CLI Command Map

Scaffold a service from a template, then run init on it. Omit the template on a terminal to choose one.

Example

kanject new webapi --name Acme.Analytics

Guide

Project Templates

Review and enroll an existing project: writes the manifest, stage files and applicable wiring after interactive confirmation. Back changes the plan; cancel leaves the project untouched.

Example

kanject init --yes --service phonebook-app --stages dev,stage,prod

Flags

--http-kind api-gateway-rest

opt into managed HTTP on a compatible schema-v2 entry

--http-auth application|anonymous

declare authentication for managed HTTP

--http-verification-path <PATH>

required safe GET health path

Guide

Lambda HTTP access

Pre-flight checks of the toolchain, and of a stage when you name one.

Example

kanject doctor --env dev

Flags

--env <stage>

add the stage checks

--features

add the edition and feature-lock checks for a distributable

--json

a CI-parseable report

Guide

Troubleshooting

Update the CLI and its template pack, then verify the new install.

Example

kanject update --check-only

Flags

--check-only

report the installed and latest versions; install nothing

--templates-only

update only the template pack

--json

one JSON document on stdout; implies --non-interactive, not --yes

Install an optional provider plugin. Omit the key on a terminal to choose from the curated providers.

Generate Bash, Zsh, or PowerShell 7 completion from the loaded command tree; writes only the script to stdout.

Example

kanject completion zsh

Guide

Shell completion

Register a Lambda entry, a stage, a cross-repo dependency, a distributable, or a plain / Parameter Store / Secrets Manager value in the manifest and stage files. add package adds a Kanject library: see Sign-in and paid libraries.

Examples

kanject add stage qakanject add env --stage dev ASPNETCORE_ENVIRONMENT Development

Guides

Project TemplatesDependenciesLocal Development

Run the service locally with the right runner for its project type.

Example

kanject test --watch

Flags

--watch

hot reload through dotnet watch (webapi projects)

--http

run an API template on Kestrel

--entry <ID>

select the manifest entry project

--event <PATH>

a JSON event payload to run the handler with (Tasks and Lambda ASP.NET Core projects)

--pull-env

use a stage's real config

--debug

CLI launch, then IDE attach

--setup-ide

generate native Debug/F5 configuration, then exit

--launch-profile <NAME>

select a compatible local profile

--startup-timeout <SECONDS>

bound HTTP startup waiting

Guide

Local Development

Show a stage's env bindings as written in its stage file, with secret: references masked. Makes no AWS call.

Example

kanject env --stage dev

Flags

--show-values

unmask the secret: references; never fetches values

Guide

Local Development

Resolve cross-repo dependencies into the lockfile and generated MSBuild imports.

Example

kanject sync --locked

Flags

--locked

verify in CI

--offline

replay the lock

Guide

Dependencies

Set up how a desktop app is distributed. With no subcommand, interactively add a destination.

Example

kanject configure distribution list --env prod

Subcommands

list

show the destination mappings (alias ls)

remove

delete one (alias rm)

scaffold

copy in a release kit for native installers (alias release-kit)

packaging

write a typed Linux packaging block for a distributable

Guide

Distribute

Adopt legacy cross-repo <ProjectReference>s into the manifest, or move the manifest to a newer schema.

Example

kanject migrate --dry-run

Flags

--dry-run

run this first

--schema-v2

upgrade a v1 manifest in place

--schema-v3

move to the provider-neutral manifest and stage layout; every file is read back before anything is written, and the old layout keeps working through 1.x

Build and ship a stage: Lambda, ECS Fargate, or a static site, per entry.

Example

kanject aws deploy --env dev

Flags

--dry-run

resolve env and write local deploy inputs; no build or AWS mutation; multi-region preview covers the primary region

--build-once

compile one bundle for an eligible multi-region deployment; --no-build is the compatibility alias

--restart-http

explicitly restart a managed HTTP operation after inspecting changed source/settings and recorded state

--bake-secrets false

skip applying resolved env to the function; baking is the default

--adopt-edge <STACK>

move a hand-written Function URL and CloudFront edge into kanject's stack; the distribution keeps its id and domain. Meant for one deploy

Guide

Deployment

Point a stage back at a prior release from the deployment ledger, with no rebuild: the Lambda alias, the previous ECS task definition, or an earlier static-site release.

Example

kanject aws rollback --env prod --to previous-stable

Flags

--to <REF>

a deployment revision, a commit SHA, previous or previous-stable; left out on a terminal, you pick from a list

Guide

Deployment

Read the S3 deployment ledger, mark releases stable or broken, and delete artifacts outside the rollback window.

Example

kanject aws deployments list --env prod

Guide

Deployment

Publish static-site previews, and list, extend, or remove previews. url resolves static-site previews.

Guide

Deployment

Configure managed REST access, external ownership, or pending HTTP setup for an existing Lambda stage.

Flags

--env <STAGE>

the stage to configure

--entry <ID>

the HTTP entry; inferred only when there is one

--kind api-gateway-rest

the managed HTTP method

--auth application|anonymous

explicit authentication

--verification-path <PATH>

a safe GET health path, e.g. /health

--mode managed|external|pending

who owns the HTTP access

--dry-run

show the plan; change no files or cloud resources

Guide

Lambda HTTP access

Interactive wizards that validate and write a stage's network and custom-domain config.

Provision a service's CodePipeline (up is the one-command path). promote and status serve library releases.

Subcommands

promote

select a fetched release tip in a terminal, then fast-forward only after rehearsal and commit checks pass

status

inspect a commit or use --select to choose a fetched release tip

Guides

CI/CD PipelinePublish .NET packages

Build a desktop app's distributables and publish them to S3, CodeArtifact, or (with the github plugin) GitHub Releases.

Example

kanject aws distribute --env prod --candidate

Flags

--candidate

stage an -rc.N release candidate

Subcommands

init

create the stage's distribution buckets

promote

copy an approved candidate to the stable buckets, byte for byte

Guide

Distribute

Publish only the distribution cells mapped to GitHub Releases.

Scaffold the repository policy, classify every packable project, and gate the release so no private package leaks into a public one. verify is the blocking CI gate.

Example

kanject packages verify

Flags

init --split

public and private packages

init --all-private

when nothing is public

Record a change's release intent: whether it needs a minor or major release. Writes packaging/intent/<date>-<slug>.json to commit with the change; a bug fix needs none, because no declaration means patch.

Example

kanject packages intent add --part minor --note "Adds IAuthProvider"

Flags

--part patch|minor|major

the increment this change needs; asked on a terminal, required in CI

--note

an optional one-line note

--package

the package IDs the note is about

The release front door, no flags needed. Resolves the declared part, plans and applies the wave on a release branch, pushes, follows the hosted rehearsal, promotes, and stops at approval.

Example

kanject packages release

Flags

--part

choose a release increment at or above declared intent; prompted when omitted in a terminal

--package <ID>

release one library and its in-repo dependencies

--no-promote

stop after the rehearsal and print the aws pipeline promote command

Subcommands

status

a commit's pipeline state; --select opens a release-tip picker, and --commit accepts a full or abbreviated SHA

wave

under the changelog versioning model, print wave or none: whether this checkout's version releases

tag

under the changelog versioning model, tag the commit that published this version and push the tag

prepare | stage

the two halves for a custom host (see Advanced and CI)

Guide

Publish .NET packages

Sign this machine in to Kanject through the browser, like aws sso login. The device key stays in the OS credential store.

Example

kanject login

Flags

--no-browser

print the approval URL instead, e.g. over SSH

--non-interactive

never prompt; at the organisation's device limit, list the devices and fail with a coded diagnostic

Subcommands

status

who this machine is signed in as; refreshes the feed token when it is due (--refresh forces it, --json for scripts)

Add a Kanject package to a project. Public ones come from nuget.org; paid ones come from the Kanject feed with your licence, after the CLI signs the feed credential into NuGet.

Example

kanject add package Kanject.Core.NoSqlDatabase

Flags

--version <VERSION>

default: the newest stable version the feed lists for your organisation

--project <PATH>

the project file, or a directory holding one; default: the current directory

Set NuGet up for paid Kanject libraries without adding one: the feed token as the kanject_feed credential in your user-level config, the feed's source and package source mapping in the repository's.

Example

kanject access --service

Flags

--service

write only the repository's part, with no sign-in and no credential: what a pipeline needs

Sign this machine out: removes its device key from the OS credential store and the feed credential from NuGet config.

Preview which packages a change reaches, prove the version wave, then apply the sealed plan with no build or network. You choose patch, minor, or major; the CLI works out what has to move with it.

Flags

--all <part>

cover the whole repository

plan --intent-file packaging/release.intent.json

on a hosted Build, stands in for --all with the part the release commit declares

Prepare the verified release bundle. Projects with public build-input contracts require an explicit stage.

Flags

--env <STAGE>

select the public build configuration

Guide

Public build inputs

Export the evaluated dependency graph, show what the feed environment variables resolve to, and list which current versions are already claimed on their feeds.

Flags

feeds --check

probe the feeds

Complete a --package release's approval set with the published bytes of everything outside the scope.

Push packed packages in dependency order, with release plans, preflight evidence, and a resumable journal.

Take the next -rc.N from the candidate feed.

Derive a candidate wave from verified stable packages.

Prove consumers restore against local packs or the actual candidate feed.

Flags

feed --build

build them too

Subcommands

fixture init

scaffold a composite consumer fixture

Print the day-to-day verify gate as a CodeBuild or GitHub Actions snippet. It publishes nothing; releases run through packages release or your own workflow.

Check and provision the hosted library release pipeline described in packaging/release.pipeline.json.

Flags

up --plan

preview the stack change, the release-surface diff, and the publisher pin

up --apply

apply it, after confirmation or from a reviewed --plan-file

Guide

Publish .NET packages

Print the DynamoDB change-feed documents each Lambda entry carries, how the manifest's aws.changeFeeds claims bind them, and what a deploy would render or check. Read-only; never builds.

Flags

--env <STAGE>

the stage to plan (required)

--entry <ID>

report only this entry's feeds; binding still considers every Lambda entry

--offline

no AWS calls: the build outputs, the claims and the stage only

Pin the newest Lambda Web Adapter layer this CLI has verified in manifest.lock.json, through kanject sync. No AWS call.

Flags

--version <N>

pin a specific layer version; only verified ones are accepted

Preview or apply migration from generated stage templates to a committed template.json base.

Inspect or set up the generated dependency wiring and git hooks.