@supacloud/cli 0.85.0 → 0.86.0

package/README.md

@@ -310,6 +310,26 @@ legacy `.env` fallback. Core URL, credential, and project-ref values are not
 filled by mixing sources. If `SUPACLOUD_ENV` is set without a complete process
 context, it strictly selects `.env.supacloud.<value>`.
 
+For one-command deployments, declare public build variables explicitly in the
+target configuration:
+
+```json
+{
+  "targets": {
+    "web": {
+      "type": "frontend",
+      "root": "apps/web",
+      "id": "web",
+      "buildEnv": ["VITE_API_URL", "VITE_SUPABASE_ANON_KEY"]
+    }
+  }
+}
+```
+
+`buildEnv` is an allowlist. The selected profile values are injected only into
+the local build command; values are never printed, undeclared values are not
+passed through, and platform credentials or runtime secrets are rejected.
+
 The two credential scopes are separate. Management-backed remote commands use
 only `SUPACLOUD_API_URL` + `SUPACLOUD_API_TOKEN`. An application profile using
 `SUPABASE_URL` + `SUPABASE_SERVICE_ROLE_KEY` can be auto-linked for `status`,
@@ -884,11 +904,12 @@ whether the body is empty and the configured header names. Update receipts bind
 delete receipts return the matched revision as `deleted_updated_at`.
 
 For secret writes, `--from-env` accepts a comma-separated list of environment
-variable names. The CLI reads each non-empty value from its own process
-environment, so command arguments contain names only and values are never
-printed. Names must be unique shell-style identifiers (`[A-Za-z_][A-Za-z0-9_]*`,
-up to 256 characters). Missing or empty values fail before any HTTP request.
-Do not combine `--from-env` with the compatibility `--secrets` input.
+variable names. The CLI reads each non-empty value from the currently selected
+profile source, such as `.env.supacloud.test` selected by `--env test`; command
+arguments contain names only and values are never printed. Names must be unique
+shell-style identifiers (`[A-Za-z_][A-Za-z0-9_]*`, up to 256 characters).
+Missing or empty values fail before any HTTP request. Do not combine
+`--from-env` with the compatibility `--secrets` input.
 
 Branch promotion is migration-first. `branch promotion_plan` prints pending
 versions, names, statement counts, and checksums without echoing SQL into terminal

