@substrat-run/adapter-cloudflare 0.162.0 → 0.164.0

package/dist/scope-do.d.ts

@@ -59,6 +59,42 @@ type ProjectedRoleRow = {
     source: string;
     holder?: 'person' | 'system' | null;
 };
+/**
+ * #2555: the directory's current permission state for one scope, as a fan-out projects it
+ * (`tenantProjection` and the vertical's connection keys), written by a control-plane-full load in
+ * its own transaction after the dump's rows are in. The roles are judged there against the state
+ * the dump has just brought, with `judge`'s reservations joined with the class's.
+ */
+export type LoadProjection = {
+    tenantId: TenantId;
+    roles: ProjectedRoleRow[];
+    tuples: {
+        subject: string;
+        relation: string;
+        object: string;
+        expires_at: string | null;
+        revoked_at: string | null;
+    }[];
+    entitlements: {
+        entitlement_key: string;
+        expires_at: string | null;
+        quota: number | null;
+        plan: string | null;
+    }[];
+    identities: {
+        provider: string;
+        external_id: string;
+        principal_id: string;
+        scope_id: string | null;
+    }[];
+    connectionKeys: {
+        connection_id: string;
+        provider: string;
+        key_id: string;
+        public_key: string;
+    }[];
+    judge: RoleJudge;
+};
 /**
  * #2531: a load's role repair, judged and written in the load's own transaction after the dump's
  * rows are in: the vertical's role set for `tenantId`, projected as `projectRolesLocal` projects it.

package/dist/scope-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAmDL,KAAK,QAAQ,EAWd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EA8DL,KAAK,mBAAmB,EASxB,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAmHtB,MAAM,sBAAsB,CAAC;AAoD9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAwBL,kBAAkB,EAiFnB,MAAM,sBAAsB,CAAC;AA2B9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAoFD,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAgB5E;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEnE,iDAAiD;AACjD,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvH;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AA4rBjG;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAmBtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,gHAAgH;AAChH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA2B9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACzD;;;;GAIG;AACH,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,mBAAmB,CAAA;CAAO,GAClD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAAC,UAAU,CAAC,CA67P7E"}
+{"version":3,"file":"scope-do.d.ts","sourceRoot":"","sources":["../src/scope-do.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAmDL,KAAK,QAAQ,EAWd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EA+DL,KAAK,mBAAmB,EASxB,KAAK,SAAS,EAsBd,KAAK,kBAAkB,EAEvB,KAAK,gBAAgB,EAyHtB,MAAM,sBAAsB,CAAC;AAoD9B,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAwBL,kBAAkB,EAiFnB,MAAM,sBAAsB,CAAC;AA2B9B;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC;IACvC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAoFD,oFAAoF;AACpF,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAgB5E;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AASnE,iDAAiD;AACjD,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvH;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IACtH,YAAY,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IAClH,UAAU,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;IACvG,cAAc,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAClG,KAAK,EAAE,SAAS,CAAC;CAClB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AA0sBjG;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AAmBtD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS,CAOxD;AAED,gHAAgH;AAChH,OAAO,EAAE,kBAAkB,EAAE,CAAC;AA2B9B,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACzD;;;;GAIG;AACH,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,mBAAmB,CAAA;CAAO,GAClD,KAAK,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,KAAK,aAAa,CAAC,UAAU,CAAC,CA6gQ7E"}

package/dist/scope-do.js

@@ -2,7 +2,7 @@ import { REWIND_REFUSED } from './rewind-refusal.js';
 import { SYSTEM_DOOR_MOVED } from './system-door.js';
