@substrat-run/adapter-sqlite 0.146.0 → 0.148.0

package/dist/index.js

@@ -1,16 +1,17 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import Database from 'better-sqlite3';
-import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
-import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, } from '@substrat-run/kernel';
+import { accessLogEntry, adminLogEntry, delegatedReadParams, operationSeriesCount, opsFailureEntry, opsFailureFingerprint, issueEntry, FRESHNESS_HEARTBEAT_MINUTES, sweepRunEntry, modelUsageEntry, ATTACHMENT_ADDED, ATTACHMENT_REMOVED, attachmentRecord, createTenantInput, domainEvent, domainEventInput, exportReadInput, importBatch, importCursorMove, exportsOfManifestJson, assertNoBindingShapeBreak, importsOfManifestJson, entitlementGrant, entitlementGrantInput, eventId, meterReading, platformRequestInput, platformRequestId, MAX_PENDING_PLATFORM_REQUESTS, identityLink, identityPool, instant, isSubstratError, connection, capabilityGrant, connectionGrant, connectionGrantRecord, connectionSecret, systemGrant, systemSwitch, systemSwitchRecord, peerSwitch, verticalCaller, verticalSlug as verticalSlugOf, subjectRef, requestFingerprint, createConnectionInput, connectLinkFilter, connectLinkKey, consumeConnectLinkInput, mintConnectLinkInput, projectedConnectionGrant, projectedConnectionKey, moduleManifest, createOrgInput, promotionAcknowledgement, bindAcknowledgement, bindHostnameInput, channelHistoryEntry, hostnameBinding, publishVersionInput, AUTO_ADMISSION_NOTE, routeTarget, ROUTE_SCOPE_HOSTNAMES_MAX, registerVerticalInput, vertical as verticalSchema, verticalChannel, verticalVersion, objectRef, entityObjectRef, assertModuleEmittableType, assertKernelAuthoredType, grantRefFromProof, org as orgSchema, orgMembership, principalId, resolvedIdentity, identityMembership, roleDefinition, scope as scopeSchema, tenant as tenantSchema, tenantRole, principalBecomeCapabilityInput, subjectShredReceipt, SCOPE_TABLE_PAGE_DEFAULT, SCOPE_TABLE_PAGE_MAX, SCOPE_QUERY_ROW_MAX, verticalServingState, callsOfManifestJson, outboundOfManifestJson, listLimitOf, pageOf, countedPageOf, SCOPE_GATE_REASONS, substratError, assertReplayableDump, delegatedReadRecord, ownerTransferAudit, memberChangeAudit, peerBindingAudit, connectionBindingAudit, copyMarkAudit, redrainEventsInput, REDRAIN_BATCH, } from '@substrat-run/contracts';
+import { actorOf, asPrincipal, assertAllowed, assertNoSecret, assertPermissionKey, CAPABILITY_DDL, UPLOAD_LINK_DDL, createAttachmentVerbs, inspectUploadLink, redeemUploadLinkInTransaction, COPY_ORIGIN_DDL, ENTITY_STATE_MOVES_DDL, CAPABILITY_EXCHANGE_OPERATION, CAPABILITY_BECOME_MINT_OPERATION, becomeMintCheck, mintBecomeCapabilityAsPrincipal, revokeBecomeCapabilityAsPrincipal, readBecomeLinkStates, ENTITY_UNBIND_OPERATION, allowedFor, unbindEntityHolderBounded, capabilityAttachmentWriteRefused, capabilityTokenHash, createCapabilityVerbs, createEntityEdgeVerbs, createEntityStateVerbs, createTrashedReads, CONTINUATION_POSITION_CAP, visibleContinuation, searchStateWhere, uncheckedView, addStatePlans, addUpdatedStampPlans, watchUpdatedStamps, entityStateMigrations, assertNoCallerPurge, isUnreachableParent, heldPurgePass, purgeDueOf, purgeHeldBy, lifecycleRefusal, purgeOnlyKeysOf, purgeReportOf, purgeStillDue, refuseTrashedTarget, assertBoundOperations, registerTrashTargets, runPurgePass, withheldKeysFor, statefulTablesOf, afterMigration, afterRuntimeDdl, derivesAnything, repairDerivedObjects, StateColumnLost, exchangeCapability as exchangeCapabilitySecret, guardSecrets, mintBecomeCapability, plausibleSessionToken, readCapabilityPage, redactSecrets, redactSecretText, moduleLog, consoleLogSink, asyncInvocationId, asyncLinePass, consoleInvocationLineSink, resolveCapabilitySession, revokeCapabilityAsPlatform, assertReadOnlyQuery, attachmentBlobKey, attachmentSha256, entitlementDenial, requiredEntitlementFor, foldMeterReading, guardSpine, guardSqlLimits, DO_SQL_LIMITS, tooManyResultColumns, tooManyTableColumns, parseValidationRecords, resolveScopeRecord, ulid, ISSUE_RETENTION_DAYS, telemetryRetentionStatements, FINDINGS_DDL, SCOPE_STORAGE_DDL, forgetScopeStorage, listScopeStorageAttemptRows, listScopeStorageRows, listScopeStoreStorageRows, pruneScopeStorageRows, recordScopeStorageRows, CONNECT_LINKS_DDL, consumeConnectLinkRow, insertConnectLink, listConnectLinks as listConnectLinkRows, readConnectLink, restoreConnectLinkRow, revokeConnectLinkRow, createFindingRule, findingOfOpsFailure, findingOfSweepRun, pruneFindings, listFindingRules, listFindings, observeFinding, revokeFindingRule, setFindingStatus, assertRowLimit, assertRowOffset, OPS_FAILURE_RETENTION_DAYS, SWEEP_RUN_RETENTION_DAYS, SWEEP_RUNS_INTENT_INDEX, sweepRunsIntentHasKind, MODEL_USAGE_RETENTION_DAYS, foldModelUsage, backoffAt, platformRequestHistoryQuery, platformRequestOf, PLATFORM_REQUEST_COLUMNS, PLATFORM_REQUEST_REDACTION_SQL, platformRequestRedactionParams, platformRequestRedactionQuery, intentPayloadCarriesSubject, redactSubjectJobRuns, eraseSubjectFromModules, moduleRowsErased, moduleErasurePlan, redactSubjectScopeText, redactSubjectDirectoryText, ISSUE_EXEMPLAR_OWNER_BACKFILL_SQL, issueExemplarOwner, JOB_RUN_PATCH_SQL, JOB_RUN_CLAIM_SQL, JOB_RUN_RENEW_SQL, JOB_RUN_BEGIN_SQL, JOB_RUN_MISS_SQL, JOB_RUN_MISS_SETTLE_SQL, admissionMissOutcome, JOB_STEP_RECORD_SQL, JOB_LEASE_EXPIRED_NOTE, assertLeaseMs, DELIVERY_ERROR_REDACTION_SQL, REDACTED_DELIVERY_NOTE, seatScopeTuple, applyScopeRoleChange, changeScopeRole, revokeScopeRoles, scopeRoleHolders, admitPeer, peerCallerAt, collectPeers, peerSeats, resolveVerticalInstanceFrom, resolvePeerInstanceFrom, peerVerticalSpellings, samePeerVertical, peerGrantsStatus, systemGrantsStatus, systemScheduleState, systemSwitchedOff, systemSwitchedOffMessage, tenantSystemSwitchedOffMessage, PEER_SWITCHES_DDL, PEER_BINDINGS_DDL, SWITCH_OWED_DDL, SWITCH_FENCES_DDL, TABLE_OWNERS_DDL, assertMigrationLeavesLedgerAlone, recordOwnershipSteps, runMigrationStatements, executableSqlStatements