@substrat-run/control-plane-api 0.163.0 → 0.164.0

package/dist/api.d.ts

@@ -1,7 +1,7 @@
 import type { ConnectionScopeBinding, ConnectionScopeBindingInput } from '@substrat-run/control-plane-client';
 import { Hono } from 'hono';
 import { type ConnectionCertificate, z, type ScopeStoreNeed, type StoreDriverRegistration } from '@substrat-run/contracts';
-import type { Connection, ConnectionActivity, ConnectionActivitySource, ConnectionCredential, ConnectionProbe, PlatformActorId } from '@substrat-run/contracts';
+import type { Connection, ConnectionActivity, ConnectionActivitySource, ConnectionCredential, ConnectionProbe, PlatformActorId, ScopeId, TenantId } from '@substrat-run/contracts';
 import type { CrossVerticalOptions, HostAdmin, OpsFailureInput, ScopeHost } from '@substrat-run/kernel';
 import type { PlatformActorAuth, BuilderAuth, Principal, TenantServiceAuth } from './auth.js';
 import { type VerticalClient } from './vertical-client.js';
@@ -9,7 +9,7 @@ import { type CopyJobs } from './copy-job.js';
 import type { PlatformScopeStores } from './platform-scope-stores.js';
 import type { ScopeStoreEnsurerOptions, StoreCanaryTarget } from './store-script.js';
 import { type CanaryCall, type StoreReleaseBytes } from './store-releases.js';
-import { type ConnectionCandidatePrepare } from './connection-relay.js';
+import { type ConnectionCandidatePrepare, type VerticalConnectorDeclarationOf } from './connection-relay.js';
 import type { DeployVerticalFn, FetchVerticalAssetFn, FetchVerticalModulesFn } from './deploy.js';
 import type { PatchScriptBindingsFn } from './wfp.js';
 import { type ObservabilityReader } from './observability.js';
@@ -349,6 +349,22 @@ export interface ControlPlaneApiOptions {
      * verify a Fortnox key yet" is a true statement; "your Fortnox key is fine" is not.
      */
     connectionInspectors?: Record<string, ConnectionInspector>;
+    /**
+     * The inspector for a vertical-defined provider (`<namespace>.<name>`, vertical-connectors.md
+     * §6.4), which `connectionInspectors` never names: built per (tenant, vertical), since its code
+     * runs in that vertical's deployment. Asked only for a dotted provider the record lacks. Absent,
+     * such a provider answers as an unregistered one does.
+     */
+    verticalConnectorInspector?: (provider: string, context: {
+        tenantId: TenantId;
+        vertical: string;
+        scopeId: ScopeId | null;
+    }) => ConnectionInspector | undefined;
+    /**
+     * A vertical-defined provider's serving declaration, which the tenant connection route grants
+     * from (`VerticalConnectorDeclarationOf`). Absent, that route refuses a dotted provider.
