@dayofweek/dcli 1.5.0 → 1.7.0

package/dist/bin/dcli.js

@@ -4,13 +4,13 @@ import { ApiError, DayOfWeekClient, toArrayBuffer } from "../client.js";
 import { getToken, getApiUrl, saveConfig, loadConfig, saveCredential, deleteCredential } from "../config.js";
 import { browserLogin } from "../auth/login.js";
 import { parseBrainResource } from "../uri.js";
-import { accessSync, constants, mkdirSync, readFileSync, existsSync, statSync, writeFileSync } from "node:fs";
+import { accessSync, constants, mkdirSync, readdirSync, readFileSync, existsSync, statSync, writeFileSync } from "node:fs";
 import { join, basename, resolve, relative, sep } from "node:path";
 import { homedir } from "node:os";
 import { createInterface } from "node:readline/promises";
 import pkg from "../../package.json" with { type: "json" };
 import { createHash } from "node:crypto";
-import { validateSkillBundle, writeSkillBundle } from "../skills.js";
+import { readInstalledSkill, validateSkillBundle, writeSkillBundle } from "../skills.js";
 const program = new Command()
     .name("dcli")
     .description("CLI for the Day of Week AgTech platform")
@@ -240,6 +240,13 @@ brain
     output(await getClient().listBrainAudit(opts.area, { cursor: opts.cursor, limit: opts.limit }));
 });
 const brainSource = brain.command("source").description("Work with original shared files and recordings");
+brainSource
+    .command("list")
+    .description("List an area's sources, newest first (metadata only)")
+    .requiredOption("--area <areaId>", "Area to inventory")
+    .action(async (opts) => {
+    output(await getClient().listBrainSources(opts.area));
+});
 brainSource
     .command("get <uri>")
     .description("Read source metadata and derived text")
@@ -325,6 +332,7 @@ read
     .option("--type <entityType>", "Filter by type (Farm, Producer, Restaurant, ...)")
     .option("--parent <entityId>", "List children of an entity")
     .option("--limit <count>", "Max results", parseInt)
+    .option("--org <org>", "Organization slug or id (admin only)")
     .action(async (opts) => {
     const client = getClient();
     const result = await client.listEntities(opts);
@@ -333,9 +341,10 @@ read
 read
     .command("entity <entityId>")
     .description("Get entity details")
-    .action(async (entityId) => {
+    .option("--org <org>", "Organization slug or id (admin only)")
+    .action(async (entityId, opts) => {
     const client = getClient();
-    const result = await client.getEntity(entityId);
+    const result = await client.getEntity(entityId, opts.org);
     output(result);
 });
 read
@@ -343,6 +352,7 @@ read
     .description("List produce profiles")
     .option("--entity <entityId>", "Filter by entity")
     .option("--limit <count>", "Max results", parseInt)
+    .option("--org <org>", "Organization slug or id (admin only)")
     .action(async (opts) => {
     const client = getClient();
     const result = await client.listProduce(opts);
@@ -353,6 +363,7 @@ read
     .description("List contacts and memberships")
     .option("--entity <entityId>", "Filter by entity")
     .option("--limit <count>", "Max results", parseInt)
+    .option("--org <org>", "Organization slug or id (admin only)")
     .action(async (opts) => {
     const client = getClient();
     const result = await client.listContacts(opts);
@@ -361,9 +372,10 @@ read
 read
     .command("entity-types")
     .description("List available entity types")
-    .action(async () => {
+    .option("--org <org>", "Organization slug or id (admin only)")
+    .action(async (opts) => {
     const client = getClient();
-    const result = await client.listEntityTypes();
+    const result = await client.listEntityTypes(opts.org);
     output(result);
 });
 read
@@ -374,6 +386,7 @@ read
     .option("--type <nodeType>", "Filter by type (category, produce, variety)")
     .option("--include-categories", "Include non-selectable categories in results")
     .option("--limit <count>", "Max results", parseInt)
+    .option("--org <org>", "Organization slug or id (admin only)")
     .action(async (opts) => {
     const client = getClient();
     const result = await client.searchCatalog(opts);
@@ -755,53 +768,207 @@ function parseTarget(value) {
     }
     return v;
 }
+function sharedToBundle(shared) {
+    return {
+        bundle: { name: shared.name, version: shared.version, hash: shared.hash, files: shared.files },
