seamless-cli 0.10.1 → 0.11.0

package/dist/commands/help.js

@@ -1,201 +1,53 @@
 import { VERSION } from "../index.js";
+import { COMMAND_HELP, findCommandHelp, } from "./helpTopics.js";
+const DIVIDER = "────────────────────────────────────────────";
+const DOCS_URL = "https://docs.seamlessauth.com";
+function indent(text, spaces) {
+    const pad = " ".repeat(spaces);
+    return text
+        .split("\n")
+        .map((line) => (line.length > 0 ? pad + line : line))
+        .join("\n");
+}
+function renderSections(command, headingIndent) {
+    return command.sections
+        .map((section) => `${indent(section.heading, headingIndent)}\n${indent(section.body, headingIndent + 2)}`)
+        .join("\n\n");
+}
 export function printHelp() {
+    const usage = COMMAND_HELP.flatMap((c) => c.usage)
+        .concat(["seamless <command> --help", "seamless --help", "seamless --version"])
+        .map((line) => `  ${line}`)
+        .join("\n");
+    const commands = COMMAND_HELP.map((c) => renderSections(c, 2)).join("\n\n");
     console.log(`
 seamless v${VERSION}
 
 Seamless CLI — scaffold and manage full-stack authentication systems.
 
-────────────────────────────────────────────
+${DIVIDER}
 
 USAGE
 
-  seamless init [project-name] [--<example>]
-  seamless check
-  seamless bootstrap-admin [email] [--api-url <url>]
-  seamless verify [--api-only] [--filter=<flow>] [--keep-up]
-  seamless profile <list|add|use|remove>
-  seamless login [identifier] [--identifier <email>] [--local] [--profile <name>]
-  seamless whoami [--profile <name>]
-  seamless logout [--all] [--profile <name>]
-  seamless sessions [list]
-  seamless sessions revoke <id | --all>
-  seamless config <get|set|roles|diff|apply>
-  seamless users <list|delete|credentials|prepare-device-replacement>
-  seamless org <list|create|get|update>
-  seamless org members <list|add|update|remove>
-  seamless --help
-  seamless --version
-
-────────────────────────────────────────────
-
-COMMANDS
-
-  init [project-name]
-    Scaffold a new Seamless Auth project
-
-    Without a name:
-      • Creates project in current directory
-
-    With a name:
-      • Creates new directory
-
-    With an example flag (e.g. --oauth):
-      • Scaffolds that use-case starter and skips the web prompt
-      • --oauth also prompts for OIDC providers (Google, GitHub, Microsoft,
-        GitLab) and wires the ones you configure into the auth server
-      • Run an unknown flag to see the available examples
-
-  profile <list|add|use|remove>
-    Manage the Seamless Auth instances the CLI targets, stored as named
-    profiles in ~/.config/seamless/config.json (respects XDG_CONFIG_HOME).
-
-    profile list
-      • Show configured profiles; the active one is marked with *
-
-    profile add <name> --instance-url <url> [--identifier-type email|phone]
-      • Create or update a profile (prompts interactively if flags are omitted)
-
-    profile use <name>
-      • Switch the active profile for subsequent commands
-
-    profile remove <name>
-      • Delete a profile
-
-    The active profile can also be chosen per command with --profile <name> or
-    the SEAMLESS_PROFILE environment variable.
-
-  login [identifier]
-    Log in to the active profile's Seamless Auth instance using email OTP.
-    Prompts for the identifier (or pass it positionally or with --identifier)
-    and the code sent to your inbox, then stores the session in the OS keychain.
-
-    --local
-      • For local instances only. Asks the instance to return the OTP in the
-        response instead of emailing it, and verifies with it automatically.
-      • Requires the auth API to run outside production with
-        ALLOW_UNCREDENTIALED_DELIVERY_SECRETS=true.
-
-    --profile <name>
-      • Log in against a specific profile instead of the active one
-      • Also selectable with the SEAMLESS_PROFILE environment variable
-
-  whoami
-    Show the identity behind the active profile's session (sub, email, roles),
-    alongside the profile name and instance URL. Fails cleanly if not logged in.
-
-  logout [--all]
-    End the current session on the instance and clear the local keychain tokens.
-    --all revokes every session for the user before clearing local tokens.
-
-  sessions [list]
-    List the active sessions for the logged-in user, with the current session
-    marked. Shows the session id, device or user agent, IP, and last-used time.
-
-  sessions revoke <id | --all>
-    Revoke one session by id, or every session with --all. Revoking the current
-    session (or --all) prompts for confirmation and then clears local tokens.
-
-  config <get|set|roles|diff|apply>
-    Read and write the instance system configuration (requires an admin role).
-
-    config get [key] [--json]
-      • Print the whole config or a single key
-
-    config set <key> <value>
-      • Update one key; the value is parsed as JSON, falling back to a string
-        (for example: config set access_token_ttl 15m,
-        config set login_methods '["email_otp","passkey"]')
-
-    config roles [--json]
-      • List the instance's available roles
-
-    config diff <file>
-      • Show how a local JSON config file differs from the instance
-
-    config apply <file> [--dry-run]
-      • Apply a local JSON config file after a confirmation prompt
+${usage}
 
