@supacloud/cli 0.96.0 → 0.96.2

package/README.md

@@ -26,11 +26,15 @@ supacloud --env test deploy
 overwriting an existing project configuration. `env list` and `env check` are
 local-only, redact credentials, and provide stable JSON with `--json` for CI or
 AI tooling. The real `.env.supacloud.*` files are added to `.gitignore`.
-Fill in `SUPACLOUD_APPLICATION_ID` and the Management credentials in the
-selected profile, and configure the application's current delivery build.
-Standalone frontend deployment is no longer supported. Upgrade the CLI with
+Fill in the Management credentials and project/environment in the selected profile.
+Static frontends need only `frontend` build configuration; no application binding
+or backend delivery build is required. Set `SUPACLOUD_APPLICATION_ID` only for
+executable application delivery. Upgrade the CLI with
 `npm install -g @supacloud/cli@latest` and upgrade the SupaCloud server together.
 `deploy` checks the server protocol before building or uploading.
+Use `frontend.name` to select exactly one named site in each environment when
+deployment IDs differ. A missing or ambiguous name fails before upload; it never
+falls back to another site.
 
 ## Application Starter
 
@@ -645,7 +649,12 @@ FA-owned business features are documented in
 and `--dry_run` are removed. Put build settings in `supacloud.json`; use
 `app deploy-plan` for read-only review. Historical project-specific manifests
 and standalone Function targets must move to application delivery configuration.
-The CLI rejects them rather than falling back to a partial Web deployment.
+The CLI rejects them rather than silently falling back to a partial Web deployment.
+For an intentional Web-only release in a mixed repository, use
+`supacloud --env test deploy --assets_only`. This preserves historical manifests,
+Functions, schedules and migrations without invoking application compilation.
+Static publication reuses immutable archives, pre-upload CAS, mutation receipts
+and exact post-activation readback. It never retries a conflicting activation.
 
 The legacy `.env` fallback is unclassified and therefore does not enable the
 production confirmation gate. Production automation must select a `prod` or

