seamless-cli 0.5.2 → 0.7.0

package/README.md

@@ -2,6 +2,7 @@
 
 [![License: AGPL-3.0-only](https://img.shields.io/badge/License-AGPL3-yellow.svg)](LICENSE)
 [![npm version](https://img.shields.io/npm/v/seamless-cli.svg?style=flat)](https://www.npmjs.com/package/seamless-cli)
+![coverage](resources/coverage-badge.svg)
 
 Seamless CLI is a command-line tool for bootstrapping applications with Seamless Auth, an open source, passwordless authentication system.
 
@@ -32,6 +33,43 @@ You’ll be guided through a short setup process where you can choose:
 
 ---
 
+## Connecting to a managed instance
+
+If you are logged in to a managed Seamless Auth account (see
+[Authenticating against an instance](#authenticating-against-an-instance)), `init` connects the new
+project to your managed instance instead of scaffolding a local auth server. This is the default
+whenever a profile has an active session.
+
+```bash
+seamless login          # once, against your managed profile
+seamless init my-app    # scaffolds web + api wired to the managed instance
+```
+
+What happens:
+
+- The CLI lists your applications from the control plane and, when you have more than one, asks
+  which to connect. Skip the prompt with `--app <id>` (an application id or infra id).
+- It issues the application's service token from the control plane (the real credential, not a
+  locally generated secret) and writes it, the managed auth server URL, and the JWKS key id into
+  `api/.env`. The frontend is pointed at the same auth server URL.
+- No local auth server, Docker Compose, or admin dashboard is generated. Auth, users, and OAuth
+  providers are managed from the dashboard.
+
+Because the service token is shown only once at issue time, `init` confirms before issuing a new
+one for an application that already has a token (issuing a new token invalidates the old one).
+
+Run inside an existing project (a non-empty directory) to wire it up in place: `init` updates
+`api/.env` when an `api` directory is present, otherwise it prints the values to set by hand. Your
+own source is never overwritten.
+
+Escape hatches:
+
+- `seamless init --local` forces the self-hosted flow below, even when logged in.
+- With no active session, `init` uses the self-hosted flow automatically.
+- `SEAMLESS_PORTAL_API_URL` overrides the control-plane host (defaults to the managed service).
+
+---
+
 ## What gets created
 
 Depending on your selections, the CLI generates a project like this:
@@ -120,6 +158,139 @@ npm run dev
 