package/dist/index.js

@@ -9144,6 +9144,7 @@ function resolveSupaCloudContext(env = process.env, cwd = process.cwd(), selecti
     credentialScope: core.credentialScope,
     source: source.kind,
     sourcePath: source.path,
+    environmentVariables: source.values,
     insecureTls
   };
 }
@@ -9153,7 +9154,7 @@ var ACTION_POLICY = {
   deploy: { write: ["deploy"] },
   applications: {
     read: ["list_releases", "get_release", "get_runtime", "get_deployment_evidence", "get_configuration", "get_release_transfer_plan", "get_promotion_plan", "get_promotion_status", "get_rollback_snapshot", "get_history", "get_deploy_plan", "logs", "get_preview_plan", "list_previews", "get_preview"],
-    write: ["upload_release", "put_configuration", "transfer_release", "promote_application", "reconcile_promotion", "create_preview", "reconcile_preview", "cleanup_preview", "activate_release", "deploy_release", "rollback_release", "reconcile_activation", "retire_activation"]
+    write: ["upload_release", "put_configuration", "release_application", "transfer_release", "promote_application", "reconcile_promotion", "create_preview", "reconcile_preview", "cleanup_preview", "activate_release", "deploy_release", "rollback_release", "reconcile_activation", "retire_activation"]
   },
   project: {
     read: ["get", "endpoints", "health", "logs", "api_keys", "settings", "tasks", "task_detail", "task_stats", "dlq", "background_settings"],
@@ -10477,6 +10478,37 @@ function parseApplicationDeployPlan(value) {
     throw new Error("Invalid application deploy plan action");
   return value;
 }
+// node_modules/@supacloud/delivery/src/application-release-operation.ts
+var closed3 = { additionalProperties: false };
+var nullableActivation = Union([ApplicationActivationIdSchema, Null()]);
+var ApplicationReleaseRequestSchema = _Object_({
+  release_id: ApplicationReleaseIdSchema,
+  configuration_id: Optional(ApplicationConfigurationIdSchema),
+  configuration_write: Optional(ApplicationConfigurationWriteSchema),
+  activation_id: Optional(ApplicationActivationIdSchema),
+  expected_activation_id: Optional(nullableActivation),
+  expected_plan_sha256: Optional(ApplicationReleaseIdSchema)
+}, closed3);
+var ApplicationReleaseResultSchema = _Object_({
+  schema: Literal("supacloud.application-release.v1"),
+  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+  application_id: ApplicationIdSchema,
+  environment_id: ApplicationIdSchema,
+  release_id: ApplicationReleaseIdSchema,
+  configuration_id: ApplicationConfigurationIdSchema,
+  activation_id: ApplicationActivationIdSchema,
+  expected_activation_id: nullableActivation,
+  plan_sha256: ApplicationReleaseIdSchema,
+  action: Union([Literal("activate"), Literal("no-op")]),
+  replayed: Boolean2(),
+  execution_performed: Boolean2()
+}, closed3);
+function parseApplicationReleaseResult(value) {
+  if (!Check2(ApplicationReleaseResultSchema, value)) {
+    throw new Error("Invalid application release result");
+  }
+  return structuredClone(value);
+}
 // node_modules/@supacloud/delivery/src/application-history.ts
 var scope = {
   project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
@@ -10561,7 +10593,7 @@ var phaseStatus = Union([
   Literal("failed"),
   Literal("cleaned")
 ]);
-var closed3 = { additionalProperties: false };
+var closed4 = { additionalProperties: false };
 var ApplicationPreviewReceiptSchema = _Object_({
   schema: Literal("supacloud.application-preview.v1"),
   preview_id: String2({ pattern: "^[a-f0-9-]{8,64}$" }),
@@ -10581,46 +10613,46 @@ var ApplicationPreviewReceiptSchema = _Object_({
     Literal("cleaned")
   ]),
   resources: _Object_({
-    build_artifact: _Object_({ status: phaseStatus, release_id: ApplicationReleaseIdSchema }, closed3),
+    build_artifact: _Object_({ status: phaseStatus, release_id: ApplicationReleaseIdSchema }, closed4),
     database_branch: _Object_({
       status: phaseStatus,
       branch_ref: String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" }),
       data_mode: Union([Literal("schema_only"), Literal("full_clone")])
-    }, closed3),
+    }, closed4),
     queue_namespace: _Object_({
       status: phaseStatus,
       namespace: String2({ minLength: 1, maxLength: 128 })
-    }, closed3),
+    }, closed4),
     storage_namespace: _Object_({
       status: phaseStatus,
       namespace: String2({ minLength: 1, maxLength: 128 })
-    }, closed3),
+    }, closed4),
     test_secret: _Object_({
       status: phaseStatus,
       name: String2({ minLength: 1, maxLength: 128 }),
       value_issued: Literal(false)
-    }, closed3),
+    }, closed4),
     configuration_revision: _Object_({
       status: phaseStatus,
       configuration_id: Union([ApplicationConfigurationIdSchema, Null()])
-    }, closed3),
+    }, closed4),
     application_activation: _Object_({
       status: phaseStatus,
       activation_id: Union([ApplicationActivationIdSchema, Null()])
-    }, closed3),
+    }, closed4),
     smoke_test: _Object_({
       status: phaseStatus,
       checks: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 32 }),
       passed: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 32 }),
       failed: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 32 })
-    }, closed3)
-  }, closed3),
+    }, closed4)
+  }, closed4),
   cleanup: _Object_({
     required: Boolean2(),
     completed: Boolean2(),
     error: Union([String2({ minLength: 1, maxLength: 128 }), Null()])
-  }, closed3)
-}, closed3);
+  }, closed4)
+}, closed4);
 function applicationPreviewBranchRef(previewId) {
   if (!/^[a-f0-9-]{8,64}$/.test(previewId))
     throw new Error("Invalid preview ID");
@@ -10673,7 +10705,7 @@ function parseApplicationReleaseTransferResult(candidate) {
   return candidate;
 }
 // node_modules/@supacloud/delivery/src/deployment-evidence.ts
-var closed4 = { additionalProperties: false };
+var closed5 = { additionalProperties: false };
 var sha256 = String2({ pattern: "^[a-f0-9]{64}$" });
 var isoDate = String2({ minLength: 20, maxLength: 40 });
 var status = Union([
