run402 1.69.5 → 1.69.7

package/lib/deploy-v2.mjs

@@ -32,6 +32,7 @@ import {
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import { API, allowanceAuthHeaders, getActiveProjectId, resolveProjectId } from "./config.mjs";
+import { normalizeArgv } from "./argparse.mjs";
 
 const APPLY_HELP = `run402 deploy apply — Unified deploy primitive (v1.34+)
 
@@ -778,19 +779,18 @@ function rejectLegacySecretManifest(spec, details) {
 }
 
 async function resumeCmd(args) {
-  const opts = { operationId: null, quiet: false };
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--help" || args[i] === "-h") { console.log(RESUME_HELP); process.exit(0); }
-    if (args[i] === "--quiet") { opts.quiet = true; continue; }
-    if (!args[i].startsWith("-") && !opts.operationId) opts.operationId = args[i];
-  }
-  if (!opts.operationId) {
-    fail({
-      code: "BAD_USAGE",
-      message: "Missing <operation_id>.",
-      hint: "run402 deploy resume <operation_id>",
-    });
-  }
+  const parsed = parseDeploySubcommandArgs(args, {
+    command: "deploy resume",
+    help: RESUME_HELP,
+    booleanFlags: ["--quiet"],
+  });
+  const [operationId] = expectPositionals(parsed.positionals, {
+    command: "run402 deploy resume <operation_id>",
+    min: 1,
+    max: 1,
+    missing: "Missing <operation_id>.",
+  });
+  const opts = { operationId, quiet: Boolean(parsed.flags["--quiet"]) };
 
   allowanceAuthHeaders("/deploy/v2/operations");
 
@@ -805,12 +805,19 @@ async function resumeCmd(args) {
 }
 
 async function listCmd(args) {
-  const opts = { project: null, limit: null };
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--help" || args[i] === "-h") { console.log(LIST_HELP); process.exit(0); }
-    if (args[i] === "--project" && args[i + 1]) { opts.project = args[++i]; continue; }
-    if (args[i] === "--limit") { opts.limit = parsePositiveInt(args[++i], "--limit"); continue; }
-  }
+  const parsed = parseDeploySubcommandArgs(args, {
+    command: "deploy list",
+    help: LIST_HELP,
+    valueFlags: ["--project", "--limit"],
+  });
+  expectPositionals(parsed.positionals, {
+    command: "run402 deploy list [--project <id>] [--limit <n>]",
+    max: 0,
+  });
+  const opts = {
+    project: parsed.flags["--project"] ?? null,
+    limit: parsed.flags["--limit"] === undefined ? null : parsePositiveInt(parsed.flags["--limit"], "--limit"),
+  };
 
   const project = resolveProjectId(opts.project);
   allowanceAuthHeaders("/deploy/v2/operations");
@@ -826,19 +833,18 @@ async function listCmd(args) {
 }
 
 async function eventsCmd(args) {
-  const opts = { operationId: null, project: null };
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--help" || args[i] === "-h") { console.log(EVENTS_HELP); process.exit(0); }
-    if (args[i] === "--project" && args[i + 1]) { opts.project = args[++i]; continue; }
-    if (!args[i].startsWith("-") && !opts.operationId) opts.operationId = args[i];
-  }
-  if (!opts.operationId) {
-    fail({
-      code: "BAD_USAGE",
-      message: "Missing <operation_id>.",
-      hint: "run402 deploy events <operation_id>",
-    });
-  }
+  const parsed = parseDeploySubcommandArgs(args, {
+    command: "deploy events",
+    help: EVENTS_HELP,
+    valueFlags: ["--project"],
+  });
+  const [operationId] = expectPositionals(parsed.positionals, {
+    command: "run402 deploy events <operation_id>",
+    min: 1,
+    max: 1,
+    missing: "Missing <operation_id>.",
+  });
+  const opts = { operationId, project: parsed.flags["--project"] ?? null };
 
   const project = resolveProjectId(opts.project);
   allowanceAuthHeaders("/deploy/v2/operations");
@@ -868,20 +874,24 @@ async function releaseCmd(args) {
 }
 
