@indigoai-us/hq-cli 5.24.0 → 5.25.1

package/dist/utils/cognito-session.js

@@ -19,7 +19,7 @@
  *   HQ_VAULT_API_URL           — vault-service API Gateway URL
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d16ef3c7-eead-5307-aaa7-ca5fc828102b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cd9690e0-c7b0-5e26-a3ee-7f7bc98a0fe2")}catch(e){}}();
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
@@ -67,7 +67,26 @@ export const DEFAULT_VAULT_API_URL = process.env.HQ_VAULT_API_URL ?? "https://hq
  * value at registration time, which matches the user's actual cwd at process
  * start. Re-importable as a function for tests and command-time resolution.
  */
-export function resolveDefaultHqRoot() {
+/**
+ * Resolve the HQ root directory.
+ *
+ * Resolution order:
+ *   1. $HQ_ROOT env var (treated as an explicit assertion by the caller)
+ *   2. Walk up from cwd looking for `core.yaml` AND `companies/` siblings
+ *   3. Fall back to `~/hq` (or throw, per `opts.onMissing`)
+ *
+ * `opts.onMissing` controls the third arm:
+ *   - `'fallback'` (default) — return `~/hq` if no HQ root is found above cwd.
+ *     This preserves the module-load contract of `DEFAULT_HQ_ROOT`, which
+ *     several commander.js `.option()` callers pin at registration time.
+ *   - `'throw'` — throw with a user-actionable error. Used by module-management
+ *     commands (pkg-install, pkg-remove, pkg-list, pkg-update, team-sync) where
+ *     a silent default-path miss would silently target the wrong directory.
+ *
+ * `$HQ_ROOT` short-circuits both arms — if the env var is set, it's used
+ * as-is regardless of `onMissing`.
+ */
+export function resolveDefaultHqRoot(opts = {}) {
     if (process.env.HQ_ROOT)
         return path.resolve(process.env.HQ_ROOT);
     let cur = path.resolve(process.cwd());
@@ -76,6 +95,10 @@ export function resolveDefaultHqRoot() {
             return cur;
         cur = path.dirname(cur);
     }
+    if (opts.onMissing === "throw") {
+        throw new Error("Could not find HQ root. Run this command from within your HQ directory " +
+            "(must contain core.yaml AND a companies/ subdirectory), or set $HQ_ROOT.");
+    }
     return path.join(os.homedir(), "hq");
 }
 /** True iff `dir` looks like an HQ root (has core.yaml + companies/ dir). */
@@ -170,4 +193,4 @@ export async function refreshCachedSession() {
     }
 }
 //# sourceMappingURL=cognito-session.js.map
-//# debugId=d16ef3c7-eead-5307-aaa7-ca5fc828102b
+//# debugId=cd9690e0-c7b0-5e26-a3ee-7f7bc98a0fe2

package/dist/utils/integrity.js

@@ -2,11 +2,11 @@
  * Integrity verification — SHA256 hash and RSA signature checks (US-005)
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="19765c32-6c3d-5477-bf80-0f7d08197d29")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="820f12b3-4caf-5f08-9add-621628715744")}catch(e){}}();
 import * as crypto from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
-import { findHqRoot } from './hq-root.js';
+import { resolveDefaultHqRoot } from './cognito-session.js';
 /**
  * Verify a file's SHA256 hash matches the expected value.
  */
@@ -29,7 +29,7 @@ export async function verifySha256(filePath, expectedHash) {
  */
 export function verifyRsaSignature(sha256Hash, signature, publicKeyPath) {
     const keyPath = publicKeyPath ??
-        path.resolve(findHqRoot(), 'packages', '.keys', 'registry-public.pem');
+        path.resolve(resolveDefaultHqRoot({ onMissing: 'throw' }), 'packages', '.keys', 'registry-public.pem');
     if (!fs.existsSync(keyPath)) {
         return false;
     }
@@ -40,4 +40,4 @@ export function verifyRsaSignature(sha256Hash, signature, publicKeyPath) {
     return verifier.verify(publicKey, Buffer.from(signature, 'base64'));
 }
 //# sourceMappingURL=integrity.js.map
-//# debugId=19765c32-6c3d-5477-bf80-0f7d08197d29
+//# debugId=820f12b3-4caf-5f08-9add-621628715744

