Skip to main content
An app is provisioned by a project’s declaration, not by a verb: naive up creates it, writes its secrets, connects its domains and ships its deploy_dir. See naive. Two commands write: create makes an app that has no declaration — the quickest way to a database is vetta app create <name> --type fullstack — and deploy ships a directory to it. Secrets, domains, updates and deletion stay with the declaration, which owns every app it names; an app made here can be adopted by one later with naive up --adopt. The rest read. What a declaration cannot do for you is wait: an app’s asynchronous halves advance on read, so naive up returns as soon as the deployment is accepted and the build is still running. These commands are the poll. Reads require the agents:read scope; create and deploy require agents:write.

Commands

create

Idempotent on the name: creating an app that exists returns it. The name is a lowercase DNS label.

deploy

Collects every file under <dir> — skipping node_modules, .git, dist subdirectories and any .env* file — and ships the tree as one deployment carrying a hash of its contents, exactly as naive up does for a deploy_dir. The build runs after the command returns; vetta app deployments is the poll.

list

show

The project field is the ownership stamp naive up compares before it writes anything. An app whose stamp names a different project is refused by an apply until you rename it in the config or re-run with --adopt.

deployments

Newest first. Each row carries the content_hash of the tree that was shipped, which is what the next naive up compares the directory against to decide whether to upload at all — equal means the app reports unchanged and nothing is sent. This is the command to run after naive up when a site is not live yet. The apply returns once the deployment is accepted; the build runs after that, and its state only advances on a read.

secrets

Secret values are write-only on the platform and never come back — not here, not anywhere. What this lists is each secret’s name and an opaque hash of its value, which is exactly what lets an apply tell a changed secret from an unchanged one without ever seeing one. Secrets that exist on the app but are absent from the declaration’s env are reported by naive up as unmanaged secrets: … and left alone; this command is how you see them in full.

domains

The domain must already exist at vetta domain list — connecting is pointing, never registering. See vetta domain.