, blankSqlComments, recordWriteSuperseded, switchFencesOf, switchSupersededMessage, SWITCH_KINDS, SYSTEM_SWITCHES_DDL, forgetSwitchesOf, listSystemSwitchRecords, moveSwitch, reassertActionOf, reassertEntry, reassertOffRow, recordSwitchedOff, recordSwitchedOn, restoreSwitchRecord, scopesSwitchedOffFor, switchActionOf, switchAuditSubject, recordAuditOutcome, auditedCapabilityRevoke, auditWarningOf, switchNotFoundMessage, switchRecordsOf, switchedOffOf, switchesBackfillSqlOf, switchesTableExists, tenantHeldOf, tenantHoldsGrant, inUnitMovesToAudit, staleCarryRevertRow, staleCarryReverts, withRecorded, VERSION_MIGRATIONS_DDL, VERTICAL_SCOPE_STORES_DDL, forgetVerticalScopeStores, indexVersionScopeStores, kindDeclarationsOf, verticalScopeStoresOf, STORE_KIND_RELEASES_DDL, beginStoreKindRolloutIn, finishStoreKindRolloutIn, holdStoreKindIn, recordStoreKindReleaseIn, releaseStoreKindHoldIn, storeKindReleaseIn, storeKindStateIn, splitManifestMigrations, splitVersionMigrationsBatch, versionMigrationsOf, writeVersionMigrations, denialListQuery, refusalListQuery, mapRefusalRow, denialSummaryQuery, denialTotalsQuery, DENIAL_WINDOW_QUERY, mapDenialRow, mapDenialSummaryBuckets, IMPERSONATION_COLUMNS, IMPERSONATION_DDL, ImpersonationRefused, assertImpersonationWrites, assertModuleEnqueueableKind, assertSessionUsable, impersonationByIdQuery, impersonationListQuery, impersonationRowValues, impersonationStampOf, mapImpersonationRow, newImpersonationSession, resolveRetryPolicy, executorOutcomeOf, isDeliveryRefusal, refusalJournalText, membershipFencesBackfillSql, MEMBERSHIP_FENCES_DDL, membershipFencesTableExists, MEMBERSHIP_FENCE_SINCE_SQL, RAISE_MEMBERSHIP_FENCE_SQL, memberAddedAudit, orgChangeBound, tenantCoverage, isSecretBoxConfigured, unconfiguredSecretBox, createSubjectKeys, generateSealingKeyPair, noSealingKeyMessage, openSealed, sealTo, ConnectionSealingKeyUnavailableError, PermissionDenied, createAtomic, NotSearchable, NotListable, listIndexMigrations, listIndexPlans, listQuery, cursorOf, moduleMigrations, MIGRATION_DIGEST_FENCE_DDL, MIGRATION_DIGEST_MARK_LEGACY, assertJournalDumpCoherent, assertMigrationSql, migrationDivergence, migrationFailedError, migrationSteps, planMigrations, isSearchIndexTable, searchIndexMigrations, searchIndexPlans, searchLimit, searchMatchExpression, searchQuery, ATTACHMENT_TEXT_DDL, assertAttachmentExtractors, resolveAttachmentTextBounds, assertJobRegistrable, attachmentRecordOfRow, attachmentTextJob, enqueueAttachmentText, ATTACHMENT_TEXT_BACKFILL_JOB, ATTACHMENT_TEXT_JOB, kernelJobFor, queueAttachmentTextBackfill, startAttachmentTextBackfill, attachmentTextBackfillJob, reconcileAttachmentText, recordAttachmentText, searchAttachments, entityVersionQuery, entityVersionOf, assertIfMatch, OUTBOX_ENTITY_INDEX, SCHEDULE_STATE_DDL, SCHEDULE_STATE_REBUILD, scheduleStateHasKind, VERTICAL_EVENTS_DDL, EXPORT_HOPS_SQL, emptyImportResult, IMPORT_CURSORS_SQL, IMPORT_CURSOR_OF_SQL, OUTBOX_MARK_SQL, emittedSinceQuery, emittedReportOf, EMITTED_REPORT_CAP, exportedSinceQuery, IMPORT_CURSOR_ADVANCE_SQL, IMPORT_RECORD_SQL, moveImportCursor, importCursorSourceOf, exportBreaksOf, exportBreakRefusal, bindExportBreaksOf, bindExportBreakRefusal, scopeMoveOf, runningVersionOf, isPrimaryScope, PROVISIONED_VERSIONS_SQL, installsReconciledOf, strandJudgmentsOf, provisionedVersionsParams, boundShapesColumn, boundShapesOfColumn, installReconciled, CrossVerticalRegistry, exportReadPlan, exportReadQuery, planExportBatch, withheldNote, JOB_RUN_DDL, JOB_RUN_DUE_AT, jobRunListLimit, jobRunOf, runDueJobRuns, startJobRun, IDEMPOTENCY_DDL, REFUSALS_TABLE_DDL, REFUSALS_INDEX, refusalInsert, refusalOf, markGuardRefusal, REFUSALS_REBUILD, refusalsAdmitGuards, assertIdempotencyKey, idempotencyLookupQuery, idempotencyPruneStatement, idempotencyRecordStatement, idempotencyOptedOutMessage, replayFor, globalFetch, createUlid, facetEvents, readHistory, walkEventCause, walkEventEffects, assertRedrainWindow, readInvocation, readDeadLetters, readLifecycleFlow, readOperationSeries, domainEventOf, readUndrainedOutbox, undrainedEventsOf, connectorCallRecord, noopConnectorCallRecorder, recordConnectorCall, settleConnectionUse, unknownRoleError, callReservedStoreOperation, callScopeStore, observeStoreCall, replayStoreErasures, scopeStoreLifecycleOf, scopeStoreRunnersOf, } from '@substrat-run/kernel';
 import { attributedView, delegatedRevokeSql, writeExplicitTupleIn, grantEntityShapeIn, shapeTopUpBatch, topUpEntityGrantShapes, settlePlatformRequestIn, } from '@substrat-run/kernel';
 import { ADMIN_LOG_INDEXES_SQL, SETTLE_INTENT_SQL, SETTLE_OUTCOME_SQL, settleOutcomeParamsOf, readAuditedOperations, unknownOutcomeOf, } from '@substrat-run/kernel';
-import { INERT_SCOPE_REASON, isPrimaryScopeRow } from '@substrat-run/kernel';
-import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, copyBackfillParams, copyBackfillRefusal, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, scopeScriptCopyOf, } from '@substrat-run/kernel';
+import { INERT_SCOPE_REASON, isPrimaryScopeRow, UPLOAD_LINK_WRONG_TARGET } from '@substrat-run/kernel';
+import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, copyBackfillParams, copyBackfillRefusal, SUBJECT_ERASURE_CLAIM_SQL, subjectErasureClaimParams, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, scopeScriptCopyOf, } from '@substrat-run/kernel';
 import { GRANT_CHILDREN_INDEX_DDL, SHAPE_MARKER_INDEX_DDL, grantedEntitiesForContext } from '@substrat-run/kernel';
 import { LEGACY_SCOPE_ROWS_BACKFILL, assertSpineTablesBuilt, capabilitiesForLoad, dumpRowsInsert, isSpineTable, loadDirectoryDump, repointScopeGrants, settleCopiedWork, emittedHere, spineColumnAdditions } from '@substrat-run/kernel';
 import { ScopeActor } from './actor.js';
 import { createTupleChecker, directoryTenantReader } from './checker.js';
+export { scopeStoreRunnersFor } from './scope-store-runners.js';
 /**
  * A fault in the database itself (full, corrupt, I/O), as opposed to one statement failing.
