@substrat-run/control-plane-api 0.49.0 → 0.51.0

package/dist/backups.d.ts

@@ -0,0 +1,93 @@
+/**
+ * The scope-backup write seam (#493) — where a reap's recoverable copy goes.
+ *
+ * A reap frees a scope's Durable Object storage because Cloudflare never garbage-
+ * collects a DO, and it is irreversible. Before #493 the operator had to REMEMBER to
+ * take a copy first, from a different surface; this seam is what makes "a reap always
+ * leaves a recoverable copy" a property of the route instead of a habit.
+ *
+ * Why a dump and not a snapshot fork. The obvious cheap move — `orchestratedSnapshot`
+ * before the reap — does not survive the case the flow exists for. A fork is provisioned
+ * INSIDE the vertical's own deployment and activated, so (a) its bytes live in the very
+ * deployment a retirement is about to delete, and (b) it counts as a live scope in
+ * `countScopesForVertical`, which means it re-blocks the `deleteVertical` the reap was
+ * clearing. A dump leaves the deployment entirely, and `POST …/restore` already loads one
+ * back, so export→store→restore is the round trip that actually closes.
+ *
+ * Provider-neutral by the same posture as `ObservabilityReader` and `DeployVerticalFn`:
+ * the contract lives here, an implementation lives in its own module (`r2-backups.ts` for
+ * Cloudflare R2), and the host injects one. A backup is addressed by (tenant, scope,
+ * capturedAt) rather than by a store-shaped key, so the key scheme stays the store's
+ * private business and no caller can build a path into someone else's tenant.
+ *
+ * Fidelity is deliberately FULL, never masked (#493). A masked dump has its PII redacted,
+ * so restoring one produces a structurally-valid but factually wrong scope — a backup that
+ * cannot restore is a false promise, and the promise is the whole point. This is not the
+ * §6 governed pull: the bytes go platform→platform and are never handed to a caller, which
+ * is why the export route's masking default does not apply here.
+ */
+import type { DirectoryBackup, DirectoryDump, ScopeBackup, ScopeDump } from '@substrat-run/contracts';
+export type { ScopeBackup, DirectoryBackup };
+export interface ScopeBackupStore {
+    /**
+     * Store one full-fidelity dump and return its metadata. Must be durable before it
+     * returns: the reap's whole guarantee is that this resolved before any byte was wiped.
+     */
+    put(input: {
+        vertical: string | null;
+        dump: ScopeDump;
+    }): Promise<ScopeBackup>;
+    /** Every backup held for one scope, newest first. */
+    list(input: {
+        tenantId: string;
+        scopeId: string;
+    }): Promise<ScopeBackup[]>;
+    /** One backup's dump, by its capture time. Null when no such copy is held. */
+    get(input: {
+        tenantId: string;
+        scopeId: string;
+        capturedAt: string;
+    }): Promise<ScopeDump | null>;
+}
+/**
+ * The DIRECTORY-backup store (#40) — the platform's own copy, not a tenant's.
+ *
+ * A sibling seam rather than a widened `ScopeBackupStore`, because the two are the same
+ * mechanism serving different jobs and the difference is worth keeping in the types.
+ * A scope backup is taken at a MOMENT — before a reap, before a migration — and is
+ * addressed by the scope it came from. A directory backup is taken on a SCHEDULE, has
+ * no tenant to be addressed by, and is pruned to a retention window. Only this one
+ * needs `delete`, and only this one is ever written by a sweep with no operator behind
+ * it.
+ *
+ * What it defends against is also different, and the distinction is the whole design
+ * (#40's own analysis). Per-scope point-in-time recovery already covers corruption
+ * inside the account — ~30 days, continuous, and strictly better than a daily copy, so
+ * scheduled per-scope backups are deliberately NOT built. The directory is the case PITR
+ * cannot answer: it is one Durable Object, and a bug that deletes it outright leaves
+ * nothing to rewind. Copies live outside the DO for that reason.
+ *
+ * Honest scoping: with the store bound in the platform's OWN account (the shape shipped
+ * today), this survives losing the directory, not losing the account. The seam is
+ * provider-neutral so an off-account target is a drop-in — see control-plane.md §4.9.
+ */
+export interface DirectoryBackupStore {
+    /**
+     * Store one full-fidelity directory dump and return its metadata. Durable before it
+     * returns, like the scope store's `put`.
+     */
+    put(input: {
+        dump: DirectoryDump;
+    }): Promise<DirectoryBackup>;
+    /** Every directory copy held, newest first. */
+    list(): Promise<DirectoryBackup[]>;
+    /** One copy's dump, by its capture time. Null when no such copy is held. */
+    get(input: {
+        capturedAt: string;
+    }): Promise<DirectoryDump | null>;
+    /** Drop one copy — how the retention window is enforced. Missing is not an error. */
+    delete(input: {
+        capturedAt: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=backups.d.ts.map

