@indigoai-us/hq-cli 5.18.2 → 5.19.0

package/CHANGELOG.md

@@ -2,6 +2,49 @@
 
 ## [Unreleased]
 
+## [5.18.3] — 2026-05-21
+
+### Fixed
+
+- **`hq members invite`: loud no-email warning + clearer next-steps.**
+  schemaVersion-2 invites only create the email-keyed pending DDB row —
+  the CLI does NOT send email. New output leads with a `chalk.yellow
+  ⚠ No email was sent` warning + a two-option "do ONE of: manually
+  notify / use hq-console UI" block. Previous wording read like passive
+  next-step copy; admins mistook it for "email sent." (#22)
+- **`hq members revoke <bare-email>`: no more 404.** Accepts bare email
+  and bare `prs_*` personUids, wrapping them into the canonical
+  `email:<email>#<companyUid>` / `<personUid>#<companyUid>` membership
+  key shape before posting to the server. (#22)
+
+## [5.18.2] — 2026-05-21
+
+### Fixed
+
+- **`hq members invite` + `hq members list` under schemaVersion 2 server.**
+  Aligns CLI with hq-pro membership schema-v2 (live-smoke surfaced regression). (#20, #21)
+
+## [5.18.1] — 2026-05-21
+
+### Fixed
+
+- **Wire narrow-hint banner into per-company pull (US-011).** Banner now renders
+  on the per-company `hq sync pull` path, not just full-sync. (#18, #19)
+
+## [5.18.0] — 2026-05-21
+
+### Added — sync-browse-vs-sync
+
+- **`hq sync mode <shared|narrow>`** — set per-membership sync mode (US-006).
+- **`hq sync narrow --dry-run | --apply`** — preview/execute ACL narrowing for
+  the active company (US-007).
+- **`hq files browse <prefix>` + `hq files cat <path>`** — read-only vault
+  browse via purpose=browse STS scope, distinct from sync (US-008).
+- **Narrow-hint banner** — surfaces on `hq sync` when local membership is
+  shared-mode but cloud signals narrowing is recommended (US-011).
+- Bumps `@indigoai-us/hq-cloud` to 5.23.0 (VaultClient SDK + sync engine
+  narrowing + journal v2). (#16, #17)
+
 ## [5.14.1] — 2026-05-14
 
 ### Fixed

package/dist/commands/cloud.d.ts

@@ -153,6 +153,23 @@ export declare function pushAll(options: PushAllOptions, deps: PushAllDeps): Pro
  * no person entity (typically means they haven't run `hq onboard`).
  */
 export declare function resolveCanonicalPersonUid(vaultClient: PullAllVaultClient): Promise<string>;
+/**
+ * Refuse `hq sync push --personal <path>` — the combination silently
+ * bypasses `PERSONAL_VAULT_EXCLUDED_TOP_LEVEL` (which is only applied by
+ * `computePersonalVaultPaths`), risking cross-scope upload of `companies/`,
+ * `repos/`, `workspace/`, or `.git/` content to the personal vault. Real
+ * incident (2026-05-21): a single command uploaded 196 `companies/{slug}/**`
+ * objects to a personal vault before being killed. Cleanup required a
+ * hand-rolled S3 sweep. Closes hq-cli#25.
+ *
+ * Refusal — not silent filtering — is intentional: explicit is better than
+ * implicit guesswork, and the legitimate "I want to push a subset of my
+ * personal vault" use case has a clean workaround (drop `--personal`, the
+ * subset upload targets the active company via standard semantics).
+ */
+export declare function assertNoPersonalPositionalPaths(opts: {
+    personal?: boolean;
+}, paths: string[] | undefined): void;
 /**
  * Refuse ambiguous selector combinations. `--all`, `--personal`, and
  * `--company` are mutually exclusive — at most one may be set per

