fix(cli): don't assume newest deployment is live in promote resolution

packages/cli/src/controllers/app.ts

@@ -574,7 +574,7 @@
   });
 }
 
 async function runSingleAppDeploy(
   context: CommandContext,
   appName: string | undefined,
   options: AppDeployOptions | undefined,
@@ -1171,9 +1171,9 @@
         ...deployment.deployment,
         live: providerLiveDeploymentId
           ? deployment.deployment.id === providerLiveDeploymentId
           : knownLiveDeploymentId
             ? deployment.deployment.id === knownLiveDeploymentId
             : deployment.deployment.live,
       },
     },
     warnings: [],
@@ -1552,10 +1552,10 @@
       });
     }
 
     await sleep(
       Math.min(pollIntervalMs, Math.max(deadline - Date.now(), 0)),
       context.runtime.signal,
     );
     current = await target.provider
       .showDomain(current.id, { signal: context.runtime.signal })
       .catch((error) => {
@@ -2139,7 +2139,7 @@
   const envAppId = readDeployEnvOverride(context, PRISMA_APP_ID_ENV_VAR);
 
   const { provider, target, projectId } =
     await requireProviderAndProjectContext(context, options?.projectRef, {
       branch,
       commandName,
       envProjectId,
@@ -2272,7 +2272,7 @@
   }
   if (
     hostname.includes("://") ||
     hostname.includes("/") ||
     hostname.includes(":") ||
     hostname.startsWith("*.")
   ) {
@@ -2307,14 +2307,14 @@
     foundryStatus: domain.foundryStatus,
     failureReason: domain.failureReason,
     failureCategory: domain.failureCategory,
     certExpiresAt: domain.certExpiresAt,
     createdAt: domain.createdAt,
     updatedAt: domain.updatedAt,
     dnsRecords: toAppDomainDnsRecords(domain),
   };
 }
 
 function toAppDomainDnsRecords(
   domain: Pick<DomainRecord, "dnsRecords">,
 ): AppDomainDnsRecord[] {
   return domain.dnsRecords.map((record) => ({
@@ -2402,7 +2402,7 @@
         why: error.message,
         fix: "Pass a valid hostname like shop.acme.com and make sure DNS can be verified.",
         debug: formatDebugDetails(error),
         exitCode: 2,
         nextSteps: ["prisma-cli app domain add shop.acme.com"],
       });
     }
@@ -2568,7 +2568,7 @@
       ? `${domain.failureCategory}: ${domain.failureReason}`
       : domain.failureReason;
   }
 
   return "The platform reported a terminal failed state for this custom domain.";
 }
 
@@ -2604,7 +2604,7 @@
           ? 1000
           : 1;
   return amount * multiplier;
 }
 
 function readDomainWaitPollIntervalMs(context: CommandContext): number {
   const raw = context.runtime.env.PRISMA_CLI_DOMAIN_WAIT_POLL_MS;
@@ -2620,11 +2620,11 @@
   context: CommandContext,
   event: {
     hostname: string;
     domainId: string;
     previousStatus: AppDomainStatus | null;
     status: AppDomainStatus;
     elapsedMs: number;
   },
 ): void {
   if (context.flags.json) {
     writeJsonEvent(context.output, {
@@ -3097,6 +3097,14 @@
   });
 }
 
+/**
+ * Resolves the app's live deployment from the app pointer, the provider's live
+ * flag, then locally cached state.
+ *
+ * @returns the live deployment id, or null when no authoritative signal exists.
+ * Callers must treat null as "not known to be live" rather than assuming the
+ * newest deployment is live.
+ */
 async function resolveCurrentLiveDeploymentId(
   context: CommandContext,
   projectId: string,
@@ -3126,7 +3134,7 @@
     return knownLiveDeploymentId;
   }
 
