@substrat-run/control-plane-api 0.146.0 → 0.147.0

package/dist/api.d.ts

@@ -1,9 +1,10 @@
 import { Hono } from 'hono';
-import { type ConnectionCertificate, z } from '@substrat-run/contracts';
+import { type ConnectionCertificate, z, type StoreKindRegistration } from '@substrat-run/contracts';
 import type { Connection, ConnectionActivity, ConnectionActivitySource, ConnectionCredential, ConnectionProbe, PlatformActorId } from '@substrat-run/contracts';
 import type { CrossVerticalOptions, HostAdmin, ScopeHost } from '@substrat-run/kernel';
 import type { PlatformActorAuth, BuilderAuth, Principal, TenantServiceAuth } from './auth.js';
 import { type VerticalClient } from './vertical-client.js';
+import type { PlatformScopeStores } from './platform-scope-stores.js';
 import { type ConnectionCandidatePrepare } from './connection-relay.js';
 import type { DeployVerticalFn, FetchVerticalAssetFn, FetchVerticalModulesFn } from './deploy.js';
 import type { PatchScriptBindingsFn } from './wfp.js';
@@ -121,6 +122,18 @@ export interface ControlPlaneApiOptions {
      * resolvers, which is only correct before any scope has adopted the serving script.
      */
     resolveVerticalRef?: (deploymentRef: string) => Promise<VerticalClient | undefined>;
+    /**
+     * Reserved scope-store operations, signed and sent to the store script (#2207).
+     * The vertical is not asked: it holds neither the namespace nor the key.
+     * Absent on a co-located host, whose own export and restore already carry the
+     * stores. Present on the hosted control plane, which is the only caller.
+     */
+    platformScopeStores?: PlatformScopeStores;
+    /**
+     * The registered scope-store kinds (#2207) this control plane judges a scope's stores against
+     * (`mayHoldScopeStores`, #2242). `STORE_KINDS` unless a test registers one.
+     */
+    storeKinds?: readonly StoreKindRegistration[];
     /** #1722: how long a copy move owns its ledger entries, and so how long its restore may land
      *  (`CopyRestoreFence`). `SCOPE_COPY_LEASE_MS` unless a test needs a lease it can outlive. */
     copyLeaseMs?: number;

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAkBL,KAAK,qBAAqB,EA+E1B,CAAC,EAaF,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAGV,UAAU,EACV,kBAAkB,EAElB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAKf,eAAe,EAUhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAoB,oBAAoB,EAAE,SAAS,EAAoD,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAqB3J,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAOrF,OAAO,EAA+C,KAAK,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAkBrH,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAyBtD,OAAO,EAA+C,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE3G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAItB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAClG;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;kGAC8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IACV,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;;OAMG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2FAA2F;IAC3F,eAAe,CAAC,EAAE,IAAI,CAAC;CACxB,CAAC;AAwYF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAiI7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAuC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAsKjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAoCD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAguQhG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAkBL,KAAK,qBAAqB,EA+E1B,CAAC,EAcD,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAGV,UAAU,EACV,kBAAkB,EAElB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAKf,eAAe,EAUhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAoB,oBAAoB,EAAE,SAAS,EAAoD,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAqB3J,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,KAAK,EAAsB,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAQ1F,OAAO,EAA+C,KAAK,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAmBrH,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAyBtD,OAAO,EAA+C,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE3G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAItB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAClG;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C;;;OAGG;IACH,UAAU,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC9C;kGAC8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IACV,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;;OAMG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2FAA2F;IAC3F,eAAe,CAAC,EAAE,IAAI,CAAC;CACxB,CAAC;AAwYF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAiI7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAuC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAsKjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAoCD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAk6QhG"}

package/dist/api.js

@@ -1,13 +1,14 @@
 import { resolveObservabilityWindow } from './observability-window.js';
 import { Hono } from 'hono';
