@supacloud/cli 0.93.0 → 0.94.0

package/README.md

@@ -13,7 +13,7 @@ are not supported.
 
 ## Project Setup and Environment Profiles
 
-For an existing frontend, the shortest path is:
+For an existing SupaCloud application with a frontend, the shortest path is:
 
 ```sh
 supacloud init
@@ -26,6 +26,11 @@ supacloud --env test deploy
 overwriting an existing project configuration. `env list` and `env check` are
 local-only, redact credentials, and provide stable JSON with `--json` for CI or
 AI tooling. The real `.env.supacloud.*` files are added to `.gitignore`.
+Fill in `SUPACLOUD_APPLICATION_ID` and the Management credentials in the
+selected profile, and configure the application's current delivery build.
+Standalone frontend deployment is no longer supported. Upgrade the CLI with
+`npm install -g @supacloud/cli@latest` and upgrade the SupaCloud server together.
+`deploy` checks the server protocol before building or uploading.
 
 ## Application Starter
 
@@ -356,6 +361,7 @@ target configuration:
 
 ```json
 {
+  "application": { "id": "orders", "environmentId": "test" },
   "targets": {
     "web": {
       "type": "frontend",
@@ -383,36 +389,24 @@ loopback development origins, with the default `:80` likewise omitted. Use
 
 ### Immutable frontend releases
 
-The `frontend` command keeps the existing deployment, Git, and tar.zst
-actions and also exposes the immutable prebuilt release workflow:
+The `frontend` command retains release inspection and explicit operator rollback.
+Publish through `supacloud deploy`, which delegates activation to the platform:
 
 ```bash
 supacloud frontend list_releases --ref abc123 --id web
 supacloud frontend get_active_release --ref abc123 --id web
 supacloud frontend get_release --ref abc123 --id web --release_id <sha256>
-supacloud frontend upload_release --ref abc123 --id web --archive_path ./dist.tar.zst
-supacloud frontend activate_release --ref abc123 --id web \
-  --release_id <sha256> \
-  --expected_active_release_id absent \
-  --expected_activation_id absent \
-  --mutation_id <retry-stable-uuid-v4>
 supacloud frontend rollback --ref abc123 --id web --release_id <retained-sha256>
 supacloud frontend rollback --ref abc123 --id web
 ```
 
-`upload_release` hashes and streams an existing regular tar.zst file without
-buffering the full archive. The Management API binds the upload to that SHA-256,
-and the CLI reads the immutable release back before reporting success.
-`activate_release` uses both the observed active release and activation IDs as
-optimistic concurrency tokens, then verifies the authoritative active release.
-Use the values returned by `get_active_release`; `absent` is valid only when no
-release has been activated. Production uploads, activations and rollback require the
-normal exact `--confirm-production <ref>` value, and
-`SUPACLOUD_READ_ONLY=true` blocks all mutations.
-
-`get_active_release` automatically handles older servers returning HTTP 404
-with a one-record history page and exact active artifact readback. It never
-falls back for authentication, integrity or server failures.
+`deploy_git`, `deploy_upload`, `redeploy`, `upload_release` and `activate_release`
+have been removed from `frontend`. Old invocations fail with an upgrade message,
+without reading an archive or sending a request. Production rollback retains
+the exact `--confirm-production <ref>` gate; read-only mode blocks mutations.
+
+`get_active_release` requires the current server endpoint. An HTTP 404 returns
+an upgrade/deployment-existence hint and never falls back to historical inventory.
 `rollback` without `--release_id` asks SupaCloud for a journal-verified previous
 immutable release, reads the current CAS identity and generates the mutation ID
 itself. An explicit `--release_id` remains available for a deliberate rollback
@@ -635,26 +629,23 @@ reporting success. Management endpoint projection is checked before and after.
 
 ### Internal release scope controls
 
-Scope files and manual release-controller operations are internal compatibility
-surfaces. The project-scoped FA deployment command is a proposed future
-contract and is not implemented yet. For current deployments, use the
-target-level one-command flow documented in
+Do not generate, rebind or hash scope files as part of a deployment.
+Use an application binding and the unified flow documented in
 [`docs/cli-guide.md`](../../docs/cli-guide.md), for example:
 
 ```bash
 supacloud deploy
-supacloud deploy --target web
-supacloud deploy --target api
 ```
 
 FA deployment policy and the boundary between platform-owned operations and
 FA-owned business features are documented in
 [`docs/fa-deployment-capability-boundary.md`](../../docs/fa-deployment-capability-boundary.md).
 
-Scope creation, rebinding, inspection and hash calculation are intentionally
-undocumented here. They remain available only for internal compatibility,
-audit and historical receipt migration. The future project-scoped flow will
-not require a scope file once its implementation lands.
+`deploy --target`, `--id`, `--build_command`, `--output_dir`, `--plan`, `--diff`
+and `--dry_run` are removed. Put build settings in `supacloud.json`; use
+`app deploy-plan` for read-only review. Historical project-specific manifests
+and standalone Function targets must move to application delivery configuration.
+The CLI rejects them rather than falling back to a partial Web deployment.
 
 The legacy `.env` fallback is unclassified and therefore does not enable the
 production confirmation gate. Production automation must select a `prod` or

package/dist/index.js

@@ -8766,6 +8766,28 @@ function outcomeUnknownGuidance(text) {
 保持原 --env/--env-file 选择，先查询：${command}` : "");
 }
 
