@substrat-run/kernel 0.146.0 → 0.148.0

package/dist/scope-copy-ledger.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-copy-ledger.js","sourceRoot":"","sources":["../src/scope-copy-ledger.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;+DAMuB,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAkC,EAAE,GAAW,EAAY,EAAE,CAC9F,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;6EAMwC,CAAC;AAE9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAAkC,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAC/D,EAAE,CAAC;IACtB,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,IAAI,IAAI;IAC/F,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM;CACvC,CAAC;AAEF,uGAAuG;AACvG,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;yEAGyC,CAAC;AAE1E,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAG;;;wEAG0C,CAAC;AAEzE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;2GAK0E,CAAC;AAE5G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,OAAe,EAAE,SAAiB,EAAY,EAAE,CACnG,CAAC,SAAS,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAK9D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;;wDAEa,gBAAgB;;;0FAGkB,gBAAgB;oCACtE,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,sHAAsH,CAAC;AAazH,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAuC,EAA2B,EAAE,CACtG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AAsB/E,mGAAmG;AACnG,MAAM,wBAAwB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAE5G,gGAAgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAAc,EAAE,UAAkB,EAAE,OAAe,EAAE,YAAoB,EACvD,EAAE,CAAC,CAAC;IACtB,MAAM;IACN,QAAQ,EAAE,IAAI,IAAI,CAAC,UAAU,GAAG,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE;IAC1F,YAAY;CACb,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAuB,EAAE,GAAW,EAAW,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAE1H,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,8EAA8E,CAAC;AAexH,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GACpC,0FAA0F,CAAC;AAE7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAqB,EAAmB,EAAE,CAAC,CAAC;IAC5E,QAAQ,EAAE,CAAC,CAAC,SAAqB;IACjC,OAAO,EAAE,CAAC,CAAC,QAAmB;IAC9B,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,MAAM,EAAE,CAAC,CAAC,OAAO;IACjB,KAAK,EAAE,CAAC,CAAC,KAAiC;IAC1C,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;IACrE,UAAU,EAAE,CAAC,CAAC,WAAW;CAC1B,CAAC,CAAC"}
+{"version":3,"file":"scope-copy-ledger.js","sourceRoot":"","sources":["../src/scope-copy-ledger.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;+DAMuB,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAkC,EAAE,GAAW,EAAY,EAAE,CAC9F,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;6EAMwC,CAAC;AAE9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAAkC,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAC/D,EAAE,CAAC;IACtB,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,IAAI,IAAI;IAC/F,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM;CACvC,CAAC;AAEF,uGAAuG;AACvG,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;yEAGyC,CAAC;AAE1E,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAG;;;wEAG0C,CAAC;AAEzE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;2GAK0E,CAAC;AAE5G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,OAAe,EAAE,SAAiB,EAAY,EAAE,CACnG,CAAC,SAAS,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAK9D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;;wDAEa,gBAAgB;;;0FAGkB,gBAAgB;oCACtE,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,sHAAsH,CAAC;AA6BzH;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;+EAWsC,CAAC;AAEhF,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,QAAgB,EAAE,OAAe,EAAE,KAA0B,EACjC,EAAE,CAAC;IAC/B,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS;IAClF,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,KAAK,CAAC,cAAc,EAAE,GAAG,IAAI,IAAI,EAAE,KAAK,CAAC,cAAc,EAAE,SAAS,IAAI,IAAI;CAC3E,CAAC;AAKF,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAuC,EAA2B,EAAE,CACtG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AAsB/E,mGAAmG;AACnG,MAAM,wBAAwB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAE5G,gGAAgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAAc,EAAE,UAAkB,EAAE,OAAe,EAAE,YAAoB,EACvD,EAAE,CAAC,CAAC;IACtB,MAAM;IACN,QAAQ,EAAE,IAAI,IAAI,CAAC,UAAU,GAAG,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE;IAC1F,YAAY;CACb,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAuB,EAAE,GAAW,EAAW,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAE1H,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,8EAA8E,CAAC;AAexH,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GACpC,0FAA0F,CAAC;AAE7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAqB,EAAmB,EAAE,CAAC,CAAC;IAC5E,QAAQ,EAAE,CAAC,CAAC,SAAqB;IACjC,OAAO,EAAE,CAAC,CAAC,QAAmB;IAC9B,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,MAAM,EAAE,CAAC,CAAC,OAAO;IACjB,KAAK,EAAE,CAAC,CAAC,KAAiC;IAC1C,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;IACrE,UAAU,EAAE,CAAC,CAAC,WAAW;CAC1B,CAAC,CAAC"}