 import { DurableObject } from 'cloudflare:workers';
 import { ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, domainEvent, domainEventInput, eventId, instant, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, toWireFailure, grantRefFromProof, principalId, principalBecomeCapabilityInput, scopeId as scopeIdOf, tenantId as tenantIdOf, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, MAX_PENDING_SWEEP_RUNS, SWEEP_RUNS_KIND, SCOPE_DUMP_PAGE_MAX_BYTES, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, listLimitOf, pageOf, countedPageOf, requestFingerprint, substratError, errorCodeOf, assertReplayableDump, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleErasurePlan, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, topUpEntityGrantShapes, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, SCOPE_SEATED_ROLES_SQL, inUnitRoleRefusal, reservedRoleSetRefusedRole, reservedGrantRefusal, reservedRoleRefusal, reservedShapeRefusal, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_BYTES_SQL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, queueAttachmentTextBackfill, startAttachmentTextBackfill, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
+import { ulid, DO_SQL_LIMITS, unknownRoleError, createUlid, assertAllowed, ConnectionSealingKeyUnavailableError, noSealingKeyMessage, sealTo, assertReadOnlyQuery, entitlementDenial, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleErasurePlan, redactSubjectScopeText, assertRowLimit, assertRowOffset, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_LEASE_EXPIRED_NOTE, JOB_STEP_RECORD_SQL, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, topUpEntityGrantShapes, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, assertModuleDeclared, noteDeclaredKeys, noteReservedKeys, SCOPE_SEATED_ROLES_SQL, inUnitRoleRefusal, loadedRoleSetRefusedRole, reservedRoleSetRefusedRole, reservedGrantRefusal, reservedRoleRefusal, reservedShapeRefusal, effectiveRoleGrantQuery, switchRecordedOff, switchSystemSchedules, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, PermissionDenied, assertImpersonationWrites, assertModuleEnqueueableKind, impersonationStampOf, createAtomic, NotSearchable, isSearchIndexTable, searchIndexPlans, NotListable, listIndexPlans, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSetDivergence, migrationSteps, planMigrations, listQuery, cursorOf, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, ATTACHMENT_BYTES_SQL, ATTACHMENT_CONDEMNED_DDL, ATTACHMENT_SWEEP_LICENCE_DDL, ATTACHMENT_SWEEP_LICENCE_TABLE, WIRE_NONCE_DDL, WIRE_NONCE_FULL, claimWireNonceIn, isWireNonceTable, isWireNonceWrite, clearOrphanSweepLicence, condemnLicensedOrphanAttachments, consumeOrphanSweepLicence, licensedOrphanIds, recordOrphanSweepLicence, refuseUnlicensedOrphanSweep, refuseCondemnedAttachment, refuseCondemnedInDump, rowlessAttachmentIds, attachmentRecordOfRow, enqueueAttachmentText, reconcileAttachmentText, queueAttachmentTextBackfill, startAttachmentTextBackfill, recordAttachmentText, searchAttachments, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, assertPermissionKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, exportedSinceQuery, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, SYSTEM_DOOR_WAIT, ancestorsWithin, } from '@substrat-run/kernel';
 import { isUpgradeRequest, readSubscription, LIVE_DECIDE_ATTEMPTS, LIVE_FANOUT_LIMIT, LIVE_PRINCIPAL_HEADER, LIVE_SCOPE_HEADER, LIVE_SUBSCRIBE_PATH, LIVE_TENANT_HEADER, LIVE_WITHIN_HEADER, LIVE_EXPIRES_HEADER, LIVE_CLOSE, LIVE_SOCKETS_PER_PRINCIPAL, decodeLiveWithin, liveInstant, liveRefusal, liveRefusalStatus, } from './live-reads.js';
 import { replyOf } from './do-reply.js';
 import { OperationQueue } from './serialization.js';
@@ -390,6 +390,10 @@ const KERNEL_DDL = `
   -- #119: the kernel's authorization for one archive/trash move, read by the derived update
   -- trigger. Shared with the other adapter from @substrat-run/kernel; the comments are there.
   ${ENTITY_STATE_MOVES_DDL}
+  -- RFC wire-signing §4: the nonces of signed calls this scope accepted, and their count.
+  -- Store-local: never dumped, written on the bookkeeping path. Shared with the pure adapter
+  -- from @substrat-run/kernel, where the column comments are.
