@substrat-run/control-plane-api 0.176.0 → 0.178.0

package/dist/platform-scope-stores.js

@@ -1,5 +1,5 @@
-import { LIST_PAGE_MAX, mayHoldScopeStores, scopeStoresDeclaredIn, STORE_DRIVERS, issueScopeStoreEnvelope, SCOPE_STORE_ENVELOPE_HEADER, SCOPE_STORE_SIGNATURE_HEADER, ScopeStoreKeyError, scopeStoreObjectName, scopeStoreScriptName, storeEraseResult, storeExportResult, storeSizeResult, StoreError, } from '@substrat-run/contracts';
-import { callReservedStoreOperation } from '@substrat-run/kernel';
+import { LIST_PAGE_MAX, mayHoldScopeStores, scopeStoresDeclaredIn, STORE_DRIVERS, issueScopeStoreEnvelope, SCOPE_STORE_ENVELOPE_HEADER, SCOPE_STORE_SIGNATURE_HEADER, ScopeStoreKeyError, STORE_CALL_MAX_BYTES, scopeStoreBodyBytes, scopeStoreObjectName, scopeStoreScriptName, storeEraseResult, storeDriverDumpPageBytes, storeSizeResult, StoreError, } from '@substrat-run/contracts';
+import { callReservedStoreOperation, readStoreDump, writeStoreDump } from '@substrat-run/kernel';
 import { ControlPlaneError } from '@substrat-run/control-plane-client';
 import { storedDeployManifest } from './deploy.js';
 /** Bindings a version manifest declares. Missing JSON is none. Unreadable JSON fails closed. */
@@ -65,34 +65,48 @@ export async function unrouteScope(admin, actor, scope) {
  * ordinary install whose store the router serves. A pin that names another script than the
  * pointer's is unknown, as #2242's erasure gate has it.
  *
- * The gate is `mayHoldScopeStores`: with no driver registered nothing can hold a store, and the
- * answer is none. Otherwise a version that cannot be named, a manifest that cannot be read, or one
- * the gate says may hold a store without naming it refuses (503), rather than let a backup, a
- * wipe, a replay or an erasure skip a store that may hold data — where a store can exist (#2394).
- * One can exist only under a binding some version of the scope's vertical declared: the router
- * reaches a store only through a version row's manifest (`READ_ROUTE_SQL`), and `publishVersion`
- * records that row's bindings in the same transaction (`HostAdmin.verticalScopeStores`). So when
- * that record says the vertical has declared none, the answer is none; when it cannot be read, the
- * refusal stands. A bind or promote that lands after the read is the erasure fence's to refuse,
- * as it is for a version that declares none.
+ * The vertical's record of declared bindings is read first (`declaredRecordOf`): with no driver
+ * registered, or a record that says the vertical has declared none, the answer is none; a record
+ * that cannot be read refuses. Only then is the running version read, and a version that cannot be
+ * named, a manifest that cannot be read, or one the gate (`mayHoldScopeStores`) says may hold a
+ * store without naming it refuses (503), rather than let a backup, a wipe, a replay or an erasure
+ * skip a store that may hold data (#2394). A bind or promote that lands after the read is the
+ * erasure fence's to refuse, as it is for a version that declares none.
  *
  * `running` is a resolution the caller already holds (`runningVersionOf`), so a caller that fences
  * on the version reads it once and judges the stores against the same read.
  */
 export async function runningVersionStoresOf(admin, actor, scope, drivers = STORE_DRIVERS, running) {
+    const record = await declaredRecordOf(admin, actor, scope, drivers);
+    return record.length === 0 ? [] : runningStoresOfDeclaring(admin, actor, scope, drivers, running);
+}
+/**
+ * The vertical's record of every binding any version declared, read first and once: a vertical
+ * that never declared a store answers none with this one read, which is what the sweep pays for
+ * almost every scope it meters or reaps. Sound because a store exists only under a binding some
+ * version declared: the router reaches a store only through a version row's manifest
+ * (`READ_ROUTE_SQL`), every insert of a version row records its bindings in the same transaction,
+ * and the read itself first indexes any stored version not yet indexed, so the record covers every
+ * version the vertical holds (#2292). A record that cannot be read refuses (503). None, with no
+ * read, where nothing can hold a store: no vertical, or no driver registered.
