<readonly ["input-conflict", "input-unbound", "input-unavailable"]>;
+}>, YieldableError>;
+
 /** Ordinary writes deduplicate across reconnects. A connection-side effect
  * (for example joining a room) must execute once for EACH native connection. */
 export declare type MutationIdempotencyScope = 'subject' | 'connection';
@@ -3020,6 +3341,12 @@ export declare interface MutationProcedureDescriptor<Name extends string, Input
     readonly idempotencyScope?: MutationIdempotencyScope | undefined;
     /** Same-key calls run in invocation order on the client — see `defineMutation`. */
     readonly serialize?: MutationSerialization<Schema.Schema.Type<Input>> | undefined;
+    /** Exclude this invocation from automatic row-image undo capture, with an
+     * explicit domain reason. Does not disable transactions, guards or audit. */
+    readonly undo?: {
+        readonly capture: false;
+        readonly reason: string;
+    } | undefined;
     /** Declarative target(s) — drives auto-optimistic on the client AND
      *  surfaces which tables this mutation touches (debug, future
      *  query-invalidation analytics). Mutations without a target run
@@ -3081,6 +3408,12 @@ export declare interface MutationSerialization<Input = unknown> {
 
 export declare const mutationToRpc: <Name extends string, Input extends Schema.Top, Output extends Schema.Top, Err extends Schema.Top>(descriptor: MutationProcedureDescriptor<Name, Input, Output, Err>, extraErrors?: ExtraErrors) => Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Output, Schema.Top, never, never>;
 
+export declare interface NativeFormCaptureDocument {
+    readonly querySelectorAll: (selector: string) => ArrayLike<{
+        readonly getAttribute: (name: string) => string | null;
+    }>;
+}
+
 export declare interface NestedTargetFields<Input = unknown> {
     /** Dot-path to the nested array within the query VALUE to patch (e.g.
      *  `'snapshot.projects'`). Absent → patch the top-level row array (default). */
@@ -3252,6 +3585,30 @@ export declare const openAccessSpec: (reason: string) => OpenAccessSpec;
  */
 export declare const orderByBearerPrefix: (strategies: ReadonlyArray<AuthStrategy>, headers: Readonly<Record<string, string | undefined>>) => ReadonlyArray<AuthStrategy>;
 
+/** Enqueue-only capability bound to the caller's actual transaction store. */
+export declare interface OutboxEnqueueFacade {
+    /** Returns the stable delivery identity. Delivery happens after commit. */
+    enqueue(effect: string, payload: Record<string, unknown>, options?: EnqueueOptions): Promise<string>;
+}
+
+/** Stable delivery context, shared by app and plugin handlers. */
+export declare interface OutboxHandlerContext {
+    readonly outboxId: string;
+    readonly idempotencyKey: string | null;
+    readonly payload: Record<string, unknown>;
+    readonly attempt: number;
+    readonly subjectId: string | null;
+    readonly tenantId: string | null;
+    readonly traceId: string | null;
+}
+
+/** Delivery happens after commit and may repeat; handlers must be idempotent. */
+export declare interface OutboxHandlerDefinition<R = never> {
+    readonly effect: string;
+    readonly handler: (context: OutboxHandlerContext) => Promise<unknown> | Effect.Effect<unknown, unknown, R>;
+    readonly maxAttempts?: number;
+}
+
 export declare interface Pairing {
     /** The api's base url as the DEVICE reaches it — a LAN address, never `localhost`. */
     readonly api: string;
@@ -3294,6 +3651,21 @@ export declare const parseEventRoute: (route: string) => {
 /** The record from a link, or `null` for anything that is not a pairing link. */
 export declare const parsePairingLink: (url: string) => Pairing | null;
 
+/**
+ * Parse a `revalidate` page export into a duration in milliseconds.
+ *
+ * Accepted shapes:
+ *   - number              → seconds (Next.js compatibility)
+ *   - '<N> seconds' / 's'
+ *   - '<N> minutes' / 'm'
+ *   - '<N> hours' / 'h'
+ *   - '<N> days' / 'd'
+ *
+ * Returns null if the value is missing or unrecognised — caller treats
+ * `null` as "don't cache" (every request re-renders, same as plain SSR).
+ */
+export declare const parseRevalidateMs: (value: unknown) => number | null;
+
 export declare const patchCellSchema: Schema.decodeTo<Schema.Unknown, Schema.Unknown, never, never>;
 
 /** A single row in a subscription result. Must carry an `id`; everything
@@ -3339,6 +3711,49 @@ export declare type PendingApproval = Schema.Schema.Type<typeof PendingApproval>
 /** The normalisation above, applied to any JSON Schema fragment. */
 export declare const plainJsonSchema: (value: unknown) => unknown;
 
+export declare interface PluginAccountMergeContext extends PluginAccountMergeRequest {
+    /** Borrow the coordinator's existing transaction. No external I/O, separate
+     * pool, nested transaction or session grant belongs in a data hook. */
+    readonly store: DataStore;
+}
+
+export declare interface PluginAccountMergeCoverage {
+    readonly participants: ReadonlyArray<{
+        readonly name: string;
+        readonly tables: ReadonlyArray<string>;
+    }>;
+    readonly missing: ReadonlyArray<string>;
+}
+
+export declare class PluginAccountMergeFailure extends PluginAccountMergeFailure_base {
+}
+
+declare const PluginAccountMergeFailure_base: Schema.Class<PluginAccountMergeFailure, Schema.TaggedStruct<"PluginAccountMergeFailure", {
+    readonly code: Schema.Literals<readonly ["invalid_request", "coverage_missing", "hook_failed"]>;
+    readonly requestId: Schema.String;
+    readonly plugin: Schema.NullOr<Schema.String>;
+    /** Hooks that returned before failure; never evidence of SQL commit. */
+    readonly returned: Schema.$Array<Schema.String>;
+    readonly missing: Schema.$Array<Schema.String>;
+}>, YieldableError>;
+
+export declare type PluginAccountMergeHook = (context: PluginAccountMergeContext) => Effect.Effect<void, unknown>;
+
+export declare interface PluginAccountMergeRegistry {
+    readonly coverage: (kind: 'user' | 'guest') => PluginAccountMergeCoverage;
+    /** The caller owns both-account authorization, confirmation, the transaction
+     * and durable receipt. This registry neither commits nor withdraws identity. */
+    readonly mergeInTransaction: (context: PluginAccountMergeContext) => Effect.Effect<ReadonlyArray<string>, PluginAccountMergeFailure>;
+}
+
+export declare interface PluginAccountMergeRequest {
+    readonly requestId: string;
+    readonly tenantId: string;
+    readonly sourceId: string;
+    readonly sourceKind: 'user' | 'guest';
+    readonly targetId: string;
+}
+
 /**
  * Called once at app boot, after `voltro dev` resolves the plugin
  * list and before the rpc server starts accepting connections. Use
@@ -3361,6 +3776,37 @@ export declare type PluginActivateHook = (ctx: PluginLifecycleContext) => Effect
 export declare const pluginAlias: (pluginName: string) => string;
 