+  ${WIRE_NONCE_DDL}
 `;
 /**
  * Workers RPC carries a plain `Error`'s MESSAGE faithfully and nothing else. A custom
@@ -425,6 +429,8 @@ function kernelEmit(ctx, event) {
         throw new Error('kernelEmit: not an operation context this host built');
     write(event);
 }
+/** #2555: the `_substrat_meta` keys a control-plane-full load keeps from the destination. */
+const PERMISSION_FLAG_KEYS = ['permission_source', 'entitlements_enforced'];
 /** #2450: a commit or a page naming a stage this store no longer holds. */
 const STAGE_GONE = 'the staged load is not here any more (another carry replaced it, or it was already loaded); nothing was loaded';
 /** A competing page zero must leave the stage a live copy owns intact. */
@@ -551,11 +557,11 @@ class WriteRevision {
             if (write)
                 this.written++;
             if (this.keeping && write) {
-                // Bookkeeping takes the copy-marker insert and the lifecycle delivery (#1713) and nothing
-                // else: any other write here would be one the revision never saw, which is the hole this
+                // Bookkeeping takes the copy-marker insert, the lifecycle delivery (#1713) and the wire
+                // nonce claim's own statements (RFC wire-signing §4) and nothing else: any other write here would be one the revision never saw, which is the hole this
                 // class exists to close.
-                if (!isCopyMarkInsert(query) && !isLifecycleWrite(query)) {
-                    throw substratError('internal', `the bookkeeping path takes only the copy-marker insert and the lifecycle delivery (#1722, #1713), not: ${query.slice(0, 80)}`);
+                if (!isCopyMarkInsert(query) && !isLifecycleWrite(query) && !isWireNonceWrite(query)) {
+                    throw substratError('internal', `the bookkeeping path takes only the copy-marker insert, the lifecycle delivery and the wire nonce claim (#1722, #1713), not: ${query.slice(0, 80)}`);
                 }
                 return raw.exec(query, ...bindings);
             }
@@ -582,8 +588,9 @@ class WriteRevision {
      * r10). That only ever restricts what the store may run and changes no data, so it advances no
      * write revision: a backfill that marks a carry's source between its export and its wipe must
      * not read as a write the carry did not copy (that would keep the copy for nothing). Enforced,
-     * not trusted: any write in here but the marker insert (`isCopyMarkInsert`) or the lifecycle
-     * delivery (`isLifecycleWrite`, #1713) throws. Clearing a
+     * not trusted: any write in here but the marker insert (`isCopyMarkInsert`), the lifecycle
+     * delivery (`isLifecycleWrite`, #1713) or a wire nonce claim (`isWireNonceWrite`, RFC
+     * wire-signing §4: a nonce describes a call this store accepted, not its data) throws. Clearing a
      * marker is NOT bookkeeping (r11): it loosens the store, so it is a write a carry fences on.
      */
     bookkeeping(run) {
@@ -3897,9 +3904,9 @@ options = {}) {
          * The answer is a fixed sentence naming the role key only, whoever reads it. The rule's own
          * wording is the pre-check's, which a caller still asks first for the common case.
          */
-        refuseRoleSetInUnit(tenantId, roles, judge) {
+        refuseRoleSetInUnit(tenantId, roles, { judge, loaded }) {
             const state = this.roleStateSync(tenantId);
-            const refused = reservedRoleSetRefusedRole(roles, { reserved: new Set([...judge.reserved, ...this.reservedKeys]), declared: new Set([...judge.declared, ...this.declaredKeys]) }, { roles: state.roles, seated: new Set(state.seated), ...(state.dropped ? { dropped: state.dropped } : {}) });
+            const refused = (loaded ? loadedRoleSetRefusedRole : reservedRoleSetRefusedRole)(roles, { reserved: new Set([...judge.reserved, ...this.reservedKeys]), declared: new Set([...judge.declared, ...this.declaredKeys]) }, { roles: state.roles, seated: new Set(state.seated), ...(state.dropped ? { dropped: state.dropped } : {}) });
             if (refused === null)
                 return;
             const error = substratError('forbidden', inUnitRoleRefusal(refused.key));
@@ -4929,6 +4936,24 @@ options = {}) {
             });
             return marked;
         }
+        /**
+         * RFC wire-signing §4: spend a signed call's nonce in this scope's own store, the claim the
+         * platform's entry makes through the vertical's host (`claimWireNonceLocal`) after every other
+         * check of the envelope has passed. `true` once per nonce; `false` for one already spent, or a
+         * claim after `until`. A store at its cap throws, after its purge committed, which the entry
+         * answers as the store's failure. In storage, so it survives an eviction. Bookkeeping, like the
+         * copy marker: a nonce describes a call this store accepted, not its data, so it advances no
+         * write revision a carry fences on, and no dump carries it.