+ */
+async function declaredRecordOf(admin, actor, scope, drivers) {
     if (!scope.vertical || !mayHoldScopeStores(undefined, drivers))
         return [];
+    return storesDeclaredBy(admin, actor, scope.vertical);
+}
+/** The running version's stores, for a scope whose vertical has declared at least one (the record says so). */
+async function runningStoresOfDeclaring(admin, actor, scope, drivers, running) {
+    const vertical = scope.vertical;
     const { versionId } = running ?? await runningVersionOf(admin, actor, scope);
     const manifestJson = versionId
-        ? await admin.versionManifest(actor, scope.vertical, versionId).catch(() => undefined)
+        ? await admin.versionManifest(actor, vertical, versionId).catch(() => undefined)
         : undefined;
     if (!mayHoldScopeStores(manifestJson, drivers))
         return [];
     const declared = typeof manifestJson === 'string' && scopeStoresDeclaredIn(manifestJson) ? declaredStoresOf(manifestJson) : [];
     if (declared.length > 0)
         return declared;
-    if ((await storesDeclaredBy(admin, actor, scope.vertical)).length === 0)
-        return [];
     throw new ControlPlaneError(503, `scope ${scope.id} may hold scope stores, and the version it runs cannot say which`);
 }
 /** Every binding any version of `vertical` declared (#2286); a record that cannot be read refuses (503). */
@@ -109,18 +123,19 @@ async function storesDeclaredBy(admin, actor, vertical) {
  * (`runningVersionStoresOf`, which still fails closed first), and every binding any version of its
  * vertical has declared (`HostAdmin.verticalScopeStores`, read by its keys). Export, wipe, erasure
  * and the meter reach `all`, so an object under a binding a later version dropped is still
- * reached. A restore imports only into `running` (L8).
+ * reached. A restore imports only into `running` (L8). The record is read once, first, and judges
+ * both.
  *
  * A binding keeps its driver for the life of the vertical, since publish refuses a driver change; a
  * running version whose driver disagrees with the record, or a record that cannot be read,
  * refuses (503).
  */
 export async function scopeStoreReachOf(admin, actor, scope, drivers = STORE_DRIVERS, running) {
-    const current = await runningVersionStoresOf(admin, actor, scope, drivers, running);
-    if (!scope.vertical || !mayHoldScopeStores(undefined, drivers))
-        return { running: current, all: current };
-    const declared = await storesDeclaredBy(admin, actor, scope.vertical);
-    const all = new Map(declared.map((store) => [store.binding, store.driver]));
+    const record = await declaredRecordOf(admin, actor, scope, drivers);
+    if (record.length === 0)
+        return { running: [], all: [] };
+    const current = await runningStoresOfDeclaring(admin, actor, scope, drivers, running);
+    const all = new Map(record.map((store) => [store.binding, store.driver]));
     for (const store of current) {
         const driver = all.get(store.binding);
         if (driver !== undefined && driver !== store.driver) {
@@ -159,6 +174,11 @@ export async function callPlatformScopeStoreAt(dispatch, target, operation, inpu
     try {
         return await callReservedStoreOperation(async (request) => {
             const body = JSON.stringify({ ...request, objectName });
+            // The store entry refuses a body over the limit (#2811), so it is refused here, before it is signed.
+            const bytes = scopeStoreBodyBytes(body);
+            if (bytes > STORE_CALL_MAX_BYTES) {
+                throw new ControlPlaneError(413, `scope store call '${request.operation}' carries a body of ${bytes} bytes, over the limit of ${STORE_CALL_MAX_BYTES}. Nothing was sent.`);
+            }
             let issued;
             try {
                 issued = await issueScopeStoreEnvelope({
@@ -198,21 +218,24 @@ export async function callPlatformScopeStoreAt(dispatch, target, operation, inpu
         asControlPlane(error);
     }
 }
-/** The five reserved operations, one call per declared binding. */
+/** The reserved operations a platform call makes, a dump in pages (D-69), one chain per declared binding. */
 export function platformScopeStoresFor(dispatch) {
     const call = (target, operation, input) => callPlatformScopeStore(dispatch, target, operation, input);
+    const reservedAt = (target) => ((operation, input) => call(target, operation, input));
     return {
         async exportStores({ tenantId, scopeId, vertical, stores }) {
             const exported = [];
             for (const store of stores) {
-                const { tables } = storeExportResult.parse(await call({ ...store, tenantId, scopeId, vertical }, 'substrat.export'));
+                const target = { ...store, tenantId, scopeId, vertical };
+                const tables = await readStoreDump(reservedAt(target), storeDriverDumpPageBytes(store.driver));
                 exported.push({ binding: store.binding, driver: store.driver, tables });
             }
             return exported;
         },
         async importStores({ tenantId, scopeId, vertical, stores }) {
             for (const store of stores) {
-                await call({ ...store, tenantId, scopeId, vertical }, 'substrat.import', { tables: store.tables });
+                const target = { ...store, tenantId, scopeId, vertical };
+                await writeStoreDump(reservedAt(target), store.tables, storeDriverDumpPageBytes(store.driver));
             }
         },
         async eraseSubject({ tenantId, scopeId, vertical, subjectId, stores }) {

