@supacloud/cli 0.85.0 → 0.87.0

package/dist/index.js

@@ -8753,9 +8753,9 @@ function outcomeUnknownGuidance(text) {
   const safeScope = typeof ref === "string" && /^[a-z0-9-]{1,20}$/.test(ref) && typeof id === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(id) && typeof environment === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(environment);
   let command;
   if (safeScope && (data.operation === "applications.promote_application" || data.operation === "applications.reconcile_promotion") && typeof data.mutation_id === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(data.mutation_id)) {
-    command = `supacloud-cli app promote-status --ref ${ref} --id ${id} --environment_id ${environment} --mutation_id ${data.mutation_id}`;
+    command = `supacloud app promote-status --ref ${ref} --id ${id} --environment_id ${environment} --mutation_id ${data.mutation_id}`;
   } else if (safeScope && (data.operation === "applications.create_preview" || data.operation === "applications.cleanup_preview")) {
-    command = `supacloud-cli app preview-list --ref ${ref} --id ${id} --environment_id ${environment}`;
+    command = `supacloud app preview-list --ref ${ref} --id ${id} --environment_id ${environment}`;
   }
   return "OUTCOME_UNKNOWN：操作结果无法确认，服务端可能已经完成操作，但客户端未收到可验证的最终结果。" + "请先查询当前状态或操作回执，再决定是否重试；不要直接重复提交。" + (command ? `
 保持原 --env/--env-file 选择，先查询：${command}` : "");
@@ -8978,7 +8978,12 @@ var CORE_CONTEXT_KEYS = [
   "SUPACLOUD_API_TOKEN",
   "SUPACLOUD_PROJECT_REF",
   "X_PROJECT_REF",
-  "SUPACLOUD_HOST"
+  "SUPACLOUD_HOST",
+  "SUPACLOUD_APPLICATION_ID",
+  "SUPACLOUD_APPLICATION_ENVIRONMENT_ID",
+  "SUPACLOUD_APPLICATION_CONFIGURATION_PATH",
+  "SUPACLOUD_APPLICATION_CONFIGURATION_ID",
+  "SUPACLOUD_APPLICATION_MANIFEST_PATH"
 ];
 function unquotedEnvValue(rawValue) {
   const value = rawValue.trim();
@@ -9144,6 +9149,12 @@ function resolveSupaCloudContext(env = process.env, cwd = process.cwd(), selecti
     credentialScope: core.credentialScope,
     source: source.kind,
     sourcePath: source.path,
+    environmentVariables: source.values,
+    applicationId: source.values.SUPACLOUD_APPLICATION_ID?.trim() || "",
+    applicationEnvironmentId: source.values.SUPACLOUD_APPLICATION_ENVIRONMENT_ID?.trim() || source.environment,
+    applicationConfigurationPath: source.values.SUPACLOUD_APPLICATION_CONFIGURATION_PATH?.trim() || "",
+    applicationConfigurationId: source.values.SUPACLOUD_APPLICATION_CONFIGURATION_ID?.trim() || "",
+    applicationManifestPath: source.values.SUPACLOUD_APPLICATION_MANIFEST_PATH?.trim() || "",
     insecureTls
   };
 }
@@ -9153,7 +9164,7 @@ var ACTION_POLICY = {
   deploy: { write: ["deploy"] },
   applications: {
     read: ["list_releases", "get_release", "get_runtime", "get_deployment_evidence", "get_configuration", "get_release_transfer_plan", "get_promotion_plan", "get_promotion_status", "get_rollback_snapshot", "get_history", "get_deploy_plan", "logs", "get_preview_plan", "list_previews", "get_preview"],
-    write: ["upload_release", "put_configuration", "transfer_release", "promote_application", "reconcile_promotion", "create_preview", "reconcile_preview", "cleanup_preview", "activate_release", "deploy_release", "rollback_release", "reconcile_activation", "retire_activation"]
+    write: ["upload_release", "put_configuration", "release_application", "transfer_release", "promote_application", "reconcile_promotion", "create_preview", "reconcile_preview", "cleanup_preview", "activate_release", "deploy_release", "rollback_release", "reconcile_activation", "retire_activation"]
   },
   project: {
     read: ["get", "endpoints", "health", "logs", "api_keys", "settings", "tasks", "task_detail", "task_stats", "dlq", "background_settings"],
@@ -10477,6 +10488,37 @@ function parseApplicationDeployPlan(value) {
     throw new Error("Invalid application deploy plan action");
   return value;
 }
+// node_modules/@supacloud/delivery/src/application-release-operation.ts
+var closed3 = { additionalProperties: false };
+var nullableActivation = Union([ApplicationActivationIdSchema, Null()]);
+var ApplicationReleaseRequestSchema = _Object_({
+  release_id: ApplicationReleaseIdSchema,
+  configuration_id: Optional(ApplicationConfigurationIdSchema),
+  configuration_write: Optional(ApplicationConfigurationWriteSchema),
+  activation_id: Optional(ApplicationActivationIdSchema),
+  expected_activation_id: Optional(nullableActivation),
+  expected_plan_sha256: Optional(ApplicationReleaseIdSchema)
+}, closed3);
+var ApplicationReleaseResultSchema = _Object_({
+  schema: Literal("supacloud.application-release.v1"),
+  project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
+  application_id: ApplicationIdSchema,
+  environment_id: ApplicationIdSchema,
+  release_id: ApplicationReleaseIdSchema,
+  configuration_id: ApplicationConfigurationIdSchema,
+  activation_id: ApplicationActivationIdSchema,
+  expected_activation_id: nullableActivation,
+  plan_sha256: ApplicationReleaseIdSchema,
+  action: Union([Literal("activate"), Literal("no-op")]),
+  replayed: Boolean2(),
+  execution_performed: Boolean2()
+}, closed3);
+function parseApplicationReleaseResult(value) {
+  if (!Check2(ApplicationReleaseResultSchema, value)) {
+    throw new Error("Invalid application release result");
+  }
+  return structuredClone(value);
+}
 // node_modules/@supacloud/delivery/src/application-history.ts
 var scope = {
   project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
@@ -10561,7 +10603,7 @@ var phaseStatus = Union([
   Literal("failed"),
   Literal("cleaned")
 ]);
-var closed3 = { additionalProperties: false };
+var closed4 = { additionalProperties: false };
