@retasc/cli 1.19.0 → 1.20.0

package/CHANGELOG.md

@@ -6,6 +6,13 @@ release commits and the issues they reference.
 
 Dates are the npm publish date. Each entry names the RTSC issue behind it.
 
+## 1.20.0 (2026-08-04)
+
+- **RTSC-561** — the org gained an **admin** role, and the CLI stopped refusing it.
+  `retasc billing` gated on `role !== "owner"` client-side, so it would have refused an
+  admin locally for a call the server allows. Owner-only copy in `bind` and the command
+  help now names both roles.
+
 ## 1.19.0 (2026-08-03)
 
 - **RTSC-495** — `retasc bind --setup <code>` sets a folder up with no sign-in and nothing

package/dist/commands/billing.js

@@ -44,8 +44,10 @@ export async function billingAction(opts) {
     const org = me.orgs.find((o) => o.id === orgId);
     orgLabel = org ? `${org.name}${org.slug ? ` (${org.slug})` : ""}` : String(orgId);
     // Fail early with the actionable message rather than a raw FORBIDDEN from the server.
-    if (org && org.role !== "owner") {
-        throw new Error(`Billing is owner-only — your role in ${orgLabel} is "${org.role}".`);
+    // Owner OR admin (RTSC-561) — this mirrors `requireOwnerOrAdmin`, and a stale copy of
+    // the rule here would refuse an admin locally for a call the server would have allowed.
+    if (org && org.role !== "owner" && org.role !== "admin") {
+        throw new Error(`Billing needs the owner or admin role — yours in ${orgLabel} is "${org.role}".`);
     }
     const [status, charges] = await Promise.all([
         api.billingStatus({ orgId: orgId }),

package/dist/commands/bind.js

@@ -286,7 +286,7 @@ export async function completeWorkspaceSetup(args) {
     let prefix;
     if (!projectId && opts.project && opts.prefix) {
         if (!args.canCreateProject) {
-            cliError("FORBIDDEN", "Only an owner can create a project.", `Ask an owner to add one, then pass --project-id <id>.`);
+            cliError("FORBIDDEN", "Only an owner or admin can create a project.", `Ask one of them to add one, then pass --project-id <id>.`);
         }
         const p = (await api.createProject({ orgId, name: opts.project, prefix: opts.prefix }));
         projectId = p.projectId;
@@ -301,7 +301,7 @@ export async function completeWorkspaceSetup(args) {
             // what to ask for, by name. A bare FORBIDDEN from `createProject` would be both
             // wrong (they never asked to create anything) and unactionable.
             if (!list.length) {
-                cliError("NO_PROJECTS", `Org ${org} has no projects yet, and only an owner can create one.`, `Ask an owner to add a project, then finish this folder with:  ${selfCommand(VERSION)} bind --org-id ${orgId}`);
+                cliError("NO_PROJECTS", `Org ${org} has no projects yet, and only an owner or admin can create one.`, `Ask one of them to add a project, then finish this folder with:  ${selfCommand(VERSION)} bind --org-id ${orgId}`);
             }
             // One project is not a choice. Asking anyway would be the only question in the
             // common invite path, for an answer that was never in doubt.

package/dist/commands/join.js

@@ -223,8 +223,9 @@ export async function joinAction(link, opts) {
             orgLabel,
             opts,
             existing: guard.existing,
-            // `createProject` is `requireOwner`, and an invite only ever grants `member`. Offering
-            // "+ create new" here would be offering a refusal dressed as a choice.
+            // `createProject` is `requireOwnerOrAdmin`, and an invite only ever grants `member`
+            // (admin is granted by `setMemberRole` after joining, never by a bearer code —
+            // RTSC-561). Offering "+ create new" here would be offering a refusal as a choice.
             canCreateProject: false,
         });
     }

package/dist/index.js

@@ -211,7 +211,7 @@ program
 });
 program
     .command("billing")
-    .description("Show the org's billing: subscription, what's owed now, and the charge + on-chain payment history across every payment link ever used (owner only).")
+    .description("Show the org's billing: subscription, what's owed now, and the charge + on-chain payment history across every payment link ever used (owner or admin).")
     .option("--org-id <id>", "Which org (defaults to your only one).")
     .option("--json", "Emit the raw payload instead of the summary.")
     .action(async (opts) => {
@@ -356,7 +356,7 @@ key
 const members = program.command("members").description("Invite people to an org and manage invites.");
 members
     .command("invite")
-    .description("Mint a single-use invite code for an org (owner only). Shown once.")
+    .description("Mint a single-use invite code for an org (owner or admin). Shown once.")
     .requiredOption("--org-id <id>")
     .option("--expires-days <n>", "Days until the code expires (1–30, default 7)", (v) => parseInt(v, 10))
     .action(async (opts) => {
@@ -377,7 +377,7 @@ members
 });
 members
     .command("list")
-    .description("List an org's invites and their status (owner only).")
+    .description("List an org's invites and their status (owner or admin).")
     .requiredOption("--org-id <id>")
     .option("--json", "Emit the raw payload instead of the table.")
     .action(async (opts) => {
@@ -392,7 +392,7 @@ members
 });
 members
     .command("revoke")
-    .description("Revoke an unused invite (owner only).")
+    .description("Revoke an unused invite (owner or admin).")
     .requiredOption("--invite-id <id>")
     .action(async (opts) => {
     requireLogin();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@retasc/cli",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "description": "Retasc CLI \u2014 the issue tracker AI agents pull work from. Sign in with GitHub or Google, create projects, mint agent API keys, and wire your agent to the Retasc MCP server in one command.",
   "type": "module",
   "bin": {