@indigoai-us/hq-cli 5.51.0 → 5.53.0

package/CHANGELOG.md

@@ -2,6 +2,47 @@
 
 ## [Unreleased]
 
+## [5.53.0]
+
+### Added
+
+- **`hq crm entity upsert` — write a client record into the native CRM from the
+  terminal.** Posts to `POST /crm/entities`, which runs through the ontology
+  write-gate (tenant-isolated, `crmEnabled`-gated) and refreshes the company's
+  CRM projection. `--company`, `--type` (`contact|deal|contract|invoice|company`)
+  and `--name` are required in flag form; `--attio-id|--stripe-id|--pandadoc-id|
+  --neon-id` populate `external_ids`; `--json <file|->` passes a full entity or
+  array instead. Surfaces a `CRM_DISABLED` 403 with an enable hint. This is the
+  build-native path for companies with no external CRM.
+- **`hq company settings set` — toggle company settings from the CLI.** Calls
+  `PUT /company-settings` with `--crm-enabled <true|false>` and/or
+  `--ontology-enabled <true|false>` (at least one required; owner-gated
+  server-side). `--crm-enabled true` is how `/crm-setup` activates the native
+  CRM for a company.
+
+## [5.52.0]
+
+### Added
+
+- **`hq members promote <target> <newRole>` (alias `set-role`) — change a
+  member's role from the CLI.** A discoverable runner for role changes via
+  `POST /membership/role`, replacing the undiscoverable, `admin|member`-only
+  `set-role` (now kept as an alias). Supports the full role set
+  (`owner|admin|member|guest`); `<target>` may be an email, a `prs_` personUid,
+  or a full membership key (same resolver as `revoke`). It is a GENERAL role
+  change — it can promote OR demote — and authorization (owner-or-admin; only
+  an owner may set a target to owner or change an owner) is enforced
+  server-side.
+- **`hq files share --full` — glob-safe whole-vault access.** Granting prefixes
+  one at a time hit `PolicyBudgetExceeded` after a few (each prefix is a
+  distinct ARN in the member's DEFLATE-packed inline STS session policy), and
+  the intended single-`*` wildcard escape hatch was unreachable because an
+  unquoted `*` expands to local filenames and fails the one-prefix check.
+  `--full` is a glob-safe flag that performs the coalesced whole-vault wildcard
+  grant in a single policy entry.
+
+## [5.51.0]
+
 ### Fixed
 
 - **`hq secrets exec` / `hq secrets env` load via the batch endpoint, killing

package/dist/commands/company.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare function registerCompanyCommand(program: Command): void;
+//# sourceMappingURL=company.d.ts.map

package/dist/commands/company.js

@@ -0,0 +1,82 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c0b7f9ed-8ddb-5422-8872-f85b6b406af6")}catch(e){}}();
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch, getEntityUid } from "../utils/vault-api.js";
+/**
+ * Parse a `--flag <true|false>` string into a boolean, or throw. Commander
+ * passes the raw string; we validate strictly so a typo never silently writes
+ * the wrong value.
+ */
+function parseBoolFlag(value, flag) {
+    const v = value.trim().toLowerCase();
+    if (v === "true")
+        return true;
+    if (v === "false")
+        return false;
+    throw new Error(`${flag} must be 'true' or 'false' (got '${value}')`);
+}
+export function registerCompanyCommand(program) {
+    const company = program
+        .command("company")
+        .description("Company-level settings")
+        .option("--company <slug>", "Company slug (resolves to companyUid)");
+    const settings = company
+        .command("settings")
+        .description("Per-company settings (owner-only)");
+    settings
+        .command("set")
+        .description("Set per-company settings (PUT /company-settings). Require at least one " +
+        "of --crm-enabled / --ontology-enabled.")
+        .option("--crm-enabled <true|false>", "Enable/disable the native CRM for this company")
+        .option("--ontology-enabled <true|false>", "Enable/disable the ontology gardener for this company")
+        .action(async (opts) => {
+        try {
+            const companySlug = company.opts().company;
+            if (!companySlug) {
+                console.error(chalk.red("Error: --company <slug> is required."));
+                process.exit(1);
+            }
+            if (opts.crmEnabled === undefined && opts.ontologyEnabled === undefined) {
+                console.error(chalk.red("Error: provide at least one of --crm-enabled / --ontology-enabled."));
+                process.exit(1);
+            }
+            const body = {};
+            if (opts.crmEnabled !== undefined) {
+                body.crmEnabled = parseBoolFlag(opts.crmEnabled, "--crm-enabled");
+            }
+            if (opts.ontologyEnabled !== undefined) {
+                body.ontologyEnabled = parseBoolFlag(opts.ontologyEnabled, "--ontology-enabled");
+            }
+            const token = await ensureCognitoToken();
+            const companyUid = await getEntityUid(token, { companySlug });
+            body.companyUid = companyUid;
+            const res = await vaultApiFetch({
+                token,
+                path: "/company-settings",
+                method: "PUT",
+                body,
+            });
+            if (!res.ok) {
+                const errBody = (await res.json().catch(() => ({})));
+                if (res.status === 403) {
+                    console.error(chalk.red("Requires owner role on this company to change its settings."));
+                    process.exit(1);
+                }
+                console.error(chalk.red(`Failed to update company settings: ${errBody.error ?? res.statusText}`));
+                process.exit(1);
+            }
+            const applied = Object.entries(body)
+                .filter(([k]) => k !== "companyUid")
+                .map(([k, v]) => `${k}=${v}`)
+                .join(", ");
+            console.log(chalk.green(`Company settings updated for ${companySlug}: ${applied}`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=company.js.map
+//# debugId=c0b7f9ed-8ddb-5422-8872-f85b6b406af6