 var ApplicationPreviewReceiptSchema = _Object_({
   schema: Literal("supacloud.application-preview.v1"),
   preview_id: String2({ pattern: "^[a-f0-9-]{8,64}$" }),
@@ -10581,46 +10623,46 @@ var ApplicationPreviewReceiptSchema = _Object_({
     Literal("cleaned")
   ]),
   resources: _Object_({
-    build_artifact: _Object_({ status: phaseStatus, release_id: ApplicationReleaseIdSchema }, closed3),
+    build_artifact: _Object_({ status: phaseStatus, release_id: ApplicationReleaseIdSchema }, closed4),
     database_branch: _Object_({
       status: phaseStatus,
       branch_ref: String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" }),
       data_mode: Union([Literal("schema_only"), Literal("full_clone")])
-    }, closed3),
+    }, closed4),
     queue_namespace: _Object_({
       status: phaseStatus,
       namespace: String2({ minLength: 1, maxLength: 128 })
-    }, closed3),
+    }, closed4),
     storage_namespace: _Object_({
       status: phaseStatus,
       namespace: String2({ minLength: 1, maxLength: 128 })
-    }, closed3),
+    }, closed4),
     test_secret: _Object_({
       status: phaseStatus,
       name: String2({ minLength: 1, maxLength: 128 }),
       value_issued: Literal(false)
-    }, closed3),
+    }, closed4),
     configuration_revision: _Object_({
       status: phaseStatus,
       configuration_id: Union([ApplicationConfigurationIdSchema, Null()])
-    }, closed3),
+    }, closed4),
     application_activation: _Object_({
       status: phaseStatus,
       activation_id: Union([ApplicationActivationIdSchema, Null()])
-    }, closed3),
+    }, closed4),
     smoke_test: _Object_({
       status: phaseStatus,
       checks: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 32 }),
       passed: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 32 }),
       failed: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 32 })
-    }, closed3)
-  }, closed3),
+    }, closed4)
+  }, closed4),
   cleanup: _Object_({
     required: Boolean2(),
     completed: Boolean2(),
     error: Union([String2({ minLength: 1, maxLength: 128 }), Null()])
-  }, closed3)
-}, closed3);
+  }, closed4)
+}, closed4);
 function applicationPreviewBranchRef(previewId) {
   if (!/^[a-f0-9-]{8,64}$/.test(previewId))
     throw new Error("Invalid preview ID");
@@ -10673,7 +10715,7 @@ function parseApplicationReleaseTransferResult(candidate) {
   return candidate;
 }
 // node_modules/@supacloud/delivery/src/deployment-evidence.ts
-var closed4 = { additionalProperties: false };
+var closed5 = { additionalProperties: false };
 var sha256 = String2({ pattern: "^[a-f0-9]{64}$" });
 var isoDate = String2({ minLength: 20, maxLength: 40 });
 var status = Union([
@@ -10700,19 +10742,19 @@ var DatabaseProviderSchema = _Object_({
       Literal("not-proven"),
       Literal("failed")
     ])
-  }, closed4),
+  }, closed5),
   backup: _Object_({
     status,
     latest_success_at: Union([isoDate, Null()]),
     freshness_seconds: Union([Integer({ minimum: 0 }), Null()])
-  }, closed4),
+  }, closed5),
   recovery: _Object_({
     status,
     drill_id: Union([String2({ minLength: 1, maxLength: 128 }), Null()]),
     rpo_seconds: Union([Integer({ minimum: 0 }), Null()]),
     rto_seconds: Union([Integer({ minimum: 0 }), Null()])
-  }, closed4)
-}, closed4);
+  }, closed5)
+}, closed5);
 var componentName = Union([
   Literal("management-api"),
   Literal("web-console"),
@@ -10730,7 +10772,7 @@ var DeploymentComponentEvidenceSchema = _Object_({
   status,
   health_check: Union([String2({ minLength: 1, maxLength: 256 }), Null()]),
   checked_at: Union([isoDate, Null()])
-}, closed4);
+}, closed5);
 var DeploymentEvidenceSchema = _Object_({
   schema: Literal(DEPLOYMENT_EVIDENCE_SCHEMA),
   status: evidenceStatus,
@@ -10739,33 +10781,33 @@ var DeploymentEvidenceSchema = _Object_({
     project_ref: String2({ pattern: "^[a-z0-9-]{1,20}$" }),
     application_id: ApplicationIdSchema,
     environment_id: ApplicationIdSchema
-  }, closed4),
+  }, closed5),
   source: _Object_({
     commit_sha: Union([String2({ pattern: "^[0-9a-f]{7,64}$" }), Null()]),
     manifest_sha256: sha256,
     contract_schema: Union([String2({ minLength: 1, maxLength: 128 }), Null()]),
     environment_binding_version: Union([sha256, Null()])
-  }, closed4),
+  }, closed5),
   database: DatabaseProviderSchema,
   components: _Array_(DeploymentComponentEvidenceSchema, { minItems: 1, maxItems: 32 }),
   activation: _Object_({
     release_id: ApplicationReleaseIdSchema,
     configuration_id: ApplicationConfigurationIdSchema,
     activation_id: ApplicationConfigurationIdSchema
-  }, closed4),
+  }, closed5),
   health: _Object_({
     status,
     checked_at: Union([isoDate, Null()]),
     authenticated_smoke: status
-  }, closed4),
+  }, closed5),
   rollback: _Object_({
     release_id: Union([ApplicationReleaseIdSchema, Null()]),
     configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
     status: Union([Literal("ready"), Literal("not-ready"), Literal("unknown")]),
     result: Union([status, Null()])
-  }, closed4),
+  }, closed5),
   notes: _Array_(String2({ minLength: 1, maxLength: 512 }), { maxItems: 32 })
-}, closed4);
+}, closed5);
 function isIsoDate(value) {
   return Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
 }
@@ -10798,13 +10840,13 @@ function parseDeploymentEvidence(value) {
   return structuredClone(value);
 }
 // node_modules/@supacloud/delivery/src/application-promotion.ts
-var closed5 = { additionalProperties: false };
+var closed6 = { additionalProperties: false };
 var projectRef2 = String2({ pattern: "^[a-z0-9-]{1,20}$" });
 var sha2562 = ApplicationReleaseIdSchema;
