@startanaicompany/crm 2.8.0 → 2.11.0

package/index.js

@@ -212,6 +212,36 @@ keysCmd
     }
   });
 
+// S20-1: set per-key rate limit (requires admin JWT auth)
+keysCmd
+  .command('set-limit <key-id> <limit>')
+  .description('Set rate limit (req/min) for an API key — requires admin credentials')
+  .option('--email <email>', 'Admin email (or set SAAC_CRM_ADMIN_EMAIL env)')
+  .option('--password <password>', 'Admin password (or set SAAC_CRM_ADMIN_PASSWORD env)')
+  .action(async (keyId, limitStr, opts) => {
+    const globalOpts = program.opts();
+    const apiUrl = resolveApiUrl(globalOpts.url);
+    if (!apiUrl) { console.error('Error: API URL not configured.'); process.exit(1); }
+    const limit = parseInt(limitStr, 10);
+    if (isNaN(limit) || limit < 1 || limit > 10000) {
+      console.error('Error: limit must be an integer between 1 and 10000');
+      process.exit(1);
+    }
+    const cfg = loadConfig();
+    const email = opts.email || process.env.SAAC_CRM_ADMIN_EMAIL || cfg.admin_email;
+    const password = opts.password || process.env.SAAC_CRM_ADMIN_PASSWORD || await promptSecret('Admin password: ');
+    try {
+      const base = apiUrl.replace(/\/$/, '');
+      const loginRes = await axios.post(`${base}/api/v1/admin/login`, { email, password });
+      const token = loginRes.data.data?.token;
+      const res = await axios.patch(`${base}/api/v1/admin/keys/${keyId}`, { rate_limit: limit }, {
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' }
+      });
+      console.log(`Rate limit updated to ${limit} req/min.`);
+      printJSON(res.data.data);
+    } catch (err) { handleError(err); }
+  });
+
 // ============================================================
 // REGISTER — first-time workspace + admin key setup
 // NOTE: For agent self-service (zero-auth), use: saac_crm keys create --name <name>
@@ -398,6 +428,10 @@ leadsCmd
   .option('--source <source>', 'Source: api|import|referral|linkedin|cold_email|website|inbound|partner|event|other', 'api')
   .option('--deal-value <amount>', 'Deal value (numeric)')
   .option('--pipeline-stage <stage>', 'Pipeline stage: new|prospecting|discovery|qualified|demo_scheduled|demo_completed|proposal_sent|negotiation|contract_sent|closed_won|closed_lost|no_decision|dormant')
+  .option('--score <n>', 'Lead score (0-100 integer). Conventions: 0-19 Cold, 20-39 Warm, 40-59 Developing, 60-79 Qualified, 80-100 Hot')
+  .option('--score-reason <text>', 'Score reason/explanation')
+  .option('--close-probability <n>', 'Close probability 0-100 integer')
+  .option('--close-reason <reason>', `Close reason (${['price','timing','competition','no_budget','no_decision','fit','other'].join('|')})`)
   .option('--notes <notes>', 'Notes')
   .option('--assigned-to <assignedTo>', 'Assigned to')
   .option('--tag <tag>', 'Tag (repeatable)', (v, prev) => prev.concat([v]), [])
@@ -419,6 +453,11 @@ leadsCmd
       source: opts.source,
       ...(opts.dealValue !== undefined && { deal_value: parseFloat(opts.dealValue) }),
       ...(opts.pipelineStage && { pipeline_stage: opts.pipelineStage }),
+      // --score 0 is valid — use !== undefined not falsy check
+      ...(opts.score !== undefined && { score: parseInt(opts.score) }),
+      ...(opts.scoreReason && { score_reason: opts.scoreReason }),
+      ...(opts.closeProbability !== undefined && { close_probability: parseInt(opts.closeProbability) }),
+      ...(opts.closeReason && { close_reason: opts.closeReason }),
       ...(opts.notes && { notes: opts.notes }),
       ...(opts.assignedTo && { assigned_to: opts.assignedTo }),
       ...(opts.tag.length > 0 && { tags: opts.tag }),
@@ -448,6 +487,9 @@ leadsCmd
   .option('--order <dir>', 'Sort direction: asc|desc', 'desc')
   .option('--score-min <n>', 'Filter leads with score >= n (0-100)')
   .option('--score-max <n>', 'Filter leads with score <= n (0-100)')
+  .option('--close-probability-min <n>', 'Filter leads with close_probability >= n')
+  .option('--close-probability-max <n>', 'Filter leads with close_probability <= n')
+  .option('--not-contacted-since-days <n>', 'Filter stale leads not contacted in N days (excludes converted/lost)')
   .option('--created-after <date>', 'Filter leads created after this ISO8601 date (e.g. 2026-01-01T00:00:00Z)')
   .option('--created-before <date>', 'Filter leads created before this ISO8601 date')
