@supacloud/cli 0.92.0 → 0.94.0

package/dist/shared/deployment-upgrade.d.ts

@@ -0,0 +1,2 @@
+export declare const DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment is no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, bind application.id and application.environmentId in supacloud.json (or SUPACLOUD_APPLICATION_ID and SUPACLOUD_ENV), then run `supacloud deploy`. SupaCloud owns deployment planning and activation; do not retry with legacy commands.";
+export declare function assertCurrentDeploymentInput(tool: string, input: unknown): void;

package/dist/shared/tools/app-tools.d.ts

@@ -55,7 +55,7 @@ export interface AppToolArguments {
     source_environment_id?: string;
     mutation_id?: string;
     approved_migration_digest?: string;
-    web?: ApplicationDeployRequest["web"];
+    web_release?: ApplicationDeployRequest["web_release"];
     branch_ref?: string;
     branch_name?: string;
     data_mode?: "schema_only" | "full_clone";

package/dist/shared/tools/application-schemas.d.ts

@@ -171,12 +171,9 @@ export declare const ApplicationDeployRequestSchema: import("typebox").TObject<{
     }>>;
     expected_plan_sha256: import("typebox").TOptional<import("typebox").TString>;
     approved_migration_digest: import("typebox").TOptional<import("typebox").TString>;
-    web: import("typebox").TOptional<import("typebox").TObject<{
+    web_release: import("typebox").TOptional<import("typebox").TObject<{
         deployment_id: import("typebox").TString;
         release_id: import("typebox").TString;
-        expected_active_release_id: import("typebox").TString;
-        expected_activation_id: import("typebox").TString;
-        mutation_id: import("typebox").TString;
     }>>;
 }>;
 export declare const ApplicationDeployResultSchema: import("typebox").TObject<{
@@ -216,10 +213,7 @@ export declare const ApplicationDeployResultSchema: import("typebox").TObject<{
         replayed: import("typebox").TBoolean;
     }>>;
 }>;
-export declare const ApplicationDeployWebRequestSchema: import("typebox").TObject<{
+export declare const ApplicationDeployWebReleaseSchema: import("typebox").TObject<{
     deployment_id: import("typebox").TString;
     release_id: import("typebox").TString;
-    expected_active_release_id: import("typebox").TString;
-    expected_activation_id: import("typebox").TString;
-    mutation_id: import("typebox").TString;
 }>;

package/dist/shared/tools/application-tools.d.ts

@@ -9,7 +9,7 @@ export declare const APPLICATION_TOOL_SCHEMA: {
     ttl_seconds: Type.TOptional<Type.TInteger>;
     wait: Type.TOptional<Type.TBoolean>;
     timeout_seconds: Type.TOptional<Type.TInteger>;
-    action: Type.TEnum<("list_releases" | "get_release" | "upload_release" | "activate_release" | "logs" | "get_runtime" | "get_deployment_evidence" | "get_configuration" | "get_release_transfer_plan" | "get_promotion_plan" | "get_promotion_status" | "get_rollback_snapshot" | "get_history" | "get_deploy_plan" | "get_preview_plan" | "list_previews" | "get_preview" | "put_configuration" | "deploy_application" | "transfer_release" | "promote_application" | "reconcile_promotion" | "create_preview" | "reconcile_preview" | "cleanup_preview" | "deploy_release" | "rollback_release" | "reconcile_activation" | "retire_activation")[]>;
+    action: Type.TEnum<("upload_release" | "activate_release" | "list_releases" | "get_release" | "logs" | "get_runtime" | "get_deployment_evidence" | "get_configuration" | "get_release_transfer_plan" | "get_promotion_plan" | "get_promotion_status" | "get_rollback_snapshot" | "get_history" | "get_deploy_plan" | "get_preview_plan" | "list_previews" | "get_preview" | "put_configuration" | "deploy_application" | "transfer_release" | "promote_application" | "reconcile_promotion" | "create_preview" | "reconcile_preview" | "cleanup_preview" | "deploy_release" | "rollback_release" | "reconcile_activation" | "retire_activation")[]>;
     ref: Type.TString;
     id: Type.TString;
     environment_id: Type.TOptional<Type.TString>;
@@ -19,12 +19,9 @@ export declare const APPLICATION_TOOL_SCHEMA: {
     configuration_path: Type.TOptional<Type.TString>;
     configuration_write: Type.TOptional<Type.TUnknown>;
     manifest_path: Type.TOptional<Type.TString>;
-    web: Type.TOptional<Type.TObject<{
+    web_release: Type.TOptional<Type.TObject<{
         deployment_id: Type.TString;
         release_id: Type.TString;
-        expected_active_release_id: Type.TString;
-        expected_activation_id: Type.TString;
-        mutation_id: Type.TString;
     }>>;
     release_id: Type.TOptional<Type.TString>;
     source_ref: Type.TOptional<Type.TString>;

