tai auth claim
Exchange a one-time claim link for its API key — runs WITHOUT a credential.
Pass the bare token or the whole claim URL; the token is taken from the link’s fragment,
under the key the server declares (GET /api/login/methods). Pass - to read the
token (or claim URL) from stdin, stripped, keeping it off the command line. The exchanged
API key is printed ONCE — capture it now (there is no second exchange; the link is
single-use). A used/unknown/expired token answers the
same unknown or already used claim token.
Example: tai auth claim 'https://host/login#claim=<token>'
tai auth member-actions
List and invoke the accounts providers’ declared member-admin actions.
tai auth member-actions invoke
Invoke one declared member action by its opaque key.
The per-action input is handed to the action’s declared input model and validated
server-side (a declared-field type error is rejected; an unknown key is ignored). The
result is the provider’s opaque result — an invite action, say, returns a one-time
sign-in link shown only once, so capture it now.
Example: tai auth member-actions invoke --action-key <key> --target-handle <handle> --input '{"role": "editor"}'
tai auth member-actions list
List every declared member action by its opaque key, label, provider name, scope, and destructive flag.
Each registered accounts provider declares its own member-admin actions; the catalog
carries each by an opaque key (which invoke echoes back), the rendered label, the
provider_name the owning provider declares, the placement scope, the
destructive confirm hint, and the input/result JSON schemas a caller renders a form
and a result view from.
Example: tai auth member-actions list
tai auth whoami
Print the caller’s derived capability projection.
Example: tai auth whoami