package/dist/scope-copy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-copy.d.ts","sourceRoot":"","sources":["../src/scope-copy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,UAAU,gBAAiB,MAAM,GAAG,SAAS,iBAAiB,MAAM,GAAG,SAAS,KAAG,OACpC,CAAC;AAK7D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,EACtF,MAAM,EAAE,CAAC,EAAE,EACX,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,CAAC,EAAE,CAGL;AAcD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,eAAe,8cAW3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,sBAAiB,MACqD,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,GAAG,EAAE,MAAM,GACV,IAAI,CAiDN;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAInE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAEa,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAIpE;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,0FAA0F,CAAC"}
+{"version":3,"file":"scope-copy.d.ts","sourceRoot":"","sources":["../src/scope-copy.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,UAAU,gBAAiB,MAAM,GAAG,SAAS,iBAAiB,MAAM,GAAG,SAAS,KAAG,OACpC,CAAC;AAK7D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,EACtF,MAAM,EAAE,CAAC,EAAE,EACX,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,CAAC,EAAE,CAGL;AAcD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,eAAe,8cAW3B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,sBAAiB,MACqD,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,SAAS,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,GAAG,EAAE,MAAM,GACV,IAAI,CAiDN;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAInE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAEa,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAIpE;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,0FAA0F,CAAC"}

package/dist/scope-copy.js

@@ -1,4 +1,5 @@
 import { CAPABILITY_TABLE_NAMES } from './capability.js';
+import { UPLOAD_LINK_TABLE_NAMES } from './upload-link.js';
 /**
  * What a dump leaves behind when it lands in a scope other than the one it was captured from
  * (#1686). One definition for both adapters' loaders, so the DO and the pure host agree.
@@ -33,8 +34,8 @@ import { CAPABILITY_TABLE_NAMES } from './capability.js';
  *   consumer's position, so a copy's cursor acknowledges nothing at the source either.
  */
 export const isCopyLoad = (destScopeId, sourceScopeId) => destScopeId === undefined || sourceScopeId !== destScopeId;
-/** The capability tables, as `capabilitiesForLoad` matches a dump's (lowercased) names. */
-const CAPABILITY_TABLES = new Set(CAPABILITY_TABLE_NAMES);
+/** The capability tables — and the upload-link table, a bearer link of the same kind — as `capabilitiesForLoad` matches a dump's (lowercased) names. */
+const CAPABILITY_TABLES = new Set([...CAPABILITY_TABLE_NAMES, ...UPLOAD_LINK_TABLE_NAMES]);
 /**
  * A dump's tables as a load into `destScopeId` takes them: **capability rows never cross a scope
  * id.** A copy loads both capability tables empty, so a live link share opens the scope it was

package/dist/scope-copy.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-copy.js","sourceRoot":"","sources":["../src/scope-copy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,WAA+B,EAAE,aAAiC,EAAW,EAAE,CACxG,WAAW,KAAK,SAAS,IAAI,aAAa,KAAK,WAAW,CAAC;AAE7D,2FAA2F;AAC3F,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAW,EACX,WAA+B,EAC/B,aAAiC;IAEjC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3D,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,GAAG,CAAC,aAAiC,EAAU,EAAE,CAC/D,4BAA4B,aAAa,CAAC,CAAC,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC,CAAC,eAAe,kBAAkB;IACxG,yDAAyD,CAAC;AAE5D,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC;IACzC,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,qBAAqB;IAC3B,UAAU,EAAE,IAAI;CACgB,CAAC,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;CAW9B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAG,EAAE,EAAU,EAAE,CAChD,GAAG,KAAK,oFAAoF,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAc,EACd,WAA+B,EAC/B,aAAiC,EACjC,GAAW;IAEX,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC;QAAE,OAAO;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CACL;;+BAE2B,EAC3B,MAAM,EACN,mBAAmB,EACnB,GAAG,CACJ,CAAC;IACF,GAAG,CAAC