Token auth
ARDA_TOKEN in the environment. Scoped per fleet, revocable, never written to the repo.
The arda command line treats a fleet the way git treats a repository: a project you init, releases you push, targets you deploy to, and a history you can walk backwards when a Friday deploy goes wrong.
Most days are the same shape: change something, push it, put it in front of a few devices, watch what happens. The rest of the surface exists for the days that aren't.
A small surface, deliberately — there is a portal for the things a terminal is bad at. Every command works against the fleet your workspace is linked to, or an explicit --fleet.
| Command | Purpose | Typical use |
|---|---|---|
arda login | Authenticate this machine against your account | Once per workstation |
arda init | Scaffold a project and its arda.json manifest | New application |
arda push | Build, sign, encrypt and upload a new release | Every change |
arda deploy | Roll a release out to a target, optionally in waves | Shipping |
arda status | Show what each device is running and when it last checked in | Daily |
arda rollback | Send the previous release back down the same path | When it goes wrong |
# .github/workflows/release.yml
steps:
- uses: actions/checkout@v4
- name: Build application
run: npm ci && npm run build
- name: Push release
env:
ARDA_TOKEN: ${{ secrets.ARDA_TOKEN }}
ARDA_PACK_KEY: ${{ secrets.ARDA_PACK_KEY }}
run: arda push -m "$GITHUB_SHA"
- name: Deploy to beta
run: arda deploy --channel beta --staged
{
"name": "order-kiosk",
"version": "1.4.0",
"entry": "dist/index.html",
"build": "npm run build",
"capabilities": ["db", "sync", "printer", "usb:read"],
"fleet": "order-kiosk",
"channel": "beta",
"ignore": ["*.map", "**/*.test.js"],
"bind": "installation"
}
Every command is non-interactive by default, authenticates from an environment token, exits non-zero on failure and speaks --json when you'd rather parse than read. Signing keys stay yours: the control plane never holds a private key, so a compromised account can't sign a package on your behalf.
ARDA_TOKEN in the environment. Scoped per fleet, revocable, never written to the repo.
The pack key signs on your machine or your runner. It is never uploaded, and the server never needs it.
The CLI is the outer loop — build it, sign it, put it on two hundred machines. The inner loop is the twenty seconds between changing a colour and wanting to see it, and a full page reload there is worse than useless: it throws away the state you spent four clicks getting into.
ArdaLive is our live-preview extension for exactly that. It diffs the <head> and <body> and patches the live DOM in place, so scroll position, focus, video playback and the form you're halfway through typing all survive the edit. Linked stylesheets hot-swap without a flash. It serves your unsaved editor buffer, not the file on disk.
We wrote it to make designing device interfaces less painful — a kiosk screen is usually several steps deep into a flow, and reloading to check a change costs you all of it. Then it turned out nothing about that is device-specific, so it shipped as a standalone extension instead: free, MIT, and just as useful on an ordinary website. You don't need ArdaForm to get something out of it.
The portal and CLI open together. Put your name down and tell us what you're building — it genuinely affects what we finish first.