@supacloud/cli 0.98.0 → 0.101.0

package/README.md

@@ -659,12 +659,19 @@ FA-owned business features are documented in
 
 `deploy --target`, `--id`, `--build_command`, `--output_dir`, `--plan`, `--diff`
 and `--dry_run` are removed. Put build settings in `supacloud.json`; use
-`app deploy-plan` for read-only review. Historical project-specific manifests
-and standalone Function targets must move to application delivery configuration.
-The CLI rejects them rather than silently falling back to a partial Web deployment.
-For an intentional Web-only release in a mixed repository, use
-`supacloud --env test deploy --assets_only`. This preserves historical manifests,
-Functions, schedules and migrations without invoking application compilation.
+`app deploy-plan` for read-only review. With a frontend configured, `supacloud deploy`
+publishes only its static assets, even in a mixed repository. `--assets_only`
+remains an explicit alias. This preserves historical manifests, Functions,
+Storage, schedules and migrations without invoking application compilation.
+Use `supacloud --env test deploy --backend` to publish the configured Application
+independently; it never builds or uploads Web. Unsupported historical backend
+manifests and standalone Function targets still fail closed on that Application path.
+
+Application deployments return `accepted` after durable queue insertion, not a
+successful activation. Inspect the receipt with the read-only
+`supacloud --env test deploy --status <deployment-id>`. Queue delivery survives
+restart; interrupted side effects require reconciliation rather than blind retry.
+
 Static publication reuses immutable archives, pre-upload CAS, mutation receipts
 and exact post-activation readback. It never retries a conflicting activation.
 

package/dist/index.js

@@ -3177,23 +3177,22 @@ function InstanceKeys(value) {
 function IsIEEE754(value) {
   return typeof value === "number";
 }
-var ByteMarker;
-(function(ByteMarker) {
-  ByteMarker[ByteMarker["Array"] = 0] = "Array";
-  ByteMarker[ByteMarker["BigInt"] = 1] = "BigInt";
-  ByteMarker[ByteMarker["Boolean"] = 2] = "Boolean";
-  ByteMarker[ByteMarker["Date"] = 3] = "Date";
-  ByteMarker[ByteMarker["Constructor"] = 4] = "Constructor";
-  ByteMarker[ByteMarker["Function"] = 5] = "Function";
-  ByteMarker[ByteMarker["Null"] = 6] = "Null";
-  ByteMarker[ByteMarker["Number"] = 7] = "Number";
-  ByteMarker[ByteMarker["Object"] = 8] = "Object";
-  ByteMarker[ByteMarker["RegExp"] = 9] = "RegExp";
-  ByteMarker[ByteMarker["String"] = 10] = "String";
-  ByteMarker[ByteMarker["Symbol"] = 11] = "Symbol";
-  ByteMarker[ByteMarker["TypeArray"] = 12] = "TypeArray";
-  ByteMarker[ByteMarker["Undefined"] = 13] = "Undefined";
-})(ByteMarker || (ByteMarker = {}));
+var ByteMarker = {
+  Array: 0,
+  BigInt: 1,
+  Boolean: 2,
+  Date: 3,
+  Constructor: 4,
+  Function: 5,
+  Null: 6,
+  Number: 7,
+  Object: 8,
+  RegExp: 9,
+  String: 10,
+  Symbol: 11,
+  TypeArray: 12,
+  Undefined: 13
+};
 var Accumulator = BigInt("14695981039346656037");
 var [Prime, Size] = [BigInt("1099511628211"), BigInt("18446744073709551616")];
 var Bytes = Array.from({ length: 256 }).map((_, i) => BigInt(i));
@@ -8786,7 +8785,7 @@ function outcomeUnknownGuidance(text) {
 }
 