package/dist/commands/cloud.js

@@ -13,7 +13,7 @@
  *   hq sync status            — show local journal summary
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4672d875-1dc8-56a2-bef1-49c7f4ff6c76")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f6dfc1de-3284-575a-b790-3dc10db2707c")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "fs";
 import * as path from "path";
@@ -234,6 +234,30 @@ export async function resolveCanonicalPersonUid(vaultClient) {
     }
     return pick.uid;
 }
+/**
+ * Refuse `hq sync push --personal <path>` — the combination silently
+ * bypasses `PERSONAL_VAULT_EXCLUDED_TOP_LEVEL` (which is only applied by
+ * `computePersonalVaultPaths`), risking cross-scope upload of `companies/`,
+ * `repos/`, `workspace/`, or `.git/` content to the personal vault. Real
+ * incident (2026-05-21): a single command uploaded 196 `companies/{slug}/**`
+ * objects to a personal vault before being killed. Cleanup required a
+ * hand-rolled S3 sweep. Closes hq-cli#25.
+ *
+ * Refusal — not silent filtering — is intentional: explicit is better than
+ * implicit guesswork, and the legitimate "I want to push a subset of my
+ * personal vault" use case has a clean workaround (drop `--personal`, the
+ * subset upload targets the active company via standard semantics).
+ */
+export function assertNoPersonalPositionalPaths(opts, paths) {
+    if (opts.personal && paths && paths.length > 0) {
+        throw new Error("`--personal` cannot be combined with explicit [paths]: " +
+            "positional paths bypass the PERSONAL_VAULT_EXCLUDED_TOP_LEVEL " +
+            "guard (skips .git/, companies/, repos/, workspace/), risking " +
+            "cross-scope upload of company data to the personal vault. " +
+            "Use bare `--personal` to push the whole personal scope, OR " +
+            "drop `--personal` to push specific paths to the active company.");
+    }
+}
 /**
  * Refuse ambiguous selector combinations. `--all`, `--personal`, and
  * `--company` are mutually exclusive — at most one may be set per
@@ -372,6 +396,8 @@ export function registerCloudCommands(program) {
                     "Cognito session, while --creds-from-stdin expects the caller " +
                     "to have already resolved entity + credentials. Pick one.");
             }
+            // Closes hq-cli#25 — see `assertNoPersonalPositionalPaths` doc-block.
+            assertNoPersonalPositionalPaths(options, paths);
             log(chalk.bold("\nHQ Sync — Push"));
             log(`  HQ root:  ${options.hqRoot}`);
             // Resolve credentials. Two paths:
@@ -1063,4 +1089,4 @@ function resolveUploadAuthorFromCache() {
     }
 }
 //# sourceMappingURL=cloud.js.map
-//# debugId=4672d875-1dc8-56a2-bef1-49c7f4ff6c76
+//# debugId=f6dfc1de-3284-575a-b790-3dc10db2707c

