@indigoai-us/hq-cli 5.77.13 → 5.78.0

package/src/commands/members.test.ts

@@ -1,1474 +0,0 @@
-/**
- * Unit tests for `hq members invite|list|revoke|set-role` (members.ts).
- *
- * Coverage:
- *   - detectTarget — pure validation for email vs personUid vs invalid
- *   - getCallerPersonUid — happy path + missing-person-entity branch
- *   - inviteMember — email + personUid targets, --paths gating, HTTP errors
- *   - listPendingInvites — happy path + 403
- *   - revokeInvite — happy path + 404
- *   - set-role CLI surface — forwards membershipKey/newRole and surfaces 403
- */
-
-import { Command } from "commander";
-import { afterEach, beforeEach, describe, expect, it, vi, type MockInstance } from "vitest";
-
-vi.mock("../utils/cognito-session.js", async (importOriginal) => {
-  const original =
-    await importOriginal<typeof import("../utils/cognito-session.js")>();
-  return {
-    ...original,
-    ensureCognitoToken: vi.fn(async () => "test-token"),
-  };
-});
-
-vi.mock("../utils/vault-api.js", async (importOriginal) => {
-  const original = await importOriginal<typeof import("../utils/vault-api.js")>();
-  return {
-    ...original,
-    getCompanyUid: vi.fn(async () => "cmp_acme"),
-  };
-});
-
-import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { getCompanyUid } from "../utils/vault-api.js";
-import {
-  InviteHttpError,
-  changeMemberRole,
-  detectTarget,
-  formatInviteHttpError,
-  getCallerPersonUid,
-  inviteMember,
-  listActiveMembers,
-  listPendingInvites,
-  registerMembersCommand,
-  resendInvite,
-  resolveRoleChangeTarget,
-  resolveRevokeTargetToMembershipKey,
-  revokeInvite,
-} from "./members.js";
-
-function jsonResponse(status: number, body: unknown): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" },
-  });
-}
-
-let fetchSpy: MockInstance<typeof fetch>;
-const mockEnsureCognitoToken = vi.mocked(ensureCognitoToken);
-const mockGetCompanyUid = vi.mocked(getCompanyUid);
-
-beforeEach(() => {
-  vi.clearAllMocks();
-  fetchSpy = vi.spyOn(globalThis, "fetch");
-  mockEnsureCognitoToken.mockResolvedValue("test-token");
-  mockGetCompanyUid.mockResolvedValue("cmp_acme");
-});
-
-afterEach(() => {
-  vi.restoreAllMocks();
-});
-
-function buildMembersProgram(): Command {
-  const program = new Command();
-  program.name("hq").exitOverride();
-  registerMembersCommand(program);
-  return program;
-}
-
-// ---------------------------------------------------------------------------
-// detectTarget
-// ---------------------------------------------------------------------------
-
-describe("detectTarget", () => {
-  it("recognizes plain emails and lowercases them", () => {
-    expect(detectTarget("Alice@Example.com")).toEqual({
-      type: "email",
-      value: "alice@example.com",
-    });
-  });
-
-  it("recognizes person UIDs", () => {
-    expect(detectTarget("prs_bob123")).toEqual({
-      type: "person",
-      value: "prs_bob123",
-    });
-  });
-
-  it("recognizes fleet agent uids", () => {
-    expect(detectTarget("agt_01HXYZABCDEFGHJKMNPQRSTVWX")).toEqual({
-      type: "agent",
-      value: "agt_01HXYZABCDEFGHJKMNPQRSTVWX",
-      isAgent: true,
-    });
-  });
-
-  it("recognizes fleet agent machine emails", () => {
-    expect(
-      detectTarget("agt-01hxyzabcdefghjkmnpqrstvwx@agents.getindigo.ai"),
-    ).toEqual({
-      type: "email",
-      value: "agt-01hxyzabcdefghjkmnpqrstvwx@agents.getindigo.ai",
-      isAgent: true,
-    });
-  });
-
-  it("returns null for invalid targets", () => {
-    expect(detectTarget("not-a-target")).toBeNull();
-    expect(detectTarget("cmp_company")).toBeNull();
-    expect(detectTarget("")).toBeNull();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// getCallerPersonUid
-// ---------------------------------------------------------------------------
-
-describe("getCallerPersonUid", () => {
-  it("returns the personUid from the first membership", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        memberships: [
-          { membershipKey: "k1", personUid: "prs_admin", companyUid: "cmp_a", role: "owner", status: "active" },
-        ],
-      }),
-    );
-
-    const uid = await getCallerPersonUid("test-token");
-    expect(uid).toBe("prs_admin");
-  });
-
-  it("throws if the caller has no person entity yet", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { memberships: [] }));
-    await expect(getCallerPersonUid("test-token")).rejects.toThrow(/no person entity/);
-  });
-
-  it("throws on auth failure", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(401, { error: "unauthorized" }));
-    await expect(getCallerPersonUid("test-token")).rejects.toThrow(/run `hq login`/);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// inviteMember
-// ---------------------------------------------------------------------------
-
-describe("inviteMember", () => {
-  it("creates an invite for an email target and returns a magic link", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        membership: { role: "member", status: "pending" },
-        inviteToken: "tok_abc",
-      }),
-    );
-
-    const result = await inviteMember({
-      target: "alice@example.com",
-      role: "member",
-      companyUid: "cmp_acme",
-      callerUid: "prs_admin",
-      token: "test-token",
-    });
-
-    expect(result.magicLink).toBe("hq://accept/tok_abc");
-    expect(result.membership.role).toBe("member");
-
-    const call = fetchSpy.mock.calls[0];
-    const body = JSON.parse((call[1]?.body as string) ?? "{}");
-    expect(body).toEqual({
-      companyUid: "cmp_acme",
-      role: "member",
-      invitedBy: "prs_admin",
-      inviteeEmail: "alice@example.com",
-    });
-  });
-
-  it("creates an invite for a personUid target", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        membership: { role: "admin", status: "pending" },
-        inviteToken: "tok_456",
-      }),
-    );
-
-    await inviteMember({
