@zuvo/cli 0.1.3 → 0.1.6

package/README.md

@@ -1,6 +1,6 @@
 # @zuvo/cli
 
-Login, link a project, deploy Edge Functions, manage secrets, and `db push` against [Zuvo](https://studio.zuvodev.com).
+Login, link a project, deploy Edge Functions / App Hosting, manage secrets & hosting env, `db push`, and fetch logs against [Zuvo](https://studio.zuvodev.com).
 
 ```bash
 npm i -g @zuvo/cli
@@ -13,7 +13,26 @@ zuvo secrets set --env-file ./supabase/.env.local
 zuvo secrets list
 zuvo secrets unset OPENAI_API_KEY
 zuvo db push
+
+# App Hosting
+zuvo hosting apps
+zuvo hosting deploy --wait
+zuvo hosting deploy --commit abc1234 --app my-app
+zuvo hosting deployments
+zuvo hosting logs --since 6h
+zuvo hosting logs -f
+zuvo hosting deploy-logs
+zuvo hosting env list
+zuvo hosting env set API_KEY=secret FOO=bar
+zuvo hosting env set --env-file ./.env.hosting
+zuvo hosting env unset API_KEY
+zuvo hosting secrets list   # alias for hosting env
 ```
 
 Token: Studio → Account → Access Tokens, or `zuvo login --token zpat_…`.  
 API override: `ZUVO_API_URL` / `--api-url` (default `https://api.zuvodev.com`).
+
+**Notes**
+- Hosting env keys must be `UPPER_SNAKE` (`^[A-Z][A-Z0-9_]{0,127}$`).
+- After `hosting env set|unset`, run `zuvo hosting deploy --wait` so the container picks up new vars.
+- `zuvo secrets` = project Edge Function secrets; `zuvo hosting env` = App Hosting container env.

package/dist/api.js

@@ -7,6 +7,12 @@ export class ApiError extends Error {
         this.name = 'ApiError';
     }
 }
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function shouldRetry(status) {
+    return status === 429 || status === 502 || status === 503 || status === 504;
+}
 export async function apiRequest(apiUrl, method, pathname, opts = {}) {
     const token = opts.token ?? (await loadAccessToken());
     const url = new URL(pathname.replace(/^\//, ''), `${apiUrl}/`);
@@ -14,34 +20,46 @@ export async function apiRequest(apiUrl, method, pathname, opts = {}) {
         if (value)
             url.searchParams.set(key, value);
     }
-    const headers = {
-        authorization: `Bearer ${token}`,
-        accept: 'application/json',
-    };
-    let body;
-    if (opts.form) {
-        body = opts.form;
-    }
-    else if (opts.json !== undefined) {
-        headers['content-type'] = 'application/json';
-        body = JSON.stringify(opts.json);
-    }
-    const response = await fetch(url, { method, headers, body });
-    const text = await response.text();
-    let parsed = text;
-    if (text) {
-        try {
-            parsed = JSON.parse(text);
+    // Control-plane GoTrue/PostgREST rate-limits batch deploys; retry longer.
+    const maxAttempts = Math.max(1, (opts.retries ?? 8) + 1);
+    let lastError;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        const headers = {
+            authorization: `Bearer ${token}`,
+            accept: 'application/json',
+        };
+        let body;
+        if (opts.form) {
+            body = opts.form;
         }
-        catch {
-            parsed = text;
+        else if (opts.json !== undefined) {
+            headers['content-type'] = 'application/json';
+            body = JSON.stringify(opts.json);
         }
-    }
-    if (!response.ok) {
+        const response = await fetch(url, { method, headers, body });
+        const text = await response.text();
+        let parsed = text;
+        if (text) {
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                parsed = text;
+            }
+        }
+        if (response.ok)
+            return parsed;
         const message = parsed && typeof parsed === 'object' && parsed !== null && 'message' in parsed
             ? String(parsed.message)
             : text || `HTTP ${response.status}`;
-        throw new ApiError(response.status, message);
+        lastError = new ApiError(response.status, message);
+        if (!shouldRetry(response.status) || attempt === maxAttempts)
+            break;
+        const retryAfter = Number(response.headers.get('retry-after') || '');
+        const backoffMs = Number.isFinite(retryAfter) && retryAfter > 0
+            ? Math.max(retryAfter * 1000, 2_000)
+            : Math.min(20_000, 1_000 * 2 ** (attempt - 1));
+        await sleep(backoffMs);
     }
-    return parsed;
+    throw lastError || new ApiError(500, 'Request failed');
 }