 async function releaseGetCmd(args) {
-  const opts = { releaseId: null, project: null, siteLimit: null };
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--help" || args[i] === "-h") { console.log(RELEASE_GET_HELP); process.exit(0); }
-    if (args[i] === "--project" && args[i + 1]) { opts.project = args[++i]; continue; }
-    if (args[i] === "--site-limit" && args[i + 1]) { opts.siteLimit = parsePositiveInt(args[++i], "--site-limit"); continue; }
-    if (!args[i].startsWith("-") && !opts.releaseId) opts.releaseId = args[i];
-  }
-  if (!opts.releaseId) {
-    fail({
-      code: "BAD_USAGE",
-      message: "Missing <release_id>.",
-      hint: "run402 deploy release get <release_id>",
-    });
-  }
+  const parsed = parseDeploySubcommandArgs(args, {
+    command: "deploy release get",
+    help: RELEASE_GET_HELP,
+    valueFlags: ["--project", "--site-limit"],
+  });
+  const [releaseId] = expectPositionals(parsed.positionals, {
+    command: "run402 deploy release get <release_id>",
+    min: 1,
+    max: 1,
+    missing: "Missing <release_id>.",
+  });
+  const opts = {
+    releaseId,
+    project: parsed.flags["--project"] ?? null,
+    siteLimit: parsed.flags["--site-limit"] === undefined
+      ? null
+      : parsePositiveInt(parsed.flags["--site-limit"], "--site-limit"),
+  };
 
   const project = resolveProjectId(opts.project);
 
@@ -896,12 +906,21 @@ async function releaseGetCmd(args) {
 }
 
 async function releaseActiveCmd(args) {
-  const opts = { project: null, siteLimit: null };
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--help" || args[i] === "-h") { console.log(RELEASE_ACTIVE_HELP); process.exit(0); }
-    if (args[i] === "--project" && args[i + 1]) { opts.project = args[++i]; continue; }
-    if (args[i] === "--site-limit" && args[i + 1]) { opts.siteLimit = parsePositiveInt(args[++i], "--site-limit"); continue; }
-  }
+  const parsed = parseDeploySubcommandArgs(args, {
+    command: "deploy release active",
+    help: RELEASE_ACTIVE_HELP,
+    valueFlags: ["--project", "--site-limit"],
+  });
+  expectPositionals(parsed.positionals, {
+    command: "run402 deploy release active [--project <id>] [--site-limit <n>]",
+    max: 0,
+  });
+  const opts = {
+    project: parsed.flags["--project"] ?? null,
+    siteLimit: parsed.flags["--site-limit"] === undefined
+      ? null
+      : parsePositiveInt(parsed.flags["--site-limit"], "--site-limit"),
+  };
 
   const project = resolveProjectId(opts.project);
 
@@ -916,14 +935,21 @@ async function releaseActiveCmd(args) {
 }
 
 async function releaseDiffCmd(args) {
-  const opts = { project: null, from: null, to: null, limit: null };
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--help" || args[i] === "-h") { console.log(RELEASE_DIFF_HELP); process.exit(0); }
-    if (args[i] === "--project" && args[i + 1]) { opts.project = args[++i]; continue; }
-    if (args[i] === "--from" && args[i + 1]) { opts.from = args[++i]; continue; }
-    if (args[i] === "--to" && args[i + 1]) { opts.to = args[++i]; continue; }
-    if (args[i] === "--limit" && args[i + 1]) { opts.limit = parsePositiveInt(args[++i], "--limit"); continue; }
-  }
+  const parsed = parseDeploySubcommandArgs(args, {
+    command: "deploy release diff",
+    help: RELEASE_DIFF_HELP,
+    valueFlags: ["--project", "--from", "--to", "--limit"],
+  });
+  expectPositionals(parsed.positionals, {
+    command: "run402 deploy release diff --from <target> --to <target>",
+    max: 0,
+  });
+  const opts = {
+    project: parsed.flags["--project"] ?? null,
+    from: parsed.flags["--from"] ?? null,
+    to: parsed.flags["--to"] ?? null,
+    limit: parsed.flags["--limit"] === undefined ? null : parsePositiveInt(parsed.flags["--limit"], "--limit"),
+  };
   if (!opts.from || !opts.to) {
     fail({
       code: "BAD_USAGE",
@@ -1076,9 +1102,80 @@ function redactResolveInput(input) {
   return copy;
 }
 