 import { parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, ownerTransferInput, memberInviteInput, memberRoleInput, ASSET_PART_PREFIX, assetHash, channelName, connectLinkId, connectionActivity, connectionActivitySource, connectionCredential, connectionCertificate, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, FINDINGS_LIMIT_DEFAULT, FINDINGS_LIMIT_MAX, findingCursorOf, findingKind, findingRuleInput, findingStatus, findingStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, operationSeriesCount, operationSeriesInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, verticalSlug, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, platformScriptCollision, platformScriptRefusal, PLATFORM_SCRIPT_NAMES, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, errorCodeOf, capabilityFilterQuery, capabilityId as capabilityIdSchema, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, } from '@substrat-run/contracts';
-import { SCOPE_COPY_LEASE_MS, copyRestoreFence } from '@substrat-run/kernel';
+import { SCOPE_COPY_LEASE_MS, copyRestoreFence, replayStoreErasures } from '@substrat-run/kernel';
 import { attributeFailure } from './failure-attribution.js';
 import { auditedChange, withAuditedOutcomes } from './audited-change.js';
 import { BIND_EXPORT_BREAK_REFUSAL, CARRIED_AWAY_KEY, bindExportBreakRefusal, carriedAwayDump, dumpMetaValue, metaValueIn, crossVerticalHealth, exportBreakRefusal, isBindExportBreakRefusal, isExportBreakRefusal, isPrimaryScope, migrationProgress, ulid, auditWarningOf, } from '@substrat-run/kernel';
 import { TENANT_HEADER, confinedTenant } from './auth.js';
 import { mintTenantToken } from './tenant-token.js';
 import { connectionGrantsForScope } from './vertical-client.js';
+import { scopeStoresOf } from './platform-scope-stores.js';
 import { assertNoUnreachableScopeCopies, listAllScopeScriptCopies, reapScopeScriptCopies, recordStrandedStorage } from './scope-copy-cleanup.js';
 import { BACKFILL_PAGE_MAX, backfillScopeScriptCopies } from './scope-copy-backfill.js';
 import { oidcCallbackUrl, retireClientsOfReapedScope, wirePreviewAuth } from './preview-auth.js';
@@ -21,7 +22,7 @@ import { mapError } from './errors.js';
 import { maskDump, maskRecords } from './mask.js';
 import { createPseudonymizer } from './pseudonymize.js';
 import { openDump, sealDump } from './seal.js';
-import { assertSandboxContract, deployManifest, storedDeployManifest, pushedPermissionRegistry, deploymentRefFor, stableDeploymentRefFor, nextMigrationTag, upstreamStatusOf, } from './deploy.js';
+import { assertSandboxContract, verticalUploadBindings, deployManifest, storedDeployManifest, pushedPermissionRegistry, deploymentRefFor, stableDeploymentRefFor, nextMigrationTag, upstreamStatusOf, } from './deploy.js';
 /**
  * Answer with a problem document (#113 phase 4).
  *
@@ -817,6 +818,100 @@ async function answeredMessage(res) {
 export function createControlPlaneApi(options) {
     const { host, authenticate, authenticateBuilder, authenticateTenantService } = options;
     const copyLeaseMs = options.copyLeaseMs ?? SCOPE_COPY_LEASE_MS;
+    /** The stores of the version the scope's deployment runs (`scopeStoresOf`, #2207). */
+    const manifestStores = (c, scope) => scopeStoresOf(c.var.admin, c.get('actor'), scope, options.storeKinds);
+    /**
+     * The platform's path to a scope's stores, or nothing: no caller is a co-located host whose
+     * own export, restore, wipe and erasure carry its stores, and a scope that declares none has
+     * none to reach. A hosted control plane always passes a caller (`unreachablePlatformScopeStores`
+     * when it has no route), so a declared store is never skipped there.
+     */
+    const platformStoresOf = async (c, scope) => {
+        const caller = options.platformScopeStores;
+        if (!caller || !scope.vertical)
+            return undefined;
+        const stores = await manifestStores(c, scope);
+        return stores.length > 0 ? { caller, vertical: scope.vertical, stores } : undefined;
+    };
+    /** `substrat.wipe` on each declared store, before the scope's own bytes go. */
+    const wipePlatformStores = async (c, scope) => {
+        const reach = await platformStoresOf(c, scope);
+        if (!reach)
+            return;
+        await reach.caller.wipeStores({ tenantId: scope.tenantId, scopeId: scope.id, vertical: reach.vertical, stores: reach.stores });
+    };
+    /** `substrat.export` on each declared store, for a backup, a full pull or a fork. */
+    const exportPlatformStores = async (c, scope) => {
+        const reach = await platformStoresOf(c, scope);
+        if (!reach)
+            return undefined;
+        return reach.caller.exportStores({ tenantId: scope.tenantId, scopeId: scope.id, vertical: reach.vertical, stores: reach.stores });
+    };
+    /**
+     * `substrat.erase` on the destination's stores for each subject tombstoned in the destination
+     * or the source, each subject once (`replayStoreErasures`, #2207): one store call per subject
+     * per declared binding, all inside this request. A failed call marks the replay incomplete,
+     * and the next restore repeats every call from the first subject, so it converges only while
+     * the whole replay fits one request's subrequest and duration budget. Nothing when the platform
+     * calls no stores for the destination.
