@supacloud/cli 0.58.5 → 0.59.0

package/dist/index.js

@@ -206726,7 +206726,11 @@ var ACTION_POLICY = {
     write: ["send", "receive", "ack", "release", "fail", "retry", "delete_message", "update_settings"]
   },
   ai: { local: ["show_skill", "install_skill"] },
-  app: { local: ["init", "generate", "compile", "check", "graph", "explain", "export-tools", "context", "doctor", "fix"] },
+  app: {
+    local: ["init", "generate", "compile", "check", "graph", "explain", "export-tools", "context", "doctor", "fix", "plan", "build"],
+    read: ["status"],
+    write: ["upload", "configure", "deploy", "rollback", "reconcile", "retire"]
+  },
   db: { local: ["lint", "explain"], read: ["module_check"] },
   dev: { read: ["status"], write: ["sync", "watch", "migrate"] }
 };
@@ -221490,8 +221494,8 @@ function registerAiTools(server2) {
 
 // src/shared/tools/app-tools.ts
 import { existsSync as existsSync10 } from "node:fs";
-import { mkdir as mkdir4, readFile as readFile3, readdir as readdir4, writeFile as writeFile5 } from "node:fs/promises";
-import { basename as basename8, dirname as dirname9, join as join14, relative as relative7, resolve as resolve14 } from "node:path";
+import { mkdir as mkdir5, readFile as readFile4, readdir as readdir5, writeFile as writeFile5 } from "node:fs/promises";
+import { basename as basename8, dirname as dirname10, join as join14, relative as relative9, resolve as resolve14 } from "node:path";
 
 // node_modules/@supacloud/compiler/dist/index.js
 var ts7 = __toESM(require_typescript(), 1);
@@ -226886,18 +226890,29 @@ import { createHash as createHash7 } from "node:crypto";
 import { dirname as dirname22, relative as relative5, sep as sep5 } from "node:path";
 var ts6 = __toESM(require_typescript(), 1);
 var ts5 = __toESM(require_typescript(), 1);
+import { createHash as createHash62 } from "node:crypto";
 import { access as access2, readFile as readFile22 } from "node:fs/promises";
 import { join as join42 } from "node:path";
 import { existsSync as existsSync22, readFileSync as readFileSync22 } from "node:fs";
 import { dirname as dirname32, join as join32, relative as relative32, resolve as resolve22, sep as sep32 } from "node:path";
 var ts11 = __toESM(require_typescript(), 1);
+import { mkdir as mkdir3, mkdtemp, readFile as readFile5, realpath as realpath3, rename as rename3, rm as rm2 } from "node:fs/promises";
+import { readFileSync as readFileSync32 } from "node:fs";
+import { dirname as dirname7, join as join92, relative as relative7, resolve as resolve112, sep as sep7 } from "node:path";
+import { createHash as createHash72 } from "node:crypto";
+import { constants as constants2 } from "node:fs";
+import { lstat as lstat2, mkdir as mkdir22, open as open3, readFile as readFile3, readdir as readdir3, realpath as realpath4, rename as rename22, rm as rm3, writeFile as writeFile22 } from "node:fs/promises";
+import { dirname as dirname42, isAbsolute as isAbsolute4, join as join52, relative as relative52, resolve as resolve62, sep as sep52 } from "node:path";
+import { isAbsolute as isAbsolute22 } from "node:path";
 import { existsSync as existsSync32 } from "node:fs";
 import { dirname as dirname52, join as join62, relative as relative6, sep as sep6 } from "node:path";
 var ts10 = __toESM(require_typescript(), 1);
 var ts9 = __toESM(require_typescript(), 1);
+import { join as join72, resolve as resolve82 } from "node:path";
 var ts12 = __toESM(require_typescript(), 1);
+import { resolve as resolve102 } from "node:path";
 import { randomUUID } from "node:crypto";
-import { lstat as lstat2, readFile as readFile6, realpath as realpath4, rename as rename4, unlink as unlink2, writeFile as writeFile3 } from "node:fs/promises";
+import { lstat as lstat22, readFile as readFile6, realpath as realpath42, rename as rename4, unlink as unlink2, writeFile as writeFile3 } from "node:fs/promises";
 import { dirname as dirname8, isAbsolute as isAbsolute32, relative as relative8, resolve as resolve122, sep as sep8 } from "node:path";
 var ts13 = __toESM(require_typescript(), 1);
 import { existsSync as existsSync52 } from "node:fs";
@@ -239275,6 +239290,387 @@ function parseDeliveryOptions(value) {
   }
   return value;
 }
+function parseDeliveryPlanResult(value) {
+  if (!Check22(DeliveryPlanResultSchema2, value))
+    throw new Error("Invalid delivery plan result.");
+  return value;
+}
+var compare2 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var sorted = (values) => [...new Set(values)].sort(compare2);
+function diagnostic(error) {
+  return {
+    severity: error.severity,
+    code: error.code,
+    message: error.message,
+    ...error.file === undefined ? {} : { file: error.file },
+    ...error.line === undefined ? {} : { line: error.line },
+    ...error.suggestion === undefined ? {} : { suggestion: error.suggestion }
+  };
+}
+function createDeliveryPlan(graph, input) {
+  let options;
+  try {
+    options = parseDeliveryOptions(input);
+  } catch (error) {
+    if (!(error instanceof DeliveryConfigurationError))
+      throw error;
+    return { ok: false, plan: null, written: [], diagnostics: [{
+      severity: "error",
+      code: error.code,
+      message: error.message,
+      suggestion: "Use DeliveryOptionsSchema or defineSupacloudConfig({ delivery: ... })."
+    }] };
+  }
+  const diagnostics = [
+    ...(graph.diagnostics ?? []).map(diagnostic),
+    ...validateGraph(graph, { strict: true }).map(diagnostic)
+  ];
+  const fail = (code, message, suggestion) => {
+    diagnostics.push({ severity: "error", code, message, suggestion });
+  };
+  const modules = new Map(graph.modules.map((module) => [module.name, module]));
+  const declarations = new Map;
+  const httpOwners = new Map;
+  const jobOwners = new Map;
+  for (const target of [...options.targets ?? []].sort((a, b) => compare2(a.name, b.name))) {
+    if (declarations.has(target.name)) {
+      fail("delivery-duplicate-target", `Target "${target.name}" is declared more than once.`, "Give each target a unique name.");
+      continue;
+    }
+    declarations.set(target.name, target);
+    if (target.name === "api" && target.kind !== "api" || target.name === "jobs" && target.kind !== "jobs") {
+      fail("delivery-reserved-target", `"${target.name}" is reserved for its matching workload kind.`, "Rename the target or use the matching kind.");
+    }
+    for (const name of sorted(target.modules)) {
+      if (!modules.has(name)) {
+        fail("delivery-unknown-module", `Target "${target.name}" refers to unknown module "${name}".`, "Select a module name from the compiler graph.");
+        continue;
+      }
+      const owners = target.kind === "jobs" ? jobOwners : httpOwners;
+      const existing = owners.get(name);
+      if (existing !== undefined) {
+        fail("delivery-ownership-conflict", `Module "${name}" has competing ${target.kind === "jobs" ? "job" : "HTTP"} owners "${existing}" and "${target.name}".`, "Assign each module's HTTP routes and jobs to at most one target of each workload category.");
+      } else
+        owners.set(name, target.name);
+    }
+  }
+  const targets = new Map;
+  function getTarget(name, fallback) {
+    const existing = targets.get(name);
+    if (existing)
+      return existing;
+    const declaration = declarations.get(name);
+    const kind = declaration?.kind ?? fallback;
+    const isolation = declaration?.isolation ?? (kind === "jobs" ? "process" : "shared");
+    const target = {
+      name,
+      kind,
+      isolation,
+      roots: [],
+      modules: [],
+      routes: [],
+      jobs: [],
+      externalTokens: [],
+      requirements: {
+        processIsolation: isolation === "process",
+        durableQueue: kind === "jobs",
+        capabilities: sorted(declaration?.capabilities ?? [])
+      },
+      runtimeStatus: options.runtime === undefined ? "unchecked" : "declared-compatible"
+    };
+    targets.set(name, target);
+    return target;
+  }
+  const publicRoutes = new Map;
+  const publicJobs = new Map;
+  for (const module of [...graph.modules].sort((a, b) => compare2(a.name, b.name))) {
+    for (const controller of module.controllers) {
+      for (const route of controller.routes) {
+        const owner = httpOwners.get(module.name);
+        const target = getTarget(owner ?? "api", "api");
+        const path = joinRoutePaths(controller.path, route.path);
+        const key = `${route.method} ${path.replace(/:[^/]+/g, ":param")}`;
+        const existing = publicRoutes.get(key);
+        if (existing !== undefined) {
+          fail("delivery-route-conflict", `Public route "${key}" is owned by both "${existing}" and "${target.name}".`, "Give public routes unambiguous method/path contracts before splitting targets.");
+        }
+        publicRoutes.set(key, target.name);
+        target.roots.push(module.name);
+        target.routes.push({
+          module: module.name,
+          controller: controller.className,
+          handler: route.handler,
+          method: route.method,
+          path,
+          ...route.command === undefined ? {} : { command: route.command },
+          reason: owner === undefined ? "default-http" : "explicit-module"
+        });
+      }
+    }
+    for (const job of module.jobs ?? []) {
+      const owner = jobOwners.get(module.name);
+      const target = getTarget(owner ?? "jobs", "jobs");
+      if (publicJobs.has(job.name)) {
+        fail("delivery-job-conflict", `Job "${job.name}" is declared more than once.`, "Use globally unique job names.");
+      }
+      publicJobs.set(job.name, target.name);
+      target.roots.push(module.name);
+      target.jobs.push({
+        module: module.name,
+        name: job.name,
+        className: job.className,
+        serviceKey: job.serviceKey,
+        reason: owner === undefined ? "declared-job" : "explicit-module"
+      });
+    }
+  }
+  for (const declaration of declarations.values()) {
+    if (!targets.has(declaration.name)) {
+      fail("delivery-empty-target", `Target "${declaration.name}" owns no ${declaration.kind === "jobs" ? "jobs" : "HTTP routes"}.`, "Select modules containing the intended workload or remove the target declaration.");
+    }
+  }
+  if (targets.size === 0 && declarations.size === 0)
+    getTarget("api", "api");
+  for (const target of targets.values()) {
+    let visit = function(name) {
+      if (visiting.has(name)) {
+        fail("delivery-import-cycle", `Target "${target.name}" contains an import cycle at "${name}".`, "Remove cyclic module imports.");
+        return;
+      }
+      if (closure.has(name))
+        return;
+      const module = modules.get(name);
+      if (!module) {
+        fail("delivery-missing-import", `Target "${target.name}" requires missing module "${name}".`, "Declare or correct the imported module.");