+        origin: { source: "shared", skillId: shared.id, areaId: shared.areaId, uri: shared.uri },
+    };
+}
+async function fetchSkillByOrigin(client, nameOrUri, areaId) {
+    if (nameOrUri?.includes("://")) {
+        const resource = parseBrainResource(nameOrUri);
+        if (resource.resourceType !== "skill" || !resource.resourceId)
+            throw new Error("A shared skill URI is required");
+        const shared = await client.getSharedSkill(resource.resourceId);
+        if (shared.areaId !== resource.areaId)
+            throw new Error("Server returned a mismatched area");
+        return sharedToBundle(shared);
+    }
+    if (areaId) {
+        if (!nameOrUri)
+            throw new Error("A skill name is required together with --area");
+        const match = (await client.listSharedSkills()).find((candidate) => candidate.areaId === areaId && candidate.name === nameOrUri);
+        if (!match)
+            throw new Error("Shared skill not found in that area");
+        return sharedToBundle(await client.getSharedSkill(match.id));
+    }
+    return { bundle: await client.getSkillBundle(nameOrUri), origin: { source: "platform" } };
+}
+async function installOrUpdateSkill(action, name, opts) {
+    const client = getClient();
+    let resolved;
+    if (action === "update" && !name && !opts.area && opts.dir) {
+        // Bare `skill update --dir …`: go back to wherever this install came from.
+        const installed = readInstalledSkill(opts.dir);
+        if (installed) {
+            resolved = installed.origin?.source === "shared"
+                ? sharedToBundle(await client.getSharedSkill(installed.origin.skillId))
+                : { bundle: await client.getSkillBundle(installed.name), origin: { source: "platform" } };
+        }
+    }
+    resolved = resolved ?? await fetchSkillByOrigin(client, name, opts.area);
+    const bundle = validateSkillBundle(resolved.bundle);
+    const dirs = resolveTargetDirs(parseTarget(opts.target), bundle.name, opts.dir);
+    const installations = [];
+    for (const dir of dirs) {
+        const result = writeSkillBundle(bundle, dir, resolved.origin);
+        installations.push({ directory: dir, ...result });
+    }
+    output({
+        action,
+        bundle: bundle.name,
+        version: bundle.version,
+        hash: bundle.hash,
+        origin: resolved.origin.source,
+        ...(resolved.origin.source === "shared" ? { uri: resolved.origin.uri } : {}),
+        installations,
+    });
+}
+/** Read a skill directory into bundle files: relative paths, utf-8 content. */
+function collectSkillFiles(dir) {
+    const root = resolve(dir);
+    if (!existsSync(root) || !statSync(root).isDirectory())
+        throw new Error("Skill directory not found");
+    const files = [];
+    const walk = (current, prefix) => {
+        for (const entry of readdirSync(current, { withFileTypes: true })) {
+            // Hidden entries (including the .dayofweek-skill.json install manifest)
+            // and update-conflict artifacts never belong in a published bundle.
+            if (entry.name.startsWith(".") || /\.new(\.\d+)?$/.test(entry.name))
+                continue;
+            if (entry.isSymbolicLink())
+                throw new Error("Symlinks are not allowed in a skill directory");
+            const full = join(current, entry.name);
+            const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+            if (entry.isDirectory())
+                walk(full, relativePath);
+            else if (entry.isFile())
+                files.push({ path: relativePath, content: readFileSync(full, "utf8") });
+        }
+    };
+    walk(root, "");
+    return files.sort((left, right) => left.path.localeCompare(right.path));
+}
 skill
     .command("list")
-    .description("List authenticated named skill bundles")
-    .action(async () => output(await getClient().listSkillBundles()));
+    .description("List installable named skill bundles; --shared adds skills shared with you")
+    .option("--shared", "Include skills other users shared with you")
+    .action(async (opts) => {
+    const client = getClient();
+    // The bare listing stays exactly the named bundles: managed installers
+    // iterate it and fetch every entry by plain name, so shared skills (which
+    // resolve by URI) only appear when explicitly asked for.
