@substrat-run/adapter-cloudflare 0.160.0 → 0.162.0

package/dist/control-plane-do.js

@@ -6,7 +6,7 @@ import { blankSqlComments, boundShapesColumn, executableSqlStatements, installsR
 import { COPY_BACKFILL_SCOPE_SQL, COPY_BACKFILL_SQL, COPY_BACKFILL_SUPERSEDE_SQL, COPY_CLAIM_SQL, COPY_EXPIRED_SQL, COPY_MOVE_RENEW_SQL, copyMoveRenewParams, PENDING_COPY_KEEP_ALIVE_SQL, pendingCopyKeepAliveParams, copyBackfillParams, copyBackfillRefusal, SUBJECT_ERASURE_CLAIM_SQL, subjectErasureClaimParams, COPY_MOVE_CONFIRM_SQL, COPY_MOVE_LIVE_PREDICATE, SCOPE_COPY_LEASE_MS, SERVES_NOW_CONDITION, SERVES_NOW_PREDICATE, servesNowParams, SCOPE_SCRIPT_COPY_COLUMNS, copyMoveConfirmParams, copyMoveLiveParams, } from '@substrat-run/kernel';
 import { opsFailureReferenceWhere } from '@substrat-run/kernel';
 import { doBuiltColumnsOf, doRedactionSql } from './sql.js';
-import { assertReplayableDump, instant, opsFailureFingerprint, ROUTE_SCOPE_HOSTNAMES_MAX, SCOPE_GATE_REASONS, substratError } from '@substrat-run/contracts';
+import { assertReplayableDump, AUTO_ADMISSION_NOTE, instant, opsFailureFingerprint, ROUTE_SCOPE_HOSTNAMES_MAX, SCOPE_GATE_REASONS, substratError } from '@substrat-run/contracts';
 /**
  * The router's per-request directory read (`readRoute`), lifted out so its plan can be asked for
  * (#2005): the scope's hostname set is a correlated subquery on the hot path every request takes,
@@ -807,6 +807,28 @@ export const REPLIED_METHODS = [
     // #2309: a fleet rebuild's lease write refuses with conflict or validation_failed.
     'claimStoreDriverRebuild',
     'advanceStoreDriverRebuild',
+    // #2528: the vertical writes that read their row's `before` and their guards in the unit that
+    // writes, refusing an unknown vertical or version with not_found and a failed guard with conflict.
+    'updateVerticalListed',
+    'updateVerticalPublishRequest',
+    'updateVerticalInstallsBlocked',
+    'updateVerticalTenantProvisioner',
+    'updateVerticalEmailSender',
+    'deleteVertical',
+    'admitVersion',
+    'rejectVersion',
+    'setVerticalServing',
+    // #2526: the role, grant and org writes at a tenant node, each with its admin row in its unit. A
+    // DO from before lists none of them, so the current coordinator fails closed against it. That is
+    // why the org write is `insertOrg` and not `createOrg` with a trailing row: an older DO lists
+    // `createOrg` and would drop the row and create the org.
+    'defineRoleOrRefusal',
+    'assignTenantRole',
+    'writeTenantTuple',
+    'writeOrgTenantTuple',
+    'writeTenantSystemGrant',
+    'grantConnectionInDirectory',
+    'insertOrg',
 ];
 export class ControlPlaneDO extends DurableObject {
     sql;
@@ -1340,8 +1362,10 @@ export class ControlPlaneDO extends DurableObject {
         const slugOwner = this.sql
             .exec('SELECT tenant_id FROM tenants WHERE slug = ?', slug)
             .toArray()[0];
+        // #2556: the refusal never names the owner. Another tenant holds it, and the text reaches
+        // whoever asked (a manager vertical's intent journal among them).