+     */
+    const replayPlatformStoreErasures = async (c, destination, source) => {
+        // Called once the data has landed: a store list that cannot be resolved is reported as an
+        // incomplete replay, never thrown past a restore that already wrote.
+        let reach;
+        try {
+            reach = await platformStoresOf(c, destination);
+        }
+        catch (e) {
+            if (e instanceof ControlPlaneError && e.status === 503)
+                return { storeErasuresReplayed: 0, storeErasureIncomplete: true };
+            throw e;
+        }
+        if (!reach)
+            return undefined;
+        const { caller, vertical, stores } = reach;
+        return replayStoreErasures({
+            admin: c.var.admin,
+            actor: c.get('actor'),
+            tenantId: destination.tenantId,
+            target: destination.id,
+            source,
+            erase: async (subjectId) => (await caller.eraseSubject({ tenantId: destination.tenantId, scopeId: destination.id, vertical, subjectId, stores })).length,
+        });
+    };
+    /**
+     * The store replay on a route's answer (#2207). Present only with something to report, as
+     * `StoreErasureReplay` is. `sourceUnknown`: the source is not a scope of this tenant here,
+     * so its marks were not read, and a retry does not change that.
+     */
+    const storeReplayFields = (replays) => replays.length === 0
+        ? {}
+        : {
+            storeErasuresReplayed: replays.reduce((n, r) => n + r.storeErasuresReplayed, 0),
+            ...(replays.some((r) => r.storeErasureIncomplete) ? { incomplete: true } : {}),
+            ...(replays.some((r) => r.storeErasureSourceUnknown) ? { sourceUnknown: true } : {}),
+        };
+    /**
+     * A dump's stores, checked against what the destination's version declares (#2207), before
+     * any write: a binding it does not declare, or one of another kind, would be imported into an
+     * object nothing reads, or into one of the wrong shape.
+     */
+    const refuseUndeclaredDumpStores = async (c, scope, stores) => {
+        if (stores.length === 0)
+            return;
+        if (!scope.vertical)
+            throw new ControlPlaneError(422, 'restore refused: the dump names stores and the scope names no vertical');
+        const declared = new Map((await manifestStores(c, scope)).map((d) => [d.binding, d.kind]));
+        for (const store of stores) {
+            const kind = declared.get(store.binding);
+            if (kind === undefined) {
+                throw new ControlPlaneError(422, `restore refused: the dump names store '${store.binding}', which this scope's version does not declare`);
+            }
+            if (kind !== store.kind) {
+                throw new ControlPlaneError(422, `restore refused: the dump's store '${store.binding}' is a '${store.kind}', and this scope's version declares a '${kind}'`);
+            }
+        }
+    };
     const app = new Hono();
     // The 5xx backstop: every 5xx this API answers lands an ops-failure row, however it was
     // answered. A 5xx is the PLATFORM failing (an unmapped throw, or a downstream vertical's own
@@ -1280,6 +1375,7 @@ export function createControlPlaneApi(options) {
                 // retiring (not erasing) a tenant pass `backup: true` deliberately.
                 const backup = wantsBackup === true ? await backupScope(c, tenantId, scope) : null;
                 const vertical = await verticalForScope(c, scope);
+                await wipePlatformStores(c, scope);
                 if (vertical)
                     await vertical.deleteScope({ tenantId, scopeId: scope.id });
                 // Tenant teardown reaps every scope and releases every name by design — force past
@@ -3173,6 +3269,9 @@ export function createControlPlaneApi(options) {
                 connectionGrants,
                 connectionKeys,
                 ...(entityGrants ? { entityGrants } : {}),
+                // #2263: a vertical with no owner of record still seats what its version declares, and
+                // answers `owner: null`, which the CLI reports as a lockout NOT repaired.