-      target: "prs_bob",
-      role: "admin",
-      companyUid: "cmp_acme",
-      callerUid: "prs_admin",
-      token: "test-token",
-    });
-
-    const body = JSON.parse((fetchSpy.mock.calls[0][1]?.body as string) ?? "{}");
-    expect(body.personUid).toBe("prs_bob");
-    expect(body.inviteeEmail).toBeUndefined();
-  });
-
-  it("forwards allowedPrefixes when --paths is set with --role guest", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        membership: { role: "guest", status: "pending" },
-        inviteToken: "tok_guest",
-      }),
-    );
-
-    await inviteMember({
-      target: "alice@example.com",
-      role: "guest",
-      paths: "docs/, shared/",
-      companyUid: "cmp_acme",
-      callerUid: "prs_admin",
-      token: "test-token",
-    });
-
-    const body = JSON.parse((fetchSpy.mock.calls[0][1]?.body as string) ?? "{}");
-    expect(body.allowedPrefixes).toEqual(["docs/", "shared/"]);
-  });
-
-  it("rejects --paths with a non-guest role", async () => {
-    await expect(
-      inviteMember({
-        target: "alice@example.com",
-        role: "member",
-        paths: "docs/",
-        companyUid: "cmp_acme",
-        callerUid: "prs_admin",
-        token: "test-token",
-      }),
-    ).rejects.toThrow(/--paths is only valid with --role guest/);
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it("rejects an invalid target", async () => {
-    await expect(
-      inviteMember({
-        target: "not-a-target",
-        role: "member",
-        companyUid: "cmp_acme",
-        callerUid: "prs_admin",
-        token: "test-token",
-      }),
-    ).rejects.toThrow(/Invalid target/);
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it("invites a fleet agent by uid as member via /membership/invite", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(201, {
-        membership: {
-          membershipKey: "agt_01HXYZ#cmp_acme",
-          role: "member",
-          status: "active",
-        },
-        agentUid: "agt_01HXYZABCDEFGHJKMNPQRSTVWX",
-        hostCompanyUid: "cmp_host",
-        activationBilled: false,
-      }),
-    );
-
-    const result = await inviteMember({
-      target: "agt_01HXYZABCDEFGHJKMNPQRSTVWX",
-      role: "member",
-      companyUid: "cmp_acme",
-      callerUid: "prs_admin",
-      token: "test-token",
-    });
-
-    expect(result.membership.status).toBe("active");
-    expect(result.membership.role).toBe("member");
-    const body = JSON.parse((fetchSpy.mock.calls[0][1]?.body as string) ?? "{}");
-    expect(body.personUid).toBe("agt_01HXYZABCDEFGHJKMNPQRSTVWX");
-    expect(body.role).toBe("member");
-  });
-
-  it("rejects owner/guest roles for agent invites", async () => {
-    await expect(
-      inviteMember({
-        target: "agt-01hxyzabcdefghjkmnpqrstvwx@agents.getindigo.ai",
-        role: "owner",
-        companyUid: "cmp_acme",
-        callerUid: "prs_admin",
-        token: "test-token",
-      }),
-    ).rejects.toThrow(/member or admin/);
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it("rejects an unknown role", async () => {
-    await expect(
-      inviteMember({
-        target: "alice@example.com",
-        role: "superuser",
-        companyUid: "cmp_acme",
-        callerUid: "prs_admin",
-        token: "test-token",
-      }),
-    ).rejects.toThrow(/Invalid role/);
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it("wraps non-2xx responses in InviteHttpError", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(409, { error: "duplicate" }));
-
-    await expect(
-      inviteMember({
-        target: "alice@example.com",
-        role: "member",
-        companyUid: "cmp_acme",
-        callerUid: "prs_admin",
-        token: "test-token",
-      }),
-    ).rejects.toBeInstanceOf(InviteHttpError);
-  });
-
-  // HQ-11: inviting an already-active member returns 409 with the machine code
-  // MEMBERSHIP_ALREADY_EXISTS. The code must ride on the InviteHttpError so the
-  // `invite` command can treat it as a terminal "already a member" (no retry).
-  it("surfaces the server `code` (MEMBERSHIP_ALREADY_EXISTS) on the InviteHttpError", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(409, {
-        error:
-          "Membership already exists for person email:alice@example.com in company cmp_acme",
-        code: "MEMBERSHIP_ALREADY_EXISTS",
-      }),
-    );
-
-    const err = await inviteMember({
-      target: "alice@example.com",
-      role: "member",
-      companyUid: "cmp_acme",
-      callerUid: "prs_admin",
-      token: "test-token",
-    }).catch((e: unknown) => e);
-
-    expect(err).toBeInstanceOf(InviteHttpError);
-    expect((err as InviteHttpError).status).toBe(409);
-    expect((err as InviteHttpError).code).toBe("MEMBERSHIP_ALREADY_EXISTS");
-  });
-
-  it("resolves the token when it is nested on the membership row", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        membership: {
-          role: "admin",
-          status: "pending",
-          inviteToken: "tok_nested",
-        },
-      }),
-    );
-
-    const result = await inviteMember({
-      target: "alice@example.com",
-      role: "admin",
-      companyUid: "cmp_acme",
-      callerUid: "prs_admin",
-      token: "test-token",
-    });
-
-    expect(result.inviteToken).toBe("tok_nested");
-    expect(result.magicLink).toBe("hq://accept/tok_nested");
-  });
-
-  it("schemaVersion 2: no inviteToken in response → success with undefined magicLink", async () => {
-    // 2026-05-21 fix: the server moved to email-keyed authoritative
-    // membership rows (schemaVersion 2) — the invite IS created, but
-    // there is no token to redeem. The CLI must NOT throw here; instead
-    // the action handler prints "sign in with the invited email"
-    // instructions. Previously this case threw "did not include an
-    // invite token" which produced false-failure UX on a working invite.