@@ -10700,19 +10732,19 @@ var DatabaseProviderSchema = _Object_({
       Literal("not-proven"),
       Literal("failed")
     ])
-  }, closed4),
+  }, closed5),
   backup: _Object_({
     status,
     latest_success_at: Union([isoDate, Null()]),
     freshness_seconds: Union([Integer({ minimum: 0 }), Null()])
-  }, closed4),
+  }, closed5),
   recovery: _Object_({
     status,
     drill_id: Union([String2({ minLength: 1, maxLength: 128 }), Null()]),
     rpo_seconds: Union([Integer({ minimum: 0 }), Null()]),
     rto_seconds: Union([Integer({ minimum: 0 }), Null()])
-  }, closed4)
-}, closed4);
+  }, closed5)
+}, closed5);
 var componentName = Union([
   Literal("management-api"),
   Literal("web-console"),
@@ -10730,7 +10762,7 @@ var DeploymentComponentEvidenceSchema = _Object_({
   status,
   health_check: Union([String2({ minLength: 1, maxLength: 256 }), Null()]),
   checked_at: Union([isoDate, Null()])
-}, closed4);
+}, closed5);
 var DeploymentEvidenceSchema = _Object_({
   schema: Literal(DEPLOYMENT_EVIDENCE_SCHEMA),
   status: evidenceStatus,
@@ -10739,33 +10771,33 @@ var DeploymentEvidenceSchema = _Object_({
     project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
     application_id: ApplicationIdSchema,
     environment_id: ApplicationIdSchema
-  }, closed4),
+  }, closed5),
   source: _Object_({
     commit_sha: Union([String2({ pattern: "^[0-9a-f]{7,64}$" }), Null()]),
     manifest_sha256: sha256,
     contract_schema: Union([String2({ minLength: 1, maxLength: 128 }), Null()]),
     environment_binding_version: Union([sha256, Null()])
-  }, closed4),
+  }, closed5),
   database: DatabaseProviderSchema,
   components: _Array_(DeploymentComponentEvidenceSchema, { minItems: 1, maxItems: 32 }),
   activation: _Object_({
     release_id: ApplicationReleaseIdSchema,
     configuration_id: ApplicationConfigurationIdSchema,
     activation_id: ApplicationConfigurationIdSchema
-  }, closed4),
+  }, closed5),
   health: _Object_({
     status,
     checked_at: Union([isoDate, Null()]),
     authenticated_smoke: status
-  }, closed4),
+  }, closed5),
   rollback: _Object_({
     release_id: Union([ApplicationReleaseIdSchema, Null()]),
     configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
     status: Union([Literal("ready"), Literal("not-ready"), Literal("unknown")]),
     result: Union([status, Null()])
-  }, closed4),
+  }, closed5),
   notes: _Array_(String2({ minLength: 1, maxLength: 512 }), { maxItems: 32 })
-}, closed4);
+}, closed5);
 function isIsoDate(value) {
   return Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
 }
@@ -10798,13 +10830,13 @@ function parseDeploymentEvidence(value) {
   return structuredClone(value);
 }
 // node_modules/@supacloud/delivery/src/application-promotion.ts
-var closed5 = { additionalProperties: false };
+var closed6 = { additionalProperties: false };
 var projectRef2 = String2({ pattern: "^[a-z0-9-]{1,20}$" });
 var sha2562 = ApplicationReleaseIdSchema;
-var nullableActivation = Union([ApplicationActivationIdSchema, Null()]);
+var nullableActivation2 = Union([ApplicationActivationIdSchema, Null()]);
 var nullableDigest = Union([sha2562, Null()]);
 var observation = {
-  activation_id: nullableActivation,
+  activation_id: nullableActivation2,
   receipt_confirmed: Boolean2(),
   ready: Boolean2(),
   smoke_verified: Boolean2(),
@@ -10835,7 +10867,7 @@ var ApplicationPromotionPlanSchema = _Object_({
     environment_id: ApplicationIdSchema,
     release_id: sha2562,
     ...observation
-  }, closed5),
+  }, closed6),
   target: _Object_({
     candidate_release_id: sha2562,
     current_release_id: Union([sha2562, Null()]),
@@ -10843,18 +10875,18 @@ var ApplicationPromotionPlanSchema = _Object_({
     configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
     configuration: Union([ApplicationConfigurationViewSchema, Null()]),
     ...observation
-  }, closed5),
+  }, closed6),
   migrations: _Object_({
     ledger_digest: sha2562,
     ledger_compatible: Boolean2(),
     project_migrations_applied: Boolean2(),
     pending_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { maxItems: 4096, uniqueItems: true }),
     operator_provisioning_required: Boolean2()
-  }, closed5),
+  }, closed6),
   backup: _Object_({
     required: Boolean2(),
     confirmed: Literal(false)
-  }, closed5),
+  }, closed6),
   action: Union([Literal("promote"), Literal("no-op"), Literal("blocked")]),
   blockers: _Array_(Enum([...blocker]), {
     maxItems: blocker.length,
@@ -10863,7 +10895,7 @@ var ApplicationPromotionPlanSchema = _Object_({
   steps: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 8, uniqueItems: true }),
   execution_performed: Literal(false),
   data_recovery: Literal("separate-required")
-}, closed5);
+}, closed6);
 function applicationPromotionPlanDigest(value) {
   return digest(canonical(value));
 }
@@ -15832,7 +15864,7 @@ Actions: list, upsert, delete`, {
     action: withDescription(stringEnum(["list", "upsert", "delete"]), "Action"),
     ref: withDescription(String2(), "Project ref"),
     secrets: withDescription(secretsSchema, "[upsert] Secret list as JSON array or KEY=VALUE,KEY2=VALUE2"),
-    "from-env": withDescription(environmentSecretNamesSchema, "[upsert] Comma-separated environment variable names; values are read from this CLI process"),
+    "from-env": withDescription(environmentSecretNamesSchema, "[upsert] Comma-separated environment variable names; values are read from the selected CLI environment"),
     name: optional(String2(), "[delete] Secret name to delete")
   }, async (args) => {
     const { action, ref, secrets, name } = args;
@@ -16810,6 +16842,7 @@ var ApplicationActivationRetirementResultSchema2 = ApplicationActivationRetireme
 var ApplicationRollbackSnapshotSchema2 = ApplicationRollbackSnapshotSchema;
 var ApplicationActivationHistoryCursorSchema2 = ApplicationActivationHistoryCursorSchema;
 var ApplicationPromotionPlanSchema2 = ApplicationPromotionPlanSchema;
+var ApplicationReleaseRequestSchema2 = ApplicationReleaseRequestSchema;
 
