QM's command-line interface in cli/src/cli.ts offers deploy, validation, and secret management commands that share common path options (--config, --env-file, --sandbox-dir) and can output structured reports. qm up, qm check, and qm secrets provide deployment planning, config validation, and safe secret injection, while qm rollback restores prior deployments using platform-specific identifiers.
All deploy commands in cli/src/cli.ts accept three shared options: --config <path> (default: qm.config.jsonc in the deploy directory), --env-file <path> (default: .env in the deploy directory), and --sandbox-dir <path> (default: sandbox/ in the deploy directory).[1]
qm up --dry-run resolves the config and reports the deployment plan without making any changes; qm plan is a direct alias for that flag.[1]
qm check performs static config and sandbox validation by default; passing --live additionally verifies the running identity, rendered config, and deployment health.[1] Passing --json to qm check outputs machine-readable results keyed by contract clause.[1]
qm secrets set writes one .env value in place, deduplicating the key and preserving file order and mode; when no value is supplied it reads from stdin or prompts interactively, so the secret never enters shell history.[1]
qm rollback accepts a --to <target> argument whose form is platform-specific: on AWS it takes a prior deployment manifest or a manifest ID/release label; on Fly it takes a sandbox image or tag.[1]
Sources