+                ownerless: 'seat',
                 ...carry,
                 // Handed over exactly as at provision: a store minted HERE has never been migrated
                 // by the vertical, so the reconcile must carry it into the same ready-gate — a bound
@@ -3864,7 +3963,7 @@ export function createControlPlaneApi(options) {
         const deployment = await deploymentForScope(c, scope);
         const vertical = deployment?.client;
         if (!vertical)
-            return c.var.host.snapshotScope(actor, tenantId, scope.id, opts);
+            return { snapId: await c.var.host.snapshotScope(actor, tenantId, scope.id, opts) };
         const snapId = scopeIdSchema.parse(ulid());
         // #1722: the script the copy lands in (the source's own), named in the ledger before the
         // copy, so a bind that fails, or a request that dies, leaves a fork reap and erasure reach.
@@ -3891,6 +3990,9 @@ export function createControlPlaneApi(options) {
                     ref = null;
             }
         }
+        // #2207: the stores are resolved before anything is written, so one that cannot be named
+        // refuses the snapshot rather than leave a fork row behind.
+        const reach = await platformStoresOf(c, scope);
         // Directory row FIRST, as `provisioning` (K-31's two-phase shape, used as
         // intended): a crash between the row and the data copy leaves an inert
         // provisioning row — which, carrying provenance and an expiry, the GC sweep
@@ -3906,6 +4008,7 @@ export function createControlPlaneApi(options) {
             expiresAt: opts.expiresAt,
         });
         const moveId = ref ? ulid() : null;
+        let replay;
         try {
             if (moveId && ref) {
                 // No load stamp: the vertical's in-script copy leaves none, so a crash-recovery sweep keeps
@@ -3913,6 +4016,16 @@ export function createControlPlaneApi(options) {
                 await c.var.admin.recordScopeScriptCopy(actor, tenantId, snapId, ref, moveId, { role: 'destination', leaseMs: copyLeaseMs });
             }
             await retryTransient(() => copier.snapshotScope({ sourceScopeId: scope.id, newScopeId: snapId, tenantId }));
+            // The scope file was copied inside the script. The store objects are per scope, so the
+            // fork gets its own copy through the reserved export and import, signed by the
+            // control plane. A version that declares no stores has nothing to copy.
+            if (reach) {
+                const stores = await reach.caller.exportStores({ tenantId, scopeId: scope.id, vertical: reach.vertical, stores: reach.stores });
+                if (stores.length > 0) {
+                    await reach.caller.importStores({ tenantId, scopeId: snapId, vertical: reach.vertical, stores });
+                    replay = await replayPlatformStoreErasures(c, { ...scope, id: snapId }, scope.id);
+                }
+            }
             await c.var.admin.activateScope(actor, tenantId, snapId);
             // Bound to the SOURCE's current version: source and fork share a deployment, so
             // the fork resolves to the DO namespace its bytes actually live in.
@@ -3934,7 +4047,7 @@ export function createControlPlaneApi(options) {
             }
             throw e;
         }
-        return snapId;
+        return { snapId, replay };
     };
     // The forks OF one scope — what a Snapshots UI lists. A directory read (kind,
     // provenance, expiry all live on the scope row); newest first.
@@ -3954,8 +4067,10 @@ export function createControlPlaneApi(options) {
         if (!scope)
             return c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404);
         try {
-            const snapId = await orchestratedSnapshot(c, tenantId, scope, body);
-            return c.json(await c.var.admin.getScopeRecord(c.get('actor'), tenantId, snapId), 201);
+            const { snapId, replay } = await orchestratedSnapshot(c, tenantId, scope, body);
+            const record = await c.var.admin.getScopeRecord(c.get('actor'), tenantId, snapId);
+            // #2207: the fork's erasure replay, under the restore's rule: present only with something to report.
+            return c.json({ ...record, ...storeReplayFields(replay ? [replay] : []) }, 201);
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
@@ -3979,11 +4094,11 @@ export function createControlPlaneApi(options) {
      * 5xx, a timeout) still aborts — an implemented wipe that failed is a retry, not a
      * shrug. Returns true when the storage was stranded.
      */
-    const deleteScopeStorageOrStrand = async (vertical, tenantId, scopeId) => {
+    const deleteScopeStorageOrStrand = async (c, vertical, scope) => {
         if (!vertical)
             return false;
         try {
-            await vertical.deleteScope({ tenantId, scopeId });
+            await vertical.deleteScope({ tenantId: scope.tenantId, scopeId: scope.id });
             return false;
         }
         catch (e) {
@@ -4005,10 +4120,13 @@ export function createControlPlaneApi(options) {
      */
     const reapScopeStorage = async (c, scope) => {
         const actor = c.get('actor');
+        // #2207: the stores first, on every path below: a routed scope's copies are reaped through
+        // their scripts, and a store is per scope, not per script.
