@indigoai-us/hq-cli 5.345.76 → 5.345.77

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 ## [Unreleased]
 
+## [5.345.77] — 2026-10-10
+- Local bots no longer fail a turn when the installed Codex is too old for the
+  model it was asked to use (often the model a newer Codex app set in your own
+  Codex settings). The bot runs the same turn once more on a model your Codex
+  supports and notes it in `hq bot status`.
+- A bot whose coding tool fails now tells you in plain words what is wrong and
+  the one thing to do (sign in, update, choose another model, or try again),
+  never the tool's raw error, and never blames the sign-in unless it is the
+  sign-in. The DM also carries a repair card for the HQ desktop app.
+- After five model failures in ten minutes a local bot now says it is pausing,
+  holds its turns for ten minutes, and then answers the next message, instead
+  of exiting and staying down until `hq bot start`. A good turn clears the
+  recorded failure from `hq bot status`, which now shows a hold and a plain
+  problem line instead of the raw error.
+- Bots created before this release: one that is still running restarts itself
+  onto the new hq-cli within a few minutes of the install and heals on its
+  first message. One that already exited after five failures on the old
+  release is brought back only by a login or reboot, the desktop's Start, or
+  `hq bot start`; after that it heals the same way.
+- New `hq bot set-model <name> <model|default>` sets a bot's own model without
+  touching the coding tool's settings.
+- New `hq bot probe (--runtime <runtime> | --bot <name>) [--model <model>]
+  --json` runs one tiny test turn exactly as a bot would, in an empty scratch
+  folder, and reports `{ ok, class, detail }`.
+- Added `hq members remove <email>` to end an active membership and drop that
+  person's file and secret grants. `hq members revoke` still only cancels
+  pending invites. Guests stay active members, so company-wide grants (`@all` /
+  Everyone in company) still apply to them; demoting to guest does not lock
+  someone out. `hq access <path> --as <email>` now accepts an email and shows
+  that person's effective access.
+
 ## [5.345.76] — 2026-10-10
 
 - `hq bot` on macOS now finds the Codex CLI bundled in the ChatGPT or Codex

package/dist/command-catalog.generated.d.ts

@@ -2880,8 +2880,8 @@ export declare const COMMAND_CATALOG: readonly [{
         readonly description: "Company slug";
         readonly hidden: false;
     }, {
-        readonly flags: "--as <person-uid>";
-        readonly description: "Check a person's access (exact prs_ or agt_ UID; self or owner/admin)";
+        readonly flags: "--as <person>";
+        readonly description: "Check a person's access (email, prs_, or agt_ uid; self or owner/admin)";
         readonly hidden: false;
     }, {
         readonly flags: "--json";
@@ -3164,9 +3164,26 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "remove";
+        readonly description: "Remove an active member. Ends membership so company-wide grants no longer apply, and drops that person's file and secret grants. Accepts an email, prs_ personUid, agt_ agentUid, or full membership key.";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <target>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "target";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "revoke";
-        readonly description: "Revoke a pending invite. Accepts an email, personUid, full membershipKey, or legacy inviteToken.";
+        readonly description: "Revoke a pending invite. For an active member, use `hq members remove` instead. Accepts an email, personUid, full membershipKey, or legacy inviteToken.";
         readonly aliases: readonly [];
         readonly hidden: false;
         readonly helpOption: true;
@@ -15644,6 +15661,69 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly hidden: false;
         }];
         readonly subcommands: readonly [];
+    }, {
+        readonly name: "set-model";
+        readonly description: "Set the model this bot asks its runtime for (stored in the bot's own settings; the runtime's own config is never changed), or default to clear it";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options] <name> <model>";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [{
+            readonly name: "name";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }, {
+            readonly name: "model";
+            readonly required: true;
+            readonly variadic: false;
+            readonly description: "";
+        }];
+        readonly options: readonly [{
+            readonly flags: "--json";
+            readonly description: "Print machine-readable JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
+    }, {
+        readonly name: "probe";
+        readonly description: "Run one minimal test turn with a runtime, model and thinking level exactly as a bot would, and say whether a bot set up that way can answer. Costs one tiny model turn on your own login; runs in an empty scratch folder, so no HQ settings or hooks load";
+        readonly aliases: readonly [];
+        readonly hidden: false;
+        readonly helpOption: true;
+        readonly helpCommand: false;
+        readonly usage: "[options]";
+        readonly helpText: readonly [];
+        readonly arguments: readonly [];
+        readonly options: readonly [{
+            readonly flags: "--runtime <runtime>";
+            readonly description: "Model CLI to check: claude|codex|grok (required unless --bot is given)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--bot <name>";
+            readonly description: "Check with this bot's saved runtime, model and thinking level (--runtime/--model/--effort override them)";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--model <model>";
+            readonly description: "Model id to check, or default for the runtime's own default";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--effort <level>";
+            readonly description: "Thinking level to check";
+            readonly hidden: false;
+        }, {
+            readonly flags: "--timeout <seconds>";
+            readonly description: "Give up after this many seconds";
+            readonly hidden: false;
+            readonly defaultValue: "120";
+        }, {
+            readonly flags: "--json";
+            readonly description: "Print { ok, class, detail, ... } as JSON";
+            readonly hidden: false;
+        }];
+        readonly subcommands: readonly [];
     }, {
         readonly name: "intro";
         readonly description: "Have the bot re-send its introduction DM to you";