,GAAG,CACL;wCACoC,EACpC,MAAM,EACN,GAAG,CACJ,CAAC;IACF,GAAG,CAAC,GAAG,CACL;;+BAE2B,EAC3B,MAAM,EACN,GAAG,EACH,GAAG,CACJ,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7E,8FAA8F;IAC9F,+FAA+F;IAC/F,6FAA6F;IAC7F,yBAAyB;IACzB,EAAE;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,0FAA0F;IAC1F,qBAAqB;IACrB,GAAG,CAAC,GAAG,CACL;;;;;;;;mEAQ+D,EAC/D,aAAa,IAAI,IAAI,EACrB,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAC1C,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAAc,EAAE,GAAW;IACxD,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,yHAAyH;IACzH,4CAA4C,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACrE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,uFAAuF,CAAC"}
+{"version":3,"file":"scope-copy.js","sourceRoot":"","sources":["../src/scope-copy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAG3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,WAA+B,EAAE,aAAiC,EAAW,EAAE,CACxG,WAAW,KAAK,SAAS,IAAI,aAAa,KAAK,WAAW,CAAC;AAE7D,wJAAwJ;AACxJ,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAS,CAAC,GAAG,sBAAsB,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC;AAExH;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAW,EACX,WAA+B,EAC/B,aAAiC;IAEjC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3D,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,GAAG,CAAC,aAAiC,EAAU,EAAE,CAC/D,4BAA4B,aAAa,CAAC,CAAC,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC,CAAC,eAAe,kBAAkB;IACxG,yDAAyD,CAAC;AAE5D,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC;IACzC,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,qBAAqB;IAC3B,UAAU,EAAE,IAAI;CACgB,CAAC,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;CAW9B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,GAAG,EAAE,EAAU,EAAE,CAChD,GAAG,KAAK,oFAAoF,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAc,EACd,WAA+B,EAC/B,aAAiC,EACjC,GAAW;IAEX,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC;QAAE,OAAO;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CACL;;+BAE2B,EAC3B,MAAM,EACN,mBAAmB,EACnB,GAAG,CACJ,CAAC;IACF,GAAG,CAAC,GAAG,CACL;wCACoC,EACpC,MAAM,EACN,GAAG,CACJ,CAAC;IACF,GAAG,CAAC,GAAG,CACL;;+BAE2B,EAC3B,MAAM,EACN,GAAG,EACH,GAAG,CACJ,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7E,8FAA8F;IAC9F,+FAA+F;IAC/F,6FAA6F;IAC7F,yBAAyB;IACzB,EAAE;IACF,6FAA6F;IAC7F,wFAAwF;IACxF,0FAA0F;IAC1F,qBAAqB;IACrB,GAAG,CAAC,GAAG,CACL;;;;;;;;mEAQ+D,EAC/D,aAAa,IAAI,IAAI,EACrB,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAC1C,GAAG,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAAc,EAAE,GAAW;IACxD,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,yHAAyH;IACzH,4CAA4C,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACrE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,uFAAuF,CAAC"}

package/dist/scope-host.d.ts

@@ -1,12 +1,16 @@
+import type { ScopeStoreStubOptions, StoreErasureReplay, StoreStub } from './scope-store.js';
 import type { ModuleLog } from './module-log.js';
 import type { BoundOperations } from './module-operations.js';
 import type { DeliveryRefusal } from './delivery-refusal.js';
 import type { ScopeRoleHolder } from './scope-role-admin.js';
-import type { ScopeCopyBackfillResult } from './scope-copy-ledger.js';
+import type { ScopeCopyBackfillResult, SubjectErasureFence } from './scope-copy-ledger.js';
+import type { VerticalScopeStore } from './vertical-scope-stores.js';
+import type { StoreKindHoldMode, StoreKindReleaseRecord, StoreKindRolloutAction, StoreKindRolloutRecord, StoreKindRolloutState, StoreKindState } from './store-kind-releases.js';
 import type { SubjectRedactionCounts } from './subject-redaction.js';
-import type { OnBehalfOf, ExportReadInput, ExportedBatch, ImportBatch, ImportedEvent, ImportResult, ImportState, ImportCursorMove, ImportCursorMoved, AdminAction, BecomeCapabilityInput, CapabilityExchange, CapabilityFilter, CapabilityId, CapabilityPage, MintedCapability, ListPage, ConnectLink, ConnectLinkConsume, ConnectLinkFilter, ConnectLinkKey, ConsumeConnectLinkInput, MintConnectLinkInput, Connection, ConnectionFilter, ConnectionId, ConnectionGrant, ConnectionGrantRecord, ConnectionSecret, CreateConnectionInput, OpenConnection, ProjectedConnectionGrant, ProjectedConnectionKey, AccessLogEntry, DelegatedReadRecord, OwnerTransferAudit, MemberChangeAudit, PeerBindingAudit, CopyMarkAudit, BindHostnameInput, AdminLogEntry, OpsFailureEntry, PlatformRequestDrainTotalsEntry, SweepRunEntry, SweepRunKind, SweepRunOutcome, ModelUsageEntry, ModelUsageSummary, CapabilityGrant, CreateTenantInput, Decision, Instant, DomainEvent, DomainEventInput, PlatformRequestInput, PlatformRequestId, PlatformRequestEntry, PlatformRequestFilter, PlatformRequestStatus, PlatformRequestFailure, PlatformOutcomeEvent, EntitlementGrant, EntitlementGrantInput, EntitlementView, MeterReading, ScopeStorageSample, EntityRef, IdentityLink, IdentityPool, Jurisdiction, ModuleId, ModuleManifest, ScheduleSpec, SystemGrant, PeerGrantsStatusEntry, SystemGrantsStatusEntry, SystemSwitchRecord, SystemSwitch, SystemSwitchResult, PeerCoverage, PeerSwitch, PeerSwitchResult, VerticalCaller, VerticalResolution, PeerBinding, PeerInstanceResolution, CreateOrgInput, Node, Org, OrgId, OrgMembership, PermissionKey, PlatformActorId, ChannelName, ExportBreak, ChannelHistoryEntry, DnsRecord, HostnameBinding, HostnameStatus, PromotionAcknowledgement, BindAcknowledgement, PublishVersionInput, RegisterVerticalInput, VerticalServingState, RouteTarget, DirectoryDump, IdentityMembership, PrincipalId, ResolvedIdentity, RoleAssignment, RoleDefinition, QueryScopeInput, ReadScopeTableInput, Scope, ScopeDump, SubjectShredReceipt, ScopeQueryResult, ScopeId, ScopeStatus, ScopeTable, DenialFilter, DenialSummary, RefusalFilter, RefusalRecord, PermissionDenial, Coverage, BeginImpersonationInput, ImpersonationFilter, ImpersonationSession, ImpersonationSessionId, ScopeTablePage, StorageShape, Tenant, TenantId, TenantRole, TenantStoreHandle, AttachmentRecord, BlobStoreHandle, Visibility, Vertical, VerticalChannel, VerticalVersion, TenantStatus, Page, CountedPage, FreshnessSpec, EntityHistoryInput, EventFacetInput, EventCauseInput, EventEffectsInput, EffectsTree, InvocationEventsInput, InvocationEvents, DeadLettersInput, DeadLetter, LifecycleFlowInput, LifecycleFlowResult, OperationSeriesInput, OperationSeriesResult, CauseChain, EventFacetResult, HistoryEntry, ErrorCode, PlatformRequestFailureOrigin, IssueEntry, IssueStatus, IssueStatusInput, FindingEntry, FindingFilter, FindingRuleEntry, FindingRuleInput, FindingStatusInput, DeclaredMigration, CheckSubject, EntityGrantShape } from '@substrat-run/contracts';
+import type { OnBehalfOf, ExportReadInput, ExportedBatch, ImportBatch, ImportedEvent, ImportResult, ImportState, ImportCursorMove, ImportCursorMoved, AdminAction, BecomeCapabilityInput, CapabilityExchange, CapabilityFilter, CapabilityId, CapabilityPage, MintedCapability, ListPage, ConnectLink, ConnectLinkConsume, ConnectLinkFilter, ConnectLinkKey, ConsumeConnectLinkInput, MintConnectLinkInput, Connection, ConnectionFilter, ConnectionId, ConnectionGrant, ConnectionGrantRecord, ConnectionSecret, CreateConnectionInput, OpenConnection, ProjectedConnectionGrant, ProjectedConnectionKey, AccessLogEntry, DelegatedReadRecord, OwnerTransferAudit, MemberChangeAudit, PeerBindingAudit, ConnectionBindingAudit, CopyMarkAudit, BindHostnameInput, AdminLogEntry, OpsFailureEntry, PlatformRequestDrainTotalsEntry, SweepRunEntry, SweepRunKind, SweepRunOutcome, ModelUsageEntry, ModelUsageSummary, CapabilityGrant, CreateTenantInput, Decision, Instant, DomainEvent, DomainEventInput, PlatformRequestInput, PlatformRequestId, PlatformRequestEntry, PlatformRequestFilter, PlatformRequestStatus, PlatformRequestFailure, PlatformOutcomeEvent, EntitlementGrant, EntitlementGrantInput, EntitlementView, MeterReading, ScopeStorageSample, EntityRef, IdentityLink, IdentityPool, Jurisdiction, ModuleId, ModuleManifest, ScheduleSpec, SystemGrant, PeerGrantsStatusEntry, SystemGrantsStatusEntry, SystemSwitchRecord, SystemSwitch, SystemSwitchResult, PeerCoverage, PeerSwitch, PeerSwitchResult, VerticalCaller, VerticalResolution, PeerBinding, PeerInstanceResolution, CreateOrgInput, Node, Org, OrgId, OrgMembership, PermissionKey, PlatformActorId, ChannelName, ExportBreak, ChannelHistoryEntry, DnsRecord, HostnameBinding, HostnameStatus, PromotionAcknowledgement, BindAcknowledgement, PublishVersionInput, RegisterVerticalInput, VerticalServingState, RouteTarget, DirectoryDump, IdentityMembership, PrincipalId, ResolvedIdentity, RoleAssignment, RoleDefinition, QueryScopeInput, ReadScopeTableInput, Scope, ScopeDump, ScopeDumpInput, SubjectShredReceipt, ScopeQueryResult, ScopeId, ScopeStatus, ScopeTable, DenialFilter, DenialSummary, RefusalFilter, RefusalRecord, PermissionDenial, Coverage, BeginImpersonationInput, ImpersonationFilter, ImpersonationSession, ImpersonationSessionId, ScopeTablePage, StorageShape, Tenant, TenantId, TenantRole, TenantStoreHandle, AttachmentRecord, UploadLinkView, BlobStoreHandle, Visibility, Vertical, VerticalChannel, VerticalVersion, TenantStatus, Page, CountedPage, FreshnessSpec, EntityHistoryInput, EventFacetInput, EventCauseInput, EventEffectsInput, EffectsTree, InvocationEventsInput, InvocationEvents, DeadLettersInput, DeadLetter, LifecycleFlowInput, LifecycleFlowResult, OperationSeriesInput, OperationSeriesResult, CauseChain, EventFacetResult, HistoryEntry, ErrorCode, PlatformRequestFailureOrigin, IssueEntry, IssueStatus, IssueStatusInput, FindingEntry, FindingFilter, FindingRuleEntry, FindingRuleInput, FindingStatusInput, DeclaredMigration, CheckSubject, EntityGrantShape } from '@substrat-run/contracts';