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(201, {
-        membership: {
-          membershipKey: "email:alice@example.com#cmp_acme",
-          role: "member",
-          status: "pending",
-          inviteeEmail: "alice@example.com",
-          schemaVersion: 2,
-        },
-      }),
-    );
-
-    const result = await inviteMember({
-      target: "alice@example.com",
-      role: "member",
-      companyUid: "cmp_acme",
-      callerUid: "prs_admin",
-      token: "test-token",
-    });
-
-    expect(result.inviteToken).toBeUndefined();
-    expect(result.magicLink).toBeUndefined();
-    expect(result.membership.role).toBe("member");
-    expect(result.membership.status).toBe("pending");
-    expect(result.membership.membershipKey).toBe(
-      "email:alice@example.com#cmp_acme",
-    );
-    expect(result.membership.inviteeEmail).toBe("alice@example.com");
-  });
-
-  it("throws when the response has no membership row at all (server bug)", async () => {
-    // Belt-and-suspenders: a 2xx response with NO membership row is a
-    // server-side regression — surface it loudly so it doesn't silently
-    // succeed-but-do-nothing.
-    fetchSpy.mockResolvedValueOnce(jsonResponse(201, {}));
-
-    await expect(
-      inviteMember({
-        target: "alice@example.com",
-        role: "admin",
-        companyUid: "cmp_acme",
-        callerUid: "prs_admin",
-        token: "test-token",
-      }),
-    ).rejects.toThrow(/no membership row/);
-  });
-
-  // ---- sendEmail flag (hq-pro PR #140 contract) ---------------------------
-
-  it("forwards `sendEmail: true` in the request body when the option is set", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(201, {
-        membership: {
-          role: "member",
-          status: "pending",
-          inviteeEmail: "alice@example.com",
-          schemaVersion: 2,
-        },
-        resent: false,
-        emailSent: true,
-        emailSkipped: false,
-      }),
-    );
-
-    const result = await inviteMember({
-      target: "alice@example.com",
-      role: "member",
-      sendEmail: true,
-      companyUid: "cmp_acme",
-      callerUid: "prs_admin",
-      token: "test-token",
-    });
-
-    const body = JSON.parse((fetchSpy.mock.calls[0][1]?.body as string) ?? "{}");
-    expect(body.sendEmail).toBe(true);
-    expect(result.emailSent).toBe(true);
-    expect(result.emailSkipped).toBe(false);
-    expect(result.emailError).toBeUndefined();
-  });
-
-  it("omits sendEmail from the body when the option is unset (backward-compat with pre-resend hq-pro)", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(201, {
-        membership: {
-          role: "member",
-          status: "pending",
-          inviteeEmail: "alice@example.com",
-          schemaVersion: 2,
-        },
-      }),
-    );
-
-    const result = await inviteMember({
-      target: "alice@example.com",
-      role: "member",
-      companyUid: "cmp_acme",
-      callerUid: "prs_admin",
-      token: "test-token",
-    });
-
-    const body = JSON.parse((fetchSpy.mock.calls[0][1]?.body as string) ?? "{}");
-    expect("sendEmail" in body).toBe(false);
-    // Pre-resend hq-pro doesn't send the email fields at all — the CLI
-    // result fields stay undefined so the caller can detect "server has no
-    // opinion" vs "server explicitly skipped".
-    expect(result.emailSent).toBeUndefined();
-    expect(result.emailSkipped).toBeUndefined();
-  });
-
-  it("surfaces emailSkipped: true when hq-pro has no RESEND_API_KEY", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(201, {
-        membership: {
-          role: "member",
-          status: "pending",
-          inviteeEmail: "alice@example.com",
-          schemaVersion: 2,
-        },
-        resent: false,
-        emailSent: false,
-        emailSkipped: true,
-      }),
-    );
-
-    const result = await inviteMember({
-      target: "alice@example.com",
-      role: "member",
-      sendEmail: true,
-      companyUid: "cmp_acme",
-      callerUid: "prs_admin",
-      token: "test-token",
-    });
-
-    expect(result.emailSent).toBe(false);
-    expect(result.emailSkipped).toBe(true);
-  });
-
-  it("surfaces emailError when the server-side Resend send failed", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(201, {
-        membership: {
-          role: "member",
-          status: "pending",
-          inviteeEmail: "alice@example.com",
-          schemaVersion: 2,
-        },
-        resent: false,
-        emailSent: false,
-        emailSkipped: false,
-        emailError: "Resend 429: rate limited",
-      }),
-    );
-
-    const result = await inviteMember({
-      target: "alice@example.com",
-      role: "member",
-      sendEmail: true,
-      companyUid: "cmp_acme",
-      callerUid: "prs_admin",
-      token: "test-token",
-    });
-
-    expect(result.emailSent).toBe(false);
-    expect(result.emailError).toMatch(/Resend 429/);
-  });
-
-  // ---- groupIds (hq-pro PR #140 contract) ---------------------------------
-
-  it("forwards groupIds in the body when set on an email-keyed invite", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(201, {
-        membership: {
-          role: "member",
-          status: "pending",
-          inviteeEmail: "alice@example.com",
-          schemaVersion: 2,
-        },
-      }),
-    );
-
-    await inviteMember({
-      target: "alice@example.com",
-      role: "member",
-      groupIds: ["grp-1", "grp-2"],
-      companyUid: "cmp_acme",
-      callerUid: "prs_admin",
-      token: "test-token",
-    });
-
-    const body = JSON.parse((fetchSpy.mock.calls[0][1]?.body as string) ?? "{}");
-    expect(body.groupIds).toEqual(["grp-1", "grp-2"]);
-  });
-
-  it("rejects --groups combined with a personUid target before hitting the server", async () => {
-    await expect(
-      inviteMember({
-        target: "prs_bob",
-        role: "member",
-        groupIds: ["grp-1"],
-        companyUid: "cmp_acme",
-        callerUid: "prs_admin",
-        token: "test-token",
-      }),
-    ).rejects.toThrow(/email-keyed invites/);
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it("omits groupIds from the body when the array is empty", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(201, {
-        membership: {
-          role: "member",
-          status: "pending",
-          inviteeEmail: "alice@example.com",
-          schemaVersion: 2,
-        },
-      }),
-    );
-
-    await inviteMember({
-      target: "alice@example.com",
-      role: "member",
-      groupIds: [],
-      companyUid: "cmp_acme",
-      callerUid: "prs_admin",
-      token: "test-token",
-    });
-
-    const body = JSON.parse((fetchSpy.mock.calls[0][1]?.body as string) ?? "{}");
-    expect("groupIds" in body).toBe(false);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// resendInvite (hq-pro PR #140 resend: true short-circuit)
-// ---------------------------------------------------------------------------
-
-describe("resendInvite", () => {
-  it("posts { resend: true, inviteeEmail, companyUid, role: 'member' } and returns the resent result", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        resent: true,
-        emailSent: true,
-        emailSkipped: false,
-      }),
-    );
-
-    const result = await resendInvite({
-      inviteeEmail: "Alice@Example.com",
-      companyUid: "cmp_acme",
-      callerUid: "prs_admin",
-      token: "test-token",
-    });
-
-    expect(result).toEqual({
-      resent: true,
-      emailSent: true,
-      emailSkipped: false,
-    });
-    const body = JSON.parse((fetchSpy.mock.calls[0][1]?.body as string) ?? "{}");
-    expect(body).toEqual({
-      companyUid: "cmp_acme",
-      // Server still requires `role` even on the resend short-circuit; the
-      // CLI passes the safe default. Server ignores it on this path.
-      role: "member",
-      // Email normalized to lowercase before send.
-      inviteeEmail: "alice@example.com",
-      invitedBy: "prs_admin",
-      resend: true,
-    });
-  });
-
-  it("surfaces emailSkipped: true when hq-pro has no RESEND_API_KEY", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        resent: true,
-        emailSent: false,
-        emailSkipped: true,
-      }),
-    );
-
-    const result = await resendInvite({
-      inviteeEmail: "alice@example.com",
-      companyUid: "cmp_acme",
-      callerUid: "prs_admin",
-      token: "test-token",
-    });
-
-    expect(result.emailSent).toBe(false);
-    expect(result.emailSkipped).toBe(true);
-  });
-
-  it("throws on a non-email target — the resend path is email-keyed-row only", async () => {
-    await expect(
-      resendInvite({
-        inviteeEmail: "prs_bob",
-        companyUid: "cmp_acme",
-        callerUid: "prs_admin",
-        token: "test-token",
-      }),
-    ).rejects.toThrow(/email target/);
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it("wraps a 404 INVITE_NOT_PENDING in InviteHttpError so the action handler can format it", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(404, {
-        error: "no pending row",
-        code: "INVITE_NOT_PENDING",
-      }),
-    );
-
-    await expect(
-      resendInvite({
-        inviteeEmail: "alice@example.com",
-        companyUid: "cmp_acme",
-        callerUid: "prs_admin",
-        token: "test-token",
-      }),
-    ).rejects.toBeInstanceOf(InviteHttpError);
-  });
-
-  it("rejects a 2xx response that lacks `resent: true` — guard against a pre-resend hq-pro silently dropping the flag", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, { membership: { role: "member", status: "pending" } }),
-    );
-
-    await expect(
-      resendInvite({
-        inviteeEmail: "alice@example.com",
-        companyUid: "cmp_acme",
-        callerUid: "prs_admin",
-        token: "test-token",
-      }),
-    ).rejects.toThrow(/doesn't support `resend: true` yet/);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// listPendingInvites
-// ---------------------------------------------------------------------------
-
-describe("listPendingInvites", () => {
-  it("returns the parsed invites array", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        invites: [
-          {
-            membershipKey: "k1",
-            inviteeEmail: "alice@example.com",
-            companyUid: "cmp_acme",
-            role: "member",
-            status: "pending",
-            invitedBy: "prs_admin",
-            invitedAt: "2026-05-04T12:00:00Z",
-          },
-        ],
-      }),
-    );
-
-    const invites = await listPendingInvites("test-token", "cmp_acme");
-    expect(invites).toHaveLength(1);
-    expect(invites[0].inviteeEmail).toBe("alice@example.com");
-  });
-
-  it("throws InviteHttpError on 403", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(403, { error: "forbidden" }));
-    await expect(listPendingInvites("test-token", "cmp_acme")).rejects.toBeInstanceOf(
-      InviteHttpError,
-    );
-  });
-
-  it("returns [] for an empty invites array", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { invites: [] }));
-    await expect(listPendingInvites("test-token", "cmp_acme")).resolves.toEqual([]);
-  });
-
-  it("returns [] when invites is null", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { invites: null }));
-    await expect(listPendingInvites("test-token", "cmp_acme")).resolves.toEqual([]);
-  });
-
-  it("returns [] when the invites key is missing", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-    await expect(listPendingInvites("test-token", "cmp_acme")).resolves.toEqual([]);
-  });
-
-  it("schemaVersion 2: reads `pending` key (the canonical server response)", async () => {
-    // 2026-05-21 fix: live server returns `{ pending: [...] }`, not
-    // `{ invites: [...] }`. The CLI must read `pending` as the primary
-    // and fall back to `invites` for older stages.
