@substrat-run/control-plane-api 0.49.0 → 0.50.0

package/dist/backups.d.ts

@@ -0,0 +1,93 @@
+/**
+ * The scope-backup write seam (#493) — where a reap's recoverable copy goes.
+ *
+ * A reap frees a scope's Durable Object storage because Cloudflare never garbage-
+ * collects a DO, and it is irreversible. Before #493 the operator had to REMEMBER to
+ * take a copy first, from a different surface; this seam is what makes "a reap always
+ * leaves a recoverable copy" a property of the route instead of a habit.
+ *
+ * Why a dump and not a snapshot fork. The obvious cheap move — `orchestratedSnapshot`
+ * before the reap — does not survive the case the flow exists for. A fork is provisioned
+ * INSIDE the vertical's own deployment and activated, so (a) its bytes live in the very
+ * deployment a retirement is about to delete, and (b) it counts as a live scope in
+ * `countScopesForVertical`, which means it re-blocks the `deleteVertical` the reap was
+ * clearing. A dump leaves the deployment entirely, and `POST …/restore` already loads one
+ * back, so export→store→restore is the round trip that actually closes.
+ *
+ * Provider-neutral by the same posture as `ObservabilityReader` and `DeployVerticalFn`:
+ * the contract lives here, an implementation lives in its own module (`r2-backups.ts` for
+ * Cloudflare R2), and the host injects one. A backup is addressed by (tenant, scope,
+ * capturedAt) rather than by a store-shaped key, so the key scheme stays the store's
+ * private business and no caller can build a path into someone else's tenant.
+ *
+ * Fidelity is deliberately FULL, never masked (#493). A masked dump has its PII redacted,
+ * so restoring one produces a structurally-valid but factually wrong scope — a backup that
+ * cannot restore is a false promise, and the promise is the whole point. This is not the
+ * §6 governed pull: the bytes go platform→platform and are never handed to a caller, which
+ * is why the export route's masking default does not apply here.
+ */
+import type { DirectoryBackup, DirectoryDump, ScopeBackup, ScopeDump } from '@substrat-run/contracts';
+export type { ScopeBackup, DirectoryBackup };
+export interface ScopeBackupStore {
+    /**
+     * Store one full-fidelity dump and return its metadata. Must be durable before it
+     * returns: the reap's whole guarantee is that this resolved before any byte was wiped.
+     */
+    put(input: {
+        vertical: string | null;
+        dump: ScopeDump;
+    }): Promise<ScopeBackup>;
+    /** Every backup held for one scope, newest first. */
+    list(input: {
+        tenantId: string;
+        scopeId: string;
+    }): Promise<ScopeBackup[]>;
+    /** One backup's dump, by its capture time. Null when no such copy is held. */
+    get(input: {
+        tenantId: string;
+        scopeId: string;
+        capturedAt: string;
+    }): Promise<ScopeDump | null>;
+}
+/**
+ * The DIRECTORY-backup store (#40) — the platform's own copy, not a tenant's.
+ *
+ * A sibling seam rather than a widened `ScopeBackupStore`, because the two are the same
+ * mechanism serving different jobs and the difference is worth keeping in the types.
+ * A scope backup is taken at a MOMENT — before a reap, before a migration — and is
+ * addressed by the scope it came from. A directory backup is taken on a SCHEDULE, has
+ * no tenant to be addressed by, and is pruned to a retention window. Only this one
+ * needs `delete`, and only this one is ever written by a sweep with no operator behind
+ * it.
+ *
+ * What it defends against is also different, and the distinction is the whole design
+ * (#40's own analysis). Per-scope point-in-time recovery already covers corruption
+ * inside the account — ~30 days, continuous, and strictly better than a daily copy, so
+ * scheduled per-scope backups are deliberately NOT built. The directory is the case PITR
+ * cannot answer: it is one Durable Object, and a bug that deletes it outright leaves
+ * nothing to rewind. Copies live outside the DO for that reason.
+ *
+ * Honest scoping: with the store bound in the platform's OWN account (the shape shipped
+ * today), this survives losing the directory, not losing the account. The seam is
+ * provider-neutral so an off-account target is a drop-in — see control-plane.md §4.9.
+ */
+export interface DirectoryBackupStore {
+    /**
+     * Store one full-fidelity directory dump and return its metadata. Durable before it
+     * returns, like the scope store's `put`.
+     */
+    put(input: {
+        dump: DirectoryDump;
+    }): Promise<DirectoryBackup>;
+    /** Every directory copy held, newest first. */
+    list(): Promise<DirectoryBackup[]>;
+    /** One copy's dump, by its capture time. Null when no such copy is held. */
+    get(input: {
+        capturedAt: string;
+    }): Promise<DirectoryDump | null>;
+    /** Drop one copy — how the retention window is enforced. Missing is not an error. */
+    delete(input: {
+        capturedAt: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=backups.d.ts.map

