@fulldivevr/workcord-cli 1.0.0

package/LICENSE

@@ -0,0 +1,18 @@
+Copyright (c) 2026 Fulldive. All rights reserved.
+
+This software is proprietary and confidential.
+
+It is published to the npm registry solely to allow authorized Fulldive
+personnel and systems to install it. Publication does not grant any license
+to use, copy, modify, merge, publish, distribute, sublicense, or sell this
+software or derivative works of it.
+
+No rights are granted except by a separate written agreement with Fulldive.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,312 @@
+# @fulldivevr/workcord-cli
+
+TypeScript CLI for the WorkCord API. **One invocation = one user action.**
+Designed for automated agents that emulate real users — wake up, do one
+thing, exit. Route-level commands are generated from the backend's own
+OpenAPI spec; a small set of hand-written semantic commands sits on top.
+
+Lives in the backend repo (`clients/workcord-cli`) so the spec it generates
+from is always the spec this server serves.
+
+## Install
+
+```bash
+npm i -g @fulldivevr/workcord-cli
+# or run without installing
+npx @fulldivevr/workcord-cli --help
+```
+
+## Configuration
+
+| Setting | How |
+| --- | --- |
+| Base URL | `WORKCORD_API_URL` env var or `--base-url <url>` — **required, no default** |
+| Signing secret | `WORKCORD_JWT_SECRET` env var **only** — never a flag |
+| Internal admin key | `WORKCORD_INTERNAL_API_KEY`, internal commands only |
+| Acting user | `--as <userId>`, per invocation |
+
+Base URL must be a bare origin (scheme + host, no path). The `/api/v1` prefix
+is added by the CLI.
+
+| Deployment | `WORKCORD_API_URL` |
+| --- | --- |
+| WorkCord prod | `https://work-rooms-api.wizeup.app` |
+| VIA | `https://via-rooms-api.wizeup.app` |
+| RoomCord prod | `https://rooms-api.wizeup.app` |
+| RoomCord dev | `https://rooms-api-dev.wizeup.app` |
+| JesusCord | `https://jesuscord-api.wizeup.app` |
+| Local WorkCord | `http://localhost:3001` |
+| Local RoomCord / JesusCord | `http://localhost:3000` |
+
+```bash
+export WORKCORD_API_URL=https://work-rooms-api.wizeup.app
+export WORKCORD_JWT_SECRET=<the server's JWT_SECRET>
+
+workcord --as <userId> users get-me
+```
+
+Output is JSON on stdout, errors on stderr, non-zero exit on failure.
+
+### How auth works
+
+Three distinct modes.
+
+**1. Normal user login (email code).** Deployed WorkCord/VIA stacks run with
+`ENABLE_EMAIL_AUTH=true` and mail a 6-digit code:
+
+```bash
+workcord auth login --email you@company.com
+# → code arrives by email, CLI prompts for it, prints { token, accessToken, refreshToken, user, isNewUser }
+```
+
+Non-interactive (no TTY) it prints a `sessionId` and you finish with:
+
+```bash
+workcord auth verify-email --session-id <id> --code 123456
+```
+
+Email login returns `accessToken`; phone/social login returns `token`. The CLI
+emits both fields on either path so callers can read one consistently.
+
+Email auth is domain-restricted. WorkCord prod and VIA both allow
+`fulldive.com`, `via.com`, `via.com.tw`, `viatech.com.cn`, `*.tvbs.com`,
+`tvbs.*.com`, `tvbs.com.*` (`EMAIL_AUTH_ALLOWED_DOMAINS` in
+`.sc/stacks/wize-rooms-api/client.yaml`). Anything else gets
+`DOMAIN_NOT_ALLOWED`.
+
+`auth login --phone` is for local and RoomCord only. Deployed WorkCord does not
+set `AUTH_PHONE_OTP_DEV_BYPASS`, so `POST /auth/send-otp` returns 503
+`OTP_NOT_AVAILABLE` — the CLI turns that into an explicit "use `--email`" error.