package/dist/command-catalog.generated.js

@@ -3473,8 +3473,8 @@ export const COMMAND_CATALOG = [
                 "hidden": false
             },
             {
-                "flags": "--as <person-uid>",
-                "description": "Check a person's access (exact prs_ or agt_ UID; self or owner/admin)",
+                "flags": "--as <person>",
+                "description": "Check a person's access (email, prs_, or agt_ uid; self or owner/admin)",
                 "hidden": false
             },
             {
@@ -3825,9 +3825,29 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "remove",
+                "description": "Remove an active member. Ends membership so company-wide grants no longer apply, and drops that person's file and secret grants. Accepts an email, prs_ personUid, agt_ agentUid, or full membership key.",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <target>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "target",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [],
+                "subcommands": []
+            },
             {
                 "name": "revoke",
-                "description": "Revoke a pending invite. Accepts an email, personUid, full membershipKey, or legacy inviteToken.",
+                "description": "Revoke a pending invite. For an active member, use `hq members remove` instead. Accepts an email, personUid, full membershipKey, or legacy inviteToken.",
                 "aliases": [],
                 "hidden": false,
                 "helpOption": true,
@@ -19052,6 +19072,83 @@ export const COMMAND_CATALOG = [
                 ],
                 "subcommands": []
             },
+            {
+                "name": "set-model",
+                "description": "Set the model this bot asks its runtime for (stored in the bot's own settings; the runtime's own config is never changed), or default to clear it",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options] <name> <model>",
+                "helpText": [],
+                "arguments": [
+                    {
+                        "name": "name",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    },
+                    {
+                        "name": "model",
+                        "required": true,
+                        "variadic": false,
+                        "description": ""
+                    }
+                ],
+                "options": [
+                    {
+                        "flags": "--json",
+                        "description": "Print machine-readable JSON",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
+            {
+                "name": "probe",
+                "description": "Run one minimal test turn with a runtime, model and thinking level exactly as a bot would, and say whether a bot set up that way can answer. Costs one tiny model turn on your own login; runs in an empty scratch folder, so no HQ settings or hooks load",
+                "aliases": [],
+                "hidden": false,
+                "helpOption": true,
+                "helpCommand": false,
+                "usage": "[options]",
+                "helpText": [],
+                "arguments": [],
+                "options": [
+                    {
+                        "flags": "--runtime <runtime>",
+                        "description": "Model CLI to check: claude|codex|grok (required unless --bot is given)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--bot <name>",
+                        "description": "Check with this bot's saved runtime, model and thinking level (--runtime/--model/--effort override them)",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--model <model>",
+                        "description": "Model id to check, or default for the runtime's own default",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--effort <level>",
+                        "description": "Thinking level to check",
+                        "hidden": false
+                    },
+                    {
+                        "flags": "--timeout <seconds>",
+                        "description": "Give up after this many seconds",
+                        "hidden": false,
+                        "defaultValue": "120"
+                    },
+                    {
+                        "flags": "--json",
+                        "description": "Print { ok, class, detail, ... } as JSON",
+                        "hidden": false
+                    }
+                ],
+                "subcommands": []
+            },
             {
                 "name": "intro",
                 "description": "Have the bot re-send its introduction DM to you",

package/dist/commands/access.d.ts

@@ -158,6 +158,7 @@ export declare function resolveAccessCompany(target: string, opts?: {
     company?: string;
     hqRoot?: string;
 }): string | undefined;
+export declare function resolveAccessAsPersonUid(token: string, companyUid: string, person: string): Promise<string>;
 export declare function runAccessForPerson(rawPath: string, personUid: string, opts?: {
     company?: string;
     hqRoot?: string;

package/dist/commands/access.js

@@ -641,7 +641,7 @@ export function registerAccessCommand(program) {
         .command("access <path-or-query>")
         .description("Tell whether a vault file exists and whether you can read it. Never a bare not-found. Exit codes: 0 local/not-synced, 2 never-existed, 3 no-access, 4 ambiguous.")
         .option("--company <slug>", "Company slug")
-        .option("--as <person-uid>", "Check a person's access (exact prs_ or agt_ UID; self or owner/admin)")
+        .option("--as <person>", "Check a person's access (email, prs_, or agt_ uid; self or owner/admin)")
         .option("--json", "Print a single JSON object")
         .option("--no-fix", "Diagnose only: do not fetch, pin, or repair sync")
         .option("--yes", "Answer the one send-confirmation yes (hosts must pass this explicitly)")
@@ -680,11 +680,22 @@ export function resolveAccessCompany(target, opts) {
     const hqRoot = opts?.hqRoot ?? DEFAULT_HQ_ROOT;
     return opts?.company ?? slugFromTarget(target) ?? readActiveCompany(hqRoot);
 }
+export async function resolveAccessAsPersonUid(token, companyUid, person) {
+    const trimmed = person.trim();
+    if (/^(?:prs|agt)_[A-Za-z0-9_-]+$/.test(trimmed))
+        return trimmed;
+    const email = trimmed.toLowerCase();
+    if (!/^[^\s]+@[^\s]+$/.test(email)) {
+        throw new Error("Pass an email, or the person's exact prs_ or agt_ UID, to --as.");
+    }
+    const members = await listActiveMembers(token, companyUid);
+    const member = members.find((candidate) => candidate.personEmail?.trim().toLowerCase() === email);
+    if (member?.personUid)
+        return member.personUid;
+    throw new Error(`No active member has email '${email}' in this company. Run \`hq members list\`.`);
+}
 export async function runAccessForPerson(rawPath, personUid, opts) {
-    const uid = personUid.trim();
-    if (!/^(?:prs|agt)_[A-Za-z0-9_-]+$/.test(uid)) {
-        throw new Error("Pass the person's exact prs_ or agt_ UID to --as.");
-    }
+    const requested = personUid.trim();
     const pathSlug = slugFromTarget(rawPath);
     if (opts?.company && pathSlug && opts.company !== pathSlug) {
         throw new Error("The --company value does not match the company in the path.");
@@ -698,6 +709,7 @@ export async function runAccessForPerson(rawPath, personUid, opts) {
     }
     const { token } = await resolveBrowseSession();
     const companyUid = await getCompanyUid(token, company);
+    const uid = await resolveAccessAsPersonUid(token, companyUid, requested);
     const response = await vaultApiFetch({
         token,
         path: `/files/${encodeURIComponent(companyUid)}/members/${encodeURIComponent(uid)}/access`,

package/dist/commands/bot.d.ts

@@ -1,5 +1,6 @@
 import { Command } from "commander";
 import { type RuntimeSignInIssue } from "../lib/bot/runtime-sign-in.js";
+import { probeBotRuntime, type RuntimeProbeResult } from "../lib/bot/probe.js";
 import { type BotLocalConfig, type MyLocalBot, type BotKind, type BotMemoryMode, type BotNotRunnableReason, type BotConfig, type BotRuntimeId, type LaunchctlExec } from "../lib/bot/index.js";
 /** Real launchctl; every failure is a non-ok result, never a throw. */
 export declare const defaultLaunchctl: LaunchctlExec;
@@ -134,6 +135,17 @@ export declare function runBotSet(nameArg: string, opts: {
     effort?: string;
     json?: boolean;
 }): Promise<void>;
+/** `hq bot probe`: exit code 0 when the runtime answered, 1 when it did not. */
+export declare function runBotProbe(opts: {
+    runtime?: string;
+    bot?: string;
+    model?: string;
+    effort?: string;
+    timeout?: string;
+    json?: boolean;
+}, deps?: {
+    probe?: typeof probeBotRuntime;
+}): Promise<RuntimeProbeResult>;
 /**
  * The one bot the caller means. Matches the local folder name, the cloud slug,
  * the display name, or the agt_ uid; an ambiguous name is refused rather than

package/dist/commands/bot.js

@@ -49,6 +49,8 @@ import { daemonPaths } from "../lib/daemon/paths.js";
 import { launchdLabel } from "../lib/bot/paths.js";
 import { isAncestorProcess } from "../lib/bot/self-process.js";
 import { runtimeDisplayName } from "../lib/bot/runtime-sign-in.js";
+import { classifyRuntimeFailure, runtimeFailureReason } from "../lib/bot/runtime-failure.js";
+import { PROBE_DEFAULT_TIMEOUT_MS, probeBotRuntime } from "../lib/bot/probe.js";
 import { BotApi, BotApiError, BOT_RESTORE_DEFAULTS, buildBotLocalConfig, describeBotLocalConfig, orphanBotRunMessage, parseBotLocalConfig, removeOrphanBotDaemon, botDaemonStatus, botDir, botCredsPath, botLogPath, botsRoot, botTokenStateDir, botWorkerRelDir, buildBotDaemonPaths, createBotLogger, deleteBotCreds, installBotDaemon, repairBotDaemonIfStale, healBotDaemonNodeFromJob, introDmText, isBotMemoryMode, botLocalMemoryDir, botMemoryMode, resolveBotMemoryDir, validateBotIntro, validateBotDisplayName, validateBotKickoff, validateBotEffort, validateBotModel, effectiveBotEffort, BOT_EFFORT_LEVELS, DEFAULT_BOT_EFFORT, BOT_MEMORY_MODES, BOT_KINDS, isBotKind, effectiveBotKind, effectiveBotCompanies, normalizeBotCompanies, SETUP_BOT_WORKER_ID, isBotRuntimeId, localNameForRemoteBot, remoteBotRunnability, isPidAlive, listBotWorkerOptions, patchBotConfig, readBotConfig, readBotCredsIdentity, readBotStatus, resolveBotWorker, runBot, runtimeFor, scaffoldBotMemory, scaffoldBotWorker, startBotDaemon, stopBotDaemon, uninstallBotDaemon, validateBotName, writeBotConfig, writeBotCreds, BOT_RUNTIMES, BOT_INTRO_MAX_CHARS, BOT_DISPLAY_NAME_MAX_CHARS, BOT_KICKOFF_MAX_CHARS, detectBotPlatform, } from "../lib/bot/index.js";
 function collectRepeated(value, previous) {
     return [...previous, value];
@@ -994,8 +996,17 @@ async function runBotStatus(nameArg, opts) {
             const tool = runtimeDisplayName(status.runtimeSignIn.runtime);
             console.log(`  ${chalk.yellow(`${tool} needs to sign in again`)} — sign in from HQ, or run \`${status.runtimeSignIn.runtime} ${status.runtimeSignIn.runtime === "claude" ? "auth login" : "login"}\`, then \`hq bot restart ${name}\``);
         }
-        if (status.lastError)
-            console.log(`  last error: ${chalk.yellow(status.lastError)}`);
+        if (status.modelHold && new Date(status.modelHold.until).getTime() > Date.now()) {
+            console.log(`  ${chalk.yellow(`holding until ${status.modelHold.until}`)} after repeated model failures; the next message after that runs again`);
+        }
+        if (status.runtimeModelFallback) {
+            console.log(`  model:      ${chalk.yellow(`running on ${status.runtimeModelFallback.to}`)} because ${row.runtime} here is too old for ${status.runtimeModelFallback.from || "its configured model"}; update ${row.runtime} to use it`);
+        }
+        // The raw runtime text stays in the log (hq bot logs) and the JSON output.
+        if (status.lastError) {
+            const cls = classifyRuntimeFailure(status.lastError);
+            console.log(`  last problem: ${chalk.yellow(`${cls}: ${runtimeFailureReason(cls, row.runtime)}`)}  ${chalk.dim(`(details: hq bot logs ${name})`)}`);
+        }
     }
     console.log(chalk.dim(`  state dir:  ${dir}`));
 }
@@ -1278,6 +1289,32 @@ export async function runBotSet(nameArg, opts) {
     }
     console.log(chalk.green(`${name} now thinks with ${result.model ?? "the default model"} at ${result.effort} effort (from its next message).`));
 }
+/** `hq bot probe`: exit code 0 when the runtime answered, 1 when it did not. */
+export async function runBotProbe(opts, deps = {}) {
+    const saved = opts.bot ? requireBot(opts.bot).config : undefined;
+    const runtimeArg = opts.runtime ?? saved?.runtime;
+    if (!isBotRuntimeId(runtimeArg)) {
+        throw Object.assign(new Error(opts.runtime === undefined && !opts.bot ? `Pass --runtime <${BOT_RUNTIMES.join("|")}> or --bot <name>.` : `--runtime must be one of ${BOT_RUNTIMES.join(", ")}`), { expected: true });
+    }
+    const runtime = runtimeArg;
+    const model = opts.model !== undefined ? validateBotModel(opts.model) : saved?.model;
+    const effort = opts.effort !== undefined ? validateBotEffort(runtime, opts.effort) : saved?.effort;
+    const seconds = Number(opts.timeout ?? PROBE_DEFAULT_TIMEOUT_MS / 1000);
+    const timeoutMs = Number.isFinite(seconds) && seconds > 0 ? Math.round(seconds * 1000) : PROBE_DEFAULT_TIMEOUT_MS;
+    const result = await (deps.probe ?? probeBotRuntime)({
+        runtime,
+        ...(model ? { model } : {}),
+        ...(effort ? { effort } : {}),
+        timeoutMs,
+    });
+    if (!result.ok)
+        process.exitCode = 1;
+    if (opts.json)
+        console.log(JSON.stringify(result, null, 2));
+    else
+        console.log(result.ok ? chalk.green(result.detail) : chalk.red(result.detail));
+    return result;
+}
 async function runBotIntro(nameArg) {
     const { name, dir, config } = requireBot(nameArg);
     if (hasPromotionHold(dir))
@@ -1938,6 +1975,21 @@ export function registerBotCommand(program) {
         .option("--effort <level>", `Thinking level (claude ${BOT_EFFORT_LEVELS.claude.join("|")}; codex ${BOT_EFFORT_LEVELS.codex.join("|")}; grok ${BOT_EFFORT_LEVELS.grok.join("|")}), or default (${DEFAULT_BOT_EFFORT})`)
         .option("--json", "Print machine-readable JSON")
         .action((name, opts) => wrap(() => runBotSet(name, opts))());
+    bot
+        .command("set-model <name> <model>")
+        .description("Set the model this bot asks its runtime for (stored in the bot's own settings; the runtime's own config is never changed), or default to clear it")
+        .option("--json", "Print machine-readable JSON")
+        .action((name, model, opts) => wrap(() => runBotSet(name, { model, ...(opts.json ? { json: true } : {}) }))());
+    bot
+        .command("probe")
+        .description("Run one minimal test turn with a runtime, model and thinking level exactly as a bot would, and say whether a bot set up that way can answer. Costs one tiny model turn on your own login; runs in an empty scratch folder, so no HQ settings or hooks load")
+        .option("--runtime <runtime>", `Model CLI to check: ${BOT_RUNTIMES.join("|")} (required unless --bot is given)`)
+        .option("--bot <name>", "Check with this bot's saved runtime, model and thinking level (--runtime/--model/--effort override them)")
+        .option("--model <model>", "Model id to check, or default for the runtime's own default")
+        .option("--effort <level>", "Thinking level to check")
+        .option("--timeout <seconds>", "Give up after this many seconds", String(PROBE_DEFAULT_TIMEOUT_MS / 1000))
+        .option("--json", "Print { ok, class, detail, ... } as JSON")
+        .action((opts) => wrap(async () => { await runBotProbe(opts); })());
     bot
         .command("intro <name>")
         .description("Have the bot re-send its introduction DM to you")

package/dist/commands/files.js

@@ -474,8 +474,9 @@ export function registerFilesCommand(program) {
             // store `granteeId === ""` on the wire, but a blank cell is confusing
             // in tabular output, so we render a human-readable phrase instead.
             function displayGrantee(e) {
-                if (e.granteeType === "company-wide")
-                    return "Everyone in company";
+                if (e.granteeType === "company-wide") {
+                    return "Everyone in company (including guests)";
+                }
                 return e.granteeId;
             }
             function printEntryTable(rows, showSource) {
@@ -531,6 +532,10 @@ export function registerFilesCommand(program) {
                 console.log("\nGranted on descendant prefixes (do not affect this prefix's access):");
                 printEntryTable(tree.children, true);
             }
+            const allEntries = [...tree.direct, ...tree.inherited, ...tree.children];
+            if (allEntries.some((entry) => entry.granteeType === "company-wide")) {
+                console.log(chalk.gray("\nCompany-wide grants apply to every active member, including guests. Demoting someone to guest does not exclude them. Use hq members remove to end membership, or hq access <path> --as <email> to see effective access."));
+            }
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));

package/dist/commands/members.d.ts

@@ -182,5 +182,47 @@ export declare function revokeInvite(token: string, tokenOrKey: string, companyU
  * a synchronous-shaped rejection for a bad role.
  */
 export declare function changeMemberRole(token: string, companyUid: string, membershipKey: string, newRole: Role): Promise<void>;
+/** Guests remain active members, so company-wide (@all) grants still apply. */
+export declare const GUEST_COMPANY_WIDE_NOTE = "Guests stay active members. Company-wide grants (Everyone in company / @all) still apply to them. Demoting to guest does not lock someone out. Use `hq members remove <email>`.";
+export declare function personUidFromMembershipKey(membershipKey: string): string;
+interface MemberAccessGrant {
+    path?: unknown;
+    permission?: unknown;
+    sources?: Array<{
+        via?: unknown;
+    }>;
+}
+interface MemberAccessProjection {
+    personUid?: unknown;
+    identity?: {
+        primaryEmail?: unknown;
+    };
+    files?: {
+        grants?: MemberAccessGrant[];
+    };
+    secrets?: {
+        grants?: MemberAccessGrant[];
+    };
+}
+/** Paths granted to this person or their email — not company-wide or group. */
+export declare function personalGrantPaths(grants: MemberAccessGrant[] | undefined): string[];
+export declare function fetchMemberAccessProjection(token: string, companyUid: string, personUid: string): Promise<MemberAccessProjection | null>;
+export interface RemoveMemberResult {
+    membershipKey: string;
+    droppedFileGrants: string[];
+    droppedSecretGrants: string[];
+    skippedGrantDrops: string[];
+}
+/**
+ * End an active membership via `POST /membership/revoke`, then drop person and
+ * email file/secret grants collected from the member-access projection.
+ * Company-wide and group grants are left in place — they belong to the company,
+ * not the person. Membership end already makes company-wide grants inert for
+ * this principal because they are no longer an active member.
+ */
+export declare function removeActiveMember(token: string, companyUid: string, membershipKey: string, opts?: {
+    email?: string;
+}): Promise<RemoveMemberResult>;
 export declare function registerMembersCommand(program: Command): void;
+export {};
 //# sourceMappingURL=members.d.ts.map