@supacloud/cli 0.84.0 → 0.86.0

package/README.md

@@ -310,6 +310,26 @@ legacy `.env` fallback. Core URL, credential, and project-ref values are not
 filled by mixing sources. If `SUPACLOUD_ENV` is set without a complete process
 context, it strictly selects `.env.supacloud.<value>`.
 
+For one-command deployments, declare public build variables explicitly in the
+target configuration:
+
+```json
+{
+  "targets": {
+    "web": {
+      "type": "frontend",
+      "root": "apps/web",
+      "id": "web",
+      "buildEnv": ["VITE_API_URL", "VITE_SUPABASE_ANON_KEY"]
+    }
+  }
+}
+```
+
+`buildEnv` is an allowlist. The selected profile values are injected only into
+the local build command; values are never printed, undeclared values are not
+passed through, and platform credentials or runtime secrets are rejected.
+
 The two credential scopes are separate. Management-backed remote commands use
 only `SUPACLOUD_API_URL` + `SUPACLOUD_API_TOKEN`. An application profile using
 `SUPABASE_URL` + `SUPABASE_SERVICE_ROLE_KEY` can be auto-linked for `status`,
@@ -884,11 +904,12 @@ whether the body is empty and the configured header names. Update receipts bind
 delete receipts return the matched revision as `deleted_updated_at`.
 
 For secret writes, `--from-env` accepts a comma-separated list of environment
-variable names. The CLI reads each non-empty value from its own process
-environment, so command arguments contain names only and values are never
-printed. Names must be unique shell-style identifiers (`[A-Za-z_][A-Za-z0-9_]*`,
-up to 256 characters). Missing or empty values fail before any HTTP request.
-Do not combine `--from-env` with the compatibility `--secrets` input.
+variable names. The CLI reads each non-empty value from the currently selected
+profile source, such as `.env.supacloud.test` selected by `--env test`; command
+arguments contain names only and values are never printed. Names must be unique
+shell-style identifiers (`[A-Za-z_][A-Za-z0-9_]*`, up to 256 characters).
+Missing or empty values fail before any HTTP request. Do not combine
+`--from-env` with the compatibility `--secrets` input.
 
 Branch promotion is migration-first. `branch promotion_plan` prints pending
 versions, names, statement counts, and checksums without echoing SQL into terminal

