repster 0.1.0__py3-none-any.whl

repster/.agents/skills/repster/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: repster
+description: >
+  Reference for using Repster, a lightweight scheduling and observability layer for dlt pipelines, with an AI-ready CLI.
+  Use when writing, deploying, or debugging Repster flows, or when asked about rp commands, secrets, scheduling, or cloud execution.
+  Triggers: "repster", "rp", "rp deploy", "rp run", "rp flow", "dlt pipeline", "repster cloud", "schedule dlt", "AI agent dlt"
+---
+
+# Repster
+
+Repster adds lightweight scheduling, run history, and a web UI to dlt pipelines. Define flows as code, run them locally, and deploy to managed serverless workers (one isolated worker per run). Every operation is an `rp` CLI command, so coding agents can operate all of it.
+
+```bash
+uv add repster
+```
+
+Quick pattern:
+
+```python
+import dlt
+import repster as rp
+
+@rp.flow(schedule="0 * * * *")
+def my_pipeline():
+    pipeline = dlt.pipeline(destination="duckdb")
+    pipeline.run(my_source())
+```
+
+```bash
+rp run my_pipeline          # local
+rp deploy && rp run --cloud my_pipeline   # cloud
+```
+
+## Reference Index
+
+### Tutorials
+
+- `references/deploy-to-cloud.md`
+- `references/quickstart.md`
+
+### How-to guides
+
+- `references/manage-api-keys.md`
+- `references/manage-secrets.md`
+- `references/manage-team.md`
+- `references/schedule-a-flow.md`
+- `references/use-with-coding-agents.md`
+- `references/view-logs.md`
+
+### Reference
+
+- `references/cli.md`
+- `references/cloud-api.md`
+- `references/configuration.md`
+
+### Explanation
+
+- `references/how-repster-works.md`
+- `references/open-core-model.md`
+- `references/pricing.md`
+- `references/why-repster.md`
+
+### Other
+
+- `references/index.md`

repster/.agents/skills/repster/references/cli.md

@@ -0,0 +1,59 @@
+# CLI reference
+
+All commands are available via `rp` (or `repster`). Cloud commands walk you through login/registration inline if you haven't authenticated yet; you never need to run `rp login` before your first `rp deploy`.
+
+## Local commands
+
+| Command | Description |
+|---------|-------------|
+| `rp dev` | Start the local scheduler; fires cron-scheduled flows according to their `@rp.flow(schedule=...)` expressions |
+| `rp run <flow>` | Run a flow now (local execution) |
+| `rp list` | List all discovered flows with their schedule and next run time |
+| `rp status [<flow>] [--profile]` | Show last N runs and next scheduled run; merges local and cloud runs when a profile is configured |
+| `rp logs [--flow <name>] [--run <id>] [--profile]` | View captured log output for a run |
+| `rp retry [--flow <name>] [--run <id>] [--profile]` | Re-run a flow, linked to the run it retries |
+
+Schedules are declared in `@rp.flow(schedule=...)` in code, not set via the CLI.
+
+## Cloud commands
+
+| Command | Description |
+|---------|-------------|
+| `rp login [--token rpk_...] [--profile NAME]` | Authenticate with Repster Cloud; interactive email-first flow: logs in if you have an account, registers if you don't. Writes a profile to `~/.repster/config.toml`. Pass `--token rpk_...` to skip interactive flow (for CI). |
+| `rp deploy [--profile NAME]` | Package the project and push to the control plane; immutable and content-addressed; deploying the same code twice is a no-op |
+| `rp run --cloud <flow> [--profile NAME]` | Trigger a cloud run of the latest deployment; fails with a helpful message if no deployment exists |
+| `rp secrets push [--profile NAME]` | Read `.env` and store its values in the cloud secrets vault |
+| `rp secrets list [--profile NAME]` | List secret key names stored in the vault for this project (values are never returned) |
+| `rp secrets delete KEY [--yes] [--profile NAME]` | Delete a secret from the vault for this project; prompts for confirmation unless `--yes` |
+
+## Org management
+
+| Command | Description |
+|---------|-------------|
+| `rp org list [--profile]` | List all orgs you belong to (slug, name, role, joined date) |
+| `rp org switch <slug>` | Set the default profile to a different org |
+| `rp org invite <email> [--role member\|admin] [--profile]` | Invite a user; creates an account with a temporary password if needed |
+| `rp org members [--profile]` | List members (email, role, joined date) |
+| `rp org members promote <email> [--profile]` | Promote a member to admin |
+| `rp org members remove <email> [--yes] [--profile]` | Remove a member; `--yes` skips confirmation |
+
+## Key management
+
+| Command | Description |
+|---------|-------------|
+| `rp keys list [--profile]` | List API keys for this org (prefix, name, status, last-used, created) |
+| `rp keys create [--name NAME] [--profile]` | Create a new API key; raw key is printed once |
+| `rp keys revoke <key-id-or-prefix> [--yes] [--profile]` | Revoke a key; `--yes` skips confirmation |
+
+## Global flags
+
+All commands that talk to the cloud accept:
+
+| Flag | Description |
+|------|-------------|
+| `--profile NAME` | Use a named profile from `~/.repster/config.toml` |
+| `--service-url URL` | Override the Repster Cloud URL for this invocation |
+
+Environment variables `REPSTER_SERVICE_URL` and `REPSTER_API_TOKEN` are also accepted and override the profile.
+
+See [Configuration](configuration.md) for the full resolution chain.