package/dist/platform-scope-stores.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-scope-stores.js","sourceRoot":"","sources":["../src/platform-scope-stores.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,2BAA2B,EAC3B,4BAA4B,EAC5B,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,UAAU,GAMX,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,0BAA0B,EAAkB,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AA8DnD,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAAC,YAA2B;IAC1D,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,4CAA4C,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,4CAA4C,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;AACjC,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAyC,EACzC,KAAsB,EACtB,KAAmE;IAEnE,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;IACxF,IAAI,OAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,2BAA2B,KAAK,CAAC,QAAQ,qBAAqB,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC;AACnH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAA0D,EAC1D,KAAsB,EACtB,KAAqC;IAErC,iGAAiG;IACjG,iFAAiF;IACjF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QACrH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,mCAAmC,CAAC,CAAC;YACrG,kGAAkG;YAClG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7F,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAqF,EACrF,KAAsB,EACtB,KAA0E,EAC1E,OAAO,GAAuC,aAAa,EAC3D,OAAwB;IAExB,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1E,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,IAAI,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,SAAS;QAC5B,CAAC,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QACtF,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,OAAO,YAAY,KAAK,QAAQ,IAAI,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/H,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,CAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnF,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,SAAS,KAAK,CAAC,EAAE,kEAAkE,CAAC,CAAC;AACxH,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,gBAAgB,CAC7B,KAA6C,EAC7C,KAAsB,EACtB,QAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,qBAAqB,QAAQ,kCAAkC,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAqF,EACrF,KAAsB,EACtB,KAA0E,EAC1E,OAAO,GAAuC,aAAa,EAC3D,OAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAC1G,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACpD,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,KAAK,CAAC,OAAO,0BAA0B,MAAM,UAAU,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3H,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAqF,EACrF,KAAsB,EACtB,KAA0E,EAC1E,OAAO,GAAuC,aAAa,EAC3D,OAAwB;IAExB,OAAO,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,KAAK,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAoC,EACpC,MAAgC,EAChC,SAAiC,EACjC,KAAe;IAEf,OAAO,wBAAwB,CAC7B,QAAQ,EACR;QACE,UAAU,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QAChE,UAAU,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;KACnG,EACD,SAAS,EACT,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAoC,EACpC,MAAoE,EACpE,SAAiC,EACjC,KAAe;IAEf,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC1B,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACxD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,uBAAuB,CAAC;oBACrC,UAAU,EAAE,QAAQ,CAAC,WAAW;oBAChC,GAAG,EAAE,UAAU;oBACf,MAAM,EAAE,UAAU;oBAClB,IAAI,EAAE,UAAU;oBAChB,EAAE,EAAE,OAAO,CAAC,SAAS;oBACrB,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACxD,2FAA2F;gBAC3F,OAAO,CAAC,IAAI,CAAC,qEAAqE,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;gBACpG,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC,UAAU,EACV,IAAI,OAAO,CAAC,4BAA4B,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC,MAAM;oBAC5C,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC,SAAS;iBACjD;gBACD,IAAI;aACL,CAAC,CACH,CAAC;YACF,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CAAC,QAAoC;IACzE,MAAM,IAAI,GAAG,CAAC,MAAgC,EAAE,SAAiC,EAAE,KAAe,EAAE,EAAE,CACpG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7D,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE;YACxD,MAAM,QAAQ,GAAG,EAAE,CAAC;YACpB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,KAAK,CACxC,MAAM,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,iBAAiB,CAAC,CACzE,CAAC;gBACF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE;YACxD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE;YACnE,MAAM,MAAM,GAAG,EAAE,CAAC;YAClB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAC9C,MAAM,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,SAAS,EAAE,CAAC,CACvF,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE;YACtD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,eAAe,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE;YACtD,MAAM,KAAK,GAAG,EAAE,CAAC;YACjB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC,KAAK,CACrC,MAAM,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,eAAe,CAAC,CACvE,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B;IAC5C,MAAM,MAAM,GAAG,KAAK,IAAoB,EAAE;QACxC,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,8CAA8C,CAAC,CAAC;IACnF,CAAC,CAAC;IACF,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtH,CAAC"}
+{"version":3,"file":"platform-scope-stores.js","sourceRoot":"","sources":["../src/platform-scope-stores.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,2BAA2B,EAC3B,4BAA4B,EAC5B,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,eAAe,EACf,UAAU,GAMX,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAE,cAAc,EAA0C,MAAM,sBAAsB,CAAC;AACzI,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AA8DnD,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAAC,YAA2B;IAC1D,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,4CAA4C,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,4CAA4C,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;AACjC,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAyC,EACzC,KAAsB,EACtB,KAAmE;IAEnE,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;IACxF,IAAI,OAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,2BAA2B,KAAK,CAAC,QAAQ,qBAAqB,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC;AACnH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAA0D,EAC1D,KAAsB,EACtB,KAAqC;IAErC,iGAAiG;IACjG,iFAAiF;IACjF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QACrH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,mCAAmC,CAAC,CAAC;YACrG,kGAAkG;YAClG,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7F,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAqF,EACrF,KAAsB,EACtB,KAA0E,EAC1E,OAAO,GAAuC,aAAa,EAC3D,OAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACpG,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,gBAAgB,CAC7B,KAA6C,EAC7C,KAAsB,EACtB,KAA8B,EAC9B,OAA2C;IAE3C,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1E,OAAO,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,+GAA+G;AAC/G,KAAK,UAAU,wBAAwB,CACrC,KAA6D,EAC7D,KAAsB,EACtB,KAA0E,EAC1E,OAA2C,EAC3C,OAAwB;IAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAS,CAAC;IACjC,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,IAAI,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,SAAS;QAC5B,CAAC,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QAChF,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,OAAO,YAAY,KAAK,QAAQ,IAAI,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/H,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,SAAS,KAAK,CAAC,EAAE,kEAAkE,CAAC,CAAC;AACxH,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,gBAAgB,CAC7B,KAA6C,EAC7C,KAAsB,EACtB,QAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,qBAAqB,QAAQ,kCAAkC,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAqF,EACrF,KAAsB,EACtB,KAA0E,EAC1E,OAAO,GAAuC,aAAa,EAC3D,OAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACpD,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,KAAK,CAAC,OAAO,0BAA0B,MAAM,UAAU,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3H,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAqF,EACrF,KAAsB,EACtB,KAA0E,EAC1E,OAAO,GAAuC,aAAa,EAC3D,OAAwB;IAExB,OAAO,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,KAAK,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAoC,EACpC,MAAgC,EAChC,SAAiC,EACjC,KAAe;IAEf,OAAO,wBAAwB,CAC7B,QAAQ,EACR;QACE,UAAU,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QAChE,UAAU,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;KACnG,EACD,SAAS,EACT,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAoC,EACpC,MAAoE,EACpE,SAAiC,EACjC,KAAe;IAEf,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC1B,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACxD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YACxD,qGAAqG;YACrG,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,KAAK,GAAG,oBAAoB,EAAE,CAAC;gBACjC,MAAM,IAAI,iBAAiB,CACzB,GAAG,EACH,qBAAqB,OAAO,CAAC,SAAS,uBAAuB,KAAK,6BAA6B,oBAAoB,qBAAqB,CACzI,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,uBAAuB,CAAC;oBACrC,UAAU,EAAE,QAAQ,CAAC,WAAW;oBAChC,GAAG,EAAE,UAAU;oBACf,MAAM,EAAE,UAAU;oBAClB,IAAI,EAAE,UAAU;oBAChB,EAAE,EAAE,OAAO,CAAC,SAAS;oBACrB,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACxD,2FAA2F;gBAC3F,OAAO,CAAC,IAAI,CAAC,qEAAqE,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;gBACpG,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC,UAAU,EACV,IAAI,OAAO,CAAC,4BAA4B,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC,MAAM;oBAC5C,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC,SAAS;iBACjD;gBACD,IAAI;aACL,CAAC,CACH,CAAC;YACF,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,sBAAsB,CAAC,QAAoC;IACzE,MAAM,IAAI,GAAG,CAAC,MAAgC,EAAE,SAAiC,EAAE,KAAe,EAAE,EAAE,CACpG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,CAAC,MAAgC,EAAE,EAAE,CACtD,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAsB,CAAC;IAC9E,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE;YACxD,MAAM,QAAQ,GAAG,EAAE,CAAC;YACpB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACzD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC/F,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE;YACxD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACzD,MAAM,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE;YACnE,MAAM,MAAM,GAAG,EAAE,CAAC;YAClB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAC9C,MAAM,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,SAAS,EAAE,CAAC,CACvF,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE;YACtD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,eAAe,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE;YACtD,MAAM,KAAK,GAAG,EAAE,CAAC;YACjB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC,KAAK,CACrC,MAAM,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,eAAe,CAAC,CACvE,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B;IAC5C,MAAM,MAAM,GAAG,KAAK,IAAoB,EAAE;QACxC,MAAM,IAAI,iBAAiB,CAAC,GAAG,EAAE,8CAA8C,CAAC,CAAC;IACnF,CAAC,CAAC;IACF,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtH,CAAC"}

package/dist/r2-backups.d.ts

@@ -20,7 +20,7 @@ export declare function createR2DirectoryBackupStore(bucket: unknown): Directory
  * *"Iceberg is the contract, the query engine is replaceable"*, and the same
  * paragraph leaves R2 SQL's fitness explicitly open pending a benchmark. Writing
  * partitioned NDJSON to a bucket the platform already operates gets the events out
- * of the scope — which is what bounds an outbox that is never pruned — without
+ * of the scope — which is what licenses the retention prune that bounds the outbox — without
  * committing the ingest path to a product decision nobody has made yet. A
  * compaction step turns these objects into Iceberg later, and the seam means the
  * drain never learns which happened.
@@ -72,10 +72,13 @@ interface PruneOptions {
 }
 /**
  * Drop `scopes/…` reap copies (#493) older than the window. A copy's age is its
- * `capturedAt` — the key's last segment, same as the store's own fallback address — so a
- * hand-uploaded object without metadata still ages out rather than living forever by
- * omission. An unparsable timestamp keeps the copy: deleting what cannot be dated is not
- * retention.
+ * `capturedAt`: the object's metadata, else the key's segment after the scope, which is the
+ * manifest's name and the directory a paged copy's entries sit in (#2839). So a hand-uploaded
+ * object without metadata still ages out rather than living forever by omission. An
+ * unparsable timestamp keeps the copy: deleting what cannot be dated is not retention.
+ *
+ * A copy's manifest sorts before its entries (`.` before `/`), so it goes first: a pass cut
+ * short leaves entries no backup names, for the next pass, never a backup missing its entries.