-  return deployments[0]?.id ?? null;
+  return null;
 }
 
 function buildAppShowNextSteps(
@@ -3399,7 +3407,7 @@
         projectId: resolved.project.id,
         branchName: requested.name,
         signal: context.runtime.signal,
       });
 
   return {
     ...resolved,
@@ -3433,7 +3441,7 @@
   const branch =
     options.branch ?? (await resolveDeployBranch(context, undefined));
   const projects = await listRealWorkspaceProjects(
     client,
     workspace,
     context.runtime.signal,
   );
@@ -4117,7 +4125,7 @@
       buildType: framework.buildType,
       displayName: framework.displayName,
       annotation,
     };
   }
 
   return null;
@@ -4130,8 +4138,8 @@
 ): Promise<{ exists: boolean; standalone: boolean; path: string | null }> {
   for (const candidate of framework.detectConfigFiles) {
     const filePath = path.join(cwd, candidate);
     signal.throwIfAborted();
     try {
       const content = await readFile(filePath, { encoding: "utf8", signal });
       return {
         exists: true,
@@ -4154,10 +4162,10 @@
   dependencyName: string,
 ): boolean {
   return (
     hasDependency(packageJson?.dependencies, dependencyName) ||
     hasDependency(packageJson?.devDependencies, dependencyName)
   );
 }
 
 function hasAnyPackageDependency(
   packageJson: BunPackageJsonLike | null,

packages/cli/tests/app-controller.test.ts

@@ -5912,6 +5912,79 @@ describe("app controller", () => {
     ]);
   });
 
+  it("promote rebinds instead of assuming the newest deployment is live when there is no authoritative live signal", async () => {
+    const requireComputeAuth = vi.fn().mockResolvedValue(createProjectClient());
+    const listApps = vi.fn().mockResolvedValue([
+      {
+        id: "app_1",
+        name: "hello-world",
+        region: "eu-west-3",
+        liveDeploymentId: null,
+      },
+    ]);
+    const listDeployments = vi.fn().mockResolvedValue({
+      app: {
+        id: "app_1",
+        name: "hello-world",
+        region: "eu-west-3",
+        liveDeploymentId: null,
+      },
+      deployments: [
+        {
+          id: "dep_2",
+          status: "running",
+          url: "https://preview-2.prisma.app",
+          createdAt: "2026-04-11T12:00:00.000Z",
+          live: false,
+        },
+      ],
+    });
+    const promoteDeployment = vi.fn().mockResolvedValue(undefined);
+
+    vi.doMock("../src/lib/auth/guard", () => ({
+      requireComputeAuth,
+    }));
+    vi.doMock("../src/lib/app/app-provider", () => ({
+      createAppProvider: vi.fn(() =>
+        withBranchDatabaseProviderDefaults({
+          resolveBranch: createResolveBranch(),
+          createProject: vi.fn(),
+          listApps,
+          promoteDeployment,
+          deployApp: vi.fn(),
+          listDeployments,
+          showDeployment: vi.fn(),
+        }),
+      ),
+    }));
+
+    const { createTempCwd, createTestCommandContext } = await import(
+      "./helpers"
+    );
+    const { runAppPromote } = await import("../src/controllers/app");
+    const cwd = await createTempCwd();
+    await writeLocalPin(cwd, { workspaceId: "ws_123", projectId: "proj_123" });
+    const stateDir = path.join(cwd, ".state");
+    const { context } = await createTestCommandContext({
+      cwd,
+      stateDir,
+      env: {
+        ...process.env,
+        PRISMA_CLI_MOCK_FIXTURE_PATH: undefined,
+      },
+    });
+
+    const result = await runAppPromote(context, "dep_2", "hello-world");
+
+    expect(promoteDeployment).toHaveBeenCalledWith(
+      expect.objectContaining({
+        appId: "app_1",
+        deploymentId: "dep_2",
+      }),
+    );
+    expect(result.warnings).toEqual([]);
+  });
+
   it("rollback chooses the previous deployment when no explicit target is provided", async () => {
     const requireComputeAuth = vi.fn().mockResolvedValue(createProjectClient());
     const listApps = vi.fn().mockResolvedValue([