 // src/shared/mutation-protocol.ts
 import { createHash as createHash6 } from "node:crypto";
@@ -17049,7 +17082,7 @@ async function fetchMutationStatus(http, ref, mutationId) {
 }
 
 // src/shared/tools/application-workflow-schemas.ts
-var closed6 = { additionalProperties: false };
+var closed7 = { additionalProperties: false };
 var ref5 = String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" });
 var uuid = ApplicationActivationIdSchema2;
 var nullableUuid = Union([uuid, Null()]);
@@ -17063,7 +17096,7 @@ var ApplicationPromotionResultSchema = _Object_({
   plan_sha256: ApplicationReleaseIdSchema2,
   action: Literal("promote"),
   replayed: Boolean2()
-}, closed6);
+}, closed7);
 var ApplicationPromotionStatusSchema = _Object_({
   ...scope2,
   mutation: Unknown(),
@@ -17082,8 +17115,8 @@ var ApplicationPromotionStatusSchema = _Object_({
     configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]),
     backup_id: Union([String2({ pattern: "^logical-full_[a-z0-9-]{1,20}_[a-f0-9]{32}$" }), Null()]),
     data_recovery: Literal("separate-required")
-  }, closed6)
-}, closed6);
+  }, closed7)
+}, closed7);
 var phase = Union([Literal("pending"), Literal("ready"), Literal("failed"), Literal("cleaned")]);
 var previewId = String2({ pattern: "^[a-f0-9-]{8,64}$" });
 var name = String2({ minLength: 1, maxLength: 256 });
@@ -17102,35 +17135,35 @@ var ApplicationPreviewReceiptSchema2 = _Object_({
     Literal("cleaned")
   ]),
   resources: _Object_({
-    build_artifact: _Object_({ status: phase, release_id: ApplicationReleaseIdSchema2 }, closed6),
+    build_artifact: _Object_({ status: phase, release_id: ApplicationReleaseIdSchema2 }, closed7),
     database_branch: _Object_({
       status: phase,
       branch_ref: ref5,
       data_mode: Union([Literal("schema_only"), Literal("full_clone")])
-    }, closed6),
-    queue_namespace: _Object_({ status: phase, namespace: name }, closed6),
-    storage_namespace: _Object_({ status: phase, namespace: name }, closed6),
-    test_secret: _Object_({ status: phase, name, value_issued: Literal(false) }, closed6),
-    configuration_revision: _Object_({ status: phase, configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]) }, closed6),
-    application_activation: _Object_({ status: phase, activation_id: nullableUuid }, closed6),
-    smoke_test: _Object_({ status: phase, checks, passed: checks, failed: checks }, closed6)
-  }, closed6),
+    }, closed7),
+    queue_namespace: _Object_({ status: phase, namespace: name }, closed7),
+    storage_namespace: _Object_({ status: phase, namespace: name }, closed7),
+    test_secret: _Object_({ status: phase, name, value_issued: Literal(false) }, closed7),
+    configuration_revision: _Object_({ status: phase, configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]) }, closed7),
+    application_activation: _Object_({ status: phase, activation_id: nullableUuid }, closed7),
+    smoke_test: _Object_({ status: phase, checks, passed: checks, failed: checks }, closed7)
+  }, closed7),
   cleanup: _Object_({
     required: Boolean2(),
     completed: Boolean2(),
     error: Union([String2({ pattern: "^[A-Z][A-Z0-9_]{0,63}$" }), Null()])
-  }, closed6),
+  }, closed7),
   branch_name: Optional(String2({ minLength: 1, maxLength: 80 })),
   queue_name: Optional(name),
   test_secret_name: Optional(name),
   source_configuration_id: Optional(Union([ApplicationConfigurationIdSchema2, Null()])),
   created_at: Optional(timestamp2),
   updated_at: Optional(timestamp2)
-}, closed6);
+}, closed7);
 var previewListSchema = _Object_({
   ...scope2,
   previews: _Array_(ApplicationPreviewReceiptSchema2, { maxItems: 1000 })
-}, closed6);
+}, closed7);
 function assertScope(value, identity) {
   if (value.project_ref !== identity.project_ref || value.application_id !== identity.application_id || value.environment_id !== identity.environment_id)
     throw new Error("Application workflow scope mismatch");
@@ -17597,6 +17630,7 @@ var APPLICATION_TOOL_SCHEMA = {
     "put_configuration",
     "get_deploy_plan",
     "deploy_release",
+    "release_application",
     "get_release_transfer_plan",
     "transfer_release",
     "get_promotion_plan",
@@ -17624,6 +17658,7 @@ var APPLICATION_TOOL_SCHEMA = {
   activation_id: optional(ApplicationActivationIdSchema2, "[deploy_release/activate_release/reconcile_activation/retire_activation/rollback_release/get_history] Stable activation ID; generated for automatic deployment/rollback if omitted"),
   expected_activation_id: optional(Union([ApplicationActivationIdSchema2, Null(), Literal("absent")]), "[deploy_release/activate_release/rollback_release] Current activation ID, or absent for first activation; selected from verified plan for automatic deployment"),
   configuration_path: optional(String2(), "[put_configuration] Local configuration write JSON including revision and expected revision"),
+  configuration_write: optional(Unknown(), "[release_application] Parsed immutable configuration write"),
   manifest_path: optional(String2(), "[upload_release] Local delivery.manifest.json"),
   release_id: optional(ApplicationReleaseIdSchema2, "[get_release/get_deploy_plan/deploy_release/activate_release/reconcile_activation/rollback_release] Immutable application release ID; platform selects previous for default rollback"),
   source_ref: optional(String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" }), "[get_release_transfer_plan/transfer_release] Source project ref"),
