Deployment

The target stack is Vercel for Next.js, Supabase for Auth/PostgreSQL/Storage and Cloudflare DNS for foliovera.app. Vercel’s application root is apps/web. Corepack selects the pinned pnpm version from the monorepo lockfile configuration.

Set these production environment variables in Vercel:

Variable	Purpose
APP_ORIGIN	https://foliovera.app
SUPABASE_URL	Target Supabase project URL
NEXT_PUBLIC_SUPABASE_URL	The same public API URL
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY	Publishable key
ENABLE_EXPERIMENTAL_COREPACK	1

Docker builds set BUILD_TARGET=docker to generate standalone output. Vercel uses its native Next.js adapter without standalone output.

Before applying migrations, check the exact project reference and existing database backups. The seed does not create test authentication users in production. Only invited family members can enter the workspace. Normal app requests use the publishable key and the user’s session under RLS. Administrative credentials belong only to separate setup operations, never the Vercel app.

The configured SMTP service is Resend, sender login@foliovera.app, host smtp.resend.com, port 465 and a domain-restricted sending key. DNS verification does not prove successful email delivery or sign-in; test those separately.

Use the official Supabase CLI with certificate and hostname verification for database operations. The current workstation cannot reach the direct IPv6 endpoint and its Session Pooler connection failed. Initial deployment used the official Management API migration endpoint. The API assigns versions with second precision: send sequential requests more than one second apart with unique Idempotency-Key headers. Repository filenames now match those authoritative versions, with unchanged SQL. The disposable local database was rebuilt and tested after synchronization. Never manually edit migration history; compare it with the repository before applying subsequent migrations.

Supabase requires the application Site URL and exact /auth/callback redirect, Google OAuth and SMTP. Google Cloud uses the Supabase project’s OAuth callback. OAuth and SMTP secrets must not be committed. The normal login page offers Google and magic link; password recovery remains separate from public navigation.

Before declaring production ready, verify HTTPS, Google sign-in, delivered magic links, outsider denial, student permissions, private uploads, logout and rollback. Current evidence and verdicts live under .agent/tasks/foliovera-mvp/. This guide describes the deployment process; it does not certify completion.