@supacloud/cli 0.86.0 → 0.87.0

package/README.md

@@ -2,8 +2,8 @@
 
 Project-scoped CLI for SupaCloud users.
 
-The only command-line executable is `supacloud-cli`. The bare `supacloud` name is reserved
-for the compiled server binary installed at `/usr/local/bin/supacloud`.
+The only command-line executable is `supacloud`. The compiled server binary
+installed at `/usr/local/bin/supacloud` is a separate managed-host installation.
 
 Tool adapters import `@supacloud/cli/tool-runtime` for typed registration and
 schema decoding. This side-effect-free entrypoint does not initialize the CLI.
@@ -14,7 +14,7 @@ are not supported.
 ## Application Starter
 
 ```sh
-supacloud-cli app init --root ./orders --name orders
+supacloud app init --root ./orders --name orders
 cd orders
 bun install
 bun run check
@@ -48,16 +48,16 @@ behavior.
 ### Application delivery
 
 ```sh
-supacloud-cli app plan --root . --format json
-supacloud-cli app build --root .
-supacloud-cli app upload --ref PROJECT --id orders --manifest_path generated/delivery/delivery.manifest.json
-supacloud-cli app configure --ref PROJECT --id orders --environment_id test --configuration_path configuration.json
-supacloud-cli app deploy --ref PROJECT --id orders --environment_id test --release_id RELEASE_SHA256 --configuration_id CONFIG_UUID --activation_id NEW_UUID --expected_activation_id absent
-supacloud-cli app status --ref PROJECT --id orders --environment_id test
-supacloud-cli app logs --ref PROJECT --id orders --environment_id test
-supacloud-cli app reconcile --ref PROJECT --id orders --environment_id test --release_id RELEASE_SHA256 --activation_id ACTIVATION_UUID
-supacloud-cli app rollback --ref PROJECT --id orders --environment_id test --release_id OLD_RELEASE_SHA256 --configuration_id CONFIG_UUID --activation_id NEW_UUID --expected_activation_id CURRENT_UUID
-supacloud-cli app retire --ref PROJECT --id orders --environment_id test --activation_id ACTIVATION_UUID
+supacloud app plan --root . --format json
+supacloud app build --root .
+supacloud app upload --ref PROJECT --id orders --manifest_path generated/delivery/delivery.manifest.json
+supacloud app configure --ref PROJECT --id orders --environment_id test --configuration_path configuration.json
+supacloud app deploy --ref PROJECT --id orders --environment_id test --release_id RELEASE_SHA256 --configuration_id CONFIG_UUID --activation_id NEW_UUID --expected_activation_id absent
+supacloud app status --ref PROJECT --id orders --environment_id test
+supacloud app logs --ref PROJECT --id orders --environment_id test
+supacloud app reconcile --ref PROJECT --id orders --environment_id test --release_id RELEASE_SHA256 --activation_id ACTIVATION_UUID
+supacloud app rollback --ref PROJECT --id orders --environment_id test --release_id OLD_RELEASE_SHA256 --configuration_id CONFIG_UUID --activation_id NEW_UUID --expected_activation_id CURRENT_UUID
+supacloud app retire --ref PROJECT --id orders --environment_id test --activation_id ACTIVATION_UUID
 ```
 
 `plan` and `build` read `delivery` in `supacloud.config.ts`; `--root` is the
@@ -82,12 +82,12 @@ Management API credentials except local plan/build and authoring commands.
 ### Isolated Application Previews
 
 ```sh
-supacloud-cli app preview-plan --env test --id orders --environment_id test --release_id RELEASE_SHA256 --branch_ref preview-orders
-supacloud-cli app preview --env test --id orders --environment_id test --release_id RELEASE_SHA256 --configuration_id CONFIG_UUID --ttl_seconds 3600 --wait --timeout_seconds 300
-supacloud-cli app previews --env test --id orders --environment_id test
-supacloud-cli app preview-status --env test --id orders --environment_id test --preview_id PREVIEW_UUID --wait --timeout_seconds 300
-supacloud-cli app preview-reconcile --env test --id orders --environment_id test --preview_id PREVIEW_UUID
-supacloud-cli app preview-cleanup --env test --id orders --environment_id test --preview_id PREVIEW_UUID
+supacloud app preview-plan --env test --id orders --environment_id test --release_id RELEASE_SHA256 --branch_ref preview-orders
+supacloud app preview --env test --id orders --environment_id test --release_id RELEASE_SHA256 --configuration_id CONFIG_UUID --ttl_seconds 3600 --wait --timeout_seconds 300
+supacloud app previews --env test --id orders --environment_id test
+supacloud app preview-status --env test --id orders --environment_id test --preview_id PREVIEW_UUID --wait --timeout_seconds 300
+supacloud app preview-reconcile --env test --id orders --environment_id test --preview_id PREVIEW_UUID
+supacloud app preview-cleanup --env test --id orders --environment_id test --preview_id PREVIEW_UUID
 ```
 
 The platform owns branch provisioning, queue/Storage namespaces, test Secrets,
@@ -194,32 +194,32 @@ Install:
 
 ```bash
 npm install -g @supacloud/cli
-supacloud-cli status
+supacloud status
 ```
 
 Bun users can run the same package explicitly with Bun, including on Windows,
 without installing Node.js or a separate wrapper:
 
 ```bash
-bunx --bun --package @supacloud/cli supacloud-cli status
+bunx --bun --package @supacloud/cli supacloud status
 ```
 
 One-off execution:
 
 ```bash
-npm exec --package @supacloud/cli -- supacloud-cli status
+npm exec --package @supacloud/cli -- supacloud status
 ```
 
 Install the packaged AI Skill:
 
 ```bash
-supacloud-cli ai show_skill
-supacloud-cli ai install_skill --dry_run
-supacloud-cli ai install_skill
+supacloud ai show_skill
+supacloud ai install_skill --dry_run
+supacloud ai install_skill
 ```
 
-The default destination is `$CODEX_HOME/skills/supacloud-cli` or
-`~/.codex/skills/supacloud-cli`. Use `--target /path/to/skills` for an explicit
+The default destination is `$CODEX_HOME/skills/supacloud` or
+`~/.codex/skills/supacloud`. Use `--target /path/to/skills` for an explicit
 Skill root. Different existing content is preserved unless `--force` is passed;
 forced replacement creates a timestamped adjacent backup first.
 
@@ -241,6 +241,9 @@ SUPACLOUD_ENV=test
 SUPACLOUD_API_URL=https://management.test.example.com
 SUPACLOUD_API_TOKEN=<test-management-api-token>
 SUPACLOUD_PROJECT_REF=test-ref
+SUPACLOUD_APPLICATION_ID=orders
+SUPACLOUD_APPLICATION_ENVIRONMENT_ID=test
+SUPACLOUD_APPLICATION_CONFIGURATION_PATH=deploy/configuration.test.json
 ```
 
 ```dotenv
@@ -249,8 +252,26 @@ SUPACLOUD_ENV=production
 SUPACLOUD_API_URL=https://management.example.com
 SUPACLOUD_API_TOKEN=<production-management-api-token>
 SUPACLOUD_PROJECT_REF=production-ref
+SUPACLOUD_APPLICATION_ID=orders
+SUPACLOUD_APPLICATION_ENVIRONMENT_ID=production
+SUPACLOUD_APPLICATION_CONFIGURATION_PATH=deploy/configuration.production.json
 ```
 