 export declare interface PluginBindContext {
+    /** Selected API work; absent custom-host selection means all workloads. */
+    readonly workloads?: ReadonlyArray<ApiWorkload>;
+    /** Starts the app's workflows from server work that has no request, such as
+     * Room results. Present when the app declares workflows. */
+    readonly workflows?: PluginWorkflowStarter;
+    /** Execute an already-provided Effect, preserving typed failures as rejection
+     * values. This does not inject request identity, app services or a new scope. */
+    readonly runEffect?: <A, E>(effect: Effect.Effect<A, E>) => Promise<A>;
+    /** Execute server work with the actual shared app services, including user
+     * Layer overrides, in a scope owned by this call. Available after the host
+     * assembles its service layer, never during store binding or shutdown. No
+     * request Subject, request-local store or transaction is injected. Consume
+     * borrowed services inside the Effect; do not return them beyond its scope.
+     * The host drains admitted calls before plugin/pool teardown. */
+    readonly runWithAppServices?: <A, E, R>(effect: Effect.Effect<A, E, R>) => Promise<A>;
+    /** App-owned subject hook registry. The server caller owns authorization and withdrawal. */
+    readonly privacyRegistry?: PluginPrivacyRegistry;
+    /** App-owned plugin namespace; tenant acquisition remains explicit and isolated. */
+    readonly hotStore?: (context?: {
+        readonly tenantId: string;
+    }) => Promise<HotStoreShape>;
+    /** Same borrowed registry as lifecycle hooks; the API host owns its pools. */
+    readonly connectionRegistry?: ConnectionRegistryShape;
+    readonly connectionReference?: PluginConnectionReference;
+    readonly connectionAvailability?: PluginConnectionAvailability;
+    /** Resolve the registered owner's retained destination for physical reference
+     * protection. Borrowed app wiring; never substitutes the caller's provider. */
+    readonly storageReferenceProvider?: (input: {
+        readonly storageInstance: string;
+        readonly address: StorageAddress;
+    }) => Effect.Effect<StorageProvider, StorageError>;
     /**
      * This process's replica identity — the same value the event bus stamps as
      * its publish `origin` and the membership registry announces under.
@@ -3380,6 +3826,16 @@ export declare interface PluginBindContext {
      * who is on the channel, and an instance that dies simply goes quiet.
      */
     readonly membership?: {
+        /** Current receiver-observed members from the same app-owned registry.
+         * Optional for custom hosts providing only change notifications. Borrowed:
+         * plugins must not start, stop or replace the membership owner. */
+        readonly list?: () => ReadonlyArray<{
+            readonly instanceId: string;
+            readonly startedAt: number;
+            readonly meta: Readonly<Record<string, string | number>> | undefined;
+            readonly lastHeardAt: number;
+            readonly self: boolean;
+        }>;
         readonly onChange: (listener: (event: {
             readonly kind: 'joined' | 'left' | 'restarted';
             readonly instanceId: string;
@@ -3487,6 +3943,14 @@ export declare interface PluginCacheHandle {
 
 export declare interface PluginCapabilities {
     readonly mediaPersist?: PluginMediaPersistCapability;
+    /** Borrow this app instance's bound object transport; the caller owns no pools. */
+    readonly storageProvider?: () => StorageProvider;
+    /** Address-aware object ownership; request tenant resolution is never global. */
+    readonly storageDestinations?: {
+        readonly router: StorageDestinationRouter;
+        readonly directDestination: string | undefined;
+        readonly registry: () => ConnectionRegistryShape | undefined;
+    };
 }
 
 /**
@@ -3608,6 +4072,36 @@ export declare interface PluginCodegenContext {
     }>;
 }
 
+/** Resolves only this plugin's admitted role; omitted policy means fail. */
+export declare type PluginConnectionAvailability = (role: string) => ConnectionUnavailablePolicy;
+
+export declare interface PluginConnectionNeed {
+    readonly onUnavailable?: ConnectionUnavailablePolicy;
+    readonly kind: ConnectionKind_2;
+    readonly role: string;
+    readonly crossNode?: boolean;
+    /** Use the plugin's direct transport only when no declaration or binding selects this role. */
+    readonly optional?: boolean;
+}
+
+/**
+ * Per-app context handed to lifecycle hooks. The shape is intentionally
+ * thin — the framework's deeper services (DataStore, Logger, etc.) are
+ * available via the per-request `AppContext` plugins see in their rpc
+ * interceptors. Lifecycle hooks run OUTSIDE any request, so they
+ * receive a minimal slice:
+ *
+ *   - `app`: the resolved app-config metadata
+ *     (`{ name, type, voltroVersion }`).
+ *   - `logger`: a scoped `@voltro/logger` instance keyed to the
+ *     plugin's `name`, so log lines are attributable.
+ *   - `env`: the process env (alias of `process.env` for typing).
+ *   - `config`: the plugin's own validated config (if `configSchema`
+ *     declared) — already decoded against the plugin's Schema, ready
+ *     for the hook to consume. Unknown otherwise.
+ */
+export declare type PluginConnectionReference = <K extends ConnectionKind_2>(role: string, kind: K) => ConnectionRef<K> | '';
+
 /**
  * A remote-mounted dashboard surface a plugin contributes. The
  * dashboard-host (voltro-cloud / voltro-devtools) renders the mount
@@ -3718,6 +4212,8 @@ export declare interface PluginEnvVar {
     readonly generate?: 'base64url' | 'hex' | 'p256';
 }
 
+export declare type PluginEraseHook = (subjectId: string, context: PluginPrivacyHookContext) => Effect.Effect<void, unknown>;
+
 /**
  * A cross-cutting error schema a plugin merges into EVERY procedure's
  * wire error union. Use when a plugin interceptor can fail with a typed
@@ -3756,8 +4252,26 @@ export declare interface PluginErrorSchema {
     };
 }
 
+/**
+ * Per-call context handed to a plugin-contributed rpc route's
+ * executor. Mirror of the user-handler `AppContext` shape but typed
+ * loosely so the plugin doesn't need to depend on `@voltro/runtime`.
+ */
+/** Structural view of the existing request-scoped typed publisher. No runtime import. */
+export declare interface PluginEventPublisher {
+    publish<Name extends string, Key extends Schema.Top, Payload extends Schema.Top>(descriptor: EventDescriptor<Name, Key, Payload>, key: Schema.Schema.Type<Key>, payload: Schema.Schema.Type<Payload>): Effect.Effect<unknown, unknown>;
+}
+
+export declare type PluginExportHook = (subjectId: string, context: PluginPrivacyHookContext) => Effect.Effect<unknown, unknown>;
+
 /** A public raw-HTTP route a plugin serves on the framework listener. */
 export declare interface PluginHttpRoute {
+    /** Executable API workload owning this route. Omitted means `rpc`.
+     * Discovery and descriptor generation remain independent of role selection. */
+    readonly workload?: ApiWorkload;
+    /** The already-mounted REST projection, retained for SDK/schema inspection.
+     * Do not remount it through generic REST auth or idempotency bindings. */
+    readonly restContract?: RestRouteDescriptor<any, any>;
     /** HTTP method, or `'*'` for any (the handler decides). The server mounts the
      *  path for exactly the methods its routes declare; `'*'` mounts it for every
      *  method the router knows (34), so keep that for a route that really serves
@@ -3786,6 +4300,13 @@ export declare interface PluginHttpRoute {
      */
     readonly match?: 'prefix' | 'exact';
     readonly handle: (req: PluginHttpRouteRequest) => Promise<PluginHttpRouteResult>;
+    /** Lazy, backpressured input instead of a buffered rawBody on real HTTP.
+     * Requires match: 'exact' and exclusive ownership of the router-equivalent
+     * path (including other methods). The required handle remains the buffered
+     * in-process entry. Both entries must apply the same authorization/codec.
+     * maxBodyBytes counts consumed bytes; overflow overrides the handler's
+     * response with 413 even when the handler catches the read error. */
+    readonly handleStream?: (req: PluginHttpRouteStreamRequest) => Promise<PluginHttpRouteResult>;
     /** Per-route body cap override (bytes) — wins over the listener's shared
      *  `maxBodyBytes`. NOTE: routes SHARING a path share one body read, so the
      *  widest override on the path's group applies to the whole group. */
@@ -3826,6 +4347,9 @@ export declare interface PluginHttpRoute {
      * handler branches on: exempting `/saml` exempts `POST /saml/anything`.
      */
     readonly originGuard?: 'exempt';
+    readonly cors?: RestCors;
+    /** Bearer-only routes must discard cookie authority before authentication. */
+    readonly credentials?: 'bearer';
 }
 
 /**
@@ -4009,11 +4533,23 @@ export declare interface PluginHttpRouteResult {
  */
 export declare interface PluginHttpRouteStream {
     readonly subscribe: (emit: (chunk: string) => void) => () => void;
+    /** Per-connection lifetime in milliseconds (1..2147483647). Ending the
+     * response releases the subscription and keep-alive timer. Absent: no cap. */
+    readonly maxDurationMs?: number;
     /** Keep-alive comment interval in ms (default 15000; `0` disables). Without
      *  it an idle SSE connection is dropped by proxies after ~30–60s. */
     readonly keepAliveMs?: number;
 }
 
