@indigoai-us/hq-cli 5.10.0 → 5.11.0

package/dist/commands/cloud.js

@@ -13,11 +13,11 @@
  *   hq sync status            — show local journal summary
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5ddbce6a-fdde-506e-8cdd-2e5b0ad20fff")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="213f074e-13c2-5b95-9519-813adf9adfa9")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
-import { share, sync, readJournal, getJournalPath, } from "@indigoai-us/hq-cloud";
+import { share, sync, readJournal, getJournalPath, loadCachedTokens, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_HQ_ROOT, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
 export function registerCloudCommands(program) {
     program
@@ -85,6 +85,13 @@ export function registerCloudCommands(program) {
             const onEvent = jsonMode
                 ? (event) => emitJson(event)
                 : undefined;
+            // Stamp every uploaded object's S3 user metadata with the syncing
+            // user's Cognito identity (`Metadata['created-by']`). The hq-console
+            // vault UI's CREATED BY column reads this back via HEAD; without it,
+            // every row renders `—`. Resolved best-effort from the cached
+            // idToken — pre-vended `--creds-from-stdin` paths still get author
+            // attribution as long as the caller is logged in locally.
+            const author = resolveUploadAuthorFromCache();
             const result = await share({
                 paths: targetPaths,
                 company: options.company,
@@ -94,6 +101,7 @@ export function registerCloudCommands(program) {
                 entityContext,
                 hqRoot: options.hqRoot,
                 onEvent,
+                ...(author ? { author } : {}),
             });
             if (jsonMode) {
                 // Synthetic terminal event so subprocess consumers can read final
@@ -226,5 +234,36 @@ async function readAllStdin() {
     }
     return Buffer.concat(chunks).toString("utf8");
 }
+/**
+ * Resolve the syncing user's `UploadAuthor` (sub + email) from the cached
+ * Cognito idToken. Returns `undefined` when no tokens are cached or the
+ * token is missing the required claims — share() then skips the metadata
+ * stamp gracefully (not an error).
+ *
+ * We deliberately decode the JWT here instead of verifying it: Cognito
+ * already verified at issuance, and we only use the public claims to
+ * label the upload's S3 user metadata (no auth decision rides on it).
+ */
+function resolveUploadAuthorFromCache() {
+    const tokens = loadCachedTokens();
+    if (!tokens?.idToken)
+        return undefined;
+    const parts = tokens.idToken.split(".");
+    if (parts.length !== 3)
+        return undefined;
+    try {
+        const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+        const padded = payload + "=".repeat((4 - (payload.length % 4)) % 4);
+        const json = Buffer.from(padded, "base64").toString("utf-8");
+        const claims = JSON.parse(json);
+        if (claims.sub && claims.email) {
+            return { userSub: claims.sub, email: claims.email };
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 //# sourceMappingURL=cloud.js.map
-//# debugId=5ddbce6a-fdde-506e-8cdd-2e5b0ad20fff
+//# debugId=213f074e-13c2-5b95-9519-813adf9adfa9

package/dist/commands/members.d.ts

@@ -0,0 +1,53 @@
+import { Command } from "commander";
+export declare const VALID_ROLES: Set<string>;
+export type Role = "owner" | "admin" | "member" | "guest";
+export interface PendingInvite {
+    membershipKey: string;
+    personUid?: string;
+    inviteeEmail?: string;
+    companyUid: string;
+    role: string;
+    status: string;
+    inviteToken?: string;
+    invitedBy: string;
+    invitedAt: string;
+}
+export interface InviteOptions {
+    target: string;
+    role: string;
+    paths?: string;
+    companyUid: string;
+    callerUid: string;
+    token: string;
+}
+export interface InviteResult {
+    inviteToken: string;
+    magicLink: string;
+    membership: {
+        role: string;
+        status: string;
+    };
+}
+export interface DetectedTarget {
+    type: "email" | "person";
+    value: string;
+}
+export declare function detectTarget(target: string): DetectedTarget | null;
+export declare function shortDate(iso: string): string;
+/**
+ * Resolve the caller's personUid by reading their own membership list.
+ * The server infers the JWT identity, so this returns the canonical
+ * personUid attached to the caller's active memberships.
+ */
+export declare function getCallerPersonUid(token: string): Promise<string>;
+/** Send a `/membership/invite` request and return the magic link. */
+export declare function inviteMember(options: InviteOptions): Promise<InviteResult>;
+export declare class InviteHttpError extends Error {
+    status: number;
+    constructor(status: number, message: string);
+}
+export declare function formatInviteHttpError(status: number, fallback: string): string;
+export declare function listPendingInvites(token: string, companyUid: string): Promise<PendingInvite[]>;
+export declare function revokeInvite(token: string, tokenOrKey: string, companyUid: string): Promise<void>;
+export declare function registerMembersCommand(program: Command): void;
+//# sourceMappingURL=members.d.ts.map