package/dist/commands/crm.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare function registerCrmCommand(program: Command): void;
+//# sourceMappingURL=crm.d.ts.map

package/dist/commands/crm.js

@@ -0,0 +1,162 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="056ad757-a0da-5318-b97f-21ae6529f648")}catch(e){}}();
+import chalk from "chalk";
+import { readFileSync } from "node:fs";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch, getEntityUid } from "../utils/vault-api.js";
+/**
+ * `hq crm entity upsert` — agent-facing controlled entity upsert
+ * (hq-native-crm US-002). Wraps `POST /crm/entities`, which fronts the ontology
+ * write gate so an authenticated company MEMBER (or higher) can create/update
+ * canonical CRM entities in their company's vault.
+ *
+ * Conventions mirror `secrets.ts`: ensureCognitoToken() → getEntityUid() →
+ * vaultApiFetch() → error-check → chalk output.
+ */
+/** The CRM/ontology entity types the upsert route accepts via `--type`. */
+const CRM_ENTITY_TYPES = [
+    "contact",
+    "deal",
+    "contract",
+    "invoice",
+    "company",
+];
+/**
+ * Read the `--json <file|->` payload: a single entity object or an array of
+ * entities. `-` reads from stdin. Returns the entities array (always
+ * normalized to an array) or throws a descriptive Error.
+ */
+function readJsonEntities(source) {
+    const raw = source === "-"
+        ? readFileSync(0, "utf8") // fd 0 = stdin
+        : readFileSync(source, "utf8");
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`--json payload is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const entities = Array.isArray(parsed) ? parsed : [parsed];
+    if (entities.length === 0) {
+        throw new Error("--json payload contained no entities");
+    }
+    for (const e of entities) {
+        if (!e || typeof e !== "object") {
+            throw new Error("--json entities must be objects");
+        }
+        const obj = e;
+        if (typeof obj.type !== "string" || typeof obj.canonical_name !== "string") {
+            throw new Error("each --json entity needs a string `type` and `canonical_name`");
+        }
+    }
+    return entities;
+}
+/**
+ * Build a single entity from the flag form (`--type` + `--name` + optional
+ * external-id flags). The route fills the additive defaults (aliases/domain/
+ * relationships/confidence) when omitted, but we send a complete minimal shape.
+ */
+function buildEntityFromFlags(opts) {
+    const externalIds = {};
+    if (opts.attioId)
+        externalIds.attio = opts.attioId;
+    if (opts.stripeId)
+        externalIds.stripe = opts.stripeId;
+    if (opts.pandadocId)
+        externalIds.pandadoc = opts.pandadocId;
+    if (opts.neonId)
+        externalIds.neon = opts.neonId;
+    const entity = {
+        type: opts.type,
+        canonical_name: opts.name,
+        aliases: [],
+        confidence: 1,
+        domain: [],
+        relationships: [],
+    };
+    if (Object.keys(externalIds).length > 0) {
+        entity.external_ids = externalIds;
+    }
+    return entity;
+}
+export function registerCrmCommand(program) {
+    const crm = program
+        .command("crm")
+        .description("Native CRM — upsert canonical entities into a company vault")
+        .option("--company <slug>", "Company slug (resolves to companyUid)");
+    const entity = crm
+        .command("entity")
+        .description("CRM entity operations");
+    entity
+        .command("upsert")
+        .description("Create or update a canonical CRM entity (POST /crm/entities). " +
+        "Use --type/--name (+ optional external-id flags) or --json <file|-> " +
+        "to pass a full entity/array.")
+        .option("--type <type>", `Entity type: ${CRM_ENTITY_TYPES.join(" | ")}`)
+        .option("--name <canonical_name>", "Canonical entity name")
+        .option("--attio-id <id>", "Attio record id → external_ids.attio")
+        .option("--stripe-id <id>", "Stripe object id → external_ids.stripe")
+        .option("--pandadoc-id <id>", "PandaDoc document id → external_ids.pandadoc")
+        .option("--neon-id <id>", "Neon row id → external_ids.neon")
+        .option("--json <file|->", "Path to a JSON file (or '-' for stdin) with a full entity object or array")
+        .action(async (opts) => {
+        try {
+            const companySlug = crm.opts().company;
+            if (!companySlug) {
+                console.error(chalk.red("Error: --company <slug> is required."));
+                process.exit(1);
+            }
+            // Resolve the entity payload: --json is the alternative to flags.
+            let entities;
+            if (opts.json) {
+                entities = readJsonEntities(opts.json);
+            }
+            else {
+                if (!opts.type) {
+                    console.error(chalk.red(`Error: --type <${CRM_ENTITY_TYPES.join("|")}> is required (or pass --json).`));
+                    process.exit(1);
+                }
+                if (!CRM_ENTITY_TYPES.includes(opts.type)) {
+                    console.error(chalk.red(`Error: --type must be one of ${CRM_ENTITY_TYPES.join(", ")}.`));
+                    process.exit(1);
+                }
+                if (!opts.name) {
+                    console.error(chalk.red("Error: --name <canonical_name> is required (or pass --json)."));
+                    process.exit(1);
+                }
+                entities = [buildEntityFromFlags(opts)];
+            }
+            const token = await ensureCognitoToken();
+            const companyUid = await getEntityUid(token, { companySlug });
+            const res = await vaultApiFetch({
+                token,
+                path: "/crm/entities",
+                method: "POST",
+                body: { companyUid, entities },
+            });
+            if (!res.ok) {
+                const body = (await res.json().catch(() => ({})));
+                // CrmDisabledError surfaces as a 403 with a helpful message.
+                if (res.status === 403 && body.code === "CRM_DISABLED") {
+                    console.error(chalk.red("CRM is not enabled for this company. Enable it first: " +
+                        `hq company settings set --company ${companySlug} --crm-enabled true`));
+                    process.exit(1);
+                }
+                console.error(chalk.red(`Failed to upsert entities: ${body.error ?? res.statusText}`));
+                process.exit(1);
+            }
+            const result = (await res.json().catch(() => ({})));
+            console.log(chalk.green(`Upsert ${result.status ?? "ok"}: ` +
+                `${result.created ?? 0} created, ` +
+                `${result.updated ?? 0} updated, ` +
+                `${result.skipped ?? 0} skipped.`));
+        }
+        catch (err) {
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=crm.js.map
+//# debugId=056ad757-a0da-5318-b97f-21ae6529f648

package/dist/commands/files.d.ts

@@ -66,6 +66,8 @@ interface RunFilesDeleteParams {
     prefix: string;
     dryRun: boolean;
     yes: boolean;
+    /** Target the caller's personal vault instead of a company vault. */
+    personal?: boolean;
     companySlug: string | undefined;
 }
 /**

