@substrat-run/control-plane-api 0.139.0 → 0.140.0

package/dist/api.d.ts

@@ -1,9 +1,10 @@
 import { Hono } from 'hono';
-import { z } from '@substrat-run/contracts';
+import { type ConnectionCertificate, z } from '@substrat-run/contracts';
 import type { Connection, ConnectionActivity, ConnectionActivitySource, ConnectionCredential, ConnectionProbe, PlatformActorId } from '@substrat-run/contracts';
 import type { CrossVerticalOptions, HostAdmin, ScopeHost } from '@substrat-run/kernel';
 import type { PlatformActorAuth, BuilderAuth, Principal, TenantServiceAuth } from './auth.js';
 import { type VerticalClient } from './vertical-client.js';
+import { type ConnectionCandidatePrepare } from './connection-relay.js';
 import type { DeployVerticalFn, FetchVerticalAssetFn, FetchVerticalModulesFn } from './deploy.js';
 import type { PatchScriptBindingsFn } from './wfp.js';
 import { type ObservabilityReader } from './observability.js';
@@ -44,6 +45,18 @@ export interface ConnectionInspector {
      * provider is checked before it writes, and a REFUSED credential never lands.
      */
     probeCandidate?: (secret: Record<string, string>) => Promise<ConnectionProbe>;
+    /**
+     * Finish a candidate credential before it is probed and stored (#2100) — for a provider
+     * where part of the credential is the platform's to make (a generated keypair). Gets the
+     * live connection's secret when the upsert rotates one, so what must survive an edit can.
+     * An `expiresAt` of `null` clears the connection's expiry (`ConnectionCandidatePrepare`).
+     */
+    prepareCandidate?: ConnectionCandidatePrepare;
+    /**
+     * The PUBLIC certificate the connection authenticates with, for the tenant to register on
+     * the provider's side (#2100). `null` when this connection uses none (a client secret).
+     */
+    certificate?: (host: ScopeHost, connection: Connection) => Promise<ConnectionCertificate | null>;
 }
 export interface ControlPlaneApiOptions {
     /**

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EA2FL,CAAC,EAYF,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAGV,UAAU,EACV,kBAAkB,EAElB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAKf,eAAe,EAUhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAoD,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAkBzI,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAuBrF,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAyBtD,OAAO,EAA+C,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE3G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAItB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IACV,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;;OAMG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,SAAS,CAAC;CAClB,CAAC;AAwYF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AA+H7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAuC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AA0JjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAujPhG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAkBL,KAAK,qBAAqB,EA4E1B,CAAC,EAYF,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAGV,UAAU,EACV,kBAAkB,EAElB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAKf,eAAe,EAUhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAoD,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAoBzI,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAKrF,OAAO,EAA+C,KAAK,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAkBrH,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAyBtD,OAAO,EAA+C,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE3G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAItB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAClG;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IACV,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;;OAMG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,SAAS,CAAC;CAClB,CAAC;AAwYF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AA+H7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAuC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAqKjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA0tPhG"}

package/dist/api.js

@@ -1,15 +1,16 @@
 import { resolveObservabilityWindow } from './observability-window.js';
 import { Hono } from 'hono';
-import { parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, ownerTransferInput, OWNER_TRANSFER_AUDIT_ERROR_MAX, memberInviteInput, memberRoleInput, ASSET_PART_PREFIX, assetHash, channelName, connectionActivity, connectionActivitySource, connectionCredential, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, findingKind, findingRuleInput, findingStatus, findingStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, operationSeriesCount, operationSeriesInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, platformScriptCollision, platformScriptRefusal, PLATFORM_SCRIPT_NAMES, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, errorCodeOf, capabilityFilterQuery, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, } from '@substrat-run/contracts';
+import { parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, ownerTransferInput, memberInviteInput, memberRoleInput, ASSET_PART_PREFIX, assetHash, channelName, connectLinkId, connectionActivity, connectionActivitySource, connectionCredential, connectionCertificate, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, findingKind, findingRuleInput, findingStatus, findingStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, operationSeriesCount, operationSeriesInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, verticalSlug, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, platformScriptCollision, platformScriptRefusal, PLATFORM_SCRIPT_NAMES, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, errorCodeOf, capabilityFilterQuery, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, } from '@substrat-run/contracts';
 import { attributeFailure } from './failure-attribution.js';
-import { BIND_EXPORT_BREAK_REFUSAL, CARRIED_AWAY_KEY, bindExportBreakRefusal, carriedAwayDump, dumpMetaValue, metaValueIn, crossVerticalHealth, exportBreakRefusal, isBindExportBreakRefusal, isExportBreakRefusal, isPrimaryScope, migrationProgress, ulid, } from '@substrat-run/kernel';
+import { auditedChange, withAuditedOutcomes } from './audited-change.js';
+import { BIND_EXPORT_BREAK_REFUSAL, CARRIED_AWAY_KEY, bindExportBreakRefusal, carriedAwayDump, dumpMetaValue, metaValueIn, crossVerticalHealth, exportBreakRefusal, isBindExportBreakRefusal, isExportBreakRefusal, isPrimaryScope, migrationProgress, ulid, auditWarningOf, } from '@substrat-run/kernel';
 import { TENANT_HEADER, confinedTenant } from './auth.js';
 import { mintTenantToken } from './tenant-token.js';
 import { connectionGrantsForScope } from './vertical-client.js';
 import { oidcCallbackUrl, retireClientsOfReapedScope, wirePreviewAuth } from './preview-auth.js';
 import { versionReachedAt } from './scope-deployment.js';
 import { reconcileConnectionGrants } from './connection-grants.js';
-import { reconcileThenReassert, switchCarryFor } from './reconcile.js';
+import { reconcileThenReassert, reviewedEntityGrants, switchCarryFor } from './reconcile.js';
 import { ConnectionRelayError, relayConnectionUpsert } from './connection-relay.js';
 import { ControlPlaneError } from '@substrat-run/control-plane-client';
 import { provisionSiblingScope } from './platform-drain.js';
@@ -595,7 +596,16 @@ const TENANT_ROUTES = [
     { method: 'DELETE', re: /\/tenants\/[^/]+\/connections\/[^/]+$/, pin: 'path' },
     { method: 'GET', re: /\/tenants\/[^/]+\/connections\/[^/]+\/activity$/, pin: 'path' },
     { method: 'GET', re: /\/tenants\/[^/]+\/connections\/[^/]+\/credential$/, pin: 'path' },
+    // #2100: the PUBLIC certificate a connection signs in with — same pin as the credential view.
+    { method: 'GET', re: /\/tenants\/[^/]+\/connections\/[^/]+\/certificate$/, pin: 'path' },
     { method: 'POST', re: /\/tenants\/[^/]+\/connections\/[^/]+\/verify$/, pin: 'path' },
+    // A vertical's mailed connect links (connections.md §3.5.4): the consent landing's liveness
+    // read, the callback's spend and its undo, and the integrations card's list and revoke.
+    { method: 'GET', re: /\/tenants\/[^/]+\/connect-links$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/connect-links\/[^/]+$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/connect-links\/[^/]+\/consume$/, pin: 'path' },
+    { method: 'POST', re: /\/tenants\/[^/]+\/connect-links\/[^/]+\/restore$/, pin: 'path' },
+    { method: 'DELETE', re: /\/tenants\/[^/]+\/connect-links\/[^/]+$/, pin: 'path' },
     // Members: identity links mirrored from the dashboard, orgs, role assignments.
     { method: 'GET', re: /\/tenants\/[^/]+\/identities$/, pin: 'path' },
     { method: 'PUT', re: /\/tenants\/[^/]+\/identities$/, pin: 'path' },
@@ -633,6 +643,8 @@ const TENANT_ROUTES = [
     { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/migrations$/, pin: 'path' },
     { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/owner-seat$/, pin: 'path' },
     { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/peer-grants$/, pin: 'path' },
+    { method: 'GET', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/peer-bindings$/, pin: 'path' },
+    { method: 'PUT', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/peer-bindings$/, pin: 'path' },
     // The peer switch (#1706): on is POST, off is DELETE, on the tenant's own scope.
     { method: 'POST', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/peer-grants$/, pin: 'path' },
     { method: 'DELETE', re: /\/tenants\/[^/]+\/scopes\/[^/]+\/peer-grants$/, pin: 'path' },
@@ -1588,7 +1600,7 @@ export function createControlPlaneApi(options) {
             return c.json({ error: 'body tenantId disagrees with the route tenant' }, 400);
         }
         try {
-            return c.json(await relayConnectionUpsert(c.var.host, c.get('actor'), { ...body, tenantId }, { probeCandidate }));
+            return c.json(await relayConnectionUpsert(c.var.host, c.get('actor'), { ...body, tenantId }, { probeCandidate, prepareCandidate }));
         }
         catch (err) {
             if (err instanceof ConnectionRelayError && err.status < 500) {
@@ -1618,6 +1630,80 @@ export function createControlPlaneApi(options) {
             await c.var.admin.revokeConnection(c.get('actor'), row.id);
         return c.body(null, 204);
     });
+    // -- a vertical's mailed connect links, tenant-scoped (connections.md §3.5.4) ---------
+    //
+    // The dashboard's half of a link a VERTICAL minted (`/internal/connections/connect-links`):
+    // its consent landing asks whether the row still stands, its callback spends the row
+    // before storing and restores it if the store fails, and its integrations card lists and
+    // revokes them. The tenant is the path's; the scope is named on every call and is half
+    // the store's key, so another scope's link — or another tenant's — reads as absent (K-3).
+    // Not in BUILDER_ROUTES: a builder has no business spending a tenant's consent round.
+    const connectLinkScope = z.object({ scopeId: scopeIdSchema });
+    app.get('/tenants/:tenantId/connect-links', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const q = connectLinkScope
+            .extend({ provider: connectionProvider.optional(), outstanding: z.literal('1').optional() })
+            .parse({
+            scopeId: c.req.query('scopeId'),
+            provider: c.req.query('provider') || undefined,
+            outstanding: c.req.query('outstanding') || undefined,
+        });
+        return c.json(await c.var.admin.listConnectLinks(c.get('actor'), {
+            tenantId,
+            scopeId: q.scopeId,
+            ...(q.provider ? { provider: q.provider } : {}),
+            ...(q.outstanding ? { outstandingOnly: true } : {}),
+        }));
+    });
+    app.get('/tenants/:tenantId/connect-links/:linkId', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const { scopeId } = connectLinkScope.parse({ scopeId: c.req.query('scopeId') });
+        const link = await c.var.admin.getConnectLink(c.get('actor'), {
+            tenantId,
+            scopeId,
+            id: connectLinkId.parse(c.req.param('linkId')),
+        });
+        return link ? c.json(link) : c.json({ error: 'unknown connect link' }, 404);
+    });
+    // The callback's spend. A refusal is a 200 carrying the typed reason, not an error status:
+    // "already used" is the answer to the question asked, and the callback renders each one.
+    app.post('/tenants/:tenantId/connect-links/:linkId/consume', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const body = connectLinkScope
+            .extend({
+            provider: connectionProvider,
+            accountRef: z.string().max(256).optional(),
+            accountLabel: z.string().max(256).optional(),
+        })
+            .parse(await c.req.json());
+        return c.json(await c.var.admin.consumeConnectLink(c.get('actor'), {
+            ...body,
+            tenantId,
+            id: connectLinkId.parse(c.req.param('linkId')),
+        }));
+    });
+    app.post('/tenants/:tenantId/connect-links/:linkId/restore', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const { scopeId } = connectLinkScope.parse(await c.req.json());
+        const restored = await c.var.admin.restoreConnectLink(c.get('actor'), {
+            tenantId,
+            scopeId,
+            id: connectLinkId.parse(c.req.param('linkId')),
+        });
+        return c.json({ restored });
+    });
+    // Idempotent, as the store is: a revoked or spent link answers 204 again. 404 only for a
+    // link this scope never held.
+    app.delete('/tenants/:tenantId/connect-links/:linkId', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const { scopeId } = connectLinkScope.parse({ scopeId: c.req.query('scopeId') });
+        const link = await c.var.admin.revokeConnectLink(c.get('actor'), {
+            tenantId,
+            scopeId,
+            id: connectLinkId.parse(c.req.param('linkId')),
+        });
+        return link ? c.body(null, 204) : c.json({ error: 'unknown connect link' }, 404);
+    });
     /**
      * The tenant-scoped connection lookup the two inspection routes share. Same K-3
      * existence hiding as the revoke above — a foreign tenant's connection id reads
@@ -1630,6 +1716,8 @@ export function createControlPlaneApi(options) {
      * in which case the upsert behaves exactly as it always did, storing unverified.
      */
     const probeCandidate = async (provider, secret) => options.connectionInspectors?.[provider]?.probeCandidate?.(secret);
+    /** #2100: the provider's own half of a credential, made before the probe sees it. */
+    const prepareCandidate = (provider) => options.connectionInspectors?.[provider]?.prepareCandidate;
     const inspectableConnection = async (c) => {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         const id = c.req.param('id');
@@ -1703,6 +1791,20 @@ export function createControlPlaneApi(options) {
         }
         return c.json(connectionCredential.parse(await credential(c.var.host, row)));
     });
+    /**
+     * The public certificate a connection signs in with (#2100) — what the tenant downloads and
+     * uploads to the provider. Public by construction: the private key never leaves the sealed
+     * credential, and only a provider whose keypair the platform generates has one at all.
+     */
+    app.get('/tenants/:tenantId/connections/:id/certificate', async (c) => {
+        const row = await inspectableConnection(c);
+        if (!row)
+            return c.json({ error: 'unknown connection' }, 404);
+        const certificate = await options.connectionInspectors?.[row.provider]?.certificate?.(c.var.host, row);
+        if (!certificate)
+            return c.json({ error: 'this connection signs in with no certificate' }, 404);
+        return c.json(connectionCertificate.parse(certificate));
+    });
     // -- the scope directory (§3.2/§4.2) ---------------------------------------
     app.get('/scopes', async (c) => {
         const p = c.get('principal');
@@ -2825,6 +2927,9 @@ export function createControlPlaneApi(options) {
             ? await c.var.admin.verticalServing(actor, scope.vertical).catch(() => null)
             : null;
         const ranAs = versionReachedAt(reached.via, scope, serving);
+        // #2071: the shapes this reconcile tops holders up to, from the reviewed registry of the
+        // version it reaches — never anything the vertical's own code names.
+        const entityGrants = scope.vertical && ranAs ? await reviewedEntityGrants(c.var.admin, actor, scope.vertical, ranAs) : undefined;
         try {
             // #1674: the recorded OFF positions go back after the reconcile, before the receipt.
             const result = await reconcileThenReassert(c.var.admin, actor, { tenantId, scopeId }, (carry) => vertical.reconcileInstance({
@@ -2834,6 +2939,7 @@ export function createControlPlaneApi(options) {
                 identityLinks,
                 connectionGrants,
                 connectionKeys,
+                ...(entityGrants ? { entityGrants } : {}),
                 ...carry,
                 // Handed over exactly as at provision: a store minted HERE has never been migrated
                 // by the vertical, so the reconcile must carry it into the same ready-gate — a bound
@@ -3256,28 +3362,46 @@ export function createControlPlaneApi(options) {
             return { refusal: c.json({ error: await diagnoseUnboundScope(actor, scope) }, 501) };
         return { tenantId, scopeId, actor, vertical, person: memberPerson(principal) };
     };
-    /** Run one audited member change: intent, the vertical's call, then the outcome row. */
-    const auditedMemberChange = async (c, entry, run, applied) => {
-        const actor = c.get('actor');
-        const base = { ...entry, operationId: ulid() };
-        await c.var.admin.recordMemberChange(actor, { ...base, phase: 'intent' });
-        let result;
-        try {
-            result = await run();
-        }
-        catch (e) {
-            const status = e instanceof ControlPlaneError ? e.status : 500;
-            const error = (e instanceof Error ? e.message : String(e)).slice(0, OWNER_TRANSFER_AUDIT_ERROR_MAX);
-            await c.var.admin
-                .recordMemberChange(actor, { ...base, phase: status < 500 ? 'refused' : 'failed', error })
-                .catch(() => undefined);
-            if (e instanceof ControlPlaneError) {
-                return { ok: false, response: c.json({ error: e.message }, e.status) };
+    /**
+     * Answer for one `auditedChange` (#2064). A refusal or failure answers with the vertical's own
+     * status (a non-`ControlPlaneError` throw is rethrown). A change that went through answers
+     * `ok`, with its `operationId`, whether or not its outcome row could be written. When it could
+     * not, the answer also carries `auditWarning`, which says so. That is a success on purpose:
+     * the change happened, so no client should read a retryable error and make it twice (a second
+     * invite, a second hand-over). The missing row is logged, and the scheduled settle closes it.
+     */
+    const auditedAnswer = (c, done, what, ok) => {
+        const { operationId } = done;
+        if ('error' in done) {
+            if (done.error instanceof ControlPlaneError) {
+                return c.json({ error: done.error.message, operationId }, done.error.status);
             }
-            throw e;
+            throw done.error;
         }
-        await c.var.admin.recordMemberChange(actor, { ...base, phase: 'applied', ...applied(result) });
-        return { ok: true, result };
+        if ('unrecorded' in done) {
+            return ok(done.result, {
+                operationId,
+                auditWarning: auditWarningOf(what, done.unrecorded),
+            });
+        }
+        return ok(done.result, { operationId });
+    };
+    /** Run one audited member change: intent, the vertical's call, then the outcome row. */
+    const auditedMemberChange = (c, entry, run, applied) => {
+        const actor = c.get('actor');
+        const operationId = ulid();
+        return auditedChange({
+            flow: 'member-change',
+            operationId,
+            run,
+            // A 4xx is the vertical's refusal: nothing was written there.
+            refused: (e) => e instanceof ControlPlaneError && e.status < 500,
+            record: (row) => c.var.admin.recordMemberChange(actor, {
+                ...entry,
+                operationId,
+                ...(row.phase === 'applied' ? { phase: 'applied', ...applied(row.result) } : row),
+            }),
+        });
     };
     const NO_PERSON = 'a member change needs the signed-in person it is made for — this credential names nobody';
     app.get('/tenants/:tenantId/scopes/:scopeId/members', async (c) => {
@@ -3306,7 +3430,7 @@ export function createControlPlaneApi(options) {
         }
         const { tenantId, scopeId, person } = target;
         const done = await auditedMemberChange(c, { tenantId, scopeId, change: 'invite', caller: person, roleKey: body.roleKey }, () => target.vertical.inviteMember({ tenantId, scopeId, caller: person, origin, roleKey: body.roleKey, email: body.email ?? null }), (link) => ({ principal: link.principal }));
-        return done.ok ? c.json(done.result, 201) : done.response;
+        return auditedAnswer(c, done, 'the invite', (link, audit) => c.json({ ...link, ...audit }, 201));
     });
     app.post('/tenants/:tenantId/scopes/:scopeId/members/:principal/role', async (c) => {
         const target = await memberTarget(c);
@@ -3318,7 +3442,7 @@ export function createControlPlaneApi(options) {
         const body = memberRoleInput.parse(await c.req.json());
         const { tenantId, scopeId, person } = target;
         const done = await auditedMemberChange(c, { tenantId, scopeId, change: 'role', caller: person, principal: member, from: body.from, to: body.to }, () => target.vertical.changeMemberRole({ tenantId, scopeId, caller: person, principal: member, from: body.from, to: body.to }), () => ({}));
-        return done.ok ? c.json({ principal: member, from: body.from, to: body.to }) : done.response;
+        return auditedAnswer(c, done, 'the role change', (_, audit) => c.json({ principal: member, from: body.from, to: body.to, ...audit }));
     });
     app.post('/tenants/:tenantId/scopes/:scopeId/members/:principal/remove', async (c) => {
         const target = await memberTarget(c);
@@ -3329,7 +3453,7 @@ export function createControlPlaneApi(options) {
         const member = principalIdSchema.parse(c.req.param('principal'));
         const { tenantId, scopeId, person } = target;
         const done = await auditedMemberChange(c, { tenantId, scopeId, change: 'remove', caller: person, principal: member }, () => target.vertical.removeMember({ tenantId, scopeId, caller: person, principal: member }), (removal) => ({ revoked: removal.revoked }));
-        return done.ok ? c.json(done.result) : done.response;
+        return auditedAnswer(c, done, 'the removal', (removal, audit) => c.json({ ...removal, ...audit }));
     });
     // The owner HAND-OVER (#1665). The move runs in the VERTICAL, behind `/internal/owner-transfer`
     // (vertical-host says in what order and why). This route decides who may ask, and audits every
@@ -3360,41 +3484,19 @@ export function createControlPlaneApi(options) {
         // An abandon (`abandon: true`) is audited the same way, every row marked, so the log tells
         // a hand-over closed without finishing from one that finished.
         const base = { tenantId, scopeId, operationId, from: body.from, to: body.to, ...(body.abandon ? { abandon: true } : {}) };
-        await c.var.admin.recordOwnerTransfer(actor, { ...base, phase: 'intent' });
-        let moved;
-        try {
-            moved = await vertical.transferOwner({ tenantId, scopeId, ...body });
-        }
-        catch (e) {
-            const refused = e instanceof ControlPlaneError && e.status === 409;
-            const error = (e instanceof Error ? e.message : String(e)).slice(0, OWNER_TRANSFER_AUDIT_ERROR_MAX);
-            await c.var.admin
-                .recordOwnerTransfer(actor, { ...base, phase: refused ? 'refused' : 'failed', error })
-                .catch(() => undefined);
-            if (e instanceof ControlPlaneError) {
-                return c.json({ error: e.message, operationId }, e.status);
-            }
-            throw e;
-        }
-        try {
-            await c.var.admin.recordOwnerTransfer(actor, {
-                ...base,
-                phase: 'applied',
-                outcome: moved.outcome,
-                fromRevoked: moved.fromRevoked,
-            });
-        }
-        catch (e) {
-            // The owner HAS moved; only the outcome row is missing. Say exactly that, so nobody retries
-            // a hand-over believing it failed, and name the operation whose intent row stands alone.
-            const why = e instanceof Error ? e.message : String(e);
-            return c.json({
-                error: `the hand-over completed, but its outcome could not be written to the admin log: ${why}`,
-                operationId,
-                ...moved,
-            }, 500);
-        }
-        return c.json({ operationId, ...moved });
+        const done = await auditedChange({
+            flow: 'owner-transfer',
+            operationId,
+            run: () => vertical.transferOwner({ tenantId, scopeId, ...body }),
+            // Only the vertical's 409 is a refusal: anything else may have stopped part-way.
+            refused: (e) => e instanceof ControlPlaneError && e.status === 409,
+            record: (row) => c.var.admin.recordOwnerTransfer(actor, row.phase === 'applied'
+                ? { ...base, phase: 'applied', outcome: row.result.outcome, fromRevoked: row.result.fromRevoked }
+                : { ...base, ...row }),
+        });
+        // A missing outcome row is said in `auditWarning` on a success, so nobody retries a hand-over
+        // believing it failed, under the operation whose intent row stands alone.
+        return auditedAnswer(c, done, 'the hand-over', (moved, audit) => c.json({ ...audit, ...moved }));
     });
     // Deliver per-instance CONFIG to the scope's own storage (vertical-auth-detach.md
     // §2.2) — the missing "delivery" step behind the dashboard's Env tab. Same K-3
@@ -6224,6 +6326,9 @@ export function createControlPlaneApi(options) {
             // `emailSender` grant itself is never touched by a push. Refreshes on every re-push
             // like the rest of the install spec, exactly because it grants nothing.
             ...(manifest.sendsEmail ? { sendsEmail: true } : {}),
+            // Where the scope lifecycle is held (#1713): `'router'` keeps the vertical's scopes out of
+            // the lifecycle delivery. Refreshes on every re-push like the rest of the install spec.
+            ...(manifest.lifecycle ? { lifecycle: manifest.lifecycle } : {}),
             // The declared surfaces (K-26) ride like envSpec: registry metadata for the
             // hostname-binding picker, never behavior. Not part of any admission digest.
             ...(manifest.surfaces ? { surfaces: manifest.surfaces } : {}),
@@ -7667,6 +7772,56 @@ export function createControlPlaneApi(options) {
         }
         return c.json(await c.var.admin.peerGrantsStatus(actor, { tenantId, scopeId }));
     });
+    // #1720: a caller's explicit target is a tenant decision. The dashboard checks its own
+    // app-management permission; this route confines the tenant and both directory endpoints.
+    const peerBindingBody = z.object({ vertical: verticalSlug, targetScopeId: scopeIdSchema.nullable() }).strict();
+    app.get('/tenants/:tenantId/scopes/:scopeId/peer-bindings', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
+        const vertical = c.req.query('vertical');
+        const pin = confinedTenant(c.get('principal'));
+        if (pin !== null && pin !== tenantId)
+            return c.json({ error: 'forbidden' }, 403);
+        const actor = c.get('actor');
+        if (!(await c.var.admin.getScopeRecord(actor, tenantId, scopeId)))
+            return c.json({ error: 'app not found' }, 404);
+        return c.json(vertical === undefined
+            ? await c.var.admin.peerBindings(actor, tenantId, scopeId)
+            : await c.var.admin.peerBinding(actor, tenantId, scopeId, verticalSlug.parse(vertical)) ?? null);
+    });
+    app.put('/tenants/:tenantId/scopes/:scopeId/peer-bindings', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
+        const pin = confinedTenant(c.get('principal'));
+        // The target choice is the tenant's alone. Staff may inspect it through GET, but cannot
+        // choose a tenant's site on its behalf.
+        if (pin !== tenantId)
+            return c.json({ error: 'forbidden' }, 403);
+        const body = peerBindingBody.parse(await c.req.json());
+        const actor = c.get('actor');
+        if (!(await c.var.admin.getScopeRecord(actor, tenantId, scopeId)))
+            return c.json({ error: 'app not found' }, 404);
+        const operationId = ulid();
+        const base = { tenantId, scopeId, operationId, vertical: body.vertical, targetScopeId: body.targetScopeId };
+        const done = await auditedChange({
+            flow: 'peer-binding', operationId,
+            run: async () => {
+                try {
+                    return await c.var.admin.setPeerBinding(actor, tenantId, scopeId, body.vertical, body.targetScopeId);
+                }
+                catch (e) {
+                    if (errorCodeOf(e) === 'not_found')
+                        throw new ControlPlaneError(404, e instanceof Error ? e.message : String(e));
+                    throw e;
+                }
+            },
+            refused: (e) => e instanceof ControlPlaneError && e.status < 500,
+            record: (row) => c.var.admin.recordPeerBindingChange(actor, row.phase === 'applied'
+                ? { ...base, phase: 'applied', changed: row.result.changed, previousScopeId: row.result.previous }
+                : { ...base, ...row }),
+        });
+        return auditedAnswer(c, done, 'the peer binding', (result, audit) => c.json({ ...result, ...audit }));
+    });
     // Orgs: the portal-customer grouping (§4.1). Creating one mints no permission —
     // members reach what the org was GRANTED, and granting stays off this surface.
     app.post('/tenants/:tenantId/orgs', async (c) => {
@@ -7693,9 +7848,12 @@ export function createControlPlaneApi(options) {
             order: c.req.query('order'),
         });
         const entries = await c.var.admin.auditLog(c.get('actor'), filter);
+        // #2064: each audited change's row says the outcome its operation stands at — the latest
+        // outcome row wins — beside the raw row, which is returned as written.
+        const resolved = await withAuditedOutcomes(c.var.admin, c.get('actor'), entries);
         // The cursor IS the last entry's id (ULID order is chronological), so the
         // page carries its own continuation and the console never assembles one.
-        return c.json(pageOf(entries, filter.limit, (e) => e.id));
+        return c.json(pageOf(resolved, filter.limit, (e) => e.id));
     });
     // The recorded operational failures (#559) — the console's failures view, and the
     // "what does this `reference = <id>` belong to" lookup. Newest first by default,