package/dist/backups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backups.d.ts","sourceRoot":"","sources":["../src/backups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAKtG,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AAE7C,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,GAAG,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/E,qDAAqD;IACrD,IAAI,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3E,8EAA8E;IAC9E,GAAG,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CAClG;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,GAAG,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9D,+CAA+C;IAC/C,IAAI,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACnC,4EAA4E;IAC5E,GAAG,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAClE,qFAAqF;IACrF,MAAM,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD"}

package/dist/backups.js

@@ -0,0 +1,30 @@
+/**
+ * The scope-backup write seam (#493) — where a reap's recoverable copy goes.
+ *
+ * A reap frees a scope's Durable Object storage because Cloudflare never garbage-
+ * collects a DO, and it is irreversible. Before #493 the operator had to REMEMBER to
+ * take a copy first, from a different surface; this seam is what makes "a reap always
+ * leaves a recoverable copy" a property of the route instead of a habit.
+ *
+ * Why a dump and not a snapshot fork. The obvious cheap move — `orchestratedSnapshot`
+ * before the reap — does not survive the case the flow exists for. A fork is provisioned
+ * INSIDE the vertical's own deployment and activated, so (a) its bytes live in the very
+ * deployment a retirement is about to delete, and (b) it counts as a live scope in
+ * `countScopesForVertical`, which means it re-blocks the `deleteVertical` the reap was
+ * clearing. A dump leaves the deployment entirely, and `POST …/restore` already loads one
+ * back, so export→store→restore is the round trip that actually closes.
+ *
+ * Provider-neutral by the same posture as `ObservabilityReader` and `DeployVerticalFn`:
+ * the contract lives here, an implementation lives in its own module (`r2-backups.ts` for
+ * Cloudflare R2), and the host injects one. A backup is addressed by (tenant, scope,
+ * capturedAt) rather than by a store-shaped key, so the key scheme stays the store's
+ * private business and no caller can build a path into someone else's tenant.
+ *
+ * Fidelity is deliberately FULL, never masked (#493). A masked dump has its PII redacted,
+ * so restoring one produces a structurally-valid but factually wrong scope — a backup that
+ * cannot restore is a false promise, and the promise is the whole point. This is not the
+ * §6 governed pull: the bytes go platform→platform and are never handed to a caller, which
+ * is why the export route's masking default does not apply here.
+ */
+export {};
+//# sourceMappingURL=backups.js.map

package/dist/backups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backups.js","sourceRoot":"","sources":["../src/backups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG"}

