@voltro/runtime 0.79.1 → 0.81.0

package/dist/index.d.ts

@@ -909,6 +909,12 @@ export declare const API_CSP = "default-src 'none'; frame-ancestors 'none'; base
 
 export declare const API_KEYS_TABLE = "_voltro_api_keys";
 
+/** Caller side: the token this app presents to the api it binds as `name`. */
+export declare const apiBindingTokenEnv: (name: string) => string;
+
+/** Caller side: where the api it binds as `name` listens (production). */
+export declare const apiBindingUrlEnv: (name: string) => string;
+
 /** What `ApiKeyStore.ensureActor` is handed for the row it plants. */
 export declare interface ApiKeyActor {
     readonly id: string;
@@ -1107,6 +1113,19 @@ export declare interface AppAccess {
     readonly scopes: ReadonlyArray<string>;
 }
 
+/**
+ * The typed clients of the apps this app calls — augmented per app by the
+ * codegen'd `apis.generated.ts`:
+ *
+ *     declare module '@voltro/runtime' {
+ *       interface AppApis { readonly cloud: ServiceApi<CloudServiceProcedures> }
+ *     }
+ *
+ * Empty until an app declares `apis:`.
+ */
+export declare interface AppApis {
+}
+
 export declare interface AppContext {
     /** Run database work with a freshly transaction-bound context. Reuses an
      * existing mutation transaction (no savepoint). The callback may be retried;
@@ -1204,6 +1223,19 @@ export declare interface AppContext {
      * subject", by construction.
      */
     readonly connections?: ConnectionsFacade;
+    /**
+     * The other apps of the project this app calls (`ctx.apis.<name>`) — one
+     * typed client per `apis:` binding in `app.config.ts`, typed from the
+     * callee's `service:` procedures by the codegen'd `apis.generated.ts`.
+     *
+     *     await ctx.apis.cloud.deployments.activate({ deploymentId, tenantId })
+     *     yield* ctx.apis.cloud.deployments.activate.effect(input)   // in a workflow step
+     *
+     * Always present — an app with no bindings gets an empty object, so the field
+     * never reads as "maybe wired". A call without an answer fails with
+     * `ApiUnavailable`; every answer the callee gives arrives as itself.
+     */
+    readonly apis: AppApis;
     /**
      * Request-scoped batching (`ctx.load` / `ctx.loadMany`). Coalesces
      * same-tick reads of one table into a single `WHERE id IN (...)`.
@@ -1460,6 +1492,9 @@ export declare const assertCan: (subject: RebacSubject, action: string, resource
  */
 export declare const assertConnectionCipherConfigured: (definitions: ReadonlyArray<ConnectionDefinition>) => void;
 
+/** Refuse a caller map that could not be what the author meant. */
+export declare const assertServiceCallersConfig: (callers: ServiceCallersConfig) => void;
+
 /**
  * Boot gate: every mounted incoming-webhook route must carry a verification
  * declaration. Throws `UnverifiedWebhookRoute` for the first that does not.
@@ -1640,6 +1675,19 @@ export declare interface AuditableQuery {
 
 export declare interface AuthMiddlewareLayerOptions {
     readonly resolveSubject: ResolveSubjectFn;
+    /**
+     * The apps allowed to call one rpc tag, or `undefined` when the tag is not a
+     * `service:` procedure. Both boot paths pass the same lookup over the
+     * procedures they registered.
+     *
+     * This is the OUTER wall for a service credential: the guard check refuses a
+     * service subject at every procedure that does not name it, but framework
+     * built-ins (`__voltro.*`) and plugin routes reach their handlers without a
+     * descriptor guard. Here, before any handler, a service subject reaches only
+     * the tags that name it — so a leaked service token opens exactly the doors
+     * the callee declared and nothing the framework adds.
+     */
+    readonly serviceCallersFor?: (tag: string) => ReadonlyArray<string> | undefined;
 }
 