package/dist/commands/files.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bc564dd4-d8c1-5d09-ad49-3bcd9f7328a6")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="af29c08f-dbeb-5406-8deb-fdc263354b4a")}catch(e){}}();
 import chalk from "chalk";
 import open from "open";
 import * as readline from "node:readline";
@@ -99,10 +99,35 @@ export function registerFilesCommand(program) {
         .description("Share file paths. Without --with: mint a share-session URL and open it in the browser. With --with: grant access directly to a person, group, or @all.")
         .option("--with <principal>", "Email address, group id, or '@all' to share with every active company member")
         .option("--permission <level>", "Permission level (only with --with): read | write")
+        .option("--full", "Grant access to the ENTIRE vault (the '*' wildcard prefix) — no need to quote a glob. Requires --with; defaults to write permission.")
         .option("--expires <duration>", "Token expiry duration for share-session URL (e.g. 15m, 1h, 24h). Default 15m. Max 24h.")
         .option("--no-open", "Print the share-session URL but do not launch the browser")
         .action(async (paths, opts) => {
         try {
+            // Full-vault grant: a glob-safe affordance for "give this person the
+            // whole vault" so admins never have to quote a `*` (an unquoted glob
+            // expands to local filenames and instantly fails the one-prefix
+            // check). Maps to the single `*` wildcard grant, which the server
+            // coalesces to one policy entry — sidestepping the per-prefix STS
+            // session-policy budget. Defaults to write permission.
+            if (opts.full) {
+                if (opts.with === undefined) {
+                    console.error(chalk.red("--full grants whole-vault access to a principal and requires --with <principal>."));
+                    process.exit(1);
+                }
+                if (paths && paths.length > 0) {
+                    console.error(chalk.red("--full grants the entire vault; do not also pass file paths."));
+                    process.exit(1);
+                }
+                await runDirectGrant({
+                    prefix: "*",
+                    principal: opts.with,
+                    permission: opts.permission ?? "write",
+                    companySlug: files.opts().company,
+                    fullVault: true,
+                });
+                return;
+            }
             if (!paths || paths.length === 0) {
                 console.error(chalk.red("usage: hq files share <paths...> [--with <principal>]"));
                 process.exit(1);
@@ -331,16 +356,24 @@ export function registerFilesCommand(program) {
     });
     files
         .command("delete <prefix>")
-        .description("Delete vault objects under a prefix (bounded + scoped). Always previews the exact count first; prompts for confirmation unless --yes.")
+        .description("Delete vault objects under a prefix (bounded + scoped). Always previews the exact count first; prompts for confirmation unless --yes. Use --personal to target your own personal vault instead of a company.")
         .option("--dry-run", "List what WOULD be deleted without deleting anything")
+        .option("--personal", "Target your own personal vault instead of a company vault (mutually exclusive with --company)")
         .option("-y, --yes", "Skip the confirmation prompt (for scripts)")
         .action(async (prefix, opts) => {
         try {
+            const companySlug = files.opts().company;
+            const personal = opts.personal === true;
+            if (personal && companySlug) {
+                console.error(chalk.red("Pass either --personal or --company, not both."));
+                process.exit(1);
+            }
             await runFilesDelete({
                 prefix,
                 dryRun: opts.dryRun === true,
                 yes: opts.yes === true,
-                companySlug: files.opts().company,
+                personal,
+                companySlug,
             });
         }
         catch (err) {