-    config oauth-providers <list|add|update|remove>
-      • Manage OAuth providers one at a time. Client secrets stay server-side,
-        referenced by clientSecretEnv; the secret value is never sent.
-        (for example: config oauth-providers add --file google.json,
-        config oauth-providers update google '{"enabled":false}',
-        config oauth-providers remove google)
+${DIVIDER}
 
-  users <list|delete|credentials|prepare-device-replacement>
-    Admin user management (requires an admin role).
-
-    users list [--limit <n>] [--offset <n>] [--json]
-      • List users
-    users delete <id>
-      • Delete a user (asks for confirmation)
-    users credentials <id> [--json]
-      • Show a user's registered credentials
-    users prepare-device-replacement <id> [--keep-sessions] [--keep-passkeys] [--keep-totp]
-      • Admin-assisted account recovery (needs an elevated session)
-
-  org <list|create|get|update>, org members <list|add|update|remove>
-    Admin organization management (requires an admin role).
-
-    org list [--json]
-    org create <name> [--slug <slug>]
-    org get <id> [--json]
-    org update <id> [--name <name>] [--slug <slug>]
-    org members list <orgId> [--json]
-    org members add <orgId> (--user <id> | --email <email>) [--roles a,b] [--scopes a,b]
-    org members update <orgId> <userId> [--roles a,b] [--scopes a,b]
-    org members remove <orgId> <userId>
-
-  check
-    Validate project setup, Docker, and running services
-
-  verify [--local] [--api-only] [--filter=<flow>] [--keep-up]
-    Stand up the auth stack and run the conformance suite across the API and
-    the cookie (adapter) paths. Requires Docker. Builds the auth server from
-    a sibling seamless-auth-api checkout (override with SEAMLESS_API_DIR).
-
-    --local builds and links the local @seamless-auth/* SDK source (sibling
-    seamless-auth-server, override with SEAMLESS_SERVER_DIR) instead of the
-    published npm packages — so you can catch SDK regressions before publishing.
-
-  bootstrap-admin [email] [--api-url <url>]
-    Create a bootstrap admin invite
-
-    Targets your app API (the SeamlessAuth server adapter), which exposes the
-    bootstrap route and delivers the invite — not the auth server directly.
-    Defaults to http://localhost:3000; override with --api-url or SEAMLESS_API_URL.
-
-    Automatically resolves bootstrap secret from:
-      • .env
-      • auth/.env
-      • docker-compose.yml
-
-    If not found, you will be prompted.
-
-    Examples:
-      seamless bootstrap-admin
-      seamless bootstrap-admin admin@example.com
-      seamless bootstrap-admin admin@example.com --api-url http://localhost:3000
-
-────────────────────────────────────────────
-
-BEHAVIOR
-
-  seamless <project-name>
+COMMANDS
 