-var nullableActivation = Union([ApplicationActivationIdSchema, Null()]);
+var nullableActivation2 = Union([ApplicationActivationIdSchema, Null()]);
 var nullableDigest = Union([sha2562, Null()]);
 var observation = {
-  activation_id: nullableActivation,
+  activation_id: nullableActivation2,
   receipt_confirmed: Boolean2(),
   ready: Boolean2(),
   smoke_verified: Boolean2(),
@@ -10835,7 +10877,7 @@ var ApplicationPromotionPlanSchema = _Object_({
     environment_id: ApplicationIdSchema,
     release_id: sha2562,
     ...observation
-  }, closed5),
+  }, closed6),
   target: _Object_({
     candidate_release_id: sha2562,
     current_release_id: Union([sha2562, Null()]),
@@ -10843,18 +10885,18 @@ var ApplicationPromotionPlanSchema = _Object_({
     configuration_id: Union([ApplicationConfigurationIdSchema, Null()]),
     configuration: Union([ApplicationConfigurationViewSchema, Null()]),
     ...observation
-  }, closed5),
+  }, closed6),
   migrations: _Object_({
     ledger_digest: sha2562,
     ledger_compatible: Boolean2(),
     project_migrations_applied: Boolean2(),
     pending_versions: _Array_(String2({ pattern: "^\\d{1,20}$" }), { maxItems: 4096, uniqueItems: true }),
     operator_provisioning_required: Boolean2()
-  }, closed5),
+  }, closed6),
   backup: _Object_({
     required: Boolean2(),
     confirmed: Literal(false)
-  }, closed5),
+  }, closed6),
   action: Union([Literal("promote"), Literal("no-op"), Literal("blocked")]),
   blockers: _Array_(Enum([...blocker]), {
     maxItems: blocker.length,
@@ -10863,7 +10905,7 @@ var ApplicationPromotionPlanSchema = _Object_({
   steps: _Array_(String2({ minLength: 1, maxLength: 64 }), { maxItems: 8, uniqueItems: true }),
   execution_performed: Literal(false),
   data_recovery: Literal("separate-required")
-}, closed5);
+}, closed6);
 function applicationPromotionPlanDigest(value) {
   return digest(canonical(value));
 }
@@ -15832,7 +15874,7 @@ Actions: list, upsert, delete`, {
     action: withDescription(stringEnum(["list", "upsert", "delete"]), "Action"),
     ref: withDescription(String2(), "Project ref"),
     secrets: withDescription(secretsSchema, "[upsert] Secret list as JSON array or KEY=VALUE,KEY2=VALUE2"),
-    "from-env": withDescription(environmentSecretNamesSchema, "[upsert] Comma-separated environment variable names; values are read from this CLI process"),
+    "from-env": withDescription(environmentSecretNamesSchema, "[upsert] Comma-separated environment variable names; values are read from the selected CLI environment"),
     name: optional(String2(), "[delete] Secret name to delete")
   }, async (args) => {
     const { action, ref, secrets, name } = args;
@@ -16810,6 +16852,7 @@ var ApplicationActivationRetirementResultSchema2 = ApplicationActivationRetireme
 var ApplicationRollbackSnapshotSchema2 = ApplicationRollbackSnapshotSchema;
 var ApplicationActivationHistoryCursorSchema2 = ApplicationActivationHistoryCursorSchema;
 var ApplicationPromotionPlanSchema2 = ApplicationPromotionPlanSchema;
+var ApplicationReleaseRequestSchema2 = ApplicationReleaseRequestSchema;
 
 // src/shared/mutation-protocol.ts
 import { createHash as createHash6 } from "node:crypto";
@@ -17049,7 +17092,7 @@ async function fetchMutationStatus(http, ref, mutationId) {
 }
 
 // src/shared/tools/application-workflow-schemas.ts
-var closed6 = { additionalProperties: false };
+var closed7 = { additionalProperties: false };
 var ref5 = String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" });
 var uuid = ApplicationActivationIdSchema2;
 var nullableUuid = Union([uuid, Null()]);
@@ -17063,7 +17106,7 @@ var ApplicationPromotionResultSchema = _Object_({
   plan_sha256: ApplicationReleaseIdSchema2,
   action: Literal("promote"),
   replayed: Boolean2()
-}, closed6);
+}, closed7);
 var ApplicationPromotionStatusSchema = _Object_({
   ...scope2,
   mutation: Unknown(),
@@ -17082,8 +17125,8 @@ var ApplicationPromotionStatusSchema = _Object_({
     configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]),
     backup_id: Union([String2({ pattern: "^logical-full_[a-z0-9-]{1,20}_[a-f0-9]{32}$" }), Null()]),
     data_recovery: Literal("separate-required")
-  }, closed6)
-}, closed6);
+  }, closed7)
+}, closed7);
 var phase = Union([Literal("pending"), Literal("ready"), Literal("failed"), Literal("cleaned")]);
 var previewId = String2({ pattern: "^[a-f0-9-]{8,64}$" });
 var name = String2({ minLength: 1, maxLength: 256 });
@@ -17102,35 +17145,35 @@ var ApplicationPreviewReceiptSchema2 = _Object_({
     Literal("cleaned")
   ]),
   resources: _Object_({
-    build_artifact: _Object_({ status: phase, release_id: ApplicationReleaseIdSchema2 }, closed6),
+    build_artifact: _Object_({ status: phase, release_id: ApplicationReleaseIdSchema2 }, closed7),
     database_branch: _Object_({
       status: phase,
       branch_ref: ref5,
       data_mode: Union([Literal("schema_only"), Literal("full_clone")])
-    }, closed6),
-    queue_namespace: _Object_({ status: phase, namespace: name }, closed6),
-    storage_namespace: _Object_({ status: phase, namespace: name }, closed6),
-    test_secret: _Object_({ status: phase, name, value_issued: Literal(false) }, closed6),
-    configuration_revision: _Object_({ status: phase, configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]) }, closed6),
-    application_activation: _Object_({ status: phase, activation_id: nullableUuid }, closed6),
-    smoke_test: _Object_({ status: phase, checks, passed: checks, failed: checks }, closed6)
-  }, closed6),
+    }, closed7),
+    queue_namespace: _Object_({ status: phase, namespace: name }, closed7),
+    storage_namespace: _Object_({ status: phase, namespace: name }, closed7),
