@supacloud/cli 0.87.1 → 0.90.0

package/dist/index.js

@@ -7797,7 +7797,7 @@ function FromObject10(context, type, value) {
     return value;
   const additionalProperties = GetAdditionalProperties(type);
   for (const key of Keys(value)) {
-    if (HasPropertyKey(type.properties, key)) {
+    if (HasPropertyKey(type.properties, key) && IsSchema(type.properties[key])) {
       value[key] = FromType19(context, type.properties[key], value[key]);
       continue;
     }
@@ -7882,6 +7882,9 @@ function FromProperties4(properties) {
     result[key] = FromType20(properties[key]);
   return result;
 }
+function FromRecordKey(type) {
+  return String2({ pattern: RecordPattern(type) });
+}
 function FromPriorityTypes(types) {
   return FromTypes6(Priority(types));
 }
@@ -7889,7 +7892,7 @@ function FromTypes6(types) {
   return types.map((type) => FromType20(type));
 }
 function FromType20(type) {
-  const next = IsArray2(type) ? _Array_(FromType20(type.items), ArrayOptions(type)) : IsIntersect(type) ? Intersect(FromTypes6(type.allOf)) : IsUnion(type) ? Union(FromPriorityTypes(type.anyOf)) : IsObject2(type) ? _Object_(FromProperties4(type.properties)) : IsRecord(type) ? Record(RecordKey(type), FromType20(RecordValue(type))) : IsTuple(type) ? Tuple(FromTypes6(type.items)) : type;
+  const next = IsArray2(type) ? _Array_(FromType20(type.items), ArrayOptions(type)) : IsIntersect(type) ? Intersect(FromTypes6(type.allOf)) : IsUnion(type) ? Union(FromPriorityTypes(type.anyOf)) : IsObject2(type) ? _Object_(FromProperties4(type.properties)) : IsRecord(type) ? Record(FromRecordKey(type), FromType20(RecordValue(type))) : IsTuple(type) ? Tuple(FromTypes6(type.items)) : type;
   return Modifiers(type, next);
 }
 function UnionPrioritySort(type) {
@@ -9164,7 +9167,7 @@ var ACTION_POLICY = {
   deploy: { write: ["deploy"] },
   applications: {
     read: ["list_releases", "get_release", "get_runtime", "get_deployment_evidence", "get_configuration", "get_release_transfer_plan", "get_promotion_plan", "get_promotion_status", "get_rollback_snapshot", "get_history", "get_deploy_plan", "logs", "get_preview_plan", "list_previews", "get_preview"],
-    write: ["upload_release", "put_configuration", "release_application", "transfer_release", "promote_application", "reconcile_promotion", "create_preview", "reconcile_preview", "cleanup_preview", "activate_release", "deploy_release", "rollback_release", "reconcile_activation", "retire_activation"]
+    write: ["upload_release", "put_configuration", "deploy_application", "transfer_release", "promote_application", "reconcile_promotion", "create_preview", "reconcile_preview", "cleanup_preview", "activate_release", "deploy_release", "rollback_release", "reconcile_activation", "retire_activation"]
   },
   project: {
     read: ["get", "endpoints", "health", "logs", "api_keys", "settings", "tasks", "task_detail", "task_stats", "dlq", "background_settings"],
@@ -9257,6 +9260,8 @@ var ACTION_POLICY = {
     write: ["send", "receive", "ack", "release", "fail", "retry", "delete_message", "update_settings"]
   },
   ai: { local: ["show_skill", "install_skill"] },
+  init: { local: ["init"] },
+  env: { local: ["list", "check"] },
   app: {
     local: ["init", "generate", "dev", "watch", "verify-plan", "compile", "check", "graph", "explain", "export-tools", "context", "doctor", "fix", "plan", "build"],
     read: ["status", "logs", "transfer-plan", "promote-plan", "rollback-plan", "history", "deploy-plan", "diff", "promote-status", "preview-plan", "previews", "preview-list", "preview-status"],
@@ -10488,34 +10493,67 @@ function parseApplicationDeployPlan(value) {
     throw new Error("Invalid application deploy plan action");
   return value;
 }
-// node_modules/@supacloud/delivery/src/application-release-operation.ts
+// node_modules/@supacloud/delivery/src/application-deploy-operation.ts
 var closed3 = { additionalProperties: false };
+var sha256 = ApplicationReleaseIdSchema;
 var nullableActivation = Union([ApplicationActivationIdSchema, Null()]);
-var ApplicationReleaseRequestSchema = _Object_({
-  release_id: ApplicationReleaseIdSchema,
+var ApplicationDeployWebRequestSchema = _Object_({
+  deployment_id: String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }),
+  release_id: sha256,
+  expected_active_release_id: String2({ minLength: 1 }),
+  expected_activation_id: String2({ minLength: 1 }),
+  mutation_id: ApplicationActivationIdSchema
+}, closed3);
+var ApplicationDeployRequestSchema = _Object_({
+  mutation_id: ApplicationActivationIdSchema,
+  release_id: sha256,
   configuration_id: Optional(ApplicationConfigurationIdSchema),
   configuration_write: Optional(ApplicationConfigurationWriteSchema),
-  activation_id: Optional(ApplicationActivationIdSchema),
-  expected_activation_id: Optional(nullableActivation),
-  expected_plan_sha256: Optional(ApplicationReleaseIdSchema)
+  expected_plan_sha256: Optional(sha256),
+  approved_migration_digest: Optional(sha256),
+  web: Optional(ApplicationDeployWebRequestSchema)
 }, closed3);
-var ApplicationReleaseResultSchema = _Object_({
-  schema: Literal("supacloud.application-release.v1"),
+var ApplicationBackendReceiptSchema = _Object_({
+  schema: Literal("supacloud.application-backend-receipt.v1"),
   project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
   application_id: ApplicationIdSchema,
   environment_id: ApplicationIdSchema,
-  release_id: ApplicationReleaseIdSchema,
+  release_id: sha256,
+  manifest_sha256: sha256,
+  mutation_id: ApplicationActivationIdSchema,
+  plan_sha256: sha256,
+  backup_id: Union([String2(), Null()]),
+  before_ledger_digest: sha256,
+  after_ledger_digest: sha256,
+  applied_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { uniqueItems: true }),
+  schema_reloaded: Boolean2(),
+  postgrest_healthy: Boolean2()
+}, closed3);
+var ApplicationDeployResultSchema = _Object_({
+  schema: Literal("supacloud.application-deploy.v1"),
+  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+  application_id: ApplicationIdSchema,
+  environment_id: ApplicationIdSchema,
+  mutation_id: ApplicationActivationIdSchema,
+  release_id: sha256,
   configuration_id: ApplicationConfigurationIdSchema,
   activation_id: ApplicationActivationIdSchema,
   expected_activation_id: nullableActivation,
-  plan_sha256: ApplicationReleaseIdSchema,
+  plan_sha256: sha256,
   action: Union([Literal("activate"), Literal("no-op")]),
   replayed: Boolean2(),
-  execution_performed: Boolean2()
+  execution_performed: Boolean2(),
+  backend_receipt: ApplicationBackendReceiptSchema,
+  web: Optional(_Object_({
+    deployment_id: String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }),
+    release_id: sha256,
+    activation_id: ApplicationActivationIdSchema,
+    replayed: Boolean2()
+  }, closed3))
 }, closed3);
-function parseApplicationReleaseResult(value) {
-  if (!Check2(ApplicationReleaseResultSchema, value)) {
-    throw new Error("Invalid application release result");
+function parseApplicationDeployResult(value) {
+  if (!Check2(ApplicationDeployResultSchema, value)) {
+    throw new Error("Invalid application deploy result");
   }