@@ -17983,6 +18018,61 @@ function registerApplicationTools(server, http) {
       const observed = await readDeployPlan(http, args, project);
       return observed.failure ?? releaseControlSuccess(operation, { ...observed.identity, plan: observed.plan });
     }
+    if (action === "release_application") {
+      const environmentId = text(args, "environment_id");
+      const releaseId = text(args, "release_id");
+      if (!Check2(ApplicationIdSchema2, environmentId) || !Check2(ApplicationReleaseIdSchema2, releaseId)) {
+        throw new Error("Invalid application release identity");
+      }
+      const configurationId = args["configuration_id"];
+      const activationId = args["activation_id"];
+      const expectedActivationId = args["expected_activation_id"];
+      if (configurationId !== undefined && !Check2(ApplicationConfigurationIdSchema2, configurationId)) {
+        throw new Error("Invalid application configuration ID");
+      }
+      if (activationId !== undefined && !Check2(ApplicationActivationIdSchema2, activationId)) {
+        throw new Error("Invalid application activation ID");
+      }
+      if (expectedActivationId !== undefined && expectedActivationId !== null && expectedActivationId !== "absent" && !Check2(ApplicationActivationIdSchema2, expectedActivationId)) {
+        throw new Error("Invalid expected activation ID");
+      }
+      const configurationWrite = args["configuration_write"];
+      const parsedConfigurationWrite = configurationWrite === undefined ? undefined : parseApplicationConfigurationWrite(configurationWrite);
+      const requestedConfigurationId = configurationId ?? parsedConfigurationWrite?.configuration_id;
+      const body = {
+        release_id: releaseId,
+        ...configurationId === undefined ? {} : { configuration_id: configurationId },
+        ...configurationWrite === undefined ? {} : { configuration_write: configurationWrite },
+        ...activationId === undefined ? {} : { activation_id: activationId },
+        ...expectedActivationId === undefined ? {} : {
+          expected_activation_id: expectedActivationId === "absent" ? null : expectedActivationId
+        }
+      };
+      if (!Check2(ApplicationReleaseRequestSchema2, body)) {
+        throw new Error("Invalid application release request");
+      }
+      const result = await http.post(`/v1/projects/${project}/applications/${encodeURIComponent(id)}/environments/${encodeURIComponent(environmentId)}/release`, body, { timeoutMs: 120000, maxJsonBytes: 65536, responseTimeoutMs: 30000 });
+      const identity = {
+        project_ref: ref,
+        application_id: id,
+        environment_id: environmentId,
+        release_id: releaseId,
+        ...configurationId === undefined ? {} : { configuration_id: configurationId },
+        ...activationId === undefined ? {} : { activation_id: activationId }
+      };
+      if (!result.ok)
+        return releaseControlMutationFailure(operation, result, identity);
+      try {
+        if (result.status !== 200)
+          throw new Error;
+        const release = parseApplicationReleaseResult(result.data);
+        if (release.project_ref !== ref || release.application_id !== id || release.environment_id !== environmentId || release.release_id !== releaseId || requestedConfigurationId !== undefined && release.configuration_id !== requestedConfigurationId || activationId !== undefined && release.activation_id !== activationId)
+          throw new Error;
+        return releaseControlSuccess(operation, release);
+      } catch {
+        return releaseControlFailure(operation, "OUTCOME_UNKNOWN", result.status, identity);
+      }
+    }
     if (action === "deploy_release")
       return deployAction(http, args, project);
     if (action === "rollback_release" || action === "get_rollback_snapshot") {
@@ -21016,7 +21106,7 @@ var starter_metadata_default = {
       }
     },
     elysia: {
-      version: "0.29.0"
+      version: "0.29.1"
     },
     commands: {
       version: "0.9.1"
@@ -25449,35 +25539,29 @@ async function runAppRelease(request, options, delegate) {
     return releasePhaseFailure("upload", releaseControlFailure("applications.upload_release", "INVALID_RESPONSE", null, { project_ref: ref, application_id: id }), completed);
   completed.upload = { ok: true, release_id: releaseId };
   let configurationId = request.configuration_id;
+  let configurationWrite;
+  const activationId = crypto.randomUUID();
   if (request.configuration_path !== undefined) {
     const configurationPath = resolve17(root, request.configuration_path);
-    const configureArgs = {
-      action: "put_configuration",
-      ref,
-      id,
-      environment_id: environmentId,
-      configuration_path: configurationPath
-    };
-    validateToolArguments(APPLICATION_TOOL_SCHEMA, configureArgs);
-    const configured = await delegate(configureArgs);
-    const configurationReceipt = resultObject(configured);
-    if (configured.isError || !configurationReceipt?.ok) {
-      return releasePhaseFailure("configure", configured, completed);
-    }
-    configurationId = releaseField(configurationReceipt, "configuration", "configuration_id");
-    if (!configurationId)
-      return releasePhaseFailure("configure", releaseControlFailure("applications.put_configuration", "INVALID_RESPONSE", null, { project_ref: ref, application_id: id, environment_id: environmentId }), completed);
