CLI deployment workflow

Install and authenticate

$ npx deploylet login
$ npx deploylet whoami
$ npx deploylet workspaces

Login opens a short-lived device authorization in Deploylet Console. The resulting revocable session is kept in a user-only local file. Use --no-browser on remote machines and open the printed URL yourself.

Create and link an app

$ npx deploylet apps create acme-site --workspace acme --name "Acme site"
$ npx deploylet init acme-site --workspace acme --yes
$ npx deploylet link --workspace acme --app acme-site

Deploy and release

$ npx deploylet deploy --dry-run
$ npx deploylet deploy --json
$ npx deploylet deployments get <deployment-id> --workspace acme
$ npx deploylet releases create <deployment-id> --workspace acme --app acme-site

A deployment is immutable and does not change traffic. A release atomically makes a ready deployment current. Use deploylet releases rollback to return to the previous deployment, ordeploylet deploy --release for the explicit fast path.

Configuration

app = "acme-site"
workspace = "acme"
environment = "production"
region = "auto"

[deploy]
directory = "dist"
source_maps = false
exclude = ["drafts/**", "*.map"]

deploylet.toml is the only project configuration file. Deploylet does not load JSON, JavaScript, YAML, or .deployletignore, and the deployment directory must stay inside the configuration directory. Exclude patterns use Deploylet's gitignore-style glob subset relative to the deployment directory; negation patterns are not supported.

Built-in safety exclusions always win and cover dependencies, VCS metadata, environment files, cloud credentials, registry credentials, and private keys. Config exclusions extend those defaults rather than replacing them. Deploylet does not blanket-exclude dot- or dash-prefixed names, so content such as .well-known/**remains eligible for deployment.

Endpoint safety

The CLI defaults to the Deploylet production API. Authentication requires HTTPS except for loopback development, credentials are bound to the API origin that issued them, and logout revokes the session remotely. CI can provide a scoped service credential through DEPLOYLET_TOKEN instead of browser login.

Agents and scripts

Add --json to identity, discovery, linking, creation, configuration, deployment, and release commands. API errors include a stable code, HTTP status, request ID, and retryability signal. Release commands accept an expected current deployment so agents can detect concurrent traffic changes instead of overwriting them.