+    test_secret: _Object_({ status: phase, name, value_issued: Literal(false) }, closed7),
+    configuration_revision: _Object_({ status: phase, configuration_id: Union([ApplicationConfigurationIdSchema2, Null()]) }, closed7),
+    application_activation: _Object_({ status: phase, activation_id: nullableUuid }, closed7),
+    smoke_test: _Object_({ status: phase, checks, passed: checks, failed: checks }, closed7)
+  }, closed7),
   cleanup: _Object_({
     required: Boolean2(),
     completed: Boolean2(),
     error: Union([String2({ pattern: "^[A-Z][A-Z0-9_]{0,63}$" }), Null()])
-  }, closed6),
+  }, closed7),
   branch_name: Optional(String2({ minLength: 1, maxLength: 80 })),
   queue_name: Optional(name),
   test_secret_name: Optional(name),
   source_configuration_id: Optional(Union([ApplicationConfigurationIdSchema2, Null()])),
   created_at: Optional(timestamp2),
   updated_at: Optional(timestamp2)
-}, closed6);
+}, closed7);
 var previewListSchema = _Object_({
   ...scope2,
   previews: _Array_(ApplicationPreviewReceiptSchema2, { maxItems: 1000 })
-}, closed6);
+}, closed7);
 function assertScope(value, identity) {
   if (value.project_ref !== identity.project_ref || value.application_id !== identity.application_id || value.environment_id !== identity.environment_id)
     throw new Error("Application workflow scope mismatch");
@@ -17597,6 +17640,7 @@ var APPLICATION_TOOL_SCHEMA = {
     "put_configuration",
     "get_deploy_plan",
     "deploy_release",
+    "release_application",
     "get_release_transfer_plan",
     "transfer_release",
     "get_promotion_plan",
@@ -17624,6 +17668,7 @@ var APPLICATION_TOOL_SCHEMA = {
   activation_id: optional(ApplicationActivationIdSchema2, "[deploy_release/activate_release/reconcile_activation/retire_activation/rollback_release/get_history] Stable activation ID; generated for automatic deployment/rollback if omitted"),
   expected_activation_id: optional(Union([ApplicationActivationIdSchema2, Null(), Literal("absent")]), "[deploy_release/activate_release/rollback_release] Current activation ID, or absent for first activation; selected from verified plan for automatic deployment"),
   configuration_path: optional(String2(), "[put_configuration] Local configuration write JSON including revision and expected revision"),
+  configuration_write: optional(Unknown(), "[release_application] Parsed immutable configuration write"),
   manifest_path: optional(String2(), "[upload_release] Local delivery.manifest.json"),
   release_id: optional(ApplicationReleaseIdSchema2, "[get_release/get_deploy_plan/deploy_release/activate_release/reconcile_activation/rollback_release] Immutable application release ID; platform selects previous for default rollback"),
   source_ref: optional(String2({ pattern: "^[A-Za-z0-9_-]{1,20}$" }), "[get_release_transfer_plan/transfer_release] Source project ref"),
@@ -17983,6 +18028,61 @@ function registerApplicationTools(server, http) {
       const observed = await readDeployPlan(http, args, project);
       return observed.failure ?? releaseControlSuccess(operation, { ...observed.identity, plan: observed.plan });
     }
+    if (action === "release_application") {
+      const environmentId = text(args, "environment_id");
+      const releaseId = text(args, "release_id");
+      if (!Check2(ApplicationIdSchema2, environmentId) || !Check2(ApplicationReleaseIdSchema2, releaseId)) {
+        throw new Error("Invalid application release identity");
+      }
+      const configurationId = args["configuration_id"];
+      const activationId = args["activation_id"];
+      const expectedActivationId = args["expected_activation_id"];
+      if (configurationId !== undefined && !Check2(ApplicationConfigurationIdSchema2, configurationId)) {
+        throw new Error("Invalid application configuration ID");
+      }
+      if (activationId !== undefined && !Check2(ApplicationActivationIdSchema2, activationId)) {
+        throw new Error("Invalid application activation ID");
+      }
+      if (expectedActivationId !== undefined && expectedActivationId !== null && expectedActivationId !== "absent" && !Check2(ApplicationActivationIdSchema2, expectedActivationId)) {
+        throw new Error("Invalid expected activation ID");
+      }
+      const configurationWrite = args["configuration_write"];
+      const parsedConfigurationWrite = configurationWrite === undefined ? undefined : parseApplicationConfigurationWrite(configurationWrite);
+      const requestedConfigurationId = configurationId ?? parsedConfigurationWrite?.configuration_id;
+      const body = {
+        release_id: releaseId,
+        ...configurationId === undefined ? {} : { configuration_id: configurationId },
+        ...configurationWrite === undefined ? {} : { configuration_write: configurationWrite },
+        ...activationId === undefined ? {} : { activation_id: activationId },
+        ...expectedActivationId === undefined ? {} : {
+          expected_activation_id: expectedActivationId === "absent" ? null : expectedActivationId
+        }
+      };
+      if (!Check2(ApplicationReleaseRequestSchema2, body)) {
+        throw new Error("Invalid application release request");
+      }
+      const result = await http.post(`/v1/projects/${project}/applications/${encodeURIComponent(id)}/environments/${encodeURIComponent(environmentId)}/release`, body, { timeoutMs: 120000, maxJsonBytes: 65536, responseTimeoutMs: 30000 });
+      const identity = {
+        project_ref: ref,
+        application_id: id,
+        environment_id: environmentId,
+        release_id: releaseId,
+        ...configurationId === undefined ? {} : { configuration_id: configurationId },