+/** A lazy binary request on the framework listener. No body bytes are read
+ * before the handler runs. Consume once, through EOF, before accepting an
+ * upload; returning early drains the unread body without validating it.
+ * The signal ends on disconnect, interruption or handler completion. */
+export declare interface PluginHttpRouteStreamRequest extends Omit<PluginHttpRouteRequest, 'rawBody'> {
+    readonly body: AsyncIterable<Uint8Array>;
+    readonly signal: AbortSignal;
+}
+
 export declare interface PluginInspectEndpoint {
     /** HTTP method. */
     readonly method: 'GET' | 'POST' | 'DELETE';
@@ -4142,23 +4678,9 @@ export declare const pluginInstanceName: (args: {
     readonly instance?: string | undefined;
 }) => string;
 
-/**
- * Per-app context handed to lifecycle hooks. The shape is intentionally
- * thin — the framework's deeper services (DataStore, Logger, etc.) are
- * available via the per-request `AppContext` plugins see in their rpc
- * interceptors. Lifecycle hooks run OUTSIDE any request, so they
- * receive a minimal slice:
- *
- *   - `app`: the resolved app-config metadata
- *     (`{ name, type, voltroVersion }`).
- *   - `logger`: a scoped `@voltro/logger` instance keyed to the
- *     plugin's `name`, so log lines are attributable.
- *   - `env`: the process env (alias of `process.env` for typing).
- *   - `config`: the plugin's own validated config (if `configSchema`
- *     declared) — already decoded against the plugin's Schema, ready
- *     for the hook to consume. Unknown otherwise.
- */
 export declare interface PluginLifecycleContext {
+    /** Selected API work; absent custom-host selection means all workloads. */
+    readonly workloads?: ReadonlyArray<ApiWorkload>;
     readonly app: {
         readonly name: string;
         readonly type: 'api' | 'web';
@@ -4173,6 +4695,11 @@ export declare interface PluginLifecycleContext {
     readonly env: NodeJS.ProcessEnv;
     /** Validated plugin config (if `configSchema` was declared). */
     readonly config: unknown;
+    /** App-owned command registry, available before API plugin activation. Never dispose it. */
+    readonly connectionRegistry?: ConnectionRegistryShape;
+    /** Resolve only this plugin's declared role through the app's binding/default. */
+    readonly connectionReference?: PluginConnectionReference;
+    readonly connectionAvailability?: PluginConnectionAvailability;
 }
 
 /** Where the offloaded-inference dispatcher puts a media artifact a provider
@@ -4257,7 +4784,13 @@ export declare type PluginMigrationSqlClient = SqlClient.SqlClient;
  * boot log + `/_voltro/inspect/plugins` so operators audit what each
  * plugin asks for before installing.
  */
-export declare type PluginPermission = 'rpc:intercept:mutation' | 'rpc:intercept:query' | 'rpc:intercept:action' | 'rpc:intercept:workflow' | 'schedule:fire' | 'schedule:read' | 'workflow:step' | 'http:intercept' | 'inspect:read' | 'inspect:write' | 'dashboard:mount' | 'store:write' | 'migration:run' | 'store:changes:read' | `secrets:read:${string}` | `network:outbound:${string}` | `plugin:hook:${string}`;
+export declare type PluginPermission = 'rpc:authority:replay' | 'rpc:intercept:mutation' | 'rpc:intercept:query' | 'rpc:intercept:action' | 'rpc:intercept:workflow' | 'rpc:intercept:stream' | 'schedule:fire' | 'schedule:read' | 'workflow:step' | 'http:intercept' | 'inspect:read' | 'inspect:write' | 'dashboard:mount' | 'outbox:handle' | 'store:write' | 'migration:run' | 'store:changes:read' | `secrets:read:${string}` | `network:outbound:${string}` | `plugin:hook:${string}`;
+
+export declare interface PluginPrivacyCoverage {
+    readonly participants: ReadonlyArray<PluginPrivacyParticipant>;
+    /** Plugin declarations only. App-owned tables require their own declared hooks. */
+    readonly missing: ReadonlyArray<string>;
+}
 
 /** What a plugin collects and uses — folded by `voltro compliance generate`
  *  into PrivacyInfo.xcprivacy and the Play Data-safety answers. A plugin that
@@ -4267,12 +4800,76 @@ export declare interface PluginPrivacyDeclaration {
     readonly requiredReasonApis?: ReadonlyArray<PrivacyRequiredReasonApi>;
 }
 
-/**
- * Per-call context handed to a plugin-contributed rpc route's
- * executor. Mirror of the user-handler `AppContext` shape but typed
- * loosely so the plugin doesn't need to depend on `@voltro/runtime`.
- */
+export declare type PluginPrivacyErasePhase = typeof PluginPrivacyErasePhaseSchema.Type;
+
+/** Resource/actor withdrawal must finish before destructive data hooks. */
+export declare const PluginPrivacyErasePhaseSchema: Schema.Literals<readonly ["prepare", "data", "identity", "finalize"]>;
+
+export declare interface PluginPrivacyErasure {
+    readonly requestId: string;
+    readonly target: PluginPrivacyTarget;
+    readonly completed: ReadonlyArray<string>;
+}
+
+export declare interface PluginPrivacyExport {
+    readonly requestId: string;
+    readonly target: PluginPrivacyTarget;
+    readonly plugins: ReadonlyArray<{
+        readonly name: string;
+        readonly data: unknown;
+    }>;
+}
+
+/** Never carries a driver's error, credentials, exported rows or the hook's cause. */
+export declare class PluginPrivacyFailure extends PluginPrivacyFailure_base {
+}
+
+declare const PluginPrivacyFailure_base: Schema.Class<PluginPrivacyFailure, Schema.TaggedStruct<"PluginPrivacyFailure", {
+    readonly code: Schema.Literals<readonly ["invalid_request", "coverage_missing", "hook_failed", "unavailable"]>;
+    readonly operation: Schema.Literals<readonly ["export", "erase"]>;
+    readonly requestId: Schema.String;
+    readonly plugin: Schema.NullOr<Schema.String>;
+    readonly completed: Schema.$Array<Schema.String>;
+    readonly missing: Schema.$Array<Schema.String>;
+}>, YieldableError>;
+
+export declare interface PluginPrivacyHookContext {
+    readonly requestId: string;
+    readonly tenantId: string | null;
+    readonly kind: 'user' | 'guest';
+    /** Only the finalizer receives these immutable, successfully completed hook names. */
+    readonly completed?: ReadonlyArray<string>;
+}
+
+export declare interface PluginPrivacyParticipant {
+    readonly name: string;
+    readonly tables: ReadonlyArray<string>;
+    readonly erasePhase: PluginPrivacyErasePhase;
+}
+
+/** Borrowed app-owned hook port. Authorization and durable withdrawal belong to the caller. */
+export declare interface PluginPrivacyRegistry {
+    readonly coverage: (kind: PluginPrivacyTarget['kind']) => PluginPrivacyCoverage;
+    readonly exportSubject: (request: PluginPrivacyRequest) => Effect.Effect<PluginPrivacyExport, PluginPrivacyFailure>;
+    readonly eraseSubject: (request: PluginPrivacyRequest) => Effect.Effect<PluginPrivacyErasure, PluginPrivacyFailure>;
+}
+
+/** Reuse the request identity on recovery; hooks must be idempotent. */
+export declare interface PluginPrivacyRequest {
+    readonly requestId: string;
+    readonly target: PluginPrivacyTarget;
+}
+
+/** A server-authorized subject, never an identity accepted from a client body. */
+export declare interface PluginPrivacyTarget {
+    readonly subjectId: string;
+    readonly tenantId: string | null;
+    readonly kind: 'user' | 'guest';
+}
+
 export declare interface PluginRouteContext {
+    /** Borrows the host request publisher, preserving tenant and transaction ownership. */
+    readonly events?: PluginEventPublisher;
     /** Request-scoped transaction for mutation routes. Reuse it instead of opening
      * a transaction on the plugin's bound root store. Absent on direct calls. */
     readonly mutationStore?: DataStore;
@@ -4375,6 +4972,8 @@ export declare interface PluginRpcRoute {
      * checking.
      */
     readonly source?: ReactivitySourceValue | ReadonlyArray<ReactivitySourceValue> | undefined;
+    /** Optional integration observers; each name must also occur in source. */
+    readonly optionalSource?: ReadonlyArray<string> | undefined;
     /**
      * The route's ACCESS DECISION — the same two-field vocabulary user
      * procedures carry, because a plugin route is dispatched through the exact
@@ -4441,6 +5040,23 @@ export declare interface PluginSchemaContribution {
  */
 export declare const pluginSlug: (pluginName: string) => string;
 