package/dist/commands/files-browse.d.ts

@@ -72,8 +72,17 @@ export type S3ClientFactory = (input: {
         sessionToken: string;
     };
 }) => FilesBrowseS3Client;
-/** ACL provenance for a single listed key. */
-export type AclSource = "shared-with-you" | "role-bypass";
+/**
+ * ACL provenance for a single listed key.
+ *   - `shared-with-you`: an explicit grant the caller holds covers the key.
+ *   - `role-bypass`: the caller has no covering explicit grant, but
+ *      owner/admin role widened the browse-vend policy to include it.
+ *   - `personal-vault`: the key lives in the caller's own person-entity
+ *      vault, where no grants graph applies — the caller is the only
+ *      principal with access by construction. Emitted only when
+ *      `runBrowse({ personalMode: true })`.
+ */
+export type AclSource = "shared-with-you" | "role-bypass" | "personal-vault";
 export interface BrowseRow {
     key: string;
     size: number;
@@ -112,10 +121,30 @@ export declare function assertOutPathOutsideCompanies(outPath: string, hqRoot: s
  */
 export declare function formatBrowseTable(rows: BrowseRow[]): string;
 export interface RunBrowseInput {
-    /** Vault path prefix, e.g. `companies/indigo/scratch/`. */
+    /**
+     * Vault path prefix.
+     *   - Company mode (`personalMode: false | undefined`): must start with
+     *     `companies/<slug>/`, e.g. `companies/indigo/scratch/`.
+     *   - Personal mode (`personalMode: true`): bucket-relative; empty string
+     *     lists the whole personal vault root.
+     */
     pathPrefix: string;
-    /** Caller-overridden company slug (defaults to slug parsed from path). */
+    /** Caller-overridden company slug (defaults to slug parsed from path). Ignored under `personalMode`. */
     companySlug?: string;
+    /**
+     * Personal-vault mode. Skips the `companies/<slug>/` path requirement,
+     * resolves the entity via `entity.get(personalUid)` instead of the
+     * company namespace, omits the explicit-grants fetch (no grants graph
+     * on a person bucket), and marks every row's `aclSource` as
+     * `"personal-vault"`. Closes hq-cli#26 (audit gap for personal vault).
+     */
+    personalMode?: boolean;
+    /**
+     * Canonical person-entity UID (e.g. `prs_…`). Required when
+     * `personalMode: true`; ignored otherwise. Caller resolves via
+     * `resolveCanonicalPersonUid` to keep this orchestrator pure.
+     */
+    personalUid?: string;
     vaultClient: FilesBrowseVaultClient;
     s3Factory: S3ClientFactory;
     region: string;
@@ -137,7 +166,11 @@ export interface RunBrowseResult {
  */
 export declare function runBrowse(input: RunBrowseInput): Promise<RunBrowseResult>;
 export interface RunCatInput {
-    /** Single vault key, e.g. `companies/indigo/scratch/foo.txt`. */
+    /**
+     * Single vault key.
+     *   - Company mode: must be a `companies/<slug>/...` path.
+     *   - Personal mode: bucket-relative, e.g. `.claude/CLAUDE.md`.
+     */
     key: string;
     /**
      * Where to write the body. `undefined` ⇒ stdout. Bright-line-guarded
@@ -146,6 +179,10 @@ export interface RunCatInput {
     out?: string;
     hqRoot: string;
     companySlug?: string;
+    /** Personal-vault mode — see `RunBrowseInput.personalMode`. */
+    personalMode?: boolean;
+    /** Canonical person-entity UID; required when `personalMode: true`. */
+    personalUid?: string;
     vaultClient: FilesBrowseVaultClient;
     s3Factory: S3ClientFactory;
     region: string;