-    • Shortcut for: seamless init <project-name>
+${commands}
 
-────────────────────────────────────────────
+${DIVIDER}
 
 GETTING STARTED
 
   1. seamless init
-  2. docker-compose up
-  3. seamless bootstrap-admin
+  2. docker compose up
+  3. Register in the browser with the email you gave init
 
-    → Complete registration to become admin
+    → That address is the owner, so it becomes an admin
 
-────────────────────────────────────────────
+${DIVIDER}
 
 WHAT YOU GET
 
@@ -205,7 +57,7 @@ WHAT YOU GET
   • Admin dashboard (Docker or source)
   • Docker Compose setup
 
-────────────────────────────────────────────
+${DIVIDER}
 
 EXAMPLES
 
@@ -218,21 +70,47 @@ EXAMPLES
   seamless init --oauth my-app
     → Create ./my-app from the OAuth example starter
 
-  seamless my-app
-    → Shortcut for init
-
   seamless check
     → Validate your project
 
-  seamless bootstrap-admin
-    → Create your first admin user
-
-────────────────────────────────────────────
+${DIVIDER}
 
 DOCS
 
-  https://docs.seamlessauth.com
+  ${DOCS_URL}
+
+`);
+}
+// Returns false when the command has no help entry, so the caller can fall
+// back to the unknown-command path instead of printing an empty topic.
+export function printCommandHelp(name) {
+    const command = findCommandHelp(name);
+    if (!command)
+        return false;
+    const usage = command.usage.map((line) => `  ${line}`).join("\n");
+    // The heading only earns its place when a command has more than one section
+    // (sessions list vs sessions revoke); otherwise it just repeats the usage.
+    const description = command.sections.length === 1
+        ? indent(command.sections[0].body, 2)
+        : renderSections(command, 2);
+    const examples = command.examples?.length
+        ? `\nEXAMPLES\n\n${command.examples
+            .map((example) => indent(example, 2))
+            .join("\n\n")}\n`
+        : "";
+    console.log(`
+seamless ${command.name} — seamless v${VERSION}
+
+USAGE
+
+${usage}
+
+DESCRIPTION
 
+${description}
+${examples}
+Docs: ${DOCS_URL}
 `);
+    return true;
 }
 //# sourceMappingURL=help.js.map

package/dist/commands/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../../src/commands/help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,UAAU,SAAS;IACvB,OAAO,CAAC,GAAG,CAAC;YACF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwOlB,CAAC,CAAC;AACH,CAAC"}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../../src/commands/help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,YAAY,EACZ,eAAe,GAEhB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,OAAO,GAAG,8CAA8C,CAAC;AAE/D,MAAM,QAAQ,GAAG,+BAA+B,CAAC;AAEjD,SAAS,MAAM,CAAC,IAAY,EAAE,MAAc;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACpD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,OAAoB,EAAE,aAAqB;IACjE,OAAO,OAAO,CAAC,QAAQ;SACpB,GAAG,CACF,CAAC,OAAO,EAAE,EAAE,CACV,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,KAAK,MAAM,CAClD,OAAO,CAAC,IAAI,EACZ,aAAa,GAAG,CAAC,CAClB,EAAE,CACN;SACA,IAAI,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;SAC/C,MAAM,CAAC,CAAC,2BAA2B,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;SAC9E,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAE5E,OAAO,CAAC,GAAG,CAAC;YACF,OAAO;;;;EAIjB,OAAO;;;;EAIP,KAAK;;EAEL,OAAO;;;;EAIP,QAAQ;;EAER,OAAO;;;;;;;;;;EAUP,OAAO;;;;;;;;;;EAUP,OAAO;;;;;;;;;;;;;;;;EAgBP,OAAO;;;;IAIL,QAAQ;;CAEX,CAAC,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAElE,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,WAAW,GACf,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC3B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM;QACvC,CAAC,CAAC,iBAAiB,OAAO,CAAC,QAAQ;aAC9B,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;aACpC,IAAI,CAAC,MAAM,CAAC,IAAI;QACrB,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,CAAC,GAAG,CAAC;WACH,OAAO,CAAC,IAAI,gBAAgB,OAAO;;;;EAI5C,KAAK;;;;EAIL,WAAW;EACX,QAAQ;QACF,QAAQ;CACf,CAAC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/commands/helpTopics.js