+// src/shared/deployment-upgrade.ts
+var DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment is no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, bind application.id and application.environmentId in supacloud.json (or SUPACLOUD_APPLICATION_ID and SUPACLOUD_ENV), then run `supacloud deploy`. SupaCloud owns deployment planning and activation; do not retry with legacy commands.";
+var removedFrontendActions = new Set([
+  "deploy_git",
+  "deploy_upload",
+  "redeploy",
+  "upload_release",
+  "activate_release"
+]);
+var removedDeployFlags = ["target", "id", "build_command", "output_dir", "plan", "diff", "dry_run"];
+function assertCurrentDeploymentInput(tool, input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    return;
+  const args = input;
+  if (tool === "frontend" && typeof args["action"] === "string" && removedFrontendActions.has(args["action"])) {
+    throw new Error(DEPLOYMENT_UPGRADE);
+  }
+  if (tool === "deploy" && removedDeployFlags.some((flag) => Object.hasOwn(args, flag))) {
+    throw new Error(`${DEPLOYMENT_UPGRADE} Put build settings in the frontend configuration. For read-only review use \`supacloud app deploy-plan\`.`);
+  }
+}
+
 // src/shared/cli.ts
 function cliToolResultIsError(toolResult) {
   if (toolResult.isError === true)
@@ -8889,6 +8911,7 @@ async function runCli(cliTools, args, options = {}) {
     const parsedArgs = parseCliFlags(args, startIdx, tool.schema);
     if (startIdx === 2)
       parsedArgs.action = args[1];
+    assertCurrentDeploymentInput(args[0], parsedArgs);
     validateToolArguments(tool.schema, parsedArgs);
     const result = await tool.callback(parsedArgs);
     if (result && result.content && Array.isArray(result.content)) {
@@ -11188,6 +11211,7 @@ var resultSchema = _Object_({
 });
 function registerTool(server, name, description, schema, callback) {
   server.tool(name, description, schema, async (input) => {
+    assertCurrentDeploymentInput(name, input);
     const args = parseToolArguments(schema, input);
     const result = await callback(args);
     if (!Check2(resultSchema, result))
@@ -16319,39 +16343,6 @@ async function getFrontendRelease(http, projectRef, deploymentId, releaseId) {
   }
   return toolResponse({ project_ref: projectRef, deployment_id: deploymentId, release });
 }
-async function uploadFrontendRelease(http, projectRef, deploymentId, archivePath) {
-  const endpoint = releaseEndpoint(projectRef, deploymentId);
-  const archive = await verifiedArchive(archivePath);
-  let response;
-  try {
-    response = await http.postBinary(endpoint, {
-      stream: archiveStream(archive),
-      byteLength: archive.sizeBytes
-    }, {
-      contentType: FRONTEND_ARCHIVE_CONTENT_TYPE,
-      contentLength: archive.sizeBytes,
-      contentSha256: archive.sha256,
-      maxJsonBytes: RESPONSE_MAX_BYTES,
-      timeoutMs: UPLOAD_REQUEST_TIMEOUT_MS,
-      responseTimeoutMs: MUTATION_RESPONSE_TIMEOUT_MS
-    });
-  } finally {
-    await archive.handle.close();
-  }
-  const release = response.ok ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId: archive.sha256 }) : null;
-  if (!release) {
-    if (response.status >= 400 && response.status < 500 && response.status !== 408 && !response.transportError) {
-      return releaseFailure("frontend.upload_release", "HTTP_ERROR", response.status);
-    }
-    return uploadReadback(http, projectRef, deploymentId, archive.sha256, response.status);
-  }
-  const readback = await http.get(`${endpoint}/${release.release_id}`, { maxJsonBytes: RESPONSE_MAX_BYTES });
-  const verified = readback.ok ? releaseEnvelope(readback.data, { projectRef, deploymentId, releaseId: release.release_id }) : null;
-  if (!verified || verified.tree_sha256 !== release.tree_sha256) {
-    return releaseFailure("frontend.upload_release", "OUTCOME_UNKNOWN", readback.status);
-  }
-  return toolResponse({ project_ref: projectRef, deployment_id: deploymentId, release: verified });
-}
 async function uploadProjectWebRelease(http, projectRef, environmentId, deploymentId, archivePath) {
   const endpoint = `/v1/projects/${encodeURIComponent(projectRef)}/environments/${encodeURIComponent(environmentId)}/deployments/web-release?deployment_id=${encodeURIComponent(deploymentId)}`;
   const archive = await verifiedArchive(archivePath);
@@ -16406,41 +16397,6 @@ async function uploadProjectWebRelease(http, projectRef, environmentId, deployme
     await archive.handle.close();
   }
 }
-async function uploadFrontendSource(http, projectRef, deploymentId, archivePath) {
-  const endpoint = `${deploymentEndpoint(projectRef, deploymentId)}/deploy/upload`;
-  const archive = await verifiedArchive(archivePath);
-  try {
-    const response = await http.postBinary(endpoint, {
-      stream: archiveStream(archive),
-      byteLength: archive.sizeBytes
-    }, {
-      contentType: FRONTEND_ARCHIVE_CONTENT_TYPE,
-      contentLength: archive.sizeBytes,
-      contentSha256: archive.sha256,
-      maxJsonBytes: RESPONSE_MAX_BYTES,
-      timeoutMs: UPLOAD_REQUEST_TIMEOUT_MS
-    });
-    if (!response.ok) {
-      return releaseFailure("frontend.deploy_upload", response.status >= 400 && response.status < 500 ? "HTTP_ERROR" : "OUTCOME_UNKNOWN", response.status);
-    }
-    if (!response.data || typeof response.data !== "object" || !("success" in response.data) || response.data.success !== true) {
-      return releaseFailure("frontend.deploy_upload", "INVALID_RESPONSE", response.status);
-    }
-    return toolResponse(response.data);
-  } finally {
-    await archive.handle.close();
-  }
-}
-async function uploadReadback(http, projectRef, deploymentId, releaseId, uploadStatus) {
-  const response = await http.get(releasePath(projectRef, deploymentId, releaseId), {
-    maxJsonBytes: RESPONSE_MAX_BYTES
-  });
-  const release = response.ok ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId }) : null;
-  if (!release) {
-    return releaseFailure("frontend.upload_release", "OUTCOME_UNKNOWN", uploadStatus);
-  }
-  return toolResponse({ project_ref: projectRef, deployment_id: deploymentId, release });
-}
 function stableJson(candidate) {
   if (candidate === null || typeof candidate !== "object")
     return JSON.stringify(candidate);
@@ -16518,9 +16474,6 @@ async function activeReleaseReadback(http, identity) {
   if (inventory.active_release_id !== identity.releaseId || inventory.active_activation_id !== identity.mutationId) {
     return { release: null, status: 200 };
   }
-  if (snapshot.exactReadback) {
-    return { release: inventory.releases[0] ?? null, status: 200 };
-  }
   const releaseRead = await http.get(releasePath(identity.projectRef, identity.deploymentId, identity.releaseId), { maxJsonBytes: RESPONSE_MAX_BYTES });
   const release = releaseRead.ok ? releaseEnvelope(releaseRead.data, {
     projectRef: identity.projectRef,
@@ -16538,43 +16491,31 @@ async function readActiveFrontendRelease(http, projectRef, deploymentId) {
     if (inventory.next_cursor !== null || inventory.releases.length !== (inventory.active_release_id === null ? 0 : 1) || inventory.releases[0] && inventory.releases[0].release_id !== inventory.active_release_id) {
       return { failure: releaseReadFailure("frontend.get_active_release", response), status: response.status };
     }
-    return { inventory, exactReadback: false };
-  }
-  if (response.ok || response.status !== 404) {
-    return { failure: releaseReadFailure("frontend.get_active_release", response), status: response.status };
+    return { inventory };
   }
-  const historyResponse = await http.get(`${releaseEndpoint(projectRef, deploymentId)}?limit=1`, {
-    maxJsonBytes: RESPONSE_MAX_BYTES
-  });
-  const history = historyResponse.ok && historyResponse.status === 200 ? releaseInventory(historyResponse.data, { projectRef, deploymentId }) : null;
-  if (!history || history.releases.length > 1) {
+  if (response.status === 404) {
     return {
-      failure: releaseReadFailure("frontend.get_active_release", historyResponse),
-      status: historyResponse.status
-    };
-  }
-  if (history.active_release_id === null) {
-    return { inventory: { ...history, releases: [], next_cursor: null }, exactReadback: false };
-  }
-  const exactResponse = await http.get(releasePath(projectRef, deploymentId, history.active_release_id), {
-    maxJsonBytes: RESPONSE_MAX_BYTES
-  });
-  const release = exactResponse.ok && exactResponse.status === 200 ? releaseEnvelope(exactResponse.data, { projectRef, deploymentId, releaseId: history.active_release_id }) : null;
-  if (!release) {
-    return {
-      failure: releaseReadFailure("frontend.get_active_release", exactResponse),
-      status: exactResponse.status
+      failure: {
+        isError: true,
+        content: [{ type: "text", text: JSON.stringify({
+          ok: false,
+          operation: "frontend.get_active_release",
+          error: {
+            code: "DEPLOYMENT_UPGRADE_REQUIRED",
+            http_status: 404,
+            message: `${DEPLOYMENT_UPGRADE} Check that the deployment exists and upgrade the server if this endpoint is unavailable.`
+          }
+        }) }]
+      },
+      status: response.status
     };
   }
-  return { inventory: { ...history, releases: [release], next_cursor: null }, exactReadback: true };
+  return { failure: releaseReadFailure("frontend.get_active_release", response), status: response.status };
 }
 async function getActiveFrontendRelease(http, projectRef, deploymentId) {
   const snapshot = await readActiveFrontendRelease(http, projectRef, deploymentId);
   return "failure" in snapshot ? snapshot.failure : toolResponse(snapshot.inventory);
 }
-async function readFrontendReleaseAuthority(http, projectRef, deploymentId) {
-  return getActiveFrontendRelease(http, projectRef, deploymentId);
-}
 async function rollbackFrontendRelease(http, projectRef, deploymentId, releaseId) {
   if (releaseId !== undefined && !RELEASE_ID_PATTERN.test(releaseId)) {
     throw new Error("'release_id' must be a SHA-256 digest");
@@ -16670,7 +16611,6 @@ async function readPreviousFrontendRelease(http, projectRef, deploymentId) {
       releases: [],