package/dist/backups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backups.d.ts","sourceRoot":"","sources":["../src/backups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAKtG,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AAE7C,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,GAAG,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/E,qDAAqD;IACrD,IAAI,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3E,8EAA8E;IAC9E,GAAG,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CAClG;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,GAAG,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9D,+CAA+C;IAC/C,IAAI,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACnC,4EAA4E;IAC5E,GAAG,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAClE,qFAAqF;IACrF,MAAM,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD"}

package/dist/backups.js

@@ -0,0 +1,30 @@
+/**
+ * The scope-backup write seam (#493) — where a reap's recoverable copy goes.
+ *
+ * A reap frees a scope's Durable Object storage because Cloudflare never garbage-
+ * collects a DO, and it is irreversible. Before #493 the operator had to REMEMBER to
+ * take a copy first, from a different surface; this seam is what makes "a reap always
+ * leaves a recoverable copy" a property of the route instead of a habit.
+ *
+ * Why a dump and not a snapshot fork. The obvious cheap move — `orchestratedSnapshot`
+ * before the reap — does not survive the case the flow exists for. A fork is provisioned
+ * INSIDE the vertical's own deployment and activated, so (a) its bytes live in the very
+ * deployment a retirement is about to delete, and (b) it counts as a live scope in
+ * `countScopesForVertical`, which means it re-blocks the `deleteVertical` the reap was
+ * clearing. A dump leaves the deployment entirely, and `POST …/restore` already loads one
+ * back, so export→store→restore is the round trip that actually closes.
+ *
+ * Provider-neutral by the same posture as `ObservabilityReader` and `DeployVerticalFn`:
+ * the contract lives here, an implementation lives in its own module (`r2-backups.ts` for
+ * Cloudflare R2), and the host injects one. A backup is addressed by (tenant, scope,
+ * capturedAt) rather than by a store-shaped key, so the key scheme stays the store's
+ * private business and no caller can build a path into someone else's tenant.
+ *
+ * Fidelity is deliberately FULL, never masked (#493). A masked dump has its PII redacted,
+ * so restoring one produces a structurally-valid but factually wrong scope — a backup that
+ * cannot restore is a false promise, and the promise is the whole point. This is not the
+ * §6 governed pull: the bytes go platform→platform and are never handed to a caller, which
+ * is why the export route's masking default does not apply here.
+ */
+export {};
+//# sourceMappingURL=backups.js.map

package/dist/backups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backups.js","sourceRoot":"","sources":["../src/backups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG"}

