# CLI reference [#cli-reference] `avaccess` ships with `@aventara/access`. Run it with `npx avaccess `. ```text avaccess [arguments] [flags] avaccess --help | -h the help avaccess --version | -v the package version avaccess --help one command's usage ``` ## Commands [#commands] | Command | Does | Read | | ------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | `push [--beacon ]` | Pushes the namespace's policies file: a `.json` file, or the module that holds the rules (default export, or `rules`), TypeScript included | [Registry](/access/docs/registry-and-cli#a-services-commands) | | `pull [--namespace ] [--out ] [--foreign :,…] [--beacon ] [--env ]` | Writes the namespace's file to `access/.policies.json` and the org's guardrails to `access/guardrails.json`, and pins their hashes in `avAccess.lock.json` | [Registry](/access/docs/registry-and-cli#a-services-commands) | | `verify [--env ]` | Holds the pulled files to the lock, and each `avAccess.beacons..json` to the rules, offline | [The lock](/access/docs/registry-and-cli#the-lock) | | `status` | Says whether the lock is behind the registry's current revisions; exits `1` when it is | [Registry](/access/docs/registry-and-cli#a-services-commands) | | `diff [ []] [--namespace ]` | Names the rules that changed between two revisions: `lock`, `head`, a hash, or its first seven or more hex digits. Default `lock` to `head`. | [Registry](/access/docs/registry-and-cli#a-services-commands) | | `generate [--orm ] [--out ] [--tsconfig ]` | Writes the generated client from the pulled files | [Generated client](/access/docs/generated-client) | | `schema --orm [--schema ] [--out ]` | Reads an ORM's schema into a module that exports `model`, to author rules against | [Generated client](/access/docs/generated-client) | | `serve [--config ] [--port ] [--hostname ] [--max-body-bytes ] [--migrate]` | Runs the standalone Access server | [The standalone server](/access/docs/standalone-server) | | `keys issue `, `keys rotate `, `keys revoke `, each with `--server ` | The operator's keys. Run in the server's own process, never over HTTP. | [Keys](/access/docs/registry-and-cli#keys) | ## Flags [#flags] | Flag | Commands | Default | | ----------------------------- | -------------------------------- | -------------------------------------------------------------------------------------- | | `--registry ` | `push`, `pull`, `status`, `diff` | `AVACCESS_REGISTRY_URL` | | `--namespace ` | `pull`, `diff` | The lock's namespace, else the key's (`pull`); the lock's (`diff`) | | `--out ` | `pull` | Where the lock has the files, else `access/` | | `--foreign :,…` | `pull` | none. May be given more than once. | | `--beacon ` | `push`, `pull` | none. The module must export `beacon` ([Beacons](/access/docs/beacons-and-foreign)). | | `--env ` | `pull`, `verify` | `AVACCESS_ENV` | | `--orm ` | `generate`, `schema` | `generate`: `none`. `schema`: required. Values: `none` (generate only), `prisma7`. | | `--out ` | `generate`, `schema` | `generate`: `src/generated/avAccess.ts`. `schema`: `src/generated/avAccess.schema.ts`. | | `--tsconfig ` | `generate` | The nearest `tsconfig.json` above the output | | `--schema ` | `schema` | `prisma/schema.prisma` (a folder of `.prisma` files reads as one) | | `--config ` | `serve` | `access.config.ts` (or `.mts`, `.cts`, `.js`, `.mjs`, `.cjs`) in the working directory | | `--port ` | `serve` | `PORT`, else `3000` | | `--hostname ` | `serve` | `127.0.0.1` | | `--max-body-bytes ` | `serve` | `1048576` (1 MiB) | | `--migrate` | `serve` | off | | `--server ` | `keys` | required | ## Environment variables [#environment-variables] | Variable | Used by | Does | | ----------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------- | | `AVACCESS_REGISTRY_URL` | `push`, `pull`, `status`, `diff` | The Access server's URL. With no path, `/api/auth` is added. `https:` only; `http:` is taken on a loopback address. | | `AVACCESS_KEY` | `push`, `pull`, `status`, `diff` | The namespace's push or pull key. Never a flag. | | `AVACCESS_ENV` | `pull`, `verify` | The environment name for beacon pins | | `AVACCESS_MIGRATE` | `serve` | `true` or `1` runs Better Auth's migration on start. `false`, `0` or unset does not. Any other value is refused. | | `PORT` | `serve` | The port, when `--port` is not given | `avaccess keys` reads no `.env`. Give it the environment the server runs with: `DATABASE_URL`, `BETTER_AUTH_SECRET` and `BETTER_AUTH_URL`. ## Exit codes [#exit-codes] | Code | Meaning | | ---- | ----------------------------------------------------------------------- | | `0` | Done | | `1` | The check failed or the registry refused | | `2` | The command could not run (bad flag, missing file, no registry address) | A failure prints `avaccess : : ` on stderr, where `` is the Access error code when there is one ([Error codes](/access/docs/error-codes)). Running `avaccess` with no command prints the help and exits `2`. ## Files the commands read and write [#files-the-commands-read-and-write] | File | Written by | Read by | | --------------------------------------------------- | ---------------- | ----------------------------------------------------------- | | `avAccess.lock.json` | `pull` | `verify`, `status`, `diff`, `generate`, your app at startup | | `access/.policies.json` | `pull` | `verify`, `generate`, your app | | `access/guardrails.json` | `pull` | `verify`, `generate`, your app | | `access/foreign.json` | `pull --foreign` | `verify`, `schema` | | `avAccess.beacons..json` | `pull --env` | `verify`, your app at startup | | `src/generated/avAccess.schema.ts` | `schema` | your rules | | `src/generated/avAccess.ts`, `avAccess.internal.ts` | `generate` | your service | `pull` and `generate` write only inside the project. A path through a symbolic link that leads out of it is refused. Formats are on [File formats, hashes and the engine](/access/docs/reference).