+        await wipePlatformStores(c, scope);
         // The deployment the scope's vertical resolves to, deleted through; a 501 there is recorded
         // as stranded storage, as `reapScopeScriptCopies` records its own.
         const viaDeployment = async () => {
-            const stranded = await deleteScopeStorageOrStrand(await verticalForScope(c, scope), scope.tenantId, scope.id);
+            const stranded = await deleteScopeStorageOrStrand(c, await verticalForScope(c, scope), scope);
             if (stranded) {
                 await recordStrandedStorage(c.var.admin, actor, scope.tenantId, scope.id, `the deployment its vertical '${scope.vertical}' resolves to`);
             }
@@ -4073,6 +4191,9 @@ export function createControlPlaneApi(options) {
         const dump = await c.var.admin.exportScope(c.get('actor'), tenantId, scope.id);
         const vertical = await verticalForScope(c, scope);
         const tables = vertical ? await vertical.exportScope(scope.id) : dump.tables;
+        // Store tables are opaque and stay unsealed. The platform reads them from the store script
+        // (#2207); a store it cannot name or reach refuses the backup rather than omitting it.
+        const stores = (await exportPlatformStores(c, scope)) ?? dump.stores;
         // Seal classified payloads per subject on the way in (#37). This copy is full-fidelity
         // and the platform keeps it, which is precisely why an erasure could never reach it: a
         // redaction fixes the live scope and does nothing to the object already in R2. Sealed
@@ -4080,7 +4201,7 @@ export function createControlPlaneApi(options) {
         // Restores open it again (`restoreFromBackup`) — except for subjects shredded in the
         // meantime, which is the mechanism working rather than the copy being damaged.
         const sealed = await sealDump(tables, sealerFor(c, tenantId, scope.id));
-        return store.put({ vertical: scope.vertical, dump: { ...dump, tables: sealed } });
+        return store.put({ vertical: scope.vertical, dump: { ...dump, tables: sealed, stores } });
     };
     // The copies held for one scope — metadata only, so listing a reaped scope's backups
     // is cheap and hands out no bytes. Readable AFTER the reap (that is the point): the
@@ -4172,17 +4293,31 @@ export function createControlPlaneApi(options) {
         }
         const erasureEpoch = await c.var.admin.scopeErasureEpoch(c.get('actor'), tenantId, scopeId);
         const currentRef = await routeOf(c, scope);
+        // #2207: the stores of the version the deployment runs, resolved before anything is erased. A
+        // version that declares none is not asked. One that cannot be resolved while a kind is
+        // registered refuses (503): the key must not be destroyed while a store may hold the subject.
+        const reach = await platformStoresOf(c, scope);
+        // Not asked is `undefined`, not `[]` (#2242): with no platform path the host's own stores
+        // (the pure adapter's co-located runners) are erased in its shred or its finalize.
+        const eraseStores = async () => reach ? reach.caller.eraseSubject({ tenantId, scopeId, vertical: reach.vertical, subjectId, stores: reach.stores }) : undefined;
+        /** The host's own shred, with the platform's store erasure first: a store that errors keeps the key. */
+        const shredHere = async () => {
+            const storeErasures = await eraseStores();
+            const receipt = await c.var.admin.shredSubject(c.get('actor'), tenantId, scopeId, subjectId);
+            return { ...receipt, storeErasures: [...receipt.storeErasures, ...(storeErasures ?? [])] };
+        };
         if (!options.resolveVerticalRef) {
             if (currentRef || copies.some((copy) => copy.state !== 'done')) {
                 throw new ControlPlaneError(502, `scope ${scopeId} has script copies, but this control plane cannot reach their deployments`);
             }
-            return c.json(await c.var.admin.shredSubject(c.get('actor'), tenantId, scopeId, subjectId));
+            return c.json(await shredHere());
         }
         // A scope nothing routes may still keep its store where its vertical resolves by slug (where
         // it was provisioned), so erasure reaches that deployment too, as reap does (`reapScopeStorage`).