+
+**2. Impersonation / agent auth.** With `WORKCORD_JWT_SECRET` set, the global
+`--as <userId>` flag mints an HS256 JWT locally (payload `{userId, id}`, 60-day
+expiry) instead of logging in. `WORKCORD_JWT_SECRET` must equal the **server's
+`JWT_SECRET`** env var — the names deliberately differ, and this is the most
+common setup mistake.
+
+Same secret on both sides means the CLI can act as **any** user, with no
+password and no server-side check. Treat it as privileged signing material:
+keep it out of source control, package metadata, logs, screenshots and public
+examples, and run this CLI only from trusted machines and CI jobs.
+
+**3. Internal admin routes.** `WORKCORD_INTERNAL_API_KEY` is sent as the
+`x-internal-key` header; the server compares it to its own `INTERNAL_API_KEY`.
+Required for `/internal/*` and the jesuscord admin routes. Treat it like the signing secret.
+
+## Usage
+
+```
+workcord [--as <userId>] <namespace> <command> [flags]
+```
+
+- `workcord --help` lists namespaces.
+- `workcord <namespace> --help` lists that namespace's commands.
+- `workcord <namespace> <command> --help` shows the command's flags.
+
+Two layers coexist under the same namespaces.
+
+**Auto-generated** (one per server route, namespaced by controller):
+
+```bash
+workcord <namespace> <command> [--<path-param> <value>] [--body '<json>'] [--query '<json>']
+```
+
+**Hand-written semantic** (small set, rich typed flags):
+
+```bash
+workcord auth login --email you@company.com
+workcord --as USER messages send-text --room R --text "hello"
+```
+
+Semantic aliases cover common agent/admin actions with consistent flags:
+paginated listing/searching public users, internal authenticated/anonymous
+user filters, acting-user room lists, discoverable app-wide room lists, room
+create/update/delete, join/leave/read, list members, remove members,
+list/approve/deny join requests, rotate join codes, get the acting user's
+membership, and merge recent messages visible to a user across rooms. The
+generated route-level commands remain available for every endpoint.
+
+`users list --account-type ...` and `users list --authenticated` use the
+internal API and require `WORKCORD_INTERNAL_API_KEY`.
+Without those flags, `users list` uses public search and only returns public
+profile fields.
+
+Server auto-extracts mention tokens from visible `@Name` text. Prefer
+`messages send-text --mention-user USER_ID` so the CLI resolves the room
+member's display name and avoids exposing raw user ids. `auth login` is the
+only semantic command that doesn't take `--as` (it returns one).
+
+### Error handling
+
+Every error is **a single JSON line on stderr**, with a non-zero exit code:
+
+```json
+{"error":"GET /api/v1/rooms/X -> 404","status":404,"body":{"error":{"code":"NOT_FOUND","message":"Room not found"}}}
+```
+
+Agents can branch on `.status` (`401` → re-login, `404` → resource gone, `5xx`
+→ already retried, give up) and `.body.error.code` for app-specific codes.
+
+## Examples
+
+```bash
+workcord --as USER rooms get-room --room-id R
+workcord --as USER rooms create-room --body '{"name":"hello","isPublic":true}'
+workcord --as USER messages list --room-id R --query '{"cursor":"2026-04-28T00:00:00Z","limit":50}'
+
+workcord --as USER users list --q alex --limit 10
+workcord --as ADMIN users list --account-type anonymous --limit 20
+workcord --as ADMIN users set-plan --user USER_ID --tier pro --platform internal
+workcord --as USER rooms discover --search "ai" --tags ai,tools --limit 20
+workcord --as USER rooms create-with-message --name "ops" --public --tags ai,news --text "First post."