+         */
+        claimWireNonce(nonce, until) {
+            let answer;
+            this.revision.transactionSync(() => {
+                answer = this.revision.bookkeeping(() => claimWireNonceIn(this.switchSql(), nonce, until, Math.floor(Date.now() / 1000)));
+            });
+            if (answer === 'full')
+                throw new Error(WIRE_NONCE_FULL);
+            return answer;
+        }
         /**
          * Clear a mistaken copy classification (#2005, `clearCopyMarker`); a load's events mark stays,
          * so copied work still never runs here (#2009). A
@@ -5328,7 +5353,8 @@ options = {}) {
          * The tables a dump carries, by name. The derived search index (#827) is excluded: its shadow
          * tables cannot be replayed — this host answers "object name reserved for internal use" — and
          * it is recomputable, so `importDump` rebuilds it from the loaded rows. A dump carries the rows,
-         * never the index over them. A staged load's own tables (#2450) are this store's, not its data.
+         * never the index over them. A staged load's own tables (#2450) are this store's, not its data,
+         * and so is the wire nonce store (RFC wire-signing §4): a load builds it empty.
          */
         dumpTableDefs() {
             return this.sql
@@ -5336,7 +5362,7 @@ options = {}) {
               WHERE type = 'table' AND name NOT GLOB 'sqlite_*' AND name NOT GLOB '_cf_*'
                 AND name NOT GLOB '${STAGE_GLOB}' AND sql IS NOT NULL
               ORDER BY name`)
-                .toArray().filter(({ name }) => !isSearchIndexTable(name));
+                .toArray().filter(({ name }) => !isSearchIndexTable(name) && !isWireNonceTable(name));
         }
         /**
          * One page of `exportDumpStamped` (#2450): the tables in the same order, each table's rows in
@@ -5609,7 +5635,7 @@ options = {}) {
          * in memory at once. `stageId` names the staged load the rows come from: checked inside the
          * load's transaction, and its tables dropped in it once the rows are in.
          */
-        async loadTables(tables, destScopeId, { switchOff, sourceScopeId, exact, loadStamp, expect, resolveKept, markCopy, provisionedFor, fence, roleRepair, onRolesProjected, } = {}, stageId) {
+        async loadTables(tables, destScopeId, { switchOff, sourceScopeId, exact, loadStamp, expect, resolveKept, markCopy, provisionedFor, fence, roleRepair, onRolesProjected, projection, keepPermissionFlags, } = {}, stageId) {
             // The WHOLE drop-then-replay runs under deferred foreign keys, in one transaction.
             //
             // Two distinct FK hazards, and both need the deferral — the second is why it cannot
@@ -5632,8 +5658,10 @@ options = {}) {
             // rather than failing a restore over data about to be recomputed.
             // Matched without case, as SQLite resolves a table name (#1883 review).
             // #1686: a copy into another scope id loads no capability rows; a same-scope restore keeps them.
+            // The wire nonce store is this store's own (RFC wire-signing §4): never replayed, so a load
+            // starts it empty.
             const replayable = tables
-                .filter((t) => !isSearchIndexTable(t.name.toLowerCase()))
+                .filter((t) => !isSearchIndexTable(t.name.toLowerCase()) && !isWireNonceTable(t.name))
                 .map((t) => (loadDropsRowsOf(t.name, destScopeId, sourceScopeId) ? { ...t, rows: () => [] } : t));
             // The dump is untrusted input (#1143). `SqlStorage.exec` runs every statement
             // in the string it is given, so a `ddl` with anything appended to its CREATE
@@ -5649,7 +5677,10 @@ options = {}) {
             // #2531: a reaped store takes no role repair, judged or not, as `projectInUnit` drops a
             // projection there: the load comes back with no roles, no receipt and no enforcement flip,
             // as it did before the repair rode the load. Read before the unit, as `projectInUnit` reads it.
-            const repair = roleRepair && !(await this.isReaped()) ? roleRepair : undefined;
+            // #2555: the directory's projection is dropped there too, for the same reason.
+            const reaped = roleRepair || projection ? await this.isReaped() : false;
+            const repair = roleRepair && !reaped ? roleRepair : undefined;
+            const directory = projection && !reaped ? projection : undefined;
             const switched = await this.revision.transaction(async () => {
                 // #1722: first, before any read: a store a reap has since emptied must refuse the late load
                 // too, and the check is against this store's clock, inside the load's own transaction.
@@ -5679,6 +5710,8 @@ options = {}) {
                     return { name: t.name, columns: ['id'], rows: at < 0 ? [] : Array.from(t.rows(), (row) => [row[at]]) };
                 }));
                 const receiptBefore = this.provisionedFor();
+                // #2555: this store's own permission flags, read before the drops take them.
+                const flagsBefore = keepPermissionFlags ? PERMISSION_FLAG_KEYS.map((key) => [key, this.metaValue(key)]) : [];
                 if (provisionedFor !== undefined && receiptBefore !== null && receiptBefore !== provisionedFor) {
                     const refused = substratError('conflict', tenantReceiptRefusal(receiptBefore, provisionedFor));
                     tenantRefusals.add(refused);
@@ -5776,6 +5809,15 @@ options = {}) {
                     if (receipt !== null) {
                         this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)`, PROVISIONED_FOR_KEY, receipt);
                     }
+                    // #2555: which reader the checker uses, and whether entitlements are enforced, are this
+                    // store's, as its receipt is: the dump's values describe the scope it was captured from,
+                    // when it was. A flag this store did not hold stays unset. The projection below may then
+                    // move them as a fan-out would.
+                    for (const [key, value] of flagsBefore) {
+                        this.sql.exec(`DELETE FROM _substrat_meta WHERE key = ?`, key);
+                        if (value !== null)
+                            this.sql.exec(`INSERT INTO _substrat_meta (key, value) VALUES (?, ?)`, key, value);
+                    }
                     // #1722: whatever stamp an export read here no longer describes this store, so every load
                     // replaces it: with the carry's own, or with none. And the write revision moves on from
                     // where it stood before the drops, so it never goes back.
@@ -5829,9 +5871,19 @@ options = {}) {
                     // seats the dump has just brought (`refuseRoleSetInUnit`), then projected exactly as
                     // `projectRolesLocal` projects it. A refusal rolls the whole load back, so the scope keeps
                     // its rows and a staged load keeps its stage; an admitted load lands with its repair.
-                    if (repair) {
+                    // #2555: a control-plane-full load writes the directory's current state the same way, in the
+                    // same place: the tenant's roles, tuples, entitlements, identity links and the vertical's
+                    // connection keys, each a full replace as a fan-out writes it, so nothing the directory has
+                    // since revoked comes back with the dump. Scope-level tuples (the seats) are not touched.
+                    // The roles are judged only where the loaded state has a part in them (`loaded`).