+        ...activationId === undefined ? {} : { activation_id: activationId }
+      };
+      if (!result.ok)
+        return releaseControlMutationFailure(operation, result, identity);
+      try {
+        if (result.status !== 200)
+          throw new Error;
+        const release = parseApplicationReleaseResult(result.data);
+        if (release.project_ref !== ref || release.application_id !== id || release.environment_id !== environmentId || release.release_id !== releaseId || requestedConfigurationId !== undefined && release.configuration_id !== requestedConfigurationId || activationId !== undefined && release.activation_id !== activationId)
+          throw new Error;
+        return releaseControlSuccess(operation, release);
+      } catch {
+        return releaseControlFailure(operation, "OUTCOME_UNKNOWN", result.status, identity);
+      }
+    }
     if (action === "deploy_release")
       return deployAction(http, args, project);
     if (action === "rollback_release" || action === "get_rollback_snapshot") {
@@ -20702,7 +20802,7 @@ import {
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname4, join as join8, relative as relative4, resolve as resolve11, sep as sep3 } from "node:path";
 import { fileURLToPath } from "node:url";
-var SKILL_NAME = "supacloud-cli";
+var SKILL_NAME = "supacloud";
 function regularFiles(rootDirectory, currentDirectory = rootDirectory) {
   const files = [];
   for (const directoryEntry of readdirSync4(currentDirectory, { withFileTypes: true })) {
@@ -20740,7 +20840,7 @@ function availableBackupDirectory(destinationDirectory, now) {
 }
 function stagedSkill(sourceDirectory, targetRoot) {
   mkdirSync3(targetRoot, { recursive: true });
-  const stagingRoot = mkdtempSync2(join8(targetRoot, ".supacloud-cli-install-"));
+  const stagingRoot = mkdtempSync2(join8(targetRoot, ".supacloud-install-"));
   const stagingSkill = join8(stagingRoot, SKILL_NAME);
   try {
     cpSync(sourceDirectory, stagingSkill, { recursive: true, errorOnExist: true });
@@ -21007,16 +21107,16 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.43.0"
+      version: "0.44.0"
     },
     app: {
-      version: "0.25.0",
+      version: "0.26.0",
       dependencies: {
         rxjs: "7.8.2"
       }
     },
     elysia: {
-      version: "0.29.0"
+      version: "0.29.1"
     },
     commands: {
       version: "0.9.1"
@@ -21793,8 +21893,8 @@ The compiler discovers this declaration; no runtime container lookup is needed.
 With the matching candidate/released CLI installed:
 
 \`\`\`sh
-supacloud-cli app generate --kind resource --name inventory --register-in src/app.module.ts --dry-run --format json
-supacloud-cli app generate --kind resource --name inventory --register-in src/app.module.ts
+supacloud app generate --kind resource --name inventory --register-in src/app.module.ts --dry-run --format json
+supacloud app generate --kind resource --name inventory --register-in src/app.module.ts
 bun run check
 bun run inspect
 \`\`\`
@@ -25449,35 +25549,29 @@ async function runAppRelease(request, options, delegate) {
     return releasePhaseFailure("upload", releaseControlFailure("applications.upload_release", "INVALID_RESPONSE", null, { project_ref: ref, application_id: id }), completed);
   completed.upload = { ok: true, release_id: releaseId };
   let configurationId = request.configuration_id;
+  let configurationWrite;
+  const activationId = crypto.randomUUID();
   if (request.configuration_path !== undefined) {
     const configurationPath = resolve17(root, request.configuration_path);
-    const configureArgs = {
-      action: "put_configuration",
-      ref,
-      id,
-      environment_id: environmentId,
-      configuration_path: configurationPath
-    };
-    validateToolArguments(APPLICATION_TOOL_SCHEMA, configureArgs);
-    const configured = await delegate(configureArgs);
-    const configurationReceipt = resultObject(configured);
-    if (configured.isError || !configurationReceipt?.ok) {
-      return releasePhaseFailure("configure", configured, completed);
-    }
-    configurationId = releaseField(configurationReceipt, "configuration", "configuration_id");
-    if (!configurationId)
-      return releasePhaseFailure("configure", releaseControlFailure("applications.put_configuration", "INVALID_RESPONSE", null, { project_ref: ref, application_id: id, environment_id: environmentId }), completed);
-    completed.configure = { ok: true, configuration_id: configurationId };
+    try {
+      configurationWrite = parseApplicationConfigurationWrite(await Bun.file(configurationPath).json());
+      configurationId = configurationWrite.configuration_id;
+    } catch {
+      return releasePhaseFailure("configure", releaseControlFailure("applications.release_application", "INVALID_RESPONSE", null, { project_ref: ref, application_id: id, environment_id: environmentId }), completed);
+    }
+    completed.configure = { delegated: true, configuration_id: configurationId };
   } else {
-    completed.configure = { skipped: true, configuration_id: configurationId };
+    completed.configure = { delegated: true, configuration_id: configurationId };
   }
   const deployArgs = {
-    action: "deploy_release",
+    action: "release_application",
     ref,
     id,
     environment_id: environmentId,
     release_id: releaseId,
-    configuration_id: configurationId
+    configuration_id: configurationId,
+    activation_id: activationId,
+    ...configurationWrite === undefined ? {} : { configuration_write: configurationWrite }
   };
   validateToolArguments(APPLICATION_TOOL_SCHEMA, deployArgs);
   const deployed = await delegate(deployArgs);