@@ -437,7 +470,12 @@ async function runDirectGrant(params) {
     const data = (await res.json());
     const printedPrefix = data.acl?.path ?? data.acl?.prefix ?? canonicalPrefix;
     const verb = autoCreated ? "Created ACL and granted" : "Granted";
-    console.log(chalk.green(`${verb} ${params.permission} on ${printedPrefix} to ${principalLabel}`));
+    if (params.fullVault) {
+        console.log(chalk.green(`${verb} ${params.permission} on the ENTIRE vault to ${principalLabel}`));
+    }
+    else {
+        console.log(chalk.green(`${verb} ${params.permission} on ${printedPrefix} to ${principalLabel}`));
+    }
 }
 async function runShareSession(params) {
     // Normalize every path through the shared prefix helper so a trailing
@@ -533,17 +571,28 @@ function realConfirm(message) {
 /**
  * POST /v1/files/delete. Throws FilesDeleteHttpError on any non-2xx so the one
  * caller renders a single consistent error path.
+ *
+ * Scope is EITHER a company vault (`companyUid` set) OR the caller's personal
+ * vault (`personal: true`). For the personal case the server resolves the target
+ * person + bucket from the authenticated caller — we send NO uid, just the
+ * `personal` flag — so there is nothing for the client to get wrong or spoof.
  */
 async function callDeleteEndpoint(params) {
     const res = await vaultApiFetch({
         token: params.token,
         path: "/v1/files/delete",
         method: "POST",
-        body: {
-            company: params.companyUid,
-            prefix: params.prefix,
-            dryRun: params.dryRun,
-        },
+        body: params.personal
+            ? {
+                personal: true,
+                prefix: params.prefix,
+                dryRun: params.dryRun,
+            }
+            : {
+                company: params.companyUid,
+                prefix: params.prefix,
+                dryRun: params.dryRun,
+            },
     });
     if (!res.ok) {
         const body = (await res.json().catch(() => ({})));
@@ -612,14 +661,21 @@ export async function runFilesDelete(params, deps = {}) {
         process.exit(1);
     }
     const token = await ensureCognitoToken();
-    const companyUid = await getCompanyUid(token, params.companySlug);
+    // Personal scope resolves the vault server-side from the caller's identity —
+    // no company to look up. Company scope resolves the companyUid as before.
+    const companyUid = params.personal
+        ? undefined
+        : await getCompanyUid(token, params.companySlug);
+    const scopeArgs = params.personal
+        ? { personal: true }
+        : { companyUid };
     // 1. Always preview first — this is how we print the EXACT key count before
     //    deleting anything (and the whole behavior of --dry-run).
     let preview;
     try {
         preview = await callDeleteEndpoint({
             token,
-            companyUid,
+            ...scopeArgs,
             prefix: normalized,
             dryRun: true,
         });
@@ -652,7 +708,9 @@ export async function runFilesDelete(params, deps = {}) {
         console.log(chalk.dim(`  (${preview.skipped} more under this prefix you can't delete will be left untouched)`));
     }
     if (!params.yes) {
-        const ok = await confirm(`Delete ${preview.matched} ${noun}? This removes them from the shared vault for everyone.`);
+        const ok = await confirm(params.personal
+            ? `Delete ${preview.matched} ${noun}? This removes them from your personal vault.`
+            : `Delete ${preview.matched} ${noun}? This removes them from the shared vault for everyone.`);
         if (!ok) {
             console.log(chalk.dim("Aborted — nothing was deleted."));
             return;
@@ -663,7 +721,7 @@ export async function runFilesDelete(params, deps = {}) {
     try {
         result = await callDeleteEndpoint({
             token,
-            companyUid,
+            ...scopeArgs,
             prefix: normalized,
             dryRun: false,
         });
@@ -682,4 +740,4 @@ export async function runFilesDelete(params, deps = {}) {
     }
 }
 //# sourceMappingURL=files.js.map
-//# debugId=bc564dd4-d8c1-5d09-ad49-3bcd9f7328a6
+//# debugId=af29c08f-dbeb-5406-8deb-fdc263354b4a