 import type { ConnectionUseOutcome } from './connector-calls.js';
 import type { CapabilityVerbs } from './capability.js';
+import type { AttachmentVerbs } from './upload-link.js';
 import type { AuditedOperationRef, AuditedOperationRow } from './audit-outcome.js';
 import { type EntityStateName } from '@substrat-run/contracts';
 import type { ModelUsageFilter, ModelUsageInput, ModelUsageWindow } from './model-usage.js';
@@ -80,7 +84,9 @@ export type SqlValue = string | number | bigint | Uint8Array | null;
  * - **5** terms in one compound `SELECT` (`UNION`/`UNION ALL`/`INTERSECT`/`EXCEPT`; a
  *   subquery or CTE body counts its own; multi-row `VALUES` is not a compound);
  * - **100** bound parameters in one statement (the highest number, `?N` included) — bind a
- *   list of unknown length as ONE JSON array and read it with `json_each`;
+ *   list of unknown length as ONE JSON array and read it with `json_each`, which is what
+ *   `inList(values)` from `@substrat-run/contracts` writes for you (#2248):
+ *   `` ctx.sql.query(`SELECT … WHERE id IN ${ids.sql}`, ids.params) ``;
  * - **100 000 bytes** of statement, UTF-8, the whole string;
  * - **50 bytes** of `LIKE`/`GLOB` pattern, UTF-8 — NOT enforced by an adapter: node's SQLite
  *   allows 50 000, and it can only be emulated by a test preload
@@ -574,6 +580,14 @@ export interface OperationContext {
      * like `ctx.grant`.
      */
     readonly capabilities: CapabilityVerbs;
+    /**
+     * Attachment verbs an operation may use — today, minting a single-use URL through which a
+     * caller with no session uploads ONE file to an entity (`mintUploadUrl`). The bytes
+     * themselves never ride an operation: they go to the redemption route, which writes them
+     * through `ScopeHost.attachments`' own upload as the principal who minted the link.
+     * See {@link AttachmentVerbs}.
+     */
+    readonly attachments: AttachmentVerbs;
     /**
      * Run `fn` as a SUB-TRANSACTION of this operation (#770,
      * docs/architecture/sub-transactions.md) — the boundary that makes catching an
@@ -2055,6 +2069,9 @@ export interface HostAdmin {
      * permission diffs are the admission gates, and binding a scope is a separate step
      * (`bindScopeVersion`), so the two human checkpoints fire where the blast radius is
      * rather than where the typing was.
+     *
+     * Refuses (`conflict`) a version that declares a scope-store binding the vertical already
+     * declared as another kind (#2286): see `verticalScopeStores`.
      */
     publishVersion(actor: PlatformActorId, input: PublishVersionInput): Promise<void>;
     /** Ordered by id (ULID = publish order), `asc` unless `page.order` says otherwise. */
@@ -2266,6 +2283,16 @@ export interface HostAdmin {
      * version can be bound per-version but never served in place.
      */
     versionManifest(actor: PlatformActorId, verticalSlug: string, versionId: string): Promise<string | null>;
+    /**
+     * Every scope-store binding any version of the vertical has declared, with its kind (#2286,
+     * RFC scope-stores L17): what export, wipe, erasure and the meter reach, so an object under a
+     * binding a later version dropped is still reached. Read by its keys, with no per-version work
+     * once the vertical is indexed. A binding keeps its kind for the life of the vertical:
+     * `publishVersion` refuses a version that re-kinds one, or declares one twice (`conflict`).
+     * Refuses (`unavailable`) when a version's manifest cannot be read, since that version may
+     * declare a store nobody can name. Empty for an unknown vertical.
+     */
+    verticalScopeStores(actor: PlatformActorId, verticalSlug: string): Promise<VerticalScopeStore[]>;
     /**
      * One version's SQL migrations (#1764), in the order the host runs them. They are stored
      * apart from the manifest, which `versionManifest` returns without them. Null for a version
@@ -2401,6 +2428,15 @@ export interface HostAdmin {
      * `/internal/database-size` instead, and this is the co-located fallback. Access-logged.
