@supacloud/cli 0.78.0 → 0.80.0

package/dist/index.js

@@ -179093,11 +179093,13 @@ function resolveSupaCloudContext(env = process.env, cwd = process.cwd(), selecti
 var ACTION_POLICY = {
   deploy: { write: ["deploy"] },
   applications: {
-    read: ["list_releases", "get_release", "get_runtime", "get_deployment_evidence", "get_configuration", "logs", "get_preview_plan"],
+    read: ["list_releases", "get_release", "get_runtime", "get_deployment_evidence", "get_configuration", "get_rollback_snapshot", "get_history", "get_deploy_plan", "logs", "get_preview_plan"],
     write: [
       "upload_release",
       "put_configuration",
       "activate_release",
+      "deploy_release",
+      "rollback_release",
       "reconcile_activation",
       "retire_activation",
       "create_preview",
@@ -179199,7 +179201,7 @@ var ACTION_POLICY = {
   ai: { local: ["show_skill", "install_skill"] },
   app: {
     local: ["init", "generate", "dev", "watch", "verify-plan", "compile", "check", "graph", "explain", "export-tools", "context", "doctor", "fix", "plan", "build"],
-    read: ["status", "logs", "preview-plan"],
+    read: ["status", "logs", "rollback-plan", "history", "deploy-plan", "diff", "preview-plan"],
     write: ["upload", "configure", "deploy", "rollback", "reconcile", "retire", "preview", "previews", "preview-status", "preview-cleanup"]
   },
   db: {
@@ -180280,6 +180282,143 @@ var ApplicationActivationRetirementResultSchema = _Object_({
   activation_id: ApplicationActivationIdSchema,
   retired_at: String2()
 }, { additionalProperties: false });
+var RollbackActivationSchema = _Object_({
+  release_id: ApplicationReleaseIdSchema,
+  configuration_id: ApplicationConfigurationIdSchema,
+  activation_id: ApplicationActivationIdSchema
+}, { additionalProperties: false });
+var ApplicationRollbackSnapshotSchema = _Object_({
+  schema: Literal("supacloud.application-rollback-snapshot.v1"),
+  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+  application_id: ApplicationIdSchema,
+  environment_id: ApplicationIdSchema,
+  active: Union([RollbackActivationSchema, Null()]),
+  previous: Union([RollbackActivationSchema, Null()])
+}, { additionalProperties: false });
+// node_modules/@supacloud/delivery/src/application-deploy-plan.ts
+var CandidateSchema = _Object_({
+  release_id: ApplicationReleaseIdSchema,
+  configuration_id: ApplicationConfigurationIdSchema
+}, { additionalProperties: false });
+var ApplicationDeployPlanSchema = _Object_({
+  schema: Literal("supacloud.application-deploy-plan.v1"),
+  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+  application_id: ApplicationIdSchema,
+  environment_id: ApplicationIdSchema,
+  candidate: CandidateSchema,
+  current: Union([_Object_({
+    ...CandidateSchema.properties,
+    activation_id: ApplicationActivationIdSchema
+  }, { additionalProperties: false }), Null()]),
+  expected_activation_id: Union([ApplicationActivationIdSchema, Null()]),
+  action: Union([Literal("activate"), Literal("no-op")]),
+  changes: _Object_({
+    release: Boolean2(),
+    configuration: Boolean2(),
+    targets: _Object_({
+      added: _Array_(String2()),
+      removed: _Array_(String2()),
+      changed: _Array_(String2())
+    }, { additionalProperties: false })
+  }, { additionalProperties: false }),
+  migrations: _Object_({
+    ledger_digest: ApplicationReleaseIdSchema,
+    ledger_compatible: Boolean2(),
+    project_migrations_applied: Boolean2(),
+    operator_provisioning: Union([
+      Literal("separate-verification-required"),
+      Literal("not-declared")
+    ])
+  }, { additionalProperties: false }),
+  compatibility: Literal("not-proven"),
+  execution_performed: Literal(false)
+}, { additionalProperties: false });
+function parseApplicationDeployPlan(value) {
+  if (!Check2(ApplicationDeployPlanSchema, value) || value.expected_activation_id !== (value.current?.activation_id ?? null) || value.changes.release !== (value.current?.release_id !== value.candidate.release_id) || value.changes.configuration !== (value.current?.configuration_id !== value.candidate.configuration_id) || value.migrations.project_migrations_applied && !value.migrations.ledger_compatible) {
+    throw new Error("Invalid application deploy plan");
+  }
+  const noOp = value.current !== null && !value.changes.release && !value.changes.configuration && Object.values(value.changes.targets).every((names) => names.length === 0) && value.migrations.ledger_compatible && value.migrations.project_migrations_applied && value.migrations.operator_provisioning === "not-declared";
+  if (value.action === "no-op" !== noOp)
+    throw new Error("Invalid application deploy plan action");
+  return value;
+}
+// node_modules/@supacloud/delivery/src/application-history.ts
+var scope = {
+  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+  application_id: ApplicationIdSchema,
+  environment_id: ApplicationIdSchema
+};
+var timestamp = String2({ pattern: "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{6}Z$" });
+var ApplicationActivationHistoryPositionSchema = _Object_({
+  completed_at: timestamp,
+  activation_id: ApplicationActivationIdSchema
+}, { additionalProperties: false });
+var cursorSchema = _Object_({
+  ...scope,
+  ...ApplicationActivationHistoryPositionSchema.properties
+}, { additionalProperties: false });
+var ApplicationActivationHistoryCursorSchema = String2({
+  pattern: "^[A-Za-z0-9_-]+$",
+  maxLength: 1024,
+  minLength: 1
+});
+var entrySchema = _Object_({
+  ...ApplicationActivationHistoryPositionSchema.properties,
+  release_id: ApplicationReleaseIdSchema,
+  configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
+  previous_activation_id: Union([ApplicationActivationIdSchema, Null()]),
+  is_active: Boolean2()
+}, { additionalProperties: false });
+var ApplicationActivationHistorySchema = _Object_({
+  schema: Literal("supacloud.application-activation-history.v1"),
