@indigoai-us/hq-cli 5.18.2 → 5.18.3

package/CHANGELOG.md

@@ -2,6 +2,49 @@
 
 ## [Unreleased]
 
+## [5.18.3] — 2026-05-21
+
+### Fixed
+
+- **`hq members invite`: loud no-email warning + clearer next-steps.**
+  schemaVersion-2 invites only create the email-keyed pending DDB row —
+  the CLI does NOT send email. New output leads with a `chalk.yellow
+  ⚠ No email was sent` warning + a two-option "do ONE of: manually
+  notify / use hq-console UI" block. Previous wording read like passive
+  next-step copy; admins mistook it for "email sent." (#22)
+- **`hq members revoke <bare-email>`: no more 404.** Accepts bare email
+  and bare `prs_*` personUids, wrapping them into the canonical
+  `email:<email>#<companyUid>` / `<personUid>#<companyUid>` membership
+  key shape before posting to the server. (#22)
+
+## [5.18.2] — 2026-05-21
+
+### Fixed
+
+- **`hq members invite` + `hq members list` under schemaVersion 2 server.**
+  Aligns CLI with hq-pro membership schema-v2 (live-smoke surfaced regression). (#20, #21)
+
+## [5.18.1] — 2026-05-21
+
+### Fixed
+
+- **Wire narrow-hint banner into per-company pull (US-011).** Banner now renders
+  on the per-company `hq sync pull` path, not just full-sync. (#18, #19)
+
+## [5.18.0] — 2026-05-21
+
+### Added — sync-browse-vs-sync
+
+- **`hq sync mode <shared|narrow>`** — set per-membership sync mode (US-006).
+- **`hq sync narrow --dry-run | --apply`** — preview/execute ACL narrowing for
+  the active company (US-007).
+- **`hq files browse <prefix>` + `hq files cat <path>`** — read-only vault
+  browse via purpose=browse STS scope, distinct from sync (US-008).
+- **Narrow-hint banner** — surfaces on `hq sync` when local membership is
+  shared-mode but cloud signals narrowing is recommended (US-011).
+- Bumps `@indigoai-us/hq-cloud` to 5.23.0 (VaultClient SDK + sync engine
+  narrowing + journal v2). (#16, #17)
+
 ## [5.14.1] — 2026-05-14
 
 ### Fixed

package/dist/commands/members.d.ts

@@ -66,6 +66,23 @@ export declare class InviteHttpError extends Error {
 }
 export declare function formatInviteHttpError(status: number, fallback: string, code?: string): string;
 export declare function listPendingInvites(token: string, companyUid: string): Promise<PendingInvite[]>;
+/**
+ * Resolve a `revoke` CLI argument into the canonical `membershipKey` shape
+ * the server requires. Accepts three input forms:
+ *
+ *   1. Full membership key — already has `#<companyUid>`; passed through.
+ *      Examples: `email:alice@example.com#cmp_abc`, `prs_abc#cmp_abc`.
+ *   2. Bare email — wrap as `email:<email>#<companyUid>`.
+ *   3. Bare personUid (`prs_*`) — wrap as `<personUid>#<companyUid>`.
+ *   4. Anything else (e.g. legacy schemaVersion-1 inviteToken) — pass through
+ *      so the server can decide. Server may 404 if the token doesn't resolve.
+ *
+ * Pure function — no I/O — so it's trivially unit-testable. The previous
+ * shape sent the user's raw arg straight through, which meant `hq members
+ * revoke alice@example.com` always 404'd ("Invite not found") even when
+ * that exact email was just shown by `hq members list`.
+ */
+export declare function resolveRevokeTargetToMembershipKey(arg: string, companyUid: string): string;
 export declare function revokeInvite(token: string, tokenOrKey: string, companyUid: string): Promise<void>;
 export declare function registerMembersCommand(program: Command): void;
 //# sourceMappingURL=members.d.ts.map

