# Foundation Deploy Contract For Agents

Canonical deployment reference for Foundation consumer app repositories.

Last updated: 2026-06-29

## Required File

Consumer app repositories need `mvp.config.json` at the repo root.

Default:

```json
{
  "build": "npm install && npm run build",
  "files": "dist",
  "entry": "index.html",
  "sdk": "^1.0.0"
}
```

Fields:

- `build`: command Foundation runs before deployment.
- `files`: build output directory to upload.
- `entry`: app entry file inside `files`.
- `sdk`: SDK compatibility hint.
- `node`: optional Node major version.

## Deployment Flow

Foundation reads `mvp.config.json` from GitHub, downloads the repo, runs the build command, uploads the configured output directory, and writes `/foundation-env.json` next to the built assets.

The app should not create `/foundation-env.json` itself for production deployment. Foundation writes it.

## Runtime Identity

`foundation-env.json` contains runtime identity:

```json
{
  "applicationId": "app-id",
  "applicationTenant": "tenant-id",
  "applicationVersion": "1.0.0",
  "configUrl": "https://backend.example.com/api/v1/public/init"
}
```

The SDK reads this file automatically in production. When it is present, values from the file override local options and `baseUrl` is cleared.

## Local Development

Local development should pass explicit SDK config:

```ts
await createFoundation({
  configUrl: import.meta.env.VITE_FOUNDATION_CONFIG_URL,
  tenantId: import.meta.env.VITE_FOUNDATION_TENANT_ID,
  appId: import.meta.env.VITE_FOUNDATION_APP_ID,
  baseUrl: import.meta.env.VITE_FOUNDATION_API_BASE_URL,
  auth
})
```

`baseUrl` is optional and dev-only. Use it for local proxies to avoid CORS while developing against a remote backend.

## Verification Checklist

- `mvp.config.json` exists at the repo root.
- `mvp.config.json` has `build`, `files`, and `entry`.
- The configured `build` command succeeds.
- The configured `files` directory exists after build.
- The configured `entry` file exists inside `files`.
- SDK initialization works with explicit local config.
- Production code can initialize from `/foundation-env.json`.
- Production code does not require `baseUrl`.
- Built frontend assets do not include private secrets or service credentials.