docs(cli): fix fabricated SUPABASE_API_URL and bare PROJECT_ID env-var references

apps/cli/src/legacy/SIDE_EFFECTS_TEMPLATE.md

@@ -61,7 +61,7 @@
 | Variable                | Purpose                                              | Required?                                               |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)  |
 
 ## Exit Codes
 

apps/cli/src/legacy/commands/backups/list/SIDE_EFFECTS.md

@@ -31,7 +31,6 @@
 | `SUPABASE_PROFILE`      | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`)                                                |
 | `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset                                                                                                                                                                                                                                                   | no (also reads `<workdir>/supabase/.temp/project-ref` then prompts on TTY) |
 | `SUPABASE_WORKDIR`      | base directory for the `.temp/project-ref` lookup                                                                                                                                                                                                                                                    | no (walks up from CWD looking for `supabase/config.toml`)                  |
-| ~~`SUPABASE_API_URL`~~  | **not honored** — Go parity. Use `SUPABASE_PROFILE` to override the API base URL.                                                                                                                                                                                                                    | —                                                                          |
 
 ## Exit Codes
 

apps/cli/src/legacy/commands/backups/restore/SIDE_EFFECTS.md

@@ -31,7 +31,6 @@
 | `SUPABASE_PROFILE`      | selects API base URL: `supabase` → `api.supabase.com`, `supabase-staging` → `api.supabase.green`, `supabase-local` → `http://localhost:8080`. May alternatively be a filesystem path to a YAML profile with at least `api_url:` and optional `name:` (Go parity — used by the cli-e2e test harness). | no (defaults to `supabase`)                                                |
 | `SUPABASE_PROJECT_ID`   | project ref fallback when `--project-ref` is unset                                                                                                                                                                                                                                                   | no (also reads `<workdir>/supabase/.temp/project-ref` then prompts on TTY) |
 | `SUPABASE_WORKDIR`      | base directory for the `.temp/project-ref` lookup                                                                                                                                                                                                                                                    | no (walks up from CWD looking for `supabase/config.toml`)                  |
-| ~~`SUPABASE_API_URL`~~  | **not honored** — Go parity. Use `SUPABASE_PROFILE` to override the API base URL.                                                                                                                                                                                                                    | —                                                                          |
 
 ## Exit Codes
 

apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md

@@ -46,13 +46,13 @@ leaking the change to the surrounding process.
 
 ## Environment Variables
 
-| Variable                               | Purpose                                            | Required? |
-| -------------------------------------- | -------------------------------------------------- | --------- |
-| `SUPABASE_WORKDIR`                     | target dir (`--workdir` flag → env → prompt → cwd) | no        |
-| `SUPABASE_DB_PASSWORD`                 | DB password (`-p` flag → env → prompt/generate)    | no        |
-| `GITHUB_TOKEN`                         | raise the GitHub API rate limit for template fetch | no        |
-| `SUPABASE_ACCESS_TOKEN`                | auth bypass for ensure-login                       | no        |
-| `SUPABASE_API_URL`, `SUPABASE_PROFILE` | API host / profile                                 | no        |
+| Variable                | Purpose                                                      | Required? |
+| ----------------------- | ------------------------------------------------------------ | --------- |
+| `SUPABASE_WORKDIR`      | target dir (`--workdir` flag → env → prompt → cwd)           | no        |
+| `SUPABASE_DB_PASSWORD`  | DB password (`-p` flag → env → prompt/generate)              | no        |
+| `GITHUB_TOKEN`          | raise the GitHub API rate limit for template fetch           | no        |
+| `SUPABASE_ACCESS_TOKEN` | auth bypass for ensure-login                                 | no        |
+| `SUPABASE_PROFILE`      | profile name/path (env → `~/.supabase/profile` → `supabase`) | no        |
 
 ## Exit Codes
 

apps/cli/src/legacy/commands/config/push/SIDE_EFFECTS.md

@@ -55,7 +55,6 @@ when its local gate is off.
 | `SUPABASE_PROJECT_ID`   | project ref (flag → this → `.temp/project-ref` → prompt) | no                                                      |
 | `SUPABASE_YES`          | auto-confirm prompts (`--yes`)                           | no                                                      |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup)     | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                         | no (defaults to `https://api.supabase.com`)             |
 | `SUPABASE_PROFILE`      | API profile selection                                    | no                                                      |
 | `env(VAR)` references   | interpolated into `config.toml` values at load           | no                                                      |
 

apps/cli/src/legacy/commands/domains/SIDE_EFFECTS.md

@@ -6,10 +6,10 @@ Cloudflare DNS-over-HTTPS CNAME pre-check.
 