package/dist/utils/registry-client.js

@@ -5,11 +5,11 @@
  * Auth tokens are NEVER written to stdout or logs.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ffe2dc58-fb20-5566-a56c-1b1c26999bba")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="43d1600f-1bf7-5a52-819b-83e71ba30c73")}catch(e){}}();
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'js-yaml';
-import { findHqRoot } from './hq-root.js';
+import { resolveDefaultHqRoot } from './cognito-session.js';
 // ---------------------------------------------------------------------------
 // URL helper (unchanged from US-004)
 // ---------------------------------------------------------------------------
@@ -19,7 +19,7 @@ import { findHqRoot } from './hq-root.js';
  * Throws if sources.yaml is missing or has no sources.
  */
 export function getRegistryUrl() {
-    const hqRoot = findHqRoot();
+    const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
     const sourcesPath = path.join(hqRoot, 'packages', 'sources.yaml');
     if (!fs.existsSync(sourcesPath)) {
         throw new Error(`No packages/sources.yaml found at ${sourcesPath}. Is your HQ packages directory set up?`);
@@ -102,4 +102,4 @@ export class RegistryClient {
     }
 }
 //# sourceMappingURL=registry-client.js.map
-//# debugId=ffe2dc58-fb20-5566-a56c-1b1c26999bba
+//# debugId=43d1600f-1bf7-5a52-819b-83e71ba30c73

package/dist/utils/version-gate.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Hard version-gate: ask hq-pro whether the current CLI is below the minimum
+ * acceptable version and, if so, run `npm install -g …@latest` synchronously
+ * before any commander parsing happens. Distinct from the existing
+ * `version-check.ts` which is a passive (cached, opt-in) stderr nag against
+ * the npm registry.
+ *
+ * Why both?
+ *   - `version-check.ts` answers "is there something newer?" by polling npm
+ *     directly. It's a soft hint, lives on a 24h cache, and never blocks.
+ *   - `version-gate.ts` answers "is the team currently allowing your version
+ *     to run?" via an authoritative hq-pro endpoint. The server can yank a
+ *     known-bad release without waiting for the npm `latest` dist-tag move.
+ *
+ * The endpoint is reusable across clients (hq-sync, hq-installer, create-hq).
+ * See `apps/hq-pro/src/vault-service/handlers/client-version-check.ts` for the
+ * source-of-truth table.
+ *
+ * Trust model: anonymous. The CLI may be running pre-login (e.g. fresh
+ * install) so we never send credentials. The endpoint identifies the client
+ * by `clientId` + `currentVersion`.
+ *
+ * Failure mode: silent. Network down, hq-pro returning 5xx, malformed body —
+ * the gate must never break the CLI for a user who's otherwise fine. We log
+ * to Sentry as a breadcrumb (best-effort) and return.
+ *
+ * Opt-out: `HQ_NO_UPDATE_CHECK=1` (same env as `version-check.ts` — one knob
+ * to silence both check + gate).
+ */
+/**
+ * Run the upgrade command in a blocking subprocess. Inherits stdio so the
+ * user sees the npm progress. We do NOT auto-rerun the CLI on completion —
+ * forcing a re-invocation would run twice on the same process and feel
+ * janky; instead we print a clear "rerun your command" message and exit.
+ */
+declare function performUpdate(command: string): {
+    ok: boolean;
+    detail?: string;
+};
+/**
+ * Public entry point. Call before commander parses argv. Blocks the CLI on
+ * network IO for up to FETCH_TIMEOUT_MS — acceptable because the alternative
+ * (a fire-and-forget background check) gives the user no chance to bail out
+ * of a known-bad version before it does damage.
+ *
+ * `--version` / `-v` callers MUST skip the gate (the user is debugging a
+ * broken install and shouldn't be force-upgraded mid-investigation). Caller
+ * is responsible for checking argv before invoking us — see index.ts.
+ */
+export declare function enforceVersionGate(): Promise<void>;
+/**
+ * Cheap argv pre-check: skip the gate for `--version` / `-V` so users
+ * inspecting a broken install can still see what they have without being
+ * force-upgraded.
+ */
+export declare function shouldSkipGate(argv: readonly string[]): boolean;
+export declare const __test__: {
+    CLIENT_ID: string;
+    ENDPOINT_PATH: string;
+    FETCH_TIMEOUT_MS: number;
+    performUpdate: typeof performUpdate;
+};
+export {};
+//# sourceMappingURL=version-gate.d.ts.map