-    completed.configure = { ok: true, configuration_id: configurationId };
+    try {
+      configurationWrite = parseApplicationConfigurationWrite(await Bun.file(configurationPath).json());
+      configurationId = configurationWrite.configuration_id;
+    } catch {
+      return releasePhaseFailure("configure", releaseControlFailure("applications.release_application", "INVALID_RESPONSE", null, { project_ref: ref, application_id: id, environment_id: environmentId }), completed);
+    }
+    completed.configure = { delegated: true, configuration_id: configurationId };
   } else {
-    completed.configure = { skipped: true, configuration_id: configurationId };
+    completed.configure = { delegated: true, configuration_id: configurationId };
   }
   const deployArgs = {
-    action: "deploy_release",
+    action: "release_application",
     ref,
     id,
     environment_id: environmentId,
     release_id: releaseId,
-    configuration_id: configurationId
+    configuration_id: configurationId,
+    activation_id: activationId,
+    ...configurationWrite === undefined ? {} : { configuration_write: configurationWrite }
   };
   validateToolArguments(APPLICATION_TOOL_SCHEMA, deployArgs);
   const deployed = await delegate(deployArgs);
@@ -25498,7 +25582,7 @@ async function runAppRelease(request, options, delegate) {
     manifest_path: manifestPath,
     build: buildReceipt ? completed.build : { skipped: true, manifest_path: manifestPath },
     phases: completed,
-    no_op: deployReceipt.no_op === true,
+    no_op: deployReceipt.action === "no-op" || deployReceipt.no_op === true,
     execution_performed: deployReceipt.execution_performed === true,
     ...typeof deployReceipt.activation_id === "string" ? { activation_id: deployReceipt.activation_id } : {}
   };
@@ -27854,6 +27938,14 @@ import { createHash as createHash9 } from "node:crypto";
 import { tmpdir as tmpdir3 } from "node:os";
 import { basename as basename8, dirname as dirname11, join as join17, relative as relative10, resolve as resolve22, sep as sep5 } from "node:path";
 var MAX_SOURCE_BYTES = 256 * 1024 * 1024;
+var PUBLIC_BUILD_ENV_PREFIXES = ["PUBLIC_", "VITE_", "NEXT_PUBLIC_", "NUXT_PUBLIC_", "ASTRO_PUBLIC_"];
+var SENSITIVE_BUILD_ENV = /(?:^|_)(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL|AUTHORIZATION|COOKIE|SESSION)(?:_|$)|(?:DATABASE_URL|DATABASE_URI|CONNECTION_STRING|DSN|PRIVATE_KEY)/i;
+function isPublicBuildEnv(name) {
+  return PUBLIC_BUILD_ENV_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+function isProtectedBuildEnv(name) {
+  return name.startsWith("SUPACLOUD_") || name === "SUPABASE_SERVICE_ROLE_KEY" || name === "SUPABASE_ACCESS_TOKEN" || name === "MANAGEMENT_API_URL" || name === "MANAGEMENT_API_TOKEN";
+}
 var deployToolSchema = {
   ref: optional(String2(), "Project ref (defaults to the linked project)"),
   target: optional(String2(), "Named deploy target from supacloud.json"),
@@ -27924,6 +28016,26 @@ function optionalBoolean(value, field) {
     throw new Error(`supacloud.json ${field} must be a boolean`);
   return value;
 }
+function optionalStringArray(value, field) {
+  if (value === undefined)
+    return;
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || !item.trim())) {
+    throw new Error(`supacloud.json ${field} must be an array of non-empty strings`);
+  }
+  return value.map((item) => item.trim()).map((name) => {
+    if (!/^[A-Z_][A-Z0-9_]*$/.test(name)) {
+      throw new Error(`supacloud.json ${field} must contain uppercase environment variable names`);
+    }
+    const isPublic = isPublicBuildEnv(name);
+    if (SENSITIVE_BUILD_ENV.test(name) && !isPublic) {
+      throw new Error(`supacloud.json ${field} cannot include sensitive variable '${name}'; use runtime secrets instead`);
+    }
+    if (isProtectedBuildEnv(name)) {
+      throw new Error(`supacloud.json ${field} cannot include platform credential '${name}'`);
+    }
+    return name;
+  });
+}
 function deployTargetConfig(candidate, name) {
   const value = record4(candidate);
   if (!value || value.type !== "frontend" && value.type !== "edge_function") {
@@ -27940,6 +28052,7 @@ function deployTargetConfig(candidate, name) {
     slug: optionalText(value.slug, `targets.${name}.slug`),
     buildCommand: optionalText(value.buildCommand, `targets.${name}.buildCommand`),
     outputDirectory: optionalText(value.outputDirectory, `targets.${name}.outputDirectory`),
+    buildEnv: optionalStringArray(value.buildEnv, `targets.${name}.buildEnv`),
     bundleDirectory: optionalText(value.bundleDirectory, `targets.${name}.bundleDirectory`),
     entrypoint: optionalText(value.entrypoint, `targets.${name}.entrypoint`),
     verifyJwt: optionalBoolean(value.verifyJwt, `targets.${name}.verifyJwt`),
@@ -27965,7 +28078,8 @@ async function readDeployConfig(configRoot) {
       id: optionalText(frontend.id, "frontend.id"),
       root: optionalText(frontend.root, "frontend.root"),
       buildCommand: optionalText(frontend.buildCommand, "frontend.buildCommand"),
-      outputDirectory: optionalText(frontend.outputDirectory, "frontend.outputDirectory")
+      outputDirectory: optionalText(frontend.outputDirectory, "frontend.outputDirectory"),
+      buildEnv: optionalStringArray(frontend.buildEnv, "frontend.buildEnv")
     } : undefined
   };
 }
@@ -28036,7 +28150,8 @@ function selectTarget(configRoot, invocationDirectory, config, requestedName) {
     root: config.frontend?.root,
     id: config.frontend?.id,
     buildCommand: config.frontend?.buildCommand,
-    outputDirectory: config.frontend?.outputDirectory
+    outputDirectory: config.frontend?.outputDirectory,
+    buildEnv: config.frontend?.buildEnv
   }]];
   if (targets.length === 0)
     throw new Error("supacloud.json defines no deploy targets");
@@ -28084,10 +28199,28 @@ function resolveInsideProject(projectDirectory, candidate, allowRoot = false) {
   }
   return resolved;
 }
-async function runBuild(command, cwd, json) {
+function createBuildEnvironment(names, environmentVariables) {
+  const selectedNames = [...new Set(names || [])].sort();
+  const selectedNameSet = new Set(selectedNames);
+  const values = environmentVariables ?? process.env;
+  const env = Object.fromEntries(Object.entries(process.env).filter(([name]) => !isProtectedBuildEnv(name) && (!isPublicBuildEnv(name) || selectedNameSet.has(name)) && (!SENSITIVE_BUILD_ENV.test(name) || isPublicBuildEnv(name))));
+  const missing = selectedNames.filter((name) => !values[name]?.trim());
+  for (const name of selectedNames) {
+    const value = values[name];
+    if (value !== undefined)
+      env[name] = value;
+  }
+  return { env, names: selectedNames, missing };
+}
+function assertBuildEnvironment(build, skipBuild) {
+  if (!skipBuild && build.missing.length > 0) {
+    throw new Error(`Missing build environment variables: ${build.missing.join(", ")}`);
+  }
+}
+async function runBuild(command, cwd, environment, json) {
   const child = Bun.spawn(["sh", "-c", command], {
     cwd,
-    env: process.env,
+    env: environment,
     stdio: ["inherit", json ? 2 : "inherit", "inherit"]
   });
   const exitCode = await child.exited;
@@ -28215,6 +28348,7 @@ function registerDeployTools(server, http, options = {}) {
       throw new Error(`Deploy target '${target.name}' root is not a regular directory: ${projectDirectory}`);
     }
     const requestedId = String(args.id || target.config.id || "").trim() || undefined;
+    const build = createBuildEnvironment(target.config.buildEnv, options.environmentVariables);
     const report = phaseReporter(args.json === true);
     report("inspect", `${target.name} (${projectRef})`);
     if (target.config.type === "edge_function") {
@@ -28252,14 +28386,17 @@ function registerDeployTools(server, http, options = {}) {
           project_ref: projectRef,
           slug,
           build_command: args.skip_build === true ? null : buildCommand,
+          build_env: build.names,
+          missing_build_env: build.missing,
           bundle_directory: bundleDirectory,
           expected_active_version: activeVersion,
           expected_activation_id: activationId
         }, null, 2) }] };
       }
+      assertBuildEnvironment(build, args.skip_build === true);
       if (args.skip_build !== true) {
         report("build", buildCommand);
-        await runBuild(buildCommand, projectDirectory, args.json === true);
+        await runBuild(buildCommand, projectDirectory, build.env, args.json === true);
       } else {
         report("build", "skipped");
       }
@@ -28309,12 +28446,15 @@ function registerDeployTools(server, http, options = {}) {
         project_ref: projectRef,
         deployment_id: selected.id,
         build_command: args.skip_build === true ? null : buildCommand,
+        build_env: build.names,
+        missing_build_env: build.missing,
         output_directory: outputDirectory
       }, null, 2) }] };
     }
+    assertBuildEnvironment(build, args.skip_build === true);
     if (args.skip_build !== true) {
       report("build", buildCommand);
-      await runBuild(buildCommand, projectDirectory, args.json === true);
+      await runBuild(buildCommand, projectDirectory, build.env, args.json === true);
     } else {
       report("build", "skipped");
     }
@@ -28702,7 +28842,7 @@ function registerRemoteDevTools(server, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.85.0",
+  version: "0.86.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -28755,13 +28895,13 @@ var package_default = {
   },
   dependencies: {
     "@supacloud/compiler": "^0.43.0",
-    "@supacloud/delivery": "0.13.0",
+    "@supacloud/delivery": "0.14.0",
     "@supacloud/db": "0.16.0",
     typebox: "1.3.34"
   },
   overrides: {
     "@supacloud/contracts": "0.8.0",
-    "@supacloud/delivery": "0.13.0",
+    "@supacloud/delivery": "0.14.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   devDependencies: {
@@ -29290,7 +29430,7 @@ function createCliTools(context, confirmProduction) {
   assign(captureTools((server) => registerAuthTools(server, http)));
   assign(captureTools((server) => registerOAuthClientTools(server, http)));
   assign(captureTools((server) => registerStorageTools(server, http)));
-  const advancedTools = captureTools((server) => registerAdvancedTools(server, http, process.env, {
+  const advancedTools = captureTools((server) => registerAdvancedTools(server, http, context.environmentVariables, {
     readOnly: context.readOnly
   }));
   assign(advancedTools);
@@ -29314,6 +29454,7 @@ function createCliTools(context, confirmProduction) {
     environment: context.environment,
     projectRef: context.projectRef || undefined,
     cwd: process.cwd(),
+    environmentVariables: context.environmentVariables,
     edgeFunctionDeploy: advancedTools.edge_functions?.callback
   })));
   assign(captureTools((server) => registerGatewayTools(server, http, {