package/dist/index.js

@@ -8767,7 +8767,7 @@ function outcomeUnknownGuidance(text) {
 }
 
 // src/shared/deployment-upgrade.ts
-var DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment is no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, bind application.id and application.environmentId in supacloud.json (or SUPACLOUD_APPLICATION_ID and SUPACLOUD_ENV), then run `supacloud deploy`. SupaCloud owns deployment planning and activation; do not retry with legacy commands.";
+var DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment commands are no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, configure frontend in supacloud.json for static assets, or application.id and application.environmentId for executable application delivery, then run `supacloud deploy`. Use `supacloud deploy --assets_only` to publish only Web assets in a mixed repository. SupaCloud owns activation; do not retry with legacy commands.";
 var removedFrontendActions = new Set([
   "deploy_git",
   "deploy_upload",
@@ -10925,12 +10925,157 @@ function parseDeploymentEvidence(value) {
   }
   return structuredClone(value);
 }
-// node_modules/@supacloud/delivery/src/application-promotion.ts
+// node_modules/@supacloud/delivery/src/delivery-tuple.ts
+var sha2563 = String2({ pattern: "^[a-f0-9]{64}$" });
+var commit = String2({ pattern: "^(?:[a-f0-9]{40}|[a-f0-9]{64})$" });
+var isoDate2 = String2({ minLength: 20, maxLength: 40 });
+var DELIVERY_TUPLE_SCHEMA = "supacloud.fa-delivery-tuple.v1";
+var FaDeliveryTupleSchema = _Object_({
+  schema: Literal(DELIVERY_TUPLE_SCHEMA),
+  customer: Literal("xigu-fa"),
+  fa_commit: commit,
+  cli: _Object_({
+    version: String2({ pattern: "^\\d+\\.\\d+\\.\\d+$" })
+  }, { additionalProperties: false }),
+  platform_commit: commit,
+  edge_runtime: _Object_({
+    version: String2({ minLength: 1, maxLength: 128 }),
+    artifact_sha256: sha2563
+  }, { additionalProperties: false }),
+  compatibility_window: _Object_({
+    contract_schema: String2({ minLength: 1, maxLength: 128 }),
+    starts_at: isoDate2,
+    ends_at: isoDate2,
+    old_client_supported: Boolean2(),
+    partial_deployment_supported: Boolean2()
+  }, { additionalProperties: false })
+}, { additionalProperties: false });
+// node_modules/@supacloud/delivery/src/contract-matrix.ts
 var closed6 = { additionalProperties: false };
+var sha2564 = String2({ pattern: "^[a-f0-9]{64}$" });
+var generation = Union([Literal("old"), Literal("new")]);
+var versions = _Object_({ old: sha2564, new: sha2564 }, closed6);
+var CONTRACT_MATRIX_SCHEMA = "supacloud.consumer-contract-matrix.v1";
+var FA_CONTRACT_SCENARIOS = [
+  "missing-display-field",
+  "missing-authority-field",
+  "added-field",
+  "legacy-envelope",
+  "lost-write-response",
+  "downgrade"
+];
+var ConsumerContractMatrixSchema = _Object_({
+  schema: Literal(CONTRACT_MATRIX_SCHEMA),
+  customer: Literal("xigu-fa"),
+  baseline_tuple_sha256: sha2564,
+  candidate_tuple_sha256: sha2564,
+  artifacts: _Object_({ frontend: versions, functions: versions, database: versions }, closed6),
+  cases: _Array_(_Object_({
+    frontend: generation,
+    functions: generation,
+    database: generation,
+    scenarios: _Array_(_Object_({
+      name: Enum(FA_CONTRACT_SCENARIOS),
+      expected: Union([Literal("compatible"), Literal("blocked-safely")])
+    }, closed6), { minItems: FA_CONTRACT_SCENARIOS.length, maxItems: FA_CONTRACT_SCENARIOS.length })
+  }, closed6), { minItems: 8, maxItems: 8 })
+}, closed6);
+// node_modules/@supacloud/delivery/src/fa-stability.ts
+var closed7 = { additionalProperties: false };
+var hash3 = String2({ pattern: "^[a-f0-9]{64}$" });
+var label = String2({ minLength: 1, maxLength: 256, pattern: "\\S" });
+var timestamp2 = String2({ minLength: 24, maxLength: 24 });
+var count = Integer({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER });
+var environment2 = Union([Literal("test"), Literal("production")]);
+var FA_REQUIRED_ACCEPTANCE = {
+  login: "real-browser",
+  permissions: "real-http",
+  upload: "real-http",
+  "async-task": "real-worker",
+  deploy: "real-http",
+  "database-migration": "real-database",
+  schedule: "real-worker",
+  rollback: "real-drill",
+  "error-policy": "real-http",
+  "alert-delivery": "real-drill"
+};
+var FA_BUSINESS_OPERATIONS = ["login", "permissions", "upload", "async-task", "report", "deploy"];
+var operation = Enum(FA_BUSINESS_OPERATIONS);
+var proof = _Object_({
+  path: String2({ pattern: "^[A-Za-z0-9_-][A-Za-z0-9_./-]{0,255}$" }),
+  sha256: hash3
+}, closed7);
+var FaBusinessObservationSchema = _Object_({
+  id: String2({ pattern: "^[A-Za-z0-9_-]{1,128}$" }),
+  tuple_sha256: hash3,
+  operation,
+  started_at: timestamp2,
+  finished_at: timestamp2,
+  outcome: Enum(["success", "failure", "timeout", "unknown"]),
+  attempts: Integer({ minimum: 1, maximum: 1000 }),
+  rollbacks: count
+}, closed7);
+var FaServiceObjectivesSchema = _Object_({
+  status: Literal("approved"),
+  owner: label,
+  approval_reference: label,
+  approved_at: timestamp2,
+  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+  environment: environment2,