 ## Files Read
 
-| Path                                   | Format                    | When                                                       |
-| -------------------------------------- | ------------------------- | ---------------------------------------------------------- |
-| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable |
-| `<workdir>/supabase/.temp/project-ref` | plain text                | when `--project-ref` flag and `PROJECT_ID` env are unset   |
+| Path                                   | Format                    | When                                                              |
+| -------------------------------------- | ------------------------- | ----------------------------------------------------------------- |
+| `~/.supabase/access-token`             | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable        |
+| `<workdir>/supabase/.temp/project-ref` | plain text                | when `--project-ref` flag and `SUPABASE_PROJECT_ID` env are unset |
 
 ## Files Written
 
@@ -92,7 +92,7 @@ suppressed on stderr. `delete` ignores `-o`.
 
 - `--custom-hostname` is required for `create`.
 - `create` validates the CNAME via Cloudflare DNS-over-HTTPS (`https://1.1.1.1`, 10s timeout) before initializing; on failure it short-circuits before any POST.
-- All subcommands resolve the ref via `--project-ref` → `PROJECT_ID` env → linked-project file, matching Go.
+- All subcommands resolve the ref via `--project-ref` → `SUPABASE_PROJECT_ID` env → linked-project file, matching Go.
 - The project-ref fallback env var is `SUPABASE_PROJECT_ID`, matching Go (Go calls `viper.GetString("PROJECT_ID")` under `viper.SetEnvPrefix("SUPABASE")`, which resolves to the `SUPABASE_PROJECT_ID` environment variable).
 - **Documented divergences from Go (intentional):**
   - `--include-raw-output` is declared as a normal boolean **on each subcommand** (Go declares it as a persistent flag on the `domains` group). Two consequences: (a) it must appear after the subcommand name (`domains get --include-raw-output`) rather than before it (`domains --include-raw-output get`), matching how `--project-ref` is already handled shell-wide; (b) it cannot reproduce Cobra's help-hiding or the `Flag --include-raw-output has been deprecated` stderr warning, which Effect CLI has no hook for. It still reproduces the behavioral effect (forces `-o json` when `-o` is unset/pretty); on `delete` it is inert, matching Go.

apps/cli/src/legacy/commands/encryption/SIDE_EFFECTS.md

@@ -6,11 +6,11 @@ additionally reads the new key from stdin.
 
 ## Files Read
 
-| Path                                             | Format                    | When                                                               |
-| ------------------------------------------------ | ------------------------- | ------------------------------------------------------------------ |
-| `~/.supabase/access-token`                       | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable         |
-| `~/.supabase/<workdir-hash>/linked-project.json` | JSON                      | when `--project-ref` / `PROJECT_ID` unset, to resolve linked ref   |
-| stdin                                            | raw bytes / masked TTY    | `update-root-key` only — masked TTY input or piped bytes (the key) |
+| Path                                             | Format                    | When                                                                      |
+| ------------------------------------------------ | ------------------------- | ------------------------------------------------------------------------- |
+| `~/.supabase/access-token`                       | plain text (token string) | when `SUPABASE_ACCESS_TOKEN` unset and keyring unavailable                |
+| `~/.supabase/<workdir-hash>/linked-project.json` | JSON                      | when `--project-ref` / `SUPABASE_PROJECT_ID` unset, to resolve linked ref |
+| stdin                                            | raw bytes / masked TTY    | `update-root-key` only — masked TTY input or piped bytes (the key)        |
 
 ## Files Written
 
@@ -30,12 +30,11 @@ additionally reads the new key from stdin.
 
 ## Environment Variables
 
-| Variable                             | Purpose                                              | Required?                                               |
-| ------------------------------------ | ---------------------------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN`              | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_PROJECT_ID` / `PROJECT_ID` | project ref (fallback when `--project-ref` unset)    | no (falls back to linked-project file → prompt)         |
-| `SUPABASE_API_URL`                   | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
-| `SUPABASE_PROFILE`                   | built-in profile name or YAML file path              | no (defaults to `supabase`)                             |
+| Variable                | Purpose                                              | Required?                                               |
+| ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
+| `SUPABASE_PROJECT_ID`   | project ref (fallback when `--project-ref` unset)    | no (falls back to linked-project file → prompt)         |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)  |
 
 ## Exit Codes
 
@@ -76,7 +75,7 @@ One `result` event carrying `{root_key}` (both subcommands).
 