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        pending: [
-          {
-            membershipKey: "email:alice@example.com#cmp_acme",
-            inviteeEmail: "alice@example.com",
-            companyUid: "cmp_acme",
-            role: "member",
-            status: "pending",
-            invitedBy: "prs_admin",
-            invitedAt: "2026-05-21T12:00:00Z",
-            schemaVersion: 2,
-          },
-        ],
-      }),
-    );
-
-    const invites = await listPendingInvites("test-token", "cmp_acme");
-    expect(invites).toHaveLength(1);
-    expect(invites[0].membershipKey).toBe("email:alice@example.com#cmp_acme");
-    expect(invites[0].inviteeEmail).toBe("alice@example.com");
-  });
-
-  it("prefers `pending` over legacy `invites` when both present (server transition)", async () => {
-    // Defensive: an in-flight server deploy could briefly return BOTH
-    // fields. CLI takes the canonical `pending` key.
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        pending: [{ membershipKey: "k_pending" } as never],
-        invites: [{ membershipKey: "k_legacy" } as never],
-      }),
-    );
-    const invites = await listPendingInvites("test-token", "cmp_acme");
-    expect(invites).toHaveLength(1);
-    expect(invites[0].membershipKey).toBe("k_pending");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// listActiveMembers
-// ---------------------------------------------------------------------------
-
-describe("listActiveMembers", () => {
-  it("GETs /membership/company/{uid} and returns the members array", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        members: [
-          {
-            membershipKey: "k1",
-            personUid: "prs_alice",
-            companyUid: "cmp_acme",
-            role: "owner",
-            status: "active",
-            personEmail: "alice@example.com",
-            personName: "Alice",
-          },
-        ],
-      }),
-    );
-
-    const members = await listActiveMembers("test-token", "cmp_acme");
-
-    const call = fetchSpy.mock.calls[0];
-    expect(String(call[0])).toMatch(/\/membership\/company\/cmp_acme$/);
-    expect(members).toHaveLength(1);
-    expect(members[0].personEmail).toBe("alice@example.com");
-    expect(members[0].role).toBe("owner");
-  });
-
-  it("returns [] when the members key is missing", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-    await expect(
-      listActiveMembers("test-token", "cmp_acme"),
-    ).resolves.toEqual([]);
-  });
-
-  it("returns [] when members is null", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { members: null }));
-    await expect(
-      listActiveMembers("test-token", "cmp_acme"),
-    ).resolves.toEqual([]);
-  });
-
-  it("throws InviteHttpError on non-ok", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(403, { error: "forbidden" }));
-    await expect(
-      listActiveMembers("test-token", "cmp_acme"),
-    ).rejects.toBeInstanceOf(InviteHttpError);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// registerMembersCommand list
-// ---------------------------------------------------------------------------
-
-describe("registerMembersCommand list", () => {
-  it("defaults to ACTIVE members: renders EMAIL/ROLE/NAME + the share hint", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        members: [
-          {
-            membershipKey: "k1",
-            personUid: "prs_alice",
-            companyUid: "cmp_acme",
-            role: "owner",
-            status: "active",
-            personEmail: "alice@example.com",
-            personName: "Alice",
-          },
-          {
-            membershipKey: "k2",
-            personUid: "prs_bob",
-            companyUid: "cmp_acme",
-            role: "member",
-            status: "active",
-            personSlug: "bob",
-          },
-        ],
-      }),
-    );
-    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
-    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
-
-    await buildMembersProgram().parseAsync(
-      ["members", "--company", "acme", "list"],
-      { from: "user" },
-    );
-
-    const call = fetchSpy.mock.calls[0];
-    expect(String(call[0])).toMatch(/\/membership\/company\/cmp_acme$/);
-    const output = logSpy.mock.calls.map((c) => String(c[0])).join("\n");
-    expect(output).toContain("EMAIL");
-    expect(output).toContain("ROLE");
-    expect(output).toContain("NAME");
-    expect(output).toContain("alice@example.com");
-    expect(output).toContain("owner");
-    expect(output).toContain("Alice");
-    // unresolved email falls back to personUid; name falls back to slug
-    expect(output).toContain("prs_bob");
-    expect(output).toContain("bob");
-    expect(output).toContain(
-      "hq secrets share <path> --with <email>",
-    );
-    expect(errSpy).not.toHaveBeenCalled();
-  });
-
-  it("default active: empty roster prints the no-active-members message", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { members: [] }));
-    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
-
-    await buildMembersProgram().parseAsync(
-      ["members", "--company", "acme", "list"],
-      { from: "user" },
-    );
-
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining("No active members found for this company."),
-    );
-  });
-
-  it("--pending preserves the OLD pending-invites table verbatim", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        pending: [
-          {
-            membershipKey: "email:alice@example.com#cmp_acme",
-            inviteeEmail: "alice@example.com",
-            companyUid: "cmp_acme",
-            role: "member",
-            status: "pending",
-            invitedBy: "prs_admin",
-            invitedAt: "2026-05-21T12:00:00Z",
-          },
-        ],
-      }),
-    );
-    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
-    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
-
-    await buildMembersProgram().parseAsync(
-      ["members", "--company", "acme", "list", "--pending"],
-      { from: "user" },
-    );
-
-    const call = fetchSpy.mock.calls[0];
-    expect(String(call[0])).toMatch(
-      /\/membership\/company\/cmp_acme\/pending$/,
-    );
-    const output = logSpy.mock.calls.map((c) => String(c[0])).join("\n");
-    expect(output).toContain("TARGET");
-    expect(output).toContain("INVITED_BY");