+  alert_route: label,
+  window_hours: Number2({ exclusiveMinimum: 0, maximum: 8760 }),
+  max_evidence_age_hours: Number2({ exclusiveMinimum: 0, maximum: 168 }),
+  operations: _Array_(_Object_({
+    operation,
+    minimum_samples: Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),
+    availability_percent: Number2({ exclusiveMinimum: 0, maximum: 100 }),
+    p95_ms: Number2({ exclusiveMinimum: 0, maximum: Number.MAX_SAFE_INTEGER })
+  }, closed7), { minItems: FA_BUSINESS_OPERATIONS.length, maxItems: FA_BUSINESS_OPERATIONS.length })
+}, closed7);
+var FaStabilityEvidenceSchema = _Object_({
+  schema: Literal("supacloud.fa-stability-evidence.v1"),
+  environment: environment2,
+  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+  tuple_sha256: hash3,
+  matrix_sha256: hash3,
+  objectives_sha256: hash3,
+  recorded_at: timestamp2,
+  window_start: timestamp2,
+  window_end: timestamp2,
+  reviewed_by: label,
+  review_reference: label,
+  acceptance: _Array_(_Object_({
+    id: Enum(Object.keys(FA_REQUIRED_ACCEPTANCE)),
+    execution: Enum([
+      "real-browser",
+      "real-http",
+      "real-worker",
+      "real-database",
+      "real-drill",
+      "local-fake"
+    ]),
+    passed: Boolean2(),
+    measured_at: timestamp2,
+    proof
+  }, closed7), { minItems: 10, maxItems: 10 }),
+  matrix: _Array_(_Object_({
+    combination: label,
+    scenario: label,
+    outcome: Union([Literal("compatible"), Literal("blocked-safely")]),
+    execution: Union([Literal("real-http-and-database"), Literal("local-fake")]),
+    passed: Boolean2(),
+    measured_at: timestamp2,
+    proof
+  }, closed7), { minItems: 48, maxItems: 48 }),
+  observation: proof,
+  alert: _Object_({ route: label, acknowledged_by: label, delivered_at: timestamp2 }, closed7)
+}, closed7);
+// node_modules/@supacloud/delivery/src/application-promotion.ts
+var closed8 = { additionalProperties: false };
 var projectRef2 = String2({ pattern: "^[a-z0-9-]{1,20}$" });
-var sha2563 = ApplicationReleaseIdSchema;
+var sha2565 = ApplicationReleaseIdSchema;
 var nullableActivation2 = Union([ApplicationActivationIdSchema, Null()]);
-var nullableDigest = Union([sha2563, Null()]);
+var nullableDigest = Union([sha2565, Null()]);
 var observation = {
   activation_id: nullableActivation2,
   receipt_confirmed: Boolean2(),
@@ -10956,33 +11101,33 @@ var ApplicationPromotionPlanSchema = _Object_({
   project_ref: projectRef2,
   application_id: ApplicationIdSchema,
   environment_id: ApplicationIdSchema,
-  manifest_sha256: sha2563,
-  plan_sha256: sha2563,
+  manifest_sha256: sha2565,
+  plan_sha256: sha2565,
   source: _Object_({
     project_ref: projectRef2,
     environment_id: ApplicationIdSchema,
-    release_id: sha2563,
+    release_id: sha2565,
     ...observation
-  }, closed6),
+  }, closed8),
   target: _Object_({
-    candidate_release_id: sha2563,
-    current_release_id: Union([sha2563, Null()]),
+    candidate_release_id: sha2565,
+    current_release_id: Union([sha2565, Null()]),
     artifact_action: Union([Literal("materialize"), Literal("reuse")]),
     configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
     configuration: Union([ApplicationConfigurationViewSchema, Null()]),
     ...observation
-  }, closed6),
+  }, closed8),
   migrations: _Object_({
-    ledger_digest: sha2563,
+    ledger_digest: sha2565,
     ledger_compatible: Boolean2(),
     project_migrations_applied: Boolean2(),
     pending_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { maxItems: 4096, uniqueItems: true }),
     operator_provisioning_required: Boolean2()
-  }, closed6),
+  }, closed8),
   backup: _Object_({
     required: Boolean2(),
     confirmed: Literal(false)
-  }, closed6),
+  }, closed8),
   action: Union([Literal("promote"), Literal("no-op"), Literal("blocked")]),
   blockers: _Array_(Enum([...blocker]), {
     maxItems: blocker.length,
@@ -10991,7 +11136,7 @@ var ApplicationPromotionPlanSchema = _Object_({
   steps: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 8, uniqueItems: true }),
   execution_performed: Literal(false),
   data_recovery: Literal("separate-required")
-}, closed6);
+}, closed8);
 function applicationPromotionPlanDigest(value) {
   return digest(canonical(value));
 }
@@ -16350,6 +16495,39 @@ async function getFrontendRelease(http, projectRef, deploymentId, releaseId) {
   }
   return toolResponse({ project_ref: projectRef, deployment_id: deploymentId, release });
 }
+async function uploadFrontendRelease(http, projectRef, deploymentId, archivePath) {
+  const endpoint = releaseEndpoint(projectRef, deploymentId);
+  const archive = await verifiedArchive(archivePath);
+  let response;
+  try {
+    response = await http.postBinary(endpoint, {
+      stream: archiveStream(archive),
+      byteLength: archive.sizeBytes
+    }, {
+      contentType: FRONTEND_ARCHIVE_CONTENT_TYPE,
+      contentLength: archive.sizeBytes,
+      contentSha256: archive.sha256,
+      maxJsonBytes: RESPONSE_MAX_BYTES,
+      timeoutMs: UPLOAD_REQUEST_TIMEOUT_MS,
+      responseTimeoutMs: MUTATION_RESPONSE_TIMEOUT_MS
+    });
+  } finally {