+function parseDeploySubcommandArgs(rawArgs, { command, help, valueFlags = [], booleanFlags = [] }) {
+  const args = normalizeArgv(rawArgs);
+  const valueFlagSet = new Set(valueFlags);
+  const booleanFlagSet = new Set(booleanFlags);
+  const numericFlagSet = new Set(["--limit", "--site-limit"]);
+  const allowedFlags = new Set([...valueFlags, ...booleanFlags, "--help", "-h"]);
+  const flags = {};
+  const positionals = [];
+
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--help" || arg === "-h") {
+      console.log(help);
+      process.exit(0);
+    }
+    if (valueFlagSet.has(arg)) {
+      const value = args[i + 1];
+      if (value === undefined || (typeof value === "string" && value.startsWith("--"))) {
+        if (numericFlagSet.has(arg)) parsePositiveInt(value, arg);
+        fail({
+          code: "BAD_USAGE",
+          message: `${arg} requires a value`,
+          details: { flag: arg },
+        });
+      }
+      flags[arg] = value;
+      i += 1;
+      continue;
+    }
+    if (booleanFlagSet.has(arg)) {
+      flags[arg] = true;
+      continue;
+    }
+    if (typeof arg === "string" && arg.startsWith("-")) {
+      fail({
+        code: "BAD_USAGE",
+        message: `Unknown flag for ${command}: ${arg}`,
+        details: { flag: arg, allowed_flags: [...allowedFlags] },
+      });
+    }
+    positionals.push(arg);
+  }
+
+  return { flags, positionals };
+}
+
+function expectPositionals(positionals, { command, min = 0, max = min, missing = "Missing required argument." }) {
+  if (positionals.length < min) {
+    fail({
+      code: "BAD_USAGE",
+      message: missing,
+      hint: command,
+    });
+  }
+  if (positionals.length > max) {
+    fail({
+      code: "BAD_USAGE",
+      message: `Unexpected argument for ${command}: ${positionals[max]}`,
+      hint: `Use \`${command}\`.`,
+    });
+  }
+  return positionals;
+}
+
 function parsePositiveInt(value, flag) {
-  const parsed = Number(value);
-  if (!Number.isInteger(parsed) || parsed < 1) {
+  if (typeof value !== "string" || !/^\d+$/.test(value)) {
+    fail({
+      code: "BAD_USAGE",
+      message: `${flag} must be a positive integer.`,
+      details: { flag, value },
+    });
+  }
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isSafeInteger(parsed) || parsed < 1) {
     fail({
       code: "BAD_USAGE",
       message: `${flag} must be a positive integer.`,

package/lib/domains.mjs

@@ -1,6 +1,7 @@
 import { resolveProjectId } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
+import { assertKnownFlags, flagValue, normalizeArgv, positionalArgs } from "./argparse.mjs";
 
 const HELP = `run402 domains — Manage custom domains
 
@@ -94,14 +95,15 @@ Examples:
 `,
 };
 
-function parseProjectFlag(args) {
-  let project = null;
-  const rest = [];
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--project" && args[i + 1]) { project = args[++i]; }
-    else { rest.push(args[i]); }
-  }
-  return { project, rest };
+function parseProjectFlag(args, extraKnown = []) {
+  const parsedArgs = normalizeArgv(args);
+  const valueFlags = ["--project"];
+  assertKnownFlags(parsedArgs, [...valueFlags, ...extraKnown, "--help", "-h"], valueFlags);
+  return {
+    project: flagValue(parsedArgs, "--project"),
+    rest: positionalArgs(parsedArgs, valueFlags),
+    args: parsedArgs,
+  };
 }
 
 async function add(args) {
@@ -115,6 +117,9 @@ async function add(args) {
       hint: "run402 domains add <domain> <subdomain_name> [--project <id>]",
     });
   }
+  if (rest.length > 2) {
+    fail({ code: "BAD_USAGE", message: `Unexpected argument for domains add: ${rest[2]}` });
+  }
   const projectId = resolveProjectId(project);
   try {
     const data = await getSdk().domains.add(projectId, domain, subdomainName);
@@ -153,6 +158,9 @@ async function status(args) {
       hint: "run402 domains status <domain> [--project <id>]",
     });
   }
+  if (rest.length > 1) {
+    fail({ code: "BAD_USAGE", message: `Unexpected argument for domains status: ${rest[1]}` });
+  }
   const projectId = resolveProjectId(project);
   try {
     const data = await getSdk().domains.status(projectId, domain);
@@ -163,8 +171,8 @@ async function status(args) {
 }
 