  *
  * Note the interaction with #37 (erasure): per-subject payloads inside these dumps are
  * sealed under per-subject DEKs, so an old copy's PII exposure is bounded by key

package/dist/r2-backups.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"r2-backups.d.ts","sourceRoot":"","sources":["../src/r2-backups.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAsC3E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAsErE;AAcD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,oBAAoB,CAgElF;AAyCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,CA6C5D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,aAAa,CAgCpE;AAED;;;;;;;;;;;;;;;GAeG;AACH,UAAU,YAAY;IACpB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAuBD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAa/F;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAqBjB"}
+{"version":3,"file":"r2-backups.d.ts","sourceRoot":"","sources":["../src/r2-backups.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAoB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAoE7F,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAqHrE;AAoED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,oBAAoB,CAsHlF;AAyCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,CA6C5D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,aAAa,CAgCpE;AAED;;;;;;;;;;;;;;;GAeG;AACH,UAAU,YAAY;IACpB;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAuBD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAa/F;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC,CAqBjB"}

package/dist/r2-backups.js

@@ -9,55 +9,101 @@
  * One bucket, held by the PLATFORM, not by the tenant. A tenant-held bucket would be
  * deleted by the very teardown these copies exist to survive.
  */
-import { directoryDump, scopeDump, } from '@substrat-run/contracts';
+import { directoryDump, mergeDumpPages, scopeDump, scopeDumpChange, scopeDumpPageTable, scopeDumpTable, z, } from '@substrat-run/contracts';
 /**
- * Keys are `scopes/<tenantId>/<scopeId>/<capturedAt>.json`, so a scope's copies are one
+ * A backup is `scopes/<tenantId>/<scopeId>/<capturedAt>.json`, so a scope's copies are one
  * prefix list and a tenant's are one level up. The scheme is private to this module —
  * callers address a backup by (tenant, scope, capturedAt) and never build a path.
+ *
+ * That object is the backup's MANIFEST (#2839): the dump's header and how many entries hold its
+ * tables, each entry its own object at `scopes/<tenantId>/<scopeId>/<capturedAt>/<stageId>/<seq>.json`.
+ * One object per page rather than one multipart object, because a restore reads it back a page at
+ * a time: a single JSON document cannot be read in parts. The manifest is written last, so a
+ * backup that did not finish has none and is never listed or read.
+ *
+ * A backup written before #2839 is one whole dump at the manifest's key. It is read as a backup
+ * of one entry, which is its tables.
  */
 function backupKey(tenantId, scopeId, capturedAt) {
     return `scopes/${tenantId}/${scopeId}/${capturedAt}.json`;
 }
+function entryKey(tenantId, scopeId, capturedAt, stageId, seq) {
+    return `scopes/${tenantId}/${scopeId}/${capturedAt}/${stageId}/${seq}.json`;
+}
 function scopePrefix(tenantId, scopeId) {
     return `scopes/${tenantId}/${scopeId}/`;
 }
+/** A backup's manifest: the dump without its tables, and where its entries are. */
+const backupManifest = scopeDump.omit({ tables: true }).extend({
+    format: z.literal('paged'),
+    stageId: z.string().min(1),
+    entries: z.number().int().positive(),
+    tables: z.number().int().nonnegative(),
+});
+const backupEntry = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('page'), tables: z.array(scopeDumpPageTable) }),
+    z.object({ kind: z.literal('changes'), tables: z.array(scopeDumpChange) }),
+]);
+/** Byte length, not string length: a size is the stored object's, and non-ASCII would under-report. */
+const byteLength = (body) => new TextEncoder().encode(body).length;
 export function createR2BackupStore(bucket) {
     const r2 = bucket;
     return {
-        async put({ vertical, dump }) {
-            const body = JSON.stringify(dump);
-            // Byte length, not string length: the size is meant to be the stored object's,
-            // and a dump full of non-ASCII would otherwise under-report.
-            const size = new TextEncoder().encode(body).length;
-            const backup = {
-                tenantId: dump.tenantId,
-                scopeId: dump.scopeId,
-                vertical,
-                capturedAt: dump.capturedAt,
-                size,
-                tables: dump.tables.length,
-            };
-            await r2.put(backupKey(dump.tenantId, dump.scopeId, dump.capturedAt), body, {
-                httpMetadata: { contentType: 'application/json' },
-                // Mirrored into custom metadata so `list` can answer without fetching every
-                // dump — a scope's backups are megabytes, its listing is a table row.
-                customMetadata: {
-                    tenantId: backup.tenantId,
-                    scopeId: backup.scopeId,
-                    capturedAt: backup.capturedAt,
-                    tables: String(backup.tables),
-                    ...(vertical ? { vertical } : {}),
+        begin({ vertical, header }) {
+            const { tenantId, scopeId, capturedAt } = header;
+            const written = new Map();
+            return {
+                async put(stageId, seq, entry) {
+                    const body = JSON.stringify(entry);
+                    await r2.put(entryKey(tenantId, scopeId, capturedAt, stageId, seq), body, {
+                        httpMetadata: { contentType: 'application/json' },
+                        // Retention dates every object of a backup by this, entries included.