package/dist/directory-backup.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The scheduled directory backup (#40) — the platform's own disaster-recovery pass.
+ *
+ * `control-plane.md` names the stake without resolving it: *"The directory becomes a real
+ * database, with its own migrations and backup story… Losing it is losing the platform,
+ * not losing a cache."* Every OTHER database the platform holds is a scope, protected by
+ * ~30-day Durable Object point-in-time recovery — which is continuous, per-scope, and
+ * strictly better than any daily copy, so scheduled per-scope backups are deliberately not
+ * built here. The directory is the one database PITR cannot answer for: it is a single DO,
+ * and a control-plane bug that deletes it outright leaves nothing to rewind. So a copy
+ * lives OUTSIDE the DO, and this is what takes it.
+ *
+ * Driven by the same cron that drives the platform sweep, and the cadence is enforced HERE
+ * rather than by a second trigger. A quarter-hourly sweep asking "is a copy due?" and answering
+ * from the store is idempotent, survives a missed tick (the next pass takes it, late
+ * rather than never), and needs no durable "last run" state of its own — the newest stored
+ * copy IS that state. A dedicated daily trigger would have to be right about time zones,
+ * deploys and restarts to do the same job worse.
+ */
+import type { DirectoryBackup, PlatformActorId } from '@substrat-run/contracts';
+import type { HostAdmin } from '@substrat-run/kernel';
+import type { DirectoryBackupStore } from './backups.js';
+export interface DirectoryBackupOptions {
+    admin: HostAdmin;
+    store: DirectoryBackupStore;
+    /** The platform actor the export is audited under. */
+    actor: PlatformActorId;
+    /** Hours between copies (default 24). */
+    intervalHours?: number;
+    /** How many copies to keep (default 30). Older ones are deleted after a successful put. */
+    retain?: number;
+    /** Take a copy regardless of cadence — what the manual "back up now" route passes. */
+    force?: boolean;
+    /** Injected clock, for tests. */
+    now?: () => Date;
+}
+export interface DirectoryBackupResult {
+    /** The copy taken this pass, or null when the cadence guard skipped it. */
+    taken: DirectoryBackup | null;
+    /** When nothing was taken: the copy that was still fresh enough to skip for. */
+    skippedFor: string | null;
+    /** Copies deleted by the retention window this pass. */
+    pruned: number;
+}
+/**
+ * Take a directory backup if one is due, then prune to the retention window.
+ *
+ * Order matters and is the inverse of the reap's (#493). A reap stores BEFORE it wipes,
+ * because the wipe is what the copy protects against. Here the prune runs AFTER a
+ * successful put, so a failed capture can never be the thing that deletes the last good
+ * copy — the worst case is an extra copy kept, never a missing one.
+ *
+ * Throws whatever the export or the store threw. The caller (a cron pass) decides what a
+ * failure means; it must not be silent, which is why nothing is swallowed here.
+ */
+export declare function backupDirectoryIfDue(options: DirectoryBackupOptions): Promise<DirectoryBackupResult>;
+//# sourceMappingURL=directory-backup.d.ts.map

package/dist/directory-backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-backup.d.ts","sourceRoot":"","sources":["../src/directory-backup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAUzD,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,oBAAoB,CAAC;IAC5B,sDAAsD;IACtD,KAAK,EAAE,eAAe,CAAC;IACvB,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC9B,gFAAgF;IAChF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CA+BhC"}

package/dist/directory-backup.js

@@ -0,0 +1,68 @@
+/**
+ * The scheduled directory backup (#40) — the platform's own disaster-recovery pass.
+ *
+ * `control-plane.md` names the stake without resolving it: *"The directory becomes a real
+ * database, with its own migrations and backup story… Losing it is losing the platform,
+ * not losing a cache."* Every OTHER database the platform holds is a scope, protected by
+ * ~30-day Durable Object point-in-time recovery — which is continuous, per-scope, and
+ * strictly better than any daily copy, so scheduled per-scope backups are deliberately not
+ * built here. The directory is the one database PITR cannot answer for: it is a single DO,
+ * and a control-plane bug that deletes it outright leaves nothing to rewind. So a copy
+ * lives OUTSIDE the DO, and this is what takes it.
+ *
+ * Driven by the same cron that drives the platform sweep, and the cadence is enforced HERE
+ * rather than by a second trigger. A quarter-hourly sweep asking "is a copy due?" and answering
+ * from the store is idempotent, survives a missed tick (the next pass takes it, late
+ * rather than never), and needs no durable "last run" state of its own — the newest stored
+ * copy IS that state. A dedicated daily trigger would have to be right about time zones,
+ * deploys and restarts to do the same job worse.
+ */
+/** One copy a day; the sweep runs far more often and skips in between. */
+const DEFAULT_INTERVAL_HOURS = 24;
+/**
+ * Thirty copies — a month of daily history, matching the DO PITR horizon so the two
+ * defences expire together rather than leaving a window covered by neither.
+ */
+const DEFAULT_RETAIN = 30;
+/**
+ * Take a directory backup if one is due, then prune to the retention window.
+ *
+ * Order matters and is the inverse of the reap's (#493). A reap stores BEFORE it wipes,
+ * because the wipe is what the copy protects against. Here the prune runs AFTER a
+ * successful put, so a failed capture can never be the thing that deletes the last good
+ * copy — the worst case is an extra copy kept, never a missing one.
+ *
+ * Throws whatever the export or the store threw. The caller (a cron pass) decides what a
+ * failure means; it must not be silent, which is why nothing is swallowed here.
+ */
+export async function backupDirectoryIfDue(options) {
+    const now = options.now?.() ?? new Date();
+    const retain = options.retain ?? DEFAULT_RETAIN;
+    const intervalMs = (options.intervalHours ?? DEFAULT_INTERVAL_HOURS) * 3_600_000;
+    // The store IS the schedule's memory: newest copy, newest first (the store sorts).
+    const existing = await options.store.list();
+    const newest = existing[0];
+    if (!options.force && newest) {
+        const age = now.getTime() - new Date(newest.capturedAt).getTime();
+        // `age < 0` — a copy stamped in the future, from a clock skew or a hand-uploaded
+        // object — counts as fresh. Skipping is the conservative read: taking a copy is
+        // cheap, but treating a future timestamp as "infinitely overdue" would take one on
+        // every single pass until real time caught up.
+        if (age < intervalMs)
+            return { taken: null, skippedFor: newest.capturedAt, pruned: 0 };
+    }
+    const dump = await options.admin.exportDirectory(options.actor);
+    const taken = await options.store.put({ dump });
+    // Prune from a re-read list, not from `existing`: the copy just written has to be in
+    // the reckoning, or a retention window of N would keep N+1 forever.
+    let pruned = 0;
+    if (retain > 0) {
+        const all = await options.store.list();
+        for (const stale of all.slice(retain)) {
+            await options.store.delete({ capturedAt: stale.capturedAt });
+            pruned += 1;
+        }
+    }
+    return { taken, skippedFor: null, pruned };
+}
+//# sourceMappingURL=directory-backup.js.map