  * The #1764 backfill logs and opens past a failed batch, but never past one of these.
@@ -213,6 +214,9 @@ const KERNEL_DDL = `
   -- an exchange trades that secret for. Spine (kernel-written), shared with the DO adapter
   -- from @substrat-run/kernel so the two cannot part company; the column comments are there.
   ${CAPABILITY_DDL}
+  -- Upload links: a short-lived, single-use URL that lets a caller with no session upload ONE
+  -- file to ONE entity. Spine (kernel-written), shared with the DO adapter from the kernel.
+  ${UPLOAD_LINK_DDL}
   -- #1686: where a copied scope's data came from, and the event id its own events start above.
   -- Shared with the other adapter from @substrat-run/kernel; the column comments are there.
   ${COPY_ORIGIN_DDL}
@@ -620,6 +624,9 @@ export class SqliteScopeHost {
     /** predicate name → the module-contributed implementation. Names are global. */
     predicates = new Map();
     /** operation names whose default binding some manifest withdrew (K-17). */
+    scopeStoreRunners;
+    scopeStoreVertical;
+    scopeStoreLifecycle;
     withdrawn = new Map(); // operation → withdrawing module
     relations = new Map();
     /** entityType → its derived FTS5 index (#827). One entity type, one index. */
@@ -634,6 +641,8 @@ export class SqliteScopeHost {
     erasurePlans = [];
     /** entityType → the declared attachment gate (#473): read key + write key (default: read). */
     attachmentTargets = new Map();
+    /** entityType → the `uploadLinks` policy its `attachmentTargets` entry declares; absent = no links. */
+    uploadLinkPolicies = new Map();
     /** operation name → who binds it: the owning module, its entitlementKey and its declared
      *  schedules — the §4.3 gate's input, resolved per invoke by `requiredEntitlementFor` (#1654). */
     operationEntitlement = new Map();
@@ -712,6 +721,9 @@ export class SqliteScopeHost {
         this.connectorCalls = options.connectorCalls ?? noopConnectorCallRecorder;
         this.clock = options.clock ?? (() => instant.parse(new Date().toISOString()));
         this.versionId = options.versionId ?? null;
+        this.scopeStoreVertical = options.scopeStores?.vertical;
+        this.scopeStoreRunners = scopeStoreRunnersOf(options.scopeStores);
+        this.scopeStoreLifecycle = scopeStoreLifecycleOf(this.scopeStoreRunners);
         this.logSink = options.logSink ?? consoleLogSink;
         this.invocationLineSink = options.invocationLineSink ?? consoleInvocationLineSink;
         // Every option is read above and here, BEFORE the directory is claimed: an option that throws
@@ -930,6 +942,8 @@ export class SqliteScopeHost {
         created_at TEXT NOT NULL,
         PRIMARY KEY (tenant_id, vertical, binding)
       );
+      -- A store kind's stored releases, rollouts and holds (D-63, #2300).
+      ${STORE_KIND_RELEASES_DDL}
       -- The vertical + version registry (#31). A scope binds to a VERSION, so
       -- dev/staging/prod are the same vertical pinned differently, and a preview
       -- deployment is a version nothing has been promoted to yet.
@@ -1000,6 +1014,7 @@ export class SqliteScopeHost {
         UNIQUE (vertical_slug, version)
       );
       ${VERSION_MIGRATIONS_DDL}
+      ${VERTICAL_SCOPE_STORES_DDL}
       -- Channels (#31 step 2): a named pointer per vertical. Promotion moves it,
       -- and promotion is where the migration and permission diffs fire — the
       -- moment a change reaches anyone, rather than the moment it was typed.
@@ -1701,6 +1716,13 @@ export class SqliteScopeHost {
                     `(${existing.read}/${existing.write}) vs (${gate.read}/${gate.write})`);
             }
             this.attachmentTargets.set(target.entityType, gate);
+            if (target.uploadLinks) {
+                const known = this.uploadLinkPolicies.get(target.entityType);
+                if (known && JSON.stringify(known) !== JSON.stringify(target.uploadLinks)) {
+                    throw new Error(`conflicting uploadLinks policies for attachment target '${target.entityType}'`);
+                }
+                this.uploadLinkPolicies.set(target.entityType, target.uploadLinks);
+            }
         }
         // WITHDRAWAL (K-17): suppress another module's default binding. Order
         // independent — a manifest may withdraw an operation whose module has not
@@ -2118,6 +2140,40 @@ export class SqliteScopeHost {
         const store = this.attachmentStore(tenantId, scopeRow?.vertical ?? null);
         return this.buildAttachments(rt, asPrincipal(principal), store);
     }
+    /** The declared write key and link policy of an attachment target — what `ctx.attachments` mints against. */
+    uploadTargetOf(entityType) {
+        const gate = this.attachmentTargets.get(entityType);
+        if (!gate)
+            return undefined;
+        const uploadLinks = this.uploadLinkPolicies.get(entityType);
+        return uploadLinks ? { write: gate.write, uploadLinks } : { write: gate.write };
+    }
+    async inspectUploadLink(tenantId, scopeId, secret) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        return rt.actor.enqueue(async () => (await inspectUploadLink({ sql: spineSql(rt.db), now: this.clock() }, secret)).view);
+    }
+    async redeemUploadLink(tenantId, scopeId, secret, input) {
+        const rt = await this.openActiveScope(tenantId, scopeId);
+        const { view, mintedBy } = await rt.actor.enqueue(() => inspectUploadLink({ sql: spineSql(rt.db), now: this.clock() }, secret));
+        if (view.entity.entityType !== input.entity.entityType || view.entity.entityId !== input.entity.entityId) {
+            throw substratError('not_found', 'This upload link is not valid for that target.', {
+                reason: UPLOAD_LINK_WRONG_TARGET,
+            });
+        }
+        // The write is made AS the minter: the same gates `attachments()` puts in front of a person.
