@dharta/cli 0.6.77 → 0.6.78

package/src/commands/genui.ts

@@ -0,0 +1,59 @@
+// `dharta genui` (RFC 0056): build and check the agent's generative-UI
+// component catalog. Both subcommands are local-only - no auth, no network.
+// The validation lives in ../genui.ts, shared with `dharta dev`'s doctor and
+// the deploy pre-flight so all three report the same problem in the same words.
+
+import * as path from "node:path";
+import type { Command } from "commander";
+import { buildGenui, formatGenuiStatus, genuiCheckData } from "../genui.js";
+import { isJson, printJson } from "../output.js";
+import { normalizeNonBlank } from "../validators.js";
+
+function resolveDir(dirArg?: string): string {
+  return path.resolve(dirArg === undefined ? process.cwd() : normalizeNonBlank(dirArg, "path"));
+}
+
+// The full layout is in the CLI's README, under "Generative UI". Repeating it
+// here would give it a second place to drift.
+const SOURCE_LAYOUT = [
+  "",
+  "Sources live one directory per component under `source` in [genui.build]",
+  "(default genui/components), named exactly as the [genui] components array",
+  "names them: component.json, plus worker.js for tier 2 or index.html for",
+  "tier 3. The build refuses when the two disagree and never edits the array -",
+  "a component's tier is your trust declaration, not a value it can derive.",
+  "",
+  "See the `Generative UI` section of the @dharta/cli README for the full",
+  "layout and the component.json keys.",
+].join("\n");
+
+export function registerGenuiCommands(program: Command): void {
+  const genui = program
+    .command("genui")
+    .description("Build and check the agent's generative-UI component catalog.")
+    .action(() => genui.help());
+
+  genui
+    .command("build")
+    .argument("[dir]", "Agent directory (default: current directory)")
+    .description("Compile `[genui]` source into the bundle and record its digest in dharta.toml.")
+    .addHelpText("after", SOURCE_LAYOUT)
+    .action(async (dirArg: string | undefined, _opts: unknown, cmd: Command) => {
+      const json = isJson(cmd);
+      const result = await buildGenui(
+        resolveDir(dirArg),
+        json ? () => {} : (line) => console.log(line),
+      );
+      if (json) printJson(result);
+    });
+
+  genui
+    .command("check")
+    .argument("[dir]", "Agent directory (default: current directory)")
+    .description("Verify the declared bundle exists, matches its digest, and is valid.")
+    .action(async (dirArg: string | undefined, _opts: unknown, cmd: Command) => {
+      const status = await genuiCheckData(resolveDir(dirArg));
+      if (isJson(cmd)) printJson(status);
+      else console.log(formatGenuiStatus(status));
+    });
+}

package/src/commands/git-credential.ts

@@ -1,6 +1,5 @@
 import { HttpClient } from "@dharta/sdk";
-import { randomUUID } from "node:crypto";
-import { activeProfile, type Profile } from "../config.js";
+import { activeProfile, mintIdempotencyKey, type Profile } from "../config.js";
 
 // `dharta git-credential <operation>` - a git credential helper in the protocol sense,
 // wired by `dharta login` via `credential.<git host>.helper = !dharta git-credential`.
@@ -68,7 +67,7 @@ async function mintWorkspaceToken(
     const res = await http.request<{ token?: string }>({
       method: "POST",
       path: `/api/agents/${encodeURIComponent(agent)}/workspace_tokens`,
-      headers: { "Idempotency-Key": randomUUID() },
+      idempotencyKey: mintIdempotencyKey("workspace-token"),
       body: { instance },
     });
     return res.token ?? null;

package/src/commands/kartas.ts

@@ -1,8 +1,9 @@
-import { randomUUID } from "node:crypto";
 import type { CliContext } from "../context.js";
+import type { KartaShareCreateResponse } from "@dharta/sdk";
 import { table } from "../output.js";
 import { maskEnvValue } from "./env.js";
 import { closestChoice, normalizeNonBlank } from "../validators.js";
+import { CliUsageError } from "../exit-codes.js";
 