 /**
@@ -2245,6 +2293,8 @@ export declare interface ClientAddressInput {
     readonly socketAddress: string | undefined;
     /** Raw `x-forwarded-for` header, if present. */
     readonly xForwardedFor: string | undefined;
+    /** Raw value of `config.clientAddressHeader`, if the request carried it. */
+    readonly clientAddressHeader?: string | undefined;
     readonly config: TrustedProxyConfig;
 }
 
@@ -3301,6 +3351,10 @@ export declare const DEFAULT_HSTS = "max-age=15552000; includeSubDomains";
  */
 export declare const DEFAULT_KEEP_ALIVE_MS = 72000;
 
+export declare const DEFAULT_LEVEL_RESYNC_MS: number;
+
+export declare const DEFAULT_LEVEL_STUCK_MS: number;
+
 /** Ceiling the idle backoff climbs to. Deliberately short enough to be a
  *  FLOOR under a missed wake rather than a substitute for one. */
 export declare const DEFAULT_MAX_IDLE_INTERVAL_MS = 30000;
@@ -3539,7 +3593,12 @@ export declare const defineOutboxHandler: <R = never>(definition: OutboxHandlerD
 
 /** Declare a reaction. Validates that the MANDATORY guard is present — an
  *  ungated reaction is a spend-storm footgun, so this fails LOUD at boot. */
-export declare const defineReaction: (def: ReactionDefinition) => ReactionDefinition;
+export declare function defineReaction(def: LevelReactionDefinition): LevelReactionDefinition;
+
+export declare function defineReaction(def: EdgeReactionDefinition): EdgeReactionDefinition;
+
+/** A value already typed as either form — narrowed at runtime by its `watch`. */
+export declare function defineReaction(def: ReactionDefinition): ReactionDefinition;
 
 /** Register a resource policy (the static, discoverable relationship registry
  *  the capability map exposes). Validates + fails LOUD on a malformed or
@@ -4062,6 +4121,15 @@ export declare interface DrainResult {
  */
 export declare const dueWakeups: (store: DataStore, now: Date, limit?: number) => Promise<ReadonlyArray<Wakeup>>;
 
+/** A reaction to each CHANGE of a table (edge-triggered). */
+export declare interface EdgeReactionDefinition extends ReactionBase {
+    /** The table whose changes trigger the reaction (+ optional op filter). */
+    readonly watch: ReactionEdgeWatch;
+    /** Optional predicate over the change — skip when it returns false. */
+    readonly when?: (event: ReactionEvent) => boolean;
+    readonly guards: ReactionGuards;
+}
+
 /** The minimal Effect-store surface `insertIgnoreRowOutcomeEffect` needs. */
 export declare interface EffectInsertIgnoreOutcomeStore {
     readonly insertIgnoreWithOutcome: (table: string, row: Row, options: {
@@ -5453,13 +5521,12 @@ export declare const forbiddenColumnsForSubject: (tableName: string, subject: Su
 export declare const forgetCredential: (store: VaultStore, connectionId: string, subjectId: string) => Promise<boolean>;
 
 /**
- * Drop rows for a replica GENERATION that is gone.
+ * Drop this replica's rows on a graceful shutdown.
  *
- * Not a retention sweep — the table has no history to age out. This removes
- * the row of a process that restarted, because the replica's NEW row is
- * written under the same `(replicaId, kind)` key and the old generation is
- * simply overwritten. What this handles is a replica that went away for good
- * (a scale-down), whose row would otherwise be counted forever.
+ * A restart under the same replica ID overwrites its row anyway; this handles
+ * a replica that goes away for good (a scale-down). It cannot run for a process
+ * that crashed or was killed — those rows are aged out by the retention sweep
+ * on `writtenAt`, which every live replica refreshes each publish interval.
  */
 export declare const forgetReplicaObservations: (store: DataStore, replicaId: string) => Promise<void>;
 
@@ -5576,6 +5643,8 @@ export declare interface GroupState {
     readonly extreme?: number;
 }
 