+        await this.getScope(mintedBy, tenantId, scopeId);
+        const scopeRow = this.directory
+            .prepare('SELECT vertical FROM scopes WHERE scope_id = ?')
+            .get(scopeId);
+        const files = this.buildAttachments(rt, asPrincipal(mintedBy), this.attachmentStore(tenantId, scopeRow?.vertical ?? null), { uploadLinkSecret: secret });
+        return files.upload({
+            entity: view.entity,
+            filename: view.filename ?? input.filename,
+            contentType: input.contentType,
+            visibility: view.visibility,
+            body: input.body,
+        });
+    }
     async getSystemAttachments(moduleId, tenantId, scopeId) {
         // The same registered-module and lifecycle gate as a system invoke. The
         // attachment surface checks the target's read key as system:<moduleId>.
@@ -2182,8 +2238,17 @@ export class SqliteScopeHost {
             }
             // #1525: null, for the reason the denial two lines up records null — this task
             // is the attachment RPC's own and no invoke set an id on the runtime.
-            await this.dispatch(rt, null);
-            await this.dispatchExecutors(rt, null);
+            // The write has COMMITTED, so a failed drain must not reach the caller as a refusal:
+            // `upload` deletes the bytes on a refusal, which would leave this row without them
+            // (and a redeemed link spent) (#2311). An undelivered event has no delivery row, so
+            // the next drain in this scope delivers it.
+            try {
+                await this.dispatch(rt, null);
+                await this.dispatchExecutors(rt, null);
+            }
+            catch (err) {
+                console.error('substrat: consumer drain failed after an attachment committed', err);
+            }
             return result;
         });
         /**
@@ -2242,9 +2307,9 @@ export class SqliteScopeHost {
                     createdBy: creator.id,
                     createdAt: new Date().toISOString(),
                 });
-                // Bytes first, row second: a crash between the two leaves an orphaned object
-                // (harmless, GC-able via list), never a row without bytes. A refused check
-                // compensates the object away below.
+                // Bytes first, row second: a crash between the two leaves an orphaned object that no
+                // row points at (#2314). A refused check compensates the object away below; a drain
+                // fault after the commit is not a refusal (`serialized` keeps it from becoming one).
                 await store.put(key, input.body, { contentType: input.contentType });
                 try {
                     return await guarded('attachments.upload', async (ctx) => {
@@ -2265,6 +2330,11 @@ export class SqliteScopeHost {
                         // #1575: queue its text extraction in the same transaction — a `pending` row
                         // and a job run. Nothing is extracted here, so nothing here can fail the upload.
                         enqueueAttachmentText(spineSql(rt.db), record.id, ulid(), this.clock());
+                        // An upload-link redemption spends its link HERE, in the same transaction as the
+                        // row it produced: a refusal anywhere above or below rolls the spend back.
+                        if (opts.uploadLinkSecret !== undefined) {
+                            await redeemUploadLinkInTransaction({ sql: spineSql(rt.db), now: this.clock(), emit: (event) => kernelEmit(ctx, event) }, opts.uploadLinkSecret, record);
+                        }
                         return record;
                     });
                 }
@@ -2358,6 +2428,7 @@ export class SqliteScopeHost {
         };
     }
     async importScope(actor, input, dump) {
+        this.refuseUnusableScopeStores(dump.stores, input.vertical ?? null);
         // Create the destination scope (directory row + storage). Its migration step
         // creates some tables; the dump then replaces them wholesale, so the end state
         // is the dump, not whatever the local module set would have built. Provenance is
@@ -2370,6 +2441,7 @@ export class SqliteScopeHost {
         });
         // A fork: its callers (snapshotScope) hand it a dump the platform exported.
         await this.loadDump(input.tenantId, input.scopeId, { ...dump, exact: true });
+        await this.importScopeStores(input.tenantId, input.scopeId, dump.stores);
         await this.admin.activateScope(actor, input.tenantId, input.scopeId);
         this.recordAdmin(actor, 'importScope', { tenantId: input.tenantId, scopeId: input.scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
     }
@@ -2522,6 +2594,7 @@ export class SqliteScopeHost {
         const existing = await this.admin.getScopeRecord(actor, tenantId, scopeId);
         if (!existing)
             throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
+        this.refuseUnusableScopeStores(dump.stores, existing.vertical);
         // #1742: a dump from before a switch was pulled brings the module's grants back live, so
         // the directory's recorded-off modules go back off in the load's own turn, as a
         // provision's seat does — no schedule pass can run in between.
@@ -2530,9 +2603,17 @@ export class SqliteScopeHost {
         // #1869: the re-point's source is the separate hint when given; the dump is otherwise as sent.
         const source = { tables: dump.tables, scopeId: opts?.sourceScopeId ?? dump.scopeId };
         await this.loadDump(tenantId, scopeId, source, (rt) => this.reassertSwitchesInTurn(rt, actor, tenantId, scopeId, undefined, (action, after) => rows.push([action, after])));
+        await this.importScopeStores(tenantId, scopeId, dump.stores);
+        const replay = await this.replayShreddedStoreErasures(actor, tenantId, scopeId, (opts?.sourceScopeId ?? dump.scopeId));
         for (const [action, after] of rows)
             this.recordAdmin(actor, action, { tenantId, scopeId }, null, after);
-        this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, { sourceScopeId: dump.scopeId, tables: dump.tables.length, capturedAt: dump.capturedAt });
+        this.recordAdmin(actor, 'restoreScope', { tenantId, scopeId }, null, {
+            sourceScopeId: dump.scopeId,
+            tables: dump.tables.length,
+            capturedAt: dump.capturedAt,
+            ...replay,
+        });
+        return replay;
     }
     async snapshotScope(actor, tenantId, scopeId, opts) {
         const source = await this.admin.getScopeRecord(actor, tenantId, scopeId);
@@ -2554,6 +2635,7 @@ export class SqliteScopeHost {
         if (source.verticalVersionId) {
             await this.admin.bindScopeVersion(actor, tenantId, snapshotId, source.verticalVersionId);
         }
+        await this.replayShreddedStoreErasures(actor, tenantId, snapshotId, scopeId);
         return snapshotId;
     }
     async deleteSnapshot(actor, tenantId, scopeId) {
@@ -2567,6 +2649,7 @@ export class SqliteScopeHost {
             throw substratError('forbidden', `scope ${scopeId} is not a fork or preview — only previews may be deleted; ` +
                 `archive a primary scope instead`);
         }
+        await this.wipeScopeStores(tenantId, scopeId);
         // Close and evict the runtime handle before touching the file.
         const rt = this.scopes.get(`${tenantId}/${scopeId}`);
         if (rt)
@@ -2635,6 +2718,202 @@ export class SqliteScopeHost {
         }
         return this.buildStub(tenantId, scopeId, rt, asPrincipal(principal), options);
     }
+    async getScopeStore(principal, tenantId, scopeId, binding, options) {
+        // The directory check is the same one `getScope` makes. With no runners
+        // configured, the binding is refused after that check.