package/dist/commands/members.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="20c76490-0485-592f-856b-3b20e403a392")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c06b812a-ee4a-5701-a64b-cee2fcfef523")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
@@ -135,6 +135,34 @@ export async function listPendingInvites(token, companyUid) {
     const data = (await res.json());
     return data?.pending ?? data?.invites ?? [];
 }
+/**
+ * Resolve a `revoke` CLI argument into the canonical `membershipKey` shape
+ * the server requires. Accepts three input forms:
+ *
+ *   1. Full membership key — already has `#<companyUid>`; passed through.
+ *      Examples: `email:alice@example.com#cmp_abc`, `prs_abc#cmp_abc`.
+ *   2. Bare email — wrap as `email:<email>#<companyUid>`.
+ *   3. Bare personUid (`prs_*`) — wrap as `<personUid>#<companyUid>`.
+ *   4. Anything else (e.g. legacy schemaVersion-1 inviteToken) — pass through
+ *      so the server can decide. Server may 404 if the token doesn't resolve.
+ *
+ * Pure function — no I/O — so it's trivially unit-testable. The previous
+ * shape sent the user's raw arg straight through, which meant `hq members
+ * revoke alice@example.com` always 404'd ("Invite not found") even when
+ * that exact email was just shown by `hq members list`.
+ */
+export function resolveRevokeTargetToMembershipKey(arg, companyUid) {
+    if (arg.includes("#"))
+        return arg;
+    const detected = detectTarget(arg);
+    if (detected?.type === "email") {
+        return `email:${detected.value}#${companyUid}`;
+    }
+    if (detected?.type === "person") {
+        return `${detected.value}#${companyUid}`;
+    }
+    return arg;
+}
 export async function revokeInvite(token, tokenOrKey, companyUid) {
     const res = await vaultApiFetch({
         token,
@@ -183,16 +211,29 @@ export function registerMembersCommand(program) {
             else {
                 // schemaVersion 2+ — email-keyed authoritative membership row.
                 // No magic link to share; invitee accepts by signing into HQ.
+                //
+                // CRITICAL UX NOTE: this CLI command does NOT send any email.
+                // hq-pro only writes the DDB pending row; only the hq-console UI
+                // path triggers Resend. Operators who run `hq members invite`
+                // expecting an email to fly out get silently broken flows. The
+                // output below uses chalk.yellow + an explicit "no email sent"
+                // line so this never sneaks past again.
                 const inviteeEmail = result.membership.inviteeEmail ??
                     (typeof target === "string" && target.includes("@")
                         ? target
                         : undefined);
-                console.log(chalk.bold("Next step:"));
-                console.log(`  Tell ${inviteeEmail ?? "the invitee"} to sign into HQ at https://hq.getindigo.ai with that email.`);
-                console.log(chalk.dim("  The pending membership row claims itself on first sign-in — no separate token redemption."));
+                console.log(chalk.yellow("⚠ No email was sent. `hq members invite` only creates the pending membership row."));
+                console.log();
+                console.log(chalk.bold("To complete the invite, do ONE of:"));
+                console.log(`  1. Manually notify ${inviteeEmail ?? "the invitee"}: ask them to sign into HQ`);
+                console.log(`     at https://hq.getindigo.ai with that email address.`);
+                console.log(`  2. Or use the hq-console UI at https://hq.getindigo.ai to issue the`);
+                console.log(`     invite instead — the UI path triggers an automated email via Resend.`);
+                console.log();
+                console.log(chalk.dim("The pending membership row claims itself on the invitee's first sign-in."));
                 if (result.membership.membershipKey) {
                     console.log();
-                    console.log(chalk.dim(`  Membership key: ${result.membership.membershipKey}`));
+                    console.log(chalk.dim(`Membership key: ${result.membership.membershipKey}`));
                 }
             }
         }
@@ -253,15 +294,16 @@ export function registerMembersCommand(program) {
         }
     });
     members
-        .command("revoke <tokenOrKey>")
-        .description("Revoke a pending invite (accepts the inviteToken or membershipKey)")
-        .action(async (tokenOrKey) => {
+        .command("revoke <target>")
+        .description("Revoke a pending invite. Accepts an email, personUid, full membershipKey, or legacy inviteToken.")
+        .action(async (target) => {
         try {
             const token = await ensureCognitoToken();
             const companySlug = members.opts().company;
             const companyUid = await getCompanyUid(token, companySlug);
-            await revokeInvite(token, tokenOrKey, companyUid);
-            console.log(chalk.green(`Revoked invite '${tokenOrKey}'`));
+            const membershipKey = resolveRevokeTargetToMembershipKey(target, companyUid);
+            await revokeInvite(token, membershipKey, companyUid);
+            console.log(chalk.green(`Revoked invite '${membershipKey}'`));
         }
         catch (err) {
             if (err instanceof InviteHttpError) {
@@ -281,4 +323,4 @@ export function registerMembersCommand(program) {
     });
 }
 //# sourceMappingURL=members.js.map
-//# debugId=20c76490-0485-592f-856b-3b20e403a392
+//# debugId=c06b812a-ee4a-5701-a64b-cee2fcfef523