+  ...scope,
+  active_activation_id: Union([ApplicationActivationIdSchema, Null()]),
+  activations: _Array_(entrySchema, { maxItems: 100 }),
+  next_cursor: Union([ApplicationActivationHistoryCursorSchema, Null()])
+}, { additionalProperties: false });
+function applicationHistoryTimestampMilliseconds(value) {
+  const milliseconds = `${value.slice(0, 23)}Z`;
+  if (!Check2(timestamp, value) || !Number.isFinite(Date.parse(milliseconds)) || new Date(milliseconds).toISOString() !== milliseconds)
+    throw new Error("Invalid application history timestamp");
+  return milliseconds;
+}
+function parseApplicationHistoryCursor(value, scope) {
+  if (!Check2(ApplicationActivationHistoryCursorSchema, value))
+    throw new Error("Invalid application history cursor");
+  const bytes = Buffer.from(value, "base64url");
+  if (bytes.toString("base64url") !== value)
+    throw new Error("Invalid application history cursor");
+  const cursor = JSON.parse(bytes.toString("utf8"));
+  if (!Check2(cursorSchema, cursor) || cursor.project_ref !== scope.project_ref || cursor.application_id !== scope.application_id || cursor.environment_id !== scope.environment_id) {
+    throw new Error("Invalid application history cursor");
+  }
+  applicationHistoryTimestampMilliseconds(cursor.completed_at);
+  return { completed_at: cursor.completed_at, activation_id: cursor.activation_id };
+}
+function applicationHistoryPositionBefore(left, right) {
+  return left.completed_at < right.completed_at || left.completed_at === right.completed_at && left.activation_id < right.activation_id;
+}
+function parseApplicationActivationHistory(value) {
+  if (!Check2(ApplicationActivationHistorySchema, value))
+    throw new Error("Invalid application activation history");
+  const seen = new Set;
+  let previous;
+  for (const entry of value.activations) {
+    applicationHistoryTimestampMilliseconds(entry.completed_at);
+    if (seen.has(entry.activation_id) || previous && !applicationHistoryPositionBefore(entry, previous) || entry.previous_activation_id === entry.activation_id || entry.is_active !== (entry.activation_id === value.active_activation_id)) {
+      throw new Error("Invalid application activation history");
+    }
+    seen.add(entry.activation_id);
+    previous = entry;
+  }
+  if (value.next_cursor !== null) {
+    const cursor = parseApplicationHistoryCursor(value.next_cursor, value);
+    if (!previous || cursor.activation_id !== previous.activation_id || cursor.completed_at !== previous.completed_at) {
+      throw new Error("Invalid application activation history");
+    }
+  }
+  return structuredClone(value);
+}
 // node_modules/@supacloud/delivery/src/deployment-evidence.ts
 var closed3 = { additionalProperties: false };
 var sha256 = String2({ pattern: "^[a-f0-9]{64}$" });
@@ -180451,7 +180590,7 @@ function parseApplicationReadinessReport(value) {
   return value;
 }
 // node_modules/@supacloud/delivery/src/delivery-migration-archive.ts
-var entrySchema = _Object_({
+var entrySchema2 = _Object_({
   version: String2({ pattern: "^[1-9][0-9]{0,18}$" }),
   name: String2({ pattern: "^[A-Za-z][A-Za-z0-9_-]{0,127}$" }),
   executor: Union([Literal("project-migration"), Literal("operator-provisioning")]),
@@ -180465,7 +180604,7 @@ var archiveSchema = _Object_({
   compatibility: Literal("not-proven"),
   executionPerformed: Literal(false),
   dataRecovery: Literal("separate-required"),
-  migrations: _Array_(entrySchema, { minItems: 1, maxItems: 128 })
+  migrations: _Array_(entrySchema2, { minItems: 1, maxItems: 128 })
 }, { additionalProperties: false });
 async function readDeliveryMigrationArchive(manifestPath, target) {
   try {
@@ -187252,6 +187391,8 @@ var ApplicationActivationIdSchema2 = ApplicationActivationIdSchema;
 var ApplicationActivationWriteSchema2 = ApplicationActivationWriteSchema;
 var ApplicationActivationResultSchema2 = ApplicationActivationResultSchema;
 var ApplicationActivationRetirementResultSchema2 = ApplicationActivationRetirementResultSchema;
+var ApplicationRollbackSnapshotSchema2 = ApplicationRollbackSnapshotSchema;
+var ApplicationActivationHistoryCursorSchema2 = ApplicationActivationHistoryCursorSchema;
 
 // src/shared/tools/application-preview-tools.ts
 var APPLICATION_PREVIEW_ACTIONS = [
@@ -187338,14 +187479,14 @@ var actionFields = {
   get_preview: ["preview_id", "wait", "timeout_seconds"],
   cleanup_preview: ["preview_id"]
 };
-function timestamp(value) {
+function timestamp2(value) {
   return Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
 }
 function receipt(value, identity) {
   if (!Check2(receiptSchema, value) || value.project_ref !== identity.ref || value.application_id !== identity.id || value.environment_id !== identity.environment || identity.previewId && value.preview_id !== identity.previewId || value.resources.build_artifact.release_id !== value.release_id || value.resources.storage_namespace.namespace !== value.resources.database_branch.branch_ref) {
     throw new Error("Invalid preview receipt");
   }
-  if (value.expires_at !== null && !timestamp(value.expires_at) || value.created_at !== undefined && !timestamp(value.created_at) || value.updated_at !== undefined && !timestamp(value.updated_at) || value.expires_at !== null && value.created_at !== undefined && !Check2(ttlSecondsSchema, (Date.parse(value.expires_at) - Date.parse(value.created_at)) / 1000)) {
+  if (value.expires_at !== null && !timestamp2(value.expires_at) || value.created_at !== undefined && !timestamp2(value.created_at) || value.updated_at !== undefined && !timestamp2(value.updated_at) || value.expires_at !== null && value.created_at !== undefined && !Check2(ttlSecondsSchema, (Date.parse(value.expires_at) - Date.parse(value.created_at)) / 1000)) {
     throw new Error("Invalid preview expiry");
   }
   if (value.status === "ready") {
@@ -187589,7 +187730,12 @@ var APPLICATION_TOOL_SCHEMA = {