 // src/shared/deployment-upgrade.ts
-var DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment commands are no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, configure frontend in supacloud.json for static assets, or application.id and application.environmentId for executable application delivery, then run `supacloud deploy`. Use `supacloud deploy --assets_only` to publish only Web assets in a mixed repository. SupaCloud owns activation; do not retry with legacy commands.";
+var DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment commands are no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, configure frontend in supacloud.json for static assets, or application.id and application.environmentId for executable application delivery, then run `supacloud deploy`. With a frontend configured, deploy publishes only Web assets; use `supacloud deploy --backend` for the application backend. `supacloud deploy --assets_only` remains an explicit Web-only option. SupaCloud owns activation; do not retry with legacy commands.";
 var removedFrontendActions = new Set([
   "deploy_git",
   "deploy_upload",
@@ -9339,6 +9338,8 @@ function declaredMode(moduleName, action) {
   return;
 }
 function executionMode(moduleName, action, args) {
+  if (moduleName === "deploy" && typeof args.status === "string")
+    return "read";
   if (moduleName === "deploy" && (args.dry_run === true || args.plan === true || args.diff === true))
     return "read";
   if (moduleName === "database" && ["push_migrations", "baseline_migrations"].includes(action) && args.dry_run === true)
@@ -15194,7 +15195,7 @@ function scaffoldFiles(framework, slug) {
       "package.json": JSON.stringify({
         private: true,
         type: "module",
-        dependencies: { elysia: "2.0.0-beta.21" }
+        dependencies: { elysia: "2.0.0-beta.32" }
       }, null, 2) + `
 `,
       "index.ts": `import { Elysia } from "elysia";
@@ -16763,7 +16764,7 @@ async function getFrontendRelease(http, projectRef, deploymentId, releaseId) {
   }
   return toolResponse({ project_ref: projectRef, deployment_id: deploymentId, release });
 }
-async function uploadFrontendRelease(http, projectRef, deploymentId, archivePath) {
+async function uploadFrontendReleaseWithReadback(http, projectRef, deploymentId, archivePath, verifyReadback) {
   const endpoint = releaseEndpoint(projectRef, deploymentId);
   const archive = await verifiedArchive(archivePath);
   let response;
@@ -16782,13 +16783,15 @@ async function uploadFrontendRelease(http, projectRef, deploymentId, archivePath
   } finally {
     await archive.handle.close();
   }
-  const release = response.ok ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId: archive.sha256 }) : null;
+  const release = response.ok && (response.status === 200 || response.status === 201) ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId: archive.sha256 }) : null;
   if (!release) {
     if (response.status >= 400 && response.status < 500 && response.status !== 408 && !response.transportError) {
       return releaseFailure("frontend.upload_release", "HTTP_ERROR", response.status);
     }
     return uploadReadback(http, projectRef, deploymentId, archive.sha256, response.status);
   }
+  if (!verifyReadback)
+    return toolResponse({ project_ref: projectRef, deployment_id: deploymentId, release });
   const readback = await http.get(`${endpoint}/${release.release_id}`, { maxJsonBytes: RESPONSE_MAX_BYTES });
   const verified = readback.ok ? releaseEnvelope(readback.data, { projectRef, deploymentId, releaseId: release.release_id }) : null;
   if (!verified || verified.tree_sha256 !== release.tree_sha256) {
@@ -16796,65 +16799,11 @@ async function uploadFrontendRelease(http, projectRef, deploymentId, archivePath
   }
   return toolResponse({ project_ref: projectRef, deployment_id: deploymentId, release: verified });
 }
-async function uploadProjectWebRelease(http, projectRef, environmentId, deploymentId, archivePath) {
-  const endpoint = `/v1/projects/${encodeURIComponent(projectRef)}/environments/${encodeURIComponent(environmentId)}/deployments/web-release?deployment_id=${encodeURIComponent(deploymentId)}`;
-  const archive = await verifiedArchive(archivePath);
-  const successPayload = (value) => {
-    const release = value ? releaseRecord(value.release) : null;
-    if (!value || value.ok !== true || value.project_ref !== projectRef || value.environment_id !== environmentId || value.deployment_id !== deploymentId || value.release_id !== archive.sha256 || release?.release_id !== archive.sha256 || release.tree_sha256.length !== 64)
-      return null;
-    return toolResponse({
-      project_ref: projectRef,
-      environment_id: environmentId,
-      deployment_id: deploymentId,
-      release_id: archive.sha256,
-      release
-    });
-  };
-  try {
-    const response = await http.postBinary(endpoint, {
-      stream: archiveStream(archive),
-      byteLength: archive.sizeBytes
-    }, {
-      contentType: FRONTEND_ARCHIVE_CONTENT_TYPE,
-      contentLength: archive.sizeBytes,
-      contentSha256: archive.sha256,
-      maxJsonBytes: RESPONSE_MAX_BYTES,
-      timeoutMs: UPLOAD_REQUEST_TIMEOUT_MS,
-      responseTimeoutMs: MUTATION_RESPONSE_TIMEOUT_MS
-    });
-    const value = response.data && typeof response.data === "object" && !Array.isArray(response.data) ? response.data : null;
-    if (response.ok && response.status === 201) {
-      const success = successPayload(value);
-      if (success)
-        return success;
-    }
-    if (response.transportError || response.responseReadError || response.status >= 500 || response.status === 202) {
-      const readback = await getFrontendRelease(http, projectRef, deploymentId, archive.sha256);
-      if (!readback.isError) {
-        const readbackValue = JSON.parse(readback.content[0]?.text ?? "{}");
-        const release = readbackValue.release;
-        if (release && typeof release === "object" && !Array.isArray(release) && release.release_id === archive.sha256) {
-          return toolResponse({
-            project_ref: projectRef,
-            environment_id: environmentId,
-            deployment_id: deploymentId,
-            release_id: archive.sha256,
-            release
-          });
-        }
-      }
-    }
-    return releaseFailure("frontend.upload_project_web_release", response.status >= 400 && response.status < 500 && !response.transportError ? "HTTP_ERROR" : "OUTCOME_UNKNOWN", response.status);
-  } finally {
-    await archive.handle.close();
-  }
-}
 async function uploadReadback(http, projectRef, deploymentId, releaseId, uploadStatus) {
   const response = await http.get(releasePath(projectRef, deploymentId, releaseId), {
     maxJsonBytes: RESPONSE_MAX_BYTES
   });
-  const release = response.ok ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId }) : null;
+  const release = response.ok && response.status === 200 ? releaseEnvelope(response.data, { projectRef, deploymentId, releaseId }) : null;
   if (!release) {
     return releaseFailure("frontend.upload_release", "OUTCOME_UNKNOWN", uploadStatus);
   }
@@ -16913,13 +16862,9 @@ function activationReceipt(candidate, input) {
   return release;
 }
 async function activeReleaseReadback(http, identity) {
-  const snapshot = await readActiveFrontendRelease(http, identity.projectRef, identity.deploymentId);
-  if ("failure" in snapshot)
-    return { release: null, status: snapshot.status };
-  const inventory = snapshot.inventory;
-  if (inventory.active_release_id !== identity.releaseId || inventory.active_activation_id !== identity.mutationId) {
-    return { release: null, status: 200 };
-  }
+  const snapshot = await activeReleaseSnapshotReadback(http, identity);
+  if (!snapshot.release)
+    return snapshot;
   const releaseRead = await http.get(releasePath(identity.projectRef, identity.deploymentId, identity.releaseId), { maxJsonBytes: RESPONSE_MAX_BYTES });
   const release = releaseRead.ok && releaseRead.status === 200 ? releaseEnvelope(releaseRead.data, {
     projectRef: identity.projectRef,
@@ -16928,6 +16873,16 @@ async function activeReleaseReadback(http, identity) {
   }) : null;
   return { release, status: releaseRead.status };
 }
+async function activeReleaseSnapshotReadback(http, identity) {
+  const snapshot = await readActiveFrontendRelease(http, identity.projectRef, identity.deploymentId);
+  if ("failure" in snapshot)
+    return { release: null, status: snapshot.status };
+  const inventory = snapshot.inventory;
+  if (inventory.active_release_id !== identity.releaseId || inventory.active_activation_id !== identity.mutationId) {
+    return { release: null, status: 200 };
+  }
+  return { release: inventory.releases[0] ?? null, status: 200 };
+}
 async function readActiveFrontendRelease(http, projectRef, deploymentId) {
   const response = await http.get(`${deploymentEndpoint(projectRef, deploymentId)}/active-release`, {
     maxJsonBytes: RESPONSE_MAX_BYTES
@@ -16962,7 +16917,7 @@ async function getActiveFrontendRelease(http, projectRef, deploymentId) {
   const snapshot = await readActiveFrontendRelease(http, projectRef, deploymentId);
   return "failure" in snapshot ? snapshot.failure : toolResponse(snapshot.inventory);
 }
-async function publishFrontendRelease(http, projectRef, deploymentId, archivePath, expectedTreeSha256) {
+async function publishFrontendRelease(http, projectRef, deploymentId, archiveSource, expectedTreeSha256) {
   const authority = await readActiveFrontendRelease(http, projectRef, deploymentId);
   if ("failure" in authority)
     return authority.failure;
@@ -16979,7 +16934,14 @@ async function publishFrontendRelease(http, projectRef, deploymentId, archivePat
       unchanged: true
     });
   }
-  const uploaded = await uploadFrontendRelease(http, projectRef, deploymentId, archivePath);
+  const archive = typeof archiveSource === "string" ? { archivePath: archiveSource } : await archiveSource();
+  let uploaded;
+  try {
+    uploaded = await uploadFrontendReleaseWithReadback(http, projectRef, deploymentId, archive.archivePath, false);
+  } finally {
+    if ("cleanup" in archive)
+      await archive.cleanup();
+  }
   if (uploaded.isError)
     return uploaded;
   const value = JSON.parse(uploaded.content[0].text);
@@ -16990,14 +16952,14 @@ async function publishFrontendRelease(http, projectRef, deploymentId, archivePat
     return releaseFailure("frontend.deploy", "INVALID_RESPONSE", 200);
   }
   const mutationId = crypto.randomUUID();
-  const activated = await activateFrontendRelease(http, {
+  const activated = await activateFrontendReleaseWithReadback(http, {
     projectRef,
     deploymentId,
     releaseId: release.release_id,
     mutationId,
     expectedActiveReleaseId: inventory.active_release_id ?? "absent",
     expectedActivationId: inventory.active_activation_id ?? "absent"
-  });
+  }, activeReleaseSnapshotReadback);
   const activatedPayload = JSON.parse(activated.content[0].text);
   const active = activatedPayload.release;
   const treeMismatch = !activated.isError && (!active || typeof active !== "object" || !("tree_sha256" in active) || active.tree_sha256 !== expectedTreeSha256);
@@ -17176,6 +17138,9 @@ async function readPreviousFrontendRelease(http, projectRef, deploymentId) {
   };
 }
 async function activateFrontendRelease(http, input) {
+  return activateFrontendReleaseWithReadback(http, input, activeReleaseReadback);
+}
+async function activateFrontendReleaseWithReadback(http, input, readActive) {
   const mutationId = input.mutationId;
   if (!MUTATION_ID_PATTERN2.test(mutationId))
     throw new Error("'mutation_id' must be a UUIDv4");
@@ -17201,7 +17166,7 @@ async function activateFrontendRelease(http, input) {
     }
     return activationReadback(http, input, mutationId, response.status);
   }
-  const readback = await activeReleaseReadback(http, { ...input, mutationId });
+  const readback = await readActive(http, { ...input, mutationId });
   if (!readback.release || readback.release.tree_sha256 !== release.tree_sha256) {
     return releaseFailure("frontend.activate_release", "OUTCOME_UNKNOWN", readback.status);
   }
@@ -21423,34 +21388,34 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.46.1"
+      version: "0.46.3"
     },
     app: {
-      version: "0.27.0",
+      version: "0.27.1",
       dependencies: {
         rxjs: "7.8.2"
       }
     },
     elysia: {
-      version: "0.30.0"
+      version: "0.31.0"
     },
     commands: {
-      version: "0.9.2"
+      version: "0.9.3"
     },
     contracts: {
       version: "0.9.0"
     },
     db: {
-      version: "0.17.0",
+      version: "0.17.1",
       peerDependencies: {
-        "drizzle-orm": "1.0.0-rc.5-169397b"
+        "drizzle-orm": "1.0.0-rc.5-5935859"
       },
       devDependencies: {
-        "drizzle-kit": "1.0.0-rc.5-ab785fc"
+        "drizzle-kit": "1.0.0-rc.5-5935859"
       }
     },
     sdk: {
-      version: "0.42.0",
+      version: "0.43.0",
       peerDependencies: {
         "@supabase/supabase-js": "^2.117.3"
       }
@@ -21793,8 +21758,8 @@ function baseFiles(name, sdkDependencies) {
       dependencies: {
         "@supacloud/app": `^${appMetadata.version}`,
         "@supacloud/elysia": `^${elysiaMetadata.version}`,
-        effect: "4.0.2",
-        elysia: "2.0.0-beta.21",
+        effect: "4.0.5",
+        elysia: "2.0.0-beta.32",
         ...sdkDependencies ?? { rxjs: appMetadata.dependencies.rxjs }
       },
       devDependencies: {
@@ -22992,20 +22957,21 @@ ALTER TABLE public.starter_application ENABLE ROW LEVEL SECURITY;
 ALTER TABLE public.starter_reviews ENABLE ROW LEVEL SECURITY;
 ALTER TABLE public.starter_members ENABLE ROW LEVEL SECURITY;
 `;
-var STARTER_REVIEW_POSTGRES = `import { AsyncLocalStorage } from "node:async_hooks";
-import { createTransactionalCommand, plaintextCommandInput } from "@supacloud/commands";
+var STARTER_REVIEW_POSTGRES = `import { plaintextCommandInput } from "@supacloud/commands";
 import { CommandError } from "@supacloud/contracts";
 import { createPostgresCommandStore, type CommandDatabase, type CommandTransaction } from "@supacloud/db";
 import {
-  ApplicationError, createSupAuthRequestContext, requireTrustedIdentity, requireIdempotencyKey,
+  ApplicationError, createSchemaDecoder, createSupAuthRequestContext, requireTrustedIdentity,
+  createTransactionalCommandGovernance,
   type CommandInvocation, type SupAuthContextOptions,
 } from "@supacloud/elysia";
 import type { AppAdapters } from "../application";
 import type { ReviewStore } from "../review/review";
 import type { ReviewUploadPort } from "../review/uploads";
+import { ApprovalInput, ReviewResult } from "../review/contracts";
 