+When `SUPACLOUD_APPLICATION_ID` is present, the top-level deployment command
+uses the application release workflow automatically:
+
+```bash
+supacloud --env test deploy
+supacloud --env production deploy --confirm-production production-ref
+```
+
+Test and production use the same workflow. Production safety is enforced by the
+CLI confirmation gate; immutable releases, configuration revisions, backups,
+readiness, CAS activation, rollback artifacts and uncertain-result
+reconciliation belong to SupaCloud. The application layer only supplies its
+build output and configuration file; it does not implement backup, activation
+or downgrade orchestration.
+
 CLI requests (including `status`) default to `SUPACLOUD_TLS_VERIFY=false`, skipping HTTPS certificate verification so that
 air-gapped installations using private or self-signed certificates work
 without extra configuration. To enable strict certificate verification, set:
@@ -276,9 +297,9 @@ where identity authentication is required.
 Run commands with the selected profile:
 
 ```bash
-supacloud-cli --env test status
-supacloud-cli project get --env test
-supacloud-cli status --env-file ./config/supacloud.staging.env
+supacloud --env test status
+supacloud project get --env test
+supacloud status --env-file ./config/supacloud.staging.env
 ```
 
 Global flags may appear before or after the command. Both `--key value` and
@@ -301,7 +322,7 @@ SUPACLOUD_ENV=test \
 SUPACLOUD_API_URL=https://management.test.example.com \
 SUPACLOUD_API_TOKEN="$CI_SUPACLOUD_API_TOKEN" \
 SUPACLOUD_PROJECT_REF=test-ref \
-supacloud-cli status
+supacloud status
 ```
 
 Project context is resolved from one atomic source: a named profile selected by
@@ -346,17 +367,17 @@ The `frontend` command keeps the existing deployment, Git, and tar.zst
 actions and also exposes the immutable prebuilt release workflow:
 
 ```bash
-supacloud-cli frontend list_releases --ref abc123 --id web
-supacloud-cli frontend get_active_release --ref abc123 --id web
-supacloud-cli frontend get_release --ref abc123 --id web --release_id <sha256>
-supacloud-cli frontend upload_release --ref abc123 --id web --archive_path ./dist.tar.zst
-supacloud-cli frontend activate_release --ref abc123 --id web \
+supacloud frontend list_releases --ref abc123 --id web
+supacloud frontend get_active_release --ref abc123 --id web
+supacloud frontend get_release --ref abc123 --id web --release_id <sha256>
+supacloud frontend upload_release --ref abc123 --id web --archive_path ./dist.tar.zst
+supacloud frontend activate_release --ref abc123 --id web \
   --release_id <sha256> \
   --expected_active_release_id absent \
   --expected_activation_id absent \
   --mutation_id <retry-stable-uuid-v4>
-supacloud-cli frontend rollback --ref abc123 --id web --release_id <retained-sha256>
-supacloud-cli frontend rollback --ref abc123 --id web
+supacloud frontend rollback --ref abc123 --id web --release_id <retained-sha256>
+supacloud frontend rollback --ref abc123 --id web
 ```
 
 `upload_release` hashes and streams an existing regular tar.zst file without
@@ -385,11 +406,11 @@ must not be blindly retried.
 Store a compiler-built HTTP/Worker application as one immutable release:
 
 ```bash
-supacloud-cli applications upload_release --ref abc123 --id reviews \
+supacloud applications upload_release --ref abc123 --id reviews \
   --manifest_path ./generated/delivery/delivery.manifest.json
-supacloud-cli applications list_releases --ref abc123 --id reviews --limit 50
-supacloud-cli applications get_release --ref abc123 --id reviews --release_id <sha256>
-supacloud-cli applications get_runtime --ref abc123 --id reviews --environment_id test
+supacloud applications list_releases --ref abc123 --id reviews --limit 50
+supacloud applications get_release --ref abc123 --id reviews --release_id <sha256>
+supacloud applications get_runtime --ref abc123 --id reviews --environment_id test
 ```
 
 Upload verifies executable objects, transfers their inventory with multipart
@@ -427,10 +448,10 @@ environment. Saving a revision does not allocate ports, start processes, change
 traffic or migrate data:
 
 ```bash
-supacloud-cli applications get_configuration --ref abc123 --id reviews --environment_id test
-supacloud-cli applications put_configuration --ref abc123 --id reviews --environment_id test \
+supacloud applications get_configuration --ref abc123 --id reviews --environment_id test
+supacloud applications put_configuration --ref abc123 --id reviews --environment_id test \
   --configuration_path ./application.test.json
-supacloud-cli applications get_configuration --ref abc123 --id reviews --environment_id test \
+supacloud applications get_configuration --ref abc123 --id reviews --environment_id test \
   --configuration_id <uuid>
 ```
 
@@ -493,12 +514,12 @@ The default Management API instance does not yet enable these endpoints.
 For an explicitly composed test host:
 
 ```bash
-supacloud-cli applications activate_release --ref abc123 --id reviews --environment_id test \
+supacloud applications activate_release --ref abc123 --id reviews --environment_id test \
   --release_id <release-sha256> --configuration_id <configuration-uuid> \
   --activation_id <new-uuid> --expected_activation_id absent
-supacloud-cli applications reconcile_activation --ref abc123 --id reviews --environment_id test \
+supacloud applications reconcile_activation --ref abc123 --id reviews --environment_id test \
   --release_id <release-sha256> --activation_id <same-uuid>
-supacloud-cli applications retire_activation --ref abc123 --id reviews --environment_id test \
+supacloud applications retire_activation --ref abc123 --id reviews --environment_id test \
   --activation_id <stopped-and-unrouted-uuid>
 ```
 
@@ -530,26 +551,26 @@ missing, the platform begins project re-provisioning instead. It does not
 restore a database backup and is never invoked automatically by the CLI.
 
 ```bash
-supacloud-cli project pause --ref abc123
-supacloud-cli release logical_backup_restore --ref abc123 \
+supacloud project pause --ref abc123
+supacloud release logical_backup_restore --ref abc123 \
   --backup_id logical-full_abc123_<backup-id-suffix> \
   --expected_sha256 <64-lowercase-hex> \
   --restore_confirmation RESTORE_PROJECT:abc123:logical-full_abc123_<backup-id-suffix>:<64-lowercase-hex>
-supacloud-cli project restore --ref abc123
+supacloud project restore --ref abc123
 ```
 
 ```bash
-supacloud-cli release logical_backup_list --ref abc123
-supacloud-cli release logical_backup_create --ref abc123
-supacloud-cli release logical_backup_restore --ref abc123 \
+supacloud release logical_backup_list --ref abc123
+supacloud release logical_backup_create --ref abc123
+supacloud release logical_backup_restore --ref abc123 \
   --backup_id logical-full_abc123_<backup-id-suffix> \
   --expected_sha256 <64-lowercase-hex> \
   --restore_confirmation RESTORE_PROJECT:abc123:logical-full_abc123_<backup-id-suffix>:<64-lowercase-hex>
-supacloud-cli release postgrest_status --ref abc123
-supacloud-cli release postgrest_restart --ref abc123
-supacloud-cli release release_canary_fixture_stage_replay --ref abc123 \
+supacloud release postgrest_status --ref abc123
+supacloud release postgrest_restart --ref abc123
+supacloud release release_canary_fixture_stage_replay --ref abc123 \
   --subject <central-subject-uuid> --request_id <stage-request-uuid>
-supacloud-cli release release_canary_fixture_disable_replay --ref abc123 \
+supacloud release release_canary_fixture_disable_replay --ref abc123 \
   --fixture_id <fixture-uuid> --disable_request_id <disable-request-uuid> \
   --issuer <issuer-url> --subject <central-subject-uuid>
 ```
@@ -601,25 +622,25 @@ base commit without manual JSON editing or risk of dirtying non-manifest fields.
 