   .option('--updated-after <date>', 'Filter leads updated after this ISO8601 date')
@@ -471,6 +513,9 @@ leadsCmd
       ...(opts.order && { order: opts.order }),
       ...(opts.scoreMin !== undefined && { score_min: opts.scoreMin }),
       ...(opts.scoreMax !== undefined && { score_max: opts.scoreMax }),
+      ...(opts.closeProbabilityMin !== undefined && { close_probability_min: opts.closeProbabilityMin }),
+      ...(opts.closeProbabilityMax !== undefined && { close_probability_max: opts.closeProbabilityMax }),
+      ...(opts.notContactedSinceDays !== undefined && { not_contacted_since_days: opts.notContactedSinceDays }),
       ...(opts.createdAfter && { created_after: opts.createdAfter }),
       ...(opts.createdBefore && { created_before: opts.createdBefore }),
       ...(opts.updatedAfter && { updated_after: opts.updatedAfter }),
@@ -563,6 +608,10 @@ leadsCmd
   .option('--status <status>', 'New status')
   .option('--source <source>', 'New source')
   .option('--deal-value <amount>', 'Deal value (numeric)')
+  .option('--close-probability <n>', 'Close probability 0-100')
+  .option('--close-reason <reason>', 'Close reason (price|timing|competition|no_budget|no_decision|fit|other)')
+  .option('--expected-close-date <date>', 'Expected close date (YYYY-MM-DD)')
+  .option('--score <n>', 'Lead score 0-100 (calls PATCH /leads/:id/score)')
   .option('--notes <notes>', 'New notes')
   .option('--assigned-to <assignedTo>', 'New assigned-to')
   .option('--tag <tag>', 'Replace ALL tags (repeatable). Use --add-tag / --remove-tag for surgical edits.', (v, prev) => prev.concat([v]), [])
@@ -570,9 +619,11 @@ leadsCmd
   .option('--remove-tag <tag>', 'Remove a single tag (repeatable)', (v, prev) => prev.concat([v]), [])
   .option('--external-id <externalId>', 'New external ID')
   .option('--version <version>', 'Optimistic lock version')
+  .option('--from-agent-name <name>', 'Agent name for attribution (falls back to config defaultAgentName)')
   .action(async (id, opts) => {
     const globalOpts = program.opts();
-    const client = getClient(globalOpts);
+    const agentName = resolveAgentName(opts.fromAgentName);
+    const client = getClient(globalOpts, agentName);
     try {
       // Surgical tag ops: call PATCH /leads/:id/tags first if add/remove specified
       if (opts.addTag.length > 0 || opts.removeTag.length > 0) {
@@ -583,14 +634,19 @@ leadsCmd
         // If no other fields to update, return tag result
         const hasOtherFields = opts.name || opts.email || opts.phone !== undefined ||
           opts.company !== undefined || opts.status || opts.source ||
-          opts.dealValue !== undefined || opts.notes !== undefined ||
-          opts.assignedTo !== undefined || opts.tag.length > 0 ||
-          opts.externalId !== undefined;
+          opts.dealValue !== undefined || opts.closeProbability !== undefined ||
+          opts.closeReason !== undefined || opts.expectedCloseDate !== undefined ||
+          opts.notes !== undefined || opts.assignedTo !== undefined ||
+          opts.tag.length > 0 || opts.externalId !== undefined || opts.score !== undefined;
         if (!hasOtherFields) {
           printJSON(tagRes.data);
           return;
         }
       }
+      // Score update: call separate PATCH /leads/:id/score endpoint
+      if (opts.score !== undefined) {
+        await client.patch(`/leads/${id}/score`, { score: parseInt(opts.score) });
+      }
       const body = {
         ...(opts.name && { name: opts.name }),
         ...(opts.email && { email: opts.email }),
@@ -599,14 +655,22 @@ leadsCmd
         ...(opts.status && { status: opts.status }),
         ...(opts.source && { source: opts.source }),
         ...(opts.dealValue !== undefined && { deal_value: parseFloat(opts.dealValue) }),
+        ...(opts.closeProbability !== undefined && { close_probability: parseInt(opts.closeProbability) }),
+        ...(opts.closeReason !== undefined && { close_reason: opts.closeReason }),
+        ...(opts.expectedCloseDate !== undefined && { expected_close_date: opts.expectedCloseDate }),
         ...(opts.notes !== undefined && { notes: opts.notes }),
         ...(opts.assignedTo !== undefined && { assigned_to: opts.assignedTo }),
         ...(opts.tag.length > 0 && { tags: opts.tag }),
         ...(opts.externalId !== undefined && { external_id: opts.externalId }),
         ...(opts.version !== undefined && { version: parseInt(opts.version) })
       };
-      const res = await client.put(`/leads/${id}`, body);
-      printJSON(res.data);
+      // Only call PUT if there are fields beyond score/tags to update
+      if (Object.keys(body).length > 0) {
+        const res = await client.put(`/leads/${id}`, body);
+        printJSON(res.data);
+      } else if (opts.score !== undefined) {
+        console.log(JSON.stringify({ success: true, data: { scored: true, score: parseInt(opts.score) } }, null, 2));
+      }
     } catch (err) {
       handleError(err);
     }
@@ -627,6 +691,21 @@ leadsCmd
     }
   });
 
+leadsCmd
+  .command('assign <id> <agent>')
+  .description('Assign a lead to an agent (fires lead.assigned webhook) — S18-2')
+  .action(async (id, agent) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.patch(`/leads/${id}/assign`, { assigned_to: agent });
+      console.log(`Lead assigned to: ${res.data.data.assigned_to}`);
+      printJSON(res.data);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+
 leadsCmd
   .command('history <id>')
   .description('Show status change history for a lead')
@@ -641,6 +720,146 @@ leadsCmd
     }
   });
 
+leadsCmd
+  .command('bulk-update')
+  .description('Bulk update lead status using filter criteria (S17-1). Up to 200 leads per call.')
+  .option('--filter-status <status>', 'Only update leads with this current status')
+  .option('--filter-source <source>', 'Only update leads with this source')
+  .option('--filter-assigned-to <agent>', 'Only update leads assigned to this agent')
+  .requiredOption('--status <status>', 'New status to set (new|contacted|qualified|unresponsive|converted|lost)')
+  .option('--close-reason <reason>', 'Close reason (required when --status lost): price|timing|competition|no_budget|no_decision|fit|other')
+  .option('--dry-run', 'Preview count without applying changes', false)
+  .action(async (opts) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    const filter = {};
+    if (opts.filterStatus) filter.status = opts.filterStatus;
+    if (opts.filterSource) filter.source = opts.filterSource;
+    if (opts.filterAssignedTo) filter.assigned_to = opts.filterAssignedTo;
+    const update = { status: opts.status };
+    if (opts.closeReason) update.close_reason = opts.closeReason;
+    try {
+      const res = await client.patch('/leads/bulk', { filter, update, dry_run: opts.dryRun });
+      if (opts.dryRun) {
+        console.log(`Dry run: ${res.data.data.would_update} lead(s) would be updated.`);
+      } else {
+        console.log(`Updated: ${res.data.data.updated} lead(s).`);
+        if (res.data.data.failed && res.data.data.failed.length > 0) {
+          console.log(`Failed: ${res.data.data.failed.length}`);
+        }
+      }
+      printJSON(res.data);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+
+// leads search <term> — S19-1
+leadsCmd
+  .command('search <term>')
+  .description('Search leads by name, email, company, or notes')
+  .action(async (term) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.get('/leads', { params: { q: term, per_page: 50 } });
+      const leads = res.data.data || [];
+      if (leads.length === 0) {
+        console.log('No leads found matching: ' + term);
+        return;
+      }
+      const rows = leads.map(l => ({
+        id: l.id,
+        name: l.name,
+        email: l.email,
+        company: l.company || '—',
+        status: l.status
+      }));
+      console.table(rows);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+
+// leads dedupe <id> — S19-3
+leadsCmd
+  .command('dedupe <id>')
+  .description('Find duplicate leads for a given lead ID')
+  .action(async (id) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const leadRes = await client.get(`/leads/${id}`);
+      const lead = leadRes.data.data;
+      const body = {};
+      if (lead.email) body.email = lead.email;
+      if (lead.name) body.name = lead.name;
+      if (lead.company) body.company = lead.company;
+      const dedupeRes = await client.post('/leads/dedupe/check', body);
+      const duplicates = (dedupeRes.data.data && dedupeRes.data.data.duplicates) || [];
+      // Filter out the lead itself
+      const matches = duplicates.filter(d => d.id !== id);
+      if (matches.length === 0) {
+        console.log('No duplicate leads found for: ' + lead.name);
+        return;
+      }
+      console.log(`Potential duplicates for "${lead.name}" (${id}):`);
+      const rows = matches.map(d => ({
+        id: d.id,
+        name: d.name,
+        email: d.email,
+        company: d.company || '—',
+        status: d.status,
+        score: d.score
+      }));
+      console.table(rows);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+
+
+// S21-1: leads tag / leads untag
+leadsCmd
+  .command('tag <lead-id> <tag>')
+  .description('Add a tag to a lead')
+  .action(async (leadId, tag, opts) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.patch(`/leads/${leadId}/tags`, { add: [tag] });
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+leadsCmd
+  .command('untag <lead-id> <tag>')
+  .description('Remove a tag from a lead')
+  .action(async (leadId, tag, opts) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.patch(`/leads/${leadId}/tags`, { remove: [tag] });
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+leadsCmd
+  .command('audit <id>')
+  .description('Show audit trail for a lead')
+  .action(async (id) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.get(`/leads/${id}/audit`);
+      const events = res.data.data || [];
+      if (events.length === 0) { console.log('No audit events found.'); return; }
+      for (const e of events) {
+        console.log(`[${new Date(e.changed_at).toLocaleString()}] ${e.field}: ${e.old_value ?? '—'} → ${e.new_value ?? '—'} (by ${e.changed_by})`);
+      }
+    } catch (err) { handleError(err); }
+  });
+
 // ============================================================
 // USERS COMMANDS (requires admin scope key)
 // ============================================================
@@ -1344,7 +1563,42 @@ emailsCmd
     }
   });
 
+emailsCmd
+  .command('sync')
+  .description('Sync Gmail inbox into CRM (deduped by Gmail message ID)')
+  .option('--max-results <n>', 'Max number of messages to fetch (default 100, max 500)', '100')
+  .action(async (opts) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.post('/emails/sync', { max_results: parseInt(opts.maxResults) || 100 });
+      printJSON(res.data);
+    } catch (err) {
+      handleError(err);
+    }
+  });
 
+emailsCmd
+  .command('send')
+  .description('Send an email via Gmail (rate-limited: 1/30min, 30/day per workspace)')
+  .requiredOption('--to <email>', 'Recipient email address')
+  .requiredOption('--subject <subject>', 'Email subject')
+  .requiredOption('--body <text>', 'Email body text')
+  .option('--lead-id <id>', 'Link sent email to a lead ID')
+  .option('--dry-run', 'Validate only — do not send or consume rate limit quota')
+  .action(async (opts) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const body = { to: opts.to, subject: opts.subject, body: opts.body };
+      if (opts.leadId) body.lead_id = opts.leadId;
+      if (opts.dryRun) body.dry_run = true;
+      const res = await client.post('/emails/send', body);
+      printJSON(res.data);
+    } catch (err) {
+      handleError(err);
+    }
+  });
 
 // ============================================================
 // QUOTES commands
@@ -2443,4 +2697,497 @@ const supportCmd = program.command('support').description('Submit and manage bug
     });
 });
 
+// ============================================================
+// EMAIL SYNC CONFIG COMMANDS (Sprint 16)
+// ============================================================
+
+const emailCmd = program.command('email-config').description('Persistent workspace email sync settings (Sprint 16)');
+
+emailCmd
+  .command('status')
+  .description('Show current workspace email sync configuration and defaults')
+  .action(async () => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.get('/emails/sync/status');
+      const d = res.data.data;
+      console.log('\n=== Email Sync Config ===');
+      console.log(`Gmail configured: ${d.gmail_configured}`);
+      console.log(`Workspace: ${d.workspace_slug}`);
+      console.log(`auto_create_inbound_leads default: ${d.auto_create_inbound_leads}`);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+
+emailCmd
+  .command('set')
+  .description('Set persistent workspace default for auto_create_inbound_leads')
+  .requiredOption('--auto-create-leads <bool>', 'Set workspace default: true or false')
+  .action(async (opts) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    const value = opts.autoCreateLeads === 'true' || opts.autoCreateLeads === true;
+    try {
+      const res = await client.patch('/emails/sync/config', { auto_create_inbound_leads: value });
+      console.log(`Workspace default auto_create_inbound_leads set to: ${res.data.data.auto_create_inbound_leads}`);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+
+// ============================================================
+// ANALYTICS COMMANDS (S17-2)
+// ============================================================
+
+const analyticsCmd = program.command('analytics').description('CRM analytics and pipeline metrics (S17-2)');
+
+analyticsCmd
+  .command('summary')
+  .description('Show aggregated lead analytics including pipeline velocity, loss reasons, and conversion rates')
+  .option('--assigned-to <agent>', 'Scope metrics to a specific agent')
+  .action(async (opts) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    const params = {};
+    if (opts.assignedTo) params.assigned_to = opts.assignedTo;
+    try {
+      const res = await client.get('/analytics/summary', { params });
+      const d = res.data.data;
+      console.log('\n=== Analytics Summary ===');
+      console.log(`Total leads: ${d.total_leads}`);
+      if (d.scoped_to) console.log(`Scoped to agent: ${d.scoped_to}`);
+      console.log('\nBy Status:');
+      Object.entries(d.by_status || {}).forEach(([k, v]) => console.log(`  ${k}: ${v}`));
+      console.log('\nBy Stage:');
+      Object.entries(d.by_stage || {}).forEach(([k, v]) => console.log(`  ${k}: ${v}`));
+      if (d.avg_close_probability != null) console.log(`\nAvg close probability: ${d.avg_close_probability}%`);
+      console.log(`Stale leads (30d no activity): ${d.stale_leads_count}`);
+      if (Object.keys(d.loss_reason_distribution || {}).length > 0) {
+        console.log('\nLoss Reasons:');
+        Object.entries(d.loss_reason_distribution).forEach(([k, v]) => console.log(`  ${k}: ${v}`));
+      }
+      if (Object.keys(d.pipeline_velocity || {}).length > 0) {
+        console.log('\nPipeline Velocity (avg days per stage):');
+        Object.entries(d.pipeline_velocity).forEach(([k, v]) => console.log(`  ${k}: ${v}d`));
+      }
+      if (Object.keys(d.stage_conversion_rates || {}).length > 0) {
+        console.log('\nStage Conversion Rates:');
+        Object.entries(d.stage_conversion_rates).forEach(([k, v]) => console.log(`  ${k}: ${v}%`));
+      }
+    } catch (err) {
+      handleError(err);
+    }
+  });
+
+// ============================================================
+// WEBHOOKS COMMANDS (S17-3)
+// ============================================================
+
+const webhooksCmd = program.command('webhooks').description('Manage webhook endpoints (S17-3)');
+
+webhooksCmd
+  .command('list')
+  .description('List registered webhook endpoints')
+  .action(async () => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.get('/webhooks');
+      printJSON(res.data);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+
+webhooksCmd
+  .command('events')
+  .description('List valid webhook event types')
+  .action(async () => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.get('/webhooks/events');
+      printJSON(res.data);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+
+webhooksCmd
+  .command('create')
+  .description('Register a new webhook endpoint')
+  .requiredOption('--url <url>', 'Webhook destination URL')
+  .requiredOption('--events <events>', 'Comma-separated event types (e.g. lead.created,lead.status_changed)')
+  .option('--secret <secret>', 'Signing secret for HMAC-SHA256 verification (generated if omitted)')
+  .action(async (opts) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    const events = opts.events.split(',').map(e => e.trim()).filter(Boolean);
+    const body = { url: opts.url, events };
+    if (opts.secret) body.secret = opts.secret;
+    try {
+      const res = await client.post('/webhooks', body);
+      console.log('Webhook registered.');
+      printJSON(res.data);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+
+webhooksCmd
+  .command('delete <id>')
+  .description('Remove a webhook endpoint by ID')
+  .action(async (id) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.delete(`/webhooks/${id}`);
+      console.log('Webhook deleted.');
+      printJSON(res.data);
+    } catch (err) {
+      handleError(err);
+    }
+  });
+
+// ── stages ──────────────────────────────────────────────────────────