@@ -0,0 +1,376 @@
+// One entry per dispatched command. Both the full `seamless --help` output and
+// the per-command `seamless <command> --help` output are rendered from this, so
+// a flag documented once shows up in both places.
+export const COMMAND_HELP = [
+    {
+        name: "init",
+        usage: [
+            "seamless init [project-name] [--<template>]",
+            "seamless init [project-name] --yes [--web=<id>] [--api=<id>] [--email=<address>] [--auth=<mode>] [--admin=<mode>]",
+        ],
+        sections: [
+            {
+                heading: "init [project-name]",
+                body: `Scaffold a new Seamless Auth project
+
+Without a name:
+  • Creates project in current directory
+
+With a name:
+  • Creates new directory
+
+With a template flag (e.g. --oauth, --react-oauth, --fastify):
+  • Scaffolds that starter and skips that layer's prompt
+  • A template answers to both its id and its short alias, so --basic and
+    --react-vite select the same starter
+  • --oauth also prompts for OIDC providers (Google, GitHub, Microsoft,
+    GitLab) and wires the ones you configure into the auth server
+  • Run seamless templates list to see every id, alias, and flag
+
+--profile <name>
+  • Use that profile instead of the active one
+
+--app <id>
+  • Connect the project to that managed application (needs a portal
+    session from seamless login)
+
+--local
+  • Point the generated project at a locally running auth stack
+
+NON-INTERACTIVE
+
+--yes, -y
+  • Answer every remaining question with the recommended option instead of
+    prompting, for CI, a Dockerfile, or a scripted run
+  • Pair it with --local or --app <id>: which stack the project gets is not
+    something --yes will guess
+  • It never stands in for a destructive confirmation (see --force)
+
+--web=<id|alias>, --api=<id|alias>
+  • Choose the web and api starters by name
+  • Default to the first selectable template of that kind in the registry
+
+--email=<address>
+  • The owner address, which becomes the admin when you register
+  • Required under --yes unless a portal session supplies one
+
+--auth=<docker|local>
+  • How the auth server runs (default: docker)
+
+--admin=<api|image|source|none>
+  • Where the admin console is hosted (default: api)
+
+--force
+  • Allow the two destructive steps --yes will not take on its own:
+    scaffolding into a directory that is not empty, and rotating a managed
+    application's existing service token`,
+            },
+        ],
+        examples: [
+            `seamless init
+  → Interactive setup in current directory`,
+            `seamless init my-app
+  → Create new project in ./my-app`,
+            `seamless init --oauth my-app
+  → Create ./my-app from the OAuth example starter`,
+            `seamless init my-app --local --yes --email=you@example.com
+  → Scaffold the recommended local stack with no prompts`,
+        ],
+    },
+    {
+        name: "templates",
+        usage: ["seamless templates list [--json]"],
+        sections: [
+            {
+                heading: "templates list [--json]",
+                body: `List the starters seamless init can scaffold, read from the same registry
+init uses (so SEAMLESS_TEMPLATES_DIR and SEAMLESS_TEMPLATES_REF apply).
+Needs no login.
+
+  • Columns: id, kind (web or api), framework, the init flags that select
+    it, and status
+  • Every template answers to --<id>; some also declare a shorter --<alias>
+  • Templates marked coming-soon cannot be selected yet, so they list no flag
+
+--json
+  • Emit the registry entries as an array, for scripting`,
+            },
+        ],
+        examples: [
+            `seamless templates list
+  → Table of every available starter`,
+            `seamless templates list --json
+  → Machine-readable registry entries`,
+        ],
+    },
+    {
+        name: "check",
+        usage: ["seamless check"],
+        sections: [
+            {
+                heading: "check",
+                body: `Validate project setup, Docker, and running services`,
+            },
+        ],
+        examples: [
+            `seamless check
+  → Validate your project`,
+        ],
+    },
+    {
+        name: "verify",
+        usage: [
+            "seamless verify [--local] [--api-only] [--no-react] [--filter=<flow>] [--keep-up]",
+        ],
+        sections: [
+            {
+                heading: "verify [--local] [--api-only] [--filter=<flow>] [--keep-up]",
+                body: `Stand up the auth stack and run the conformance suite across the API and
+the cookie (adapter) paths. Requires Docker. Builds the auth server from