repster/.agents/skills/repster/references/cloud-api.md

@@ -0,0 +1,83 @@
+# Cloud API
+
+The REST API exposed by Repster Cloud. Used by the Repster CLI and the Repster Cloud UI. You can call it directly for automation or integration.
+
+**Base URL**: `https://repster.online/api` — the paths below are relative to it. (The browser UI is served at `https://repster.online/`; `GET /health` lives at the host root, outside `/api`.)
+
+**Auth**: API key in the `Authorization: Bearer rpk_...` header. Keys are org-scoped, so all endpoints automatically scope to the calling key's org.
+
+**Client header**: `X-Repster-Client: <version>`, sent automatically by the CLI.
+
+**Async runs**: `POST /runs` returns a `run_id` immediately. Poll `GET /runs/{id}` or stream logs via `GET /runs/{id}/logs?follow=true`.
+
+## Auth endpoints (no token required)
+
+| Method | Path | Body | Returns |
+|--------|------|------|---------|
+| `POST` | `/auth/register` | `{email, password, org_slug, org_name}` | `{org, api_key}` (raw key shown once) |
+| `POST` | `/auth/login` | `{email, password, org_slug?}` | `{org, api_key}` or `{needs_org: true, orgs: [...]}` |
+| `POST` | `/auth/create-org` | `{email, password, org_slug, org_name}` | `{org, api_key}` |
+
+When a user belongs to multiple orgs and `org_slug` is omitted from `POST /auth/login`, the response includes `orgs` listing all their orgs. Re-POST with `org_slug` to select one.
+
+## User identity
+
+| Method | Path | Returns |
+|--------|------|---------|
+| `GET` | `/users/me` | `{user_id, email, created_at}` |
+| `GET` | `/users/me/orgs` | `[{org_id, slug, name, role, joined_at}]` |
+
+## Org & key management
+
+| Method | Path | Body | Returns |
+|--------|------|------|---------|
+| `GET` | `/orgs/me` | — | `{org_id, slug, name, created_at}` |
+| `POST` | `/orgs` | `{slug, name}` | `{org, api_key}` |
+| `POST` | `/orgs/{org_id}/keys` | `{name}` | `{key_id, raw_key, ...}` (raw key shown once) |
+| `GET` | `/orgs/{org_id}/keys` | — | `[{key_id, name, key_prefix, created_at, last_used_at, revoked_at}]` |
+| `DELETE` | `/orgs/{org_id}/keys/{key_id}` | — | `{ok: true}` |
+
+## Member management (admin only)
+
+| Method | Path | Body | Returns |
+|--------|------|------|---------|
+| `GET` | `/orgs/{org_id}/members` | — | `[{user_id, email, role, created_at}]` |
+| `POST` | `/orgs/{org_id}/members` | `{email, role?}` | `{user_id, email, role, temp_password?}` (201) |
+| `PATCH` | `/orgs/{org_id}/members/{user_id}` | `{role}` | updated member |
+| `DELETE` | `/orgs/{org_id}/members/{user_id}` | — | `{ok: true}` |
+
+`role` defaults to `"member"`. Valid values: `"admin"`, `"member"`. Cannot remove or demote the last admin (409). Cannot remove yourself (409).
+
+## Deployments (admin only)
+
+| Method | Path | Body | Returns |
+|--------|------|------|---------|
+| `POST` | `/deployments` | multipart: `manifest` + `archive` | `{deployment_id, code_digest}` |
+| `GET` | `/deployments?project=` | — | deployments for the caller's org, latest first |
+
+Deployments are immutable and content-addressed, so uploading the same archive twice returns the existing deployment.
+
+## Runs
+
+| Method | Path | Body / Params | Returns |
+|--------|------|---------------|---------|
+| `POST` | `/runs` | `{project, flow, trigger, retry_of?}` | `{run_id, status: "running"}` |
+| `GET` | `/runs?project=&flow=&limit=` | — | run records for the caller's org |
+| `GET` | `/runs/{id}` | — | `{run_id, status, trigger, deployment_id, started_at, finished_at, rows_loaded, summary, retry_of}` |
+| `GET` | `/runs/{id}/logs` | `?follow=bool` | full log text; SSE stream when `follow=true` |
+
+`POST /runs` returns 404 with a helpful message if the flow has never been deployed.
+
+## Secrets (admin only)
+
+| Method | Path | Body | Returns |
+|--------|------|------|---------|
+| `PUT` | `/projects/{project}/secrets` | `{KEY: VALUE, ...}` | `{ok: true}` |
+| `GET` | `/projects/{project}/secrets` | — | key names only (values are never returned) |
+| `DELETE` | `/projects/{project}/secrets/{key}` | — | `{ok: true}` |
+
+## Health
+
+| Method | Path | Returns |
+|--------|------|---------|
+| `GET` | `/health` | `{ok: true}` (no auth required) |

repster/.agents/skills/repster/references/configuration.md

@@ -0,0 +1,55 @@
+# Configuration
+
+How repster knows which Repster Cloud endpoint to connect to, as whom, and about which project. Standard CLI pattern: global per-user credentials, per-repo non-secret pointers, env-var overrides for CI.
+
+## Resolution chain
+
+Settings are resolved in priority order (highest first):
+
+1. **CLI flags**: `--profile`, `--service-url`
+2. **Environment variables**: `REPSTER_SERVICE_URL`, `REPSTER_API_TOKEN`
+3. **Project config**: `[tool.repster]` in `pyproject.toml` (non-secret; safe to commit)
+4. **Global profiles**: `~/.repster/config.toml` (credentials; never commit this)
+
+## Global credentials: `~/.repster/config.toml`
+
+Written by `rp login`. Edit it directly if needed.
+
+```toml
+[profiles.default]
+service_url = "https://repster.online"
+token = "rpk_K7mXwQ3..."
+
+[profiles.prod]
+service_url = "https://repster.online"
+token = "rpk_..."
+```
+
+Use `rp login --profile <name>` to add a named profile. Use `--profile <name>` on any cloud command to select it.
+
+## Project config: `pyproject.toml`
+
+Your project is already a uv project, so `pyproject.toml` exists. By default nothing needs configuring: the project name defaults to `[project].name` and the profile defaults to `default`.
+
+Override when needed:
+
+```toml
+[tool.repster]
+project = "acme-pipelines"   # defaults to [project].name
+profile = "prod"              # defaults to "default"
+```
+
+Never put tokens in `pyproject.toml`; use `~/.repster/config.toml` or environment variables.
+
+## Environment variables
+
+| Variable | Description |
+|----------|-------------|
+| `REPSTER_SERVICE_URL` | Override the Repster Cloud URL |
+| `REPSTER_API_TOKEN` | Override the API token (useful for CI) |
+
+Example CI setup:
+
+```bash
+REPSTER_API_TOKEN=rpk_... rp deploy
+```