 const DHARTA_AUDIENCES = ["members", "anonymous", "off"] as const;
 const DHARTA_ROLES = ["viewer", "participant", "manager"] as const;
@@ -75,7 +76,6 @@ export async function kartasCreateData(
   return ctx.http.request<{ karta: KartaRecord }>({
     method: "POST",
     path: "/api/kartas",
-    headers: { "Idempotency-Key": randomUUID() },
     body: {
       agent,
       name: name.trim(),
@@ -147,7 +147,7 @@ export async function kartasShow(ctx: CliContext, id: string): Promise<string> {
 
 export function validateKartaConfigureOptions(options: KartaConfigureOptions): void {
   if (options.name === undefined && options.slug === undefined && options.access === undefined) {
-    throw new Error("Set at least one of --name, --slug, or --access.");
+    throw new CliUsageError("Set at least one of --name, --slug, or --access.");
   }
   if (options.name !== undefined) normalizeNonBlank(options.name, "dharta name");
   if (options.slug !== undefined) normalizeNonBlank(options.slug, "dharta vanity slug");
@@ -190,7 +190,6 @@ export async function kartasConfigureData(
   return ctx.http.request<{ karta: KartaRecord }>({
     method: "PATCH",
     path: `/api/kartas/${encodeURIComponent(kartaId)}`,
-    headers: { "Idempotency-Key": randomUUID() },
     body,
   });
 }
@@ -214,7 +213,6 @@ export async function kartasArchiveData(
   return ctx.http.request<{ karta: KartaRecord }>({
     method: "DELETE",
     path: `/api/kartas/${encodeURIComponent(kartaId)}`,
-    headers: { "Idempotency-Key": randomUUID() },
   });
 }
 
@@ -234,7 +232,6 @@ export async function kartasRestoreData(
   return ctx.http.request<{ karta: KartaRecord }>({
     method: "POST",
     path: `/api/kartas/${encodeURIComponent(kartaId)}/restore`,
-    headers: { "Idempotency-Key": randomUUID() },
   });
 }
 
@@ -245,6 +242,46 @@ export async function kartasRestore(ctx: CliContext, id: string): Promise<string
     : `Restored ${karta.name ?? karta.id}.`;
 }
 