package/dist/argv.js

@@ -0,0 +1,33 @@
+const GLOBAL_VALUE_FLAGS = new Set(['--api-url']);
+const GLOBAL_BOOL_FLAGS = new Set(['-h', '--help']);
+/**
+ * Slice argv after `zuvo <verbs…>`, keeping subcommand flags.
+ *
+ * Global `parseArgs({ strict: false })` drops unknown options like
+ * `--env-file` but leaves the path as a positional — so secrets set
+ * thought the file path was a secret name. Rebuild from the raw argv
+ * instead of relying on global positionals for flag-bearing commands.
+ */
+export function argvAfterCommand(argv, ...verbs) {
+    const stripped = [];
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (GLOBAL_BOOL_FLAGS.has(arg))
+            continue;
+        if (GLOBAL_VALUE_FLAGS.has(arg)) {
+            i += 1;
+            continue;
+        }
+        if (arg.startsWith('--api-url='))
+            continue;
+        stripped.push(arg);
+    }
+    let idx = 0;
+    for (const verb of verbs) {
+        if (stripped[idx] === verb)
+            idx += 1;
+        else
+            break;
+    }
+    return stripped.slice(idx);
+}

package/dist/hosting.js

@@ -0,0 +1,58 @@
+/** Parse `--since 30m|2h|1d` or an ISO timestamp into a Date. */
+export function parseSince(input, now = Date.now()) {
+    const trimmed = input.trim();
+    const relative = trimmed.match(/^(\d+)\s*(s|m|h|d)$/i);
+    if (relative) {
+        const amount = Number(relative[1]);
+        if (!Number.isFinite(amount) || amount < 0) {
+            throw new Error(`Invalid --since: ${input}`);
+        }
+        const unit = relative[2].toLowerCase();
+        const ms = unit === 's'
+            ? amount * 1_000
+            : unit === 'm'
+                ? amount * 60_000
+                : unit === 'h'
+                    ? amount * 3_600_000
+                    : amount * 86_400_000;
+        return new Date(now - ms);
+    }
+    const absolute = new Date(trimmed);
+    if (Number.isNaN(absolute.getTime())) {
+        throw new Error(`Invalid --since: ${input} (use 30m, 2h, 1d, or ISO timestamp)`);
+    }
+    return absolute;
+}
+export function formatLogTimestamp(value) {
+    if (value == null || value === '')
+        return '';
+    const n = typeof value === 'number' ? value : Number(value);
+    let ms;
+    if (Number.isFinite(n)) {
+        // Studio analytics returns microseconds when numeric.
+        ms = n > 1e14 ? Math.floor(n / 1000) : n;
+    }
+    else {
+        ms = new Date(String(value)).getTime();
+    }
+    if (!Number.isFinite(ms))
+        return String(value);
+    return new Date(ms).toISOString();
+}
+/** Oldest → newest for terminal reading. */
+export function sortLogsChronological(rows) {
+    return [...rows].sort((a, b) => {
+        const ta = formatLogTimestamp(a.timestamp);
+        const tb = formatLogTimestamp(b.timestamp);
+        return ta.localeCompare(tb);
+    });
+}
+export function formatHostingLogLine(row) {
+    const ts = formatLogTimestamp(row.timestamp);
+    const msg = row.event_message ?? '';
+    return ts ? `${ts}  ${msg}` : msg;
+}
+export function hostingLogsSql(limit) {
+    const safe = Math.min(Math.max(1, Math.floor(limit)), 5_000);
+    return `select id, timestamp, event_message from hosting_logs order by timestamp desc limit ${safe}`;
+}