+        await this.getScope(principal, tenantId, scopeId);
+        if (this.scopeStoreRunners.size === 0) {
+            throw substratError('unavailable', `no scope-store runner is configured for binding '${binding}'`);
+        }
+        const vertical = this.scopeStoreVerticalOf(scopeId);
+        const runner = this.scopeStoreRunners.get(binding);
+        if (!runner) {
+            throw substratError('not_found', `no scope store is bound for '${binding}'`);
+        }
+        await this.scopeStoreLifecycle.start();
+        return {
+            tenantId,
+            scopeId,
+            subjectKind: 'principal',
+            invoke: (operation, input, ...extra) => observeStoreCall(binding, operation, () => callScopeStore((request) => runner.invoke({ tenantId, vertical, scopeId, binding }, request), operation, input, ...extra), options?.onStoreCall),
+        };
+    }
+    /** The scope's vertical when it has one. No vertical means this host has no store to touch. */
+    scopeStoreVerticalIfPresent(scopeId) {
+        const row = this.directory.prepare('SELECT vertical FROM scopes WHERE scope_id = ?').get(scopeId);
+        const vertical = row?.vertical;
+        if (!vertical)
+            return undefined;
+        if (this.scopeStoreVertical !== undefined && vertical !== this.scopeStoreVertical) {
+            throw substratError('forbidden', `this host serves vertical '${this.scopeStoreVertical}', and scope ${scopeId} runs '${vertical}'`);
+        }
+        return vertical;
+    }
+    /** The scope's vertical, refused when this host is limited to another one. */
+    scopeStoreVerticalOf(scopeId) {
+        const vertical = this.scopeStoreVerticalIfPresent(scopeId);
+        if (!vertical) {
+            throw substratError('not_found', `scope ${scopeId} has no vertical, so it has no scope store`);
+        }
+        return vertical;
+    }
+    /**
+     * One reserved call on a declared binding. The vertical's stub never reaches
+     * this; `callReservedStoreOperation` refuses a name that is not reserved.
+     */
+    async invokeReservedStore(address, operation, input) {
+        const runner = this.scopeStoreRunners.get(address.binding);
+        if (!runner)
+            throw substratError('not_found', `no scope store is bound for '${address.binding}'`);
+        await this.scopeStoreLifecycle.start();
+        return callReservedStoreOperation((request) => runner.invoke(address, request), operation, input);
+    }
+    /**
+     * Each declared binding's `substrat.size`. No runners means an empty list,
+     * and the scope is not opened to discover that.
+     */
+    async readScopeStoreSizes(tenantId, scopeId) {
+        const bindings = [...this.scopeStoreRunners.keys()];
+        if (bindings.length === 0)
+            return [];
+        this.scopeReadDbFor(tenantId, scopeId);
+        const vertical = this.scopeStoreVerticalOf(scopeId);
+        const sizes = [];
+        for (const binding of bindings) {
+            const { bytes } = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.size');
+            sizes.push({ binding, bytes });
+        }
+        return sizes;
+    }
+    /** The vertical whose stores this scope has on this host, or nothing when it has none. */
+    storeVerticalOf(scopeId) {
+        if (this.scopeStoreRunners.size === 0)
+            return undefined;
+        const row = this.directory.prepare('SELECT vertical FROM scopes WHERE scope_id = ?').get(scopeId);
+        const vertical = row?.vertical ?? undefined;
+        if (!vertical)
+            return undefined;
+        if (this.scopeStoreVertical !== undefined && vertical !== this.scopeStoreVertical)
+            return undefined;
+        return vertical;
+    }
+    /** The erasure claim (`SUBJECT_ERASURE_CLAIM_SQL`); a scope that moved refuses with the key kept. */
+    claimSubjectErasure(tenantId, scopeId, fence) {
+        const claimed = this.directory.prepare(SUBJECT_ERASURE_CLAIM_SQL).run(...subjectErasureClaimParams(tenantId, scopeId, fence));
+        if (claimed.changes === 0) {
+            throw substratError('precondition_failed', 'scope route or copy inventory changed during subject erasure; retry after it settles');
+        }
+    }
+    /**
+     * `substrat.erase` on each declared binding. A store error throws, so the caller
+     * can leave the subject key untouched. Fail closed (#2242): an empty answer means
+     * this host KNOWS it holds nothing for the scope. It always can tell — the
+     * directory names the scope's vertical, and the runners are this host's own — so
+     * unlike a Cloudflare host with no control plane it has no "cannot tell" case.
+     */
+    async eraseScopeStores(tenantId, scopeId, subjectId) {
+        const bindings = [...this.scopeStoreRunners.keys()];
+        // Shred calls this for every scope. No vertical names no store object, and a
+        // vertical this host is not pinned to is one its runners never served: both hold
+        // nothing here, and the key is still destroyed.
+        const vertical = this.storeVerticalOf(scopeId);
+        if (!vertical)
+            return [];
+        const erasures = [];
+        for (const binding of bindings) {
+            const { erased } = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.erase', { subjectId });
+            erasures.push({ binding, erased });
+        }
+        return erasures;
+    }
+    /**
+     * A dump's stores this host cannot load are refused before any write (#2211, L8): a
+     * binding that is not bound, a store with no kind or a kind other than the bound runner's,
+     * any store at all for a destination with no vertical (no store object can be named for
+     * it, so loading would drop them), or a destination on a vertical other than the one this
+     * host is pinned to.