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.18.2",
+  "version": "5.18.3",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/members.test.ts

@@ -18,6 +18,7 @@ import {
   getCallerPersonUid,
   inviteMember,
   listPendingInvites,
+  resolveRevokeTargetToMembershipKey,
   revokeInvite,
 } from "./members.js";
 
@@ -414,6 +415,58 @@ describe("revokeInvite", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// resolveRevokeTargetToMembershipKey
+// ---------------------------------------------------------------------------
+
+describe("resolveRevokeTargetToMembershipKey", () => {
+  // Regression: `hq members revoke alice@example.com` used to send the raw
+  // email straight to /membership/revoke, which the server rejects with 404
+  // "Invite not found" because it keys on `email:<email>#<companyUid>`. Live
+  // smoke 2026-05-21 reproduced this against indigo.
+  it("wraps a bare email into the email-keyed membership shape", () => {
+    expect(
+      resolveRevokeTargetToMembershipKey("alice@example.com", "cmp_abc"),
+    ).toBe("email:alice@example.com#cmp_abc");
+  });
+
+  it("lowercases the email when wrapping", () => {
+    expect(
+      resolveRevokeTargetToMembershipKey("Alice@Example.COM", "cmp_abc"),
+    ).toBe("email:alice@example.com#cmp_abc");
+  });
+
+  it("wraps a bare personUid into the personUid-keyed membership shape", () => {
+    expect(resolveRevokeTargetToMembershipKey("prs_bob123", "cmp_abc")).toBe(
+      "prs_bob123#cmp_abc",
+    );
+  });
+
+  it("passes through a full email-keyed membership key unchanged", () => {
+    expect(
+      resolveRevokeTargetToMembershipKey(
+        "email:alice@example.com#cmp_abc",
+        "cmp_other",
+      ),
+    ).toBe("email:alice@example.com#cmp_abc");
+  });
+
+  it("passes through a full personUid-keyed membership key unchanged", () => {
+    expect(
+      resolveRevokeTargetToMembershipKey("prs_bob#cmp_abc", "cmp_other"),
+    ).toBe("prs_bob#cmp_abc");
+  });
+
+  it("passes through unrecognized strings (legacy inviteToken, garbage)", () => {
+    // A schemaVersion-1 inviteToken is opaque base64url; we can't tell it
+    // apart from garbage. Send it to the server and let the server 404 if
+    // it doesn't resolve.
+    expect(
+      resolveRevokeTargetToMembershipKey("some-opaque-token", "cmp_abc"),
+    ).toBe("some-opaque-token");
+  });
+});
+
 // ---------------------------------------------------------------------------
 // formatInviteHttpError
 // ---------------------------------------------------------------------------

package/src/commands/members.ts

@@ -248,6 +248,37 @@ export async function listPendingInvites(
   return data?.pending ?? data?.invites ?? [];
 }
 