       next_cursor: null
     },
-    exactReadback: false,
     ...previous ? { previousRelease: previous } : {}
   };
 }
@@ -16740,16 +16680,13 @@ async function activationReadback(http, input, mutationId, activationStatus) {
 // src/shared/tools/frontend-tools.ts
 function registerFrontendTools(server, http) {
   registerTool(server, "frontend", `Frontend hosting and immutable prebuilt releases. Supports: static, react, vue, svelte, sveltekit, sveltekit-static, nextjs, nuxt, astro.
-Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy, build_logs, add_domain, remove_domain, set_env, list_frameworks, list_records, list_releases, get_active_release, get_release, upload_release, activate_release, rollback`, {
+Actions: list, get, create, update, delete, build_logs, add_domain, remove_domain, set_env, list_frameworks, list_records, list_releases, get_active_release, get_release, rollback. Publish with supacloud deploy.`, {
     action: withDescription(stringEnum([
       "list",
       "get",
       "create",
       "update",
       "delete",
-      "deploy_git",
-      "deploy_upload",
-      "redeploy",
       "build_logs",
       "add_domain",
       "remove_domain",
@@ -16759,8 +16696,6 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
       "list_releases",
       "get_active_release",
       "get_release",
-      "upload_release",
-      "activate_release",
       "rollback"
     ]), "Action"),
     ref: optional(String2(), "Project ref"),
@@ -16774,13 +16709,7 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
     node_version: optional(String2(), "[create/update] Node.js version"),
     health_check_path: optional(String2(), "[create/update] SSR readiness path (default: /)"),
     env_vars: optional(Record(String2(), String2()), "[create/update/set_env] Environment variables"),
-    git_url: optional(String2(), "[deploy_git] Git repository URL"),
-    branch: optional(String2(), "[deploy_git] Branch (default: main)"),
-    archive_path: optional(String2(), "[deploy_upload/upload_release] Local tar.zst file path"),
-    release_id: optional(String2(), "[get_release/activate_release] SHA-256 release ID; [rollback] optional, defaults to journal-verified previous release"),
-    expected_active_release_id: optional(String2(), "[activate_release] Current release SHA-256 or absent"),
-    expected_activation_id: optional(String2(), "[activate_release] Current activation UUIDv4 or absent"),
-    mutation_id: optional(String2(), "[activate_release] Required retry-stable UUIDv4"),
+    release_id: optional(String2(), "[get_release] SHA-256 release ID; [rollback] optional, defaults to journal-verified previous release"),
     cursor: optional(String2(), "[list_releases] Last release SHA-256 cursor"),
     limit: optional(Number2(), "[list_releases] Page size, 1-100 (default 50)")
   }, async (args) => {
@@ -16797,13 +16726,7 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
       node_version,
       health_check_path,
       env_vars,
-      git_url,
-      branch,
-      archive_path,
       release_id,
-      expected_active_release_id,
-      expected_activation_id,
-      mutation_id,
       cursor,
       limit
     } = args;
@@ -16858,22 +16781,6 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
         need("id", id);
         text = (await http.delete(`/v1/projects/${ref}/frontend/deployments/${id}`)).ok ? `✅ Deleted` : `❌ Failed`;
         break;
-      case "deploy_git":
-        need("ref", ref);
-        need("id", id);
-        need("git_url", git_url);
-        text = ok(await http.post(`/v1/projects/${ref}/frontend/deployments/${id}/deploy/git`, { git_url, branch }));
-        break;
-      case "deploy_upload":
-        need("ref", ref);
-        need("id", id);
-        need("archive_path", archive_path);
-        return uploadFrontendSource(http, ref, id, archive_path);
-      case "redeploy":
-        need("ref", ref);
-        need("id", id);
-        text = ok(await http.post(`/v1/projects/${ref}/frontend/deployments/${id}/redeploy`));
-        break;
       case "build_logs":
         need("ref", ref);
         need("id", id);
@@ -16919,26 +16826,6 @@ Actions: list, get, create, update, delete, deploy_git, deploy_upload, redeploy,
         need("ref", ref);
         need("id", id);
         return getActiveFrontendRelease(http, ref, id);
-      case "upload_release":
-        need("ref", ref);
-        need("id", id);
-        need("archive_path", archive_path);
-        return uploadFrontendRelease(http, ref, id, archive_path);
-      case "activate_release":
-        need("ref", ref);
-        need("id", id);
-        need("release_id", release_id);
-        need("expected_active_release_id", expected_active_release_id);
-        need("expected_activation_id", expected_activation_id);
-        need("mutation_id", mutation_id);
-        return activateFrontendRelease(http, {
-          projectRef: ref,
-          deploymentId: id,
-          releaseId: release_id,
-          expectedActiveReleaseId: expected_active_release_id,
-          expectedActivationId: expected_activation_id,
-          mutationId: mutation_id
-        });
       case "rollback":
         need("ref", ref);
         need("id", id);
@@ -21230,7 +21117,7 @@ var starter_metadata_default = {
       version: "0.8.1"
     },
     db: {
-      version: "0.16.1",
+      version: "0.16.2",
       peerDependencies: {
         "drizzle-orm": "1.0.0-rc.5-169397b"
       },
@@ -28108,6 +27995,117 @@ import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash9 } from "node:crypto";
 import { tmpdir as tmpdir3 } from "node:os";
 import { basename as basename8, dirname as dirname11, join as join17, relative as relative10, resolve as resolve22, sep as sep5 } from "node:path";
+
+// src/shared/tools/project-deployment.ts
+async function requireProjectDeploymentProtocol(http, projectRef, environmentId) {
+  const response = await http.get(`/v1/projects/${encodeURIComponent(projectRef)}/environments/${encodeURIComponent(environmentId)}/deployments/protocol`, { retry: false, totalTimeoutMs: 5000, maxJsonBytes: 4096 });
+  if (response.transportError || response.responseReadError || response.status >= 500 || response.status === 401 || response.status === 403 || response.status === 429) {
+    throw new Error(`DEPLOYMENT_PROTOCOL_UNAVAILABLE: Cannot verify the selected server (HTTP ${response.status}). Check connectivity, credentials and server health; no upload or deployment was attempted.`);
+  }
+  const data = response.data;
+  if (response.status !== 200 || !response.ok || !data || typeof data !== "object" || !("protocol" in data) || data.protocol !== "supacloud.project-deployment.v1" || !("project_ref" in data) || data.project_ref !== projectRef || !("environment_id" in data) || data.environment_id !== environmentId) {
+    throw new Error("DEPLOYMENT_PROTOCOL_MISMATCH: Upgrade the SupaCloud server and CLI together (`npm install -g @supacloud/cli@latest`), then retry `supacloud deploy`. No upload or deployment was attempted; legacy endpoints will not be used.");
+  }
+}
+var operation = "applications.project_deploy";
+var scopeSchema = _Object_({
+  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+  application_id: ApplicationIdSchema,
+  environment_id: ApplicationIdSchema
+});
+var statusSchema = _Object_({
+  schema: Literal("supacloud.project-deployment-status.v1"),
+  deployment_id: ApplicationDeployRequestSchema.properties.mutation_id,
+  status: Union([
+    Literal("pending"),
+    Literal("running"),
+    Literal("succeeded"),
+    Literal("failed_retryable"),
+    Literal("failed_terminal"),
+    Literal("outcome_unknown")
+  ]),
+  phase: Union([
+    Literal("queued"),
+    Literal("prepared"),
+    Literal("migrating"),
+    Literal("activating"),
+    Literal("binding-web"),
+    Literal("verifying")
+  ]),
+  operation: Literal("application.release.deploy"),
+  ...scopeSchema.properties,
+  receipt: Optional(Unknown()),
+  failure_code: Optional(String2({ pattern: "^[A-Z][A-Z0-9_]{0,63}$" }))
+}, { additionalProperties: false });
+function responseReceipt(data, expected) {
+  if (!data || typeof data !== "object" || Array.isArray(data) || !("ok" in data) || data.ok !== true) {
+    throw new Error("Invalid project deployment response");
+  }
+  const { ok: _ok, ...receipt } = data;
+  return parseApplicationDeployResult(receipt, expected);
+}
+async function runProjectDeployment(http, args) {
+  const scope = { project_ref: args.ref, application_id: args.id, environment_id: args.environment_id };
+  const request = {
+    mutation_id: args.mutation_id,
+    release_id: args.release_id,
+    ...args.configuration_id === undefined ? {} : { configuration_id: args.configuration_id },
+    ...args.configuration_write === undefined ? {} : { configuration_write: args.configuration_write },
+    ...args.expected_plan_sha256 === undefined ? {} : { expected_plan_sha256: args.expected_plan_sha256 },
+    ...args.approved_migration_digest === undefined ? {} : { approved_migration_digest: args.approved_migration_digest },
+    ...args.web_release === undefined ? {} : { web_release: args.web_release }
+  };
+  if (!Check2(scopeSchema, scope) || !Check2(ApplicationDeployRequestSchema, request) || request.configuration_id !== undefined && request.configuration_write !== undefined && request.configuration_id !== request.configuration_write.configuration_id) {
+    return releaseControlFailure(operation, "INVALID_RESPONSE", null);
+  }
+  const expected = { ...scope, request };
+  const identity = {
+    ...scope,
+    deployment_id: request.mutation_id,
+    mutation_id: request.mutation_id,
+    release_id: request.release_id
+  };
+  const endpoint = `/v1/projects/${encodeURIComponent(scope.project_ref)}/environments/${encodeURIComponent(scope.environment_id)}/deployments`;
+  const { mutation_id, ...candidate } = request;
+  const result = await http.post(endpoint, {
+    ...candidate,
+    deployment_id: mutation_id,
+    application_id: scope.application_id
+  }, { timeoutMs: 120000, maxJsonBytes: 131072, responseTimeoutMs: 30000 });