-        const bySlug = currentRef ? undefined : await verticalForScope(c, scope);
+        const reached = currentRef ? undefined : await deploymentForScope(c, scope);
+        const bySlug = reached?.client;
         if (!currentRef && !bySlug && copies.every((copy) => copy.state === 'done')) {
-            return c.json(await c.var.admin.shredSubject(c.get('actor'), tenantId, scopeId, subjectId));
+            return c.json(await shredHere());
         }
         const refs = new Set(copies.filter((copy) => copy.state !== 'done').map((copy) => copy.scriptRef));
         if (currentRef)
@@ -4196,10 +4331,11 @@ export function createControlPlaneApi(options) {
         }
         if (bySlug)
             redactions.push(await bySlug.redactSubject(scopeId, subjectId));
+        const storeErasures = await eraseStores();
         return c.json(await c.var.admin.finalizeSubjectShred(c.get('actor'), tenantId, scopeId, subjectId, redactions, {
             versionId: scope.verticalVersionId, servingRef: scope.servingRef ?? null, epoch: erasureEpoch,
             copyCount: copies.length,
-        }).catch(relayHostRefusal));
+        }, storeErasures).catch(relayHostRefusal));
     });
     // -- directory backups (#40) -----------------------------------------------
     // The platform's own disaster recovery, on the same store posture as the scope
@@ -4693,14 +4829,20 @@ export function createControlPlaneApi(options) {
             const dump = await c.var.admin.exportScope(actor, tenantId, scopeId);
             const vertical = await verticalForScope(c, scope);
             const tables = vertical ? await vertical.exportScope(scopeId) : dump.tables;
-            if (full)
-                return c.json({ ...dump, tables, masked: false });
+            if (full) {
+                // Store tables are opaque. The platform reads them from the store script (#2207); a
+                // store it cannot name or reach refuses the pull rather than omitting it.
+                const stores = (await exportPlatformStores(c, scope)) ?? dump.stores;
+                return c.json({ ...dump, tables, stores, masked: false });
+            }
             // One pseudonymizer for the whole response (#1034): the same customer has to read
             // the same in their own row, in every event payload that quoted them, and in the
             // timeline — a per-table generator would break exactly the joins that make a
             // masked copy worth pulling.
             const mask = await createPseudonymizer(options.maskSalt ?? crypto.randomUUID());
-            return c.json({ ...dump, tables: await maskDump(tables, mask), masked: true });
+            // A masked pull cannot see inside a scope store, so it ships none rather than
+            // the raw tables beside pseudonymized scope rows.
+            return c.json({ ...dump, tables: await maskDump(tables, mask), stores: [], masked: true });
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
@@ -4780,7 +4922,15 @@ export function createControlPlaneApi(options) {
                 const dump = await c.var.admin.exportScope(actor, tenantId, scope.id);
                 const vertical = await verticalForScope(c, scope);
                 const tables = vertical ? await vertical.exportScope(scope.id) : dump.tables;
-                data.push({ ...dump, tables: mask ? await maskDump(tables, mask) : tables });
+                data.push({
+                    ...dump,
+                    tables: mask ? await maskDump(tables, mask) : tables,
+                    // A scope store's tables are opaque, so the pseudonymizer cannot see inside them.
+                    // A masked export omits them rather than shipping them unmasked. A full one reads them
+                    // where they live, as a backup does (#2207): the host's own dump has none on the hosted
+                    // plane, and a store that cannot be named refuses the export rather than leave it out.
+                    stores: mask ? [] : ((await exportPlatformStores(c, scope)) ?? dump.stores),
+                });
             }
             // The admin log is FULL-only (#36): it records what STAFF did, so it is not the
             // customer's Art. 20 data, and it carries staff actor ids and internal action
@@ -4853,6 +5003,17 @@ export function createControlPlaneApi(options) {
         if (dump.tables.length === 0) {
             return c.json({ error: 'restore refused: the backup has no tables — not a scope dump' }, 422);
         }
+        // #2207: the dump's stores against the destination's declaration, before anything is written.
