@fieldwork-ai/cli 0.16.0

package/README.md

@@ -0,0 +1,64 @@
+# Fieldwork CLI (`@fieldwork-ai/cli`)
+
+The Fieldwork CLI: drive your organization's [Fieldwork](https://app.getfieldwork.ai) assets and tools from a terminal, a script, or an agent harness like Claude Code.
+
+```bash
+npm install -g @fieldwork-ai/cli
+fieldwork login          # browser sign-in; the token is pinned to the org you pick
+fieldwork whoami
+fieldwork tool list
+```
+
+Inside a Fieldwork compute container the CLI is preinstalled and pre-authenticated as the conversation's user — no login step; credentials are injected per conversation.
+
+## Running tools
+
+Every tool your account can use in chat (platform reads plus your org's connected integrations) is invocable by name. Arguments are one JSON object:
+
+```bash
+fieldwork tool describe kb_search                 # description + input schema
+fieldwork tool run kb_search --args '{"query": "replenishment thresholds"}'
+echo '{"database": "Metrics DB", "sql": "select count(*) from orders"}' \
+  | fieldwork tool run db_query --args -          # stdin for large payloads
+fieldwork tool run kb_search --args '{"query": "x"}' --arg query=override
+```
+
+`--arg key=value` overlays a string field; `--arg key:=json` parses the value as JSON. Tool-level errors (strings starting `Error:`) are data and exit 0; transport and auth failures use the exit codes below.
+
+## Asset families
+
+```bash
+fieldwork agents list | get <slug>
+fieldwork kb ls [prefix] | get <path> [--out <f>] | put <path> [local] | search <q> | rm <path> | mv <from> <to> | pull --dir <d> | push --dir <d>
+fieldwork data list | schema <table> | query "select …"
+fieldwork db list | schema <database> [table] | query <database> "select …"
+fieldwork apps list | get | init | pull | publish <dir> --message "…"
+fieldwork automations list | get | enable | disable | runs [--follow] | run-now [--follow] | logs <name> | delete
+fieldwork connectors list | pull <key> | publish <dir> --message "…" | connect <key> --spec <file> | test <id> | secrets set | secrets pull --out <file>
+```
+
+`kb` covers the whole Knowledge Base — markdown pages and the org's other files, one tree — dispatching on the kind the server reports rather than on the extension. `kb put <path>` writes a page from `--file`/stdin; `kb put <path> <local>` uploads a document. One group, not one per storage kind: the tree stopped being two things, and the name matches the `kb_*` tools so a person and an agent describe the same operation the same way.
+
+Mutations prompt for confirmation on a TTY; pass `--yes` to skip (required in non-interactive use). `--json` prints stable machine-readable output on every verb. Secret values never travel via argv or stdout: `secrets set` reads from `--stdin`, `--from-env-file`, or `--from-env`; `secrets pull` writes a chmod-600 file atomically and refuses to overwrite an existing file without `--force`.
+
+The connector development loop end to end: `connectors pull acme_erp` → edit the adapter → `connectors publish acme_erp --message "…" --base-revision N` (a new key creates the definition from the tree's `connector.json`) → `connectors connect acme_erp --spec spec.json` → `connectors secrets set <id>` → `automations run-now <sync> --follow` to watch the logs.
+
+## Auth and configuration
+
+Credential resolution order: the injected container file (`~/.fieldwork/credentials`) → `FIELDWORK_TOKEN` / `FIELDWORK_API_URL` environment variables → the `fieldwork login` config (`~/.config/fieldwork/config.json`). One token binds one organization; `fieldwork orgs use` re-runs the browser flow to switch. Revoke a login anytime in Fieldwork under Settings → Connected apps.
+
+Prefer a native tool surface in an MCP-capable harness? Fieldwork is also a remote MCP server:
+
+```bash
+claude mcp add --transport http fieldwork https://app.getfieldwork.ai/mcp
+```
+
+## Exit codes
+
+`0` success (including tool-level `Error:` strings) · `1` server/network · `2` usage or validation · `3` unauthenticated · `4` forbidden · `5` not found · `6` conflict · `7` rate-limited
+
+## Development and releases
+
+Source stays in the private app repository under `cli/`. Run `pnpm install --frozen-lockfile`, `pnpm build`, and `pnpm test` here. Publish the compiled package with `npm publish --access public`; the package includes `dist/` and npm metadata, without TypeScript source or source maps. `scripts/pack-cli.sh` builds and packs this same package into the compute image without depending on an npm release.
+
+The terminal chat client is the separate public `@fieldwork-ai/fieldwork-code` package (`fwcode`).