+  if (result.ok && result.status === 200) {
+    try {
+      return releaseControlSuccess(operation, {
+        ...responseReceipt(result.data, expected),
+        deployment_id: mutation_id
+      });
+    } catch {}
+  } else if (!result.ok && !result.transportError && !result.responseReadError && result.status < 500 && result.status !== 408) {
+    return releaseControlMutationFailure(operation, result, identity);
+  }
+  const observed = await http.get(`${endpoint}/${encodeURIComponent(mutation_id)}`, {
+    retry: false,
+    totalTimeoutMs: 30000,
+    maxJsonBytes: 131072
+  });
+  try {
+    if (!observed.ok || observed.status !== 200 || !Check2(statusSchema, observed.data))
+      throw new Error;
+    const state = observed.data;
+    if (state.deployment_id !== mutation_id || state.project_ref !== scope.project_ref || state.application_id !== scope.application_id || state.environment_id !== scope.environment_id || state.status !== "succeeded" || state.phase !== "verifying")
+      throw new Error;
+    const receipt = parseApplicationDeployResult(state.receipt, expected);
+    return releaseControlSuccess(operation, {
+      ...receipt,
+      deployment_id: mutation_id,
+      replayed: true,
+      execution_performed: false
+    });
+  } catch {
+    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", result.transportError ? null : result.status, identity);
+  }
+}
+
+// src/shared/tools/deploy-tools.ts
 var MAX_SOURCE_BYTES = 256 * 1024 * 1024;
 var PUBLIC_BUILD_ENV_PREFIXES = ["PUBLIC_", "VITE_", "NEXT_PUBLIC_", "NUXT_PUBLIC_", "ASTRO_PUBLIC_"];
 var SENSITIVE_BUILD_ENV = /(?:^|_)(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL|AUTHORIZATION|COOKIE|SESSION)(?:_|$)|(?:DATABASE_URL|DATABASE_URI|CONNECTION_STRING|DSN|PRIVATE_KEY)/i;
@@ -28119,15 +28117,8 @@ function isProtectedBuildEnv(name) {
 }
 var deployToolSchema = {
   ref: optional(String2(), "Project ref (defaults to the linked project)"),
-  target: optional(String2(), "Named deploy target from supacloud.json"),
-  id: optional(String2(), "Frontend deployment ID (auto-selected when unambiguous)"),
   cwd: optional(String2(), "Project directory (default: current directory)"),
-  build_command: optional(String2(), "Build command override"),
-  output_dir: optional(String2(), "Build output directory override"),
   skip_build: optional(Boolean2(), "Use an existing output directory without building"),
-  dry_run: optional(Boolean2(), "Resolve and validate the deployment without building or publishing"),
-  plan: optional(Boolean2(), "Build and compare the release with current authority without publishing"),
-  diff: optional(Boolean2(), "Build and report the immutable release-level diff without publishing"),
   json: optional(Boolean2(), "Print only the final JSON result")
 };
 function record4(candidate) {
@@ -28386,40 +28377,6 @@ function targetRoot(configRoot, target, name) {
   }
   return root;
 }
-function selectTarget(configRoot, invocationDirectory, config, requestedName) {
-  const targets = config.targets ? Object.entries(config.targets) : [["frontend", {
-    type: "frontend",
-    root: config.frontend?.root,
-    id: config.frontend?.id,
-    buildCommand: config.frontend?.buildCommand,
-    outputDirectory: config.frontend?.outputDirectory,
-    buildEnv: config.frontend?.buildEnv
-  }]];
-  if (targets.length === 0)
-    throw new Error("supacloud.json defines no deploy targets");
-  if (requestedName) {
-    const selected = targets.find(([name]) => name === requestedName);
-    if (!selected)
-      throw new Error(`Deploy target '${requestedName}' was not found in supacloud.json`);
-    return { name: selected[0], config: selected[1], root: targetRoot(configRoot, selected[1], selected[0]) };
-  }
-  const containing = targets.map(([name, target]) => ({ name, target, root: targetRoot(configRoot, target, name) })).filter((candidate) => invocationDirectory === candidate.root || invocationDirectory.startsWith(`${candidate.root}${sep5}`)).sort((left, right) => right.root.length - left.root.length);
-  if (containing.length === 1 || containing.length > 1 && containing[0].root !== containing[1].root) {
-    const selected = containing[0];
-    return { name: selected.name, config: selected.target, root: selected.root };
-  }
-  if (config.defaultTarget) {
-    const selected = targets.find(([name]) => name === config.defaultTarget);
-    if (!selected)
-      throw new Error(`supacloud.json defaultTarget '${config.defaultTarget}' was not found`);
-    return { name: selected[0], config: selected[1], root: targetRoot(configRoot, selected[1], selected[0]) };
-  }
-  if (targets.length === 1) {
-    const selected = targets[0];
-    return { name: selected[0], config: selected[1], root: targetRoot(configRoot, selected[1], selected[0]) };
-  }
-  throw new Error(`Multiple deploy targets found (${targets.map(([name]) => name).sort().join(", ")}). Pass --target`);
-}
 function defaultOutputDirectory(framework) {
   switch (framework) {
     case "sveltekit-static":
@@ -28599,24 +28556,8 @@ async function stageApplicationWebRelease(http, projectRef, environmentId, confi
     await archive.cleanup();
   }
 }
-function deployResponse(result, json) {
-  if (json)
-    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-  const lines = [
-    result.unchanged === true ? "Already up to date." : `Deployed ${String(result.target || result.deployment_id || result.slug)}.`,
-    result.url ? `URL: ${String(result.url)}` : null,
-    result.release_id ? `Release: ${String(result.release_id)}` : null,
-    result.active_version ? `Active version: ${String(result.active_version)}` : null,
-    result.file_count ? `Files: ${String(result.file_count)}` : null
-  ].filter((line) => Boolean(line));
-  return { content: [{ type: "text", text: lines.join(`
-`) }] };
-}
 function registerDeployTools(server, http, options = {}) {
   registerTool(server, "deploy", "Build and publish the linked project with one command", deployToolSchema, async (args) => {
-    if (args.dry_run === true && (args.plan === true || args.diff === true)) {
-      throw new Error("Use dry_run for resolution only, or plan/diff for a built release comparison, not both");
-    }
     const invocationDirectory = resolve22(String(args.cwd || options.cwd || process.cwd()));
     const projectRef = String(args.ref || options.projectRef || "").trim();
     if (!projectRef)
@@ -28627,8 +28568,8 @@ function registerDeployTools(server, http, options = {}) {
       ...config.application,
       environmentId: options.environment || config.application.environmentId
     } : undefined;
-    if (!args.target && await hasProjectReleaseManifest(configRoot)) {
-      throw new Error("PROJECT_DEPLOYMENT_UNSUPPORTED: This project declares a release manifest that the current deployment orchestrator cannot execute. No Web-only fallback or remote mutation was performed.");
+    if (await hasProjectReleaseManifest(configRoot)) {
+      throw new Error(`${DEPLOYMENT_UPGRADE} Replace deploy-manifest.json with the current application delivery configuration; no remote mutation was performed.`);
     }
     if (application?.id) {
       if (Object.values(config.targets ?? {}).some((target) => target.type === "edge_function")) {
@@ -28637,12 +28578,6 @@ function registerDeployTools(server, http, options = {}) {
       if (!options.applicationRelease) {
         throw new Error("Application release support is unavailable in this CLI context");
       }
-      if (args.target || args.build_command || args.output_dir) {
-        throw new Error("Application profile deploy does not accept frontend target, build command, or output directory flags");
-      }
-      if (args.dry_run === true || args.plan === true || args.diff === true) {
-        throw new Error("Application profile deploy does not support dry_run, plan, or diff; use app deploy-plan for a read-only plan");
-      }
       const environmentId = application.environmentId?.trim();
       if (!environmentId || !Check2(ApplicationIdSchema, environmentId) || !Check2(ApplicationIdSchema, application.id)) {
         throw new Error("Application profile requires SUPACLOUD_APPLICATION_ENVIRONMENT_ID or SUPACLOUD_ENV");
@@ -28652,6 +28587,7 @@ function registerDeployTools(server, http, options = {}) {
       if (configurationPath && configurationId) {
         throw new Error("Application profile must set only one of SUPACLOUD_APPLICATION_CONFIGURATION_PATH or SUPACLOUD_APPLICATION_CONFIGURATION_ID");
       }
+      await requireProjectDeploymentProtocol(http, projectRef, environmentId);
       const stagedWeb = await stageApplicationWebRelease(http, projectRef, environmentId, configRoot, args.skip_build === true, args.json === true, options.environmentVariables);
       const result = await options.applicationRelease({
         action: "release",
@@ -28668,215 +28604,7 @@ function registerDeployTools(server, http, options = {}) {
       });
       return result;
     }
-    const target = selectTarget(configRoot, invocationDirectory, config, String(args.target || "").trim() || undefined);
-    if (!args.target && target.config.type === "frontend" && (Object.values(config.targets ?? {}).some((candidate) => candidate.type === "edge_function") || await pathExists(join17(configRoot, "supacloud.config.ts")) || await pathExists(join17(configRoot, "supabase", "migrations")) || await pathExists(join17(configRoot, "supabase", "functions")))) {
-      throw new Error("PROJECT_DEPLOYMENT_UNSUPPORTED: Backend declarations were detected but are not covered by this deployment. No Web-only fallback or remote mutation was performed.");
-    }
-    const projectDirectory = target.root;
-    const targetState = await lstat5(projectDirectory).catch(() => null);
-    if (!targetState?.isDirectory() || targetState.isSymbolicLink()) {
-      throw new Error(`Deploy target '${target.name}' root is not a regular directory: ${projectDirectory}`);
-    }
-    const requestedId = String(args.id || target.config.id || "").trim() || undefined;
-    const build = createBuildEnvironment(target.config.buildEnv, options.environmentVariables);
-    if (target.config.type === "edge_function") {
-      if (args.diff === true)
-        throw new Error("Function release diffs require an immutable function release manifest");
-      if (!options.edgeFunctionDeploy)
-        throw new Error("Edge Function deploy support is unavailable in this CLI context");
-      const slug = target.config.slug || requestedId || target.name;
-      const functionListResponse = await options.edgeFunctionDeploy({
-        action: "list",
-        ref: projectRef
-      });
-      if (functionListResponse.isError) {
-        throw new Error(`Unable to read the current identity for Edge Function '${slug}'`);
-      }
-      const functionListText = functionListResponse.content.find((chunk) => chunk.type === "text")?.text;
-      if (!functionListText)
-        throw new Error(`Unable to read the current identity for Edge Function '${slug}'`);
-      const functions = projectedFunctionList(JSON.parse(functionListText));
-      if (!functions)
-        throw new Error(`Invalid current identity for Edge Function '${slug}'`);
-      const current = functions?.find((candidate) => candidate.slug === slug);
-      const activeVersion = current && typeof current.version === "number" ? String(current.version) : "absent";
-      const activationId = current && typeof current.activation_id === "string" ? current.activation_id : "legacy";
-      if (!activeVersion || !activationId)
-        throw new Error(`Edge Function '${slug}' has an invalid active identity`);
-      const buildCommand = String(args.build_command || target.config.buildCommand || "").trim() || (args.skip_build === true ? "" : await defaultBuildCommand(projectDirectory, configRoot));
-      const bundleDirectory = resolveInsideProject(projectDirectory, String(args.output_dir || target.config.bundleDirectory || target.config.outputDirectory || "dist"), true);
-      if (args.dry_run === true || args.plan === true) {
-        return { content: [{ type: "text", text: JSON.stringify({
-          ok: true,
-          dry_run: true,
-          type: target.config.type,
-          target: target.name,
-          project_ref: projectRef,
-          slug,
-          build_command: args.skip_build === true ? null : buildCommand,
-          build_env: build.names,
-          missing_build_env: build.missing,
-          bundle_directory: bundleDirectory,
-          expected_active_version: activeVersion,
-          expected_activation_id: activationId
-        }, null, 2) }] };
-      }
-      assertBuildEnvironment(build, args.skip_build === true);
-      if (args.skip_build !== true) {
-        await runBuild(buildCommand, projectDirectory, build.env, args.json === true);
-      }
-      const deployed = await options.edgeFunctionDeploy({
-        action: "deploy_bundle",
-        ref: projectRef,
-        slug,
-        "bundle-dir": bundleDirectory,
-        entrypoint: target.config.entrypoint || "index.ts",
-        minify: target.config.minify,
-        verify_jwt: target.config.verifyJwt,
-        framework: target.config.framework,
-        "expected-active-version": activeVersion,
-        "expected-activation-id": activationId
-      });
-      if (deployed.isError)
-        return deployed;
-      const deployedText = deployed.content.find((chunk) => chunk.type === "text")?.text;
-      const deployedPayload = deployedText ? record4(JSON.parse(deployedText)) : null;
-      return deployResponse({
-        ok: true,
-        unchanged: false,
-        type: target.config.type,
-        target: target.name,
-        project_ref: projectRef,
-        slug,
-        active_version: deployedPayload?.active_version,
-        activation_id: deployedPayload?.activation_id
-      }, args.json === true);
-    }
-    const listResponse = await http.get(`/v1/projects/${encodeURIComponent(projectRef)}/frontend/deployments`);
-    if (!listResponse.ok)
-      throw new Error(`Failed to list frontend deployments (HTTP ${listResponse.status})`);
-    const selected = selectDeployment(deploymentList(listResponse.data), requestedId, await packageName(projectDirectory));
-    const configuredBuildCommand = String(args.build_command || target.config.buildCommand || selected.buildCommand || "").trim();
-    const buildCommand = configuredBuildCommand || (args.skip_build === true ? "" : await defaultBuildCommand(projectDirectory, configRoot));
-    const configuredOutput = String(args.output_dir || target.config.outputDirectory || "").trim();
-    const remoteOutput = selected.outputDirectory && selected.outputDirectory !== "." ? selected.outputDirectory : "";
-    const outputDirectory = resolveInsideProject(projectDirectory, configuredOutput || remoteOutput || defaultOutputDirectory(selected.framework));
-    if (args.dry_run === true) {
-      return { content: [{ type: "text", text: JSON.stringify({
-        ok: true,
-        dry_run: true,
-        project_ref: projectRef,
-        deployment_id: selected.id,
-        build_command: args.skip_build === true ? null : buildCommand,
-        build_env: build.names,
-        missing_build_env: build.missing,
-        output_directory: outputDirectory
-      }, null, 2) }] };
-    }
-    assertBuildEnvironment(build, args.skip_build === true);
-    if (args.skip_build !== true) {
-      await runBuild(buildCommand, projectDirectory, build.env, args.json === true);
-    }
-    const archive = await createFrontendArchive(outputDirectory);
-    try {
-      const inventory = payload(await readFrontendReleaseAuthority(http, projectRef, selected.id));
-      const activeReleaseId = typeof inventory.active_release_id === "string" ? inventory.active_release_id : null;
-      const activeActivationId = typeof inventory.active_activation_id === "string" ? inventory.active_activation_id : null;
-      const current = Array.isArray(inventory.releases) ? record4(inventory.releases[0]) : null;
-      if (archive.sha256 === activeReleaseId && archive.treeSha256 !== current?.tree_sha256) {
-        throw new Error("Active release tree does not match the local archive");
-      }
-      const unchanged = archive.treeSha256 === current?.tree_sha256;
-      if (args.plan === true || args.diff === true) {
-        return { content: [{ type: "text", text: JSON.stringify({
-          schema: "supacloud.frontend-deploy-plan.v1",
-          ok: true,
-          planned: true,
-          published: false,
-          unchanged,
-          environment: options.environment ?? null,
-          type: "frontend",
-          target: target.name,
-          project_ref: projectRef,
-          deployment_id: selected.id,
-          comparison: "immutable_release",
-          archive_format: FRONTEND_ARCHIVE_FORMAT,
-          release_id: archive.sha256,
-          tree_sha256: archive.treeSha256,
-          active_release_id: activeReleaseId,
-          active_tree_sha256: current?.tree_sha256 ?? null,
-          expected_active_release_id: activeReleaseId ?? "absent",
-          expected_activation_id: activeActivationId ?? "absent",
-          actions: unchanged ? [] : ["upload_release", "activate_release"],
-          file_count: archive.fileCount,
-          source_bytes: archive.sourceBytes,
-          archive_bytes: archive.archiveBytes
-        }, null, 2) }] };
-      }
-      if (unchanged) {
-        return deployResponse({
-          ok: true,
-          unchanged: true,
-          project_ref: projectRef,
-          deployment_id: selected.id,
-          release_id: activeReleaseId,
-          tree_sha256: archive.treeSha256,
-          url: selected.deploymentUrl,
-          file_count: archive.fileCount,
-          source_bytes: archive.sourceBytes
-        }, args.json === true);
-      }
-      const uploaded = payload(await uploadFrontendRelease(http, projectRef, selected.id, archive.archivePath));
-      const release = record4(uploaded.release);
-      const releaseId = requiredString(release?.release_id, "release.release_id");
-      if (releaseId !== archive.sha256)
-        throw new Error("Uploaded release identity does not match the local archive");
-      if (release?.tree_sha256 !== archive.treeSha256)
-        throw new Error("Uploaded release tree does not match the local build");
-      const mutationId = crypto.randomUUID();
-      const activationResponse = await activateFrontendRelease(http, {
-        projectRef,
-        deploymentId: selected.id,
-        releaseId,
-        expectedActiveReleaseId: activeReleaseId || "absent",
-        expectedActivationId: activeActivationId || "absent",
-        mutationId
-      });
-      if (activationResponse.isError) {
-        const failure = record4(JSON.parse(activationResponse.content[0]?.text ?? "{}"));
-        return {
-          isError: true,
-          content: [{ type: "text", text: JSON.stringify({
-            ...failure,
-            operation: "deploy",
-            project_ref: projectRef,
-            deployment_id: selected.id,
-            mutation_id: mutationId,
-            target_release_id: releaseId,
-            expected_active_release_id: activeReleaseId ?? "absent",
-            expected_activation_id: activeActivationId ?? "absent"
-          }) }]
-        };
-      }
-      const activated = payload(activationResponse);
-      const finalResponse = await http.get(`/v1/projects/${encodeURIComponent(projectRef)}/frontend/deployments/${encodeURIComponent(selected.id)}`);
-      const finalDeployment = finalResponse.ok ? frontendDeployment(finalResponse.data) : selected;
-      return deployResponse({
-        ok: true,
-        unchanged: false,
-        project_ref: projectRef,
-        deployment_id: selected.id,
-        release_id: activated.active_release_id,
-        activation_id: activated.activation_id,
-        previous_release_id: activeReleaseId,
-        previous_activation_id: activeActivationId,
-        url: finalDeployment.deploymentUrl,
-        file_count: archive.fileCount,
-        source_bytes: archive.sourceBytes
-      }, args.json === true);
-    } finally {
-      await archive.cleanup();
-    }
+    throw new Error(DEPLOYMENT_UPGRADE);
   });
 }
 
@@ -29168,6 +28896,7 @@ var TEST_PROFILE = [
   "SUPACLOUD_API_URL=https://management.test.example.com",
   "SUPACLOUD_API_TOKEN=<test-management-api-token>",
   "SUPACLOUD_PROJECT_REF=<test-project-ref>",
+  "SUPACLOUD_APPLICATION_ID=<application-id>",
   ""
 ].join(`
 `);
@@ -29176,6 +28905,7 @@ var PRODUCTION_PROFILE = [
   "SUPACLOUD_API_URL=https://management.example.com",
   "SUPACLOUD_API_TOKEN=<production-management-api-token>",
   "SUPACLOUD_PROJECT_REF=<production-project-ref>",
+  "SUPACLOUD_APPLICATION_ID=<application-id>",
   ""
 ].join(`
 `);
@@ -29299,6 +29029,7 @@ async function initializeProject(request, options) {
     },
     next: [
       "cp .env.supacloud.test.example .env.supacloud.test",
+      "Set SUPACLOUD_APPLICATION_ID to the application's ID and configure its current SupaCloud delivery build.",
       "supacloud env check",
       "supacloud --env test deploy"
     ]
@@ -29346,17 +29077,16 @@ function statusMissing(context) {
   }
   return ["SUPACLOUD_API_URL", "SUPACLOUD_API_TOKEN", "SUPACLOUD_PROJECT_REF"];
 }
-function deployMissing(context) {
+function deployMissing(context, application) {
   const missing = statusMissing(context);
   if (context.credentialScope !== "management") {
     return [...missing, "Management API context"];
   }
-  if (context.applicationId) {
-    if (!context.applicationEnvironmentId)
-      missing.push("SUPACLOUD_APPLICATION_ENVIRONMENT_ID");
-    if (!context.applicationConfigurationPath && !context.applicationConfigurationId) {
-      missing.push("SUPACLOUD_APPLICATION_CONFIGURATION_PATH or SUPACLOUD_APPLICATION_CONFIGURATION_ID");
-    }
+  if (!Check2(ApplicationIdSchema, context.applicationId || application?.id)) {
+    missing.push("valid SUPACLOUD_APPLICATION_ID or supacloud.json application.id");
+  }
+  if (!Check2(ApplicationIdSchema, context.applicationEnvironmentId || application?.environmentId)) {
+    missing.push("valid SUPACLOUD_APPLICATION_ENVIRONMENT_ID or SUPACLOUD_ENV");
   }
   return missing;
 }
@@ -29366,7 +29096,13 @@ async function inspectProfile(profile) {
       environmentName: profile.name
     });
     const status = statusMissing(context);
-    const deploy = deployMissing(context);
+    const configText = await readFile8(join19(dirname12(profile.path), "supacloud.json"), "utf8").catch((error) => {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT")
+        return "{}";
+      throw error;
+    });
+    const config = record5(JSON.parse(configText));
+    const deploy = deployMissing(context, record5(config?.application));
     return {
       name: profile.name,
       path: profile.path,
@@ -29459,109 +29195,10 @@ function registerDeveloperExperienceTools(server, options = {}) {
   registerTool(server, "init", "Create SupaCloud deployment configuration and non-secret environment examples without overwriting project files.", initToolSchema, (request) => initializeProject(request, options));
   registerTool(server, "env", "List or locally validate named SupaCloud environment profiles without contacting the platform or printing secrets.", environmentToolSchema, (request) => inspectEnvironment(request, options));
 }
-
-// src/shared/tools/project-deployment.ts
-var operation = "applications.project_deploy";
-var scopeSchema = _Object_({
-  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
-  application_id: ApplicationIdSchema,
-  environment_id: ApplicationIdSchema
-});
-var statusSchema = _Object_({
-  schema: Literal("supacloud.project-deployment-status.v1"),
-  deployment_id: ApplicationDeployRequestSchema.properties.mutation_id,
-  status: Union([
-    Literal("pending"),
-    Literal("running"),
-    Literal("succeeded"),
-    Literal("failed_retryable"),
-    Literal("failed_terminal"),
-    Literal("outcome_unknown")
-  ]),
-  phase: Union([
-    Literal("queued"),
-    Literal("prepared"),
-    Literal("migrating"),
-    Literal("activating"),
-    Literal("binding-web"),
-    Literal("verifying")
-  ]),
-  operation: Literal("application.release.deploy"),
-  ...scopeSchema.properties,
-  receipt: Optional(Unknown()),
-  failure_code: Optional(String2({ pattern: "^[A-Z][A-Z0-9_]{0,63}$" }))
-}, { additionalProperties: false });
-function responseReceipt(data, expected) {
-  if (!data || typeof data !== "object" || Array.isArray(data) || !("ok" in data) || data.ok !== true) {
-    throw new Error("Invalid project deployment response");
-  }
-  const { ok: _ok, ...receipt } = data;
-  return parseApplicationDeployResult(receipt, expected);
-}
-async function runProjectDeployment(http, args) {
-  const scope = { project_ref: args.ref, application_id: args.id, environment_id: args.environment_id };
-  const request = {
-    mutation_id: args.mutation_id,
-    release_id: args.release_id,
-    ...args.configuration_id === undefined ? {} : { configuration_id: args.configuration_id },
-    ...args.configuration_write === undefined ? {} : { configuration_write: args.configuration_write },
-    ...args.expected_plan_sha256 === undefined ? {} : { expected_plan_sha256: args.expected_plan_sha256 },
-    ...args.approved_migration_digest === undefined ? {} : { approved_migration_digest: args.approved_migration_digest },
-    ...args.web_release === undefined ? {} : { web_release: args.web_release }
-  };
-  if (!Check2(scopeSchema, scope) || !Check2(ApplicationDeployRequestSchema, request) || request.configuration_id !== undefined && request.configuration_write !== undefined && request.configuration_id !== request.configuration_write.configuration_id) {
-    return releaseControlFailure(operation, "INVALID_RESPONSE", null);
-  }
-  const expected = { ...scope, request };
-  const identity = {
-    ...scope,
-    deployment_id: request.mutation_id,
-    mutation_id: request.mutation_id,
-    release_id: request.release_id
-  };
-  const endpoint = `/v1/projects/${encodeURIComponent(scope.project_ref)}/environments/${encodeURIComponent(scope.environment_id)}/deployments`;
-  const { mutation_id, ...candidate } = request;
-  const result = await http.post(endpoint, {
-    ...candidate,
-    deployment_id: mutation_id,
-    application_id: scope.application_id
-  }, { timeoutMs: 120000, maxJsonBytes: 131072, responseTimeoutMs: 30000 });
-  if (result.ok && result.status === 200) {
-    try {
-      return releaseControlSuccess(operation, {
-        ...responseReceipt(result.data, expected),
-        deployment_id: mutation_id
-      });
-    } catch {}
-  } else if (!result.ok && !result.transportError && !result.responseReadError && result.status < 500 && result.status !== 408) {
-    return releaseControlMutationFailure(operation, result, identity);
-  }
-  const observed = await http.get(`${endpoint}/${encodeURIComponent(mutation_id)}`, {
-    retry: false,
-    totalTimeoutMs: 30000,
-    maxJsonBytes: 131072
-  });
-  try {
-    if (!observed.ok || observed.status !== 200 || !Check2(statusSchema, observed.data))
-      throw new Error;
-    const state = observed.data;
-    if (state.deployment_id !== mutation_id || state.project_ref !== scope.project_ref || state.application_id !== scope.application_id || state.environment_id !== scope.environment_id || state.status !== "succeeded" || state.phase !== "verifying")
-      throw new Error;
-    const receipt = parseApplicationDeployResult(state.receipt, expected);
-    return releaseControlSuccess(operation, {
-      ...receipt,
-      deployment_id: mutation_id,
-      replayed: true,
-      execution_performed: false
-    });
-  } catch {
-    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", result.transportError ? null : result.status, identity);
-  }
-}
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.93.0",
+  version: "0.94.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -29615,7 +29252,7 @@ var package_default = {
   dependencies: {
     "@supacloud/compiler": "^0.44.1",
     "@supacloud/delivery": "0.16.0",
-    "@supacloud/db": "0.16.1",
+    "@supacloud/db": "0.16.2",
     typebox: "1.3.36"
   },
   overrides: {
@@ -29837,8 +29474,6 @@ EXAMPLES
   ${preferredCommand} deploy
   ${preferredCommand} --env test deploy
   ${preferredCommand} --env production deploy --confirm-production <project-ref>
-  ${preferredCommand} deploy --target web
-  ${preferredCommand} deploy --target api
   ${preferredCommand} dev sync --env test --target functions --function api
   ${preferredCommand} dev status --env test
   ${preferredCommand} dev watch --env test --target project
@@ -30194,8 +29829,7 @@ function createCliTools(context, confirmProduction) {
     applicationRelease: (args) => tools.app ? tools.app.callback(args) : Promise.resolve({
       isError: true,
       content: [{ type: "text", text: "Application release support is unavailable in this CLI context" }]
-    }),
-    edgeFunctionDeploy: advancedTools.edge_functions?.callback
+    })
   })));
   assign(captureTools((server) => registerGatewayTools(server, http, {
     projectRef: context.projectRef || undefined

