@fulldivevr/workcord-cli 1.0.0 → 1.1.1

package/README.md

@@ -20,13 +20,15 @@ npx @fulldivevr/workcord-cli --help
 
 | Setting | How |
 | --- | --- |
-| Base URL | `WORKCORD_API_URL` env var or `--base-url <url>` — **required, no default** |
-| Signing secret | `WORKCORD_JWT_SECRET` env var **only** — never a flag |
+| Base URL | WorkCord production by default; override with saved configuration, `WORKCORD_API_URL`, or `--base-url <url>` |
+| User token | Saved by `auth login --save`, or supplied by `WORKCORD_TOKEN` |
+| Signing secret | `WORKCORD_JWT_SECRET` env var **only** — never a flag; privileged, enables `--as` impersonation |
 | Internal admin key | `WORKCORD_INTERNAL_API_KEY`, internal commands only |
-| Acting user | `--as <userId>`, per invocation |
+| Acting user | `--as <userId>`, per invocation — only with `WORKCORD_JWT_SECRET` |
 
 Base URL must be a bare origin (scheme + host, no path). The `/api/v1` prefix
-is added by the CLI.
+is added by the CLI. Resolution order is `--base-url`, `WORKCORD_API_URL`,
+saved configuration, then the WorkCord production default.
 
 | Deployment | `WORKCORD_API_URL` |
 | --- | --- |
@@ -39,38 +41,66 @@ is added by the CLI.
 | Local RoomCord / JesusCord | `http://localhost:3000` |
 
 ```bash
-export WORKCORD_API_URL=https://work-rooms-api.wizeup.app
-export WORKCORD_JWT_SECRET=<the server's JWT_SECRET>
+workcord auth login --email you@company.com --save
 
-workcord --as <userId> users get-me
+workcord rooms list
+```
+
+Use another server for one command:
+
+```bash
+workcord --base-url https://via-rooms-api.wizeup.app rooms list
+```
+
+Save another server and login for future commands:
+
+```bash
+workcord --base-url https://via-rooms-api.wizeup.app auth login --email you@via.com --save
+```
+
+Reset the saved server to WorkCord by logging in and saving again:
+
+```bash
+workcord --base-url https://work-rooms-api.wizeup.app auth login --email you@company.com --save
 ```
 
 Output is JSON on stdout, errors on stderr, non-zero exit on failure.
 
 ### How auth works
 
-Three distinct modes.
+Every request carries a bearer token. There are two ways to get one, and one
+extra header for internal admin routes.
 
-**1. Normal user login (email code).** Deployed WorkCord/VIA stacks run with
-`ENABLE_EMAIL_AUTH=true` and mail a 6-digit code:
+**1. A real user token (normal path).** Log in once with `--save`, and every
+command runs as that user with exactly that user's permissions:
 
 ```bash
-workcord auth login --email you@company.com
-# → code arrives by email, CLI prompts for it, prints { token, accessToken, refreshToken, user, isNewUser }
+workcord auth login --email you@company.com --save
+# → code arrives by email, CLI prompts for it, prints
+#   { token, accessToken, refreshToken, user, isNewUser } on stdout
+#   and confirms the login was saved locally
+
+workcord rooms list
 ```
 
-Non-interactive (no TTY) it prints a `sessionId` and you finish with:
+`WORKCORD_TOKEN` is sent as-is in `Authorization: Bearer`; the CLI never signs
+anything in this mode and `--as` is not needed. This is the least-privilege
+setup and the right one for agents.
+
+Non-interactive (no TTY) `auth login --email` prints a `sessionId` and you
+finish with:
 
 ```bash
 workcord auth verify-email --session-id <id> --code 123456
 ```
 
 Email login returns `accessToken`; phone/social login returns `token`. The CLI
-emits both fields on either path so callers can read one consistently.
+emits both fields on either path so callers can read one consistently — either
+value works as `WORKCORD_TOKEN`.
 
 Email auth is domain-restricted. WorkCord prod and VIA both allow
 `fulldive.com`, `via.com`, `via.com.tw`, `viatech.com.cn`, `*.tvbs.com`,
-`tvbs.*.com`, `tvbs.com.*` (`EMAIL_AUTH_ALLOWED_DOMAINS` in
+`tvbs.*.com`, `tvbs.com.*`, and `*.tvbs.com.tw` (`EMAIL_AUTH_ALLOWED_DOMAINS` in
 `.sc/stacks/wize-rooms-api/client.yaml`). Anything else gets
 `DOMAIN_NOT_ALLOWED`.
 