 ```bash
 # Rebind a single scope manifest to latest git main (or origin/main)
-supacloud-cli release scope_rebind --file supacloud/fa/release-scopes/20260907-intake-p1-production.json
+supacloud release scope_rebind --file supacloud/fa/release-scopes/20260907-intake-p1-production.json
 
 # Rebind multiple files (e.g. production and staging together)
-supacloud-cli release scope_rebind --files "20260907-intake-p1-production.json,20260907-intake-p1-staging.json"
+supacloud release scope_rebind --files "20260907-intake-p1-production.json,20260907-intake-p1-staging.json"
 
 # Rebind all scopes matching a task ID or filename prefix in standard directories
-supacloud-cli release scope_rebind --task 20260907-intake-p1
+supacloud release scope_rebind --task 20260907-intake-p1
 
 # Specify an explicit base commit SHA or git ref
-supacloud-cli release scope_rebind --task 20260907-intake-p1 --base_commit origin/main
+supacloud release scope_rebind --task 20260907-intake-p1 --base_commit origin/main
 
 # Preview changes without modifying files
-supacloud-cli release scope_rebind --task 20260907-intake-p1 --dry_run
+supacloud release scope_rebind --task 20260907-intake-p1 --dry_run
 
 # Inspect scope status, SHA-256 hash, and alignment with git HEAD / origin/main
-supacloud-cli release scope_inspect --file 20260907-intake-p1-production.json
+supacloud release scope_inspect --file 20260907-intake-p1-production.json
 
 # Scaffold a new canonical release scope
-supacloud-cli release scope_create \
+supacloud release scope_create \
   --file supacloud/fa/release-scopes/20260907-intake-p1.json \
   --task FA-INTAKE-P1 \
   --ref abc123 \
@@ -642,7 +663,7 @@ Production writes require an explicit confirmation equal to the selected
 profile's project ref:
 
 ```bash
-supacloud-cli database push_migrations --env prod \
+supacloud database push_migrations --env prod \
   --ref production-ref --dir supabase/migrations \
   --confirm-production production-ref
 ```
@@ -667,44 +688,44 @@ API token or service-role key.
 Examples:
 
 ```bash
-supacloud-cli status
-supacloud-cli project get
-supacloud-cli project logs --log_type database
-supacloud-cli project task_stats
-supacloud-cli project task_detail --task_id task_123
-supacloud-cli queue stats --queue emails
-supacloud-cli queue dlq --queue emails --limit 20
-supacloud-cli task_events inspect_webhook --ref abc123
-supacloud-cli database query --sql "select now()"
-supacloud-cli database query --ref abc123 --file ./queries/vector-search.sql
-supacloud-cli database migration_inventory --ref abc123
-supacloud-cli database lint_migrations --dir supabase/migrations
-supacloud-cli database rebase_migrations --dir supabase/migrations --baseline_file backups/schema.sql --baseline_version 20261008000000 --output_dir supabase/migrations-rebased
-supacloud-cli database push_migrations --ref abc123 --dir supabase/migrations --dry_run
-supacloud-cli supabase migration_new --name add_accounts
-supacloud-cli supabase db_diff --schema public --name add_accounts
-supacloud-cli supabase push --ref abc123 --dir supabase/migrations --dry_run
-supacloud-cli frontend list --ref abc123
-supacloud-cli branch create --name feature-orders --data_mode schema_only
-supacloud-cli branch promotion_plan --branch_ref preview123
-supacloud-cli branch promote --branch_ref preview123 --plan_checksum <sha256>
-supacloud-cli edge_functions get_config --ref abc123 --slug hello
-supacloud-cli edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello --expected-active-version absent --expected-activation-id legacy
-supacloud-cli edge_functions deploy --ref abc123 --slug hello --prebundled-path ./dist/hello.js --expected-sha256 <sha256> --expected-active-version 4 --expected-activation-id <uuid>
-supacloud-cli edge_functions deploy_bundle --ref abc123 --slug hello --files '{"index.ts":"export default { fetch: () => new Response(\"ok\") }"}' --expected-active-version 7 --expected-activation-id <uuid>
-supacloud-cli edge_functions source --ref abc123 --slug hello --version 7 --output ./hello-v7.ts
-supacloud-cli edge_functions activate --ref abc123 --slug hello --version 3 --expected-active-version 8 --expected-activation-id <uuid>
-supacloud-cli edge_functions delete --ref abc123 --slug hello --expected-activation-id <uuid>
-supacloud-cli scheduled_functions list --ref abc123
-supacloud-cli secrets upsert --ref abc123 --from-env API_KEY,WEBHOOK_SECRET
-supacloud-cli storage list_buckets --ref abc123
-supacloud-cli storage get_bucket --ref abc123 --bucket reports
-supacloud-cli storage create_bucket --ref abc123 --bucket reports --public false \
+supacloud status
+supacloud project get
+supacloud project logs --log_type database
+supacloud project task_stats
+supacloud project task_detail --task_id task_123
+supacloud queue stats --queue emails
+supacloud queue dlq --queue emails --limit 20
+supacloud task_events inspect_webhook --ref abc123
+supacloud database query --sql "select now()"
+supacloud database query --ref abc123 --file ./queries/vector-search.sql
+supacloud database migration_inventory --ref abc123
+supacloud database lint_migrations --dir supabase/migrations
+supacloud database rebase_migrations --dir supabase/migrations --baseline_file backups/schema.sql --baseline_version 20261008000000 --output_dir supabase/migrations-rebased
+supacloud database push_migrations --ref abc123 --dir supabase/migrations --dry_run
+supacloud supabase migration_new --name add_accounts
+supacloud supabase db_diff --schema public --name add_accounts
+supacloud supabase push --ref abc123 --dir supabase/migrations --dry_run
+supacloud frontend list --ref abc123
+supacloud branch create --name feature-orders --data_mode schema_only
+supacloud branch promotion_plan --branch_ref preview123
+supacloud branch promote --branch_ref preview123 --plan_checksum <sha256>
+supacloud edge_functions get_config --ref abc123 --slug hello
+supacloud edge_functions deploy --ref abc123 --slug hello --path ./supabase/functions/hello --expected-active-version absent --expected-activation-id legacy
+supacloud edge_functions deploy --ref abc123 --slug hello --prebundled-path ./dist/hello.js --expected-sha256 <sha256> --expected-active-version 4 --expected-activation-id <uuid>
+supacloud edge_functions deploy_bundle --ref abc123 --slug hello --files '{"index.ts":"export default { fetch: () => new Response(\"ok\") }"}' --expected-active-version 7 --expected-activation-id <uuid>
+supacloud edge_functions source --ref abc123 --slug hello --version 7 --output ./hello-v7.ts
+supacloud edge_functions activate --ref abc123 --slug hello --version 3 --expected-active-version 8 --expected-activation-id <uuid>
+supacloud edge_functions delete --ref abc123 --slug hello --expected-activation-id <uuid>
+supacloud scheduled_functions list --ref abc123
+supacloud secrets upsert --ref abc123 --from-env API_KEY,WEBHOOK_SECRET
+supacloud storage list_buckets --ref abc123
+supacloud storage get_bucket --ref abc123 --bucket reports
+supacloud storage create_bucket --ref abc123 --bucket reports --public false \
   --file_size_limit 10485760 --allowed_mime_types "application/pdf,image/png"
-supacloud-cli storage update_bucket --ref abc123 --bucket reports \
+supacloud storage update_bucket --ref abc123 --bucket reports \
   --expected_revision <revision-from-get_bucket> \
   --allowed_mime_types '["application/pdf"]'
-supacloud-cli storage delete_bucket --ref abc123 --bucket reports \
+supacloud storage delete_bucket --ref abc123 --bucket reports \
   --expected_revision <revision-from-get_bucket> --require_empty true
 ```
 