+    const listings = (await client.listSkillBundles()).map((bundle) => ({
+        ...bundle,
+        source: "platform",
+    }));
+    if (opts.shared) {
+        try {
+            for (const shared of await client.listSharedSkills()) {
+                listings.push({
+                    name: shared.name,
+                    version: shared.version,
+                    hash: shared.hash,
+                    source: "shared",
+                    areaId: shared.areaId,
+                    areaName: shared.areaName,
+                    visibility: shared.visibility,
+                    description: shared.description,
+                    uri: shared.uri,
+                    updatedAt: shared.updatedAt,
+                });
+            }
+        }
+        catch (error) {
+            // Older servers or tokens without knowledge scopes have no shared-skill
+            // surface — the named bundles are still worth listing.
+            console.error(`Shared skills unavailable: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    output(listings.sort((left, right) => left.name.localeCompare(right.name)));
+});
 skill
-    .command("bundle <name>")
-    .description("Fetch and verify a named skill bundle for a managed installer")
-    .action(async (name) => output(validateSkillBundle(await getClient().getSkillBundle(name))));
+    .command("bundle <nameOrUri>")
+    .description("Fetch and verify a skill bundle (by name, or shared-skill URI) for a managed installer")
+    .action(async (nameOrUri) => {
+    if (nameOrUri.includes("://")) {
+        const resource = parseBrainResource(nameOrUri);
+        if (resource.resourceType !== "skill" || !resource.resourceId)
+            throw new Error("A shared skill URI is required");
+        const shared = await getClient().getSharedSkill(resource.resourceId);
+        if (shared.areaId !== resource.areaId)
+            throw new Error("Server returned a mismatched area");
+        // Emit the plain bundle shape managed installers expect.
+        output(validateSkillBundle({ name: shared.name, version: shared.version, hash: shared.hash, files: shared.files }));
+        return;
+    }
+    output(validateSkillBundle(await getClient().getSkillBundle(nameOrUri)));
+});
 skill
     .command("install [name]")
-    .description("Install the agent skill (requires valid auth)")
+    .description("Install a skill by bundle name, shared-skill URI, or name + --area")
     .option("--dir <path>", "Custom install directory (overrides --target)")
     .option("--target <target>", "Install target: agents, claude, or all (default: all)")
-    .action(async (name, opts) => {
-    const client = getClient();
-    const bundle = await client.getSkillBundle(name);
-    const target = parseTarget(opts.target);
-    const dirs = resolveTargetDirs(target, bundle.name, opts.dir);
-    const installations = [];
-    for (const dir of dirs) {
-        const result = writeSkillBundle(bundle, dir);
-        installations.push({ directory: dir, ...result });
-    }
-    output({ action: "install", bundle: bundle.name, version: bundle.version, hash: bundle.hash, installations });
-});
+    .option("--area <areaId>", "Install a shared skill from this area")
+    .action(async (name, opts) => installOrUpdateSkill("install", name, opts));
 skill
     .command("update [name]")
-    .description("Update the skill to the latest version")
+    .description("Update a skill to the latest version from its origin")
     .option("--dir <path>", "Custom install directory (overrides --target)")
     .option("--target <target>", "Install target: agents, claude, or all (default: all)")
-    .action(async (name, opts) => {
-    const client = getClient();
-    const bundle = await client.getSkillBundle(name);
-    const target = parseTarget(opts.target);
-    const dirs = resolveTargetDirs(target, bundle.name, opts.dir);
-    const installations = [];
-    for (const dir of dirs) {
-        const result = writeSkillBundle(bundle, dir);
-        installations.push({ directory: dir, ...result });
+    .option("--area <areaId>", "Update a shared skill from this area")
+    .action(async (name, opts) => installOrUpdateSkill("update", name, opts));
+skill
+    .command("publish")
+    .description("Share a skill directory to a knowledge area so teammates can install it")
+    .requiredOption("--area <areaId>", "Owning area (see: dcli brain list)")
+    .requiredOption("--dir <path>", "Skill directory containing SKILL.md")
+    .option("--name <name>", "Skill name (default: SKILL.md frontmatter, else the directory name)")
+    .option("--skill-version <version>", "Version string (default: SKILL.md frontmatter version)")
+    .option("--visibility <visibility>", "Who can discover it: area (members only), company, or global (admins; every user)")
+    .option("--description <text>", "Short description shown in listings")
+    .action(async (opts) => {
+    const visibility = (opts.visibility ?? "area").toLowerCase();
+    if (visibility !== "area" && visibility !== "company" && visibility !== "global") {
+        throw new Error("Invalid --visibility: use area, company, or global");
     }
-    output({ action: "update", bundle: bundle.name, version: bundle.version, hash: bundle.hash, installations });
+    const files = collectSkillFiles(opts.dir);
+    const skillMd = files.find((file) => file.path === "SKILL.md");
+    if (!skillMd)
+        throw new Error("The skill directory must contain SKILL.md");
+    const name = opts.name
+        ?? skillMd.content.match(/^name:\s*"?([a-z0-9][a-z0-9-]*)"?\s*$/m)?.[1]
+        ?? basename(resolve(opts.dir));
+    const version = opts.skillVersion ?? skillMd.content.match(/version:\s*"([^"]+)"/)?.[1] ?? "1.0.0";
+    validateSkillBundle({ name, version, files });
+    const result = await getClient().publishSharedSkill({
+        areaId: opts.area,
+        name,
+        version,
+        description: opts.description,
+        visibility,
+        files,
+    });
+    output({ action: "publish", ...result });
+});
+skill
+    .command("archive <uri>")
+    .description("Archive a shared skill you own (removes it from listing and install)")
+    .action(async (uri) => {
+    const resource = parseBrainResource(uri);
+    if (resource.resourceType !== "skill" || !resource.resourceId)
+        throw new Error("A shared skill URI is required");
+    const result = await getClient().archiveSharedSkill(resource.resourceId);
+    if (result.areaId !== resource.areaId)
+        throw new Error("Server returned a mismatched area");
+    output({ action: "archive", ...result });
 });
 skill
     .command("status [name]")
-    .description("Check if the skill is installed")
+    .description("Check if the skill is installed; --check compares against its origin")
     .option("--dir <path>", "Custom install directory (overrides --target)")
     .option("--target <target>", "Check target: agents, claude, or all (default: all)")
+    .option("--check", "Also ask the server whether a newer version exists")
     .action(async (name, opts) => {
     const bundleName = name ?? "dayofweek-platform";
     const target = parseTarget(opts.target);
@@ -810,6 +977,7 @@ skill
         : target === "all"
             ? [join(homedir(), ".agents", "skills", bundleName), join(homedir(), ".claude", "skills", bundleName)]
             : resolveTargetDirs(target, bundleName);
+    let platformBundles;
     const installations = [];
     for (const dir of dirs) {
         const skillPath = join(dir, "SKILL.md");
@@ -817,15 +985,154 @@ skill
             installations.push({ installed: false, directory: dir, name: bundleName });
             continue;
         }
+        const metadata = readInstalledSkill(dir);
         const content = readFileSync(skillPath, "utf-8");
         const versionMatch = content.match(/version:\s*"([^"]+)"/);
-        installations.push({ installed: true, directory: dir, name: bundleName, version: versionMatch?.[1] ?? "unknown", sha256: sha256(content) });
+        const entry = {
+            installed: true,
+            directory: dir,
+            name: metadata?.name ?? bundleName,
+            version: metadata?.version ?? versionMatch?.[1] ?? "unknown",
+            sha256: sha256(content),
+            origin: metadata?.origin?.source ?? "platform",
+        };
+        if (opts.check) {
+            try {
+                if (metadata?.origin?.source === "shared") {
+                    const latest = await getClient().getSharedSkill(metadata.origin.skillId);
+                    entry.latestVersion = latest.version;
+                    entry.upToDate = metadata.hash === latest.hash;
+                }
+                else {
+                    platformBundles ??= await getClient().listSkillBundles();
+                    const latest = platformBundles.find((candidate) => candidate.name === entry.name);
+                    if (latest) {
+                        entry.latestVersion = latest.version;
+                        // Pre-origin installs have no recorded manifest hash; fall back
+                        // to comparing the declared versions.
