I need confirmation of Vercel’s targeting behavior for the first deployment of an existing empty, non-Git project.

Project configuration:

• Hobby plan
• Existing project with standard Production, Preview, and Development environments
• No Git connection
• No custom environments
• Deployment Protection enabled for All Deployments
• Source files supplied inline to POST /v13/deployments
• No gitSource or Git metadata
• No existing deployments before either attempt

Two separate single-attempt deployments were made:

Attempt 1:

• Request included target: "preview"
• Deployment ID: dpl_CttWNtaDmEuKzpwCzMnA8HkKpybW
• Result: Ready Production deployment with Production alias

Attempt 2:

• The serialized request completely omitted the target property
• Deployment ID: dpl_6vcpkSkLDoS8ozQ4DTXa2cbqbvDs
• Result: Ready Production deployment with Production alias

The first deployment was deleted before the second attempt. Both unintended deployments have now been deleted and their temporary credentials revoked.

The current REST API documentation says that if target is omitted, the target will be Preview:

https://vercel.com/docs/rest-api/deployments/create-a-new-deployment

The Vercel support chat stated that:

1. The first deployment of an empty project is always Production.
2. Deleting the project’s only deployment returns it to an uninitialized state.
3. The next deployment is therefore again treated as the initial Production deployment.
4. This behavior also applies to vercel deploy and vercel deploy --target=preview.

Can someone from Vercel confirm:

1. Is the first deployment always Production regardless of REST or CLI Preview selection?
2. Does deleting the only deployment reset this first-deployment state?
3. Is there any supported way to make the first deployment Preview?
4. Does vercel --prod --skip-domain prevent assignment of the automatic project .vercel.app Production alias, or only custom domains?
5. Must an initial Production baseline remain permanently for subsequent omitted-target API deployments to become Preview?
6. How should the REST and CLI documentation be interpreted in light of this first-deployment rule?

This is important because post-creation detection and deletion are not sufficient for our security boundary. We need to know the environment before submitting another deployment.

No credentials, source contents, or authorization headers are included in this post.