+                        customMetadata: { capturedAt },
+                    });
+                    const sizes = written.get(stageId) ?? [];
+                    sizes[seq] = byteLength(body);
+                    written.set(stageId, sizes);
                 },
-            });
-            return backup;
+                async discard(stageId) {
+                    const sizes = written.get(stageId) ?? [];
+                    written.delete(stageId);
+                    await Promise.all(sizes.map((_, seq) => r2.delete(entryKey(tenantId, scopeId, capturedAt, stageId, seq)).catch(() => undefined)));
+                },
+                async commit({ stageId, entries, tables }) {
+                    const sizes = written.get(stageId) ?? [];
+                    for (let seq = 0; seq < entries; seq++) {
+                        if (sizes[seq] === undefined)
+                            throw new Error(`backup entry ${seq} of ${entries} was never written`);
+                    }
+                    const body = JSON.stringify({ ...header, format: 'paged', stageId, entries, tables });
+                    const size = byteLength(body) + sizes.slice(0, entries).reduce((a, b) => a + b, 0);
+                    const backup = { tenantId, scopeId, vertical, capturedAt, size, tables };
+                    await r2.put(backupKey(tenantId, scopeId, capturedAt), body, {
+                        httpMetadata: { contentType: 'application/json' },
+                        // Mirrored into custom metadata so `list` can answer without fetching every
+                        // manifest. `size` too: the manifest is the smallest part of the copy.
+                        customMetadata: {
+                            tenantId,
+                            scopeId,
+                            capturedAt,
+                            tables: String(tables),
+                            size: String(size),
+                            ...(vertical ? { vertical } : {}),
+                        },
+                    });
+                    return backup;
+                },
+            };
         },
         async list({ tenantId, scopeId }) {
             const prefix = scopePrefix(tenantId, scopeId);
             const out = [];
             let cursor;
             do {
+                // One level: a backup's entries sit under a directory of their own, and are not backups.
                 const page = await r2.list({
                     prefix,
+                    delimiter: '/',
                     include: ['customMetadata'],
                     ...(cursor ? { cursor } : {}),
                 });
@@ -71,7 +117,7 @@ export function createR2BackupStore(bucket) {
                         scopeId,
                         vertical: meta.vertical ?? null,
                         capturedAt,
-                        size: o.size,
+                        size: meta.size ? Number(meta.size) : o.size,
                         tables: meta.tables ? Number(meta.tables) : 0,
                     });
                 }
@@ -86,8 +132,32 @@ export function createR2BackupStore(bucket) {
             if (!obj)
                 return null;
             // Parsed through the contract on the way out: a corrupted or hand-edited object
-            // fails HERE, loudly, rather than at the restore that trusted it.
-            return scopeDump.parse(JSON.parse(await obj.text()));
+            // fails HERE, loudly, rather than at the restore that trusted it. A manifest says so,
+            // so a damaged one is refused as a manifest rather than as a whole dump.
+            const raw = JSON.parse(await obj.text());
+            if (raw?.format !== 'paged') {
+                const { tables, ...header } = scopeDump.parse(raw);
+                return {
+                    header,
+                    entries: 1,
+                    entry: async (index) => {
+                        if (index !== 0)
+                            throw new Error(`backup ${capturedAt} of scope ${scopeId} has one entry`);
+                        return { kind: 'page', tables };
+                    },
+                };
+            }
+            const { format: _, stageId, entries, tables: __, ...header } = backupManifest.parse(raw);
+            return {
+                header,
+                entries,
+                entry: async (index) => {
+                    const part = await r2.get(entryKey(tenantId, scopeId, capturedAt, stageId, index));
+                    if (!part)
+                        throw new Error(`backup ${capturedAt} of scope ${scopeId} is missing entry ${index}`);
+                    return backupEntry.parse(JSON.parse(await part.text()));
+                },
+            };
         },
     };
 }
@@ -96,11 +166,61 @@ export function createR2BackupStore(bucket) {
  * directory per deployment and `capturedAt` is a copy's whole address. Sharing a bucket
  * with the scope backups above is safe by construction: `scopes/` and `directory/` cannot
  * collide, and neither prefix is ever built by a caller.
+ *
+ * That object is the copy's MANIFEST (#2868), as a scope backup's is (#2839): its capture time
+ * and how many pages hold its tables, each page its own object at
+ * `directory/<capturedAt>/<stageId>/<seq>.json`. The manifest is written last, so a copy that did
+ * not finish has none and is never listed or read. A copy written before #2868 is one whole dump
+ * at the manifest's key, and still reads.
  */
 function directoryKey(capturedAt) {
     return `directory/${capturedAt}.json`;
 }
+function directoryPageKey(capturedAt, stageId, seq) {
+    return `directory/${capturedAt}/${stageId}/${seq}.json`;
+}
 const DIRECTORY_PREFIX = 'directory/';
+/**
+ * How old a copy's pages must be, with no manifest, before a commit sweeps them (#2868). A copy cut
+ * off mid-write (its invocation's limits, an eviction) never reaches `discard`, and a pageful
+ * of the directory each time would otherwise stay forever. A day, so a copy still being written
+ * beside this one, the manual "back up now" racing the cron, is never one of them.