+a sibling seamless-auth-api checkout (override with SEAMLESS_API_DIR).
+
+--local
+  • Builds and links the local @seamless-auth/* SDK source (sibling
+    seamless-auth-server, override with SEAMLESS_SERVER_DIR) instead of the
+    published npm packages, so you can catch SDK regressions before
+    publishing
+
+--api-only
+  • Run the API layer only, skipping the adapter and browser layers
+
+--no-react
+  • Skip the browser layer but keep the adapter layer
+
+--filter=<flow>
+  • Run only the flows matching <flow> (the = form; a space-separated
+    --filter <flow> is not parsed)
+
+--keep-up
+  • Leave the Docker stack running after the suite finishes`,
+            },
+        ],
+        examples: [
+            `seamless verify --api-only
+  → Fast pass against the API layer only`,
+            `seamless verify --local --filter=passkey
+  → Run the passkey flows against locally built SDK source`,
+        ],
+    },
+    {
+        name: "profile",
+        usage: ["seamless profile <list|add|use|remove|login>"],
+        sections: [
+            {
+                heading: "profile <list|add|use|remove|login>",
+                body: `Manage the Seamless Auth instances the CLI targets, stored as named
+profiles in ~/.config/seamless/config.json (respects XDG_CONFIG_HOME).
+A profile is an instance you administer, which is a different account from
+your portal login: it lives in that instance's own user pool.
+
+profile list
+  • Show configured profiles; the active one is marked with *
+
+profile add <name> --instance-url <url> [--identifier-type email|phone]
+  • Create or update a profile (prompts interactively if flags are omitted)
+
+profile use <name>
+  • Switch the active profile for subsequent commands
+
+profile remove <name>
+  • Delete a profile
+
+profile login [name] [identifier] [--identifier <email>] [--local]
+  • Log in to that instance so users, config, org, and sessions can run
+  • Defaults to the active profile, and does not change which one is active
+
+The active profile can also be chosen per command with --profile <name> or
+the SEAMLESS_PROFILE environment variable.`,
+            },
+        ],
+    },
+    {
+        name: "login",
+        usage: ["seamless login [identifier] [--identifier <email>] [--local]"],
+        sections: [
+            {
+                heading: "login [identifier]",
+                body: `Sign in to the Seamless portal, the managed control plane. This is the
+account that authorizes connecting a project to a managed application, and
+it needs no profile. Prompts for the identifier (or pass it positionally or
+with --identifier) and the emailed code, then stores the session in the OS
+keychain. Use seamless profile login to sign in to an auth instance.
+
+--local
+  • For a local portal only. Asks the instance to return the OTP in the
+    response instead of emailing it, and verifies with it automatically.
+  • Requires the auth API to run outside production with
+    ALLOW_UNCREDENTIALED_DELIVERY_SECRETS=true.
+  • Point SEAMLESS_PORTAL_AUTH_URL at a local instance to develop against it.`,
+            },
+        ],
+    },
+    {
+        name: "apps",
+        usage: ["seamless apps <list|get>"],
+        sections: [
+            {
+                heading: "apps <list|get>",
+                body: `Show the managed applications your portal account owns. Requires a portal
+session (seamless login), not an instance profile.
+
+apps list [--json]
+  • Table of reference, name, plan, status, and instance URL
+  • The reference is the infra id, or the id before one is assigned
+  • Applications still provisioning are listed with (provisioning)
+
+apps get <id|name|infra-id> [--json]
+  • Detail for one application, including the console URL, owners, and
+    whether a service token has been issued (masked, never the live value)`,
+            },
+        ],
+    },
+    {
+        name: "whoami",
+        usage: ["seamless whoami [--profile <name>]"],
+        sections: [
+            {
+                heading: "whoami",
+                body: `Show the identity behind your portal session (sub, email, roles), alongside
+the instance URL. Pass --profile <name> to report an instance session
+instead. Fails cleanly if not logged in.`,
+            },
+        ],
+    },
+    {
+        name: "logout",
+        usage: ["seamless logout [--all] [--profile <name>]"],
+        sections: [
+            {
+                heading: "logout [--all]",
+                body: `End your portal session and clear the local keychain tokens. Pass
+--profile <name> to log out of an instance instead.