-interface Approval { id: string; expectedVersion: number }
-interface Review { state: "draft" | "approved"; version: number }
+const input = createSchemaDecoder(ApprovalInput, { normalize: false });
+const result = createSchemaDecoder(ReviewResult, { normalize: false });
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -23022,19 +22988,6 @@ function isPublicConflict(value: unknown): boolean {
   return value instanceof ApplicationError && value.status === 409
     || isRecord(value) && value["expose"] === true && value["status"] === 409 && typeof value["code"] === "string";
 }
-function input(value: unknown): Approval {
-  const item = record(value);
-  if (typeof item["id"] !== "string" || !item["id"].length || typeof item["expectedVersion"] !== "number"
-    || !Number.isSafeInteger(item["expectedVersion"]) || item["expectedVersion"] < 1) throw new TypeError("Invalid approval input");
-  return { id: item["id"], expectedVersion: item["expectedVersion"] };
-}
-function result(value: unknown): Review {
-  const item = record(value);
-  if ((item["state"] !== "draft" && item["state"] !== "approved") || typeof item["version"] !== "number"
-    || !Number.isSafeInteger(item["version"]) || item["version"] < 1) throw new TypeError("Invalid review result");
-  return { state: item["state"], version: item["version"] };
-}
-
 export interface ReviewPostgresOptions {
   database: CommandDatabase;
   tenantId: string;
@@ -23072,12 +23025,7 @@ export async function createReviewPostgresAdapters(options: ReviewPostgresOption
       } : null;
     },
   });
-  const scope = new AsyncLocalStorage<CommandTransaction>();
-  const transaction = () => {
-    const tx = scope.getStore();
-    if (!tx) throw new Error("Review storage requires its durable command transaction");
-    return tx;
-  };
+  const transaction = () => commandBinding.transaction();
   const store: ReviewStore = {
     ...options.uploads,
     async get(table, id) {
@@ -23106,64 +23054,30 @@ export async function createReviewPostgresAdapters(options: ReviewPostgresOption
     }
     return who.subject;
   }
-  const commandStore = createPostgresCommandStore(database);
-  return {
-    deps: { dbClient: store }, requestContext,
-    commandGovernance: {
-      authorize(invocation) {
-        const command = invocation.command;
-        if (command.name !== "review.approve" || command.permission !== "review.approve"
-          || command.transaction !== "required" || command.idempotency !== "required"
-          || command.audit !== "review.approved" || command.rpc !== undefined) {
-          throw new ApplicationError("Unsupported review command", { status: 501, code: "REVIEW_COMMAND_UNSUPPORTED" });
-        }
-        actor(invocation);
-      },
-      async idempotency(invocation, next) {
-        const command = createTransactionalCommand({
-          name: invocation.command.name, store: commandStore,
-          inputCodec: plaintextCommandInput, input, result,
-          async authorize(who, request, tx) {
-            const found = rows(await tx.query(
-              "SELECT r.id FROM public.starter_reviews r JOIN public.starter_members m ON m.subject=r.owner_id " +
-              "CROSS JOIN public.starter_application a " +
-              "WHERE r.id=$1 AND r.owner_id=$2 AND m.enabled AND m.can_approve " +
-              "AND a.singleton AND a.project_id=$3 AND a.tenant_id=$4 FOR UPDATE OF r,m FOR SHARE OF a",
-              [request.id, who.actorId, projectId, who.tenantId],
-            ));
-            return found.length === 1 ? "allow" : "deny";
-          },
-          execute: tx => scope.run(tx, async () => {
-            try { return await next(); }
-            catch (error) {
-              if (isPublicConflict(error)) {
-                throw new CommandError("COMMAND_IDEMPOTENCY_CONFLICT");
-              }
-              throw error;
-            }
-          }),
-          audit: { event: "review.approved", details: request => ({ reviewId: request.id }) },
-        });
-        try {
-          const receipt = await command.execute(
-            { actorId: actor(invocation), tenantId }, requireIdempotencyKey(invocation),
-            { id: invocation.input.params["id"], expectedVersion: record(invocation.input.body)["expectedVersion"] },
-            invocation.request.signal,
-          );
-          if (receipt.status !== "confirmed") throw new CommandError("COMMAND_OUTCOME_UNKNOWN");
-          return receipt.result;
-        } catch (error) {
-          if (!(error instanceof CommandError)) throw error;
-          const status = error.code === "COMMAND_REJECTED" ? 403
-            : error.code === "COMMAND_IDEMPOTENCY_CONFLICT" ? 409 : 503;
-          throw new ApplicationError(error.code, { code: error.code, status });
-        }
+  const commandBinding = createTransactionalCommandGovernance({
+    permission: "review.approve",
+    identity: invocation => ({ actorId: actor(invocation), tenantId }),
+    input: invocation => ({
+      ...record(invocation.input.body), id: invocation.input.params["id"],
+    }),
+    rejection: error => isPublicConflict(error) ? new CommandError("COMMAND_IDEMPOTENCY_CONFLICT") : undefined,
+    definition: {
+      name: "review.approve", store: createPostgresCommandStore(database),
+      inputCodec: plaintextCommandInput, input, result,
+      async authorize(who, request, tx) {
+        const found = rows(await tx.query(
+          "SELECT r.id FROM public.starter_reviews r JOIN public.starter_members m ON m.subject=r.owner_id " +
+          "CROSS JOIN public.starter_application a " +
+          "WHERE r.id=$1 AND r.owner_id=$2 AND m.enabled AND m.can_approve " +
+          "AND a.singleton AND a.project_id=$3 AND a.tenant_id=$4 FOR UPDATE OF r,m FOR SHARE OF a",
+          [request.id, who.actorId, projectId, who.tenantId],
+        ));
+        return found.length === 1 ? "allow" : "deny";
       },
-      transaction(_invocation, next) { transaction(); return next(); },
-      // The durable command owns the authoritative audit and receipt in the same transaction.
-      audit: { succeeded() { transaction(); }, failed() {} },
+      audit: { event: "review.approved", details: request => ({ reviewId: request.id }) },
     },
-  };
+  });
+  return { deps: { dbClient: store }, requestContext, commandGovernance: commandBinding.governance };
 }
 `;
 var STARTER_REVIEW_POSTGRES_TEST = `import { expect, test } from "bun:test";
@@ -23200,9 +23114,9 @@ test("PostgreSQL host never falls back to demo identity or unbound business stor
   await expect(adapters.requestContext(new Request("http://localhost/reviews/health")))
     .rejects.toMatchObject({ code: "AUTHENTICATION_REQUIRED" });
   const store = adapters.deps["dbClient"] as ReviewStore;
-  await expect(store.get("reviews", "example")).rejects.toThrow("durable command transaction");
+  await expect(store.get("reviews", "example")).rejects.toThrow("not active");
   await expect(store.set("reviews", "example", { state: "approved", version: 2 }))
-    .rejects.toThrow("durable command transaction");
+    .rejects.toThrow("not active");
   expect(db.queries).toHaveLength(1);
 });
 `;
@@ -23488,6 +23402,58 @@ export default defineConfig({
   };
 }
 
+// src/shared/tools/app-starter-query.ts
+var STARTER_REVIEW_QUERY = `import type { SupabaseClient } from "@supabase/supabase-js";
+import type { ReviewRow } from "../../db/schema";
+
+// This read projection uses SQL column names shared with the Drizzle source.
+// Do not expose camelCase Drizzle property names as PostgREST column names.
+export type ReviewSummary = Pick<ReviewRow, "id" | "state" | "version">;
+export type ReviewReadDatabase = {
+  public: {
+    Tables: {
+      starter_reviews: {
+        Row: ReviewSummary;
+        Insert: never;
+        Update: never;
+        Relationships: [];
+      };
+    };
+    Views: Record<never, never>;
+    Functions: Record<never, never>;
+  };
+};
+
+export interface ReviewPageOptions {
+  page?: number;
+  pageSize?: number;
+  signal?: AbortSignal;
+}
+
+// Reuse the application's user-scoped client. Identity verification and row
+// authorization belong to the gateway and database, never a caller-supplied owner.
+export async function listReviews(
+  client: SupabaseClient<ReviewReadDatabase>,
+  { page = 1, pageSize = 25, signal }: ReviewPageOptions = {},
+) {
+  if (!Number.isSafeInteger(page) || page < 1
+    || !Number.isSafeInteger(pageSize) || pageSize < 1 || pageSize > 100
+    || !Number.isSafeInteger(page * pageSize)) {
+    throw new RangeError("Invalid review page: page >= 1 and pageSize between 1 and 100 are required");
+  }
+  signal?.throwIfAborted();
+  const start = (page - 1) * pageSize;
+  const query = client.from("starter_reviews")
+    .select("id,state,version", { count: "exact" })
+    .order("id", { ascending: true })
+    .range(start, start + pageSize - 1);
+  const { data, error, count } = await (signal ? query.abortSignal(signal) : query);
+  if (error) throw error;
+  if (data === null || count === null) throw new Error("Incomplete review page response");
+  return { data, total: count, page, pageSize, hasNextPage: start + data.length < count };
+}
+`;
+
 // src/shared/tools/app-starter.ts
 var { compiler: compilerMetadata2, app: appMetadata2, elysia: elysiaMetadata2, commands: commandsMetadata, contracts: contractsMetadata, db: dbMetadata, sdk: sdkMetadata } = starter_metadata_default.packages;
 var json2 = (value) => `${JSON.stringify(value, null, 2)}
@@ -23495,6 +23461,7 @@ var json2 = (value) => `${JSON.stringify(value, null, 2)}
 function appStarterFiles(name) {
   return {
     ...starterDatabaseFiles(),
+    "src/review/list-reviews.ts": STARTER_REVIEW_QUERY,
     "package.json": json2({
       name,
       version: "0.0.0",
@@ -23529,8 +23496,8 @@ function appStarterFiles(name) {
         "drizzle-orm": dbMetadata.peerDependencies["drizzle-orm"],
         "@supacloud/js": `^${sdkMetadata.version}`,
         "@supabase/supabase-js": sdkMetadata.peerDependencies["@supabase/supabase-js"],
-        effect: "4.0.2",
-        elysia: "2.0.0-beta.21",
+        effect: "4.0.5",
+        elysia: "2.0.0-beta.32",
         rxjs: appMetadata2.dependencies.rxjs
       },
       devDependencies: {
@@ -23784,11 +23751,10 @@ import {
   Body, Command, Controller, DB_CLIENT, Get, Inject, Param, Post,
   defineFeatureSlice, defineFeatureSpec, type Aspect,
 } from "@supacloud/app";
-import { ApplicationError, assertFeatureTransition } from "@supacloud/elysia";
-import { ApproveBody, HealthResult, Params, ReviewResult } from "./contracts";
+import { ApplicationError, assertFeatureTransition, createSchemaDecoder } from "@supacloud/elysia";
+import { ApproveBody, HealthResult, Params, ReviewResult, type ApprovalBody, type Review } from "./contracts";
 import { VerifyReviewAttachment } from "./attachment";
 import { ReviewUploads, ReviewUploadsController, type ReviewUploadPort } from "./uploads";
-import type { ReviewRow } from "../../db/schema";
 
 export const reviewSpec = defineFeatureSpec({
   name: "review",
@@ -23803,7 +23769,6 @@ export const reviewSpec = defineFeatureSpec({
   },
 });
 
-type Review = Pick<ReviewRow, "state" | "version">;
 // Production implementations must bind both operations to the current transaction.
 export interface ReviewStore extends Partial<ReviewUploadPort> {
   get(table: string, key: string): unknown;
@@ -23816,13 +23781,12 @@ export const requireRequest: Aspect = (context, next) => {
   return next();
 };
 
+const decodeReview = createSchemaDecoder(ReviewResult, { normalize: false });
 function readReview(value: unknown): Review {
-  if (typeof value !== "object" || value === null ||
-      !("state" in value) || (value.state !== "draft" && value.state !== "approved") ||
-      !("version" in value) || typeof value.version !== "number") {
+  try { return decodeReview(value); }
+  catch {
     throw new ApplicationError("Review not found", { status: 404, code: "REVIEW_NOT_FOUND" });
   }
-  return { state: value.state, version: value.version };
 }
 
 @Command({
@@ -23854,7 +23818,7 @@ type ReviewError =
     | { readonly _tag: "FEATURE_TRANSITION_CONFLICT" }
     | { readonly _tag: "COMMAND_IDEMPOTENCY_CONFLICT" }
     | { readonly _tag: "COMMAND_REJECTED" }
-    | { readonly _tag: "REVIEW_COMMAND_UNSUPPORTED" }
+    | { readonly _tag: "COMMAND_BINDING_MISMATCH" }
     | { readonly _tag: "COMMAND_OUTCOME_UNKNOWN" };
 