@@ -720,7 +741,7 @@ human-readable behavior.
 with the separate read-only `/database/migrations/inventory` endpoint:
 
 ```bash
-supacloud-cli database delivery_migration_plan --ref abc123 \
+supacloud database delivery_migration_plan --ref abc123 \
   --delivery_manifest /archive/delivery/delivery.manifest.json --delivery_target api
 ```
 
@@ -878,12 +899,12 @@ activation targets still require a positive version.
 Scheduled Function lifecycle operations are also project-scoped:
 
 ```bash
-supacloud-cli scheduled_functions create --ref abc123 --name nightly \
+supacloud scheduled_functions create --ref abc123 --name nightly \
   --slug cleanup --cron "0 2 * * *" --method POST
-supacloud-cli scheduled_functions get --ref abc123 --schedule_id <id>
-supacloud-cli scheduled_functions update --ref abc123 --schedule_id <id> \
+supacloud scheduled_functions get --ref abc123 --schedule_id <id>
+supacloud scheduled_functions update --ref abc123 --schedule_id <id> \
   --expected_updated_at <updated_at-from-list> --cron "0 3 * * *"
-supacloud-cli scheduled_functions delete --ref abc123 --schedule_id <id> \
+supacloud scheduled_functions delete --ref abc123 --schedule_id <id> \
   --expected_updated_at <updated_at-from-list>
 ```
 
@@ -923,20 +944,20 @@ break-glass API mode and is intentionally not exposed by this project CLI.
 ## SupaCloud Lite CLI adapter
 
 Lite can be used from its standalone `supacloud-lite` CLI and from the main
-`supacloud-cli` through the local-only `lite` module. The adapter never calls
+`supacloud` through the local-only `lite` module. The adapter never calls
 the Management API, never invokes the official Supabase CLI, and never treats a
 PGlite data directory as a Postgres DSN.
 
 ```bash
-supacloud-cli lite migrate --project_dir .
-supacloud-cli lite status --project_dir .
-supacloud-cli lite db_diff --project_dir . --file add_accounts
-supacloud-cli lite db_pull --project_dir . --file remote_schema
-supacloud-cli lite db_pull --project_dir . --file reviewed_schema --baseline
-supacloud-cli lite gen_types --project_dir . --output src/database.types.ts
-supacloud-cli lite snapshot_create --project_dir . --output backups/lite.tar.gz
-supacloud-cli lite doctor --project_dir . --json
-supacloud-cli lite start --project_dir . --port 54321
+supacloud lite migrate --project_dir .
+supacloud lite status --project_dir .
+supacloud lite db_diff --project_dir . --file add_accounts
+supacloud lite db_pull --project_dir . --file remote_schema
+supacloud lite db_pull --project_dir . --file reviewed_schema --baseline
+supacloud lite gen_types --project_dir . --output src/database.types.ts
+supacloud lite snapshot_create --project_dir . --output backups/lite.tar.gz
+supacloud lite doctor --project_dir . --json
+supacloud lite start --project_dir . --port 54321
 ```
 
 The adapter resolves the executable in this order:
@@ -964,29 +985,29 @@ open-source Supabase CLI. It is not a fork. Local authoring commands work withou
 SupaCloud credentials:
 
 ```bash
-supacloud-cli supabase version
-supacloud-cli supabase init --workdir .
-supacloud-cli supabase migration_new --name add_accounts
-supacloud-cli supabase db_diff --schema public --name add_accounts
-supacloud-cli supabase db_reset --no_seed
+supacloud supabase version
+supacloud supabase init --workdir .
+supacloud supabase migration_new --name add_accounts
+supacloud supabase db_diff --schema public --name add_accounts
+supacloud supabase db_reset --no_seed
 ```
 
 Remote inspection and backup commands require an explicit, percent-encoded
 Postgres DSN:
 
 ```bash
-supacloud-cli supabase db_pull --db_url "$SUPACLOUD_DB_URL" --declarative
-supacloud-cli supabase migration_list --db_url "$SUPACLOUD_DB_URL"
-supacloud-cli supabase db_dump --db_url "$SUPACLOUD_DB_URL" --file backups/schema.sql
-supacloud-cli supabase gen_types --db_url "$SUPACLOUD_DB_URL" --schema public --file src/database.types.ts
+supacloud supabase db_pull --db_url "$SUPACLOUD_DB_URL" --declarative
+supacloud supabase migration_list --db_url "$SUPACLOUD_DB_URL"
+supacloud supabase db_dump --db_url "$SUPACLOUD_DB_URL" --file backups/schema.sql
+supacloud supabase gen_types --db_url "$SUPACLOUD_DB_URL" --schema public --file src/database.types.ts
 ```
 
 Remote migration application intentionally stays on SupaCloud's existing
 project-authenticated API:
 
 ```bash
-supacloud-cli supabase push --ref abc123 --dir supabase/migrations --dry_run
-supacloud-cli supabase push --ref abc123 --dir supabase/migrations
+supacloud supabase push --ref abc123 --dir supabase/migrations --dry_run
+supacloud supabase push --ref abc123 --dir supabase/migrations
 ```
 
 `push` uses only `SUPACLOUD_API_TOKEN` for the SupaCloud Management API. That
@@ -1003,17 +1024,17 @@ the adapter does not install a new CLI or replace an existing schema authority.
 `init` preserves existing configuration and inherits the installed CLI's defaults.
 
 ```bash
-supacloud-cli supabase db_schema_declarative_generate --db_url "$SUPACLOUD_DB_URL"
-supacloud-cli supabase db_schema_declarative_sync --name add_accounts --strict_coverage
-supacloud-cli supabase db_diff --diff_engine pg-delta --name add_accounts
-supacloud-cli supabase config_pull --ref upstream-project
-supacloud-cli supabase config_pull --ref upstream-project --dry_run=false --yes
-supacloud-cli supabase stack_start --workdir .
-supacloud-cli supabase stack_status --workdir .
-SUPACLOUD_ENABLE_NATIVE_STACK=1 supacloud-cli supabase stack_prepare --workdir . --runtime native
-SUPACLOUD_ENABLE_NATIVE_STACK=1 supacloud-cli supabase stack_start --workdir . --runtime native --preparation on-demand
-supacloud-cli supabase stack_stop --workdir .
-supacloud-cli supabase stack_destroy --workdir . --confirm_destroy --yes
+supacloud supabase db_schema_declarative_generate --db_url "$SUPACLOUD_DB_URL"
+supacloud supabase db_schema_declarative_sync --name add_accounts --strict_coverage
+supacloud supabase db_diff --diff_engine pg-delta --name add_accounts
+supacloud supabase config_pull --ref upstream-project
+supacloud supabase config_pull --ref upstream-project --dry_run=false --yes
+supacloud supabase stack_start --workdir .
+supacloud supabase stack_status --workdir .
+SUPACLOUD_ENABLE_NATIVE_STACK=1 supacloud supabase stack_prepare --workdir . --runtime native
+SUPACLOUD_ENABLE_NATIVE_STACK=1 supacloud supabase stack_start --workdir . --runtime native --preparation on-demand
+supacloud supabase stack_stop --workdir .
+supacloud supabase stack_destroy --workdir . --confirm_destroy --yes
 ```
 