+// A no-sign-in link to one karta. Anyone holding it gets their own session
+// against the SAME durable workspace and spends from its budget, so the secret
+// and the link are shown once and are never readable again. Two kartas cannot
+// take one: a members-only karta has a member list instead, and a karta no
+// agent has run yet has no host to publish under.
+export async function kartaShareData(
+  ctx: CliContext,
+  id: string,
+): Promise<KartaShareCreateResponse> {
+  return ctx.sdk.kartas.createShare(normalizeNonBlank(id, "karta id"));
+}
+
+export async function kartaShare(ctx: CliContext, id: string): Promise<string> {
+  const res = await kartaShareData(ctx, id);
+  return [
+    `Shared karta ${res.share.agent_instance_id} as ${res.share.prefix}.`,
+    "",
+    "Link (shown once - store it now):",
+    res.url,
+    "",
+    `Revoke it with: dharta kartas unshare ${res.share.agent_instance_id} ${res.share.id}`,
+  ].join("\n");
+}
+
+export async function kartaUnshareData(
+  ctx: CliContext,
+  id: string,
+  shareId: string,
+): Promise<{ id: string; share_id: string; revoked: true }> {
+  const kartaId = normalizeNonBlank(id, "karta id");
+  const share = normalizeNonBlank(shareId, "share id");
+  await ctx.sdk.kartas.revokeShare(kartaId, share);
+  return { id: kartaId, share_id: share, revoked: true };
+}
+
+export async function kartaUnshare(ctx: CliContext, id: string, shareId: string): Promise<string> {
+  const res = await kartaUnshareData(ctx, id, shareId);
+  return `Revoked share ${res.share_id} on karta ${res.id}. The link stops working immediately.`;
+}
+
 export async function kartaMembersGrantData(
   ctx: CliContext,
   id: string,
@@ -257,7 +294,6 @@ export async function kartaMembersGrantData(
   return ctx.http.request<{ member: KartaMember }>({
     method: "POST",
     path: `/api/kartas/${encodeURIComponent(kartaId)}/members`,
-    headers: { "Idempotency-Key": randomUUID() },
     body: { email: normalizedEmail, role: normalizedRole },
   });
 }
@@ -279,7 +315,6 @@ export async function kartaMembersSetRoleData(
   return ctx.http.request<{ member: KartaMember }>({
     method: "PATCH",
     path: `/api/kartas/${encodeURIComponent(kartaId)}/members/${encodeURIComponent(memberId)}`,
-    headers: { "Idempotency-Key": randomUUID() },
     body: { role: normalizedRole },
   });
 }
@@ -304,7 +339,6 @@ export async function kartaMembersRevokeData(
   await ctx.http.request<void>({
     method: "DELETE",
     path: `/api/kartas/${encodeURIComponent(kartaId)}/members/${encodeURIComponent(memberId)}`,
-    headers: { "Idempotency-Key": randomUUID() },
   });
   return { id: kartaId, membership_id: memberId, revoked: true };
 }
@@ -318,7 +352,7 @@ function normalizeAudience(audience: string): KartaAudience {
   const normalized = normalizeNonBlank(audience, "karta access audience");
   if ((DHARTA_AUDIENCES as readonly string[]).includes(normalized)) return normalized as KartaAudience;
   const suggestion = closestChoice(normalized, DHARTA_AUDIENCES);
-  throw new Error(
+  throw new CliUsageError(
     `Unknown karta access ${normalized}. Allowed values: ${DHARTA_AUDIENCES.join(", ")}.` +
       (suggestion ? ` Did you mean ${suggestion}?` : ""),
   );
@@ -328,7 +362,7 @@ function normalizeRole(role: string): KartaRole {
   const normalized = normalizeNonBlank(role, "karta member role");
   if ((DHARTA_ROLES as readonly string[]).includes(normalized)) return normalized as KartaRole;
   const suggestion = closestChoice(normalized, DHARTA_ROLES);
-  throw new Error(
+  throw new CliUsageError(
     `Unknown karta member role ${normalized}. Allowed roles: ${DHARTA_ROLES.join(", ")}.` +
       (suggestion ? ` Did you mean ${suggestion}?` : ""),
   );

package/src/commands/keys.ts

@@ -1,31 +1,28 @@
 import type { CliContext } from "../context.js";
-import { API_KEY_SCOPES, type ApiKeyScope } from "@dharta/sdk";
-import { randomUUID } from "node:crypto";
+import {
+  API_KEY_BULK_ACTIONS,
+  API_KEY_ROTATION_GRACE_PERIODS,
+  API_KEY_SCOPES,
+  type ApiKey,
+  type ApiKeyBulkAction,
+  type ApiKeyBulkUpdateResponse,
+  type ApiKeyRotateResponse,
+  type ApiKeyRotationGracePeriod,
+  type ApiKeyScope,
+  type ApiKeyStateResponse,
+} from "@dharta/sdk";
 import { fmtTs, table } from "../output.js";
-import { closestChoice, normalizeIsoTimestamp, normalizeNonBlank } from "../validators.js";
+import { closestChoice, normalizeIsoTimestamp, normalizeNonBlank, parsePositiveInteger } from "../validators.js";
 import { formatScopes, SENSITIVE_API_KEY_SCOPES } from "./scopes.js";
+import { CliUsageError } from "../exit-codes.js";
+
+export const KEY_BULK_ACTIONS = API_KEY_BULK_ACTIONS;
+export const KEY_ROTATION_GRACE_PERIODS = API_KEY_ROTATION_GRACE_PERIODS;
 
 interface ListEnvelope<T> {
   data: T[];
 }
 
-interface ApiKey {
-  id: string;
-  name: string;
-  prefix: string;
-  scopes: ApiKeyScope[];
-  mode?: string;
-  expires_at?: string | null;
-  created_at: string;
-  last_used_at: string | null;
-  revoked_at: string | null;
-}
-
-interface ApiKeyCreateResponse {
-  api_key: ApiKey;
-  secret: string;
-}
-
 export interface ApiKeyCreateOptions {
   expiresAt?: string;
 }
@@ -45,6 +42,7 @@ export async function keysList(ctx: CliContext): Promise<string> {
   if (keys.length === 0) return "No API keys. Create one with: dharta keys create <name> --scope agents:read";
   return table(
     keys.map((k) => ({
+      id: String(k.id),
       prefix: k.prefix,
       name: k.name,
       scopes: formatScopes(k.scopes, ","),
@@ -64,13 +62,11 @@ export async function keysCreateData(
   validateKeysCreateInput(name, scopes, opts);
   const normalizedScopes = normalizeScopes(scopes);
   const normalizedOpts = normalizeCreateOptions(normalizedScopes, opts);
-  const body: Record<string, unknown> = { name: normalizeKeyName(name), scopes: normalizedScopes };
-  if (normalizedOpts.expiresAt !== undefined) body.expires_at = normalizedOpts.expiresAt;
-  return ctx.http.request<ApiKeyCreateResponse>({
-    method: "POST",
-    path: "/api_keys",
-    body,
-    headers: { "Idempotency-Key": randomUUID() },
+  // Through the SDK resource, not a hand-built request: every new endpoint
+  // ships an @dharta/sdk method and the curated command calls it (RFC 0048
+  // D2), so the wire shape and the idempotency header have one owner.
+  return ctx.sdk.apiKeys.create(normalizeKeyName(name), normalizedScopes, {
+    expiresAt: normalizedOpts.expiresAt,
   });
 }
 
@@ -108,7 +104,6 @@ export async function keysRevokeData(
   await ctx.http.request<void>({
     method: "DELETE",
     path: `/api_keys/${encodeURIComponent(normalizedId)}`,
-    headers: { "Idempotency-Key": randomUUID() },
   });
   return { id: normalizedId, revoked: true };
 }
@@ -129,7 +124,6 @@ export async function keysRenameData(
     method: "PATCH",
     path: `/api_keys/${encodeURIComponent(normalizedId)}`,
     body: { name: normalizedName },
-    headers: { "Idempotency-Key": randomUUID() },
   });
   return res.api_key;
 }
@@ -139,24 +133,147 @@ export async function keysRename(ctx: CliContext, id: string, name: string): Pro
   return `Renamed ${key.prefix} to ${key.name}.`;
 }
 