package/dist/index.js

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 import { parseArgs } from 'node:util';
 import { apiRequest, ApiError } from './api.js';
+import { argvAfterCommand } from './argv.js';
 import { apiUrlFromEnv, deleteAccessToken, isAccessToken, requireLinkedRef, saveLinkedRef, } from './config.js';
 import { encodeFunctionForm, listFunctionSlugs, loadFunctionBundle } from './functions.js';
+import { formatHostingLogLine, formatLogTimestamp, hostingLogsSql, parseSince, sortLogsChronological, } from './hosting.js';
 import { loginBrowser, loginWithToken } from './login.js';
 import { loadLocalMigrations, pendingMigrations } from './migrations.js';
 import { loadSecretsEnvFile, parseSecretArgs } from './secrets.js';
@@ -21,6 +23,15 @@ Commands:
   secrets set --env-file <path>
   secrets unset NAME [NAME ...]
   db push
+  hosting apps
+  hosting deployments [--app <appId|slug>]
+  hosting deploy [--app <appId|slug>] [--commit <sha>] [--wait]
+  hosting logs [--limit N] [--since 1h|30m|ISO] [-f|--follow]
+  hosting deploy-logs [deploymentId] [--app <appId|slug>]
+  hosting env list [--app <appId|slug>]
+  hosting env set NAME=VALUE [...] [--env-file <path>] [--app <appId|slug>]
+  hosting env unset NAME [...] [--app <appId|slug>]
+  hosting secrets …          Alias for hosting env …
 