 ---
 
+## Authenticating against an instance
+
+Beyond scaffolding, the CLI can log in to a Seamless Auth instance (self-hosted, a managed
+tenant, or local dev) and call its authenticated and admin endpoints from the terminal. It talks
+to the instance directly over Bearer and JSON, so no server or contract changes are required.
+
+### Profiles
+
+The CLI targets instances through named profiles stored at `~/.config/seamless/config.json`
+(respecting `XDG_CONFIG_HOME`). Profiles hold no secrets; tokens live in the OS keychain (see
+below). Pick the active profile per command with `--profile <name>` or the `SEAMLESS_PROFILE`
+environment variable, otherwise the `default` profile is used.
+
+```bash
+# Add a profile (prompts if you omit the flags)
+seamless profile add prod --instance-url https://auth.example.com
+seamless profile add local --instance-url http://localhost:5312
+
+seamless profile list          # active profile is marked with *
+seamless profile use local     # switch the active profile
+seamless profile remove local  # delete a profile (also clears its keychain tokens)
+```
+
+`instanceUrl` is normalized: the trailing slash is stripped and `https` is required for any host
+other than `localhost`, `127.0.0.1`, or `::1`.
+
+### Logging in
+
+Login uses email OTP: you paste the code from your inbox, so nothing needs to be delivered to the
+CLI and no service token is required.
+
+```bash
+seamless login                       # prompts for the identifier, then the code
+seamless login you@example.com       # identifier as an argument
+seamless login --identifier you@example.com --profile prod
+```
+
+The command honors the instance's advertised login methods, caps local retries so it does not trip
+the OTP rate limiter, and refreshes the code automatically if the five minute window lapses.
+
+### Identity and sessions
+
+```bash
+seamless whoami                 # sub, email, roles, active profile, and instance URL
+seamless logout                 # end the current session and clear local tokens
+seamless logout --all           # revoke every session for the user, then clear local tokens
+
+seamless sessions               # list active sessions (current one marked)
+seamless sessions revoke <id>   # revoke one session (confirms if it is the current one)
+seamless sessions revoke --all  # revoke every session (confirms, then clears local tokens)
+```
+
+### Configuration as code
+
+Read and write the instance system configuration (requires an admin role). This turns the
+dashboard's config panel into something you can version, diff, and apply in CI.
+
+```bash
+seamless config get                       # print the whole config
+seamless config get access_token_ttl      # print a single key
+seamless config get --json > config.json  # capture as JSON
+
+# Values are parsed as JSON, falling back to a string, so every shape works:
+seamless config set access_token_ttl 15m
+seamless config set rate_limit 250
+seamless config set passkey_login_fallback_enabled false
+seamless config set login_methods '["email_otp","passkey"]'
+
+seamless config roles                     # list the instance's roles
+
+seamless config diff config.json          # show how a local file differs from the instance
+seamless config apply config.json --dry-run   # preview the delta
+seamless config apply config.json             # apply after a confirmation prompt
+```
+
+`apply` sends only the changed keys and ignores read-only or unknown keys, so a full config
+captured with `config get --json` can be edited and applied directly. Token TTLs, origins, login
+methods, and the WebAuthn RP id are all readable and writable.
+
+### Admin: users and organizations
+
+Manage users and organizations from the terminal (requires an admin role).
+
+```bash
+seamless users list --limit 50 --offset 0
+seamless users delete <id>                 # confirms first
+seamless users credentials <id>            # registered credentials for a user
+seamless users prepare-device-replacement <id>   # admin-assisted recovery
+
+seamless org list
+seamless org create "Acme Inc" --slug acme
+seamless org get <id>
+seamless org update <id> --name "Acme" --slug acme
+
+seamless org members list <orgId>
+seamless org members add <orgId> --email person@example.com --roles member,billing
+seamless org members update <orgId> <userId> --roles admin
+seamless org members remove <orgId> <userId>
+```
+
+A non-admin user receives a clear permission error rather than a stack trace.
+
+### Token storage and the keychain
+
+The refresh token is the durable secret, so sessions are stored in the operating system keychain,
+never in a plaintext file:
+
+- macOS: Keychain
+- Windows: Credential Manager
+- Linux: Secret Service (libsecret, for example GNOME Keyring or KWallet)
+
+Tokens are keyed per profile (by name and instance URL) so multiple instances never collide, and
+they are removed when you log out or remove the profile. Access tokens are refreshed transparently:
+on a `401` the CLI rotates the pair via `/refresh`, stores the new tokens, and retries once. A
+rotated or reused refresh token clears the local session and prompts a fresh login.
+
+### Headless and CI
+
+When no OS keychain is available (for example a headless CI runner), the CLI does not fall back to
+a plaintext file. Instead, set `SEAMLESS_REFRESH_TOKEN` to a valid refresh token and the CLI will
+use it to obtain an access token for the run:
+
+```bash
+export SEAMLESS_PROFILE=prod
+export SEAMLESS_REFRESH_TOKEN=<refresh-token>
+seamless whoami
+```
+
+Because `/refresh` rotates the refresh token on every call, this path is best for a single
+invocation; the rotated token is held only in memory for that process.
+
+---
+
 ## What is configured for you
 
 Seamless CLI handles the parts that are usually difficult to get right:

package/dist/commands/adminShared.js

@@ -0,0 +1,23 @@
+import kleur from "kleur";
+import { ReauthRequiredError } from "../core/authClient.js";
+import { AdminApiError, PermissionError } from "../core/admin.js";
+export function reportAdminError(err) {
+    if (err instanceof ReauthRequiredError) {
+        console.log(kleur.yellow(err.message));
+        process.exit(1);
+    }
+    if (err instanceof PermissionError || err instanceof AdminApiError) {
+        console.error(kleur.red(err.message));
+        process.exit(1);
+    }
+    throw err;
+}
+export function parseList(value) {
+    if (value === undefined)
+        return undefined;
+    return value
+        .split(",")
+        .map((item) => item.trim())
+        .filter((item) => item.length > 0);
+}
+//# sourceMappingURL=adminShared.js.map