+const stagesCmd = program.command('stages').description('Manage pipeline stages (admin)');
+
+// Helper: login via workspace-scoped POST /auth/login and return JWT token
+async function stagesAdminLogin(base, cfg, opts) {
+  const workspace = opts.workspace || process.env.SAAC_CRM_WORKSPACE || cfg.workspace;
+  const email = opts.email || process.env.SAAC_CRM_ADMIN_EMAIL || cfg.admin_email;
+  const password = opts.password || process.env.SAAC_CRM_ADMIN_PASSWORD || await promptSecret('Admin password: ');
+  if (!workspace) { console.error('Error: workspace required. Use --workspace or run: saac_crm config set --workspace <slug>'); process.exit(1); }
+  if (!email) { console.error('Error: email required. Use --email or SAAC_CRM_ADMIN_EMAIL'); process.exit(1); }
+  const loginRes = await axios.post(`${base}/api/v1/auth/login`, { workspace, email, password });
+  return loginRes.data.data?.token;
+}
+
+stagesCmd
+  .command('list')
+  .description('List all pipeline stages for workspace')
+  .option('--workspace <slug>', 'Workspace slug')
+  .option('--email <email>', 'Admin email')
+  .option('--password <password>', 'Admin password')
+  .action(async (opts) => {
+    const globalOpts = program.opts();
+    const apiUrl = resolveApiUrl(globalOpts.url);
+    if (!apiUrl) { console.error('Error: API URL not configured.'); process.exit(1); }
+    const cfg = loadConfig();
+    try {
+      const base = apiUrl.replace(/\/$/, '');
+      const token = await stagesAdminLogin(base, cfg, opts);
+      const res = await axios.get(`${base}/api/v1/admin/stages`, {
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' }
+      });
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+stagesCmd
+  .command('create <name>')
+  .description('Create a new pipeline stage')
+  .option('--order <n>', 'Sort order (integer)', '999')
+  .option('--workspace <slug>', 'Workspace slug')
+  .option('--email <email>', 'Admin email')
+  .option('--password <password>', 'Admin password')
+  .action(async (name, opts) => {
+    const globalOpts = program.opts();
+    const apiUrl = resolveApiUrl(globalOpts.url);
+    if (!apiUrl) { console.error('Error: API URL not configured.'); process.exit(1); }
+    const cfg = loadConfig();
+    try {
+      const base = apiUrl.replace(/\/$/, '');
+      const token = await stagesAdminLogin(base, cfg, opts);
+      const res = await axios.post(`${base}/api/v1/admin/stages`, { name, order: parseInt(opts.order, 10) }, {
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' }
+      });
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+stagesCmd
+  .command('update <stage-id>')
+  .description('Rename or reorder a pipeline stage')
+  .option('--name <name>', 'New stage name')
+  .option('--order <n>', 'New sort order (integer)')
+  .option('--workspace <slug>', 'Workspace slug')
+  .option('--email <email>', 'Admin email')
+  .option('--password <password>', 'Admin password')
+  .action(async (stageId, opts) => {
+    const globalOpts = program.opts();
+    const apiUrl = resolveApiUrl(globalOpts.url);
+    if (!apiUrl) { console.error('Error: API URL not configured.'); process.exit(1); }
+    const cfg = loadConfig();
+    const body = {};
+    if (opts.name) body.name = opts.name;
+    if (opts.order !== undefined) body.order = parseInt(opts.order, 10);
+    if (Object.keys(body).length === 0) { console.error('Provide --name and/or --order'); process.exit(1); }
+    try {
+      const base = apiUrl.replace(/\/$/, '');
+      const token = await stagesAdminLogin(base, cfg, opts);
+      const res = await axios.patch(`${base}/api/v1/admin/stages/${stageId}`, body, {
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' }
+      });
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+stagesCmd
+  .command('delete <stage-id>')
+  .description('Delete a pipeline stage (fails if leads are in that stage)')
+  .option('--workspace <slug>', 'Workspace slug')
+  .option('--email <email>', 'Admin email')
+  .option('--password <password>', 'Admin password')
+  .action(async (stageId, opts) => {
+    const globalOpts = program.opts();
+    const apiUrl = resolveApiUrl(globalOpts.url);
+    if (!apiUrl) { console.error('Error: API URL not configured.'); process.exit(1); }
+    const cfg = loadConfig();
+    try {
+      const base = apiUrl.replace(/\/$/, '');
+      const token = await stagesAdminLogin(base, cfg, opts);