 Global:
   --api-url <url>     Default https://api.zuvodev.com (or ZUVO_API_URL)
@@ -147,8 +158,28 @@ async function cmdFunctionsDeploy(apiUrl, argv) {
     if (!slugs.length) {
         throw new Error('No functions to deploy (expected supabase/functions/<slug>).');
     }
-    for (const name of slugs) {
-        await deployOne(apiUrl, ref, name);
+    const failures = [];
+    for (let i = 0; i < slugs.length; i++) {
+        const name = slugs[i];
+        try {
+            await deployOne(apiUrl, ref, name);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            failures.push({ slug: name, message });
+            console.error(`Failed ${name}: ${message}`);
+            if (slug)
+                throw error;
+        }
+        // Space out multi-deploys so PostgREST/GoTrue do not rate-limit the next auth.
+        if (i < slugs.length - 1) {
+            await new Promise((r) => setTimeout(r, 1_500));
+        }
+    }
+    if (failures.length) {
+        throw new Error(`Deploy finished with ${failures.length} failure(s): ${failures
+            .map((f) => f.slug)
+            .join(', ')}`);
     }
 }
 async function cmdSecretsList(apiUrl) {
@@ -222,6 +253,330 @@ async function cmdDbPush(apiUrl) {
         console.log(`Applied ${migration.filename}`);
     }
 }
+async function listHostingApps(apiUrl, ref) {
+    const data = await apiRequest(apiUrl, 'GET', `/platform/projects/${ref}/hosting/apps`);
+    return Array.isArray(data?.apps) ? data.apps : [];
+}
+async function resolveHostingApp(apiUrl, ref, appId) {
+    const apps = await listHostingApps(apiUrl, ref);
+    if (!apps.length)
+        throw new Error('No hosting apps on this project.');
+    if (appId) {
+        const match = apps.find((app) => app.id === appId || app.slug === appId || app.name === appId);
+        if (!match)
+            throw new Error(`Hosting app not found: ${appId}`);
+        return match;
+    }
+    if (apps.length === 1)
+        return apps[0];
+    throw new Error(`Multiple hosting apps — pass --app <id|slug>. Available: ${apps
+        .map((app) => app.slug || app.id)
+        .join(', ')}`);
+}
+async function listHostingDeployments(apiUrl, ref, appId) {
+    const data = await apiRequest(apiUrl, 'GET', `/platform/projects/${ref}/hosting/apps/${appId}/deployments`);
+    return Array.isArray(data?.deployments) ? data.deployments : [];
+}
+async function cmdHostingApps(apiUrl) {
+    const ref = await requireLinkedRef();
+    const apps = await listHostingApps(apiUrl, ref);
+    if (!apps.length) {
+        console.log('No hosting apps.');
+        return;
+    }
+    for (const app of apps) {
+        console.log([app.id, app.slug || app.name || '', app.status || '', app.branch || '', app.public_url || '']
+            .filter(Boolean)
+            .join('\t'));
+    }
+}
+async function cmdHostingDeployments(apiUrl, argv) {
+    const { values } = parseArgs({
+        args: argv,
+        options: {
+            app: { type: 'string' },
+            'api-url': { type: 'string' },
+        },
+        allowPositionals: true,
+        strict: false,
+    });
+    const ref = await requireLinkedRef();
+    const app = await resolveHostingApp(apiUrl, ref, typeof values.app === 'string' ? values.app : undefined);
+    const deployments = await listHostingDeployments(apiUrl, ref, app.id);
+    if (!deployments.length) {
+        console.log('No deployments.');
+        return;
+    }
+    for (const dep of deployments) {
+        console.log([
+            dep.id,
+            dep.status || '',
+            dep.commit_sha ? String(dep.commit_sha).slice(0, 12) : '',
+            dep.created_at || '',
+        ]
+            .filter(Boolean)
+            .join('\t'));
+    }
+}
+async function fetchHostingRuntimeLogs(apiUrl, ref, opts) {
+    const body = {
+        sql: hostingLogsSql(opts.limit),
+    };
+    if (opts.since)
+        body.iso_timestamp_start = opts.since.toISOString();
+    const data = await apiRequest(apiUrl, 'POST', `/platform/projects/${ref}/analytics/endpoints/logs.all`, { json: body });
+    return Array.isArray(data?.result) ? data.result : [];
+}
+async function cmdHostingLogs(apiUrl, argv) {
+    const { values } = parseArgs({
+        args: argv,
+        options: {
+            limit: { type: 'string' },
+            since: { type: 'string' },
+            follow: { type: 'boolean', short: 'f' },
+            'api-url': { type: 'string' },
+        },
+        allowPositionals: true,
+        strict: false,
+    });