+     */
+    refuseUnusableScopeStores(stores, vertical) {
+        const listed = stores ?? [];
+        if (listed.length === 0)
+            return;
+        if (vertical === null) {
+            throw substratError('conflict', 'dump carries scope stores, and the destination scope has no vertical to hold them');
+        }
+        if (this.scopeStoreVertical !== undefined && vertical !== this.scopeStoreVertical) {
+            throw substratError('forbidden', `this host serves vertical '${this.scopeStoreVertical}', and the destination scope runs '${vertical}'`);
+        }
+        for (const store of listed) {
+            const runner = this.scopeStoreRunners.get(store.binding);
+            if (!runner) {
+                throw substratError('not_found', `dump names scope store '${store.binding}', which is not bound`);
+            }
+            if (!store.kind) {
+                throw substratError('validation_failed', `dump's scope store '${store.binding}' names no kind`);
+            }
+            if (store.kind !== runner.kind) {
+                throw substratError('conflict', `dump's scope store '${store.binding}' is kind '${store.kind}', and this host binds kind '${runner.kind}'`);
+            }
+        }
+    }
+    async exportScopeStores(tenantId, scopeId) {
+        const bindings = [...this.scopeStoreRunners.keys()];
+        if (bindings.length === 0)
+            return [];
+        const vertical = this.scopeStoreVerticalIfPresent(scopeId);
+        if (!vertical)
+            return [];
+        const stores = [];
+        for (const binding of bindings) {
+            const runner = this.scopeStoreRunners.get(binding);
+            if (!runner)
+                throw substratError('not_found', `no scope store is bound for '${binding}'`);
+            const exported = await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.export');
+            stores.push({ binding, kind: runner.kind, tables: exported.tables });
+        }
+        return stores;
+    }
+    async importScopeStores(tenantId, scopeId, stores) {
+        const listed = stores ?? [];
+        if (listed.length === 0)
+            return;
+        const vertical = this.scopeStoreVerticalIfPresent(scopeId);
+        if (!vertical) {
+            throw substratError('conflict', `dump carries scope stores, and scope ${scopeId} has no vertical to hold them`);
+        }
+        for (const store of listed) {
+            await this.invokeReservedStore({ tenantId, vertical, scopeId, binding: store.binding }, 'substrat.import', { tables: store.tables });
+        }
+    }
+    /**
+     * `substrat.erase` again for every tombstoned subject (#2207), on the target's and the
+     * source's marks (`replayStoreErasures`). A target this host names no store for (no
+     * runner, or no vertical a store is kept for) has nothing to replay into: nothing is read.
+     */
+    async replayShreddedStoreErasures(actor, tenantId, target, source) {
+        if (!this.storeVerticalOf(target))
+            return undefined;
+        return replayStoreErasures({
+            admin: this.admin,
+            actor,
+            tenantId,
+            target,
+            source,
+            erase: async (subjectId) => (await this.eraseScopeStores(tenantId, target, subjectId)).length,
+        });
+    }
+    /** `substrat.wipe` on each declared binding, before the scope's own storage goes. */
+    async wipeScopeStores(tenantId, scopeId) {
+        const bindings = [...this.scopeStoreRunners.keys()];
+        if (bindings.length === 0)
+            return;
+        const vertical = this.scopeStoreVerticalIfPresent(scopeId);
+        if (!vertical)
+            return;
+        for (const binding of bindings) {
+            await this.invokeReservedStore({ tenantId, vertical, scopeId, binding }, 'substrat.wipe');
+        }
+    }
     /**
      * A scope stub whose authority is a CONNECTION (#97).
      *
@@ -4072,10 +4351,15 @@ export class SqliteScopeHost {
         }
     }
     async close() {
-        for (const rt of [...this.scopes.values()])
-            this.closeRuntime(rt);
-        this.directory.close();
-        this.owner.release();
+        try {
+            await this.scopeStoreLifecycle.stop();
+        }
+        finally {
+            for (const rt of [...this.scopes.values()])
+                this.closeRuntime(rt);
+            this.directory.close();
+            this.owner.release();
+        }
     }
     // -------------------------------------------------------------------------
     // Event dispatch (testrun spec §9.2.3): at-least-once, kernel-journaled,
@@ -6118,14 +6402,16 @@ export class SqliteScopeHost {
                 }
                 this.recordAdmin(actor, 'setHostnameIssuance', { tenantId: row.tenant_id, scopeId: row.scope_id }, { status: row.status }, { status: fields.status, note: fields.note ?? null });
             },
-            unbindHostname: async (actor, raw) => {
+            unbindHostname: async (actor, raw, owner) => {
                 const hostname = raw.toLowerCase(); // DNS is case-insensitive; the map is normalized
+                // One statement: the row it removes is the row it audits, and an owner is judged by the
+                // delete itself, so a name rebound to another scope in between is left alone (#2285).
                 const row = this.directory
-                    .prepare('SELECT tenant_id, scope_id, status FROM hostnames WHERE hostname = ?')
-                    .get(hostname);
+                    .prepare(`DELETE FROM hostnames WHERE hostname = ?${owner ? ' AND tenant_id = ? AND scope_id = ?' : ''}
+            RETURNING tenant_id, scope_id, status`)
+                    .get(hostname, ...(owner ? [owner.tenantId, owner.scopeId] : []));
                 if (!row)
                     return; // idempotent, and a no-op is not audited
-                this.directory.prepare('DELETE FROM hostnames WHERE hostname = ?').run(hostname);
                 this.recordAdmin(actor, 'unbindHostname', { tenantId: row.tenant_id, scopeId: row.scope_id }, { hostname, status: row.status }, null);
             },
             listHostnames: async (actor, filter) => {
@@ -6361,6 +6647,8 @@ export class SqliteScopeHost {
                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?)`)
                         .run(audited.id, audited.verticalSlug, audited.version, audited.manifestDigest, audited.permissionDigest, audited.migrationDigest, audited.deploymentRef, selfAdmits ? 'admitted' : 'pending', selfAdmits ? AUTO_ADMISSION_NOTE : null, split.manifestJson, origin ? JSON.stringify(origin) : null, split.migrations?.length ?? null, new Date().toISOString());
                     writeVersionMigrations(switchSqlOf(this.directory), audited.id, split.migrations);
+                    // #2286: the version's scope-store bindings, refusing one re-kinded, in the insert's transaction.
+                    indexVersionScopeStores(switchSqlOf(this.directory), audited.verticalSlug, audited.id, split.manifestJson);
                 })();
                 this.recordAdmin(actor, 'publishVersion', { tenantId: null }, null, {
                     ...audited,
@@ -6368,6 +6656,12 @@ export class SqliteScopeHost {
                     admission: selfAdmits ? 'admitted' : 'pending',
                 });
             },
+            verticalScopeStores: async (actor, verticalSlug) => {
+                // One transaction: versions not indexed yet are indexed by the read (#2286).