package/dist/index.js

@@ -9144,6 +9144,7 @@ function resolveSupaCloudContext(env = process.env, cwd = process.cwd(), selecti
     credentialScope: core.credentialScope,
     source: source.kind,
     sourcePath: source.path,
+    environmentVariables: source.values,
     insecureTls
   };
 }
@@ -9153,7 +9154,7 @@ var ACTION_POLICY = {
   deploy: { write: ["deploy"] },
   applications: {
     read: ["list_releases", "get_release", "get_runtime", "get_deployment_evidence", "get_configuration", "get_release_transfer_plan", "get_promotion_plan", "get_promotion_status", "get_rollback_snapshot", "get_history", "get_deploy_plan", "logs", "get_preview_plan", "list_previews", "get_preview"],
-    write: ["upload_release", "put_configuration", "transfer_release", "promote_application", "reconcile_promotion", "create_preview", "reconcile_preview", "cleanup_preview", "activate_release", "deploy_release", "rollback_release", "reconcile_activation", "retire_activation"]
+    write: ["upload_release", "put_configuration", "release_application", "transfer_release", "promote_application", "reconcile_promotion", "create_preview", "reconcile_preview", "cleanup_preview", "activate_release", "deploy_release", "rollback_release", "reconcile_activation", "retire_activation"]
   },
   project: {
     read: ["get", "endpoints", "health", "logs", "api_keys", "settings", "tasks", "task_detail", "task_stats", "dlq", "background_settings"],
@@ -9249,7 +9250,7 @@ var ACTION_POLICY = {
   app: {
     local: ["init", "generate", "dev", "watch", "verify-plan", "compile", "check", "graph", "explain", "export-tools", "context", "doctor", "fix", "plan", "build"],
     read: ["status", "logs", "transfer-plan", "promote-plan", "rollback-plan", "history", "deploy-plan", "diff", "promote-status", "preview-plan", "previews", "preview-list", "preview-status"],
-    write: ["upload", "configure", "transfer", "promote", "promote-reconcile", "deploy", "rollback", "reconcile", "retire", "preview", "preview-create", "preview-reconcile", "preview-cleanup"]
+    write: ["release", "upload", "configure", "transfer", "promote", "promote-reconcile", "deploy", "rollback", "reconcile", "retire", "preview", "preview-create", "preview-reconcile", "preview-cleanup"]
   },
   db: {
     local: ["context", "lint", "explain", "diff", "role_sql"],
@@ -10477,6 +10478,37 @@ function parseApplicationDeployPlan(value) {
     throw new Error("Invalid application deploy plan action");
   return value;
 }
+// node_modules/@supacloud/delivery/src/application-release-operation.ts
+var closed3 = { additionalProperties: false };
+var nullableActivation = Union([ApplicationActivationIdSchema, Null()]);
+var ApplicationReleaseRequestSchema = _Object_({
+  release_id: ApplicationReleaseIdSchema,
+  configuration_id: Optional(ApplicationConfigurationIdSchema),
+  configuration_write: Optional(ApplicationConfigurationWriteSchema),
+  activation_id: Optional(ApplicationActivationIdSchema),
+  expected_activation_id: Optional(nullableActivation),
+  expected_plan_sha256: Optional(ApplicationReleaseIdSchema)
+}, closed3);
+var ApplicationReleaseResultSchema = _Object_({
+  schema: Literal("supacloud.application-release.v1"),
+  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+  application_id: ApplicationIdSchema,
+  environment_id: ApplicationIdSchema,
+  release_id: ApplicationReleaseIdSchema,
+  configuration_id: ApplicationConfigurationIdSchema,
+  activation_id: ApplicationActivationIdSchema,
+  expected_activation_id: nullableActivation,
+  plan_sha256: ApplicationReleaseIdSchema,
+  action: Union([Literal("activate"), Literal("no-op")]),
+  replayed: Boolean2(),
+  execution_performed: Boolean2()
+}, closed3);
+function parseApplicationReleaseResult(value) {
+  if (!Check2(ApplicationReleaseResultSchema, value)) {
+    throw new Error("Invalid application release result");
+  }
+  return structuredClone(value);
+}
 // node_modules/@supacloud/delivery/src/application-history.ts
 var scope = {
   project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
@@ -10561,7 +10593,7 @@ var phaseStatus = Union([
   Literal("failed"),
   Literal("cleaned")
 ]);
-var closed3 = { additionalProperties: false };
+var closed4 = { additionalProperties: false };
 var ApplicationPreviewReceiptSchema = _Object_({
   schema: Literal("supacloud.application-preview.v1"),
   preview_id: String2({ pattern: "^[a-f0-9-]{8,64}$" }),
@@ -10581,46 +10613,46 @@ var ApplicationPreviewReceiptSchema = _Object_({
     Literal("cleaned")
   ]),
   resources: _Object_({
-    build_artifact: _Object_({ status: phaseStatus, release_id: ApplicationReleaseIdSchema }, closed3),
+    build_artifact: _Object_({ status: phaseStatus, release_id: ApplicationReleaseIdSchema }, closed4),
     database_branch: _Object_({
       status: phaseStatus,
       branch_ref: String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" }),
       data_mode: Union([Literal("schema_only"), Literal("full_clone")])
-    }, closed3),
+    }, closed4),
     queue_namespace: _Object_({
       status: phaseStatus,
       namespace: String2({ minLength: 1, maxLength: 128 })
-    }, closed3),
+    }, closed4),
     storage_namespace: _Object_({
       status: phaseStatus,
       namespace: String2({ minLength: 1, maxLength: 128 })
-    }, closed3),
+    }, closed4),
     test_secret: _Object_({
       status: phaseStatus,
       name: String2({ minLength: 1, maxLength: 128 }),
       value_issued: Literal(false)
-    }, closed3),
+    }, closed4),
     configuration_revision: _Object_({
       status: phaseStatus,
       configuration_id: Union([ApplicationConfigurationIdSchema, Null()])
-    }, closed3),
+    }, closed4),
     application_activation: _Object_({
       status: phaseStatus,
       activation_id: Union([ApplicationActivationIdSchema, Null()])
-    }, closed3),
+    }, closed4),
     smoke_test: _Object_({
       status: phaseStatus,
       checks: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 32 }),
       passed: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 32 }),
       failed: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 32 })
-    }, closed3)
-  }, closed3),
+    }, closed4)
+  }, closed4),
   cleanup: _Object_({
     required: Boolean2(),
     completed: Boolean2(),
     error: Union([String2({ minLength: 1, maxLength: 128 }), Null()])
-  }, closed3)
-}, closed3);
+  }, closed4)
+}, closed4);
 function applicationPreviewBranchRef(previewId) {
   if (!/^[a-f0-9-]{8,64}$/.test(previewId))