package/dist/directory-backup.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The scheduled directory backup (#40) — the platform's own disaster-recovery pass.
+ *
+ * `control-plane.md` names the stake without resolving it: *"The directory becomes a real
+ * database, with its own migrations and backup story… Losing it is losing the platform,
+ * not losing a cache."* Every OTHER database the platform holds is a scope, protected by
+ * ~30-day Durable Object point-in-time recovery — which is continuous, per-scope, and
+ * strictly better than any daily copy, so scheduled per-scope backups are deliberately not
+ * built here. The directory is the one database PITR cannot answer for: it is a single DO,
+ * and a control-plane bug that deletes it outright leaves nothing to rewind. So a copy
+ * lives OUTSIDE the DO, and this is what takes it.
+ *
+ * Driven by the same cron that drives the platform sweep, and the cadence is enforced HERE
+ * rather than by a second trigger. A quarter-hourly sweep asking "is a copy due?" and answering
+ * from the store is idempotent, survives a missed tick (the next pass takes it, late
+ * rather than never), and needs no durable "last run" state of its own — the newest stored
+ * copy IS that state. A dedicated daily trigger would have to be right about time zones,
+ * deploys and restarts to do the same job worse.
+ */
+import type { DirectoryBackup, PlatformActorId } from '@substrat-run/contracts';
+import type { HostAdmin } from '@substrat-run/kernel';
+import type { DirectoryBackupStore } from './backups.js';
+export interface DirectoryBackupOptions {
+    admin: HostAdmin;
+    store: DirectoryBackupStore;
+    /** The platform actor the export is audited under. */
+    actor: PlatformActorId;
+    /** Hours between copies (default 24). */
+    intervalHours?: number;
+    /** How many copies to keep (default 30). Older ones are deleted after a successful put. */
+    retain?: number;
+    /** Take a copy regardless of cadence — what the manual "back up now" route passes. */
+    force?: boolean;
+    /** Injected clock, for tests. */
+    now?: () => Date;
+}
+export interface DirectoryBackupResult {
+    /** The copy taken this pass, or null when the cadence guard skipped it. */
+    taken: DirectoryBackup | null;
+    /** When nothing was taken: the copy that was still fresh enough to skip for. */
+    skippedFor: string | null;
+    /** Copies deleted by the retention window this pass. */
+    pruned: number;
+}
+/**
+ * Take a directory backup if one is due, then prune to the retention window.
+ *
+ * Order matters and is the inverse of the reap's (#493). A reap stores BEFORE it wipes,
+ * because the wipe is what the copy protects against. Here the prune runs AFTER a
+ * successful put, so a failed capture can never be the thing that deletes the last good
+ * copy — the worst case is an extra copy kept, never a missing one.
+ *
+ * Throws whatever the export or the store threw. The caller (a cron pass) decides what a
+ * failure means; it must not be silent, which is why nothing is swallowed here.
+ */
+export declare function backupDirectoryIfDue(options: DirectoryBackupOptions): Promise<DirectoryBackupResult>;
+//# sourceMappingURL=directory-backup.d.ts.map

package/dist/directory-backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-backup.d.ts","sourceRoot":"","sources":["../src/directory-backup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAUzD,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,oBAAoB,CAAC;IAC5B,sDAAsD;IACtD,KAAK,EAAE,eAAe,CAAC;IACvB,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC9B,gFAAgF;IAChF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CA+BhC"}

package/dist/directory-backup.js

@@ -0,0 +1,68 @@
+/**
+ * The scheduled directory backup (#40) — the platform's own disaster-recovery pass.
+ *
+ * `control-plane.md` names the stake without resolving it: *"The directory becomes a real
+ * database, with its own migrations and backup story… Losing it is losing the platform,
+ * not losing a cache."* Every OTHER database the platform holds is a scope, protected by
+ * ~30-day Durable Object point-in-time recovery — which is continuous, per-scope, and
+ * strictly better than any daily copy, so scheduled per-scope backups are deliberately not
+ * built here. The directory is the one database PITR cannot answer for: it is a single DO,
+ * and a control-plane bug that deletes it outright leaves nothing to rewind. So a copy
+ * lives OUTSIDE the DO, and this is what takes it.
+ *
+ * Driven by the same cron that drives the platform sweep, and the cadence is enforced HERE
+ * rather than by a second trigger. A quarter-hourly sweep asking "is a copy due?" and answering
+ * from the store is idempotent, survives a missed tick (the next pass takes it, late
+ * rather than never), and needs no durable "last run" state of its own — the newest stored
+ * copy IS that state. A dedicated daily trigger would have to be right about time zones,
+ * deploys and restarts to do the same job worse.
+ */
+/** One copy a day; the sweep runs far more often and skips in between. */
+const DEFAULT_INTERVAL_HOURS = 24;
+/**
+ * Thirty copies — a month of daily history, matching the DO PITR horizon so the two
+ * defences expire together rather than leaving a window covered by neither.
+ */
+const DEFAULT_RETAIN = 30;
+/**
+ * Take a directory backup if one is due, then prune to the retention window.
+ *
+ * Order matters and is the inverse of the reap's (#493). A reap stores BEFORE it wipes,
+ * because the wipe is what the copy protects against. Here the prune runs AFTER a
+ * successful put, so a failed capture can never be the thing that deletes the last good
+ * copy — the worst case is an extra copy kept, never a missing one.
+ *
+ * Throws whatever the export or the store threw. The caller (a cron pass) decides what a
+ * failure means; it must not be silent, which is why nothing is swallowed here.
+ */
+export async function backupDirectoryIfDue(options) {
+    const now = options.now?.() ?? new Date();
+    const retain = options.retain ?? DEFAULT_RETAIN;
+    const intervalMs = (options.intervalHours ?? DEFAULT_INTERVAL_HOURS) * 3_600_000;
+    // The store IS the schedule's memory: newest copy, newest first (the store sorts).
+    const existing = await options.store.list();
+    const newest = existing[0];
+    if (!options.force && newest) {
+        const age = now.getTime() - new Date(newest.capturedAt).getTime();
+        // `age < 0` — a copy stamped in the future, from a clock skew or a hand-uploaded
+        // object — counts as fresh. Skipping is the conservative read: taking a copy is
+        // cheap, but treating a future timestamp as "infinitely overdue" would take one on
+        // every single pass until real time caught up.
+        if (age < intervalMs)
+            return { taken: null, skippedFor: newest.capturedAt, pruned: 0 };
+    }
+    const dump = await options.admin.exportDirectory(options.actor);
+    const taken = await options.store.put({ dump });
+    // Prune from a re-read list, not from `existing`: the copy just written has to be in
+    // the reckoning, or a retention window of N would keep N+1 forever.
+    let pruned = 0;
+    if (retain > 0) {
+        const all = await options.store.list();
+        for (const stale of all.slice(retain)) {
+            await options.store.delete({ capturedAt: stale.capturedAt });
+            pruned += 1;
+        }
+    }
+    return { taken, skippedFor: null, pruned };
+}
+//# sourceMappingURL=directory-backup.js.map