         if (slugOwner) {
-            throw substratError('conflict', `tenant slug '${slug}' already taken by ${slugOwner.tenant_id} (slugs are unique)`);
+            throw substratError('conflict', `tenant slug '${slug}' is already taken (slugs are unique)`);
         }
         this.writeAndAudit(() => this.sql.exec(`INSERT INTO tenants (tenant_id, slug, name, status, created_at, provisioned_by_tenant)
        VALUES (?, ?, ?, 'active', ?, ?)`, id, slug, name, createdAt, provisionedByTenant).rowsWritten > 0, audit && (() => ({ ...audit, after: this.readTenant(id) })));
@@ -1851,9 +1875,19 @@ export class ControlPlaneDO extends DurableObject {
      * system-held definition of a key with no system-held definition stored (none at all included): its tenant-level seats are read here, in the unit, and
      * `seatedInScopes` carries what the coordinator read off the tenant's scopes. A refusal is answered
      * as data, so its text survives the hop, and writes nothing. The current coordinator calls this one
-     * (the same split as `transitionScope` and `transitionScopeOrRefusal`).
+     * (the same split as `transitionScope` and `transitionScopeOrRefusal`), through `reply` (#2526),
+     * with `audit`: the row, its `before` the role read here, commits with the definition. A
+     * coordinator from before #2526 passes none and records its own.
      */
-    defineRoleOrRefusal(tenantId, role, reservation = { reserved: [], declared: [] }, seatedInScopes = false) {
+    defineRoleOrRefusal(tenantId, role, reservation = { reserved: [], declared: [] }, seatedInScopes = false, audit) {
+        return this.ctx.storage.transactionSync(() => {
+            const outcome = this.defineRoleIn(tenantId, role, reservation, seatedInScopes);
+            if (audit && 'before' in outcome)
+                this.recordAdmin({ ...audit, before: outcome.before });
+            return outcome;
+        });
+    }
+    defineRoleIn(tenantId, role, reservation, seatedInScopes) {
         const tenantRoles = this.listRoles({ tenantId }).map((r) => ({
             key: r.role_key,
             permissions: JSON.parse(r.permissions),
@@ -1917,21 +1951,67 @@ export class ControlPlaneDO extends DurableObject {
         };
     }
     // -- tenant-level tuples (checker rules 1, 2, 4) ----------------------------
-    writeTenantTuple(tenantId, subject, relation, object, expiresAt) {
-        this.sql.exec(`INSERT OR REPLACE INTO _substrat_tenant_tuples
-         (tenant_id, subject, relation, object, expires_at)
-       VALUES (?, ?, ?, ?, ?)`, tenantId, subject, relation, object, expiresAt);
+    /**
+     * A tenant tuple, upserted. With `audit` (#2526, `grant` at the tenant node, called through
+     * `reply`), its admin row commits in the same transaction; without, as a coordinator from before
+     * #2526 calls it, and as this object's own units do, it is the bare write.
+     */
+    writeTenantTuple(tenantId, subject, relation, object, expiresAt, audit) {
+        const write = () => {
+            this.sql.exec(`INSERT OR REPLACE INTO _substrat_tenant_tuples
+           (tenant_id, subject, relation, object, expires_at)
+         VALUES (?, ?, ?, ?, ?)`, tenantId, subject, relation, object, expiresAt);
+            return true;
+        };
+        if (audit)
+            this.writeAndAudit(write, audit);
+        else
+            write();
+    }
+    /**
+     * #2526: `assignRole` at the tenant node — the role's reservation judged (`reserved`, what the
+     * coordinator's modules reserve to a system principal: a role mixing them with other keys is
+     * refused, #2430), the tuple and its admin row, in one unit. A refusal is answered as data and
+     * writes nothing. A role not defined here is not judged, as before.
+     */
+    assignTenantRole(tenantId, principal, roleKey, reserved, audit) {
+        return this.ctx.storage.transactionSync(() => {
+            const role = reserved.length > 0 ? this.getRole(tenantId, roleKey) : undefined;
+            const refused = role ? reservedRoleRefusal(role, new Set(reserved), 'platform') : null;
+            if (refused)
+                return { refused };
+            this.writeTenantTuple(tenantId, `principal:${principal}`, `role:${roleKey}`, `tenant:${tenantId}`, null);
+            this.recordAdmin(audit);
+            return {};
+        });
+    }
+    /**
+     * #2526: a tenant tuple that names an org — `grantToOrg` at the tenant node, and `addMember` —
+     * with its admin row, in one unit, refused `not_found` when the org is not in the tenant.