+                    if (repair || directory) {
                         try {
-                            this.projectionBody(repair.judge, repair.tenantId, repair.roles, []);
+                            if (repair)
+                                this.projectionBody({ judge: repair.judge }, repair.tenantId, repair.roles, []);
+                            else if (directory) {
+                                const { judge, tenantId, roles, tuples, entitlements, identities, connectionKeys } = directory;
+                                this.projectionBody({ judge, loaded: true }, tenantId, roles, tuples, entitlements, undefined, identities, connectionKeys);
+                            }
                         }
                         catch (e) {
                             // The projection's own tenant refusal (its receipt check) is a tenant refusal of the
@@ -5914,6 +5966,35 @@ options = {}) {
         async importDumpJudged(tables, destScopeId, opts, roleRepair) {
             return this.judgedLoad((onRolesProjected) => this.checkedLoad(() => this.importDump(tables, destScopeId, { ...opts, roleRepair, onRolesProjected })));
         }
+        /**
+         * #2555: a control-plane-full restore or import. `importDump`, with this store's permission flags
+         * kept through it and, when `projection` is given (a host that projects permissions into its
+         * scopes), the directory's current state judged and projected last in the load's transaction. A
+         * refusal rolls the whole load back. The role judgement's own is answered as `refusedRoles`, so
+         * the host can tell it from any other; every other is answered as data so its code survives the
+         * hop. A method of its own, so a host meeting a ScopeDO from before it is refused by the
+         * runtime, nothing loaded, rather than loading the dump's permission state as is.
+         */
+        importDumpProjected(tables, destScopeId, opts, projection) {
+            return replyOf(async () => {
+                try {
+                    return {
+                        switchedOff: await this.importDump(tables, destScopeId, {
+                            switchOff: opts.switchOff,
+                            sourceScopeId: opts.sourceScopeId,
+                            exact: opts.exact,
+                            keepPermissionFlags: true,
+                            ...(projection ? { projection } : {}),
+                        }),
+                    };
+                }
+                catch (e) {
+                    if (e instanceof Error && roleRefusals.has(e))
+                        return { refusedRoles: e.message };
+                    throw e;
+                }
+            });
+        }
         /** #2531: `commitStagedDumpChecked` with the role repair in the load's transaction (`importDumpJudged`). */
         async commitStagedDumpJudged(stageId, destScopeId, opts, roleRepair) {
             return this.judgedLoad((onRolesProjected) => this.commitStagedDumpChecked(stageId, destScopeId, { ...opts, roleRepair, onRolesProjected }));
@@ -7176,13 +7257,13 @@ options = {}) {
             // The whole body is synchronous storage work, so it is ONE transaction (#1738): the queue
             // serializes but does not roll back, and a role insert that throws part-way must not leave
             // the receipt (or a half-replaced role set) behind for `servesTenant` to trust.
-            return this.queue.enqueue(() => this.revision.transactionSync(() => this.projectionBody(judge, ...args)));
+            return this.queue.enqueue(() => this.revision.transactionSync(() => this.projectionBody(judge && { judge }, ...args)));
         }
         /**
          * The projection's writes, synchronous, for a unit the caller holds: `projectInUnit`'s, or a
          * load's (`loadTables`, #2531), so a restore's role repair lands in the load's transaction.
          */
-        projectionBody(judge, ...[tenantId, roles, tuples, entitlements, scopeTuples, identities, connectionKeys, switchOff, serviceSubjects]) {
+        projectionBody(judgement, ...[tenantId, roles, tuples, entitlements, scopeTuples, identities, connectionKeys, switchOff, serviceSubjects]) {
             // #1738: the receipt `servesTenant` reads. First writer wins: absent or equal is written,
             // a receipt for ANOTHER tenant refuses the whole projection (K-3), before a single row
             // moves, so a misdirected projection can never re-point a scope or leave its roles behind.
@@ -7198,8 +7279,8 @@ options = {}) {
                     : `applyProjection ${foreignTenant(held, tenantId)}`);
             }
             // #2531: judged before the first write of the unit, on what the scope holds now.
-            if (judge)
-                this.refuseRoleSetInUnit(tenantId, roles.map(roleShapeOfRow), judge);
+            if (judgement)
+                this.refuseRoleSetInUnit(tenantId, roles.map(roleShapeOfRow), judgement);
             // Written before any guard below can return early, so every projection leaves it.
             this.sql.exec(`INSERT OR REPLACE INTO _substrat_meta (key, value) VALUES (?, ?)`, PROVISIONED_FOR_KEY, tenantId);
             // #2531: a role the new set leaves out is TOMBSTONED, not deleted: it keeps the keys and the