+      const res = await axios.delete(`${base}/api/v1/admin/stages/${stageId}`, {
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' }
+      });
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+// ============================================================
+// Sprint 49 T1-B: companies command group
+// ============================================================
+const companiesCmd = program.command('companies').description('Manage companies/accounts (S49-T1-B)');
+
+companiesCmd
+  .command('list')
+  .description('List companies')
+  .option('--q <query>', 'Search by name or domain')
+  .option('--limit <n>', 'Max results', '20')
+  .option('--offset <n>', 'Offset for pagination', '0')
+  .action(async (opts) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const params = {};
+      if (opts.q) params.q = opts.q;
+      if (opts.limit) params.limit = opts.limit;
+      if (opts.offset) params.offset = opts.offset;
+      const res = await client.get('/companies', { params });
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+companiesCmd
+  .command('get <id>')
+  .description('Get a company by ID (includes linked leads)')
+  .action(async (id) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.get(`/companies/${id}`);
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+companiesCmd
+  .command('create')
+  .description('Create a new company')
+  .requiredOption('--name <name>', 'Company name')
+  .option('--domain <domain>', 'Company domain (e.g. acme.com)')
+  .option('--industry <industry>', 'Industry')
+  .option('--employee-count <n>', 'Number of employees')
+  .option('--website <url>', 'Website URL')
+  .option('--from-agent-name <name>', 'Agent name for attribution')
+  .action(async (opts) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts, resolveAgentName(opts.fromAgentName));
+    try {
+      const body = {
+        name: opts.name,
+        ...(opts.domain && { domain: opts.domain }),
+        ...(opts.industry && { industry: opts.industry }),
+        ...(opts.employeeCount !== undefined && { employee_count: parseInt(opts.employeeCount) }),
+        ...(opts.website && { website: opts.website }),
+      };
+      const res = await client.post('/companies', body);
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+companiesCmd
+  .command('update <id>')
+  .description('Update a company by ID')
+  .option('--name <name>', 'New name')
+  .option('--domain <domain>', 'New domain')
+  .option('--industry <industry>', 'New industry')
+  .option('--employee-count <n>', 'New employee count')
+  .option('--website <url>', 'New website URL')
+  .option('--from-agent-name <name>', 'Agent name for attribution')
+  .action(async (id, opts) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts, resolveAgentName(opts.fromAgentName));
+    try {
+      const body = {
+        ...(opts.name && { name: opts.name }),
+        ...(opts.domain !== undefined && { domain: opts.domain }),
+        ...(opts.industry !== undefined && { industry: opts.industry }),
+        ...(opts.employeeCount !== undefined && { employee_count: parseInt(opts.employeeCount) }),
+        ...(opts.website !== undefined && { website: opts.website }),
+      };
+      const res = await client.put(`/companies/${id}`, body);
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+companiesCmd
+  .command('delete <id>')
+  .description('Delete a company (soft delete, unlinks leads)')
+  .action(async (id) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.delete(`/companies/${id}`);
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+companiesCmd
+  .command('leads <id>')
+  .description('List leads linked to a company')
+  .action(async (id) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.get(`/companies/${id}`);
+      // Return only the leads array from the company response
+      const data = res.data?.data;
+      printJSON({ success: true, data: data?.leads || [] });
+    } catch (err) { handleError(err); }
+  });
+
+// ============================================================
+// Sprint 49 T1-B: sequences command group (enrollment only — definitions are admin-only)
+// ============================================================
+const sequencesCmd = program.command('sequences').description('Manage sequence enrollments (S49-T1-B). Sequence definitions are admin-only.');
+
+sequencesCmd
+  .command('list')
