@supacloud/cli 0.88.0 → 0.90.1

package/README.md

@@ -284,9 +284,13 @@ supacloud --env production deploy --confirm-production production-ref
 Test and production use the same workflow. Production safety is enforced by the
 CLI confirmation gate; immutable releases, configuration revisions, backups,
 readiness, CAS activation, rollback artifacts and uncertain-result
-reconciliation belong to SupaCloud. The application layer only supplies its
-build output and configuration file; it does not implement backup, activation
-or downgrade orchestration.
+reconciliation belong to SupaCloud. `SUPACLOUD_APPLICATION_CONFIGURATION_PATH`
+and `SUPACLOUD_APPLICATION_CONFIGURATION_ID` are optional pins; when neither
+is supplied, SupaCloud reuses the current configuration head for the selected
+environment. A first deployment still requires a configuration revision to
+exist on the platform. The application layer only supplies its build output and
+optional configuration file; it does not implement backup, activation or
+downgrade orchestration.
 
 CLI requests (including `status`) default to `SUPACLOUD_TLS_VERIFY=false`, skipping HTTPS certificate verification so that
 air-gapped installations using private or self-signed certificates work
@@ -629,44 +633,25 @@ query parameters and accepts only its authoritative JSON boolean `false`
 read-back. The fixture binding comes from the validated disable receipt before
 reporting success. Management endpoint projection is checked before and after.
 
-### Release scope rebinding and inspection
+### Internal release scope controls
 
-Release scopes bind deployment manifests (functions, migrations, web assets) to
-an exact 40-character base commit SHA. When upstream `main` advances with
-unrelated fixes, `release scope_rebind` rebinds release manifests to the updated
-base commit without manual JSON editing or risk of dirtying non-manifest fields.
+Scope files and manual release-controller operations are internal compatibility
+surfaces. They are not part of the normal customer deployment path. Use the
+project command instead:
 
-```bash
-# Rebind a single scope manifest to latest git main (or origin/main)
-supacloud release scope_rebind --file supacloud/fa/release-scopes/20260907-intake-p1-production.json
-
-# Rebind multiple files (e.g. production and staging together)
-supacloud release scope_rebind --files "20260907-intake-p1-production.json,20260907-intake-p1-staging.json"
-
-# Rebind all scopes matching a task ID or filename prefix in standard directories
-supacloud release scope_rebind --task 20260907-intake-p1
-
-# Specify an explicit base commit SHA or git ref
-supacloud release scope_rebind --task 20260907-intake-p1 --base_commit origin/main
-
-# Preview changes without modifying files
-supacloud release scope_rebind --task 20260907-intake-p1 --dry_run
-
-# Inspect scope status, SHA-256 hash, and alignment with git HEAD / origin/main
-supacloud release scope_inspect --file 20260907-intake-p1-production.json
-
-# Scaffold a new canonical release scope
-supacloud release scope_create \
-  --file supacloud/fa/release-scopes/20260907-intake-p1.json \
-  --task FA-INTAKE-P1 \
-  --ref abc123 \
-  --functions "fa-api,fa-worker" \
-  --migrations "20260907120000_init"
+```sh
+supacloud --env test deploy
+supacloud --env production deploy --confirm-production PROJECT_REF
 ```
 
-Scope actions run locally without requiring Management API credentials. Files
-are formatted canonically with 2 spaces and sorted keys, and the authoritative
-`scope_sha256` checksum is recalculated automatically.
+FA deployment policy and the boundary between platform-owned operations and
+FA-owned business features are documented in
+[`docs/fa-deployment-capability-boundary.md`](../../docs/fa-deployment-capability-boundary.md).
+
+Scope creation, rebinding, inspection and hash calculation are intentionally
+undocumented here. They remain available only for internal compatibility,
+audit and historical receipt migration. Customers do not need a scope file
+before running the one-command deployment flow above.
 
 The legacy `.env` fallback is unclassified and therefore does not enable the
 production confirmation gate. Production automation must select a `prod` or

package/dist/index.js

@@ -8713,6 +8713,8 @@ function decodedSchema(inputSchema, outputSchema, decode, options) {
   return result;
 }
 function schemaEnumValues(schema) {
+  if (!schema)
+    return [];
   const view = schema;
   if (Array.isArray(view.enum)) {
     return view.enum.filter((value) => typeof value === "string" || typeof value === "number").map((value) => String(value));
@@ -8818,7 +8820,7 @@ async function runCli(cliTools, args, options = {}) {
   `);
   const getSchemaShape = (schema) => schemaProperties(schema);
   const getEnumOptions = (field) => schemaEnumValues(field);
-  const getDescription = (field) => schemaDescription(field);
+  const getDescription = (field) => field ? schemaDescription(field) : "";
   const formatToolHelp = (toolName, tool) => {
     const shape = getSchemaShape(tool.schema);
     const actionField = shape.action;
@@ -9167,7 +9169,7 @@ var ACTION_POLICY = {
   deploy: { write: ["deploy"] },
   applications: {
     read: ["list_releases", "get_release", "get_runtime", "get_deployment_evidence", "get_configuration", "get_release_transfer_plan", "get_promotion_plan", "get_promotion_status", "get_rollback_snapshot", "get_history", "get_deploy_plan", "logs", "get_preview_plan", "list_previews", "get_preview"],
-    write: ["upload_release", "put_configuration", "release_application", "transfer_release", "promote_application", "reconcile_promotion", "create_preview", "reconcile_preview", "cleanup_preview", "activate_release", "deploy_release", "rollback_release", "reconcile_activation", "retire_activation"]
+    write: ["upload_release", "put_configuration", "deploy_application", "transfer_release", "promote_application", "reconcile_promotion", "create_preview", "reconcile_preview", "cleanup_preview", "activate_release", "deploy_release", "rollback_release", "reconcile_activation", "retire_activation"]
   },
   project: {
     read: ["get", "endpoints", "health", "logs", "api_keys", "settings", "tasks", "task_detail", "task_stats", "dlq", "background_settings"],
@@ -10493,34 +10495,67 @@ function parseApplicationDeployPlan(value) {
     throw new Error("Invalid application deploy plan action");
   return value;
 }
-// node_modules/@supacloud/delivery/src/application-release-operation.ts
+// node_modules/@supacloud/delivery/src/application-deploy-operation.ts
 var closed3 = { additionalProperties: false };
+var sha256 = ApplicationReleaseIdSchema;
 var nullableActivation = Union([ApplicationActivationIdSchema, Null()]);
-var ApplicationReleaseRequestSchema = _Object_({
-  release_id: ApplicationReleaseIdSchema,
+var ApplicationDeployWebRequestSchema = _Object_({
+  deployment_id: String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }),
+  release_id: sha256,
+  expected_active_release_id: String2({ minLength: 1 }),
+  expected_activation_id: String2({ minLength: 1 }),
+  mutation_id: ApplicationActivationIdSchema
+}, closed3);
+var ApplicationDeployRequestSchema = _Object_({
+  mutation_id: ApplicationActivationIdSchema,
+  release_id: sha256,
   configuration_id: Optional(ApplicationConfigurationIdSchema),
   configuration_write: Optional(ApplicationConfigurationWriteSchema),
-  activation_id: Optional(ApplicationActivationIdSchema),
-  expected_activation_id: Optional(nullableActivation),
-  expected_plan_sha256: Optional(ApplicationReleaseIdSchema)
+  expected_plan_sha256: Optional(sha256),
+  approved_migration_digest: Optional(sha256),
+  web: Optional(ApplicationDeployWebRequestSchema)
 }, closed3);
-var ApplicationReleaseResultSchema = _Object_({
-  schema: Literal("supacloud.application-release.v1"),
+var ApplicationBackendReceiptSchema = _Object_({