package/dist/shared/deployment-upgrade.d.ts

@@ -0,0 +1,2 @@
+export declare const DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment is no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, bind application.id and application.environmentId in supacloud.json (or SUPACLOUD_APPLICATION_ID and SUPACLOUD_ENV), then run `supacloud deploy`. SupaCloud owns deployment planning and activation; do not retry with legacy commands.";
+export declare function assertCurrentDeploymentInput(tool: string, input: unknown): void;

package/dist/shared/tools/application-tools.d.ts

@@ -9,7 +9,7 @@ export declare const APPLICATION_TOOL_SCHEMA: {
     ttl_seconds: Type.TOptional<Type.TInteger>;
     wait: Type.TOptional<Type.TBoolean>;
     timeout_seconds: Type.TOptional<Type.TInteger>;
-    action: Type.TEnum<("list_releases" | "get_release" | "upload_release" | "activate_release" | "logs" | "get_runtime" | "get_deployment_evidence" | "get_configuration" | "get_release_transfer_plan" | "get_promotion_plan" | "get_promotion_status" | "get_rollback_snapshot" | "get_history" | "get_deploy_plan" | "get_preview_plan" | "list_previews" | "get_preview" | "put_configuration" | "deploy_application" | "transfer_release" | "promote_application" | "reconcile_promotion" | "create_preview" | "reconcile_preview" | "cleanup_preview" | "deploy_release" | "rollback_release" | "reconcile_activation" | "retire_activation")[]>;
+    action: Type.TEnum<("upload_release" | "activate_release" | "list_releases" | "get_release" | "logs" | "get_runtime" | "get_deployment_evidence" | "get_configuration" | "get_release_transfer_plan" | "get_promotion_plan" | "get_promotion_status" | "get_rollback_snapshot" | "get_history" | "get_deploy_plan" | "get_preview_plan" | "list_previews" | "get_preview" | "put_configuration" | "deploy_application" | "transfer_release" | "promote_application" | "reconcile_promotion" | "create_preview" | "reconcile_preview" | "cleanup_preview" | "deploy_release" | "rollback_release" | "reconcile_activation" | "retire_activation")[]>;
     ref: Type.TString;
     id: Type.TString;
     environment_id: Type.TOptional<Type.TString>;

package/dist/shared/tools/deploy-tools.d.ts

@@ -14,7 +14,6 @@ interface DeployToolOptions {
         manifestPath?: string;
     };
     applicationRelease?: (args: Record<string, unknown>) => Promise<ToolResponse>;
-    edgeFunctionDeploy?: (args: Record<string, unknown>) => Promise<ToolResponse>;
 }
 interface ToolResponse {
     content: Array<{
@@ -25,15 +24,8 @@ interface ToolResponse {
 }
 export declare const deployToolSchema: {
     ref: Type.TOptional<Type.TString>;
-    target: Type.TOptional<Type.TString>;
-    id: Type.TOptional<Type.TString>;
     cwd: Type.TOptional<Type.TString>;
-    build_command: Type.TOptional<Type.TString>;
-    output_dir: Type.TOptional<Type.TString>;
     skip_build: Type.TOptional<Type.TBoolean>;
-    dry_run: Type.TOptional<Type.TBoolean>;
-    plan: Type.TOptional<Type.TBoolean>;
-    diff: Type.TOptional<Type.TBoolean>;
     json: Type.TOptional<Type.TBoolean>;
 };
 export declare function findDeployConfigRoot(startDirectory: string, environmentName?: string): Promise<string>;

package/dist/shared/tools/developer-experience-tools.d.ts

@@ -15,7 +15,7 @@ export declare const environmentToolSchema: ToolSchema;
 declare function outputDirectoryFor(manifest: PackageManifest): string;
 declare function profileNameFromFile(name: string): string | null;
 declare function statusMissing(context: ResolvedContext): string[];
-declare function deployMissing(context: ResolvedContext): string[];
+declare function deployMissing(context: ResolvedContext, application?: Record<string, unknown> | null): string[];
 export declare function registerDeveloperExperienceTools(server: ToolServer, options?: DeveloperExperienceOptions): void;
 export declare const __internal: {
     outputDirectoryFor: typeof outputDirectoryFor;

package/dist/shared/tools/project-deployment.d.ts

@@ -1,3 +1,4 @@
 import type { ToolResult } from "../tool-server";
 import type { HttpTransport } from "../transports/http";
+export declare function requireProjectDeploymentProtocol(http: Pick<HttpTransport, "get">, projectRef: string, environmentId: string): Promise<void>;
 export declare function runProjectDeployment(http: Pick<HttpTransport, "post" | "get">, args: Record<string, unknown>): Promise<ToolResult>;