+  .description('List all sequences (read-only)')
+  .action(async () => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.get('/sequences');
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+sequencesCmd
+  .command('get <id>')
+  .description('Get a sequence with its steps')
+  .action(async (id) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.get(`/sequences/${id}`);
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+sequencesCmd
+  .command('enroll <sequenceId>')
+  .description('Enroll one or more leads into a sequence')
+  .requiredOption('--lead-ids <ids>', 'Comma-separated lead UUIDs')
+  .option('--from-agent-name <name>', 'Agent name for attribution')
+  .action(async (sequenceId, opts) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts, resolveAgentName(opts.fromAgentName));
+    try {
+      const lead_ids = opts.leadIds.split(',').map(s => s.trim()).filter(Boolean);
+      const res = await client.post(`/sequences/${sequenceId}/enroll`, { lead_ids });
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+sequencesCmd
+  .command('unenroll <sequenceId> <leadId>')
+  .description('Unenroll a single lead from a sequence')
+  .action(async (sequenceId, leadId) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.delete(`/sequences/${sequenceId}/enroll/${leadId}`);
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+sequencesCmd
+  .command('enrollments <sequenceId>')
+  .description('List enrollments for a sequence')
+  .option('--status <status>', 'Filter by status (active|paused|completed|unenrolled)')
+  .option('--q <query>', 'Search by lead name or email')
+  .option('--limit <n>', 'Max results', '50')
+  .option('--offset <n>', 'Offset for pagination', '0')
+  .action(async (sequenceId, opts) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const params = { limit: opts.limit, offset: opts.offset };
+      if (opts.status) params.status = opts.status;
+      if (opts.q) params.q = opts.q;
+      const res = await client.get(`/sequences/${sequenceId}/enrollments`, { params });
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+sequencesCmd
+  .command('bulk-enroll <sequenceId>')
+  .description('Bulk enroll leads into a sequence (≤50 sync, >50 returns job ID)')
+  .option('--lead-ids <ids>', 'Comma-separated lead UUIDs (max 500)')
+  .option('--segment-id <id>', 'Enroll all leads in a segment')
+  .option('--search-status <status>', 'Enroll leads matching status filter')
+  .option('--from-agent-name <name>', 'Agent name for attribution')
+  .action(async (sequenceId, opts) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts, resolveAgentName(opts.fromAgentName));
+    try {
+      const body = {};
+      if (opts.leadIds) body.lead_ids = opts.leadIds.split(',').map(s => s.trim()).filter(Boolean);
+      else if (opts.segmentId) body.segment_id = opts.segmentId;
+      else if (opts.searchStatus) body.search = { status: opts.searchStatus };
+      else { console.error('One of --lead-ids, --segment-id, or --search-status required'); process.exit(1); }
+      const res = await client.post(`/sequences/${sequenceId}/enroll/bulk`, body);
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+sequencesCmd
+  .command('bulk-unenroll <sequenceId>')
+  .description('Bulk unenroll leads from a sequence')
+  .requiredOption('--lead-ids <ids>', 'Comma-separated lead UUIDs')
+  .action(async (sequenceId, opts) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const lead_ids = opts.leadIds.split(',').map(s => s.trim()).filter(Boolean);
+      const res = await client.post(`/sequences/${sequenceId}/unenroll/bulk`, { lead_ids });
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
+sequencesCmd
+  .command('job <jobId>')
+  .description('Poll status of an async bulk-enroll job')
+  .action(async (jobId) => {
+    const globalOpts = program.opts();
+    const client = getClient(globalOpts);
+    try {
+      const res = await client.get(`/jobs/${jobId}`);
+      printJSON(res.data);
+    } catch (err) { handleError(err); }
+  });
+
 program.parse(process.argv);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@startanaicompany/crm",
-  "version": "2.8.0",
-  "description": "AI-first CRM CLI \u2014 manage leads and API keys from the terminal",
+  "version": "2.11.0",
+  "description": "AI-first CRM CLI — manage leads and API keys from the terminal",
   "main": "index.js",
   "bin": {
     "saac_crm": "./index.js"