+        if (options.platformScopeStores) {
+            try {
+                await refuseUndeclaredDumpStores(c, scope, dump.stores);
+            }
+            catch (e) {
+                if (e instanceof ControlPlaneError)
+                    return c.json({ error: e.message }, failedWith(c, e));
+                throw e;
+            }
+        }
         try {
             // Belt and braces for #37: a caller who fetched the object bytes by some other route
             // may POST a still-sealed dump, and a scope restored full of ciphertext is a silent
@@ -4866,12 +5027,25 @@ export function createControlPlaneApi(options) {
             // the destination's would find no key, null every payload, and call it a restore.
             const origin = { tenantId: tenantIdSchema.parse(dump.tenantId), scopeId: scopeIdSchema.parse(dump.scopeId) };
             const tables = await openDump(dump.tables, sealerFor(c, origin.tenantId, origin.scopeId));
-            const landing = { ...dump, tables };
+            const vertical = await verticalForScope(c, scope);
+            const storesCaller = options.platformScopeStores;
+            const landing = { ...dump, tables, stores: storesCaller && vertical ? [] : dump.stores };
             // #2185: cleared before the load as well as after it (below): a step after the load can still
             // throw (the deployment's half, the re-assert), and the data that landed may predate a reconcile.
             await c.var.admin.markScopeProvisioned(actor, tenantId, scopeId, null);
-            await c.var.host.restoreScope(actor, tenantId, scopeId, landing, sourceHint ? { sourceScopeId: sourceHint } : undefined);
-            const vertical = await verticalForScope(c, scope);
+            const hostReplay = await c.var.host.restoreScope(actor, tenantId, scopeId, landing, sourceHint ? { sourceScopeId: sourceHint } : undefined);
+            if (storesCaller && vertical && scope.vertical && dump.stores.length > 0) {
+                await storesCaller.importStores({
+                    tenantId,
+                    scopeId,
+                    vertical: scope.vertical,
+                    stores: dump.stores,
+                });
+            }
+            const platformReplay = storesCaller && scope.vertical
+                ? await replayPlatformStoreErasures(c, scope, sourceHint ?? origin.scopeId)
+                : undefined;
+            const replays = [hostReplay, platformReplay].filter((r) => !!r);
             // #1742: the recorded OFF positions ride the restore, so the deployment switches them
             // off in the replay's own event — its own sweeper cannot land in between.
             const restored = vertical
@@ -4890,7 +5064,11 @@ export function createControlPlaneApi(options) {
             // finished: the install reads as not reconciled, and the sweep's next pass reconciles it.
             // Again here, after the load, for a sweep reconcile that wrote the receipt while it ran.
             await c.var.admin.markScopeProvisioned(actor, tenantId, scopeId, null);
-            return c.json({ restored: scopeId, tables: tables.length });
+            return c.json({
+                restored: scopeId,
+                tables: tables.length,
+                ...storeReplayFields(replays),
+            });
         }
         catch (e) {
             // #2185: and once more on the way out of a failure, for a sweep reconcile that wrote the
@@ -6160,7 +6338,9 @@ export function createControlPlaneApi(options) {
             compatibilityFlags: manifest.compatibilityFlags,
             modules,
             doClasses,
-            bindings: [...manifest.bindings, ...storeBindings],
+            // #2210: a declared scope store adds no binding to either upload (L1), held at both call
+            // sites with a kind registered by upload-scope-store-bindings.test.ts.
+            bindings: verticalUploadBindings({ vertical: slug, manifest, platformBindings: storeBindings }),
             // #1242: the version now being served, injected as `SUBSTRAT_VERSION_ID` so the
             // scope host stamps the signals `version` dimension. The serving script is one
             // stable script updated in place, so this refresh is what keeps the binding
@@ -6684,7 +6864,7 @@ export function createControlPlaneApi(options) {
                 compatibilityFlags: manifest.compatibilityFlags,
                 modules,
                 doClasses: manifest.doClasses,
-                bindings: manifest.bindings,
+                bindings: verticalUploadBindings({ vertical: slug, manifest, platformBindings: [] }),
                 // #1242: the freshly minted version id — this archive script IS that version,
                 // and a preview routed at it stamps the signals `version` dimension honestly.
                 versionId: id,
@@ -7541,6 +7721,7 @@ export function createControlPlaneApi(options) {
         // place, so the retry a PR-close job makes still finds it — after the row is gone, nothing
         // would name those clients again. A clean room never had one.
         await retireClientsOfReapedScope(previewAuthDeps(c), preview);
+        await wipePlatformStores(c, preview);
         let storageStranded = false;
         if (options.resolveVerticalRef) {
             ({ storageStranded } = await reapScopeScriptCopies({