+     */
+    writeOrgTenantTuple(tenantId, orgId, subject, relation, object, expiresAt, audit) {
+        this.writeAndAudit(() => {
+            if (!this.readOrg(tenantId, orgId))
+                throw substratError('not_found', `unknown org ${orgId} in tenant ${tenantId}`);
+            this.writeTenantTuple(tenantId, subject, relation, object, expiresAt);
+            return true;
+        }, audit);
     }
     /**
      * #1743: a tenant-level `system:<module>` grant, refused while the record holds the module
      * off on any scope (`scopesSwitchedOffFor`). Synchronous, so the read and the write are one
-     * DO unit. Answers the switched-off scopes; non-empty means nothing was written.
+     * DO unit. Answers the switched-off scopes; non-empty means nothing was written. With `audit`
+     * (#2526, through `reply`), the row commits with the tuple, and a refusal records none.
      */
-    writeTenantSystemGrant(tenantId, moduleId, relation, expiresAt) {
-        const off = scopesSwitchedOffFor(this.kernelSql, tenantId, moduleId);
-        if (off.length === 0) {
+    writeTenantSystemGrant(tenantId, moduleId, relation, expiresAt, audit) {
+        let off = [];
+        this.writeAndAudit(() => {
+            off = scopesSwitchedOffFor(this.kernelSql, tenantId, moduleId);
+            if (off.length > 0)
+                return false;
             this.writeTenantTuple(tenantId, `system:${moduleId}`, relation, `tenant:${tenantId}`, expiresAt);
-        }
+            return true;
+        }, audit);
         return off;
     }
     // -- the hostname map (K-26) ------------------------------------------------
@@ -2218,30 +2298,55 @@ export class ControlPlaneDO extends DurableObject {
             this.sql.exec('UPDATE verticals SET listed = ? WHERE slug = ?', listed, slug);
         }
     }
-    /** Publish/unpublish a vertical to the public marketplace + resolve any pending request. */
+    /**
+     * Publish/unpublish a vertical to the public marketplace + resolve any pending request. Listing
+     * refuses a prod version that is auto-admitted (only its author has read it), judged on the
+     * channel as this unit reads it (#2528).
+     */
     updateVerticalListed(slug, listed, audit) {
-        this.writeAndAudit(() => this.sql.exec('UPDATE verticals SET listed = ?, publish_requested_at = NULL WHERE slug = ?', listed, slug)
-            .rowsWritten > 0, audit);
+        this.updateVertical(slug, 'listed = ?, publish_requested_at = NULL', [listed], (r) => {
+            if (listed) {
+                const prod = this.sql
+                    .exec(`SELECT v.id, v.admission_note FROM vertical_channels c JOIN vertical_versions v ON v.id = c.version_id
+              WHERE c.vertical_slug = ? AND c.channel = 'prod'`, slug)
+                    .toArray()[0];
+                if (prod?.admission_note === AUTO_ADMISSION_NOTE) {
+                    throw substratError('conflict', `vertical '${slug}' prod version ${prod.id} is auto-admitted (private self-serve) — ` +
+                        `a staff admit must vouch for it before listing`);
+                }
+            }
+            return { listed: !!r.listed };
+        }, audit);
     }
     /** Record a builder's pending publish request (marketplace-publish.md §5). */
     updateVerticalPublishRequest(slug, requestedAt, audit) {
-        this.writeAndAudit(() => this.sql.exec('UPDATE verticals SET publish_requested_at = ? WHERE slug = ?', requestedAt, slug)
-            .rowsWritten > 0, audit);
+        this.updateVertical(slug, 'publish_requested_at = ?', [requestedAt], () => null, audit);
     }