+    await archive.handle.close();
+  }
+  const release = response.ok ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId: archive.sha256 }) : null;
+  if (!release) {
+    if (response.status >= 400 && response.status < 500 && response.status !== 408 && !response.transportError) {
+      return releaseFailure("frontend.upload_release", "HTTP_ERROR", response.status);
+    }
+    return uploadReadback(http, projectRef, deploymentId, archive.sha256, response.status);
+  }
+  const readback = await http.get(`${endpoint}/${release.release_id}`, { maxJsonBytes: RESPONSE_MAX_BYTES });
+  const verified = readback.ok ? releaseEnvelope(readback.data, { projectRef, deploymentId, releaseId: release.release_id }) : null;
+  if (!verified || verified.tree_sha256 !== release.tree_sha256) {
+    return releaseFailure("frontend.upload_release", "OUTCOME_UNKNOWN", readback.status);
+  }
+  return toolResponse({ project_ref: projectRef, deployment_id: deploymentId, release: verified });
+}
 async function uploadProjectWebRelease(http, projectRef, environmentId, deploymentId, archivePath) {
   const endpoint = `/v1/projects/${encodeURIComponent(projectRef)}/environments/${encodeURIComponent(environmentId)}/deployments/web-release?deployment_id=${encodeURIComponent(deploymentId)}`;
   const archive = await verifiedArchive(archivePath);
@@ -16404,6 +16582,16 @@ async function uploadProjectWebRelease(http, projectRef, environmentId, deployme
     await archive.handle.close();
   }
 }
+async function uploadReadback(http, projectRef, deploymentId, releaseId, uploadStatus) {
+  const response = await http.get(releasePath(projectRef, deploymentId, releaseId), {
+    maxJsonBytes: RESPONSE_MAX_BYTES
+  });
+  const release = response.ok ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId }) : null;
+  if (!release) {
+    return releaseFailure("frontend.upload_release", "OUTCOME_UNKNOWN", uploadStatus);
+  }
+  return toolResponse({ project_ref: projectRef, deployment_id: deploymentId, release });
+}
 function stableJson(candidate) {
   if (candidate === null || typeof candidate !== "object")
     return JSON.stringify(candidate);
@@ -16523,6 +16711,57 @@ async function getActiveFrontendRelease(http, projectRef, deploymentId) {
   const snapshot = await readActiveFrontendRelease(http, projectRef, deploymentId);
   return "failure" in snapshot ? snapshot.failure : toolResponse(snapshot.inventory);
 }
+async function publishFrontendRelease(http, projectRef, deploymentId, archivePath, expectedTreeSha256) {
+  const authority = await readActiveFrontendRelease(http, projectRef, deploymentId);
+  if ("failure" in authority)
+    return authority.failure;
+  const inventory = authority.inventory;
+  const current = inventory.releases[0];
+  if (current?.tree_sha256 === expectedTreeSha256) {
+    return toolResponse({
+      operation: "frontend.deploy",
+      project_ref: projectRef,
+      deployment_id: deploymentId,
+      active_release_id: inventory.active_release_id,
+      activation_id: inventory.active_activation_id,
+      release: current,
+      unchanged: true
+    });
+  }
+  const uploaded = await uploadFrontendRelease(http, projectRef, deploymentId, archivePath);
+  if (uploaded.isError)
+    return uploaded;
+  const value = JSON.parse(uploaded.content[0].text);
+  const envelope = value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  const candidate = envelope?.release;
+  const release = candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : null;
+  if (!release || release.tree_sha256 !== expectedTreeSha256 || typeof release.release_id !== "string" || !RELEASE_ID_PATTERN.test(release.release_id)) {
+    return releaseFailure("frontend.deploy", "INVALID_RESPONSE", 200);
+  }
+  const mutationId = crypto.randomUUID();
+  const activated = await activateFrontendRelease(http, {
+    projectRef,
+    deploymentId,
+    releaseId: release.release_id,
+    mutationId,
+    expectedActiveReleaseId: inventory.active_release_id ?? "absent",
+    expectedActivationId: inventory.active_activation_id ?? "absent"
+  });
+  const activatedPayload = JSON.parse(activated.content[0].text);
+  const active = activatedPayload.release;
+  const treeMismatch = !activated.isError && (!active || typeof active !== "object" || !("tree_sha256" in active) || active.tree_sha256 !== expectedTreeSha256);
+  return {
+    ...toolResponse({
+      ...treeMismatch ? { ok: false, error: { code: "OUTCOME_UNKNOWN", http_status: 200 } } : activatedPayload,
+      operation: "frontend.deploy",
+      mutation_id: mutationId,
+      target_release_id: release.release_id,
+      previous_release_id: inventory.active_release_id,
+      previous_activation_id: inventory.active_activation_id
+    }),
+    ...activated.isError || treeMismatch ? { isError: true } : {}
+  };
+}
 async function rollbackFrontendRelease(http, projectRef, deploymentId, releaseId) {
   if (releaseId !== undefined && !RELEASE_ID_PATTERN.test(releaseId)) {
     throw new Error("'release_id' must be a SHA-256 digest");
@@ -17097,12 +17336,12 @@ async function fetchMutationStatus(http, ref, mutationId) {
 }
 
 // src/shared/tools/application-workflow-schemas.ts
-var closed7 = { additionalProperties: false };
+var closed9 = { additionalProperties: false };
 var ref5 = String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" });
 var uuid = ApplicationActivationIdSchema2;
 var nullableUuid = Union([uuid, Null()]);
 var nullableDigest2 = Union([ApplicationReleaseIdSchema2, Null()]);
-var timestamp2 = String2({ pattern: "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$" });
+var timestamp3 = String2({ pattern: "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$" });
 var scope2 = { project_ref: ref5, application_id: ApplicationIdSchema2, environment_id: ApplicationIdSchema2 };
 var ApplicationPromotionResultSchema = _Object_({
   ...scope2,
@@ -17111,7 +17350,7 @@ var ApplicationPromotionResultSchema = _Object_({
   plan_sha256: ApplicationReleaseIdSchema2,
   action: Literal("promote"),
   replayed: Boolean2()
-}, closed7);
+}, closed9);
 var ApplicationPromotionStatusSchema = _Object_({
   ...scope2,
   mutation: Unknown(),
@@ -17130,8 +17369,8 @@ var ApplicationPromotionStatusSchema = _Object_({
     configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]),
     backup_id: Union([String2({ pattern: "^logical-full_[a-z0-9-]{1,20}_[a-f0-9]{32}$" }), Null()]),
     data_recovery: Literal("separate-required")
-  }, closed7)
-}, closed7);
+  }, closed9)
+}, closed9);
 var phase = Union([Literal("pending"), Literal("ready"), Literal("failed"), Literal("cleaned")]);
 var previewId = String2({ pattern: "^[a-f0-9-]{8,64}$" });
 var name = String2({ minLength: 1, maxLength: 256 });
@@ -17141,7 +17380,7 @@ var ApplicationPreviewReceiptSchema2 = _Object_({
   ...scope2,
   preview_id: previewId,
   release_id: ApplicationReleaseIdSchema2,
-  expires_at: Union([timestamp2, Null()]),
+  expires_at: Union([timestamp3, Null()]),
   status: Union([
     Literal("planned"),
     Literal("provisioning"),
@@ -17150,35 +17389,35 @@ var ApplicationPreviewReceiptSchema2 = _Object_({
     Literal("cleaned")
   ]),
   resources: _Object_({
-    build_artifact: _Object_({ status: phase, release_id: ApplicationReleaseIdSchema2 }, closed7),
+    build_artifact: _Object_({ status: phase, release_id: ApplicationReleaseIdSchema2 }, closed9),
     database_branch: _Object_({
       status: phase,
       branch_ref: ref5,
       data_mode: Union([Literal("schema_only"), Literal("full_clone")])
-    }, closed7),
-    queue_namespace: _Object_({ status: phase, namespace: name }, closed7),
-    storage_namespace: _Object_({ status: phase, namespace: name }, closed7),
-    test_secret: _Object_({ status: phase, name, value_issued: Literal(false) }, closed7),
-    configuration_revision: _Object_({ status: phase, configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]) }, closed7),
-    application_activation: _Object_({ status: phase, activation_id: nullableUuid }, closed7),
-    smoke_test: _Object_({ status: phase, checks, passed: checks, failed: checks }, closed7)
-  }, closed7),
+    }, closed9),
+    queue_namespace: _Object_({ status: phase, namespace: name }, closed9),
+    storage_namespace: _Object_({ status: phase, namespace: name }, closed9),
+    test_secret: _Object_({ status: phase, name, value_issued: Literal(false) }, closed9),
+    configuration_revision: _Object_({ status: phase, configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]) }, closed9),
+    application_activation: _Object_({ status: phase, activation_id: nullableUuid }, closed9),
+    smoke_test: _Object_({ status: phase, checks, passed: checks, failed: checks }, closed9)
+  }, closed9),
   cleanup: _Object_({
     required: Boolean2(),
     completed: Boolean2(),
     error: Union([String2({ pattern: "^[A-Z][A-Z0-9_]{0,63}$" }), Null()])
-  }, closed7),
+  }, closed9),
   branch_name: Optional(String2({ minLength: 1, maxLength: 80 })),
   queue_name: Optional(name),
   test_secret_name: Optional(name),
   source_configuration_id: Optional(Union([ApplicationConfigurationIdSchema2, Null()])),
-  created_at: Optional(timestamp2),
-  updated_at: Optional(timestamp2)
-}, closed7);
+  created_at: Optional(timestamp3),
+  updated_at: Optional(timestamp3)
+}, closed9);
 var previewListSchema = _Object_({
   ...scope2,
   previews: _Array_(ApplicationPreviewReceiptSchema2, { maxItems: 1000 })
-}, closed7);
+}, closed9);
 function assertScope(value, identity) {
   if (value.project_ref !== identity.project_ref || value.application_id !== identity.application_id || value.environment_id !== identity.environment_id)
     throw new Error("Application workflow scope mismatch");
@@ -17372,14 +17611,14 @@ var actionFields = {
   reconcile_preview: ["preview_id"],
   cleanup_preview: ["preview_id"]
 };
-function timestamp3(value) {
+function timestamp4(value) {
   return Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
 }
 function receipt(value, identity) {
   if (!Check2(receiptSchema, value) || value.project_ref !== identity.ref || value.application_id !== identity.id || value.environment_id !== identity.environment || identity.previewId && value.preview_id !== identity.previewId || value.resources.build_artifact.release_id !== value.release_id || value.resources.storage_namespace.namespace !== value.resources.database_branch.branch_ref) {
     throw new Error("Invalid preview receipt");
   }
-  if (value.expires_at !== undefined && value.expires_at !== null && !timestamp3(value.expires_at) || value.created_at !== undefined && !timestamp3(value.created_at) || value.updated_at !== undefined && !timestamp3(value.updated_at) || value.expires_at !== undefined && value.expires_at !== null && value.created_at !== undefined && !Check2(ttlSecondsSchema, (Date.parse(value.expires_at) - Date.parse(value.created_at)) / 1000)) {
+  if (value.expires_at !== undefined && value.expires_at !== null && !timestamp4(value.expires_at) || value.created_at !== undefined && !timestamp4(value.created_at) || value.updated_at !== undefined && !timestamp4(value.updated_at) || value.expires_at !== undefined && value.expires_at !== null && value.created_at !== undefined && !Check2(ttlSecondsSchema, (Date.parse(value.expires_at) - Date.parse(value.created_at)) / 1000)) {
     throw new Error("Invalid preview expiry");
   }
   if (value.status === "ready") {
@@ -21106,22 +21345,22 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.46.0"
+      version: "0.46.1"
     },
     app: {
-      version: "0.26.1",
+      version: "0.27.0",
       dependencies: {
         rxjs: "7.8.2"
       }
     },
     elysia: {
-      version: "0.29.2"
+      version: "0.30.0"
     },
     commands: {
       version: "0.9.2"
     },
     contracts: {
-      version: "0.8.1"
+      version: "0.9.0"
     },
     db: {
       version: "0.17.0",
@@ -26168,7 +26407,7 @@ import {
   reverseDatabase
 } from "@supacloud/db";
 import { parseDatabaseSourcesConfig } from "@supacloud/db/source-contracts";
-var hash3 = (content) => createHash7("sha256").update(content).digest("hex");
+var hash4 = (content) => createHash7("sha256").update(content).digest("hex");
 var result = (value, isError = false) => ({
   isError,
   content: [{ type: "text", text: JSON.stringify(value, null, 2) }]
@@ -26299,7 +26538,7 @@ async function initializeCandidate(stage, majorVersion = 17) {
   await mkdir6(join14(stage, "supabase/migrations"), { recursive: true });
   await mkdir6(join14(stage, "supabase/schemas"), { recursive: true });
   await writeFile5(join14(stage, "supabase/config.toml"), [
-    `project_id = "supacloud-candidate-${hash3(stage).slice(0, 12)}"`,
+    `project_id = "supacloud-candidate-${hash4(stage).slice(0, 12)}"`,
     "[db]",
     `major_version = ${majorVersion}`,
     "[db.migrations]",
@@ -26427,7 +26666,7 @@ async function migrations(root, path) {
   const files = [];
   for (const file of names) {
     const text = await readFile5(await projectPath2(root, `${path}/${file}`), "utf8");
-    files.push({ file, text, sha256: hash3(text) });
+    files.push({ file, text, sha256: hash4(text) });
   }
   return { dir, files };
 }
@@ -26457,7 +26696,7 @@ async function migrationAction(args, root, options) {
       files: input.files.map(({ file, sha256 }) => ({ file, sha256 })),
       dryRun
     };
-    const digest = hash3(JSON.stringify(report));
+    const digest = hash4(JSON.stringify(report));
     if (dryRun.isError)
       return result({ ...report, ok: false, digest, executionPerformed: false }, true);
     if (args.action === "plan")
@@ -28074,7 +28313,7 @@ async function requireProjectDeploymentProtocol(http, projectRef, environmentId)
     throw new Error("DEPLOYMENT_PROTOCOL_MISMATCH: Upgrade the SupaCloud server and CLI together (`npm install -g @supacloud/cli@latest`), then retry `supacloud deploy`. No upload or deployment was attempted; legacy endpoints will not be used.");
   }
 }
-var operation = "applications.project_deploy";
+var operation2 = "applications.project_deploy";
 var scopeSchema = _Object_({
   project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
   application_id: ApplicationIdSchema,
@@ -28123,7 +28362,7 @@ async function runProjectDeployment(http, args) {
     ...args.web_release === undefined ? {} : { web_release: args.web_release }
   };
   if (!Check2(scopeSchema, scope) || !Check2(ApplicationDeployRequestSchema, request) || request.configuration_id !== undefined && request.configuration_write !== undefined && request.configuration_id !== request.configuration_write.configuration_id) {
-    return releaseControlFailure(operation, "INVALID_RESPONSE", null);
+    return releaseControlFailure(operation2, "INVALID_RESPONSE", null);
   }
   const expected = { ...scope, request };
   const identity = {
@@ -28141,13 +28380,13 @@ async function runProjectDeployment(http, args) {
   }, { timeoutMs: 120000, maxJsonBytes: 131072, responseTimeoutMs: 30000 });
   if (result.ok && result.status === 200) {
     try {
-      return releaseControlSuccess(operation, {
+      return releaseControlSuccess(operation2, {
         ...responseReceipt(result.data, expected),
         deployment_id: mutation_id
       });
     } catch {}
   } else if (!result.ok && !result.transportError && !result.responseReadError && result.status < 500 && result.status !== 408) {
-    return releaseControlMutationFailure(operation, result, identity);
+    return releaseControlMutationFailure(operation2, result, identity);
   }
   const observed = await http.get(`${endpoint}/${encodeURIComponent(mutation_id)}`, {
     retry: false,
@@ -28161,14 +28400,14 @@ async function runProjectDeployment(http, args) {
     if (state.deployment_id !== mutation_id || state.project_ref !== scope.project_ref || state.application_id !== scope.application_id || state.environment_id !== scope.environment_id || state.status !== "succeeded" || state.phase !== "verifying")
       throw new Error;
     const receipt = parseApplicationDeployResult(state.receipt, expected);
-    return releaseControlSuccess(operation, {
+    return releaseControlSuccess(operation2, {
       ...receipt,
       deployment_id: mutation_id,
       replayed: true,
       execution_performed: false
     });
   } catch {
-    return releaseControlFailure(operation, "OUTCOME_UNKNOWN", result.transportError ? null : result.status, identity);
+    return releaseControlFailure(operation2, "OUTCOME_UNKNOWN", result.transportError ? null : result.status, identity);
   }
 }
 
@@ -28186,6 +28425,7 @@ var deployToolSchema = {
   ref: optional(String2(), "Project ref (defaults to the linked project)"),
   cwd: optional(String2(), "Project directory (default: current directory)"),
   skip_build: optional(Boolean2(), "Use an existing output directory without building"),
+  assets_only: optional(Boolean2(), "Publish only configured static assets; leave backend Functions, schedules and migrations unchanged"),
   json: optional(Boolean2(), "Print only the final JSON result")
 };
 function record4(candidate) {
@@ -28280,6 +28520,7 @@ function deployTargetConfig(candidate, name) {
     type: value.type,
     root: optionalText(value.root, `targets.${name}.root`),
     id: optionalText(value.id, `targets.${name}.id`),
+    name: optionalText(value.name, `targets.${name}.name`),
     slug: optionalText(value.slug, `targets.${name}.slug`),
     buildCommand: optionalText(value.buildCommand, `targets.${name}.buildCommand`),
     outputDirectory: optionalText(value.outputDirectory, `targets.${name}.outputDirectory`),
@@ -28330,6 +28571,7 @@ async function readDeployConfig(configRoot) {
     targets: targetValues ? Object.fromEntries(Object.entries(targetValues).map(([name, value]) => [name, deployTargetConfig(value, name)])) : undefined,
     frontend: frontend ? {
       id: optionalText(frontend.id, "frontend.id"),
+      name: optionalText(frontend.name, "frontend.name"),
       root: optionalText(frontend.root, "frontend.root"),
       buildCommand: optionalText(frontend.buildCommand, "frontend.buildCommand"),
       outputDirectory: optionalText(frontend.outputDirectory, "frontend.outputDirectory"),
@@ -28392,13 +28634,22 @@ function deploymentList(candidate) {
     throw new Error("Invalid frontend deployment list response");
   return values.map(frontendDeployment);
 }
-function selectDeployment(deployments, requestedId, projectName) {
+function selectDeployment(deployments, requestedId, projectName, requestedName) {
   if (requestedId) {
     const selected = deployments.find((deployment) => deployment.id === requestedId);
     if (!selected)
       throw new Error(`Frontend deployment '${requestedId}' was not found`);
+    if (requestedName && selected.name !== requestedName) {
+      throw new Error(`Frontend deployment '${requestedId}' does not match name '${requestedName}'`);
+    }
     return selected;
   }
+  if (requestedName) {
+    const matches = deployments.filter((deployment) => deployment.name === requestedName);
+    if (matches.length !== 1)
+      throw new Error(`Expected exactly one frontend deployment named '${requestedName}'`);
+    return matches[0];
+  }
   if (deployments.length === 1)
     return deployments[0];
   if (projectName) {
@@ -28416,6 +28667,7 @@ function selectFrontendTarget(configRoot, config) {
     type: "frontend",
     root: config.frontend?.root,
     id: config.frontend?.id,
+    name: config.frontend?.name,
     buildCommand: config.frontend?.buildCommand,
     outputDirectory: config.frontend?.outputDirectory,
     buildEnv: config.frontend?.buildEnv
@@ -28580,7 +28832,7 @@ function payload(response) {
     throw new Error("Deployment operation returned an invalid response");
   return parsed;
 }
-async function stageApplicationWebRelease(http, projectRef, environmentId, configRoot, skipBuild, json, environmentVariables) {
+async function stageApplicationWebRelease(http, projectRef, environmentId, configRoot, skipBuild, json, environmentVariables, assetsOnly = false) {
   const target = selectFrontendTarget(configRoot, await readDeployConfig(configRoot));
   if (!target)
     return null;
@@ -28593,7 +28845,7 @@ async function stageApplicationWebRelease(http, projectRef, environmentId, confi
   const listResponse = await http.get(`/v1/projects/${encodeURIComponent(projectRef)}/frontend/deployments`);
   if (!listResponse.ok)
     throw new Error(`Failed to list frontend deployments (HTTP ${listResponse.status})`);
-  const selected = selectDeployment(deploymentList(listResponse.data), requestedId, await packageName(projectDirectory));
+  const selected = selectDeployment(deploymentList(listResponse.data), requestedId, await packageName(projectDirectory), target.config.name);
   const configuredBuildCommand = String(target.config.buildCommand || selected.buildCommand || "").trim();
   const buildCommand = configuredBuildCommand || (skipBuild ? "" : await defaultBuildCommand(projectDirectory, configRoot));
   const configuredOutput = String(target.config.outputDirectory || "").trim();
@@ -28606,6 +28858,9 @@ async function stageApplicationWebRelease(http, projectRef, environmentId, confi
   }
   const archive = await createFrontendArchive(outputDirectory);
   try {
+    if (assetsOnly) {
+      return { result: await publishFrontendRelease(http, projectRef, selected.id, archive.archivePath, archive.treeSha256) };
+    }
     const uploaded = payload(await uploadProjectWebRelease(http, projectRef, environmentId, selected.id, archive.archivePath));
     const release = record4(uploaded.release);
     const releaseId = requiredString(release?.release_id, "release.release_id");
@@ -28635,7 +28890,23 @@ function registerDeployTools(server, http, options = {}) {
       ...config.application,
       environmentId: options.environment || config.application.environmentId
     } : undefined;
-    if (await hasProjectReleaseManifest(configRoot)) {
+    const legacyManifest = await hasProjectReleaseManifest(configRoot);
+    const assetsOnly = args.assets_only === true || !application?.id && selectFrontendTarget(configRoot, config) !== null && !legacyManifest && !Object.values(config.targets ?? {}).some((target) => target.type === "edge_function");
+    if (assetsOnly) {
+      if (!selectFrontendTarget(configRoot, config)) {
+        throw new Error("Static asset deployment requires a frontend configuration in supacloud.json");
+      }
+      const environmentId = options.environment?.trim() || application?.environmentId?.trim();
+      if (!environmentId || !Check2(ApplicationIdSchema, environmentId)) {
+        throw new Error("Static asset deployment requires SUPACLOUD_ENV");
+      }
+      await requireProjectDeploymentProtocol(http, projectRef, environmentId);
+      const staged = await stageApplicationWebRelease(http, projectRef, environmentId, configRoot, args.skip_build === true, args.json === true, options.environmentVariables, true);
+      if (!staged?.result)
+        throw new Error("Static asset deployment did not produce a receipt");
+      return staged.result;
+    }
+    if (legacyManifest) {
       throw new Error(`${DEPLOYMENT_UPGRADE} Replace deploy-manifest.json with the current application delivery configuration; no remote mutation was performed.`);
     }
     if (application?.id) {
@@ -28963,7 +29234,7 @@ var TEST_PROFILE = [
   "SUPACLOUD_API_URL=https://management.test.example.com",
   "SUPACLOUD_API_TOKEN=<test-management-api-token>",
   "SUPACLOUD_PROJECT_REF=<test-project-ref>",
-  "SUPACLOUD_APPLICATION_ID=<application-id>",
+  "# Optional for executable application delivery: SUPACLOUD_APPLICATION_ID=<application-id>",
   ""
 ].join(`
 `);
@@ -28972,7 +29243,7 @@ var PRODUCTION_PROFILE = [
   "SUPACLOUD_API_URL=https://management.example.com",
   "SUPACLOUD_API_TOKEN=<production-management-api-token>",
   "SUPACLOUD_PROJECT_REF=<production-project-ref>",
-  "SUPACLOUD_APPLICATION_ID=<application-id>",
+  "# Optional for executable application delivery: SUPACLOUD_APPLICATION_ID=<application-id>",
   ""
 ].join(`
 `);
@@ -29096,7 +29367,7 @@ async function initializeProject(request, options) {
     },
     next: [
       "cp .env.supacloud.test.example .env.supacloud.test",
-      "Set SUPACLOUD_APPLICATION_ID to the application's ID and configure its current SupaCloud delivery build.",
+      "Configure frontend assets; set SUPACLOUD_APPLICATION_ID only for executable application delivery.",
       "supacloud env check",
       "supacloud --env test deploy"
     ]
@@ -29144,12 +29415,12 @@ function statusMissing(context) {
   }
   return ["SUPACLOUD_API_URL", "SUPACLOUD_API_TOKEN", "SUPACLOUD_PROJECT_REF"];
 }
-function deployMissing(context, application) {
+function deployMissing(context, application, hasFrontend = false) {
   const missing = statusMissing(context);
   if (context.credentialScope !== "management") {
     return [...missing, "Management API context"];
   }
-  if (!Check2(ApplicationIdSchema, context.applicationId || application?.id)) {
+  if (!(hasFrontend && !context.applicationId && !application) && !Check2(ApplicationIdSchema, context.applicationId || application?.id)) {
     missing.push("valid SUPACLOUD_APPLICATION_ID or supacloud.json application.id");
   }
   if (!Check2(ApplicationIdSchema, context.applicationEnvironmentId || application?.environmentId)) {
@@ -29169,7 +29440,8 @@ async function inspectProfile(profile) {
       throw error;
     });
     const config = record5(JSON.parse(configText));
-    const deploy = deployMissing(context, record5(config?.application));
+    const hasFrontend = record5(config?.frontend) !== null || Object.values(record5(config?.targets) ?? {}).some((target) => record5(target)?.type === "frontend");
+    const deploy = deployMissing(context, record5(config?.application), hasFrontend);
     return {
       name: profile.name,
       path: profile.path,
@@ -29265,7 +29537,7 @@ function registerDeveloperExperienceTools(server, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.96.0",
+  version: "0.96.2",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -29317,14 +29589,14 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.46.0",
-    "@supacloud/delivery": "0.17.0",
+    "@supacloud/compiler": "^0.46.1",
+    "@supacloud/delivery": "0.18.0",
     "@supacloud/db": "0.17.0",
     typebox: "1.3.36"
   },
   overrides: {
-    "@supacloud/contracts": "0.8.1",
-    "@supacloud/delivery": "0.17.0",
+    "@supacloud/contracts": "0.9.0",
+    "@supacloud/delivery": "0.18.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   devDependencies: {

package/dist/shared/deployment-upgrade.d.ts

@@ -1,2 +1,2 @@
-export declare const DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment is no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, bind application.id and application.environmentId in supacloud.json (or SUPACLOUD_APPLICATION_ID and SUPACLOUD_ENV), then run `supacloud deploy`. SupaCloud owns deployment planning and activation; do not retry with legacy commands.";
+export declare const DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment commands are no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, configure frontend in supacloud.json for static assets, or application.id and application.environmentId for executable application delivery, then run `supacloud deploy`. Use `supacloud deploy --assets_only` to publish only Web assets in a mixed repository. SupaCloud owns activation; do not retry with legacy commands.";
 export declare function assertCurrentDeploymentInput(tool: string, input: unknown): void;

package/dist/shared/tools/deploy-tools.d.ts

@@ -26,6 +26,7 @@ export declare const deployToolSchema: {
     ref: Type.TOptional<Type.TString>;
     cwd: Type.TOptional<Type.TString>;
     skip_build: Type.TOptional<Type.TBoolean>;
+    assets_only: Type.TOptional<Type.TBoolean>;
     json: Type.TOptional<Type.TBoolean>;
 };
 export declare function findDeployConfigRoot(startDirectory: string, environmentName?: string): Promise<string>;

package/dist/shared/tools/developer-experience-tools.d.ts

@@ -15,7 +15,7 @@ export declare const environmentToolSchema: ToolSchema;
 declare function outputDirectoryFor(manifest: PackageManifest): string;
 declare function profileNameFromFile(name: string): string | null;
 declare function statusMissing(context: ResolvedContext): string[];
-declare function deployMissing(context: ResolvedContext, application?: Record<string, unknown> | null): string[];
+declare function deployMissing(context: ResolvedContext, application?: Record<string, unknown> | null, hasFrontend?: boolean): string[];
 export declare function registerDeveloperExperienceTools(server: ToolServer, options?: DeveloperExperienceOptions): void;
 export declare const __internal: {
     outputDirectoryFor: typeof outputDirectoryFor;

package/dist/shared/tools/frontend-release-control.d.ts

@@ -46,6 +46,7 @@ export declare function uploadProjectWebRelease(http: FrontendReleaseHttp, proje
 export declare function uploadFrontendSource(http: FrontendReleaseHttp, projectRef: string, deploymentId: string, archivePath: string): Promise<ToolResponse>;
 export declare function getActiveFrontendRelease(http: FrontendReleaseHttp, projectRef: string, deploymentId: string): Promise<ToolResponse>;
 export declare function readFrontendReleaseAuthority(http: FrontendReleaseHttp, projectRef: string, deploymentId: string): Promise<ToolResponse>;
+export declare function publishFrontendRelease(http: FrontendReleaseHttp, projectRef: string, deploymentId: string, archivePath: string, expectedTreeSha256: string): Promise<ToolResponse>;
 export declare function rollbackFrontendRelease(http: FrontendReleaseHttp, projectRef: string, deploymentId: string, releaseId?: string): Promise<ToolResponse>;
 export declare function activateFrontendRelease(http: FrontendReleaseHttp, input: {
     projectRef: string;

package/dist/tool-runtime.js

@@ -131,7 +131,7 @@ import { Type as Type2 } from "typebox";
 import { Value as Value2 } from "typebox/value";
 
 // src/shared/deployment-upgrade.ts
-var DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment is no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, bind application.id and application.environmentId in supacloud.json (or SUPACLOUD_APPLICATION_ID and SUPACLOUD_ENV), then run `supacloud deploy`. SupaCloud owns deployment planning and activation; do not retry with legacy commands.";
+var DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment commands are no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, configure frontend in supacloud.json for static assets, or application.id and application.environmentId for executable application delivery, then run `supacloud deploy`. Use `supacloud deploy --assets_only` to publish only Web assets in a mixed repository. SupaCloud owns activation; do not retry with legacy commands.";
 var removedFrontendActions = new Set([
   "deploy_git",
   "deploy_upload",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.96.0",
+  "version": "0.96.2",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,14 +52,14 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@supacloud/compiler": "^0.46.0",
-    "@supacloud/delivery": "0.17.0",
+    "@supacloud/compiler": "^0.46.1",
+    "@supacloud/delivery": "0.18.0",
     "@supacloud/db": "0.17.0",
     "typebox": "1.3.36"
   },
   "overrides": {
-    "@supacloud/contracts": "0.8.1",
-    "@supacloud/delivery": "0.17.0",
+    "@supacloud/contracts": "0.9.0",
+    "@supacloud/delivery": "0.18.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   "devDependencies": {