 Declarative sync generates without applying unless `--apply` is explicit.
@@ -1051,7 +1072,7 @@ If the live database already contains reviewed historical changes, first pull,
 back up, and prove schema equivalence. Then preview the controlled tracking sync:
 
 ```bash
-supacloud-cli database baseline_migrations --ref abc123 --dir supabase/migrations --dry_run
+supacloud database baseline_migrations --ref abc123 --dir supabase/migrations --dry_run
 ```
 
 Only after explicit approval, rerun without `--dry_run`. This records migration
@@ -1079,9 +1100,9 @@ Transaction boundary: SupaCloud supports transaction blocks inside one SQL reque
 Auth configuration commands accept a JSON object from the CLI:
 
 ```bash
-supacloud-cli auth update_settings --ref abc123 \
+supacloud auth update_settings --ref abc123 \
   --config '{"disable_signup":true,"enable_signup":false}'
-supacloud-cli auth update_config --ref abc123 \
+supacloud auth update_config --ref abc123 \
   --config '{"third_party_auth":{"enabled":true}}'
 ```
 
@@ -1156,14 +1177,14 @@ Gateway / Caddy commands (require admin privileges; config is injected via the C
 - `gateway verify_custom_hostname` — verify a custom hostname
 
 ```bash
-supacloud-cli gateway routes --ref abc123
-supacloud-cli gateway upsert_route --ref abc123 --route_id webhook \
+supacloud gateway routes --ref abc123
+supacloud gateway upsert_route --ref abc123 --route_id webhook \
   --hosts "api.example.com" --paths "/webhook/*" --upstream 10.0.0.5:8080
-supacloud-cli gateway upsert_route --ref abc123 --route_id canonical-https \
+supacloud gateway upsert_route --ref abc123 --route_id canonical-https \
   --hosts "www.example.com" --paths "/*" --protocol http \
   --redirect_to 'https://www.example.com{http.request.uri}' --redirect_status 308
-supacloud-cli gateway config --ref abc123 --rate_limit_tier pro
-supacloud-cli gateway rebuild --ref abc123 --clean
+supacloud gateway config --ref abc123 --rate_limit_tier pro
+supacloud gateway rebuild --ref abc123 --clean
 ```
 
 For server installation, SSH diagnostics, and tenant administration, use `@supacloud/admin`.

package/dist/index.js

@@ -8753,9 +8753,9 @@ function outcomeUnknownGuidance(text) {
   const safeScope = typeof ref === "string" && /^[a-z0-9-]{1,20}$/.test(ref) && typeof id === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(id) && typeof environment === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(environment);
   let command;
   if (safeScope && (data.operation === "applications.promote_application" || data.operation === "applications.reconcile_promotion") && typeof data.mutation_id === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(data.mutation_id)) {
-    command = `supacloud-cli app promote-status --ref ${ref} --id ${id} --environment_id ${environment} --mutation_id ${data.mutation_id}`;
+    command = `supacloud app promote-status --ref ${ref} --id ${id} --environment_id ${environment} --mutation_id ${data.mutation_id}`;
   } else if (safeScope && (data.operation === "applications.create_preview" || data.operation === "applications.cleanup_preview")) {
-    command = `supacloud-cli app preview-list --ref ${ref} --id ${id} --environment_id ${environment}`;
+    command = `supacloud app preview-list --ref ${ref} --id ${id} --environment_id ${environment}`;
   }
   return "OUTCOME_UNKNOWN：操作结果无法确认，服务端可能已经完成操作，但客户端未收到可验证的最终结果。" + "请先查询当前状态或操作回执，再决定是否重试；不要直接重复提交。" + (command ? `
 保持原 --env/--env-file 选择，先查询：${command}` : "");
@@ -8978,7 +8978,12 @@ var CORE_CONTEXT_KEYS = [
   "SUPACLOUD_API_TOKEN",
   "SUPACLOUD_PROJECT_REF",
   "X_PROJECT_REF",
-  "SUPACLOUD_HOST"
+  "SUPACLOUD_HOST",
+  "SUPACLOUD_APPLICATION_ID",
+  "SUPACLOUD_APPLICATION_ENVIRONMENT_ID",
+  "SUPACLOUD_APPLICATION_CONFIGURATION_PATH",
+  "SUPACLOUD_APPLICATION_CONFIGURATION_ID",
+  "SUPACLOUD_APPLICATION_MANIFEST_PATH"
 ];
 function unquotedEnvValue(rawValue) {
   const value = rawValue.trim();
@@ -9145,6 +9150,11 @@ function resolveSupaCloudContext(env = process.env, cwd = process.cwd(), selecti
     source: source.kind,
     sourcePath: source.path,
     environmentVariables: source.values,
+    applicationId: source.values.SUPACLOUD_APPLICATION_ID?.trim() || "",
+    applicationEnvironmentId: source.values.SUPACLOUD_APPLICATION_ENVIRONMENT_ID?.trim() || source.environment,
+    applicationConfigurationPath: source.values.SUPACLOUD_APPLICATION_CONFIGURATION_PATH?.trim() || "",
+    applicationConfigurationId: source.values.SUPACLOUD_APPLICATION_CONFIGURATION_ID?.trim() || "",
+    applicationManifestPath: source.values.SUPACLOUD_APPLICATION_MANIFEST_PATH?.trim() || "",
     insecureTls
   };
 }
@@ -20792,7 +20802,7 @@ import {
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname4, join as join8, relative as relative4, resolve as resolve11, sep as sep3 } from "node:path";
 import { fileURLToPath } from "node:url";
-var SKILL_NAME = "supacloud-cli";
+var SKILL_NAME = "supacloud";
 function regularFiles(rootDirectory, currentDirectory = rootDirectory) {
   const files = [];
   for (const directoryEntry of readdirSync4(currentDirectory, { withFileTypes: true })) {
@@ -20830,7 +20840,7 @@ function availableBackupDirectory(destinationDirectory, now) {
 }
 function stagedSkill(sourceDirectory, targetRoot) {
   mkdirSync3(targetRoot, { recursive: true });
-  const stagingRoot = mkdtempSync2(join8(targetRoot, ".supacloud-cli-install-"));
+  const stagingRoot = mkdtempSync2(join8(targetRoot, ".supacloud-install-"));
   const stagingSkill = join8(stagingRoot, SKILL_NAME);
   try {
     cpSync(sourceDirectory, stagingSkill, { recursive: true, errorOnExist: true });
@@ -21097,10 +21107,10 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.43.0"
+      version: "0.44.0"
     },
     app: {
-      version: "0.25.0",
+      version: "0.26.0",
       dependencies: {
         rxjs: "7.8.2"
       }
@@ -21883,8 +21893,8 @@ The compiler discovers this declaration; no runtime container lookup is needed.
 With the matching candidate/released CLI installed:
 