     "get_deployment_evidence",
     "get_configuration",
     "put_configuration",
+    "get_deploy_plan",
+    "deploy_release",
     "activate_release",
+    "rollback_release",
+    "get_rollback_snapshot",
+    "get_history",
     "reconcile_activation",
     "retire_activation",
     ...APPLICATION_PREVIEW_ACTIONS,
@@ -187597,15 +187743,15 @@ var APPLICATION_TOOL_SCHEMA = {
   ]), "Action"),
   ref: withDescription(String2(), "Project ref"),
   id: withDescription(ApplicationIdSchema2, "Application ID"),
-  environment_id: optional(withDescription(ApplicationIdSchema2, "[get_runtime/get_configuration/put_configuration] Environment ID")),
-  configuration_id: optional(ApplicationConfigurationIdSchema2, "[get_configuration/activate_release] Immutable revision; required for activation"),
-  activation_id: optional(ApplicationActivationIdSchema2, "[activate_release/reconcile_activation/retire_activation] Explicit stable activation ID"),
-  expected_activation_id: optional(Union([ApplicationActivationIdSchema2, Null(), Literal("absent")]), "[activate_release] Current activation ID, or absent for first activation"),
+  environment_id: optional(withDescription(ApplicationIdSchema2, "[get_runtime/get_configuration/put_configuration/get_deploy_plan/deploy_release/get_rollback_snapshot/rollback_release/get_history] Environment ID")),
+  configuration_id: optional(ApplicationConfigurationIdSchema2, "[get_configuration/get_deploy_plan/deploy_release/activate_release/rollback_release/get_history] Immutable revision; required for deployment"),
+  activation_id: optional(ApplicationActivationIdSchema2, "[deploy_release/activate_release/reconcile_activation/retire_activation/rollback_release/get_history] Stable activation ID; generated for automatic deployment/rollback if omitted"),
+  expected_activation_id: optional(Union([ApplicationActivationIdSchema2, Null(), Literal("absent")]), "[deploy_release/activate_release/rollback_release] Current activation ID, or absent for first activation; selected from verified plan for automatic deployment"),
   configuration_path: optional(String2(), "[put_configuration] Local configuration write JSON including revision and expected revision"),
   manifest_path: optional(String2(), "[upload_release] Local delivery.manifest.json"),
-  release_id: optional(ApplicationReleaseIdSchema2, "[get_release/activate_release/reconcile_activation] Immutable application release ID"),
-  cursor: optional(ApplicationReleaseIdSchema2, "[list_releases] Last release ID"),
-  limit: optional(Integer({ minimum: 1, maximum: 100 }), "[list_releases] Page size, default 50"),
+  release_id: optional(ApplicationReleaseIdSchema2, "[get_release/get_deploy_plan/deploy_release/activate_release/reconcile_activation/rollback_release] Immutable application release ID; platform selects previous for default rollback"),
+  cursor: optional(Union([ApplicationReleaseIdSchema2, ApplicationActivationHistoryCursorSchema2]), "[list_releases/get_history] Returned page cursor"),
+  limit: optional(Integer({ minimum: 1, maximum: 100 }), "[list_releases/get_history] Page size, default 50/20"),
   offset: optional(Integer({ minimum: 0, maximum: 1e6 }), "[logs] Result offset"),
   service: optional(String2(), "[logs] Application target/service filter"),
   search: optional(String2(), "[logs] Full-text log filter"),
@@ -187636,6 +187782,84 @@ function boundRelease(value, ref, id) {
     throw new Error("Unbound application release");
   return release;
 }
+async function readDeployPlan(http, args, project) {
+  const ref = text(args, "ref"), id = text(args, "id"), environmentId = text(args, "environment_id");
+  const releaseId = text(args, "release_id"), configurationId = text(args, "configuration_id");
+  if (!Check2(ApplicationIdSchema2, environmentId) || !Check2(ApplicationReleaseIdSchema2, releaseId) || !Check2(ApplicationConfigurationIdSchema2, configurationId))
+    throw new Error("Invalid deployment plan identity");
+  const identity = {
+    project_ref: ref,
+    application_id: id,
+    environment_id: environmentId,
+    release_id: releaseId,
+    configuration_id: configurationId
+  };
+  const query = new URLSearchParams({ release_id: releaseId, configuration_id: configurationId });
+  const response = await http.get(`/v1/projects/${project}/applications/${encodeURIComponent(id)}/environments/${encodeURIComponent(environmentId)}/deploy-plan?${query}`, { maxJsonBytes: 65536, responseTimeoutMs: 30000 });
+  const operation = `applications.${text(args, "action")}`;
+  if (!response.ok)
+    return { failure: releaseControlFailure(operation, "HTTP_ERROR", response.transportError ? null : response.status, identity) };
+  let plan;
+  try {
+    if (response.status !== 200)
+      throw new Error("Incomplete deployment plan response");
+    plan = parseApplicationDeployPlan(response.data);
+    if (plan.project_ref !== ref || plan.application_id !== id || plan.environment_id !== environmentId || plan.candidate.release_id !== releaseId || plan.candidate.configuration_id !== configurationId)
+      throw new Error;
+  } catch {
+    return { failure: releaseControlFailure(operation, "INVALID_RESPONSE", response.status, identity) };
+  }
+  return { plan, identity };
+}
+async function deployAction(http, args, project) {
+  const activationId = args["activation_id"], expected = args["expected_activation_id"];
+  if (activationId !== undefined && !Check2(ApplicationActivationIdSchema2, activationId)) {
+    throw new Error("Invalid application activation ID");
+  }
+  if (expected !== undefined && expected !== null && expected !== "absent" && !Check2(ApplicationActivationIdSchema2, expected))
+    throw new Error("Invalid expected activation ID");
+  if (activationId !== undefined && expected !== undefined) {
+    return activationAction(http, { ...args, action: "activate_release" }, project, {
+      operation: "applications.deploy_release",
+      configuration_id: args["configuration_id"],
+      expected_activation_id: expected === "absent" ? null : expected
+    });
+  }
+  const observed = await readDeployPlan(http, args, project);
+  if (observed.failure)
+    return observed.failure;
+  const { plan, identity } = observed;
+  if (expected !== undefined && (expected === "absent" ? null : expected) !== plan.expected_activation_id) {
+    return releaseControlFailure("applications.deploy_release", "HTTP_ERROR", 409, {
+      ...identity,
+      reason: "EXPECTED_ACTIVATION_CONFLICT",
+      expected_activation_id: plan.expected_activation_id
+    });
+  }
+  if (plan.action === "no-op")
+    return releaseControlSuccess("applications.deploy_release", {
+      ...identity,
+      no_op: true,
+      execution_performed: false,
+      activation_id: plan.current.activation_id,
+      expected_activation_id: plan.expected_activation_id,
+      plan,
+      ...activationId === undefined ? {} : { requested_activation_id: activationId }
+    });
+  const selectedId = activationId ?? crypto.randomUUID();
+  if (selectedId === plan.expected_activation_id)
+    throw new Error("Deployment requires a new activation ID");
+  return activationAction(http, {
+    ...args,
+    action: "activate_release",
+    activation_id: selectedId,
+    expected_activation_id: plan.expected_activation_id
+  }, project, {
+    operation: "applications.deploy_release",
+    configuration_id: args["configuration_id"],
+    expected_activation_id: plan.expected_activation_id
+  });
+}
 async function configurationAction(http, args, project) {
   const action = text(args, "action"), ref = text(args, "ref"), id = text(args, "id");
   const environmentId = text(args, "environment_id"), operation = `applications.${action}`;
@@ -187682,7 +187906,7 @@ async function configurationAction(http, args, project) {
     return releaseControlFailure(operation, action === "put_configuration" ? "OUTCOME_UNKNOWN" : "INVALID_RESPONSE", result.status, identity);
   }
 }
-async function activationAction(http, args, project) {
+async function activationAction(http, args, project, selection) {
   const action = text(args, "action"), ref = text(args, "ref"), id = text(args, "id");
   const environmentId = text(args, "environment_id"), activationId = text(args, "activation_id");
   const releaseId = args["release_id"] === undefined ? undefined : text(args, "release_id");
@@ -187692,7 +187916,7 @@ async function activationAction(http, args, project) {
   if (!Check2(ApplicationIdSchema2, environmentId) || !Check2(ApplicationActivationIdSchema2, activationId) || action !== "retire_activation" && !Check2(ApplicationReleaseIdSchema2, releaseId)) {
     throw new Error("Invalid application activation identity");
   }
-  const operation = `applications.${action}`;
+  const operation = selection?.operation ?? `applications.${action}`;
   const path = `/v1/projects/${project}/applications/${encodeURIComponent(id)}/environments/${encodeURIComponent(environmentId)}/activations`;
   const identity = {
     project_ref: ref,
@@ -187701,6 +187925,11 @@ async function activationAction(http, args, project) {
     activation_id: activationId,
     ...releaseId ? { release_id: releaseId } : {}
   };
+  const selectedState = selection ? {
+    configuration_id: selection.configuration_id,
+    expected_activation_id: selection.expected_activation_id
+  } : {};
+  const safeState = { ...identity, ...selectedState };
   let body = {};
   if (action === "activate_release") {
     body = {
@@ -187715,7 +187944,9 @@ async function activationAction(http, args, project) {
   const endpoint = action === "activate_release" ? path : `${path}/${activationId}/${action === "retire_activation" ? "retire" : "reconcile"}`;
   const result = await http.post(endpoint, body, { timeoutMs: 120000, maxJsonBytes: 65536, responseTimeoutMs: 30000 });
   if (!result.ok)
-    return releaseControlMutationFailure(operation, result, identity);
+    return releaseControlMutationFailure(operation, result, safeState);
+  if (result.status !== 200)
+    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", result.status, safeState);
   if (action === "retire_activation") {
     if (!Check2(ApplicationActivationRetirementResultSchema2, result.data) || Object.entries(identity).some(([key, value]) => Reflect.get(result.data, key) !== value)) {
       return releaseControlFailure(operation, "OUTCOME_UNKNOWN", result.status, identity);
@@ -187723,9 +187954,88 @@ async function activationAction(http, args, project) {
     return releaseControlSuccess(operation, result.data);
   }
   if (!Check2(ApplicationActivationResultSchema2, result.data) || Object.entries(identity).some(([key, value]) => Reflect.get(result.data, key) !== value) || action === "reconcile_activation" && !result.data.replayed) {
-    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", result.status, identity);
+    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", result.status, safeState);
+  }
+  return releaseControlSuccess(operation, { ...result.data, ...selectedState });
+}
+async function rollbackAction(http, args, project) {
+  const ref = text(args, "ref"), id = text(args, "id"), environmentId = text(args, "environment_id");
+  if (!Check2(ApplicationIdSchema2, environmentId))
+    throw new Error("Invalid environment ID");
+  const operation = `applications.${text(args, "action")}`;
+  const identity = { project_ref: ref, application_id: id, environment_id: environmentId };
+  let activationId = args["activation_id"];
+  if (activationId !== undefined && !Check2(ApplicationActivationIdSchema2, activationId)) {
+    throw new Error("Invalid application activation ID");
+  }
+  let releaseId = args["release_id"], configurationId = args["configuration_id"];
+  let expectedActivationId = args["expected_activation_id"];
+  if (releaseId === undefined || args["action"] === "get_rollback_snapshot") {