+     */
+    verticalConnectorDeclaration?: VerticalConnectorDeclarationOf;
     /**
      * Where this platform's compute actually runs — the coordinates a staff surface needs
      * to hand an operator a link INTO the provider's own console (the right script, the

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAE9G,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAsBL,KAAK,qBAAqB,EAqF1B,CAAC,EAeD,KAAK,cAAc,EAEnB,KAAK,uBAAuB,EAE7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAKV,UAAU,EACV,kBAAkB,EAGlB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAKf,eAAe,EAYhB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAoB,oBAAoB,EAAE,SAAS,EAAc,eAAe,EAAkC,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAoCtK,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA0J,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACnN,OAAO,EAEe,KAAK,QAAQ,EAClC,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAsB,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAE1F,OAAO,KAAK,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAErF,OAAO,EAAoF,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAOhK,OAAO,EAA+C,KAAK,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAqBrH,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EAGvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAkDtD,OAAO,EAAuE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEnI,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAuD,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAChH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAW1D,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAIL,KAAK,kBAAkB,EAExB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,6FAA6F;IAC7F,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,2BAA2B,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACxL,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAE1F,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAClG;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C;;;;;OAKG;IACH,YAAY,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAClD;;;;OAIG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B;kGAC8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;QAClC,uFAAuF;QACvF,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,gFAAgF;QAChF,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,WAAW,EAAE,wBAAwB,CAAC,aAAa,CAAC,CAAC;KAEtD,KAAK,OAAO,CAAC,IAAI,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3C;;;;OAIG;IACH,aAAa,CAAC,EAAE;QACd,KAAK,EAAE,iBAAiB,CAAC;QACzB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG;YAAE,WAAW,EAAE,wBAAwB,CAAC,aAAa,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACtJ,UAAU,EAAE,UAAU,CAAC;QACvB;;;WAGG;QACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,0EAA0E;QAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACxE;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;OAIG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IACV,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;;OAMG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2FAA2F;IAC3F,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,sGAAsG;IACtG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uGAAuG;IACvG,gBAAgB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAA;KAAE,CAAC;CACvF,CAAC;AA+FF,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAGxC,uFAAuF;AACvF,eAAO,MAAM,sBAAsB,QAEmC,CAAC;AAuWvE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAiI7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAmC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AA0KjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAwCD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAu6UhG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAE9G,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAsBL,KAAK,qBAAqB,EAqF1B,CAAC,EAeD,KAAK,cAAc,EAEnB,KAAK,uBAAuB,EAG7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAKV,UAAU,EACV,kBAAkB,EAGlB,wBAAwB,EACxB,oBAAoB,EAEpB,eAAe,EAKf,eAAe,EAKf,OAAO,EAMP,QAAQ,EACT,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAoB,oBAAoB,EAAE,SAAS,EAAc,eAAe,EAAkC,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAoCtK,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9F,OAAO,EAA0J,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACnN,OAAO,EAEe,KAAK,QAAQ,EAClC,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAsB,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAE1F,OAAO,KAAK,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAErF,OAAO,EAAoF,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAOhK,OAAO,EAA+C,KAAK,0BAA0B,EAAiC,KAAK,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAsBzL,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EAGvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAkDtD,OAAO,EAAuE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEnI,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAuD,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAChH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAW1D,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAIL,KAAK,kBAAkB,EAExB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,6FAA6F;IAC7F,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,2BAA2B,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACxL,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAE1F,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,KACtD,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAClG;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACjD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C;;;;;OAKG;IACH,YAAY,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAClD;;;;OAIG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B;kGAC8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;QAClC,uFAAuF;QACvF,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,gFAAgF;QAChF,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,WAAW,EAAE,wBAAwB,CAAC,aAAa,CAAC,CAAC;KAEtD,KAAK,OAAO,CAAC,IAAI,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3C;;;;OAIG;IACH,aAAa,CAAC,EAAE;QACd,KAAK,EAAE,iBAAiB,CAAC;QACzB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG;YAAE,WAAW,EAAE,wBAAwB,CAAC,aAAa,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACtJ,UAAU,EAAE,UAAU,CAAC;QACvB;;;WAGG;QACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,0EAA0E;QAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACxE;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,iBAAiB,CAAC;IAC9C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;OAIG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,KACvE,mBAAmB,GAAG,SAAS,CAAC;IACrC;;;OAGG;IACH,4BAA4B,CAAC,EAAE,8BAA8B,CAAC;IAC9D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,KAAK,IAAI,GAAG;IACV,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB;;;;;;OAMG;IACH,IAAI,EAAE,SAAS,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,SAAS,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2FAA2F;IAC3F,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,sGAAsG;IACtG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uGAAuG;IACvG,gBAAgB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAA;KAAE,CAAC;CACvF,CAAC;AA+GF,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAGxC,uFAAuF;AACvF,eAAO,MAAM,sBAAsB,QAEmC,CAAC;AAuWvE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBASzB,CAAC;AAqCH,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAiI7C,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAmC/C,KAAK,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AA0KjE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEvF;AAwCD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA8gVhG"}

package/dist/api.js

@@ -2,8 +2,9 @@ import { PREVIEW_CONNECTIONS_REFUSAL } from './connection-relay.js';
 import { connectionBindingOptions } from './connection-binding-options.js';
 import { resolveObservabilityWindow } from './observability-window.js';
 import { Hono } from 'hono';
-import { permissionKey, parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, lakeEventsInput, ownerTransferInput, memberInviteInput, memberRoleInput, ASSET_PART_PREFIX, assetHash, STORE_DRIVERS, STORE_RELEASE_MAX_BYTES, channelName, connectLinkId, connectionActivity, connectionActivitySource, connectionCredential, connectionCertificate, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, FINDINGS_LIMIT_DEFAULT, FINDINGS_LIMIT_MAX, findingCursorOf, findingKind, findingRuleInput, findingStatus, findingStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, rebindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, operationSeriesCount, operationSeriesInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, verticalSlug, scopeText, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, platformScriptCollision, platformScriptRefusal, PLATFORM_SCRIPT_NAMES, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, requestRollupReading, meterDaysReading, verticalOwnersReading, utcDay, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, validationIssuesFrom, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, substratError, errorCodeOf, capabilityFilterQuery, capabilityId as capabilityIdSchema, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, SOCIAL_RELAY_VERTICALS, } from '@substrat-run/contracts';
+import { permissionKey, parseHostname, withLabel, RESERVED_LABEL_SEPARATOR, adminAction, lakeEventsInput, ownerTransferInput, memberInviteInput, memberRoleInput, ASSET_PART_PREFIX, assetHash, STORE_DRIVERS, STORE_RELEASE_MAX_BYTES, channelName, connectLinkId, connectionActivity, connectionActivitySource, connectionCredential, connectionCertificate, connectionFilter, connectionHealthState, connectionProvider, connectorDispatchKind, PROVISION_SIBLING_KIND, ARCHIVE_SCOPE_KIND, PROVISION_TENANT_KIND, SET_ENTITLEMENTS_KIND, MODEL_USAGE_KIND, SWEEP_RUNS_KIND, toConnectionHealthEntry, CONNECTION_EXPIRY_WARNING_DAYS, CONNECTION_STALE_DAYS, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, errorCode, issueStatus, issueStatusInput, FINDINGS_LIMIT_DEFAULT, FINDINGS_LIMIT_MAX, findingCursorOf, findingKind, findingRuleInput, findingStatus, findingStatusInput, listPageQuery, matchesOutboundHost, pageOf, platformRequestFilter, principalId as principalIdSchema, impersonationStamp, promotionAcknowledgement, bindAcknowledgement, rebindAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, entityHistoryInput, eventFacetInput, eventCauseInput, eventEffectsInput, invocationEventsInput, deadLettersInput, lifecycleFlowInput, operationSeriesCount, operationSeriesInput, delegatedReadParams, createOrgInput, roleKey as roleKeySchema, peerSwitch, verticalSlug, scopeText, systemSwitch, DEFAULT_DENIAL_LIMIT, DENIAL_LIMIT_MAX, denialGroupBy, registerVerticalInput, platformScriptCollision, platformScriptRefusal, PLATFORM_SCRIPT_NAMES, serviceDimensions, sweepRunKind, sweepRunOutcome, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, requestRollupReading, meterDaysReading, verticalOwnersReading, utcDay, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, PROBLEM_CONTENT_TYPE, toProblem, validationIssuesFrom, redrainEventsInput, importCursorMove, importCursorAcknowledgementMissing, REDRAIN_BATCH, migrationsOnTop, substratError, errorCodeOf, capabilityFilterQuery, capabilityId as capabilityIdSchema, PLATFORM_FEATURES_HEADER, PLATFORM_FEATURE_SCOPE_SWEEPER, SOCIAL_RELAY_VERTICALS, isVerticalConnectorProvider, } from '@substrat-run/contracts';
 import { upstreamHandleIn, upstreamReferenceOf, withUpstreamReference } from '@substrat-run/contracts';
+import { ENGINE_ENTITLEMENT_KEYS, bareSlug, declarableEntitlementKey, entitlementNamespaceRefusal, grantableEntitlements } from '@substrat-run/contracts';
 import { SCOPE_COPY_LEASE_MS, copyRestoreFence, publishedMigrationDigest, replayStoreErasures } from '@substrat-run/kernel';
 import { attributeFailure } from './failure-attribution.js';
 import { auditedChange, withAuditedOutcomes } from './audited-change.js';
@@ -28,7 +29,7 @@ import { NON_PROBLEM_REFUSAL, coded, mapError, relayed } from './errors.js';
 import { maskDump, maskRecords } from './mask.js';
 import { createPseudonymizer } from './pseudonymize.js';
 import { openDump, sealDump } from './seal.js';
-import { assertSandboxContract, verticalUploadBindings, migrationsDigestBindings, deployManifest, storedDeployManifest, pushedOwnerGrantProblems, pushedModuleRegistryProblems, pushedPermissionRegistry, deploymentRefFor, stableDeploymentRefFor, nextMigrationTag, upstreamStatusOf, } from './deploy.js';
+import { assertSandboxContract, verticalUploadBindings, migrationsDigestBindings, deployManifest, storedDeployManifest, pushedOwnerGrantProblems, pushedConnectorProblems, pushedModuleRegistryProblems, pushedPermissionRegistry, deploymentRefFor, stableDeploymentRefFor, nextMigrationTag, upstreamStatusOf, } from './deploy.js';
 /**
  * Answer with a problem document (#113 phase 4).
  *
@@ -113,6 +114,18 @@ class ExportBreakRefused extends ControlPlaneError {
         this.breaks = breaks;
     }
 }
+/**
+ * #2577: a serve whose upload carried a DO-class migration, refused its record because another serve
+ * changed the serving row's class set or tag during the upload. The runtime's migration tag is now
+ * past the record's, so a re-serve diffed from the record names an `old_tag` the runtime refuses:
+ * promoting again cannot land, and the record needs repair.
+ */
+class ServeRecordBehindScript extends ControlPlaneError {
+    constructor(slug) {
+        super(409, `the serving record of '${slug}' changed while this serve's upload added a Durable Object class, so the ` +
+            "record's migration tag is behind the serving script's (#2577)");
+    }
+}
 /**
  * A carry whose source store kept changing between its export and its bind (#1722, Codex #2008
  * r12): every re-carry from a fresh export found the source changed again before it could bind.
@@ -2161,7 +2174,11 @@ export function createControlPlaneApi(options) {
             return refuse(c, 'validation_failed', 'body tenantId disagrees with the route tenant');
         }
         try {
-            return c.json(await relayConnectionUpsert(c.var.host, c.get('actor'), { ...body, tenantId }, { probeCandidate, prepareCandidate }));
+            return c.json(await relayConnectionUpsert(c.var.host, c.get('actor'), { ...body, tenantId }, {
+                probeCandidate,
+                prepareCandidate,
+                ...(options.verticalConnectorDeclaration ? { declarationOf: options.verticalConnectorDeclaration } : {}),
+            }));
         }
         catch (err) {
             if (err instanceof ConnectionRelayError && err.status < 500) {
@@ -2271,12 +2288,20 @@ export function createControlPlaneApi(options) {
      * exactly like an absent one — and revoked rows are excluded: a withdrawn credential
      * has no secret left to probe with, so "revoked" is a 404 for these reads too.
      */
+    /**
+     * The inspector for `provider`: the record's entry, else, for a vertical-defined provider, the one
+     * built for the vertical the connection belongs to (vertical-connectors.md §6.4).
+     */
+    const inspectorFor = (provider, context) => options.connectionInspectors?.[provider] ??
+        (isVerticalConnectorProvider(provider) ? options.verticalConnectorInspector?.(provider, context) : undefined);
+    /** {@link inspectorFor} for a connection row, which names its own tenant and vertical. */
+    const inspectorOf = (row) => inspectorFor(row.provider, { tenantId: row.tenantId, vertical: row.vertical, scopeId: null });
     /**
      * The connect-time gate (#605), as the relay consumes it: ask the provider about a
      * candidate credential, or answer `undefined` when this platform has no probe for it —
      * in which case the upsert behaves exactly as it always did, storing unverified.
      */
-    const probeCandidate = async (provider, secret) => options.connectionInspectors?.[provider]?.probeCandidate?.(secret);
+    const probeCandidate = async (provider, secret, context) => inspectorFor(provider, context)?.probeCandidate?.(secret);
     /** #2100: the provider's own half of a credential, made before the probe sees it. */
     const prepareCandidate = (provider) => options.connectionInspectors?.[provider]?.prepareCandidate;
     const inspectableConnection = async (c) => {
@@ -2292,7 +2317,7 @@ export function createControlPlaneApi(options) {
         const row = await inspectableConnection(c);
         if (!row)
             return refuse(c, 'not_found', 'unknown connection');
-        const read = options.connectionInspectors?.[row.provider]?.bindings;
+        const read = inspectorOf(row)?.bindings;
         if (!read)
             return refuseStatus(c, 501, `no scope binding registered for provider '${row.provider}'`);
         const bindings = await read(c.var.host, row);
@@ -2313,7 +2338,7 @@ export function createControlPlaneApi(options) {
         const row = await inspectableConnection(c);
         if (!row)
             return refuse(c, 'not_found', 'unknown connection');
-        const bind = options.connectionInspectors?.[row.provider]?.bindScope;
+        const bind = inspectorOf(row)?.bindScope;
         if (!bind)
             return refuseStatus(c, 501, `no scope binding registered for provider '${row.provider}'`);
         const scopeId = scopeIdSchema.parse(c.req.param('scopeId'));
@@ -2367,7 +2392,7 @@ export function createControlPlaneApi(options) {
         const row = await inspectableConnection(c);
         if (!row)
             return refuse(c, 'not_found', 'unknown connection');
-        const probe = options.connectionInspectors?.[row.provider]?.probe;
+        const probe = inspectorOf(row)?.probe;
         if (!probe) {
             return refuseStatus(c, 501, `no probe registered for provider '${row.provider}'`);
         }
@@ -2389,7 +2414,7 @@ export function createControlPlaneApi(options) {
         const row = await inspectableConnection(c);
         if (!row)
             return refuse(c, 'not_found', 'unknown connection');
-        const activity = options.connectionInspectors?.[row.provider]?.activity;
+        const activity = inspectorOf(row)?.activity;
         if (!activity) {
             return refuseStatus(c, 501, `no activity view registered for provider '${row.provider}'`);
         }
@@ -2410,7 +2435,7 @@ export function createControlPlaneApi(options) {
         const row = await inspectableConnection(c);
         if (!row)
             return refuse(c, 'not_found', 'unknown connection');
-        const credential = options.connectionInspectors?.[row.provider]?.credential;
+        const credential = inspectorOf(row)?.credential;
         if (!credential) {
             return refuseStatus(c, 501, `no credential view registered for provider '${row.provider}'`);
         }
@@ -2425,7 +2450,7 @@ export function createControlPlaneApi(options) {
         const row = await inspectableConnection(c);
         if (!row)
             return refuse(c, 'not_found', 'unknown connection');
-        const certificate = await options.connectionInspectors?.[row.provider]?.certificate?.(c.var.host, row);
+        const certificate = await inspectorOf(row)?.certificate?.(c.var.host, row);
         if (!certificate)
             return refuse(c, 'not_found', 'this connection signs in with no certificate');
         return c.json(connectionCertificate.parse(certificate));
@@ -5883,7 +5908,10 @@ export function createControlPlaneApi(options) {
     });
     // The write half of the governed pull (§8) — load a dump INTO an existing scope:
     // restore a backup, back out to a snapshot, or land a locally-built world on a
-    // hosted app. Staff-only like the export (not in BUILDER_ROUTES). No jurisdiction
+    // hosted app. Staff, and a tenant's own credential (TENANT_ROUTES, path-pinned): the
+    // dashboard's Import sends a file a team owner or admin uploaded (#2573), the dashboard
+    // asking that role, since this plane sees the credential, not the person. Builders are
+    // refused (not in BUILDER_ROUTES). The dump is input, judged on load. No jurisdiction
     // gate: this is ingress — the data ENTERS the scope's pinned region, it never
     // leaves one. Mirrors the export's delegation shape: the canonical `restoreScope`
     // writes the audit row (and the co-located bytes); when the scope's data lives in
@@ -5988,7 +6016,7 @@ export function createControlPlaneApi(options) {
             // A restore throw is driven by the caller-supplied dump (a shape the target cannot
             // load, a DDL the engine rejects), so DISCLOSE it as an actionable 422 rather than
             // collapsing to the generic 500 `internal error` mapError would produce (#321,
-            // secondary obs #2). The route is staff/owner-gated and the detail is about the
+            // secondary obs #2). The route is staff- or own-tenant-gated and the detail is about the
             // dump the caller sent, not another tenant's state.
             const detail = e instanceof Error ? e.message : String(e);
             return refuseStatus(c, 422, 'restore failed — the backup could not be loaded', { detail });
@@ -6743,6 +6771,8 @@ export function createControlPlaneApi(options) {
      * vertical stays owner-only, and so do the reads narrowed on purpose (migration SQL,
      * the prod history).
      */
+    /** The bare slug of every registered vertical: what a manager's SKU may not be (#2388). */
+    const verticalSlugsOf = async (actor) => (await host.admin.listVerticals(actor)).map((v) => bareSlug(v.slug));
     /**
      * Whether a CONFINED principal may grant its own tenant `key` (#977): some vertical it
      * can read — its own, or a listed one — declares the key, or is the vertical whose
@@ -6750,14 +6780,40 @@ export function createControlPlaneApi(options) {
      * (`installEntitlements`), checked here so a credential cannot grant what no install
      * would. Read through the configured host: a check audits nothing.
      */
+    /**
+     * The refusal for REGISTERING a vertical whose bare slug is a plan SKU a manager declares (#2388),
+     * so the manager's key does not change meaning under a later registration. A manager is a row that
+     * holds the tenant-provisioner capability or declares `provisions` (the capability is granted after
+     * the first push). Its own slug and the engine keys are always declarable, so they reserve nothing.
+     * Only a new slug is judged; the sentence names no other vertical.
+     */
+    const slugClaimsSku = async (actor, slug) => {
+        const all = await host.admin.listVerticals(actor);
+        if (all.some((v) => v.slug === slug))
+            return undefined;
+        const name = bareSlug(slug);
+        return all.some((v) => (v.tenantProvisioner || v.provisions?.length) &&
+            bareSlug(v.slug) !== name &&
+            !ENGINE_ENTITLEMENT_KEYS.includes(name) &&
+            v.entitlements?.includes(name))
+            ? `'${bareSlug(slug)}' is not available as a vertical name`
+            : undefined;
+    };
+    /** The declared keys of a registry row that an install may grant: a manager's include plan SKUs. */
+    const grantableOf = (v, slugs) => grantableEntitlements(v.slug, v.entitlements ?? [], v.tenantProvisioner ? slugs : undefined);
     const tenantGrantable = async (p, key) => {
         const pin = confinedTenant(p);
         if (pin === null)
             return true;
-        const visible = (await host.admin.listVerticals(p.actor)).filter((v) => v.ownerTenant === pin || v.listed);
-        return visible.some((v) => v.entitlements && v.entitlements.length > 0
-            ? v.entitlements.includes(key)
-            : (v.slug.split('/').pop() || v.slug) === key);
+        const all = await host.admin.listVerticals(p.actor);
+        const slugs = all.map((v) => bareSlug(v.slug));
+        const visible = all.filter((v) => v.ownerTenant === pin || v.listed);
+        return visible.some((v) => {
+            // The install's own derivation (`installEntitlements`): the declared keys the vertical may
+            // declare, else its bare slug.
+            const grantable = grantableOf(v, slugs);
+            return (grantable.length > 0 ? grantable : declarableEntitlementKey(v.slug, bareSlug(v.slug), v.tenantProvisioner ? slugs : undefined) ? [bareSlug(v.slug)] : []).includes(key);
+        });
     };
     const notReadable = async (p, slug) => {
         const pin = confinedTenant(p);
@@ -6834,7 +6890,13 @@ export function createControlPlaneApi(options) {
             ? all.filter((v) => v.ownerTenant === p.tenantId)
             : all.filter((v) => (ownerTenant === undefined || v.ownerTenant === ownerTenant) &&
                 (visibleTo === undefined || v.listed || v.ownerTenant === visibleTo));
-        return c.json(pageSlice(visible, page, (v) => v.slug));
+        // The install catalog (`visibleTo`) carries what an install may grant, not what a row declared
+        // before the namespace rule (#2388), so the dashboard's install and the grant paths agree.
+        const slugs = visibleTo === undefined || p.kind === 'builder' ? [] : all.map((v) => bareSlug(v.slug));
+        const rows = visibleTo === undefined || p.kind === 'builder'
+            ? visible
+            : visible.map((v) => (v.entitlements ? { ...v, entitlements: grantableOf(v, slugs) } : v));
+        return c.json(pageSlice(rows, page, (v) => v.slug));
     });
     // -- the service→dimensions resolver (#1231's last item) -----------------------
     // What a Cloudflare service ref MEANS: each owned vertical's serving script and
@@ -6939,6 +7001,15 @@ export function createControlPlaneApi(options) {
                 return refuse(c, 'forbidden', 'forbidden');
             input.ownerTenant = p.tenantId;
         }
+        const claimed = await slugClaimsSku(c.get('actor'), input.slug);
+        if (claimed)
+            return refuseStatus(c, 422, claimed);
+        // #2388: the same declaration rule as a push, for any principal that is not staff.
+        if (p.kind !== 'staff') {
+            const foreignKey = entitlementNamespaceRefusal(input.slug, input.entitlements ?? [], input.provisions?.length ? await verticalSlugsOf(c.get('actor')) : undefined);
+            if (foreignKey)
+                return refuseStatus(c, 422, foreignKey);
+        }
         await c.var.admin.registerVertical(c.get('actor'), input);
         // Idempotent on the slug (a conflicting re-register throws below the seam), so
         // read back rather than echo the request.
@@ -7009,6 +7080,9 @@ export function createControlPlaneApi(options) {
             const ownerGrants = pushedOwnerGrantProblems(checked.data);
             if (ownerGrants.length > 0)
                 return refuseManifest({ path: ['ownerGrants'], message: ownerGrants.join('; ') });
+            const connectorProblems = pushedConnectorProblems(checked.data);
+            if (connectorProblems.length > 0)
+                return refuseManifest({ path: ['connectors'], message: connectorProblems.join('; ') });
         }
         await c.var.admin.publishVersion(c.get('actor'), input);
         const version = await c.var.admin.getVersion(c.get('actor'), input.id, slug);
@@ -7488,6 +7562,11 @@ export function createControlPlaneApi(options) {
             : undefined);
         await recordWireUpload(admin, actor, versionId, wire);
         const addedClasses = serving ? doClasses.some((cls) => !serving.doClasses.includes(cls)) : false;
+        // #2577: `serving`'s class set and tag are what the upload's migration was diffed from, so the
+        // record lands only while the row still holds them; a serve that moved only the ref and version
+        // meanwhile is recorded over, as before. A refusal is not retried: the script already runs this
+        // upload. When a migration rode it, the runtime's tag is past the record's and a retry cannot land.
