agentful 0.4.6 → 0.4.7

package/README.md

@@ -72,9 +72,15 @@ What does **not** work:
   or streaming, **no webhook signature verification** (no raw request body;
   look the event up at the provider instead, or put a verifying receiver in
   front), and no custom status codes, headers or HTML responses.
-- Build-time env vars or build secrets. `.env*` files never leave your machine,
-  and the `agentful push` build injects nothing; keep public values in an
-  ordinary source constant.
+- Build-time env vars or build secrets of your own. `.env*` files never leave
+  your machine. Every cloud build defines one fixed allowlist of public values
+  and nothing else: the project ID (`VITE_PROJECT_ID`, `PUBLIC_PROJECT_ID`) and,
+  while your own Supabase database is connected in the Backend tab, its URL and
+  publishable key (`VITE_`/`PUBLIC_`/`NEXT_PUBLIC_` + `SUPABASE_URL`,
+  `SUPABASE_ANON_KEY`). Reading one of those names while nothing defines it
+  fails the build instead of compiling to `undefined`; `agentful push` warns
+  about it before the upload. Keep public values of your own in an ordinary
+  source constant.
 
 Actions have **no staging**: they run from your project's source, so a push can
 change what the published app does immediately, while warm instances may serve