+workcord --as USER rooms members --room R
+workcord --as USER rooms upload-icon-file --room R --file ./icon.png
+workcord --as USER custom-agents create-hosted --name "Helper" --description "Room helper" --prompt-file ./prompt.txt --tools web_search
+workcord --as USER room-agents install-hosted --room R --agent system-wizeup
+workcord --as USER messages react --room R --message M --emoji 👍
+workcord --as USER dm send-text --to USER_B --text "hi"
+```
+
+### Common agent patterns
+
+**Send a message with a mention + image:**
+
+```bash
+URL=$(workcord --as $U rooms upload-image-file --room $R --file ./img.png | jq -r .url)
+workcord --as $U messages send-text --room $R --text "look @user_abc" --attachments "$URL"
+```
+
+**Poll for new messages since last check:**
+
+```bash
+SINCE=2026-04-28T10:00:00Z
+workcord --as $U messages list --room-id $R --query "{\"cursor\":\"$SINCE\",\"limit\":50}"
+```
+
+**Receive latest messages visible to a user across rooms:**
+
+```bash
+workcord --as $U messages latest --limit 50 --per-room-limit 10
+workcord --as $U messages latest --since "$SINCE" --inbox-category aiRooms --limit 100
+```
+
+This composite command lists the acting user's rooms, fetches recent messages
+from each room, merges them by `sentAt` descending, and includes
+`room`/`roomName` context on each message.
+
+**Switch user identity per call:**
+
+The CLI is stateless — `--as <userId>` per invocation. One process can act as
+100 users by changing the flag.
+
+**Onboard a fresh agent identity:**
+
+```bash
+# deployed WorkCord / VIA
+USER=$(workcord auth verify-email --session-id $SID --code $CODE | jq -r .user.id)
+
+# local / RoomCord dev, where AUTH_PHONE_OTP_DEV_BYPASS=true
+USER=$(workcord auth login --phone "+14155550$RANDOM" | jq -r .user.id)
+```
+
+Locally any phone with OTP `111111` works. On deployed WorkCord phone OTP is
+disabled — start with `workcord auth login --email <address>`.
+
+**React to a message + reply with mention:**
+
+```bash
+workcord --as $U messages react --room $R --message $M --emoji 👍
+workcord --as $U messages send-text --room $R --text "agreed @user_abc" --reply-to $M
+```
+
+**DM a user once-and-done:**
+
+```bash
+workcord --as $U dm send-text --to $OTHER --text "hey"
+# → composite: opens (or finds) the DM room, sends the message, returns both
+```
+
+## Development
+
+```bash
+cd clients/workcord-cli
+npm install
+npm run build
+npx tsx src/cli.ts --as <userId> users get-me
+```
+
+### Refreshing the spec when the server changes
+
+`npm run sync-spec` builds the backend from the repo root (`npm run
+dump-spec`) and copies the resulting `cli/openapi.json` into this package.
+No GitHub token and no network — the spec comes from the source tree you are
+sitting in.
+
+```bash
+npm run regen      # sync-spec + generate
+npm run typecheck  # confirm clean
+```
+
+Generated files live in `src/generated/` and are committed, so the CLI works
+without running `regen` if you don't need the latest server changes.
+
+### Layout
+
+```
+src/
+├── cli.ts                  commander entry, global --as flag
+├── auth.ts                 mints HS256 JWT from --as
+├── client.ts               fetch wrapper (JSON + multipart)
+├── commands/               hand-written semantic commands
+└── generated/              auto-generated from openapi.json
+    ├── index.ts
+    └── commands/<tag>.ts   one file per controller namespace
+
+scripts/
+├── sync-spec.ts            backend build → openapi.json
+└── generate-commands.ts    spec → commander commands
+
+tests/smoke.sh              hermetic end-to-end test
+```
+
+### Adding a hand-written semantic command
+
+When an auto-generated command has a use pattern that would benefit from rich
+flags (e.g. typed fields instead of an opaque `--body`):
+
+1. Create `src/commands/<area>.ts`.
+2. Use `getOrCreateGroup(program, "<area>", "...")` to extend the
+   auto-generated namespace, then `.command("<verb>")` for the new subcommand.
+3. Register in `src/cli.ts`.
+4. Add an assertion in `tests/smoke.sh`.
+
+### Testing
+
+```bash
+npm run smoke
+```
+
+Hermetic end-to-end suite (creates two fresh users per run via OTP, exercises
+multi-user flows, file upload, custom agents, error paths). Requires a running
+server (`WORKCORD_API_URL`) and a matching `WORKCORD_JWT_SECRET`, so it is not
+part of any automated gate.
+
+## Release
+
+Publishing is a manual maintainer action — there is no auto-publish CI.