@@ -25498,7 +25592,7 @@ async function runAppRelease(request, options, delegate) {
     manifest_path: manifestPath,
     build: buildReceipt ? completed.build : { skipped: true, manifest_path: manifestPath },
     phases: completed,
-    no_op: deployReceipt.no_op === true,
+    no_op: deployReceipt.action === "no-op" || deployReceipt.no_op === true,
     execution_performed: deployReceipt.execution_performed === true,
     ...typeof deployReceipt.activation_id === "string" ? { activation_id: deployReceipt.activation_id } : {}
   };
@@ -26474,9 +26568,9 @@ function buildDatabaseAiContext(modules, root, moduleName, target) {
       ]
     },
     verification: [
-      "supacloud-cli db lint --module_file db/modules.ts",
-      "supacloud-cli db explain --target <object>",
-      'supacloud-cli db module_check --module_file db/modules.ts --database_url "$DATABASE_URL"'
+      "supacloud db lint --module_file db/modules.ts",
+      "supacloud db explain --target <object>",
+      'supacloud db module_check --module_file db/modules.ts --database_url "$DATABASE_URL"'
     ]
   };
 }
@@ -27684,7 +27778,7 @@ function registerReleaseTools(server, http, options = {}) {
         content: [
           {
             type: "text",
-            text: "⚠️ This command requires Management API context. Run `supacloud-cli status` to inspect current detection."
+            text: "⚠️ This command requires Management API context. Run `supacloud status` to inspect current detection."
           }
         ]
       };
@@ -27854,6 +27948,14 @@ import { createHash as createHash9 } from "node:crypto";
 import { tmpdir as tmpdir3 } from "node:os";
 import { basename as basename8, dirname as dirname11, join as join17, relative as relative10, resolve as resolve22, sep as sep5 } from "node:path";
 var MAX_SOURCE_BYTES = 256 * 1024 * 1024;
+var PUBLIC_BUILD_ENV_PREFIXES = ["PUBLIC_", "VITE_", "NEXT_PUBLIC_", "NUXT_PUBLIC_", "ASTRO_PUBLIC_"];
+var SENSITIVE_BUILD_ENV = /(?:^|_)(?:PASSWORD|PASS|SECRET|TOKEN|KEY|CREDENTIAL|AUTHORIZATION|COOKIE|SESSION)(?:_|$)|(?:DATABASE_URL|DATABASE_URI|CONNECTION_STRING|DSN|PRIVATE_KEY)/i;
+function isPublicBuildEnv(name) {
+  return PUBLIC_BUILD_ENV_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+function isProtectedBuildEnv(name) {
+  return name.startsWith("SUPACLOUD_") || name === "SUPABASE_SERVICE_ROLE_KEY" || name === "SUPABASE_ACCESS_TOKEN" || name === "MANAGEMENT_API_URL" || name === "MANAGEMENT_API_TOKEN";
+}
 var deployToolSchema = {
   ref: optional(String2(), "Project ref (defaults to the linked project)"),
   target: optional(String2(), "Named deploy target from supacloud.json"),
@@ -27898,11 +28000,13 @@ async function readJson(path) {
     throw new Error(`Invalid JSON file ${path}: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
-async function findDeployConfigRoot(startDirectory) {
+async function findDeployConfigRoot(startDirectory, environmentName) {
   let directory = resolve22(startDirectory);
   while (true) {
-    if (await pathExists(join17(directory, "supacloud.json")))
+    const environmentFile = environmentName ? `.env.supacloud.${environmentName}` : null;
+    if (await pathExists(join17(directory, "supacloud.json")) || await pathExists(join17(directory, "supacloud.config.ts")) || environmentFile !== null && await pathExists(join17(directory, environmentFile))) {
       return directory;
+    }
     const parent = dirname11(directory);
     if (parent === directory)
       return resolve22(startDirectory);
@@ -27924,6 +28028,26 @@ function optionalBoolean(value, field) {
     throw new Error(`supacloud.json ${field} must be a boolean`);
   return value;
 }
+function optionalStringArray(value, field) {
+  if (value === undefined)
+    return;
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || !item.trim())) {
+    throw new Error(`supacloud.json ${field} must be an array of non-empty strings`);
+  }
+  return value.map((item) => item.trim()).map((name) => {
+    if (!/^[A-Z_][A-Z0-9_]*$/.test(name)) {
+      throw new Error(`supacloud.json ${field} must contain uppercase environment variable names`);
+    }
+    const isPublic = isPublicBuildEnv(name);
+    if (SENSITIVE_BUILD_ENV.test(name) && !isPublic) {
+      throw new Error(`supacloud.json ${field} cannot include sensitive variable '${name}'; use runtime secrets instead`);
+    }
+    if (isProtectedBuildEnv(name)) {
+      throw new Error(`supacloud.json ${field} cannot include platform credential '${name}'`);
+    }
+    return name;
+  });
+}
 function deployTargetConfig(candidate, name) {
   const value = record4(candidate);
   if (!value || value.type !== "frontend" && value.type !== "edge_function") {
@@ -27940,6 +28064,7 @@ function deployTargetConfig(candidate, name) {
     slug: optionalText(value.slug, `targets.${name}.slug`),
     buildCommand: optionalText(value.buildCommand, `targets.${name}.buildCommand`),
     outputDirectory: optionalText(value.outputDirectory, `targets.${name}.outputDirectory`),
+    buildEnv: optionalStringArray(value.buildEnv, `targets.${name}.buildEnv`),
     bundleDirectory: optionalText(value.bundleDirectory, `targets.${name}.bundleDirectory`),
     entrypoint: optionalText(value.entrypoint, `targets.${name}.entrypoint`),
     verifyJwt: optionalBoolean(value.verifyJwt, `targets.${name}.verifyJwt`),
@@ -27965,7 +28090,8 @@ async function readDeployConfig(configRoot) {
       id: optionalText(frontend.id, "frontend.id"),
       root: optionalText(frontend.root, "frontend.root"),
       buildCommand: optionalText(frontend.buildCommand, "frontend.buildCommand"),
-      outputDirectory: optionalText(frontend.outputDirectory, "frontend.outputDirectory")