     throw new Error("Invalid preview ID");
@@ -10673,7 +10705,7 @@ function parseApplicationReleaseTransferResult(candidate) {
   return candidate;
 }
 // node_modules/@supacloud/delivery/src/deployment-evidence.ts
-var closed4 = { additionalProperties: false };
+var closed5 = { additionalProperties: false };
 var sha256 = String2({ pattern: "^[a-f0-9]{64}$" });
 var isoDate = String2({ minLength: 20, maxLength: 40 });
 var status = Union([
@@ -10700,19 +10732,19 @@ var DatabaseProviderSchema = _Object_({
       Literal("not-proven"),
       Literal("failed")
     ])
-  }, closed4),
+  }, closed5),
   backup: _Object_({
     status,
     latest_success_at: Union([isoDate, Null()]),
     freshness_seconds: Union([Integer({ minimum: 0 }), Null()])
-  }, closed4),
+  }, closed5),
   recovery: _Object_({
     status,
     drill_id: Union([String2({ minLength: 1, maxLength: 128 }), Null()]),
     rpo_seconds: Union([Integer({ minimum: 0 }), Null()]),
     rto_seconds: Union([Integer({ minimum: 0 }), Null()])
-  }, closed4)
-}, closed4);
+  }, closed5)
+}, closed5);
 var componentName = Union([
   Literal("management-api"),
   Literal("web-console"),
@@ -10730,7 +10762,7 @@ var DeploymentComponentEvidenceSchema = _Object_({
   status,
   health_check: Union([String2({ minLength: 1, maxLength: 256 }), Null()]),
   checked_at: Union([isoDate, Null()])
-}, closed4);
+}, closed5);
 var DeploymentEvidenceSchema = _Object_({
   schema: Literal(DEPLOYMENT_EVIDENCE_SCHEMA),
   status: evidenceStatus,
@@ -10739,33 +10771,33 @@ var DeploymentEvidenceSchema = _Object_({
     project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
     application_id: ApplicationIdSchema,
     environment_id: ApplicationIdSchema
-  }, closed4),
+  }, closed5),
   source: _Object_({
     commit_sha: Union([String2({ pattern: "^[0-9a-f]{7,64}$" }), Null()]),
     manifest_sha256: sha256,
     contract_schema: Union([String2({ minLength: 1, maxLength: 128 }), Null()]),
     environment_binding_version: Union([sha256, Null()])
-  }, closed4),
+  }, closed5),
   database: DatabaseProviderSchema,
   components: _Array_(DeploymentComponentEvidenceSchema, { minItems: 1, maxItems: 32 }),
   activation: _Object_({
     release_id: ApplicationReleaseIdSchema,
     configuration_id: ApplicationConfigurationIdSchema,
     activation_id: ApplicationConfigurationIdSchema
-  }, closed4),
+  }, closed5),
   health: _Object_({
     status,
     checked_at: Union([isoDate, Null()]),
     authenticated_smoke: status
-  }, closed4),
+  }, closed5),
   rollback: _Object_({
     release_id: Union([ApplicationReleaseIdSchema, Null()]),
     configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
     status: Union([Literal("ready"), Literal("not-ready"), Literal("unknown")]),
     result: Union([status, Null()])
-  }, closed4),
+  }, closed5),
   notes: _Array_(String2({ minLength: 1, maxLength: 512 }), { maxItems: 32 })
-}, closed4);
+}, closed5);
 function isIsoDate(value) {
   return Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
 }
@@ -10798,13 +10830,13 @@ function parseDeploymentEvidence(value) {
   return structuredClone(value);
 }
 // node_modules/@supacloud/delivery/src/application-promotion.ts
-var closed5 = { additionalProperties: false };
+var closed6 = { additionalProperties: false };
 var projectRef2 = String2({ pattern: "^[a-z0-9-]{1,20}$" });
 var sha2562 = ApplicationReleaseIdSchema;
-var nullableActivation = Union([ApplicationActivationIdSchema, Null()]);
+var nullableActivation2 = Union([ApplicationActivationIdSchema, Null()]);
 var nullableDigest = Union([sha2562, Null()]);
 var observation = {
-  activation_id: nullableActivation,
+  activation_id: nullableActivation2,
   receipt_confirmed: Boolean2(),
   ready: Boolean2(),
   smoke_verified: Boolean2(),
@@ -10835,7 +10867,7 @@ var ApplicationPromotionPlanSchema = _Object_({
     environment_id: ApplicationIdSchema,
     release_id: sha2562,
     ...observation
-  }, closed5),
+  }, closed6),
   target: _Object_({
     candidate_release_id: sha2562,
     current_release_id: Union([sha2562, Null()]),
@@ -10843,18 +10875,18 @@ var ApplicationPromotionPlanSchema = _Object_({
     configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
     configuration: Union([ApplicationConfigurationViewSchema, Null()]),
     ...observation
-  }, closed5),
+  }, closed6),
   migrations: _Object_({
     ledger_digest: sha2562,
     ledger_compatible: Boolean2(),
     project_migrations_applied: Boolean2(),
     pending_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { maxItems: 4096, uniqueItems: true }),
     operator_provisioning_required: Boolean2()
-  }, closed5),
+  }, closed6),
   backup: _Object_({
     required: Boolean2(),
     confirmed: Literal(false)
-  }, closed5),
+  }, closed6),
   action: Union([Literal("promote"), Literal("no-op"), Literal("blocked")]),
   blockers: _Array_(Enum([...blocker]), {
     maxItems: blocker.length,
@@ -10863,7 +10895,7 @@ var ApplicationPromotionPlanSchema = _Object_({
   steps: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 8, uniqueItems: true }),
   execution_performed: Literal(false),
   data_recovery: Literal("separate-required")
-}, closed5);
+}, closed6);
 function applicationPromotionPlanDigest(value) {
   return digest(canonical(value));
 }
@@ -15832,7 +15864,7 @@ Actions: list, upsert, delete`, {
     action: withDescription(stringEnum(["list", "upsert", "delete"]), "Action"),
     ref: withDescription(String2(), "Project ref"),
     secrets: withDescription(secretsSchema, "[upsert] Secret list as JSON array or KEY=VALUE,KEY2=VALUE2"),
-    "from-env": withDescription(environmentSecretNamesSchema, "[upsert] Comma-separated environment variable names; values are read from this CLI process"),
+    "from-env": withDescription(environmentSecretNamesSchema, "[upsert] Comma-separated environment variable names; values are read from the selected CLI environment"),
     name: optional(String2(), "[delete] Secret name to delete")
   }, async (args) => {
     const { action, ref, secrets, name } = args;
@@ -16810,6 +16842,7 @@ var ApplicationActivationRetirementResultSchema2 = ApplicationActivationRetireme
 var ApplicationRollbackSnapshotSchema2 = ApplicationRollbackSnapshotSchema;
 var ApplicationActivationHistoryCursorSchema2 = ApplicationActivationHistoryCursorSchema;
 var ApplicationPromotionPlanSchema2 = ApplicationPromotionPlanSchema;
+var ApplicationReleaseRequestSchema2 = ApplicationReleaseRequestSchema;
 
 // src/shared/mutation-protocol.ts
 import { createHash as createHash6 } from "node:crypto";
@@ -17049,7 +17082,7 @@ async function fetchMutationStatus(http, ref, mutationId) {
 }
 
 // src/shared/tools/application-workflow-schemas.ts
-var closed6 = { additionalProperties: false };
+var closed7 = { additionalProperties: false };
 var ref5 = String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" });
 var uuid = ApplicationActivationIdSchema2;
 var nullableUuid = Union([uuid, Null()]);
@@ -17063,7 +17096,7 @@ var ApplicationPromotionResultSchema = _Object_({
   plan_sha256: ApplicationReleaseIdSchema2,
   action: Literal("promote"),
   replayed: Boolean2()
-}, closed6);
+}, closed7);
 var ApplicationPromotionStatusSchema = _Object_({
   ...scope2,
   mutation: Unknown(),
@@ -17082,8 +17115,8 @@ var ApplicationPromotionStatusSchema = _Object_({
     configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]),
     backup_id: Union([String2({ pattern: "^logical-full_[a-z0-9-]{1,20}_[a-f0-9]{32}$" }), Null()]),
     data_recovery: Literal("separate-required")
-  }, closed6)
-}, closed6);
+  }, closed7)
+}, closed7);
 var phase = Union([Literal("pending"), Literal("ready"), Literal("failed"), Literal("cleaned")]);
 var previewId = String2({ pattern: "^[a-f0-9-]{8,64}$" });
 var name = String2({ minLength: 1, maxLength: 256 });
@@ -17102,35 +17135,35 @@ var ApplicationPreviewReceiptSchema2 = _Object_({
     Literal("cleaned")
   ]),
   resources: _Object_({
-    build_artifact: _Object_({ status: phase, release_id: ApplicationReleaseIdSchema2 }, closed6),
+    build_artifact: _Object_({ status: phase, release_id: ApplicationReleaseIdSchema2 }, closed7),
     database_branch: _Object_({
       status: phase,
       branch_ref: ref5,
       data_mode: Union([Literal("schema_only"), Literal("full_clone")])
-    }, closed6),
-    queue_namespace: _Object_({ status: phase, namespace: name }, closed6),
-    storage_namespace: _Object_({ status: phase, namespace: name }, closed6),
-    test_secret: _Object_({ status: phase, name, value_issued: Literal(false) }, closed6),
-    configuration_revision: _Object_({ status: phase, configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]) }, closed6),
-    application_activation: _Object_({ status: phase, activation_id: nullableUuid }, closed6),
-    smoke_test: _Object_({ status: phase, checks, passed: checks, failed: checks }, closed6)
-  }, closed6),
+    }, closed7),
+    queue_namespace: _Object_({ status: phase, namespace: name }, closed7),
+    storage_namespace: _Object_({ status: phase, namespace: name }, closed7),
+    test_secret: _Object_({ status: phase, name, value_issued: Literal(false) }, closed7),
+    configuration_revision: _Object_({ status: phase, configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]) }, closed7),
+    application_activation: _Object_({ status: phase, activation_id: nullableUuid }, closed7),
+    smoke_test: _Object_({ status: phase, checks, passed: checks, failed: checks }, closed7)
+  }, closed7),
   cleanup: _Object_({
     required: Boolean2(),
     completed: Boolean2(),
     error: Union([String2({ pattern: "^[A-Z][A-Z0-9_]{0,63}$" }), Null()])
-  }, closed6),
+  }, closed7),
   branch_name: Optional(String2({ minLength: 1, maxLength: 80 })),
   queue_name: Optional(name),
   test_secret_name: Optional(name),
   source_configuration_id: Optional(Union([ApplicationConfigurationIdSchema2, Null()])),
   created_at: Optional(timestamp2),
   updated_at: Optional(timestamp2)
-}, closed6);
+}, closed7);
 var previewListSchema = _Object_({
   ...scope2,
   previews: _Array_(ApplicationPreviewReceiptSchema2, { maxItems: 1000 })
-}, closed6);
+}, closed7);
 function assertScope(value, identity) {
   if (value.project_ref !== identity.project_ref || value.application_id !== identity.application_id || value.environment_id !== identity.environment_id)
     throw new Error("Application workflow scope mismatch");
@@ -17597,6 +17630,7 @@ var APPLICATION_TOOL_SCHEMA = {
     "put_configuration",
     "get_deploy_plan",
     "deploy_release",
+    "release_application",
     "get_release_transfer_plan",
     "transfer_release",
     "get_promotion_plan",
@@ -17624,6 +17658,7 @@ var APPLICATION_TOOL_SCHEMA = {
   activation_id: optional(ApplicationActivationIdSchema2, "[deploy_release/activate_release/reconcile_activation/retire_activation/rollback_release/get_history] Stable activation ID; generated for automatic deployment/rollback if omitted"),
   expected_activation_id: optional(Union([ApplicationActivationIdSchema2, Null(), Literal("absent")]), "[deploy_release/activate_release/rollback_release] Current activation ID, or absent for first activation; selected from verified plan for automatic deployment"),
   configuration_path: optional(String2(), "[put_configuration] Local configuration write JSON including revision and expected revision"),
+  configuration_write: optional(Unknown(), "[release_application] Parsed immutable configuration write"),
   manifest_path: optional(String2(), "[upload_release] Local delivery.manifest.json"),
   release_id: optional(ApplicationReleaseIdSchema2, "[get_release/get_deploy_plan/deploy_release/activate_release/reconcile_activation/rollback_release] Immutable application release ID; platform selects previous for default rollback"),
   source_ref: optional(String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" }), "[get_release_transfer_plan/transfer_release] Source project ref"),
@@ -17983,6 +18018,61 @@ function registerApplicationTools(server, http) {
       const observed = await readDeployPlan(http, args, project);
       return observed.failure ?? releaseControlSuccess(operation, { ...observed.identity, plan: observed.plan });
     }
+    if (action === "release_application") {
+      const environmentId = text(args, "environment_id");
+      const releaseId = text(args, "release_id");
+      if (!Check2(ApplicationIdSchema2, environmentId) || !Check2(ApplicationReleaseIdSchema2, releaseId)) {
+        throw new Error("Invalid application release identity");
+      }
+      const configurationId = args["configuration_id"];
+      const activationId = args["activation_id"];
+      const expectedActivationId = args["expected_activation_id"];
+      if (configurationId !== undefined && !Check2(ApplicationConfigurationIdSchema2, configurationId)) {
+        throw new Error("Invalid application configuration ID");
+      }
+      if (activationId !== undefined && !Check2(ApplicationActivationIdSchema2, activationId)) {
+        throw new Error("Invalid application activation ID");
+      }
+      if (expectedActivationId !== undefined && expectedActivationId !== null && expectedActivationId !== "absent" && !Check2(ApplicationActivationIdSchema2, expectedActivationId)) {
+        throw new Error("Invalid expected activation ID");
+      }
+      const configurationWrite = args["configuration_write"];
+      const parsedConfigurationWrite = configurationWrite === undefined ? undefined : parseApplicationConfigurationWrite(configurationWrite);
+      const requestedConfigurationId = configurationId ?? parsedConfigurationWrite?.configuration_id;
+      const body = {
+        release_id: releaseId,
+        ...configurationId === undefined ? {} : { configuration_id: configurationId },
+        ...configurationWrite === undefined ? {} : { configuration_write: configurationWrite },
+        ...activationId === undefined ? {} : { activation_id: activationId },
+        ...expectedActivationId === undefined ? {} : {
+          expected_activation_id: expectedActivationId === "absent" ? null : expectedActivationId
+        }
+      };
+      if (!Check2(ApplicationReleaseRequestSchema2, body)) {
+        throw new Error("Invalid application release request");
+      }
+      const result = await http.post(`/v1/projects/${project}/applications/${encodeURIComponent(id)}/environments/${encodeURIComponent(environmentId)}/release`, body, { timeoutMs: 120000, maxJsonBytes: 65536, responseTimeoutMs: 30000 });
+      const identity = {
+        project_ref: ref,
+        application_id: id,
+        environment_id: environmentId,
+        release_id: releaseId,
+        ...configurationId === undefined ? {} : { configuration_id: configurationId },
+        ...activationId === undefined ? {} : { activation_id: activationId }
+      };
+      if (!result.ok)
+        return releaseControlMutationFailure(operation, result, identity);
+      try {
+        if (result.status !== 200)
+          throw new Error;
+        const release = parseApplicationReleaseResult(result.data);
+        if (release.project_ref !== ref || release.application_id !== id || release.environment_id !== environmentId || release.release_id !== releaseId || requestedConfigurationId !== undefined && release.configuration_id !== requestedConfigurationId || activationId !== undefined && release.activation_id !== activationId)
+          throw new Error;
+        return releaseControlSuccess(operation, release);
+      } catch {
+        return releaseControlFailure(operation, "OUTCOME_UNKNOWN", result.status, identity);
+      }
+    }
     if (action === "deploy_release")
       return deployAction(http, args, project);
     if (action === "rollback_release" || action === "get_rollback_snapshot") {
@@ -21016,7 +21106,7 @@ var starter_metadata_default = {
       }
     },
     elysia: {
-      version: "0.29.0"
+      version: "0.29.1"
     },
     commands: {
       version: "0.9.1"
@@ -24419,14 +24509,14 @@ var REMOTE_APP_ACTIONS = {
   "preview-reconcile": "reconcile_preview"
 };
 var REMOTE_APP_DESCRIPTIONS = {
-  ref: "[upload/configure/transfer-plan/transfer/promote-plan/diff/promote/promote-status/promote-reconcile/preview-plan/preview/previews/preview-list/preview-create/preview-status/preview-reconcile/preview-cleanup/deploy/deploy-plan/status/rollback/rollback-plan/history/reconcile/retire] Project ref (defaults to context)",
-  id: "[upload/configure/transfer-plan/transfer/promote-plan/diff/promote/promote-status/promote-reconcile/preview-plan/preview/previews/preview-list/preview-create/preview-status/preview-reconcile/preview-cleanup/deploy/deploy-plan/status/rollback/rollback-plan/history/reconcile/retire] Application ID",
-  environment_id: "[configure/promote-plan/diff/promote/promote-status/promote-reconcile/preview-plan/preview/previews/preview-list/preview-create/preview-status/preview-reconcile/preview-cleanup/deploy/deploy-plan/status/rollback/rollback-plan/history/reconcile/retire] Target environment ID",
-  configuration_id: "[promote-plan/diff/promote/preview-plan/preview/preview-create/deploy/deploy-plan/rollback] Immutable target configuration revision",
+  ref: "[release/upload/configure/transfer-plan/transfer/promote-plan/diff/promote/promote-status/promote-reconcile/preview-plan/preview/previews/preview-list/preview-create/preview-status/preview-reconcile/preview-cleanup/deploy/deploy-plan/status/rollback/rollback-plan/history/reconcile/retire] Project ref (defaults to context)",
+  id: "[release/upload/configure/transfer-plan/transfer/promote-plan/diff/promote/promote-status/promote-reconcile/preview-plan/preview/previews/preview-list/preview-create/preview-status/preview-reconcile/preview-cleanup/deploy/deploy-plan/status/rollback/rollback-plan/history/reconcile/retire] Application ID",
+  environment_id: "[release/configure/promote-plan/diff/promote/promote-status/promote-reconcile/preview-plan/preview/previews/preview-list/preview-create/preview-status/preview-reconcile/preview-cleanup/deploy/deploy-plan/status/rollback/rollback-plan/history/reconcile/retire] Target environment ID",
+  configuration_id: "[release/promote-plan/diff/promote/preview-plan/preview/preview-create/deploy/deploy-plan/rollback] Immutable target configuration revision",
   activation_id: "[deploy/rollback/reconcile/retire] Required explicit activation ID",
   expected_activation_id: "[deploy/rollback] Required current activation ID, or absent for first activation",
-  configuration_path: "[configure] Configuration write JSON including revision and expected revision",
-  manifest_path: "[upload] Local delivery.manifest.json",
+  configuration_path: "[release/configure] Configuration write JSON including revision and expected revision",
+  manifest_path: "[release/upload] Local delivery.manifest.json",
   release_id: "[preview-plan/preview/preview-create/deploy/deploy-plan/diff/rollback/reconcile] Required immutable application release ID",
   source_ref: "[transfer-plan/transfer/promote-plan/diff/promote] Source project ref",
   source_release_id: "[transfer-plan/transfer/promote-plan/diff/promote] Source immutable release ID",
@@ -25340,6 +25430,171 @@ async function runDelivery(args) {
   const result = await buildDeliveryProject(options, loaded.delivery);
   return textResult(JSON.stringify(result, null, 2), !result.ok);
 }
+function resultObject(result) {
+  try {
+    const value = JSON.parse(result.content[0]?.text ?? "");
+    return value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+  } catch {
+    return;
+  }
+}
+function resultErrorCode(result, fallback) {
+  const payload = resultObject(result);
+  const error = payload?.error;
+  const errorRecord = error !== null && typeof error === "object" && !Array.isArray(error) ? error : undefined;
+  return typeof errorRecord?.code === "string" ? errorRecord.code : fallback;
+}
+function releasePhaseFailure(phase, result, completed) {
+  const phaseResult = resultObject(result);
+  const upload = completed.upload !== null && typeof completed.upload === "object" && !Array.isArray(completed.upload) ? completed.upload : undefined;
+  const configure = completed.configure !== null && typeof completed.configure === "object" && !Array.isArray(completed.configure) ? completed.configure : undefined;
+  const releaseId = typeof upload?.release_id === "string" ? upload.release_id : undefined;
+  const configurationId = typeof configure?.configuration_id === "string" ? configure.configuration_id : undefined;
+  const payload = {
+    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
+    ok: false,
+    operation: "applications.release",
+    phase,
+    phases: completed,
+    error: { code: resultErrorCode(result, phase === "build" ? "BUILD_FAILED" : "PHASE_FAILED") },
+    ...releaseId === undefined ? {} : { release_id: releaseId },
+    ...configurationId === undefined ? {} : { configuration_id: configurationId },
+    ...phaseResult === undefined ? {} : { phase_result: phaseResult }
+  };
+  if (phaseResult?.activation_id !== undefined)
+    payload.activation_id = phaseResult.activation_id;
+  if (phaseResult?.expected_activation_id !== undefined) {
+    payload.expected_activation_id = phaseResult.expected_activation_id;
+  }
+  return textResult(JSON.stringify(payload, null, 2), true);
+}
+function releaseField(payload, container, field) {
+  const value = payload?.[container];
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return;
+  const record = value;
+  return typeof record[field] === "string" ? record[field] : undefined;
+}
+async function runAppRelease(request, options, delegate) {
+  const ref = request.ref ?? options.projectRef;
+  const id = request.id?.trim();
+  const environmentId = request.environment_id?.trim();
+  if (!ref || !id || !environmentId) {
+    throw new Error("app release requires --ref, --id and --environment_id (ref may come from context)");
+  }
+  if (!Check2(ApplicationIdSchema2, id) || !Check2(ApplicationIdSchema2, environmentId)) {
+    throw new Error("app release requires valid --id and --environment_id");
+  }
+  if (request.configuration_id !== undefined && !Check2(ApplicationConfigurationIdSchema2, request.configuration_id)) {
+    throw new Error("app release requires a valid --configuration_id");
+  }
+  if (request.configuration_path !== undefined && request.configuration_id !== undefined) {
+    throw new Error("app release accepts either --configuration_path or --configuration_id, not both");
+  }
+  if (request.configuration_path === undefined && request.configuration_id === undefined) {
+    throw new Error("app release requires --configuration_path or --configuration_id");
+  }
+  if (request.activation_id !== undefined || request.expected_activation_id !== undefined) {
+    throw new Error("app release generates one activation identity; use app deploy for an exact retry");
+  }
+  const root = resolve17(request.root || process.cwd());
+  const completed = {};
+  let manifestPath;
+  let buildReceipt;
+  if (request.skip_build === true) {
+    if (request.manifest_path === undefined) {
+      throw new Error("app release --skip_build requires --manifest_path");
+    }
+    manifestPath = resolve17(root, request.manifest_path);
+    completed.build = { skipped: true, manifest_path: manifestPath };
+  } else {
+    const built = await runDelivery({ ...request, action: "build", root, format: "json" });
+    buildReceipt = resultObject(built);
+    if (built.isError || !buildReceipt?.ok || buildReceipt.manifest === null || buildReceipt.manifest === undefined) {
+      return releasePhaseFailure("build", built, completed);
+    }
+    const loaded = await loadSupacloudConfig(root);
+    const resolved = resolveSupacloudConfig(loaded, root);
+    manifestPath = join13(resolved.outDir, "delivery", "delivery.manifest.json");
+    completed.build = {