     /** Block/unblock new installs of a vertical (staff kill-switch). */
     updateVerticalInstallsBlocked(slug, blocked, audit) {
-        this.writeAndAudit(() => this.sql.exec('UPDATE verticals SET installs_blocked = ? WHERE slug = ?', blocked, slug)
-            .rowsWritten > 0, audit);
+        this.updateVertical(slug, 'installs_blocked = ?', [blocked], (r) => ({ installsBlocked: !!r.installs_blocked }), audit);
     }
     /** Grant/revoke the tenant-provisioner capability (#412, staff grant). */
     updateVerticalTenantProvisioner(slug, granted, audit) {
-        this.writeAndAudit(() => this.sql.exec('UPDATE verticals SET tenant_provisioner = ? WHERE slug = ?', granted, slug)
-            .rowsWritten > 0, audit);
+        this.updateVertical(slug, 'tenant_provisioner = ?', [granted], (r) => ({ tenantProvisioner: !!r.tenant_provisioner }), audit);
     }
     /** Grant/revoke the email-sender capability (#303, staff grant). */
     updateVerticalEmailSender(slug, granted, audit) {
-        this.writeAndAudit(() => this.sql.exec('UPDATE verticals SET email_sender = ? WHERE slug = ?', granted, slug)
-            .rowsWritten > 0, audit);
+        this.updateVertical(slug, 'email_sender = ?', [granted], (r) => ({ emailSender: !!r.email_sender }), audit);
+    }
+    /**
+     * #2528: one vertical row update whose row reads its `before` (and runs its guard, by throwing)
+     * from the vertical as this unit reads it, so neither can be stale against the write.
+     */
+    updateVertical(slug, set, args, judge, audit) {
+        let before = null;
+        this.writeAndAudit(() => {
+            const r = this.readVertical(slug);
+            if (!r)
+                throw substratError('not_found', `unknown vertical '${slug}'`);
+            before = judge(r);
+            return this.sql.exec(`UPDATE verticals SET ${set} WHERE slug = ?`, ...args, slug).rowsWritten > 0;
+        }, audit && (() => ({ ...audit, before })));
     }
     /**
      * How many scopes a vertical still backs, split by liveness — deleteVertical's refusal
@@ -2260,8 +2365,10 @@ export class ControlPlaneDO extends DurableObject {
         return { live: r?.live ?? 0, archived: r?.archived ?? 0 };
     }
     /**
-     * Remove a vertical's registry presence: channels, versions, the row. The bound-scope
-     * refusal lives host-side (the audited seam), not here — this is the storage verb.
+     * Remove a vertical's registry presence: channels, versions, the row. Refused while any
+     * restorable scope is bound (`countScopesForVertical`): a deleted registry row would strand
+     * those scopes' version pins and routing. That refusal and `audit`'s `before` are read in the
+     * unit that deletes (#2528).
      */
     deleteVertical(slug, audit, until) {
         // #2501: one transaction, so the row and its ownership period close together. `until` is the
@@ -2269,7 +2376,21 @@ export class ControlPlaneDO extends DurableObject {
         // optional and trailing so a caller from before it, sending (slug, audit), still closes the
         // period, on this DO's own reading of that clock; anything but an instant is refused.
         const closedAt = until === undefined ? verticalOwnerNow() : instant.parse(until);
+        let before = null;
         this.writeAndAudit(() => {
+            const existing = this.readVertical(slug);
+            if (!existing)
+                throw substratError('not_found', `unknown vertical '${slug}'`);
+            // An `archived` scope (a deleted app) still blocks — unarchive can bring it back — but the
+            // refusal names reap/restore, because the app itself is already gone.
+            const bound = this.countScopesForVertical(slug);
+            if (bound.live > 0) {
+                throw substratError('conflict', `vertical '${slug}' still backs ${bound.live} scope(s) — delete or rebind them first`);
+            }
+            if (bound.archived > 0) {
+                throw substratError('conflict', `vertical '${slug}' still backs ${bound.archived} archived scope(s) — reap or restore them first`);
+            }
+            before = { slug, source: existing.source, ownerTenant: existing.owner_tenant };
             this.sql.exec('DELETE FROM vertical_channels WHERE vertical_slug = ?', slug);
             this.sql.exec('DELETE FROM vertical_channel_history WHERE vertical_slug = ?', slug);
             this.sql.exec(`DELETE FROM vertical_version_migrations
@@ -2281,7 +2402,7 @@ export class ControlPlaneDO extends DurableObject {
             if (changed)
                 closeVerticalOwnerRow(doRedactionSql(this.sql), slug, closedAt);
             return changed;
-        }, audit);
+        }, audit && (() => ({ ...audit, before })));
     }
     /** #2501: every period of a slug's ownership, oldest first — kernel `vertical-owners.ts`. */
     listVerticalOwners(slug) {
@@ -2312,17 +2433,26 @@ export class ControlPlaneDO extends DurableObject {
      * that carries none to show.
      */
     insertVersion(v, audit) {
+        // #2528: whether it self-admits is judged on the vertical as this unit reads it — a PRIVATE
+        // vertical (tenant-owned, not listed) self-admits, noted so the publish seam can tell a staff
+        // vouch from this shortcut — whatever the caller judged from its own earlier read.
+        let admission = v.admission;
         this.writeAndAudit(() => {
+            const owning = this.readVertical(v.verticalSlug);
+            if (!owning)
+                throw substratError('not_found', `unknown vertical '${v.verticalSlug}'`);
+            const selfAdmits = owning.owner_tenant !== null && !owning.listed;
+            admission = selfAdmits ? 'admitted' : 'pending';
             this.sql.exec(`INSERT INTO vertical_versions
            (id, vertical_slug, version, manifest_digest, permission_digest,
             migration_digest, deployment_ref, admission, admission_note, manifest_json,
             origin_json, migration_count, migrations_split, migration_digest_derived, created_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, 1, ?)`, v.id, v.verticalSlug, v.version, v.manifestDigest, v.permissionDigest, v.migrationDigest, v.deploymentRef, v.admission, v.admissionNote, v.manifestJson, v.originJson, v.migrations?.length ?? null, v.createdAt);
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, 1, ?)`, v.id, v.verticalSlug, v.version, v.manifestDigest, v.permissionDigest, v.migrationDigest, v.deploymentRef, admission, selfAdmits ? AUTO_ADMISSION_NOTE : null, v.manifestJson, v.originJson, v.migrations?.length ?? null, v.createdAt);
             writeVersionMigrations(this.kernelSql, v.id, v.migrations);
             // #2286: the version's scope-store bindings, refusing one moved to another driver, in the insert's transaction.
             indexVersionScopeStores(this.kernelSql, v.verticalSlug, v.id, v.manifestJson);
             return true;
-        }, audit);
+        }, audit && (() => ({ ...audit, after: { ...audit.after, admission } })));
     }
     /** Every scope-store binding any version of the vertical declared (#2286); indexes versions not indexed yet. */
     verticalScopeStores(slug) {
@@ -2332,18 +2462,37 @@ export class ControlPlaneDO extends DurableObject {
     readVersionMigrations(id) {
         return versionMigrationsOf(this.kernelSql, id);
     }
-    /** Record what the serving script now runs — written only after a successful
-     *  in-place upload, so a failed serve leaves the trailing state visible. */
-    setVerticalServing(slug, s, audit) {
-        this.writeAndAudit(() => this.sql.exec(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
-              serving_do_classes = ?, serving_migration_tag = ? WHERE slug = ?`, s.ref, s.versionId, s.doClassesJson, s.migrationTag, slug).rowsWritten > 0, audit);
+    /**
+     * Record what the serving script now runs — written only after a successful in-place upload, so
+     * a failed serve leaves the trailing state visible. #2528: `expected` is the serving ref and
+     * version the caller's #2178 gate judged the move from (nulls: nothing served); the write lands
+     * only if the row still names both (`SERVES_NOW_CONDITION`), and `audit`'s `before` is the
+     * serving state this unit read. False when either moved. Optional and trailing, so a caller from
+     * before it still writes unconditionally.
+     */
+    setVerticalServing(slug, s, audit, expected) {
+        let before = null;
+        let raced = false;
+        this.writeAndAudit(() => {
+            const r = this.readVertical(slug);
+            if (!r)
+                throw substratError('not_found', `unknown vertical '${slug}'`);
+            before = r.serving_ref ? { ref: r.serving_ref, versionId: r.serving_version_id } : null;
+            const moved = this.sql.exec(`UPDATE verticals SET serving_ref = ?, serving_version_id = ?,
+                serving_do_classes = ?, serving_migration_tag = ?
+          WHERE ${expected === undefined ? 'slug = ?' : SERVES_NOW_CONDITION}`, s.ref, s.versionId, s.doClassesJson, s.migrationTag, ...(expected === undefined ? [slug] : [slug, expected.ref, expected.versionId])).rowsWritten > 0;
+            raced = !moved;
+            return moved;
+        }, audit && (() => ({ ...audit, before })));
+        return !raced;
     }
-    /** One upload's capability record (RFC wire-signing §7, Q8), replacing the script's earlier one. */
+    /**
+     * One upload's capability record (RFC wire-signing §7, Q8), replacing the script's earlier one. False,
+     * with nothing written and no admin row, for a vertical the registry does not hold: the host answers
+     * that `not_found` on its side of the RPC, so the code survives.
+     */
     recordWireAuth(row, audit) {
-        this.writeAndAudit(() => {
-            writeDeploymentWireAuth(this.kernelSql, row);
-            return true;
-        }, audit);
+        return this.writeAndAudit(() => writeDeploymentWireAuth(this.kernelSql, row), audit);
     }
     /**
      * One page of the stored capability records the filter's reach confines it to (one tenant's
@@ -2391,9 +2540,55 @@ export class ControlPlaneDO extends DurableObject {
             await deriveVersionMigrationDigest(this.kernelSql, r.id);
         return read();
     }
+    /** Kept for a coordinator from before #2528, which judged the admission itself. */
     setAdmission(id, admission, note, audit) {
         this.writeAndAudit(() => this.sql.exec('UPDATE vertical_versions SET admission = ?, admission_note = ? WHERE id = ?', admission, note, id).rowsWritten > 0, audit);
     }
+    /**
+     * Admit a version, judged on its admission as this unit reads it (#2528). Idempotent on an
+     * admitted one — except an AUTO-admitted version, which this upgrades to a manual vouch by
+     * clearing the note (what the publish seam requires). A rejected one is refused.
+     */
+    admitVersion(id, audit) {
+        let row = { before: null, after: null };
+        this.writeAndAudit(() => {
+            const v = this.versionAdmission(id);
+            if (v.admission === 'admitted') {
+                if (v.admission_note !== AUTO_ADMISSION_NOTE)
+                    return false;
+                row = { before: { admission: v.admission, note: v.admission_note }, after: { admission: 'admitted', note: null } };
+            }
+            else if (v.admission === 'rejected') {
+                throw substratError('conflict', `version ${id} was rejected — publish a new one`);
+            }
+            else {
+                row = { before: { admission: v.admission }, after: { admission: 'admitted' } };
+            }
+            return this.sql.exec("UPDATE vertical_versions SET admission = 'admitted', admission_note = NULL WHERE id = ?", id)
+                .rowsWritten > 0;
+        }, audit && (() => ({ ...audit, ...row })));
+    }
+    /** Reject a version, judged as `admitVersion` is: an admitted one is refused, a rejected one is a no-op. */
+    rejectVersion(id, note, audit) {
+        let before = null;
+        this.writeAndAudit(() => {
+            const v = this.versionAdmission(id);
+            if (v.admission === 'admitted')
+                throw substratError('conflict', `version ${id} is already admitted — it may be bound`);
+            if (v.admission === 'rejected')
+                return false;
+            before = { admission: v.admission };
+            return this.sql.exec("UPDATE vertical_versions SET admission = 'rejected', admission_note = ? WHERE id = ?", note, id)
+                .rowsWritten > 0;
+        }, audit && (() => ({ ...audit, before, after: { admission: 'rejected', note } })));
+    }
+    versionAdmission(id) {
+        const v = this.sql.exec('SELECT admission, admission_note FROM vertical_versions WHERE id = ?', id)
+            .toArray()[0];
+        if (!v)
+            throw substratError('not_found', `unknown version ${id}`);
+        return v;
+    }
     /**
      * False when a conditional bind lost its compare-and-set (the host throws, as above). #2347:
      * `servingRef` moves the route in the same write, and `expectedServing` holds it to what the
@@ -2677,6 +2872,15 @@ export class ControlPlaneDO extends DurableObject {
         this.sql.exec('INSERT INTO orgs (org_id, tenant_id, slug, name, created_at) VALUES (?, ?, ?, ?, ?)', orgId, tenantId, slug, name, createdAt);
         return true;
     }
+    /**
+     * #2526: `createOrg` with its admin row, in one unit; an org that already exists writes nothing,
+     * the row included. A new name rather than a trailing argument on `createOrg`, which an older
+     * ControlPlaneDO already lists in `REPLIED_METHODS`: there the argument would be dropped and the
+     * org created with no row, where an unknown method fails closed.
+     */
+    insertOrg(orgId, tenantId, slug, name, createdAt, audit) {
+        return this.writeAndAudit(() => this.createOrg(orgId, tenantId, slug, name, createdAt), audit);
+    }
     listOrgs(tenantId) {
         return this.sql
             .exec('SELECT * FROM orgs WHERE tenant_id = ? ORDER BY slug', tenantId)
@@ -3210,6 +3414,42 @@ export class ControlPlaneDO extends DurableObject {
           granted_by, granted_at, revoked_at)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`, row.connectionId, row.tenantId, row.vertical, row.permission, row.scopeId, row.expiresAt, row.grantedBy, row.grantedAt);
     }
+    /**
+     * #2526: `grantToConnection`'s directory half as one unit — the connection (live, in the grant's
+     * tenant) and, at a scope node, the scope (in that tenant, running the connection's vertical)
+     * judged as they stand now, the record (`recordConnectionGrant`), the tenant tuple at the tenant
+     * node, and the admin row, whose vertical and provider are the connection's as read here. A
+     * scope node's tuple is delivered by the coordinator after this commits; the record is what a
+     * reconcile re-seats it from when that delivery fails. Answers the connection's vertical.
+     */
+    grantConnectionInDirectory(row, audit) {
+        return this.ctx.storage.transactionSync(() => {
+            const conn = this.readConnection(row.connectionId);
+            if (!conn)
+                throw new Error(`connection not found: ${row.connectionId}`);
+            if (conn.revoked_at)
+                throw new Error(`connection ${row.connectionId} is revoked — grant nothing to it`);
+            if (conn.tenant_id !== row.tenantId) {
+                throw new Error(`connection ${row.connectionId} belongs to tenant ${conn.tenant_id} and cannot be granted anything in ${row.tenantId}`);
+            }
+            if (row.scopeId) {
+                const scope = this.getScopeRecord(row.tenantId, row.scopeId);
+                if (!scope)
+                    throw substratError('not_found', `unknown scope ${row.scopeId} in tenant ${row.tenantId}`);
+                if (scope.vertical !== conn.vertical) {
+                    throw new Error(`connection ${row.connectionId} is for vertical '${conn.vertical}' and scope ` +
+                        `${row.scopeId} runs '${scope.vertical ?? 'none'}'`);
+                }
+            }
+            this.recordConnectionGrant({ ...row, vertical: conn.vertical });
+            if (!row.scopeId) {
+                this.writeTenantTuple(row.tenantId, `connection:${row.connectionId}`, `granted:${row.permission}`, `tenant:${row.tenantId}`, row.expiresAt);
+            }
+            const after = (audit.after ?? {});
+            this.recordAdmin({ ...audit, vertical: conn.vertical, after: { ...after, provider: conn.provider } });
+            return { vertical: conn.vertical };
+        });
+    }
     // -- the kill switches' record (#1674, #2029) — `system-switch-record.ts` is the whole rule ---
     /** OFF's write, before the scope's switch moves (#1823). Answers the row as it was. */
     recordSwitchedOff(row) {