@lambdacurry/arbor 0.13.7 → 0.13.8

package/dist/arbor.js

@@ -1847,7 +1847,7 @@ var apps = sqliteTable("apps", {
   stateMode: text("state_mode").$type().notNull(),
   stateIdentity: text("state_identity").notNull(),
   stateGeneration: integer("state_generation").notNull().default(0),
-  pendingStateResetId: text("pending_state_reset_id"),
+  pendingStateOperationId: text("pending_state_reset_id"),
   currentStateSchemaVersion: integer("current_state_schema_version").notNull().default(0),
   deploymentRevision: integer("deployment_revision").notNull().default(0),
   metadataRevision: integer("metadata_revision").notNull().default(0),
@@ -1897,6 +1897,19 @@ var appStateResets = sqliteTable("app_state_resets", {
   activeDeploymentId: text("active_deployment_id"),
   deploymentRevision: integer("deployment_revision"),
   targetStateSchemaVersion: integer("target_state_schema_version"),
+  recoveryBookmark: text("recovery_bookmark"),
+  recoveryExpiresAt: ts("recovery_expires_at"),
+  previousStateSchemaVersion: integer("previous_state_schema_version"),
+  restoreIdempotencyKey: text("restore_idempotency_key"),
+  restoredByProfileId: text("restored_by_profile_id").references(() => profiles.id),
+  restoreExecutionContextId: text("restore_execution_context_id").references(() => executionContexts.id),
+  restoreProviderReceipt: text("restore_provider_receipt", {
+    mode: "json"
+  }).$type(),
+  restoreFromGeneration: integer("restore_from_generation"),
+  restoreToGeneration: integer("restore_to_generation"),
+  restoreRequestedAt: ts("restore_requested_at"),
+  restoredAt: ts("restored_at"),
   createdAt: ts("created_at").notNull(),
   completedAt: ts("completed_at")
 }, (t) => ({
@@ -16983,6 +16996,7 @@ var MCP_OUTPUT_SCHEMAS = {
   }),
   app_set_access: app2,
   app_reset_state: exports_external.looseObject({ reset: jsonObject, replayed: exports_external.boolean() }),
+  app_restore_state: exports_external.looseObject({ reset: jsonObject, replayed: exports_external.boolean() }),
   app_archive: app2,
   charter: exports_external.looseObject({
     ok: exports_external.boolean().optional(),
@@ -17231,6 +17245,7 @@ var MCP_TOOL_ANNOTATIONS = {
   app_rollback: additive,
   app_set_access: additive,
   app_reset_state: destructiveIdempotent,
+  app_restore_state: destructiveIdempotent,
   app_archive: additive,
   charter: destructive,
   computer_open: additive,
@@ -18936,7 +18951,7 @@ var ACTION_DEFINITIONS = [
   {
     name: "app_reset_state",
     title: "Reset durable App state",
-    description: "Permanently delete one durable App facet's isolated SQLite database as an explicit attributed transition; deploying or rolling back never does this. Read app_get first, pass its expectedGeneration, and keep the same idempotencyKey across retries. A provider interruption leaves a visible pending intent that the same call resumes; do not change release or archive while pending.",
+    description: "Delete one durable App facet's isolated SQLite database as an explicit attributed transition after capturing a Cloudflare recovery point valid for 30 days. Only the App creator or an Org owner/admin may do this; deploying or rolling back never does. Read app_get first, pass its expectedGeneration, and keep the same idempotencyKey across retries. A provider interruption leaves a visible pending intent that the same call resumes; do not change release or archive while pending.",
     inputSchema: {
       appId: exports_external.string().describe("durable App, app_…"),
       expectedGeneration: exports_external.number().int().min(0).describe("state generation from app_get"),
@@ -18946,6 +18961,20 @@ var ACTION_DEFINITIONS = [
     toolset: "apps",
     run: forward("app.reset_state")
   },
+  {
+    name: "app_restore_state",
+    title: "Restore durable App state",
+    description: "Restore the latest completed durable-state reset from its automatic Cloudflare recovery point, discarding state written after that reset. Recovery is available for 30 days, only while that reset remains latest and its active release has not changed. Only the App creator or an Org owner/admin may do this. Read app_get first, pass the reset id and current generation, and keep the same idempotencyKey across retries.",
+    inputSchema: {
+      appId: exports_external.string().describe("durable App, app_…"),
+      resetId: exports_external.string().describe("latest recoverable reset from app_get, rst_…"),
+      expectedGeneration: exports_external.number().int().min(0).describe("state generation from app_get"),
+      idempotencyKey: exports_external.string().min(1).max(200).describe("stable key for this one deliberate recovery")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "apps",
+    run: forward("app.restore_state")
+  },
   {
     name: "app_archive",
     title: "Archive an App",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lambdacurry/arbor",
-  "version": "0.13.7",
+  "version": "0.13.8",
   "description": "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   "keywords": [
     "agents",