+        return;
+      }
+      visiting.add(name);
+      for (const imported of sorted(module.imports))
+        visit(imported);
+      visiting.delete(name);
+      closure.set(name, module);
+    };
+    target.roots = sorted(target.roots);
+    const closure = new Map;
+    const visiting = new Set;
+    for (const root of target.roots)
+      visit(root);
+    target.modules = sorted(closure.keys()).map((name) => ({
+      name,
+      reason: target.roots.includes(name) ? "owner" : "dependency",
+      importedBy: sorted([...closure.values()].filter((module) => module.imports.includes(name)).map((module) => module.name))
+    }));
+    const dependencies = new Set([...closure.values()].flatMap((module) => [
+      ...module.providers.flatMap((provider) => provider.deps),
+      ...module.controllers.flatMap((controller) => controller.deps)
+    ]));
+    target.externalTokens = sorted(graph.externalTokens.filter((token) => dependencies.has(token)));
+    target.routes.sort((a, b) => compare2(JSON.stringify(a), JSON.stringify(b)));
+    target.jobs.sort((a, b) => compare2(JSON.stringify(a), JSON.stringify(b)));
+    const runtime = options.runtime;
+    if (target.requirements.durableQueue && runtime?.durableQueue !== true) {
+      fail("delivery-queue-required", `Target "${target.name}" requires a declared durable queue.`, "Configure a durable queue adapter and declare runtime.durableQueue; do not run jobs in an HTTP background Promise.");
+    }
+    if (target.requirements.processIsolation && runtime?.processIsolation !== true) {
+      fail("delivery-isolation-required", `Target "${target.name}" requires declared process isolation.`, "Select a process-isolated host and declare runtime.processIsolation. A Worker or function name alone is insufficient.");
+    }
+    for (const capability of target.requirements.capabilities) {
+      if (!runtime?.capabilities.includes(capability)) {
+        fail("delivery-capability-required", `Target "${target.name}" requires capability reference "${capability}".`, "Configure the named adapter or credential boundary and declare its reference, never its secret value.");
+      }
+    }
+  }
+  const canonicalDiagnostics = [...new Map(diagnostics.map((item) => [JSON.stringify(item), item])).values()].sort((a, b) => compare2(JSON.stringify(a), JSON.stringify(b)));
+  if (canonicalDiagnostics.some((item) => item.severity === "error")) {
+    return parseDeliveryPlanResult({ ok: false, plan: null, diagnostics: canonicalDiagnostics, written: [] });
+  }
+  const topology = {
+    schemaVersion: 1,
+    policyVersion: "module-workload-v1",
+    digestScope: "topology-only",
+    deploymentReady: false,
+    targets: [...targets.values()].sort((a, b) => compare2(a.name, b.name))
+  };
+  const topologyDigest = createHash62("sha256").update(JSON.stringify(topology)).digest("hex");
+  return parseDeliveryPlanResult({
+    ok: true,
+    plan: { ...topology, topologyDigest },
+    diagnostics: canonicalDiagnostics,
+    written: []
+  });
+}
+async function planDeliveryProject(options, delivery) {
+  try {
+    parseDeliveryOptions(delivery);
+  } catch (error) {
+    if (!(error instanceof DeliveryConfigurationError))
+      throw error;
+    return createDeliveryPlan({ modules: [], externalTokens: [] }, delivery);
+  }
+  const checked = await checkProject(options);
+  return createDeliveryPlan({ ...checked.graph, diagnostics: checked.diagnostics }, delivery);
+}
+function formatDeliveryPlan(result) {
+  const lines = result.ok ? [
+    `DELIVERY PLAN ${result.plan.topologyDigest}`,
+    "Preview only: topology digest is not a build hash or deployment approval.",
+    ...result.plan.targets.flatMap((target) => [
+      `${target.name} (${target.kind}, ${target.isolation}): ${target.routes.length} route(s), ${target.jobs.length} job(s)`,
+      `  modules: ${target.modules.map((module) => module.name).join(", ") || "-"}`,
+      ...target.routes.map((route) => `  ${route.method} ${route.path} [${route.reason}]`),
+      ...target.jobs.map((job) => `  job ${job.name} [${job.reason}]`)
+    ])
+  ] : ["Delivery planning failed; no files written."];
+  return [...lines, ...result.diagnostics.map((item) => `${item.severity} ${item.code}: ${item.message}`)].join(`
+`);
+}
+var digest3 = (value) => createHash72("sha256").update(value).digest("hex");
+function canonical22(value) {
+  return JSON.stringify(value, (_key, item) => item !== null && typeof item === "object" && !Array.isArray(item) ? Object.fromEntries(Object.entries(item).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) : item);
+}
+function inside2(parent, path) {
+  const part = relative52(parent, path);
+  return !isAbsolute4(part) && part !== ".." && !part.startsWith(`..${sep52}`);
+}
+async function exists2(path) {
+  try {
+    await lstat2(path);
+    return true;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT")
+      return false;
+    throw error;
+  }
+}
+async function noLinks2(anchor, path) {
+  if (!inside2(anchor, path))
+    throw new Error("Delivery path escapes its owned root.");
+  let current = anchor;
+  for (const part of relative52(anchor, path).split(sep52).filter(Boolean)) {
+    current = join52(current, part);
+    if (!await exists2(current))
+      continue;
+    if ((await lstat2(current)).isSymbolicLink())
+      throw new Error("Delivery paths cannot contain symbolic links.");
+  }
+}
+async function readOwned(anchor, path) {
+  await noLinks2(anchor, path);
+  const stat = await lstat2(path);
+  if (!stat.isFile())
+    throw new Error("Expected a regular delivery input or artifact.");
+  return readFile3(path);
+}
+async function readBoundedOwned2(root, path, maximum) {
+  await noLinks2(root, path);
+  const file = await open3(path, constants2.O_RDONLY | constants2.O_NONBLOCK | constants2.O_NOFOLLOW);
+  try {
+    const stat = await file.stat();
+    if (!stat.isFile() || stat.size > maximum)
+      throw new Error("Invalid artifact size.");
+    const buffer = Buffer.alloc(stat.size + 1);
+    let length = 0;
+    while (length < buffer.length) {
+      const { bytesRead } = await file.read(buffer, length, buffer.length - length, length);
+      if (bytesRead === 0)
+        break;
+      length += bytesRead;
+    }
+    if (length !== stat.size)
+      throw new Error("Artifact changed while reading.");
+    return buffer.subarray(0, length);
+  } finally {
+    await file.close();
+  }
+}
+async function reserveOutput(project, requested) {
+  if (!inside2(project, requested))
+    throw new Error("Delivery output must be inside the application project.");
+  const base = await realpath4(project);
+  const path = resolve62(base, relative52(project, requested));
+  if (relative52(base, path).split(sep52).some((part) => part === ".git" || part === "node_modules")) {
+    throw new Error("Delivery output cannot use repository or dependency internals.");
+  }
+  await noLinks2(base, path);
+  await mkdir22(path, { recursive: true });
+  const marker = join52(path, "owner.json");
+  const owner = canonical22({ producer: "@supacloud/compiler/delivery-build-v1", project: base });
+  if (!await exists2(marker)) {
+    if ((await readdir3(path)).length > 0)
+      throw new Error("Refusing to adopt an unowned delivery directory.");
+    await writeFile22(marker, owner, { flag: "wx" });
+  } else if (new TextDecoder().decode(await readOwned(base, marker)) !== owner) {
+    throw new Error("Delivery output is owned by a different project or producer.");
+  }
+  const lockPath = join52(path, "build.lock");
+  await noLinks2(base, lockPath);
+  const lock = await open3(lockPath, "wx");
+  return {
+    path,
+    async release() {
+      await lock.close();
+      await rm3(lockPath);
+    }
+  };
+}
+async function writeArtifact(root, path, content) {
+  if (!Check22(DeliveryFilePathSchema2, path))
+    throw new Error("Invalid artifact path.");
+  const destination = join52(root, path);
+  await noLinks2(root, destination);
+  await mkdir22(dirname42(destination), { recursive: true });
+  await writeFile22(destination, content, { flag: "wx" });
+}
+async function artifactInventory(root) {
+  const files = [];
+  async function visit(directory) {
+    for (const entry of await readdir3(directory, { withFileTypes: true })) {
+      const path = join52(directory, entry.name);
+      if (entry.isSymbolicLink())
+        throw new Error("Artifact contains a symbolic link.");
+      if (entry.isDirectory())
+        await visit(path);
+      else {
+        const content = await readOwned(root, path);
+        files.push({ path: relative52(root, path).split(sep52).join("/"), sha256: digest3(content), bytes: content.length });
+      }
+    }
+  }
+  await visit(root);
+  return files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+}
+async function sourceInventory(root, output) {
+  const inputs = new Map;
+  async function visit(directory) {
+    for (const entry of await readdir3(directory, { withFileTypes: true })) {
+      const path = join52(directory, entry.name);
+      if (inside2(output, path) || entry.name === "node_modules" || entry.name === ".git")
+        continue;
+      if (entry.isDirectory())
+        await visit(path);
+      else if (/\.(?:[cm]?[jt]sx?|json)$/.test(entry.name)) {
+        inputs.set(path, digest3(await readOwned(root, path)));
+      }
+    }
+  }
+  await visit(root);
+  return inputs;
+}
+async function publishPointer(root, content) {
+  const path = join52(root, "delivery.manifest.json");
+  if (await exists2(path) && new TextDecoder().decode(await readOwned(root, path)) === content)
+    return false;
+  const temporary = join52(root, "delivery.manifest.pending");
+  await noLinks2(root, path);
+  await noLinks2(root, temporary);
+  await writeFile22(temporary, content, { flag: "wx" });
+  try {
+    await rename22(temporary, path);
+  } finally {
+    await rm3(temporary, { force: true });
+  }
+  return true;
+}
 var closed2 = { additionalProperties: false };
 var digest22 = String22({ pattern: "^[a-f0-9]{64}$" });
 var DeliveryObjectSchema2 = _Object_3({
@@ -239328,6 +239724,45 @@ var DeliveryBuildResultSchema2 = Union4([
     manifest: Null3()
   }, closed2)
 ]);
+function deliveryObjectDigest2(object) {
+  return digest3(canonical22({
+    inputDigest: object.inputDigest,
+    files: object.files,
+    ...object.entryKind !== "compiled-module-factory" ? { entryKind: object.entryKind } : {}
+  }));
+}
+function parseDeliveryBuildManifest2(value) {
+  if (!Check22(DeliveryBuildManifestSchema2, value))
+    throw new Error("Invalid delivery build manifest.");
+  if (new Set(value.objects.map((item) => item.name)).size !== value.objects.length) {
+    throw new Error("Duplicate delivery object owner.");
+  }
+  if (canonical22(value.objects.map((item) => item.name).sort()) !== canonical22(value.plan.targets.map((item) => item.name).sort())) {
+    throw new Error("Delivery objects do not match planned targets.");
+  }
+  for (const object of value.objects) {
+    const target = value.plan.targets.find((target) => target.name === object.name);
+    if (object.entryKind === "bun-worker-application" && target?.kind !== "jobs" || object.entryKind === "bun-http-application" && target?.kind === "jobs") {
+      throw new Error("Delivery executable kind does not match its target.");
+    }
+    if (new Set(object.files.map((file) => file.path)).size !== object.files.length || !object.files.some((file) => file.path === object.entrypoint) || deliveryObjectDigest2(object) !== object.objectId) {
+      throw new Error("Invalid delivery object inventory.");
+    }
+  }
+  const routes = value.plan.targets.flatMap((target) => target.routes.map((route) => ({ method: route.method, path: route.path, target: target.name })));
+  const jobs = value.plan.targets.flatMap((target) => target.jobs.map((job) => ({ name: job.name, target: target.name })));
+  if (canonical22(value.routes) !== canonical22(routes) || canonical22(value.jobs) !== canonical22(jobs)) {
+    throw new Error("Delivery mappings do not match planned ownership.");
+  }
+  return value;
+}
+function parseDeliveryBuildResult(value) {
+  if (!Check22(DeliveryBuildResultSchema2, value))
+    throw new Error("Invalid delivery build result.");
+  if (value.ok)
+    parseDeliveryBuildManifest2(value.manifest);
+  return value;
+}
 init_generate();
 var Metrics22 = {
   assign: 0,
@@ -244749,6 +245184,7 @@ var SnapshotSchema = _Object_22({
     }, closed22))
   }, closed22))
 }, closed22);
+var EXECUTION_SNAPSHOT_MAX_BYTES = 1048576;
 var indices = _Array_22(Integer32({ minimum: 0 }));
 var WireSnapshotSchema = _Object_22({
   version: Literal22(1),
@@ -244765,6 +245201,144 @@ var WireSnapshotSchema = _Object_22({
     diagnostics: indices
   }, closed22))
 }, closed22);
+function executionSourceFile(file) {
+  if (!file || isAbsolute22(file) || /^[A-Za-z][A-Za-z0-9+.-]*:/.test(file) || file.startsWith("\\") || file.split(/[\\/]/).includes("..") || file.length > 512 || /[\u0000-\u001f\u007f]/.test(file))
+    return;
+  return file;
+}
+function createExecutionSnapshot(graph, subjects = graph.modules.map((module) => module.name)) {
+  return {
+    version: 1,
+    plans: createExecutionPlans(graph),
+    commandAliases: graph.modules.flatMap((module) => module.commands.map((command) => ({ module: module.name, name: command.name, alias: command.className }))),
+    contexts: subjects.map((subject) => {
+      const context = createContextPack(graph, subject);
+      const owner = graph.modules.find((module) => module.name === context.subject);
+      return {
+        subject: context.subject,
+        aliases: [...new Set([
+          owner.className,
+          ...owner.providers.flatMap((provider) => [provider.token, ...provider.useClass ? [provider.useClass] : []]),
+          ...owner.controllers.map((controller) => controller.className),
+          ...owner.commands.flatMap((command) => [command.name, command.className]),
+          ...(owner.jobs ?? []).flatMap((job) => [job.name, job.className, job.serviceKey]),
+          ...owner.queries.flatMap((query) => [query.name, query.className])
+        ])],
+        modules: context.modules.map((module) => ({
+          name: module.name,
+          ...executionSourceFile(module.file) ? { file: executionSourceFile(module.file) } : {}
+        })),
+        files: context.files,
+        diagnostics: context.diagnostics.map((diagnostic) => {
+          const repair = createDiagnosticRepairPlan([diagnostic])[0];
+          const file = executionSourceFile(diagnostic.file);
+          return {
+            code: diagnostic.code,
+            severity: diagnostic.severity,
+            ...file ? { file } : {},
+            ...Number.isSafeInteger(diagnostic.line) && diagnostic.line > 0 ? { line: diagnostic.line } : {},
+            ...repair ? { repair: { type: repair.type, readiness: repair.readiness } } : {}
+          };
+        })
+      };
+    })
+  };
+}
+function parseExecutionSnapshot(value) {
+  if (!Check42(WireSnapshotSchema, value))
+    throw new Error("Invalid execution snapshot.");
+  function select(table, indices) {
+    return indices.map((index) => {
+      const item = table[index];
+      if (item === undefined)
+        throw new Error("Invalid execution snapshot reference.");
+      return item;
+    });
+  }
+  const expanded = {
+    version: value.version,
+    plans: value.plans,
+    commandAliases: value.commandAliases,
+    contexts: value.contexts.map((context) => ({
+      subject: context.subject,
+      aliases: context.aliases,
+      modules: select(value.modules, context.modules),
+      files: select(value.files, context.files),
+      diagnostics: select(value.diagnostics, context.diagnostics)
+    }))
+  };
+  if (new Set(expanded.contexts.map((context) => context.subject)).size !== expanded.contexts.length || expanded.contexts.some((context) => [
+    ...context.files,
+    ...context.modules.flatMap((module) => module.file ?? []),
+    ...context.diagnostics.flatMap((diagnostic) => diagnostic.file ?? [])
+  ].some((file) => executionSourceFile(file) !== file))) {
+    throw new Error("Invalid execution snapshot.");
+  }
+  return expanded;
+}
+function dictionary() {
+  const values = [];
+  const indices = new Map;
+  return {
+    values,
+    add(value) {
+      const key = JSON.stringify(value);
+      const found = indices.get(key);
+      if (found !== undefined)
+        return found;
+      const index = values.length;
+      indices.set(key, index);
+      values.push(value);
+      return index;
+    }
+  };
+}
+function serializedExecutionSnapshot(graph) {
+  const snapshot = createExecutionSnapshot(graph);
+  const modules = dictionary();
+  const files = dictionary();
+  const diagnostics = dictionary();
+  const contexts = snapshot.contexts.map((context) => ({
+    subject: context.subject,
+    aliases: context.aliases,
+    modules: context.modules.map((module) => modules.add(module)),
+    files: context.files.flatMap((file) => executionSourceFile(file) ?? []).map((file) => files.add(file)),
+    diagnostics: context.diagnostics.map((diagnostic) => diagnostics.add(diagnostic))
+  }));
+  const wire = {
+    version: 1,
+    plans: snapshot.plans,
+    commandAliases: snapshot.commandAliases,
+    modules: modules.values,
+    files: files.values,
+    diagnostics: diagnostics.values,
+    contexts
+  };
+  const json = JSON.stringify(wire);
+  if (Buffer.byteLength(json, "utf8") > EXECUTION_SNAPSHOT_MAX_BYTES)
+    throw new Error("Execution snapshot exceeds byte budget.");
+  parseExecutionSnapshot(wire);
+  return json;
+}
+function renderDeliveryTarget(graph, target, options) {
+  const included = new Set(target.modules.map((module) => module.name));
+  const projected = {
+    ...graph,
+    modules: graph.modules.filter((module) => included.has(module.name)).map((module) => ({
+      ...module,
+      controllers: module.controllers.map((controller) => ({
+        ...controller,
+        routes: controller.routes.filter((route) => target.routes.some((owned) => owned.module === module.name && owned.controller === controller.className && owned.handler === route.handler && owned.method === route.method && owned.path === joinRoutePaths(controller.path, route.path)))
+      })),
+      jobs: (module.jobs ?? []).filter((job) => target.jobs.some((owned) => owned.module === module.name && owned.name === job.name && owned.className === job.className))
+    })),
+    externalTokens: target.externalTokens
+  };
+  return {
+    ...renderApplication(projected, { ...options, treeShakeUnusedProviders: false }),
+    executionSnapshot: serializedExecutionSnapshot(projected)
+  };
+}
 var closed3 = { additionalProperties: false };
 var requestSchema = _Object_22({
   parentPid: Integer32({ minimum: 1 }),
@@ -244783,6 +245357,66 @@ var responseSchema2 = Union22([
   }, closed3),
   _Object_22({ ok: Literal22(false) }, closed3)
 ]);
+function parseDeliveryBundleResponse(input) {
+  if (!Check42(responseSchema2, input))
+    throw new Error("Invalid isolated bundle response.");
+  return input;
+}
+async function bundleDeliveryTarget(name, code, project, generatedDirectory, options) {
+  const worker = join72(import.meta.dir, `delivery-bundle-worker.${import.meta.path.endsWith(".ts") ? "ts" : "js"}`);
+  const environment = {};
+  for (const name of ["PATH", "HOME", "TMPDIR", "TMP", "TEMP", "SystemRoot"]) {
+    const value = process.env[name];
+    if (value !== undefined)
+      environment[name] = value;
+  }
+  const child = Bun.spawn([process.execPath, "--no-env-file", worker], {
+    cwd: project,
+    env: environment,
+    stdin: "pipe",
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  let interrupted = false;
+  const terminate = () => {
+    interrupted = true;
+    child.kill("SIGTERM");
+  };
+  process.on("SIGINT", terminate);
+  process.on("SIGTERM", terminate);
+  const timeout = setTimeout(() => {
+    interrupted = true;
+    child.kill("SIGKILL");
+  }, 300000);
+  try {
+    const request = { parentPid: process.pid, name, code, project, generatedDirectory, options };
+    child.stdin.write(JSON.stringify(request));
+    child.stdin.end();
+    const [stdout, , status] = await Promise.all([
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+      child.exited
+    ]);
+    if (interrupted || status !== 0)
+      throw new Error("Isolated delivery bundle failed.");
+    const response = parseDeliveryBundleResponse(JSON.parse(stdout));
+    if (!response.ok)
+      throw new Error("Isolated delivery bundle failed.");
+    return {
+      files: new Map(response.files.map(([path, bytes]) => [path, new Uint8Array(Buffer.from(bytes, "base64"))])),
+      inputs: new Map(response.inputs),
+      runtimeImports: response.runtimeImports
+    };
+  } finally {
+    clearTimeout(timeout);
+    process.removeListener("SIGINT", terminate);
+    process.removeListener("SIGTERM", terminate);
+    if (child.exitCode === null) {
+      child.kill("SIGKILL");
+      await child.exited;
+    }
+  }
+}
 var ApplicationIdSchema3 = String22({ pattern: "^[A-Za-z0-9_-]{1,64}$" });
 var ApplicationReleaseIdSchema3 = String22({ pattern: "^[a-f0-9]{64}$" });
 var ApplicationReleaseRecordSchema3 = _Object_3({
@@ -244876,6 +245510,7 @@ var ApplicationActivationRetirementResultSchema3 = _Object_3({
   activation_id: ApplicationActivationIdSchema3,
   retired_at: String22()
 }, { additionalProperties: false });
+var APPLICATION_RUNTIME_PROBE_PATH2 = "/.well-known/supacloud/runtime";
 var ApplicationRuntimeIdentitySchema2 = _Object_3({
   schema: Literal3("supacloud.application-runtime.v1"),
   project_ref: String22({ pattern: "^[a-z0-9-]{1,20}$" }),
@@ -244930,13 +245565,627 @@ var archiveSchema2 = _Object_3({
   dataRecovery: Literal3("separate-required"),
   migrations: _Array_2(entrySchema2, { minItems: 1, maxItems: 128 })
 }, { additionalProperties: false });
+function renderDeliveryRuntimeIdentity() {
+  return `
+function deliveryRuntimeIdentity(kind: "http" | "worker") {
+  const env = deliveryProcess.env;
+  if (env.SUPACLOUD_ACTIVATION_ID === undefined) return null;
+  const identity = {
+    schema: "supacloud.application-runtime.v1",
+    project_ref: env.SUPACLOUD_PROJECT_REF,
+    application_id: env.SUPACLOUD_APPLICATION_ID,
+    environment_id: env.SUPACLOUD_ENVIRONMENT_ID,
+    release_id: env.SUPACLOUD_RELEASE_ID,
+    activation_id: env.SUPACLOUD_ACTIVATION_ID,
+    target: env.SUPACLOUD_TARGET,
+    object_id: env.SUPACLOUD_OBJECT_ID,
+    kind, pid: deliveryProcess.pid,
+  };
+  const matches = (value: string | undefined, pattern: RegExp) => typeof value === "string" && pattern.test(value);
+  if (!matches(identity.project_ref, /^[a-z0-9-]{1,20}$/)
+    || !matches(identity.application_id, /^[A-Za-z0-9_-]{1,64}$/)
+    || !matches(identity.environment_id, /^[A-Za-z0-9_-]{1,64}$/)
+    || !matches(identity.release_id, /^[a-f0-9]{64}$/)
+    || !matches(identity.activation_id, /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/)
+    || !matches(identity.target, /^[a-z][a-z0-9-]{0,62}$/)
+    || !matches(identity.object_id, /^[a-f0-9]{64}$/)) throw new Error("Invalid managed runtime identity.");
+  return identity;
+}
+`;
+}
+function renderDeliveryHttpEntry(generatedDirectory, hostPath) {
+  const specifier = relativeImportPath(generatedDirectory, hostPath);
+  return `
+import { serve as serveDeliveryHttp } from "bun";
+import deliveryProcess from "node:process";
+import { createDeliveryApplication } from ${JSON.stringify(specifier)};
+${renderDeliveryRuntimeIdentity()}
+
+interface DeliveryHttpHost {
+  fetch(request: Request): Response | Promise<Response>;
+  close(): void | Promise<void>;
+  ready?(): boolean | Promise<boolean>;
+}
+
+async function startDeliveryHttp(signal: AbortSignal, shutdownTimeout: number, startDeadline: () => void) {
+  const identity = deliveryRuntimeIdentity("http");
+  const port = Number(deliveryProcess.env.PORT ?? "3000");
+  const hostname = deliveryProcess.env.HOST ?? "127.0.0.1";
+  if (!Number.isInteger(port) || port < 0 || port > 65535 || hostname.length === 0) {
+    throw new Error("Invalid delivery HTTP listener configuration.");
+  }
+  const createHost: (
+    modules: ReturnType<typeof createCompiledModules>, lifecycle: { signal: AbortSignal },
+  ) => DeliveryHttpHost | Promise<DeliveryHttpHost> = createDeliveryApplication;
+  const host = await createHost(createCompiledModules(), { signal });
+  if (!host || typeof host.close !== "function") {
+    throw new Error("Invalid delivery HTTP host.");
+  }
+  let closing: Promise<void> | undefined;
+  const closeHost = () => {
+    startDeadline();
+    return closing ??= Promise.resolve().then(() => host.close());
+  };
+  if (typeof host.fetch !== "function") {
+    await closeHost();
+    throw new Error("Invalid delivery HTTP host.");
+  }
+  if (host.ready !== undefined && typeof host.ready !== "function") {
+    await closeHost();
+    throw new Error("Invalid delivery HTTP readiness hook.");
+  }
+  if (signal.aborted) { await closeHost(); return undefined; }
+  let server: ReturnType<typeof serveDeliveryHttp>;
+  try {
+    server = serveDeliveryHttp({
+      hostname, port,
+      development: false,
+      fetch: async (request) => {
+        if (identity && new URL(request.url).pathname === ${JSON.stringify(APPLICATION_RUNTIME_PROBE_PATH2)}) {
+          if (request.method !== "GET") return new Response(null, { status: 405 });
+          const ready = !signal.aborted && (host.ready ? await host.ready() === true : true) && !signal.aborted;
+          return Response.json({ identity, ready }, {
+            status: ready ? 200 : 503, headers: { "cache-control": "no-store" },
+          });
+        }
+        return host.fetch(request);
+      },
+      error: () => new Response("Internal Server Error", { status: 500 }),
+    });
+  } catch {
+    await closeHost();
+    throw new Error("Delivery HTTP listener failed.");
+  }
+  let stopping: Promise<void> | undefined;
+  return {
+    url: server.url,
+    stop() {
+      stopping ??= (async () => {
+        let forced = false;
+        const drainLimit = setTimeout(() => {
+          forced = true;
+          void server.stop(true).catch(() => {});
+        }, Math.max(1, Math.floor(shutdownTimeout / 2)));
+        // Forced connection closure is not a successful graceful shutdown.
+        try { await server.stop(false); }
+        finally { clearTimeout(drainLimit); await closeHost(); }
+        if (forced) throw new Error("Delivery HTTP drain deadline exceeded.");
+      })();
+      return stopping;
+    },
+  };
+}
+
+{
+  const lifecycle = new AbortController();
+  const shutdownTimeout = Number(deliveryProcess.env.SHUTDOWN_TIMEOUT_MS ?? "10000");
+  let running: Awaited<ReturnType<typeof startDeliveryHttp>>;
+  let deadline: ReturnType<typeof setTimeout> | undefined;
+  const finish = (failed: boolean) => {
+    clearTimeout(deadline);
+    deliveryProcess.removeListener("SIGINT", requestShutdown);
+    deliveryProcess.removeListener("SIGTERM", requestShutdown);
+    deliveryProcess.exit(failed ? 1 : 0);
+  };
+  const stop = () => {
+    void running?.stop().then(
+      () => finish(false),
+      () => { console.error("Delivery HTTP shutdown failed."); finish(true); },
+    );
+  };
+  const startDeadline = () => {
+    if (deadline !== undefined) return;
+    deadline = setTimeout(() => {
+      console.error("Delivery HTTP shutdown deadline exceeded.");
+      finish(true);
+    }, shutdownTimeout);
+  };
+  const requestShutdown = () => {
+    if (lifecycle.signal.aborted) return;
+    // Start the deadline before invoking user-owned abort listeners.
+    startDeadline();
+    lifecycle.abort();
+    stop();
+  };
+  try {
+    if (!Number.isInteger(shutdownTimeout) || shutdownTimeout < 1 || shutdownTimeout > 300000) {
+      throw new Error("Invalid delivery HTTP shutdown configuration.");
+    }
+    deliveryProcess.on("SIGINT", requestShutdown);
+    deliveryProcess.on("SIGTERM", requestShutdown);
+    running = await startDeliveryHttp(lifecycle.signal, shutdownTimeout, startDeadline);
+    if (lifecycle.signal.aborted) {
+      if (running) stop();
+      else finish(false);
+    } else if (running) {
+      console.log(JSON.stringify({ event: "delivery-http-listening", url: running.url.href }));
+    }
+  } catch {
+    console.error("Delivery HTTP startup failed.");
+    finish(true);
+  }
+}
+`;
+}
+function renderDeliveryWorkerEntry(generatedDirectory, hostPath) {
+  const specifier = relativeImportPath(generatedDirectory, hostPath);
+  return `
+import deliveryProcess from "node:process";
+import { createDeliveryWorker } from ${JSON.stringify(specifier)};
+${renderDeliveryRuntimeIdentity()}
+
+interface DeliveryWorkerHost {
+  start(): void | Promise<void>;
+  close(): void | Promise<void>;
+  failure?: Promise<never>;
+}
+
+{
+  const lifecycle = new AbortController();
+  const shutdownTimeout = Number(deliveryProcess.env.SHUTDOWN_TIMEOUT_MS ?? "10000");
+  let host: DeliveryWorkerHost | undefined;
+  let running = false;
+  let runtimeFailed = false;
+  let closing: Promise<void> | undefined;
+  let deadline: ReturnType<typeof setTimeout> | undefined;
+  let keepAlive: ReturnType<typeof setInterval> | undefined;
+  const finish = (failed: boolean) => {
+    clearTimeout(deadline);
+    clearInterval(keepAlive);
+    deliveryProcess.removeListener("SIGINT", requestShutdown);
+    deliveryProcess.removeListener("SIGTERM", requestShutdown);
+    deliveryProcess.removeListener("uncaughtException", runtimeFailure);
+    deliveryProcess.removeListener("unhandledRejection", runtimeFailure);
+    deliveryProcess.exit(failed ? 1 : 0);
+  };
+  const startDeadline = () => {
+    if (deadline !== undefined) return;
+    deadline = setTimeout(() => {
+      console.error("Delivery worker shutdown deadline exceeded.");
+      finish(true);
+    }, shutdownTimeout);
+  };
+  const closeHost = () => {
+    startDeadline();
+    return closing ??= Promise.resolve().then(() => host?.close());
+  };
+  const finishShutdown = async () => {
+    await closeHost();
+    // Observe errors queued by abort listeners before declaring graceful shutdown.
+    await new Promise<void>(resolve => setTimeout(resolve, 0));
+    finish(runtimeFailed);
+  };
+  const requestShutdown = () => {
+    if (lifecycle.signal.aborted) return;
+    startDeadline();
+    try { lifecycle.abort(); }
+    catch { runtimeFailed = true; console.error("Delivery worker runtime failed."); }
+    // A host may need close() to unblock start(). Success still waits for start.
+    if (host) void closeHost().catch(() => { runtimeFailed = true; });
+    if (running) {
+      void finishShutdown().catch(() => {
+        console.error("Delivery worker shutdown failed.");
+        finish(true);
+      });
+    }
+  };
+  const runtimeFailure = () => {
+    runtimeFailed = true;
+    console.error("Delivery worker runtime failed.");
+    requestShutdown();
+  };
+  try {
+    const identity = deliveryRuntimeIdentity("worker");
+    if (!Number.isInteger(shutdownTimeout) || shutdownTimeout < 1 || shutdownTimeout > 300000) {
+      throw new Error("Invalid delivery worker shutdown configuration.");
+    }
+    deliveryProcess.on("SIGINT", requestShutdown);
+    deliveryProcess.on("SIGTERM", requestShutdown);
+    deliveryProcess.on("uncaughtException", runtimeFailure);
+    deliveryProcess.on("unhandledRejection", runtimeFailure);
+    const createHost: (
+      modules: ReturnType<typeof createCompiledModules>, lifecycle: { signal: AbortSignal },
+    ) => DeliveryWorkerHost | Promise<DeliveryWorkerHost> = createDeliveryWorker;
+    const candidate = await createHost(createCompiledModules(), { signal: lifecycle.signal });
+    if (!candidate || typeof candidate.close !== "function") throw new Error("Invalid delivery worker host.");
+    host = candidate;
+    if (typeof host.start !== "function") throw new Error("Invalid delivery worker host.");
+    if (host.failure !== undefined) {
+      if (!host.failure || typeof host.failure.then !== "function") throw new Error("Invalid worker failure signal.");
+      // A fulfilled fatal channel is also invalid; neither outcome may leave a dead worker alive.
+      void host.failure.then(runtimeFailure, runtimeFailure);
+    }
+    if (!lifecycle.signal.aborted) await host.start();
+    if (lifecycle.signal.aborted) {
+      await finishShutdown();
+    } else {
+      running = true;
+      keepAlive = setInterval(() => {}, 1000);
+      console.log(JSON.stringify({ event: "delivery-worker-started", ...(identity ? { identity } : {}) }));
+    }
+  } catch {
+    if (host) {
+      try { await closeHost(); }
+      catch { console.error("Delivery worker cleanup failed."); }
+    }
+    console.error("Delivery worker startup failed.");
+    finish(true);
+  }
+}
+`;
+}
+async function prepareDeliveryMigrations(project, generatedRoot, declarations = []) {
+  const entries = [];
+  const files = new Map;
+  const inputs = new Map;
+  let totalBytes = 0;
+  for (const declaration of [...declarations].sort((a, b) => BigInt(a.version) < BigInt(b.version) ? -1 : BigInt(a.version) > BigInt(b.version) ? 1 : 0)) {
+    const source = resolve102(project, declaration.source);
+    if (!inside2(project, source) || inside2(generatedRoot, source))
+      throw new Error("Invalid migration source.");
+    const bytes = await readBoundedOwned2(project, source, 1048576);
+    totalBytes += bytes.length;
+    if (totalBytes > 16777216 || !new TextDecoder("utf-8", { fatal: true }).decode(bytes).trim()) {
+      throw new Error("Invalid migration content or byte budget.");
+    }
+    const hash = digest3(bytes);
+    const path = `bundle/migrations/${declaration.executor}/${declaration.version}_${declaration.name}.sql`;
+    entries.push({
+      version: declaration.version,
+      name: declaration.name,
+      executor: declaration.executor,
+      path: path.slice("bundle/".length),
+      sha256: hash,
+      bytes: bytes.length
+    });
+    files.set(path, bytes);
+    inputs.set(source, hash);
+  }
+  if (entries.length) {
+    files.set("bundle/migrations.json", new TextEncoder().encode(canonical22({
+      version: 1,
+      digestScope: "raw-sql-bytes",
+      compatibility: "not-proven",
+      executionPerformed: false,
+      dataRecovery: "separate-required",
+      migrations: entries
+    })));
+  }
+  return { entries, files, inputs };
+}
+var producer = "@supacloud/compiler/delivery-build-v1";
+async function buildDeliveryProject(options, delivery) {
+  const bundledTargets = [];
+  let resultDiagnostics = [];
+  const failed = (diagnostics) => {
+    resultDiagnostics = [...diagnostics];
+    return { ok: false, manifest: null, diagnostics: resultDiagnostics, written: [], bundledTargets };
+  };
+  let phase = "configuration";
+  let output;
+  const temporary = [];
+  try {
+    const settings = parseDeliveryOptions(delivery);
+    if (typeof Bun === "undefined")
+      throw new Error("Independent delivery builds require Bun.");
+    const configPath = ts11.findConfigFile(resolve112(options.rootDir), ts11.sys.fileExists);
+    if (!configPath)
+      throw new Error("Independent delivery builds require a project tsconfig.json.");
+    const lexicalProject = dirname7(configPath);
+    const project = await realpath3(lexicalProject);
+    const sourceRoot = await realpath3(options.rootDir);
+    if (!inside2(project, sourceRoot))
+      throw new Error("Application sources must be inside the project.");
+    const requested = resolve112(options.outDir, "delivery");
+    if (!inside2(lexicalProject, requested))
+      throw new Error("Output must be inside the application project.");
+    const buildRoot = resolve112(project, relative7(lexicalProject, requested));
+    const generatedRoot = resolve112(project, relative7(lexicalProject, options.outDir));
+    if (inside2(generatedRoot, sourceRoot))
+      throw new Error("Output must not contain the application source root.");
+    const configInputs = new Map;
+    const parsedConfig = ts11.getParsedCommandLineOfConfigFile(await realpath3(configPath), {}, {
+      ...ts11.sys,
+      readFile(path) {
+        const contents = readFileSync32(path, "utf8");
+        configInputs.set(resolve112(path), digest3(contents));
+        return contents;
+      },
+      onUnRecoverableConfigFileDiagnostic() {
+        throw new Error("Invalid project TypeScript configuration.");
+      }
+    });
+    if (!parsedConfig || parsedConfig.errors.length > 0)
+      throw new Error("Invalid project TypeScript configuration.");
+    phase = "compiler-checks";
+    const sources = await sourceInventory(sourceRoot, generatedRoot);
+    const checked = await checkProject(options);
+    const planned = createDeliveryPlan({ ...checked.graph, diagnostics: checked.diagnostics }, settings);
+    if (!planned.ok)
+      return failed(planned.diagnostics);
+    if (options.graphql && checked.mismatches.some((mismatch) => mismatch.startsWith("graphql"))) {
+      throw new Error("Refresh GraphQL artifacts with compile before building independent targets.");
+    }
+    const assets = settings.build?.assets ?? [];
+    for (const asset of assets) {
+      if (!planned.plan.targets.some((target) => target.name === asset.target)) {
+        throw new Error("An asset refers to an unknown delivery target.");
+      }
+    }
+    const assetOwners = assets.map((asset) => `${asset.target}/${asset.path}`);
+    if (new Set(assetOwners).size !== assetOwners.length)
+      throw new Error("Duplicate target asset path.");
+    const httpApplications = settings.build?.httpApplications ?? [];
+    const workerApplications = settings.build?.workerApplications ?? [];
+    const hosts = new Map;
+    for (const [kind, applications] of [["http", httpApplications], ["worker", workerApplications]]) {
+      for (const app of applications) {
+        if (hosts.has(app.target))
+          throw new Error("Duplicate delivery application host.");
+        const target = planned.plan.targets.find((target) => target.name === app.target);
+        if (!target || (kind === "worker" ? target.kind !== "jobs" : target.kind === "jobs")) {
+          throw new Error("Delivery host kind does not match its target.");
+        }
+        const path = resolve112(sourceRoot, app.source);
+        if (inside2(generatedRoot, path) || !/\.[cm]?ts$/.test(path))
+          throw new Error("Hosts require application TypeScript source.");
+        hosts.set(app.target, { path, kind, hash: digest3(await readOwned(sourceRoot, path)) });
+      }
+    }
+    phase = "migration-inputs";
+    const migrations = await prepareDeliveryMigrations(project, generatedRoot, settings.build?.migrations);
+    phase = "output-ownership";
+    output = await reserveOutput(project, buildRoot);
+    const objectRoot = join92(output.path, "objects");
+    await noLinks2(output.path, objectRoot);
+    await mkdir3(objectRoot, { recursive: true });
+    const pointer = join92(output.path, "delivery.manifest.json");
+    const previous = await exists2(pointer) ? parseDeliveryBuildManifest2(JSON.parse(new TextDecoder().decode(await readOwned(output.path, pointer)))) : undefined;
+    const objects = [];
+    const candidates = [];
+    const snapshots = new Map([...sources, ...configInputs]);
+    for (const [path, hash] of migrations.inputs) {
+      const previous = snapshots.get(path);
+      if (previous !== undefined && previous !== hash)
+        throw new Error("Migration changed during analysis.");
+      snapshots.set(path, hash);
+    }
+    for (const host of hosts.values()) {
+      const previous = snapshots.get(host.path);
+      if (previous !== undefined && previous !== host.hash)
+        throw new Error("Delivery host changed during analysis.");
+      snapshots.set(host.path, host.hash);
+    }
+    const configuration = {};
+    let directory = project;
+    while (true) {
+      for (const name of ["package.json", "bun.lock", "bun.lockb", "package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bunfig.toml", "tsconfig.json"]) {
+        const path = join92(directory, name);
+        if (await exists2(path)) {
+          const bytes = await readFile5(path);
+          const before = snapshots.get(path);
+          if (before !== undefined && before !== digest3(bytes))
+            throw new Error("Configuration changed during analysis; retry.");
+          snapshots.set(path, digest3(bytes));
+          configuration[relative7(project, path).split(sep7).join("/")] = digest3(bytes);
+        }
+      }
+      const parent = dirname7(directory);
+      if (parent === directory)
+        break;
+      directory = parent;
+    }
+    const toolchain = {
+      producer,
+      bun: Bun.version,
+      revision: Bun.revision,
+      compiler: digest3(canonical22(Object.fromEntries([...await sourceInventory(import.meta.dir, join92(import.meta.dir, "node_modules"))].map(([path, hash]) => [relative7(import.meta.dir, path), hash]))))
+    };
+    for (const target of planned.plan.targets) {
+      phase = `target:${target.name}`;
+      const stage = await mkdtemp(join92(objectRoot, ".build-"));
+      temporary.push(stage);
+      const generatedDirectory = join92(objectRoot, "0".repeat(64), "generated");
+      const rendered = renderDeliveryTarget(checked.graph, target, {
+        ...options,
+        rootDir: sourceRoot,
+        outDir: generatedDirectory
+      });
+      const host = hosts.get(target.name);
+      const entryKind = host?.kind === "http" ? "bun-http-application" : host?.kind === "worker" ? "bun-worker-application" : "compiled-module-factory";
+      const applicationCode = rendered.applicationCode + (host?.kind === "http" ? renderDeliveryHttpEntry(generatedDirectory, host.path) : host?.kind === "worker" ? renderDeliveryWorkerEntry(generatedDirectory, host.path) : "");
+      const generated = {
+        "application.ts": applicationCode,
+        ...rendered.clientCode === undefined ? {} : { "client.ts": rendered.clientCode },
+        ...rendered.permissionsCode === undefined ? {} : { "permissions.ts": rendered.permissionsCode }
+      };
+      const unsafe = scanGeneratedArtifacts(generated, true);
+      if (unsafe.some((item) => item.severity === "error"))
+        return failed(unsafe);
+      for (const [name, contents] of Object.entries(generated))
+        await writeArtifact(stage, `generated/${name}`, contents);
+      {
+        const program = ts11.createProgram({
+          rootNames: [
+            ...parsedConfig.fileNames.filter((path) => !inside2(generatedRoot, path)),
+            ...Object.keys(generated).map((name) => join92(stage, "generated", name))
+          ],
+          options: { ...parsedConfig.options, rootDir: project },
+          ...parsedConfig.projectReferences ? { projectReferences: parsedConfig.projectReferences } : {}
+        });
+        const diagnostics = ts11.getPreEmitDiagnostics(program);
+        if (diagnostics.some((item) => item.category === ts11.DiagnosticCategory.Error)) {
+          return failed(diagnostics.filter((item) => item.category === ts11.DiagnosticCategory.Error).map((item) => ({
+            severity: "error",
+            code: "delivery-generated-type-error",
+            message: ts11.flattenDiagnosticMessageText(item.messageText, `
+`),
+            ...item.file ? { file: item.file.fileName } : {}
+          })));
+        }
+      }
+      phase = `target:${target.name}:bundle`;
+      const bundled = await bundleDeliveryTarget(target.name, applicationCode, project, generatedDirectory, settings);
+      phase = `target:${target.name}:host-resolution`;
+      if (host && bundled.inputs.get(host.path) !== host.hash) {
+        throw new Error("Delivery host resolution did not match its declared source.");
+      }
+      bundledTargets.push(target.name);
+      phase = `target:${target.name}:inventory`;
+      for (const [path, hash] of bundled.inputs) {
+        const previousHash = snapshots.get(path);
+        if (previousHash !== undefined && previousHash !== hash)
+          throw new Error("Shared source changed between target builds; retry.");
+        snapshots.set(path, hash);
+      }
+      for (const [path, bytes] of bundled.files)
+        await writeArtifact(stage, path, bytes);
+      await writeArtifact(stage, "bundle/package.json", canonical22({ type: "module", private: true }));
+      await writeArtifact(stage, "bundle/app.manifest.json", rendered.manifestJson);
+      await writeArtifact(stage, "bundle/execution-context.json", rendered.executionSnapshot);
+      for (const [path, bytes] of migrations.files)
+        await writeArtifact(stage, path, bytes);
+      await writeArtifact(stage, "bundle/target.json", canonical22({
+        target,
+        entryKind,
+        deploymentReady: false
+      }));
+      const assetInputs = {};
+      for (const asset of assets.filter((asset) => asset.target === target.name)) {
+        const path = resolve112(sourceRoot, asset.source);
+        const bytes = await readOwned(sourceRoot, path);
+        const hash = digest3(bytes);
+        const previousHash = snapshots.get(path);
+        if (previousHash !== undefined && previousHash !== hash)
+          throw new Error("Asset changed during build; retry.");
+        snapshots.set(path, hash);
+        assetInputs[asset.source] = hash;
+        await writeArtifact(stage, `bundle/assets/${asset.path}`, bytes);
+      }
+      const inputDigest = digest3(canonical22({
+        target,
+        generated,
+        toolchain,
+        configuration,
+        build: {
+          minify: settings.build?.minify ?? true,
+          environmentContract: settings.build?.environmentContract,
+          migrations: settings.build?.migrations,
+          httpApplication: httpApplications.find((app) => app.target === target.name),
+          workerApplication: workerApplications.find((app) => app.target === target.name),
+          assets: assets.filter((asset) => asset.target === target.name)
+        },
+        inputs: Object.fromEntries([...bundled.inputs].map(([path, hash]) => [relative7(project, path).split(sep7).join("/"), hash])),
+        assets: assetInputs,
+        ...migrations.entries.length ? { migrations: migrations.entries } : {}
+      }));
+      const files = await artifactInventory(stage);
+      const object = {
+        name: target.name,
+        inputDigest,
+        objectId: deliveryObjectDigest2({ inputDigest, files, entryKind }),
+        entrypoint: "bundle/index.js",
+        entryKind,
+        runtimeImports: bundled.runtimeImports,
+        files
+      };
+      objects.push(object);
+      candidates.push({ path: stage, object });
+    }
+    phase = "source-consistency";
+    if (canonical22(Object.fromEntries(sources)) !== canonical22(Object.fromEntries(await sourceInventory(sourceRoot, generatedRoot))))
+      throw new Error("Application sources changed during analysis; retry.");
+    for (const [path, hash] of snapshots) {
+      if (digest3(await readFile5(path)) !== hash)
+        throw new Error("Build inputs changed before publication; retry.");
+    }
+    const manifest = parseDeliveryBuildManifest2({
+      schemaVersion: 1,
+      producer,
+      deploymentReady: false,
+      plan: planned.plan,
+      objects,
+      routes: planned.plan.targets.flatMap((target) => target.routes.map((route) => ({ method: route.method, path: route.path, target: target.name }))),
+      jobs: planned.plan.targets.flatMap((target) => target.jobs.map((job) => ({ name: job.name, target: target.name })))
+    });
+    phase = "artifact-integrity";
+    for (const candidate of candidates) {
+      const destination = join92(objectRoot, candidate.object.objectId);
+      await noLinks2(output.path, destination);
+      if (await exists2(destination) && canonical22(await artifactInventory(destination)) !== canonical22(candidate.object.files)) {
+        throw new Error("An immutable artifact was modified. Refusing to overwrite it.");
+      }
+    }
+    const written = [];
+    for (const candidate of candidates) {
+      const destination = join92(objectRoot, candidate.object.objectId);
+      if (!await exists2(destination)) {
+        await rename3(candidate.path, destination);
+        written.push(...candidate.object.files.map((file) => join92(destination, file.path)));
+      }
+    }
+    phase = "manifest-publication";
+    if (await publishPointer(output.path, canonical22(manifest) + `
+`))
+      written.push(pointer);
+    const unchangedTargets = objects.filter((object) => previous?.objects.some((old) => old.name === object.name && old.objectId === object.objectId)).map((object) => object.name);
+    resultDiagnostics = [...planned.diagnostics];
+    return parseDeliveryBuildResult({
+      ok: true,
+      manifest,
+      diagnostics: resultDiagnostics,
+      written,
+      bundledTargets,
+      unchangedTargets,
+      changedTargets: objects.filter((object) => !unchangedTargets.includes(object.name)).map((object) => object.name),
+      removedTargets: previous?.objects.filter((old) => !objects.some((object) => object.name === old.name)).map((old) => old.name) ?? []
+    });
+  } catch {
+    return failed([{
+      severity: "error",
+      code: "delivery-build-failed",
+      message: `Independent delivery build failed during ${phase}.`,
+      suggestion: phase === "configuration" ? "Use Bun, a project tsconfig, valid delivery options and a project-local output directory." : phase === "output-ownership" ? "Use an empty output namespace or this project's owned directory; resolve locks and symlinks explicitly." : "Check compiler/type diagnostics, static imports, declared asset paths and artifact integrity; retry only after resolving the failure."
+    }]);
+  } finally {
+    const cleaned = await Promise.allSettled(temporary.map((path) => rm2(path, { recursive: true, force: true })));
+    try {
+      await output?.release();
+    } catch {
+      resultDiagnostics.push({ severity: "warn", code: "delivery-cleanup-failed", message: "Output lock cleanup failed; inspect the owned build directory before retrying." });
+    }
+    if (cleaned.some((result) => result.status === "rejected")) {
+      resultDiagnostics.push({ severity: "warn", code: "delivery-cleanup-failed", message: "Some inactive staging directories could not be removed." });
+    }
+  }
+}
 async function applyDiagnosticFix(fix, options = {}) {
   if (!fix || typeof fix.targetFile !== "string")
     throw new Error("Invalid DiagnosticFix");
-  const root = await realpath4(options.rootDir ?? process.cwd());
+  const root = await realpath42(options.rootDir ?? process.cwd());
   const file = resolve122(root, fix.targetFile);
-  const stat = await lstat2(file);
-  const resolved = await realpath4(file);
+  const stat = await lstat22(file);
+  const resolved = await realpath42(file);
   const relativePath = relative8(root, resolved);
   if (stat.isSymbolicLink() || !stat.isFile() || isAbsolute32(relativePath) || relativePath === ".." || relativePath.startsWith(`..${sep8}`)) {
     throw new Error("Fix target must be a regular file inside rootDir");
@@ -245396,8 +246645,8 @@ function buildToolDefinitions(manifest) {
 }
 
 // src/shared/tools/app-starter.ts
-import { lstat as lstat3, mkdir as mkdir3, readdir as readdir3, writeFile as writeFile4 } from "node:fs/promises";
-import { basename as basename7, dirname as dirname7, join as join13, resolve as resolve13 } from "node:path";
+import { lstat as lstat3, mkdir as mkdir4, readdir as readdir4, writeFile as writeFile4 } from "node:fs/promises";
+import { basename as basename7, dirname as dirname9, join as join13, resolve as resolve13 } from "node:path";
 
 // src/shared/tools/app-starter-environment.ts
 var STARTER_ENVIRONMENT = String.raw`import { existsSync, readFileSync } from "node:fs";
@@ -248047,24 +249296,45 @@ async function initializeAppProject(options) {
   if (!/^[a-z][a-z0-9-]*$/.test(name) || name.length > 100) {
     throw new Error("Project name must be lowercase kebab-case (1-100 characters)");
   }
-  await mkdir3(root, { recursive: true });
+  await mkdir4(root, { recursive: true });
   const stat = await lstat3(root);
   if (stat.isSymbolicLink() || !stat.isDirectory())
     throw new Error("Project root must be a real directory");
-  if ((await readdir3(root)).some((entry) => entry !== ".git")) {
+  if ((await readdir4(root)).some((entry) => entry !== ".git")) {
     throw new Error("app init requires an empty directory (an existing .git directory is allowed)");
   }
   const template = options.template ?? "command";
   const files = template === "command" ? appStarterFiles(name) : appTemplateFiles(name, template);
   for (const [relativePath, content] of Object.entries(files)) {
     const path = join13(root, relativePath);
-    await mkdir3(dirname7(path), { recursive: true });
+    await mkdir4(dirname9(path), { recursive: true });
     await writeFile4(path, content, { encoding: "utf8", flag: "wx" });
   }
   return { root, name, files: Object.keys(files) };
 }
 
 // src/shared/tools/app-tools.ts
+var REMOTE_APP_ACTIONS = {
+  upload: "upload_release",
+  configure: "put_configuration",
+  deploy: "activate_release",
+  status: "get_runtime",
+  rollback: "activate_release",
+  reconcile: "reconcile_activation",
+  retire: "retire_activation"
+};
+var REMOTE_APP_DESCRIPTIONS = {
+  ref: "[upload/configure/deploy/status/rollback/reconcile/retire] Project ref (defaults to context)",
+  id: "[upload/configure/deploy/status/rollback/reconcile/retire] Application ID",
+  environment_id: "[configure/deploy/status/rollback/reconcile/retire] Environment ID",
+  configuration_id: "[deploy/rollback] Required immutable configuration revision",
+  activation_id: "[deploy/rollback/reconcile/retire] Required explicit activation ID",
+  expected_activation_id: "[deploy/rollback] Required current activation ID, or absent for first activation",
+  configuration_path: "[configure] Configuration write JSON including revision and expected revision",
+  manifest_path: "[upload] Local delivery.manifest.json",
+  release_id: "[deploy/rollback/reconcile] Required immutable application release ID"
+};
+var REMOTE_APP_SCHEMA = Object.fromEntries(Object.entries(APPLICATION_TOOL_SCHEMA).filter(([name]) => name !== "action").map(([name, schema]) => [name, optional(schema, REMOTE_APP_DESCRIPTIONS[name])]));
 async function initProject(args) {
   if (args.force)
     throw new Error("app init never overwrites files; choose an empty directory");
@@ -248108,7 +249378,7 @@ async function writeScaffold(path, content, force) {
     await writeFile5(path, content, "utf8");
     return "overwritten";
   }
-  await mkdir4(dirname9(path), { recursive: true });
+  await mkdir5(dirname10(path), { recursive: true });
   await writeFile5(path, content, "utf8");
   return "created";
 }
@@ -248267,7 +249537,7 @@ async function readAllowedDependencies(root) {
   if (!existsSync10(path))
     return { dependencies: [], devDependencies: [] };
   try {
-    const parsed = JSON.parse(await readFile3(path, "utf8"));
+    const parsed = JSON.parse(await readFile4(path, "utf8"));
     return {
       dependencies: Object.keys(parsed.dependencies ?? {}).sort(),
       devDependencies: Object.keys(parsed.devDependencies ?? {}).sort()
@@ -248344,7 +249614,7 @@ async function findUnwiredContracts(rootDir) {
   async function walk(directory) {
     let entries;
     try {
-      entries = await readdir4(directory, { withFileTypes: true });
+      entries = await readdir5(directory, { withFileTypes: true });
     } catch {
       return;
     }
@@ -248362,17 +249632,17 @@ async function findUnwiredContracts(rootDir) {
   const contracts = files.filter((file) => file.endsWith(".contract.ts"));
   if (contracts.length === 0)
     return [];
-  const otherSources = await Promise.all(files.filter((file) => !contracts.includes(file)).map(async (file) => await readFile3(file, "utf8").catch(() => "")));
+  const otherSources = await Promise.all(files.filter((file) => !contracts.includes(file)).map(async (file) => await readFile4(file, "utf8").catch(() => "")));
   const unwired = [];
   for (const contract of contracts) {
-    const source = await readFile3(contract, "utf8").catch(() => "");
+    const source = await readFile4(contract, "utf8").catch(() => "");
     const symbols = [...source.matchAll(/export\s+const\s+([A-Za-z_$][A-Za-z0-9_$]*)/g)].map((match) => match[1]);
     if (symbols.length === 0)
       continue;
     const moduleName = basename8(contract).replace(/\.ts$/, "");
     const wired = otherSources.some((text) => text.includes(moduleName) || symbols.some((symbol) => new RegExp(`\\b${symbol}\\b`).test(text)));
     if (!wired)
-      unwired.push({ file: relative7(rootDir, contract), symbols });
+      unwired.push({ file: relative9(rootDir, contract), symbols });
   }
   return unwired;
 }
@@ -248413,7 +249683,7 @@ async function runFix(args) {
   const fixPath = args.fix?.trim();
   if (!fixPath)
     throw new Error("app fix requires --fix <path-to-diagnostic-fix.json>");
-  const parsed = JSON.parse(await readFile3(resolve14(root, fixPath), "utf8"));
+  const parsed = JSON.parse(await readFile4(resolve14(root, fixPath), "utf8"));
   const write = args.write === true;
   const applied = await applyDiagnosticFix(parsed, { rootDir: root, dryRun: !write });
   return textResult(JSON.stringify({
@@ -248479,7 +249749,7 @@ async function readManifest(root) {
   if (!existsSync10(manifestPath)) {
     throw new Error(`Manifest not found: ${manifestPath}（先运行 app compile 生成）`);
   }
-  const parsed = JSON.parse(await readFile3(manifestPath, "utf8"));
+  const parsed = JSON.parse(await readFile4(manifestPath, "utf8"));
   if (!Array.isArray(parsed.modules)) {
     throw new Error(`Invalid manifest: ${manifestPath}`);
   }
@@ -248666,7 +249936,7 @@ async function runExportTools(args) {
   const manifest = await readManifest(root);
   const definitions = buildToolDefinitions(manifest);
   const outDir = resolve14(args.out_dir || join14(root, "generated"));
-  await mkdir4(outDir, { recursive: true });
+  await mkdir5(outDir, { recursive: true });
   if (args.format === "json") {
     return textResult(JSON.stringify(definitions, null, 2));
   }
@@ -248685,8 +249955,39 @@ async function runExportTools(args) {
 `);
   return textResult(summary);
 }
-async function runAppTool(request) {
+async function runDelivery(args) {
+  const root = resolve14(args.root || process.cwd());
+  const loaded = await loadSupacloudConfig(root);
+  const options = compileOptionsFromConfig({
+    ...loaded,
+    ...args.out_dir === undefined ? {} : { outDir: resolve14(root, args.out_dir) },
+    ...args.include === undefined ? {} : { include: parseInclude(args.include) },
+    ...args.strict === undefined ? {} : { strict: args.strict }
+  }, root);
+  if (args.action === "plan") {
+    const result = await planDeliveryProject(options, loaded.delivery);
+    return textResult(args.format === "json" ? JSON.stringify(result, null, 2) : formatDeliveryPlan(result), !result.ok);
+  }
+  const result = await buildDeliveryProject(options, loaded.delivery);
+  return textResult(JSON.stringify(result, null, 2), !result.ok);
+}
+async function runAppTool(request, options = {}) {
+  if (Object.hasOwn(REMOTE_APP_ACTIONS, request.action)) {
+    const delegate = options.getApplications?.();
+    if (!delegate)
+      return textResult("App remote actions require a Management API context.", true);
+    const action = REMOTE_APP_ACTIONS[request.action];
+    const args = parseToolArguments(APPLICATION_TOOL_SCHEMA, {
+      ...request,
+      action,
+      ref: request.ref ?? options.projectRef
+    });
+    return delegate(args);
+  }
   switch (request.action) {
+    case "plan":
+    case "build":
+      return runDelivery(request);
     case "init":
       return initProject(request);
     case "generate":
@@ -248711,24 +250012,45 @@ async function runAppTool(request) {
       return textResult(`Unknown app action: ${String(request.action)}`, true);
   }
 }
-function registerAppTools(server2) {
-  server2.tool("app", "Local @supacloud/app framework commands: init, scaffold, compile, check, graph, explain, export-tools, AI context/doctor and fix. Actions: init, generate, compile, check, graph, explain, export-tools, context, doctor, fix", {
-    action: withDescription(stringEnum(["init", "generate", "compile", "check", "graph", "explain", "export-tools", "context", "doctor", "fix"]), "App action"),
+function registerAppTools(server2, options = {}) {
+  server2.tool("app", "Application authoring and delivery. Plan is read-only; build, upload and configure never deploy. Deploy/rollback explicitly activate a release; rollback never downgrades schema.", {
+    ...REMOTE_APP_SCHEMA,
+    action: withDescription(stringEnum([
+      "init",
+      "generate",
+      "compile",
+      "check",
+      "graph",
+      "explain",
+      "export-tools",
+      "context",
+      "doctor",
+      "fix",
+      "plan",
+      "build",
+      "upload",
+      "configure",
+      "deploy",
+      "status",
+      "rollback",
+      "reconcile",
+      "retire"
+    ]), "App action; upload/configure only prepare, rollback activates an explicit old release without schema downgrade"),
     kind: optional(stringEnum(["module", "command", "query", "controller", "job", "contract"]), "[generate] Scaffold kind"),
     template: optional(stringEnum(["http", "command", "edge"]), "[init] Golden-path template (default: command)"),
     name: optional(Type.String(), "[init/generate] Project or object name"),
     module: optional(Type.String(), "[generate] Target feature module (required for command/query/controller)"),
     dir: optional(Type.String(), "[generate] Feature root directory (default: src/features)"),
     force: optional(Type.Boolean(), "[generate] Overwrite existing files"),
-    root: optional(Type.String(), "Project directory containing supacloud.config.ts (default: current directory)"),
+    root: optional(Type.String(), "[plan/build/compile/check] Project directory containing supacloud.config.ts (default: current directory)"),
     include: optional(Type.String(), "[compile/check] Comma-separated glob patterns for source files"),
-    out_dir: optional(Type.String(), "[compile/export-tools] Output directory (default: <root>/generated)"),
+    out_dir: optional(Type.String(), "[compile/plan/build/export-tools] Output directory (default: configured outDir)"),
     strict: optional(Type.Boolean(), "[compile/check] Promote warnings to errors"),
-    format: optional(stringEnum(["text", "json"]), "[graph/export-tools] Output format (default: text)"),
+    format: optional(stringEnum(["text", "json"]), "[plan/graph/export-tools] Output format (default: text)"),
     target: optional(Type.String(), "[explain/context] Provider class name / token name / command name / job name / module name"),
     fix: optional(Type.String(), "[fix] Path to a DiagnosticFix JSON file produced by `doctor --format json`"),
     write: optional(Type.Boolean(), "[fix] Write the fix to disk (default: preview only)")
-  }, runAppTool);
+  }, (request) => runAppTool(request, options));
 }
 var APP_ALIAS_ACTIONS = ["generate", "compile", "check", "graph", "explain", "context", "doctor", "fix"];
 function registerAppAliases(server2) {
@@ -250034,7 +251356,7 @@ var MUTATION_TOOL_SCHEMA = {
 import { execFileSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
 import { existsSync as existsSync12, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname10, join as join16, relative as relative9, resolve as resolve17 } from "node:path";
+import { dirname as dirname11, join as join16, relative as relative10, resolve as resolve17 } from "node:path";
 var SAFE_PROJECT_REF = /^[A-Za-z0-9_-]{1,64}$/;
 var BACKUP_ID = /^logical-full_[A-Za-z0-9_-]{1,64}_[a-f0-9]{32}$/;
 var SHA256 = /^[a-f0-9]{64}$/;
@@ -250428,7 +251750,7 @@ function handleScopeRebind(args) {
       writeFileSync3(filePath, formatted, "utf8");
     }
     scopes.push({
-      file: relative9(cwd, filePath),
+      file: relative10(cwd, filePath),
       task_id: typeof parsed.taskId === "string" ? parsed.taskId : "",
       target_project_ref: typeof parsed.targetProjectRef === "string" ? parsed.targetProjectRef : "",
       previous_base_commit: previousBaseCommit,
@@ -250482,7 +251804,7 @@ function handleScopeInspect(args) {
   const scopeSha256 = genericScopedReleaseScopeSha256(parsed);
   const git = gitCommitInfo(cwd);
   return releaseControlSuccess("release.scope_inspect", {
-    file: relative9(cwd, filePath),
+    file: relative10(cwd, filePath),
     scope: {
       task_id: parsed.taskId,
       target_project_ref: parsed.targetProjectRef,
@@ -250532,7 +251854,7 @@ function handleScopeCreate(args, fallbackRef) {
   }
   const targetBaseCommit = resolveGitBaseCommit(cwd, args.base_commit);
   const filePath = resolve17(cwd, args.file.trim());
-  mkdirSync4(dirname10(filePath), { recursive: true });
+  mkdirSync4(dirname11(filePath), { recursive: true });
   const scope = {
     baseCommit: targetBaseCommit,
     excludedFunctions: parseCommaList(args.excluded_functions),
@@ -250548,7 +251870,7 @@ function handleScopeCreate(args, fallbackRef) {
 `;
   writeFileSync3(filePath, formatted, "utf8");
   return releaseControlSuccess("release.scope_create", {
-    file: relative9(cwd, filePath),
+    file: relative10(cwd, filePath),
     task_id: scope.taskId,
     target_project_ref: projectRef,
     base_commit: targetBaseCommit,
@@ -250753,10 +252075,10 @@ function registerReleaseTools(server2, http, options = {}) {
 }
 
 // src/shared/tools/deploy-tools.ts
-import { access as access3, lstat as lstat4, mkdtemp, opendir, readFile as readFile4, rm as rm2, writeFile as writeFile6 } from "node:fs/promises";
+import { access as access3, lstat as lstat4, mkdtemp as mkdtemp2, opendir, readFile as readFile7, rm as rm4, writeFile as writeFile6 } from "node:fs/promises";
 import { createHash as createHash9 } from "node:crypto";
 import { tmpdir as tmpdir2 } from "node:os";
-import { basename as basename9, dirname as dirname11, join as join17, relative as relative10, resolve as resolve18, sep as sep7 } from "node:path";
+import { basename as basename9, dirname as dirname12, join as join17, relative as relative11, resolve as resolve18, sep as sep9 } from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 
 // node_modules/fflate/esm/index.mjs
@@ -251440,7 +252762,7 @@ function frontendDeployment(candidate) {
 }
 async function readJson(path) {
   try {
-    return JSON.parse(await readFile4(path, "utf8"));
+    return JSON.parse(await readFile7(path, "utf8"));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
       return null;
@@ -251452,7 +252774,7 @@ async function findDeployConfigRoot(startDirectory) {
   while (true) {
     if (await pathExists(join17(directory, "supacloud.json")))
       return directory;
-    const parent = dirname11(directory);
+    const parent = dirname12(directory);
     if (parent === directory)
       return resolve18(startDirectory);
     directory = parent;
@@ -251541,8 +252863,8 @@ async function defaultBuildCommand(projectDirectory, configRoot) {
       return "yarn build";
     if (directory === configRoot)
       break;
-    const parent = dirname11(directory);
-    if (parent === directory || !directory.startsWith(`${configRoot}${sep7}`))
+    const parent = dirname12(directory);
+    if (parent === directory || !directory.startsWith(`${configRoot}${sep9}`))
       break;
     directory = parent;
   }
@@ -251573,7 +252895,7 @@ function selectDeployment(deployments, requestedId, projectName) {
 }
 function targetRoot(configRoot, target, name) {
   const root = resolve18(configRoot, target.root || (name === "frontend" ? "." : name));
-  const prefix = `${resolve18(configRoot)}${sep7}`;
+  const prefix = `${resolve18(configRoot)}${sep9}`;
   if (root !== resolve18(configRoot) && !root.startsWith(prefix)) {
     throw new Error(`Deploy target '${name}' root must stay inside the repository root`);
   }
@@ -251595,7 +252917,7 @@ function selectTarget(configRoot, invocationDirectory, config, requestedName) {
       throw new Error(`Deploy target '${requestedName}' was not found in supacloud.json`);
     return { name: selected[0], config: selected[1], root: targetRoot(configRoot, selected[1], selected[0]) };
   }
-  const containing = targets.map(([name, target]) => ({ name, target, root: targetRoot(configRoot, target, name) })).filter((candidate) => invocationDirectory === candidate.root || invocationDirectory.startsWith(`${candidate.root}${sep7}`)).sort((left, right) => right.root.length - left.root.length);
+  const containing = targets.map(([name, target]) => ({ name, target, root: targetRoot(configRoot, target, name) })).filter((candidate) => invocationDirectory === candidate.root || invocationDirectory.startsWith(`${candidate.root}${sep9}`)).sort((left, right) => right.root.length - left.root.length);
   if (containing.length === 1 || containing.length > 1 && containing[0].root !== containing[1].root) {
     const selected = containing[0];
     return { name: selected.name, config: selected.target, root: selected.root };
@@ -251627,7 +252949,7 @@ function defaultOutputDirectory(framework) {
 function resolveInsideProject(projectDirectory, candidate, allowRoot = false) {
   const resolved = resolve18(projectDirectory, candidate);
   const projectRoot = resolve18(projectDirectory);
-  const projectPrefix = `${projectRoot}${sep7}`;
+  const projectPrefix = `${projectRoot}${sep9}`;
   if (!allowRoot && resolved === projectRoot || resolved !== projectRoot && !resolved.startsWith(projectPrefix)) {
     throw new Error("Frontend output directory must stay inside the project directory");
   }
@@ -251675,18 +252997,18 @@ async function collectArchiveFiles(root) {
   let bytes = 0;
   const files = {};
   for (const path of paths) {
-    const data = new Uint8Array(await readFile4(path));
+    const data = new Uint8Array(await readFile7(path));
     bytes += data.byteLength;
     if (bytes > MAX_SOURCE_BYTES)
       throw new Error(`Frontend output exceeds ${MAX_SOURCE_BYTES} bytes`);
-    const archivePath = relative10(root, path).split(sep7).join("/");
+    const archivePath = relative11(root, path).split(sep9).join("/");
     files[archivePath] = [data, { mtime: FIXED_ZIP_MTIME }];
   }
   return { files, bytes, count: paths.length };
 }
 async function createFrontendArchive(outputDirectory) {
   const collected = await collectArchiveFiles(outputDirectory);
-  const temporaryDirectory = await mkdtemp(join17(tmpdir2(), "supacloud-deploy-"));
+  const temporaryDirectory = await mkdtemp2(join17(tmpdir2(), "supacloud-deploy-"));
   const archivePath = join17(temporaryDirectory, `${basename9(outputDirectory)}.zip`);
   try {
     const archiveBytes = zipSync(collected.files, { level: 6, mtime: FIXED_ZIP_MTIME });
@@ -251697,10 +253019,10 @@ async function createFrontendArchive(outputDirectory) {
       sha256,
       sourceBytes: collected.bytes,
       fileCount: collected.count,
-      cleanup: () => rm2(temporaryDirectory, { recursive: true, force: true })
+      cleanup: () => rm4(temporaryDirectory, { recursive: true, force: true })
     };
   } catch (error) {
-    await rm2(temporaryDirectory, { recursive: true, force: true });
+    await rm4(temporaryDirectory, { recursive: true, force: true });
     throw error;
   }
 }
@@ -251851,7 +253173,7 @@ function registerDeployTools(server2, http, options = {}) {
     } else {
       report("build", "skipped");
     }
-    report("package", relative10(projectDirectory, outputDirectory) || ".");
+    report("package", relative11(projectDirectory, outputDirectory) || ".");
     const archive = await createFrontendArchive(outputDirectory);
     try {
       const inventory = payload(await listFrontendReleases(http, projectRef, selected.id, undefined, 100));
@@ -251911,8 +253233,8 @@ function registerDeployTools(server2, http, options = {}) {
 // src/shared/tools/remote-dev-tools.ts
 import { spawn as spawn4 } from "node:child_process";
 import { existsSync as existsSync13 } from "node:fs";
-import { readFile as readFile5 } from "node:fs/promises";
-import { readdir as readdir5 } from "node:fs/promises";
+import { readFile as readFile8 } from "node:fs/promises";
+import { readdir as readdir6 } from "node:fs/promises";
 import { createHash as createHash10 } from "node:crypto";
 import { join as join18, resolve as resolve20 } from "node:path";
 var SAFE_TOKEN = /^[A-Za-z0-9._:@/+,-]+$/;
@@ -251992,7 +253314,7 @@ async function readProjectConfig3(root) {
   if (!existsSync13(file))
     return {};
   try {
-    const parsed = JSON.parse(await readFile5(file, "utf8"));
+    const parsed = JSON.parse(await readFile8(file, "utf8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch (error) {
     throw new Error(`Invalid supacloud.json: ${error instanceof Error ? error.message : String(error)}`);
@@ -252005,7 +253327,7 @@ async function readDevConfig(root) {
 async function sourceFingerprint(root) {
   const files = [];
   const visit = async (directory) => {
-    const entries = await readdir5(directory, { withFileTypes: true });
+    const entries = await readdir6(directory, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       const path = join18(directory, entry.name);
       if (entry.isDirectory() && ![".git", "node_modules", "dist", "generated", ".supacloud"].includes(entry.name))
@@ -252018,7 +253340,7 @@ async function sourceFingerprint(root) {
   const hash = createHash10("sha256");
   for (const file of files) {
     hash.update(file.slice(root.length).replace(/\\/g, "/"));
-    hash.update(await readFile5(file));
+    hash.update(await readFile8(file));
   }
   return hash.digest("hex");
 }
@@ -252182,7 +253504,7 @@ function registerRemoteDevTools(server2, options = {}) {
 // package.json
 var package_default8 = {
   name: "@supacloud/cli",
-  version: "0.58.5",
+  version: "0.59.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -252486,6 +253808,13 @@ EXAMPLES
   ${preferredCommand} app generate --kind job --module billing --name sync-orders
   ${preferredCommand} app generate --kind contract --module billing --name issue-invoice
   ${preferredCommand} app compile --root .
+  ${preferredCommand} app plan --root . --format json
+  ${preferredCommand} app build --root .
+  ${preferredCommand} app upload --ref abc123 --id orders --manifest_path generated/delivery/delivery.manifest.json
+  ${preferredCommand} app configure --ref abc123 --id orders --environment_id test --configuration_path configuration.json
+  ${preferredCommand} app deploy --ref abc123 --id orders --environment_id test --release_id <sha256> --configuration_id <uuid> --activation_id <uuid> --expected_activation_id absent
+  ${preferredCommand} app status --ref abc123 --id orders --environment_id test
+  ${preferredCommand} app rollback --ref abc123 --id orders --environment_id test --release_id <old-sha256> --configuration_id <uuid> --activation_id <new-uuid> --expected_activation_id <current-uuid>
   ${preferredCommand} app check --root . --strict
   ${preferredCommand} app graph --root . --format json
   ${preferredCommand} app explain --target CaseService
@@ -252728,6 +254057,10 @@ function createCliTools(context, confirmProduction) {
   })));
   assign(captureTools((server2) => registerFrontendTools(server2, http)));
   assign(captureTools((server2) => registerApplicationTools(server2, http)));
+  Object.assign(tools, captureTools((server2) => registerAppTools(server2, {
+    getApplications: () => tools.applications?.callback,
+    projectRef: context.projectRef || undefined
+  })));
   assign(captureTools((server2) => registerDeployTools(server2, http, {
     projectRef: context.projectRef || undefined,
     cwd: process.cwd(),