package/dist/commands/files-browse.js

@@ -29,7 +29,7 @@
  * `pnpm.overrides` until that release ships to npm.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7a4467c5-bef0-5f15-99f9-9db157497caa")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="55a4ece7-6b33-5809-97c0-475c423bc012")}catch(e){}}();
 import chalk from "chalk";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -38,6 +38,7 @@ import { S3Client, ListObjectsV2Command, GetObjectCommand, } from "@aws-sdk/clie
 import { VaultClient, } from "@indigoai-us/hq-cloud";
 import { DEFAULT_HQ_ROOT, DEFAULT_COGNITO, ensureCognitoToken, buildVaultConfig, } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
+import { resolveCanonicalPersonUid } from "./cloud.js";
 // ── Pure helpers ────────────────────────────────────────────────────────────
 /**
  * Parse the company slug from a vault prefix. Vault paths are anchored at
@@ -122,19 +123,43 @@ export function formatBrowseTable(rows) {
  * Pure-ish: no console output, no process.exit — caller renders + exits.
  */
 export async function runBrowse(input) {
-    const { pathPrefix, vaultClient, s3Factory, region } = input;
-    const slug = input.companySlug ?? parseCompanySlugFromPath(pathPrefix);
-    const entity = await vaultClient.entity.findInMyNamespace("company", slug);
-    if (!entity) {
-        throw new Error(`No company found for slug '${slug}' in your namespace. Confirm you have an active membership.`);
+    const { pathPrefix, vaultClient, s3Factory, region, personalMode } = input;
+    // Branch by mode. Company mode parses slug from path and looks up by
+    // namespace; personal mode resolves the entity directly by the supplied
+    // person UID and skips the slug + grants machinery (a person bucket has
+    // no grants graph — the owner is the only principal). The vend call is
+    // identical for both modes once we have the entity in hand.
+    let bucket;
+    let entityUid;
+    if (personalMode) {
+        if (!input.personalUid) {
+            throw new Error("runBrowse: personalMode requires personalUid. Resolve via " +
+                "resolveCanonicalPersonUid() before calling.");
+        }
+        const entity = await vaultClient.entity.get(input.personalUid);
+        if (!entity.bucketName) {
+            throw new Error(`Personal entity '${input.personalUid}' has no provisioned bucket.`);
+        }
+        entityUid = entity.uid;
+        bucket = entity.bucketName;
     }
-    if (!entity.bucketName) {
-        throw new Error(`Company '${slug}' (${entity.uid}) has no provisioned bucket.`);
+    else {
+        const slug = input.companySlug ?? parseCompanySlugFromPath(pathPrefix);
+        const entity = await vaultClient.entity.findInMyNamespace("company", slug);
+        if (!entity) {
+            throw new Error(`No company found for slug '${slug}' in your namespace. Confirm you have an active membership.`);
+        }
+        if (!entity.bucketName) {
+            throw new Error(`Company '${slug}' (${entity.uid}) has no provisioned bucket.`);
+        }
+        entityUid = entity.uid;
+        bucket = entity.bucketName;
     }
-    const companyUid = entity.uid;
-    const bucket = entity.bucketName;
     // Distinct vend call from sync — `purpose: 'browse'` opts the request
-    // into the role-bypass-allowed code path on the server (US-009).
+    // into the role-bypass-allowed code path on the server (US-009). The
+    // personal mode vends against the person entity which is owner-only by
+    // construction; the vend response shape is identical so downstream
+    // S3Client construction doesn't branch.
     const vend = await vaultClient.vend({
         paths: [pathPrefix],
         operations: "read-only",
@@ -149,8 +174,12 @@ export async function runBrowse(input) {
         },
     });
     // Pull the caller's explicit-grant graph once so per-key classification
-    // is O(grants) without N round-trips.
-    const grants = await vaultClient.listMyExplicitGrants(companyUid);
+    // is O(grants) without N round-trips. Skipped in personal mode — the
+    // grants graph is a company concept; a person bucket marks every row
+    // as `"personal-vault"` directly.
+    const grants = personalMode
+        ? []
+        : await vaultClient.listMyExplicitGrants(entityUid);
     const rows = [];
     let continuationToken;
     do {
@@ -169,7 +198,7 @@ export async function runBrowse(input) {
                 key: obj.Key,
                 size: obj.Size ?? 0,
                 lastModified: obj.LastModified,
-                aclSource: classifyAclSource(obj.Key, grants),
+                aclSource: personalMode ? "personal-vault" : classifyAclSource(obj.Key, grants),
             });
         }
         continuationToken = resp.NextContinuationToken ?? undefined;
@@ -182,20 +211,37 @@ export async function runBrowse(input) {
  * containment guard). Refuses ahead of any I/O when `--out` is unsafe.
  */
 export async function runCat(input) {
-    const { key, vaultClient, s3Factory, region, hqRoot } = input;
-    const slug = input.companySlug ?? parseCompanySlugFromPath(key);
+    const { key, vaultClient, s3Factory, region, hqRoot, personalMode } = input;
     // Acceptance 5: refuse BEFORE vending — no point pulling credentials
     // for a request we're already going to abort.
     let absOut;
     if (input.out !== undefined) {
         absOut = assertOutPathOutsideCompanies(input.out, hqRoot);
     }
-    const entity = await vaultClient.entity.findInMyNamespace("company", slug);
-    if (!entity) {
-        throw new Error(`No company found for slug '${slug}' in your namespace. Confirm you have an active membership.`);
+    // Same branch logic as runBrowse — see that function's doc-block for
+    // the personal-vs-company rationale.
+    let bucket;
+    if (personalMode) {
+        if (!input.personalUid) {
+            throw new Error("runCat: personalMode requires personalUid. Resolve via " +
+                "resolveCanonicalPersonUid() before calling.");
+        }
+        const entity = await vaultClient.entity.get(input.personalUid);
+        if (!entity.bucketName) {
+            throw new Error(`Personal entity '${input.personalUid}' has no provisioned bucket.`);
+        }
+        bucket = entity.bucketName;
     }
-    if (!entity.bucketName) {
-        throw new Error(`Company '${slug}' (${entity.uid}) has no provisioned bucket.`);
+    else {
+        const slug = input.companySlug ?? parseCompanySlugFromPath(key);