package/dist/commands/members.js

@@ -0,0 +1,240 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1b3646e3-32c8-5601-9dba-1d7c0f6cf972")}catch(e){}}();
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
+const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
+export const VALID_ROLES = new Set(["owner", "admin", "member", "guest"]);
+export function detectTarget(target) {
+    if (EMAIL_PATTERN.test(target)) {
+        return { type: "email", value: target.trim().toLowerCase() };
+    }
+    if (PERSON_UID_PATTERN.test(target)) {
+        return { type: "person", value: target };
+    }
+    return null;
+}
+export function shortDate(iso) {
+    return iso.slice(0, 10);
+}
+/**
+ * Resolve the caller's personUid by reading their own membership list.
+ * The server infers the JWT identity, so this returns the canonical
+ * personUid attached to the caller's active memberships.
+ */
+export async function getCallerPersonUid(token) {
+    const res = await vaultApiFetch({ token, path: "/membership/me" });
+    if (!res.ok) {
+        throw new Error("Failed to resolve caller identity — run `hq login` and try again");
+    }
+    const data = (await res.json());
+    const personUid = data.memberships.find((m) => m.personUid)?.personUid;
+    if (!personUid) {
+        throw new Error("Your account has no person entity yet. Run `hq onboard create-company` or accept an invite first.");
+    }
+    return personUid;
+}
+/** Send a `/membership/invite` request and return the magic link. */
+export async function inviteMember(options) {
+    if (!VALID_ROLES.has(options.role)) {
+        throw new Error(`Invalid role '${options.role}': must be one of owner, admin, member, guest`);
+    }
+    if (options.paths && options.role !== "guest") {
+        throw new Error("--paths is only valid with --role guest (allowedPrefixes are only meaningful for the guest role)");
+    }
+    const detected = detectTarget(options.target);
+    if (!detected) {
+        throw new Error(`Invalid target '${options.target}': must be an email address or a personUid matching prs_<alphanumeric>`);
+    }
+    const allowedPrefixes = options.paths
+        ? options.paths.split(",").map((p) => p.trim()).filter(Boolean)
+        : undefined;
+    const body = {
+        companyUid: options.companyUid,
+        role: options.role,
+        invitedBy: options.callerUid,
+    };
+    if (detected.type === "email")
+        body.inviteeEmail = detected.value;
+    else
+        body.personUid = detected.value;
+    if (allowedPrefixes)
+        body.allowedPrefixes = allowedPrefixes;
+    const res = await vaultApiFetch({
+        token: options.token,
+        path: "/membership/invite",
+        method: "POST",
+        body,
+    });
+    if (!res.ok) {
+        const err = (await res.json().catch(() => ({})));
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText);
+    }
+    const data = (await res.json());
+    return {
+        inviteToken: data.inviteToken,
+        magicLink: `hq://accept/${data.inviteToken}`,
+        membership: data.membership,
+    };
+}
+export class InviteHttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = "InviteHttpError";
+    }
+}
+export function formatInviteHttpError(status, fallback) {
+    if (status === 401)
+        return "Not authenticated — please run `hq login`";
+    if (status === 403) {
+        return "Not authorized — only admins and owners can invite members";
+    }
+    if (status === 409) {
+        return "This person already has a membership or pending invite for this company";
+    }
+    if (status >= 500)
+        return `Server error: ${fallback}`;
+    return fallback;
+}
+export async function listPendingInvites(token, companyUid) {
+    const res = await vaultApiFetch({
+        token,
+        path: `/membership/company/${encodeURIComponent(companyUid)}/pending`,
+    });
+    if (!res.ok) {
+        const err = (await res.json().catch(() => ({})));
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText);
+    }
+    const data = (await res.json());
+    return data.invites;
+}
+export async function revokeInvite(token, tokenOrKey, companyUid) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/membership/revoke",
+        method: "POST",
+        body: { membershipKey: tokenOrKey, companyUid },
+    });
+    if (!res.ok) {
+        const err = (await res.json().catch(() => ({})));
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText);
+    }
+}
+export function registerMembersCommand(program) {
+    const members = program
+        .command("members")
+        .description("Manage company memberships and invites")
+        .option("--company <slug>", "Company slug (resolves to companyUid)");
+    members
+        .command("invite <target>")
+        .description("Invite a person to the company by email or personUid (prints a magic link)")
+        .option("--role <role>", "Role for the invitee: owner, admin, member, or guest", "member")
+        .option("--paths <prefixes>", "Comma-separated allowed prefixes (only valid with --role guest)")
+        .action(async (target, opts) => {
+        try {
+            const token = await ensureCognitoToken();
+            const companySlug = members.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const callerUid = await getCallerPersonUid(token);
+            const result = await inviteMember({
+                target,
+                role: opts.role,
+                paths: opts.paths,
+                companyUid,
+                callerUid,
+                token,
+            });
+            console.log(chalk.green(`Invited ${target} as ${result.membership.role} (status: ${result.membership.status})`));
+            console.log();
+            console.log(chalk.bold("Magic link:"));
+            console.log(`  ${result.magicLink}`);
+            console.log();
+            console.log(chalk.dim("Share this link with the invitee. They can run `hq onboard join --invite-token <token>` to accept."));
+        }
+        catch (err) {
+            if (err instanceof InviteHttpError) {
+                console.error(chalk.red(formatInviteHttpError(err.status, err.message)));
+                process.exit(1);
+            }
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    members
+        .command("list")
+        .description("List pending invites for the company")
+        .action(async () => {
+        try {
+            const token = await ensureCognitoToken();
+            const companySlug = members.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const invites = await listPendingInvites(token, companyUid);
+            if (invites.length === 0) {
+                console.log(chalk.gray("No pending invites for this company."));
+                return;
+            }
+            const targetW = Math.max(6, ...invites.map((i) => (i.inviteeEmail ?? i.personUid ?? "").length));
+            const roleW = Math.max(4, ...invites.map((i) => i.role.length));
+            const byW = Math.max(10, ...invites.map((i) => i.invitedBy.length));
+            const keyW = Math.max(14, ...invites.map((i) => i.membershipKey.length));
+            console.log(chalk.bold([
+                "TARGET".padEnd(targetW),
+                "ROLE".padEnd(roleW),
+                "INVITED_BY".padEnd(byW),
+                "INVITED_AT",
+                "MEMBERSHIP_KEY".padEnd(keyW),
+            ].join("  ")));
+            for (const inv of invites) {
+                const target = inv.inviteeEmail ?? inv.personUid ?? "";
+                console.log([
+                    target.padEnd(targetW),
+                    inv.role.padEnd(roleW),
+                    inv.invitedBy.padEnd(byW),
+                    shortDate(inv.invitedAt),
+                    inv.membershipKey.padEnd(keyW),
+                ].join("  "));
+            }
+        }
+        catch (err) {
+            if (err instanceof InviteHttpError) {
+                const msg = err.status === 403
+                    ? "Not authorized — only admins and owners can list invites"
+                    : formatInviteHttpError(err.status, err.message);
+                console.error(chalk.red(msg));
+                process.exit(1);
+            }
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    members
+        .command("revoke <tokenOrKey>")
+        .description("Revoke a pending invite (accepts the inviteToken or membershipKey)")
+        .action(async (tokenOrKey) => {
+        try {
+            const token = await ensureCognitoToken();
+            const companySlug = members.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            await revokeInvite(token, tokenOrKey, companyUid);
+            console.log(chalk.green(`Revoked invite '${tokenOrKey}'`));
+        }
+        catch (err) {
+            if (err instanceof InviteHttpError) {
+                const msg = err.status === 403
+                    ? "Not authorized — only admins and owners can revoke invites"
+                    : err.status === 404
+                        ? "Invite not found — it may have already been accepted or revoked"
+                        : formatInviteHttpError(err.status, err.message);
+                console.error(chalk.red(msg));
+                process.exit(1);
+            }
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=members.js.map
+//# debugId=1b3646e3-32c8-5601-9dba-1d7c0f6cf972