 async function deleteDomain(args) {
-  const { project, rest } = parseProjectFlag(args);
-  const domain = rest.find((a) => !a.startsWith("--"));
+  const { project, rest, args: parsedArgs } = parseProjectFlag(args, ["--confirm"]);
+  const domain = rest[0];
   if (!domain) {
     fail({
       code: "BAD_USAGE",
@@ -172,7 +180,10 @@ async function deleteDomain(args) {
       hint: "run402 domains delete <domain> --confirm [--project <id>]",
     });
   }
-  if (!Array.isArray(args) || !args.includes("--confirm")) {
+  if (rest.length > 1) {
+    fail({ code: "BAD_USAGE", message: `Unexpected argument for domains delete: ${rest[1]}` });
+  }
+  if (!parsedArgs.includes("--confirm")) {
     fail({
       code: "CONFIRMATION_REQUIRED",
       message: `Destructive: releasing custom domain '${domain}' detaches it from this project and clears its DNS/SSL configuration. This is irreversible. Re-run with --confirm to proceed.`,

package/lib/functions.mjs

@@ -5,6 +5,7 @@ import { reportSdkError, fail } from "./sdk-errors.mjs";
 import { assertKnownFlags, hasHelp, normalizeArgv, parseIntegerFlag, validateRegularFile } from "./argparse.mjs";
 
 const FUNCTION_LOG_REQUEST_ID_RE = /^req_[A-Za-z0-9_-]{4,128}$/;
+const FUNCTION_LOG_TAIL_MAX = 1000;
 
 const HELP = `run402 functions — Manage serverless functions
 
@@ -180,7 +181,7 @@ async function deploy(projectId, name, args) {
     if (args[i] === "--file" && args[i + 1]) opts.file = args[++i];
     if (args[i] === "--timeout") opts.timeout = parseIntegerFlag("--timeout", args[++i], { min: 1 });
     if (args[i] === "--memory") opts.memory = parseIntegerFlag("--memory", args[++i], { min: 1 });
-    if (args[i] === "--deps" && args[i + 1]) opts.deps = args[++i].split(",");
+    if (args[i] === "--deps" && args[i + 1]) opts.deps = parseDepsFlag(args[++i]);
     if (args[i] === "--schedule" && i + 1 < args.length) opts.schedule = args[++i];
   }
   if (!opts.file) {
@@ -239,7 +240,7 @@ async function logs(projectId, name, args) {
   let requestId = undefined;
   let follow = false;
   for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--tail") tail = parseIntegerFlag("--tail", args[++i], { min: 1 });
+    if (args[i] === "--tail") tail = parseIntegerFlag("--tail", args[++i], { min: 1, max: FUNCTION_LOG_TAIL_MAX });
     if (args[i] === "--since" && args[i + 1]) since = args[++i];
     if (args[i] === "--request-id" && args[i + 1]) requestId = args[++i];
     if (args[i] === "--follow") follow = true;
@@ -360,6 +361,13 @@ async function update(projectId, name, args) {
     if (args[i] === "--timeout") timeout = parseIntegerFlag("--timeout", args[++i], { min: 1 });
     if (args[i] === "--memory") memory = parseIntegerFlag("--memory", args[++i], { min: 1 });
   }
+  if (scheduleRemove && schedule !== undefined) {
+    fail({
+      code: "BAD_USAGE",
+      message: "--schedule and --schedule-remove are mutually exclusive",
+      details: { flags: ["--schedule", "--schedule-remove"] },
+    });
+  }
 
   const updateOpts = {};
   if (scheduleRemove || schedule === "") {
@@ -385,8 +393,10 @@ async function update(projectId, name, args) {
   }
 }
 
