@supacloud/cli 0.75.1 → 0.76.0

package/README.md

@@ -231,6 +231,7 @@ actions and also exposes the immutable prebuilt release workflow:
 
 ```bash
 supacloud-cli frontend list_releases --ref abc123 --id web
+supacloud-cli frontend get_active_release --ref abc123 --id web
 supacloud-cli frontend get_release --ref abc123 --id web --release_id <sha256>
 supacloud-cli frontend upload_release --ref abc123 --id web --zip_path ./dist.zip
 supacloud-cli frontend activate_release --ref abc123 --id web \
@@ -238,6 +239,7 @@ supacloud-cli frontend activate_release --ref abc123 --id web \
   --expected_active_release_id absent \
   --expected_activation_id absent \
   --mutation_id <retry-stable-uuid-v4>
+supacloud-cli frontend rollback --ref abc123 --id web --release_id <retained-sha256>
 ```
 
 `upload_release` hashes and streams an existing regular ZIP file without
@@ -245,10 +247,19 @@ buffering the full archive. The Management API binds the upload to that SHA-256,
 and the CLI reads the immutable release back before reporting success.
 `activate_release` uses both the observed active release and activation IDs as
 optimistic concurrency tokens, then verifies the authoritative active release.
-Use the values returned by `list_releases`; `absent` is valid only when no
-release has been activated. Production uploads and activations require the
+Use the values returned by `get_active_release`; `absent` is valid only when no
+release has been activated. Production uploads, activations and rollback require the
 normal exact `--confirm-production <ref>` value, and
-`SUPACLOUD_READ_ONLY=true` blocks both mutations.
+`SUPACLOUD_READ_ONLY=true` blocks all mutations.
+
+`get_active_release` automatically handles older servers returning HTTP 404
+with a one-record history page and exact active artifact readback. It never
+falls back for authentication, integrity or server failures.
+`rollback` reads the current CAS identity and generates the mutation ID itself;
+the retained target release must be explicit. It does not infer the previous
+version from content-hash-sorted history, reupload assets or restore a database.
+An uncertain result includes the mutation ID for read-only reconciliation and
+must not be blindly retried.
 