package/dist/commands/secrets.d.ts

@@ -1,6 +1,6 @@
 import { Command } from "commander";
-import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+import { vaultApiFetch, getCompanyUid, getEntityUid } from "../utils/vault-api.js";
 export type { VaultApiOptions } from "../utils/vault-api.js";
-export { vaultApiFetch, getCompanyUid };
+export { vaultApiFetch, getCompanyUid, getEntityUid };
 export declare function registerSecretsCommand(program: Command): void;
 //# sourceMappingURL=secrets.d.ts.map

package/dist/commands/secrets.js

@@ -1,13 +1,26 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0239c476-98b8-53c0-9458-1c82dc0d26a9")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="217ceadb-01cd-5778-9cc0-6f6d895d8d67")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN } from "./_patterns.js";
-import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
-export { vaultApiFetch, getCompanyUid };
+import { vaultApiFetch, getCompanyUid, getEntityUid, } from "../utils/vault-api.js";
+export { vaultApiFetch, getCompanyUid, getEntityUid };
+function scopeOpts(opts) {
+    if (opts.personal && opts.company) {
+        console.error(chalk.red("Error: --personal cannot be combined with --company."));
+        process.exit(1);
+    }
+    return { personal: !!opts.personal, companySlug: opts.company };
+}
+function rejectIfPersonal(opts, action) {
+    if (opts.personal) {
+        console.error(chalk.red(`Error: ${action} is not supported with --personal.`));
+        process.exit(1);
+    }
+}
 function shellSingleQuote(value) {
     return "'" + value.replace(/'/g, "'\\''") + "'";
 }
@@ -115,7 +128,8 @@ export function registerSecretsCommand(program) {
     const secrets = program
         .command("secrets")
         .description("Manage secrets in HQ vault (SSM Parameter Store)")
-        .option("--company <slug>", "Company slug (resolves to companyUid)");
+        .option("--company <slug>", "Company slug (resolves to companyUid)")
+        .option("--personal", "Operate on the caller's personal vault (no sharing)");
     secrets
         .command("set <name>")
         .description("Create or update a secret")
@@ -150,8 +164,7 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
                 path: `/secrets/${encodeURIComponent(companyUid)}`,
@@ -178,8 +191,7 @@ export function registerSecretsCommand(program) {
         .action(async (name, opts) => {
         try {
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const query = {};
             if (opts.reveal) {
                 query.reveal = "true";
@@ -233,8 +245,7 @@ export function registerSecretsCommand(program) {
                 normalizedPrefix = normalized;
             }
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const query = {};
             if (normalizedPrefix) {
                 query.prefix = normalizedPrefix;
@@ -298,8 +309,7 @@ export function registerSecretsCommand(program) {
                 }
             }
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
                 path: buildSecretNamePath(companyUid, name),
@@ -350,8 +360,7 @@ export function registerSecretsCommand(program) {
                 }
             }
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const revealed = await Promise.all(keys.map(async (key) => {
                 const cached = readCache(companyUid, key);
                 if (cached !== null) {
@@ -420,8 +429,7 @@ export function registerSecretsCommand(program) {
                 }
             }
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const revealed = await Promise.all(keys.map(async (key) => {
                 const cached = readCache(companyUid, key);
                 if (cached !== null) {
@@ -459,6 +467,7 @@ export function registerSecretsCommand(program) {
         .option("--expires <duration>", "Token expiry duration (e.g. 24h, 2d, 30m)", "24h")
         .action(async (name, opts) => {
         try {
+            rejectIfPersonal(secrets.opts(), "generate-link");
             if (!SECRET_NAME_PATTERN.test(name)) {
                 console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
                 process.exit(1);
@@ -474,8 +483,7 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
                 path: buildSecretNamePath(companyUid, name),
@@ -507,6 +515,7 @@ export function registerSecretsCommand(program) {
         .requiredOption("--permission <level>", "Permission level: read | write | admin")
         .action(async (path, opts) => {
         try {
+            rejectIfPersonal(secrets.opts(), "share");
             if (!SECRET_NAME_PATTERN.test(path)) {
                 console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
                 process.exit(1);
@@ -523,8 +532,7 @@ export function registerSecretsCommand(program) {
             const granteeType = isEmail ? "email" : "group";
             const granteeId = opts.with;
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
                 path: `/secrets/${encodeURIComponent(companyUid)}/acl/grant`,
@@ -566,6 +574,7 @@ export function registerSecretsCommand(program) {
         .requiredOption("--from <principal>", "Email address or group id to remove")
         .action(async (path, opts) => {
         try {
+            rejectIfPersonal(secrets.opts(), "unshare");
             if (!SECRET_NAME_PATTERN.test(path)) {
                 console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
                 process.exit(1);
@@ -578,8 +587,7 @@ export function registerSecretsCommand(program) {
             const granteeType = isEmailFrom ? "email" : "group";
             const granteeId = opts.from;
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
                 path: `/secrets/${encodeURIComponent(companyUid)}/acl/revoke`,
@@ -618,13 +626,13 @@ export function registerSecretsCommand(program) {
         .description("Show the ACL (access control list) for a secret path")
         .action(async (path) => {
         try {
+            rejectIfPersonal(secrets.opts(), "acl");
             if (!SECRET_NAME_PATTERN.test(path)) {
                 console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
                 process.exit(1);
             }
             const token = await ensureCognitoToken();
-            const companySlug = secrets.opts().company;
-            const companyUid = await getCompanyUid(token, companySlug);
+            const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const secretPath = path;
             const res = await vaultApiFetch({
                 token,
@@ -705,4 +713,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=0239c476-98b8-53c0-9458-1c82dc0d26a9
+//# debugId=217ceadb-01cd-5778-9cc0-6f6d895d8d67