+      outputDirectory: optionalText(frontend.outputDirectory, "frontend.outputDirectory"),
+      buildEnv: optionalStringArray(frontend.buildEnv, "frontend.buildEnv")
     } : undefined
   };
 }
@@ -28036,7 +28162,8 @@ function selectTarget(configRoot, invocationDirectory, config, requestedName) {
     root: config.frontend?.root,
     id: config.frontend?.id,
     buildCommand: config.frontend?.buildCommand,
-    outputDirectory: config.frontend?.outputDirectory
+    outputDirectory: config.frontend?.outputDirectory,
+    buildEnv: config.frontend?.buildEnv
   }]];
   if (targets.length === 0)
     throw new Error("supacloud.json defines no deploy targets");
@@ -28084,10 +28211,28 @@ function resolveInsideProject(projectDirectory, candidate, allowRoot = false) {
   }
   return resolved;
 }
-async function runBuild(command, cwd, json) {
+function createBuildEnvironment(names, environmentVariables) {
+  const selectedNames = [...new Set(names || [])].sort();
+  const selectedNameSet = new Set(selectedNames);
+  const values = environmentVariables ?? process.env;
+  const env = Object.fromEntries(Object.entries(process.env).filter(([name]) => !isProtectedBuildEnv(name) && (!isPublicBuildEnv(name) || selectedNameSet.has(name)) && (!SENSITIVE_BUILD_ENV.test(name) || isPublicBuildEnv(name))));
+  const missing = selectedNames.filter((name) => !values[name]?.trim());
+  for (const name of selectedNames) {
+    const value = values[name];
+    if (value !== undefined)
+      env[name] = value;
+  }
+  return { env, names: selectedNames, missing };
+}
+function assertBuildEnvironment(build, skipBuild) {
+  if (!skipBuild && build.missing.length > 0) {
+    throw new Error(`Missing build environment variables: ${build.missing.join(", ")}`);
+  }
+}
+async function runBuild(command, cwd, environment, json) {
   const child = Bun.spawn(["sh", "-c", command], {
     cwd,
-    env: process.env,
+    env: environment,
     stdio: ["inherit", json ? 2 : "inherit", "inherit"]
   });
   const exitCode = await child.exited;
@@ -28207,6 +28352,42 @@ function registerDeployTools(server, http, options = {}) {
     if (!projectRef)
       throw new Error("A linked project ref is required. Set SUPACLOUD_PROJECT_REF or pass --ref");
     const configRoot = await findDeployConfigRoot(invocationDirectory);
+    if (options.application?.id) {
+      if (!options.applicationRelease) {
+        throw new Error("Application release support is unavailable in this CLI context");
+      }
+      if (args.target || args.build_command || args.output_dir) {
+        throw new Error("Application profile deploy does not accept frontend target, build command, or output directory flags");
+      }
+      if (args.dry_run === true || args.plan === true || args.diff === true) {
+        throw new Error("Application profile deploy does not support dry_run, plan, or diff; use app deploy-plan for a read-only plan");
+      }
+      const environmentId = options.application.environmentId.trim();
+      if (!environmentId) {
+        throw new Error("Application profile requires SUPACLOUD_APPLICATION_ENVIRONMENT_ID or SUPACLOUD_ENV");
+      }
+      const configurationPath = options.application.configurationPath?.trim();
+      const configurationId = options.application.configurationId?.trim();
+      if (!configurationPath && !configurationId) {
+        throw new Error("Application profile requires SUPACLOUD_APPLICATION_CONFIGURATION_PATH or SUPACLOUD_APPLICATION_CONFIGURATION_ID");
+      }
+      if (configurationPath && configurationId) {
+        throw new Error("Application profile must set only one of SUPACLOUD_APPLICATION_CONFIGURATION_PATH or SUPACLOUD_APPLICATION_CONFIGURATION_ID");
+      }
+      const result = await options.applicationRelease({
+        action: "release",
+        ref: projectRef,
+        id: options.application.id,
+        environment_id: environmentId,
+        root: configRoot,
+        ...configurationPath ? { configuration_path: configurationPath } : {},
+        ...configurationId ? { configuration_id: configurationId } : {},
+        ...options.application.manifestPath ? { manifest_path: options.application.manifestPath } : {},
+        ...args.skip_build === true ? { skip_build: true } : {},
+        ...args.json === true ? { format: "json", json: true } : {}
+      });
+      return result;
+    }
     const config = await readDeployConfig(configRoot);
     const target = selectTarget(configRoot, invocationDirectory, config, String(args.target || "").trim() || undefined);
     const projectDirectory = target.root;
@@ -28215,6 +28396,7 @@ function registerDeployTools(server, http, options = {}) {
       throw new Error(`Deploy target '${target.name}' root is not a regular directory: ${projectDirectory}`);
     }
     const requestedId = String(args.id || target.config.id || "").trim() || undefined;
+    const build = createBuildEnvironment(target.config.buildEnv, options.environmentVariables);
     const report = phaseReporter(args.json === true);
     report("inspect", `${target.name} (${projectRef})`);
     if (target.config.type === "edge_function") {
@@ -28252,14 +28434,17 @@ function registerDeployTools(server, http, options = {}) {
           project_ref: projectRef,
           slug,
           build_command: args.skip_build === true ? null : buildCommand,
+          build_env: build.names,
+          missing_build_env: build.missing,
           bundle_directory: bundleDirectory,
           expected_active_version: activeVersion,
           expected_activation_id: activationId
         }, null, 2) }] };
       }
+      assertBuildEnvironment(build, args.skip_build === true);