   return structuredClone(value);
 }
@@ -10716,7 +10754,7 @@ function parseApplicationReleaseTransferResult(candidate) {
 }
 // node_modules/@supacloud/delivery/src/deployment-evidence.ts
 var closed5 = { additionalProperties: false };
-var sha256 = String2({ pattern: "^[a-f0-9]{64}$" });
+var sha2562 = String2({ pattern: "^[a-f0-9]{64}$" });
 var isoDate = String2({ minLength: 20, maxLength: 40 });
 var status = Union([
   Literal("confirmed"),
@@ -10736,7 +10774,7 @@ var DatabaseProviderSchema = _Object_({
   topology: Union([Literal("single-node"), Literal("distributed")]),
   migration: _Object_({
     status,
-    inventory_sha256: Union([sha256, Null()]),
+    inventory_sha256: Union([sha2562, Null()]),
     compatibility: Union([
       Literal("verified"),
       Literal("not-proven"),
@@ -10784,9 +10822,9 @@ var DeploymentEvidenceSchema = _Object_({
   }, closed5),
   source: _Object_({
     commit_sha: Union([String2({ pattern: "^[0-9a-f]{7,64}$" }), Null()]),
-    manifest_sha256: sha256,
+    manifest_sha256: sha2562,
     contract_schema: Union([String2({ minLength: 1, maxLength: 128 }), Null()]),
-    environment_binding_version: Union([sha256, Null()])
+    environment_binding_version: Union([sha2562, Null()])
   }, closed5),
   database: DatabaseProviderSchema,
   components: _Array_(DeploymentComponentEvidenceSchema, { minItems: 1, maxItems: 32 }),
@@ -10842,9 +10880,9 @@ function parseDeploymentEvidence(value) {
 // node_modules/@supacloud/delivery/src/application-promotion.ts
 var closed6 = { additionalProperties: false };
 var projectRef2 = String2({ pattern: "^[a-z0-9-]{1,20}$" });
-var sha2562 = ApplicationReleaseIdSchema;
+var sha2563 = ApplicationReleaseIdSchema;
 var nullableActivation2 = Union([ApplicationActivationIdSchema, Null()]);
-var nullableDigest = Union([sha2562, Null()]);
+var nullableDigest = Union([sha2563, Null()]);
 var observation = {
   activation_id: nullableActivation2,
   receipt_confirmed: Boolean2(),
@@ -10870,24 +10908,24 @@ var ApplicationPromotionPlanSchema = _Object_({
   project_ref: projectRef2,
   application_id: ApplicationIdSchema,
   environment_id: ApplicationIdSchema,
-  manifest_sha256: sha2562,
-  plan_sha256: sha2562,
+  manifest_sha256: sha2563,
+  plan_sha256: sha2563,
   source: _Object_({
     project_ref: projectRef2,
     environment_id: ApplicationIdSchema,
-    release_id: sha2562,
+    release_id: sha2563,
     ...observation
   }, closed6),
   target: _Object_({
-    candidate_release_id: sha2562,
-    current_release_id: Union([sha2562, Null()]),
+    candidate_release_id: sha2563,
+    current_release_id: Union([sha2563, Null()]),
     artifact_action: Union([Literal("materialize"), Literal("reuse")]),
     configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
     configuration: Union([ApplicationConfigurationViewSchema, Null()]),
     ...observation
   }, closed6),
   migrations: _Object_({
-    ledger_digest: sha2562,
+    ledger_digest: sha2563,
     ledger_compatible: Boolean2(),
     project_migrations_applied: Boolean2(),
     pending_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { maxItems: 4096, uniqueItems: true }),
@@ -16852,7 +16890,8 @@ var ApplicationActivationRetirementResultSchema2 = ApplicationActivationRetireme
 var ApplicationRollbackSnapshotSchema2 = ApplicationRollbackSnapshotSchema;
 var ApplicationActivationHistoryCursorSchema2 = ApplicationActivationHistoryCursorSchema;
 var ApplicationPromotionPlanSchema2 = ApplicationPromotionPlanSchema;
-var ApplicationReleaseRequestSchema2 = ApplicationReleaseRequestSchema;
+var ApplicationDeployRequestSchema2 = ApplicationDeployRequestSchema;
+var ApplicationDeployWebRequestSchema2 = ApplicationDeployWebRequestSchema;
 
 // src/shared/mutation-protocol.ts
 import { createHash as createHash6 } from "node:crypto";
@@ -17640,7 +17679,7 @@ var APPLICATION_TOOL_SCHEMA = {
     "put_configuration",
     "get_deploy_plan",
     "deploy_release",
-    "release_application",
+    "deploy_application",
     "get_release_transfer_plan",
     "transfer_release",
     "get_promotion_plan",
@@ -17668,14 +17707,15 @@ var APPLICATION_TOOL_SCHEMA = {
   activation_id: optional(ApplicationActivationIdSchema2, "[deploy_release/activate_release/reconcile_activation/retire_activation/rollback_release/get_history] Stable activation ID; generated for automatic deployment/rollback if omitted"),
   expected_activation_id: optional(Union([ApplicationActivationIdSchema2, Null(), Literal("absent")]), "[deploy_release/activate_release/rollback_release] Current activation ID, or absent for first activation; selected from verified plan for automatic deployment"),
   configuration_path: optional(String2(), "[put_configuration] Local configuration write JSON including revision and expected revision"),
-  configuration_write: optional(Unknown(), "[release_application] Parsed immutable configuration write"),
+  configuration_write: optional(Unknown(), "[deploy_application] Parsed immutable configuration write"),
   manifest_path: optional(String2(), "[upload_release] Local delivery.manifest.json"),
+  web: optional(ApplicationDeployWebRequestSchema2, "[deploy_application] Immutable staged Web release binding"),
   release_id: optional(ApplicationReleaseIdSchema2, "[get_release/get_deploy_plan/deploy_release/activate_release/reconcile_activation/rollback_release] Immutable application release ID; platform selects previous for default rollback"),
   source_ref: optional(String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" }), "[get_release_transfer_plan/transfer_release] Source project ref"),
   source_release_id: optional(ApplicationReleaseIdSchema2, "[get_release_transfer_plan/transfer_release] Source immutable release ID"),
   source_environment_id: optional(ApplicationIdSchema2, "[get_promotion_plan] Source environment"),
-  mutation_id: optional(ApplicationActivationIdSchema2, "[promote_application/get_promotion_status/reconcile_promotion] Stable promotion mutation ID"),
-  approved_migration_digest: optional(ApplicationReleaseIdSchema2, "[promote_application] Exact reviewed migration execution-plan digest"),
+  mutation_id: optional(ApplicationActivationIdSchema2, "[deploy_application/promote_application/get_promotion_status/reconcile_promotion] Stable mutation ID"),
+  approved_migration_digest: optional(ApplicationReleaseIdSchema2, "[deploy_application/promote_application] Exact reviewed migration execution-plan digest"),
   plan: optional(ApplicationPromotionPlanSchema2, "[promote_application] Immutable plan returned by get_promotion_plan"),
   cursor: optional(Union([ApplicationReleaseIdSchema2, ApplicationActivationHistoryCursorSchema2]), "[list_releases/get_history] Returned page cursor"),
   limit: optional(Integer({ minimum: 1, maximum: 100 }), "[list_releases/get_history] Page size, default 50/20"),
@@ -18028,57 +18068,50 @@ function registerApplicationTools(server, http) {
       const observed = await readDeployPlan(http, args, project);
       return observed.failure ?? releaseControlSuccess(operation, { ...observed.identity, plan: observed.plan });
     }
-    if (action === "release_application") {
+    if (action === "deploy_application") {
       const environmentId = text(args, "environment_id");
       const releaseId = text(args, "release_id");
-      if (!Check2(ApplicationIdSchema2, environmentId) || !Check2(ApplicationReleaseIdSchema2, releaseId)) {
-        throw new Error("Invalid application release identity");
+      const mutationId = text(args, "mutation_id");
+      if (!Check2(ApplicationIdSchema2, environmentId) || !Check2(ApplicationReleaseIdSchema2, releaseId) || !Check2(ApplicationActivationIdSchema2, mutationId)) {
+        throw new Error("Invalid application deploy identity");
       }
       const configurationId = args["configuration_id"];
-      const activationId = args["activation_id"];
-      const expectedActivationId = args["expected_activation_id"];
       if (configurationId !== undefined && !Check2(ApplicationConfigurationIdSchema2, configurationId)) {
         throw new Error("Invalid application configuration ID");
       }
-      if (activationId !== undefined && !Check2(ApplicationActivationIdSchema2, activationId)) {
-        throw new Error("Invalid application activation ID");
-      }
-      if (expectedActivationId !== undefined && expectedActivationId !== null && expectedActivationId !== "absent" && !Check2(ApplicationActivationIdSchema2, expectedActivationId)) {
-        throw new Error("Invalid expected activation ID");
-      }
       const configurationWrite = args["configuration_write"];
       const parsedConfigurationWrite = configurationWrite === undefined ? undefined : parseApplicationConfigurationWrite(configurationWrite);
       const requestedConfigurationId = configurationId ?? parsedConfigurationWrite?.configuration_id;
       const body = {
+        mutation_id: mutationId,
         release_id: releaseId,
         ...configurationId === undefined ? {} : { configuration_id: configurationId },
         ...configurationWrite === undefined ? {} : { configuration_write: configurationWrite },
-        ...activationId === undefined ? {} : { activation_id: activationId },
-        ...expectedActivationId === undefined ? {} : {
-          expected_activation_id: expectedActivationId === "absent" ? null : expectedActivationId
-        }
+        ...typeof args["approved_migration_digest"] === "string" ? { approved_migration_digest: args["approved_migration_digest"] } : {},
+        ...args["web"] === undefined ? {} : { web: args["web"] }
       };
-      if (!Check2(ApplicationReleaseRequestSchema2, body)) {
-        throw new Error("Invalid application release request");
+      if (!Check2(ApplicationDeployRequestSchema2, body)) {
+        throw new Error("Invalid application deploy request");
       }
-      const result = await http.post(`/v1/projects/${project}/applications/${encodeURIComponent(id)}/environments/${encodeURIComponent(environmentId)}/release`, body, { timeoutMs: 120000, maxJsonBytes: 65536, responseTimeoutMs: 30000 });
+      const result = await http.post(`/v1/projects/${project}/applications/${encodeURIComponent(id)}/environments/${encodeURIComponent(environmentId)}/deploy`, body, { timeoutMs: 120000, maxJsonBytes: 131072, responseTimeoutMs: 30000 });
       const identity = {
         project_ref: ref,
         application_id: id,
         environment_id: environmentId,
         release_id: releaseId,
-        ...configurationId === undefined ? {} : { configuration_id: configurationId },
-        ...activationId === undefined ? {} : { activation_id: activationId }
+        mutation_id: mutationId,
+        ...requestedConfigurationId === undefined ? {} : { configuration_id: requestedConfigurationId }
       };
       if (!result.ok)
         return releaseControlMutationFailure(operation, result, identity);
       try {
         if (result.status !== 200)
           throw new Error;
-        const release = parseApplicationReleaseResult(result.data);
-        if (release.project_ref !== ref || release.application_id !== id || release.environment_id !== environmentId || release.release_id !== releaseId || requestedConfigurationId !== undefined && release.configuration_id !== requestedConfigurationId || activationId !== undefined && release.activation_id !== activationId)
+        const deploy = parseApplicationDeployResult(result.data);
+        if (deploy.project_ref !== ref || deploy.application_id !== id || deploy.environment_id !== environmentId || deploy.release_id !== releaseId || deploy.mutation_id !== mutationId || requestedConfigurationId !== undefined && deploy.configuration_id !== requestedConfigurationId) {
           throw new Error;
-        return releaseControlSuccess(operation, release);
+        }
+        return releaseControlSuccess(operation, deploy);
       } catch {
         return releaseControlFailure(operation, "OUTCOME_UNKNOWN", result.status, identity);
       }
@@ -21107,25 +21140,25 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.44.0"
+      version: "0.44.1"
     },
     app: {
-      version: "0.26.0",
+      version: "0.26.1",
       dependencies: {
         rxjs: "7.8.2"
       }
     },
     elysia: {
-      version: "0.29.1"
+      version: "0.29.2"
     },
     commands: {
-      version: "0.9.1"
+      version: "0.9.2"
     },
     contracts: {
-      version: "0.8.0"
+      version: "0.8.1"
     },
     db: {
-      version: "0.16.0",
+      version: "0.16.1",
       peerDependencies: {
         "drizzle-orm": "1.0.0-rc.5-169397b"
       },
@@ -21134,7 +21167,7 @@ var starter_metadata_default = {
       }
     },
     sdk: {
-      version: "0.41.1",
+      version: "0.41.2",
       peerDependencies: {
         "@supabase/supabase-js": "^2.117.3"
       }
@@ -24533,6 +24566,7 @@ var REMOTE_APP_DESCRIPTIONS = {
   source_environment_id: "[promote-plan/diff/promote] Source environment ID",
   mutation_id: "[promote-status/promote-reconcile] Stable promotion mutation ID",
   approved_migration_digest: "[promote] Exact reviewed migration execution-plan digest",
+  web: "[release] Immutable staged Web release binding prepared by the deploy profile",
   branch_ref: "[preview-plan] Preview branch identity",
   branch_name: "[preview/preview-create] Human-readable preview branch name",
   data_mode: "[preview-plan/preview/preview-create] schema_only or full_clone",
@@ -25501,9 +25535,6 @@ async function runAppRelease(request, options, delegate) {
   if (request.configuration_path !== undefined && request.configuration_id !== undefined) {
     throw new Error("app release accepts either --configuration_path or --configuration_id, not both");
   }
-  if (request.configuration_path === undefined && request.configuration_id === undefined) {
-    throw new Error("app release requires --configuration_path or --configuration_id");
-  }
   if (request.activation_id !== undefined || request.expected_activation_id !== undefined) {
     throw new Error("app release generates one activation identity; use app deploy for an exact retry");
   }
@@ -25557,25 +25588,36 @@ async function runAppRelease(request, options, delegate) {
       configurationWrite = parseApplicationConfigurationWrite(await Bun.file(configurationPath).json());
       configurationId = configurationWrite.configuration_id;
     } catch {
-      return releasePhaseFailure("configure", releaseControlFailure("applications.release_application", "INVALID_RESPONSE", null, { project_ref: ref, application_id: id, environment_id: environmentId }), completed);
+      return releasePhaseFailure("configure", releaseControlFailure("applications.deploy_application", "INVALID_RESPONSE", null, { project_ref: ref, application_id: id, environment_id: environmentId }), completed);
     }
     completed.configure = { delegated: true, configuration_id: configurationId };
   } else {
-    completed.configure = { delegated: true, configuration_id: configurationId };
+    completed.configure = {
+      delegated: false,
+      resolved_by: "platform",
+      ...configurationId === undefined ? {} : { configuration_id: configurationId }
+    };
   }
   const deployArgs = {
-    action: "release_application",
+    action: "deploy_application",
     ref,
     id,
     environment_id: environmentId,
     release_id: releaseId,
-    configuration_id: configurationId,
-    activation_id: activationId,
-    ...configurationWrite === undefined ? {} : { configuration_write: configurationWrite }
+    mutation_id: activationId,
+    ...configurationId === undefined ? {} : { configuration_id: configurationId },
+    ...configurationWrite === undefined ? {} : { configuration_write: configurationWrite },
+    ...request.web === undefined ? {} : { web: request.web }
   };
   validateToolArguments(APPLICATION_TOOL_SCHEMA, deployArgs);
   const deployed = await delegate(deployArgs);
   const deployReceipt = resultObject(deployed);
+  const resolvedConfigurationId = typeof deployReceipt?.configuration_id === "string" ? deployReceipt.configuration_id : undefined;
+  if (resolvedConfigurationId !== undefined) {
+    configurationId = resolvedConfigurationId;
+    const configure = completed.configure;
+    completed.configure = configure && typeof configure === "object" && !Array.isArray(configure) ? { ...configure, configuration_id: resolvedConfigurationId } : { delegated: false, resolved_by: "platform", configuration_id: resolvedConfigurationId };
+  }
   if (deployed.isError || !deployReceipt?.ok) {
     return releasePhaseFailure("deploy", deployed, completed);
   }
@@ -25588,13 +25630,14 @@ async function runAppRelease(request, options, delegate) {
     application_id: id,
     environment_id: environmentId,
     release_id: releaseId,
-    configuration_id: configurationId,
+    ...configurationId === undefined ? {} : { configuration_id: configurationId },
     manifest_path: manifestPath,
     build: buildReceipt ? completed.build : { skipped: true, manifest_path: manifestPath },
     phases: completed,
     no_op: deployReceipt.action === "no-op" || deployReceipt.no_op === true,
     execution_performed: deployReceipt.execution_performed === true,
-    ...typeof deployReceipt.activation_id === "string" ? { activation_id: deployReceipt.activation_id } : {}
+    ...typeof deployReceipt.activation_id === "string" ? { activation_id: deployReceipt.activation_id } : {},
+    ...deployReceipt.web === undefined ? {} : { web: deployReceipt.web }
   };
   return request.format === "json" || request.json === true ? textResult(JSON.stringify(result, null, 2)) : textResult([
     `${ref}/${id}/${environmentId}: ${result.no_op ? "no-op" : "released"}`,
@@ -27200,6 +27243,7 @@ import { createHash as createHash8 } from "node:crypto";
 import { existsSync as existsSync13, mkdirSync as mkdirSync4, readdirSync as readdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname10, join as join16, relative as relative9, resolve as resolve21 } from "node:path";
 var SAFE_PROJECT_REF = /^[A-Za-z0-9_-]{1,64}$/;
+var SAFE_ENVIRONMENT_ID = /^[A-Za-z0-9_-]{1,64}$/;
 var BACKUP_ID = /^logical-full_[A-Za-z0-9_-]{1,64}_[a-f0-9]{32}$/;
 var SHA256 = /^[a-f0-9]{64}$/;
 var SAFE_DATABASE = /^[^\u0000-\u001f\u007f]{1,128}$/;
@@ -27440,6 +27484,27 @@ function genericScopedReleaseScopeJson(scope) {
 function genericScopedReleaseScopeSha256(scope) {
   return createHash8("sha256").update(genericScopedReleaseScopeJson(scope)).digest("hex");
 }
+function scopeEnvironmentId(scope, action) {
+  const environmentId = isRecord6(scope) ? scope.targetEnvironmentId : undefined;
+  if (typeof environmentId !== "string" || !SAFE_ENVIRONMENT_ID.test(environmentId)) {
+    throw new Error(`Scope for ${action} must be regenerated with a concrete targetEnvironmentId`);
+  }
+  return environmentId;
+}
+function requestedScopeEnvironment(args, action) {
+  const environmentId = args.environment_id;
+  if (typeof environmentId !== "string" || !SAFE_ENVIRONMENT_ID.test(environmentId)) {
+    throw new Error(`'environment_id' is required for ${action} and must identify one deployment environment`);
+  }
+  return environmentId;
+}
+function assertScopeEnvironment(scope, requestedEnvironmentId, action) {
+  const targetEnvironmentId = scopeEnvironmentId(scope, action);
+  if (targetEnvironmentId !== requestedEnvironmentId) {
+    throw new Error(`Scope target environment '${targetEnvironmentId}' does not match requested environment '${requestedEnvironmentId}'`);
+  }
+  return targetEnvironmentId;
+}
 function runGitRevParse(cwd, args) {
   const res = Bun.spawnSync(["git", ...args], { cwd });
   if (res.exitCode !== 0 || !res.stdout)
@@ -27566,10 +27631,10 @@ function collectScopeFiles(cwd, file, files, dir, task) {
 function handleScopeRebind(args) {
   const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve21(args.cwd.trim()) : process.cwd();
   const targetBaseCommit = resolveGitBaseCommit(cwd, args.base_commit);
+  const requestedEnvironmentId = requestedScopeEnvironment(args, "scope_rebind");
   const scopeFiles = collectScopeFiles(cwd, args.file, args.files, args.dir, args.task);
   const dryRun = args.dry_run === true;
-  const scopes = [];
-  for (const filePath of scopeFiles) {
+  const parsedScopes = scopeFiles.map((filePath) => {
     let content;
     try {
       content = readFileSync10(filePath, "utf8");
@@ -27582,15 +27647,20 @@ function handleScopeRebind(args) {
     } catch {
       throw new Error(`Scope file '${filePath}' is not valid JSON`);
     }
-    if (!isRecord6(parsed) || typeof parsed.baseCommit !== "string" || !/^[0-9a-f]{40}$/.test(parsed.baseCommit)) {
+    const targetEnvironmentId = assertScopeEnvironment(parsed, requestedEnvironmentId, "scope_rebind");
+    const previousBaseCommit = parsed.baseCommit;
+    if (typeof previousBaseCommit !== "string" || !/^[0-9a-f]{40}$/.test(previousBaseCommit)) {
       throw new Error(`Scope file '${filePath}' has missing or invalid baseCommit`);
     }
+    return { filePath, parsed, targetEnvironmentId };
+  });
+  const scopes = [];
+  for (const { filePath, parsed, targetEnvironmentId } of parsedScopes) {
     const previousBaseCommit = parsed.baseCommit;
     const updated = previousBaseCommit !== targetBaseCommit;
     if (updated) {
       parsed.baseCommit = targetBaseCommit;
     }
-    const canonicalJson = genericScopedReleaseScopeJson(parsed);
     const scopeSha256 = genericScopedReleaseScopeSha256(parsed);
     if (updated && !dryRun) {
       const formatted = JSON.stringify(canonicalValue(parsed), null, 2) + `
@@ -27603,6 +27673,7 @@ function handleScopeRebind(args) {
       target_project_ref: typeof parsed.targetProjectRef === "string" ? parsed.targetProjectRef : "",
       previous_base_commit: previousBaseCommit,
       new_base_commit: targetBaseCommit,
+      target_environment_id: targetEnvironmentId,
       scope_sha256: scopeSha256,
       updated
     });
@@ -27617,6 +27688,7 @@ function handleScopeRebind(args) {
 }
 function handleScopeInspect(args) {
   const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve21(args.cwd.trim()) : process.cwd();
+  const requestedEnvironmentId = requestedScopeEnvironment(args, "scope_inspect");
   if (typeof args.file !== "string" || !args.file.trim()) {
     throw new Error("'file' is required for scope_inspect");
   }
@@ -27646,7 +27718,11 @@ function handleScopeInspect(args) {
   } catch {
     throw new Error(`Scope file '${args.file}' is not valid JSON`);
   }
-  if (!isRecord6(parsed) || typeof parsed.baseCommit !== "string" || !/^[0-9a-f]{40}$/.test(parsed.baseCommit)) {
+  if (!isRecord6(parsed)) {
+    throw new Error(`Scope file '${args.file}' must be an object and must be regenerated`);
+  }
+  const targetEnvironmentId = assertScopeEnvironment(parsed, requestedEnvironmentId, "scope_inspect");
+  if (typeof parsed.baseCommit !== "string" || !/^[0-9a-f]{40}$/.test(parsed.baseCommit)) {
     throw new Error(`Scope file '${args.file}' has missing or invalid baseCommit`);
   }
   const scopeSha256 = genericScopedReleaseScopeSha256(parsed);
@@ -27656,6 +27732,7 @@ function handleScopeInspect(args) {
     scope: {
       task_id: parsed.taskId,
       target_project_ref: parsed.targetProjectRef,
+      target_environment_id: targetEnvironmentId,
       base_commit: parsed.baseCommit,
       functions: parsed.functions,
       excluded_functions: parsed.excludedFunctions,
@@ -27693,6 +27770,7 @@ function handleScopeCreate(args, fallbackRef) {
   if (typeof args.task !== "string" || !args.task.trim()) {
     throw new Error("'task' is required for scope_create");
   }
+  const targetEnvironmentId = requestedScopeEnvironment(args, "scope_create");
   const projectRef = typeof args.ref === "string" && args.ref.trim() || fallbackRef;
   if (!projectRef) {
     throw new Error("'ref' is required for scope_create");
@@ -27709,6 +27787,7 @@ function handleScopeCreate(args, fallbackRef) {
     functions: parseCommaList(args.functions),
     migrations: parseCommaList(args.migrations),
     targetProjectRef: projectRef,
+    targetEnvironmentId,
     taskId: String(args.task).trim(),
     web: Boolean(args.web)
   };
@@ -27721,6 +27800,7 @@ function handleScopeCreate(args, fallbackRef) {
     file: relative9(cwd, filePath),
     task_id: scope.taskId,
     target_project_ref: projectRef,
+    target_environment_id: targetEnvironmentId,
     base_commit: targetBaseCommit,
     scope_sha256: scopeSha256,
     scope
@@ -27747,6 +27827,7 @@ function registerReleaseTools(server, http, options = {}) {
     dir: optional(String2(), "[scope_rebind] Directory containing release scope JSON files (defaults to supacloud/fa/release-scopes, release-scopes, or scopes)"),
     task: optional(String2(), "[scope_rebind/scope_create] Task ID or prefix filter for scope files"),
     base_commit: optional(String2(), "[scope_rebind/scope_create] Target 40-character base commit SHA or git ref (defaults to origin/main -> main -> HEAD^ -> HEAD)"),
+    environment_id: optional(String2(), "[scope_inspect/scope_rebind/scope_create] Exact target deployment environment"),
     functions: optional(String2(), "[scope_create] Comma-separated list of functions to deploy"),
     excluded_functions: optional(String2(), "[scope_create] Comma-separated list of functions to exclude"),
     migrations: optional(String2(), "[scope_create] Comma-separated list of migrations to apply"),
@@ -28148,6 +28229,33 @@ function selectDeployment(deployments, requestedId, projectName) {
   const ids = deployments.map((deployment) => deployment.id).sort().join(", ");
   throw new Error(deployments.length === 0 ? "No frontend deployments exist for this project" : `Multiple frontend deployments found (${ids}). Set frontend.id in supacloud.json or pass --id`);
 }
+function selectFrontendTarget(configRoot, config) {
+  if (config.targets === undefined && config.frontend === undefined)
+    return null;
+  const targets = config.targets ? Object.entries(config.targets).filter(([, target]) => target.type === "frontend") : [["frontend", {
+    type: "frontend",
+    root: config.frontend?.root,
+    id: config.frontend?.id,
+    buildCommand: config.frontend?.buildCommand,
+    outputDirectory: config.frontend?.outputDirectory,
+    buildEnv: config.frontend?.buildEnv
+  }]];
+  if (targets.length === 0)
+    return null;
+  if (config.defaultTarget) {
+    const selected = targets.find(([name]) => name === config.defaultTarget);
+    if (selected)
+      return { name: selected[0], config: selected[1], root: targetRoot(configRoot, selected[1], selected[0]) };
+  }
+  const namedWeb = targets.find(([name]) => name === "web");
+  if (namedWeb)
+    return { name: namedWeb[0], config: namedWeb[1], root: targetRoot(configRoot, namedWeb[1], namedWeb[0]) };
+  if (targets.length === 1) {
+    const selected = targets[0];
+    return { name: selected[0], config: selected[1], root: targetRoot(configRoot, selected[1], selected[0]) };
+  }
+  throw new Error(`Multiple frontend deploy targets found (${targets.map(([name]) => name).sort().join(", ")}). Set defaultTarget to the Web target`);
+}
 function targetRoot(configRoot, target, name) {
   const root = resolve22(configRoot, target.root || (name === "frontend" ? "." : name));
   const prefix = `${resolve22(configRoot)}${sep5}`;
@@ -28320,6 +28428,71 @@ function payload(response) {
     throw new Error("Deployment operation returned an invalid response");
   return parsed;
 }
+async function stageApplicationWebRelease(http, projectRef, configRoot, skipBuild, json, environmentVariables) {
+  const target = selectFrontendTarget(configRoot, await readDeployConfig(configRoot));
+  if (!target)
+    return null;
+  const projectDirectory = target.root;
+  const targetState = await lstat5(projectDirectory).catch(() => null);
+  if (!targetState?.isDirectory() || targetState.isSymbolicLink()) {
+    throw new Error(`Deploy target '${target.name}' root is not a regular directory: ${projectDirectory}`);
+  }
+  const requestedId = target.config.id;
+  const listResponse = await http.get(`/v1/projects/${encodeURIComponent(projectRef)}/frontend/deployments`);
+  if (!listResponse.ok)
+    throw new Error(`Failed to list frontend deployments (HTTP ${listResponse.status})`);
+  const selected = selectDeployment(deploymentList(listResponse.data), requestedId, await packageName(projectDirectory));
+  const configuredBuildCommand = String(target.config.buildCommand || selected.buildCommand || "").trim();
+  const buildCommand = configuredBuildCommand || (skipBuild ? "" : await defaultBuildCommand(projectDirectory, configRoot));
+  const configuredOutput = String(target.config.outputDirectory || "").trim();
+  const remoteOutput = selected.outputDirectory && selected.outputDirectory !== "." ? selected.outputDirectory : "";
+  const outputDirectory = resolveInsideProject(projectDirectory, configuredOutput || remoteOutput || defaultOutputDirectory(selected.framework));
+  const build = createBuildEnvironment(target.config.buildEnv, environmentVariables);
+  const report = phaseReporter(json);
+  report("web", `${target.name} (${selected.id})`);
+  assertBuildEnvironment(build, skipBuild);
+  if (!skipBuild) {
+    report("build", buildCommand);
+    await runBuild(buildCommand, projectDirectory, build.env, json);
+  } else {
+    report("build", "skipped");
+  }
+  report("package", relative10(projectDirectory, outputDirectory) || ".");
+  const archive = await createFrontendArchive(outputDirectory);
+  try {
+    const authority = payload(await readFrontendReleaseAuthority(http, projectRef, selected.id));
+    const activeReleaseId = typeof authority.active_release_id === "string" ? authority.active_release_id : null;
+    const activeActivationId = typeof authority.active_activation_id === "string" ? authority.active_activation_id : null;
+    const current = Array.isArray(authority.releases) ? record4(authority.releases[0]) : null;
+    if (archive.sha256 === activeReleaseId && archive.treeSha256 !== current?.tree_sha256) {
+      throw new Error("Active Web release tree does not match the local archive");
+    }
+    if (archive.treeSha256 === current?.tree_sha256) {
+      report("done", "Web already current");
+      return {};
+    }
+    report("upload", `${archive.fileCount} files`);
+    const uploaded = payload(await uploadFrontendRelease(http, projectRef, selected.id, archive.archivePath));
+    const release = record4(uploaded.release);
+    const releaseId = requiredString(release?.release_id, "release.release_id");
+    if (releaseId !== archive.sha256)
+      throw new Error("Uploaded Web release identity does not match the local archive");
+    if (release?.tree_sha256 !== archive.treeSha256)
+      throw new Error("Uploaded Web release tree does not match the local build");
+    report("done", releaseId.slice(0, 12));
+    return {
+      request: {
+        deployment_id: selected.id,
+        release_id: releaseId,
+        expected_active_release_id: activeReleaseId ?? "absent",
+        expected_activation_id: activeActivationId ?? "absent",
+        mutation_id: crypto.randomUUID()
+      }
+    };
+  } finally {
+    await archive.cleanup();
+  }
+}
 function phaseReporter(json) {
   const started = performance.now();
   return (phase, detail) => {
@@ -28368,12 +28541,10 @@ function registerDeployTools(server, http, options = {}) {
       }
       const configurationPath = options.application.configurationPath?.trim();
       const configurationId = options.application.configurationId?.trim();
-      if (!configurationPath && !configurationId) {
-        throw new Error("Application profile requires SUPACLOUD_APPLICATION_CONFIGURATION_PATH or SUPACLOUD_APPLICATION_CONFIGURATION_ID");
-      }
       if (configurationPath && configurationId) {
         throw new Error("Application profile must set only one of SUPACLOUD_APPLICATION_CONFIGURATION_PATH or SUPACLOUD_APPLICATION_CONFIGURATION_ID");
       }
+      const stagedWeb = await stageApplicationWebRelease(http, projectRef, configRoot, args.skip_build === true, args.json === true, options.environmentVariables);
       const result = await options.applicationRelease({
         action: "release",
         ref: projectRef,
@@ -28384,6 +28555,7 @@ function registerDeployTools(server, http, options = {}) {
         ...configurationId ? { configuration_id: configurationId } : {},
         ...options.application.manifestPath ? { manifest_path: options.application.manifestPath } : {},
         ...args.skip_build === true ? { skip_build: true } : {},
+        ...stagedWeb?.request === undefined ? {} : { web: stagedWeb.request },
         ...args.json === true ? { format: "json", json: true } : {}
       });
       return result;
@@ -28887,10 +29059,320 @@ function registerRemoteDevTools(server, options = {}) {
     throw new Error("Unsupported remote dev action");
   });
 }
+
+// src/shared/tools/developer-experience-tools.ts
+import { existsSync as existsSync15 } from "node:fs";
+import { mkdir as mkdir7, readdir as readdir8, readFile as readFile7, writeFile as writeFile6 } from "node:fs/promises";
+import { dirname as dirname12, join as join19, resolve as resolve24 } from "node:path";
+var initToolSchema = {
+  root: optional(String2(), "Project directory to initialize (default: current directory)"),
+  json: optional(Boolean2(), "Emit one machine-readable JSON result")
+};
+var environmentToolSchema = {
+  action: withDescription(stringEnum(["list", "check"]), "Environment profile inspection action"),
+  root: optional(String2(), "Project directory containing .env.supacloud.* files"),
+  json: optional(Boolean2(), "Emit one machine-readable JSON result")
+};
+var TEST_PROFILE = [
+  "SUPACLOUD_ENV=test",
+  "SUPACLOUD_API_URL=https://management.test.example.com",
+  "SUPACLOUD_API_TOKEN=<test-management-api-token>",
+  "SUPACLOUD_PROJECT_REF=<test-project-ref>",
+  ""
+].join(`
+`);
+var PRODUCTION_PROFILE = [
+  "SUPACLOUD_ENV=production",
+  "SUPACLOUD_API_URL=https://management.example.com",
+  "SUPACLOUD_API_TOKEN=<production-management-api-token>",
+  "SUPACLOUD_PROJECT_REF=<production-project-ref>",
+  ""
+].join(`
+`);
+function textResult3(text, isError = false) {
+  return { isError, content: [{ type: "text", text }] };
+}
+function jsonResult(value, isError = false) {
+  return textResult3(JSON.stringify(value, null, 2), isError);
+}
+function record5(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function packageDependencies(manifest) {
+  return new Set([
+    ...Object.keys(manifest.dependencies ?? {}),
+    ...Object.keys(manifest.devDependencies ?? {})
+  ]);
+}
+function outputDirectoryFor(manifest) {
+  const dependencies = packageDependencies(manifest);
+  if (dependencies.has("next"))
+    return "out";
+  if (dependencies.has("@sveltejs/kit") || dependencies.has("svelte"))
+    return "build";
+  return "dist";
+}
+async function readPackageManifest(root) {
+  const path = join19(root, "package.json");
+  if (!existsSync15(path))
+    return {};
+  try {
+    const parsed = JSON.parse(await readFile7(path, "utf8"));
+    const value = record5(parsed);
+    if (!value)
+      throw new Error("package.json must contain an object");
+    const scripts = record5(value.scripts);
+    const dependencies = record5(value.dependencies);
+    const devDependencies = record5(value.devDependencies);
+    return {
+      scripts: scripts ?? undefined,
+      dependencies: dependencies ?? undefined,
+      devDependencies: devDependencies ?? undefined
+    };
+  } catch (error) {
+    throw new Error(`Invalid package.json: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+async function writeNewFile(path, content) {
+  try {
+    await writeFile6(path, content, { encoding: "utf8", flag: "wx", mode: 384 });
+    return true;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "EEXIST")
+      return false;
+    throw error;
+  }
+}
+async function ensureGitignore(root) {
+  const path = join19(root, ".gitignore");
+  const existing = existsSync15(path) ? await readFile7(path, "utf8") : "";
+  const required = [".env.supacloud.*", "!.env.supacloud.*.example"];
+  const missing = required.filter((entry) => !existing.split(/\r?\n/).includes(entry));
+  if (missing.length === 0)
+    return false;
+  const prefix = existing.length > 0 && !existing.endsWith(`
+`) ? `${existing}
+` : existing;
+  await writeFile6(path, `${prefix}${missing.join(`
+`)}
+`, "utf8");
+  return true;
+}
+async function initializeProject(request, options) {
+  const root = resolve24(request.root || options.cwd || process.cwd());
+  await mkdir7(root, { recursive: true });
+  const configPath = join19(root, "supacloud.json");
+  if (existsSync15(configPath)) {
+    throw new Error(`supacloud.json already exists in ${root}; init never overwrites project configuration`);
+  }
+  const manifest = await readPackageManifest(root);
+  const hasBuildScript = typeof manifest.scripts?.build === "string" && Boolean(manifest.scripts.build.trim());
+  const outputDirectory = outputDirectoryFor(manifest);
+  const config = {
+    frontend: {
+      root: ".",
+      outputDirectory
+    }
+  };
+  const created = [];
+  try {
+    await writeFile6(configPath, `${JSON.stringify(config, null, 2)}
+`, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: 420
+    });
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "EEXIST") {
+      throw new Error(`supacloud.json already exists in ${root}; init never overwrites project configuration`);
+    }
+    throw error;
+  }
+  created.push("supacloud.json");
+  if (await writeNewFile(join19(root, ".env.supacloud.test.example"), TEST_PROFILE)) {
+    created.push(".env.supacloud.test.example");
+  }
+  if (await writeNewFile(join19(root, ".env.supacloud.production.example"), PRODUCTION_PROFILE)) {
+    created.push(".env.supacloud.production.example");
+  }
+  if (await ensureGitignore(root))
+    created.push(".gitignore");
+  const result = {
+    schema: "supacloud.developer-experience.init.v1",
+    ok: true,
+    root,
+    created,
+    detected: {
+      package_json: existsSync15(join19(root, "package.json")),
+      build_script: hasBuildScript,
+      output_directory: outputDirectory
+    },
+    next: [
+      "cp .env.supacloud.test.example .env.supacloud.test",
+      "supacloud env check",
+      "supacloud --env test deploy"
+    ]
+  };
+  if (request.json === true)
+    return jsonResult(result);
+  return textResult3([
+    `Initialized SupaCloud deployment in ${root}.`,
+    `Created: ${created.join(", ")}.`,
+    hasBuildScript ? `Detected package.json build script; deploy output defaults to ${outputDirectory}.` : "No package.json build script detected; add one before deploying.",
+    "",
+    ...result.next
+  ].join(`
+`));
+}
+function profileNameFromFile(name) {
+  const match = name.match(/^\.env\.supacloud\.([A-Za-z0-9][A-Za-z0-9_-]{0,63})$/);
+  return match?.[1] ?? null;
+}
+async function environmentProfiles(root) {
+  const entries = await readdir8(root, { withFileTypes: true }).catch((error) => {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT")
+      return [];
+    throw error;
+  });
+  return entries.filter((entry) => entry.isFile()).map((entry) => {
+    const name = profileNameFromFile(entry.name);
+    return name ? { name, path: join19(root, entry.name), exists: true } : null;
+  }).filter((profile) => profile !== null).sort((left, right) => left.name.localeCompare(right.name));
+}
+function statusMissing(context) {
+  if (context.credentialScope === "management") {
+    return [
+      !context.apiUrl ? "SUPACLOUD_API_URL" : null,
+      !context.apiToken ? "SUPACLOUD_API_TOKEN" : null,
+      !context.projectRef ? "SUPACLOUD_PROJECT_REF" : null
+    ].filter((value) => value !== null);
+  }
+  if (context.credentialScope === "project_application") {
+    return [
+      !context.inferredSupabaseUrl ? "SUPABASE_URL" : null,
+      !context.inferredServiceRoleKey ? "SUPABASE_SERVICE_ROLE_KEY" : null,
+      !context.projectRef ? "SUPACLOUD_PROJECT_REF" : null
+    ].filter((value) => value !== null);
+  }
+  return ["SUPACLOUD_API_URL", "SUPACLOUD_API_TOKEN", "SUPACLOUD_PROJECT_REF"];
+}
+function deployMissing(context) {
+  const missing = statusMissing(context);
+  if (context.credentialScope !== "management") {
+    return [...missing, "Management API context"];
+  }
+  if (context.applicationId) {
+    if (!context.applicationEnvironmentId)
+      missing.push("SUPACLOUD_APPLICATION_ENVIRONMENT_ID");
+    if (!context.applicationConfigurationPath && !context.applicationConfigurationId) {
+      missing.push("SUPACLOUD_APPLICATION_CONFIGURATION_PATH or SUPACLOUD_APPLICATION_CONFIGURATION_ID");
+    }
+  }
+  return missing;
+}
+async function inspectProfile(profile) {
+  try {
+    const context = resolveSupaCloudContext({}, dirname12(profile.path), {
+      environmentName: profile.name
+    });
+    const status = statusMissing(context);
+    const deploy = deployMissing(context);
+    return {
+      name: profile.name,
+      path: profile.path,
+      environment: context.environment || null,
+      production: context.production,
+      source: "named_env_file",
+      credentialScope: context.credentialScope,
+      projectRef: context.projectRef || null,
+      statusReady: status.length === 0,
+      statusMissing: status,
+      deployReady: deploy.length === 0,
+      deployMissing: deploy,
+      hasApiToken: Boolean(context.apiToken),
+      hasServiceRoleKey: Boolean(context.inferredServiceRoleKey),
+      error: null
+    };
+  } catch (error) {
+    return {
+      name: profile.name,
+      path: profile.path,
+      environment: null,
+      production: false,
+      source: "invalid",
+      credentialScope: "incomplete",
+      projectRef: null,
+      statusReady: false,
+      statusMissing: [],
+      deployReady: false,
+      deployMissing: [],
+      hasApiToken: false,
+      hasServiceRoleKey: false,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function inspectEnvironment(request, options) {
+  const root = resolve24(request.root || options.cwd || process.cwd());
+  const profiles = await environmentProfiles(root);
+  if (request.action === "list") {
+    const active = options.activeContext?.environment || null;
+    const result = {
+      schema: "supacloud.developer-experience.environments.v1",
+      ok: true,
+      root,
+      active,
+      environments: profiles.map((profile) => ({
+        name: profile.name,
+        path: profile.path,
+        active: profile.name.toLowerCase() === active?.toLowerCase()
+      }))
+    };
+    if (request.json === true)
+      return jsonResult(result);
+    if (profiles.length === 0) {
+      return textResult3(`No .env.supacloud.<name> profiles found in ${root}.
+Run \`supacloud init\` to create safe examples.`);
+    }
+    return textResult3([
+      `Environment profiles in ${root}:`,
+      ...result.environments.map((profile) => `${profile.active ? "*" : " "} ${profile.name}  ${profile.path}`)
+    ].join(`
+`));
+  }
+  const reports = await Promise.all(profiles.map((profile) => inspectProfile(profile)));
+  const result = {
+    schema: "supacloud.developer-experience.environment-check.v1",
+    ok: reports.length > 0 && reports.every((report) => report.statusReady),
+    root,
+    active: options.activeContext?.environment || null,
+    environments: reports
+  };
+  if (request.json === true)
+    return jsonResult(result, !result.ok);
+  if (reports.length === 0) {
+    return textResult3(`No environment profiles found in ${root}.
+Run \`supacloud init\` and copy an example profile.`, true);
+  }
+  const lines = reports.map((report) => {
+    if (report.error)
+      return `FAIL ${report.name}: ${report.error}`;
+    const status = report.statusReady ? "OK" : `FAIL missing ${report.statusMissing.join(", ")}`;
+    const deploy = report.deployReady ? "deploy=ready" : `deploy=blocked(${report.deployMissing.join(", ")})`;
+    const ref = report.projectRef ? `project=${report.projectRef}` : "project=unknown";
+    return `${status}  ${report.name}  ${deploy}  ${ref}`;
+  });
+  return textResult3(lines.join(`
+`), !result.ok);
+}
+function registerDeveloperExperienceTools(server, options = {}) {
+  registerTool(server, "init", "Create SupaCloud deployment configuration and non-secret environment examples without overwriting project files.", initToolSchema, (request) => initializeProject(request, options));
+  registerTool(server, "env", "List or locally validate named SupaCloud environment profiles without contacting the platform or printing secrets.", environmentToolSchema, (request) => inspectEnvironment(request, options));
+}
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.87.1",
+  version: "0.90.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -28942,14 +29424,14 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.44.0",
-    "@supacloud/delivery": "0.14.0",
-    "@supacloud/db": "0.16.0",
-    typebox: "1.3.34"
+    "@supacloud/compiler": "^0.44.1",
+    "@supacloud/delivery": "0.15.0",
+    "@supacloud/db": "0.16.1",
+    typebox: "1.3.36"
   },
   overrides: {
-    "@supacloud/contracts": "0.8.0",
-    "@supacloud/delivery": "0.14.0",
+    "@supacloud/contracts": "0.8.1",
+    "@supacloud/delivery": "0.15.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   devDependencies: {
@@ -29125,6 +29607,8 @@ USAGE
 
   ${preferredCommand} [global flags] deploy [--flags]
   ${preferredCommand} [global flags] <module> <action> [--flags]
+  ${preferredCommand} init [--root <directory>]
+  ${preferredCommand} env <list|check> [--root <directory>]
   ${preferredCommand} [global flags] status
   ${preferredCommand} --help
   ${preferredCommand} --version
@@ -29157,6 +29641,9 @@ DEFAULT CONTEXT
 
 EXAMPLES
 
+  ${preferredCommand} init
+  ${preferredCommand} env check
+  ${preferredCommand} env check --json
   ${preferredCommand} status
   ${preferredCommand} deploy
   ${preferredCommand} --env test deploy
@@ -29178,8 +29665,8 @@ EXAMPLES
   ${preferredCommand} release postgrest_restart --ref abc123
   ${preferredCommand} release release_canary_fixture_stage_replay --ref abc123 --subject <uuid> --request_id <uuid>
   ${preferredCommand} release release_canary_fixture_disable_replay --ref abc123 --fixture_id <uuid> --disable_request_id <uuid> --issuer <issuer-url> --subject <uuid>
-  ${preferredCommand} release scope_rebind --file supacloud/fa/release-scopes/20260907-intake-p1-production.json
-  ${preferredCommand} release scope_inspect --file supacloud/fa/release-scopes/20260907-intake-p1-production.json
+  ${preferredCommand} release scope_rebind --file supacloud/fa/release-scopes/20260907-intake-p1-production.json --environment_id production
+  ${preferredCommand} release scope_inspect --file supacloud/fa/release-scopes/20260907-intake-p1-production.json --environment_id production
   ${preferredCommand} queue stats --queue emails
   ${preferredCommand} queue dlq --queue emails --limit 20
   ${preferredCommand} frontend list --ref abc123
@@ -29316,6 +29803,10 @@ function createCliTools(context, confirmProduction) {
   })));
   Object.assign(tools, captureTools((server) => registerLiteCliTools(server)));
   Object.assign(tools, captureTools((server) => registerAiTools(server)));
+  Object.assign(tools, captureTools((server) => registerDeveloperExperienceTools(server, {
+    cwd: process.cwd(),
+    activeContext: context
+  })));
   Object.assign(tools, captureTools((server) => registerAppTools(server, { onDevProgress: writeDevProgress })));
   Object.assign(tools, captureTools((server) => registerAppAliases(server)));
   Object.assign(tools, captureTools((server) => registerDbGovernanceTools(server, {
@@ -29550,7 +30041,7 @@ async function main() {
     return;
   }
   const cliTools = createCliTools(context, globalOptions.confirmProduction);
-  if (args.length === 1 && !["ai", "supabase", "lite", "app", "db"].includes(args[0]) && cliTools[args[0]]) {
+  if (args.length === 1 && !["ai", "supabase", "lite", "app", "db", "env"].includes(args[0]) && cliTools[args[0]]) {
     if ("action" in cliTools[args[0]].schema) {
       if (context.credentialScope !== "management" || !context.apiUrl || !context.apiToken) {
         console.error(`This command requires Management API context. Run \`${preferredCommand} status\` to inspect current detection.`);