+                        entry.upToDate = metadata ? metadata.hash === latest.hash : latest.version === entry.version;
+                    }
+                }
+            }
+            catch (error) {
+                entry.checkError = error instanceof Error ? error.message : String(error);
+            }
+        }
+        installations.push(entry);
     }
     const installed = installations.some((entry) => entry.installed);
     output({ installed, bundle: bundleName, installations });
     if (!installed)
         process.exitCode = 2;
 });
+// ── Data Commands ────────────────────────────────────────────────────────────
+//
+// Generic, name-blind reads of platform datasets. The server's catalog decides
+// what exists and what the caller may see — this CLI ships no dataset names,
+// so new platform surfaces appear in `data list` without a CLI release.
+const data = program.command("data").description("Read platform datasets the server offers you");
+data
+    .command("list")
+    .description("List the datasets your credential may read")
+    .option("--org <org>", "Organization slug or id (admin only)")
+    .action(async (opts) => {
+    const client = getClient();
+    output(await client.listDatasets(opts.org));
+});
+data
+    .command("get <dataset>")
+    .description("Read one dataset's rows (names come from `data list`)")
+    .option("--limit <count>", "Max rows (default 50, max 200)", parseInt)
+    .option("--org <org>", "Organization slug or id (admin only)")
+    .action(async (dataset, opts) => {
+    const client = getClient();
+    output(await client.readDataset(dataset, { limit: opts.limit, org: opts.org }));
+});
+// ── Feedback Commands ────────────────────────────────────────────────────────
+//
+// The customer feedback backlog. Scope-gated rather than admin-gated:
+// read:feedback for the reads, write:feedback to comment, admin:feedback for
+// claim/status/priority. backOffice users implicitly hold every scope, so the
+// group stays visible and the endpoint decides what the caller may do.
+const feedback = program
+    .command("feedback")
+    .description("Read and work the customer feedback backlog");
+feedback
+    .command("list")
+    .description("List backlog items")
+    .option("--status <status>", "backlog | planned | in_progress | shipped | rejected | new")
+    .option("--priority <priority>", "urgent | high | medium | low")
+    .option("--category <category>", "Filter by category, e.g. studio")
+    .option("--limit <count>", "Max results", parseInt)
+    .action(async (opts) => {
+    const client = getClient();
+    output(await client.listFeedback({
+        status: opts.status,
+        priority: opts.priority,
+        category: opts.category,
+        limit: opts.limit,
+    }));
+});
+feedback
+    .command("next")
+    .description("What should I work on next — the prioritizer's top picks")
+    .option("--limit <count>", "How many recommendations", parseInt)
+    .action(async (opts) => {
+    const client = getClient();
+    output(await client.feedbackRecommendations(opts.limit));
+});
+feedback
+    .command("show <itemId>")
+    .description("Show one backlog item in full")
+    .action(async (itemId) => {
+    const client = getClient();
+    output(await client.getFeedbackItem(itemId));
+});
+feedback
+    .command("claim <itemId>")
+    .description("Claim an item so humans see it is being worked on")
+    .action(async (itemId) => {
+    const client = getClient();
+    output(await client.claimFeedbackItem(itemId));
+});
+feedback
+    .command("comment <itemId>")
+    .description("Add a comment to a backlog item")
+    .option("--body <text>", "Comment text")
+    .option("--file <path>", "Read the comment from a file (- for stdin)")
+    .action(async (itemId, opts) => {
+    let body;
+    if (opts.body) {
+        body = String(opts.body);
+    }
+    else if (opts.file) {
+        body = opts.file === "-" ? readFileSync(0, "utf8") : readFileSync(opts.file, "utf8");
+    }
+    else {
+        throw new Error("Provide --body or --file");
+    }
+    if (!body.trim())
+        throw new Error("Comment is empty");
+    const client = getClient();
+    output(await client.commentOnFeedbackItem(itemId, body));
+});
+feedback
+    .command("status <itemId>")
+    .description("Set status and/or priority on a backlog item")
+    .option("--status <status>", "backlog | planned | in_progress | shipped | rejected")
+    .option("--priority <priority>", "urgent | high | medium | low")
+    .option("--rejected-reason <text>", "Why it was rejected (with --status rejected)")
+    .action(async (itemId, opts) => {
+    if (!opts.status && !opts.priority) {
+        throw new Error("Provide --status and/or --priority");
+    }
+    const client = getClient();
+    output(await client.updateFeedbackItem(itemId, {
+        status: opts.status,
+        priority: opts.priority,
+        rejectedReason: opts.rejectedReason,
+    }));
+});
 // ── Admin Commands ───────────────────────────────────────────────────────────
 //
 // These are admin-only. They're registered as hidden subcommands when the
@@ -877,6 +1184,224 @@ function registerAdminCommands() {
         });
         output(result);
     });
+    // ── Assortment import ──────────────────────────────────────────────────────
+    //
+    // These write real Creator rows rather than proposals, so the operator
+    // approves the parsed result first. --dry-run rehearses the whole import
+    // server-side and rolls it back; that response is what the review is built
+    // from. Writing requires --approved for the same reason email does.
+    const produce = program
+        .command("produce", { hidden: true })
+        .description("Assortment import and recipe refinement (DoW staff)");
+    produce
+        .command("import")
+        .description("Import a producer's items into Creator. Requires --dry-run or --approved")
+        .requiredOption("--file <path>", "JSON payload: { entityId, items[] } (- for stdin)")
+        .option("--dry-run", "Rehearse server-side and roll back — build the review from this")
+        .option("--skip-existing-names", "Skip items whose displayName already exists")
+        .option("--approved", "The operator approved the dry-run result")
+        .option("--org <org>", "Organization slug or id")
+        .action(async (opts) => {
+        if (!opts.dryRun && !opts.approved) {
+            throw new Error("Refusing to write: run with --dry-run first, show the operator the result, " +
+                "then repeat with --approved. This creates real Creator rows, not proposals.");
+        }
+        const raw = opts.file === "-" ? readFileSync(0, "utf8") : readFileSync(opts.file, "utf8");
+        const payload = JSON.parse(raw);
+        if (!payload?.entityId || !Array.isArray(payload.items)) {
+            throw new Error("Payload needs { entityId, items: [...] }");
+        }
+        const client = getClient();
+        output(await client.importProduce({
+            entityId: payload.entityId,
+            items: payload.items,
+            dryRun: Boolean(opts.dryRun),
+            skipExistingNames: opts.skipExistingNames ?? payload.skipExistingNames,
+            org: opts.org ?? payload.org,
+        }));
+    });
+    produce
+        .command("add-concepts")
+        .description("Add concepts to the shared produce catalog. Requires --approved")
+        .requiredOption("--file <path>", "JSON: { concepts: [...] } or a bare array (- for stdin)")
+        .option("--approved", "The operator approved these concepts")
+        .option("--org <org>", "Organization slug or id")
+        .action(async (opts) => {
+        if (!opts.approved) {
+            throw new Error("Refusing to write: the produce catalog is shared by every customer. " +
+                "Show the operator the concepts you want to add, then repeat with --approved.");
+        }
+        const raw = opts.file === "-" ? readFileSync(0, "utf8") : readFileSync(opts.file, "utf8");
+        const parsed = JSON.parse(raw);
+        const concepts = Array.isArray(parsed) ? parsed : parsed?.concepts;
+        if (!Array.isArray(concepts) || concepts.length === 0) {
+            throw new Error("Payload needs a non-empty `concepts` array");
+        }
+        const client = getClient();
+        output(await client.createCatalogConcepts({ concepts, org: opts.org ?? parsed?.org }));
+    });
+    produce
+        .command("ingredients")
+        .description("Recipe ingredients still standing in for something vaguer")
+        .requiredOption("--entity <entityId>", "Producer entity")
+        .option("--org <org>", "Organization slug or id")
+        .action(async (opts) => {
+        const client = getClient();
+        output(await client.listImpreciseIngredients(opts.entity, opts.org));
+    });
+    produce
+        .command("refine")
+        .description("Point an imprecise ingredient at what it actually is")
+        .requiredOption("--process-input <id>", "processInputId from `produce ingredients`")
+        .option("--concept <catalogConceptId>", "What it actually is")
+        .option("--material <materialId>", "Material node instead of a catalog concept")
+        .option("--role <role>", "e.g. seasoning, base")
+        .option("--qty <n>", "Quantity", parseFloat)
+        .option("--unit <unitCode>", "Unit code")
+        .option("--still-imprecise", "Narrowed but not resolved — keeps it on the worklist")
+        .option("--org <org>", "Organization slug or id")
+        .action(async (opts) => {
+        if (!opts.concept && !opts.material) {
+            throw new Error("Provide --concept or --material");
+        }
+        const client = getClient();
+        output(await client.refineIngredient({
+            processInputId: opts.processInput,
+            catalogConceptId: opts.concept,
+            materialId: opts.material,
+            role: opts.role,
+            qty: opts.qty,
+            unitCode: opts.unit,
+            stillImprecise: Boolean(opts.stillImprecise),
+            org: opts.org,
+        }));
+    });
+    admin
+        .command("customers-only")
+        .description("Entities with a customer role and no investor/partner/producer role")
+        .action(async () => {
+        const client = getClient();
+        output(await client.adminCustomersOnly());
+    });
+    admin
+        .command("press-inbox")
+        .description("Tips mailed to press@mail.dayofweek.com (Press Radar)")
+        .option("--since <date>", "ISO date or epoch ms (default 45 days back)")
+        .option("--limit <count>", "Max emails (max 200)", parseInt)
+        .action(async (opts) => {
+        const client = getClient();
+        output(await client.adminPressInbox({ since: opts.since, limit: opts.limit }));
+    });
+    // ── Customer emails ────────────────────────────────────────────────────────
+    //
+    // Mail sent to a customer's own inbox address (<slug>@mail.dayofweek.com)
+    // becomes a thread the agent can answer. Reading is free; sending is not:
+    // `reply` and `compose` refuse to run without --approved, so an agent cannot
+    // mail a customer as a side effect of "check the inbox". The human approves
+    // the exact text first — that rule lives in the skill; --approved is the
+    // mechanical backstop for it.