 @Controller("/reviews")
@@ -23883,13 +23847,13 @@ export class ReviewController {
         { tag: "FEATURE_TRANSITION_CONFLICT", status: 409, code: "FEATURE_TRANSITION_CONFLICT" },
         { tag: "COMMAND_IDEMPOTENCY_CONFLICT", status: 409, code: "COMMAND_IDEMPOTENCY_CONFLICT" },
         { tag: "COMMAND_REJECTED", status: 403, code: "COMMAND_REJECTED" },
-        { tag: "REVIEW_COMMAND_UNSUPPORTED", status: 501, code: "REVIEW_COMMAND_UNSUPPORTED" },
+        { tag: "COMMAND_BINDING_MISMATCH", status: 501, code: "COMMAND_BINDING_MISMATCH" },
         { tag: "COMMAND_OUTCOME_UNKNOWN", status: 503, code: "COMMAND_OUTCOME_UNKNOWN" },
       ],
       retry: "none",
     },
   })
-  approve(@Param("id") id: string, @Body() body: { expectedVersion: number }): Effect.Effect<Review, ReviewError, never> {
+  approve(@Param("id") id: string, @Body() body: ApprovalBody): Effect.Effect<Review, ReviewError, never> {
     return Effect.promise(() => this.approveReview.execute(id, body.expectedVersion));
   }
 }
@@ -23901,13 +23865,16 @@ export const ReviewFeature = defineFeatureSlice({
 });
 `,
     "src/review/attachment.ts": STARTER_REVIEW_JOB,
-    "src/review/contracts.ts": `import { t } from "elysia";
+    "src/review/contracts.ts": `import { t, type UnwrapSchema } from "elysia";
 export const Params = t.Object({ id: t.String({ minLength: 1 }) });
-export const ApproveBody = t.Object({ expectedVersion: t.Integer({ minimum: 1 }) });
+export const ApproveBody = t.Object({ expectedVersion: t.Integer({ minimum: 1, maximum: 9007199254740991 }) });
+export const ApprovalInput = t.Object({ ...Params.properties, ...ApproveBody.properties }, { additionalProperties: false });
+export type ApprovalBody = UnwrapSchema<typeof ApproveBody>;
 export const ReviewResult = t.Object({
   state: t.Union([t.Literal("draft"), t.Literal("approved")]),
-  version: t.Integer({ minimum: 1 }),
+  version: t.Integer({ minimum: 1, maximum: 9007199254740991 }),
 });
+export type Review = UnwrapSchema<typeof ReviewResult>;
 export const HealthResult = t.Object({ ok: t.Boolean() });
 export const UploadParams = t.Object({ id: t.String({ format: "uuid" }) });
 export const UploadBody = t.Object({
@@ -24049,6 +24016,18 @@ Ordinary reads use PostgREST through the existing user-scoped
 Use the caller's session, RLS and grants; never introduce a second session store.
 Business writes continue through the governed Command/RPC boundary.
 
+Use listReviews from src/review/list-reviews.ts for the paginated review list.
+Type the existing client with ReviewReadDatabase (a read-only projection derived
+from db/schema.ts), then call listReviews(client, { page: 1, pageSize: 25, signal }).
+The helper returns data, total, page, pageSize and hasNextPage, orders by the unique
+id and preserves PostgREST errors. Pages are one-based and limited to 100 rows.
+Exact counts obey RLS but may be expensive on large tables; offset pages are not
+a cross-request snapshot when records change. No owner filter replaces RLS.
+Do not create a service-role client or a second auth session for this helper.
+Existing starters can add this file without a new migration only if their reviewed
+review-table grants and identity-mapping RLS from migration 003 are already applied.
+The projection is not a full database export and grants no write access.
+
 GraphQL is not generated or enabled by this starter. For a specific Query Contract,
 explicitly configure graphql.schema with a role-scoped database export and add
 checked query documents. Drizzle and append-only migrations remain the database
@@ -26359,6 +26338,7 @@ async function runAppRelease(request, options, delegate) {
     schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
     ok: true,
     operation: "applications.release",
+    ...deployReceipt.status === "accepted" ? { status: "accepted" } : {},
     project_ref: ref,
     application_id: id,
     environment_id: environmentId,
@@ -26369,16 +26349,17 @@ async function runAppRelease(request, options, delegate) {
     build: buildReceipt ? completed.build : { skipped: true, manifest_path: manifestPath },
     phases: completed,
     no_op: deployReceipt.action === "no-op" || deployReceipt.no_op === true,
-    execution_performed: deployReceipt.execution_performed === true,
+    ...deployReceipt.status === "accepted" ? {} : { execution_performed: deployReceipt.execution_performed === true },
     ...typeof deployReceipt.activation_id === "string" ? { activation_id: deployReceipt.activation_id } : {},
     ...deployReceipt.web === undefined ? {} : { web: deployReceipt.web }
   };
   return request.format === "json" || request.json === true ? textResult(JSON.stringify(result, null, 2)) : textResult([
-    `${ref}/${id}/${environmentId}: ${result.no_op ? "no-op" : "released"}`,
+    `${ref}/${id}/${environmentId}: ${deployReceipt.status === "accepted" ? "accepted" : result.no_op ? "no-op" : "released"}`,
     `Release: ${releaseId}`,
     `Configuration: ${configurationId}`,
     `Activation: ${result.activation_id ?? "not performed"}`,
     ...result.deployment_id === undefined ? [] : [`Deployment: ${result.deployment_id}`],
+    ...deployReceipt.status === "accepted" && result.deployment_id !== undefined ? [`Status: supacloud deploy --status ${result.deployment_id}`] : [],
     `Build: ${request.skip_build ? "skipped" : "completed"}`
   ].join(`
 `));
@@ -29057,11 +29038,22 @@ async function requireProjectDeploymentProtocol(http, projectRef, environmentId)
     throw new Error("DEPLOYMENT_PROTOCOL_MISMATCH: Upgrade the SupaCloud server and CLI together (`npm install -g @supacloud/cli@latest`), then retry `supacloud deploy`. No upload or deployment was attempted; legacy endpoints will not be used.");
   }
 }
+var operation2 = "applications.project_deploy";
 var scopeSchema = _Object_({
   project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
   application_id: ApplicationIdSchema,
   environment_id: ApplicationIdSchema
 });
+var acceptedSchema = _Object_({
+  schema: Literal("supacloud.project-deployment-accepted.v1"),
+  ok: Literal(true),
+  status: Literal("accepted"),
+  deployment_id: ApplicationDeployRequestSchema.properties.mutation_id,
+  ...scopeSchema.properties,
+  release_id: ApplicationDeployRequestSchema.properties.release_id,
+  request_sha256: String2({ pattern: "^[a-f0-9]{64}$" }),
+  replayed: Boolean2()
+}, { additionalProperties: false });
 var statusSchema = _Object_({
   schema: Literal("supacloud.project-deployment-status.v1"),
   deployment_id: ApplicationDeployRequestSchema.properties.mutation_id,
@@ -29086,6 +29078,27 @@ var statusSchema = _Object_({
   receipt: Optional(Unknown()),
   failure_code: Optional(String2({ pattern: "^[A-Z][A-Z0-9_]{0,63}$" }))
 }, { additionalProperties: false });
+async function readProjectDeploymentStatus(http, projectRef, environmentId, deploymentId) {
+  if (!/^[a-z0-9-]{1,20}$/.test(projectRef) || !Check2(ApplicationIdSchema, environmentId) || !Check2(ApplicationDeployRequestSchema.properties.mutation_id, deploymentId)) {
+    return releaseControlFailure(operation2, "INVALID_RESPONSE", null);
+  }
+  const path = `/v1/projects/${encodeURIComponent(projectRef)}/environments/${encodeURIComponent(environmentId)}/deployments/${deploymentId}`;
+  const response = await http.get(path, { retry: false, totalTimeoutMs: 1e4, maxJsonBytes: 131072 });
+  try {
+    const state = response.data;
+    if (!response.ok || response.status !== 200 || !Check2(statusSchema, state) || state.project_ref !== projectRef || state.environment_id !== environmentId || state.deployment_id !== deploymentId)
+      throw new Error;
+    if (state.status === "succeeded") {
+      const receipt = parseApplicationDeployResult(state.receipt);
+      if (state.phase !== "verifying" || receipt.project_ref !== projectRef || receipt.environment_id !== environmentId || receipt.application_id !== state.application_id || receipt.mutation_id !== deploymentId)
+        throw new Error;
+    } else if (state.receipt !== undefined)
+      throw new Error;
+    return state.status === "outcome_unknown" || state.status === "failed_terminal" ? releaseControlFailure(operation2, state.status === "outcome_unknown" ? "OUTCOME_UNKNOWN" : "MUTATION_NOT_SUCCEEDED", response.status, { ...state }) : releaseControlSuccess(operation2, { ...state });
+  } catch {
+    return releaseControlFailure(operation2, "INVALID_RESPONSE", response.status);
+  }
+}
 