+        const entity = await vaultClient.entity.findInMyNamespace("company", slug);
+        if (!entity) {
+            throw new Error(`No company found for slug '${slug}' in your namespace. Confirm you have an active membership.`);
+        }
+        if (!entity.bucketName) {
+            throw new Error(`Company '${slug}' (${entity.uid}) has no provisioned bucket.`);
+        }
+        bucket = entity.bucketName;
     }
     const vend = await vaultClient.vend({
         paths: [key],
@@ -210,7 +256,7 @@ export async function runCat(input) {
             sessionToken: vend.credentials.sessionToken,
         },
     });
-    const resp = (await s3.send(new GetObjectCommand({ Bucket: entity.bucketName, Key: key })));
+    const resp = (await s3.send(new GetObjectCommand({ Bucket: bucket, Key: key })));
     if (!resp.Body) {
         throw new Error(`GetObject for '${key}' returned no body.`);
     }
@@ -247,15 +293,47 @@ const defaultS3Factory = ({ region, credentials }) => new S3Client({ region, cre
  */
 export function registerFilesBrowseCommands(filesCmd) {
     filesCmd
-        .command("browse <path>")
-        .description("List vault objects under <path> without syncing them locally. Uses the browse-vend path (role-bypass allowed).")
+        .command("browse [path]")
+        .description("List vault objects under [path] without syncing them locally. Uses the browse-vend path (role-bypass allowed). Pass --personal to browse the caller's personal vault; otherwise [path] must start with companies/<slug>/.")
         .option("--company <slug>", "Company slug (defaults to the slug parsed from <path>)")
+        .option("--personal", "Browse the caller's canonical personal vault. [path] is treated as " +
+        "bucket-relative (omit it to list the vault root). Mutually exclusive " +
+        "with --company.")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
         .action(async (pathArg, options) => {
         try {
+            if (options.personal && options.company) {
+                throw new Error("--personal and --company are mutually exclusive. Pick one.");
+            }
             const accessToken = await ensureCognitoToken();
             const vaultConfig = buildVaultConfig(accessToken);
             const client = new VaultClient(vaultConfig);
+            if (options.personal) {
+                // Personal-vault path. Resolve the caller's canonical person
+                // entity once; the orchestrator does the bucket lookup + vend.
+                // Empty [path] → list bucket root.
+                const personalUid = await resolveCanonicalPersonUid({
+                    listMyMemberships: () => client.listMyMemberships(),
+                    listPersonEntities: () => client.entity.listByType("person"),
+                    getEntity: async () => null,
+                });
+                const result = await runBrowse({
+                    pathPrefix: pathArg ?? "",
+                    personalMode: true,
+                    personalUid,
+                    vaultClient: client,
+                    s3Factory: defaultS3Factory,
+                    region: DEFAULT_COGNITO.region,
+                });
+                console.log(formatBrowseTable(result.rows));
+                return;
+            }
+            // Company path. [path] is required here — the slug parse needs it.
+            if (!pathArg) {
+                throw new Error("browse: [path] is required when --personal is not set. " +
+                    "Pass a companies/<slug>/... path, or add --personal to " +
+                    "browse your personal vault.");
+            }
             // Resolve slug — CLI flag wins, otherwise parse from path arg.
             const slug = options.company ?? parseCompanySlugFromPath(pathArg);
             // If the user passed `--company` AND the path doesn't begin with
@@ -301,15 +379,41 @@ export function registerFilesBrowseCommands(filesCmd) {
     });
     filesCmd
         .command("cat <path>")
-        .description("Stream a single vault object to stdout (or --out <file>) without syncing it. Uses the browse-vend path.")
+        .description("Stream a single vault object to stdout (or --out <file>) without syncing it. Uses the browse-vend path. Pass --personal to read from the caller's personal vault.")
         .option("--out <file>", "Write the object body to <file> instead of stdout. Refused under <hqRoot>/companies/.")
         .option("--company <slug>", "Company slug (defaults to the slug parsed from <path>)")
+        .option("--personal", "Read from the caller's canonical personal vault. <path> is treated as " +
+        "bucket-relative. Mutually exclusive with --company.")
         .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
         .action(async (keyArg, options) => {
         try {
+            if (options.personal && options.company) {
+                throw new Error("--personal and --company are mutually exclusive. Pick one.");
+            }
             const accessToken = await ensureCognitoToken();
             const vaultConfig = buildVaultConfig(accessToken);
             const client = new VaultClient(vaultConfig);
+            if (options.personal) {
+                const personalUid = await resolveCanonicalPersonUid({
+                    listMyMemberships: () => client.listMyMemberships(),
+                    listPersonEntities: () => client.entity.listByType("person"),
+                    getEntity: async () => null,
+                });
+                const result = await runCat({
+                    key: keyArg,
+                    out: options.out,
+                    hqRoot: options.hqRoot,
+                    personalMode: true,
+                    personalUid,
+                    vaultClient: client,
+                    s3Factory: defaultS3Factory,
+                    region: DEFAULT_COGNITO.region,
+                });
+                if (result.destination.kind === "file") {
+                    console.error(chalk.green("✓"), `Wrote ${result.bytesWritten} bytes to ${result.destination.absPath}`);
+                }
+                return;
+            }
             const slug = options.company ?? parseCompanySlugFromPath(keyArg);
             if (options.company !== undefined) {
                 const fromPath = (() => {
@@ -345,4 +449,4 @@ export function registerFilesBrowseCommands(filesCmd) {
     });
 }
 //# sourceMappingURL=files-browse.js.map
-//# debugId=7a4467c5-bef0-5f15-99f9-9db157497caa
+//# debugId=55a4ece7-6b33-5809-97c0-475c423bc012