+  schema: Literal("supacloud.application-backend-receipt.v1"),
   project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
   application_id: ApplicationIdSchema,
   environment_id: ApplicationIdSchema,
-  release_id: ApplicationReleaseIdSchema,
+  release_id: sha256,
+  manifest_sha256: sha256,
+  mutation_id: ApplicationActivationIdSchema,
+  plan_sha256: sha256,
+  backup_id: Union([String2(), Null()]),
+  before_ledger_digest: sha256,
+  after_ledger_digest: sha256,
+  applied_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { uniqueItems: true }),
+  schema_reloaded: Boolean2(),
+  postgrest_healthy: Boolean2()
+}, closed3);
+var ApplicationDeployResultSchema = _Object_({
+  schema: Literal("supacloud.application-deploy.v1"),
+  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+  application_id: ApplicationIdSchema,
+  environment_id: ApplicationIdSchema,
+  mutation_id: ApplicationActivationIdSchema,
+  release_id: sha256,
   configuration_id: ApplicationConfigurationIdSchema,
   activation_id: ApplicationActivationIdSchema,
   expected_activation_id: nullableActivation,
-  plan_sha256: ApplicationReleaseIdSchema,
+  plan_sha256: sha256,
   action: Union([Literal("activate"), Literal("no-op")]),
   replayed: Boolean2(),
-  execution_performed: Boolean2()
+  execution_performed: Boolean2(),
+  backend_receipt: ApplicationBackendReceiptSchema,
+  web: Optional(_Object_({
+    deployment_id: String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }),
+    release_id: sha256,
+    activation_id: ApplicationActivationIdSchema,
+    replayed: Boolean2()
+  }, closed3))
 }, closed3);
-function parseApplicationReleaseResult(value) {
-  if (!Check2(ApplicationReleaseResultSchema, value)) {
-    throw new Error("Invalid application release result");
+function parseApplicationDeployResult(value) {
+  if (!Check2(ApplicationDeployResultSchema, value)) {
+    throw new Error("Invalid application deploy result");
   }
   return structuredClone(value);
 }
@@ -10721,7 +10756,7 @@ function parseApplicationReleaseTransferResult(candidate) {
 }
 // node_modules/@supacloud/delivery/src/deployment-evidence.ts
 var closed5 = { additionalProperties: false };
-var sha256 = String2({ pattern: "^[a-f0-9]{64}$" });
+var sha2562 = String2({ pattern: "^[a-f0-9]{64}$" });
 var isoDate = String2({ minLength: 20, maxLength: 40 });
 var status = Union([
   Literal("confirmed"),
@@ -10741,7 +10776,7 @@ var DatabaseProviderSchema = _Object_({
   topology: Union([Literal("single-node"), Literal("distributed")]),
   migration: _Object_({
     status,
-    inventory_sha256: Union([sha256, Null()]),
+    inventory_sha256: Union([sha2562, Null()]),
     compatibility: Union([
       Literal("verified"),
       Literal("not-proven"),
@@ -10789,9 +10824,9 @@ var DeploymentEvidenceSchema = _Object_({
   }, closed5),
   source: _Object_({
     commit_sha: Union([String2({ pattern: "^[0-9a-f]{7,64}$" }), Null()]),
-    manifest_sha256: sha256,
+    manifest_sha256: sha2562,
     contract_schema: Union([String2({ minLength: 1, maxLength: 128 }), Null()]),
-    environment_binding_version: Union([sha256, Null()])
+    environment_binding_version: Union([sha2562, Null()])
   }, closed5),
   database: DatabaseProviderSchema,
   components: _Array_(DeploymentComponentEvidenceSchema, { minItems: 1, maxItems: 32 }),
@@ -10847,9 +10882,9 @@ function parseDeploymentEvidence(value) {
 // node_modules/@supacloud/delivery/src/application-promotion.ts
 var closed6 = { additionalProperties: false };
 var projectRef2 = String2({ pattern: "^[a-z0-9-]{1,20}$" });
-var sha2562 = ApplicationReleaseIdSchema;
+var sha2563 = ApplicationReleaseIdSchema;
 var nullableActivation2 = Union([ApplicationActivationIdSchema, Null()]);
-var nullableDigest = Union([sha2562, Null()]);
+var nullableDigest = Union([sha2563, Null()]);
 var observation = {
   activation_id: nullableActivation2,
   receipt_confirmed: Boolean2(),
@@ -10875,24 +10910,24 @@ var ApplicationPromotionPlanSchema = _Object_({
   project_ref: projectRef2,
   application_id: ApplicationIdSchema,
   environment_id: ApplicationIdSchema,
-  manifest_sha256: sha2562,
-  plan_sha256: sha2562,
+  manifest_sha256: sha2563,
+  plan_sha256: sha2563,
   source: _Object_({
     project_ref: projectRef2,
     environment_id: ApplicationIdSchema,
-    release_id: sha2562,
+    release_id: sha2563,
     ...observation
   }, closed6),
   target: _Object_({
-    candidate_release_id: sha2562,
-    current_release_id: Union([sha2562, Null()]),
+    candidate_release_id: sha2563,
+    current_release_id: Union([sha2563, Null()]),
     artifact_action: Union([Literal("materialize"), Literal("reuse")]),
     configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
     configuration: Union([ApplicationConfigurationViewSchema, Null()]),
     ...observation
   }, closed6),
   migrations: _Object_({
-    ledger_digest: sha2562,
+    ledger_digest: sha2563,
     ledger_compatible: Boolean2(),
     project_migrations_applied: Boolean2(),
     pending_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { maxItems: 4096, uniqueItems: true }),
@@ -16857,7 +16892,8 @@ var ApplicationActivationRetirementResultSchema2 = ApplicationActivationRetireme
 var ApplicationRollbackSnapshotSchema2 = ApplicationRollbackSnapshotSchema;
 var ApplicationActivationHistoryCursorSchema2 = ApplicationActivationHistoryCursorSchema;
 var ApplicationPromotionPlanSchema2 = ApplicationPromotionPlanSchema;
-var ApplicationReleaseRequestSchema2 = ApplicationReleaseRequestSchema;
+var ApplicationDeployRequestSchema2 = ApplicationDeployRequestSchema;
+var ApplicationDeployWebRequestSchema2 = ApplicationDeployWebRequestSchema;
 
 // src/shared/mutation-protocol.ts
 import { createHash as createHash6 } from "node:crypto";
@@ -17645,7 +17681,7 @@ var APPLICATION_TOOL_SCHEMA = {
     "put_configuration",
     "get_deploy_plan",
     "deploy_release",
-    "release_application",
+    "deploy_application",
     "get_release_transfer_plan",
     "transfer_release",
     "get_promotion_plan",
@@ -17673,14 +17709,15 @@ var APPLICATION_TOOL_SCHEMA = {
   activation_id: optional(ApplicationActivationIdSchema2, "[deploy_release/activate_release/reconcile_activation/retire_activation/rollback_release/get_history] Stable activation ID; generated for automatic deployment/rollback if omitted"),
   expected_activation_id: optional(Union([ApplicationActivationIdSchema2, Null(), Literal("absent")]), "[deploy_release/activate_release/rollback_release] Current activation ID, or absent for first activation; selected from verified plan for automatic deployment"),
   configuration_path: optional(String2(), "[put_configuration] Local configuration write JSON including revision and expected revision"),
-  configuration_write: optional(Unknown(), "[release_application] Parsed immutable configuration write"),
+  configuration_write: optional(Unknown(), "[deploy_application] Parsed immutable configuration write"),
   manifest_path: optional(String2(), "[upload_release] Local delivery.manifest.json"),
+  web: optional(ApplicationDeployWebRequestSchema2, "[deploy_application] Immutable staged Web release binding"),
   release_id: optional(ApplicationReleaseIdSchema2, "[get_release/get_deploy_plan/deploy_release/activate_release/reconcile_activation/rollback_release] Immutable application release ID; platform selects previous for default rollback"),
   source_ref: optional(String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" }), "[get_release_transfer_plan/transfer_release] Source project ref"),
   source_release_id: optional(ApplicationReleaseIdSchema2, "[get_release_transfer_plan/transfer_release] Source immutable release ID"),
   source_environment_id: optional(ApplicationIdSchema2, "[get_promotion_plan] Source environment"),
-  mutation_id: optional(ApplicationActivationIdSchema2, "[promote_application/get_promotion_status/reconcile_promotion] Stable promotion mutation ID"),
-  approved_migration_digest: optional(ApplicationReleaseIdSchema2, "[promote_application] Exact reviewed migration execution-plan digest"),
+  mutation_id: optional(ApplicationActivationIdSchema2, "[deploy_application/promote_application/get_promotion_status/reconcile_promotion] Stable mutation ID"),
+  approved_migration_digest: optional(ApplicationReleaseIdSchema2, "[deploy_application/promote_application] Exact reviewed migration execution-plan digest"),
   plan: optional(ApplicationPromotionPlanSchema2, "[promote_application] Immutable plan returned by get_promotion_plan"),
   cursor: optional(Union([ApplicationReleaseIdSchema2, ApplicationActivationHistoryCursorSchema2]), "[list_releases/get_history] Returned page cursor"),
   limit: optional(Integer({ minimum: 1, maximum: 100 }), "[list_releases/get_history] Page size, default 50/20"),
@@ -18033,57 +18070,50 @@ function registerApplicationTools(server, http) {
       const observed = await readDeployPlan(http, args, project);
       return observed.failure ?? releaseControlSuccess(operation, { ...observed.identity, plan: observed.plan });
     }
-    if (action === "release_application") {
+    if (action === "deploy_application") {
       const environmentId = text(args, "environment_id");
       const releaseId = text(args, "release_id");
-      if (!Check2(ApplicationIdSchema2, environmentId) || !Check2(ApplicationReleaseIdSchema2, releaseId)) {
-        throw new Error("Invalid application release identity");
+      const mutationId = text(args, "mutation_id");
+      if (!Check2(ApplicationIdSchema2, environmentId) || !Check2(ApplicationReleaseIdSchema2, releaseId) || !Check2(ApplicationActivationIdSchema2, mutationId)) {
+        throw new Error("Invalid application deploy identity");
       }
       const configurationId = args["configuration_id"];
-      const activationId = args["activation_id"];
-      const expectedActivationId = args["expected_activation_id"];
       if (configurationId !== undefined && !Check2(ApplicationConfigurationIdSchema2, configurationId)) {
         throw new Error("Invalid application configuration ID");
       }
-      if (activationId !== undefined && !Check2(ApplicationActivationIdSchema2, activationId)) {
-        throw new Error("Invalid application activation ID");
-      }
-      if (expectedActivationId !== undefined && expectedActivationId !== null && expectedActivationId !== "absent" && !Check2(ApplicationActivationIdSchema2, expectedActivationId)) {
-        throw new Error("Invalid expected activation ID");
-      }
       const configurationWrite = args["configuration_write"];
       const parsedConfigurationWrite = configurationWrite === undefined ? undefined : parseApplicationConfigurationWrite(configurationWrite);
       const requestedConfigurationId = configurationId ?? parsedConfigurationWrite?.configuration_id;
       const body = {
+        mutation_id: mutationId,
         release_id: releaseId,
         ...configurationId === undefined ? {} : { configuration_id: configurationId },
         ...configurationWrite === undefined ? {} : { configuration_write: configurationWrite },
-        ...activationId === undefined ? {} : { activation_id: activationId },
-        ...expectedActivationId === undefined ? {} : {
-          expected_activation_id: expectedActivationId === "absent" ? null : expectedActivationId
-        }
+        ...typeof args["approved_migration_digest"] === "string" ? { approved_migration_digest: args["approved_migration_digest"] } : {},
+        ...args["web"] === undefined ? {} : { web: args["web"] }
       };
-      if (!Check2(ApplicationReleaseRequestSchema2, body)) {
-        throw new Error("Invalid application release request");
+      if (!Check2(ApplicationDeployRequestSchema2, body)) {
+        throw new Error("Invalid application deploy request");
       }
-      const result = await http.post(`/v1/projects/${project}/applications/${encodeURIComponent(id)}/environments/${encodeURIComponent(environmentId)}/release`, body, { timeoutMs: 120000, maxJsonBytes: 65536, responseTimeoutMs: 30000 });
+      const result = await http.post(`/v1/projects/${project}/applications/${encodeURIComponent(id)}/environments/${encodeURIComponent(environmentId)}/deploy`, body, { timeoutMs: 120000, maxJsonBytes: 131072, responseTimeoutMs: 30000 });
       const identity = {
         project_ref: ref,
         application_id: id,
         environment_id: environmentId,
         release_id: releaseId,
-        ...configurationId === undefined ? {} : { configuration_id: configurationId },
-        ...activationId === undefined ? {} : { activation_id: activationId }
+        mutation_id: mutationId,
+        ...requestedConfigurationId === undefined ? {} : { configuration_id: requestedConfigurationId }
       };
       if (!result.ok)
         return releaseControlMutationFailure(operation, result, identity);
       try {
         if (result.status !== 200)
           throw new Error;
-        const release = parseApplicationReleaseResult(result.data);
-        if (release.project_ref !== ref || release.application_id !== id || release.environment_id !== environmentId || release.release_id !== releaseId || requestedConfigurationId !== undefined && release.configuration_id !== requestedConfigurationId || activationId !== undefined && release.activation_id !== activationId)
+        const deploy = parseApplicationDeployResult(result.data);
+        if (deploy.project_ref !== ref || deploy.application_id !== id || deploy.environment_id !== environmentId || deploy.release_id !== releaseId || deploy.mutation_id !== mutationId || requestedConfigurationId !== undefined && deploy.configuration_id !== requestedConfigurationId) {
           throw new Error;
-        return releaseControlSuccess(operation, release);
+        }
+        return releaseControlSuccess(operation, deploy);
       } catch {
         return releaseControlFailure(operation, "OUTCOME_UNKNOWN", result.status, identity);
       }
@@ -24538,6 +24568,7 @@ var REMOTE_APP_DESCRIPTIONS = {
   source_environment_id: "[promote-plan/diff/promote] Source environment ID",
   mutation_id: "[promote-status/promote-reconcile] Stable promotion mutation ID",
   approved_migration_digest: "[promote] Exact reviewed migration execution-plan digest",
+  web: "[release] Immutable staged Web release binding prepared by the deploy profile",
   branch_ref: "[preview-plan] Preview branch identity",
   branch_name: "[preview/preview-create] Human-readable preview branch name",
   data_mode: "[preview-plan/preview/preview-create] schema_only or full_clone",
@@ -25506,9 +25537,6 @@ async function runAppRelease(request, options, delegate) {
   if (request.configuration_path !== undefined && request.configuration_id !== undefined) {
     throw new Error("app release accepts either --configuration_path or --configuration_id, not both");
   }
-  if (request.configuration_path === undefined && request.configuration_id === undefined) {
-    throw new Error("app release requires --configuration_path or --configuration_id");
-  }
   if (request.activation_id !== undefined || request.expected_activation_id !== undefined) {
     throw new Error("app release generates one activation identity; use app deploy for an exact retry");
   }
@@ -25562,25 +25590,36 @@ async function runAppRelease(request, options, delegate) {
       configurationWrite = parseApplicationConfigurationWrite(await Bun.file(configurationPath).json());
       configurationId = configurationWrite.configuration_id;
     } catch {
-      return releasePhaseFailure("configure", releaseControlFailure("applications.release_application", "INVALID_RESPONSE", null, { project_ref: ref, application_id: id, environment_id: environmentId }), completed);
+      return releasePhaseFailure("configure", releaseControlFailure("applications.deploy_application", "INVALID_RESPONSE", null, { project_ref: ref, application_id: id, environment_id: environmentId }), completed);
     }
     completed.configure = { delegated: true, configuration_id: configurationId };
   } else {
-    completed.configure = { delegated: true, configuration_id: configurationId };
+    completed.configure = {
+      delegated: false,
+      resolved_by: "platform",
+      ...configurationId === undefined ? {} : { configuration_id: configurationId }
+    };
   }
   const deployArgs = {
-    action: "release_application",
+    action: "deploy_application",
     ref,
     id,
     environment_id: environmentId,
     release_id: releaseId,
-    configuration_id: configurationId,
-    activation_id: activationId,
-    ...configurationWrite === undefined ? {} : { configuration_write: configurationWrite }
+    mutation_id: activationId,
+    ...configurationId === undefined ? {} : { configuration_id: configurationId },
+    ...configurationWrite === undefined ? {} : { configuration_write: configurationWrite },
+    ...request.web === undefined ? {} : { web: request.web }
   };
   validateToolArguments(APPLICATION_TOOL_SCHEMA, deployArgs);
   const deployed = await delegate(deployArgs);
   const deployReceipt = resultObject(deployed);
+  const resolvedConfigurationId = typeof deployReceipt?.configuration_id === "string" ? deployReceipt.configuration_id : undefined;
+  if (resolvedConfigurationId !== undefined) {
+    configurationId = resolvedConfigurationId;
+    const configure = completed.configure;
+    completed.configure = configure && typeof configure === "object" && !Array.isArray(configure) ? { ...configure, configuration_id: resolvedConfigurationId } : { delegated: false, resolved_by: "platform", configuration_id: resolvedConfigurationId };
+  }
   if (deployed.isError || !deployReceipt?.ok) {
     return releasePhaseFailure("deploy", deployed, completed);
   }
@@ -25593,13 +25632,14 @@ async function runAppRelease(request, options, delegate) {
     application_id: id,
     environment_id: environmentId,
     release_id: releaseId,
-    configuration_id: configurationId,
+    ...configurationId === undefined ? {} : { configuration_id: configurationId },
     manifest_path: manifestPath,
     build: buildReceipt ? completed.build : { skipped: true, manifest_path: manifestPath },
     phases: completed,
     no_op: deployReceipt.action === "no-op" || deployReceipt.no_op === true,
     execution_performed: deployReceipt.execution_performed === true,
-    ...typeof deployReceipt.activation_id === "string" ? { activation_id: deployReceipt.activation_id } : {}
+    ...typeof deployReceipt.activation_id === "string" ? { activation_id: deployReceipt.activation_id } : {},
+    ...deployReceipt.web === undefined ? {} : { web: deployReceipt.web }
   };
   return request.format === "json" || request.json === true ? textResult(JSON.stringify(result, null, 2)) : textResult([
     `${ref}/${id}/${environmentId}: ${result.no_op ? "no-op" : "released"}`,
@@ -27205,6 +27245,7 @@ import { createHash as createHash8 } from "node:crypto";
 import { existsSync as existsSync13, mkdirSync as mkdirSync4, readdirSync as readdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname10, join as join16, relative as relative9, resolve as resolve21 } from "node:path";
 var SAFE_PROJECT_REF = /^[A-Za-z0-9_-]{1,64}$/;
+var SAFE_ENVIRONMENT_ID = /^[A-Za-z0-9_-]{1,64}$/;
 var BACKUP_ID = /^logical-full_[A-Za-z0-9_-]{1,64}_[a-f0-9]{32}$/;
 var SHA256 = /^[a-f0-9]{64}$/;
 var SAFE_DATABASE = /^[^\u0000-\u001f\u007f]{1,128}$/;
@@ -27445,6 +27486,27 @@ function genericScopedReleaseScopeJson(scope) {
 function genericScopedReleaseScopeSha256(scope) {
   return createHash8("sha256").update(genericScopedReleaseScopeJson(scope)).digest("hex");
 }
+function scopeEnvironmentId(scope, action) {
+  const environmentId = isRecord6(scope) ? scope.targetEnvironmentId : undefined;
+  if (typeof environmentId !== "string" || !SAFE_ENVIRONMENT_ID.test(environmentId)) {
+    throw new Error(`Scope for ${action} must be regenerated with a concrete targetEnvironmentId`);
+  }
+  return environmentId;
+}
+function requestedScopeEnvironment(args, action) {
+  const environmentId = args.environment_id;
+  if (typeof environmentId !== "string" || !SAFE_ENVIRONMENT_ID.test(environmentId)) {
+    throw new Error(`'environment_id' is required for ${action} and must identify one deployment environment`);
+  }
+  return environmentId;
+}
+function assertScopeEnvironment(scope, requestedEnvironmentId, action) {
+  const targetEnvironmentId = scopeEnvironmentId(scope, action);
+  if (targetEnvironmentId !== requestedEnvironmentId) {
+    throw new Error(`Scope target environment '${targetEnvironmentId}' does not match requested environment '${requestedEnvironmentId}'`);
+  }
+  return targetEnvironmentId;
+}
 function runGitRevParse(cwd, args) {
   const res = Bun.spawnSync(["git", ...args], { cwd });
   if (res.exitCode !== 0 || !res.stdout)
@@ -27571,10 +27633,10 @@ function collectScopeFiles(cwd, file, files, dir, task) {
 function handleScopeRebind(args) {
   const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve21(args.cwd.trim()) : process.cwd();
   const targetBaseCommit = resolveGitBaseCommit(cwd, args.base_commit);
+  const requestedEnvironmentId = requestedScopeEnvironment(args, "scope_rebind");
   const scopeFiles = collectScopeFiles(cwd, args.file, args.files, args.dir, args.task);
   const dryRun = args.dry_run === true;
-  const scopes = [];
-  for (const filePath of scopeFiles) {
+  const parsedScopes = scopeFiles.map((filePath) => {
     let content;
     try {
       content = readFileSync10(filePath, "utf8");
@@ -27587,15 +27649,20 @@ function handleScopeRebind(args) {
     } catch {
       throw new Error(`Scope file '${filePath}' is not valid JSON`);
     }
-    if (!isRecord6(parsed) || typeof parsed.baseCommit !== "string" || !/^[0-9a-f]{40}$/.test(parsed.baseCommit)) {
+    const targetEnvironmentId = assertScopeEnvironment(parsed, requestedEnvironmentId, "scope_rebind");
+    const previousBaseCommit = parsed.baseCommit;
+    if (typeof previousBaseCommit !== "string" || !/^[0-9a-f]{40}$/.test(previousBaseCommit)) {
       throw new Error(`Scope file '${filePath}' has missing or invalid baseCommit`);
     }
+    return { filePath, parsed, targetEnvironmentId };
+  });
+  const scopes = [];
+  for (const { filePath, parsed, targetEnvironmentId } of parsedScopes) {
     const previousBaseCommit = parsed.baseCommit;
     const updated = previousBaseCommit !== targetBaseCommit;
     if (updated) {
       parsed.baseCommit = targetBaseCommit;
     }
-    const canonicalJson = genericScopedReleaseScopeJson(parsed);
     const scopeSha256 = genericScopedReleaseScopeSha256(parsed);
     if (updated && !dryRun) {
       const formatted = JSON.stringify(canonicalValue(parsed), null, 2) + `
@@ -27608,6 +27675,7 @@ function handleScopeRebind(args) {
       target_project_ref: typeof parsed.targetProjectRef === "string" ? parsed.targetProjectRef : "",
       previous_base_commit: previousBaseCommit,
       new_base_commit: targetBaseCommit,
+      target_environment_id: targetEnvironmentId,
       scope_sha256: scopeSha256,
       updated
     });
@@ -27622,6 +27690,7 @@ function handleScopeRebind(args) {
 }
 function handleScopeInspect(args) {
   const cwd = typeof args.cwd === "string" && args.cwd.trim() ? resolve21(args.cwd.trim()) : process.cwd();
+  const requestedEnvironmentId = requestedScopeEnvironment(args, "scope_inspect");
   if (typeof args.file !== "string" || !args.file.trim()) {
     throw new Error("'file' is required for scope_inspect");
   }
@@ -27651,7 +27720,11 @@ function handleScopeInspect(args) {
   } catch {
     throw new Error(`Scope file '${args.file}' is not valid JSON`);
   }
-  if (!isRecord6(parsed) || typeof parsed.baseCommit !== "string" || !/^[0-9a-f]{40}$/.test(parsed.baseCommit)) {
+  if (!isRecord6(parsed)) {
+    throw new Error(`Scope file '${args.file}' must be an object and must be regenerated`);
+  }
+  const targetEnvironmentId = assertScopeEnvironment(parsed, requestedEnvironmentId, "scope_inspect");
+  if (typeof parsed.baseCommit !== "string" || !/^[0-9a-f]{40}$/.test(parsed.baseCommit)) {
     throw new Error(`Scope file '${args.file}' has missing or invalid baseCommit`);
   }
   const scopeSha256 = genericScopedReleaseScopeSha256(parsed);
@@ -27661,6 +27734,7 @@ function handleScopeInspect(args) {
     scope: {
       task_id: parsed.taskId,
       target_project_ref: parsed.targetProjectRef,
+      target_environment_id: targetEnvironmentId,
       base_commit: parsed.baseCommit,
       functions: parsed.functions,
       excluded_functions: parsed.excludedFunctions,
@@ -27698,6 +27772,7 @@ function handleScopeCreate(args, fallbackRef) {
   if (typeof args.task !== "string" || !args.task.trim()) {
     throw new Error("'task' is required for scope_create");
   }
+  const targetEnvironmentId = requestedScopeEnvironment(args, "scope_create");
   const projectRef = typeof args.ref === "string" && args.ref.trim() || fallbackRef;
   if (!projectRef) {
     throw new Error("'ref' is required for scope_create");
@@ -27714,6 +27789,7 @@ function handleScopeCreate(args, fallbackRef) {
     functions: parseCommaList(args.functions),
     migrations: parseCommaList(args.migrations),
     targetProjectRef: projectRef,
+    targetEnvironmentId,
     taskId: String(args.task).trim(),
     web: Boolean(args.web)
   };
@@ -27726,6 +27802,7 @@ function handleScopeCreate(args, fallbackRef) {
     file: relative9(cwd, filePath),
     task_id: scope.taskId,
     target_project_ref: projectRef,
+    target_environment_id: targetEnvironmentId,
     base_commit: targetBaseCommit,
     scope_sha256: scopeSha256,
     scope
@@ -27752,6 +27829,7 @@ function registerReleaseTools(server, http, options = {}) {
     dir: optional(String2(), "[scope_rebind] Directory containing release scope JSON files (defaults to supacloud/fa/release-scopes, release-scopes, or scopes)"),
     task: optional(String2(), "[scope_rebind/scope_create] Task ID or prefix filter for scope files"),
     base_commit: optional(String2(), "[scope_rebind/scope_create] Target 40-character base commit SHA or git ref (defaults to origin/main -> main -> HEAD^ -> HEAD)"),
+    environment_id: optional(String2(), "[scope_inspect/scope_rebind/scope_create] Exact target deployment environment"),
     functions: optional(String2(), "[scope_create] Comma-separated list of functions to deploy"),
     excluded_functions: optional(String2(), "[scope_create] Comma-separated list of functions to exclude"),
     migrations: optional(String2(), "[scope_create] Comma-separated list of migrations to apply"),
@@ -27948,7 +28026,8 @@ function registerReleaseTools(server, http, options = {}) {
 }
 
 // src/shared/tools/deploy-tools.ts
-import { access, lstat as lstat5, mkdtemp as mkdtemp2, opendir, rm as rm3 } from "node:fs/promises";
+import { access, lstat as lstat5, mkdtemp as mkdtemp2, opendir, readFile as readFile6, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
+import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash9 } from "node:crypto";
 import { tmpdir as tmpdir3 } from "node:os";
 import { basename as basename8, dirname as dirname11, join as join17, relative as relative10, resolve as resolve22, sep as sep5 } from "node:path";
@@ -27998,7 +28077,7 @@ function frontendDeployment(candidate) {
 }
 async function readJson(path) {
   try {
-    return await Bun.file(path).json();
+    return JSON.parse(await readFile6(path, "utf8"));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
       return null;
@@ -28153,6 +28232,33 @@ function selectDeployment(deployments, requestedId, projectName) {
   const ids = deployments.map((deployment) => deployment.id).sort().join(", ");
   throw new Error(deployments.length === 0 ? "No frontend deployments exist for this project" : `Multiple frontend deployments found (${ids}). Set frontend.id in supacloud.json or pass --id`);
 }
+function selectFrontendTarget(configRoot, config) {
+  if (config.targets === undefined && config.frontend === undefined)
+    return null;
+  const targets = config.targets ? Object.entries(config.targets).filter(([, target]) => target.type === "frontend") : [["frontend", {
+    type: "frontend",
+    root: config.frontend?.root,
+    id: config.frontend?.id,
+    buildCommand: config.frontend?.buildCommand,
+    outputDirectory: config.frontend?.outputDirectory,
+    buildEnv: config.frontend?.buildEnv
+  }]];
+  if (targets.length === 0)
+    return null;
+  if (config.defaultTarget) {
+    const selected = targets.find(([name]) => name === config.defaultTarget);
+    if (selected)
+      return { name: selected[0], config: selected[1], root: targetRoot(configRoot, selected[1], selected[0]) };
+  }
+  const namedWeb = targets.find(([name]) => name === "web");
+  if (namedWeb)
+    return { name: namedWeb[0], config: namedWeb[1], root: targetRoot(configRoot, namedWeb[1], namedWeb[0]) };
+  if (targets.length === 1) {
+    const selected = targets[0];
+    return { name: selected[0], config: selected[1], root: targetRoot(configRoot, selected[1], selected[0]) };
+  }
+  throw new Error(`Multiple frontend deploy targets found (${targets.map(([name]) => name).sort().join(", ")}). Set defaultTarget to the Web target`);
+}
 function targetRoot(configRoot, target, name) {
   const root = resolve22(configRoot, target.root || (name === "frontend" ? "." : name));
   const prefix = `${resolve22(configRoot)}${sep5}`;
@@ -28217,9 +28323,9 @@ function resolveInsideProject(projectDirectory, candidate, allowRoot = false) {
   return resolved;
 }
 function createBuildEnvironment(names, environmentVariables) {
-  const selectedNames = [...new Set(names || [])].sort();
-  const selectedNameSet = new Set(selectedNames);
   const values = environmentVariables ?? process.env;
+  const selectedNames = [...new Set(names ?? Object.keys(values).filter(isPublicBuildEnv))].sort();
+  const selectedNameSet = new Set(selectedNames);
   const env = Object.fromEntries(Object.entries(process.env).filter(([name]) => !isProtectedBuildEnv(name) && (!isPublicBuildEnv(name) || selectedNameSet.has(name)) && (!SENSITIVE_BUILD_ENV.test(name) || isPublicBuildEnv(name))));
   const missing = selectedNames.filter((name) => !values[name]?.trim());
   for (const name of selectedNames) {
@@ -28235,15 +28341,21 @@ function assertBuildEnvironment(build, skipBuild) {
   }
 }
 async function runBuild(command, cwd, environment, json) {
-  const child = Bun.spawn(["sh", "-c", command], {
-    cwd,
-    env: environment,
-    stdio: ["inherit", json ? 2 : "inherit", "inherit"]
+  await new Promise((resolve, reject) => {
+    const child = spawn2("sh", ["-c", command], {
+      cwd,
+      env: environment,
+      stdio: ["inherit", json ? 2 : "inherit", "inherit"]
+    });
+    child.once("error", reject);
+    child.once("close", (exitCode) => {
+      if (exitCode === 0) {
+        resolve();
+      } else {
+        reject(new Error(`Build command failed (exit ${exitCode ?? "unknown"}): ${command}`));
+      }
+    });
   });
-  const exitCode = await child.exited;
-  if (exitCode !== 0) {
-    throw new Error(`Build command failed (exit ${exitCode ?? "unknown"}): ${command}`);
-  }
 }
 async function collectArchiveFiles(root) {
   const rootStat = await lstat5(root).catch(() => null);
@@ -28276,7 +28388,7 @@ async function collectArchiveFiles(root) {
   const files = new Map;
   const digests = [];
   for (const path of paths) {
-    const data = new Uint8Array(await Bun.file(path).arrayBuffer());
+    const data = new Uint8Array(await readFile6(path));