 // src/shared/tools/deploy-tools.ts
 var MAX_SOURCE_BYTES = 256 * 1024 * 1024;
@@ -29102,6 +29115,8 @@ var deployToolSchema = {
   cwd: optional(String2(), "Project directory (default: current directory)"),
   skip_build: optional(Boolean2(), "Use an existing output directory without building"),
   assets_only: optional(Boolean2(), "Publish only configured static assets; leave backend Functions, schedules and migrations unchanged"),
+  backend: optional(Boolean2(), "Publish the application backend independently; do not build or activate frontend assets"),
+  status: optional(String2({ format: "uuid" }), "Read a backend deployment status without publishing"),
   json: optional(Boolean2(), "Print only the final JSON result")
 };
 function record4(candidate) {
@@ -29477,8 +29492,7 @@ async function collectArchiveFiles(root) {
   }
   return { files, bytes, count: paths.length, treeSha256: tree.digest("hex") };
 }
-async function createFrontendArchive(outputDirectory) {
-  const collected = await collectArchiveFiles(outputDirectory);
+async function createCollectedFrontendArchive(outputDirectory, collected) {
   const temporaryDirectory = await mkdtemp2(join18(tmpdir3(), "supacloud-deploy-"));
   const archivePath = join18(temporaryDirectory, `${basename8(outputDirectory)}.tar.zst`);
   try {
@@ -29499,16 +29513,7 @@ async function createFrontendArchive(outputDirectory) {
     throw error;
   }
 }
-function payload(response) {
-  if (response.isError)
-    throw new Error(response.content[0]?.text || "Deployment operation failed");
-  const text = response.content.find((chunk) => chunk.type === "text")?.text;
-  const parsed = text ? record4(JSON.parse(text)) : null;
-  if (!parsed)
-    throw new Error("Deployment operation returned an invalid response");
-  return parsed;
-}
-async function stageApplicationWebRelease(http, projectRef, environmentId, configRoot, skipBuild, json, environmentVariables, assetsOnly = false) {
+async function publishConfiguredFrontend(http, projectRef, configRoot, skipBuild, json, environmentVariables) {
   const target = selectFrontendTarget(configRoot, await readDeployConfig(configRoot));
   if (!target)
     return null;
@@ -29532,27 +29537,8 @@ async function stageApplicationWebRelease(http, projectRef, environmentId, confi
   if (!skipBuild) {
     await runBuild(buildCommand, projectDirectory, build.env, json);
   }
-  const archive = await createFrontendArchive(outputDirectory);
-  try {
-    if (assetsOnly) {
-      return { result: await publishFrontendRelease(http, projectRef, selected.id, archive.archivePath, archive.treeSha256) };
-    }
-    const uploaded = payload(await uploadProjectWebRelease(http, projectRef, environmentId, selected.id, archive.archivePath));
-    const release = record4(uploaded.release);
-    const releaseId = requiredString(release?.release_id, "release.release_id");
-    if (releaseId !== archive.sha256)
-      throw new Error("Uploaded Web release identity does not match the local archive");
-    if (release?.tree_sha256 !== archive.treeSha256)
-      throw new Error("Uploaded Web release tree does not match the local build");
-    return {
-      request: {
-        deployment_id: selected.id,
-        release_id: releaseId
-      }
-    };
-  } finally {
-    await archive.cleanup();
-  }
+  const collected = await collectArchiveFiles(outputDirectory);
+  return publishFrontendRelease(http, projectRef, selected.id, () => createCollectedFrontendArchive(outputDirectory, collected), collected.treeSha256);
 }
 function registerDeployTools(server, http, options = {}) {
   registerTool(server, "deploy", "Build and publish the linked project with one command", deployToolSchema, async (args) => {
@@ -29560,6 +29546,16 @@ function registerDeployTools(server, http, options = {}) {
     const projectRef = String(args.ref || options.projectRef || "").trim();
     if (!projectRef)
       throw new Error("A linked project ref is required. Set SUPACLOUD_PROJECT_REF or pass --ref");
+    if (args.assets_only === true && args.backend === true)
+      throw new Error("Choose either frontend assets or backend deployment");
+    if (typeof args.status === "string") {
+      if (args.assets_only === true || args.backend === true)
+        throw new Error("Status cannot be combined with publishing options");
+      const environmentId = options.environment?.trim() || options.application?.environmentId?.trim();
+      if (!environmentId)
+        throw new Error("Deployment status requires SUPACLOUD_ENV");
+      return readProjectDeploymentStatus(http, projectRef, environmentId, args.status);
+    }
     const configRoot = await findDeployConfigRoot(invocationDirectory, options.environment ?? undefined);
     const config = await readDeployConfig(configRoot);
     const application = options.application?.id ? options.application : config.application ? {
@@ -29567,7 +29563,7 @@ function registerDeployTools(server, http, options = {}) {
       environmentId: options.environment || config.application.environmentId
     } : undefined;
     const legacyManifest = await hasProjectReleaseManifest(configRoot);
-    const assetsOnly = args.assets_only === true || !application?.id && selectFrontendTarget(configRoot, config) !== null && !legacyManifest && !Object.values(config.targets ?? {}).some((target) => target.type === "edge_function");
+    const assetsOnly = args.assets_only === true || args.backend !== true && selectFrontendTarget(configRoot, config) !== null;
     if (assetsOnly) {
       if (!selectFrontendTarget(configRoot, config)) {
         throw new Error("Static asset deployment requires a frontend configuration in supacloud.json");
@@ -29577,10 +29573,10 @@ function registerDeployTools(server, http, options = {}) {
         throw new Error("Static asset deployment requires SUPACLOUD_ENV");
       }
       await requireProjectDeploymentProtocol(http, projectRef, environmentId);
-      const staged = await stageApplicationWebRelease(http, projectRef, environmentId, configRoot, args.skip_build === true, args.json === true, options.environmentVariables, true);
-      if (!staged?.result)
+      const result = await publishConfiguredFrontend(http, projectRef, configRoot, args.skip_build === true, args.json === true, options.environmentVariables);
+      if (!result)
         throw new Error("Static asset deployment did not produce a receipt");
-      return staged.result;
+      return result;
     }
     if (legacyManifest) {
       throw new Error(`${DEPLOYMENT_UPGRADE} Replace deploy-manifest.json with the current application delivery configuration; no remote mutation was performed.`);
@@ -29602,7 +29598,6 @@ function registerDeployTools(server, http, options = {}) {
         throw new Error("Application profile must set only one of SUPACLOUD_APPLICATION_CONFIGURATION_PATH or SUPACLOUD_APPLICATION_CONFIGURATION_ID");
       }
       await requireProjectDeploymentProtocol(http, projectRef, environmentId);
-      const stagedWeb = await stageApplicationWebRelease(http, projectRef, environmentId, configRoot, args.skip_build === true, args.json === true, options.environmentVariables);
       const result = await options.applicationRelease({
         action: "release",
         ref: projectRef,
@@ -29613,7 +29608,6 @@ function registerDeployTools(server, http, options = {}) {
         ...configurationId ? { configuration_id: configurationId } : {},
         ...application.manifestPath ? { manifest_path: application.manifestPath } : {},
         ...args.skip_build === true ? { skip_build: true } : {},
-        ...stagedWeb?.request === undefined ? {} : { web_release: stagedWeb.request },
         ...args.json === true ? { format: "json", json: true } : {}
       });
       return result;
@@ -30408,12 +30402,22 @@ function registerDeveloperExperienceTools(server, options = {}) {
 }
 
 // src/shared/tools/project-deployment.ts
-var operation2 = "applications.project_deploy";
+var operation3 = "applications.project_deploy";
 var scopeSchema2 = _Object_({
   project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
   application_id: ApplicationIdSchema,
   environment_id: ApplicationIdSchema
 });
+var acceptedSchema2 = _Object_({
+  schema: Literal("supacloud.project-deployment-accepted.v1"),
+  ok: Literal(true),
+  status: Literal("accepted"),
+  deployment_id: ApplicationDeployRequestSchema.properties.mutation_id,
+  ...scopeSchema2.properties,
+  release_id: ApplicationDeployRequestSchema.properties.release_id,
+  request_sha256: String2({ pattern: "^[a-f0-9]{64}$" }),
+  replayed: Boolean2()
+}, { additionalProperties: false });
 var statusSchema2 = _Object_({
   schema: Literal("supacloud.project-deployment-status.v1"),
   deployment_id: ApplicationDeployRequestSchema.properties.mutation_id,
@@ -30457,7 +30461,7 @@ async function runProjectDeployment(http, args) {
     ...args.web_release === undefined ? {} : { web_release: args.web_release }
   };
   if (!Check2(scopeSchema2, scope) || !Check2(ApplicationDeployRequestSchema, request) || request.configuration_id !== undefined && request.configuration_write !== undefined && request.configuration_id !== request.configuration_write.configuration_id) {
-    return releaseControlFailure(operation2, "INVALID_RESPONSE", null);
+    return releaseControlFailure(operation3, "INVALID_RESPONSE", null);
   }
   const expected = { ...scope, request };
   const identity = {
@@ -30473,15 +30477,29 @@ async function runProjectDeployment(http, args) {
     deployment_id: mutation_id,
     application_id: scope.application_id
   }, { timeoutMs: 120000, maxJsonBytes: 131072, responseTimeoutMs: 30000 });
-  if (result.ok && result.status === 200) {
+  if (result.ok && result.status === 202) {
+    const accepted = result.data;
+    if (Check2(acceptedSchema2, accepted) && accepted.deployment_id === mutation_id && accepted.project_ref === scope.project_ref && accepted.application_id === scope.application_id && accepted.environment_id === scope.environment_id && accepted.release_id === request.release_id && accepted.request_sha256 === mutationRequestFingerprint(request)) {
+      return releaseControlSuccess(operation3, {
+        status: "accepted",
+        deployment_id: mutation_id,
+        project_ref: scope.project_ref,
+        application_id: scope.application_id,
+        environment_id: scope.environment_id,
+        release_id: request.release_id,
+        replayed: accepted.replayed,
+        status_path: `${endpoint}/${mutation_id}`
+      });
+    }
+  } else if (result.ok && result.status === 200) {
     try {
-      return releaseControlSuccess(operation2, {
+      return releaseControlSuccess(operation3, {
         ...responseReceipt(result.data, expected),
         deployment_id: mutation_id
       });
     } catch {}
   } else if (!result.ok && !result.transportError && !result.responseReadError && result.status < 500 && result.status !== 408) {
-    return releaseControlMutationFailure(operation2, result, identity);
+    return releaseControlMutationFailure(operation3, result, identity);
   }
   const observed = await http.get(`${endpoint}/${encodeURIComponent(mutation_id)}`, {
     retry: false,
@@ -30495,20 +30513,20 @@ async function runProjectDeployment(http, args) {
     if (state.deployment_id !== mutation_id || state.project_ref !== scope.project_ref || state.application_id !== scope.application_id || state.environment_id !== scope.environment_id || state.status !== "succeeded" || state.phase !== "verifying")
       throw new Error;
     const receipt = parseApplicationDeployResult(state.receipt, expected);
-    return releaseControlSuccess(operation2, {
+    return releaseControlSuccess(operation3, {
       ...receipt,
       deployment_id: mutation_id,
       replayed: true,
       execution_performed: false
     });
   } catch {
-    return releaseControlFailure(operation2, "OUTCOME_UNKNOWN", result.transportError ? null : result.status, identity);
+    return releaseControlFailure(operation3, "OUTCOME_UNKNOWN", result.transportError ? null : result.status, identity);
   }
 }
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.98.0",
+  version: "0.101.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -30560,21 +30578,21 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.46.1",
-    "@supacloud/delivery": "0.18.0",
-    "@supacloud/db": "0.17.0",
-    typebox: "1.3.36"
+    "@supacloud/compiler": "^0.46.3",
+    "@supacloud/delivery": "0.18.1",
+    "@supacloud/db": "0.17.1",
+    typebox: "1.3.37"
   },
   overrides: {
     "@supacloud/contracts": "0.9.0",
-    "@supacloud/delivery": "0.18.0",
-    "@graphql-tools/utils": "^12.0.3"
+    "@supacloud/delivery": "0.18.1",
+    "@graphql-tools/utils": "^12.0.4"
   },
   devDependencies: {
-    "@supacloud/elysia": "^0.24.1",
+    "@supacloud/elysia": "0.31.0",
     "@types/bun": "^1.4.3",
-    effect: "4.0.2",
-    elysia: "2.0.0-beta.21",
+    effect: "4.0.5",
+    elysia: "2.0.0-beta.32",
     typescript: "^7.0.2"
   }
 };

package/dist/shared/deployment-upgrade.d.ts

@@ -1,2 +1,2 @@
-export declare const DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment commands are no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, configure frontend in supacloud.json for static assets, or application.id and application.environmentId for executable application delivery, then run `supacloud deploy`. Use `supacloud deploy --assets_only` to publish only Web assets in a mixed repository. SupaCloud owns activation; do not retry with legacy commands.";
+export declare const DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment commands are no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, configure frontend in supacloud.json for static assets, or application.id and application.environmentId for executable application delivery, then run `supacloud deploy`. With a frontend configured, deploy publishes only Web assets; use `supacloud deploy --backend` for the application backend. `supacloud deploy --assets_only` remains an explicit Web-only option. SupaCloud owns activation; do not retry with legacy commands.";
 export declare function assertCurrentDeploymentInput(tool: string, input: unknown): void;

