Signet — Signet CLI v0

The production signet binary owns its setup commands. There is no second package, login, hosted dashboard session, or project-link file.

Scaffold a config

signet init \
  --base-url https://auth.example.com \
  --database postgres \
  --config signet.toml

--config defaults to signet.toml; --base-url defaults to http://localhost:3000; --database accepts memory (the development default) or postgres. The generated file contains env:SIGNET_SECRET and, for PostgreSQL, env:SIGNET_DATABASE_URL references—not values. init uses create-new semantics: if the path already exists, it refuses and leaves the file byte-for-byte unchanged. There is deliberately no --force overwrite path.

Then supply the named values out of band:

export SIGNET_SECRET="$(openssl rand -hex 32)"
export SIGNET_DATABASE_URL="postgres://user:pass@host/db"

Diagnose config and the live instance

signet doctor --offline --config signet.toml
signet doctor --config signet.toml

Offline mode loads the same strict config as boot, runs the licence gate, and reports whether mail delivery is usable. It does not connect to the database, mutate migrations, bind a socket, or make a network request. The existing signet --check remains the terse config-only CI form.

Without --offline, doctor also requests the configured root /health and {base_path}/open-api/generate-schema with a five-second timeout and redirects disabled. It requires success responses, valid schema JSON, at least one published path, and a schema server URL equal to this config's base_url + base_path. A failure names the URL, observed condition, and the next check; it never prints response bodies that may have come from an intermediary.

Pull the public client environment

signet env pull --config signet.toml --file .env.local
# or, for an agent/pipe:
signet env pull --config signet.toml --stdout

The file form inserts or updates exactly one line:

SIGNET_AUTH_URL=https://auth.example.com/api/auth

Unrelated lines and comments remain. Repeating the command is idempotent. Duplicate SIGNET_AUTH_URL assignments fail instead of silently choosing precedence, and symlink destinations are refused. A newly created env file is mode 0600 on Unix. --stdout emits only the assignment on stdout so an agent can compose it safely.

SIGNET_AUTH_URL is public and is suitable for createAuthClient({ baseURL: ... }). Signet is operator-owned, so there is no remote vendor vault from which this command could retrieve SIGNET_SECRET, the database DSN, an admin key, OAuth client secrets, SMTP credentials, webhook secrets, or a licence. Those remain in the operator-owned env:/file: references declared by signet.toml; env pull neither reads nor writes them.