@dayofweek/dcli 1.2.0 → 1.3.0

package/dist/bin/dcli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { Command } from "commander";
 import { DayOfWeekClient } from "../client.js";
-import { getToken, getApiUrl, saveConfig } from "../config.js";
+import { getToken, getApiUrl, saveConfig, loadConfig } from "../config.js";
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { homedir } from "node:os";
@@ -57,6 +57,13 @@ auth
     try {
         const client = getClient();
         const result = await client.checkAuth();
+        // Persist isAdmin so the next CLI invocation can register admin
+        // subcommands in --help without a network round-trip. Stale cache
+        // is harmless: admin commands still reject non-admin tokens at the
+        // API boundary, and admin demotion is rare.
+        if (result.authenticated && typeof result.isAdmin === "boolean") {
+            saveConfig({ isAdmin: result.isAdmin, roleCachedAt: Date.now() });
+        }
         output(result);
     }
     catch (err) {
@@ -329,6 +336,59 @@ skill
     }
     console.log("\nTo update: dcli skill update");
 });
+// ── Admin Commands ───────────────────────────────────────────────────────────
+//
+// These are admin-only. They're registered as hidden subcommands when the
+// cached role from the last `dcli auth status` says the caller is admin —
+// otherwise they're not advertised in --help at all and customers never
+// learn the commands exist. The endpoints themselves enforce admin auth
+// independently, so stale or absent cache can't grant access.
+//
+// New admin agents should run `dcli auth status` once after install to
+// populate the cache; the admin skill bundle (ADMIN_MD) documents this.
+function registerAdminCommands() {
+    const cfg = loadConfig();
+    if (!cfg.isAdmin)
+        return;
+    const admin = program
+        .command("admin", { hidden: true })
+        .description("Admin-only cross-org operations (DoW staff)");
+    admin
+        .command("entities")
+        .description("List entities across all orgs with admin filters")
+        .option("--type <entityType>", "Filter by entity type")
+        .option("--missing-location", "Only entities lacking metadata.places[].lat/lng")
+        .option("--search <query>", "Substring match on name")
+        .option("--org <slug>", "Restrict to a single org slug or ID")
+        .option("--limit <count>", "Max results (default 200)", parseInt)
+        .action(async (opts) => {
+        const client = getClient();
+        const result = await client.adminListEntities({
+            org: opts.org,
+            type: opts.type,
+            missingLocation: opts.missingLocation,
+            search: opts.search,
+            limit: opts.limit,
+        });
+        output(result);
+    });
+    admin
+        .command("proposals")
+        .description("List agent proposals across all orgs")
+        .option("--status <status>", "Filter: pending, approved, rejected, failed")
+        .option("--source-agent <name>", "Filter by sourceAgent identifier")
+        .option("--limit <count>", "Max results (default 100)", parseInt)
+        .action(async (opts) => {
+        const client = getClient();
+        const result = await client.adminListProposals({
+            status: opts.status,
+            sourceAgent: opts.sourceAgent,
+            limit: opts.limit,
+        });
+        output(result);
+    });
+}
+registerAdminCommands();
 // ── Helpers ──────────────────────────────────────────────────────────────────
 async function readStdin() {
     const chunks = [];

package/dist/client.d.ts

@@ -13,6 +13,7 @@ export declare class DayOfWeekClient {
     checkAuth(): Promise<{
         status: string;
         authenticated: boolean;
+        isAdmin?: boolean;
     }>;
     listDevices(): Promise<Array<{
         _id: string;
@@ -61,6 +62,26 @@ export declare class DayOfWeekClient {
         sourceAgent?: string;
         proposals: any[];
     }): Promise<any>;
+    adminListEntities(opts?: {
+        org?: string;
+        type?: string;
+        missingLocation?: boolean;
+        search?: string;
+        limit?: number;
+    }): Promise<{
+        results: any[];
+        truncated: boolean;
+        total: number;
+    }>;
+    adminListProposals(opts?: {
+        status?: string;
+        sourceAgent?: string;
+        limit?: number;
+    }): Promise<{
+        results: any[];
+        truncated: boolean;
+        total: number;
+    }>;
     getSkillBundle(): Promise<{
         name: string;
         version: string;

package/dist/client.js

@@ -103,6 +103,34 @@ export class DayOfWeekClient {
     async submitBatch(batch) {
         return this.post("/proposals/batch", batch);
     }
+    // ── Admin (cross-org) ─────────────────────────────────────────────────────
+    // These endpoints reject non-admin tokens with 401 "Admin access required".
+    async adminListEntities(opts) {
+        const params = new URLSearchParams();
+        if (opts?.org)
+            params.set("org", opts.org);
+        if (opts?.type)
+            params.set("type", opts.type);
+        if (opts?.missingLocation)
+            params.set("missing-location", "1");
+        if (opts?.search)
+            params.set("search", opts.search);
+        if (opts?.limit)
+            params.set("limit", String(opts.limit));
+        const qs = params.toString();
+        return this.get(`/admin/entities${qs ? `?${qs}` : ""}`);
+    }
+    async adminListProposals(opts) {
+        const params = new URLSearchParams();
+        if (opts?.status)
+            params.set("status", opts.status);
+        if (opts?.sourceAgent)
+            params.set("source-agent", opts.sourceAgent);
+        if (opts?.limit)
+            params.set("limit", String(opts.limit));
+        const qs = params.toString();
+        return this.get(`/admin/proposals${qs ? `?${qs}` : ""}`);
+    }
     // ── Skill ─────────────────────────────────────────────────────────────────
     async getSkillBundle() {
         return this.get("/skill");

package/dist/config.d.ts

@@ -1,6 +1,15 @@
 export interface DcliConfig {
     authToken?: string;
     apiUrl?: string;
+    /**
+     * Cached admin status from the last `dcli auth status` call. Used to
+     * decide locally whether to expose admin-only subcommands in `--help`.
+     * Refreshed automatically when `dcli auth status` or `dcli auth login`
+     * runs; admin commands are hidden when this is unset or false.
+     */
+    isAdmin?: boolean;
+    /** Unix-ms timestamp of the last isAdmin refresh. */
+    roleCachedAt?: number;
 }
 export declare function loadConfig(): DcliConfig;
 export declare function saveConfig(updates: Partial<DcliConfig>): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dayofweek/dcli",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "CLI for the Day of Week AgTech platform — read data and submit proposals for review",
   "license": "MIT",
   "type": "module",