 \`\`\`sh
-supacloud-cli app generate --kind resource --name inventory --register-in src/app.module.ts --dry-run --format json
-supacloud-cli app generate --kind resource --name inventory --register-in src/app.module.ts
+supacloud app generate --kind resource --name inventory --register-in src/app.module.ts --dry-run --format json
+supacloud app generate --kind resource --name inventory --register-in src/app.module.ts
 bun run check
 bun run inspect
 \`\`\`
@@ -26558,9 +26568,9 @@ function buildDatabaseAiContext(modules, root, moduleName, target) {
       ]
     },
     verification: [
-      "supacloud-cli db lint --module_file db/modules.ts",
-      "supacloud-cli db explain --target <object>",
-      'supacloud-cli db module_check --module_file db/modules.ts --database_url "$DATABASE_URL"'
+      "supacloud db lint --module_file db/modules.ts",
+      "supacloud db explain --target <object>",
+      'supacloud db module_check --module_file db/modules.ts --database_url "$DATABASE_URL"'
     ]
   };
 }
@@ -27768,7 +27778,7 @@ function registerReleaseTools(server, http, options = {}) {
         content: [
           {
             type: "text",
-            text: "⚠️ This command requires Management API context. Run `supacloud-cli status` to inspect current detection."
+            text: "⚠️ This command requires Management API context. Run `supacloud status` to inspect current detection."
           }
         ]
       };
@@ -27990,11 +28000,13 @@ async function readJson(path) {
     throw new Error(`Invalid JSON file ${path}: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
-async function findDeployConfigRoot(startDirectory) {
+async function findDeployConfigRoot(startDirectory, environmentName) {
   let directory = resolve22(startDirectory);
   while (true) {
-    if (await pathExists(join17(directory, "supacloud.json")))
+    const environmentFile = environmentName ? `.env.supacloud.${environmentName}` : null;
+    if (await pathExists(join17(directory, "supacloud.json")) || await pathExists(join17(directory, "supacloud.config.ts")) || environmentFile !== null && await pathExists(join17(directory, environmentFile))) {
       return directory;
+    }
     const parent = dirname11(directory);
     if (parent === directory)
       return resolve22(startDirectory);
@@ -28340,6 +28352,42 @@ function registerDeployTools(server, http, options = {}) {
     if (!projectRef)
       throw new Error("A linked project ref is required. Set SUPACLOUD_PROJECT_REF or pass --ref");
     const configRoot = await findDeployConfigRoot(invocationDirectory);
+    if (options.application?.id) {
+      if (!options.applicationRelease) {
+        throw new Error("Application release support is unavailable in this CLI context");
+      }
+      if (args.target || args.build_command || args.output_dir) {
+        throw new Error("Application profile deploy does not accept frontend target, build command, or output directory flags");
+      }
+      if (args.dry_run === true || args.plan === true || args.diff === true) {
+        throw new Error("Application profile deploy does not support dry_run, plan, or diff; use app deploy-plan for a read-only plan");
+      }
+      const environmentId = options.application.environmentId.trim();
+      if (!environmentId) {
+        throw new Error("Application profile requires SUPACLOUD_APPLICATION_ENVIRONMENT_ID or SUPACLOUD_ENV");
+      }
+      const configurationPath = options.application.configurationPath?.trim();
+      const configurationId = options.application.configurationId?.trim();
+      if (!configurationPath && !configurationId) {
+        throw new Error("Application profile requires SUPACLOUD_APPLICATION_CONFIGURATION_PATH or SUPACLOUD_APPLICATION_CONFIGURATION_ID");
+      }
+      if (configurationPath && configurationId) {
+        throw new Error("Application profile must set only one of SUPACLOUD_APPLICATION_CONFIGURATION_PATH or SUPACLOUD_APPLICATION_CONFIGURATION_ID");
+      }
+      const result = await options.applicationRelease({
+        action: "release",
+        ref: projectRef,
+        id: options.application.id,
+        environment_id: environmentId,
+        root: configRoot,
+        ...configurationPath ? { configuration_path: configurationPath } : {},
+        ...configurationId ? { configuration_id: configurationId } : {},
+        ...options.application.manifestPath ? { manifest_path: options.application.manifestPath } : {},
+        ...args.skip_build === true ? { skip_build: true } : {},
+        ...args.json === true ? { format: "json", json: true } : {}
+      });
+      return result;
+    }
     const config = await readDeployConfig(configRoot);
     const target = selectTarget(configRoot, invocationDirectory, config, String(args.target || "").trim() || undefined);
     const projectDirectory = target.root;
@@ -28842,7 +28890,7 @@ function registerRemoteDevTools(server, options = {}) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.86.0",
+  version: "0.87.0",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -28860,7 +28908,7 @@ var package_default = {
     }
   },
   bin: {
-    "supacloud-cli": "dist/index.js"
+    supacloud: "dist/index.js"
   },
   files: [
     "NOTICE",
@@ -28894,7 +28942,7 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.43.0",
+    "@supacloud/compiler": "^0.44.0",
     "@supacloud/delivery": "0.14.0",
     "@supacloud/db": "0.16.0",
     typebox: "1.3.34"
@@ -28914,7 +28962,7 @@ var package_default = {
 };
 
 // src/index.ts
-var commandName = "supacloud-cli";
+var commandName = "supacloud";
 var preferredCommand = commandName;
 var projectActionSchema = stringEnum([
   "get",
@@ -29069,7 +29117,7 @@ function printHelp(context) {
   const autoLink = context.inferredSupabaseUrl ? `Project context: ${context.inferredSupabaseUrl} (${context.source})` : "Project context: not detected";
   console.error(`
 ╔═══════════════════════════════════════════════════════════╗
-║  supacloud-cli                                           ║
+║  supacloud                                           ║
 ║  Project CLI for SupaCloud users                         ║
 ╚═══════════════════════════════════════════════════════════╝
 
@@ -29111,6 +29159,8 @@ EXAMPLES
 
   ${preferredCommand} status
   ${preferredCommand} deploy
+  ${preferredCommand} --env test deploy
+  ${preferredCommand} --env production deploy --confirm-production <project-ref>
   ${preferredCommand} deploy --target web
   ${preferredCommand} deploy --target api
   ${preferredCommand} dev sync --env test --target functions --function api
@@ -29377,7 +29427,7 @@ function createCliTools(context, confirmProduction) {
               "Provide one of these sources:",
               "",
               "  1. Named environment file",
-              "     supacloud-cli --env test status",
+              "     supacloud --env test status",
               "",
               "  2. Explicit environment variables",
               "     SUPACLOUD_API_URL=https://your-project.example.com",
@@ -29455,6 +29505,17 @@ function createCliTools(context, confirmProduction) {
     projectRef: context.projectRef || undefined,
     cwd: process.cwd(),
     environmentVariables: context.environmentVariables,
+    application: context.applicationId ? {
+      id: context.applicationId,
+      environmentId: context.applicationEnvironmentId,
+      ...context.applicationConfigurationPath ? { configurationPath: context.applicationConfigurationPath } : {},
+      ...context.applicationConfigurationId ? { configurationId: context.applicationConfigurationId } : {},
+      ...context.applicationManifestPath ? { manifestPath: context.applicationManifestPath } : {}
+    } : undefined,
+    applicationRelease: (args) => tools.app ? tools.app.callback(args) : Promise.resolve({
+      isError: true,
+      content: [{ type: "text", text: "Application release support is unavailable in this CLI context" }]
+    }),
     edgeFunctionDeploy: advancedTools.edge_functions?.callback
   })));
   assign(captureTools((server) => registerGatewayTools(server, http, {
@@ -29478,7 +29539,7 @@ async function main() {
   }
   const globalOptions = parseGlobalOptions(rawArgs);
   const args = globalOptions.args;
-  const contextDirectory = args[0] === "deploy" ? await findDeployConfigRoot(process.cwd()) : process.cwd();
+  const contextDirectory = args[0] === "deploy" ? await findDeployConfigRoot(process.cwd(), globalOptions.environmentName) : process.cwd();
   const context = resolveSupaCloudContext(process.env, contextDirectory, {
     environmentName: globalOptions.environmentName,
     envFile: globalOptions.envFile

