CLI Commands

Examples use devray@example.com as the placeholder user throughout.

`csax config init`

Interactive setup. Prompts for a database connection string and a JWT secret (leave blank to auto-generate one), writes both to a local .env file.

$ csax config init
Database connection string: postgresql://user:pass@host:5432/dbname?sslmode=require
JWT secret (leave blank to generate one): [enter]
Generated a new JWT secret.
✔ Wrote .env

If .env already exists, you'll be prompted before it's overwritten.

`csax migrate status`

Shows which migration files (in MIGRATIONS_DIR, default ./migrations) have been applied, based on csax's own tracking table (csax_migrations), created automatically on first use.

$ csax migrate status
✔ 0001_initial_schema.up.sql  applied
✗ 0002_notes.up.sql            pending

`csax migrate up`

Applies every pending *.up.sql file, in filename order, each inside its own database transaction (so a failing migration does not partially apply).

$ csax migrate up
Applying 0002_notes.up.sql... done

`csax migrate down`

Rolls back the single most recently applied migration, using its corresponding .down.sql file.

$ csax migrate down
Rolling back 0002_notes.up.sql... done

`csax users get <email>`

Shows a user's ID, creation date, lock status, and active session count.

$ csax users get devray@example.com
ID:       019f9635-9d49-7a55-95e9-ff25259469f4
Email:    devray@example.com
Created:  2026-08-11 14:20
Locked:   no (failed attempts: 0)
Sessions: 2 active

Clears an account lockout early — resets both the failed-attempt counter and the lock itself. Internally, this reuses the engine's existing ResetFailedAttempts store method (the same one called automatically on a successful login) rather than introducing new lockout-clearing logic.

$ csax users unlock devray@example.com
✔ Unlocked devray@example.com

`csax sessions list --user <email>`

Lists every active session for a user: session ID, device (user agent), IP, and creation time.

$ csax sessions list --user devray@example.com
019f9635-9e80-...  Chrome/Windows    1.2.3.4      2026-08-13 22:10
019f9635-9f12-...  Safari/iOS        5.6.7.8      2026-08-14 08:05

`csax sessions revoke <session-id> --user <email>`

Revokes one specific session. Calls the engine's cryden.RevokeSession, which verifies the session actually belongs to the specified user before revoking — a raw storage-layer revoke bypassing this check is deliberately not exposed.

$ csax sessions revoke 019f9635-9e80-... --user devray@example.com
✔ Revoked session 019f9635-9e80-...

`csax sessions revoke-all --user <email>`

Revokes every session for a user (equivalent to that user calling LogoutAll themselves).

$ csax sessions revoke-all --user devray@example.com
✔ Revoked all sessions for devray@example.com

`csax audit tail --user <email> [--limit N]`

Shows the most recent audit events for a user (default limit: 20). Events matching token_reuse_detected are visually flagged.

$ csax audit tail --user devray@example.com
2026-08-14 08:05  login_success             ip=5.6.7.8
2026-08-13 22:10  login_success             ip=1.2.3.4
2026-08-12 03:41  token_reuse_detected       ip=9.9.9.9  ⚠

`csax health`

Confirms database connectivity and that migration tracking is set up.

$ csax health
✔ Database reachable
✔ Migration tracking present

`csax version`

$ csax version
csax v0.1.0 (cryden/v2 v2.0.0)

Shows both the CLI's own version and which version of the engine it was built/verified against.