package/dist/directory-backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-backup.js","sourceRoot":"","sources":["../src/directory-backup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,0EAA0E;AAC1E,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC;;;GAGG;AACH,MAAM,cAAc,GAAG,EAAE,CAAC;AA0B1B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA+B;IAE/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC;IAChD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC,GAAG,SAAS,CAAC;IAEjF,mFAAmF;IACnF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;QAClE,iFAAiF;QACjF,gFAAgF;QAChF,mFAAmF;QACnF,+CAA+C;QAC/C,IAAI,GAAG,GAAG,UAAU;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhD,qFAAqF;IACrF,oEAAoE;IACpE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC"}

package/dist/index.d.ts

@@ -18,4 +18,8 @@ export type { CustomHostnameProvisioner, CustomHostnameProvisionerOptions, Custo
 export type { ObservabilityReader, ServiceMetricsRow, RecentLogEvent } from './observability.js';
 export { createCfObservabilityReader } from './cf-observability.js';
 export type { CfObservabilityOptions } from './cf-observability.js';
+export type { ScopeBackup, ScopeBackupStore, DirectoryBackup, DirectoryBackupStore, } from './backups.js';
+export { createR2BackupStore, createR2DirectoryBackupStore } from './r2-backups.js';
+export { backupDirectoryIfDue } from './directory-backup.js';
+export type { DirectoryBackupOptions, DirectoryBackupResult } from './directory-backup.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,YAAY,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,SAAS,GACV,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACpE,YAAY,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAChG,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,yBAAyB,EACzB,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,YAAY,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,SAAS,GACV,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACpE,YAAY,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAChG,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,yBAAyB,EACzB,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAIpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -9,4 +9,9 @@ export { createWfpUploader, createWfpModulesFetcher, createWfpBindingsPatcher }
 export { blobStoreBindings, collectBlobStoreHandles, collectTenantStoreHandles, tenantStoreBindings, } from './tenant-stores.js';
 export { createCustomHostnameProvisioner, mapCfStatus, extractRecords, reconcilePendingHostnames, isCustomHostname, validateBindableHostname, } from './custom-hostnames.js';
 export { createCfObservabilityReader } from './cf-observability.js';
+export { createR2BackupStore, createR2DirectoryBackupStore } from './r2-backups.js';
+// #40 — the scheduled directory copy. Exported as a function the CP worker's cron calls,
+// not as a route with a timer behind it: this package stays library-only, exactly as the
+// platform-request drain does (the recurrence has to come from a deployment, #444).
+export { backupDirectoryIfDue } from './directory-backup.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAUrG,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,GAUvB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAQhG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAUrG,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,GAUvB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAQhG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAQpE,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AACpF,yFAAyF;AACzF,yFAAyF;AACzF,oFAAoF;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/mask.d.ts