+export declare const guardUndeclaredTables: (underlying: DataStore, isKnownTable: (table: string) => boolean) => DataStore;
+
 /** What a user handler may return. */
 export declare type HandlerBody<R = never> = void | Promise<unknown> | Effect.Effect<unknown, unknown, R>;
 
@@ -5862,7 +5931,10 @@ export { InspectStore }
  */
 export declare interface InspectStream {
     readonly replicaId?: string;
-    readonly select?: (url: string, headers: Readonly<Record<string, string>>) => Stream.Stream<Uint8Array, unknown> | undefined;
+    /** Undefined serves this process's own feed. Decided before the response
+     *  starts: an event stream is a 200 from its first byte, so a refusal found
+     *  inside the body could only reach the client as a feed that closes. */
+    readonly select?: (url: string, headers: Readonly<Record<string, string>>) => Effect.Effect<InspectStreamSelection | undefined>;
     /** Same shape as the inspect auth resolver — returns ok or reason. */
     readonly authorize: (headers: Readonly<Record<string, string>>) => {
         readonly ok: true;
@@ -5884,6 +5956,16 @@ export declare interface InspectStream {
     readonly keepAliveMs?: number;
 }
 
+/** A named process's feed, or the reasoned refusal to open it. */
+export declare type InspectStreamSelection = {
+    readonly kind: 'stream';
+    readonly stream: Stream.Stream<Uint8Array>;
+} | {
+    readonly kind: 'refused';
+    readonly status: number;
+    readonly body: unknown;
+};
+
 export { inspectWorkflow }
 
 export declare const installApprovalGate: (gate: ApprovalGateApi) => void;
@@ -6002,6 +6084,12 @@ export declare const isIdleNow: (opts: IdleCheckOptions) => Promise<boolean>;
 
 export declare const isInfraError: (e: unknown) => boolean;
 
+/** Narrow a reaction definition to the level form. */
+export declare const isLevelReaction: (def: ReactionDefinition) => def is LevelReactionDefinition;
+
+/** Narrow a reaction to the level form. */
+export declare const isLevelWatch: (watch: ReactionWatch) => watch is ReactionLevelWatch;
+
 export declare const isObservingGraph: () => boolean;
 
 /**
@@ -6109,6 +6197,8 @@ export declare const isTransactionReadConflict: (err: unknown) => err is Transac
 /** Is `address` one of the peers we are willing to take a forwarded chain from? */
 export declare const isTrustedProxy: (address: string | undefined, config: TrustedProxyConfig) => boolean;
 
+export declare const isWellFormedServiceToken: (value: string) => boolean;
+
 export declare const isWorkflowEventTriggerDefinition: (value: unknown) => value is WorkflowEventTriggerDefinition;
 
 /** A maintainable aggregate op. (countDistinct / window funcs are NOT here —
@@ -6232,6 +6322,34 @@ export declare const lastWriteProvenance: (row: Record<string, unknown> | null |
     readonly traceId?: string | null;
 }) => ProvenanceResult;
 
+/**
+ * A reaction to every ROW of a live query's current result (level-triggered).
+ *
+ * The act is a workflow, and the workflow's `idempotencyKey` is what makes it
+ * exactly-once across the fleet: every replica that sees the row may try to
+ * start it, and the engine collapses them into one execution. So there is no
+ * `dedupeKey` here, and the workflow's key must identify the unit of work — a
+ * row that can come BACK into the set (an org suspended, unsuspended, suspended
+ * again) needs a key carrying that generation (`suspend:${orgId}:${suspendedAt}`).
+ *
+ * The workflow must move the row OUT of the set (its first step flips a status,
+ * its failure path records a terminal one). A row still in the set long after
+ * it was started is reported as `stuck`, never silently restarted.
+ */
+export declare interface LevelReactionDefinition extends ReactionBase {
+    readonly watch: ReactionLevelWatch;
+    /** The identity of a row in the set — what `stuck` reports and the runner tracks. */
+    readonly key: (row: never) => string;
+    /** Only rows it returns true for act. */
+    readonly when?: (row: never) => boolean;
+    /** Re-read the whole set this often even when nothing changed, so a start that
+     *  failed is retried. Default 5 minutes, minimum 30 seconds. */
+    readonly resync?: number | string;
+    /** Report a row still in the set this long after it was started. Default 15 minutes. */
+    readonly stuckAfter?: number | string;
+    readonly guards?: Omit<ReactionGuards, 'dedupeKey'>;
+}
+
 export declare class LinearScanMatcher implements Matcher {
     private readonly byTable;
     register(sub: SubscriptionRecord): void;
@@ -7055,6 +7173,11 @@ export declare type MetricsMode = 'off' | 'console' | 'otlp' | 'memory';
 /** The lowest cadence any platform scheduler can express. */
 export declare const MIN_EXTERNALIZABLE_INTERVAL_MS = 60000;
 