+export declare interface PluginSubjectMerge {
+    readonly tables: ReadonlyArray<string>;
+    /** Source kinds whose data this implementation can reconcile. */
+    readonly kinds: ReadonlyArray<'user' | 'guest'>;
+}
+
+/** SQL tables owned by this hook pair. External resources belong in the hooks too. */
+export declare interface PluginSubjectPrivacy {
+    readonly tables: ReadonlyArray<string>;
+    readonly kinds: ReadonlyArray<PluginPrivacyTarget['kind']>;
+    /** Preparation withdraws active work before data hooks. Identity/session
+     * deletion follows every data hook, regardless of plugin order. */
+    /** Terminal request bookkeeping follows every data and identity hook.
+     * At most one finalizer may own completion for each subject kind. */
+    readonly erasePhase?: PluginPrivacyErasePhase;
+}
+
 /**
  * The wire tag a plugin's own client code must call for one of its routes.
  *
@@ -4523,6 +5139,20 @@ export declare interface PluginTemplate {
  */
 export declare type PluginUninstallHook = (ctx: PluginLifecycleContext) => Effect.Effect<void, unknown> | Promise<void> | void;
 
+/** Starts app workflows from plugin server work outside a request. */
+export declare interface PluginWorkflowStarter {
+    /** Resolves once the run is accepted. Runs as the plugin's system subject
+     * (`plugin:<name>`); rejects while the host's workflow runtime is not ready. */
+    start(workflowName: string, payload: unknown): Promise<unknown>;
+}
+
+export declare type PluginWorkloadHook = (context: PluginLifecycleContext) => Effect.Effect<PluginWorkloadResource, unknown> | Promise<PluginWorkloadResource> | PluginWorkloadResource;
+
+export declare interface PluginWorkloadResource {
+    /** Await drainage; rejection retains ownership and must be retryable. */
+    stop(): Effect.Effect<void, unknown> | Promise<void> | void;
+}
+
 /** The runtime-erased form of `PolicyGuardSpec` — a relationship check. */
 export declare interface PolicyCheckSpec {
     readonly action: string | ((input: unknown) => string);
@@ -4579,6 +5209,17 @@ export declare interface PolicyGuardSpec<Input = unknown> {
     readonly resource: (input: Input) => string | undefined;
 }
 
+export declare interface PreparedIdempotentInput {
+    readonly input: unknown;
+    readonly fingerprint: string;
+}
+
+/** Capture the declared schema's wire input before waiting for a receipt.
+ * Decode an independent snapshot for execution and require an equal round trip.
+ * The principal comes from server authentication, never a client digest/header.
+ * This binds identity and input, not current permissions or a business lease. */
+export declare const prepareIdempotentInput: (schema: Schema.Top, offered: unknown, subject: Subject, transportInput?: unknown) => Promise<PreparedIdempotentInput>;
+
 /**
  * An environment variable a plugin reads. DECLARATION ONLY — metadata, not a
  * read path: the plugin still reads the value itself (typically
@@ -4673,6 +5314,9 @@ export declare interface PublicApiClientConfig {
     readonly baseUrl?: string;
 }
 
+/** A descriptor kind that can be projected to REST (streams are not, in v1). */
+declare type PublicApiDescriptor = QueryProcedureDescriptor<string, Schema.Top, Schema.Top, Schema.Top> | MutationProcedureDescriptor<string, Schema.Top, Schema.Top, Schema.Top> | ActionProcedureDescriptor<string, Schema.Top, Schema.Top, Schema.Top>;
+
 /** The `publicApi:` block of an api `app.config.ts`, and the shape of a
  *  descriptor's `publicApi.format` override (every field optional there). */
 export declare interface PublicApiProfileConfig {
@@ -4749,6 +5393,10 @@ export declare interface PublicApiSpec {
     /** Streaming queries over request/response: 'snapshot' (default — first
      *  snapshot, like POST /rpc) | 'sse' (Server-Sent Events of snapshot+deltas). */
     readonly stream?: 'snapshot' | 'sse';
+    /** Per-connection SSE lifetime in milliseconds (1..2147483647). Requires
+     * an SSE query projection. Clients may reconnect for a freshly authorized
+     * snapshot; expiry does not cancel a domain operation. */
+    readonly streamMaxDurationMs?: number;
     /**
      * HTTP status per DECLARED typed error tag, for the projection. A typed
      * error the handler fails with — one of the descriptor's `error:` union —
@@ -4760,6 +5408,11 @@ export declare interface PublicApiSpec {
      *     publicApi: { errorStatus: { AccessDeniedError: 403, NotFoundError: 404 } }
      */
     readonly errorStatus?: Readonly<Record<string, number>>;
+    /** Additional HTTP failure statuses for the same declared error schema.
+     * Documents dedicated handlers that choose a status from the error's fields;
+     * does not change `errorStatus` or the generic projection's runtime mapping.
+     * Values must be integer HTTP error statuses (400–599); duplicates are omitted. */
+    readonly additionalErrorStatuses?: Readonly<Record<string, ReadonlyArray<number>>>;
     /**
      * The spec's tag group(s) for this operation. Default: the rpc tag's prefix
      * (`teams.list` → `teams`) — the first path segment, what a consumer looks
@@ -4861,6 +5514,16 @@ export declare interface QueryCacheConfig {
      * cardinality of a cache the author sized per org.
      */
     readonly scope: 'subject' | 'tenant' | 'global';
+    /**
+     * The handler's result also depends on something no table write
+     * invalidates — the clock, randomness, `ctx.connections`, an outgoing HTTP
+     * call, `ctx.kv`. Applies to a COMPUTED query (a handler that returns a
+     * value): without it such a result is computed but NOT kept, and the dev log
+     * names what was used. With it, `ttl` is the bound on how stale that part may
+     * be. `Date.now()`, `Math.random()` and a `fetch` outside the framework's
+     * HTTP client are not observable — a handler that uses them must say so here.
+     */
+    readonly volatile?: boolean | undefined;
 }
 
 export declare interface QueryProcedureDescriptor<Name extends string, Input extends Schema.Top, Output extends Schema.Top, Error extends Schema.Top> {
@@ -4875,6 +5538,9 @@ export declare interface QueryProcedureDescriptor<Name extends string, Input ext
      *  listed table changes (pass an array to depend on several). Optional:
      *  queries without a source never receive auto-patches (joins, aggregates). */
     readonly source: string | ReadonlyArray<string> | undefined;
+    /** Optional integration observers, all also present in source. They keep
+     *  invalidation active when installed; absence is a visible graph warning. */
+    readonly optionalSource?: ReadonlyArray<string>;
     /** Server-side snapshot cache config. Absent → never cached (the
      *  default; the dispatcher already keeps live subscriptions fresh). */
     readonly cache: QueryCacheConfig | undefined;
@@ -4950,7 +5616,7 @@ export declare const queryToRpc: <Name extends string, Input extends Schema.Top,
     }>;
 }>, Schema.Struct<{
     readonly _tag: Schema.Literal<"error">;
-    readonly error: Schema.Unknown;
+    readonly error: Schema.decodeTo<Schema.Unknown, Schema.Codec<Schema.Json, Schema.Json, never, never>, never, never>;
     readonly revision: Schema.optional<Schema.Number>;
 }>]>, Schema.Top>, Schema.Never, never, never>;
 