+
+1. `npm run regen` — refresh the spec and generated commands; commit the diff.
+2. `npm run typecheck`
+3. `npm run build`
+4. `npm pack --dry-run` — confirm the file list is exactly `dist/**/*.js`,
+   `README.md`, `LICENSE`, `package.json`. No sources, no `openapi.json`, no
+   `.npmrc`.
+5. Smoke: `node dist/cli.js --help` and `node dist/cli.js --version`.
+6. Bump `version` in `package.json`, then `npm publish`.
+
+`prepack` re-runs `typecheck` + `build`, so steps 2–3 also gate the publish.
+
+## License
+
+Proprietary — see [LICENSE](./LICENSE). Published to npm for installation by
+authorized Fulldive personnel and systems only; no reuse rights are granted.

package/dist/auth.js

@@ -0,0 +1,9 @@
+import jwt from "jsonwebtoken";
+export function mintToken(userId) {
+    const secret = process.env.WORKCORD_JWT_SECRET;
+    if (!secret) {
+        throw new Error("WORKCORD_JWT_SECRET not set");
+    }
+    return jwt.sign({ userId, id: userId }, secret, { algorithm: "HS256", expiresIn: "60d" });
+}
+//# sourceMappingURL=auth.js.map

package/dist/cli.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import { createRequire } from "node:module";
+import { setBaseUrlOverride } from "./client.js";
+import { registerWhoami } from "./commands/whoami.js";
+import { registerAuth } from "./commands/auth.js";
+import { registerDm } from "./commands/dm.js";
+import { registerMessages } from "./commands/messages.js";
+import { registerRooms } from "./commands/rooms.js";
+import { registerUsers } from "./commands/users.js";
+import { registerRoomAgents } from "./commands/room-agents.js";
+import { registerCustomAgents } from "./commands/custom-agents.js";
+import { registerChallenges } from "./commands/challenges.js";
+import { registerAll as registerGenerated } from "./generated/index.js";
+const program = new Command();
+const require = createRequire(import.meta.url);
+const { version } = require("../package.json");
+program
+    .name("workcord")
+    .description("CLI for the WorkCord API. One invocation = one user action.")
+    .version(version)
+    .option("--as <userId>", "user to act as")
+    .option("--base-url <url>", "API base URL (overrides WORKCORD_API_URL)");
+program.hook("preAction", () => {
+    setBaseUrlOverride(program.opts().baseUrl);
+});
+registerWhoami(program);
+registerAuth(program);
+registerMessages(program);
+registerRooms(program);
+registerDm(program);
+registerUsers(program);
+registerRoomAgents(program);
+registerCustomAgents(program);
+registerChallenges(program); // adds regenerate-cards (not in the OpenAPI spec)
+registerGenerated(program);
+program.parseAsync().catch((err) => {
+    const out = { error: err.message ?? String(err) };
+    if (err.status !== undefined)
+        out.status = err.status;
+    if (err.body !== undefined)
+        out.body = err.body;
+    process.stderr.write(JSON.stringify(out) + "\n");
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/client.js

@@ -0,0 +1,125 @@
+import { mintToken } from "./auth.js";
+let baseUrlOverride;
+export function setBaseUrlOverride(url) {
+    baseUrlOverride = url;
+}
+export function getBaseUrl() {
+    const raw = baseUrlOverride || process.env.WORKCORD_API_URL;
+    if (!raw) {
+        throw new Error("No API base URL configured. Set WORKCORD_API_URL or pass --base-url <url> (e.g. https://work-rooms-api.wizeup.app)");
+    }
+    const trimmed = raw.replace(/\/+$/, "");
+    let parsed;
+    try {
+        parsed = new URL(trimmed);
+    }
+    catch {
+        throw new Error(`Invalid API base URL: ${raw}`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new Error(`API base URL must be http or https: ${raw}`);
+    }
+    if (parsed.pathname !== "/" || parsed.search || parsed.hash) {
+        throw new Error(`API base URL must be an origin with no path, query or fragment: ${raw}`);
+    }
+    return parsed.origin;
+}
+const RETRY_MAX = Number(process.env.WORKCORD_RETRY_MAX ?? 3);
+const RETRY_BACKOFF_MS = Number(process.env.WORKCORD_RETRY_BACKOFF_MS ?? 200);
+const RETRY_STATUSES = new Set([408, 429, 502, 503, 504]);