+export declare const MIN_LEVEL_RESYNC_MS = 30000;
+
+/** Mint a fresh service token. `voltro dev` and `voltro secret generate` call this. */
+export declare const mintServiceToken: () => string;
+
 /**
  * Ordering token for one mirrored write.
  *
@@ -8268,17 +8391,23 @@ export declare type ReactionAct = {
     readonly payload?: (event: ReactionEvent) => unknown;
 };
 
-export declare interface ReactionDefinition {
+declare interface ReactionBase {
     readonly name: string;
-    /** The table whose changes trigger the reaction (+ optional op filter). */
-    readonly watch: {
-        readonly table: string;
-        readonly on?: ReactionOp | ReadonlyArray<ReactionOp>;
-    };
-    /** Optional predicate over the change — skip when it returns false. */
-    readonly when?: (event: ReactionEvent) => boolean;
     readonly act: ReactionAct;
-    readonly guards: ReactionGuards;
+}
+
+export declare type ReactionDefinition = EdgeReactionDefinition | LevelReactionDefinition;
+
+/** `'5 minutes'` / `'30s'` / `'8 days'` / `300000` → milliseconds. */
+export declare const reactionDurationMs: (value: number | string, field: string, reaction: string) => number;
+
+/**
+ * The EDGE form: react to each change of one table, as it happens.
+ * Best-effort — a change made while the reacting process is down is not seen.
+ */
+export declare interface ReactionEdgeWatch {
+    readonly table: string;
+    readonly on?: ReactionOp | ReadonlyArray<ReactionOp>;
 }
 
 /** The change a reaction reacts to (the framework's CDC shape). */
@@ -8324,6 +8453,23 @@ export declare interface ReactionGuards {
     };
 }
 
+/**
+ * The LEVEL form: react to every ROW of a live query's current result — the set
+ * of open work — for as long as it is in the set.
+ *
+ * Each delivery of the query is the whole current set, so work that appeared
+ * while the reacting process was down, restarting or deploying is seen on the
+ * first delivery after it comes back: nothing is lost. `api` names a binding in
+ * `apis:` (the query is another app's `service:` query); omit it to watch one
+ * of this app's own queries.
+ */
+export declare interface ReactionLevelWatch {
+    readonly query: string;
+    readonly api?: string;
+    /** The query's input. Default `{}`. */
+    readonly input?: unknown;
+}
+
 export declare type ReactionOp = 'insert' | 'update' | 'delete';
 
 export declare type ReactionOutcome = 'acted' | 'skipped-op' | 'skipped-when' | 'skipped-dedupe' | 'skipped-ratelimit' | 'skipped-budget';
@@ -8382,6 +8528,8 @@ export declare interface ReactionRunDeps {
     readonly now?: () => number;
 }
 
+export declare type ReactionWatch = ReactionEdgeWatch | ReactionLevelWatch;
+
 /** The reactive tunables a caller may declare. Every field optional; every
  *  default above. */
 export declare interface ReactiveConfigInput {
@@ -9425,6 +9573,14 @@ export declare const resolveReactiveConfig: (config?: ReactiveConfigInput | unde
 
 export declare const resolveRedirectUri: (definition: OAuth2ConnectionDefinition, publicUrl: string) => string;
 