+      ok: true,
+      manifest_path: manifestPath,
+      written: Array.isArray(buildReceipt.written) ? buildReceipt.written.length : 0
+    };
+  }
+  const uploadArgs = {
+    action: "upload_release",
+    ref,
+    id,
+    manifest_path: manifestPath
+  };
+  validateToolArguments(APPLICATION_TOOL_SCHEMA, uploadArgs);
+  const uploaded = await delegate(uploadArgs);
+  const uploadReceipt = resultObject(uploaded);
+  if (uploaded.isError || !uploadReceipt?.ok) {
+    return releasePhaseFailure("upload", uploaded, completed);
+  }
+  const releaseId = releaseField(uploadReceipt, "release", "release_id");
+  if (!releaseId)
+    return releasePhaseFailure("upload", releaseControlFailure("applications.upload_release", "INVALID_RESPONSE", null, { project_ref: ref, application_id: id }), completed);
+  completed.upload = { ok: true, release_id: releaseId };
+  let configurationId = request.configuration_id;
+  let configurationWrite;
+  const activationId = crypto.randomUUID();
+  if (request.configuration_path !== undefined) {
+    const configurationPath = resolve17(root, request.configuration_path);
+    try {
+      configurationWrite = parseApplicationConfigurationWrite(await Bun.file(configurationPath).json());
+      configurationId = configurationWrite.configuration_id;
+    } catch {
+      return releasePhaseFailure("configure", releaseControlFailure("applications.release_application", "INVALID_RESPONSE", null, { project_ref: ref, application_id: id, environment_id: environmentId }), completed);
+    }
+    completed.configure = { delegated: true, configuration_id: configurationId };
+  } else {
+    completed.configure = { delegated: true, configuration_id: configurationId };
+  }
+  const deployArgs = {
+    action: "release_application",
+    ref,
+    id,
+    environment_id: environmentId,
+    release_id: releaseId,
+    configuration_id: configurationId,
+    activation_id: activationId,
+    ...configurationWrite === undefined ? {} : { configuration_write: configurationWrite }
+  };
+  validateToolArguments(APPLICATION_TOOL_SCHEMA, deployArgs);
+  const deployed = await delegate(deployArgs);
+  const deployReceipt = resultObject(deployed);
+  if (deployed.isError || !deployReceipt?.ok) {
+    return releasePhaseFailure("deploy", deployed, completed);
+  }
+  completed.deploy = deployReceipt;
+  const result = {
+    schema: RELEASE_CONTROL_RESPONSE_SCHEMA,
+    ok: true,
+    operation: "applications.release",
+    project_ref: ref,
+    application_id: id,
+    environment_id: environmentId,
+    release_id: releaseId,
+    configuration_id: configurationId,
+    manifest_path: manifestPath,
+    build: buildReceipt ? completed.build : { skipped: true, manifest_path: manifestPath },
+    phases: completed,
+    no_op: deployReceipt.action === "no-op" || deployReceipt.no_op === true,
+    execution_performed: deployReceipt.execution_performed === true,
+    ...typeof deployReceipt.activation_id === "string" ? { activation_id: deployReceipt.activation_id } : {}
+  };
+  return request.format === "json" || request.json === true ? textResult(JSON.stringify(result, null, 2)) : textResult([
+    `${ref}/${id}/${environmentId}: ${result.no_op ? "no-op" : "released"}`,
+    `Release: ${releaseId}`,
+    `Configuration: ${configurationId}`,
+    `Activation: ${result.activation_id ?? "not performed"}`,
+    `Build: ${request.skip_build ? "skipped" : "completed"}`
+  ].join(`
+`));
+}
 function formatReleaseTransfer(result) {
   if (result.isError)
     return result;
@@ -25610,7 +25865,7 @@ async function runAppTool(request, options = {}) {
   if (request.database_url !== undefined && request.action !== "dev" && request.action !== "watch") {
     throw new ScaffoldError("SCAFFOLD_OPTION_INVALID", "--database-url applies only to app dev --profile integration");
   }
-  if (request.json !== undefined && !Object.hasOwn(REMOTE_APP_ACTIONS, request.action) && request.action !== "promote")
+  if (request.json !== undefined && !Object.hasOwn(REMOTE_APP_ACTIONS, request.action) && request.action !== "promote" && request.action !== "release")
     throw new Error("--json applies only to remote app actions");
   if (request.json && request.format === "text")
     throw new Error("--json and --format text cannot be combined");
@@ -25620,6 +25875,12 @@ async function runAppTool(request, options = {}) {
       return textResult("App remote actions require a Management API context.", true);
     return runPromotion(request, options, delegate);
   }
+  if (request.action === "release") {
+    const delegate = options.getApplications?.();
+    if (!delegate)
+      return textResult("App remote actions require a Management API context.", true);
+    return runAppRelease(request, options, delegate);
+  }
   if (Object.hasOwn(REMOTE_APP_ACTIONS, request.action)) {
     const delegate = options.getApplications?.();
     if (!delegate)
@@ -25716,6 +25977,7 @@ function registerAppTools(server, options = {}) {
       "fix",
       "plan",
       "build",
+      "release",
       "upload",
       "configure",
       "transfer-plan",
@@ -25753,11 +26015,11 @@ function registerAppTools(server, options = {}) {
     "dry-run": optional(Boolean2(), "[generate] CLI alias of dry_run"),
     register_in: optional(String2(), "[generate] Existing parent module file for module/resource; uses the compiler AST editor"),
     "register-in": optional(String2(), "[generate] CLI alias of register_in"),
-    root: optional(String2(), "[dev/plan/build/compile/check] Project directory containing supacloud.config.ts (default: current directory)"),
+    root: optional(String2(), "[dev/plan/build/release/compile/check] Project directory containing supacloud.config.ts (default: current directory)"),
     include: optional(String2(), "[dev/compile/check] Comma-separated glob patterns for source files"),
     out_dir: optional(String2(), "[dev/compile/plan/build/export-tools] Output directory (default: configured outDir)"),
     strict: optional(Boolean2(), "[dev/compile/check] Promote warnings to errors"),
-    format: optional(stringEnum(["text", "json"]), "[dev/generate/compile/check/plan/deploy-plan/diff/history/promote-plan/graph/export-tools] Output format (default: text)"),
+    format: optional(stringEnum(["text", "json"]), "[dev/generate/compile/check/plan/release/deploy-plan/diff/history/promote-plan/graph/export-tools] Output format (default: text)"),
     json: optional(Boolean2(), "[history/transfer-plan/transfer/promote-plan] Preserve or return the full machine-readable receipt"),
     profile: optional(stringEnum(["fast", "integration"]), "[dev] Run dev or dev:integration; integration verifies an explicit loopback database"),
     once: optional(Boolean2(), "[dev] Validate and report once without watching"),
@@ -25766,7 +26028,8 @@ function registerAppTools(server, options = {}) {
     "database-url": optional(String2(), "[dev] CLI alias of database_url"),
     target: optional(String2(), "[explain/context/verify-plan] Provider class name / token name / command name / job name / module name"),
     fix: optional(String2(), "[fix] Path to a DiagnosticFix JSON file produced by `doctor --format json`"),
-    write: optional(Boolean2(), "[fix] Write the fix to disk (default: preview only)")
+    write: optional(Boolean2(), "[fix] Write the fix to disk (default: preview only)"),
+    skip_build: optional(Boolean2(), "[release] Reuse --manifest_path instead of running the local delivery build")
   }, (request) => runAppTool(request, options));
 }
 var APP_ALIAS_ACTIONS = ["generate", "compile", "check", "graph", "explain", "context", "doctor", "fix"];
@@ -27675,6 +27938,14 @@ import { createHash as createHash9 } from "node:crypto";
 import { tmpdir as tmpdir3 } from "node:os";
 import { basename as basename8, dirname as dirname11, join as join17, relative as relative10, resolve as resolve22, sep as sep5 } from "node:path";
 var MAX_SOURCE_BYTES = 256 * 1024 * 1024;
+var PUBLIC_BUILD_ENV_PREFIXES = ["PUBLIC_", "VITE_", "NEXT_PUBLIC_", "NUXT_PUBLIC_", "ASTRO_PUBLIC_"];
+var SENSITIVE_BUILD_ENV = /(?:^|_)(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL|AUTHORIZATION|COOKIE|SESSION)(?:_|$)|(?:DATABASE_URL|DATABASE_URI|CONNECTION_STRING|DSN|PRIVATE_KEY)/i;
+function isPublicBuildEnv(name) {
+  return PUBLIC_BUILD_ENV_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+function isProtectedBuildEnv(name) {
+  return name.startsWith("SUPACLOUD_") || name === "SUPABASE_SERVICE_ROLE_KEY" || name === "SUPABASE_ACCESS_TOKEN" || name === "MANAGEMENT_API_URL" || name === "MANAGEMENT_API_TOKEN";
+}
 var deployToolSchema = {
   ref: optional(String2(), "Project ref (defaults to the linked project)"),
   target: optional(String2(), "Named deploy target from supacloud.json"),
@@ -27745,6 +28016,26 @@ function optionalBoolean(value, field) {
     throw new Error(`supacloud.json ${field} must be a boolean`);
   return value;
 }
+function optionalStringArray(value, field) {
+  if (value === undefined)
+    return;
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || !item.trim())) {
+    throw new Error(`supacloud.json ${field} must be an array of non-empty strings`);
+  }
+  return value.map((item) => item.trim()).map((name) => {
+    if (!/^[A-Z_][A-Z0-9_]*$/.test(name)) {
+      throw new Error(`supacloud.json ${field} must contain uppercase environment variable names`);
+    }
+    const isPublic = isPublicBuildEnv(name);
+    if (SENSITIVE_BUILD_ENV.test(name) && !isPublic) {
+      throw new Error(`supacloud.json ${field} cannot include sensitive variable '${name}'; use runtime secrets instead`);
+    }
+    if (isProtectedBuildEnv(name)) {
+      throw new Error(`supacloud.json ${field} cannot include platform credential '${name}'`);
+    }
+    return name;
+  });
+}
 function deployTargetConfig(candidate, name) {
   const value = record4(candidate);
   if (!value || value.type !== "frontend" && value.type !== "edge_function") {
@@ -27761,6 +28052,7 @@ function deployTargetConfig(candidate, name) {
     slug: optionalText(value.slug, `targets.${name}.slug`),
     buildCommand: optionalText(value.buildCommand, `targets.${name}.buildCommand`),
     outputDirectory: optionalText(value.outputDirectory, `targets.${name}.outputDirectory`),
+    buildEnv: optionalStringArray(value.buildEnv, `targets.${name}.buildEnv`),
     bundleDirectory: optionalText(value.bundleDirectory, `targets.${name}.bundleDirectory`),
     entrypoint: optionalText(value.entrypoint, `targets.${name}.entrypoint`),
     verifyJwt: optionalBoolean(value.verifyJwt, `targets.${name}.verifyJwt`),
@@ -27786,7 +28078,8 @@ async function readDeployConfig(configRoot) {
       id: optionalText(frontend.id, "frontend.id"),
       root: optionalText(frontend.root, "frontend.root"),
       buildCommand: optionalText(frontend.buildCommand, "frontend.buildCommand"),
-      outputDirectory: optionalText(frontend.outputDirectory, "frontend.outputDirectory")
+      outputDirectory: optionalText(frontend.outputDirectory, "frontend.outputDirectory"),
+      buildEnv: optionalStringArray(frontend.buildEnv, "frontend.buildEnv")
     } : undefined
   };
 }
@@ -27857,7 +28150,8 @@ function selectTarget(configRoot, invocationDirectory, config, requestedName) {
     root: config.frontend?.root,
     id: config.frontend?.id,
     buildCommand: config.frontend?.buildCommand,
-    outputDirectory: config.frontend?.outputDirectory
+    outputDirectory: config.frontend?.outputDirectory,
+    buildEnv: config.frontend?.buildEnv
   }]];
   if (targets.length === 0)
     throw new Error("supacloud.json defines no deploy targets");
@@ -27905,10 +28199,28 @@ function resolveInsideProject(projectDirectory, candidate, allowRoot = false) {
   }
   return resolved;
 }
-async function runBuild(command, cwd, json) {
+function createBuildEnvironment(names, environmentVariables) {
+  const selectedNames = [...new Set(names || [])].sort();
+  const selectedNameSet = new Set(selectedNames);
+  const values = environmentVariables ?? process.env;
+  const env = Object.fromEntries(Object.entries(process.env).filter(([name]) => !isProtectedBuildEnv(name) && (!isPublicBuildEnv(name) || selectedNameSet.has(name)) && (!SENSITIVE_BUILD_ENV.test(name) || isPublicBuildEnv(name))));
+  const missing = selectedNames.filter((name) => !values[name]?.trim());
+  for (const name of selectedNames) {
+    const value = values[name];
+    if (value !== undefined)
+      env[name] = value;
+  }
+  return { env, names: selectedNames, missing };
+}
+function assertBuildEnvironment(build, skipBuild) {
+  if (!skipBuild && build.missing.length > 0) {
+    throw new Error(`Missing build environment variables: ${build.missing.join(", ")}`);
+  }
+}
+async function runBuild(command, cwd, environment, json) {
   const child = Bun.spawn(["sh", "-c", command], {
     cwd,
-    env: process.env,
+    env: environment,
     stdio: ["inherit", json ? 2 : "inherit", "inherit"]
   });
   const exitCode = await child.exited;
@@ -28036,6 +28348,7 @@ function registerDeployTools(server, http, options = {}) {
       throw new Error(`Deploy target '${target.name}' root is not a regular directory: ${projectDirectory}`);
     }
     const requestedId = String(args.id || target.config.id || "").trim() || undefined;
+    const build = createBuildEnvironment(target.config.buildEnv, options.environmentVariables);
     const report = phaseReporter(args.json === true);
     report("inspect", `${target.name} (${projectRef})`);
     if (target.config.type === "edge_function") {
@@ -28073,14 +28386,17 @@ function registerDeployTools(server, http, options = {}) {
           project_ref: projectRef,
           slug,
           build_command: args.skip_build === true ? null : buildCommand,
+          build_env: build.names,
+          missing_build_env: build.missing,
           bundle_directory: bundleDirectory,
           expected_active_version: activeVersion,
           expected_activation_id: activationId
         }, null, 2) }] };
       }
+      assertBuildEnvironment(build, args.skip_build === true);
       if (args.skip_build !== true) {
         report("build", buildCommand);
-        await runBuild(buildCommand, projectDirectory, args.json === true);
+        await runBuild(buildCommand, projectDirectory, build.env, args.json === true);
       } else {
         report("build", "skipped");
       }
@@ -28130,12 +28446,15 @@ function registerDeployTools(server, http, options = {}) {
         project_ref: projectRef,
         deployment_id: selected.id,
         build_command: args.skip_build === true ? null : buildCommand,
+        build_env: build.names,
+        missing_build_env: build.missing,
         output_directory: outputDirectory
       }, null, 2) }] };
     }
+    assertBuildEnvironment(build, args.skip_build === true);
     if (args.skip_build !== true) {
       report("build", buildCommand);
-      await runBuild(buildCommand, projectDirectory, args.json === true);
+      await runBuild(buildCommand, projectDirectory, build.env, args.json === true);
     } else {
       report("build", "skipped");
     }
@@ -28523,7 +28842,7 @@ function registerRemoteDevTools(server, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.84.0",
+  version: "0.86.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -28576,13 +28895,13 @@ var package_default = {
   },
   dependencies: {
     "@supacloud/compiler": "^0.43.0",
-    "@supacloud/delivery": "0.13.0",
+    "@supacloud/delivery": "0.14.0",
     "@supacloud/db": "0.16.0",
     typebox: "1.3.34"
   },
   overrides: {
     "@supacloud/contracts": "0.8.0",
-    "@supacloud/delivery": "0.13.0",
+    "@supacloud/delivery": "0.14.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   devDependencies: {
@@ -28842,6 +29161,7 @@ EXAMPLES
   ${preferredCommand} app compile --root .
   ${preferredCommand} app plan --root . --format json
   ${preferredCommand} app build --root .
+  ${preferredCommand} --env test app release --id orders --environment_id test --configuration_path configuration.json
   ${preferredCommand} app upload --ref abc123 --id orders --manifest_path generated/delivery/delivery.manifest.json
   ${preferredCommand} app configure --ref abc123 --id orders --environment_id test --configuration_path configuration.json
   ${preferredCommand} app deploy-plan --ref abc123 --id orders --environment_id test --release_id <sha256> --configuration_id <uuid>
@@ -29110,7 +29430,7 @@ function createCliTools(context, confirmProduction) {
   assign(captureTools((server) => registerAuthTools(server, http)));
   assign(captureTools((server) => registerOAuthClientTools(server, http)));
   assign(captureTools((server) => registerStorageTools(server, http)));
-  const advancedTools = captureTools((server) => registerAdvancedTools(server, http, process.env, {
+  const advancedTools = captureTools((server) => registerAdvancedTools(server, http, context.environmentVariables, {
     readOnly: context.readOnly
   }));
   assign(advancedTools);
@@ -29134,6 +29454,7 @@ function createCliTools(context, confirmProduction) {
     environment: context.environment,
     projectRef: context.projectRef || undefined,
     cwd: process.cwd(),
+    environmentVariables: context.environmentVariables,
     edgeFunctionDeploy: advancedTools.edge_functions?.callback
   })));
   assign(captureTools((server) => registerGatewayTools(server, http, {