package/dist/directory-backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-backup.js","sourceRoot":"","sources":["../src/directory-backup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,0EAA0E;AAC1E,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC;;;GAGG;AACH,MAAM,cAAc,GAAG,EAAE,CAAC;AA0B1B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA+B;IAE/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC;IAChD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC,GAAG,SAAS,CAAC;IAEjF,mFAAmF;IACnF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,MAAM,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;QAClE,iFAAiF;QACjF,gFAAgF;QAChF,mFAAmF;QACnF,+CAA+C;QAC/C,IAAI,GAAG,GAAG,UAAU;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhD,qFAAqF;IACrF,oEAAoE;IACpE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC"}

package/dist/do-namespaces.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Resolving a scope's Durable Object to something an operator can OPEN.
+ *
+ * A scope's data lives in one Durable Object, named after the scope id inside a namespace
+ * (a class × a script). The console has always been able to say the name; the dashboard,
+ * however, addresses a namespace by an id Cloudflare assigns — not by the class or the
+ * script — so without that id the best a link could do was the account-wide namespace
+ * list, which on a real fleet is one entry per pushed script.
+ *
+ * This is the seam that closes the gap: given the script a scope serves from, hand back
+ * the namespaces defined in it. Injected by the host like every other Cloudflare read
+ * (D-34: this package holds no SDK and no credential), and entirely optional — absent, the
+ * console falls back to the namespace list exactly as before.
+ */
+/** One Durable Object namespace as Cloudflare describes it. */
+export interface DoNamespaceRecord {
+    /** The dashboard's address for this namespace — the whole point of the read. */
+    id: string;
+    /** The exported class the namespace is defined by (e.g. `ScopeDO`). */
+    className: string;
+    /** The script defining it — a dispatch-namespace script name for a pushed vertical. */
+    script: string | null;
+    name: string | null;
+    useSqlite: boolean;
+}
+export interface DoNamespaceReader {
+    /** Every Durable Object namespace on the account. Filtering by script happens above:
+     *  Cloudflare's list endpoint takes no filter, and a reader that pretended otherwise
+     *  would hide the pagination cost from the one place that can cache it. */
+    list(): Promise<DoNamespaceRecord[]>;
+}
+export interface CfDoNamespaceOptions {
+    accountId: string;
+    apiToken: string;
+    /** Injected for tests. */
+    fetchImpl?: typeof fetch;
+    /**
+     * How long a listing stays fresh. The mapping changes only when a script is pushed or
+     * deleted, and the read is one-or-more paginated API calls that would otherwise run on
+     * every scope-detail open — so the default trades a few minutes of staleness (worst
+     * case: a just-pushed script's namespace is not linkable yet) for not hammering the API.
+     */
+    ttlMs?: number;
+    /** Hard cap on pages walked, so an account with a very large fleet degrades to a slow
+     *  read rather than an unbounded one. */
+    maxPages?: number;
+}
+/**
+ * A {@link DoNamespaceReader} over Cloudflare's account-wide list endpoint, with a small
+ * TTL cache. Pure web-standard `fetch`, like every other Cloudflare seam in this package.
+ */
+export declare function createCfDoNamespaceReader(opts: CfDoNamespaceOptions): DoNamespaceReader;
+/**
+ * The namespaces defined in one script, most-likely-scope-class first.
+ *
+ * A vertical's script defines several classes (the scope DO, an identity DO, sweepers), so
+ * ORDER is the useful part: the console links the first entry, and a scope's data is in the
+ * scope class. Matching is on the class name because that is the only stable signal — the
+ * namespace's `name` is Cloudflare's, and the binding name lives in the script's settings,
+ * not here. Every namespace of the script is still returned, so a vertical that named its
+ * class something else is one click away rather than unreachable.
+ */
+export declare function namespacesForScript(rows: DoNamespaceRecord[], script: string): DoNamespaceRecord[];
+//# sourceMappingURL=do-namespaces.d.ts.map