@@ -5029,8 +5695,24 @@ export declare type ReactivitySource = TableName | ReactivityChannel;
  */
 export declare type ReactivitySourceValue = string | ReactivityChannel;
 
+export declare const readFormCaptureSource: (document?: NativeFormCaptureDocument | undefined) => string | undefined;
+
 export declare const readPairing: (storage: PairingStorage) => Promise<Pairing | null>;
 
+/**
+ * Reauthenticate a live grant through its original strategy chain. Tenant and
+ * principal identity stay bound to the original subscription: changing either
+ * requires a new subscription, never reuse of an already scoped descriptor.
+ * Runtime-owned subjects without a request binding retain their explicit grant.
+ */
+export declare const reauthorizeSubject: (subject: Subject, prepare?: (fresh: Subject) => Promise<void>) => Promise<Subject>;
+
+/** Recheck a live grant through fresh authentication and derived authority. */
+export declare const recheckGuardsEffect: (subject: Subject, guards: ReadonlyArray<AnyCheckSpec> | undefined, input: unknown, options?: GuardCheckOptions) => Effect.Effect<ScopeError | Unauthenticated | RequestedTenantRefused | NoSuchResource | null>;
+
+/** Refresh derived authority without replaying unrelated RPC plugin hooks. */
+export declare const refreshEffectiveScopes: (original: Subject, fresh: Subject) => Promise<void>;
+
 /** Every error a plugin registers, as one union (`never` before codegen). */
 export declare type RegisteredPluginError = VoltroPluginErrors[keyof VoltroPluginErrors];
 
@@ -5063,13 +5745,48 @@ export declare const registerPluginAliases: (aliases: Readonly<Record<string, st
  */
 export declare const reportableError: (err: unknown) => Error;
 
+/** An authenticated request cannot use its requested workspace. This is
+ * scoped access refusal, not evidence that the credential or session ended.
+ * Consumers must keep unrelated workspace sessions intact. */
+export declare class RequestedTenantRefused extends RequestedTenantRefused_base {
+}
+
+declare const RequestedTenantRefused_base: Schema.Class<RequestedTenantRefused, Schema.TaggedStruct<"RequestedTenantRefused", {
+    readonly reason: Schema.Literals<readonly ["target-unavailable", "invalid-target", "memberships-unavailable", "not-a-member", "subject-has-no-tenant"]>;
+}>, YieldableError>;
+
+/** A request's tenant hint, read only after a strategy authenticates the caller.
+ * Return null for the credential / stored selection. A non-null target is
+ * checked against fresh memberships on every resolution, including when it
+ * equals the credential's tenant. It never writes a persistent selection.
+ * Do not return a tenant default for an absent hint: that would silently change
+ * the authority of requests which did not select a workspace.
+ */
+export declare type RequestedTenantSource = (subject: Subject, input: AuthStrategyInput) => Promise<string | null> | string | null;
+
 /** Gate a handler on a scope; fails with a typed `ScopeError` if missing.
  *  Checks the EFFECTIVE set so role-derived scopes count. */
 export declare const requireScope: (subject: Subject, scope: string) => Effect.Effect<void, ScopeError>;
 
+/** Browser-safe descriptor guard for capabilities that require registration. */
+export declare const requireUpgraded: () => UpgradedGuardSpec;
+
 /** Drop every registration. Tests only — production registers once at module load. */
 export declare const resetPluginAliases: () => void;
 
+/**
+ * Put authority back onto an IDENTITY that arrived without it — a resumed
+ * durable run, a redeemed Room seat — through the app's own `resolveScopes`
+ * and `subjectGuards`, the same seam a request uses. Credentials never carry
+ * scopes (`subjectIdentity`), so every non-request consumer resolves here
+ * rather than trusting authority frozen at mint time. With no resolver the
+ * identity keeps what it carries (nothing), the fail-closed default.
+ */
+export declare const resolveIdentityAuthority: (identity: Subject, ctx: AuthSubjectGuardContext, authority: {
+    readonly resolveScopes?: ((subject: Subject, ctx: AuthSubjectGuardContext) => Promise<ScopeResolverResult> | ScopeResolverResult) | undefined;
+    readonly subjectGuards?: ReadonlyArray<AuthSubjectGuard> | undefined;
+} | undefined) => Promise<IdentityAuthorityOutcome>;
+
 /** Resolve the input-selected action once. Invalid selectors deny rather than
  * widening to any action the subject happens to hold. Also used when an
  * approval persists the resolved guard for its later recheck. */
@@ -5179,6 +5896,16 @@ declare interface RestCache {
     readonly audience?: (output: unknown, input: unknown, subject: Subject) => 'public' | 'private';
 }
 
+/** Cross-origin browser access for one route. Origins are exact, including opaque `null`. */
+declare interface RestCors {
+    readonly origins: ReadonlyArray<string>;
+    readonly headers?: ReadonlyArray<string>;
+    readonly methods?: ReadonlyArray<RestMethod>;
+    /** Preflight cache lifetime in seconds. */
+    readonly maxAge?: number;
+    readonly exposeHeaders?: ReadonlyArray<string>;
+}
+
 export declare type RestDates = 'iso' | 'epoch-ms';
 
 export declare type RestEnvelope = 'none' | 'data' | 'jsonapi';
@@ -5256,7 +5983,7 @@ export declare interface RestFormatResponse {
     readonly contentType?: string;
 }
 
-declare type RestGuard = (ctx: RestRouteContext) => RestGuardRejection | undefined | Promise<RestGuardRejection | undefined>;
+declare type RestGuard = (ctx: RestRouteContext, request?: RestGuardRequest) => RestGuardRejection | undefined | Promise<RestGuardRejection | undefined>;
 
 /**
  * A guard runs after input decode + ctx resolution, before the handler.
@@ -5268,6 +5995,13 @@ declare interface RestGuardRejection {
     readonly message: string;
 }
 
+/** Guard input is the decoded execution snapshot. Guards are read-only
+ * admission checks and may run again after awaited admission/storage work. */
+declare interface RestGuardRequest {
+    readonly input: unknown;
+    readonly defaultDeny: boolean;
+}
+
 /** What a REST handler may return: the decoded output, a `response(...)` with
  *  its own status and headers, an `sse(...)` stream, or `bytes(...)` for a
  *  non-JSON body (a file, an export, an XML document). */
@@ -5279,6 +6013,13 @@ export declare type RestNaming = 'camelCase' | 'snake_case';
 
 export declare type RestPagination = 'link-header' | 'body-cursor';
 
+/** Uses the mounted rate-limit plugin's store, algorithms and dynamic policy. */
+declare interface RestRateLimit {
+    readonly limit: number;
+    readonly window: string;
+    readonly by?: 'subject' | 'tenant' | 'apiKey' | 'ip' | 'global';
+}
+
 /** A schema-encoded REST body with an application-selected HTTP status and
  *  response headers. The marker keeps ordinary domain objects unambiguous.
  *  `output` still validates/encodes `body`; use `Schema.Void` with a 204 when
@@ -5300,6 +6041,8 @@ declare interface RestResponse<O> {
  * stays free of the database dep).
  */
 declare interface RestRouteContext {
+    /** Server-owned invocation trace, stable through readmission and projection. */
+    readonly traceId: string;
     readonly subject: Subject;
     readonly headers: Readonly<Record<string, string>>;
     /** Request metadata and the byte-exact body as received by the HTTP
@@ -5324,6 +6067,9 @@ declare interface RestRouteContext {
 }
 