package/dist/shared/tools/app-starter-postgres.d.ts

@@ -1,4 +1,4 @@
 export declare const STARTER_REVIEW_SCHEMA = "-- Apply with the platform migration owner, never from the HTTP process.\n-- One application database belongs to one explicitly provisioned project/tenant.\nCREATE TABLE public.starter_application (\n  singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),\n  project_id text NOT NULL CHECK (length(project_id) > 0),\n  tenant_id text NOT NULL CHECK (length(tenant_id) > 0)\n);\nCREATE TABLE public.starter_reviews (\n  id text PRIMARY KEY, owner_id text NOT NULL,\n  state text NOT NULL CHECK (state IN ('draft','approved')),\n  version integer NOT NULL CHECK (version > 0)\n);\nCREATE TABLE public.starter_members (\n  subject text PRIMARY KEY, enabled boolean NOT NULL DEFAULT true,\n  can_approve boolean NOT NULL DEFAULT false\n);\nALTER TABLE public.starter_application ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.starter_reviews ENABLE ROW LEVEL SECURITY;\nALTER TABLE public.starter_members ENABLE ROW LEVEL SECURITY;\n";
-export declare const STARTER_REVIEW_POSTGRES = "import { AsyncLocalStorage } from \"node:async_hooks\";\nimport { createTransactionalCommand, plaintextCommandInput } from \"@supacloud/commands\";\nimport { CommandError } from \"@supacloud/contracts\";\nimport { createPostgresCommandStore, type CommandDatabase, type CommandTransaction } from \"@supacloud/db\";\nimport {\n  ApplicationError, createSupAuthRequestContext, requireTrustedIdentity, requireIdempotencyKey,\n  type CommandInvocation, type SupAuthContextOptions,\n} from \"@supacloud/elysia\";\nimport type { AppAdapters } from \"../application\";\nimport type { ReviewStore } from \"../review/review\";\nimport type { ReviewUploadPort } from \"../review/uploads\";\n\ninterface Approval { id: string; expectedVersion: number }\ninterface Review { state: \"draft\" | \"approved\"; version: number }\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\nfunction record(value: unknown): Record<string, unknown> {\n  if (!isRecord(value)) throw new TypeError(\"Invalid review record\");\n  return value;\n}\nfunction rows(value: unknown): Record<string, unknown>[] {\n  if (!Array.isArray(value)) throw new TypeError(\"Invalid database result\");\n  return value.map(record);\n}\nfunction isPublicConflict(value: unknown): boolean {\n  return value instanceof ApplicationError && value.status === 409\n    || isRecord(value) && value[\"expose\"] === true && value[\"status\"] === 409 && typeof value[\"code\"] === \"string\";\n}\nfunction input(value: unknown): Approval {\n  const item = record(value);\n  if (typeof item[\"id\"] !== \"string\" || !item[\"id\"].length || typeof item[\"expectedVersion\"] !== \"number\"\n    || !Number.isSafeInteger(item[\"expectedVersion\"]) || item[\"expectedVersion\"] < 1) throw new TypeError(\"Invalid approval input\");\n  return { id: item[\"id\"], expectedVersion: item[\"expectedVersion\"] };\n}\nfunction result(value: unknown): Review {\n  const item = record(value);\n  if ((item[\"state\"] !== \"draft\" && item[\"state\"] !== \"approved\") || typeof item[\"version\"] !== \"number\"\n    || !Number.isSafeInteger(item[\"version\"]) || item[\"version\"] < 1) throw new TypeError(\"Invalid review result\");\n  return { state: item[\"state\"], version: item[\"version\"] };\n}\n\nexport interface ReviewPostgresOptions {\n  database: CommandDatabase;\n  tenantId: string;\n  identity: Omit<SupAuthContextOptions, \"resolveAccess\">;\n  uploads?: ReviewUploadPort;\n  // Only database effects here: they commit/rollback with the approval and receipt.\n  afterApproved?(tx: CommandTransaction, id: string, version: number): Promise<void>;\n}\n\nexport async function createReviewPostgresAdapters(options: ReviewPostgresOptions): Promise<\n  AppAdapters & { requestContext: ReturnType<typeof createSupAuthRequestContext> }\n> {\n  const { database, tenantId, identity } = options;\n  const projectId = identity.projectId;\n  const afterApproved = options.afterApproved;\n  if (!tenantId.trim()) throw new TypeError(\"Review tenantId is required\");\n  const query = (text: string, parameters: readonly string[] = []) =>\n    database.transaction(tx => tx.query(text, parameters));\n  const binding = rows(await query(\n    \"SELECT project_id,tenant_id FROM public.starter_application WHERE singleton\",\n  ));\n  if (binding.length !== 1 || binding[0]?.[\"project_id\"] !== projectId || binding[0]?.[\"tenant_id\"] !== tenantId) {\n    throw new Error(\"Review database project/tenant binding mismatch\");\n  }\n  const requestContext = createSupAuthRequestContext({\n    ...identity,\n    async resolveAccess(who) {\n      const found = rows(await query(\n        \"SELECT m.can_approve FROM public.starter_members m,public.starter_application a \" +\n        \"WHERE m.subject=$1 AND m.enabled AND a.singleton AND a.project_id=$2 AND a.tenant_id=$3\",\n        [who.subject, projectId, tenantId],\n      ));\n      return found.length === 1 ? { projectId, tenantId,\n        permissions: found[0]?.[\"can_approve\"] === true ? [\"review.approve\"] : [],\n      } : null;\n    },\n  });\n  const scope = new AsyncLocalStorage<CommandTransaction>();\n  const transaction = () => {\n    const tx = scope.getStore();\n    if (!tx) throw new Error(\"Review storage requires its durable command transaction\");\n    return tx;\n  };\n  const store: ReviewStore = {\n    ...options.uploads,\n    async get(table, id) {\n      if (table !== \"reviews\") throw new Error(\"Unsupported review table\");\n      return rows(await transaction().query(\n        \"SELECT state,version FROM public.starter_reviews WHERE id=$1 FOR UPDATE\", [id],\n      ))[0];\n    },\n    async set(table, id, value) {\n      if (table !== \"reviews\") throw new Error(\"Unsupported review table\");\n      const review = result(value);\n      const updated = rows(await transaction().query(\n        \"UPDATE public.starter_reviews SET state=$2,version=$3 WHERE id=$1 RETURNING id\",\n        [id, review.state, review.version],\n      ));\n      if (updated.length !== 1) throw new Error(\"Review write did not update one record\");\n      await afterApproved?.(transaction(), id, review.version);\n    },\n  };\n  function actor(invocation: CommandInvocation): string {\n    const who = requireTrustedIdentity(invocation.requestContext);\n    const access = record(record(invocation.requestContext)[\"access\"]);\n    if (access[\"projectId\"] !== projectId || access[\"tenantId\"] !== tenantId\n      || !Array.isArray(access[\"permissions\"]) || !access[\"permissions\"].includes(\"review.approve\")) {\n      throw new ApplicationError(\"Command permission denied\", { status: 403, code: \"REVIEW_PERMISSION_DENIED\" });\n    }\n    return who.subject;\n  }\n  const commandStore = createPostgresCommandStore(database);\n  return {\n    deps: { dbClient: store }, requestContext,\n    commandGovernance: {\n      authorize(invocation) {\n        const command = invocation.command;\n        if (command.name !== \"review.approve\" || command.permission !== \"review.approve\"\n          || command.transaction !== \"required\" || command.idempotency !== \"required\"\n          || command.audit !== \"review.approved\" || command.rpc !== undefined) {\n          throw new ApplicationError(\"Unsupported review command\", { status: 501, code: \"REVIEW_COMMAND_UNSUPPORTED\" });\n        }\n        actor(invocation);\n      },\n      async idempotency(invocation, next) {\n        const command = createTransactionalCommand({\n          name: invocation.command.name, store: commandStore,\n          inputCodec: plaintextCommandInput, input, result,\n          async authorize(who, request, tx) {\n            const found = rows(await tx.query(\n              \"SELECT r.id FROM public.starter_reviews r JOIN public.starter_members m ON m.subject=r.owner_id \" +\n              \"CROSS JOIN public.starter_application a \" +\n              \"WHERE r.id=$1 AND r.owner_id=$2 AND m.enabled AND m.can_approve \" +\n              \"AND a.singleton AND a.project_id=$3 AND a.tenant_id=$4 FOR UPDATE OF r,m FOR SHARE OF a\",\n              [request.id, who.actorId, projectId, who.tenantId],\n            ));\n            return found.length === 1 ? \"allow\" : \"deny\";\n          },\n          execute: tx => scope.run(tx, async () => {\n            try { return await next(); }\n            catch (error) {\n              if (isPublicConflict(error)) {\n                throw new CommandError(\"COMMAND_IDEMPOTENCY_CONFLICT\");\n              }\n              throw error;\n            }\n          }),\n          audit: { event: \"review.approved\", details: request => ({ reviewId: request.id }) },\n        });\n        try {\n          const receipt = await command.execute(\n            { actorId: actor(invocation), tenantId }, requireIdempotencyKey(invocation),\n            { id: invocation.input.params[\"id\"], expectedVersion: record(invocation.input.body)[\"expectedVersion\"] },\n            invocation.request.signal,\n          );\n          if (receipt.status !== \"confirmed\") throw new CommandError(\"COMMAND_OUTCOME_UNKNOWN\");\n          return receipt.result;\n        } catch (error) {\n          if (!(error instanceof CommandError)) throw error;\n          const status = error.code === \"COMMAND_REJECTED\" ? 403\n            : error.code === \"COMMAND_IDEMPOTENCY_CONFLICT\" ? 409 : 503;\n          throw new ApplicationError(error.code, { code: error.code, status });\n        }\n      },\n      transaction(_invocation, next) { transaction(); return next(); },\n      // The durable command owns the authoritative audit and receipt in the same transaction.\n      audit: { succeeded() { transaction(); }, failed() {} },\n    },\n  };\n}\n";
-export declare const STARTER_REVIEW_POSTGRES_TEST = "import { expect, test } from \"bun:test\";\nimport { createReviewPostgresAdapters } from \"../src/host/review-postgres\";\nimport type { ReviewStore } from \"../src/review/review\";\n\nconst identity = {\n  issuer: \"https://identity.example.test\", audience: \"review-test\", clientId: \"review-client\",\n  projectId: \"review-test\", jwksUrl: \"https://identity.example.test/jwks\",\n};\nfunction database(binding: unknown) {\n  const queries: string[] = [];\n  return {\n    queries,\n    async transaction<T>(run: (tx: { query(text: string): Promise<unknown> }) => Promise<T>): Promise<T> {\n      return run({ async query(text) { queries.push(text); return binding; } });\n    },\n  };\n}\n\ntest(\"PostgreSQL host rejects missing or mismatched application ownership without creating data\", async () => {\n  for (const binding of [[], [{ project_id: \"other\", tenant_id: \"review-test\" }],\n    [{ project_id: \"review-test\", tenant_id: \"other\" }]]) {\n    const db = database(binding);\n    await expect(createReviewPostgresAdapters({ database: db, identity, tenantId: \"review-test\" }))\n      .rejects.toThrow(\"binding mismatch\");\n    expect(db.queries).toEqual([\"SELECT project_id,tenant_id FROM public.starter_application WHERE singleton\"]);\n  }\n});\n\ntest(\"PostgreSQL host never falls back to demo identity or unbound business storage\", async () => {\n  const db = database([{ project_id: \"review-test\", tenant_id: \"review-test\" }]);\n  const adapters = await createReviewPostgresAdapters({ database: db, identity, tenantId: \"review-test\" });\n  await expect(adapters.requestContext(new Request(\"http://localhost/reviews/health\")))\n    .rejects.toMatchObject({ code: \"AUTHENTICATION_REQUIRED\" });\n  const store = adapters.deps[\"dbClient\"] as ReviewStore;\n  await expect(store.get(\"reviews\", \"example\")).rejects.toThrow(\"durable command transaction\");\n  await expect(store.set(\"reviews\", \"example\", { state: \"approved\", version: 2 }))\n    .rejects.toThrow(\"durable command transaction\");\n  expect(db.queries).toHaveLength(1);\n});\n";