+    const emails = program
+        .command("emails", { hidden: true })
+        .description("Customer email threads — read, reply, compose (DoW staff)");
+    const APPROVAL_REQUIRED = "Refusing to send: pass --approved once the human has approved this exact text. " +
+        "Never send an email the human has not seen.";
+    emails
+        .command("list")
+        .description("List customer email threads")
+        .option("--status <status>", "needs_reply | manual_review | all (default all)")
+        .option("--since <date>", "ISO date (2026-07-01) or epoch ms; default 30 days back")
+        .option("--customer <entityId>", "One customer only")
+        .option("--limit <count>", "Max threads (default 50, max 200)", parseInt)
+        .option("--org <org>", "Organization slug or id")
+        .action(async (opts) => {
+        const client = getClient();
+        output(await client.listEmailThreads({
+            status: opts.status,
+            since: opts.since,
+            customer: opts.customer,
+            limit: opts.limit,
+            org: opts.org,
+        }));
+    });
+    emails
+        .command("show <threadKey>")
+        .description("Full thread: messages, attachments, and reply hints")
+        .action(async (threadKey) => {
+        const client = getClient();
+        output(await client.getEmailThread(threadKey));
+    });
+    emails
+        .command("reply <threadKey>")
+        .description("Reply in a thread. Requires --approved")
+        .option("--message <text>", "Plain-text reply body")
+        .option("--file <path>", "Read the body from a file (- for stdin)")
+        .option("--subject <text>", "Override the subject (defaults to Re: …)")
+        .option("--to <address>", "Override the recipient")
+        .option("--cc <addresses>", "Comma-separated cc list")
+        .option("--no-quote", "Do not quote the original underneath")
+        .option("--approved", "The human approved this exact text")
+        .action(async (threadKey, opts) => {
+        if (!opts.approved)
+            throw new Error(APPROVAL_REQUIRED);
+        let message;
+        if (opts.message) {
+            message = String(opts.message);
+        }
+        else if (opts.file) {
+            message = opts.file === "-" ? readFileSync(0, "utf8") : readFileSync(opts.file, "utf8");
+        }
+        else {
+            throw new Error("Provide --message or --file");
+        }
+        if (!message.trim())
+            throw new Error("Message is empty");
+        const client = getClient();
+        output(await client.replyToEmailThread(threadKey, {
+            message,
+            subject: opts.subject,
+            to: opts.to,
+            cc: splitList(opts.cc),
+            quote: opts.quote,
+        }));
+    });
+    emails
+        .command("compose")
+        .description("Start a new thread from a customer inbox. Requires --approved")
+        .option("--entity <entityId>", "Customer entity whose inbox sends the mail")
+        .option("--inbox <address>", "Inbox address instead of --entity")
+        .requiredOption("--to <address>", "Recipient")
+        .option("--cc <addresses>", "Comma-separated cc list")
+        .requiredOption("--subject <text>", "Subject line")
+        .option("--message <text>", "Plain-text body")
+        .option("--file <path>", "Read the body from a file (- for stdin)")
+        .option("--approved", "The human approved this exact text")
+        .action(async (opts) => {
+        if (!opts.approved)
+            throw new Error(APPROVAL_REQUIRED);
+        if (!opts.entity && !opts.inbox)
+            throw new Error("Provide --entity or --inbox");
+        let message;
+        if (opts.message) {
+            message = String(opts.message);
+        }
+        else if (opts.file) {
+            message = opts.file === "-" ? readFileSync(0, "utf8") : readFileSync(opts.file, "utf8");
+        }
+        else {
+            throw new Error("Provide --message or --file");
+        }
+        if (!message.trim())
+            throw new Error("Message is empty");
+        const client = getClient();
+        output(await client.composeEmail({
+            entityId: opts.entity,
+            inbox: opts.inbox,
+            to: opts.to,
+            cc: splitList(opts.cc),
+            subject: opts.subject,
+            message,
+        }));
+    });
 }
 registerAdminCommands();
 // ── Helpers ──────────────────────────────────────────────────────────────────
@@ -888,6 +1413,13 @@ async function readStdin() {
     }
     return chunks.join("\n");
 }
+/** Parse a comma-separated CLI option into a trimmed list, or undefined. */
+function splitList(value) {
+    if (!value)
+        return undefined;
+    const items = String(value).split(",").map((entry) => entry.trim()).filter(Boolean);
+    return items.length ? items : undefined;
+}
 function inferMimeType(path) {
     const extension = path.toLowerCase().split(".").at(-1);
     const types = {