package/dist/do-namespaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"do-namespaces.d.ts","sourceRoot":"","sources":["../src/do-namespaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC;;+EAE2E;IAC3E,IAAI,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;6CACyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,oBAAoB,GAAG,iBAAiB,CAiEvF;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,EAAE,CASlG"}

package/dist/do-namespaces.js

@@ -0,0 +1,101 @@
+/**
+ * Resolving a scope's Durable Object to something an operator can OPEN.
+ *
+ * A scope's data lives in one Durable Object, named after the scope id inside a namespace
+ * (a class × a script). The console has always been able to say the name; the dashboard,
+ * however, addresses a namespace by an id Cloudflare assigns — not by the class or the
+ * script — so without that id the best a link could do was the account-wide namespace
+ * list, which on a real fleet is one entry per pushed script.
+ *
+ * This is the seam that closes the gap: given the script a scope serves from, hand back
+ * the namespaces defined in it. Injected by the host like every other Cloudflare read
+ * (D-34: this package holds no SDK and no credential), and entirely optional — absent, the
+ * console falls back to the namespace list exactly as before.
+ */
+const PER_PAGE = 100;
+/**
+ * A {@link DoNamespaceReader} over Cloudflare's account-wide list endpoint, with a small
+ * TTL cache. Pure web-standard `fetch`, like every other Cloudflare seam in this package.
+ */
+export function createCfDoNamespaceReader(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const ttlMs = opts.ttlMs ?? 5 * 60_000;
+    const maxPages = opts.maxPages ?? 50;
+    const base = `https://api.cloudflare.com/client/v4/accounts/${opts.accountId}/workers/durable_objects/namespaces`;
+    let cached = null;
+    // Concurrent scope-detail opens must not each start their own walk; they share the
+    // in-flight promise and settle together.
+    let inFlight = null;
+    async function walk() {
+        const rows = [];
+        for (let page = 1; page <= maxPages; page++) {
+            const res = await fetchImpl(`${base}?page=${page}&per_page=${PER_PAGE}`, {
+                headers: { authorization: `Bearer ${opts.apiToken}` },
+            });
+            if (!res.ok) {
+                throw new Error(`Cloudflare Durable Object namespace list failed (${res.status})`);
+            }
+            const body = (await res.json());
+            if (body.success === false) {
+                throw new Error(`Cloudflare Durable Object namespace list failed: ${body.errors?.map((e) => e.message).join('; ') || 'unknown error'}`);
+            }
+            const batch = body.result ?? [];
+            for (const r of batch) {
+                // An id-less row cannot be linked to, which is this read's whole purpose.
+                if (!r.id || !r.class)
+                    continue;
+                rows.push({
+                    id: r.id,
+                    className: r.class,
+                    script: r.script ?? null,
+                    name: r.name ?? null,
+                    useSqlite: r.use_sqlite === true,
+                });
+            }
+            if (batch.length < PER_PAGE)
+                break;
+        }
+        return rows;
+    }
+    return {
+        async list() {
+            const now = Date.now();
+            if (cached && now - cached.at < ttlMs)
+                return cached.rows;
+            if (inFlight)
+                return inFlight;
+            inFlight = walk()
+                .then((rows) => {
+                cached = { at: Date.now(), rows };
+                return rows;
+            })
+                .finally(() => {
+                inFlight = null;
+            });
+            return inFlight;
+        },
+    };
+}
+/**
+ * The namespaces defined in one script, most-likely-scope-class first.
+ *
+ * A vertical's script defines several classes (the scope DO, an identity DO, sweepers), so
+ * ORDER is the useful part: the console links the first entry, and a scope's data is in the
+ * scope class. Matching is on the class name because that is the only stable signal — the
+ * namespace's `name` is Cloudflare's, and the binding name lives in the script's settings,
+ * not here. Every namespace of the script is still returned, so a vertical that named its
+ * class something else is one click away rather than unreachable.
+ */
+export function namespacesForScript(rows, script) {
+    const mine = rows.filter((r) => r.script === script);
+    const rank = (r) => {
+        const c = r.className.toLowerCase();
+        if (c === 'scopedo')
+            return 0;
+        if (c.includes('scope'))
+            return 1;
+        return 2;
+    };
+    return mine.sort((a, b) => rank(a) - rank(b) || a.className.localeCompare(b.className));
+}
+//# sourceMappingURL=do-namespaces.js.map

package/dist/do-namespaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"do-namespaces.js","sourceRoot":"","sources":["../src/do-namespaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAsCH,MAAM,QAAQ,GAAG,GAAG,CAAC;AAErB;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAA0B;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,iDAAiD,IAAI,CAAC,SAAS,qCAAqC,CAAC;IAElH,IAAI,MAAM,GAAqD,IAAI,CAAC;IACpE,mFAAmF;IACnF,yCAAyC;IACzC,IAAI,QAAQ,GAAwC,IAAI,CAAC;IAEzD,KAAK,UAAU,IAAI;QACjB,MAAM,IAAI,GAAwB,EAAE,CAAC;QACrC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,SAAS,IAAI,aAAa,QAAQ,EAAE,EAAE;gBACvE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE,EAAE;aACtD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,oDAAoD,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;YACF,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,oDACE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eACnD,EAAE,CACH,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,0EAA0E;gBAC1E,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK;oBAAE,SAAS;gBAChC,IAAI,CAAC,IAAI,CAAC;oBACR,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,SAAS,EAAE,CAAC,CAAC,KAAK;oBAClB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;oBACxB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;oBACpB,SAAS,EAAE,CAAC,CAAC,UAAU,KAAK,IAAI;iBACjC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ;gBAAE,MAAM;QACrC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,EAAE,GAAG,KAAK;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC;YAC1D,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,QAAQ,GAAG,IAAI,EAAE;iBACd,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACb,MAAM,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC;YACd,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC,CAAC,CAAC;YACL,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAyB,EAAE,MAAc;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,CAAoB,EAAE,EAAE;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1F,CAAC"}

package/dist/index.d.ts

@@ -16,6 +16,13 @@ export { blobStoreBindings, collectBlobStoreHandles, collectTenantStoreHandles,
 export { createCustomHostnameProvisioner, mapCfStatus, extractRecords, reconcilePendingHostnames, isCustomHostname, validateBindableHostname, } from './custom-hostnames.js';
 export type { CustomHostnameProvisioner, CustomHostnameProvisionerOptions, CustomHostnameIssuance, ReconcileHostnamesResult, } from './custom-hostnames.js';
 export type { ObservabilityReader, ServiceMetricsRow, RecentLogEvent } from './observability.js';
+export type { PlatformRuntime } from './platform-runtime.js';
+export { createCfDoNamespaceReader, namespacesForScript } from './do-namespaces.js';
+export type { DoNamespaceReader, DoNamespaceRecord, CfDoNamespaceOptions } from './do-namespaces.js';
 export { createCfObservabilityReader } from './cf-observability.js';
 export type { CfObservabilityOptions } from './cf-observability.js';
+export type { ScopeBackup, ScopeBackupStore, DirectoryBackup, DirectoryBackupStore, } from './backups.js';
+export { createR2BackupStore, createR2DirectoryBackupStore } from './r2-backups.js';
+export { backupDirectoryIfDue } from './directory-backup.js';
+export type { DirectoryBackupOptions, DirectoryBackupResult } from './directory-backup.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,YAAY,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,SAAS,GACV,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACpE,YAAY,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAChG,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,yBAAyB,EACzB,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACjD,YAAY,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrG,YAAY,EACV,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,SAAS,GACV,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACpE,YAAY,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAChG,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,yBAAyB,EACzB,gCAAgC,EAChC,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACjG,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAIpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -8,5 +8,11 @@ export { assertSandboxContract, deployManifest, deploymentRefFor, stableDeployme
 export { createWfpUploader, createWfpModulesFetcher, createWfpBindingsPatcher } from './wfp.js';
 export { blobStoreBindings, collectBlobStoreHandles, collectTenantStoreHandles, tenantStoreBindings, } from './tenant-stores.js';
 export { createCustomHostnameProvisioner, mapCfStatus, extractRecords, reconcilePendingHostnames, isCustomHostname, validateBindableHostname, } from './custom-hostnames.js';
+export { createCfDoNamespaceReader, namespacesForScript } from './do-namespaces.js';
 export { createCfObservabilityReader } from './cf-observability.js';
+export { createR2BackupStore, createR2DirectoryBackupStore } from './r2-backups.js';
+// #40 — the scheduled directory copy. Exported as a function the CP worker's cron calls,
+// not as a route with a timer behind it: this package stays library-only, exactly as the
+// platform-request drain does (the recurrence has to come from a deployment, #444).
+export { backupDirectoryIfDue } from './directory-backup.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAUrG,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,GAUvB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAQhG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAUrG,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,GAUvB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAQhG,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,+BAA+B,EAC/B,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAQpE,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AACpF,yFAAyF;AACzF,yFAAyF;AACzF,oFAAoF;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/mask.d.ts