@@ -1,4 +1,19 @@
 import type { ScopeDumpTable } from '@substrat-run/contracts';
 /** Mask one dump in place-shape (returns new arrays; never mutates the input). */
 export declare function maskDump(tables: ScopeDumpTable[]): ScopeDumpTable[];
+/**
+ * The same heuristic applied to plain JSON records — the directory half of a tenant
+ * export (#36).
+ *
+ * A tenant export carries two kinds of thing: scope databases (table-shaped, masked by
+ * `maskDump` above) and directory records (object-shaped — a tenant's display name, an
+ * org's name, an identity link's external id, which is usually an email). Both halves
+ * must be masked by the SAME rule, or the default-masked promise is only half true and
+ * the leak is in the half nobody looked at.
+ *
+ * So this reuses `maskJsonValue` rather than growing a second heuristic: one PII column
+ * list, one recursive sweep, two entry points. Ids and timestamps pass through — the
+ * sweep targets free text, and ids are what keep an export intelligible.
+ */
+export declare function maskRecords<T>(records: readonly T[]): T[];
 //# sourceMappingURL=mask.d.ts.map

package/dist/mask.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mask.d.ts","sourceRoot":"","sources":["../src/mask.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAoD9D,kFAAkF;AAClF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE,CAqBnE"}
+{"version":3,"file":"mask.d.ts","sourceRoot":"","sources":["../src/mask.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AA2D9D,kFAAkF;AAClF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE,CAqBnE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,CAEzD"}

package/dist/mask.js

@@ -22,7 +22,14 @@
  */
 // Free-text/PII column names. `name` is included on purpose: entity names
 // (customers, properties, contacts) are customer data even when they look benign.
-const PII_COLUMN = /(^|_)(email|e?mail_address|phone|mobile|tel|address|street|city|postal|zip|ssn|personnummer|name|first_name|last_name|full_name|contact|note|notes|comment|comments|message|subject|body|description)($|_)/i;
+//
+// `external_id` earns its place from the platform's OWN schema (#36): an identity link's
+// `externalId` is the provider's subject, which in practice is very often the person's
+// email address — so a tenant export that swept only the obvious columns would hand out
+// the one field most likely to name a human. It is the deliberately lossy direction of
+// the trade: an opaque third-party id (a document ref, an upstream order number) gets
+// masked too, which costs a masked pull some fidelity and costs a leak nothing.
+const PII_COLUMN = /(^|_)(email|e?mail_address|phone|mobile|tel|address|street|city|postal|zip|ssn|personnummer|name|first_name|last_name|full_name|contact|external_id|note|notes|comment|comments|message|subject|body|description)($|_)/i;
 // Columns that carry JSON documents worth sweeping by key rather than blanking.
 const JSON_COLUMN = /(^|_)(payload|detail|details|data|before|after)($|_)/i;
 const MASKED = '[masked]';
@@ -68,4 +75,21 @@ export function maskDump(tables) {
         return { ...t, rows };
     });
 }
+/**
+ * The same heuristic applied to plain JSON records — the directory half of a tenant
+ * export (#36).
+ *
+ * A tenant export carries two kinds of thing: scope databases (table-shaped, masked by
+ * `maskDump` above) and directory records (object-shaped — a tenant's display name, an
+ * org's name, an identity link's external id, which is usually an email). Both halves
+ * must be masked by the SAME rule, or the default-masked promise is only half true and
+ * the leak is in the half nobody looked at.
+ *
+ * So this reuses `maskJsonValue` rather than growing a second heuristic: one PII column
+ * list, one recursive sweep, two entry points. Ids and timestamps pass through — the
+ * sweep targets free text, and ids are what keep an export intelligible.
+ */
+export function maskRecords(records) {
+    return records.map((r) => maskJsonValue(r, false));
+}
 //# sourceMappingURL=mask.js.map

package/dist/mask.js.map

@@ -1 +1 @@
-{"version":3,"file":"mask.js","sourceRoot":"","sources":["../src/mask.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,0EAA0E;AAC1E,kFAAkF;AAClF,MAAM,UAAU,GAAG,6MAA6M,CAAC;AAEjO,gFAAgF;AAChF,MAAM,WAAW,GAAG,uDAAuD,CAAC;AAE5E,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,iFAAiF;AACjF,iFAAiF;AACjF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE,CAC3C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC;AAE/D,SAAS,aAAa,CAAC,KAAc,EAAE,UAAmB;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAChF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,QAAQ,CAAC,MAAwB;IAC/C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9B,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YAClB,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1C,IAAI,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,MAAM,CAAC;YAC9B,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;gBAChE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC,CAAC,6DAA6D;gBAC5E,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CACH,CAAC;QACF,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"mask.js","sourceRoot":"","sources":["../src/mask.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,0EAA0E;AAC1E,kFAAkF;AAClF,EAAE;AACF,yFAAyF;AACzF,uFAAuF;AACvF,wFAAwF;AACxF,uFAAuF;AACvF,sFAAsF;AACtF,gFAAgF;AAChF,MAAM,UAAU,GAAG,yNAAyN,CAAC;AAE7O,gFAAgF;AAChF,MAAM,WAAW,GAAG,uDAAuD,CAAC;AAE5E,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,iFAAiF;AACjF,iFAAiF;AACjF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE,CAC3C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC;AAE/D,SAAS,aAAa,CAAC,KAAc,EAAE,UAAmB;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAChF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,QAAQ,CAAC,MAAwB;IAC/C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9B,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YAClB,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1C,IAAI,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,MAAM,CAAC;YAC9B,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;gBAChE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC,CAAC,6DAA6D;gBAC5E,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CACH,CAAC;QACF,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAI,OAAqB;IAClD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,CAAM,CAAC,CAAC;AAC1D,CAAC"}