package/dist/utils/version-gate.js

@@ -0,0 +1,185 @@
+/**
+ * Hard version-gate: ask hq-pro whether the current CLI is below the minimum
+ * acceptable version and, if so, run `npm install -g …@latest` synchronously
+ * before any commander parsing happens. Distinct from the existing
+ * `version-check.ts` which is a passive (cached, opt-in) stderr nag against
+ * the npm registry.
+ *
+ * Why both?
+ *   - `version-check.ts` answers "is there something newer?" by polling npm
+ *     directly. It's a soft hint, lives on a 24h cache, and never blocks.
+ *   - `version-gate.ts` answers "is the team currently allowing your version
+ *     to run?" via an authoritative hq-pro endpoint. The server can yank a
+ *     known-bad release without waiting for the npm `latest` dist-tag move.
+ *
+ * The endpoint is reusable across clients (hq-sync, hq-installer, create-hq).
+ * See `apps/hq-pro/src/vault-service/handlers/client-version-check.ts` for the
+ * source-of-truth table.
+ *
+ * Trust model: anonymous. The CLI may be running pre-login (e.g. fresh
+ * install) so we never send credentials. The endpoint identifies the client
+ * by `clientId` + `currentVersion`.
+ *
+ * Failure mode: silent. Network down, hq-pro returning 5xx, malformed body —
+ * the gate must never break the CLI for a user who's otherwise fine. We log
+ * to Sentry as a breadcrumb (best-effort) and return.
+ *
+ * Opt-out: `HQ_NO_UPDATE_CHECK=1` (same env as `version-check.ts` — one knob
+ * to silence both check + gate).
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d7d58261-f0e4-56bc-b6eb-4117731744f9")}catch(e){}}();
+import { spawnSync } from "node:child_process";
+import chalk from "chalk";
+import { CLI_VERSION } from "../cli-version.js";
+import { DEFAULT_VAULT_API_URL } from "./cognito-session.js";
+const CLIENT_ID = "hq-cli";
+const ENDPOINT_PATH = "/v1/client-version/check";
+const FETCH_TIMEOUT_MS = 3_000;
+function isOptedOut() {
+    return process.env.HQ_NO_UPDATE_CHECK === "1";
+}
+/**
+ * Hit POST /v1/client-version/check. Returns the parsed body on 200, or
+ * `null` on any failure (caller treats as "no gate"). Tight 3s timeout —
+ * a hung server must not delay CLI startup.
+ */
+async function fetchVersionDecision() {
+    try {
+        const url = `${DEFAULT_VAULT_API_URL}${ENDPOINT_PATH}`;
+        const res = await fetch(url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json",
+            },
+            body: JSON.stringify({
+                clientId: CLIENT_ID,
+                currentVersion: CLI_VERSION,
+                platform: `${process.platform}-${process.arch}`,
+            }),
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        if (typeof body.minVersion !== "string" ||
+            typeof body.latestVersion !== "string" ||
+            typeof body.updateRequired !== "boolean") {
+            return null;
+        }
+        return body;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Run the upgrade command in a blocking subprocess. Inherits stdio so the
+ * user sees the npm progress. We do NOT auto-rerun the CLI on completion —
+ * forcing a re-invocation would run twice on the same process and feel
+ * janky; instead we print a clear "rerun your command" message and exit.
+ */
+function performUpdate(command) {
+    const parts = command.split(/\s+/).filter(Boolean);
+    if (parts.length === 0)
+        return { ok: false, detail: "empty command" };
+    const cmd = parts[0];
+    const args = parts.slice(1);
+    try {
+        const result = spawnSync(cmd, args, { stdio: "inherit" });
+        if (result.status !== 0) {
+            return {
+                ok: false,
+                detail: `exit ${result.status ?? "signal"}`,
+            };
+        }
+        return { ok: true };
+    }
+    catch (err) {
+        return { ok: false, detail: err instanceof Error ? err.message : String(err) };
+    }
+}
+/**
+ * Soft notify when the server says we're below `latestVersion` but still ≥
+ * `minVersion`. Single chalk-yellow line on stderr; never blocks.
+ */
+function nudgeUpdateRecommended(decision) {
+    const msg = chalk.yellow(`⚠ A new version of hq-cli is available: ${decision.latestVersion} (current: ${decision.currentVersion}).`);
+    console.error(msg);
+    if (decision.updateCommand) {
+        console.error(chalk.dim(`  Update: ${decision.updateCommand}`));
+    }
+}
+/**
+ * Hard enforcement when the server says we're below `minVersion`. Print a
+ * red banner, attempt the update, then exit so the user reruns against the
+ * fresh binary. Sequence chosen so a user with a broken `npm` global prefix
+ * still gets a clear error rather than an opaque silent failure.
+ *
+ * Exit codes:
+ *   0 — update succeeded; user must rerun their command
+ *   75 — update failed (EX_TEMPFAIL; common for sudo/EACCES on system npm)
+ */
+function enforceUpdateRequired(decision) {
+    const banner = chalk.red.bold(`✗ hq-cli ${decision.currentVersion} is below the minimum required version (${decision.minVersion}).`);
+    console.error(banner);
+    if (decision.message)
+        console.error(chalk.dim(`  ${decision.message}`));
+    const command = decision.updateCommand;
+    if (!command) {
+        console.error(chalk.red("  No updateCommand provided by hq-pro — see https://hq.indigo.ai/docs/cli-update for manual steps."));
+        if (decision.downloadUrl) {
+            console.error(chalk.dim(`  Download: ${decision.downloadUrl}`));
+        }
+        process.exit(75);
+    }
+    console.error(chalk.dim(`  Running: ${command}`));
+    const result = performUpdate(command);
+    if (!result.ok) {
+        console.error(chalk.red(`✗ Update failed${result.detail ? `: ${result.detail}` : ""}.`));
+        console.error(chalk.dim(`  Try manually: ${command}`));
+        process.exit(75);
+    }
+    console.error(chalk.green(`✓ Updated to hq-cli ${decision.latestVersion}. Rerun your command.`));
+    process.exit(0);
+}
+/**
+ * Public entry point. Call before commander parses argv. Blocks the CLI on
+ * network IO for up to FETCH_TIMEOUT_MS — acceptable because the alternative
+ * (a fire-and-forget background check) gives the user no chance to bail out
+ * of a known-bad version before it does damage.
+ *
+ * `--version` / `-v` callers MUST skip the gate (the user is debugging a
+ * broken install and shouldn't be force-upgraded mid-investigation). Caller
+ * is responsible for checking argv before invoking us — see index.ts.
+ */
+export async function enforceVersionGate() {
+    if (isOptedOut())
+        return;
+    const decision = await fetchVersionDecision();
+    if (!decision)
+        return; // best-effort: silent on any failure
+    if (decision.updateRequired) {
+        enforceUpdateRequired(decision); // exits process
+    }
+    if (decision.updateRecommended) {
+        nudgeUpdateRecommended(decision);
+    }
+}
+/**
+ * Cheap argv pre-check: skip the gate for `--version` / `-V` so users
+ * inspecting a broken install can still see what they have without being
+ * force-upgraded.
+ */
+export function shouldSkipGate(argv) {
+    return argv.some((a) => a === "--version" || a === "-V" || a === "-v" || a === "--help" || a === "-h");
+}
+export const __test__ = {
+    CLIENT_ID,
+    ENDPOINT_PATH,
+    FETCH_TIMEOUT_MS,
+    performUpdate,
+};
+//# sourceMappingURL=version-gate.js.map
+//# debugId=d7d58261-f0e4-56bc-b6eb-4117731744f9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.24.0",
+  "version": "5.25.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/members.test.ts

@@ -18,6 +18,7 @@ import {
   getCallerPersonUid,
   inviteMember,
   listPendingInvites,
+  resendInvite,
   resolveRevokeTargetToMembershipKey,
   revokeInvite,
 } from "./members.js";
@@ -300,6 +301,296 @@ describe("inviteMember", () => {
       }),
     ).rejects.toThrow(/no membership row/);
   });
+
+  // ---- sendEmail flag (hq-pro PR #140 contract) ---------------------------
+
+  it("forwards `sendEmail: true` in the request body when the option is set", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(201, {
+        membership: {
+          role: "member",
+          status: "pending",
+          inviteeEmail: "alice@example.com",
+          schemaVersion: 2,
+        },
+        resent: false,
+        emailSent: true,
+        emailSkipped: false,
+      }),
+    );
+
+    const result = await inviteMember({
+      target: "alice@example.com",
+      role: "member",
+      sendEmail: true,
+      companyUid: "cmp_acme",
+      callerUid: "prs_admin",
+      token: "test-token",
+    });
+
+    const body = JSON.parse((fetchSpy.mock.calls[0][1]?.body as string) ?? "{}");
+    expect(body.sendEmail).toBe(true);
+    expect(result.emailSent).toBe(true);
+    expect(result.emailSkipped).toBe(false);
+    expect(result.emailError).toBeUndefined();
+  });
+
+  it("omits sendEmail from the body when the option is unset (backward-compat with pre-resend hq-pro)", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(201, {
+        membership: {
+          role: "member",
+          status: "pending",
+          inviteeEmail: "alice@example.com",
+          schemaVersion: 2,
+        },
+      }),
+    );
+
+    const result = await inviteMember({
+      target: "alice@example.com",
+      role: "member",
+      companyUid: "cmp_acme",
+      callerUid: "prs_admin",
+      token: "test-token",
+    });
+
+    const body = JSON.parse((fetchSpy.mock.calls[0][1]?.body as string) ?? "{}");
+    expect("sendEmail" in body).toBe(false);
+    // Pre-resend hq-pro doesn't send the email fields at all — the CLI
+    // result fields stay undefined so the caller can detect "server has no
+    // opinion" vs "server explicitly skipped".
+    expect(result.emailSent).toBeUndefined();
+    expect(result.emailSkipped).toBeUndefined();
+  });
+
+  it("surfaces emailSkipped: true when hq-pro has no RESEND_API_KEY", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(201, {
+        membership: {
+          role: "member",
+          status: "pending",
+          inviteeEmail: "alice@example.com",
+          schemaVersion: 2,
+        },
+        resent: false,
+        emailSent: false,
+        emailSkipped: true,
+      }),
+    );
+
+    const result = await inviteMember({
+      target: "alice@example.com",
+      role: "member",
+      sendEmail: true,
+      companyUid: "cmp_acme",
+      callerUid: "prs_admin",
+      token: "test-token",
+    });
+
+    expect(result.emailSent).toBe(false);
+    expect(result.emailSkipped).toBe(true);
+  });
+
+  it("surfaces emailError when the server-side Resend send failed", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(201, {
+        membership: {
+          role: "member",
+          status: "pending",
+          inviteeEmail: "alice@example.com",
+          schemaVersion: 2,
+        },
+        resent: false,
+        emailSent: false,
+        emailSkipped: false,
+        emailError: "Resend 429: rate limited",
+      }),
+    );
+
+    const result = await inviteMember({
+      target: "alice@example.com",
+      role: "member",
+      sendEmail: true,
+      companyUid: "cmp_acme",
+      callerUid: "prs_admin",
+      token: "test-token",
+    });
+
+    expect(result.emailSent).toBe(false);
+    expect(result.emailError).toMatch(/Resend 429/);
+  });
+
+  // ---- groupIds (hq-pro PR #140 contract) ---------------------------------
+
+  it("forwards groupIds in the body when set on an email-keyed invite", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(201, {
+        membership: {
+          role: "member",
+          status: "pending",
+          inviteeEmail: "alice@example.com",
+          schemaVersion: 2,
+        },
+      }),
+    );
+
+    await inviteMember({
+      target: "alice@example.com",
+      role: "member",
+      groupIds: ["grp-1", "grp-2"],
+      companyUid: "cmp_acme",
+      callerUid: "prs_admin",
+      token: "test-token",
+    });
+
+    const body = JSON.parse((fetchSpy.mock.calls[0][1]?.body as string) ?? "{}");
+    expect(body.groupIds).toEqual(["grp-1", "grp-2"]);
+  });
+
+  it("rejects --groups combined with a personUid target before hitting the server", async () => {
+    await expect(
+      inviteMember({
+        target: "prs_bob",
+        role: "member",
+        groupIds: ["grp-1"],
+        companyUid: "cmp_acme",
+        callerUid: "prs_admin",
+        token: "test-token",
+      }),
+    ).rejects.toThrow(/email-keyed invites/);
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("omits groupIds from the body when the array is empty", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(201, {
+        membership: {
+          role: "member",
+          status: "pending",
+          inviteeEmail: "alice@example.com",
+          schemaVersion: 2,
+        },
+      }),
+    );
+
+    await inviteMember({
+      target: "alice@example.com",
+      role: "member",
+      groupIds: [],
+      companyUid: "cmp_acme",
+      callerUid: "prs_admin",
+      token: "test-token",
+    });
+
+    const body = JSON.parse((fetchSpy.mock.calls[0][1]?.body as string) ?? "{}");
+    expect("groupIds" in body).toBe(false);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// resendInvite (hq-pro PR #140 resend: true short-circuit)
+// ---------------------------------------------------------------------------
+
+describe("resendInvite", () => {
+  it("posts { resend: true, inviteeEmail, companyUid, role: 'member' } and returns the resent result", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        resent: true,
+        emailSent: true,
+        emailSkipped: false,
+      }),
+    );
+
+    const result = await resendInvite({
+      inviteeEmail: "Alice@Example.com",
+      companyUid: "cmp_acme",
+      callerUid: "prs_admin",
+      token: "test-token",
+    });
+
+    expect(result).toEqual({
+      resent: true,
+      emailSent: true,
+      emailSkipped: false,
+    });
+    const body = JSON.parse((fetchSpy.mock.calls[0][1]?.body as string) ?? "{}");
+    expect(body).toEqual({
+      companyUid: "cmp_acme",
+      // Server still requires `role` even on the resend short-circuit; the
+      // CLI passes the safe default. Server ignores it on this path.
+      role: "member",
+      // Email normalized to lowercase before send.
+      inviteeEmail: "alice@example.com",
+      invitedBy: "prs_admin",
+      resend: true,
+    });
+  });
+
+  it("surfaces emailSkipped: true when hq-pro has no RESEND_API_KEY", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, {
+        resent: true,
+        emailSent: false,
+        emailSkipped: true,
+      }),
+    );
+
+    const result = await resendInvite({
+      inviteeEmail: "alice@example.com",
+      companyUid: "cmp_acme",
+      callerUid: "prs_admin",
+      token: "test-token",
+    });
+
+    expect(result.emailSent).toBe(false);
+    expect(result.emailSkipped).toBe(true);
+  });
+
+  it("throws on a non-email target — the resend path is email-keyed-row only", async () => {
+    await expect(
+      resendInvite({
+        inviteeEmail: "prs_bob",
+        companyUid: "cmp_acme",
+        callerUid: "prs_admin",
+        token: "test-token",
+      }),
+    ).rejects.toThrow(/email target/);
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("wraps a 404 INVITE_NOT_PENDING in InviteHttpError so the action handler can format it", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(404, {
+        error: "no pending row",
+        code: "INVITE_NOT_PENDING",
+      }),
+    );
+
+    await expect(
+      resendInvite({
+        inviteeEmail: "alice@example.com",
+        companyUid: "cmp_acme",
+        callerUid: "prs_admin",
+        token: "test-token",
+      }),
+    ).rejects.toBeInstanceOf(InviteHttpError);
+  });
+
+  it("rejects a 2xx response that lacks `resent: true` — guard against a pre-resend hq-pro silently dropping the flag", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(200, { membership: { role: "member", status: "pending" } }),
+    );
+
+    await expect(
+      resendInvite({
+        inviteeEmail: "alice@example.com",
+        companyUid: "cmp_acme",
+        callerUid: "prs_admin",
+        token: "test-token",
+      }),
+    ).rejects.toThrow(/doesn't support `resend: true` yet/);
+  });
 });
 
 // ---------------------------------------------------------------------------