@@ -1,4 +1,19 @@
 import type { ScopeDumpTable } from '@substrat-run/contracts';
 /** Mask one dump in place-shape (returns new arrays; never mutates the input). */
 export declare function maskDump(tables: ScopeDumpTable[]): ScopeDumpTable[];
+/**
+ * The same heuristic applied to plain JSON records — the directory half of a tenant
+ * export (#36).
+ *
+ * A tenant export carries two kinds of thing: scope databases (table-shaped, masked by
+ * `maskDump` above) and directory records (object-shaped — a tenant's display name, an
+ * org's name, an identity link's external id, which is usually an email). Both halves
+ * must be masked by the SAME rule, or the default-masked promise is only half true and
+ * the leak is in the half nobody looked at.
+ *
+ * So this reuses `maskJsonValue` rather than growing a second heuristic: one PII column
+ * list, one recursive sweep, two entry points. Ids and timestamps pass through — the
+ * sweep targets free text, and ids are what keep an export intelligible.
+ */
+export declare function maskRecords<T>(records: readonly T[]): T[];
 //# sourceMappingURL=mask.d.ts.map

package/dist/mask.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mask.d.ts","sourceRoot":"","sources":["../src/mask.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAoD9D,kFAAkF;AAClF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE,CAqBnE"}
+{"version":3,"file":"mask.d.ts","sourceRoot":"","sources":["../src/mask.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AA2D9D,kFAAkF;AAClF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE,CAqBnE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,CAEzD"}

package/dist/mask.js

@@ -22,7 +22,14 @@
  */
 // Free-text/PII column names. `name` is included on purpose: entity names
 // (customers, properties, contacts) are customer data even when they look benign.
-const PII_COLUMN = /(^|_)(email|e?mail_address|phone|mobile|tel|address|street|city|postal|zip|ssn|personnummer|name|first_name|last_name|full_name|contact|note|notes|comment|comments|message|subject|body|description)($|_)/i;
+//
+// `external_id` earns its place from the platform's OWN schema (#36): an identity link's
+// `externalId` is the provider's subject, which in practice is very often the person's
+// email address — so a tenant export that swept only the obvious columns would hand out
+// the one field most likely to name a human. It is the deliberately lossy direction of
+// the trade: an opaque third-party id (a document ref, an upstream order number) gets
+// masked too, which costs a masked pull some fidelity and costs a leak nothing.
+const PII_COLUMN = /(^|_)(email|e?mail_address|phone|mobile|tel|address|street|city|postal|zip|ssn|personnummer|name|first_name|last_name|full_name|contact|external_id|note|notes|comment|comments|message|subject|body|description)($|_)/i;
 // Columns that carry JSON documents worth sweeping by key rather than blanking.
 const JSON_COLUMN = /(^|_)(payload|detail|details|data|before|after)($|_)/i;
 const MASKED = '[masked]';
@@ -68,4 +75,21 @@ export function maskDump(tables) {
         return { ...t, rows };
     });
 }
+/**
+ * The same heuristic applied to plain JSON records — the directory half of a tenant
+ * export (#36).
+ *
+ * A tenant export carries two kinds of thing: scope databases (table-shaped, masked by
+ * `maskDump` above) and directory records (object-shaped — a tenant's display name, an
+ * org's name, an identity link's external id, which is usually an email). Both halves
+ * must be masked by the SAME rule, or the default-masked promise is only half true and
+ * the leak is in the half nobody looked at.
+ *
+ * So this reuses `maskJsonValue` rather than growing a second heuristic: one PII column
+ * list, one recursive sweep, two entry points. Ids and timestamps pass through — the
+ * sweep targets free text, and ids are what keep an export intelligible.
+ */
+export function maskRecords(records) {
+    return records.map((r) => maskJsonValue(r, false));
+}
 //# sourceMappingURL=mask.js.map