@@ -78,16 +108,37 @@ Email auth is domain-restricted. WorkCord prod and VIA both allow
 set `AUTH_PHONE_OTP_DEV_BYPASS`, so `POST /auth/send-otp` returns 503
 `OTP_NOT_AVAILABLE` — the CLI turns that into an explicit "use `--email`" error.
 
-**2. Impersonation / agent auth.** With `WORKCORD_JWT_SECRET` set, the global
-`--as <userId>` flag mints an HS256 JWT locally (payload `{userId, id}`, 60-day
-expiry) instead of logging in. `WORKCORD_JWT_SECRET` must equal the **server's
-`JWT_SECRET`** env var — the names deliberately differ, and this is the most
-common setup mistake.
+Tokens expire. On `401`, log in again with `--save`, or replace `WORKCORD_TOKEN`.
+
+**2. Local minting / impersonation (privileged, trusted CI only).** With
+`WORKCORD_JWT_SECRET` set, the global `--as <userId>` flag mints an HS256 JWT
+locally (payload `{userId, id}`, 60-day expiry) instead of logging in.
+`WORKCORD_JWT_SECRET` must equal the **server's `JWT_SECRET`** env var — the
+names deliberately differ, and this is the most common setup mistake.
+
+```bash
+export WORKCORD_JWT_SECRET=<the server's JWT_SECRET>
+workcord --as <userId> users get-me
+```
 
 Same secret on both sides means the CLI can act as **any** user, with no
 password and no server-side check. Treat it as privileged signing material:
 keep it out of source control, package metadata, logs, screenshots and public
-examples, and run this CLI only from trusted machines and CI jobs.
+examples, and run this CLI only from trusted machines and CI jobs. Prefer
+`WORKCORD_TOKEN` unless you actually need to switch identities.
+
+Resolution order, in one place (`resolveAuth` in `src/auth.ts`):
+
+| Situation | Result |
+| --- | --- |
+| `--as <userId>` passed, `WORKCORD_JWT_SECRET` set | mint and impersonate that user |
+| `--as <userId>` passed, no secret | error — set the secret or drop `--as` |
+| no `--as`, `WORKCORD_TOKEN` set | send that token verbatim |
+| no `--as`, only `WORKCORD_JWT_SECRET` set | error — `--as <userId>` required |
+| neither set | error naming both options |
+
+`--as` wins over `WORKCORD_TOKEN` when both are available: passing it is an
+explicit statement of impersonation intent.
 
 **3. Internal admin routes.** `WORKCORD_INTERNAL_API_KEY` is sent as the
 `x-internal-key` header; the server compares it to its own `INTERNAL_API_KEY`.
@@ -99,6 +150,9 @@ Required for `/internal/*` and the jesuscord admin routes. Treat it like the sig
 workcord [--as <userId>] <namespace> <command> [flags]
 ```
 
+`--as` is only needed when minting with `WORKCORD_JWT_SECRET`; with
+`WORKCORD_TOKEN` set, omit it everywhere.
+
 - `workcord --help` lists namespaces.
 - `workcord <namespace> --help` lists that namespace's commands.
 - `workcord <namespace> <command> --help` shows the command's flags.
@@ -133,8 +187,8 @@ profile fields.
 
 Server auto-extracts mention tokens from visible `@Name` text. Prefer
 `messages send-text --mention-user USER_ID` so the CLI resolves the room
-member's display name and avoids exposing raw user ids. `auth login` is the
-only semantic command that doesn't take `--as` (it returns one).
+member's display name and avoids exposing raw user ids. `auth login` never
+takes `--as` — it is how you obtain a `WORKCORD_TOKEN` in the first place.
 
 ### Error handling
 
@@ -196,8 +250,9 @@ from each room, merges them by `sentAt` descending, and includes
 
 **Switch user identity per call:**
 
-The CLI is stateless — `--as <userId>` per invocation. One process can act as
-100 users by changing the flag.
+Saved login is for one interactive user. Agents can use `WORKCORD_TOKEN` to
+choose the token owner per invocation; with `WORKCORD_JWT_SECRET`, one process
+can act as 100 users by changing `--as <userId>` per invocation.
 
 **Onboard a fresh agent identity:**
 
@@ -255,7 +310,7 @@ without running `regen` if you don't need the latest server changes.
 ```
 src/
 ├── cli.ts                  commander entry, global --as flag
-├── auth.ts                 mints HS256 JWT from --as
+├── auth.ts                 auth resolution: WORKCORD_TOKEN vs minted --as JWT
 ├── client.ts               fetch wrapper (JSON + multipart)
 ├── commands/               hand-written semantic commands
 └── generated/              auto-generated from openapi.json
@@ -266,7 +321,9 @@ scripts/
 ├── sync-spec.ts            backend build → openapi.json
 └── generate-commands.ts    spec → commander commands
 