+--all revokes every session for the user before clearing local tokens.`,
+            },
+        ],
+    },
+    {
+        name: "sessions",
+        usage: [
+            "seamless sessions [list]",
+            "seamless sessions revoke <id | --all> [--force]",
+        ],
+        sections: [
+            {
+                heading: "sessions [list]",
+                body: `List the active sessions for the logged-in user, with the current session
+marked. Shows the session id, device or user agent, IP, and last-used time.`,
+            },
+            {
+                heading: "sessions revoke <id | --all> [--force]",
+                body: `Revoke one session by id, or every session with --all. Revoking the current
+session (or --all) prompts for confirmation and then clears local tokens.
+
+--force
+  • Skip that confirmation (--yes and -y are accepted aliases), which is also
+    what lets this run without a terminal attached`,
+            },
+        ],
+    },
+    {
+        name: "config",
+        usage: ["seamless config <get|set|roles|diff|apply|oauth-providers>"],
+        sections: [
+            {
+                heading: "config <get|set|roles|diff|apply>",
+                body: `Read and write the instance system configuration (requires an admin role).
+
+config get [key] [--json]
+  • Print the whole config or a single key
+
+config set <key> <value>
+  • Update one key; the value is parsed as JSON, falling back to a string
+    (for example: config set access_token_ttl 15m,
+    config set login_methods '["email_otp","passkey"]')
+
+config roles [--json]
+  • List the instance's available roles
+
+config diff <file>
+  • Show how a local JSON config file differs from the instance
+
+config apply <file> [--dry-run] [--force]
+  • Apply a local JSON config file after a confirmation prompt
+  • --force skips the confirmation; --dry-run still changes nothing
+
+config oauth-providers <list|add|update|remove>
+  • Manage OAuth providers one at a time. Client secrets stay server-side,
+    referenced by clientSecretEnv; the secret value is never sent.
+    (for example: config oauth-providers add --file google.json,
+    config oauth-providers update google '{"enabled":false}',
+    config oauth-providers remove google --force)
+
+--force
+  • Skips the confirmation on apply and oauth-providers remove (--yes and -y
+    are accepted aliases), which is also what lets them run without a
+    terminal attached`,
+            },
+        ],
+    },
+    {
+        name: "users",
+        usage: [
+            "seamless users <list|delete|credentials|prepare-device-replacement>",
+        ],
+        sections: [
+            {
+                heading: "users <list|delete|credentials|prepare-device-replacement>",
+                body: `Admin user management (requires an admin role).
+
+users list [--limit <n>] [--offset <n>] [--json]
+  • List users
+users delete <id> [--force]
+  • Delete a user (asks for confirmation)
+users credentials <id> [--json]
+  • Show a user's registered credentials
+users prepare-device-replacement <id> [--force] [--keep-sessions] [--keep-passkeys] [--keep-totp]
+  • Admin-assisted account recovery (needs an elevated session)
+
+--force
+  • Skips the confirmation on delete and prepare-device-replacement (--yes and
+    -y are accepted aliases), which is also what lets them run without a
+    terminal attached`,
+            },
+        ],
+    },
+    {
+        name: "org",
+        usage: [
+            "seamless org <list|create|get|update>",
+            "seamless org members <list|add|update|remove>",
+        ],
+        sections: [
+            {
+                heading: "org <list|create|get|update>, org members <list|add|update|remove>",
+                body: `Admin organization management (requires an admin role).
+
+org list [--json]
+org create <name> [--slug <slug>]
+org get <id> [--json]
+org update <id> [--name <name>] [--slug <slug>]
+org members list <orgId> [--json]
+org members add <orgId> (--user <id> | --email <email>) [--roles a,b] [--scopes a,b]
+org members update <orgId> <userId> [--roles a,b] [--scopes a,b]
+org members remove <orgId> <userId> [--force]
+
+--force
+  • Skips the confirmation on members remove (--yes and -y are accepted
+    aliases), which is also what lets it run without a terminal attached`,
+            },
+        ],
+    },
+];
+export const COMMANDS = COMMAND_HELP.map((c) => c.name);
+export function findCommandHelp(name) {
+    return COMMAND_HELP.find((c) => c.name === name);
+}
+//# sourceMappingURL=helpTopics.js.map