+                const stores = this.directory.transaction(() => verticalScopeStoresOf(switchSqlOf(this.directory), verticalSlug))();
+                this.recordAccess(actor, 'verticalScopeStores', {}, { verticalSlug }, stores.length);
+                return stores;
+            },
             listVersions: async (actor, verticalSlug, page) => {
                 const where = ['vertical_slug = ?'];
                 const params = [verticalSlug];
@@ -6471,6 +6765,7 @@ export class SqliteScopeHost {
                     .prepare(`DELETE FROM vertical_version_migrations
               WHERE version_id IN (SELECT id FROM vertical_versions WHERE vertical_slug = ?)`)
                     .run(slug);
+                forgetVerticalScopeStores(switchSqlOf(this.directory), slug);
                 this.directory.prepare('DELETE FROM vertical_versions WHERE vertical_slug = ?').run(slug);
                 this.directory.prepare('DELETE FROM verticals WHERE slug = ?').run(slug);
                 this.recordAdmin(actor, 'deleteVertical', { tenantId: null }, { slug, source: existing.source, ownerTenant: existing.ownerTenant }, null);
@@ -7227,6 +7522,11 @@ export class SqliteScopeHost {
                 this.recordAccess(actor, 'scopeDatabaseSize', { tenantId, scopeId }, null, 1);
                 return bytes;
             },
+            scopeStoreSizes: async (actor, tenantId, scopeId) => {
+                const sizes = await this.readScopeStoreSizes(tenantId, scopeId);
+                this.recordAccess(actor, 'scopeStoreSizes', { tenantId, scopeId }, null, sizes.length);
+                return sizes;
+            },
             rewindScope: async () => {
                 throw new Error('point-in-time rewind is not available on this host (PITR is a Durable-Object-plane mechanism) — use the backup restore path');
             },
@@ -7482,6 +7782,48 @@ export class SqliteScopeHost {
                     createdAt: r.created_at,
                 }));
             },
+            // -- store-kind releases, rollouts and holds (D-63, #2300) -------------------
+            // The state is kernel code over the directory (store-kind-releases.ts), shared with the
+            // Cloudflare control plane; each call is one transaction. A hold's expiry is judged against
+            // this host's clock, so a test can let a lease lapse without waiting.
+            recordStoreKindRelease: async (actor, input) => {
+                const at = this.clock();
+                const { record, created } = this.directory.transaction(() => recordStoreKindReleaseIn(switchSqlOf(this.directory), { ...input, actor, at }))();
+                if (created)
+                    this.recordAdmin(actor, 'uploadStoreKindRelease', { tenantId: null }, null, record, at);
+                return record;
+            },
+            getStoreKindRelease: async (actor, kind, sha256) => {
+                const record = storeKindReleaseIn(switchSqlOf(this.directory), kind, sha256);
+                this.recordAccess(actor, 'getStoreKindRelease', { tenantId: null }, { kind, sha256 }, record ? 1 : 0);
+                return record;
+            },
+            storeKindState: async (actor, kind) => {
+                const state = storeKindStateIn(switchSqlOf(this.directory), kind, Date.parse(this.clock()));
+                this.recordAccess(actor, 'storeKindState', { tenantId: null }, { kind }, state.rollouts.length);
+                return state;
+            },
+            storeKindDeclarations: async (actor, kind) => {
+                const declared = this.directory.transaction(() => kindDeclarationsOf(switchSqlOf(this.directory), kind))();
+                this.recordAccess(actor, 'storeKindDeclarations', { tenantId: null }, { kind }, declared.verticals.length);
+                return declared;
+            },
+            holdStoreKind: async (_actor, input) => this.directory.transaction(() => holdStoreKindIn(switchSqlOf(this.directory), { ...input, nowMs: Date.parse(this.clock()) }))(),
+            releaseStoreKindHold: async (_actor, input) => {
+                releaseStoreKindHoldIn(switchSqlOf(this.directory), input);
+            },
+            beginStoreKindRollout: async (actor, input) => {
+                const at = this.clock();
+                const row = this.directory.transaction(() => beginStoreKindRolloutIn(switchSqlOf(this.directory), { ...input, actor, at, nowMs: Date.parse(at) }))();
+                this.recordAdmin(actor, input.action === 'rollback' ? 'rollBackStoreKind' : 'rollOutStoreKind', { tenantId: null }, null, row, at);
+                return row;
+            },
+            finishStoreKindRollout: async (actor, input) => {
+                const at = this.clock();
+                const row = this.directory.transaction(() => finishStoreKindRolloutIn(switchSqlOf(this.directory), { ...input, at, nowMs: Date.parse(at) }))();
+                this.recordAdmin(actor, row.action === 'rollback' ? 'rollBackStoreKind' : 'rollOutStoreKind', { tenantId: null }, null, row, at);
+                return row;
+            },
             getScopeRecord: async (actor, tenantId, scopeId) => {
                 const r = this.directory.prepare('SELECT * FROM scopes WHERE scope_id = ?').get(scopeId);
                 // Cross-check the pair (K-3): a scope that exists under a DIFFERENT tenant
@@ -7622,7 +7964,8 @@ export class SqliteScopeHost {
                     return { name, ddl: sql, columns, rows };
                 });
                 this.recordAccess(actor, 'exportScope', { tenantId, scopeId }, null, tables.length);
-                return { tenantId, scopeId, capturedAt: new Date().toISOString(), tables };
+                const stores = await this.exportScopeStores(tenantId, scopeId);
+                return { tenantId, scopeId, capturedAt: new Date().toISOString(), tables, stores };
             },
             // -- directory disaster recovery (#40) ----------------------------------
             // The self-hosted half of the same story. A self-host has no DO point-in-time
@@ -7762,6 +8105,7 @@ export class SqliteScopeHost {
                 const rt = this.scopes.get(`${tenantId}/${scopeId}`);
                 if (rt)
                     this.closeRuntime(rt);
+                await this.wipeScopeStores(tenantId, scopeId);
                 rmSync(join(this.dir, `${tenantId}__${scopeId}.sqlite`), { force: true });
                 // The recoverable copy the caller stored first (#493), named in the audit entry so
                 // the trail answers "was there a backup" without correlating two timestamps.
@@ -7789,13 +8133,29 @@ export class SqliteScopeHost {
             },
             // `stamp` is the erasure epoch an orchestrated erasure's claim compared (#1722). A direct shred
             // claims nothing and records the epoch it ran under: the backfill orders erasures by them.
-            shredSubject: async (actor, tenantId, scopeId, subjectId, stamp) => {
+            listShreddedSubjects: async (actor, tenantId, scopeId, cursor) => {
+                this.assertScope(tenantId, scopeId);
+                const rows = this.directory
+                    .prepare(`SELECT subject_id FROM _substrat_subject_keys
+              WHERE scope_id = ? AND tenant_id = ? AND shredded_at IS NOT NULL AND subject_id > ?
+              ORDER BY subject_id LIMIT 101`)
+                    .all(scopeId, tenantId, cursor ?? '');
+                const subjects = rows.slice(0, 100).map((row) => row.subject_id);
+                const nextCursor = rows.length > 100 ? (subjects[99] ?? null) : null;
+                this.recordAccess(actor, 'listShreddedSubjects', { tenantId, scopeId }, null, subjects.length);
+                return { subjects, nextCursor };
+            },
+            shredSubject: async (actor, tenantId, scopeId, subjectId, fence, stamp, storeErasures) => {
                 this.assertScope(tenantId, scopeId);
                 const before = stamp ?? {
                     erasureEpoch: this.directory.prepare(COPY_BACKFILL_SCOPE_SQL).get(tenantId, scopeId)
                         ?.erasure_epoch ?? 0,
                     path: 'direct',
                 };
+                // #2285: a direct shred with a fence claims what it read, as the finalize does; the epoch
+                // it records is the one its claim compared.