-tests/smoke.sh              hermetic end-to-end test
+tests/
+├── auth.test.ts            node --test suite for auth resolution
+└── smoke.sh                end-to-end test, needs a live server
 ```
 
 ### Adding a hand-written semantic command
@@ -283,7 +340,8 @@ flags (e.g. typed fields instead of an opaque `--body`):
 ### Testing
 
 ```bash
-npm run smoke
+npm test           # hermetic, no network — auth resolution rules
+npm run smoke      # end-to-end, needs a live server
 ```
 
 Hermetic end-to-end suite (creates two fresh users per run via OTP, exercises
@@ -297,14 +355,14 @@ Publishing is a manual maintainer action — there is no auto-publish CI.
 
 1. `npm run regen` — refresh the spec and generated commands; commit the diff.
 2. `npm run typecheck`
-3. `npm run build`
+3. `npm test` then `npm run build`
 4. `npm pack --dry-run` — confirm the file list is exactly `dist/**/*.js`,
    `README.md`, `LICENSE`, `package.json`. No sources, no `openapi.json`, no
    `.npmrc`.
 5. Smoke: `node dist/cli.js --help` and `node dist/cli.js --version`.
 6. Bump `version` in `package.json`, then `npm publish`.
 
-`prepack` re-runs `typecheck` + `build`, so steps 2–3 also gate the publish.
+`prepack` re-runs `typecheck` + `test` + `build`, so steps 2–3 also gate the publish.
 
 ## License
 

package/dist/auth.js

@@ -1,9 +1,43 @@
 import jwt from "jsonwebtoken";
-export function mintToken(userId) {
-    const secret = process.env.WORKCORD_JWT_SECRET;
-    if (!secret) {
+export function actingUserId(program) {
+    return program.opts().as;
+}
+export function mintToken(userId, secret) {
+    const key = secret ?? process.env.WORKCORD_JWT_SECRET;
+    if (!key) {
         throw new Error("WORKCORD_JWT_SECRET not set");
     }
-    return jwt.sign({ userId, id: userId }, secret, { algorithm: "HS256", expiresIn: "60d" });
+    return jwt.sign({ userId, id: userId }, key, { algorithm: "HS256", expiresIn: "60d" });
+}
+export function resolveAuth(asUserId, env = process.env, config = {}) {
+    const secret = env.WORKCORD_JWT_SECRET?.trim() || undefined;
+    const token = env.WORKCORD_TOKEN?.trim() || config.token?.trim() || undefined;
+    if (asUserId) {
+        if (!secret) {
+            throw new Error("--as <userId> mints a token and needs WORKCORD_JWT_SECRET. Set it, or drop --as and set WORKCORD_TOKEN to a token from `workcord auth login`.");
+        }
+        const minted = mintToken(asUserId, secret);
+        return { mode: "minted", bearer: `Bearer ${minted}`, token: minted, userId: asUserId };
+    }
+    if (token) {
+        return { mode: "token", bearer: `Bearer ${token}`, token };
+    }
+    if (secret) {
+        throw new Error("--as <userId> is required when authenticating with WORKCORD_JWT_SECRET");
+    }
+    throw new Error("No credentials. Run `workcord auth login --email <address> --save`, or set WORKCORD_TOKEN. For privileged impersonation, set WORKCORD_JWT_SECRET and pass --as <userId>.");
+}
+export function decodeJwtPayload(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return null;
+    try {
+        const json = Buffer.from(parts[1], "base64url").toString("utf8");
+        const parsed = JSON.parse(json);
+        return parsed && typeof parsed === "object" ? parsed : null;
+    }
+    catch {
+        return null;
+    }
 }
 //# sourceMappingURL=auth.js.map

package/dist/cli.js

@@ -11,6 +11,7 @@ import { registerUsers } from "./commands/users.js";
 import { registerRoomAgents } from "./commands/room-agents.js";
 import { registerCustomAgents } from "./commands/custom-agents.js";
 import { registerChallenges } from "./commands/challenges.js";
+import { registerHealth } from "./commands/health.js";
 import { registerAll as registerGenerated } from "./generated/index.js";
 const program = new Command();
 const require = createRequire(import.meta.url);
@@ -20,7 +21,7 @@ program
     .description("CLI for the WorkCord API. One invocation = one user action.")
     .version(version)
     .option("--as <userId>", "user to act as")
-    .option("--base-url <url>", "API base URL (overrides WORKCORD_API_URL)");
+    .option("--base-url <url>", "API base URL (overrides WORKCORD_API_URL and saved configuration)");
 program.hook("preAction", () => {
     setBaseUrlOverride(program.opts().baseUrl);
 });
@@ -33,6 +34,7 @@ registerUsers(program);
 registerRoomAgents(program);
 registerCustomAgents(program);
 registerChallenges(program); // adds regenerate-cards (not in the OpenAPI spec)
+registerHealth(program);
 registerGenerated(program);
 program.parseAsync().catch((err) => {
     const out = { error: err.message ?? String(err) };

package/dist/client.js

@@ -1,13 +1,14 @@
-import { mintToken } from "./auth.js";
+import { resolveAuth } from "./auth.js";
+import { DEFAULT_BASE_URL, readConfig } from "./config.js";
 let baseUrlOverride;
 export function setBaseUrlOverride(url) {
     baseUrlOverride = url;
 }
-export function getBaseUrl() {
-    const raw = baseUrlOverride || process.env.WORKCORD_API_URL;
-    if (!raw) {
-        throw new Error("No API base URL configured. Set WORKCORD_API_URL or pass --base-url <url> (e.g. https://work-rooms-api.wizeup.app)");
-    }
+export async function getBaseUrl() {
+    const config = await readConfig();
+    return normalizeBaseUrl(baseUrlOverride || process.env.WORKCORD_API_URL || config.baseUrl || DEFAULT_BASE_URL);
+}
+function normalizeBaseUrl(raw) {
     const trimmed = raw.replace(/\/+$/, "");
     let parsed;
     try {
@@ -52,7 +53,15 @@ async function fetchWithRetry(build) {
     throw lastErr;
 }
 export async function call({ method = "GET", path, query, body, headers, asUserId }) {
-    const base = getBaseUrl();
+    const config = await readConfig();
+    const { bearer } = resolveAuth(asUserId, process.env, config);
+    return request({ method, path, query, body, headers, bearer });
+}
+export async function callPublic({ method = "GET", path, query, body, headers }) {
+    return request({ method, path, query, body, headers });
+}
+async function request({ method = "GET", path, query, body, headers, bearer }) {
+    const base = await getBaseUrl();
     const url = new URL(base + path);
     if (query) {
         for (const [k, v] of Object.entries(query)) {
@@ -60,14 +69,13 @@ export async function call({ method = "GET", path, query, body, headers, asUserI
                 url.searchParams.set(k, String(v));
         }
     }
-    const token = mintToken(asUserId);
     const res = await fetchWithRetry(() => ({
         url,
         init: {
             method,
             headers: {
                 "content-type": "application/json",
-                authorization: `Bearer ${token}`,
+                ...(bearer ? { authorization: bearer } : {}),
                 ...headers,
             },
             body: body !== undefined ? JSON.stringify(body) : undefined,
@@ -92,9 +100,10 @@ function safeJson(s) {
     }
 }
 export async function callMultipart({ path, asUserId, fields, file }) {
-    const base = getBaseUrl();
+    const config = await readConfig();
+    const { bearer } = resolveAuth(asUserId, process.env, config);
+    const base = await getBaseUrl();
     const url = base + path;
-    const token = mintToken(asUserId);
     const res = await fetchWithRetry(() => {
         const fd = new FormData();
         if (fields) {
@@ -107,7 +116,7 @@ export async function callMultipart({ path, asUserId, fields, file }) {
             url,
             init: {
                 method: "POST",
-                headers: { authorization: `Bearer ${token}` },
+                headers: { authorization: bearer },
                 body: fd,
             },
         };

package/dist/commands/auth.js

@@ -1,9 +1,10 @@
 import { randomUUID } from "node:crypto";
 import { createInterface } from "node:readline/promises";
 import { getBaseUrl } from "../client.js";
+import { getConfigPath, saveConfig } from "../config.js";
 import { getOrCreateGroup } from "./_group.js";
 async function postJson(path, body) {
-    const res = await fetch(getBaseUrl() + path, {
+    const res = await fetch((await getBaseUrl()) + path, {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify(body),
@@ -37,8 +38,22 @@ function normalize(data) {
         r.accessToken = r.token;
     return r;
 }
-function emit(data) {
-    process.stdout.write(JSON.stringify(normalize(data)) + "\n");
+async function emit(data, save = false) {
+    const result = normalize(data);
+    process.stdout.write(JSON.stringify(result) + "\n");
+    if (save && result.token) {
+        await saveConfig({
+            baseUrl: await getBaseUrl(),
+            token: result.token,
+        });
+        if (process.stdout.isTTY) {
+            process.stderr.write(`Logged in and saved to ${getConfigPath()}. Next: workcord rooms list\n`);
+        }
+        return;
+    }
+    if (result.token) {
+        process.stderr.write("Logged in. Re-run with --save to remember this login on this computer.\n");
+    }
 }
 async function promptCode() {
     const rl = createInterface({ input: process.stdin, output: process.stderr });
@@ -55,7 +70,7 @@ async function verifyEmailCode(sessionId, code) {
     }
     return postJson("/api/v1/auth/email/verify-code", { sessionId, code });
 }
-async function loginByEmail(email, code) {
+async function loginByEmail(email, code, save) {
     const sessionId = randomUUID();
     try {
         await postJson(`/api/v1/auth/email/login/by-code/${encodeURIComponent(sessionId)}`, { email });
@@ -63,8 +78,9 @@ async function loginByEmail(email, code) {
     catch (err) {
         const c = errorCode(err);
         if (c === "DOMAIN_NOT_ALLOWED" || c === "EMAIL_NOT_ALLOWED") {
-            throw new Error(`Email ${email} is not allowed to sign in on this deployment. ` +
-                "Check the stack's EMAIL_AUTH_ALLOWED_DOMAINS / email_auth_allowlist.");
+            const allowed = err.body?.error?.allowedDomains;
+            const domains = Array.isArray(allowed) ? allowed.filter((value) => typeof value === "string") : [];
+            throw new Error(`Email ${email} cannot sign in on this deployment.${domains.length ? ` Allowed domains: ${domains.join(", ")}.` : ""} Try an allowed work address or ask your WorkCord administrator to enable this domain.`);
         }
         throw err;
     }
@@ -75,9 +91,9 @@ async function loginByEmail(email, code) {
         process.stdout.write(JSON.stringify({ sessionId, codeSent: true }) + "\n");
         return;
     }
-    emit(await verifyEmailCode(sessionId, entered));
+    await emit(await verifyEmailCode(sessionId, entered), save);
 }
-async function loginByPhone(phone, code) {
+async function loginByPhone(phone, code, save) {
     try {
         await postJson("/api/v1/auth/send-otp", { phone });
     }
@@ -88,18 +104,20 @@ async function loginByPhone(phone, code) {
         }
         throw err;
     }
-    emit(await postJson("/api/v1/auth/verify-otp", { phone, code }));
+    await emit(await postJson("/api/v1/auth/verify-otp", { phone, code }), save);
 }
 export function registerAuth(program) {
     const group = getOrCreateGroup(program, "auth", "Auth operations");
     group
         .command("login")
-        .description("End-to-end login. Returns { token, accessToken, refreshToken, user, isNewUser }. " +
+        .description("End-to-end login. Use --save to remember this login on this computer. Returns { token, accessToken, refreshToken, user, isNewUser }. " +
         "--email uses the emailed 6-digit code (deployed WorkCord/VIA); --phone uses OTP " +
-        "(local/RoomCord only). Does NOT use --as / WORKCORD_JWT_SECRET — the server mints the token.")
+        "(local/RoomCord only). Does NOT use --as / WORKCORD_JWT_SECRET — the server mints the token. " +
+        "Without --save, set the returned token as WORKCORD_TOKEN to authenticate later commands.")
         .option("--email <address>", "email address (mutually exclusive with --phone)")
         .option("--phone <e164>", 'phone number in E.164 format (e.g. "+14155550199")')
         .option("--code <code>", "verification code; prompted interactively for --email when omitted")
+        .option("--save", "remember this login on this computer")
         .action(async (opts) => {
         if (opts.email && opts.phone) {
             throw new Error("--email and --phone are mutually exclusive");
@@ -108,18 +126,19 @@ export function registerAuth(program) {
             throw new Error("one of --email <address> or --phone <e164> is required");
         }
         if (opts.email) {
-            await loginByEmail(opts.email, opts.code);
+            await loginByEmail(opts.email, opts.code, !!opts.save);
             return;
         }
-        await loginByPhone(opts.phone, opts.code ?? "111111");
+        await loginByPhone(opts.phone, opts.code ?? "111111", !!opts.save);
     });
     group
         .command("verify-email")
         .description("Verify an emailed code for a session started by `auth login --email`")
         .requiredOption("--session-id <id>", "sessionId printed by `auth login --email`")
