feat: add isolated app development workflow

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.5.0
+
+- Add isolated app development sessions with stable preview URLs, migration-replayed dummy databases, immutable revisions, and correlated diagnostics.
+- Add `app dev start|sync|status|request|invoke|requests|verify|promote|stop`.
+- Require successful explicit invocation of every dormant development Function before exact-revision verification.
+- Promote only the verified receipt and refuse stale source, migration, or production-base revisions.
+- Vendor the public dev-environment API contracts and bundler safeguards for the reserved `.opencloud` runtime directory.
+
 ## 0.4.0
 
 - Add `agent-feed` for the stable, bounded app health, signal, alert, and

README.md

@@ -9,12 +9,12 @@ plugin when one is available in that environment.
 
 ## Install a pinned release
 
-OpenCloud application skills pin an exact CLI release. To install `v0.4.0` in
+OpenCloud application skills pin an exact CLI release. To install `v0.5.0` in
 an isolated task directory:
 
 ```bash
-OPENCLOUD_CLI_VERSION="v0.4.0"
-OPENCLOUD_CLI_PACKAGE="opencloud-cli-0.4.0.tgz"
+OPENCLOUD_CLI_VERSION="v0.5.0"
+OPENCLOUD_CLI_PACKAGE="opencloud-cli-0.5.0.tgz"
 OPENCLOUD_CLI_DIR="$(mktemp -d)"
 
 curl -fsSLo "$OPENCLOUD_CLI_DIR/$OPENCLOUD_CLI_PACKAGE" \
@@ -94,6 +94,23 @@ Existing installations can still supply `OPENCLOUD_API_URL` and
 See the [OpenCloud CLI reference](https://docs.opencloud.ai/reference/cli) and
 [agent guide](https://docs.opencloud.ai/getting-started/agents).
 
+## Isolated development environments
+
+Use the stable capability preview and isolated migration-replayed database before changing production:
+
+```bash
+"$OPENCLOUD_CLI" app dev start .
+"$OPENCLOUD_CLI" app dev sync .
+"$OPENCLOUD_CLI" app dev request . /
+"$OPENCLOUD_CLI" app dev invoke . function-name --body '{"example":true}'
+"$OPENCLOUD_CLI" app dev requests .
+"$OPENCLOUD_CLI" app dev verify .
+"$OPENCLOUD_CLI" app dev promote . --idempotency-key "$IDEMPOTENCY_KEY"
+"$OPENCLOUD_CLI" app dev stop .
+```
+
+Development data is isolated from production and uses dummy records. Auth, Storage, Realtime, cron, production secrets, and implicit Function execution are unavailable. Functions imported from `@opencloud/server` remain dormant until explicitly invoked, and exact-revision verification requires every declared Function to have a successful explicit invocation.
+
 ## Agent Feed and alert rules
 
 Read the stable app health, signal, alert, and recent-event contract without

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opencloud/cli",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Versioned command-line client for building, deploying, and verifying OpenCloud applications",
   "type": "module",
   "bin": {

src/bundle.test.ts

@@ -111,6 +111,27 @@ functions:
     expect(archivedFiles.sort()).toEqual(first.files);
   });
 
+  it("never archives local .opencloud development metadata", async () => {
+    const root = await temporaryDirectory();
+    await mkdir(path.join(root, ".opencloud"));
+    await writeFile(path.join(root, "index.html"), "hello");
+    await writeFile(
+      path.join(root, ".opencloud", "dev.json"),
+      JSON.stringify({ sessionId: "bearer-capability" }),
+    );
+    await writeManifest(
+      root,
+      `
+frontend:
+  directory: .
+`,
+    );
+
+    const bundle = await buildBundle(root);
+    expect(bundle.files).toContain("index.html");
+    expect(bundle.files.some((file) => file.startsWith(".opencloud/"))).toBe(false);
+  });
+
   it("preserves an explicit older SDK pin instead of replacing it with current", async () => {
     const root = await temporaryDirectory();
     await mkdir(path.join(root, "frontend"));