package/dist/commands/members.d.ts

@@ -66,6 +66,23 @@ export declare class InviteHttpError extends Error {
 }
 export declare function formatInviteHttpError(status: number, fallback: string, code?: string): string;
 export declare function listPendingInvites(token: string, companyUid: string): Promise<PendingInvite[]>;
+/**
+ * Resolve a `revoke` CLI argument into the canonical `membershipKey` shape
+ * the server requires. Accepts three input forms:
+ *
+ *   1. Full membership key — already has `#<companyUid>`; passed through.
+ *      Examples: `email:alice@example.com#cmp_abc`, `prs_abc#cmp_abc`.
+ *   2. Bare email — wrap as `email:<email>#<companyUid>`.
+ *   3. Bare personUid (`prs_*`) — wrap as `<personUid>#<companyUid>`.
+ *   4. Anything else (e.g. legacy schemaVersion-1 inviteToken) — pass through
+ *      so the server can decide. Server may 404 if the token doesn't resolve.
+ *
+ * Pure function — no I/O — so it's trivially unit-testable. The previous
+ * shape sent the user's raw arg straight through, which meant `hq members
+ * revoke alice@example.com` always 404'd ("Invite not found") even when
+ * that exact email was just shown by `hq members list`.
+ */
+export declare function resolveRevokeTargetToMembershipKey(arg: string, companyUid: string): string;
 export declare function revokeInvite(token: string, tokenOrKey: string, companyUid: string): Promise<void>;
 export declare function registerMembersCommand(program: Command): void;
 //# sourceMappingURL=members.d.ts.map

package/dist/commands/members.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="20c76490-0485-592f-856b-3b20e403a392")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c06b812a-ee4a-5701-a64b-cee2fcfef523")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
@@ -135,6 +135,34 @@ export async function listPendingInvites(token, companyUid) {
     const data = (await res.json());
     return data?.pending ?? data?.invites ?? [];
 }
+/**
+ * Resolve a `revoke` CLI argument into the canonical `membershipKey` shape
+ * the server requires. Accepts three input forms:
+ *
+ *   1. Full membership key — already has `#<companyUid>`; passed through.
+ *      Examples: `email:alice@example.com#cmp_abc`, `prs_abc#cmp_abc`.
+ *   2. Bare email — wrap as `email:<email>#<companyUid>`.
+ *   3. Bare personUid (`prs_*`) — wrap as `<personUid>#<companyUid>`.
+ *   4. Anything else (e.g. legacy schemaVersion-1 inviteToken) — pass through
+ *      so the server can decide. Server may 404 if the token doesn't resolve.
+ *
+ * Pure function — no I/O — so it's trivially unit-testable. The previous
+ * shape sent the user's raw arg straight through, which meant `hq members
+ * revoke alice@example.com` always 404'd ("Invite not found") even when
+ * that exact email was just shown by `hq members list`.
+ */
+export function resolveRevokeTargetToMembershipKey(arg, companyUid) {
+    if (arg.includes("#"))
+        return arg;
+    const detected = detectTarget(arg);
+    if (detected?.type === "email") {
+        return `email:${detected.value}#${companyUid}`;
+    }
+    if (detected?.type === "person") {
+        return `${detected.value}#${companyUid}`;
+    }
+    return arg;
+}
 export async function revokeInvite(token, tokenOrKey, companyUid) {
     const res = await vaultApiFetch({
         token,
@@ -183,16 +211,29 @@ export function registerMembersCommand(program) {
             else {
                 // schemaVersion 2+ — email-keyed authoritative membership row.
                 // No magic link to share; invitee accepts by signing into HQ.
+                //
+                // CRITICAL UX NOTE: this CLI command does NOT send any email.
+                // hq-pro only writes the DDB pending row; only the hq-console UI
+                // path triggers Resend. Operators who run `hq members invite`
+                // expecting an email to fly out get silently broken flows. The
+                // output below uses chalk.yellow + an explicit "no email sent"
+                // line so this never sneaks past again.
                 const inviteeEmail = result.membership.inviteeEmail ??
                     (typeof target === "string" && target.includes("@")
                         ? target
                         : undefined);
-                console.log(chalk.bold("Next step:"));
-                console.log(`  Tell ${inviteeEmail ?? "the invitee"} to sign into HQ at https://hq.getindigo.ai with that email.`);
-                console.log(chalk.dim("  The pending membership row claims itself on first sign-in — no separate token redemption."));
+                console.log(chalk.yellow("⚠ No email was sent. `hq members invite` only creates the pending membership row."));
+                console.log();
+                console.log(chalk.bold("To complete the invite, do ONE of:"));
+                console.log(`  1. Manually notify ${inviteeEmail ?? "the invitee"}: ask them to sign into HQ`);
+                console.log(`     at https://hq.getindigo.ai with that email address.`);
+                console.log(`  2. Or use the hq-console UI at https://hq.getindigo.ai to issue the`);
+                console.log(`     invite instead — the UI path triggers an automated email via Resend.`);
+                console.log();
+                console.log(chalk.dim("The pending membership row claims itself on the invitee's first sign-in."));
                 if (result.membership.membershipKey) {
                     console.log();
-                    console.log(chalk.dim(`  Membership key: ${result.membership.membershipKey}`));
+                    console.log(chalk.dim(`Membership key: ${result.membership.membershipKey}`));
                 }
             }
         }
@@ -253,15 +294,16 @@ export function registerMembersCommand(program) {
         }
     });
     members
-        .command("revoke <tokenOrKey>")
-        .description("Revoke a pending invite (accepts the inviteToken or membershipKey)")
-        .action(async (tokenOrKey) => {
+        .command("revoke <target>")
+        .description("Revoke a pending invite. Accepts an email, personUid, full membershipKey, or legacy inviteToken.")
+        .action(async (target) => {
         try {
             const token = await ensureCognitoToken();
             const companySlug = members.opts().company;
             const companyUid = await getCompanyUid(token, companySlug);
-            await revokeInvite(token, tokenOrKey, companyUid);
-            console.log(chalk.green(`Revoked invite '${tokenOrKey}'`));
+            const membershipKey = resolveRevokeTargetToMembershipKey(target, companyUid);
+            await revokeInvite(token, membershipKey, companyUid);
+            console.log(chalk.green(`Revoked invite '${membershipKey}'`));
         }
         catch (err) {
             if (err instanceof InviteHttpError) {
@@ -281,4 +323,4 @@ export function registerMembersCommand(program) {
     });
 }
 //# sourceMappingURL=members.js.map
-//# debugId=20c76490-0485-592f-856b-3b20e403a392
+//# debugId=c06b812a-ee4a-5701-a64b-cee2fcfef523

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.18.2",
+  "version": "5.19.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {