@substrat-run/control-plane-api 0.138.0 → 0.139.0

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAmFL,CAAC,EAYF,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAGV,UAAU,EACV,kBAAkB,EAElB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAKf,eAAe,EAUhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAoD,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAkBzI,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAuBrF,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAyBtD,OAAO,EAA+C,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE3G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAItB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IACV,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;;OAMG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,SAAS,CAAC;CAClB,CAAC;AAwYF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AA8G7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAuC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AA8IjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAm4OhG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EA2FL,CAAC,EAYF,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAGV,UAAU,EACV,kBAAkB,EAElB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAKf,eAAe,EAUhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAoD,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAkBzI,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAuBrF,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAyBtD,OAAO,EAA+C,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE3G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAItB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IACV,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;;OAMG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,SAAS,CAAC;CAClB,CAAC;AAwYF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AA+H7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAuC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AA0JjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAujPhG"}

package/dist/api.js

@@ -1,6 +1,6 @@
 import { resolveObservabilityWindow } from './observability-window.js';
 import { Hono } from 'hono';
-import { parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, ownerTransferInput, OWNER_TRANSFER_AUDIT_ERROR_MAX, ASSET_PART_PREFIX, assetHash, channelName, connectionActivity, connectionActivitySource, connectionCredential, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, operationSeriesCount, operationSeriesInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, platformScriptCollision, platformScriptRefusal, PLATFORM_SCRIPT_NAMES, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, errorCodeOf, capabilityFilterQuery, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, } from '@substrat-run/contracts';
+import { parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, ownerTransferInput, OWNER_TRANSFER_AUDIT_ERROR_MAX, memberInviteInput, memberRoleInput, ASSET_PART_PREFIX, assetHash, channelName, connectionActivity, connectionActivitySource, connectionCredential, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, findingKind, findingRuleInput, findingStatus, findingStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, operationSeriesCount, operationSeriesInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, platformScriptCollision, platformScriptRefusal, PLATFORM_SCRIPT_NAMES, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, errorCodeOf, capabilityFilterQuery, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, } from '@substrat-run/contracts';
 import { attributeFailure } from './failure-attribution.js';
 import { BIND_EXPORT_BREAK_REFUSAL, CARRIED_AWAY_KEY, bindExportBreakRefusal, carriedAwayDump, dumpMetaValue, metaValueIn, crossVerticalHealth, exportBreakRefusal, isBindExportBreakRefusal, isExportBreakRefusal, isPrimaryScope, migrationProgress, ulid, } from '@substrat-run/kernel';
 import { TENANT_HEADER, confinedTenant } from './auth.js';
@@ -478,6 +478,22 @@ const issueStatusUpdate = z.object({
     fingerprint: z.string().min(1),
     status: issueStatusInput,
 });
+// The findings read (#1748). No cursor, for the issues read's reason: the cardinality is the
+// number of distinct shapes a tenant has. `tenantId` is forced for a confined principal.
+const findingsQuery = z.object({
+    tenantId: tenantIdSchema.optional(),
+    status: findingStatus.optional(),
+    kind: findingKind.optional(),
+    limit: z.coerce.number().int().min(1).max(500).optional(),
+});
+const findingStatusUpdate = z.object({ status: findingStatusInput }).strict();
+const findingRulesQuery = z.object({
+    active: z
+        .enum(['true', 'false'])
+        .optional()
+        .transform((v) => v === 'true'),
+    limit: z.coerce.number().int().min(1).max(500).optional(),
+});
 /**
  * A TENANT-LEVEL role assignment under an addressed tenant (#1343) — which is
  * what a team membership is, and all this surface does.
@@ -592,6 +608,12 @@ const TENANT_ROUTES = [
     // grant (`tenantGrantableEntitlement`): the pin alone would let it grant itself any.
     { method: 'PUT', re: /\/tenants\/[^/]+\/entitlements\/[^/]+$/, pin: 'path' },
     { method: 'GET', re: /\/tenants\/[^/]+\/cross-vertical\/edges$/, pin: 'path' },
+    // Findings (#1748): the tenant's inbox, its verdicts and its suppress rules. The dashboard
+    // checks WHO inside the tenant may read or act (its findings permissions) before calling.
+    { method: 'PUT', re: /\/tenants\/[^/]+\/findings\/[^/]+\/status$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/finding-rules$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/finding-rules$/, pin: 'path' },
+    { method: 'DELETE', re: /\/tenants\/[^/]+\/finding-rules\/[^/]+$/, pin: 'path' },
     // Scopes: provision, read, and the lifecycle acts the Data and Deployments tabs offer.
     { method: 'POST', re: /\/tenants\/[^/]+\/scopes$/, pin: 'path' },
     { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+$/, pin: 'path' },
@@ -624,6 +646,11 @@ const TENANT_ROUTES = [
     { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/lifecycle-flow$/, pin: 'path' },
     { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/operation-series$/, pin: 'path' },
     { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/owner-claim$/, pin: 'path' },
+    // An installed vertical's members (#1150): the roster, an invite, a role move, a removal.
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/members$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/members$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/members\/[^/]+\/role$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/members\/[^/]+\/remove$/, pin: 'path' },
     { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/query$/, pin: 'path' },
     { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/reap$/, pin: 'path' },
     { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/rebind-vertical$/, pin: 'path' },
@@ -652,6 +679,7 @@ const TENANT_ROUTES = [
     { method: 'GET', re: /\/admin-log$/, pin: 'query' },
     { method: 'GET', re: /\/ops-failures$/, pin: 'query' },
     { method: 'GET', re: /\/sweep-runs$/, pin: 'query' },
+    { method: 'GET', re: /\/findings$/, pin: 'query' },
     { method: 'GET', re: /\/service-refs$/, pin: 'query' },
     { method: 'GET', re: /\/observability\/tenant-metrics$/, pin: 'query' },
     { method: 'GET', re: /\/observability\/tenant-metrics-series$/, pin: 'query' },
@@ -3158,6 +3186,19 @@ export function createControlPlaneApi(options) {
             throw e;
         }
     });
+    /**
+     * The address a link into an instance opens on: the scope's canonical `app` hostname,
+     * preferring one the platform has activated but not requiring it — a platform hostname is
+     * bound `pending` and activated a step later, and that step can fail while the app is fully
+     * reachable (#294). `failed` is the one state that never routes, so only it is skipped. The
+     * platform owns the hostname directory, so the origin is never taken from a body.
+     */
+    const instanceOrigin = async (admin, actor, scopeId) => {
+        const bound = (await admin.listHostnames(actor, { scopeId })).filter((h) => h.status !== 'failed');
+        const pick = (hs) => hs.find((h) => h.surface === 'app' && h.canonical) ?? hs.find((h) => h.surface === 'app') ?? hs[0];
+        const host = pick(bound.filter((h) => h.status === 'active')) ?? pick(bound);
+        return host ? `https://${host.hostname}` : null;
+    };
     app.post('/tenants/:tenantId/scopes/:scopeId/owner-claim', async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
@@ -3172,18 +3213,12 @@ export function createControlPlaneApi(options) {
         const vertical = await verticalForScope(c, scope);
         if (!vertical)
             return c.json({ error: await diagnoseUnboundScope(actor, scope) }, 501);
-        // The address the link opens on: the scope's canonical `app` hostname, preferring one
-        // the platform has activated but not requiring it — a platform hostname is bound
-        // `pending` and activated a step later, and that step can fail while the app is fully
-        // reachable (#294). `failed` is the one state that never routes, so only it is skipped.
-        const bound = (await c.var.admin.listHostnames(actor, { scopeId })).filter((h) => h.status !== 'failed');
-        const pick = (hs) => hs.find((h) => h.surface === 'app' && h.canonical) ?? hs.find((h) => h.surface === 'app') ?? hs[0];
-        const host = pick(bound.filter((h) => h.status === 'active')) ?? pick(bound);
-        if (!host) {
+        const origin = await instanceOrigin(c.var.admin, actor, scopeId);
+        if (!origin) {
             return c.json({ error: `scope ${scopeId} has no hostname bound — a claim link needs an address to open on` }, 409);
         }
         try {
-            return c.json(await vertical.mintOwnerClaim({ tenantId, scopeId, origin: `https://${host.hostname}`, actor }), 201);
+            return c.json(await vertical.mintOwnerClaim({ tenantId, scopeId, origin, actor }), 201);
         }
         catch (e) {
             if (e instanceof ControlPlaneError)
@@ -3191,6 +3226,111 @@ export function createControlPlaneApi(options) {
             throw e;
         }
     });
+    // An installed vertical's MEMBERS (#1150) — the dashboard's Members section. The roster and
+    // every change live in the VERTICAL (its scope's role tuples, its identity directory), so each
+    // route makes the same K-3 cross-check as the owner seat and then asks the deployment that
+    // holds the scope. One scope per call: no walk across scopes (#1581).
+    //
+    // **Who is acting is the credential's person, and only that.** Every change is bounded in the
+    // vertical by the K-21 set comparison at the vertical's scope, asked about a principal — and
+    // the one principal this plane can vouch for is the `onBehalfOf` the dashboard's tenant token
+    // carries (#977), which only the staff mint writes. A builder session, a staff token or a
+    // tenant token minted for nobody names no person, so the writes refuse it rather than
+    // borrowing an authority it does not have. Being a tenant (dashboard) admin confers nothing in
+    // the vertical's scope: what the person holds THERE is what bounds them.
+    //
+    // Every change is audited intent-first then outcome (`manageScopeMember`), like the hand-over.
+    const memberPerson = (p) => p.kind === 'tenant' && p.onBehalfOf ? p.onBehalfOf.principal : null;
+    /** The scope, its vertical and the acting person, or the answer that refuses the request. */
+    const memberTarget = async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
+        const principal = c.get('principal');
+        const actor = c.get('actor');
+        // K-3: another tenant's pair, or no such scope, reads the same — absent.
+        const scope = outsideTenant(principal, tenantId) ? null : await c.var.admin.getScopeRecord(actor, tenantId, scopeId);
+        if (!scope)
+            return { refusal: c.json({ error: `unknown scope for tenant: (${tenantId}, ${scopeId})` }, 404) };
+        const vertical = await verticalForScope(c, scope);
+        if (!vertical)
+            return { refusal: c.json({ error: await diagnoseUnboundScope(actor, scope) }, 501) };
+        return { tenantId, scopeId, actor, vertical, person: memberPerson(principal) };
+    };
+    /** Run one audited member change: intent, the vertical's call, then the outcome row. */
+    const auditedMemberChange = async (c, entry, run, applied) => {
+        const actor = c.get('actor');
+        const base = { ...entry, operationId: ulid() };
+        await c.var.admin.recordMemberChange(actor, { ...base, phase: 'intent' });
+        let result;
+        try {
+            result = await run();
+        }
+        catch (e) {
+            const status = e instanceof ControlPlaneError ? e.status : 500;
+            const error = (e instanceof Error ? e.message : String(e)).slice(0, OWNER_TRANSFER_AUDIT_ERROR_MAX);
+            await c.var.admin
+                .recordMemberChange(actor, { ...base, phase: status < 500 ? 'refused' : 'failed', error })
+                .catch(() => undefined);
+            if (e instanceof ControlPlaneError) {
+                return { ok: false, response: c.json({ error: e.message }, e.status) };
+            }
+            throw e;
+        }
+        await c.var.admin.recordMemberChange(actor, { ...base, phase: 'applied', ...applied(result) });
+        return { ok: true, result };
+    };
+    const NO_PERSON = 'a member change needs the signed-in person it is made for — this credential names nobody';
+    app.get('/tenants/:tenantId/scopes/:scopeId/members', async (c) => {
+        const target = await memberTarget(c);
+        if ('refusal' in target)
+            return target.refusal;
+        try {
+            return c.json(await target.vertical.listMembers(target.tenantId, target.scopeId));
+        }
+        catch (e) {
+            if (e instanceof ControlPlaneError)
+                return c.json({ error: e.message }, e.status);
+            throw e;
+        }
+    });
+    app.post('/tenants/:tenantId/scopes/:scopeId/members', async (c) => {
+        const target = await memberTarget(c);
+        if ('refusal' in target)
+            return target.refusal;
+        if (!target.person)
+            return c.json({ error: NO_PERSON }, 403);
+        const body = memberInviteInput.parse(await c.req.json());
+        const origin = await instanceOrigin(c.var.admin, target.actor, target.scopeId);
+        if (!origin) {
+            return c.json({ error: `scope ${target.scopeId} has no hostname bound — an invite link needs an address to open on` }, 409);
+        }
+        const { tenantId, scopeId, person } = target;
+        const done = await auditedMemberChange(c, { tenantId, scopeId, change: 'invite', caller: person, roleKey: body.roleKey }, () => target.vertical.inviteMember({ tenantId, scopeId, caller: person, origin, roleKey: body.roleKey, email: body.email ?? null }), (link) => ({ principal: link.principal }));
+        return done.ok ? c.json(done.result, 201) : done.response;
+    });
+    app.post('/tenants/:tenantId/scopes/:scopeId/members/:principal/role', async (c) => {
+        const target = await memberTarget(c);
+        if ('refusal' in target)
+            return target.refusal;
+        if (!target.person)
+            return c.json({ error: NO_PERSON }, 403);
+        const member = principalIdSchema.parse(c.req.param('principal'));
+        const body = memberRoleInput.parse(await c.req.json());
+        const { tenantId, scopeId, person } = target;
+        const done = await auditedMemberChange(c, { tenantId, scopeId, change: 'role', caller: person, principal: member, from: body.from, to: body.to }, () => target.vertical.changeMemberRole({ tenantId, scopeId, caller: person, principal: member, from: body.from, to: body.to }), () => ({}));
+        return done.ok ? c.json({ principal: member, from: body.from, to: body.to }) : done.response;
+    });
+    app.post('/tenants/:tenantId/scopes/:scopeId/members/:principal/remove', async (c) => {
+        const target = await memberTarget(c);
+        if ('refusal' in target)
+            return target.refusal;
+        if (!target.person)
+            return c.json({ error: NO_PERSON }, 403);
+        const member = principalIdSchema.parse(c.req.param('principal'));
+        const { tenantId, scopeId, person } = target;
+        const done = await auditedMemberChange(c, { tenantId, scopeId, change: 'remove', caller: person, principal: member }, () => target.vertical.removeMember({ tenantId, scopeId, caller: person, principal: member }), (removal) => ({ revoked: removal.revoked }));
+        return done.ok ? c.json(done.result) : done.response;
+    });
     // The owner HAND-OVER (#1665). The move runs in the VERTICAL, behind `/internal/owner-transfer`
     // (vertical-host says in what order and why). This route decides who may ask, and audits every
     // attempt: an `intent` row before the vertical is reached, so a row the log cannot take means
@@ -7674,6 +7814,57 @@ export function createControlPlaneApi(options) {
             return c.json({ error: 'unknown issue fingerprint' }, 404);
         return c.json(updated);
     });
+    // -- findings (#1748): the tenant inbox, with a lifecycle and suppress rules ----
+    // Staff read the fleet; a tenant credential's tenant is forced from the principal, the
+    // /ops-failures posture. Builders never reach any of these (absent from BUILDER_ROUTES): a
+    // finding is the tenant's, not the vertical author's.
+    app.get('/findings', async (c) => {
+        const filter = findingsQuery.parse({
+            tenantId: confinedTenant(c.get('principal')) ?? c.req.query('tenantId'),
+            status: c.req.query('status'),
+            kind: c.req.query('kind'),
+            limit: c.req.query('limit'),
+        });
+        return c.json({ entries: await c.var.admin.listFindings(c.get('actor'), filter) });
+    });
+    // A verdict: acknowledge, resolve or reopen. Keyed on the tenant in the path as well as the id,
+    // so another tenant's finding is a 404, never a write.
+    app.put('/tenants/:tenantId/findings/:id/status', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        if (outsideTenant(c.get('principal'), tenantId))
+            return c.json({ error: 'forbidden' }, 403);
+        const { status } = findingStatusUpdate.parse(await c.req.json());
+        const updated = await c.var.admin.setFindingStatus(c.get('actor'), tenantId, c.req.param('id'), status);
+        if (!updated)
+            return c.json({ error: 'unknown finding' }, 404);
+        return c.json(updated);
+    });
+    app.get('/tenants/:tenantId/finding-rules', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        if (outsideTenant(c.get('principal'), tenantId))
+            return c.json({ error: 'forbidden' }, 403);
+        const filter = findingRulesQuery.parse({ active: c.req.query('active'), limit: c.req.query('limit') });
+        const entries = await c.var.admin.listFindingRules(c.get('actor'), tenantId, filter);
+        return c.json({ entries });
+    });
+    // Suppress with a rule: a scope plus an expiry, audited. 201 with the rule and how many
+    // findings it suppressed at once.
+    app.post('/tenants/:tenantId/finding-rules', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        if (outsideTenant(c.get('principal'), tenantId))
+            return c.json({ error: 'forbidden' }, 403);
+        const input = findingRuleInput.parse(await c.req.json());
+        return c.json(await c.var.admin.createFindingRule(c.get('actor'), tenantId, input), 201);
+    });
+    app.delete('/tenants/:tenantId/finding-rules/:ruleId', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        if (outsideTenant(c.get('principal'), tenantId))
+            return c.json({ error: 'forbidden' }, 403);
+        const revoked = await c.var.admin.revokeFindingRule(c.get('actor'), tenantId, c.req.param('ruleId'));
+        if (!revoked)
+            return c.json({ error: 'unknown finding rule' }, 404);
+        return c.json(revoked);
+    });
     // -- model usage (#1054): meter 3, the one D-30 could not compute -------------
     // The ledger the `model-usage` intents drain into. Staff-only: the tenant-facing
     // read is the vertical's own usage screen over its metering engine; this is the