+/**
+ * Resolve a `revoke` CLI argument into the canonical `membershipKey` shape
+ * the server requires. Accepts three input forms:
+ *
+ *   1. Full membership key — already has `#<companyUid>`; passed through.
+ *      Examples: `email:alice@example.com#cmp_abc`, `prs_abc#cmp_abc`.
+ *   2. Bare email — wrap as `email:<email>#<companyUid>`.
+ *   3. Bare personUid (`prs_*`) — wrap as `<personUid>#<companyUid>`.
+ *   4. Anything else (e.g. legacy schemaVersion-1 inviteToken) — pass through
+ *      so the server can decide. Server may 404 if the token doesn't resolve.
+ *
+ * Pure function — no I/O — so it's trivially unit-testable. The previous
+ * shape sent the user's raw arg straight through, which meant `hq members
+ * revoke alice@example.com` always 404'd ("Invite not found") even when
+ * that exact email was just shown by `hq members list`.
+ */
+export function resolveRevokeTargetToMembershipKey(
+  arg: string,
+  companyUid: string,
+): string {
+  if (arg.includes("#")) return arg;
+  const detected = detectTarget(arg);
+  if (detected?.type === "email") {
+    return `email:${detected.value}#${companyUid}`;
+  }
+  if (detected?.type === "person") {
+    return `${detected.value}#${companyUid}`;
+  }
+  return arg;
+}
+
 export async function revokeInvite(
   token: string,
   tokenOrKey: string,
@@ -328,24 +359,47 @@ export function registerMembersCommand(program: Command): void {
           } else {
             // schemaVersion 2+ — email-keyed authoritative membership row.
             // No magic link to share; invitee accepts by signing into HQ.
+            //
+            // CRITICAL UX NOTE: this CLI command does NOT send any email.
+            // hq-pro only writes the DDB pending row; only the hq-console UI
+            // path triggers Resend. Operators who run `hq members invite`
+            // expecting an email to fly out get silently broken flows. The
+            // output below uses chalk.yellow + an explicit "no email sent"
+            // line so this never sneaks past again.
             const inviteeEmail =
               result.membership.inviteeEmail ??
               (typeof target === "string" && target.includes("@")
                 ? target
                 : undefined);
-            console.log(chalk.bold("Next step:"));
             console.log(
-              `  Tell ${inviteeEmail ?? "the invitee"} to sign into HQ at https://hq.getindigo.ai with that email.`,
+              chalk.yellow(
+                "⚠ No email was sent. `hq members invite` only creates the pending membership row.",
+              ),
+            );
+            console.log();
+            console.log(chalk.bold("To complete the invite, do ONE of:"));
+            console.log(
+              `  1. Manually notify ${inviteeEmail ?? "the invitee"}: ask them to sign into HQ`,
+            );
+            console.log(
+              `     at https://hq.getindigo.ai with that email address.`,
+            );
+            console.log(
+              `  2. Or use the hq-console UI at https://hq.getindigo.ai to issue the`,
             );
+            console.log(
+              `     invite instead — the UI path triggers an automated email via Resend.`,
+            );
+            console.log();
             console.log(
               chalk.dim(
-                "  The pending membership row claims itself on first sign-in — no separate token redemption.",
+                "The pending membership row claims itself on the invitee's first sign-in.",
               ),
             );
             if (result.membership.membershipKey) {
               console.log();
               console.log(
-                chalk.dim(`  Membership key: ${result.membership.membershipKey}`),
+                chalk.dim(`Membership key: ${result.membership.membershipKey}`),
               );
             }
           }
@@ -431,16 +485,22 @@ export function registerMembersCommand(program: Command): void {
     });
 
   members
-    .command("revoke <tokenOrKey>")
-    .description("Revoke a pending invite (accepts the inviteToken or membershipKey)")
-    .action(async (tokenOrKey: string) => {
+    .command("revoke <target>")
+    .description(
+      "Revoke a pending invite. Accepts an email, personUid, full membershipKey, or legacy inviteToken.",
+    )
+    .action(async (target: string) => {
       try {
         const token = await ensureCognitoToken();
         const companySlug = members.opts().company as string | undefined;
         const companyUid = await getCompanyUid(token, companySlug);
 
-        await revokeInvite(token, tokenOrKey, companyUid);
-        console.log(chalk.green(`Revoked invite '${tokenOrKey}'`));
+        const membershipKey = resolveRevokeTargetToMembershipKey(
+          target,
+          companyUid,
+        );
+        await revokeInvite(token, membershipKey, companyUid);
+        console.log(chalk.green(`Revoked invite '${membershipKey}'`));
       } catch (err) {
         if (err instanceof InviteHttpError) {
           const msg =