micro CLI

micro builds, previews, deploys, and maintains small sites with managed auth, data, files, email, and payments on micro.do.

The command tree is defined with abla-cli. Root and subcommand help, positional arguments, required options, defaults, and inherited options are generated from the same typed schema used to validate invocations and pass matched values into command execution. The CLI does not maintain a second raw argument parser; run micro <command> --help for the exact contract.

Install

Choose the installation that matches how you build your Micro.

The lightweight CLI is enough for static sites, prebuilt Wasm from Rust or any other toolchain, deployments, and project administration:

curl -fsSL https://micro.do/install | sh -s -- cli
micro doctor

Add the local runner when you want micro dev while keeping your own language toolchain:

curl -fsSL https://micro.do/install | sh -s -- runtime

Or install the complete self-contained Abla toolchain:

curl -fsSL https://micro.do/install | sh -s -- abla

On macOS, use the signed, checksum-pinned Homebrew formula:

brew install microdotdo/tap/micro
micro doctor

Every Linux mode verifies its published SHA-256 checksum and installs under ~/.local/share/micro, with public commands linked into ~/.local/bin. cli installs only the standalone Micro executable, runtime adds the static local runner, and abla installs the matching compiler, standard library, LLVM-based Wasm tools, and runner. None installs Homebrew or modifies system packages. Homebrew currently provides the complete Abla toolchain.

The manual instructions below install only the micro executable and are primarily useful for release verification.

Linux x86-64 and macOS releases include a checksum alongside each executable. For Linux:

curl -LO https://github.com/microdotdo/micro-cli/releases/latest/download/micro-linux-x86_64
curl -LO https://github.com/microdotdo/micro-cli/releases/latest/download/micro-linux-x86_64.sha256
sha256sum --check micro-linux-x86_64.sha256
install -Dm755 micro-linux-x86_64 "$HOME/.local/bin/micro"
micro login

On macOS, install the runtime TLS library with brew install openssl@3. On Apple Silicon, replace the two asset names above with micro-macos-arm64; on an Intel Mac, use micro-macos-x86_64. Verify with shasum -a 256 --check <asset>.sha256, then install the executable as $HOME/.local/bin/micro.

To install from source instead, install the Abla compiler, then:

make install
micro login

Pairing uses a one-time authorization code, PKCE, and a loopback callback. Access and refresh tokens are written only to the operating system's per-user configuration directory; on Unix, the directory is mode 0700 and the credential file is mode 0600.

Create and develop

micro new my-site
cd my-site
micro dev

micro build accepts static assets on their own, an already-built .micro/build/app.wasm from Rust or another toolchain, or compiles app.ab when the optional Abla toolchain is installed. micro dev builds that exact production bundle and starts the optional official runner on http://127.0.0.1:8787. Its app users, data, purchases, entitlements, and purchase events are disposable in-memory fixtures. Override the runner binary with MICRO_RUNNER and the compiler with MICRO_ABLAC when developing those repositories together.

To start from a reviewed site instead of an empty project:

micro gallery
micro remix digital-product my-shop
cd my-shop
micro dev

Remix is public and local-only. It restores an immutable source snapshot and records its creator, license, source digest, and copy policy in .micro/remix.json; it does not create a project, reserve a slug, or link the new directory to the original project. Only source, public assets, and product definitions in micro.yaml are copied. Users, records, purchases, entitlements, stored files, domains, team members, schedules, email history, secrets, and provider connections remain behind. The source project's optional micro.yaml slug: field is removed so every remix must choose its own slug explicitly.

Deploy and maintain

micro signup --email you@example.com
micro deploy my-site
micro status
micro settings
micro settings visibility private --confirm
micro invitations create teammate@example.com developer --can-promote
micro domains add app.example.com
micro private-grants create --expires-days 30 --label client-preview
micro schedules set daily-digest --every-minutes 1440
micro schedules set cleanup --every-minutes 60 --payload-file schedule.json
micro schedules run daily-digest --confirm
micro emails
micro platform status
micro usage
micro spending-cap set --monthly-cents 1000 --warning-percent 80
micro logs --since 30m
micro users
micro users disable 11111111-1111-4111-8111-111111111111 --confirm
micro users enable 11111111-1111-4111-8111-111111111111
micro users revoke-sessions 11111111-1111-4111-8111-111111111111 --confirm
micro records
micro records delete production notes project welcome --version 3 --confirm
micro export
micro export records --limit 100 --offset 0 --json
micro retention
micro retention set --record-days 90 --automatic --confirm
micro retention prune --expected-records 12 --confirm
micro backups
micro backups create --confirm
micro backups restore BACKUP_ID --backup-sha256 BACKUP_SHA --expected-current-sha256 CURRENT_SHA --confirm
micro backups delete BACKUP_ID --sha256 BACKUP_SHA --confirm
micro project deletions
micro project delete --confirm-slug my-site --confirm
micro pull my-site another-checkout

The first successful deployment atomically claims an available slug. Subsequent deployments use the stored source revision and reject stale updates instead of silently overwriting another checkout. Optional micro.yaml products are synchronized non-destructively; protected files are uploaded explicitly with micro files upload. App-user disablement preserves their records, purchases, and entitlements while immediately revoking active sessions, recovery links, verification links, and private download grants. Session revocation can be used separately without disabling the user.

Project roles are viewer, developer, and admin; production activation is an independent --can-promote grant. Email invitations are single-use and expire after seven days. Accept a token through standard input with micro invitations accept --token-stdin so it does not enter shell history or the process list. Custom domains must complete the returned DNS proof before they route. Private access tokens are shown only by the create response and can be revoked without redeploying the site.

Schedules enqueue authenticated schedule.triggered events for the active production Wasm deployment. The control plane prevents overlapping automatic deliveries for the same schedule and skips stale backlog instead of flooding a project after downtime. Payload files must contain a JSON object up to 8 KiB; they are ordinary configuration and must never contain credentials or bearer tokens. Manual runs and removals require --confirm.

micro usage reports account and daily totals. A hard spending cap is the default; add --soft only for a warning-only threshold. micro plans is public, while micro billing, micro billing checkout PLAN, and micro billing portal use the authenticated owner account when paid plans are enabled. Retention defaults to keeping project records forever. A finite 30–3650 day policy can be manual or automatic, but it never prunes purchases or entitlements. Manual pruning requires the current preview count and --confirm, so a changed preview fails instead of deleting a different set. Record backups are transactional, bounded snapshots of project records. A restore replaces the current record set only after both the selected backup digest and freshly inspected current-record digest match. It never rewinds app users, purchases, entitlements, products, files, deployments, or local source. Project deletion is linked to the exact project ID in .micro/project.json and requires both the typed slug and --confirm. The project disappears from the runner immediately, its slug remains reserved for 30 days, and protected-object cleanup finishes asynchronously behind a durable receipt. The CLI never removes the local source tree; export anything needed before requesting remote deletion.

GitHub Actions

Authorize an exact repository, ref, environment, and target slug without creating a project or reserving the slug:

micro github link \
  --repository owner/repository \
  --environment production \
  --ref refs/heads/main \
  --slug my-site

Commit the generated micro.github.json. It contains a public binding ID and policy facts, never a credential; the Action uses it to select the exact owner-approved binding without accepting a target slug from workflow input.

The first-party Action runs micro build before requesting GitHub OIDC, then invokes micro deploy --github --prebuilt so project compilation never receives the short-lived deployment authority. No long-lived Micro token is stored in GitHub.

Development

make test build

From Linux, ABLA_MACOS_SDK=/path/to/MacOSX.sdk make macos builds both Intel and Apple Silicon executables through Abla's LLVM/LLD cross path.

On systems where locally built Abla executables use an OpenSSL library outside the default loader path, pass its directory with ABLA_TEST_LD_LIBRARY_PATH=/path/to/openssl/lib make test. This affects only the test process and is never embedded in the released CLI.

Set MICRO_API=http://127.0.0.1:8080 to work against a local control plane. Plain HTTP is rejected for non-loopback API addresses.

License

MIT