+/** The client address of a request, read from its headers per `config`. The
+ *  one call every listener makes — which headers matter is decided here. */
+export declare const resolveRequestClientAddress: (input: {
+    readonly socketAddress: string | undefined;
+    readonly headers: Readonly<Record<string, string | undefined>>;
+    readonly config: TrustedProxyConfig;
+}) => string | undefined;
+
 /**
  * Whether the request reached the app over TLS.
  *
@@ -9500,7 +9656,8 @@ export declare type ResolveSubjectFn = (input: {
 export declare const resolveTimelineMode: (env?: Record<string, string | undefined>) => TimelineMode;
 
 /** Select identity before opening a transaction, never while one owns writes.
- * Only the framework's system subject may select a different tenant. */
+ * Only a cross-tenant machine subject — the framework's system subject, or a
+ * service calling a `service:` procedure — may select a different tenant. */
 export declare const resolveTransactionSubject: (subject: Subject, tenantId: string | undefined, transactionActive: boolean) => Subject;
 
 /**
@@ -9513,7 +9670,7 @@ export declare const resolveTransactionSubject: (subject: Subject, tenantId: str
  * rebuild; the config field exists because it is a tunable and tunables belong
  * in `app.config.ts`.
  */
-export declare const resolveTrustedProxies: (configured?: ReadonlyArray<string> | undefined, env?: Readonly<Record<string, string | undefined>>) => TrustedProxyConfig;
+export declare const resolveTrustedProxies: (configured?: ReadonlyArray<string> | undefined, env?: Readonly<Record<string, string | undefined>>, configuredHeader?: string | undefined) => TrustedProxyConfig;
 
 /** Per-resource-type policy. `actions` maps an action to the relations that
  *  grant it (ANY-of). `implies` is relation implication (owner ⇒ editor ⇒
@@ -9944,6 +10101,9 @@ export declare interface RowHistoryEntry {
     readonly traceId?: string | null;
 }
 
+/** Internal header name. Its value is meaningless without the process mark. */
+export declare const RPC_CLIENT_ADDRESS_HEADER = "x-voltro-client-address";
+
 /** Server-owned lifetime, not a user identity or a client-supplied claim.
  * WebSockets retain it across calls; HTTP retains it only within one request.
  * Reconnects and server restarts receive a new id. */
@@ -9951,6 +10111,11 @@ export declare interface RpcConnection {
     readonly id: string;
     readonly transport: 'websocket' | 'http';
     readonly signal: AbortSignal;
+    /** The caller's address, resolved by the rpc listener through
+     *  `security.trustedProxies` / `clientAddressHeader` — the same value its
+     *  per-IP shield counts. Absent when the call did not arrive through that
+     *  listener (an internal invocation, an embedder's own transport). */
+    readonly remoteAddr?: string;
 }
 
 export declare interface RpcServerOptions<Rpcs extends Rpc.Any> {
@@ -10005,6 +10170,9 @@ export declare interface RpcServerOptions<Rpcs extends Rpc.Any> {
      * boot-path parity rule asks for.
      */
     readonly publishSurfaceDigest?: boolean;
+    /** The bound tags that are `service:` procedures — published as
+     *  `serviceSurface`, kept out of the client `surface`. */
+    readonly serviceSurfaceTags?: ReadonlySet<string>;
     /** Non-sensitive fleet identity written on the rpc WebSocket open/close
      *  records. Defaults to the process identity resolver (POD_NAME/HOSTNAME).
      *  Embedders may state it explicitly when they own process identity. */
@@ -10218,7 +10386,7 @@ export declare const runProvidedEffect: <A>(effect: Effect.Effect<A, unknown, ne
  * `agentActor(via:'agent')` scoped to the row's tenant. Idempotent: the same
  * dedupe key never acts twice.
  */
-export declare const runReaction: (reaction: ReactionDefinition, event: ReactionEvent, deps: ReactionRunDeps) => Promise<ReactionOutcome>;
+export declare const runReaction: (reaction: EdgeReactionDefinition, event: ReactionEvent, deps: ReactionRunDeps) => Promise<ReactionOutcome>;
 