 declare interface RestRouteDescriptor<I, O> {
+    /** Original schemas for client generation. Metadata only: never mounts a
+     * second handler or selects authentication/idempotency bindings. */
+    readonly publicApiDescriptor?: PublicApiDescriptor;
     readonly method: RestMethod;
     /** Absolute path, e.g. `/v1/customers`. Matches that path exactly. */
     readonly path: string;
@@ -5337,6 +6083,12 @@ declare interface RestRouteDescriptor<I, O> {
      *  encodes it to JSON for the `200` response. */
     readonly output: Schema.Codec<O, any, never, never>;
     readonly handler: (input: I, ctx: RestRouteContext) => Promise<RestHandlerResult<O>> | RestHandlerResult<O>;
+    /** Pure synchronous normalization of thrown admission/handler failures.
+     * Return a mapped thrown value (for example RestRouteError), not an HTTP
+     * response; undefined keeps the original failure. Available before authentication,
+     * so only request metadata is given.
+     * Public projections supply their existing typed/profile error mapper here. */
+    readonly mapFailure?: (error: unknown, request: Pick<PluginHttpRouteRequest, 'method' | 'path' | 'query'>) => unknown;
     readonly summary?: string;
     readonly description?: string;
     readonly example?: RestRouteExample;
@@ -5377,6 +6129,10 @@ declare interface RestRouteDescriptor<I, O> {
      */
     readonly version?: `v${number}`;
     readonly guards?: ReadonlyArray<RestGuard>;
+    readonly cors?: RestCors;
+    /** Only an explicit bearer header may authenticate; cookies are removed before auth and context construction. */
+    readonly credentials?: 'bearer';
+    readonly rateLimit?: RestRateLimit;
     /**
      * This route STREAMS (Server-Sent Events) rather than resolving one value — its
      * handler returns `sse(...)`. Declared on the descriptor, not left implicit in
@@ -5436,6 +6192,44 @@ declare interface RestRouteProjection {
     readonly format: RestFormat;
 }
 
+/**
+ * Default ctx resolver used when the serve pipeline doesn't inject one
+ * (e.g. unit tests). Real mounts pass a resolver that reads the framework's
+ * auth subject + the bound DataStore.
+ */
+declare interface RestServeBindings {
+    /** Pure scope-refresher registration, shared with native RPC admission. */
+    readonly bindReplayAuthority?: RpcReplayAuthorityBinding;
+    /** Actual host policy for projected procedure guards; raw routes own guards. */
+    readonly defaultDeny?: boolean;
+    /** Full runtime hosts supply their existing trace generator. */
+    readonly traceId?: () => string;
+    /** Bound once from the app's mounted rate-limit plugin. */
+    readonly rateLimit?: (policy: RestRateLimit, ctx: RestRouteContext, route: RestRouteDescriptor<any, any>) => Effect.Effect<void, unknown>;
+    /** Resolve the calling subject and request-local selection before guards. */
+    readonly resolveSubject?: (headers: Readonly<Record<string, string>>, request: {
+        readonly path: string;
+        readonly query: string;
+    }) => Subject | Promise<Subject>;
+    /** The bound framework DataStore. */
+    readonly store?: unknown;
+    /** Build the full per-request app context after authentication. */
+    readonly buildContext?: (subject: Subject, headers: Readonly<Record<string, string>>, request: Pick<RestRouteContext, 'traceId' | 'remoteAddr'>) => unknown | Promise<unknown>;
+    /**
+     * HTTP idempotency — when set, a mutating request (POST/PUT/PATCH/DELETE)
+     * carrying the `header` is deduplicated: the first call runs + caches its
+     * response; a replay within `ttlMs` returns the cached response
+     * (`Idempotency-Replayed: true`); an in-flight duplicate gets `409`. Scoped
+     * per (tenant, method, path). The serve path injects the store + config from
+     * `app.config.ts`'s `idempotency` field.
+     */
+    readonly idempotency?: {
+        readonly store: IdempotencyStore;
+        readonly header: string;
+        readonly ttlMs: number;
+    };
+}
+
 /**
  * What a REST handler returns to stream its response instead of resolving one
  * value: `sse((emit) => unsubscribe)`. The route's schema `output` is not used
@@ -5584,9 +6378,13 @@ export declare type RpcInterceptor = (next: Effect.Effect<unknown, unknown>, con
  * them automatically.
  */
 export declare interface RpcInterceptorContext {
+    /** Enqueue a settled invocation outcome on the host's root store, outside
+     * the business transaction. Required transactional success capture must use
+     * MutationCommitContext.outbox instead. Older/custom hosts may omit this. */
+    readonly enqueueOutcome?: OutboxEnqueueFacade['enqueue'];
     /** Procedure tag, e.g. `todos.create`. */
     readonly tag: string;
-    /** Discriminator — `'mutation' | 'query' | 'action' | 'workflow'`. */
+    /** Procedure kind, including finite stream admission. */
     readonly kind: RpcKind;
     /** The validated input the executor is about to (or already did) receive. */
     readonly input: unknown;
@@ -5622,10 +6420,20 @@ export declare interface RpcInterceptorContext {
  * Which kind of rpc the interceptor is wrapping. The runtime passes
  * `kind: 'mutation'` to interceptors registered as `interceptMutation`,
  * `kind: 'query'` to `interceptQuery`, `kind: 'action'` to
- * `interceptAction`, and `kind: 'workflow'` to `interceptWorkflow` — one
+ * `interceptAction`, `kind: 'workflow'` to `interceptWorkflow`, and
+ * `kind: 'stream'` to `interceptStream` — one
  * plugin can implement any combination.
  */
-export declare type RpcKind = 'mutation' | 'query' | 'action' | 'workflow';
+export declare type RpcKind = 'mutation' | 'query' | 'action' | 'workflow' | 'stream';
+
+export declare type RpcReplayAuthorityBinding = (context: RpcReplayAuthorityContext) => undefined;
+
+/** Pure synchronous authority-refresher binding for RPC and REST admission.
+ * No business work, I/O, grants or side effects belong in this hook. The host
+ * calls the existing guard rechecker after every binding. */
+export declare interface RpcReplayAuthorityContext extends Pick<RpcInterceptorContext, 'tag' | 'input' | 'subject' | 'traceId' | 'surface' | 'publicApi' | 'remoteAddr'> {
+    readonly kind: RpcKind | 'rest';
+}
 
 /**
  * Per-firing context passed to schedule-fire interceptors. Shape
@@ -5774,6 +6582,10 @@ declare const ScopeError_base: Schema.Class<ScopeError, Schema.TaggedStruct<"Sco
  *  resolver already has. */
 export declare type ScopeResolverResult = ReadonlyArray<string> | ScopeDecision;
 
+/** Exact tags outrank namespace filters; deeper namespaces outrank broader ones.
+ * Equal specificity is an ambiguity, never an implicit failover/credential hop. */
+export declare const selectApiRoleEndpoint: (endpoints: ApiRoleEndpoints, tag: string, workload: ApiRoleRpcWorkload) => ApiRoleEndpoint;
+
 /**
  * The subject with `tenantId` selected — or a refusal.
  *
@@ -5977,6 +6789,9 @@ export declare const sessionValueFromHeaders: (headers: Readonly<Record<string,
  */
 export declare const setEffectiveScopes: (subject: Subject, scopes: ReadonlyArray<string>) => void;
 
+/** Register a request's dynamic role/permission resolver for live delivery. */
+export declare const setEffectiveScopesRefresher: (subject: Subject, refresh: (fresh: Subject) => Promise<void>) => void;
+
 /** Register (or clear) the process-global policy-guard resolver. Last write
  *  wins. The runtime installs one backed by the resource-policy registry and
  *  the registered tuple source. */
@@ -6007,6 +6822,33 @@ export declare const shapeDigest: (text: string) => string;
  */
 export declare const sourceKeys: (source: ReactivitySourceValue | ReadonlyArray<ReactivitySourceValue> | undefined) => ReadonlyArray<string>;
 