package/dist/shared/context.d.ts

@@ -21,6 +21,7 @@ export interface ResolvedContext {
     credentialScope: ContextCredentialScope;
     source: ContextSourceKind;
     sourcePath: string | null;
+    environmentVariables: Readonly<Record<string, string>>;
     insecureTls: boolean;
 }
 export declare function resolveSupaCloudContext(env?: NodeJS.ProcessEnv, cwd?: string, selection?: ContextSelection): ResolvedContext;

package/dist/shared/tools/app-tools.d.ts

@@ -36,7 +36,7 @@ export interface AppToolOptions {
     onDevProgress?: (result: ToolResult) => void;
 }
 export interface AppToolArguments {
-    action: "init" | "generate" | "dev" | "watch" | "verify-plan" | "compile" | "check" | "graph" | "explain" | "export-tools" | "context" | "doctor" | "fix" | "plan" | "build" | "promote" | keyof typeof REMOTE_APP_ACTIONS;
+    action: "init" | "generate" | "dev" | "watch" | "verify-plan" | "compile" | "check" | "graph" | "explain" | "export-tools" | "context" | "doctor" | "fix" | "plan" | "build" | "release" | "promote" | keyof typeof REMOTE_APP_ACTIONS;
     ref?: string;
     id?: string;
     environment_id?: string;
@@ -45,6 +45,8 @@ export interface AppToolArguments {
     expected_activation_id?: string | null;
     configuration_path?: string;
     manifest_path?: string;
+    /** `app release`: reuse an existing configuration revision instead of writing configuration_path. */
+    skip_build?: boolean;
     release_id?: string;
     source_ref?: string;
     source_release_id?: string;

package/dist/shared/tools/application-schemas.d.ts

@@ -152,3 +152,37 @@ export declare const ApplicationPromotionPlanSchema: import("typebox").TObject<{
     execution_performed: import("typebox").TLiteral<false>;
     data_recovery: import("typebox").TLiteral<"separate-required">;
 }>;
+export declare const ApplicationReleaseRequestSchema: import("typebox").TObject<{
+    release_id: import("typebox").TString;
+    configuration_id: import("typebox").TOptional<import("typebox").TString>;
+    configuration_write: import("typebox").TOptional<import("typebox").TObject<{
+        configuration_id: import("typebox").TString;
+        expected_configuration_id: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
+        configuration: import("typebox").TObject<{
+            bun_version: import("typebox").TString;
+            targets: import("typebox").TArray<import("typebox").TObject<{
+                name: import("typebox").TString;
+                kind: import("typebox").TUnion<[import("typebox").TLiteral<"http">, import("typebox").TLiteral<"worker">]>;
+                hosts: import("typebox").TArray<import("typebox").TString>;
+                environment: import("typebox").TRecord<"^.*$", import("typebox").TString>;
+            }>>;
+        }>;
+    }>>;
+    activation_id: import("typebox").TOptional<import("typebox").TString>;
+    expected_activation_id: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>>;
+    expected_plan_sha256: import("typebox").TOptional<import("typebox").TString>;
+}>;
+export declare const ApplicationReleaseResultSchema: import("typebox").TObject<{
+    schema: import("typebox").TLiteral<"supacloud.application-release.v1">;
+    project_ref: import("typebox").TString;
+    application_id: import("typebox").TString;
+    environment_id: import("typebox").TString;
+    release_id: import("typebox").TString;
+    configuration_id: import("typebox").TString;
+    activation_id: import("typebox").TString;
+    expected_activation_id: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
+    plan_sha256: import("typebox").TString;
+    action: import("typebox").TUnion<[import("typebox").TLiteral<"activate">, import("typebox").TLiteral<"no-op">]>;
+    replayed: import("typebox").TBoolean;
+    execution_performed: import("typebox").TBoolean;
+}>;

package/dist/shared/tools/application-tools.d.ts

@@ -9,7 +9,7 @@ export declare const APPLICATION_TOOL_SCHEMA: {
     ttl_seconds: Type.TOptional<Type.TInteger>;
     wait: Type.TOptional<Type.TBoolean>;
     timeout_seconds: Type.TOptional<Type.TInteger>;
-    action: Type.TEnum<("list_releases" | "get_release" | "upload_release" | "activate_release" | "logs" | "get_runtime" | "get_deployment_evidence" | "get_configuration" | "get_release_transfer_plan" | "get_promotion_plan" | "get_promotion_status" | "get_rollback_snapshot" | "get_history" | "get_deploy_plan" | "get_preview_plan" | "list_previews" | "get_preview" | "put_configuration" | "transfer_release" | "promote_application" | "reconcile_promotion" | "create_preview" | "reconcile_preview" | "cleanup_preview" | "deploy_release" | "rollback_release" | "reconcile_activation" | "retire_activation")[]>;
+    action: Type.TEnum<("list_releases" | "get_release" | "upload_release" | "activate_release" | "logs" | "get_runtime" | "get_deployment_evidence" | "get_configuration" | "get_release_transfer_plan" | "get_promotion_plan" | "get_promotion_status" | "get_rollback_snapshot" | "get_history" | "get_deploy_plan" | "get_preview_plan" | "list_previews" | "get_preview" | "put_configuration" | "release_application" | "transfer_release" | "promote_application" | "reconcile_promotion" | "create_preview" | "reconcile_preview" | "cleanup_preview" | "deploy_release" | "rollback_release" | "reconcile_activation" | "retire_activation")[]>;
     ref: Type.TString;
     id: Type.TString;
     environment_id: Type.TOptional<Type.TString>;
@@ -17,6 +17,7 @@ export declare const APPLICATION_TOOL_SCHEMA: {
     activation_id: Type.TOptional<Type.TString>;
     expected_activation_id: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull, Type.TLiteral<"absent">]>>;
     configuration_path: Type.TOptional<Type.TString>;
+    configuration_write: Type.TOptional<Type.TUnknown>;
     manifest_path: Type.TOptional<Type.TString>;
     release_id: Type.TOptional<Type.TString>;
     source_ref: Type.TOptional<Type.TString>;

package/dist/shared/tools/deploy-tools.d.ts

@@ -5,6 +5,7 @@ interface DeployToolOptions {
     projectRef?: string;
     environment?: string | null;
     cwd?: string;
+    environmentVariables?: Readonly<Record<string, string>>;
     edgeFunctionDeploy?: (args: Record<string, unknown>) => Promise<ToolResponse>;
 }
 interface ToolResponse {
@@ -28,6 +29,11 @@ export declare const deployToolSchema: {
     json: Type.TOptional<Type.TBoolean>;
 };
 export declare function findDeployConfigRoot(startDirectory: string): Promise<string>;
+export declare function createBuildEnvironment(names: string[] | undefined, environmentVariables: Readonly<Record<string, string>> | undefined): {
+    env: NodeJS.ProcessEnv;
+    names: string[];
+    missing: string[];
+};
 export declare function createFrontendArchive(outputDirectory: string): Promise<{
     archivePath: string;
     sha256: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.84.0",
+  "version": "0.86.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -53,13 +53,13 @@
   },
   "dependencies": {
     "@supacloud/compiler": "^0.43.0",
-    "@supacloud/delivery": "0.13.0",
+    "@supacloud/delivery": "0.14.0",
     "@supacloud/db": "0.16.0",
     "typebox": "1.3.34"
   },
   "overrides": {
     "@supacloud/contracts": "0.8.0",
-    "@supacloud/delivery": "0.13.0",
+    "@supacloud/delivery": "0.14.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   "devDependencies": {