 /**
  * Start the full single-node orchestrator: bind the router on the public
@@ -10250,6 +10418,9 @@ export declare interface RuntimeContext {
     /** Server-owned transport identity and close signal. Not authentication;
      * session membership remains an application's explicit access decision. */
     readonly connection?: RpcConnection;
+    /** `connection.remoteAddr`, lifted so the serve pipeline — which also serves
+     *  REST calls that have no connection — reads one field for both. */
+    readonly remoteAddr?: string;
 }
 
 /**
@@ -11099,6 +11270,11 @@ export declare interface ServeRequestContext {
     readonly surface?: 'rest';
     /** The descriptor's `publicApi` spec, on a projected call. */
     readonly publicApi?: PublicApiSpec;
+    /** The caller's address as the listener resolved it through
+     *  `security.trustedProxies` — carried to the plugin interceptor so a
+     *  per-endpoint limit can count per client. Absent for calls that did not
+     *  arrive over the network. */
+    readonly remoteAddr?: string;
     /**
      * Caller-side cancellation (the gRPC deadline / client-cancel path).
      * Honoured at the ONE place the executor effect runs to a promise, so an
@@ -11163,11 +11339,56 @@ export declare type ServeRpcInterceptor = (base: Effect.Effect<unknown, unknown,
     /** See `ServeRequestContext.surface` — present on a REST-projected call. */
     readonly surface?: 'rest';
     readonly publicApi?: PublicApiSpec;
+    /** See `ServeRequestContext.remoteAddr`. */
+    readonly remoteAddr?: string;
 }) => Effect.Effect<unknown, unknown, never>;
 
 /** The published tracer, or `undefined` when tracing is off / no server booted. */
 export declare const serverTracer: () => Tracer.Tracer | undefined;
 
+/** The bearer prefix every service credential carries. */
+export declare const SERVICE_TOKEN_PREFIX = "vsvc_";
+
+/**
+ * One accepted caller. Declared in the callee's `app.config.ts`:
+ *
+ *     serviceCallers: { worker: {} }
+ *
+ * The object is the per-caller configuration slot; today it carries nothing,
+ * because the token comes from the environment by convention and the grant
+ * comes from the procedures. It is an object rather than `true` so a later
+ * per-caller option (a rate limit, an mTLS identity) is an addition, not a
+ * change of shape.
+ */
+export declare type ServiceCallerConfig = Readonly<Record<string, never>>;
+
+/** Callee side: the second accepted value during a rotation. */
+export declare const serviceCallerNextTokenEnv: (caller: string) => string;
+
+export declare type ServiceCallersConfig = Readonly<Record<string, ServiceCallerConfig>>;
+
+/**
+ * The strategy an app with `serviceCallers` puts FIRST in its chain.
+ *
+ * It claims only `Bearer vsvc_…`. Every other request is a `skip`, so an app's
+ * users never pay more than a prefix check.
+ */
+export declare const serviceCallerStrategy: (options: ServiceCallerStrategyOptions) => AuthStrategy;
+
+export declare interface ServiceCallerStrategyOptions {
+    readonly callers: ServiceCallersConfig;
+    /** Read lazily — at request time and in `verifyConfig` — never while the
+     *  config is imported, so `voltro build` needs no production secret. */
+    readonly env?: () => Readonly<Record<string, string | undefined>>;
+}
+
+/** Callee side: the env var holding the token a caller presents. */
+export declare const serviceCallerTokenEnv: (caller: string) => string;
+
+/** `worker` → `WORKER`, `build-runner` → `BUILD_RUNNER`, `voltroCloudWorker` →
+ *  `VOLTRO_CLOUD_WORKER`. The env-var spelling of an app name. */
+export declare const serviceEnvSegment: (name: string) => string;
+
 export declare const setBufferedBytes: (label: string, bytes: number) => void;
 
 /** Register the process-wide connection resolver (or clear with `undefined`).
@@ -12182,6 +12403,12 @@ export declare interface TransportSecurityOptions {
      *  CIDRs, the presets `loopback` / `private`, a hop count (`['2']`), or
      *  `['*']` to trust any peer. Env override: `VOLTRO_TRUSTED_PROXIES`. */
     readonly trustedProxies?: ReadonlyArray<string>;
+    /** A header a trusted proxy SETS to the client's single address
+     *  (`'cf-connecting-ip'`, `'x-real-ip'`). Believed only from a peer
+     *  `trustedProxies` covers, and only when it holds one valid IP; otherwise
+     *  the `x-forwarded-for` chain applies. Env override:
+     *  `VOLTRO_CLIENT_ADDRESS_HEADER`. */
+    readonly clientAddressHeader?: string;
     /** Security response headers. Env override: `VOLTRO_SECURITY_HEADERS`
      *  (`off|default|strict`), plus `VOLTRO_CSP` / `VOLTRO_CSP_HTML` /
      *  `VOLTRO_HSTS`. */
@@ -12227,6 +12454,10 @@ export declare interface TrustedProxyConfig {
     readonly trustAll: boolean;
     /** Hop count (express's numeric `trust proxy`). `undefined` → not hop mode. */
     readonly hops?: number;
+    /** Lower-cased name of a single-address header a trusted proxy SETS
+     *  (`cf-connecting-ip`, `x-real-ip`). Preferred over the forwarded chain when
+     *  it holds one valid IP; `x-forwarded-for` remains the fallback. */
+    readonly clientAddressHeader?: string;
 }
 
 /**
@@ -12315,6 +12546,13 @@ declare interface TypedUpsertOptions<T extends AnyWritableTable> {
  */
 export declare const unbindConnection: (clientId: number) => void;
 
+export declare class UndeclaredTableAccess extends Error {
+    readonly table: string;
+    readonly operation: string;
+    readonly _tag = "UndeclaredTableAccess";
+    constructor(table: string, operation: string);
+}
+
 /** The store surface an inverse op needs (a subset of the framework DataStore). */
 export declare interface UndoApplyStore {
     insert(table: string, row: Record<string, unknown>): Promise<unknown> | unknown;
@@ -12806,15 +13044,12 @@ export declare type WorkflowAdmissionOutcome = {
      *  that filled up on this arrival. */
     readonly payload: unknown;
     /** Dispatch the resident submission and return its durably acknowledged
-     * execution ID. Recovery owns retries; callers must not execute separately. */
-    readonly accept: () => Promise<string>;
-} | {
-    readonly kind: 'queued';
-    readonly receiptId: string;
-    readonly intentId: string;
-    readonly mode: string;
-    readonly dueAt: number;
-} | {
+     * execution ID — or, when the dispatch went unacknowledged, the receipt
+     * recovery completes it under (`mode: 'unacknowledged'`). That start may
+     * still run, so it is neither an execution ID nor a failure. Recovery owns
+     * retries; callers must not execute separately. */
+    readonly accept: () => Promise<string | WorkflowQueuedAdmission>;
+} | WorkflowQueuedAdmission | {
     readonly kind: 'dropped';
     readonly retryAfterMs: number;
 } | {
@@ -13118,6 +13353,15 @@ export declare class WorkflowPayloadError extends Error {
     missingFields: ReadonlyArray<string>, detail: string);
 }
 
+/** A start the caller follows through its receipt instead of an execution ID. */
+export declare interface WorkflowQueuedAdmission {
+    readonly kind: 'queued';
+    readonly receiptId: string;
+    readonly intentId: string;
+    readonly mode: string;
+    readonly dueAt: number;
+}
+
 export declare interface WorkflowQueuedControlOptions {
     readonly callerContext?: WorkflowCallerContext;
     readonly cause?: NonNullable<WorkflowControlRequest['cause']>;