Deploy and operate

Validate

"$OPENCLOUD_CLI" validate "$APP_DIR"

The command prints the exact manifest-reachable file list. Only the canonical manifest, frontend tree, declared migrations, and declared Function source trees enter the deterministic archive.

Validation also resolves runtime.javascriptSdk.version to one exact version. The deployment records that pin, so later platform SDK releases cannot change the running app.

Develop and verify the candidate

Use an isolated development session before changing production:

"$OPENCLOUD_CLI" app dev start "$APP_DIR"
# edit locally
"$OPENCLOUD_CLI" app dev sync "$APP_DIR"
"$OPENCLOUD_CLI" app dev verify "$APP_DIR"

The stable capability URL serves the exact active dev revision with an isolated schema and no production data or secrets. Migration changes replay from empty. Functions remain dormant until the CLI or a deliberate preview interaction invokes them. Verification issues a short-lived receipt bound to the source digest, migration digest, and production base deployment. See Develop safely before production.

Deploy

Promote the exact verified candidate with a unique idempotency key:

"$OPENCLOUD_CLI" app dev promote "$APP_DIR" --idempotency-key "$UNIQUE_KEY"

The command follows the durable deployment, runs feature-aware production verification, prints the live URL, and stops dev after success. The platform verifies the artifact, reconciles runtime boundaries, preflights all migrations in a disposable constrained schema, creates a pre-deployment backup, applies new migrations, activates the release, checks health, and reconciles cron. For automation that intentionally does not use a development session, direct deploy "$APP_DIR" remains available but does not carry a dev verification receipt.

Verify

"$OPENCLOUD_CLI" app verify "$APP_ID"
"$OPENCLOUD_CLI" verify "$APP_ID" "$APP_DIR/opencloud.verify.yaml"

app verify creates a durable server-side verification operation for active release state, exact runtime metadata, deployment-pinned SDK, canonical HTTPS health, Chromium diagnostics, and the app-declared interaction contract. The manifest-aware verify command adds two-user data, Storage, Realtime, Function/secret, cron, logs, and usage checks when a verification contract is present.

Inspect

"$OPENCLOUD_CLI" app sdk-inspect "$APP_ID"
"$OPENCLOUD_CLI" deployment list "$APP_ID"
"$OPENCLOUD_CLI" deployment get "$APP_ID" "$DEPLOYMENT_ID"
"$OPENCLOUD_CLI" cron history "$APP_ID"
"$OPENCLOUD_CLI" logs "$APP_ID" --level error
"$OPENCLOUD_CLI" usage "$APP_ID"

A normally replaced healthy deployment becomes superseded. rolled_back means an explicit operator rollback targeted that deployment. SDK upgrades are normal new releases; rollback restores both the frontend and its previous SDK pin.

Recovery

Backups are non-destructive to create and inspect. Restore and code rollback can discard or replace state and require explicit user authorization.