Variable precedence and snapshots
Variable precedence
Appaloft resolves configuration as defaults, system, organization, project, environment, resource, and deployment snapshot. Users mainly need to know that deployments use snapshot values.
User-visible rules:
- Configuration closer to the deployment wins.
- Environment variables override project or system defaults.
- Resource variables override environment variables for the same key plus exposure on that resource only.
- Creating a deployment stores an immutable snapshot.
- Changing variables later does not change that deployment.
This lets users update staging or production configuration without silently rewriting deployment history.
Build-time and runtime variables
Build-time variables can enter artifacts and cannot be secret. Runtime variables are used when the application starts and runs.
| Type | Used when | Can be secret |
|---|---|---|
| Build-time variable | Build phase, frontend bundle, static artifact generation. | No. It may enter artifacts. |
| Runtime variable | Application startup and runtime. | Yes. Read models and logs must mask values. |
If a variable is visible to the browser, such as PUBLIC_ or VITE_, do not treat it as a secret.
Deployment snapshot
Every deployment stores an immutable environment snapshot. That snapshot may include inherited environment values and resource-specific overrides. Later variable changes do not change running or completed deployments.
Deployment details should show the configuration summary used by that deployment, not only the current environment variable table.
Entrypoints
The Web console should show environment and resource variables, masked secret status, last update time, ownership scope, and deployment snapshot hints.
The CLI fits set, unset, effective-precedence, effective-config, diff, and automation
scripts. CLI output should show masked status for secrets, not values.
The HTTP API should return variable key, scope, whether it is secret, source layer, and masked value. It should not return plaintext secrets.
Use environments.effective-precedence to inspect the values one environment contributes before
resource overrides. Use resources.effective-config to inspect the deployment input view after
resource variables override environment variables.
Common issues
If a deployment did not read a new variable:
- Confirm the variable was set in the correct environment.
- Confirm whether the variable is needed at build time or runtime.
- For runtime variables, redeploy so the app reads a new snapshot.
- For build-time variables, rebuild and redeploy.
Related pages: Secrets and Diff and promote environments.