       if (args.skip_build !== true) {
         report("build", buildCommand);
-        await runBuild(buildCommand, projectDirectory, args.json === true);
+        await runBuild(buildCommand, projectDirectory, build.env, args.json === true);
       } else {
         report("build", "skipped");
       }
@@ -28309,12 +28494,15 @@ function registerDeployTools(server, http, options = {}) {
         project_ref: projectRef,
         deployment_id: selected.id,
         build_command: args.skip_build === true ? null : buildCommand,
+        build_env: build.names,
+        missing_build_env: build.missing,
         output_directory: outputDirectory
       }, null, 2) }] };
     }
+    assertBuildEnvironment(build, args.skip_build === true);
     if (args.skip_build !== true) {
       report("build", buildCommand);
-      await runBuild(buildCommand, projectDirectory, args.json === true);
+      await runBuild(buildCommand, projectDirectory, build.env, args.json === true);
     } else {
       report("build", "skipped");
     }
@@ -28702,7 +28890,7 @@ function registerRemoteDevTools(server, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.85.0",
+  version: "0.87.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -28720,7 +28908,7 @@ var package_default = {
     }
   },
   bin: {
-    "supacloud-cli": "dist/index.js"
+    supacloud: "dist/index.js"
   },
   files: [
     "NOTICE",
@@ -28754,14 +28942,14 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.43.0",
-    "@supacloud/delivery": "0.13.0",
+    "@supacloud/compiler": "^0.44.0",
+    "@supacloud/delivery": "0.14.0",
     "@supacloud/db": "0.16.0",
     typebox: "1.3.34"
   },
   overrides: {
     "@supacloud/contracts": "0.8.0",
-    "@supacloud/delivery": "0.13.0",
+    "@supacloud/delivery": "0.14.0",
     "@graphql-tools/utils": "^12.0.3"
   },
   devDependencies: {
@@ -28774,7 +28962,7 @@ var package_default = {
 };
 
 // src/index.ts
-var commandName = "supacloud-cli";
+var commandName = "supacloud";
 var preferredCommand = commandName;
 var projectActionSchema = stringEnum([
   "get",
@@ -28929,7 +29117,7 @@ function printHelp(context) {
   const autoLink = context.inferredSupabaseUrl ? `Project context: ${context.inferredSupabaseUrl} (${context.source})` : "Project context: not detected";
   console.error(`
 ╔═══════════════════════════════════════════════════════════╗
-║  supacloud-cli                                           ║
+║  supacloud                                           ║
 ║  Project CLI for SupaCloud users                         ║
 ╚═══════════════════════════════════════════════════════════╝
 
@@ -28971,6 +29159,8 @@ EXAMPLES
 
   ${preferredCommand} status
   ${preferredCommand} deploy
+  ${preferredCommand} --env test deploy
+  ${preferredCommand} --env production deploy --confirm-production <project-ref>
   ${preferredCommand} deploy --target web
   ${preferredCommand} deploy --target api
   ${preferredCommand} dev sync --env test --target functions --function api
@@ -29237,7 +29427,7 @@ function createCliTools(context, confirmProduction) {
               "Provide one of these sources:",
               "",
               "  1. Named environment file",
-              "     supacloud-cli --env test status",
+              "     supacloud --env test status",
               "",
               "  2. Explicit environment variables",
               "     SUPACLOUD_API_URL=https://your-project.example.com",
@@ -29290,7 +29480,7 @@ function createCliTools(context, confirmProduction) {
   assign(captureTools((server) => registerAuthTools(server, http)));
   assign(captureTools((server) => registerOAuthClientTools(server, http)));
   assign(captureTools((server) => registerStorageTools(server, http)));
-  const advancedTools = captureTools((server) => registerAdvancedTools(server, http, process.env, {
+  const advancedTools = captureTools((server) => registerAdvancedTools(server, http, context.environmentVariables, {
     readOnly: context.readOnly
   }));
   assign(advancedTools);
@@ -29314,6 +29504,18 @@ function createCliTools(context, confirmProduction) {
     environment: context.environment,
     projectRef: context.projectRef || undefined,
     cwd: process.cwd(),
+    environmentVariables: context.environmentVariables,
+    application: context.applicationId ? {
+      id: context.applicationId,
+      environmentId: context.applicationEnvironmentId,
+      ...context.applicationConfigurationPath ? { configurationPath: context.applicationConfigurationPath } : {},
+      ...context.applicationConfigurationId ? { configurationId: context.applicationConfigurationId } : {},
+      ...context.applicationManifestPath ? { manifestPath: context.applicationManifestPath } : {}
+    } : undefined,
+    applicationRelease: (args) => tools.app ? tools.app.callback(args) : Promise.resolve({
+      isError: true,
+      content: [{ type: "text", text: "Application release support is unavailable in this CLI context" }]
+    }),
     edgeFunctionDeploy: advancedTools.edge_functions?.callback
   })));
   assign(captureTools((server) => registerGatewayTools(server, http, {
@@ -29337,7 +29539,7 @@ async function main() {
   }
   const globalOptions = parseGlobalOptions(rawArgs);
   const args = globalOptions.args;
-  const contextDirectory = args[0] === "deploy" ? await findDeployConfigRoot(process.cwd()) : process.cwd();
+  const contextDirectory = args[0] === "deploy" ? await findDeployConfigRoot(process.cwd(), globalOptions.environmentName) : process.cwd();
   const context = resolveSupaCloudContext(process.env, contextDirectory, {
     environmentName: globalOptions.environmentName,
     envFile: globalOptions.envFile