+async function fetchWithRetry(build) {
+    let lastErr;
+    for (let attempt = 0; attempt <= RETRY_MAX; attempt++) {
+        try {
+            const { url, init } = build();
+            const res = await fetch(url, init);
+            if (!RETRY_STATUSES.has(res.status))
+                return res;
+            lastErr = res;
+            if (attempt >= RETRY_MAX)
+                return res;
+        }
+        catch (err) {
+            lastErr = err;
+            if (attempt >= RETRY_MAX)
+                throw err;
+        }
+        const delay = RETRY_BACKOFF_MS * Math.pow(3, attempt);
+        await new Promise((r) => setTimeout(r, delay));
+    }
+    if (lastErr instanceof Response)
+        return lastErr;
+    throw lastErr;
+}
+export async function call({ method = "GET", path, query, body, headers, asUserId }) {
+    const base = getBaseUrl();
+    const url = new URL(base + path);
+    if (query) {
+        for (const [k, v] of Object.entries(query)) {
+            if (v !== undefined && v !== null)
+                url.searchParams.set(k, String(v));
+        }
+    }
+    const token = mintToken(asUserId);
+    const res = await fetchWithRetry(() => ({
+        url,
+        init: {
+            method,
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${token}`,
+                ...headers,
+            },
+            body: body !== undefined ? JSON.stringify(body) : undefined,
+        },
+    }));
+    const text = await res.text();
+    const data = text ? safeJson(text) : null;
+    if (!res.ok) {
+        const err = new Error(`${method} ${path} -> ${res.status}`);
+        err.status = res.status;
+        err.body = data;
+        throw err;
+    }
+    return data;
+}
+function safeJson(s) {
+    try {
+        return JSON.parse(s);
+    }
+    catch {
+        return s;
+    }
+}
+export async function callMultipart({ path, asUserId, fields, file }) {
+    const base = getBaseUrl();
+    const url = base + path;
+    const token = mintToken(asUserId);
+    const res = await fetchWithRetry(() => {
+        const fd = new FormData();
+        if (fields) {
+            for (const [k, v] of Object.entries(fields))
+                fd.append(k, v);
+        }
+        const blob = new Blob([new Uint8Array(file.data)], { type: file.contentType ?? "application/octet-stream" });
+        fd.append(file.fieldName, blob, file.fileName);
+        return {
+            url,
+            init: {
+                method: "POST",
+                headers: { authorization: `Bearer ${token}` },
+                body: fd,
+            },
+        };
+    });
+    const text = await res.text();
+    const data = text ? safeJson(text) : null;
+    if (!res.ok) {
+        const err = new Error(`POST ${path} -> ${res.status}`);
+        err.status = res.status;
+        err.body = data;
+        throw err;
+    }
+    return data;
+}
+//# sourceMappingURL=client.js.map

package/dist/commands/_group.js

@@ -0,0 +1,5 @@
+export function getOrCreateGroup(program, name, description) {
+    const existing = program.commands.find((c) => c.name() === name);
+    return existing ?? program.command(name).description(description);
+}
+//# sourceMappingURL=_group.js.map

package/dist/commands/auth.js

@@ -0,0 +1,125 @@
+import { randomUUID } from "node:crypto";
+import { createInterface } from "node:readline/promises";
+import { getBaseUrl } from "../client.js";
+import { getOrCreateGroup } from "./_group.js";
+async function postJson(path, body) {
+    const res = await fetch(getBaseUrl() + path, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    const text = await res.text();
+    let data = null;
+    try {
+        data = text ? JSON.parse(text) : null;
+    }
+    catch {
+        data = text;
+    }
+    if (!res.ok) {
+        const err = new Error(`POST ${path} -> ${res.status}`);
+        err.status = res.status;
+        err.body = data;
+        throw err;
+    }
+    return data;
+}
+function errorCode(err) {
+    return err.body?.error?.code;
+}
+// Phone/social login returns `token`, email login returns `accessToken`.