package/dist/shared/tools/remote-dev-tools.d.ts

@@ -20,7 +20,7 @@ export interface RemoteDevToolOptions {
 }
 export declare const remoteDevToolSchema: {
     action: Type.TEnum<("status" | "migrate" | "watch" | "sync")[]>;
-    target: Type.TOptional<Type.TEnum<("project" | "frontend" | "db" | "functions")[]>>;
+    target: Type.TOptional<Type.TEnum<("frontend" | "project" | "db" | "functions")[]>>;
     project_dir: Type.TOptional<Type.TString>;
     remote_root: Type.TOptional<Type.TString>;
     remote_host: Type.TOptional<Type.TString>;

package/dist/tool-runtime.js

@@ -129,12 +129,37 @@ function schemaProperties(schema) {
 // src/shared/tool-server.ts
 import { Type as Type2 } from "typebox";
 import { Value as Value2 } from "typebox/value";
+
+// src/shared/deployment-upgrade.ts
+var DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment is no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, bind application.id and application.environmentId in supacloud.json (or SUPACLOUD_APPLICATION_ID and SUPACLOUD_ENV), then run `supacloud deploy`. SupaCloud owns deployment planning and activation; do not retry with legacy commands.";
+var removedFrontendActions = new Set([
+  "deploy_git",
+  "deploy_upload",
+  "redeploy",
+  "upload_release",
+  "activate_release"
+]);
+var removedDeployFlags = ["target", "id", "build_command", "output_dir", "plan", "diff", "dry_run"];
+function assertCurrentDeploymentInput(tool, input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    return;
+  const args = input;
+  if (tool === "frontend" && typeof args["action"] === "string" && removedFrontendActions.has(args["action"])) {
+    throw new Error(DEPLOYMENT_UPGRADE);
+  }
+  if (tool === "deploy" && removedDeployFlags.some((flag) => Object.hasOwn(args, flag))) {
+    throw new Error(`${DEPLOYMENT_UPGRADE} Put build settings in the frontend configuration. For read-only review use \`supacloud app deploy-plan\`.`);
+  }
+}
+
+// src/shared/tool-server.ts
 var resultSchema = Type2.Object({
   content: Type2.Array(Type2.Object({ type: Type2.Literal("text"), text: Type2.String() })),
   isError: Type2.Optional(Type2.Boolean())
 });
 function registerTool(server, name, description, schema, callback) {
   server.tool(name, description, schema, async (input) => {
+    assertCurrentDeploymentInput(name, input);
     const args = parseToolArguments(schema, input);
     const result = await callback(args);
     if (!Value2.Check(resultSchema, result))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.93.0",
+  "version": "0.94.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -54,7 +54,7 @@
   "dependencies": {
     "@supacloud/compiler": "^0.44.1",
     "@supacloud/delivery": "0.16.0",
-    "@supacloud/db": "0.16.1",
+    "@supacloud/db": "0.16.2",
     "typebox": "1.3.36"
   },
   "overrides": {

package/skills/supacloud/SKILL.md

@@ -29,6 +29,15 @@ Use `supacloud` as the project-level control surface and keep durable changes re
 
 ## Workflow
 
+For normal application deployment, run `supacloud --env <name> deploy`.
+Use the current application delivery configuration and a bound application ID.
+Do not assemble a client-side sequence of scope generation, backup, migration
+apply, PostgREST refresh, Function deployment and Web activation.
+The server owns that sequence. Old `deploy --target` and `frontend` publishing
+actions are removed: upgrade CLI and server together, migrate the configuration,
+and retry the unified command. Do not substitute a legacy endpoint when it fails.
+The inspection and database-maintenance workflow below is not a deployment checklist.
+
 1. Classify the request using [references/command-map.md](references/command-map.md).
 2. For database work, load [references/database-workflow.md](references/database-workflow.md) and choose either new-change or historical-drift reconciliation.
 3. For AI-assisted database changes, first request bounded context:

package/skills/supacloud/references/command-map.md

@@ -6,6 +6,7 @@ Load this reference when selecting a command surface or when a user asks an AI t
 
 | Intent | Use | Guardrail |
 | --- | --- | --- |
+| Deploy the bound application | `supacloud --env <name> deploy` | Use current CLI/server and application delivery configuration; never fall back to standalone target or direct frontend activation commands |
 | Inspect current project binding | `supacloud status` | Read-only; run first |
 | Inspect selected project API/Auth/Studio origins | `supacloud project endpoints` | Uses the Management API's authoritative projection; do not reconstruct domains locally |
 | Enumerate projects or endpoint projections | `supacloud-admin project list` / `project list_endpoints` | Platform-wide read; never promote a project credential to Admin authority |
@@ -23,9 +24,6 @@ Load this reference when selecting a command surface or when a user asks an AI t
 | Inspect or back up a remote database | `supabase db_pull`, `migration_list`, `db_dump`, `gen_types` | Requires explicit PostgreSQL DSN; redact it |
 | Replay the release-canary fixture stage receipt | `release release_canary_fixture_stage_replay` | Dual-bind Management project context and that project's service-role application origin; accepts only the exact subject/request UUID pair and a strict idempotent receipt |
 | Disable a staged release-canary fixture | `release release_canary_fixture_disable_replay` | Uses the fixed disable RPC once, accepts idempotent false/true receipts, then queries the existing pending RPC with issuer/subject and requires authoritative JSON `false`; fixture binding comes from the strict disable receipt |
-| Rebind release scope manifest to upstream base commit | `release scope_rebind` | Local maintenance action; requires the exact `--environment_id`, updates only scopes bound to that environment, supports `--dry_run`/`--task`, and recalculates `scope_sha256` |
-| Inspect release scope manifest and git alignment | `release scope_inspect` | Local maintenance action; requires the exact `--environment_id`, rejects legacy or cross-environment scopes, returns canonical hash, and checks alignment with HEAD / origin/main |
-| Scaffold a new canonical release scope manifest | `release scope_create` | Local maintenance action; requires `--environment_id` and outputs a current-main-bound scope with sorted functions, migrations, and environment identity |
 | Preview/apply migrations remotely | `supabase push` | Always dry-run first; production needs explicit approval |
 | Mark proven-equivalent historical migrations as applied | `database baseline_migrations` | Dry-run, schema-equivalence proof, backup, explicit approval |
 | Inspect auth users or generate a controlled login link | `auth list_users`, `auth get_user`, `auth generate_link` | User reads are bounded; generation supports only `magiclink`, `recovery`, and `invite`, requires production confirmation, and returns only a validated action URL |
@@ -47,11 +45,11 @@ until a project-scoped context is resolved.
 - `auth`: provider/configuration plus bounded user lookup and production-confirmed `magiclink`, `recovery`, or `invite` generation. Search/email/redirect inputs and returned action URLs are bounded and validated before use.
 - `storage`: buckets and object-management workflows.
 - `edge_functions`: list, atomically read one active or deleted identity with `get_config`, read immutable source, deploy, activate, configure, and delete Edge Functions. For every mutation, pass the `activation_id` read from the same `list` or `get_config` snapshot as `--expected-activation-id`; use `legacy` only for a never-created or listed legacy Function, not for a deleted slug with a tombstone UUID. Deploy and activate actions also require the non-negative observed version as `--expected-active-version`; use `absent` for a never-created slug or a `get_config` tombstone. Version `0` is a legacy version token and cannot be used as a source or activation target.
-- `frontend`: list, build/deploy, domain, and deployment workflows.
+- `frontend`: hosting management, release inspection and operator rollback. Publishing uses `supacloud deploy`; `deploy_git`, `deploy_upload`, `redeploy`, `upload_release` and `activate_release` are removed.
 - `secrets`: project secret management; never print values after write.
 - `queue`, `task_events`, `diagnostics`: asynchronous workload operations and bounded diagnostics.
 - `gateway`: project route/config/rebuild operations.
-- `release`: local release scope maintenance (`scope_rebind`, `scope_inspect`, `scope_create`), verified backup/PostgREST lifecycle controls, plus production-confirmed, non-retried, strict release-canary fixture stage and disable replay actions. Scope maintenance is not a prerequisite for the normal `supacloud --env <name> deploy` flow.
+- `release`: explicit backup/PostgREST maintenance and release-canary replay diagnostics. Do not run these or generate release scopes as prerequisites for `supacloud --env <name> deploy`; the platform owns deployment orchestration.
 - `ai`: inspect or install this packaged Skill.
 
 ## Safe inspection pattern