package/dist/shared/context.d.ts

@@ -21,6 +21,7 @@ export interface ResolvedContext {
     credentialScope: ContextCredentialScope;
     source: ContextSourceKind;
     sourcePath: string | null;
+    environmentVariables: Readonly<Record<string, string>>;
     insecureTls: boolean;
 }
 export declare function resolveSupaCloudContext(env?: NodeJS.ProcessEnv, cwd?: string, selection?: ContextSelection): ResolvedContext;

package/dist/shared/tools/application-schemas.d.ts

@@ -152,3 +152,37 @@ export declare const ApplicationPromotionPlanSchema: import("typebox").TObject<{
     execution_performed: import("typebox").TLiteral<false>;
     data_recovery: import("typebox").TLiteral<"separate-required">;
 }>;
+export declare const ApplicationReleaseRequestSchema: import("typebox").TObject<{
+    release_id: import("typebox").TString;
+    configuration_id: import("typebox").TOptional<import("typebox").TString>;
+    configuration_write: import("typebox").TOptional<import("typebox").TObject<{
+        configuration_id: import("typebox").TString;
+        expected_configuration_id: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
+        configuration: import("typebox").TObject<{
+            bun_version: import("typebox").TString;
+            targets: import("typebox").TArray<import("typebox").TObject<{
+                name: import("typebox").TString;
+                kind: import("typebox").TUnion<[import("typebox").TLiteral<"http">, import("typebox").TLiteral<"worker">]>;
+                hosts: import("typebox").TArray<import("typebox").TString>;
+                environment: import("typebox").TRecord<"^.*$", import("typebox").TString>;
+            }>>;
+        }>;
+    }>>;
+    activation_id: import("typebox").TOptional<import("typebox").TString>;
+    expected_activation_id: import("typebox").TOptional<import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>>;
+    expected_plan_sha256: import("typebox").TOptional<import("typebox").TString>;
+}>;
+export declare const ApplicationReleaseResultSchema: import("typebox").TObject<{
+    schema: import("typebox").TLiteral<"supacloud.application-release.v1">;
+    project_ref: import("typebox").TString;
+    application_id: import("typebox").TString;
+    environment_id: import("typebox").TString;
+    release_id: import("typebox").TString;
+    configuration_id: import("typebox").TString;
+    activation_id: import("typebox").TString;
+    expected_activation_id: import("typebox").TUnion<[import("typebox").TString, import("typebox").TNull]>;
+    plan_sha256: import("typebox").TString;
+    action: import("typebox").TUnion<[import("typebox").TLiteral<"activate">, import("typebox").TLiteral<"no-op">]>;
+    replayed: import("typebox").TBoolean;
+    execution_performed: import("typebox").TBoolean;
+}>;

package/dist/shared/tools/application-tools.d.ts

@@ -9,7 +9,7 @@ export declare const APPLICATION_TOOL_SCHEMA: {
     ttl_seconds: Type.TOptional<Type.TInteger>;
     wait: Type.TOptional<Type.TBoolean>;
     timeout_seconds: Type.TOptional<Type.TInteger>;
-    action: Type.TEnum<("list_releases" | "get_release" | "upload_release" | "activate_release" | "logs" | "get_runtime" | "get_deployment_evidence" | "get_configuration" | "get_release_transfer_plan" | "get_promotion_plan" | "get_promotion_status" | "get_rollback_snapshot" | "get_history" | "get_deploy_plan" | "get_preview_plan" | "list_previews" | "get_preview" | "put_configuration" | "transfer_release" | "promote_application" | "reconcile_promotion" | "create_preview" | "reconcile_preview" | "cleanup_preview" | "deploy_release" | "rollback_release" | "reconcile_activation" | "retire_activation")[]>;
+    action: Type.TEnum<("list_releases" | "get_release" | "upload_release" | "activate_release" | "logs" | "get_runtime" | "get_deployment_evidence" | "get_configuration" | "get_release_transfer_plan" | "get_promotion_plan" | "get_promotion_status" | "get_rollback_snapshot" | "get_history" | "get_deploy_plan" | "get_preview_plan" | "list_previews" | "get_preview" | "put_configuration" | "release_application" | "transfer_release" | "promote_application" | "reconcile_promotion" | "create_preview" | "reconcile_preview" | "cleanup_preview" | "deploy_release" | "rollback_release" | "reconcile_activation" | "retire_activation")[]>;
     ref: Type.TString;
     id: Type.TString;
     environment_id: Type.TOptional<Type.TString>;
@@ -17,6 +17,7 @@ export declare const APPLICATION_TOOL_SCHEMA: {
     activation_id: Type.TOptional<Type.TString>;
     expected_activation_id: Type.TOptional<Type.TUnion<[Type.TString, Type.TNull, Type.TLiteral<"absent">]>>;
     configuration_path: Type.TOptional<Type.TString>;
+    configuration_write: Type.TOptional<Type.TUnknown>;
     manifest_path: Type.TOptional<Type.TString>;
     release_id: Type.TOptional<Type.TString>;
     source_ref: Type.TOptional<Type.TString>;

package/dist/shared/tools/deploy-tools.d.ts

@@ -5,6 +5,7 @@ interface DeployToolOptions {
     projectRef?: string;
     environment?: string | null;
     cwd?: string;
+    environmentVariables?: Readonly<Record<string, string>>;
     edgeFunctionDeploy?: (args: Record<string, unknown>) => Promise<ToolResponse>;
 }
 interface ToolResponse {
@@ -28,6 +29,11 @@ export declare const deployToolSchema: {
     json: Type.TOptional<Type.TBoolean>;
 };
 export declare function findDeployConfigRoot(startDirectory: string): Promise<string>;
+export declare function createBuildEnvironment(names: string[] | undefined, environmentVariables: Readonly<Record<string, string>> | undefined): {
+    env: NodeJS.ProcessEnv;
+    names: string[];
+    missing: string[];
+};
 export declare function createFrontendArchive(outputDirectory: string): Promise<{
     archivePath: string;
     sha256: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.85.0",
+  "version": "0.86.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -53,13 +53,13 @@
   },
   "dependencies": {
     "@supacloud/compiler": "^0.43.0",
-    "@supacloud/delivery": "0.13.0",
+    "@supacloud/delivery": "0.14.0",
     "@supacloud/db": "0.16.0",
     "typebox": "1.3.34"
   },
   "overrides": {
     "@supacloud/contracts": "0.8.0",
-    "@supacloud/delivery": "0.13.0",
+    "@supacloud/delivery": "0.14.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   "devDependencies": {