package/dist/shared/tools/deploy-tools.d.ts

@@ -14,7 +14,6 @@ interface DeployToolOptions {
         manifestPath?: string;
     };
     applicationRelease?: (args: Record<string, unknown>) => Promise<ToolResponse>;
-    edgeFunctionDeploy?: (args: Record<string, unknown>) => Promise<ToolResponse>;
 }
 interface ToolResponse {
     content: Array<{
@@ -25,15 +24,8 @@ interface ToolResponse {
 }
 export declare const deployToolSchema: {
     ref: Type.TOptional<Type.TString>;
-    target: Type.TOptional<Type.TString>;
-    id: Type.TOptional<Type.TString>;
     cwd: Type.TOptional<Type.TString>;
-    build_command: Type.TOptional<Type.TString>;
-    output_dir: Type.TOptional<Type.TString>;
     skip_build: Type.TOptional<Type.TBoolean>;
-    dry_run: Type.TOptional<Type.TBoolean>;
-    plan: Type.TOptional<Type.TBoolean>;
-    diff: Type.TOptional<Type.TBoolean>;
     json: Type.TOptional<Type.TBoolean>;
 };
 export declare function findDeployConfigRoot(startDirectory: string, environmentName?: string): Promise<string>;

package/dist/shared/tools/developer-experience-tools.d.ts

@@ -15,7 +15,7 @@ export declare const environmentToolSchema: ToolSchema;
 declare function outputDirectoryFor(manifest: PackageManifest): string;
 declare function profileNameFromFile(name: string): string | null;
 declare function statusMissing(context: ResolvedContext): string[];
-declare function deployMissing(context: ResolvedContext): string[];
+declare function deployMissing(context: ResolvedContext, application?: Record<string, unknown> | null): string[];
 export declare function registerDeveloperExperienceTools(server: ToolServer, options?: DeveloperExperienceOptions): void;
 export declare const __internal: {
     outputDirectoryFor: typeof outputDirectoryFor;

package/dist/shared/tools/frontend-release-control.d.ts

@@ -42,6 +42,7 @@ export interface FrontendReleaseRecord {
 export declare function listFrontendReleases(http: FrontendReleaseHttp, projectRef: string, deploymentId: string, cursor?: string, limit?: number): Promise<ToolResponse>;
 export declare function getFrontendRelease(http: FrontendReleaseHttp, projectRef: string, deploymentId: string, releaseId: string): Promise<ToolResponse>;
 export declare function uploadFrontendRelease(http: FrontendReleaseHttp, projectRef: string, deploymentId: string, archivePath: string): Promise<ToolResponse>;
+export declare function uploadProjectWebRelease(http: FrontendReleaseHttp, projectRef: string, environmentId: string, deploymentId: string, archivePath: string): Promise<ToolResponse>;
 export declare function uploadFrontendSource(http: FrontendReleaseHttp, projectRef: string, deploymentId: string, archivePath: string): Promise<ToolResponse>;
 export declare function getActiveFrontendRelease(http: FrontendReleaseHttp, projectRef: string, deploymentId: string): Promise<ToolResponse>;
 export declare function readFrontendReleaseAuthority(http: FrontendReleaseHttp, projectRef: string, deploymentId: string): Promise<ToolResponse>;

package/dist/shared/tools/project-deployment.d.ts

@@ -1,3 +1,4 @@
 import type { ToolResult } from "../tool-server";
 import type { HttpTransport } from "../transports/http";
+export declare function requireProjectDeploymentProtocol(http: Pick<HttpTransport, "get">, projectRef: string, environmentId: string): Promise<void>;
 export declare function runProjectDeployment(http: Pick<HttpTransport, "post" | "get">, args: Record<string, unknown>): Promise<ToolResult>;

package/dist/shared/tools/remote-dev-tools.d.ts

@@ -20,7 +20,7 @@ export interface RemoteDevToolOptions {
 }
 export declare const remoteDevToolSchema: {
     action: Type.TEnum<("status" | "migrate" | "watch" | "sync")[]>;
-    target: Type.TOptional<Type.TEnum<("project" | "frontend" | "db" | "functions")[]>>;
+    target: Type.TOptional<Type.TEnum<("frontend" | "project" | "db" | "functions")[]>>;
     project_dir: Type.TOptional<Type.TString>;
     remote_root: Type.TOptional<Type.TString>;
     remote_host: Type.TOptional<Type.TString>;

package/dist/tool-runtime.js

@@ -129,12 +129,37 @@ function schemaProperties(schema) {
 // src/shared/tool-server.ts
 import { Type as Type2 } from "typebox";
 import { Value as Value2 } from "typebox/value";
+
+// src/shared/deployment-upgrade.ts
+var DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment is no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, bind application.id and application.environmentId in supacloud.json (or SUPACLOUD_APPLICATION_ID and SUPACLOUD_ENV), then run `supacloud deploy`. SupaCloud owns deployment planning and activation; do not retry with legacy commands.";
+var removedFrontendActions = new Set([
+  "deploy_git",
+  "deploy_upload",
+  "redeploy",
+  "upload_release",
+  "activate_release"
+]);
+var removedDeployFlags = ["target", "id", "build_command", "output_dir", "plan", "diff", "dry_run"];
+function assertCurrentDeploymentInput(tool, input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    return;
+  const args = input;
+  if (tool === "frontend" && typeof args["action"] === "string" && removedFrontendActions.has(args["action"])) {
+    throw new Error(DEPLOYMENT_UPGRADE);
+  }
+  if (tool === "deploy" && removedDeployFlags.some((flag) => Object.hasOwn(args, flag))) {
+    throw new Error(`${DEPLOYMENT_UPGRADE} Put build settings in the frontend configuration. For read-only review use \`supacloud app deploy-plan\`.`);
+  }
+}
+
+// src/shared/tool-server.ts
 var resultSchema = Type2.Object({
   content: Type2.Array(Type2.Object({ type: Type2.Literal("text"), text: Type2.String() })),
   isError: Type2.Optional(Type2.Boolean())
 });
 function registerTool(server, name, description, schema, callback) {
   server.tool(name, description, schema, async (input) => {
+    assertCurrentDeploymentInput(name, input);
     const args = parseToolArguments(schema, input);
     const result = await callback(args);
     if (!Value2.Check(resultSchema, result))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.92.0",
+  "version": "0.94.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -53,13 +53,13 @@
   },
   "dependencies": {
     "@supacloud/compiler": "^0.44.1",
-    "@supacloud/delivery": "0.15.1",
-    "@supacloud/db": "0.16.1",
+    "@supacloud/delivery": "0.16.0",
+    "@supacloud/db": "0.16.2",
     "typebox": "1.3.36"
   },
   "overrides": {
     "@supacloud/contracts": "0.8.1",
-    "@supacloud/delivery": "0.15.1",
+    "@supacloud/delivery": "0.16.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   "devDependencies": {

package/skills/supacloud/SKILL.md

@@ -29,6 +29,15 @@ Use `supacloud` as the project-level control surface and keep durable changes re
 
 ## Workflow
 
+For normal application deployment, run `supacloud --env <name> deploy`.
+Use the current application delivery configuration and a bound application ID.
+Do not assemble a client-side sequence of scope generation, backup, migration
+apply, PostgREST refresh, Function deployment and Web activation.
+The server owns that sequence. Old `deploy --target` and `frontend` publishing
+actions are removed: upgrade CLI and server together, migrate the configuration,
+and retry the unified command. Do not substitute a legacy endpoint when it fails.
+The inspection and database-maintenance workflow below is not a deployment checklist.
+
 1. Classify the request using [references/command-map.md](references/command-map.md).
 2. For database work, load [references/database-workflow.md](references/database-workflow.md) and choose either new-change or historical-drift reconciliation.
 3. For AI-assisted database changes, first request bounded context:

package/skills/supacloud/references/command-map.md

@@ -6,6 +6,7 @@ Load this reference when selecting a command surface or when a user asks an AI t
 
 | Intent | Use | Guardrail |
 | --- | --- | --- |
+| Deploy the bound application | `supacloud --env <name> deploy` | Use current CLI/server and application delivery configuration; never fall back to standalone target or direct frontend activation commands |
 | Inspect current project binding | `supacloud status` | Read-only; run first |
 | Inspect selected project API/Auth/Studio origins | `supacloud project endpoints` | Uses the Management API's authoritative projection; do not reconstruct domains locally |
 | Enumerate projects or endpoint projections | `supacloud-admin project list` / `project list_endpoints` | Platform-wide read; never promote a project credential to Admin authority |
@@ -23,9 +24,6 @@ Load this reference when selecting a command surface or when a user asks an AI t
 | Inspect or back up a remote database | `supabase db_pull`, `migration_list`, `db_dump`, `gen_types` | Requires explicit PostgreSQL DSN; redact it |
 | Replay the release-canary fixture stage receipt | `release release_canary_fixture_stage_replay` | Dual-bind Management project context and that project's service-role application origin; accepts only the exact subject/request UUID pair and a strict idempotent receipt |
 | Disable a staged release-canary fixture | `release release_canary_fixture_disable_replay` | Uses the fixed disable RPC once, accepts idempotent false/true receipts, then queries the existing pending RPC with issuer/subject and requires authoritative JSON `false`; fixture binding comes from the strict disable receipt |
-| Rebind release scope manifest to upstream base commit | `release scope_rebind` | Local maintenance action; requires the exact `--environment_id`, updates only scopes bound to that environment, supports `--dry_run`/`--task`, and recalculates `scope_sha256` |
-| Inspect release scope manifest and git alignment | `release scope_inspect` | Local maintenance action; requires the exact `--environment_id`, rejects legacy or cross-environment scopes, returns canonical hash, and checks alignment with HEAD / origin/main |
-| Scaffold a new canonical release scope manifest | `release scope_create` | Local maintenance action; requires `--environment_id` and outputs a current-main-bound scope with sorted functions, migrations, and environment identity |
 | Preview/apply migrations remotely | `supabase push` | Always dry-run first; production needs explicit approval |
 | Mark proven-equivalent historical migrations as applied | `database baseline_migrations` | Dry-run, schema-equivalence proof, backup, explicit approval |
 | Inspect auth users or generate a controlled login link | `auth list_users`, `auth get_user`, `auth generate_link` | User reads are bounded; generation supports only `magiclink`, `recovery`, and `invite`, requires production confirmation, and returns only a validated action URL |
@@ -47,11 +45,11 @@ until a project-scoped context is resolved.
 - `auth`: provider/configuration plus bounded user lookup and production-confirmed `magiclink`, `recovery`, or `invite` generation. Search/email/redirect inputs and returned action URLs are bounded and validated before use.
 - `storage`: buckets and object-management workflows.
 - `edge_functions`: list, atomically read one active or deleted identity with `get_config`, read immutable source, deploy, activate, configure, and delete Edge Functions. For every mutation, pass the `activation_id` read from the same `list` or `get_config` snapshot as `--expected-activation-id`; use `legacy` only for a never-created or listed legacy Function, not for a deleted slug with a tombstone UUID. Deploy and activate actions also require the non-negative observed version as `--expected-active-version`; use `absent` for a never-created slug or a `get_config` tombstone. Version `0` is a legacy version token and cannot be used as a source or activation target.
-- `frontend`: list, build/deploy, domain, and deployment workflows.
+- `frontend`: hosting management, release inspection and operator rollback. Publishing uses `supacloud deploy`; `deploy_git`, `deploy_upload`, `redeploy`, `upload_release` and `activate_release` are removed.
 - `secrets`: project secret management; never print values after write.
 - `queue`, `task_events`, `diagnostics`: asynchronous workload operations and bounded diagnostics.
 - `gateway`: project route/config/rebuild operations.
-- `release`: local release scope maintenance (`scope_rebind`, `scope_inspect`, `scope_create`), verified backup/PostgREST lifecycle controls, plus production-confirmed, non-retried, strict release-canary fixture stage and disable replay actions. Scope maintenance is not a prerequisite for the normal `supacloud --env <name> deploy` flow.
+- `release`: explicit backup/PostgREST maintenance and release-canary replay diagnostics. Do not run these or generate release scopes as prerequisites for `supacloud --env <name> deploy`; the platform owns deployment orchestration.
 - `ai`: inspect or install this packaged Skill.
 
 ## Safe inspection pattern