+export declare interface SsrfPolicy {
+    /**
+     * Hosts that bypass the guard. An entry may be an exact hostname
+     * (`billing.internal`), a suffix wildcard (`*.svc.cluster.local`), or a
+     * host:port (`127.0.0.1:8787`) when only one port should be reachable.
+     *
+     * This is the one escape hatch, and it is deliberately per-HOST rather than a
+     * boolean: "we call one internal service" and "we do not check URLs" are very
+     * different postures, and a boolean cannot tell them apart six months later.
+     */
+    readonly allowHosts?: ReadonlyArray<string>;
+    /** Max redirect hops to follow. Each one is revalidated. Default 5. */
+    readonly maxRedirects?: number;
+}
+
+/**
+ * Decide whether a URL may be fetched. Returns `null` when allowed, else the
+ * reason. Fails CLOSED: a URL that will not parse is blocked.
+ *
+ * DNS is deliberately NOT resolved — this is a synchronous check on the literal
+ * target, so a hostname that RESOLVES to a private address (DNS rebinding) is not
+ * caught here. Blocking the direct-IP vector is the high-severity, cheap half;
+ * rebinding needs network-layer egress control and is called out in the docs
+ * rather than silently implied.
+ */
+export declare const ssrfReason: (rawUrl: string, policy?: SsrfPolicy) => string | null;
+
 export declare type StorageAccessPolicy = typeof StorageAccessPolicySchema.Type;
 
 export declare const StorageAccessPolicySchema: Schema.$Array<Schema.Struct<{
@@ -6185,6 +7027,9 @@ export declare const strictInput: <S extends Schema.Top>(input: S, procedure?: s
 
 export declare const Subject: Schema.Union<readonly [Schema.Struct<{
     readonly type: Schema.Literal<"user">;
+    /** A guest has a stable identity but has not linked a registered account.
+     * This identity mark survives session signing; it never grants authority. */
+    readonly kind: Schema.optional<Schema.Literal<"guest">>;
     readonly id: Schema.String;
     readonly tenantId: Schema.String;
     readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
@@ -6251,6 +7096,7 @@ export declare const subjectAuditActorId: (subject: Subject) => string | null;
 export declare const SubjectIdentity: Schema.Union<readonly [Schema.Struct<{
     readonly type: Schema.Literal<"user">;
     readonly id: Schema.String;
+    readonly kind: Schema.optional<Schema.Literal<"guest">>;
     readonly tenantId: Schema.String;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
@@ -6293,9 +7139,9 @@ export declare const SubjectIdentity: Schema.Union<readonly [Schema.Struct<{
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"service">;
     readonly id: Schema.String;
+    readonly service: Schema.String;
     readonly tenantId: Schema.Null;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-    readonly service: Schema.String;
 }>]>;
 
 export declare type SubjectIdentity = typeof SubjectIdentity.Type;
@@ -6334,6 +7180,7 @@ declare const SubjectService_base: Context.ServiceClass<SubjectService, "@voltro
     readonly type: "user";
     readonly id: string;
     readonly tenantId: string;
+    readonly kind?: "guest" | undefined;
     readonly scopes?: readonly string[] | undefined;
     readonly metadata?: {
         readonly [x: string]: unknown;
@@ -6371,8 +7218,8 @@ declare const SubjectService_base: Context.ServiceClass<SubjectService, "@voltro
 } | {
     readonly type: "service";
     readonly id: string;
-    readonly tenantId: null;
     readonly service: string;
+    readonly tenantId: null;
     readonly scopes?: readonly string[] | undefined;
     readonly metadata?: {
         readonly [x: string]: unknown;
@@ -6430,7 +7277,7 @@ export declare const subscriptionEvent: <D extends Schema.Top>(data: D) => Schem
     }>;
 }>, Schema.Struct<{
     readonly _tag: Schema.Literal<"error">;
-    readonly error: Schema.Unknown;
+    readonly error: Schema.decodeTo<Schema.Unknown, Schema.Codec<Schema.Json, Schema.Json, never, never>, never, never>;
     readonly revision: Schema.optional<Schema.Number>;
 }>]>;
 
@@ -6710,7 +7557,7 @@ export declare const toRpc: <Name extends string, Input extends Schema.Top, Outp
     }>;
 }>, Schema.Struct<{
     readonly _tag: Schema.Literal<"error">;
-    readonly error: Schema.Unknown;
+    readonly error: Schema.decodeTo<Schema.Unknown, Schema.Codec<Schema.Json, Schema.Json, never, never>, never, never>;
     readonly revision: Schema.optional<Schema.Number>;
 }>]>, Schema.Top>, Schema.Never, never, never> | Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Output, Schema.Top, never, never> | Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Stream<Output, Schema.Top>, Schema.Never, never, never>;
 
@@ -6865,6 +7712,29 @@ export declare interface UpdateTarget<Input = unknown, Row = unknown, Item = Rec
     readonly shapeItem?: ((input: Input, current: Item) => Item) | undefined;
 }
 
+/** Runtime form of the registered-human identity requirement. */
+export declare interface UpgradedCheckSpec {
+    readonly upgraded: true;
+}
+
+/** Reject an upgraded marker combined with another guard variant in one entry.
+ * Structural guard unions allow such objects to compile. Keep independent
+ * requirements in separate entries so dispatch and persistence retain both. */
+export declare const upgradedGuardShapeError: (guard: unknown) => ScopeError | null;
+
+/** Require a registered human identity. Guest and machine credentials cannot
+ * satisfy this requirement, including credentials holding admin scopes. */
+export declare interface UpgradedGuardSpec {
+    readonly upgraded: true;
+}
+
+/** Validate an optional per-connection SSE lifetime before acquiring resources.
+ * The timer ceiling also prevents millisecond overflow becoming a 1ms timer. */
+export declare const validateHttpStreamMaxDuration: (value: unknown) => number | undefined;
+
+/** Refuse malformed runtime contributions before starting a worker. */
+export declare function validateOutboxHandlerDefinition(value: unknown, owner: string): asserts value is OutboxHandlerDefinition<unknown>;
+
 /**
  * A server-side validation failure pinned to ONE field.
  *
@@ -6908,6 +7778,26 @@ export declare const ValidationIssue: Schema.Struct<{
 export declare type ValidationIssueShape = Schema.Schema.Type<typeof ValidationIssue>;
 
