Skip to main content
Fused keeps the common path short without removing any control boundary. Guided commands compose the same plan and apply functions used by the explicit workflow, and the Engine still owns validation, permissions, and immutable state.

​
Choose the right level of control

Terminal commands prompt only when a decision is needed. Omit --interactive; that compatibility flag only makes the terminal default explicit.

​
Plan and apply separately

Use the explicit SDK lifecycle when you are editing an existing config, need an independent approval boundary, or want to retry package transfer separately:
1

Preview

Plan validates the local config before contacting the Engine. If the exact selected bucket is missing a credential, a terminal plan can securely offer to write it and retry once.
2

Apply

Apply commits only the config content and Engine recorded by the receipt.
3

Download

Keeping transfer separate lets you retry a failed download without replaying apply.
The same lifecycle applies to other config kinds:
Only SDK planning offers credential remediation. Workspace, MCP, webhook, and import planning do not mutate credentials.

​
Make automation explicit

Use --no-input for every unattended command. It turns a missing selection, confirmation, or credential into an error instead of waiting for terminal input. Add --json when the command exposes structured output. For app initialization, automation must declare the mode and operation boundary that the terminal selectors would normally collect:
Use --select-all linear instead when the SDK intentionally needs the service’s complete operation surface. Top-level extend infers the app mode from the existing YAML and updates that same file; no parallel config is created. A real change to a stable SemVer version advances to the next minor version deterministically, including under --no-input:
For example, 1.0.0 becomes 1.1.0. A terminal includes the inferred successor in its combined confirmation. An idempotent extension keeps its current version. Pass --version to override the inference; prerelease and non-SemVer identities always require an explicit successor. An unattended MCP init also requires an authored description:
--value-stdin is not an interaction flag. It selects the secure source of secret bytes, while --no-input guarantees that the command will not prompt. A missing credential remains a structured bucket_credentials_missing error in automation.

​
Migrate existing init commands

The resource-scoped creation commands remain supported as compatibility aliases for existing scripts. New documentation uses the top-level command so SDK, API, and MCP onboarding share one path. The aliases call the same underlying creation functions. You can migrate without changing the resulting resource, receipt boundaries, or config location. For discovery, make both choices explicit as well:

​
Use offline validation deliberately

Plan already validates the local config before its first Engine request. Run standalone validation only when the check must stay offline:

​
Keep and move receipts deliberately

A receipt binds a plan to the exact config hash and normalized Engine URL. Apply refuses a stale file, a receipt without Engine identity, or a receipt created for another Engine. Use a direct plan ID only when it came from the exact current config and Engine. Re-plan after the config or target Engine changes.

​
Recover without guessing

  • If generated init --sdk receives generation_contract_pin_unavailable, it first resolves every selected active workspace version. It then prints Refreshing immutable SDK generation snapshot for <service>@<version>... as it refreshes each exact snapshot and retries the unchanged plan once. --no-input uses the same deterministic path without prompting. The CLI never derives a pin locally, substitutes the runtime contract hash, selects a newer version, or retries twice. API mode, MCP mode, ordinary sdk plan, and unrelated failures do not refresh snapshots.
  • If exact resolution or refresh fails, init does not retry the plan or create the app config. If the one retry fails, the error reports every refresh that already completed. A repeated missing-pin response directs you to the Engine and Registry logs or another enabled version. A workspace activation may already be applied under its separate receipt. Changing credentials or operation selection does not repair this failure.
  • If SDK credential remediation is declined or unavailable, store the credential in the selected bucket and rerun sdk plan.
  • If package transfer fails after a successful SDK apply, rerun sdk download, not apply.
  • If import apply times out or loses its response, run fused-cli import status <operation-id> with the receipt’s plan ID. Do not replay the mutation while its commit state is unknown.
  • If a scoped workspace activation partially succeeds, use the exact ID-pinned recovery command printed by the CLI.
For explicit workspace maintenance, run:
This advanced command refreshes only a bounded batch of activated versions whose runtime contract snapshot is missing or unpinned. It reacquires each exact immutable contract from Registry. It does not manufacture a generation pin, float to another version, or run automatically as a workspace-wide fallback.

Build an SDK

Return to the guided creation path.

Enable a service

Activate one service without mirroring the full workspace.