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ebc3116c-f836-550a-b5bb-4a74bce24abc")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e834c407-cd5c-5dc1-af3b-7f041af651ef")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -27,6 +27,7 @@ import { registerSecretsCommand } from "./commands/secrets.js";
 import { registerRunCommand } from "./commands/run.js";
 import { registerGroupsCommand } from "./commands/groups.js";
 import { registerFilesCommand } from "./commands/files.js";
+import { registerMembersCommand } from "./commands/members.js";
 initSentry();
 const program = new Command();
 program
@@ -81,6 +82,8 @@ registerRunCommand(program);
 registerGroupsCommand(program);
 // Files ACL management (subcommand group — hq files share|unshare|acl)
 registerFilesCommand(program);
+// Membership management (subcommand group — hq members invite|list|revoke)
+registerMembersCommand(program);
 // Onboarding (top-level — Cognito + vault-service provisioning)
 registerOnboardCommand(program);
 (async () => {
@@ -96,4 +99,4 @@ registerOnboardCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=ebc3116c-f836-550a-b5bb-4a74bce24abc
+//# debugId=e834c407-cd5c-5dc1-af3b-7f041af651ef

package/dist/utils/vault-api.d.ts

@@ -7,4 +7,9 @@ export interface VaultApiOptions {
 }
 export declare function vaultApiFetch(opts: VaultApiOptions): Promise<Response>;
 export declare function getCompanyUid(token: string, companySlug: string | undefined): Promise<string>;
+export declare function resolveCallerPersonUid(token: string): Promise<string>;
+export declare function getEntityUid(token: string, opts: {
+    personal?: boolean;
+    companySlug?: string;
+}): Promise<string>;
 //# sourceMappingURL=vault-api.d.ts.map

package/dist/utils/vault-api.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4e482805-d129-5563-a77b-97b80410154b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="05d73a12-54b0-559c-a964-de7dff2d48eb")}catch(e){}}();
 import { DEFAULT_VAULT_API_URL } from './cognito-session.js';
 export async function vaultApiFetch(opts) {
     const url = new URL(opts.path, DEFAULT_VAULT_API_URL);
@@ -54,5 +54,38 @@ export async function getCompanyUid(token, companySlug) {
     }
     return resolveCompanyFromMemberships(token);
 }
+// Same selection rule as the backend's `resolveCallerPersonUid`: ascending by
+// createdAt, tie-break by uid ascending. Returns the `prs_*` UID.
+export async function resolveCallerPersonUid(token) {
+    const res = await vaultApiFetch({
+        token,
+        path: '/entity/by-type/person',
+    });
+    if (!res.ok) {
+        throw new Error("Failed to fetch person entity — run `hq login` and try again");
+    }
+    const data = (await res.json());
+    const persons = (data.entities ?? []).filter((e) => e.type === 'person');
+    if (persons.length === 0) {
+        throw new Error('No person entity found for the caller. Sign in to HQ once to provision one.');
+    }
+    persons.sort((a, b) => {
+        const ac = a.createdAt ?? '';
+        const bc = b.createdAt ?? '';
+        if (ac !== bc)
+            return ac < bc ? -1 : 1;
+        return a.uid < b.uid ? -1 : 1;
+    });
+    return persons[0].uid;
+}
+// Resolves the scope UID (cmp_* or prs_*) for a secrets command. Precedence:
+// `--personal` → caller's canonical person entity; else `--company <slug>` →
+// resolved company UID; else fallback to single active company membership.
+export async function getEntityUid(token, opts) {
+    if (opts.personal) {
+        return resolveCallerPersonUid(token);
+    }
+    return getCompanyUid(token, opts.companySlug);
+}
 //# sourceMappingURL=vault-api.js.map
-//# debugId=4e482805-d129-5563-a77b-97b80410154b
+//# debugId=05d73a12-54b0-559c-a964-de7dff2d48eb

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.10.0",
+  "version": "5.11.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {