[Blocker] Missing member contract and revision lifecycle APIs block final Studio de-serviceId cleanup

[AbigailDeng]

Why this blocks frontend

PR #428 landed the backend member authority, roster, detail, binding, invoke, and runs routes. Studio frontend can now move most of Bind / Invoke / Observe to member-first requests.

The remaining blocker is that the frontend still cannot fully remove serviceId from the last contract/revision-management paths, because the backend still only exposes these capabilities on service routes.

Missing APIs

1. Member endpoint contract route

Current backend only exposes:

• GET /api/scopes/{scopeId}/services/{serviceId}/endpoints/{endpointId}/contract

What Studio still needs:

• GET /api/scopes/{scopeId}/members/{memberId}/endpoints/{endpointId}/contract

This should resolve the member-owned published service internally and then return the same contract payload shape the service route returns.

2. Member binding revision lifecycle routes

Current backend only exposes scope-default/service-oriented lifecycle routes such as:

• POST /api/scopes/{scopeId}/binding/revisions/{revisionId}:activate

Studio still needs member-first lifecycle routes so revision management can stay pinned to the selected member instead of leaking service-default semantics:

• POST /api/scopes/{scopeId}/members/{memberId}/binding/revisions/{revisionId}:activate
• POST /api/scopes/{scopeId}/members/{memberId}/binding/revisions/{revisionId}:retire

If the backend prefers a different member-first lifecycle shape, that is fine, but the key requirement is: frontend callers should not need to know or pass serviceId for these operations.

Current frontend impact

Without these APIs, Studio still has to keep a compatibility layer around:

• bind contract / request editor / invoke URL inspection still ultimately depends on service-based contract reads
• revision lifecycle operations cannot be made purely member-first
• the final serviceId cleanup in Studio routes/state cannot be completed cleanly

Acceptance criteria

• Backend provides a member-first endpoint contract route.
• Backend provides member-first revision lifecycle routes (activate and retire, or an equivalent member-first lifecycle contract).
• All routes resolve the member-owned published service internally.
• Response payloads stay stable with the existing service-route payload shapes where possible, so frontend migration is straightforward.

Related

• Durable refresh-safe Observe / implementation-agnostic run truth is tracked separately in [Blocker] Backend durable service-run registry blocking refresh-safe Studio Observe #429.
• This issue is intentionally narrower and only tracks the remaining member-first contract + revision API gap after PR feat(studio): member-first authority + bind orchestration (#325) #428.