+// Both are emitted so downstream consumers can read either.
+function normalize(data) {
+    const r = { ...(data ?? {}) };
+    if (!r.token && r.accessToken)
+        r.token = r.accessToken;
+    if (!r.accessToken && r.token)
+        r.accessToken = r.token;
+    return r;
+}
+function emit(data) {
+    process.stdout.write(JSON.stringify(normalize(data)) + "\n");
+}
+async function promptCode() {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        return (await rl.question("Verification code (6 digits): ")).trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+async function verifyEmailCode(sessionId, code) {
+    if (!/^\d{6}$/.test(code)) {
+        throw new Error("Verification code must be exactly 6 digits");
+    }
+    return postJson("/api/v1/auth/email/verify-code", { sessionId, code });
+}
+async function loginByEmail(email, code) {
+    const sessionId = randomUUID();
+    try {
+        await postJson(`/api/v1/auth/email/login/by-code/${encodeURIComponent(sessionId)}`, { email });
+    }
+    catch (err) {
+        const c = errorCode(err);
+        if (c === "DOMAIN_NOT_ALLOWED" || c === "EMAIL_NOT_ALLOWED") {
+            throw new Error(`Email ${email} is not allowed to sign in on this deployment. ` +
+                "Check the stack's EMAIL_AUTH_ALLOWED_DOMAINS / email_auth_allowlist.");
+        }
+        throw err;
+    }
+    const entered = code ?? (process.stdin.isTTY ? await promptCode() : undefined);
+    if (!entered) {
+        process.stderr.write("Code sent. stdin is not a TTY, so finish with:\n" +
+            `  workcord auth verify-email --session-id ${sessionId} --code <code>\n`);
+        process.stdout.write(JSON.stringify({ sessionId, codeSent: true }) + "\n");
+        return;
+    }
+    emit(await verifyEmailCode(sessionId, entered));
+}
+async function loginByPhone(phone, code) {
+    try {
+        await postJson("/api/v1/auth/send-otp", { phone });
+    }
+    catch (err) {
+        if (errorCode(err) === "OTP_NOT_AVAILABLE") {
+            throw new Error("Phone OTP is not available on this deployment (server has no AUTH_PHONE_OTP_DEV_BYPASS). " +
+                "Use `auth login --email <address>` instead.");
+        }
+        throw err;
+    }
+    emit(await postJson("/api/v1/auth/verify-otp", { phone, code }));
+}
+export function registerAuth(program) {
+    const group = getOrCreateGroup(program, "auth", "Auth operations");
+    group
+        .command("login")
+        .description("End-to-end login. Returns { token, accessToken, refreshToken, user, isNewUser }. " +
+        "--email uses the emailed 6-digit code (deployed WorkCord/VIA); --phone uses OTP " +
+        "(local/RoomCord only). Does NOT use --as / WORKCORD_JWT_SECRET — the server mints the token.")
+        .option("--email <address>", "email address (mutually exclusive with --phone)")
+        .option("--phone <e164>", 'phone number in E.164 format (e.g. "+14155550199")')
+        .option("--code <code>", "verification code; prompted interactively for --email when omitted")
+        .action(async (opts) => {
+        if (opts.email && opts.phone) {
+            throw new Error("--email and --phone are mutually exclusive");
+        }
+        if (!opts.email && !opts.phone) {
+            throw new Error("one of --email <address> or --phone <e164> is required");
+        }
+        if (opts.email) {
+            await loginByEmail(opts.email, opts.code);
+            return;
+        }
+        await loginByPhone(opts.phone, opts.code ?? "111111");
+    });
+    group
+        .command("verify-email")
+        .description("Verify an emailed code for a session started by `auth login --email`")
+        .requiredOption("--session-id <id>", "sessionId printed by `auth login --email`")
+        .requiredOption("--code <code>", "6-digit code from the email")
+        .action(async (opts) => {
+        emit(await verifyEmailCode(opts.sessionId, opts.code));
+    });
+}
+//# sourceMappingURL=auth.js.map