 ### Immutable application releases
 

package/dist/index.js

@@ -210793,8 +210793,8 @@ var ACTION_POLICY = {
   },
   secrets: { read: ["list"], write: ["upsert", "delete"] },
   frontend: {
-    read: ["list", "get", "build_logs", "list_frameworks", "list_records", "list_releases", "get_release"],
-    write: ["create", "update", "delete", "deploy_git", "deploy_upload", "redeploy", "add_domain", "remove_domain", "set_env", "upload_release", "activate_release"]
+    read: ["list", "get", "build_logs", "list_frameworks", "list_records", "list_releases", "get_active_release", "get_release"],
+    write: ["create", "update", "delete", "deploy_git", "deploy_upload", "redeploy", "add_domain", "remove_domain", "set_env", "upload_release", "activate_release", "rollback"]
   },
   task_events: { read: ["inspect_webhook"], write: ["register_webhook", "unregister_webhook"] },
   diagnostics: { read: ["list_checks", "get_run"], write: ["run_checks", "repair"] },
@@ -218159,12 +218159,15 @@ function releaseInventory(candidate, expected) {
     next_cursor: nextCursor
   };
 }
-function releaseEndpoint(projectRef, deploymentId) {
+function deploymentEndpoint(projectRef, deploymentId) {
   if (!PROJECT_REF_PATTERN3.test(projectRef))
     throw new Error("'ref' is invalid for frontend releases");
   if (!DEPLOYMENT_ID_PATTERN.test(deploymentId))
     throw new Error("'id' is invalid for frontend releases");
-  return `/v1/projects/${encodeURIComponent(projectRef)}/frontend/deployments/${encodeURIComponent(deploymentId)}/releases`;
+  return `/v1/projects/${encodeURIComponent(projectRef)}/frontend/deployments/${encodeURIComponent(deploymentId)}`;
+}
+function releaseEndpoint(projectRef, deploymentId) {
+  return `${deploymentEndpoint(projectRef, deploymentId)}/releases`;
 }
 function releasePath(projectRef, deploymentId, releaseId) {
   if (!RELEASE_ID_PATTERN.test(releaseId))
@@ -218369,16 +218372,15 @@ function activationReceipt(candidate, input) {
   return release;
 }
 async function activeReleaseReadback(http, identity) {
-  const endpoint = releaseEndpoint(identity.projectRef, identity.deploymentId);
-  const inventoryRead = await http.get(`${endpoint}?limit=${RELEASE_LIST_LIMIT_MAX}`, {
-    maxJsonBytes: RESPONSE_MAX_BYTES
-  });
-  const inventory = inventoryRead.ok ? releaseInventory(inventoryRead.data, {
-    projectRef: identity.projectRef,
-    deploymentId: identity.deploymentId
-  }) : null;
-  if (!inventory || inventory.releases.length > RELEASE_LIST_LIMIT_MAX || inventory.active_release_id !== identity.releaseId || inventory.active_activation_id !== identity.mutationId) {
-    return { release: null, status: inventoryRead.status };
+  const snapshot = await readActiveFrontendRelease(http, identity.projectRef, identity.deploymentId);
+  if ("failure" in snapshot)
+    return { release: null, status: snapshot.status };
+  const inventory = snapshot.inventory;
+  if (inventory.active_release_id !== identity.releaseId || inventory.active_activation_id !== identity.mutationId) {
+    return { release: null, status: 200 };
+  }
+  if (snapshot.exactReadback) {
+    return { release: inventory.releases[0] ?? null, status: 200 };
   }
   const releaseRead = await http.get(releasePath(identity.projectRef, identity.deploymentId, identity.releaseId), { maxJsonBytes: RESPONSE_MAX_BYTES });
   const release = releaseRead.ok ? releaseEnvelope(releaseRead.data, {
@@ -218388,6 +218390,103 @@ async function activeReleaseReadback(http, identity) {
   }) : null;
   return { release, status: releaseRead.status };
 }
+async function readActiveFrontendRelease(http, projectRef, deploymentId) {
+  const response = await http.get(`${deploymentEndpoint(projectRef, deploymentId)}/active-release`, {
+    maxJsonBytes: RESPONSE_MAX_BYTES
+  });
+  const inventory = response.ok && response.status === 200 ? releaseInventory(response.data, { projectRef, deploymentId }) : null;
+  if (inventory) {
+    if (inventory.next_cursor !== null || inventory.releases.length !== (inventory.active_release_id === null ? 0 : 1) || inventory.releases[0] && inventory.releases[0].release_id !== inventory.active_release_id) {
+      return { failure: releaseReadFailure("frontend.get_active_release", response), status: response.status };
+    }
+    return { inventory, exactReadback: false };
+  }
+  if (response.ok || response.status !== 404) {
+    return { failure: releaseReadFailure("frontend.get_active_release", response), status: response.status };
+  }
+  const historyResponse = await http.get(`${releaseEndpoint(projectRef, deploymentId)}?limit=1`, {
+    maxJsonBytes: RESPONSE_MAX_BYTES
+  });
+  const history = historyResponse.ok && historyResponse.status === 200 ? releaseInventory(historyResponse.data, { projectRef, deploymentId }) : null;
+  if (!history || history.releases.length > 1) {
+    return {
+      failure: releaseReadFailure("frontend.get_active_release", historyResponse),
+      status: historyResponse.status
+    };
+  }
+  if (history.active_release_id === null) {
+    return { inventory: { ...history, releases: [], next_cursor: null }, exactReadback: false };
+  }
+  const exactResponse = await http.get(releasePath(projectRef, deploymentId, history.active_release_id), {
+    maxJsonBytes: RESPONSE_MAX_BYTES
+  });
+  const release = exactResponse.ok && exactResponse.status === 200 ? releaseEnvelope(exactResponse.data, { projectRef, deploymentId, releaseId: history.active_release_id }) : null;
+  if (!release) {
+    return {
+      failure: releaseReadFailure("frontend.get_active_release", exactResponse),
+      status: exactResponse.status
+    };
+  }
+  return { inventory: { ...history, releases: [release], next_cursor: null }, exactReadback: true };
+}
+async function getActiveFrontendRelease(http, projectRef, deploymentId) {
+  const snapshot = await readActiveFrontendRelease(http, projectRef, deploymentId);
+  return "failure" in snapshot ? snapshot.failure : toolResponse(snapshot.inventory);
+}
+async function readFrontendReleaseAuthority(http, projectRef, deploymentId) {
+  return getActiveFrontendRelease(http, projectRef, deploymentId);
+}
+async function rollbackFrontendRelease(http, projectRef, deploymentId, releaseId) {
+  if (!RELEASE_ID_PATTERN.test(releaseId))
+    throw new Error("'release_id' must be a SHA-256 digest");
+  const authority = await readActiveFrontendRelease(http, projectRef, deploymentId);
+  if ("failure" in authority)
+    return authority.failure;
+  const inventory = authority.inventory;
+  if (inventory.active_release_id === releaseId) {
+    return toolResponse({
+      project_ref: projectRef,
+      deployment_id: deploymentId,
+      active_release_id: releaseId,
+      activation_id: inventory.active_activation_id,
+      unchanged: true
+    });
+  }
+  if (inventory.active_release_id === null || inventory.active_activation_id === null) {
+    return releaseFailure("frontend.rollback", "NO_ACTIVE_RELEASE", 409);
+  }
+  const target = await getFrontendRelease(http, projectRef, deploymentId, releaseId);
+  if (target.isError)
+    return target;
+  const mutationId = crypto.randomUUID();
+  const activation = await activateFrontendRelease(http, {
+    projectRef,
+    deploymentId,
+    releaseId,
+    expectedActiveReleaseId: inventory.active_release_id,
+    expectedActivationId: inventory.active_activation_id,
+    mutationId
+  });
+  if (activation.isError) {
+    return {
+      ...toolResponse({
+        ...JSON.parse(activation.content[0].text),
+        operation: "frontend.rollback",
+        mutation_id: mutationId,
+        target_release_id: releaseId,
+        expected_active_release_id: inventory.active_release_id,
+        expected_activation_id: inventory.active_activation_id
+      }),
+      isError: true
+    };
+  }
+  return toolResponse({
+    ...JSON.parse(activation.content[0].text),
+    rollback: true,
+    previous_release_id: inventory.active_release_id,
+    previous_activation_id: inventory.active_activation_id
+  });
+}
 async function activateFrontendRelease(http, input) {
   const mutationId = input.mutationId;
   if (!MUTATION_ID_PATTERN.test(mutationId))
@@ -218454,7 +218553,7 @@ async function activationReadback(http, input, mutationId, activationStatus) {
 // src/shared/tools/frontend-tools.ts
 function registerFrontendTools(server2, http) {
   registerTool(server2, "frontend", `Frontend hosting and immutable prebuilt releases. Supports: static, react, vue, svelte, sveltekit, sveltekit-static, nextjs, nuxt, astro.
-Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy, build_logs, add_domain, remove_domain, set_env, list_frameworks, list_records, list_releases, get_release, upload_release, activate_release`, {
+Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy, build_logs, add_domain, remove_domain, set_env, list_frameworks, list_records, list_releases, get_active_release, get_release, upload_release, activate_release, rollback`, {
     action: withDescription(stringEnum([
       "list",
       "get",
@@ -218471,9 +218570,11 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
       "list_frameworks",
       "list_records",
       "list_releases",
+      "get_active_release",
       "get_release",
       "upload_release",
-      "activate_release"
+      "activate_release",
+      "rollback"
     ]), "Action"),
     ref: optional(String2(), "Project ref"),
     id: optional(String2(), "Deployment ID"),
@@ -218489,7 +218590,7 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
     git_url: optional(String2(), "[deploy_git] Git repository URL"),
     branch: optional(String2(), "[deploy_git] Branch (default: main)"),
     zip_path: optional(String2(), "[deploy_upload/upload_release] Local ZIP file path"),
-    release_id: optional(String2(), "[get_release/activate_release] SHA-256 release ID"),
+    release_id: optional(String2(), "[get_release/activate_release/rollback] SHA-256 release ID"),
     expected_active_release_id: optional(String2(), "[activate_release] Current release SHA-256 or absent"),
     expected_activation_id: optional(String2(), "[activate_release] Current activation UUIDv4 or absent"),
     mutation_id: optional(String2(), "[activate_release] Required retry-stable UUIDv4"),
@@ -218634,6 +218735,10 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
         need("id", id);
         need("release_id", release_id);
         return getFrontendRelease(http, ref, id, release_id);
+      case "get_active_release":
+        need("ref", ref);
+        need("id", id);
+        return getActiveFrontendRelease(http, ref, id);
       case "upload_release":
         need("ref", ref);
         need("id", id);
@@ -218654,6 +218759,11 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
           expectedActivationId: expected_activation_id,
           mutationId: mutation_id
         });
+      case "rollback":
+        need("ref", ref);
+        need("id", id);
+        need("release_id", release_id);
+        return rollbackFrontendRelease(http, ref, id, release_id);
       default:
         text = `❌ Unknown action`;
     }
@@ -252167,7 +252277,7 @@ function registerDeployTools(server2, http, options = {}) {
     report("package", relative17(projectDirectory, outputDirectory) || ".");
     const archive = await createFrontendArchive(outputDirectory);
     try {
-      const inventory = payload(await listFrontendReleases(http, projectRef, selected.id, undefined, 100));
+      const inventory = payload(await readFrontendReleaseAuthority(http, projectRef, selected.id));
       const activeReleaseId = typeof inventory.active_release_id === "string" ? inventory.active_release_id : null;
       const activeActivationId = typeof inventory.active_activation_id === "string" ? inventory.active_activation_id : null;
       if (archive.sha256 === activeReleaseId) {
@@ -252210,6 +252320,8 @@ function registerDeployTools(server2, http, options = {}) {
         deployment_id: selected.id,
         release_id: activated.active_release_id,
         activation_id: activated.activation_id,
+        previous_release_id: activeReleaseId,
+        previous_activation_id: activeActivationId,
         url: finalDeployment.deploymentUrl,
         file_count: archive.fileCount,
         source_bytes: archive.sourceBytes,
@@ -252492,7 +252604,7 @@ function registerRemoteDevTools(server2, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.75.1",
+  version: "0.76.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.75.1",
+  "version": "0.76.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",