+    if (releaseId !== undefined || configurationId !== undefined || expectedActivationId !== undefined) {
+      throw new Error("Default rollback selection cannot mix explicit release/configuration/CAS flags");
+    }
+    const response = await http.get(`/v1/projects/${project}/applications/${encodeURIComponent(id)}/environments/${encodeURIComponent(environmentId)}/rollback-snapshot`, { maxJsonBytes: 65536, responseTimeoutMs: 30000 });
+    if (!response.ok)
+      return releaseControlFailure(operation, "HTTP_ERROR", response.transportError ? null : response.status, identity);
+    const snapshot = response.data;
+    if (response.status !== 200 || !Check2(ApplicationRollbackSnapshotSchema2, snapshot) || snapshot.project_ref !== ref || snapshot.application_id !== id || snapshot.environment_id !== environmentId || snapshot.previous !== null && (snapshot.active === null || snapshot.previous.activation_id === snapshot.active.activation_id)) {
+      return releaseControlFailure(operation, "INVALID_RESPONSE", response.status, identity);
+    }
+    if (args["action"] === "get_rollback_snapshot")
+      return releaseControlSuccess(operation, { ...identity, snapshot });
+    if (!snapshot.active || !snapshot.previous) {
+      return releaseControlFailure(operation, "MUTATION_NOT_SUCCEEDED", response.status, {
+        ...identity,
+        reason: "NO_PREVIOUS_ACTIVATION"
+      });
+    }
+    if (activationId === snapshot.active.activation_id || activationId === snapshot.previous.activation_id) {
+      throw new Error("Rollback requires a new activation ID");
+    }
+    releaseId = snapshot.previous.release_id;
+    configurationId = snapshot.previous.configuration_id;
+    expectedActivationId = snapshot.active.activation_id;
+  }
+  activationId ??= crypto.randomUUID();
+  return activationAction(http, {
+    ...args,
+    action: "activate_release",
+    activation_id: activationId,
+    release_id: releaseId,
+    configuration_id: configurationId,
+    expected_activation_id: expectedActivationId
+  }, project, {
+    operation: "applications.rollback_release",
+    configuration_id: configurationId,
+    expected_activation_id: expectedActivationId === "absent" ? null : expectedActivationId
+  });
+}
+async function historyAction(http, args, project) {
+  const ref = text(args, "ref"), id = text(args, "id"), environmentId = text(args, "environment_id");
+  if (!Check2(ApplicationIdSchema2, environmentId))
+    throw new Error("Invalid environment ID");
+  const limit = args["limit"] ?? 20, cursor = args["cursor"];
+  if (typeof limit !== "number" || !Number.isInteger(limit) || limit < 1 || limit > 100 || cursor !== undefined && typeof cursor !== "string")
+    throw new Error("Invalid history page");
+  const query = new URLSearchParams({ limit: String(limit) });
+  const scope = { project_ref: ref, application_id: id, environment_id: environmentId };
+  const before = typeof cursor === "string" ? parseApplicationHistoryCursor(cursor, scope) : null;
+  if (typeof cursor === "string")
+    query.set("cursor", cursor);
+  const operation = "applications.get_history";
+  const response = await http.get(`/v1/projects/${project}/applications/${encodeURIComponent(id)}/environments/${encodeURIComponent(environmentId)}/history?${query}`, { maxJsonBytes: 262144, responseTimeoutMs: 30000 });
+  if (!response.ok)
+    return releaseControlFailure(operation, "HTTP_ERROR", response.transportError ? null : response.status, scope);
+  try {
+    if (response.status !== 200)
+      throw new Error;
+    const history = parseApplicationActivationHistory(response.data);
+    if (history.project_ref !== ref || history.application_id !== id || history.environment_id !== environmentId || history.activations.length > limit || history.next_cursor !== null && history.activations.length !== limit || before && history.activations.some((entry) => !applicationHistoryPositionBefore(entry, before)))
+      throw new Error;
+    return releaseControlSuccess(operation, { project_ref: ref, application_id: id, environment_id: environmentId, history });
+  } catch {
+    return releaseControlFailure(operation, "INVALID_RESPONSE", response.status, scope);
   }
-  return releaseControlSuccess(operation, result.data);
 }
 function registerApplicationTools(server2, http) {
   registerTool(server2, "applications", "Store, inspect and explicitly activate immutable HTTP/Worker application releases. Upload does not activate a release.", APPLICATION_TOOL_SCHEMA, async (args) => {
@@ -187735,6 +188045,17 @@ function registerApplicationTools(server2, http) {
       throw new Error("Invalid application ID");
     const path = `/v1/projects/${project}/applications/${encodeURIComponent(id)}/releases`;
     const operation = `applications.${action}`;
+    if (action === "get_deploy_plan") {
+      const observed = await readDeployPlan(http, args, project);
+      return observed.failure ?? releaseControlSuccess(operation, { ...observed.identity, plan: observed.plan });
+    }
+    if (action === "deploy_release")
+      return deployAction(http, args, project);
+    if (action === "rollback_release" || action === "get_rollback_snapshot") {
+      return rollbackAction(http, args, project);
+    }
+    if (action === "get_history")
+      return historyAction(http, args, project);
     if (APPLICATION_PREVIEW_ACTIONS.some((value) => value === action)) {
       return applicationPreviewAction(http, args, project);
     }
@@ -193979,9 +194300,13 @@ async function applyScaffoldWrites(plan) {
 var REMOTE_APP_ACTIONS = {
   upload: "upload_release",
   configure: "put_configuration",
-  deploy: "activate_release",
+  deploy: "deploy_release",
+  "deploy-plan": "get_deploy_plan",
+  diff: "get_deploy_plan",
   status: "get_runtime",
-  rollback: "activate_release",
+  rollback: "rollback_release",
+  "rollback-plan": "get_rollback_snapshot",
+  history: "get_history",
   reconcile: "reconcile_activation",
   retire: "retire_activation",
   logs: "logs",
@@ -193992,22 +194317,24 @@ var REMOTE_APP_ACTIONS = {
   "preview-cleanup": "cleanup_preview"
 };
 var REMOTE_APP_DESCRIPTIONS = {
-  ref: "[upload/configure/deploy/status/rollback/reconcile/retire/preview-plan/preview/previews/preview-status/preview-cleanup] Project ref (defaults to context)",
-  id: "[upload/configure/deploy/status/rollback/reconcile/retire/preview-plan/preview/previews/preview-status/preview-cleanup] Application ID",
-  environment_id: "[configure/deploy/status/rollback/reconcile/retire/preview-plan/preview/previews/preview-status/preview-cleanup] Environment ID",
-  configuration_id: "[deploy/rollback/preview] Required immutable configuration revision",
-  activation_id: "[deploy/rollback/reconcile/retire] Required explicit activation ID",
-  expected_activation_id: "[deploy/rollback] Required current activation ID, or absent for first activation",
+  ref: "[upload/configure/deploy/deploy-plan/diff/status/rollback/rollback-plan/history/reconcile/retire/preview-plan/preview/previews/preview-status/preview-cleanup] Project ref (defaults to context)",
+  id: "[upload/configure/deploy/deploy-plan/diff/status/rollback/rollback-plan/history/reconcile/retire/preview-plan/preview/previews/preview-status/preview-cleanup] Application ID",
+  environment_id: "[configure/deploy/deploy-plan/diff/status/rollback/rollback-plan/history/reconcile/retire/preview-plan/preview/previews/preview-status/preview-cleanup] Environment ID",
+  configuration_id: "[deploy/deploy-plan/diff/rollback/preview] Required for deployment/preview; platform selects for default rollback",
+  activation_id: "[deploy/rollback/reconcile/retire] Stable activation ID; auto-generated for deploy/rollback if omitted",
+  expected_activation_id: "[deploy/rollback] Auto-selected from verified state; supply with activation_id for an exact retry",
   configuration_path: "[configure] Configuration write JSON including revision and expected revision",
   manifest_path: "[upload] Local delivery.manifest.json",
-  release_id: "[deploy/rollback/reconcile/preview-plan/preview] Required immutable application release ID",
+  release_id: "[deploy/deploy-plan/diff/rollback/reconcile/preview-plan/preview] Required for deployment/preview; defaults to journal-selected previous for rollback",
   preview_id: "[preview-status/preview-cleanup] Preview receipt ID",
   branch_ref: "[preview-plan] Proposed branch ref; preview assigns its own",
   branch_name: "[preview] Branch display name",
   data_mode: "[preview-plan/preview] Default schema_only; full_clone copies rows",
   ttl_seconds: "[preview-plan/preview] Lifetime from 300 to 604800 seconds; creation defaults to the platform TTL",
   wait: "[preview/preview-status] Wait for verified readiness of the selected preview",
-  timeout_seconds: "[preview/preview-status] Observation budget with --wait, from 1 to 3600 seconds (default 300)"
+  timeout_seconds: "[preview/preview-status] Observation budget with --wait, from 1 to 3600 seconds (default 300)",
+  cursor: "[history] Returned page cursor",
+  limit: "[history] Page size, default 20 (1-100)"
 };
 var { action: _remoteAction, ...remoteFields } = APPLICATION_TOOL_SCHEMA;
 var REMOTE_APP_SCHEMA = Partial(_Object_(remoteFields)).properties;
@@ -194906,6 +195233,75 @@ async function runDelivery(args) {
   const result = await buildDeliveryProject(options, loaded.delivery);
   return textResult(JSON.stringify(result, null, 2), !result.ok);
 }
+var historyReceiptSchema = _Object_({
+  schema: Literal(RELEASE_CONTROL_RESPONSE_SCHEMA),
+  ok: Literal(true),
+  operation: Literal("applications.get_history"),
+  project_ref: String2(),
+  application_id: String2(),
+  environment_id: String2(),
+  history: ApplicationActivationHistorySchema
+}, { additionalProperties: false });
+function historyText(result, request, projectRef) {
+  if (result.isError)
+    return result;
+  try {
+    if (result.content.length !== 1 || result.content[0].text.length > 262144)
+      throw new Error;
+    const receipt = JSON.parse(result.content[0].text);
+    if (!Check2(historyReceiptSchema, receipt))
+      throw new Error;
+    const history = parseApplicationActivationHistory(receipt.history);
+    if (history.project_ref !== projectRef || history.application_id !== request.id || history.environment_id !== request.environment_id || receipt.project_ref !== history.project_ref || receipt.application_id !== history.application_id || receipt.environment_id !== history.environment_id)
+      throw new Error;
+    const lines = [
+      `Activation History: ${history.project_ref}/${history.application_id}/${history.environment_id}`,
+      `Active activation: ${history.active_activation_id ?? "none"}`,
+      ""
+    ];
+    if (history.activations.length === 0)
+      lines.push("No successful activations on this page.");
+    else {
+      lines.push(`${"Completed (UTC)".padEnd(29)}  ${"State".padEnd(7)}  ${"Activation ID".padEnd(36)}  Release (12)`);
+      for (const entry of history.activations)
+        lines.push(`${entry.completed_at.padEnd(29)}  ${(entry.is_active ? "current" : "-").padEnd(7)}  ${entry.activation_id}  ${entry.release_id.slice(0, 12)}`);
+    }
+    if (history.next_cursor)
+      lines.push("", `Next cursor: ${history.next_cursor}`);
+    return textResult(lines.join(`
+`));
+  } catch {
+    return releaseControlFailure("applications.get_history", "INVALID_RESPONSE", null);
+  }
+}
+function formatRemoteDeployPlan(result) {
+  if (result.isError)
+    return result;
+  try {
+    const payload = JSON.parse(result.content[0]?.text ?? "");
+    if (!payload || typeof payload !== "object" || !("ok" in payload) || payload.ok !== true || !("plan" in payload))
+      return result;
+    const plan = parseApplicationDeployPlan(payload.plan);