package/dist/r2-backups.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The Cloudflare R2 implementation of the `ScopeBackupStore` seam (#493) — the platform's
+ * own backup bucket, bound on the control-plane worker.
+ *
+ * Structurally typed against the binding (`R2BucketLike`) rather than importing a
+ * Cloudflare SDK, the same way `adapter-cloudflare/src/r2.ts` wraps a tenant blob store:
+ * this package stays SDK-free and the fake in tests is an object literal.
+ *
+ * One bucket, held by the PLATFORM, not by the tenant. A tenant-held bucket would be
+ * deleted by the very teardown these copies exist to survive.
+ */
+import type { DirectoryBackupStore, ScopeBackupStore } from './backups.js';
+export declare function createR2BackupStore(bucket: unknown): ScopeBackupStore;
+/**
+ * The Cloudflare R2 implementation of `DirectoryBackupStore` (#40).
+ *
+ * Deliberately a separate factory over the SAME binding shape rather than a mode flag on
+ * `createR2BackupStore`: the two stores answer different questions and only this one can
+ * delete. A deployment may point them at one bucket or two — the prefixes keep them apart
+ * either way, and pointing THIS one at a bucket in another account is the upgrade path
+ * from "survives losing the directory" to "survives losing the account".
+ */
+export declare function createR2DirectoryBackupStore(bucket: unknown): DirectoryBackupStore;
+//# sourceMappingURL=r2-backups.d.ts.map

package/dist/r2-backups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2-backups.d.ts","sourceRoot":"","sources":["../src/r2-backups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAsC3E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAsErE;AAcD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,oBAAoB,CAgElF"}