-    expect(output).toContain("MEMBERSHIP_KEY");
-    expect(output).toContain("alice@example.com");
-    // the active-only share hint must NOT appear in the pending view
-    expect(output).not.toContain("hq secrets share");
-    expect(errSpy).not.toHaveBeenCalled();
-  });
-
-  it("--pending: empty invites prints the no-pending-invites message", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { pending: [] }));
-    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
-
-    await buildMembersProgram().parseAsync(
-      ["members", "--company", "acme", "list", "--pending"],
-      { from: "user" },
-    );
-
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining("No pending invites for this company."),
-    );
-  });
-});
-
-// ---------------------------------------------------------------------------
-// revokeInvite
-// ---------------------------------------------------------------------------
-
-describe("revokeInvite", () => {
-  it("posts membershipKey + companyUid", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-
-    await revokeInvite("test-token", "k1", "cmp_acme");
-
-    const body = JSON.parse((fetchSpy.mock.calls[0][1]?.body as string) ?? "{}");
-    expect(body).toEqual({ membershipKey: "k1", companyUid: "cmp_acme" });
-  });
-
-  it("throws InviteHttpError on 404", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(404, { error: "not found" }));
-    await expect(revokeInvite("test-token", "k1", "cmp_acme")).rejects.toBeInstanceOf(
-      InviteHttpError,
-    );
-  });
-});
-
-// ---------------------------------------------------------------------------
-// registerMembersCommand set-role
-// ---------------------------------------------------------------------------
-
-describe("registerMembersCommand set-role", () => {
-  it("forwards membershipKey + newRole to /membership/role", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
-    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
-
-    await buildMembersProgram().parseAsync(
-      ["members", "--company", "acme", "set-role", "agt_ops#cmp_acme", "admin"],
-      { from: "user" },
-    );
-
-    expect(mockEnsureCognitoToken).toHaveBeenCalledTimes(1);
-    expect(mockGetCompanyUid).toHaveBeenCalledWith("test-token", "acme");
-    expect(fetchSpy).toHaveBeenCalledTimes(1);
-
-    const call = fetchSpy.mock.calls[0];
-    expect(String(call[0])).toMatch(/\/membership\/role$/);
-    expect(call[1]?.method).toBe("POST");
-    const body = JSON.parse((call[1]?.body as string) ?? "{}");
-    expect(body).toEqual({
-      companyUid: "cmp_acme",
-      membershipKey: "agt_ops#cmp_acme",
-      newRole: "admin",
-    });
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining("Updated role for 'agt_ops#cmp_acme' to admin"),
-    );
-    expect(errSpy).not.toHaveBeenCalled();
-  });
-
-  it("surfaces a backend 403 verbatim and exits non-zero", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(403, { error: "Only owners can change member roles." }),
-    );
-    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
-    vi.spyOn(console, "log").mockImplementation(() => undefined);
-    vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
-      throw new Error(`__EXIT__:${code ?? 0}`);
-    }) as never);
-
-    await expect(
-      buildMembersProgram().parseAsync(
-        ["members", "--company", "acme", "set-role", "agt_ops#cmp_acme", "admin"],
-        { from: "user" },
-      ),
-    ).rejects.toThrow("__EXIT__:1");
-
-    expect(errSpy).toHaveBeenCalledWith(
-      expect.stringContaining("Only owners can change member roles."),
-    );
-  });
-});
-
-// ---------------------------------------------------------------------------
-// changeMemberRole + the unified `promote` command (alias `set-role`)
-// ---------------------------------------------------------------------------
-
-describe("changeMemberRole", () => {
-  it("rejects an invalid role WITHOUT making a network call", async () => {
-    await expect(
-      changeMemberRole(
-        "test-token",
-        "cmp_acme",
-        "prs_x#cmp_acme",
-        "superuser" as never,
-      ),
-    ).rejects.toThrow("must be one of owner, admin, member, guest");
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it("accepts the full role set and POSTs to /membership/role", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-    await changeMemberRole("test-token", "cmp_acme", "prs_x#cmp_acme", "guest");
-    const call = fetchSpy.mock.calls[0];
-    expect(String(call[0])).toMatch(/\/membership\/role$/);
-    const body = JSON.parse((call[1]?.body as string) ?? "{}");
-    expect(body).toEqual({
-      companyUid: "cmp_acme",
-      membershipKey: "prs_x#cmp_acme",
-      newRole: "guest",
-    });
-  });
-});
-
-describe("registerMembersCommand promote", () => {
-  it("resolves an email target and promotes to a full-set role the old set-role couldn't (admin)", async () => {
-    fetchSpy
-      .mockResolvedValueOnce(
-        jsonResponse(200, {
-          members: [
-            {
-              membershipKey: "prs_alice#cmp_acme",
-              personUid: "prs_alice",
-              companyUid: "cmp_acme",
-              role: "member",
-              status: "active",
-              personEmail: "Alice@Example.com",
-            },
-          ],
-        }),
-      )
-      .mockResolvedValueOnce(jsonResponse(200, {}));
-    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
-
-    await buildMembersProgram().parseAsync(
-      ["members", "--company", "acme", "promote", "alice@example.com", "admin"],
-      { from: "user" },
-    );
-
-    expect(String(fetchSpy.mock.calls[0][0])).toMatch(
-      /\/membership\/company\/cmp_acme$/,
-    );
-    const call = fetchSpy.mock.calls[1];
-    expect(String(call[0])).toMatch(/\/membership\/role$/);
-    const body = JSON.parse((call[1]?.body as string) ?? "{}");
-    expect(body).toEqual({
-      companyUid: "cmp_acme",
-      membershipKey: "prs_alice#cmp_acme",
-      newRole: "admin",
-    });
-    expect(body.membershipKey).not.toContain("email:");
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining("Updated role for 'alice@example.com' to admin"),
-    );
-    // Clarifies that admins already have full context access automatically
-    // (no separate grant) and that sync mode governs local visibility.