repster/.agents/skills/repster/references/deploy-to-cloud.md

@@ -0,0 +1,74 @@
+---
+description: Deploy dlt pipelines to Repster Cloud with managed scheduling, secrets, and serverless workers, using the same code you ran locally.
+---
+
+# Deploy to cloud
+
+Run your flows on Repster Cloud: your schedules fire without your machine on, and each run gets its own isolated worker, created on demand. The pipeline code is exactly what you ran locally.
+
+## Prerequisites
+
+- A working local flow (see [Quickstart](quickstart.md))
+- A Repster account (you'll create one during `rp login` if you don't have one yet)
+
+## 1. Authenticate
+
+```bash
+rp login
+```
+
+Repster walks you through account creation or login interactively. Your credentials are saved to `~/.repster/config.toml`. You never need to run `rp login` before deploying; any cloud command that needs auth will walk you through it inline.
+
+## 2. Push secrets
+
+If your pipeline uses environment variables (API keys, database credentials), push them before deploying:
+
+```bash
+rp secrets push
+```
+
+This reads your `.env` file and stores the values, encrypted, in the Repster Cloud vault. See [Manage secrets](../how-tos/manage-secrets.md) for details.
+
+## 3. Deploy
+
+```bash
+rp deploy
+```
+
+Repster packages your project (source files + `uv.lock`), uploads it, and registers your flows. Deployments are immutable; see [How Repster works](../explanation/how-repster-works.md#deployments).
+
+## 4. Trigger a cloud run
+
+```bash
+rp run --cloud hackernews_top
+```
+
+The run is dispatched to an isolated cloud worker. You get the run ID immediately; the flow executes asynchronously.
+
+## 5. Monitor the run
+
+```bash
+rp status                         # last N runs (local + cloud, combined)
+rp logs --run <run-id>            # full log output
+```
+
+## 6. View in the UI
+
+Log in to the Repster Cloud UI ([repster.online](https://repster.online)) to see runs, logs, deployments, and secrets in one place.
+
+## Re-deploying
+
+After changing your pipeline code:
+
+```bash
+rp deploy        # upload new version
+rp run --cloud hackernews_top   # runs the latest deployment
+```
+
+Old deployments are preserved; runs always reference the deployment they were dispatched against.
+
+## Next steps
+
+- **[Manage secrets →](../how-tos/manage-secrets.md)**
+- **[Schedule a flow →](../how-tos/schedule-a-flow.md)**
+- **[Manage API keys →](../how-tos/manage-api-keys.md)**

repster/.agents/skills/repster/references/how-repster-works.md

@@ -0,0 +1,74 @@
+---
+description: Repster's execution model: flow discovery, local vs. cloud runs, immutable deployments, secrets injection, and observability.
+---
+
+# How Repster works
+
+Repster adds scheduling, secrets management, cloud execution, and observability on top of [dlt](https://dlthub.com), without changing how you write pipelines.
+
+## The core idea
+
+A Repster project is a Python package with flows:
+
+```python
+@rp.flow(schedule="0 * * * *")
+def my_pipeline():
+    pipeline = dlt.pipeline(destination="duckdb")
+    pipeline.run(my_source())
+```
+
+Repster discovers flows by scanning your project files for `@rp.flow()` decorators. Each flow is a callable that runs a dlt pipeline. The decorator adds a name, an optional schedule, and hooks into the Repster execution model.
+
+## Local vs. cloud execution
+
+Repster uses the same `@rp.flow()` code for both local and cloud execution; the runner is swapped, not the flow definition.
+
+**Local**: `rp run <flow>` or `rp dev` (scheduler). Runs in your local Python environment, writes state to `.repster/` (SQLite).
+
+**Cloud**: `rp run --cloud <flow>`. Dispatches to an isolated worker managed by Repster. The worker runs the same `@rp.flow()` code in an environment built from your `uv.lock`.
+
+## Deployments
+
+`rp deploy` packages your project into a source archive with your `uv.lock` and uploads it to the Repster control plane. Each deployment is:
+
+- **Immutable**: the archive is content-addressed by `sha256`. Deploying the same code twice is a no-op.
+- **Complete**: the lockfile is included so workers build a reproducible environment.
+
+Cloud runs always execute against a specific deployment. `rp run --cloud` uses the latest.
+
+## Secrets
+
+Secrets (API keys, database credentials) live in `.env` locally and in the Repster secrets vault in the cloud.
+
+`rp secrets push` reads `.env` and stores values encrypted in the vault. At run time, the worker receives the secrets as environment variables, never in logs or run records.
+
+Repster uses dlt's env-var naming convention, so the same secrets work locally and in the cloud without any code changes.
+
+## Observability
+
+Every run produces a log stream captured from dlt's output. Logs include:
+
+- dlt pipeline progress (rows loaded, tables updated)
+- Any `print()` / `logging` output from your code
+- Full stack traces on failure
+
+Runs are stored in the control plane with status, timing, and row counts. Local runs are stored in `.repster/` and merged with cloud runs in `rp status`.
+
+## What belongs in a flow
+
+Keep the flow body a thin wrapper: construct a `dlt.pipeline(...)` and call `.run(...)`. Extraction logic (HTTP calls, pagination, parsing) belongs inside your `@dlt.resource`/`@dlt.source` functions, where dlt already expects arbitrary Python. One flow run should map to one observable dlt pipeline run.
+
+Repster is not a general-purpose script or task runner. If you need to run arbitrary non-dlt workloads on a schedule, use a dedicated orchestrator (Dagster, Airflow, plain cron) instead of stretching a flow to cover it. See [Why Repster?](why-repster.md) for how the two fit together.
+
+## What Repster owns and what you own
+
+| Repster owns | You own |
+|--------------|---------|
+| Execution (cloud workers) | Pipeline code |
+| Scheduling (cron dispatch) | Connectors and sources |
+| Secrets injection | Destination schema |
+| Log capture and retention | `.env` secrets |
+| Run state and history | `pyproject.toml` config |
+| Infrastructure | |
+
+Your pipeline code runs unchanged. Repster adds the operational layer around it.

repster/.agents/skills/repster/references/index.md

@@ -0,0 +1,104 @@
+---
+description: Repster adds lightweight scheduling, run history, and an AI-ready CLI to dlt pipelines. Run them locally for free, or on managed serverless workers.
+---
+
+# Repster
+
+**Lightweight scheduling and observability for dlt pipelines.**
+
+[dlt](https://dlthub.com) loads your data; Repster runs it. Add one decorator to an existing dlt pipeline and get a scheduler, run history, and a web UI, all behind an AI-ready CLI that does everything, so your coding agent can drive it too.
+
+```python
+import dlt
+import repster as rp # add this
+
+@rp.flow() # add this
+def flow_name():
+    """ Your dlt pipeline code goes here """
+    ...
+```
+
+```bash
+uv add repster
+```
+
+## How it works
+
+Illustrative example: an hourly schedule around a dlt pipeline:
+
+```python
+import dlt
+import repster as rp
+
+@rp.flow(schedule="0 * * * *")   # run hourly
+def github_stars():
+    @dlt.resource
+    def stars():
+        yield from fetch_stars("my-org/my-repo")
+
+    pipeline = dlt.pipeline(destination="duckdb")
+    pipeline.run(stars())
+```
+
+Run it locally:
+
+```bash
+rp run github_stars       # run now
+rp dev                    # start the scheduler and local UI
+```
+
+## What you get
+
+Everything here is open source (Apache 2.0) and runs entirely on your machine:
+
+* **An AI ready CLI.** Everything is an `rp` command, from running flows and viewing logs to deploying, managing secrets, and more. The web UI is an alternative view, never the only way.
+
+* **One decorator.** `@rp.flow()` wraps your pipeline while leaving dlt fully usable underneath. Its state, destinations, and tooling all work as before.
+
+* **Just run `rp dev`.** Repster schedules your flows, records every run, and serves a web UI where you can trigger flows, watch logs, and inspect run history.
+
+Wondering how this compares to cron, Airflow, or Airbyte? See **[Why Repster?](explanation/why-repster.md)**
+
+Because every operation is available from the CLI, AI coding agents can drive the entire development loop. Write a flow, run it, inspect the logs, fix the code, retry the run, and deploy, all without needing a browser.
+
+Repster also ships with an agent skill, and these docs are published as [llms.txt](https://docs.repster.online/llms.txt) for agent context windows. See **[Use Repster with AI coding agents](how-tos/use-with-coding-agents.md)**.
+
+## Repster Cloud
+
+When pipelines need to run without your laptop open, deploy them:
+
+```bash
+rp deploy
+```
+
+Then flows can run on a schedule or on-demand:
+
+```bash
+rp run --cloud github_stars
+```
+
+Repster Cloud gives you:
+
+* **Serverless compute**: each run gets its own isolated worker, created on demand and gone when the run finishes. Nothing to provision, size, or keep running. Automatically scales to your workload, and you only pay for what you use.
+* **Managed scheduling**: the same cron expressions from your code, fired by the cloud.
+* **Teams and secrets**: authentication, org roles, and an encrypted secrets vault.
+* **Transparent pricing**: when metered billing launches, you'll pay for raw compute: CPU seconds, memory, storage. No seats, no rows, no MTU.
+
+Develop locally, then deploy with confidence. The same flow code you test on your machine runs in Repster Cloud, so moving from development to production is seamless.
+
+**[Deploy to cloud →](tutorials/deploy-to-cloud.md)**
+
+## Get started
+
+**[Quickstart →](tutorials/quickstart.md)**: build and run your first flow in 5 minutes
+
+**[Deploy to cloud →](tutorials/deploy-to-cloud.md)**: move from local to managed execution
+
+## Sections
+
+| Section | What you'll find |
+| ------- | --------------- |
+| [Tutorials](tutorials/quickstart.md) | Step-by-step guides for getting started |
+| [How-to guides](how-tos/manage-secrets.md) | Recipes for specific tasks |
+| [Reference](reference/cli.md) | CLI commands, configuration, and API |
+| [Explanation](explanation/why-repster.md) | Concepts and background |

repster/.agents/skills/repster/references/manage-api-keys.md

@@ -0,0 +1,58 @@
+---
+description: Create, list, and revoke Repster Cloud API keys (rpk_) for CI and programmatic access.
+---
+
+# Manage API keys
+
+API keys (`rpk_...`) authenticate CLI and programmatic access to Repster Cloud. Keys are org-scoped and can be created, listed, and revoked.
+
+## List keys
+
+```bash
+rp keys list
+rp keys list --profile prod
+```
+
+Shows key prefix, name, status, last-used date, and creation date. Key values are never shown after creation.
+
+## Create a key
+
+```bash
+rp keys create
+rp keys create --name "ci-deploy-key"
+```
+
+The raw key is printed once; copy it immediately. It cannot be retrieved again.
+
+## Revoke a key
+
+```bash
+rp keys revoke <key-id-or-prefix>
+rp keys revoke rpk_abc123 --yes    # skip confirmation prompt
+```
+
+Revoked keys are rejected immediately by Repster Cloud.
+
+## Using keys in CI
+
+Set the key as an environment variable; repster picks it up automatically:
+
+```bash
+REPSTER_API_TOKEN=rpk_... rp deploy
+```
+
+Or configure it in a named profile:
+
+```bash
+rp login --token rpk_... --profile ci
+```
+
+Then use `--profile ci` in commands that need it.
+
+## Key roles
+
+Keys inherit the role of the user who created them (see the role table in [Manage your team](manage-team.md)). Create dedicated CI keys with the minimum role needed.
+
+## Web UI
+
+Keys can also be created and revoked in the Repster Cloud UI ([repster.online](https://repster.online)) under **Settings → API Keys**.

repster/.agents/skills/repster/references/manage-secrets.md

@@ -0,0 +1,74 @@
+---
+description: Store credentials for dlt pipelines in .env locally and push them to the encrypted Repster Cloud secrets vault.
+---
+
+# Manage secrets
+
+Repster separates secrets from your pipeline code: `.env` locally, the encrypted Repster Cloud vault for cloud runs.
+
+## Local development
+
+For local runs, Repster reads secrets from a `.env` file at the root of your project. Use dlt's env-var naming convention:
+
+```properties
+SOURCES__GITHUB__ACCESS_TOKEN=ghp_...
+DESTINATION__BIGQUERY__CREDENTIALS__PROJECT_ID=my-project
+```
+
+Never commit `.env`; add it to `.gitignore`.
+
+## Pushing secrets to cloud
+
+```bash
+rp secrets push
+```
+
+Reads all key-value pairs from `.env` and stores them in the vault, encrypted at rest. At run time they're injected into the worker as environment variables, never written to logs or run records (see [How Repster works](../explanation/how-repster-works.md#secrets)).
+
+To target a specific profile:
+
+```bash
+rp secrets push --profile prod
+```
+
+## Viewing stored secrets (key names only)
+
+```bash
+rp secrets list
+```
+
+The vault returns key names only; values are never retrievable after being stored.
+
+## Rotating a secret
+
+Push the updated value; Repster overwrites the existing entry:
+
+```bash
+# update .env, then:
+rp secrets push
+```
+
+## Removing a secret
+
+```bash
+rp secrets delete SOURCES__GITHUB__ACCESS_TOKEN
+```
+
+Prompts for confirmation (pass `--yes` to skip). Secrets can also be deleted in the Repster Cloud UI ([repster.online](https://repster.online)).
+
+## CI / non-interactive environments
+
+For CI pipelines, skip the interactive login flow by passing a token directly:
+
+```bash
+REPSTER_API_TOKEN=rpk_... rp secrets push
+```
+
+Or configure it in `pyproject.toml`:
+
+```toml
+[tool.repster]
+profile = "ci"
+```
+
+And add the profile to `~/.repster/config.toml` on the CI machine.