+ */
+const ABANDONED_PAGES_MS = 24 * 3_600_000;
+/** Outside `directory/`, so it is never listed as a copy: the newest started copy (#2868). */
+const DIRECTORY_ATTEMPT_KEY = 'directory-attempt.json';
+const directoryManifest = z.object({
+    capturedAt: z.string().min(1),
+    format: z.literal('paged'),
+    stageId: z.string().min(1),
+    entries: z.number().int().positive(),
+    tables: z.number().int().nonnegative(),
+});
+const directoryPage = z.object({ tables: z.array(scopeDumpTable) });
+/**
+ * Delete the pages of every copy captured before `before` that has no manifest: copies cut off
+ * before their commit (#2868). Read with no delimiter, so every key under `directory/` is seen:
+ * thirty copies of a few dozen pages each is a list call or two, once a day.
+ */
+async function sweepAbandonedPages(r2, before) {
+    const manifests = new Set();
+    const pages = [];
+    let cursor;
+    do {
+        const page = await r2.list({ prefix: DIRECTORY_PREFIX, ...(cursor ? { cursor } : {}) });
+        for (const { key } of page.objects) {
+            const rest = key.slice(DIRECTORY_PREFIX.length);
+            const slash = rest.indexOf('/');
+            if (slash < 0)
+                manifests.add(rest.replace(/\.json$/, ''));
+            else
+                pages.push({ key, capturedAt: rest.slice(0, slash) });
+        }
+        cursor = page.truncated ? page.cursor : undefined;
+    } while (cursor);
+    const abandoned = pages.filter((p) => p.capturedAt < before && !manifests.has(p.capturedAt));
+    await Promise.all(abandoned.map((p) => r2.delete(p.key).catch(() => undefined)));
+}
 /**
  * The Cloudflare R2 implementation of `DirectoryBackupStore` (#40).
  *
@@ -113,32 +233,53 @@ const DIRECTORY_PREFIX = 'directory/';
 export function createR2DirectoryBackupStore(bucket) {
     const r2 = bucket;
     return {
-        async put({ dump }) {
-            const body = JSON.stringify(dump);
-            // Byte length, not string length — the size is the stored object's.
-            const size = new TextEncoder().encode(body).length;
-            const backup = {
-                capturedAt: dump.capturedAt,
-                size,
-                tables: dump.tables.length,
-            };
-            await r2.put(directoryKey(dump.capturedAt), body, {
-                httpMetadata: { contentType: 'application/json' },
-                // Mirrored into custom metadata so `list` answers without fetching every dump —
-                // a directory copy is megabytes, its listing is a table row.
-                customMetadata: {
-                    capturedAt: backup.capturedAt,
-                    tables: String(backup.tables),
+        begin({ capturedAt }) {
+            const stageId = crypto.randomUUID();
+            const sizes = [];
+            return {
+                async put(seq, tables) {
+                    const body = JSON.stringify({ tables });
+                    await r2.put(directoryPageKey(capturedAt, stageId, seq), body, {
+                        httpMetadata: { contentType: 'application/json' },
+                    });
+                    sizes[seq] = byteLength(body);
                 },
-            });
-            return backup;
+                async discard() {
+                    await Promise.all(sizes.map((_, seq) => r2.delete(directoryPageKey(capturedAt, stageId, seq)).catch(() => undefined)));
+                },
+                async commit({ entries, tables }) {
+                    for (let seq = 0; seq < entries; seq++) {
+                        if (sizes[seq] === undefined)
+                            throw new Error(`directory backup page ${seq} of ${entries} was never written`);
+                    }
+                    const body = JSON.stringify({ capturedAt, format: 'paged', stageId, entries, tables });
+                    const size = byteLength(body) + sizes.slice(0, entries).reduce((a, b) => a + b, 0);
+                    await r2.put(directoryKey(capturedAt), body, {
+                        httpMetadata: { contentType: 'application/json' },
+                        // Mirrored into custom metadata so `list` answers without fetching every manifest.
+                        // `size` too: the manifest is the smallest part of the copy.
+                        customMetadata: { capturedAt, tables: String(tables), size: String(size) },
+                    });
+                    // Best-effort, and after the manifest: the copy is committed now, and a failed sweep
+                    // must not reject the commit, or the caller's `discard` would delete a listed copy's pages.
+                    try {
+                        await sweepAbandonedPages(r2, new Date(Date.parse(capturedAt) - ABANDONED_PAGES_MS).toISOString());
+                    }
+                    catch (err) {
+                        console.error('directory-backup: sweeping abandoned pages failed; the next commit tries again', err instanceof Error ? err.message : String(err));
+                    }
+                    return { capturedAt, size, tables };
+                },
+            };
         },
         async list() {
             const out = [];
             let cursor;
             do {
+                // One level: a copy's pages sit under a directory of their own, and are not copies.
                 const page = await r2.list({
                     prefix: DIRECTORY_PREFIX,
+                    delimiter: '/',
                     include: ['customMetadata'],
                     ...(cursor ? { cursor } : {}),
                 });
@@ -149,7 +290,7 @@ export function createR2DirectoryBackupStore(bucket) {
                     const capturedAt = meta.capturedAt ?? o.key.slice(DIRECTORY_PREFIX.length).replace(/\.json$/, '');
                     out.push({
                         capturedAt,
-                        size: o.size,
+                        size: meta.size ? Number(meta.size) : o.size,
                         tables: meta.tables ? Number(meta.tables) : 0,
                     });
                 }
@@ -165,10 +306,42 @@ export function createR2DirectoryBackupStore(bucket) {
                 return null;
             // Parsed through the contract on the way out, so a corrupted object fails HERE
             // rather than half-way through the restore that trusted it.