+export interface KeysRotateOptions {
+  gracePeriod?: string;
+}
+
+export function validateKeysRotateInput(id: string, opts: KeysRotateOptions = {}): void {
+  normalizeNonBlank(id, "API key id");
+  if (opts.gracePeriod !== undefined) normalizeGracePeriod(opts.gracePeriod);
+}
+
+export async function keysRotateData(
+  ctx: CliContext,
+  id: string,
+  opts: KeysRotateOptions = {},
+): Promise<ApiKeyRotateResponse> {
+  const normalizedId = normalizeNonBlank(id, "API key id");
+  const gracePeriod = opts.gracePeriod === undefined ? undefined : normalizeGracePeriod(opts.gracePeriod);
+  return ctx.sdk.apiKeys.rotate(normalizedId, { gracePeriod });
+}
+
+export async function keysRotate(
+  ctx: CliContext,
+  id: string,
+  opts: KeysRotateOptions = {},
+): Promise<string> {
+  const res = await keysRotateData(ctx, id, opts);
+  return [
+    `Rotated ${res.previous_key.prefix} into ${res.api_key.prefix} (${res.api_key.id}).`,
+    `Scopes: ${res.api_key.scopes.join(",")}`,
+    `The rotated key stops working at ${res.grace_ends_at}.`,
+    "",
+    "Secret (shown once - store it now):",
+    res.secret,
+  ].join("\n");
+}
+
+export async function keysDisableData(ctx: CliContext, id: string): Promise<ApiKeyStateResponse> {
+  return ctx.sdk.apiKeys.disable(normalizeNonBlank(id, "API key id"));
+}
+
+export async function keysDisable(ctx: CliContext, id: string): Promise<string> {
+  const res = await keysDisableData(ctx, id);
+  return res.changed
+    ? `Disabled ${res.api_key.prefix}. Re-enable it with: dharta keys enable ${res.api_key.id}`
+    : `${res.api_key.prefix} was already disabled.`;
+}
+
+export async function keysEnableData(ctx: CliContext, id: string): Promise<ApiKeyStateResponse> {
+  return ctx.sdk.apiKeys.enable(normalizeNonBlank(id, "API key id"));
+}
+
+export async function keysEnable(ctx: CliContext, id: string): Promise<string> {
+  const res = await keysEnableData(ctx, id);
+  return res.changed
+    ? `Enabled ${res.api_key.prefix}.`
+    : `${res.api_key.prefix} was already enabled.`;
+}
+
+export function validateKeysBulkInput(action: string, ids: string[]): void {
+  normalizeBulkAction(action);
+  normalizeBulkIds(ids);
+}
+
+export async function keysBulkData(
+  ctx: CliContext,
+  action: string,
+  ids: string[],
+): Promise<ApiKeyBulkUpdateResponse> {
+  return ctx.sdk.apiKeys.bulkUpdate(normalizeBulkAction(action), normalizeBulkIds(ids));
+}
+
+export async function keysBulk(ctx: CliContext, action: string, ids: string[]): Promise<string> {
+  const res = await keysBulkData(ctx, action, ids);
+  const lines = [
+    `${BULK_PAST_TENSE[res.action]} ${res.updated.length} of ${res.updated.length + res.skipped.length} keys.`,
+  ];
+  if (res.updated.length > 0) lines.push(`Changed: ${res.updated.map((key) => key.prefix).join(", ")}`);
+  // A skip is the answer, not a failure: the action did not apply to that key.
+  if (res.skipped.length > 0) {
+    lines.push(`Already in that state: ${res.skipped.map((key) => key.prefix).join(", ")}`);
+  }
+  return lines.join("\n");
+}
+
+const BULK_PAST_TENSE: Record<ApiKeyBulkAction, string> = {
+  disable: "Disabled",
+  enable: "Enabled",
+  revoke: "Revoked",
+};
+
+function normalizeGracePeriod(value: string): ApiKeyRotationGracePeriod {
+  const normalized = normalizeNonBlank(value, "--grace-period");
+  if ((KEY_ROTATION_GRACE_PERIODS as readonly string[]).includes(normalized)) {
+    return normalized as ApiKeyRotationGracePeriod;
+  }
+  const suggestion = closestChoice(normalized, KEY_ROTATION_GRACE_PERIODS);
+  throw new CliUsageError(
+    `Unknown --grace-period ${normalized}. Allowed windows: ${KEY_ROTATION_GRACE_PERIODS.join(", ")}.` +
+      (suggestion ? ` Did you mean ${suggestion}?` : ""),
+  );
+}
+
+function normalizeBulkAction(value: string): ApiKeyBulkAction {
+  const normalized = normalizeNonBlank(value, "Bulk action");
+  if ((KEY_BULK_ACTIONS as readonly string[]).includes(normalized)) {
+    return normalized as ApiKeyBulkAction;
+  }
+  const suggestion = closestChoice(normalized, KEY_BULK_ACTIONS);
+  throw new CliUsageError(
+    `Unknown bulk action ${normalized}. Allowed actions: ${KEY_BULK_ACTIONS.join(", ")}.` +
+      (suggestion ? ` Did you mean ${suggestion}?` : ""),
+  );
+}
+
+// Ids are the numeric primary key the API answers, so a typo is caught here
+// rather than becoming a silently ignored id in the batch.
+function normalizeBulkIds(ids: string[]): number[] {
+  const normalized = ids.map((id) => parsePositiveInteger(id, "API key id"));
+  if (normalized.length === 0) {
+    throw new CliUsageError("Name at least one API key id, e.g. dharta keys bulk disable 12 13.");
+  }
+  return [...new Set(normalized)];
+}
+
 function normalizeKeyName(name: string): string {
   const normalized = name.trim();
   if (!normalized) {
-    throw new Error("API key name cannot be blank.");
+    throw new CliUsageError("API key name cannot be blank.");
   }
   return normalized;
 }
 
 function normalizeScopes(scopes: ApiKeyScope[]): ApiKeyScope[] {
   if (scopes.length === 0) {
-    throw new Error("Pass at least one --scope, e.g. --scope agents:read.");
+    throw new CliUsageError("Pass at least one --scope, e.g. --scope agents:read.");
   }
   const allowed = new Set<string>(API_KEY_SCOPES);
   const normalized = scopes.map((scope) => normalizeNonBlank(scope, "API key scope") as ApiKeyScope);
   const unknown = normalized.filter((scope) => !allowed.has(scope));
   if (unknown.length > 0) {
     const suggestion = unknown.length === 1 ? closestChoice(unknown[0]!, API_KEY_SCOPES) : null;
-    throw new Error(
+    throw new CliUsageError(
       `Unknown --scope ${unknown.join(", ")}. Allowed scopes: ${API_KEY_SCOPES.join(", ")}.` +
         (suggestion ? ` Did you mean ${suggestion}?` : ""),
     );
@@ -169,7 +286,7 @@ function normalizeCreateOptions(scopes: ApiKeyScope[], opts: ApiKeyCreateOptions
   if (opts.expiresAt !== undefined) {
     normalized.expiresAt = normalizeIsoTimestamp(opts.expiresAt, "--expires-at");
     if (new Date(normalized.expiresAt).getTime() <= Date.now()) {
-      throw new Error("--expires-at must be in the future.");
+      throw new CliUsageError("--expires-at must be in the future.");
     }
   }
 
@@ -177,12 +294,12 @@ function normalizeCreateOptions(scopes: ApiKeyScope[], opts: ApiKeyCreateOptions
   if (forced.length === 0) return normalized;
 
   if (normalized.expiresAt === undefined) {
-    throw new Error(
+    throw new CliUsageError(
       `Sensitive scopes require --expires-at within 90 days: ${forced.join(", ")}.`,
     );
   }
   if (new Date(normalized.expiresAt).getTime() > Date.now() + MAX_FORCED_EXPIRY_MS) {
-    throw new Error("Sensitive scopes require --expires-at within 90 days.");
+    throw new CliUsageError("Sensitive scopes require --expires-at within 90 days.");
   }
   return normalized;
 }

package/src/commands/login.ts

@@ -10,6 +10,7 @@ import {
 import { deviceFlowLogin, type DeviceFlowOptions } from "../device-flow.js";
 import type { Me } from "./auth.js";
 import { normalizeHttpUrl, normalizeNonBlank } from "../validators.js";
+import { CliUsageError } from "../exit-codes.js";
 