package/dist/commands/adminShared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminShared.js","sourceRoot":"","sources":["../../src/commands/adminShared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;QACnE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC"}

package/dist/commands/config.js

@@ -0,0 +1,187 @@
+import fs from "fs";
+import { confirm, isCancel } from "@clack/prompts";
+import kleur from "kleur";
+import { extractFlag } from "../core/args.js";
+import { createAuthClient, ReauthRequiredError } from "../core/authClient.js";
+import { ConfigApiError, diffConfig, filterWritable, getRoles, getSystemConfig, parseValue, patchSystemConfig, PermissionError, } from "../core/systemConfig.js";
+export async function runConfig(args) {
+    const sub = args[0];
+    const { value: profileFlag, rest } = extractFlag(args.slice(1), "profile");
+    try {
+        const client = await createAuthClient({ profileFlag });
+        switch (sub) {
+            case "get":
+                await configGet(client, rest);
+                return;
+            case "set":
+                await configSet(client, rest);
+                return;
+            case "roles":
+                await configRoles(client, rest);
+                return;
+            case "diff":
+                await configDiff(client, rest);
+                return;
+            case "apply":
+                await configApply(client, rest);
+                return;
+            default:
+                console.error(kleur.red(`Unknown config subcommand: ${sub ?? "(none)"}`));
+                console.log("Usage: seamless config <get|set|roles|diff|apply>");
+                process.exit(1);
+        }
+    }
+    catch (err) {
+        if (err instanceof ReauthRequiredError) {
+            console.log(kleur.yellow(err.message));
+            process.exit(1);
+        }
+        if (err instanceof PermissionError || err instanceof ConfigApiError) {
+            console.error(kleur.red(err.message));
+            process.exit(1);
+        }
+        throw err;
+    }
+}
+async function configGet(client, rest) {
+    const json = rest.includes("--json");
+    const key = rest.find((arg) => !arg.startsWith("--"));
+    const config = await getSystemConfig(client);
+    if (key) {
+        if (!(key in config)) {
+            console.error(kleur.red(`No such config key: ${key}`));
+            process.exit(1);
+        }
+        const value = config[key];
+        console.log(json
+            ? JSON.stringify(value, null, 2)
+            : typeof value === "string"
+                ? value
+                : JSON.stringify(value, null, 2));
+        return;
+    }
+    if (json) {
+        console.log(JSON.stringify(config, null, 2));
+        return;
+    }
+    printConfig(config);
+}
+async function configSet(client, rest) {
+    const positional = rest.filter((arg) => !arg.startsWith("--"));
+    const [key, ...valueParts] = positional;
+    if (!key || valueParts.length === 0) {
+        console.error(kleur.red("Usage: seamless config set <key> <value>"));
+        process.exit(1);
+    }
+    const value = parseValue(valueParts.join(" "));
+    const result = await patchSystemConfig(client, { [key]: value });
+    if (result.updatedKeys.length) {
+        console.log(kleur.green(`Updated: ${result.updatedKeys.join(", ")}`));
+    }
+    else {
+        console.log(kleur.dim("No changes."));
+    }
+}
+async function configRoles(client, rest) {
+    const json = rest.includes("--json");
+    const roles = await getRoles(client);
+    if (json) {
+        console.log(JSON.stringify(roles, null, 2));
+        return;
+    }
+    if (roles.length === 0) {
+        console.log(kleur.dim("No roles."));
+        return;
+    }
+    for (const role of roles) {
+        console.log("  " + role);
+    }
+}
+async function configDiff(client, rest) {
+    const file = rest.find((arg) => !arg.startsWith("--"));
+    if (!file) {
+        console.error(kleur.red("Usage: seamless config diff <file>"));
+        process.exit(1);
+    }
+    const local = readConfigFile(file);
+    const remote = await getSystemConfig(client);
+    const changes = diffConfig(local, remote);
+    if (changes.length === 0) {
+        console.log(kleur.green("In sync. No differences."));
+        return;
+    }
+    printChanges(changes);
+}
+async function configApply(client, rest) {
+    const dryRun = rest.includes("--dry-run");
+    const file = rest.find((arg) => !arg.startsWith("--"));
+    if (!file) {
+        console.error(kleur.red("Usage: seamless config apply <file> [--dry-run]"));
+        process.exit(1);
+    }
+    const local = readConfigFile(file);
+    const { patch, dropped } = filterWritable(local);
+    if (dropped.length) {
+        console.log(kleur.dim(`Ignoring read-only or unknown keys: ${dropped.join(", ")}`));
+    }
+    const remote = await getSystemConfig(client);
+    const changes = diffConfig(patch, remote);
+    if (changes.length === 0) {
+        console.log(kleur.green("Already in sync. Nothing to apply."));
+        return;
+    }
+    printChanges(changes);
+    if (dryRun) {
+        console.log(kleur.dim("Dry run: no changes applied."));
+        return;
+    }
+    const proceed = await confirm({
+        message: `Apply ${changes.length} change${changes.length === 1 ? "" : "s"} to ${client.profile.instanceUrl}?`,
+        initialValue: false,
+    });
+    if (isCancel(proceed) || !proceed) {
+        console.log("Cancelled.");
+        return;
+    }
+    const body = Object.fromEntries(changes.map((change) => [change.key, change.to]));
+    const result = await patchSystemConfig(client, body);
+    console.log(kleur.green(`Applied. Updated: ${result.updatedKeys.join(", ") || "(none reported)"}`));
+}
+function readConfigFile(file) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf-8");
+    }
+    catch {
+        throw new ConfigApiError(`Could not read file: ${file}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new ConfigApiError(`${file} is not valid JSON.`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new ConfigApiError(`${file} must contain a JSON object.`);
+    }
+    return parsed;
+}
+function inline(value) {
+    return value === undefined ? "(unset)" : JSON.stringify(value);
+}
+function printConfig(config) {
+    const keys = Object.keys(config).sort();
+    const width = keys.reduce((max, key) => Math.max(max, key.length), 0);
+    for (const key of keys) {
+        console.log(kleur.dim(key.padEnd(width) + "  ") + inline(config[key]));
+    }
+}
+function printChanges(changes) {
+    for (const change of changes) {
+        console.log(kleur.bold(change.key));
+        console.log("  " + kleur.red(`- ${inline(change.from)}`));
+        console.log("  " + kleur.green(`+ ${inline(change.to)}`));
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/commands/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAmB,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EACL,cAAc,EACd,UAAU,EACV,cAAc,EACd,QAAQ,EACR,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,eAAe,GAGhB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAc;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAE3E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACvD,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,KAAK;gBACR,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC9B,OAAO;YACT,KAAK,KAAK;gBACR,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC9B,OAAO;YACT,KAAK,OAAO;gBACV,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAChC,OAAO;YACT,KAAK,MAAM;gBACT,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC/B,OAAO;YACT,KAAK,OAAO;gBACV,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAChC,OAAO;YACT;gBACE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,8BAA8B,GAAG,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC1E,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YACpE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAkB,EAAE,IAAc;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CACT,IAAI;YACF,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;gBACzB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CACrC,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,WAAW,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,MAAkB,EAAE,IAAc;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,GAAG,UAAU,CAAC;IACxC,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAEjE,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAkB,EAAE,IAAc;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IAErC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,MAAkB,EAAE,IAAc;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAE1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,YAAY,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAkB,EAAE,IAAc;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,uCAAuC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAE1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,YAAY,CAAC,OAAO,CAAC,CAAC;IAEtB,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;QAC5B,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,UAC9B,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAC9B,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,GAAG;QACpC,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CACT,qBAAqB,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,EAAE,CAC1E,CACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,cAAc,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,cAAc,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,cAAc,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAsB,CAAC;AAChC,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,MAAoB;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAuB;IAC3C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/commands/help.js

@@ -13,6 +13,16 @@ USAGE
   seamless check
   seamless bootstrap-admin [email]
   seamless verify [--api-only] [--filter=<flow>] [--keep-up]
+  seamless profile <list|add|use|remove>
+  seamless login [identifier] [--identifier <email>] [--profile <name>]
+  seamless whoami [--profile <name>]
+  seamless logout [--all] [--profile <name>]
+  seamless sessions [list]
+  seamless sessions revoke <id | --all>
+  seamless config <get|set|roles|diff|apply>
+  seamless users <list|delete|credentials|prepare-device-replacement>
+  seamless org <list|create|get|update>
+  seamless org members <list|add|update|remove>
   seamless --help
   seamless --version
 
@@ -35,6 +45,94 @@ COMMANDS
         GitLab) and wires the ones you configure into the auth server
       • Run an unknown flag to see the available examples
 
+  profile <list|add|use|remove>
+    Manage the Seamless Auth instances the CLI targets, stored as named
+    profiles in ~/.config/seamless/config.json (respects XDG_CONFIG_HOME).
+
+    profile list
+      • Show configured profiles; the active one is marked with *
+
+    profile add <name> --instance-url <url> [--identifier-type email|phone]
+      • Create or update a profile (prompts interactively if flags are omitted)
+
+    profile use <name>
+      • Switch the active profile for subsequent commands
+
+    profile remove <name>
+      • Delete a profile
+
+    The active profile can also be chosen per command with --profile <name> or
+    the SEAMLESS_PROFILE environment variable.
+
+  login [identifier]
+    Log in to the active profile's Seamless Auth instance using email OTP.
+    Prompts for the identifier (or pass it positionally or with --identifier)
+    and the code sent to your inbox, then stores the session in the OS keychain.
+
+    --profile <name>
+      • Log in against a specific profile instead of the active one
+      • Also selectable with the SEAMLESS_PROFILE environment variable
+
+  whoami
+    Show the identity behind the active profile's session (sub, email, roles),
+    alongside the profile name and instance URL. Fails cleanly if not logged in.
+
+  logout [--all]
+    End the current session on the instance and clear the local keychain tokens.
+    --all revokes every session for the user before clearing local tokens.
+
+  sessions [list]
+    List the active sessions for the logged-in user, with the current session
+    marked. Shows the session id, device or user agent, IP, and last-used time.
+
+  sessions revoke <id | --all>
+    Revoke one session by id, or every session with --all. Revoking the current
+    session (or --all) prompts for confirmation and then clears local tokens.
+
+  config <get|set|roles|diff|apply>
+    Read and write the instance system configuration (requires an admin role).
+
+    config get [key] [--json]
+      • Print the whole config or a single key
+
+    config set <key> <value>
+      • Update one key; the value is parsed as JSON, falling back to a string
+        (for example: config set access_token_ttl 15m,
+        config set login_methods '["email_otp","passkey"]')
+
+    config roles [--json]
+      • List the instance's available roles
+
+    config diff <file>
+      • Show how a local JSON config file differs from the instance
+
+    config apply <file> [--dry-run]
+      • Apply a local JSON config file after a confirmation prompt
+
+  users <list|delete|credentials|prepare-device-replacement>
+    Admin user management (requires an admin role).
+
+    users list [--limit <n>] [--offset <n>] [--json]
+      • List users
+    users delete <id>
+      • Delete a user (asks for confirmation)
+    users credentials <id> [--json]
+      • Show a user's registered credentials
+    users prepare-device-replacement <id> [--keep-sessions] [--keep-passkeys] [--keep-totp]
+      • Admin-assisted account recovery (needs an elevated session)
+
+  org <list|create|get|update>, org members <list|add|update|remove>
+    Admin organization management (requires an admin role).
+
+    org list [--json]
+    org create <name> [--slug <slug>]
+    org get <id> [--json]
+    org update <id> [--name <name>] [--slug <slug>]
+    org members list <orgId> [--json]
+    org members add <orgId> (--user <id> | --email <email>) [--roles a,b] [--scopes a,b]
+    org members update <orgId> <userId> [--roles a,b] [--scopes a,b]
+    org members remove <orgId> <userId>
+
   check
     Validate project setup, Docker, and running services
 

package/dist/commands/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../../src/commands/help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,UAAU,SAAS;IACvB,OAAO,CAAC,GAAG,CAAC;YACF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoHlB,CAAC,CAAC;AACH,CAAC"}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../../src/commands/help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,UAAU,SAAS;IACvB,OAAO,CAAC,GAAG,CAAC;YACF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsNlB,CAAC,CAAC;AACH,CAAC"}