 export declare interface VoltroPlugin {
+    /** Server callbacks for explicitly policy-bound event client streams. */
+    readonly eventClientPolicies?: ReadonlyArray<EventClientPolicy>;
+    /** Declared background/listener work. Omitted means rpc-only for role admission.
+     * Metadata alone does not suppress hooks; hosts must apply the role plan. */
+    readonly workloads?: ReadonlyArray<ApiWorkload>;
+    /** Separately owned API work, started after shared activation. A failed start
+     * must release partial acquisitions before rejecting. Returned resources drain
+     * before shared deactivation; stop failures retain them for retry. */
+    readonly workloadHooks?: Readonly<Partial<Record<ApiWorkload, PluginWorkloadHook>>>;
+    /** App-supplied connection references for this configured plugin instance.
+     * Registry bindings override these selections. Library plugins must not set
+     * topology defaults here; populate only from explicit app options. */
+    readonly connectionBindings?: Readonly<Record<string, ConnectionRef>>;
+    /** Backend-independent requirements. Cross-node HotStore requires Redis; broker roles require their native transport. */
+    readonly needs?: {
+        readonly hot?: 'local' | 'crossNode';
+        readonly connections?: ReadonlyArray<PluginConnectionNeed>;
+        readonly pubsub?: boolean;
+        readonly atomicMulti?: boolean;
+    };
     /**
      * Plugin identifier — printed in `voltro dev` boot logs + surfaced in
      * the inspect manifest. Use a stable string scoped to the package
@@ -7006,6 +7896,16 @@ export declare interface VoltroPlugin {
     readonly declaredEnv?: ReadonlyArray<PluginEnvVar>;
     /** What this plugin collects and uses — see `PluginPrivacyDeclaration`. */
     readonly privacy?: PluginPrivacyDeclaration;
+    /** Subject-data ownership; distinct from the platform privacy disclosure above. */
+    readonly subjectPrivacy?: PluginSubjectPrivacy;
+    /** Idempotent server hook. Identity hooks run after all declared data hooks. */
+    readonly onErase?: PluginEraseHook;
+    /** Server-authorized JSON export. Omit credentials, hashes and session tokens. */
+    readonly onExport?: PluginExportHook;
+    /** Transactional account-data reconciliation; distinct from privacy erasure. */
+    readonly subjectMerge?: PluginSubjectMerge;
+    /** Trusted coordinator must authenticate both accounts and confirmation. */
+    readonly onMergeAccounts?: PluginAccountMergeHook;
     /** Where this plugin sends data outside the installation — see `PluginEgressDeclaration`. Omit when it sends nothing. */
     readonly egress?: ReadonlyArray<PluginEgressDeclaration>;
     /**
@@ -7047,7 +7947,21 @@ export declare interface VoltroPlugin {
      * Absent → the plugin contributes nothing at the mutation boundary
      * (schema-only / lifecycle-only plugins are fine).
      */
+    /** Register pure authority refreshers for native and REST admission,
+     * including queries and raw REST routes, before/after receipt waits. Requires rpc:authority:replay; never run the executor
+     * or normal interceptors to reconstruct an authorization decision. */
+    readonly bindReplayAuthority?: RpcReplayAuthorityBinding;
     readonly interceptMutation?: RpcInterceptor;
+    /** Runs after successful executor and business-rule evaluation, before the
+     * transaction commits. Use only the supplied store for required records or
+     * durable intents. External I/O is prohibited; transaction retries replay
+     * this hook. Requires rpc:intercept:mutation and store:write permissions.
+     * Ordinary RPC interceptors retain their existing outside-transaction scope. */
+    readonly beforeMutationCommit?: MutationCommitHook;
+    /** Post-commit delivery handlers, registered with the shared app worker in
+     * Dev and serve. Requires outbox:handle; effects must not collide with app,
+     * framework or other plugin contributions. Handlers must be idempotent. */
+    readonly outboxHandlers?: ReadonlyArray<OutboxHandlerDefinition<unknown>>;
     /**
      * Wraps every QUERY (streaming subscription handler) call. Same
      * composition semantics as `interceptMutation`. Most observability
@@ -7078,6 +7992,11 @@ export declare interface VoltroPlugin {
      * plugins carry a parity test that fails when one does.
      */
     readonly interceptWorkflow?: RpcInterceptor;
+    /** Wraps finite stream admission and construction, once per subscription,
+     * before guards and executor side effects. The successful value is the
+     * Stream itself; element delivery retains ordinary live guard rechecks.
+     * Requires rpc:intercept:stream. */
+    readonly interceptStream?: RpcInterceptor;
     /**
      * Effect Layer that contributes services into the per-request
      * context. Anything declared here is yieldable from any handler in
@@ -7258,7 +8177,7 @@ export declare interface VoltroPlugin {
      */
     readonly extendSchema?: PluginSchemaContribution;
     /**
-     * A directory of APP-SHAPED primitives this plugin brings with it — the same
+     * An absolute directory or named directories of APP-SHAPED primitives this plugin brings with it — the same
      * file conventions an app uses (`*.query.ts` + `.server.ts`, `*.mutation.ts`,
      * `*.workflow.tsx`, `*.cron.tsx`, `*.subscribe.ts`, `*.reaction.ts`,
      * `schema.ts` / `*.entity.ts`, …).
@@ -7277,9 +8196,12 @@ export declare interface VoltroPlugin {
      *
      * The block's procedures keep the names their descriptors declare; a name
      * that collides with the app's own is refused at codegen, as any collision is.
-     * An absolute path to a directory; a missing one refuses the boot.
+     * A directory or a plain named map of directories. Named roots use stable
+     * per-plugin module identities independent of declaration order; choose names
+     * explicitly when optional subsystems contribute separate folders. Each value
+     * must be an absolute existing directory; missing/overlapping roots refuse boot.
      */
-    readonly sources?: string;
+    readonly sources?: string | Readonly<Record<string, string>>;
     /**
      * Cross-cutting error schemas merged into every procedure's wire error
      * union. Lets a plugin interceptor fail with a typed error (e.g.
@@ -7332,6 +8254,8 @@ export declare interface VoltroPlugin {
      * SDK here). Returns of `undefined`/empty are no-ops.
      */
     readonly contributeObservability?: (ctx: PluginLifecycleContext) => Promise<ObservabilityContribution | undefined> | ObservabilityContribution | undefined;
+    /** Enforce a hand-authored REST route's quota through this plugin. */
+    readonly restRateLimit?: RestServeBindings['rateLimit'];
     /**
      * Told the app's mounted REST surface — hand-authored `restRoutes` AND the
      * routes projected from `publicApi` annotations — once the boot has built it,
@@ -7416,15 +8340,17 @@ export declare interface WebSocketGatewayConnection {
     readonly send: (data: string | Uint8Array) => void;
     /** Await the local transport write, NOT peer receipt. Rejects on close or
      * overflow. Await each send to propagate backpressure to the producer. */
-    readonly sendAsync: (data: string | Uint8Array) => Promise<void>;
+    readonly sendAsync: (data: string | Uint8Array) => Promise<WebSocketGatewaySendResult>;
+    /** Active plus queued frame bytes, excluding WebSocket framing overhead. */
+    readonly queuedBytes: number;
     /** Aborted on close, expiry, shutdown or setup failure, including while
      * onConnection is still awaiting an upstream connection. */
     readonly signal: AbortSignal;
     /** Close the connection (application close codes 4000-4999 are yours). */
     readonly close: (code?: number, reason?: string) => void;
     /** Register a message listener (binary-safe; text arrives as bytes). */
-    readonly onMessage: (listener: (data: Uint8Array) => void) => void;
-    /** The authenticated subject — `null` only on an `auth: 'public'` route. */
+    readonly onMessage: (listener: (data: Uint8Array, receivedAt: number) => void) => void;
+    /** The verified subject — `null` only on an `auth: 'public'` route. */
     readonly subject: Subject | null;
     /** Lowercased request headers of the upgrade. */
     readonly headers: Readonly<Record<string, string>>;
@@ -7445,11 +8371,27 @@ export declare interface WebSocketGatewayRoute {
      *   expires.
      * - `'public'` — deliberately unauthenticated (a device fleet with its own
      *   protocol-level auth). A decision somebody wrote down, not a default.
-     */
-    readonly auth: 'subject' | 'public';
+     * - `'token'` — upgrades after the origin check, then verifies the first
+     *   assembled frame before starting onConnection. The credential frame
+     *   never reaches message listeners. Clients wait for an application
+     *   acknowledgement before sending more frames; early frames close 1008.
+     */
+    readonly auth: 'subject' | 'public' | 'token';
+    /** Required only for auth: 'token'. Return null to refuse (1008), or the
+     * verified SubjectResolution (credentialExpiresAt is Unix SECONDS).
+     * Throw/rejection closes 1011 with a generic reason. Respect context.signal:
+     * timeout, disconnect and shutdown abort it, and late results are ignored. */
+    readonly verify?: (firstFrame: Uint8Array, context: WebSocketGatewayVerificationContext) => SubjectResolution | null | Promise<SubjectResolution | null>;
+    /** Only for auth: 'token'. Deadline from socket open, including waiting for
+     * the first frame and verification; default 5000 ms, maximum 2147483647. */
+    readonly verificationTimeoutMs?: number;
     /** Per-connection bounds. Inbound size is checked before app dispatch,
      * not before the platform assembles a WebSocket message. */
     readonly limits?: {
+        /** Optional per-connection token refill rate. Omitted means no rate limit. */
+        readonly maxInboundMessagesPerSecond?: number;
+        /** Initial and maximum token capacity; defaults to the configured rate. */
+        readonly burst?: number;
         /** Maximum inbound/outbound frame bytes; default 1 MiB. */
         readonly maxMessageBytes?: number;
         /** Active plus queued outbound bytes; default 4 MiB. */
@@ -7468,6 +8410,20 @@ export declare interface WebSocketGatewayRoute {
     readonly onConnection: (connection: WebSocketGatewayConnection) => void | (() => void) | Promise<void | (() => void)>;
 }
 
+/** Local queue pressure after the frame's transport write; not peer receipt. */
+export declare interface WebSocketGatewaySendResult {
+    readonly queuedBytes: number;
+}
+
+/** Cancellation and upgrade metadata for first-frame credential verification. */
+export declare interface WebSocketGatewayVerificationContext {
+    readonly signal: AbortSignal;
+    readonly headers: Readonly<Record<string, string>>;
+    readonly path: string;
+    /** Process-monotonic reception time in milliseconds, not a Unix timestamp. */
+    readonly receivedAt: number;
+}
+
 /**
  * Who may call a procedure over the wire: the app's own clients, or only other
  * apps of the project.