+    const ref = await requireLinkedRef();
+    const limitRaw = typeof values.limit === 'string' ? Number(values.limit) : 100;
+    const limit = Number.isFinite(limitRaw) ? limitRaw : 100;
+    const since = typeof values.since === 'string' && values.since.trim()
+        ? parseSince(values.since)
+        : parseSince('1h');
+    const follow = Boolean(values.follow);
+    const seen = new Set();
+    const printNew = (rows) => {
+        for (const row of sortLogsChronological(rows)) {
+            const key = row.id || `${formatHostingLogLine(row)}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            console.log(formatHostingLogLine(row));
+        }
+    };
+    const initial = await fetchHostingRuntimeLogs(apiUrl, ref, { limit, since });
+    if (!initial.length && !follow) {
+        console.log('No hosting logs in range.');
+        return;
+    }
+    printNew(initial);
+    if (!follow)
+        return;
+    let cursor = since;
+    for (const row of sortLogsChronological(initial)) {
+        const iso = formatLogTimestamp(row.timestamp);
+        const parsed = iso ? new Date(iso) : null;
+        if (parsed && !Number.isNaN(parsed.getTime()) && parsed > cursor)
+            cursor = parsed;
+    }
+    console.error('Following hosting logs… (Ctrl+C to stop)');
+    for (;;) {
+        await new Promise((r) => setTimeout(r, 2_500));
+        const nextSince = new Date(Math.max(0, cursor.getTime() - 1_000));
+        const rows = await fetchHostingRuntimeLogs(apiUrl, ref, {
+            limit: Math.max(limit, 200),
+            since: nextSince,
+        });
+        printNew(rows);
+        for (const row of sortLogsChronological(rows)) {
+            const iso = formatLogTimestamp(row.timestamp);
+            const parsed = iso ? new Date(iso) : null;
+            if (parsed && !Number.isNaN(parsed.getTime()) && parsed > cursor)
+                cursor = parsed;
+        }
+    }
+}
+async function cmdHostingDeployLogs(apiUrl, argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        options: {
+            app: { type: 'string' },
+            'api-url': { type: 'string' },
+        },
+        allowPositionals: true,
+        strict: false,
+    });
+    const ref = await requireLinkedRef();
+    const app = await resolveHostingApp(apiUrl, ref, typeof values.app === 'string' ? values.app : undefined);
+    let deploymentId = positionals.find((arg) => !arg.startsWith('-')) || '';
+    if (!deploymentId) {
+        const deployments = await listHostingDeployments(apiUrl, ref, app.id);
+        if (!deployments.length)
+            throw new Error('No deployments found.');
+        deploymentId = deployments[0].id;
+        console.error(`Using latest deployment ${deploymentId} (${deployments[0].status || 'unknown'})`);
+    }
+    const data = await apiRequest(apiUrl, 'GET', `/platform/projects/${ref}/hosting/apps/${app.id}/deployments/${deploymentId}/logs`);
+    const log = data?.log || '';
+    if (!log) {
+        console.log(`(empty build log) status=${data?.status || 'unknown'}`);
+        return;
+    }
+    process.stdout.write(log.endsWith('\n') ? log : `${log}\n`);
+}
+const HOSTING_ENV_KEY = /^[A-Z][A-Z0-9_]{0,127}$/;
+function assertHostingEnvKey(key) {
+    if (!HOSTING_ENV_KEY.test(key)) {
+        throw new Error(`Invalid env key: ${key} (must match /^[A-Z][A-Z0-9_]{0,127}$/)`);
+    }
+}
+async function getDeploymentStatus(apiUrl, ref, appId, deploymentId) {
+    return apiRequest(apiUrl, 'GET', `/platform/projects/${ref}/hosting/apps/${appId}/deployments/${deploymentId}/logs`);
+}
+async function cmdHostingDeploy(apiUrl, argv) {
+    const { values } = parseArgs({
+        args: argv,
+        options: {
+            app: { type: 'string' },
+            commit: { type: 'string' },
+            wait: { type: 'boolean' },
+            'api-url': { type: 'string' },
+        },
+        allowPositionals: true,
+        strict: false,
+    });
+    const ref = await requireLinkedRef();
+    const app = await resolveHostingApp(apiUrl, ref, typeof values.app === 'string' ? values.app : undefined);
+    const commitSha = typeof values.commit === 'string' && values.commit.trim()
+        ? values.commit.trim()
+        : undefined;
+    const data = await apiRequest(apiUrl, 'POST', `/platform/projects/${ref}/hosting/apps/${app.id}/deploy`, {
+        json: commitSha ? { commit_sha: commitSha } : {},
+    });
+    const deployment = data?.deployment;
+    if (!deployment?.id)
+        throw new Error('Deploy enqueue failed (no deployment id).');
+    console.log(`Queued deploy ${deployment.id} for ${app.slug || app.id} (${deployment.status || 'queued'})`);
+    if (!values.wait) {
+        console.error(`Tip: zuvo hosting deploy-logs ${deployment.id} --app ${app.slug || app.id}`);
+        return;
+    }
+    console.error('Waiting for deploy…');
+    const started = Date.now();
+    const timeoutMs = 20 * 60_000;
+    let lastStatus = deployment.status || 'queued';
+    for (;;) {
+        if (Date.now() - started > timeoutMs) {
+            throw new Error(`Timed out waiting for deploy (last status: ${lastStatus})`);
+        }
+        await new Promise((r) => setTimeout(r, 3_000));
+        const statusRes = await getDeploymentStatus(apiUrl, ref, app.id, deployment.id);
+        const status = statusRes.status || 'unknown';
+        if (status !== lastStatus) {
+            console.error(`status: ${status}`);
+            lastStatus = status;
+        }
+        if (status === 'ready') {
+            console.log(`Deploy ready: ${deployment.id}`);
+            if (app.public_url)
+                console.log(app.public_url);
+            return;
+        }
+        if (status === 'failed') {
+            const log = statusRes.log || '';
+            if (log)
+                process.stderr.write(log.endsWith('\n') ? log : `${log}\n`);
+            throw new Error(`Deploy failed: ${deployment.id}`);
+        }
+    }
+}
+async function cmdHostingEnvList(apiUrl, argv) {
+    const { values } = parseArgs({
+        args: argv,
+        options: {
+            app: { type: 'string' },
+            'api-url': { type: 'string' },
+        },
+        allowPositionals: true,
+        strict: false,
+    });
+    const ref = await requireLinkedRef();
+    const app = await resolveHostingApp(apiUrl, ref, typeof values.app === 'string' ? values.app : undefined);
+    const data = await apiRequest(apiUrl, 'GET', `/platform/projects/${ref}/hosting/apps/${app.id}/env`);
+    const auto = Array.isArray(data?.auto) ? data.auto : [];
+    const custom = Array.isArray(data?.custom) ? data.custom : [];
+    if (!auto.length && !custom.length) {
+        console.log('No env vars.');
+        return;
+    }
+    for (const row of auto) {
+        console.log([row.key, row.value || '(auto)', 'auto'].filter(Boolean).join('\t'));
+    }
+    for (const row of custom) {
+        console.log([row.key, row.value || '********', 'custom'].filter(Boolean).join('\t'));
+    }
+}
+async function cmdHostingEnvSet(apiUrl, argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        options: {
+            app: { type: 'string' },
+            'env-file': { type: 'string' },
+            'api-url': { type: 'string' },
+        },
+        allowPositionals: true,
+        strict: false,
+    });
+    const ref = await requireLinkedRef();
+    const app = await resolveHostingApp(apiUrl, ref, typeof values.app === 'string' ? values.app : undefined);
+    const fromFile = typeof values['env-file'] === 'string' && values['env-file'].trim()
+        ? await loadSecretsEnvFile(values['env-file'].trim())
+        : [];
+    const fromArgs = parseSecretArgs(positionals);
+    const pairs = [...fromFile, ...fromArgs];
+    if (!pairs.length) {
+        throw new Error('Usage: zuvo hosting env set NAME=VALUE [...] | --env-file <path> [--app <id|slug>]');
+    }
+    for (const pair of pairs) {
+        assertHostingEnvKey(pair.name);
+    }
+    await apiRequest(apiUrl, 'PUT', `/platform/projects/${ref}/hosting/apps/${app.id}/env`, {
+        json: { vars: pairs.map((p) => ({ key: p.name, value: p.value })) },
+    });
+    console.log(`Set ${pairs.map((p) => p.name).join(', ')} on ${app.slug || app.id}`);
+    console.error('Redeploy to apply env changes: zuvo hosting deploy --wait');
+}
+async function cmdHostingEnvUnset(apiUrl, argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        options: {
+            app: { type: 'string' },
+            'api-url': { type: 'string' },
+        },
+        allowPositionals: true,
+        strict: false,
+    });
+    const names = positionals
+        .filter((arg) => !arg.startsWith('-'))
+        .map((n) => n.trim())
+        .filter(Boolean);
+    if (!names.length) {
+        throw new Error('Usage: zuvo hosting env unset NAME [NAME ...] [--app <id|slug>]');
+    }
+    for (const name of names)
+        assertHostingEnvKey(name);
+    const ref = await requireLinkedRef();
+    const app = await resolveHostingApp(apiUrl, ref, typeof values.app === 'string' ? values.app : undefined);