+                if (fence)
+                    before.erasureEpoch = fence.epoch;
                 // Redact the live spine FIRST. Both halves are idempotent and a crash between them
                 // converges on retry, so the order is decided by which half-done state harms the
                 // person: dying after this leaves ciphertext in a backup that no key opens; dying
@@ -7864,6 +8224,13 @@ export class SqliteScopeHost {
                 // intents, an issue's exemplar, a sweep record's error. Before the key, for the
                 // ordering reason above.
                 redactSubjectDirectoryText(redactionSqlOf(this.directory), { tenantId, scopeId, subjectId, intentIds });
+                // Scope stores after the scope-side redaction and before the key (#2068). A store
+                // that errors throws here, so the key below is untouched and a retry converges.
+                // An orchestrated caller passes the serving script's result and this host does
+                // not erase again.
+                const erasures = storeErasures ?? (await this.eraseScopeStores(tenantId, scopeId, subjectId));
+                if (fence)
+                    this.claimSubjectErasure(tenantId, scopeId, fence);
                 const { existed } = await this.subjectKeysFor(tenantId, scopeId).destroy(subjectId, at);
                 const receipt = subjectShredReceipt.parse({
                     subjectId,
@@ -7871,6 +8238,7 @@ export class SqliteScopeHost {
                     intentsRedacted,
                     jobRunsRedacted,
                     ...vertical,
+                    storeErasures: erasures,
                     keyDestroyed: existed,
                     tombstoned: true,
                 });
@@ -7891,23 +8259,14 @@ export class SqliteScopeHost {
                     throw substratError('not_found', `unknown scope ${scopeId} in tenant ${tenantId}`);
                 return row.erasure_epoch;
             },
-            finalizeSubjectShred: async (actor, tenantId, scopeId, subjectId, redactions, expected) => {
+            finalizeSubjectShred: async (actor, tenantId, scopeId, subjectId, redactions, expected, storeErasures) => {
                 if (redactions.length === 0)
                     throw substratError('conflict', 'subject erasure has no confirmed scope redaction');
-                const claimed = this.directory.prepare(`UPDATE scopes SET erasure_epoch = COALESCE(erasure_epoch, 0) + 1
-           WHERE tenant_id = ? AND scope_id = ? AND vertical_version_id IS ?
-             AND serving_ref IS ? AND COALESCE(erasure_epoch, 0) = ?
-             AND NOT EXISTS (SELECT 1 FROM scope_script_copies AS copy
-               WHERE copy.tenant_id = scopes.tenant_id AND copy.scope_id = scopes.scope_id
-                 AND copy.state = 'pending')
-             AND (SELECT COUNT(*) FROM scope_script_copies AS copy
-               WHERE copy.tenant_id = scopes.tenant_id AND copy.scope_id = scopes.scope_id) = ?`).run(tenantId, scopeId, expected.versionId, expected.servingRef, expected.epoch, expected.copyCount);
-                if (claimed.changes === 0)
-                    throw substratError('precondition_failed', 'scope route or copy inventory changed during subject erasure; retry after it settles');
+                this.claimSubjectErasure(tenantId, scopeId, expected);
                 // The pure adapter has one co-located scope store. Its existing atomic shred is
                 // the final local redaction and key destruction, after remote copies confirmed.
                 const shred = this.admin.shredSubject;
-                return shred(actor, tenantId, scopeId, subjectId, { erasureEpoch: expected.epoch, path: 'orchestrated' });
+                return shred(actor, tenantId, scopeId, subjectId, undefined, { erasureEpoch: expected.epoch, path: 'orchestrated' }, storeErasures);
             },
             // -- impersonation (K-42, #868) ----------------------------------------
             beginImpersonation: async (actor, input) => {
@@ -7983,6 +8342,7 @@ export class SqliteScopeHost {
                     '_substrat_finding_rules', // #1748: the tenant's suppress rules
                     '_substrat_scope_storage', // #1524: storage samples of scopes whose storage is gone
                     '_substrat_scope_storage_attempts', // #1524: and the phase's last try at each
+                    '_substrat_scope_store_storage', // #2212: scope-store samples, gone with the tenant
                 ];
                 const clear = this.directory.transaction(() => {
                     for (const table of tables) {
@@ -8091,6 +8451,7 @@ export class SqliteScopeHost {
                     // #1524: the stored gauge's latest sample per non-reaped scope. A directory read only.
                     storage: listScopeStorageRows(redactionSqlOf(this.directory), { tenantId: only, latest: true }),
                     storageAttempts: listScopeStorageAttemptRows(redactionSqlOf(this.directory), only),
+                    storeStorage: listScopeStoreStorageRows(redactionSqlOf(this.directory), only),
                 });
                 // The count that matters for K-24 is how many TENANTS this reading covered —
                 // "read the meter for one tenant" and "metered the whole fleet" are different
@@ -8541,6 +8902,10 @@ export class SqliteScopeHost {
                 const { tenantId, scopeId, ...after } = memberChangeAudit.parse(entry);
                 this.recordAdmin(actor, 'manageScopeMember', { tenantId, scopeId }, null, after);
             },
+            recordConnectionBindingChange: async (actor, entry) => {
+                const { tenantId, scopeId, ...after } = connectionBindingAudit.parse(entry);
+                this.recordAdmin(actor, 'bindConnectionScope', { tenantId, scopeId }, null, after);
+            },
             recordPeerBindingChange: async (actor, entry) => {
                 const { tenantId, scopeId, ...after } = peerBindingAudit.parse(entry);
                 this.recordAdmin(actor, 'setPeerBinding', { tenantId, scopeId }, null, after);
@@ -9707,6 +10072,18 @@ export class SqliteScopeHost {
                 assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
                 minted,
             }),
+            // Upload links: mint / revoke / list, written once in the kernel — the same four things
+            // `capabilities` is handed, and the same consumer-is-system-actor rule.
+            attachments: createAttachmentVerbs({
+                sql: spineSql(rt.db),
+                subject: overrideActor ? { kind: 'system', id: overrideActor.system } : subject,
+                now: at,
+                check: runCheck,
+                emit: (event) => writeEvent(event, 'kernel'),
+                assertWrites: (verb) => assertImpersonationWrites(impersonation, verb),
+                minted,
+                targetOf: (entityType) => this.uploadTargetOf(entityType),
+            }),
             // K-16 / #1864: link and relink, written once in the kernel over the raw spine seam.
             ...createEntityEdgeVerbs({
                 sql: spineSql(rt.db),