     bytes += data.byteLength;
     if (bytes > MAX_SOURCE_BYTES)
       throw new Error(`Frontend output exceeds ${MAX_SOURCE_BYTES} bytes`);
@@ -28300,7 +28412,7 @@ async function createFrontendArchive(outputDirectory) {
   const archivePath = join17(temporaryDirectory, `${basename8(outputDirectory)}.tar.zst`);
   try {
     const archiveBytes = await createFrontendTarZstd(collected.files);
-    await Bun.write(archivePath, archiveBytes);
+    await writeFile6(archivePath, archiveBytes);
     const sha256 = createHash9("sha256").update(archiveBytes).digest("hex");
     return {
       archivePath,
@@ -28325,6 +28437,71 @@ function payload(response) {
     throw new Error("Deployment operation returned an invalid response");
   return parsed;
 }
+async function stageApplicationWebRelease(http, projectRef, configRoot, skipBuild, json, environmentVariables) {
+  const target = selectFrontendTarget(configRoot, await readDeployConfig(configRoot));
+  if (!target)
+    return null;
+  const projectDirectory = target.root;
+  const targetState = await lstat5(projectDirectory).catch(() => null);
+  if (!targetState?.isDirectory() || targetState.isSymbolicLink()) {
+    throw new Error(`Deploy target '${target.name}' root is not a regular directory: ${projectDirectory}`);
+  }
+  const requestedId = target.config.id;
+  const listResponse = await http.get(`/v1/projects/${encodeURIComponent(projectRef)}/frontend/deployments`);
+  if (!listResponse.ok)
+    throw new Error(`Failed to list frontend deployments (HTTP ${listResponse.status})`);
+  const selected = selectDeployment(deploymentList(listResponse.data), requestedId, await packageName(projectDirectory));
+  const configuredBuildCommand = String(target.config.buildCommand || selected.buildCommand || "").trim();
+  const buildCommand = configuredBuildCommand || (skipBuild ? "" : await defaultBuildCommand(projectDirectory, configRoot));
+  const configuredOutput = String(target.config.outputDirectory || "").trim();
+  const remoteOutput = selected.outputDirectory && selected.outputDirectory !== "." ? selected.outputDirectory : "";
+  const outputDirectory = resolveInsideProject(projectDirectory, configuredOutput || remoteOutput || defaultOutputDirectory(selected.framework));
+  const build = createBuildEnvironment(target.config.buildEnv, environmentVariables);
+  const report = phaseReporter(json);
+  report("web", `${target.name} (${selected.id})`);
+  assertBuildEnvironment(build, skipBuild);
+  if (!skipBuild) {
+    report("build", buildCommand);
+    await runBuild(buildCommand, projectDirectory, build.env, json);
+  } else {
+    report("build", "skipped");
+  }
+  report("package", relative10(projectDirectory, outputDirectory) || ".");
+  const archive = await createFrontendArchive(outputDirectory);
+  try {
+    const authority = payload(await readFrontendReleaseAuthority(http, projectRef, selected.id));
+    const activeReleaseId = typeof authority.active_release_id === "string" ? authority.active_release_id : null;
+    const activeActivationId = typeof authority.active_activation_id === "string" ? authority.active_activation_id : null;
+    const current = Array.isArray(authority.releases) ? record4(authority.releases[0]) : null;
+    if (archive.sha256 === activeReleaseId && archive.treeSha256 !== current?.tree_sha256) {
+      throw new Error("Active Web release tree does not match the local archive");
+    }
+    if (archive.treeSha256 === current?.tree_sha256) {
+      report("done", "Web already current");
+      return {};
+    }
+    report("upload", `${archive.fileCount} files`);
+    const uploaded = payload(await uploadFrontendRelease(http, projectRef, selected.id, archive.archivePath));
+    const release = record4(uploaded.release);
+    const releaseId = requiredString(release?.release_id, "release.release_id");
+    if (releaseId !== archive.sha256)
+      throw new Error("Uploaded Web release identity does not match the local archive");
+    if (release?.tree_sha256 !== archive.treeSha256)
+      throw new Error("Uploaded Web release tree does not match the local build");
+    report("done", releaseId.slice(0, 12));
+    return {
+      request: {
+        deployment_id: selected.id,
+        release_id: releaseId,
+        expected_active_release_id: activeReleaseId ?? "absent",
+        expected_activation_id: activeActivationId ?? "absent",
+        mutation_id: crypto.randomUUID()
+      }
+    };
+  } finally {
+    await archive.cleanup();
+  }
+}
 function phaseReporter(json) {
   const started = performance.now();
   return (phase, detail) => {
@@ -28373,12 +28550,10 @@ function registerDeployTools(server, http, options = {}) {
       }
       const configurationPath = options.application.configurationPath?.trim();
       const configurationId = options.application.configurationId?.trim();
-      if (!configurationPath && !configurationId) {
-        throw new Error("Application profile requires SUPACLOUD_APPLICATION_CONFIGURATION_PATH or SUPACLOUD_APPLICATION_CONFIGURATION_ID");
-      }
       if (configurationPath && configurationId) {
         throw new Error("Application profile must set only one of SUPACLOUD_APPLICATION_CONFIGURATION_PATH or SUPACLOUD_APPLICATION_CONFIGURATION_ID");
       }
+      const stagedWeb = await stageApplicationWebRelease(http, projectRef, configRoot, args.skip_build === true, args.json === true, options.environmentVariables);
       const result = await options.applicationRelease({
         action: "release",
         ref: projectRef,
@@ -28389,6 +28564,7 @@ function registerDeployTools(server, http, options = {}) {
         ...configurationId ? { configuration_id: configurationId } : {},
         ...options.application.manifestPath ? { manifest_path: options.application.manifestPath } : {},
         ...args.skip_build === true ? { skip_build: true } : {},
+        ...stagedWeb?.request === undefined ? {} : { web: stagedWeb.request },
         ...args.json === true ? { format: "json", json: true } : {}
       });
       return result;
@@ -28625,7 +28801,7 @@ function registerDeployTools(server, http, options = {}) {
 
 // src/shared/tools/remote-dev-tools.ts
 import { existsSync as existsSync14 } from "node:fs";
-import { readFile as readFile6 } from "node:fs/promises";
+import { readFile as readFile7 } from "node:fs/promises";
 import { readdir as readdir7 } from "node:fs/promises";
 import { createHash as createHash10 } from "node:crypto";
 import { join as join18, resolve as resolve23 } from "node:path";
@@ -28703,7 +28879,7 @@ async function readProjectConfig(root) {
   if (!existsSync14(file))
     return {};
   try {
-    const parsed = JSON.parse(await readFile6(file, "utf8"));
+    const parsed = JSON.parse(await readFile7(file, "utf8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch (error) {
     throw new Error(`Invalid supacloud.json: ${error instanceof Error ? error.message : String(error)}`);
@@ -28729,7 +28905,7 @@ async function sourceFingerprint(root) {
   const hash = createHash10("sha256");
   for (const file of files) {
     hash.update(file.slice(root.length).replace(/\\/g, "/"));
-    hash.update(await readFile6(file));
+    hash.update(await readFile7(file));
   }
   return hash.digest("hex");
 }
@@ -28895,7 +29071,7 @@ function registerRemoteDevTools(server, options = {}) {
 
 // src/shared/tools/developer-experience-tools.ts
 import { existsSync as existsSync15 } from "node:fs";
-import { mkdir as mkdir7, readdir as readdir8, readFile as readFile7, writeFile as writeFile6 } from "node:fs/promises";
+import { mkdir as mkdir7, readdir as readdir8, readFile as readFile8, writeFile as writeFile7 } from "node:fs/promises";
 import { dirname as dirname12, join as join19, resolve as resolve24 } from "node:path";
 var initToolSchema = {
   root: optional(String2(), "Project directory to initialize (default: current directory)"),
@@ -28950,7 +29126,7 @@ async function readPackageManifest(root) {
   if (!existsSync15(path))
     return {};
   try {
-    const parsed = JSON.parse(await readFile7(path, "utf8"));
+    const parsed = JSON.parse(await readFile8(path, "utf8"));
     const value = record5(parsed);
     if (!value)
       throw new Error("package.json must contain an object");
@@ -28968,7 +29144,7 @@ async function readPackageManifest(root) {
 }
 async function writeNewFile(path, content) {
   try {
-    await writeFile6(path, content, { encoding: "utf8", flag: "wx", mode: 384 });
+    await writeFile7(path, content, { encoding: "utf8", flag: "wx", mode: 384 });
     return true;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "EEXIST")
@@ -28978,7 +29154,7 @@ async function writeNewFile(path, content) {
 }
 async function ensureGitignore(root) {
   const path = join19(root, ".gitignore");
-  const existing = existsSync15(path) ? await readFile7(path, "utf8") : "";
+  const existing = existsSync15(path) ? await readFile8(path, "utf8") : "";
   const required = [".env.supacloud.*", "!.env.supacloud.*.example"];
   const missing = required.filter((entry) => !existing.split(/\r?\n/).includes(entry));
   if (missing.length === 0)
@@ -28986,7 +29162,7 @@ async function ensureGitignore(root) {
   const prefix = existing.length > 0 && !existing.endsWith(`
 `) ? `${existing}
 ` : existing;
-  await writeFile6(path, `${prefix}${missing.join(`
+  await writeFile7(path, `${prefix}${missing.join(`
 `)}
 `, "utf8");
   return true;
@@ -29009,7 +29185,7 @@ async function initializeProject(request, options) {
   };
   const created = [];
   try {
-    await writeFile6(configPath, `${JSON.stringify(config, null, 2)}
+    await writeFile7(configPath, `${JSON.stringify(config, null, 2)}
 `, {
       encoding: "utf8",
       flag: "wx",
@@ -29205,7 +29381,7 @@ function registerDeveloperExperienceTools(server, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.88.0",
+  version: "0.90.1",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -29258,13 +29434,13 @@ var package_default = {
   },
   dependencies: {
     "@supacloud/compiler": "^0.44.1",
-    "@supacloud/delivery": "0.14.1",
+    "@supacloud/delivery": "0.15.0",
     "@supacloud/db": "0.16.1",
     typebox: "1.3.36"
   },
   overrides: {
     "@supacloud/contracts": "0.8.1",
-    "@supacloud/delivery": "0.14.1",
+    "@supacloud/delivery": "0.15.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   devDependencies: {
@@ -29498,8 +29674,6 @@ EXAMPLES
   ${preferredCommand} release postgrest_restart --ref abc123
   ${preferredCommand} release release_canary_fixture_stage_replay --ref abc123 --subject <uuid> --request_id <uuid>
   ${preferredCommand} release release_canary_fixture_disable_replay --ref abc123 --fixture_id <uuid> --disable_request_id <uuid> --issuer <issuer-url> --subject <uuid>
-  ${preferredCommand} release scope_rebind --file supacloud/fa/release-scopes/20260907-intake-p1-production.json
-  ${preferredCommand} release scope_inspect --file supacloud/fa/release-scopes/20260907-intake-p1-production.json
   ${preferredCommand} queue stats --queue emails
   ${preferredCommand} queue dlq --queue emails --limit 20
   ${preferredCommand} frontend list --ref abc123

package/dist/shared/schema.d.ts

@@ -8,6 +8,6 @@ export declare function stringEnum<const Values extends readonly [string, ...str
 export declare function withDescription<T extends TSchema>(schema: T, description: string): T;
 export declare function optional<T extends TSchema>(schema: T, description?: string): "~optional" extends keyof T ? T : Type.TOptional<T>;
 export declare function decodedSchema<TInput extends TSchema, TOutput extends TSchema>(inputSchema: TInput, outputSchema: TOutput, decode: (input: StaticDecode<TInput>) => unknown, options?: TSchemaOptions): Type.TCodec<TInput, import("typebox").StaticType<[], "Decode", {}, {}, TOutput>>;
-export declare function schemaEnumValues(schema: TSchema): string[];
+export declare function schemaEnumValues(schema: TSchema | undefined): string[];
 export declare function schemaDescription(schema: TSchema): string;
 export declare function schemaProperties(schema: TSchema | ToolSchema): ToolSchema;

package/dist/shared/tools/app-tools.d.ts

@@ -1,3 +1,4 @@
+import type { ApplicationDeployRequest } from "@supacloud/delivery";
 import { type ToolServer } from "../tool-server";
 import { type AppManifest } from "./app-tool-export";
 declare const REMOTE_APP_ACTIONS: {
@@ -53,6 +54,7 @@ export interface AppToolArguments {
     source_environment_id?: string;
     mutation_id?: string;
     approved_migration_digest?: string;
+    web?: ApplicationDeployRequest["web"];
     branch_ref?: string;
     branch_name?: string;
     data_mode?: "schema_only" | "full_clone";

package/dist/shared/tools/application-schemas.d.ts

@@ -152,7 +152,8 @@ export declare const ApplicationPromotionPlanSchema: import("typebox").TObject<{
     execution_performed: import("typebox").TLiteral<false>;
     data_recovery: import("typebox").TLiteral<"separate-required">;
 }>;
-export declare const ApplicationReleaseRequestSchema: import("typebox").TObject<{
+export declare const ApplicationDeployRequestSchema: import("typebox").TObject<{
+    mutation_id: import("typebox").TString;
     release_id: import("typebox").TString;
     configuration_id: import("typebox").TOptional<import("typebox").TString>;
     configuration_write: import("typebox").TOptional<import("typebox").TObject<{
@@ -168,15 +169,22 @@ export declare const ApplicationReleaseRequestSchema: import("typebox").TObject<
             }>>;
         }>;
     }>>;
-    activation_id: import("typebox").TOptional<import("typebox").TString>;
-    expected_activation_id: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>>;
     expected_plan_sha256: import("typebox").TOptional<import("typebox").TString>;
+    approved_migration_digest: import("typebox").TOptional<import("typebox").TString>;
+    web: import("typebox").TOptional<import("typebox").TObject<{
+        deployment_id: import("typebox").TString;
+        release_id: import("typebox").TString;
+        expected_active_release_id: import("typebox").TString;
+        expected_activation_id: import("typebox").TString;
+        mutation_id: import("typebox").TString;
+    }>>;
 }>;
-export declare const ApplicationReleaseResultSchema: import("typebox").TObject<{
-    schema: import("typebox").TLiteral<"supacloud.application-release.v1">;
+export declare const ApplicationDeployResultSchema: import("typebox").TObject<{
+    schema: import("typebox").TLiteral<"supacloud.application-deploy.v1">;
     project_ref: import("typebox").TString;
     application_id: import("typebox").TString;
     environment_id: import("typebox").TString;
+    mutation_id: import("typebox").TString;
     release_id: import("typebox").TString;
     configuration_id: import("typebox").TString;
     activation_id: import("typebox").TString;
@@ -185,4 +193,33 @@ export declare const ApplicationReleaseResultSchema: import("typebox").TObject<{
     action: import("typebox").TUnion<[import("typebox").TLiteral<"activate">, import("typebox").TLiteral<"no-op">]>;
     replayed: import("typebox").TBoolean;
     execution_performed: import("typebox").TBoolean;
+    backend_receipt: import("typebox").TObject<{
+        schema: import("typebox").TLiteral<"supacloud.application-backend-receipt.v1">;
+        project_ref: import("typebox").TString;
+        application_id: import("typebox").TString;
+        environment_id: import("typebox").TString;
+        release_id: import("typebox").TString;
+        manifest_sha256: import("typebox").TString;
+        mutation_id: import("typebox").TString;
+        plan_sha256: import("typebox").TString;
+        backup_id: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
+        before_ledger_digest: import("typebox").TString;
+        after_ledger_digest: import("typebox").TString;
+        applied_versions: import("typebox").TArray<import("typebox").TString>;
+        schema_reloaded: import("typebox").TBoolean;
+        postgrest_healthy: import("typebox").TBoolean;
+    }>;
+    web: import("typebox").TOptional<import("typebox").TObject<{
+        deployment_id: import("typebox").TString;
+        release_id: import("typebox").TString;
+        activation_id: import("typebox").TString;
+        replayed: import("typebox").TBoolean;
+    }>>;
+}>;
+export declare const ApplicationDeployWebRequestSchema: import("typebox").TObject<{
+    deployment_id: import("typebox").TString;
+    release_id: import("typebox").TString;
+    expected_active_release_id: import("typebox").TString;
+    expected_activation_id: import("typebox").TString;
+    mutation_id: import("typebox").TString;
 }>;

package/dist/shared/tools/application-tools.d.ts

@@ -9,7 +9,7 @@ export declare const APPLICATION_TOOL_SCHEMA: {
     ttl_seconds: Type.TOptional<Type.TInteger>;
     wait: Type.TOptional<Type.TBoolean>;
     timeout_seconds: Type.TOptional<Type.TInteger>;
-    action: Type.TEnum<("list_releases" | "get_release" | "upload_release" | "activate_release" | "logs" | "get_runtime" | "get_deployment_evidence" | "get_configuration" | "get_release_transfer_plan" | "get_promotion_plan" | "get_promotion_status" | "get_rollback_snapshot" | "get_history" | "get_deploy_plan" | "get_preview_plan" | "list_previews" | "get_preview" | "put_configuration" | "release_application" | "transfer_release" | "promote_application" | "reconcile_promotion" | "create_preview" | "reconcile_preview" | "cleanup_preview" | "deploy_release" | "rollback_release" | "reconcile_activation" | "retire_activation")[]>;
+    action: Type.TEnum<("list_releases" | "get_release" | "upload_release" | "activate_release" | "logs" | "get_runtime" | "get_deployment_evidence" | "get_configuration" | "get_release_transfer_plan" | "get_promotion_plan" | "get_promotion_status" | "get_rollback_snapshot" | "get_history" | "get_deploy_plan" | "get_preview_plan" | "list_previews" | "get_preview" | "put_configuration" | "deploy_application" | "transfer_release" | "promote_application" | "reconcile_promotion" | "create_preview" | "reconcile_preview" | "cleanup_preview" | "deploy_release" | "rollback_release" | "reconcile_activation" | "retire_activation")[]>;
     ref: Type.TString;
     id: Type.TString;
     environment_id: Type.TOptional<Type.TString>;
@@ -19,6 +19,13 @@ export declare const APPLICATION_TOOL_SCHEMA: {
     configuration_path: Type.TOptional<Type.TString>;
     configuration_write: Type.TOptional<Type.TUnknown>;
     manifest_path: Type.TOptional<Type.TString>;
+    web: Type.TOptional<Type.TObject<{
+        deployment_id: Type.TString;
+        release_id: Type.TString;
+        expected_active_release_id: Type.TString;
+        expected_activation_id: Type.TString;
+        mutation_id: Type.TString;
+    }>>;
     release_id: Type.TOptional<Type.TString>;
     source_ref: Type.TOptional<Type.TString>;
     source_release_id: Type.TOptional<Type.TString>;

package/dist/tool-runtime.js

@@ -97,6 +97,8 @@ function decodedSchema(inputSchema, outputSchema, decode, options) {
   return result;
 }
 function schemaEnumValues(schema) {
+  if (!schema)
+    return [];
   const view = schema;
   if (Array.isArray(view.enum)) {
     return view.enum.filter((value) => typeof value === "string" || typeof value === "number").map((value) => String(value));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.88.0",
+  "version": "0.90.1",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -53,13 +53,13 @@
   },
   "dependencies": {
     "@supacloud/compiler": "^0.44.1",
-    "@supacloud/delivery": "0.14.1",
+    "@supacloud/delivery": "0.15.0",
     "@supacloud/db": "0.16.1",
     "typebox": "1.3.36"
   },
   "overrides": {
     "@supacloud/contracts": "0.8.1",
-    "@supacloud/delivery": "0.14.1",
+    "@supacloud/delivery": "0.15.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   "devDependencies": {

package/skills/supacloud/references/command-map.md

@@ -23,9 +23,9 @@ Load this reference when selecting a command surface or when a user asks an AI t
 | Inspect or back up a remote database | `supabase db_pull`, `migration_list`, `db_dump`, `gen_types` | Requires explicit PostgreSQL DSN; redact it |
 | Replay the release-canary fixture stage receipt | `release release_canary_fixture_stage_replay` | Dual-bind Management project context and that project's service-role application origin; accepts only the exact subject/request UUID pair and a strict idempotent receipt |
 | Disable a staged release-canary fixture | `release release_canary_fixture_disable_replay` | Uses the fixed disable RPC once, accepts idempotent false/true receipts, then queries the existing pending RPC with issuer/subject and requires authoritative JSON `false`; fixture binding comes from the strict disable receipt |
-| Rebind release scope manifest to upstream base commit | `release scope_rebind` | Local action; updates baseCommit in scope JSON files canonically to target git commit, supports `--dry_run`, `--task`, and recalculates `scope_sha256` |
-| Inspect release scope manifest and git alignment | `release scope_inspect` | Local action; validates scope structure, returns canonical hash, and checks alignment with HEAD / origin/main |
-| Scaffold a new canonical release scope manifest | `release scope_create` | Local action; outputs canonical JSON scope with sorted functions, migrations, and baseCommit |
+| Rebind release scope manifest to upstream base commit | `release scope_rebind` | Local maintenance action; requires the exact `--environment_id`, updates only scopes bound to that environment, supports `--dry_run`/`--task`, and recalculates `scope_sha256` |
+| Inspect release scope manifest and git alignment | `release scope_inspect` | Local maintenance action; requires the exact `--environment_id`, rejects legacy or cross-environment scopes, returns canonical hash, and checks alignment with HEAD / origin/main |
+| Scaffold a new canonical release scope manifest | `release scope_create` | Local maintenance action; requires `--environment_id` and outputs a current-main-bound scope with sorted functions, migrations, and environment identity |
 | Preview/apply migrations remotely | `supabase push` | Always dry-run first; production needs explicit approval |
 | Mark proven-equivalent historical migrations as applied | `database baseline_migrations` | Dry-run, schema-equivalence proof, backup, explicit approval |
 | Inspect auth users or generate a controlled login link | `auth list_users`, `auth get_user`, `auth generate_link` | User reads are bounded; generation supports only `magiclink`, `recovery`, and `invite`, requires production confirmation, and returns only a validated action URL |
@@ -51,7 +51,7 @@ until a project-scoped context is resolved.
 - `secrets`: project secret management; never print values after write.
 - `queue`, `task_events`, `diagnostics`: asynchronous workload operations and bounded diagnostics.
 - `gateway`: project route/config/rebuild operations.
-- `release`: local release scope rebinding/inspection (`scope_rebind`, `scope_inspect`, `scope_create`), verified backup/PostgREST lifecycle controls, plus production-confirmed, non-retried, strict release-canary fixture stage and disable replay actions.
+- `release`: local release scope maintenance (`scope_rebind`, `scope_inspect`, `scope_create`), verified backup/PostgREST lifecycle controls, plus production-confirmed, non-retried, strict release-canary fixture stage and disable replay actions. Scope maintenance is not a prerequisite for the normal `supacloud --env <name> deploy` flow.
 - `ai`: inspect or install this packaged Skill.
 
 ## Safe inspection pattern