package/dist/shared/context.d.ts

@@ -22,6 +22,11 @@ export interface ResolvedContext {
     source: ContextSourceKind;
     sourcePath: string | null;
     environmentVariables: Readonly<Record<string, string>>;
+    applicationId: string;
+    applicationEnvironmentId: string;
+    applicationConfigurationPath: string;
+    applicationConfigurationId: string;
+    applicationManifestPath: string;
     insecureTls: boolean;
 }
 export declare function resolveSupaCloudContext(env?: NodeJS.ProcessEnv, cwd?: string, selection?: ContextSelection): ResolvedContext;

package/dist/shared/tools/ai-tools.d.ts

@@ -1,5 +1,5 @@
 import { type ToolServer } from "../tool-server";
-declare const SKILL_NAME = "supacloud-cli";
+declare const SKILL_NAME = "supacloud";
 type InstallMode = "dry-run" | "write";
 type ConflictPolicy = "reject" | "replace";
 type InstallAction = "create" | "replace" | "none";

package/dist/shared/tools/deploy-tools.d.ts

@@ -6,6 +6,14 @@ interface DeployToolOptions {
     environment?: string | null;
     cwd?: string;
     environmentVariables?: Readonly<Record<string, string>>;
+    application?: {
+        id: string;
+        environmentId: string;
+        configurationPath?: string;
+        configurationId?: string;
+        manifestPath?: string;
+    };
+    applicationRelease?: (args: Record<string, unknown>) => Promise<ToolResponse>;
     edgeFunctionDeploy?: (args: Record<string, unknown>) => Promise<ToolResponse>;
 }
 interface ToolResponse {
@@ -28,7 +36,7 @@ export declare const deployToolSchema: {
     diff: Type.TOptional<Type.TBoolean>;
     json: Type.TOptional<Type.TBoolean>;
 };
-export declare function findDeployConfigRoot(startDirectory: string): Promise<string>;
+export declare function findDeployConfigRoot(startDirectory: string, environmentName?: string): Promise<string>;
 export declare function createBuildEnvironment(names: string[] | undefined, environmentVariables: Readonly<Record<string, string>> | undefined): {
     env: NodeJS.ProcessEnv;
     names: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.86.0",
+  "version": "0.87.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",
@@ -18,7 +18,7 @@
     }
   },
   "bin": {
-    "supacloud-cli": "dist/index.js"
+    "supacloud": "dist/index.js"
   },
   "files": [
     "NOTICE",
@@ -52,7 +52,7 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@supacloud/compiler": "^0.43.0",
+    "@supacloud/compiler": "^0.44.0",
     "@supacloud/delivery": "0.14.0",
     "@supacloud/db": "0.16.0",
     "typebox": "1.3.34"

package/skills/{supacloud-cli → supacloud}/SKILL.md

@@ -1,11 +1,11 @@
 ---
-name: supacloud-cli
-description: Use when operating, implementing, diagnosing, deploying, or documenting a SupaCloud project through supacloud-cli, especially project endpoint discovery, database schema, functions/RPC, triggers, RLS, indexes, grants, extensions, migrations, backups, auth, storage, Edge Functions, frontend, queues, task events, diagnostics, or gateway work. Also use when an AI might otherwise call SQL, psql, a database API, or the Management API directly.
+name: supacloud
+description: Use when operating, implementing, diagnosing, deploying, or documenting a SupaCloud project through supacloud, especially project endpoint discovery, database schema, functions/RPC, triggers, RLS, indexes, grants, extensions, migrations, backups, auth, storage, Edge Functions, frontend, queues, task events, diagnostics, or gateway work. Also use when an AI might otherwise call SQL, psql, a database API, or the Management API directly.
 ---
 
 # SupaCloud CLI
 
-Use `supacloud-cli` as the project-level control surface and keep durable changes reproducible from version-controlled files. Use `supacloud-admin` only for server/platform operations.
+Use `supacloud` as the project-level control surface and keep durable changes reproducible from version-controlled files. Use `supacloud-admin` only for server/platform operations.
 
 ## Non-negotiable rules
 
@@ -13,7 +13,7 @@ Use `supacloud-cli` as the project-level control surface and keep durable change
 
    ```bash
    git status --short --branch
-   supacloud-cli status
+   supacloud status
    ```
 
    A missing remote project context does not block local `migration_new`, `db_diff`, or `db_reset`; it blocks remote inspection/apply until context is supplied.
@@ -24,7 +24,7 @@ Use `supacloud-cli` as the project-level control surface and keep durable change
 5. Run a remote migration dry-run before apply. Production apply requires explicit user approval in the current task.
 6. Do not edit `supabase_migrations.schema_migrations` through ordinary SQL. Migration history is an application ledger, not a schema backup or source of truth. For a proven-equivalent historical baseline, use the controlled `database baseline_migrations` action with dry-run and explicit approval.
 7. Service-role credentials authenticate the SupaCloud Management API. Never reinterpret them as PostgreSQL passwords or forward them to the official Supabase CLI.
-8. Read project domains through `supacloud-cli project endpoints`. Do not infer API, Auth, or Studio origins by concatenating project refs and base domains. The projection reports configuration, not DNS/certificate/runtime readiness.
+8. Read project domains through `supacloud project endpoints`. Do not infer API, Auth, or Studio origins by concatenating project refs and base domains. The projection reports configuration, not DNS/certificate/runtime readiness.
 9. Cross-project enumeration is an Admin boundary. Use `supacloud-admin project list` or `supacloud-admin project list_endpoints`; do not attempt to widen project credentials.
 
 ## Workflow
@@ -34,8 +34,8 @@ Use `supacloud-cli` as the project-level control surface and keep durable change
 3. For AI-assisted database changes, first request bounded context:
 
    ```bash
-   supacloud-cli db context --module_file db/modules.ts --module <module>
-   supacloud-cli db context --module_file db/modules.ts --target <object>
+   supacloud db context --module_file db/modules.ts --module <module>
+   supacloud db context --module_file db/modules.ts --target <object>
    ```
 
    Use the returned source/test paths and ownership boundary; do not scan or
@@ -52,8 +52,8 @@ Use `supacloud-cli` as the project-level control surface and keep durable change
 For the selected project:
 
 ```bash
-supacloud-cli status
-supacloud-cli project endpoints
+supacloud status
+supacloud project endpoints
 ```
 
 The fixed projection contains credential-free API/Auth/Studio origins, hosts,
@@ -66,18 +66,18 @@ ready. Project-wide or fleet-wide inventories belong to `supacloud-admin`.
 For a new database change:
 
 ```bash
-supacloud-cli supabase migration_new --name add_accounts
+supacloud supabase migration_new --name add_accounts
 # Edit the generated SQL migration.
-supacloud-cli supabase db_reset --no_seed
-supacloud-cli supabase push --ref <project-ref> --dir supabase/migrations --dry_run
+supacloud supabase db_reset --no_seed
+supacloud supabase push --ref <project-ref> --dir supabase/migrations --dry_run
 # Apply only after explicit approval.
-supacloud-cli supabase push --ref <project-ref> --dir supabase/migrations
+supacloud supabase push --ref <project-ref> --dir supabase/migrations
 ```
 
 Use `db_diff` as an authoring aid, not as permission to bypass review:
 
 ```bash
-supacloud-cli supabase db_diff --schema public --name reconcile_public_schema
+supacloud supabase db_diff --schema public --name reconcile_public_schema
 ```
 
 For existing declarative SQL projects, `supabase db_schema_declarative_sync`
@@ -91,7 +91,7 @@ an existing Docker workflow. Lite drift pull writes drafts by default; only use
 For a database that was previously changed directly, stop further direct writes and follow the reconciliation workflow in [references/database-workflow.md](references/database-workflow.md). Do not push guessed historical migrations against a live database. After schema equivalence is proven, preview and record the baseline through:
 
 ```bash
-supacloud-cli database baseline_migrations \
+supacloud database baseline_migrations \
   --ref <project-ref> \
   --dir supabase/migrations \
   --dry_run
@@ -99,9 +99,9 @@ supacloud-cli database baseline_migrations \
 
 ## CLI boundaries
 
-- `supacloud-cli`: selected-project status and endpoint projection, database, migrations, auth, storage, Edge Functions, frontend, queues, task events, diagnostics, and project gateway configuration.
+- `supacloud`: selected-project status and endpoint projection, database, migrations, auth, storage, Edge Functions, frontend, queues, task events, diagnostics, and project gateway configuration.
 - `supacloud-admin`: installation, upgrades, SSH diagnostics, platform-wide project/endpoint inventory, project lifecycle, tenant runtime, and server operations.
-- Official `supabase` CLI: invoked only through the allowlisted `supacloud-cli supabase` adapter for supported local authoring or explicit-DSN inspection commands.
+- Official `supabase` CLI: invoked only through the allowlisted `supacloud supabase` adapter for supported local authoring or explicit-DSN inspection commands.
 - Direct HTTP/SQL: read-only diagnosis or an explicitly approved break-glass path; never the default implementation path.
 
 ## Completion evidence

package/skills/supacloud/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "SupaCloud CLI"
+  short_description: "安全使用 SupaCloud CLI 与数据库迁移"
+  default_prompt: "Use $supacloud to manage this SupaCloud project through migrations and safe CLI workflows."

package/skills/{supacloud-cli → supacloud}/references/command-map.md

@@ -6,8 +6,8 @@ Load this reference when selecting a command surface or when a user asks an AI t
 
 | Intent | Use | Guardrail |
 | --- | --- | --- |
-| Inspect current project binding | `supacloud-cli status` | Read-only; run first |
-| Inspect selected project API/Auth/Studio origins | `supacloud-cli project endpoints` | Uses the Management API's authoritative projection; do not reconstruct domains locally |
+| Inspect current project binding | `supacloud status` | Read-only; run first |
+| Inspect selected project API/Auth/Studio origins | `supacloud project endpoints` | Uses the Management API's authoritative projection; do not reconstruct domains locally |
 | Enumerate projects or endpoint projections | `supacloud-admin project list` / `project list_endpoints` | Platform-wide read; never promote a project credential to Admin authority |
 | Inspect project health/logs/tasks | `project`, `queue`, `task_events`, `diagnostics` | Prefer bounded reads |
 | Read database rows or metadata | `database query` and database inspection actions | `SELECT`/read-only by default |
@@ -57,11 +57,11 @@ until a project-scoped context is resolved.
 ## Safe inspection pattern
 
 ```bash
-supacloud-cli status
-supacloud-cli project get
-supacloud-cli project endpoints
-supacloud-cli project health
-supacloud-cli supabase migration_list --db_url "$SUPACLOUD_DB_URL"
+supacloud status
+supacloud project get
+supacloud project endpoints
+supacloud project health
+supacloud supabase migration_list --db_url "$SUPACLOUD_DB_URL"
 ```
 
 The endpoint projection returns bounded, credential-free API/Auth/Studio origins,

package/skills/{supacloud-cli → supacloud}/references/database-workflow.md

@@ -8,7 +8,7 @@ Migration files are the durable source of truth. `supabase_migrations.schema_mig
 2. Create a migration:
 
    ```bash
-   supacloud-cli supabase migration_new --name <intent>
+   supacloud supabase migration_new --name <intent>
    ```
 
 3. Put tables, views, functions/RPC, triggers, RLS, indexes, grants, extensions, and required reference data in the generated SQL file.
@@ -21,13 +21,13 @@ Migration files are the durable source of truth. `supabase_migrations.schema_mig
 5. Rebuild locally and run application tests:
 
    ```bash
-   supacloud-cli supabase db_reset --no_seed
+   supacloud supabase db_reset --no_seed
    ```
 
 6. Preview remote application:
 
    ```bash
-   supacloud-cli supabase push --ref <project-ref> --dir supabase/migrations --dry_run
+   supacloud supabase push --ref <project-ref> --dir supabase/migrations --dry_run
    ```
 
 7. After explicit environment approval, apply and read back migration history.
@@ -38,7 +38,7 @@ Preserve the repository's existing schema authority. In a project already using
 declarative SQL, edit those files and run:
 
 ```bash
-supacloud-cli supabase db_schema_declarative_sync --name <intent> --strict_coverage
+supacloud supabase db_schema_declarative_sync --name <intent> --strict_coverage
 ```
 
 The adapter defaults to no-apply. Review the generated migration, then use the
@@ -64,7 +64,7 @@ Do not fabricate old migration files and immediately push them. Reconcile delibe
 3. Create a schema-only backup before changing tracking or schema:
 
    ```bash
-   supacloud-cli supabase db_dump \
+   supacloud supabase db_dump \
      --db_url "$SUPACLOUD_DB_URL" \
      --file backups/pre-reconcile-schema.sql
    ```
@@ -72,7 +72,7 @@ Do not fabricate old migration files and immediately push them. Reconcile delibe
 4. In an isolated branch/worktree, pull the actual remote schema:
 
    ```bash
-   supacloud-cli supabase db_pull \
+   supacloud supabase db_pull \
      --db_url "$SUPACLOUD_DB_URL" \
      --declarative \
      --name remote_baseline
@@ -86,7 +86,7 @@ Do not fabricate old migration files and immediately push them. Reconcile delibe
 8. Only after equivalence is proven, preview the controlled baseline action:
 
    ```bash
-   supacloud-cli database baseline_migrations \
+   supacloud database baseline_migrations \
      --ref <project-ref> \
      --dir supabase/migrations \
      --dry_run

package/skills/supacloud-cli/agents/openai.yaml

@@ -1,4 +0,0 @@
-interface:
-  display_name: "SupaCloud CLI"
-  short_description: "安全使用 SupaCloud CLI 与数据库迁移"
-  default_prompt: "Use $supacloud-cli to manage this SupaCloud project through migrations and safe CLI workflows."