package/dist/commands/helpTopics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpTopics.js","sourceRoot":"","sources":["../../src/commands/helpTopics.ts"],"names":[],"mappings":"AAYA,+EAA+E;AAC/E,gFAAgF;AAChF,kDAAkD;AAClD,MAAM,CAAC,MAAM,YAAY,GAAkB;IACzC;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE;YACL,6CAA6C;YAC7C,mHAAmH;SACpH;QACD,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,qBAAqB;gBAC9B,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yCAoD2B;aAClC;SACF;QACD,QAAQ,EAAE;YACR;2CACqC;YACrC;mCAC6B;YAC7B;mDAC6C;YAC7C;yDACmD;SACpD;KACF;IACD;QACE,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,CAAC,kCAAkC,CAAC;QAC3C,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,yBAAyB;gBAClC,IAAI,EAAE;;;;;;;;;;yDAU2C;aAClD;SACF;QACD,QAAQ,EAAE;YACR;qCAC+B;YAC/B;sCACgC;SACjC;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,CAAC,gBAAgB,CAAC;QACzB,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,OAAO;gBAChB,IAAI,EAAE,sDAAsD;aAC7D;SACF;QACD,QAAQ,EAAE;YACR;0BACoB;SACrB;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE;YACL,mFAAmF;SACpF;QACD,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,6DAA6D;gBACtE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;4DAqB8C;aACrD;SACF;QACD,QAAQ,EAAE;YACR;yCACmC;YACnC;2DACqD;SACtD;KACF;IACD;QACE,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,CAAC,8CAA8C,CAAC;QACvD,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,qCAAqC;gBAC9C,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;2CAsB6B;aACpC;SACF;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,CAAC,8DAA8D,CAAC;QACvE,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,oBAAoB;gBAC7B,IAAI,EAAE;;;;;;;;;;;8EAWgE;aACvE;SACF;KACF;IACD;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,0BAA0B,CAAC;QACnC,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,IAAI,EAAE;;;;;;;;;;2EAU6D;aACpE;SACF;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,CAAC,oCAAoC,CAAC;QAC7C,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,QAAQ;gBACjB,IAAI,EAAE;;yCAE2B;aAClC;SACF;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,CAAC,4CAA4C,CAAC;QACrD,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,gBAAgB;gBACzB,IAAI,EAAE;;uEAEyD;aAChE;SACF;KACF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE;YACL,0BAA0B;YAC1B,iDAAiD;SAClD;QACD,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,IAAI,EAAE;4EAC8D;aACrE;YACD;gBACE,OAAO,EAAE,wCAAwC;gBACjD,IAAI,EAAE;;;;;mDAKqC;aAC5C;SACF;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,CAAC,4DAA4D,CAAC;QACrE,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,mCAAmC;gBAC5C,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBA8BQ;aACf;SACF;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,KAAK,EAAE;YACL,qEAAqE;SACtE;QACD,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,4DAA4D;gBACrE,IAAI,EAAE;;;;;;;;;;;;;;sBAcQ;aACf;SACF;KACF;IACD;QACE,IAAI,EAAE,KAAK;QACX,KAAK,EAAE;YACL,uCAAuC;YACvC,+CAA+C;SAChD;QACD,QAAQ,EAAE;YACR;gBACE,OAAO,EACL,oEAAoE;gBACtE,IAAI,EAAE;;;;;;;;;;;;;yEAa2D;aAClE;SACF;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAExD,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACnD,CAAC"}