      */
     scopeDatabaseSize(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId): Promise<number>;
+    /**
+     * The size of each scope store bound for this scope (#2207). Access-logged like
+     * `scopeDatabaseSize`. An undeclared scope has none, so the list is empty. This is
+     * the co-located reading. A hosted control plane asks the store script directly.
+     */
+    scopeStoreSizes(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId): Promise<{
+        binding: string;
+        bytes: number;
+    }[]>;
     /**
      * #286's backout: PITR-rewind a scope to a pre-migration bookmark — schema AND
      * data, discarding every write since. Audited (destructive by design). The scope
@@ -2449,8 +2485,15 @@ export interface HostAdmin {
      * the append-only admin log (K-21 protects tuples, not the route table).
      * Idempotent: unbinding an unknown hostname is a silent no-op, not an error —
      * so a cleanup pass can re-run over a partial failure.
+     *
+     * `owner` (#2285): remove the binding only while it still names this tenant and scope,
+     * decided by the delete itself. A name rebound to another scope since the caller listed it
+     * is left bound to that scope, and the call is a silent no-op, as for an unknown name.
      */
-    unbindHostname(actor: PlatformActorId, hostname: string): Promise<void>;
+    unbindHostname(actor: PlatformActorId, hostname: string, owner?: {
+        tenantId: TenantId;
+        scopeId: ScopeId;
+    }): Promise<void>;
     /**
      * Ordered by hostname; the cursor is a hostname.
      *
@@ -2575,6 +2618,73 @@ export interface HostAdmin {
         tenantId?: TenantId;
         vertical?: string;
     }): Promise<BlobStoreRecord[]>;
+    /**
+     * Record that a store kind's release bytes are stored, keyed by their sha256 (D-63, #2300).
+     * Insert-only: the same sha256 again answers the row as it stands, and from another source
+     * commit is refused (`conflict`). Audited `uploadStoreKindRelease` when it writes.
+     */
+    recordStoreKindRelease(actor: PlatformActorId, input: {
+        kind: string;
+        sha256: string;
+        sourceCommit: string;
+    }): Promise<StoreKindReleaseRecord>;
+    /** One stored release, or undefined. */
+    getStoreKindRelease(actor: PlatformActorId, kind: string, sha256: string): Promise<StoreKindReleaseRecord | undefined>;
+    /**
+     * A kind's current good release, every rollout of it, oldest first, and where a rollback goes.
+     * A `rolling` row whose holder holds the kind no longer reads as `diverged`.
+     */
+    storeKindState(actor: PlatformActorId, kind: string): Promise<StoreKindState>;
+    /**
+     * Every vertical any version of which declared a store of `kind`, with those bindings: the
+     * scripts a rollout reaches, and in `unreadable` every vertical that cannot say (a manifest that
+     * does not parse, or versions from before the record that re-kinded a binding): the caller that
+     * must reach every script refuses while it is not empty.
+     */
+    storeKindDeclarations(actor: PlatformActorId, kind: string): Promise<{
+        verticals: {
+            vertical: string;
+            stores: VerticalScopeStore[];
+        }[];
+        unreadable: string[];
+    }>;
+    /**
+     * Take or renew a lease on a kind (#2300): `exclusive` for a rollout or rollback, `shared` for
+     * a push or serve rebuilding a script. False when a live hold of another holder excludes it.
+     * `renew` extends only a hold the holder still holds (a lapsed one answers false, never a fresh
+     * hold), and `rolloutSeq` also needs that rollout to be `rolling` still.
+     */
+    holdStoreKind(actor: PlatformActorId, input: {
+        kind: string;
+        holder: string;
+        mode: StoreKindHoldMode;
+        ttlMs: number;
+        renew?: boolean;
+        rolloutSeq?: number;
+    }): Promise<boolean>;
+    releaseStoreKindHold(actor: PlatformActorId, input: {
+        kind: string;
+        holder: string;
+    }): Promise<void>;
+    /**
+     * Begin a rollout (or a rollback) of a stored release, as the kind's exclusive holder; refused
+     * (`conflict`) otherwise. A rollback must name `storeKindState`'s `rollbackTarget`. Audited
+     * under `rollOutStoreKind` / `rollBackStoreKind`.