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining(
-        "Admins automatically have full read and write access",
-      ),
-    );
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining("governed by their sync mode"),
-    );
-  });
-
-  it("fails clearly when no active member matches an email and never posts a role change", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, { members: [] }));
-    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
-    vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
-      throw new Error(`__EXIT__:${code ?? 0}`);
-    }) as never);
-
-    await expect(
-      buildMembersProgram().parseAsync(
-        [
-          "members",
-          "--company",
-          "acme",
-          "promote",
-          "missing@example.com",
-          "admin",
-        ],
-        { from: "user" },
-      ),
-    ).rejects.toThrow("__EXIT__:1");
-
-    const errorOutput = errSpy.mock.calls
-      .flatMap((call) => call.map(String))
-      .join(" ");
-    expect(errorOutput).toContain(
-      "No active member has email 'missing@example.com'",
-    );
-    expect(errorOutput).toContain("hq members list");
-    expect(fetchSpy).toHaveBeenCalledTimes(1);
-    expect(
-      fetchSpy.mock.calls.some(
-        ([url, init]) =>
-          String(url).endsWith("/membership/role") && init?.method === "POST",
-      ),
-    ).toBe(false);
-  });
-
-  it("forwards a personUid target and the guest role (beyond set-role's admin|member cap)", async () => {
-    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
-    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
-
-    await buildMembersProgram().parseAsync(
-      ["members", "--company", "acme", "promote", "prs_bob", "guest"],
-      { from: "user" },
-    );
-
-    const body = JSON.parse(
-      (fetchSpy.mock.calls[0]?.[1]?.body as string) ?? "{}",
-    );
-    expect(body).toEqual({
-      companyUid: "cmp_acme",
-      membershipKey: "prs_bob#cmp_acme",
-      newRole: "guest",
-    });
-    // The full-access clarification applies ONLY to the role-bypass roles
-    // (owner/admin) — a guest/member promotion must not claim full access.
-    expect(logSpy).not.toHaveBeenCalledWith(
-      expect.stringContaining("full read and write access"),
-    );
-  });
-
-  it("rejects an invalid role at the CLI and exits non-zero without a network call", async () => {
-    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
-    vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
-      throw new Error(`__EXIT__:${code ?? 0}`);
-    }) as never);
-
-    await expect(
-      buildMembersProgram().parseAsync(
-        ["members", "--company", "acme", "promote", "alice@example.com", "wizard"],
-        { from: "user" },
-      ),
-    ).rejects.toThrow("__EXIT__:1");
-
-    expect(errSpy).toHaveBeenCalledWith(
-      expect.stringContaining("must be one of owner, admin, member, guest"),
-    );
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it("surfaces a backend 403 verbatim (server-enforced authorization)", async () => {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(403, { error: "Only an owner may promote a member to owner" }),
-    );
-    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
-    vi.spyOn(console, "log").mockImplementation(() => undefined);
-    vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
-      throw new Error(`__EXIT__:${code ?? 0}`);
-    }) as never);
-
-    await expect(
-      buildMembersProgram().parseAsync(
-        ["members", "--company", "acme", "promote", "prs_bob", "owner"],
-        { from: "user" },
-      ),
-    ).rejects.toThrow("__EXIT__:1");
-
-    expect(errSpy).toHaveBeenCalledWith(
-      expect.stringContaining("Only an owner may promote a member to owner"),
-    );
-  });
-});
-
-describe("resolveRoleChangeTarget", () => {
-  it("passes through a full membership key without fetching members", async () => {
-    await expect(
-      resolveRoleChangeTarget(
-        "test-token",
-        "cmp_acme",
-        "prs_alice#cmp_acme",
-      ),
-    ).resolves.toBe("prs_alice#cmp_acme");
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it("wraps bare person and agent uids without fetching members", async () => {
-    await expect(
-      resolveRoleChangeTarget("test-token", "cmp_acme", "prs_alice"),
-    ).resolves.toBe("prs_alice#cmp_acme");
-    await expect(
-      resolveRoleChangeTarget("test-token", "cmp_acme", "agt_ops"),
-    ).resolves.toBe("agt_ops#cmp_acme");
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-
-  it("maps agent machine emails to agt_…#companyUid without fetching members", async () => {
-    await expect(
-      resolveRoleChangeTarget(
-        "test-token",
-        "cmp_acme",
-        "agt-01hxyzabcdefghjkmnpqrstvwx@agents.getindigo.ai",
-      ),
-    ).resolves.toBe("agt_01HXYZABCDEFGHJKMNPQRSTVWX#cmp_acme");
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// registerMembersCommand invite — MEMBERSHIP_ALREADY_EXISTS messaging
-// ---------------------------------------------------------------------------
-
-describe("registerMembersCommand invite 409 messaging", () => {
-  function mockCallerIdentity(): void {
-    fetchSpy.mockResolvedValueOnce(
-      jsonResponse(200, {
-        memberships: [
-          {
-            membershipKey: "prs_admin#cmp_acme",
-            personUid: "prs_admin",
-            companyUid: "cmp_acme",
