CLI (`csax`) — Overview

`csax` is an administrative command-line tool for managing a CrydenSync deployment — inspecting users, managing sessions, reviewing audit logs, and running migrations.

csax — short for CrydenSync Auth eXperience — is an administrative command-line tool for managing a CrydenSync deployment — inspecting users, managing sessions, reviewing audit logs, and running database migrations.

Who this is for

Developers and operators managing their own CrydenSync-backed deployment — comparable to how psql is a tool for whoever administers a database, not something an application's end users ever touch. csax is never end-user-facing. A real application's own users manage their own sessions, password, and account through that application's own UI (built on the engine directly, the HTTP API, or an SDK) — not through this CLI.

Design principles

Zero engine changes. Every csax command is built entirely on the engine's already-published, public API and existing store methods. No engine code was modified or added specifically to support the CLI — this was a deliberate scope boundary for the CLI's first release, not an oversight. See design-decisions.md.
No CLI framework dependency. csax is built using only Go's standard library (flag, os.Args-based dispatch) — consistent with the engine's own dependency-light philosophy.
Ownership-checked operations go through the engine, not raw storage. Any command that revokes a session, for example, calls cryden.RevokeSession (which enforces that the session belongs to the specified user) rather than calling SessionStore.Revoke directly, which would bypass that check.

Installation

go install github.com/crydensync/csax@latest

Quick reference

csax config init                                    # interactive setup, writes .env
csax migrate status|up|down                          # database migrations
csax users get <email>                                # user details
csax users unlock <email>                              # clear a lockout early
csax sessions list --user <email>
csax sessions revoke <session-id> --user <email>
csax sessions revoke-all --user <email>
csax audit tail --user <email> [--limit N]
csax health
csax version

See commands.md for full detail on every command, and configuration.md for setup.

A known, deliberate scope gap

csax users list (enumerating every user in the system) does not exist in the current version. The engine's UserStore interface has no method for listing all users — only single-user lookups (GetByEmail, GetByID) exist. Adding this would require an engine change, which was deliberately deferred rather than mixed into the CLI's zero-engine-change first release. This is documented here explicitly so it is understood as a known boundary, not a bug to report.