+    const names = (values, prefix) => values.map((name) => `${prefix}${name}`);
+    const targets = [
+      ...names(plan.changes.targets.added, "+"),
+      ...names(plan.changes.targets.removed, "-"),
+      ...names(plan.changes.targets.changed, "~")
+    ];
+    return textResult([
+      `${plan.project_ref}/${plan.application_id} [${plan.environment_id}]: ${plan.action === "no-op" ? "No changes" : "Activation required"}`,
+      `Release: ${plan.candidate.release_id} (${plan.changes.release ? "changed" : "unchanged"})`,
+      `Configuration: ${plan.candidate.configuration_id} (${plan.changes.configuration ? "changed" : "unchanged"})`,
+      `Targets: ${targets.length ? targets.join(", ") : "unchanged"}`,
+      `Migrations: ${!plan.migrations.ledger_compatible ? "ledger conflict" : plan.migrations.project_migrations_applied ? "applied" : "pending"}`,
+      `Provisioning: ${plan.migrations.operator_provisioning}`,
+      `Expected activation: ${plan.expected_activation_id ?? "absent"}`
+    ].join(`
+`));
+  } catch {
+    return result;
+  }
+}
 async function runAppTool(request, options = {}) {
   if (request.dry_run !== undefined && request["dry-run"] !== undefined || request.register_in !== undefined && request["register-in"] !== undefined || request.database_url !== undefined && request["database-url"] !== undefined) {
     throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "Do not combine hyphenated and underscored aliases of the same flag");
@@ -194922,18 +195318,26 @@ async function runAppTool(request, options = {}) {
   if (request.database_url !== undefined && request.action !== "dev" && request.action !== "watch") {
     throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "--database-url applies only to app dev --profile integration");
   }
+  if (request.json !== undefined && (request.action !== "history" || request.json !== true || request.format === "text")) {
+    throw new Error("--json applies only to app history and cannot be combined with --format text");
+  }
   if (Object.hasOwn(REMOTE_APP_ACTIONS, request.action)) {
     const delegate = options.getApplications?.();
     if (!delegate)
       return textResult("App remote actions require a Management API context.", true);
     const action = REMOTE_APP_ACTIONS[request.action];
+    const { format, json, ...remoteRequest } = request;
     const args = {
-      ...request,
+      ...remoteRequest,
       action,
       ref: request.ref ?? options.projectRef
     };
     validateToolArguments(APPLICATION_TOOL_SCHEMA, args);
-    return delegate(args);
+    const result = await delegate(args);
+    if (request.action === "history" && format !== "json" && json !== true) {
+      return historyText(result, request, args.ref);
+    }
+    return (request.action === "deploy-plan" || request.action === "diff") && format !== "json" ? formatRemoteDeployPlan(result) : result;
   }
   switch (request.action) {
     case "verify-plan": {
@@ -195008,8 +195412,12 @@ function registerAppTools(server2, options = {}) {
       "upload",
       "configure",
       "deploy",
+      "deploy-plan",
+      "diff",
       "status",
       "rollback",
+      "rollback-plan",
+      "history",
       "reconcile",
       "retire",
       "logs",
@@ -195018,7 +195426,7 @@ function registerAppTools(server2, options = {}) {
       "previews",
       "preview-status",
       "preview-cleanup"
-    ]), "App action; upload/configure only prepare, rollback activates an explicit old release without schema downgrade"),
+    ]), "App action; local plan is topology-only, deploy-plan/diff observe remote state, deploy skips verified no-op, rollback never downgrades schema"),
     kind: optional(stringEnum(["module", "command", "query", "controller", "job", "contract", "resource"]), "[generate] Scaffold kind"),
     template: optional(stringEnum(["minimal", "http", "command", "edge"]), "[init] Minimal application by default; explicit http/command/edge recipes"),
     name: optional(String2(), "[init/generate] Project or object name"),
@@ -195033,7 +195441,8 @@ function registerAppTools(server2, options = {}) {
     include: optional(String2(), "[dev/compile/check] Comma-separated glob patterns for source files"),
     out_dir: optional(String2(), "[dev/compile/plan/build/export-tools] Output directory (default: configured outDir)"),
     strict: optional(Boolean2(), "[dev/compile/check] Promote warnings to errors"),
-    format: optional(stringEnum(["text", "json"]), "[dev/generate/compile/check/plan/graph/export-tools] Output format (default: text)"),
+    format: optional(stringEnum(["text", "json"]), "[dev/generate/compile/check/plan/deploy-plan/diff/history/graph/export-tools] Output format (default: text)"),
+    json: optional(Literal(true), "[history] Return the validated JSON receipt"),
     profile: optional(stringEnum(["fast", "integration"]), "[dev] Run dev or dev:integration; integration verifies an explicit loopback database"),
     once: optional(Boolean2(), "[dev] Validate and report once without watching"),
     watch: optional(Boolean2(), "[dev] Watch for changes (default: true; --once disables)"),
@@ -198585,7 +198994,7 @@ function registerRemoteDevTools(server2, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.78.0",
+  version: "0.80.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -198637,14 +199046,14 @@ var package_default = {
   },
   dependencies: {
     "@supacloud/compiler": "^0.43.0",
-    "@supacloud/delivery": "0.8.0",
+    "@supacloud/delivery": "0.10.0",
     "@supacloud/db": "0.16.0",
     fflate: "^0.8.3",
     typebox: "1.3.34"
   },
   overrides: {
     "@supacloud/contracts": "0.8.0",
-    "@supacloud/delivery": "0.8.0",
+    "@supacloud/delivery": "0.10.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   devDependencies: {
@@ -198905,7 +199314,9 @@ EXAMPLES
   ${preferredCommand} app build --root .
   ${preferredCommand} app upload --ref abc123 --id orders --manifest_path generated/delivery/delivery.manifest.json
   ${preferredCommand} app configure --ref abc123 --id orders --environment_id test --configuration_path configuration.json
-  ${preferredCommand} app deploy --ref abc123 --id orders --environment_id test --release_id <sha256> --configuration_id <uuid> --activation_id <uuid> --expected_activation_id absent
+  ${preferredCommand} app deploy-plan --ref abc123 --id orders --environment_id test --release_id <sha256> --configuration_id <uuid>
+  ${preferredCommand} app diff --ref abc123 --id orders --environment_id test --release_id <sha256> --configuration_id <uuid>
+  ${preferredCommand} app deploy --ref abc123 --id orders --environment_id test --release_id <sha256> --configuration_id <uuid>
   ${preferredCommand} app status --ref abc123 --id orders --environment_id test
   ${preferredCommand} app preview-plan --ref abc123 --id orders --environment_id test --release_id <sha256> --branch_ref preview-orders
   ${preferredCommand} app preview --ref abc123 --id orders --environment_id test --release_id <sha256> --configuration_id <uuid> --ttl_seconds 3600 --wait

package/dist/shared/tools/app-tools.d.ts

@@ -3,9 +3,13 @@ import { type AppManifest } from "./app-tool-export";
 declare const REMOTE_APP_ACTIONS: {
     readonly upload: "upload_release";
     readonly configure: "put_configuration";
-    readonly deploy: "activate_release";
+    readonly deploy: "deploy_release";
+    readonly "deploy-plan": "get_deploy_plan";
+    readonly diff: "get_deploy_plan";
     readonly status: "get_runtime";
-    readonly rollback: "activate_release";
+    readonly rollback: "rollback_release";
+    readonly "rollback-plan": "get_rollback_snapshot";
+    readonly history: "get_history";
     readonly reconcile: "reconcile_activation";
     readonly retire: "retire_activation";
     readonly logs: "logs";
@@ -34,6 +38,8 @@ export interface AppToolArguments {
     configuration_path?: string;
     manifest_path?: string;
     release_id?: string;
+    cursor?: string;
+    limit?: number;
     preview_id?: string;
     branch_ref?: string;
     branch_name?: string;
@@ -56,6 +62,7 @@ export interface AppToolArguments {
     out_dir?: string;
     strict?: boolean;
     format?: "text" | "json";
+    json?: true;
     target?: string;
     fix?: string;
     write?: boolean;

package/dist/shared/tools/application-activation-http-status.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/shared/tools/application-deploy-http-status.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/shared/tools/application-history.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/shared/tools/application-schemas.d.ts

@@ -73,3 +73,20 @@ export declare const ApplicationActivationRetirementResultSchema: import("typebo
     activation_id: import("typebox").TString;
     retired_at: import("typebox").TString;
 }>;
+export declare const ApplicationRollbackSnapshotSchema: import("typebox").TObject<{
+    schema: import("typebox").TLiteral<"supacloud.application-rollback-snapshot.v1">;
+    project_ref: import("typebox").TString;
+    application_id: import("typebox").TString;
+    environment_id: import("typebox").TString;
+    active: import("typebox").TUnion<[import("typebox").TObject<{
+        release_id: import("typebox").TString;
+        configuration_id: import("typebox").TString;
+        activation_id: import("typebox").TString;
+    }>, import("typebox").TNull]>;
+    previous: import("typebox").TUnion<[import("typebox").TObject<{
+        release_id: import("typebox").TString;
+        configuration_id: import("typebox").TString;
+        activation_id: import("typebox").TString;
+    }>, import("typebox").TNull]>;
+}>;
+export declare const ApplicationActivationHistoryCursorSchema: import("typebox").TString;

package/dist/shared/tools/application-tools.d.ts

@@ -9,7 +9,7 @@ export declare const APPLICATION_TOOL_SCHEMA: {
     ttl_seconds: Type.TOptional<Type.TInteger>;
     wait: Type.TOptional<Type.TBoolean>;
     timeout_seconds: Type.TOptional<Type.TInteger>;
-    action: Type.TEnum<("list_releases" | "get_release" | "upload_release" | "activate_release" | "logs" | "get_runtime" | "get_deployment_evidence" | "get_configuration" | "get_preview_plan" | "put_configuration" | "reconcile_activation" | "retire_activation" | "create_preview" | "list_previews" | "get_preview" | "cleanup_preview")[]>;
+    action: Type.TEnum<("list_releases" | "get_release" | "upload_release" | "activate_release" | "logs" | "get_runtime" | "get_deployment_evidence" | "get_configuration" | "get_rollback_snapshot" | "get_history" | "get_deploy_plan" | "get_preview_plan" | "put_configuration" | "deploy_release" | "rollback_release" | "reconcile_activation" | "retire_activation" | "create_preview" | "list_previews" | "get_preview" | "cleanup_preview")[]>;
     ref: Type.TString;
     id: Type.TString;
     environment_id: Type.TOptional<Type.TString>;
@@ -19,7 +19,7 @@ export declare const APPLICATION_TOOL_SCHEMA: {
     configuration_path: Type.TOptional<Type.TString>;
     manifest_path: Type.TOptional<Type.TString>;
     release_id: Type.TOptional<Type.TString>;
-    cursor: Type.TOptional<Type.TString>;
+    cursor: Type.TOptional<Type.TUnion<[Type.TString, Type.TString]>>;
     limit: Type.TOptional<Type.TInteger>;
     offset: Type.TOptional<Type.TInteger>;
     service: Type.TOptional<Type.TString>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.78.0",
+  "version": "0.80.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,14 +52,14 @@
   },
   "dependencies": {
     "@supacloud/compiler": "^0.43.0",
-    "@supacloud/delivery": "0.8.0",
+    "@supacloud/delivery": "0.10.0",
     "@supacloud/db": "0.16.0",
     "fflate": "^0.8.3",
     "typebox": "1.3.34"
   },
   "overrides": {
     "@supacloud/contracts": "0.8.0",
-    "@supacloud/delivery": "0.8.0",
+    "@supacloud/delivery": "0.10.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   "devDependencies": {