package/dist/r2-backups.js

@@ -0,0 +1,175 @@
+/**
+ * The Cloudflare R2 implementation of the `ScopeBackupStore` seam (#493) — the platform's
+ * own backup bucket, bound on the control-plane worker.
+ *
+ * Structurally typed against the binding (`R2BucketLike`) rather than importing a
+ * Cloudflare SDK, the same way `adapter-cloudflare/src/r2.ts` wraps a tenant blob store:
+ * this package stays SDK-free and the fake in tests is an object literal.
+ *
+ * One bucket, held by the PLATFORM, not by the tenant. A tenant-held bucket would be
+ * deleted by the very teardown these copies exist to survive.
+ */
+import { directoryDump, scopeDump, } from '@substrat-run/contracts';
+/**
+ * Keys are `scopes/<tenantId>/<scopeId>/<capturedAt>.json`, so a scope's copies are one
+ * prefix list and a tenant's are one level up. The scheme is private to this module —
+ * callers address a backup by (tenant, scope, capturedAt) and never build a path.
+ */
+function backupKey(tenantId, scopeId, capturedAt) {
+    return `scopes/${tenantId}/${scopeId}/${capturedAt}.json`;
+}
+function scopePrefix(tenantId, scopeId) {
+    return `scopes/${tenantId}/${scopeId}/`;
+}
+export function createR2BackupStore(bucket) {
+    const r2 = bucket;
+    return {
+        async put({ vertical, dump }) {
+            const body = JSON.stringify(dump);
+            // Byte length, not string length: the size is meant to be the stored object's,
+            // and a dump full of non-ASCII would otherwise under-report.
+            const size = new TextEncoder().encode(body).length;
+            const backup = {
+                tenantId: dump.tenantId,
+                scopeId: dump.scopeId,
+                vertical,
+                capturedAt: dump.capturedAt,
+                size,
+                tables: dump.tables.length,
+            };
+            await r2.put(backupKey(dump.tenantId, dump.scopeId, dump.capturedAt), body, {
+                httpMetadata: { contentType: 'application/json' },
+                // Mirrored into custom metadata so `list` can answer without fetching every
+                // dump — a scope's backups are megabytes, its listing is a table row.
+                customMetadata: {
+                    tenantId: backup.tenantId,
+                    scopeId: backup.scopeId,
+                    capturedAt: backup.capturedAt,
+                    tables: String(backup.tables),
+                    ...(vertical ? { vertical } : {}),
+                },
+            });
+            return backup;
+        },
+        async list({ tenantId, scopeId }) {
+            const prefix = scopePrefix(tenantId, scopeId);
+            const out = [];
+            let cursor;
+            do {
+                const page = await r2.list({
+                    prefix,
+                    include: ['customMetadata'],
+                    ...(cursor ? { cursor } : {}),
+                });
+                for (const o of page.objects) {
+                    const meta = o.customMetadata ?? {};
+                    // The key is the fallback address: an object written before the metadata
+                    // existed (or by a manual upload) still lists rather than vanishing.
+                    const capturedAt = meta.capturedAt ?? o.key.slice(prefix.length).replace(/\.json$/, '');
+                    out.push({
+                        tenantId,
+                        scopeId,
+                        vertical: meta.vertical ?? null,
+                        capturedAt,
+                        size: o.size,
+                        tables: meta.tables ? Number(meta.tables) : 0,
+                    });
+                }
+                cursor = page.truncated ? page.cursor : undefined;
+            } while (cursor);
+            // Newest first. ISO 8601 sorts lexicographically, which is why `capturedAt` is
+            // the key's last segment.
+            return out.sort((a, b) => (a.capturedAt < b.capturedAt ? 1 : -1));
+        },
+        async get({ tenantId, scopeId, capturedAt }) {
+            const obj = await r2.get(backupKey(tenantId, scopeId, capturedAt));
+            if (!obj)
+                return null;
+            // Parsed through the contract on the way out: a corrupted or hand-edited object
+            // fails HERE, loudly, rather than at the restore that trusted it.
+            return scopeDump.parse(JSON.parse(await obj.text()));
+        },
+    };
+}
+/**
+ * Keys are `directory/<capturedAt>.json` — one flat prefix, because there is exactly one
+ * directory per deployment and `capturedAt` is a copy's whole address. Sharing a bucket
+ * with the scope backups above is safe by construction: `scopes/` and `directory/` cannot
+ * collide, and neither prefix is ever built by a caller.
+ */
+function directoryKey(capturedAt) {
+    return `directory/${capturedAt}.json`;
+}
+const DIRECTORY_PREFIX = 'directory/';
+/**
+ * The Cloudflare R2 implementation of `DirectoryBackupStore` (#40).
+ *
+ * Deliberately a separate factory over the SAME binding shape rather than a mode flag on
+ * `createR2BackupStore`: the two stores answer different questions and only this one can
+ * delete. A deployment may point them at one bucket or two — the prefixes keep them apart
+ * either way, and pointing THIS one at a bucket in another account is the upgrade path
+ * from "survives losing the directory" to "survives losing the account".
+ */
+export function createR2DirectoryBackupStore(bucket) {
+    const r2 = bucket;
+    return {
+        async put({ dump }) {
+            const body = JSON.stringify(dump);
+            // Byte length, not string length — the size is the stored object's.
+            const size = new TextEncoder().encode(body).length;
+            const backup = {
+                capturedAt: dump.capturedAt,
+                size,
+                tables: dump.tables.length,
+            };
+            await r2.put(directoryKey(dump.capturedAt), body, {
+                httpMetadata: { contentType: 'application/json' },
+                // Mirrored into custom metadata so `list` answers without fetching every dump —
+                // a directory copy is megabytes, its listing is a table row.
+                customMetadata: {
+                    capturedAt: backup.capturedAt,
+                    tables: String(backup.tables),
+                },
+            });
+            return backup;
+        },
+        async list() {
+            const out = [];
+            let cursor;
+            do {
+                const page = await r2.list({
+                    prefix: DIRECTORY_PREFIX,
+                    include: ['customMetadata'],
+                    ...(cursor ? { cursor } : {}),
+                });
+                for (const o of page.objects) {
+                    const meta = o.customMetadata ?? {};
+                    // The key is the fallback address, as in the scope store: an object written
+                    // before the metadata existed still lists rather than vanishing.
+                    const capturedAt = meta.capturedAt ?? o.key.slice(DIRECTORY_PREFIX.length).replace(/\.json$/, '');
+                    out.push({
+                        capturedAt,
+                        size: o.size,
+                        tables: meta.tables ? Number(meta.tables) : 0,
+                    });
+                }
+                cursor = page.truncated ? page.cursor : undefined;
+            } while (cursor);
+            // Newest first — ISO 8601 sorts lexicographically, which is why `capturedAt` is
+            // the key's last segment. The daily-cadence guard reads element 0.
+            return out.sort((a, b) => (a.capturedAt < b.capturedAt ? 1 : -1));
+        },
+        async get({ capturedAt }) {
+            const obj = await r2.get(directoryKey(capturedAt));
+            if (!obj)
+                return null;
+            // Parsed through the contract on the way out, so a corrupted object fails HERE
+            // rather than half-way through the restore that trusted it.
+            return directoryDump.parse(JSON.parse(await obj.text()));
+        },
+        async delete({ capturedAt }) {
+            await r2.delete(directoryKey(capturedAt));
+        },
+    };
+}
+//# sourceMappingURL=r2-backups.js.map