package/dist/app-bundle.d.ts

@@ -0,0 +1,6 @@
+export type AppFiles = Record<string, string | {
+    encoding: "base64";
+    data: string;
+}>;
+export declare function readAppBundle(dir: string): AppFiles;
+export declare function writeAppBundle(dir: string, files: AppFiles): string[];

package/dist/app-bundle.js

@@ -0,0 +1,75 @@
+import { lstatSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+const MAX_BYTES = 10 * 1024 * 1024;
+const MAX_FILES = 40;
+function validPath(name) {
+    return name.length <= 240 && /^([a-z0-9][a-z0-9._-]*\/)*[a-z0-9][a-z0-9._-]*$/i.test(name) && !name.includes("..");
+}
+export function readAppBundle(dir) {
+    const files = Object.create(null);
+    let total = 0;
+    const walk = (rel) => {
+        const abs = path.join(dir, rel);
+        const stat = lstatSync(abs);
+        if (stat.isSymbolicLink())
+            throw new Error(`Symlinks are not supported: ${rel || dir}`);
+        if (stat.isDirectory()) {
+            for (const entry of readdirSync(abs)) {
+                if (!entry.startsWith("."))
+                    walk(rel ? `${rel}/${entry}` : entry);
+            }
+            return;
+        }
+        if (!stat.isFile() || !validPath(rel))
+            throw new Error(`Invalid app file: ${rel}`);
+        total += stat.size;
+        if (total > MAX_BYTES || Object.keys(files).length >= MAX_FILES)
+            throw new Error("App exceeds 10 MiB or 40 files");
+        const bytes = readFileSync(abs);
+        const text = bytes.toString("utf8");
+        files[rel] = !text.includes("\0") && !text.includes("\uFFFD") && Buffer.from(text).equals(bytes)
+            ? text : { encoding: "base64", data: bytes.toString("base64") };
+    };
+    walk("");
+    return files;
+}
+export function writeAppBundle(dir, files) {
+    const root = path.resolve(dir);
+    const safeParents = (target) => {
+        for (let current = target;; current = path.dirname(current)) {
+            try {
+                if (lstatSync(current).isSymbolicLink())
+                    throw new Error(`Refusing symlink: ${current}`);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            if (current === root)
+                break;
+        }
+    };
+    let total = 0;
+    const entries = Object.entries(files);
+    if (entries.length > MAX_FILES)
+        throw new Error("App exceeds 40 files");
+    const prepared = entries.map(([name, file]) => {
+        if (!validPath(name))
+            throw new Error(`Invalid app path: ${name}`);
+        if (typeof file !== "string" && (file.encoding !== "base64" || typeof file.data !== "string"
+            || file.data.length > Math.ceil(MAX_BYTES / 3) * 4 || Buffer.from(file.data, "base64").toString("base64") !== file.data))
+            throw new Error(`Invalid binary file: ${name}`);
+        const bytes = typeof file === "string" ? Buffer.from(file) : Buffer.from(file.data, "base64");
+        total += bytes.length;
+        if (total > MAX_BYTES)
+            throw new Error("App exceeds 10 MiB");
+        const target = path.join(root, name);
+        safeParents(target);
+        return { name, target, bytes };
+    });
+    for (const { target, bytes } of prepared) {
+        mkdirSync(path.dirname(target), { recursive: true });
+        writeFileSync(target, bytes);
+    }
+    return prepared.map(entry => entry.name);
+}

package/dist/bundle.d.ts

@@ -0,0 +1,5 @@
+/** Read a local bundle directory into {path: content}, files only, skipping
+ * dotfiles — publish-side validation enforces the real limits. */
+export declare function readBundle(dir: string): Record<string, string>;
+/** Write a pulled {path: content} tree under dir, creating directories. */
+export declare function writeBundle(dir: string, files: Record<string, string>): string[];

package/dist/bundle.js

@@ -0,0 +1,38 @@
+import { mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { EXIT, fail } from "./output.js";
+/** Read a local bundle directory into {path: content}, files only, skipping
+ * dotfiles — publish-side validation enforces the real limits. */
+export function readBundle(dir) {
+    const files = {};
+    const walk = (rel) => {
+        for (const entry of readdirSync(path.join(dir, rel))) {
+            if (entry.startsWith("."))
+                continue;
+            const relPath = rel ? `${rel}/${entry}` : entry;
+            const abs = path.join(dir, relPath);
+            if (statSync(abs).isDirectory())
+                walk(relPath);
+            else
+                files[relPath] = readFileSync(abs, "utf8");
+        }
+    };
+    try {
+        walk("");
+    }
+    catch (err) {
+        fail(`could not read ${dir}: ${err instanceof Error ? err.message : "unknown error"}`, EXIT.usage);
+    }
+    return files;
+}
+/** Write a pulled {path: content} tree under dir, creating directories. */
+export function writeBundle(dir, files) {
+    const written = [];
+    for (const [file, content] of Object.entries(files)) {
+        const target = path.join(dir, file);
+        mkdirSync(path.dirname(target), { recursive: true });
+        writeFileSync(target, content);
+        written.push(file);
+    }
+    return written;
+}

package/dist/commands/apps.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare function registerAppCommands(program: Command): void;

package/dist/commands/apps.js

@@ -0,0 +1,96 @@
+import path from "node:path";
+import { readAppBundle, writeAppBundle } from "../app-bundle.js";
+import { apiJson, getContext, requireOrgId } from "../http.js";
+import { EXIT, confirm, fail, note, printData } from "../output.js";
+async function resolveApp(slug) {
+    const body = await apiJson(`/api/organizations/${requireOrgId()}/apps?slug=${encodeURIComponent(slug)}`);
+    const app = body.apps?.[0];
+    if (!app)
+        fail(`no app at "${slug}"`, EXIT.notFound);
+    return app;
+}
+export function registerAppCommands(program) {
+    const apps = program.command("apps").description("Org apps (deployed mini-apps)");
+    apps
+        .command("list")
+        .description("List the apps you can access")
+        .action(async () => {
+        const { json } = getContext();
+        const body = await apiJson(`/api/organizations/${requireOrgId()}/apps`);
+        if (json) {
+            printData(body, true);
+            return;
+        }
+        for (const app of body.apps) {
+            printData(`${app.slug}\tr${app.latest_revision_number}\t${app.title}`, false);
+        }
+    });
+    apps
+        .command("get <slug>")
+        .description("One app's metadata")
+        .action(async (slug) => {
+        printData(await resolveApp(slug), getContext().json);
+    });
+    apps
+        .command("init <slug>")
+        .description("Scaffold a new app bundle locally")
+        .option("--title <title>", "display title (defaults to the slug)")
+        .option("--out <dir>", "target directory (defaults to ./<slug>)")
+        .action(async (slug, opts) => {
+        const { json } = getContext();
+        if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) {
+            fail(`invalid slug "${slug}" — lowercase kebab-case`, EXIT.usage);
+        }
+        const dir = opts.out ?? slug;
+        const title = opts.title ?? slug;
+        // Fetched, not vendored: the bundle's styles.css embeds the platform's
+        // live design tokens, which the CLI cannot compute locally (APP-89).
+        const body = await apiJson(`/api/organizations/${requireOrgId()}/apps/scaffold?title=${encodeURIComponent(title)}`);
+        const scaffolded = writeAppBundle(dir, body.files);
+        if (json) {
+            printData({ slug, dir, scaffolded }, true);
+            return;
+        }
+        note(`Scaffolded ${scaffolded.length} files in ${dir}/ — edit, then: fieldwork apps publish ${dir} --slug ${slug} --message "first deploy"`);
+    });
+    apps
+        .command("pull <slug>")
+        .description("Download an app's source tree")
+        .option("--out <dir>", "target directory (defaults to ./<slug>)")
+        .option("--revision <n>", "a historical revision instead of head")
+        .action(async (slug, opts) => {
+        const { json } = getContext();
+        const app = await resolveApp(slug);
+        const suffix = opts.revision ? `?revision=${opts.revision}` : "";
+        const body = await apiJson(`/api/organizations/${requireOrgId()}/apps/${app.app_id}/source${suffix}`);
+        const dir = opts.out ?? slug;
+        const pulled = writeAppBundle(dir, body.files);
+        if (json) {
+            printData({ slug, revision: body.revision, dir, pulled }, true);
+            return;
+        }
+        note(`Pulled "${slug}" revision ${body.revision} into ${dir}/ — pass --base-revision ${body.revision} when publishing.`);
+    });
+    apps
+        .command("publish <dir>")
+        .description("Deploy a bundle directory as a new revision (creates the app on first publish)")
+        .requiredOption("--message <message>", "what changed and why")
+        .option("--slug <slug>", "app slug (defaults to the directory name)")
+        .option("--base-revision <n>", "head revision your changes are based on (required for existing apps)")
+        .action(async (dir, opts) => {
+        const { json, yes } = getContext();
+        const slug = opts.slug ?? path.basename(path.resolve(dir));
+        const files = readAppBundle(dir);
+        await confirm(`Publish ${Object.keys(files).length} files to "${slug}"?`, yes);
+        const body = await apiJson(`/api/organizations/${requireOrgId()}/apps/publish`, {
+            method: "POST",
+            body: JSON.stringify({
+                slug,
+                message: opts.message,
+                base_revision: opts.baseRevision ? Number(opts.baseRevision) : undefined,
+                files,
+            }),
+        });
+        printData(body, json);
+    });
+}

package/dist/commands/assets.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare function registerAssetCommands(program: Command): void;

package/dist/commands/assets.js

@@ -0,0 +1,170 @@
+import { apiJson, getContext, requireOrgId } from "../http.js";
+import { EXIT, fail, printData, printTabular } from "../output.js";
+import { applyArgEntries, readStdin } from "./tool.js";
+export function registerAssetCommands(program) {
+    const agents = program.command("agents").description("Org agents (named personas)");
+    agents
+        .command("list")
+        .description("List the agents you can access")
+        .action(async () => {
+        const { json } = getContext();
+        const body = await apiJson(`/api/organizations/${requireOrgId()}/agents`);
+        if (json) {
+            printData(body, true);
+            return;
+        }
+        for (const a of body.agents) {
+            printData(`${a.slug}\tr${a.latest_revision_number}\t${a.name}${a.description ? `\t${a.description}` : ""}`, false);
+        }
+    });
+    agents
+        .command("get <slug>")
+        .description("Read one agent in full")
+        .action(async (slug) => {
+        const body = await apiJson(`/api/organizations/${requireOrgId()}/agents?slug=${encodeURIComponent(slug)}`);
+        const agent = body.agents?.[0];
+        if (!agent)
+            fail(`no agent at "${slug}"`, EXIT.notFound);
+        printData(agent, getContext().json);
+    });
+    const data = program.command("data").description("Curated datalake tables");
+    data
+        .command("list")
+        .description("List the curated tables you can read")
+        .action(async () => {
+        const { json } = getContext();
+        const body = await apiJson(`/api/organizations/${requireOrgId()}/datalake/tables`);
+        if (json) {
+            printData(body, true);
+            return;
+        }
+        for (const t of body.tables) {
+            const rows = t.latestSnapshot ? `${t.latestSnapshot.rowCount} rows` : "no data yet";
+            printData(`${t.name}\t${rows}\t${t.freshness}${t.description ? `\t${t.description}` : ""}`, false);
+        }
+    });
+    data
+        .command("schema <table>")
+        .description("A table's columns and catalog documentation")
+        .action(async (table) => {
+        const { json } = getContext();
+        const list = await apiJson(`/api/organizations/${requireOrgId()}/datalake/tables`);
+        const found = list.tables.find((t) => t.name === table);
+        if (!found)
+            fail(`no table "${table}" — check fieldwork data list`, EXIT.notFound);
+        const body = await apiJson(`/api/organizations/${requireOrgId()}/datalake/tables/${found.datalakeTableId}`);
+        if (json) {
+            printData(body, true);
+            return;
+        }
+        const detail = body.table;
+        for (const c of detail.schema?.columns ?? []) {
+            printData(`${c.name}\t${c.type}${c.description ? `\t${c.description}` : ""}`, false);
+        }
+        if (detail.doc)
+            printData(`\n${detail.doc}`, false);
+    });
+    data
+        .command("query [sql]")
+        .description("Run SQL over the curated datalake tables ('-' or omitted reads stdin)")
+        .option("--param <entry...>", "bind a named parameter: key=value or key:=json", [])
+        .option("--tables <names>", "comma-separated tables to mount (default: all readable)")
+        .action(async (sql, opts) => {
+        const { json } = getContext();
+        const statement = sql === undefined || sql === "-" ? await readStdin() : sql;
+        if (!statement?.trim())
+            fail("no SQL given (pass it as an argument or on stdin)", EXIT.usage);
+        const params = applyArgEntries({}, opts.param, "--param");
+        const body = await apiJson(`/api/organizations/${requireOrgId()}/datalake/query`, {
+            method: "POST",
+            body: JSON.stringify({
+                sql: statement,
+                ...(opts.param.length > 0 ? { params } : {}),
+                ...(opts.tables ? { tables: opts.tables.split(",").map((t) => t.trim()) } : {}),
+            }),
+        });
+        printTabular(body, json);
+    });
+    const db = program.command("db").description("Connected databases (read-only)");
+    db.command("list")
+        .description("List connected databases")
+        .action(async () => {
+        const { json } = getContext();
+        const body = await apiJson(`/api/organizations/${requireOrgId()}/db-connectors`);
+        if (json) {
+            printData(body, true);
+            return;
+        }
+        for (const c of body.connectors) {
+            const restricted = c.restricted_tables ? "\trestricted tables" : "";
+            printData(`${dbAddressOf(c)}\t${c.display_name ?? c.name}\t${c.engine}\t${c.label}\tread-only ${c.read_only}${restricted}`, false);
+        }
+    });
+    db.command("schema <database> [table]")
+        .description("A database's tables, or one table's columns")
+        .option("--schema <schema>", "schema name (required with a table on restricted databases)")
+        .action(async (database, table, opts) => {
+        const { json } = getContext();
+        const row = await resolveDbConnector(database);
+        const query = new URLSearchParams();
+        if (opts.schema)
+            query.set("schema", opts.schema);
+        if (table)
+            query.set("table", table);
+        const suffix = query.size > 0 ? `?${query}` : "";
+        const body = await apiJson(`/api/organizations/${requireOrgId()}/db-connectors/${dbAddressOf(row)}/schema${suffix}`);
+        if (json) {
+            printData(body, true);
+            return;
+        }
+        if (body.columns) {
+            for (const c of body.columns) {
+                printData(`${c.name}\t${c.type}${c.nullable === false ? "\tNOT NULL" : ""}`, false);
+            }
+        }
+        else {
+            for (const t of body.tables ?? [])
+                printData(`${t.schema}.${t.name}`, false);
+        }
+    });
+    db.command("query <database> [sql]")
+        .description("Run a read-only SQL query ('-' or omitted reads stdin; --sql kept for compatibility)")
+        .option("--sql <sql>", "the SELECT to run")
+        .option("--param <entry...>", "bind one positional parameter (repeat in order): value or :=json", [])
+        .action(async (database, sql, opts) => {
+        const { json } = getContext();
+        const statement = opts.sql ?? (sql === undefined || sql === "-" ? await readStdin() : sql);
+        if (!statement?.trim())
+            fail("no SQL given (argument, --sql, or stdin)", EXIT.usage);
+        const row = await resolveDbConnector(database);
+        const values = opts.param.map((p) => p.startsWith(":=") ? JSON.parse(p.slice(2)) : p);
+        const body = await apiJson(`/api/organizations/${requireOrgId()}/db-connectors/${dbAddressOf(row)}/query`, {
+            method: "POST",
+            body: JSON.stringify({
+                sql: statement,
+                ...(values.length > 0 ? { params: values } : {}),
+            }),
+        });
+        printTabular(body, json);
+    });
+}
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Resolve id, name, or display name against the caller's readable list —
+ * the db_query resolveDatabase semantics, client-side. */
+/** How a connector is addressed in a URL (ADR 20260819): the definition key for
+ * a global system, its id for an org-authored one. Mirrors `connectorAddress`
+ * in the app; the CLI is its own package and shares no code with it. */
+function dbAddressOf(c) {
+    return c.definition_is_global ? c.definition_key : c.connector_definition_id;
+}
+async function resolveDbConnector(database) {
+    const body = await apiJson(`/api/organizations/${requireOrgId()}/db-connectors`);
+    const found = UUID_RE.test(database)
+        ? body.connectors.find((c) => c.connector_definition_id === database)
+        : (body.connectors.find((c) => c.definition_key === database) ??
+            body.connectors.find((c) => c.name === database) ??
+            body.connectors.find((c) => c.display_name === database));
+    if (!found)
+        fail(`no connected database "${database}" — check fieldwork db list`, EXIT.notFound);
+    return found;
+}

package/dist/commands/auth.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare function registerAuthCommands(program: Command): void;

package/dist/commands/auth.js

@@ -0,0 +1,113 @@
+import { rmSync } from "node:fs";
+import { decodeToken, loginConfigPath } from "../config.js";
+import { getContext } from "../http.js";
+import { login } from "../oauth.js";
+import { EXIT, fail, note, printData } from "../output.js";
+/** Resolve the pinned org's display name with the fresh token — also the
+ * first live API call of the session, so login fails loudly if the token
+ * doesn't actually work. Falls back to the id alone. */
+async function describeOrg(apiUrl, token, orgId) {
+    if (!orgId)
+        return "(unknown organization)";
+    try {
+        const res = await fetch(`${apiUrl}/api/organizations`, {
+            headers: { authorization: `Bearer ${token}` },
+        });
+        if (res.ok) {
+            const { organizations } = (await res.json());
+            const name = organizations.find((o) => o.organization_id === orgId)?.name;
+            if (name)
+                return `${name} (${orgId})`;
+        }
+    }
+    catch {
+        // Offline or slow API: the id alone is still correct.
+    }
+    return orgId;
+}
+export function registerAuthCommands(program) {
+    program
+        .command("login")
+        .description("Sign in via your browser (org-bound OAuth token)")
+        .action(async () => {
+        const { config, json } = getContext();
+        const result = await login(config.apiUrl);
+        const described = await describeOrg(config.apiUrl, result.access_token, result.organization_id);
+        note(`Signed in. Token pinned to ${described}.`);
+        if (json) {
+            printData({
+                user_id: decodeToken(result.access_token)?.sub ?? null,
+                organization_id: result.organization_id ?? null,
+                api_url: config.apiUrl,
+            }, true);
+        }
+    });
+    program
+        .command("logout")
+        .description("Forget the login-managed token (revoke the grant in Settings → Connected apps)")
+        .action(() => {
+        const { json } = getContext();
+        let removed = true;
+        try {
+            rmSync(loginConfigPath());
+            note("Logged out.");
+        }
+        catch {
+            removed = false;
+            note("Nothing to log out of.");
+        }
+        if (json)
+            printData({ logged_out: removed }, true);
+    });
+    program
+        .command("whoami")
+        .description("Who the current credential acts as (decoded locally, verified server-side)")
+        .action(() => {
+        const { config, json } = getContext();
+        if (!config.token) {
+            fail("no credentials — run `fieldwork login`", EXIT.auth);
+        }
+        const decoded = decodeToken(config.token);
+        if (!decoded)
+            fail("the current token is unreadable", EXIT.auth);
+        printData({
+            user_id: decoded.sub ?? null,
+            organization_id: decoded.org ?? decoded.organization_id ?? null,
+            conversation_id: decoded.cnv ?? null,
+            kind: decoded.typ === "cli" ? "container" : "oauth",
+            source: config.source,
+            expires_at: decoded.exp ? new Date(decoded.exp * 1000).toISOString() : null,
+            api_url: config.apiUrl,
+        }, json);
+    });
+    const orgs = program.command("orgs").description("Organization binding");
+    orgs
+        .command("current")
+        .description("The organization the current token is pinned to")
+        .action(() => {
+        const { config, json } = getContext();
+        const decoded = config.token ? decodeToken(config.token) : null;
+        const org = decoded?.org ?? decoded?.organization_id ?? null;
+        if (!org)
+            fail("no org-pinned credential — run `fieldwork login`", EXIT.auth);
+        printData({ organization_id: org }, json);
+    });
+    orgs
+        .command("use")
+        .description("Switch organization: re-run the browser sign-in and pick a different org")
+        .action(async () => {
+        const { config, json } = getContext();
+        // One token per org (the pin lives in the credential): switching is a
+        // fresh authorize, where the org picker/consent page names the org.
+        const result = await login(config.apiUrl);
+        const described = await describeOrg(config.apiUrl, result.access_token, result.organization_id);
+        note(`Now acting in ${described}.`);
+        if (json) {
+            printData({
+                user_id: decodeToken(result.access_token)?.sub ?? null,
+                organization_id: result.organization_id ?? null,
+                api_url: config.apiUrl,
+            }, true);
+        }
+    });
+}

package/dist/commands/automations.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare function registerAutomationCommands(program: Command): void;