+     */
+    beginStoreKindRollout(actor: PlatformActorId, input: {
+        kind: string;
+        sha256: string;
+        action: StoreKindRolloutAction;
+        holder: string;
+    }): Promise<StoreKindRolloutRecord>;
+    /** End a rollout as its exclusive holder; a `good` end makes its release current. Audited as its begin. */
+    finishStoreKindRollout(actor: PlatformActorId, input: {
+        kind: string;
+        seq: number;
+        holder: string;
+        state: Exclude<StoreKindRolloutState, 'rolling'>;
+        detail: string | null;
+    }): Promise<StoreKindRolloutRecord>;
     /**
      * One scope's directory record. Cross-checks the (tenantId, scopeId) pair and
      * returns undefined on a mismatch rather than another tenant's scope (K-3) —
@@ -3003,19 +3113,41 @@ export interface HostAdmin {
      * vertical's own table, copies already handed to a customer, and the PITR window (see
      * kernel-design.md's answer to open question 17). A mechanism whose limits are
      * undocumented gets oversold by someone who was not in the room.
+     *
+     * A scope store is reached, by `substrat.erase`, after the scope-side redaction and
+     * before the key is destroyed. A store that answers with an error throws, and the key
+     * stays, so a retry converges. The receipt's `storeErasures` names each binding.
+     *
+     * `fence` (#2285): the scope state the caller read before it erased the platform's stores. Given,
+     * the shred takes the same claim `finalizeSubjectShred` takes, just before the key goes, and
+     * refuses (`precondition_failed`) with the key kept when the scope moved. Omitted, nothing is
+     * claimed: the caller reached no store outside this host.
+     */
+    shredSubject(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId, subjectId: string, fence?: SubjectErasureFence): Promise<SubjectShredReceipt>;
+    /**
+     * Subjects whose key row is tombstoned (`shredded_at` set), in subject-id order.
+     * A page is at most 100. `cursor` is the last id the caller already has.
      */
-    shredSubject(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId, subjectId: string): Promise<SubjectShredReceipt>;
+    listShreddedSubjects(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId, cursor?: string): Promise<{
+        subjects: string[];
+        nextCursor: string | null;
+    }>;
     /** Monotone directory fence against a carry from before subject erasure. */
     scopeErasureEpoch(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId): Promise<number>;
     /** Finish an orchestrated erasure only after every script holding a copy has redacted it.
      * The copy count fences a move that was recorded after the coordinator listed scripts;
      * ledger rows are append-only, so a changed count means that inventory is stale. */
-    finalizeSubjectShred(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId, subjectId: string, redactions: readonly SubjectRedactionCounts[], expected: {
-        versionId: string | null;
-        servingRef: string | null;
-        epoch: number;
-        copyCount: number;
-    }): Promise<SubjectShredReceipt>;
+    finalizeSubjectShred(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId, subjectId: string, redactions: readonly SubjectRedactionCounts[], expected: SubjectErasureFence, 
+    /**
+     * What the serving script's stores erased (#2068). The coordinator calls
+     * `substrat.erase` once — store objects are per vertical, not per script copy —
+     * and passes the result. Omitted means this host erases its own stores, which
+     * is the pure adapter's co-located shred.
+     */
+    storeErasures?: readonly {
+        binding: string;
+        erased: number;
+    }[]): Promise<SubjectShredReceipt>;
     /**
      * Open a session that acts as `input.principal`, and record it.
      *
@@ -3540,6 +3672,7 @@ export interface HostAdmin {
      */
     recordMemberChange(actor: PlatformActorId, entry: MemberChangeAudit): Promise<void>;
     /** One intent or outcome of a tenant's peer-instance binding change (#1720). */
+    recordConnectionBindingChange(actor: PlatformActorId, entry: ConnectionBindingAudit): Promise<void>;
     recordPeerBindingChange(actor: PlatformActorId, entry: PeerBindingAudit): Promise<void>;
     /**
      * Close one audited change whose intent has no outcome (#2064): in ONE transaction, read the
@@ -3829,6 +3962,16 @@ export interface AttachmentUploadInput {
     visibility: Visibility;
     body: Uint8Array;
 }
+/**
+ * Input to `ScopeHost.redeemUploadLink`. No `visibility`: the link carries it, as it carries
+ * the author. `entity` is what the URL named, and must be the link's own.
+ */
+export interface UploadLinkRedeemInput {
+    entity: EntityRef;
+    filename: string;
+    contentType: string;
+    body: Uint8Array;
+}
 /** An opened attachment: the metadata fact plus the bytes it witnesses. */
 export interface OpenedAttachment {
     record: AttachmentRecord;
@@ -4286,6 +4429,20 @@ export interface ScopeHost {
      * transaction is rolled back rather than committed.
      */
     getImpersonatedScope(session: ImpersonationSessionId, tenantId: TenantId, scopeId: ScopeId, options?: ScopeStubOptions): Promise<ScopeStub>;
+    /**
+     * Mint a stub for one scope store (#2207). A door of its own, beside `getScope`:
+     * `ScopeStubOptions` carries no authority, and a store is not a flag on that bag.