package/dist/r2-backups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2-backups.js","sourceRoot":"","sources":["../src/r2-backups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,aAAa,EACb,SAAS,GAKV,MAAM,yBAAyB,CAAC;AA0BjC;;;;GAIG;AACH,SAAS,SAAS,CAAC,QAAgB,EAAE,OAAe,EAAE,UAAkB;IACtE,OAAO,UAAU,QAAQ,IAAI,OAAO,IAAI,UAAU,OAAO,CAAC;AAC5D,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,OAAe;IACpD,OAAO,UAAU,QAAQ,IAAI,OAAO,GAAG,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAe;IACjD,MAAM,EAAE,GAAG,MAAsB,CAAC;IAClC,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,+EAA+E;YAC/E,6DAA6D;YAC7D,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACnD,MAAM,MAAM,GAAgB;gBAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ;gBACR,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;aAC3B,CAAC;YACF,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;gBAC1E,YAAY,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;gBACjD,4EAA4E;gBAC5E,sEAAsE;gBACtE,cAAc,EAAE;oBACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClC;aACF,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;YAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAkB,EAAE,CAAC;YAC9B,IAAI,MAA0B,CAAC;YAC/B,GAAG,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC;oBACzB,MAAM;oBACN,OAAO,EAAE,CAAC,gBAAgB,CAAC;oBAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9B,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC;oBACpC,yEAAyE;oBACzE,qEAAqE;oBACrE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;oBACxF,GAAG,CAAC,IAAI,CAAC;wBACP,QAAQ;wBACR,OAAO;wBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;wBAC/B,UAAU;wBACV,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;qBAC9C,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,CAAC,QAAQ,MAAM,EAAE;YACjB,+EAA+E;YAC/E,0BAA0B;YAC1B,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;YACnE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,gFAAgF;YAChF,kEAAkE;YAClE,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAc,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,aAAa,UAAU,OAAO,CAAC;AACxC,CAAC;AAED,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAe;IAC1D,MAAM,EAAE,GAAG,MAAsB,CAAC;IAClC,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;YAChB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,oEAAoE;YACpE,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACnD,MAAM,MAAM,GAAoB;gBAC9B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;aAC3B,CAAC;YACF,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;gBAChD,YAAY,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;gBACjD,gFAAgF;gBAChF,6DAA6D;gBAC7D,cAAc,EAAE;oBACd,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;iBAC9B;aACF,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAsB,EAAE,CAAC;YAClC,IAAI,MAA0B,CAAC;YAC/B,GAAG,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC;oBACzB,MAAM,EAAE,gBAAgB;oBACxB,OAAO,EAAE,CAAC,gBAAgB,CAAC;oBAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9B,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC;oBACpC,4EAA4E;oBAC5E,iEAAiE;oBACjE,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;oBACjF,GAAG,CAAC,IAAI,CAAC;wBACP,UAAU;wBACV,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;qBAC9C,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,CAAC,QAAQ,MAAM,EAAE;YACjB,gFAAgF;YAChF,mEAAmE;YACnE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE;YACtB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,+EAA+E;YAC/E,4DAA4D;YAC5D,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAkB,CAAC;QAC5E,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE;YACzB,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC"}