         .requiredOption("--code <code>", "6-digit code from the email")
+        .option("--save", "remember this login on this computer")
         .action(async (opts) => {
-        emit(await verifyEmailCode(opts.sessionId, opts.code));
+        await emit(await verifyEmailCode(opts.sessionId, opts.code), !!opts.save);
     });
 }
 //# sourceMappingURL=auth.js.map

package/dist/commands/challenges.js

@@ -1,11 +1,6 @@
+import { actingUserId } from "../auth.js";
 import { call } from "../client.js";
 import { getOrCreateGroup } from "./_group.js";
-function currentUser(program) {
-    const { as } = program.opts();
-    if (!as)
-        throw new Error("--as <userId> is required");
-    return as;
-}
 /**
  * Custom challenge commands that are NOT covered by the OpenAPI-generated
  * commands (src/generated/commands/challenges.ts). Everything else — create,
@@ -34,7 +29,7 @@ export function registerChallenges(program) {
             const data = (await call({
                 method: "POST",
                 path: `/api/v1/challenges/${encodeURIComponent(opts.id)}/regenerate-cards?offset=${offset}&limit=10`,
-                asUserId: currentUser(program),
+                asUserId: actingUserId(program),
                 body: {},
             }));
             totals.total = data.total;

package/dist/commands/custom-agents.js

@@ -1,12 +1,7 @@
 import { readFileSync } from "node:fs";
+import { actingUserId } from "../auth.js";
 import { call } from "../client.js";
 import { getOrCreateGroup } from "./_group.js";
-function currentUser(program) {
-    const { as } = program.opts();
-    if (!as)
-        throw new Error("--as <userId> is required");
-    return as;
-}
 function bool(v, name) {
     if (v === undefined)
         return undefined;
@@ -54,7 +49,7 @@ export function registerCustomAgents(program) {
         const data = await call({
             method: "POST",
             path: "/api/v1/agents",
-            asUserId: currentUser(program),
+            asUserId: actingUserId(program),
             body: {
                 name: opts.name,
                 description: opts.description,
@@ -111,7 +106,7 @@ export function registerCustomAgents(program) {
         const data = await call({
             method: "PATCH",
             path: `/api/v1/agents/${encodeURIComponent(opts.agent)}`,
-            asUserId: currentUser(program),
+            asUserId: actingUserId(program),
             body,
         });
         process.stdout.write(JSON.stringify(data) + "\n");

package/dist/commands/dm.js

@@ -1,3 +1,4 @@
+import { actingUserId } from "../auth.js";
 import { call } from "../client.js";
 import { getOrCreateGroup } from "./_group.js";
 export function registerDm(program) {
@@ -10,9 +11,7 @@ export function registerDm(program) {
         .requiredOption("--text <text>", "message body — mention users with @userId inline")
         .option("--reply-to <messageId>", "parent message id (for threaded replies)")
         .action(async (opts) => {
-        const { as } = program.opts();
-        if (!as)
-            throw new Error("--as <userId> is required");
+        const as = actingUserId(program);
         const dm = (await call({
             method: "POST",
             path: "/api/v1/dm/start",

package/dist/commands/health.js

@@ -0,0 +1,29 @@
+import { call, callPublic, getBaseUrl } from "../client.js";
+export function registerHealth(program) {
+    program
+        .command("health")
+        .allowExcessArguments(false)
+        .description("Check the selected server and saved login")
+        .action(async () => {
+        const baseUrl = await getBaseUrl();
+        const health = await callPublic({ path: "/api/health" });
+        let loggedIn = false;
+        let userId;
+        try {
+            const user = await call({ path: "/api/v1/users/me", asUserId: program.opts().as });
+            loggedIn = true;
+            userId = user.id;
+        }
+        catch {
+            loggedIn = false;
+        }
+        process.stdout.write(JSON.stringify({ baseUrl, loggedIn, userId, health }) + "\n");
+    });
+    program
+        .command("hello")
+        .description("Check the selected server")
+        .action(async () => {
+        process.stdout.write(JSON.stringify(await callPublic({ path: "/api/hello" })) + "\n");
+    });
+}
+//# sourceMappingURL=health.js.map