 export interface LoginOptions {
   baseUrl?: string;
@@ -50,7 +51,7 @@ export async function login(opts: LoginOptions = {}): Promise<LoginResult> {
       ...opts.deviceFlow,
     }));
   if (!key) {
-    throw new Error(
+    throw new CliUsageError(
       "No API key provided. Run `dharta login` for the browser flow, or pipe a key: " +
         "echo $DHARTA_API_KEY | dharta login --with-token",
     );

package/src/commands/members.ts

@@ -1,7 +1,8 @@
-import { randomUUID } from "node:crypto";
 import type { CliContext } from "../context.js";
+import type { MemberInvitation } from "@dharta/sdk";
 import { table } from "../output.js";
 import { closestChoice, normalizeNonBlank, parsePositiveInteger } from "../validators.js";
+import { CliUsageError } from "../exit-codes.js";
 
 const MEMBER_ROLES = ["owner", "admin", "developer", "billing", "viewer"] as const;
 type MemberRole = (typeof MEMBER_ROLES)[number];
@@ -44,7 +45,6 @@ export async function membersInviteData(ctx: CliContext, email: string, role: st
     method: "POST",
     path: "/api/members/invitations",
     body: { email: normalizedEmail, role: normalizedRole },
-    headers: { "Idempotency-Key": randomUUID() },
   });
 }
 
@@ -64,7 +64,6 @@ export async function membersSetRoleData(ctx: CliContext, id: string, role: stri
     method: "PATCH",
     path: `/api/members/${encodeURIComponent(memberId)}`,
     body: { role: normalizedRole },
-    headers: { "Idempotency-Key": randomUUID() },
   });
 }
 
@@ -78,7 +77,6 @@ export async function membersRemoveData(ctx: CliContext, id: string): Promise<{
   await ctx.http.request<void>({
     method: "DELETE",
     path: `/api/members/${encodeURIComponent(memberId)}`,
-    headers: { "Idempotency-Key": randomUUID() },
   });
   return { id: String(memberId), removed: true };
 }
@@ -88,10 +86,37 @@ export async function membersRemove(ctx: CliContext, id: string): Promise<string
   return `Removed member ${res.id}.`;
 }
 
+export async function membersRevokeInvitationData(
+  ctx: CliContext,
+  id: string,
+): Promise<{ id: string; revoked: boolean }> {
+  const invitationId = parsePositiveInteger(id, "invitation id");
+  await ctx.sdk.members.revokeInvitation(invitationId);
+  return { id: String(invitationId), revoked: true };
+}
+
+export async function membersRevokeInvitation(ctx: CliContext, id: string): Promise<string> {
+  const res = await membersRevokeInvitationData(ctx, id);
+  return `Revoked invitation ${res.id}.`;
+}
+
+export async function membersResendInvitationData(
+  ctx: CliContext,
+  id: string,
+): Promise<{ invitation: MemberInvitation }> {
+  const invitationId = parsePositiveInteger(id, "invitation id");
+  return { invitation: await ctx.sdk.members.resendInvitation(invitationId) };
+}
+
+export async function membersResendInvitation(ctx: CliContext, id: string): Promise<string> {
+  const res = await membersResendInvitationData(ctx, id);
+  return `Re-sent the invitation to ${res.invitation.email}. The original link still works.`;
+}
+
 function normalizeEmail(email: string): string {
   const normalized = email.trim();
   if (!normalized) {
-    throw new Error("Member email cannot be blank.");
+    throw new CliUsageError("Member email cannot be blank.");
   }
   return normalized;
 }
@@ -102,7 +127,7 @@ function normalizeRole(role: string): MemberRole {
     return normalized as MemberRole;
   }
   const suggestion = closestChoice(normalized, MEMBER_ROLES);
-  throw new Error(
+  throw new CliUsageError(
     `Unknown member role ${normalized}. Allowed roles: ${MEMBER_ROLES.join(", ")}.` +
       (suggestion ? ` Did you mean ${suggestion}?` : ""),
   );