 ## Notes
 
-- Requires `--project-ref`, `SUPABASE_PROJECT_ID`/`PROJECT_ID`, or a linked project.
+- Requires `--project-ref`, `SUPABASE_PROJECT_ID`, or a linked project.
 - `update-root-key` reads the key from stdin: a real TTY is read with a masked
   prompt; piped stdin is decoded as UTF-8 and whitespace-trimmed. An empty or
   whitespace-only key sends an empty `root_key`, matching Go's `io.Copy` +

apps/cli/src/legacy/commands/functions/delete/SIDE_EFFECTS.md

@@ -23,7 +23,7 @@
 | Variable                | Purpose                                              | Required?                                               |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)  |
 
 ## Exit Codes
 

apps/cli/src/legacy/commands/functions/download/SIDE_EFFECTS.md

@@ -31,7 +31,7 @@
 | Variable                | Purpose                                              | Required?                                               |
 | ----------------------- | ---------------------------------------------------- | ------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN` | auth token (bypasses credential file/keyring lookup) | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL                     | no (defaults to `https://api.supabase.com`)             |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path              | no (falls back to `~/.supabase/profile` -> `supabase`)  |
 
 ## Exit Codes
 

apps/cli/src/legacy/commands/functions/list/SIDE_EFFECTS.md

@@ -34,7 +34,6 @@
 | `SUPABASE_PROFILE`      | select a built-in profile or YAML profile file with `api_url:` | no (falls back to `~/.supabase/profile` -> `supabase`)    |
 | `SUPABASE_PROJECT_ID`   | provides the project ref when `--project-ref` is unset         | no (falls back to `<workdir>/supabase/.temp/project-ref`) |
 | `SUPABASE_WORKDIR`      | sets `<workdir>` for local Supabase temp files                 | no (falls back to `--workdir` -> current working dir)     |
-| ~~`SUPABASE_API_URL`~~  | **not honored** - Go parity. Use `SUPABASE_PROFILE` instead.   | -                                                         |
 
 ## Exit Codes
 

apps/cli/src/legacy/commands/gen/keys/SIDE_EFFECTS.md

@@ -20,10 +20,10 @@
 
 ## Environment Variables
 
-| Variable                | Purpose                          | Required?                                               |
-| ----------------------- | -------------------------------- | ------------------------------------------------------- |
-| `SUPABASE_ACCESS_TOKEN` | auth token                       | no (falls back to keyring → `~/.supabase/access-token`) |
-| `SUPABASE_API_URL`      | override Management API base URL | no (defaults to `https://api.supabase.com`)             |
+| Variable                | Purpose                                 | Required?                                               |
+| ----------------------- | --------------------------------------- | ------------------------------------------------------- |
+| `SUPABASE_ACCESS_TOKEN` | auth token                              | no (falls back to keyring → `~/.supabase/access-token`) |
+| `SUPABASE_PROFILE`      | built-in profile name or YAML file path | no (falls back to `~/.supabase/profile` -> `supabase`)  |
 
 ## Exit Codes
 

apps/cli/src/legacy/commands/gen/types/SIDE_EFFECTS.md

@@ -59,7 +59,7 @@ default 10s pg-delta probe timeout.
 | Variable                           | Purpose                                                                                     | Required?                                                                                                     |
 | ---------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
 | `SUPABASE_ACCESS_TOKEN`            | auth token for linked/project-id mode                                                       | no (falls back to keyring → `~/.supabase/access-token`)                                                       |
-| `SUPABASE_API_URL`                 | override Management API base URL                                                            | no (defaults to `https://api.supabase.com`)                                                                   |
+| `SUPABASE_PROFILE`                 | built-in profile name or YAML file path                                                     | no (falls back to `~/.supabase/profile` -> `supabase`)                                                        |
 | `SUPABASE_DB_PASSWORD`             | database password for `--local` and the `--linked` workdir project                          | no (defaults to `postgres`; **ignored** for ad-hoc `--project-id`, which always mints a temporary login role) |
 | `SUPABASE_SERVICES_HOSTNAME`       | host used for the local TLS probe                                                           | no (defaults to `127.0.0.1`)                                                                                  |
 | `SUPABASE_INTERNAL_IMAGE_REGISTRY` | pg-meta image registry override (`docker.io` → Docker Hub; any other value → that registry) | no (defaults to the ECR registry)                                                                             |

apps/cli/src/legacy/commands/inspect/db/SIDE_EFFECTS.md

@@ -40,7 +40,7 @@ no new config reads.
 | ---------------------------------------------------- | --------------------------------- | --------------------------------------- |
 | `SUPABASE_DB_PASSWORD` / `DB_PASSWORD`               | database password (linked/local)  | no (prompts / config fallback)          |
 | `SUPABASE_ACCESS_TOKEN`                              | Management API auth (linked only) | no (falls back to keyring / token file) |
-| `PROJECT_ID`                                         | project ref fallback (linked)     | no (config resolution fallback)         |
+| `SUPABASE_PROJECT_ID`                                | project ref fallback (linked)     | no (config resolution fallback)         |
 | libpq vars (`PGSSLROOTCERT`, `PGCONNECT_TIMEOUT`, …) | honored when `--db-url` is used   | no                                      |
 
 ## Database Queries