-            return directoryDump.parse(JSON.parse(await obj.text()));
+            const raw = JSON.parse(await obj.text());
+            if (raw?.format !== 'paged')
+                return directoryDump.parse(raw);
+            const manifest = directoryManifest.parse(raw);
+            const pages = [];
+            for (let seq = 0; seq < manifest.entries; seq++) {
+                const part = await r2.get(directoryPageKey(capturedAt, manifest.stageId, seq));
+                if (!part)
+                    throw new Error(`directory backup ${capturedAt} is missing page ${seq}`);
+                pages.push(directoryPage.parse(JSON.parse(await part.text())).tables);
+            }
+            // `restoreDirectory` takes one dump, so the pages are joined here (a paged restore is #2868's follow-up).
+            return { capturedAt, tables: mergeDumpPages(pages) };
         },
         async delete({ capturedAt }) {
+            // The manifest first: once it is gone the copy is no longer listed, whatever of its pages remain.
             await r2.delete(directoryKey(capturedAt));
+            const prefix = `${DIRECTORY_PREFIX}${capturedAt}/`;
+            let cursor;
+            do {
+                const page = await r2.list({ prefix, ...(cursor ? { cursor } : {}) });
+                await Promise.all(page.objects.map((o) => r2.delete(o.key)));
+                cursor = page.truncated ? page.cursor : undefined;
+            } while (cursor);
+        },
+        async markAttempt({ attemptedAt }) {
+            await r2.put(DIRECTORY_ATTEMPT_KEY, JSON.stringify({ attemptedAt }), {
+                httpMetadata: { contentType: 'application/json' },
+            });
+        },
+        async lastAttempt() {
+            const obj = await r2.get(DIRECTORY_ATTEMPT_KEY);
+            if (!obj)
+                return null;
+            const parsed = z.object({ attemptedAt: z.string().min(1) }).safeParse(JSON.parse(await obj.text()));
+            return parsed.success ? parsed.data.attemptedAt : null;
         },
     };
 }
@@ -217,7 +390,7 @@ function occurrenceDay(occurredAt) {
  * *"Iceberg is the contract, the query engine is replaceable"*, and the same
  * paragraph leaves R2 SQL's fitness explicitly open pending a benchmark. Writing
  * partitioned NDJSON to a bucket the platform already operates gets the events out
- * of the scope — which is what bounds an outbox that is never pruned — without
+ * of the scope — which is what licenses the retention prune that bounds the outbox — without
  * committing the ingest path to a product decision nobody has made yet. A
  * compaction step turns these objects into Iceberg later, and the seam means the
  * drain never learns which happened.
@@ -338,10 +511,13 @@ async function listAll(r2, prefix) {
 const DAY_MS = 86_400_000;
 /**
  * Drop `scopes/…` reap copies (#493) older than the window. A copy's age is its
- * `capturedAt` — the key's last segment, same as the store's own fallback address — so a
- * hand-uploaded object without metadata still ages out rather than living forever by
- * omission. An unparsable timestamp keeps the copy: deleting what cannot be dated is not
- * retention.
+ * `capturedAt`: the object's metadata, else the key's segment after the scope, which is the
+ * manifest's name and the directory a paged copy's entries sit in (#2839). So a hand-uploaded
+ * object without metadata still ages out rather than living forever by omission. An
+ * unparsable timestamp keeps the copy: deleting what cannot be dated is not retention.
+ *
+ * A copy's manifest sorts before its entries (`.` before `/`), so it goes first: a pass cut
+ * short leaves entries no backup names, for the next pass, never a backup missing its entries.
  *
  * Note the interaction with #37 (erasure): per-subject payloads inside these dumps are
  * sealed under per-subject DEKs, so an old copy's PII exposure is bounded by key
@@ -352,7 +528,7 @@ export async function pruneScopeBackups(bucket, options) {
     const cutoff = (options.now?.() ?? new Date()).getTime() - options.olderThanDays * DAY_MS;
     let pruned = 0;
     for (const o of await listAll(r2, 'scopes/')) {
-        const capturedAt = o.customMetadata?.capturedAt ?? o.key.slice(o.key.lastIndexOf('/') + 1).replace(/\.json$/, '');
+        const capturedAt = o.customMetadata?.capturedAt ?? (o.key.split('/')[3] ?? '').replace(/\.json$/, '');
         const at = new Date(capturedAt).getTime();
         if (Number.isNaN(at) || at >= cutoff)
             continue;