package/dist/commands/members.d.ts

@@ -149,5 +149,15 @@ export declare function listActiveMembers(token: string, companyUid: string): Pr
  */
 export declare function resolveRevokeTargetToMembershipKey(arg: string, companyUid: string): string;
 export declare function revokeInvite(token: string, tokenOrKey: string, companyUid: string): Promise<void>;
+/**
+ * Change a member's role via `POST /membership/role`, accepting the FULL role
+ * set (owner|admin|member|guest). This is a GENERAL role change — it can promote
+ * OR demote. Authorization (owner-or-admin `changeRoles`, owner-only
+ * promote-to-owner / change-an-owner) is enforced SERVER-side; this function
+ * only validates the role string locally and surfaces the server's error.
+ * Role string is validated BEFORE any network call so callers/tests can rely on
+ * a synchronous-shaped rejection for a bad role.
+ */
+export declare function changeMemberRole(token: string, companyUid: string, membershipKey: string, newRole: Role): Promise<void>;
 export declare function registerMembersCommand(program: Command): void;
 //# sourceMappingURL=members.d.ts.map

package/dist/commands/members.js

@@ -1,12 +1,11 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8244d720-094e-5d4e-b813-75086ed0849d")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="83a54ed2-3f52-5b6f-a784-09f78f488ddd")}catch(e){}}();
 import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
 const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
 export const VALID_ROLES = new Set(["owner", "admin", "member", "guest"]);
-const VALID_MEMBER_SET_ROLES = new Set(["admin", "member"]);
 export function detectTarget(target) {
     if (EMAIL_PATTERN.test(target)) {
         return { type: "email", value: target.trim().toLowerCase() };
@@ -265,9 +264,18 @@ export async function revokeInvite(token, tokenOrKey, companyUid) {
         throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText, err.code);
     }
 }
-async function setMemberRole(token, companyUid, membershipKey, newRole) {
-    if (!VALID_MEMBER_SET_ROLES.has(newRole)) {
-        throw new Error(`Invalid role '${newRole}': must be one of admin, member`);
+/**
+ * Change a member's role via `POST /membership/role`, accepting the FULL role
+ * set (owner|admin|member|guest). This is a GENERAL role change — it can promote
+ * OR demote. Authorization (owner-or-admin `changeRoles`, owner-only
+ * promote-to-owner / change-an-owner) is enforced SERVER-side; this function
+ * only validates the role string locally and surfaces the server's error.
+ * Role string is validated BEFORE any network call so callers/tests can rely on
+ * a synchronous-shaped rejection for a bad role.
+ */
+export async function changeMemberRole(token, companyUid, membershipKey, newRole) {
+    if (!VALID_ROLES.has(newRole)) {
+        throw new Error(`Invalid role '${newRole}': must be one of owner, admin, member, guest`);
     }
     const res = await vaultApiFetch({
         token,
@@ -285,16 +293,29 @@ export function registerMembersCommand(program) {
         .command("members")
         .description("Manage company memberships and invites")
         .option("--company <slug>", "Company slug (resolves to companyUid)");
+    // Canonical role-change command. `promote` is the discoverable verb users
+    // reach for; `set-role` is kept as an alias for the older name. The route is a
+    // GENERAL role change, so the help text and success message are honest that it
+    // can demote as well as promote. Authorization is enforced server-side.
     members
-        .command("set-role <membershipKey> <role>")
-        .description("Change a member or agent role to admin or member")
-        .action(async (membershipKey, role) => {
+        .command("promote <target> <newRole>")
+        .alias("set-role")
+        .description("Change a member's role (owner|admin|member|guest) — promotes OR demotes. " +
+        "<target> may be an email, a prs_ personUid, or a full membership key. " +
+        "Owner-or-admin only; setting a target to owner (or changing an owner) is owner-only. Server-enforced.")
+        .action(async (target, newRole) => {
         try {
+            const role = newRole.trim().toLowerCase();
+            if (!VALID_ROLES.has(role)) {
+                console.error(chalk.red(`Invalid role '${newRole}': must be one of owner, admin, member, guest`));
+                process.exit(1);
+            }
             const token = await ensureCognitoToken();
             const companySlug = members.opts().company;
             const companyUid = await getCompanyUid(token, companySlug);
-            await setMemberRole(token, companyUid, membershipKey, role);
-            console.log(chalk.green(`Updated role for '${membershipKey}' to ${role}`));
+            const membershipKey = resolveRevokeTargetToMembershipKey(target, companyUid);
+            await changeMemberRole(token, companyUid, membershipKey, role);
+            console.log(chalk.green(`Updated role for '${target}' to ${role}`));
         }
         catch (err) {
             if (err instanceof InviteHttpError) {
@@ -534,4 +555,4 @@ export function registerMembersCommand(program) {
     });
 }
 //# sourceMappingURL=members.js.map
-//# debugId=8244d720-094e-5d4e-b813-75086ed0849d
+//# debugId=83a54ed2-3f52-5b6f-a784-09f78f488ddd

package/dist/index.js

@@ -5,7 +5,7 @@
 // MUST be first: guard the Node version before any dependency that needs a
 // Node 20+ API (e.g. util.styleText) or a newer native ABI is evaluated.
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="82c44c14-a953-5644-9bf2-dd2c6d487d63")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6ad01242-c165-5be2-bb31-e929c0b38f5e")}catch(e){}}();
 import "./node-preflight.js";
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
@@ -48,6 +48,8 @@ import { registerSignalsCommand } from "./commands/signals.js";
 import { registerReindexCommand } from "./commands/reindex.js";
 import { registerRescueCommand } from "./commands/rescue.js";
 import { registerMcpCommand } from "./commands/mcp-status.js";
+import { registerCrmCommand } from "./commands/crm.js";
+import { registerCompanyCommand } from "./commands/company.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
 import { isEpipe } from "./utils/epipe.js";
@@ -173,6 +175,13 @@ registerRescueCommand(program);
 // provenance-based status across BOTH Claude + Codex runtimes (reads `_hqPack`
 // off the configs, NOT linkStatus), with secret-redacted output + `--json`.
 registerMcpCommand(program);
+// Native CRM entity upsert (subcommand group — `hq crm entity upsert`). Wraps
+// POST /crm/entities (the ontology write gate) so an authenticated company
+// member can create/update canonical CRM entities in the company vault.
+registerCrmCommand(program);
+// Company settings (subcommand group — `hq company settings set`). Owner-only
+// toggles for crmEnabled / ontologyEnabled via PUT /company-settings.
+registerCompanyCommand(program);
 (async () => {
     try {
         Sentry.addBreadcrumb({
@@ -233,4 +242,4 @@ registerMcpCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=82c44c14-a953-5644-9bf2-dd2c6d487d63
+//# debugId=6ad01242-c165-5be2-bb31-e929c0b38f5e

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.51.0",
+  "version": "5.53.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {