@substrat-run/control-plane-api 0.141.0 → 0.143.0

package/dist/api.d.ts

@@ -339,6 +339,14 @@ type Vars = {
     host: ScopeHost;
     /** `host.admin` of the same request — the spelling every route writes through. */
     admin: HostAdmin;
+    /**
+     * The error this request answered with, when a route answered it itself instead of throwing
+     * (`failedWith`) or `onError` did. The 5xx backstop reads it to attribute the row, and to skip
+     * one a step already recorded.
+     */
+    failure?: unknown;
+    /** A step recorded this request's failure with no error object to mark (a literal 5xx). */
+    failureRecorded?: true;
 };
 /**
  * The K-35 denial-log filter (#867). Bounded by default like every other HTTP read

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAkBL,KAAK,qBAAqB,EA4E1B,CAAC,EAYF,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAGV,UAAU,EACV,kBAAkB,EAElB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAKf,eAAe,EAUhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAoB,oBAAoB,EAAE,SAAS,EAAoD,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAqB3J,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAMrF,OAAO,EAA+C,KAAK,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAkBrH,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAyBtD,OAAO,EAA+C,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE3G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAItB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAClG;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;kGAC8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IACV,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;;OAMG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,SAAS,CAAC;CAClB,CAAC;AAwYF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AA+H7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAuC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAsKjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAylQhG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAkBL,KAAK,qBAAqB,EA4E1B,CAAC,EAaF,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAGV,UAAU,EACV,kBAAkB,EAElB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAKf,eAAe,EAUhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAoB,oBAAoB,EAAE,SAAS,EAAoD,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAqB3J,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAOrF,OAAO,EAA+C,KAAK,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAkBrH,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAyBtD,OAAO,EAA+C,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE3G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAItB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAClG;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;kGAC8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IACV,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;;OAMG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2FAA2F;IAC3F,eAAe,CAAC,EAAE,IAAI,CAAC;CACxB,CAAC;AAwYF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AA+H7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAuC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAsKjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAoCD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAurQhG"}

package/dist/api.js

@@ -1,6 +1,6 @@
 import { resolveObservabilityWindow } from './observability-window.js';
 import { Hono } from 'hono';
-import { parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, ownerTransferInput, memberInviteInput, memberRoleInput, ASSET_PART_PREFIX, assetHash, channelName, connectLinkId, connectionActivity, connectionActivitySource, connectionCredential, connectionCertificate, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, findingKind, findingRuleInput, findingStatus, findingStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, operationSeriesCount, operationSeriesInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, verticalSlug, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, platformScriptCollision, platformScriptRefusal, PLATFORM_SCRIPT_NAMES, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, errorCodeOf, capabilityFilterQuery, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, } from '@substrat-run/contracts';
+import { parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, ownerTransferInput, memberInviteInput, memberRoleInput, ASSET_PART_PREFIX, assetHash, channelName, connectLinkId, connectionActivity, connectionActivitySource, connectionCredential, connectionCertificate, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, findingKind, findingRuleInput, findingStatus, findingStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, operationSeriesCount, operationSeriesInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, verticalSlug, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, platformScriptCollision, platformScriptRefusal, PLATFORM_SCRIPT_NAMES, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, errorCodeOf, capabilityFilterQuery, capabilityId as capabilityIdSchema, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, } from '@substrat-run/contracts';
 import { SCOPE_COPY_LEASE_MS, copyRestoreFence } from '@substrat-run/kernel';
 import { attributeFailure } from './failure-attribution.js';
 import { auditedChange, withAuditedOutcomes } from './audited-change.js';
@@ -9,8 +9,9 @@ import { TENANT_HEADER, confinedTenant } from './auth.js';
 import { mintTenantToken } from './tenant-token.js';
 import { connectionGrantsForScope } from './vertical-client.js';
 import { assertNoUnreachableScopeCopies, listAllScopeScriptCopies, reapScopeScriptCopies, recordStrandedStorage } from './scope-copy-cleanup.js';
+import { BACKFILL_PAGE_MAX, backfillScopeScriptCopies } from './scope-copy-backfill.js';
 import { oidcCallbackUrl, retireClientsOfReapedScope, wirePreviewAuth } from './preview-auth.js';
-import { versionReachedAt } from './scope-deployment.js';
+import { scopeDeployment, versionReachedAt } from './scope-deployment.js';
 import { reconcileConnectionGrants } from './connection-grants.js';
 import { reconcileThenReassert, reviewedEntityGrants, switchCarryFor } from './reconcile.js';
 import { ConnectionRelayError, relayConnectionUpsert } from './connection-relay.js';
@@ -772,6 +773,18 @@ const namedTenants = (c) => {
     ];
     return named.filter((v) => typeof v === 'string' && v.length > 0);
 };
+function messageOfThrow(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/** What a 5xx answered with no error object said: the JSON body's `error` (and `detail`), else the status. */
+async function answeredMessage(res) {
+    const body = (await res.clone().json().catch(() => null));
+    const error = typeof body?.['error'] === 'string' ? body['error'] : typeof body?.['title'] === 'string' ? body['title'] : null;
+    const detail = typeof body?.['detail'] === 'string' ? body['detail'] : null;
+    if (error && detail)
+        return `${error}: ${detail}`;
+    return error ?? detail ?? `HTTP ${res.status}`;
+}
 /**
  * The audited HTTP surface over `HostAdmin` (control-plane.md §4.5).
  *
@@ -803,6 +816,48 @@ export function createControlPlaneApi(options) {
     const { host, authenticate, authenticateBuilder, authenticateTenantService } = options;
     const copyLeaseMs = options.copyLeaseMs ?? SCOPE_COPY_LEASE_MS;
     const app = new Hono();
+    // The 5xx backstop: every 5xx this API answers lands an ops-failure row, however it was
+    // answered. A 5xx is the PLATFORM failing (an unmapped throw, or a downstream vertical's own
+    // 5xx passing through, #559), so the console must be able to list it and a `reference = <id>`
+    // search must find it. It used to be recorded only in `onError`, which never sees the routes
+    // that catch a ControlPlaneError and answer it themselves: a preview re-push whose bind failed
+    // after a clean carry answered 502 with a reference and left no row behind.
+    //
+    // Registered first, so it wraps every other middleware and route. 501 stays out: an honest
+    // not-implemented is a capability statement, not a failure. 4xx stay out too: they are
+    // refusals the caller can already read. Actor is unset only when the request failed before
+    // authentication, where nothing worth recording refuses. A throw a step already recorded,
+    // with its stage and scope, is not recorded again.
+    app.use('*', async (c, next) => {
+        await next();
+        const status = c.res.status;
+        const actor = c.get('actor');
+        if (status >= 500 && status !== 501 && actor && !c.get('failureRecorded')) {
+            const cause = c.get('failure');
+            const marked = typeof cause === 'object' && cause !== null && recordedCauses.has(cause);
+            if (!marked) {
+                const { vertical, tenantId } = await failureSubject(c);
+                recordFailure({
+                    actor,
+                    operation: `${c.req.method} ${c.req.routePath}`,
+                    vertical,
+                    tenantId,
+                    scopeId: c.req.param('scopeId') ?? null,
+                    status,
+                    message: cause !== undefined ? messageOfThrow(cause) : await answeredMessage(c.res),
+                }, cause === undefined ? NO_CAUSE : cause);
+            }
+        }
+        if (inflightRecords.size) {
+            // `executionCtx` throws outside a Worker (tests, node); the write then simply runs on.
+            try {
+                c.executionCtx.waitUntil(Promise.allSettled([...inflightRecords]));
+            }
+            catch {
+                // no execution context
+            }
+        }
+    });
     // The CLI version advisory (#971), stamped on EVERY response — including the 401 the
     // auth middleware below answers with, since a CLI too old to authenticate is exactly
     // the one that needs to hear it. Registered first so nothing can return around it.
@@ -1026,20 +1081,62 @@ export function createControlPlaneApi(options) {
     // `undefined` (`throw undefined`, a bare rejection), and that throw deserves an
     // `unknown` attribution, not a skipped one. Only true omission skips.
     const NO_CAUSE = Symbol('no-cause');
+    // The throws a step already recorded, so the 5xx backstop below does not record them twice.
+    const recordedCauses = new WeakSet();
+    // The writes still in flight. A Worker may end once its response is sent, and a write nobody
+    // awaits goes with it, so the backstop hands these to `waitUntil`.
+    const inflightRecords = new Set();
     const recordFailure = (entry, cause = NO_CAUSE) => {
+        if (typeof cause === 'object' && cause !== null)
+            recordedCauses.add(cause);
         // The error SHAPE rides beside the prose (#1233): attributed here — one place,
         // from the throw itself — so a fingerprint groups on a column and never has to
         // regex a message. A caller with no throw in hand leaves the columns null,
         // which reads as "nobody classified this" rather than a guess nobody made.
         const attributed = cause === NO_CAUSE ? undefined : attributeFailure(cause);
-        void host.admin
+        const write = host.admin
             .recordOpsFailure({
             ...entry,
             origin: entry.origin ?? attributed?.origin ?? null,
             code: entry.code ?? attributed?.code ?? null,
             reference: entry.reference ?? UPSTREAM_REFERENCE.exec(entry.message)?.[1] ?? null,
         })
-            .catch(() => undefined);
+            .catch(() => undefined)
+            .finally(() => inflightRecords.delete(write));
+        inflightRecords.add(write);
+    };
+    /**
+     * Whose failure the backstop is recording, so the dashboard's tenant-pinned failure view lists
+     * it. The path's tenant when it names one; otherwise the credential's own (a CI push token, a
+     * builder); otherwise, on a vertical route, the vertical's owner. The slug is resolved the way
+     * the route resolves it, so a CI push's bare `todo` is recorded as the full slug the
+     * dashboard filters on. Best effort: a lookup that fails still records the row, unattributed.
+     */
+    const failureSubject = async (c) => {
+        // Already decoded by Hono, and handed on as-is the way the routes hand it to
+        // `resolveVerticalId`. Decoding again would throw on a slug carrying `%25`, and a throw here
+        // replaces the 5xx being recorded with onError's answer.
+        const raw = c.req.param('slug') ?? null;
+        const pathTenant = c.req.param('tenantId') ?? null;
+        const principal = c.get('principal');
+        const confined = principal ? confinedTenant(principal) : null;
+        if (!raw)
+            return { vertical: null, tenantId: pathTenant ?? confined };
+        try {
+            const vertical = await resolveVerticalId(c, raw);
+            const owner = (pathTenant ?? confined)
+                ? null
+                : ((await verticalOf(c.get('actor'), vertical))?.ownerTenant ?? null);
+            return { vertical, tenantId: pathTenant ?? confined ?? owner };
+        }
+        catch {
+            return { vertical: raw, tenantId: pathTenant ?? confined };
+        }
+    };
+    /** The status of a ControlPlaneError a route answers itself, with the error marked for the backstop. */
+    const failedWith = (c, e) => {
+        c.set('failure', e);
+        return e.status;
     };
     // Rides out a transient downstream window: the install path's binding-attach →
     // script-settings propagation race (#424 case 2), and a one-shot DO storage blip
@@ -1083,25 +1180,8 @@ export function createControlPlaneApi(options) {
             return c.json({ error: err.message, carrySourceChanged: { scopeId: err.scopeId, from: err.from, to: err.to, attempts: err.attempts } }, 409);
         }
         const { status, body } = mapError(err);
-        // A 5xx is the PLATFORM failing — an unmapped throw, or a downstream vertical's
-        // own 5xx passing through (a DO storage fault during a preview restore is the
-        // founding case, #559) — so it lands a durable ops-failure row the console can
-        // list and a `reference = <id>` search can find. 501 stays out: an honest
-        // not-implemented is a capability statement, not a failure. 4xx stay out too:
-        // they are refusals the caller can already read. Actor is unset only when the
-        // throw happened before authentication — nothing worth recording refuses there.
-        const actor = c.get('actor');
-        if (status >= 500 && status !== 501 && actor) {
-            recordFailure({
-                actor,
-                operation: `${c.req.method} ${c.req.routePath}`,
-                vertical: c.req.param('slug') ? decodeURIComponent(c.req.param('slug')) : null,
-                tenantId: c.req.param('tenantId') ?? null,
-                scopeId: c.req.param('scopeId') ?? null,
-                status,
-                message: err instanceof Error ? err.message : String(err),
-            }, err);
-        }
+        // The 5xx backstop (registered first, above) records it, with this throw as the cause.
+        c.set('failure', err);
         // A 500 is, by definition, a throw whose message `mapError` did not recognise — so the
         // client gets a GENERIC body that discloses nothing, and until now nothing recorded WHAT
         // threw either. That left every unmapped failure (e.g. a raw SQLite constraint from a
@@ -1212,7 +1292,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             }
             throw e;
         }
@@ -1884,7 +1964,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError)
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             throw e;
         }
     });
@@ -1940,42 +2020,14 @@ export function createControlPlaneApi(options) {
      * served version's hook ran when the bound one's did. `versionReachedAt(via, …)` turns
      * this answer into the version, so the choice and the receipt have one source.
      */
-    const deploymentForScope = async (c, scope) => {
-        if (!scope.vertical)
-            return undefined;
-        const actor = c.get('actor');
-        // A scope on the stable serving script (#286) is reached THERE — that script holds
-        // its DOs regardless of what the bound version or the prod channel say.
-        if (scope.servingRef && options.resolveVerticalRef) {
-            const serving = await options.resolveVerticalRef(scope.servingRef);
-            if (serving)
-                return { client: serving, via: 'serving-script' };
-        }
-        const bySlug = async (slug) => {
-            if (scope.verticalVersionId && options.resolveVerticalVersion) {
-                const bound = await options.resolveVerticalVersion(slug, scope.verticalVersionId, actor);
-                if (bound)
-                    return { client: bound, via: 'bound-version' };
-            }
-            const bySlugClient = options.verticals?.[slug] ?? (await options.resolveVertical?.(slug, actor));
-            return bySlugClient ? { client: bySlugClient, via: 'slug' } : undefined;
-        };
-        const direct = await bySlug(scope.vertical);
-        if (direct)
-            return direct;
-        // Miss path only (#417) — a resolved scope never pays for these registry reads: a
-        // scope bound to a BARE slug that is not registered, while the owning tenant's
-        // prefixed registration of the same name exists, is addressing the prefixed lineage
-        // under its bare spelling. Retry once under the registry id; anything else still
-        // misses and surfaces through `diagnoseUnboundScope` as before.
-        if (scope.tenantId && !scope.vertical.includes('/') && (await ownerOf(actor, scope.vertical)) === undefined) {
-            const tenant = await c.var.admin.getTenant(actor, scope.tenantId).catch(() => null);
-            const prefixed = tenant ? `${tenant.slug}/${scope.vertical}` : null;
-            if (prefixed && (await ownerOf(actor, prefixed)) !== undefined)
-                return bySlug(prefixed);
-        }
-        return undefined;
-    };
+    const deploymentForScope = (c, scope) => scopeDeployment({
+        verticals: options.verticals,
+        resolveVertical: options.resolveVertical,
+        resolveVerticalVersion: options.resolveVerticalVersion,
+        resolveVerticalRef: options.resolveVerticalRef,
+        ownerOf,
+        tenantSlugOf: async (actor, tenantId) => (await c.var.admin.getTenant(actor, tenantId).catch(() => null))?.slug ?? null,
+    }, c.get('actor'), scope);
     /**
      * Why a scope's vertical did not resolve to a running deployment — an ACTIONABLE 501
      * body, computed only on the miss path, in place of the bare "no deployment is bound"
@@ -3142,7 +3194,7 @@ export function createControlPlaneApi(options) {
                 // unbound store is exactly what makes a vertical refuse its own reconcile), so
                 // it must not be the half that gets dropped.
                 const detail = storeErrors.length ? `${e.message} (stores: ${storeErrors.join('; ')})` : e.message;
-                return c.json({ error: detail }, e.status);
+                return c.json({ error: detail }, failedWith(c, e));
             }
             throw e;
         }
@@ -3439,6 +3491,23 @@ export function createControlPlaneApi(options) {
             colocated: () => c.var.admin.listCapabilities(c.get('actor'), tenantId, scopeId, filter),
         }, (r) => r.entries.length));
     });
+    // The operator's revoke of one capability (#1686): the lever for a leaked link, beside the
+    // read above and gated the same way, in the handler as well as by the builder default-deny.
+    // `HostAdmin.revokeCapability` reaches the deployment serving a hosted scope (its
+    // `capabilityDelegation`) and audits it on this side, intent then outcome; the record names the
+    // actor as its revoker. Idempotent: revoking a revoked capability answers 204 again. A capability
+    // the scope does not hold is 404; a deployment built before the far end answers 501 "redeploy".
+    app.post('/tenants/:tenantId/scopes/:scopeId/capabilities/:capabilityId/revoke', async (c) => {
+        if (confinedTenant(c.get('principal')) !== null) {
+            return c.json({ error: 'forbidden: revoking a capability is staff-only' }, 403);
+        }
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
+        const capability = capabilityIdSchema.parse(c.req.param('capabilityId'));
+        // An unknown scope, another tenant's included, is the verb's own `not_found`: a 404.
+        await c.var.admin.revokeCapability(c.get('actor'), tenantId, scopeId, capability);
+        return c.body(null, 204);
+    });
     // The owner seat (#925). Both reads go to the VERTICAL — the seat lives in its identity
     // directory, in its deployment — after the same K-3 cross-check every scope-addressed read
     // here makes. A co-located scope (contract-test host, self-host running no vertical code)
@@ -3464,7 +3533,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError)
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             throw e;
         }
     });
@@ -3504,7 +3573,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError)
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             throw e;
         }
     });
@@ -3550,7 +3619,7 @@ export function createControlPlaneApi(options) {
         const { operationId } = done;
         if ('error' in done) {
             if (done.error instanceof ControlPlaneError) {
-                return c.json({ error: done.error.message, operationId }, done.error.status);
+                return c.json({ error: done.error.message, operationId }, failedWith(c, done.error));
             }
             throw done.error;
         }
@@ -3589,7 +3658,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError)
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             throw e;
         }
     });
@@ -3698,7 +3767,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             }
             throw e;
         }
@@ -3754,6 +3823,7 @@ export function createControlPlaneApi(options) {
                             status: 503,
                             message: error,
                         }, failure.cause);
+                        c.set('failureRecorded', true);
                         return c.json({ error }, 503);
                     }
                 }
@@ -3883,7 +3953,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             }
             throw e;
         }
@@ -3968,7 +4038,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             }
             throw e;
         }
@@ -4059,7 +4129,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             }
             throw e;
         }
@@ -4560,7 +4630,7 @@ export function createControlPlaneApi(options) {
             }
             catch (e) {
                 if (e instanceof ControlPlaneError) {
-                    return c.json({ error: e.message }, e.status);
+                    return c.json({ error: e.message }, failedWith(c, e));
                 }
                 return c.json({
                     error: 'backup failed — the scope was NOT reaped and its data is intact; ' +
@@ -4581,7 +4651,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             }
             throw e;
         }
@@ -4628,7 +4698,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             }
             throw e;
         }
@@ -4743,7 +4813,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             }
             throw e;
         }
@@ -4809,7 +4879,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             }
             // A restore throw is driven by the caller-supplied dump (a shape the target cannot
             // load, a DDL the engine rejects), so DISCLOSE it as an actionable 422 rather than
@@ -4889,7 +4959,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             }
             throw e;
         }
@@ -4909,7 +4979,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json(exportBreakBody(e), e.status);
+                return c.json(exportBreakBody(e), failedWith(c, e));
             }
             throw e;
         }
@@ -4947,7 +5017,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json({ ...exportBreakBody(e), adopted, alreadyAdopted }, e.status);
+                return c.json({ ...exportBreakBody(e), adopted, alreadyAdopted }, failedWith(c, e));
             }
             throw e;
         }
@@ -4979,7 +5049,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError) {
-                return c.json(exportBreakBody(e), e.status);
+                return c.json(exportBreakBody(e), failedWith(c, e));
             }
             throw e;
         }
@@ -5311,6 +5381,23 @@ export function createControlPlaneApi(options) {
         await bind({ acknowledge });
         return c.json(await c.var.admin.getScopeRecord(actor, tenantId, scopeId));
     });
+    // -- copy-ledger backfill (#1722) ------------------------------------------------------------
+    // Records the scripts a scope was copied into before the ledger existed, read from the admin
+    // log, as `retained`: reached by reap and erasure from then on, never wiped from here
+    // (`scope-copy-backfill.ts`). A dry run unless the body says otherwise, one page per call,
+    // resumed with the `nextCursor` it answers. Staff only, by default-deny: on neither
+    // BUILDER_ROUTES nor TENANT_ROUTES.
+    const copyBackfillBody = z.object({
+        dryRun: z.boolean().default(true),
+        cursor: z.string().min(1).optional(),
+        limit: z.number().int().min(1).max(BACKFILL_PAGE_MAX).optional(),
+    }).strict();
+    app.post('/scope-copies/backfill', async (c) => {
+        const body = await readJsonBody(c, copyBackfillBody);
+        if (!options.resolveVerticalRef)
+            throw new ControlPlaneError(501, 'the copy backfill needs dispatch resolution by script');
+        return c.json(await backfillScopeScriptCopies({ admin: c.var.admin, actor: c.get('actor'), resolveRef: options.resolveVerticalRef }, body));
+    });
     // -- instances (K-31) -------------------------------------------------------
     // The one place this surface calls OUT rather than sitting over `HostAdmin`, and
     // it is unavoidable: only the vertical can create a usable scope DO, because the
@@ -5447,7 +5534,7 @@ export function createControlPlaneApi(options) {
                         message: e.message,
                     }, e);
                 }
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             }
             throw e;
         }
@@ -6598,6 +6685,7 @@ export function createControlPlaneApi(options) {
                 status: rejected ? 422 : 502,
                 message: detail,
             }, e);
+            c.set('failureRecorded', true);
             return rejected
                 ? c.json({ error: 'deploy rejected', detail }, 422)
                 : c.json({ error: 'deploy upload failed', detail }, 502);
@@ -7908,7 +7996,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError)
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             throw e;
         }
     });
@@ -7959,7 +8047,7 @@ export function createControlPlaneApi(options) {
         }
         catch (e) {
             if (e instanceof ControlPlaneError)
-                return c.json({ error: e.message }, e.status);
+                return c.json({ error: e.message }, failedWith(c, e));
             throw e;
         }
     });