-async function list(projectId) {
+async function list(projectId, args = []) {
   assertRequiredProject(projectId, "run402 functions list <project_id>");
+  assertKnownFlags(args, ["--help", "-h"]);
+  assertNoExtraPositionals(args, "run402 functions list <project_id>");
   try {
     const data = await getSdk().functions.list(projectId);
     console.log(JSON.stringify(data, null, 2));
@@ -395,8 +405,10 @@ async function list(projectId) {
   }
 }
 
-async function deleteFunction(projectId, name) {
+async function deleteFunction(projectId, name, args = []) {
   assertRequiredProjectAndName(projectId, name, "run402 functions delete <project_id> <name>");
+  assertKnownFlags(args, ["--help", "-h"]);
+  assertNoExtraPositionals(args, "run402 functions delete <project_id> <name>");
   try {
     await getSdk().functions.delete(projectId, name);
     console.log(JSON.stringify({ status: "ok", message: `Function '${name}' deleted.` }));
@@ -417,8 +429,8 @@ export async function run(sub, args) {
     case "invoke": await invoke(args[0], args[1], args.slice(2)); break;
     case "logs":   await logs(args[0], args[1], args.slice(2)); break;
     case "update": await update(args[0], args[1], args.slice(2)); break;
-    case "list":   await list(args[0]); break;
-    case "delete": await deleteFunction(args[0], args[1]); break;
+    case "list":   await list(args[0], args.slice(1)); break;
+    case "delete": await deleteFunction(args[0], args[1], args.slice(2)); break;
     default:
       console.error(`Unknown subcommand: ${sub}\n`);
       console.log(HELP);
@@ -426,6 +438,30 @@ export async function run(sub, args) {
   }
 }
 
+function parseDepsFlag(value) {
+  const raw = String(value);
+  const deps = raw.split(",").map((entry) => entry.trim());
+  if (deps.some((entry) => entry === "")) {
+    fail({
+      code: "BAD_USAGE",
+      message: "--deps must be a comma-separated list of non-empty package specs",
+      details: { flag: "--deps", value: raw },
+    });
+  }
+  return deps;
+}
+
+function assertNoExtraPositionals(args, usage) {
+  if (args.length > 0) {
+    fail({
+      code: "BAD_USAGE",
+      message: `Unexpected argument: ${args[0]}`,
+      hint: usage,
+      details: { argument: args[0] },
+    });
+  }
+}
+
 function assertRequiredProject(projectId, usage) {
   if (!projectId || String(projectId).startsWith("-")) {
     fail({

package/lib/image.mjs

@@ -1,6 +1,7 @@
 import { writeFileSync } from "fs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
+import { assertAllowedValue, assertKnownFlags, flagValue, normalizeArgv, positionalArgs } from "./argparse.mjs";
 
 const HELP = `run402 image — Generate AI images via x402 micropayments
 
@@ -71,15 +72,22 @@ export async function run(sub, args) {
     process.exit(1);
   }
 
-  const opts = { prompt: null, aspect: "square", output: null };
-  let i = 0;
-  if (i < args.length && !args[i].startsWith("--")) opts.prompt = args[i++];
-  while (i < args.length) {
-    if (args[i] === "--help" || args[i] === "-h") { console.log(SUB_HELP[sub] || HELP); process.exit(0); }
-    else if (args[i] === "--aspect" && args[i + 1]) { opts.aspect = args[++i]; }
-    else if (args[i] === "--output" && args[i + 1]) { opts.output = args[++i]; }
-    i++;
+  const parsedArgs = normalizeArgv(args);
+  const valueFlags = ["--aspect", "--output"];
+  assertKnownFlags(parsedArgs, [...valueFlags, "--help", "-h"], valueFlags);
+  const positionals = positionalArgs(parsedArgs, valueFlags);
+  if (positionals.length > 1) {
+    fail({
+      code: "BAD_USAGE",
+      message: `Unexpected argument for image generate: ${positionals[1]}`,
+      hint: 'Quote multi-word prompts, e.g. run402 image generate "your prompt".',
+    });
   }
+  const opts = {
+    prompt: positionals[0] ?? null,
+    aspect: flagValue(parsedArgs, "--aspect") ?? "square",
+    output: flagValue(parsedArgs, "--output"),
+  };
 
   if (!opts.prompt) {
     fail({
@@ -88,6 +96,7 @@ export async function run(sub, args) {
       hint: 'run402 image generate "your prompt"',
     });
   }
+  assertAllowedValue(opts.aspect, ["square", "landscape", "portrait"], "--aspect");
 
   try {
     const data = await getSdk().ai.generateImage({ prompt: opts.prompt, aspect: opts.aspect });

package/lib/message.mjs

@@ -1,6 +1,7 @@
 import { allowanceAuthHeaders } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
+import { assertKnownFlags, normalizeArgv } from "./argparse.mjs";
 
 const HELP = `run402 message — Send messages to Run402 developers
 
@@ -88,5 +89,7 @@ export async function run(sub, args) {
     console.log(HELP);
     process.exit(1);
   }
-  await send(args.join(" "));
+  const parsedArgs = normalizeArgv(args);
+  assertKnownFlags(parsedArgs, ["--help", "-h"]);
+  await send(parsedArgs.join(" "));
 }

package/lib/secrets.mjs

@@ -1,7 +1,7 @@
 import { readFileSync } from "fs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
-import { validateRegularFile } from "./argparse.mjs";
+import { assertKnownFlags, flagValue, normalizeArgv, positionalArgs, validateRegularFile } from "./argparse.mjs";
 
 const HELP = `run402 secrets — Manage project secrets
 
@@ -78,15 +78,20 @@ Examples:
 };
 
 async function set(projectId, key, args = []) {
-  let file = null;
-  let value = null;
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--file" && args[i + 1]) { file = args[++i]; }
-    else if (!value && !args[i].startsWith("--")) { value = args[i]; }
+  const parsedArgs = normalizeArgv(args);
+  const valueFlags = ["--file"];
+  assertKnownFlags(parsedArgs, [...valueFlags, "--help", "-h"], valueFlags);
+  const values = positionalArgs(parsedArgs, valueFlags);
+  if (values.length > 1) {
+    fail({ code: "BAD_USAGE", message: `Unexpected argument for secrets set: ${values[1]}` });
+  }
+  const file = flagValue(parsedArgs, "--file");
+  if (file && values.length > 0) {
+    fail({ code: "BAD_USAGE", message: "Provide either an inline value or --file, not both." });
   }
   if (file) validateRegularFile(file, "--file");
-  const val = file ? readFileSync(file, "utf-8") : value;
-  if (!val) {
+  const val = file ? readFileSync(file, "utf-8") : values.length === 1 ? values[0] : undefined;
+  if (val === undefined) {
     fail({
       code: "BAD_USAGE",
       message: "Missing secret value.",
@@ -101,7 +106,13 @@ async function set(projectId, key, args = []) {
   }
 }
 
-async function list(projectId) {
+async function list(projectId, args = []) {
+  const parsedArgs = normalizeArgv(args);
+  assertKnownFlags(parsedArgs, ["--help", "-h"]);
+  const extra = positionalArgs(parsedArgs);
+  if (extra.length > 0) {
+    fail({ code: "BAD_USAGE", message: `Unexpected argument for secrets list: ${extra[0]}` });
+  }
   try {
     const data = await getSdk().secrets.list(projectId);
     const sanitized = {
@@ -117,7 +128,13 @@ async function list(projectId) {
   }
 }
 
-async function deleteSecret(projectId, key) {
+async function deleteSecret(projectId, key, args = []) {
+  const parsedArgs = normalizeArgv(args);
+  assertKnownFlags(parsedArgs, ["--help", "-h"]);
+  const extra = positionalArgs(parsedArgs);
+  if (extra.length > 0) {
+    fail({ code: "BAD_USAGE", message: `Unexpected argument for secrets delete: ${extra[0]}` });
+  }
   try {
     await getSdk().secrets.delete(projectId, key);
     console.log(JSON.stringify({ status: "ok", message: `Secret '${key}' deleted.` }));
@@ -134,8 +151,8 @@ export async function run(sub, args) {
   }
   switch (sub) {
     case "set":    await set(args[0], args[1], args.slice(2)); break;
-    case "list":   await list(args[0]); break;
-    case "delete": await deleteSecret(args[0], args[1]); break;
+    case "list":   await list(args[0], args.slice(1)); break;
+    case "delete": await deleteSecret(args[0], args[1], args.slice(2)); break;
     default:
       console.error(`Unknown subcommand: ${sub}\n`);
       console.log(HELP);