+    await apiRequest(apiUrl, 'DELETE', `/platform/projects/${ref}/hosting/apps/${app.id}/env`, {
+        json: { keys: names },
+    });
+    console.log(`Unset ${names.join(', ')} on ${app.slug || app.id}`);
+    console.error('Redeploy to apply env changes: zuvo hosting deploy --wait');
+}
+async function cmdHostingEnv(apiUrl, argv) {
+    const [action, ...rest] = argv;
+    if (action === 'list' || !action)
+        await cmdHostingEnvList(apiUrl, rest);
+    else if (action === 'set')
+        await cmdHostingEnvSet(apiUrl, rest);
+    else if (action === 'unset' || action === 'delete')
+        await cmdHostingEnvUnset(apiUrl, rest);
+    else {
+        throw new Error('Usage: zuvo hosting env list|set|unset … (alias: zuvo hosting secrets …)');
+    }
+}
 async function main() {
     const argv = process.argv.slice(2);
     const global = parseGlobal(argv);
@@ -229,7 +584,7 @@ async function main() {
         console.log(usage());
         return;
     }
-    const [command, sub, ...rest] = global.positionals;
+    const [command, sub] = global.positionals;
     const apiUrl = global.apiUrl;
     try {
         if (command === 'login')
@@ -243,15 +598,27 @@ async function main() {
         else if (command === 'functions' && sub === 'list')
             await cmdFunctionsList(apiUrl);
         else if (command === 'functions' && sub === 'deploy')
-            await cmdFunctionsDeploy(apiUrl, rest);
+            await cmdFunctionsDeploy(apiUrl, argvAfterCommand(argv, 'functions', 'deploy'));
         else if (command === 'secrets' && (sub === 'list' || !sub))
             await cmdSecretsList(apiUrl);
         else if (command === 'secrets' && sub === 'set')
-            await cmdSecretsSet(apiUrl, rest);
+            await cmdSecretsSet(apiUrl, argvAfterCommand(argv, 'secrets', 'set'));
         else if (command === 'secrets' && (sub === 'unset' || sub === 'delete'))
-            await cmdSecretsUnset(apiUrl, rest);
+            await cmdSecretsUnset(apiUrl, argvAfterCommand(argv, 'secrets', sub));
         else if (command === 'db' && sub === 'push')
             await cmdDbPush(apiUrl);
+        else if (command === 'hosting' && (sub === 'apps' || sub === 'list'))
+            await cmdHostingApps(apiUrl);
+        else if (command === 'hosting' && sub === 'deployments')
+            await cmdHostingDeployments(apiUrl, argvAfterCommand(argv, 'hosting', 'deployments'));
+        else if (command === 'hosting' && sub === 'deploy')
+            await cmdHostingDeploy(apiUrl, argvAfterCommand(argv, 'hosting', 'deploy'));
+        else if (command === 'hosting' && sub === 'logs')
+            await cmdHostingLogs(apiUrl, argvAfterCommand(argv, 'hosting', 'logs'));
+        else if (command === 'hosting' && (sub === 'deploy-logs' || sub === 'build-logs'))
+            await cmdHostingDeployLogs(apiUrl, argvAfterCommand(argv, 'hosting', sub));
+        else if (command === 'hosting' && (sub === 'env' || sub === 'secrets'))
+            await cmdHostingEnv(apiUrl, argvAfterCommand(argv, 'hosting', sub));
         else {
             console.error(usage());
             process.exit(command ? 1 : 0);
@@ -259,7 +626,7 @@ async function main() {
     }
     catch (error) {
         if (error instanceof ApiError && error.status === 403) {
-            fail('Forbidden. Functions, secrets, and db push require owner, admin, or developer.');
+            fail('Forbidden. Functions, secrets, db push, and hosting require owner, admin, or developer.');
         }
         fail(error);
     }

package/dist/secrets.js

@@ -17,6 +17,9 @@ export function parseSecretArgs(args) {
         }
         const next = args[i + 1];
         if (!next || next.startsWith('-') || next.includes('=')) {
+            if (/[./]/.test(arg) || arg.endsWith('.env') || arg.includes('.env.')) {
+                throw new Error(`Missing value for ${arg}. To load a file use: zuvo secrets set --env-file ${arg}`);
+            }
             throw new Error(`Missing value for secret ${arg} (use NAME=VALUE)`);
         }
         out.push({ name: arg.trim(), value: next });

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@zuvo/cli",
-  "version": "0.1.3",
+  "version": "0.1.6",
   "type": "module",
-  "description": "Zuvo CLI — login, link, functions deploy, secrets, and db push",
+  "description": "Zuvo CLI — login, link, functions/hosting deploy, secrets, env, db push, and logs",
   "license": "MIT",
   "bin": {
     "zuvo": "bin/zuvo.js"