+     *
+     * The host checks the (tenant, scope) pair the way `getScope` does, then builds
+     * the object name itself. `binding` is the declaration. The vertical does not
+     * choose the tenant, the scope, or the vertical slug that go into the name.
+     *
+     * `options` carries no authority (#2245). Each invoke is recorded on the
+     * request now running — binding, operation, outcome, duration, never the input —
+     * with nothing passed by the vertical (RFC §6). `onStoreCall`, when passed, is
+     * heard instead. A call made where no request is current is not logged.
+     */
+    getScopeStore(principal: PrincipalId, tenantId: TenantId, scopeId: ScopeId, binding: string, options?: ScopeStoreStubOptions): Promise<StoreStub>;
     /**
      * The entry scope-lifecycle transition (control-plane.md §4.2): idempotent,
      * journaled, audited. Requires an existing ACTIVE tenant — a scope with no
@@ -4344,6 +4501,27 @@ export interface ScopeHost {
      * extraction job has no reason to mutate attachment metadata or bytes.
      */
     getSystemAttachments(moduleId: ModuleId, tenantId: TenantId, scopeId: ScopeId): Promise<Pick<ScopeAttachments, 'open'>>;
+    /**
+     * Look an upload link up WITHOUT spending it, so the route can refuse an oversize body or a
+     * wrong type before it reads a byte. `not_found` for a secret that names nothing (and for
+     * one that cannot be ours); `conflict` with reason `upload_link_gone` for one that is used,
+     * expired or revoked. The mint is `ctx.attachments.mintUploadUrl`.
+     *
+     * Optional, like `getCapabilityAttachments`: a host that has not wired the link table says so
+     * by leaving it out, and `mountUploadLinkRedeem` refuses to mount over one.
+     */
+    inspectUploadLink?(tenantId: TenantId, scopeId: ScopeId, secret: string): Promise<UploadLinkView>;
+    /**
+     * Redeem an upload link: write the bytes as ONE attachment, AS the principal who minted the
+     * link — the target's `writePermission` is checked as them now, they are the author, and
+     * `attachment.added` is emitted exactly as for any upload. The link is spent in the same
+     * transaction as the attachment row, so a redemption that fails anywhere leaves it unspent;
+     * the size and the type are the LINK's to refuse (`validation_failed`, reasons
+     * `upload_link_too_large` / `upload_link_type_refused`) and a link used by another request
+     * first is `conflict` / `upload_link_gone`. The bytes are written to the blob store before
+     * the row, as an upload's are, and removed again if the row is refused.
+     */
+    redeemUploadLink?(tenantId: TenantId, scopeId: ScopeId, secret: string, input: UploadLinkRedeemInput): Promise<AttachmentRecord>;
     /**
      * Provision a NEW scope and load a `ScopeDump` into it — the write side of
      * `exportScope` and the fork primitive (docs/architecture/preview-and-snapshots.md §3):
@@ -4359,7 +4537,7 @@ export interface ScopeHost {
      * fail-closed tenant gate (the dump's own `tenantId`/`scopeId` are provenance, never
      * the authority — `input` says where the copy lands).
      */
-    importScope(actor: PlatformActorId, input: ProvisionScopeInput, dump: ScopeDump): Promise<void>;
+    importScope(actor: PlatformActorId, input: ProvisionScopeInput, dump: ScopeDumpInput): Promise<void>;
     /**
      * Load a `ScopeDump` into an EXISTING scope in place — the restore/backout half of
      * `exportScope` (preview-and-snapshots.md §8). Same drop-then-replay as a fork: the
@@ -4374,10 +4552,17 @@ export interface ScopeHost {
      * `opts.sourceScopeId` (#1869) is a separate hint for the grant re-point ONLY: the scope the
      * uploaded file says it came from, when the dump's own `scopeId` was set to something else.
      * The dump's `tenantId`/`scopeId` are left exactly as they are for everything else.
+     *
+     * A host with scope stores then re-erases every tombstoned subject (#2207,
+     * `replayStoreErasures`): the target's marks, and the source's (`sourceScopeId`, else the
+     * dump's `scopeId`) when the source is a scope of this tenant on this host. An unknown
+     * source never refuses the restore; the result says `storeErasureSourceUnknown`. With nothing
+     * re-erased and nothing missing (no store here, or no tombstone that applies) it returns
+     * nothing, as a restore always did.
      */
-    restoreScope(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId, dump: ScopeDump, opts?: {
+    restoreScope(actor: PlatformActorId, tenantId: TenantId, scopeId: ScopeId, dump: ScopeDumpInput, opts?: {
         sourceScopeId?: ScopeId;
-    }): Promise<void>;
+    }): Promise<StoreErasureReplay | void>;
     /**
      * Snapshot a scope — fork its current data into a new scope and return that scope's
      * id. A thin composition of `exportScope` + `importScope` (preview-and-snapshots.md