package/dist/mask.js.map

@@ -1 +1 @@
-{"version":3,"file":"mask.js","sourceRoot":"","sources":["../src/mask.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,0EAA0E;AAC1E,kFAAkF;AAClF,MAAM,UAAU,GAAG,6MAA6M,CAAC;AAEjO,gFAAgF;AAChF,MAAM,WAAW,GAAG,uDAAuD,CAAC;AAE5E,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,iFAAiF;AACjF,iFAAiF;AACjF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE,CAC3C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC;AAE/D,SAAS,aAAa,CAAC,KAAc,EAAE,UAAmB;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAChF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,QAAQ,CAAC,MAAwB;IAC/C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9B,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YAClB,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1C,IAAI,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,MAAM,CAAC;YAC9B,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;gBAChE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC,CAAC,6DAA6D;gBAC5E,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CACH,CAAC;QACF,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"mask.js","sourceRoot":"","sources":["../src/mask.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,0EAA0E;AAC1E,kFAAkF;AAClF,EAAE;AACF,yFAAyF;AACzF,uFAAuF;AACvF,wFAAwF;AACxF,uFAAuF;AACvF,sFAAsF;AACtF,gFAAgF;AAChF,MAAM,UAAU,GAAG,yNAAyN,CAAC;AAE7O,gFAAgF;AAChF,MAAM,WAAW,GAAG,uDAAuD,CAAC;AAE5E,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,iFAAiF;AACjF,iFAAiF;AACjF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAW,EAAE,CAC3C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC;AAE/D,SAAS,aAAa,CAAC,KAAc,EAAE,UAAmB;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAChF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,QAAQ,CAAC,MAAwB;IAC/C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9B,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YAClB,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1C,IAAI,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,MAAM,CAAC;YAC9B,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;gBAChE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC,CAAC,6DAA6D;gBAC5E,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CACH,CAAC;QACF,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAI,OAAqB;IAClD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,CAAM,CAAC,CAAC;AAC1D,CAAC"}

package/dist/platform-runtime.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Where this platform's compute and per-tenant stores physically live (#537-adjacent ops
+ * ergonomics): the coordinates a staff surface turns into a link into the provider's own
+ * console — this scope's serving script, this tenant's database, this tenant's bucket.
+ *
+ * Substrate-agnostic on purpose. The control plane already knows a scope's `servingRef`,
+ * a store's `ref`, and a version's `deploymentRef`; what it has never told anyone is
+ * WHERE those refs resolve. That is one descriptor, not a Cloudflare dependency: this
+ * package still holds no provider SDK and no credential (D-34), and the pure adapter
+ * simply has no runtime to describe (`provider` absent ⇒ the console shows plain ids).
+ */
+export interface PlatformRuntime {
+    /** The substrate these refs resolve in. Only Cloudflare exists today; the tag is what
+     *  lets a consumer refuse to build links for a substrate it does not know. */
+    provider: 'cloudflare';
+    /** The account the platform's scripts, databases and buckets belong to. */
+    accountId: string;
+    /** The dispatch namespace pushed verticals run in (WfP) — where a `servingRef` or a
+     *  version's `deploymentRef` is a script name. */
+    dispatchNamespace: string;
+}
+//# sourceMappingURL=platform-runtime.d.ts.map

package/dist/platform-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-runtime.d.ts","sourceRoot":"","sources":["../src/platform-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B;kFAC8E;IAC9E,QAAQ,EAAE,YAAY,CAAC;IACvB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB;sDACkD;IAClD,iBAAiB,EAAE,MAAM,CAAC;CAC3B"}

package/dist/platform-runtime.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=platform-runtime.js.map

package/dist/platform-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-runtime.js","sourceRoot":"","sources":["../src/platform-runtime.ts"],"names":[],"mappings":""}