# Deploy and operate a SmallForce website

A SmallForce deployment creates an immutable release from the project’s build output, uploads it, and waits until Preview serves it. Run deployment from an existing Vite SPA or a project already containing `smallforce.json`. The first deployment of a Vite SPA detects its build and creates the static project manifest automatically.

```bash
smallforce app deploy
smallforce app status
smallforce app release list
smallforce app env list
```

The application is the stable website identity. Releases are immutable code and
assets. Preview, Production, and optional custom environments are stable URLs
that point to a ready release. Promote the reviewed release without rebuilding:

```bash
smallforce app env deploy production --release <releaseId>
```

Promotion and rollback move only the environment pointer. Each environment
keeps its own variables, secrets, SQLite data, mutable files, and observability.

## Operate the deployed application

The application tools can inspect:

- Release history and the release currently active in each environment.
- Runtime logs over a selected time range.
- Human traffic and crawler traffic.
- Requests, failures, rate limits, and runtime diagnostics.
- Application database schema and queries.
- Mutable application files and storage usage.

Select the environment when inspecting runtime data. Reads default to Preview;
database and configuration mutations require an explicit environment:

```bash
smallforce app inspect --environment preview --json
smallforce app analytics --environment production --days 30 --json
smallforce app var set API_URL https://api.example.com --environment preview
```

Use server variables for non-secret runtime configuration and write-only secrets for credentials. Secret values are not returned after being stored.

## Control access

A generated application can be public, protected by a shared password, restricted to an allowlist of Google member emails, or use organization SSO. Preview and custom URLs first require SmallForce organization membership, then run the same application access policy so authentication can be tested before Production promotion.

See the complete [`smallforce app` reference](/docs/cli/commands/app) for every deployment, database, file, environment, observability, and access command.