+export declare const STARTER_REVIEW_POSTGRES = "import { plaintextCommandInput } from \"@supacloud/commands\";\nimport { CommandError } from \"@supacloud/contracts\";\nimport { createPostgresCommandStore, type CommandDatabase, type CommandTransaction } from \"@supacloud/db\";\nimport {\n  ApplicationError, createSchemaDecoder, createSupAuthRequestContext, requireTrustedIdentity,\n  createTransactionalCommandGovernance,\n  type CommandInvocation, type SupAuthContextOptions,\n} from \"@supacloud/elysia\";\nimport type { AppAdapters } from \"../application\";\nimport type { ReviewStore } from \"../review/review\";\nimport type { ReviewUploadPort } from \"../review/uploads\";\nimport { ApprovalInput, ReviewResult } from \"../review/contracts\";\n\nconst input = createSchemaDecoder(ApprovalInput, { normalize: false });\nconst result = createSchemaDecoder(ReviewResult, { normalize: false });\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\nfunction record(value: unknown): Record<string, unknown> {\n  if (!isRecord(value)) throw new TypeError(\"Invalid review record\");\n  return value;\n}\nfunction rows(value: unknown): Record<string, unknown>[] {\n  if (!Array.isArray(value)) throw new TypeError(\"Invalid database result\");\n  return value.map(record);\n}\nfunction isPublicConflict(value: unknown): boolean {\n  return value instanceof ApplicationError && value.status === 409\n    || isRecord(value) && value[\"expose\"] === true && value[\"status\"] === 409 && typeof value[\"code\"] === \"string\";\n}\nexport interface ReviewPostgresOptions {\n  database: CommandDatabase;\n  tenantId: string;\n  identity: Omit<SupAuthContextOptions, \"resolveAccess\">;\n  uploads?: ReviewUploadPort;\n  // Only database effects here: they commit/rollback with the approval and receipt.\n  afterApproved?(tx: CommandTransaction, id: string, version: number): Promise<void>;\n}\n\nexport async function createReviewPostgresAdapters(options: ReviewPostgresOptions): Promise<\n  AppAdapters & { requestContext: ReturnType<typeof createSupAuthRequestContext> }\n> {\n  const { database, tenantId, identity } = options;\n  const projectId = identity.projectId;\n  const afterApproved = options.afterApproved;\n  if (!tenantId.trim()) throw new TypeError(\"Review tenantId is required\");\n  const query = (text: string, parameters: readonly string[] = []) =>\n    database.transaction(tx => tx.query(text, parameters));\n  const binding = rows(await query(\n    \"SELECT project_id,tenant_id FROM public.starter_application WHERE singleton\",\n  ));\n  if (binding.length !== 1 || binding[0]?.[\"project_id\"] !== projectId || binding[0]?.[\"tenant_id\"] !== tenantId) {\n    throw new Error(\"Review database project/tenant binding mismatch\");\n  }\n  const requestContext = createSupAuthRequestContext({\n    ...identity,\n    async resolveAccess(who) {\n      const found = rows(await query(\n        \"SELECT m.can_approve FROM public.starter_members m,public.starter_application a \" +\n        \"WHERE m.subject=$1 AND m.enabled AND a.singleton AND a.project_id=$2 AND a.tenant_id=$3\",\n        [who.subject, projectId, tenantId],\n      ));\n      return found.length === 1 ? { projectId, tenantId,\n        permissions: found[0]?.[\"can_approve\"] === true ? [\"review.approve\"] : [],\n      } : null;\n    },\n  });\n  const transaction = () => commandBinding.transaction();\n  const store: ReviewStore = {\n    ...options.uploads,\n    async get(table, id) {\n      if (table !== \"reviews\") throw new Error(\"Unsupported review table\");\n      return rows(await transaction().query(\n        \"SELECT state,version FROM public.starter_reviews WHERE id=$1 FOR UPDATE\", [id],\n      ))[0];\n    },\n    async set(table, id, value) {\n      if (table !== \"reviews\") throw new Error(\"Unsupported review table\");\n      const review = result(value);\n      const updated = rows(await transaction().query(\n        \"UPDATE public.starter_reviews SET state=$2,version=$3 WHERE id=$1 RETURNING id\",\n        [id, review.state, review.version],\n      ));\n      if (updated.length !== 1) throw new Error(\"Review write did not update one record\");\n      await afterApproved?.(transaction(), id, review.version);\n    },\n  };\n  function actor(invocation: CommandInvocation): string {\n    const who = requireTrustedIdentity(invocation.requestContext);\n    const access = record(record(invocation.requestContext)[\"access\"]);\n    if (access[\"projectId\"] !== projectId || access[\"tenantId\"] !== tenantId\n      || !Array.isArray(access[\"permissions\"]) || !access[\"permissions\"].includes(\"review.approve\")) {\n      throw new ApplicationError(\"Command permission denied\", { status: 403, code: \"REVIEW_PERMISSION_DENIED\" });\n    }\n    return who.subject;\n  }\n  const commandBinding = createTransactionalCommandGovernance({\n    permission: \"review.approve\",\n    identity: invocation => ({ actorId: actor(invocation), tenantId }),\n    input: invocation => ({\n      ...record(invocation.input.body), id: invocation.input.params[\"id\"],\n    }),\n    rejection: error => isPublicConflict(error) ? new CommandError(\"COMMAND_IDEMPOTENCY_CONFLICT\") : undefined,\n    definition: {\n      name: \"review.approve\", store: createPostgresCommandStore(database),\n      inputCodec: plaintextCommandInput, input, result,\n      async authorize(who, request, tx) {\n        const found = rows(await tx.query(\n          \"SELECT r.id FROM public.starter_reviews r JOIN public.starter_members m ON m.subject=r.owner_id \" +\n          \"CROSS JOIN public.starter_application a \" +\n          \"WHERE r.id=$1 AND r.owner_id=$2 AND m.enabled AND m.can_approve \" +\n          \"AND a.singleton AND a.project_id=$3 AND a.tenant_id=$4 FOR UPDATE OF r,m FOR SHARE OF a\",\n          [request.id, who.actorId, projectId, who.tenantId],\n        ));\n        return found.length === 1 ? \"allow\" : \"deny\";\n      },\n      audit: { event: \"review.approved\", details: request => ({ reviewId: request.id }) },\n    },\n  });\n  return { deps: { dbClient: store }, requestContext, commandGovernance: commandBinding.governance };\n}\n";
+export declare const STARTER_REVIEW_POSTGRES_TEST = "import { expect, test } from \"bun:test\";\nimport { createReviewPostgresAdapters } from \"../src/host/review-postgres\";\nimport type { ReviewStore } from \"../src/review/review\";\n\nconst identity = {\n  issuer: \"https://identity.example.test\", audience: \"review-test\", clientId: \"review-client\",\n  projectId: \"review-test\", jwksUrl: \"https://identity.example.test/jwks\",\n};\nfunction database(binding: unknown) {\n  const queries: string[] = [];\n  return {\n    queries,\n    async transaction<T>(run: (tx: { query(text: string): Promise<unknown> }) => Promise<T>): Promise<T> {\n      return run({ async query(text) { queries.push(text); return binding; } });\n    },\n  };\n}\n\ntest(\"PostgreSQL host rejects missing or mismatched application ownership without creating data\", async () => {\n  for (const binding of [[], [{ project_id: \"other\", tenant_id: \"review-test\" }],\n    [{ project_id: \"review-test\", tenant_id: \"other\" }]]) {\n    const db = database(binding);\n    await expect(createReviewPostgresAdapters({ database: db, identity, tenantId: \"review-test\" }))\n      .rejects.toThrow(\"binding mismatch\");\n    expect(db.queries).toEqual([\"SELECT project_id,tenant_id FROM public.starter_application WHERE singleton\"]);\n  }\n});\n\ntest(\"PostgreSQL host never falls back to demo identity or unbound business storage\", async () => {\n  const db = database([{ project_id: \"review-test\", tenant_id: \"review-test\" }]);\n  const adapters = await createReviewPostgresAdapters({ database: db, identity, tenantId: \"review-test\" });\n  await expect(adapters.requestContext(new Request(\"http://localhost/reviews/health\")))\n    .rejects.toMatchObject({ code: \"AUTHENTICATION_REQUIRED\" });\n  const store = adapters.deps[\"dbClient\"] as ReviewStore;\n  await expect(store.get(\"reviews\", \"example\")).rejects.toThrow(\"not active\");\n  await expect(store.set(\"reviews\", \"example\", { state: \"approved\", version: 2 }))\n    .rejects.toThrow(\"not active\");\n  expect(db.queries).toHaveLength(1);\n});\n";
 export declare const STARTER_REVIEW_DELIVERY_HOST = "import { SQL } from \"bun\";\nimport { createClient } from \"@supabase/supabase-js\";\nimport { createBunCommandDatabase } from \"@supacloud/db/bun\";\nimport { createApplication, type CompiledModule } from \"@supacloud/elysia\";\nimport { createReviewPostgresAdapters } from \"./host/review-postgres\";\nimport { createReviewAttachmentAdapters } from \"./host/review-attachments\";\nimport { createReviewUploadAdapters } from \"./host/review-uploads\";\n\nfunction required(name: string): string {\n  const value = process.env[name];\n  if (!value?.trim()) throw new Error(\"Missing required host setting: \" + name);\n  return value;\n}\n\nfunction databaseConnection(): SQL.Options {\n  const socket = process.env[\"DATABASE_SOCKET_PATH\"];\n  if (socket && process.env[\"DATABASE_URL\"]) throw new Error(\"Conflicting database connection settings\");\n  if (socket) {\n    return { adapter: \"postgres\", path: socket, database: required(\"DATABASE_NAME\"), username: required(\"DATABASE_USER\") };\n  }\n  const url = new URL(required(\"DATABASE_URL\"));\n  if (url.protocol !== \"postgres:\" && url.protocol !== \"postgresql:\") throw new Error(\"Invalid database URL\");\n  return {\n    adapter: \"postgres\", url: url.href, hostname: url.hostname.replace(/^\\[|\\]$/g, \"\"), port: Number(url.port || 5432),\n    username: decodeURIComponent(url.username), password: decodeURIComponent(url.password),\n    database: decodeURIComponent(url.pathname.slice(1)),\n  };\n}\n\nexport async function createDeliveryApplication(modules: CompiledModule[], lifecycle: { signal: AbortSignal }) {\n  lifecycle.signal.throwIfAborted();\n  const connection = databaseConnection();\n  const attachments = process.env[\"REVIEW_ATTACHMENTS\"];\n  if (attachments !== undefined && attachments !== \"enabled\") throw new Error(\"Invalid attachment configuration\");\n  const settings = {\n    tenantId: required(\"APP_TENANT_ID\"),\n    identity: {\n      issuer: required(\"SUPAUTH_ISSUER\"), audience: required(\"SUPAUTH_AUDIENCE\"),\n      clientId: required(\"SUPAUTH_CLIENT_ID\"), projectId: required(\"SUPACLOUD_PROJECT_ID\"),\n      jwksUrl: required(\"SUPAUTH_JWKS_URL\"),\n    },\n  };\n  const pool = new SQL({ ...connection, max: 12, connectionTimeout: 5 });\n  let closing: Promise<void> | undefined;\n  const close = () => closing ??= pool.close({ timeout: 5 });\n  let stage: \"attachments\" | \"uploads\" | \"postgres\" | \"application\" = \"attachments\";\n  try {\n    const database = createBunCommandDatabase(pool);\n    const attachmentOptions = attachments === \"enabled\" ? {\n      database, tenantId: settings.tenantId, projectId: settings.identity.projectId,\n      service: createClient(required(\"SUPACLOUD_URL\"), required(\"SUPACLOUD_SERVICE_ROLE_KEY\"), {\n        auth: { persistSession: false, autoRefreshToken: false, detectSessionInUrl: false },\n      }),\n    } : undefined;\n    const durable = attachmentOptions ? await createReviewAttachmentAdapters(attachmentOptions) : undefined;\n    stage = \"uploads\";\n    const uploads = attachmentOptions ? await createReviewUploadAdapters(attachmentOptions) : undefined;\n    stage = \"postgres\";\n    const adapters = await createReviewPostgresAdapters({\n      database, tenantId: settings.tenantId, identity: settings.identity,\n      ...(uploads ? { uploads } : {}),\n      ...(durable ? { afterApproved: durable.enqueue } : {}),\n    });\n    lifecycle.signal.throwIfAborted();\n    stage = \"application\";\n    const app = createApplication({ name: \"review\", modules, ...adapters });\n    return { fetch: (request: Request) => app.handle(request), close };\n  } catch (error) {\n    await close();\n    const code = error !== null && typeof error === \"object\" && \"code\" in error\n      && typeof error.code === \"string\" && /^[A-Z0-9_]{1,64}$/.test(error.code) ? error.code : \"UNKNOWN\";\n    console.error(JSON.stringify({ event: \"review-host-initialization-failed\", stage, code }));\n    // Database/identity errors can contain connection details; never echo the underlying cause.\n    throw new Error(\"Review host initialization failed\");\n  }\n}\n";