+        const migrated = !serving || addedClasses;
         await admin.setVerticalServing(actor, slug, {
             ref,
             versionId,
@@ -7500,6 +7579,8 @@ export function createControlPlaneApi(options) {
                     ? nextMigrationTag(serving.migrationTag)
                     : serving.migrationTag
                 : 'v1',
+        }, serving).catch((e) => {
+            throw migrated && errorCodeOf(e) === 'precondition_failed' ? new ServeRecordBehindScript(slug) : e;
         });
     };
     /**
@@ -7811,7 +7892,11 @@ export function createControlPlaneApi(options) {
                 // The serve, the adopt and the backfill reach every install of the vertical, whoever's, so
                 // what failed is withheld from a confined caller (#2540), and the tenant the backstop would
                 // have filed it under reads only the sentence.
-                const sentence = (reference) => `promoted, but the in-place serve failed — scopes still run the previous code; promote again to retry (reference ${reference})`;
+                // #2577: a serve refused after its upload already runs the new code, so neither says which code runs.
+                const sentence = (reference) => e instanceof ServeRecordBehindScript
+                    ? `promoted, but the in-place serve failed — another serve changed the serving record while this one ` +
+                        `added a Durable Object class, so promoting again cannot land until the record is repaired (reference ${reference})`
+                    : `promoted, but the in-place serve failed — promote again to retry (reference ${reference})`;
                 const withheld = withheldFailure(c, {
                     operation: 'promote.serve',
                     stage: 'serve-in-place',
@@ -7906,6 +7991,10 @@ export function createControlPlaneApi(options) {
         const ownerGrants = pushedOwnerGrantProblems(manifest);
         if (ownerGrants.length > 0)
             return refuse(c, 'validation_failed', `manifest ownerGrants: ${ownerGrants.join('; ')}`);
+        // vertical-connectors.md §7.1: a connector's standing grant is a declared, person-held key.
+        const connectorProblems = pushedConnectorProblems(manifest);
+        if (connectorProblems.length > 0)
+            return refuse(c, 'validation_failed', `manifest connectors: ${connectorProblems.join('; ')}`);
         // §4 sandbox contract, before anything reaches the namespace.
         assertSandboxContract(manifest, options.storeDrivers);
         // #2339: a push whose migration digest is not the one its migrations give is refused here,
@@ -8050,6 +8139,17 @@ export function createControlPlaneApi(options) {
         if (!modules.some((m) => m.name === manifest.entry)) {
             return refuse(c, 'validation_failed', `entry module '${manifest.entry}' is not among the uploaded files`);
         }
+        // #2388: a new version declares only keys its vertical may (its own, the engines', and those of
+        // the verticals it provisions). The capability is granted after a first push, so the declaration
+        // is judged here and honoured by the grant paths only for a tenant-provisioner. Earlier versions
+        // are not re-judged.
+        // Declaring `provisions` marks a manager: the capability itself is granted after a first push.
+        const foreignKey = entitlementNamespaceRefusal(slug, manifest.entitlements ?? [], manifest.provisions?.length ? await verticalSlugsOf(c.get('actor')) : undefined);
+        if (foreignKey)
+            return refuseStatus(c, 422, foreignKey);
+        const claimed = await slugClaimsSku(c.get('actor'), slug);
+        if (claimed)
+            return refuseStatus(c, 422, claimed);
         // The static-asset half of the §4 sandbox contract (self-serve-deploy.md §4.1). The
         // bytes are inert — no code, no authority — so they are ACCEPTED; the content-address
         // is not, so it is VERIFIED. The runtime's asset store dedups by hash across the whole
@@ -8179,6 +8279,9 @@ export function createControlPlaneApi(options) {
             ...(manifest.entitlements ? { entitlements: manifest.entitlements } : {}),
             ...(manifest.provides ? { provides: manifest.provides } : {}),
             ...(manifest.requires ? { requires: manifest.requires } : {}),
+            // The declared vertical-defined connectors (vertical-connectors.md §7.2): what the dashboard's
+            // door renders. The proxy never reads this copy; it reads the running version's manifest.
+            ...(manifest.connectors ? { connectors: manifest.connectors } : {}),
             // The declared provisioner intent (#455) — a REQUEST the console reviews; the
             // tenant-provisioner grant itself is never touched by a push. Refreshes on every
             // re-push like the rest of the install spec, exactly because it grants nothing.