package/dist/shared/tools/app-starter-query.d.ts

@@ -0,0 +1 @@
+export declare const STARTER_REVIEW_QUERY = "import type { SupabaseClient } from \"@supabase/supabase-js\";\nimport type { ReviewRow } from \"../../db/schema\";\n\n// This read projection uses SQL column names shared with the Drizzle source.\n// Do not expose camelCase Drizzle property names as PostgREST column names.\nexport type ReviewSummary = Pick<ReviewRow, \"id\" | \"state\" | \"version\">;\nexport type ReviewReadDatabase = {\n  public: {\n    Tables: {\n      starter_reviews: {\n        Row: ReviewSummary;\n        Insert: never;\n        Update: never;\n        Relationships: [];\n      };\n    };\n    Views: Record<never, never>;\n    Functions: Record<never, never>;\n  };\n};\n\nexport interface ReviewPageOptions {\n  page?: number;\n  pageSize?: number;\n  signal?: AbortSignal;\n}\n\n// Reuse the application's user-scoped client. Identity verification and row\n// authorization belong to the gateway and database, never a caller-supplied owner.\nexport async function listReviews(\n  client: SupabaseClient<ReviewReadDatabase>,\n  { page = 1, pageSize = 25, signal }: ReviewPageOptions = {},\n) {\n  if (!Number.isSafeInteger(page) || page < 1\n    || !Number.isSafeInteger(pageSize) || pageSize < 1 || pageSize > 100\n    || !Number.isSafeInteger(page * pageSize)) {\n    throw new RangeError(\"Invalid review page: page >= 1 and pageSize between 1 and 100 are required\");\n  }\n  signal?.throwIfAborted();\n  const start = (page - 1) * pageSize;\n  const query = client.from(\"starter_reviews\")\n    .select(\"id,state,version\", { count: \"exact\" })\n    .order(\"id\", { ascending: true })\n    .range(start, start + pageSize - 1);\n  const { data, error, count } = await (signal ? query.abortSignal(signal) : query);\n  if (error) throw error;\n  if (data === null || count === null) throw new Error(\"Incomplete review page response\");\n  return { data, total: count, page, pageSize, hasNextPage: start + data.length < count };\n}\n";

package/dist/shared/tools/deploy-tools.d.ts

@@ -27,6 +27,8 @@ export declare const deployToolSchema: {
     cwd: Type.TOptional<Type.TString>;
     skip_build: Type.TOptional<Type.TBoolean>;
     assets_only: Type.TOptional<Type.TBoolean>;
+    backend: Type.TOptional<Type.TBoolean>;
+    status: Type.TOptional<Type.TString>;
     json: Type.TOptional<Type.TBoolean>;
 };
 export declare function findDeployConfigRoot(startDirectory: string, environmentName?: string): Promise<string>;

package/dist/shared/tools/frontend-release-control.d.ts

@@ -46,7 +46,10 @@ export declare function uploadProjectWebRelease(http: FrontendReleaseHttp, proje
 export declare function uploadFrontendSource(http: FrontendReleaseHttp, projectRef: string, deploymentId: string, archivePath: string): Promise<ToolResponse>;
 export declare function getActiveFrontendRelease(http: FrontendReleaseHttp, projectRef: string, deploymentId: string): Promise<ToolResponse>;
 export declare function readFrontendReleaseAuthority(http: FrontendReleaseHttp, projectRef: string, deploymentId: string): Promise<ToolResponse>;
-export declare function publishFrontendRelease(http: FrontendReleaseHttp, projectRef: string, deploymentId: string, archivePath: string, expectedTreeSha256: string): Promise<ToolResponse>;
+export declare function publishFrontendRelease(http: FrontendReleaseHttp, projectRef: string, deploymentId: string, archiveSource: string | (() => Promise<{
+    archivePath: string;
+    cleanup(): Promise<void>;
+}>), expectedTreeSha256: string): Promise<ToolResponse>;
 export declare function rollbackFrontendRelease(http: FrontendReleaseHttp, projectRef: string, deploymentId: string, releaseId?: string, options?: {
     expectedActiveReleaseId?: string;
     expectedActivationId?: string;

package/dist/shared/tools/project-deployment.d.ts

@@ -2,3 +2,4 @@ import type { ToolResult } from "../tool-server";
 import type { HttpTransport } from "../transports/http";
 export declare function requireProjectDeploymentProtocol(http: Pick<HttpTransport, "get">, projectRef: string, environmentId: string): Promise<void>;
 export declare function runProjectDeployment(http: Pick<HttpTransport, "post" | "get">, args: Record<string, unknown>): Promise<ToolResult>;
+export declare function readProjectDeploymentStatus(http: Pick<HttpTransport, "get">, projectRef: string, environmentId: string, deploymentId: string): Promise<ToolResult>;

package/dist/tool-runtime.js

@@ -131,7 +131,7 @@ import { Type as Type2 } from "typebox";
 import { Value as Value2 } from "typebox/value";
 
 // src/shared/deployment-upgrade.ts
-var DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment commands are no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, configure frontend in supacloud.json for static assets, or application.id and application.environmentId for executable application delivery, then run `supacloud deploy`. Use `supacloud deploy --assets_only` to publish only Web assets in a mixed repository. SupaCloud owns activation; do not retry with legacy commands.";
+var DEPLOYMENT_UPGRADE = "DEPLOYMENT_UPGRADE_REQUIRED: Legacy deployment commands are no longer supported. Upgrade with `npm install -g @supacloud/cli@latest`, configure frontend in supacloud.json for static assets, or application.id and application.environmentId for executable application delivery, then run `supacloud deploy`. With a frontend configured, deploy publishes only Web assets; use `supacloud deploy --backend` for the application backend. `supacloud deploy --assets_only` remains an explicit Web-only option. SupaCloud owns activation; do not retry with legacy commands.";
 var removedFrontendActions = new Set([
   "deploy_git",
   "deploy_upload",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.98.0",
+  "version": "0.101.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,21 +52,21 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@supacloud/compiler": "^0.46.1",
-    "@supacloud/delivery": "0.18.0",
-    "@supacloud/db": "0.17.0",
-    "typebox": "1.3.36"
+    "@supacloud/compiler": "^0.46.3",
+    "@supacloud/delivery": "0.18.1",
+    "@supacloud/db": "0.17.1",
+    "typebox": "1.3.37"
   },
   "overrides": {
     "@supacloud/contracts": "0.9.0",
-    "@supacloud/delivery": "0.18.0",
-    "@graphql-tools/utils": "^12.0.3"
+    "@supacloud/delivery": "0.18.1",
+    "@graphql-tools/utils": "^12.0.4"
   },
   "devDependencies": {
-    "@supacloud/elysia": "^0.24.1",
+    "@supacloud/elysia": "0.31.0",
     "@types/bun": "^1.4.3",
-    "effect": "4.0.2",
-    "elysia": "2.0.0-beta.21",
+    "effect": "4.0.5",
+    "elysia": "2.0.0-beta.32",
     "typescript": "^7.0.2"
   }
 }