-            role: "owner",
-            status: "active",
-          },
-        ],
-      }),
-    );
-  }
-
-  it("guides --resend when the conflict is a pending invite", async () => {
-    mockCallerIdentity();
-    fetchSpy
-      .mockResolvedValueOnce(
-        jsonResponse(409, {
-          error: "Membership already exists",
-          code: "MEMBERSHIP_ALREADY_EXISTS",
-        }),
-      )
-      .mockResolvedValueOnce(
-        jsonResponse(200, {
-          pending: [
-            {
-              membershipKey: "email:alice@example.com#cmp_acme",
-              inviteeEmail: "alice@example.com",
-              companyUid: "cmp_acme",
-              role: "member",
-              status: "pending",
-              invitedBy: "prs_admin",
-              invitedAt: "2026-05-21T12:00:00Z",
-            },
-          ],
-        }),
-      );
-
-    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
-    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
-
-    await buildMembersProgram().parseAsync(
-      ["members", "--company", "acme", "invite", "Alice@Example.com"],
-      { from: "user" },
-    );
-
-    const output = logSpy.mock.calls.map((c) => String(c[0])).join("\n");
-    expect(output).toContain("already has a pending invite");
-    expect(output).toContain(
-      "hq members invite alice@example.com --company acme --resend",
-    );
-    expect(output).not.toContain("already a member of this company");
-    expect(errSpy).not.toHaveBeenCalled();
-  });
-
-  it("keeps the already-member note when the conflict is an active member", async () => {
-    mockCallerIdentity();
-    fetchSpy
-      .mockResolvedValueOnce(
-        jsonResponse(409, {
-          error: "Membership already exists",
-          code: "MEMBERSHIP_ALREADY_EXISTS",
-        }),
-      )
-      .mockResolvedValueOnce(jsonResponse(200, { pending: [] }))
-      .mockResolvedValueOnce(
-        jsonResponse(200, {
-          members: [
-            {
-              membershipKey: "prs_alice#cmp_acme",
-              personUid: "prs_alice",
-              companyUid: "cmp_acme",
-              role: "member",
-              status: "active",
-              personEmail: "alice@example.com",
-            },
-          ],
-        }),
-      );
-
-    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
-
-    await buildMembersProgram().parseAsync(
-      ["members", "--company", "acme", "invite", "alice@example.com"],
-      { from: "user" },
-    );
-
-    const output = logSpy.mock.calls.map((c) => String(c[0])).join("\n");
-    expect(output).toContain("already a member of this company");
-    expect(output).not.toContain("pending invite");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// resolveRevokeTargetToMembershipKey
-// ---------------------------------------------------------------------------
-
-describe("resolveRevokeTargetToMembershipKey", () => {
-  it("wraps fleet agent uids as agt_…#companyUid", () => {
-    expect(
-      resolveRevokeTargetToMembershipKey(
-        "agt_01HXYZABCDEFGHJKMNPQRSTVWX",
-        "cmp_abc",
-      ),
-    ).toBe("agt_01HXYZABCDEFGHJKMNPQRSTVWX#cmp_abc");
-  });
-
-  it("maps agent machine emails to agt_…#companyUid (active guest memberships)", () => {
-    expect(
-      resolveRevokeTargetToMembershipKey(
-        "agt-01hxyzabcdefghjkmnpqrstvwx@agents.getindigo.ai",
-        "cmp_abc",
-      ),
-    ).toBe("agt_01HXYZABCDEFGHJKMNPQRSTVWX#cmp_abc");
-  });
-
-  // Regression: `hq members revoke alice@example.com` used to send the raw
-  // email straight to /membership/revoke, which the server rejects with 404
-  // "Invite not found" because it keys on `email:<email>#<companyUid>`. Live
-  // smoke 2026-05-21 reproduced this against indigo.
-  it("wraps a bare email into the email-keyed membership shape", () => {
-    expect(
-      resolveRevokeTargetToMembershipKey("alice@example.com", "cmp_abc"),
-    ).toBe("email:alice@example.com#cmp_abc");
-  });
-
-  it("lowercases the email when wrapping", () => {
-    expect(
-      resolveRevokeTargetToMembershipKey("Alice@Example.COM", "cmp_abc"),
-    ).toBe("email:alice@example.com#cmp_abc");
-  });
-
-  it("wraps a bare personUid into the personUid-keyed membership shape", () => {
-    expect(resolveRevokeTargetToMembershipKey("prs_bob123", "cmp_abc")).toBe(
-      "prs_bob123#cmp_abc",
-    );
-  });
-
-  it("passes through a full email-keyed membership key unchanged", () => {
-    expect(
-      resolveRevokeTargetToMembershipKey(
-        "email:alice@example.com#cmp_abc",
-        "cmp_other",
-      ),
-    ).toBe("email:alice@example.com#cmp_abc");
-  });
-
-  it("passes through a full personUid-keyed membership key unchanged", () => {
-    expect(
-      resolveRevokeTargetToMembershipKey("prs_bob#cmp_abc", "cmp_other"),
-    ).toBe("prs_bob#cmp_abc");
-  });
-
-  it("passes through unrecognized strings (legacy inviteToken, garbage)", () => {
-    // A schemaVersion-1 inviteToken is opaque base64url; we can't tell it
-    // apart from garbage. Send it to the server and let the server 404 if
-    // it doesn't resolve.
-    expect(
-      resolveRevokeTargetToMembershipKey("some-opaque-token", "cmp_abc"),
-    ).toBe("some-opaque-token");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// formatInviteHttpError
-// ---------------------------------------------------------------------------
-
-describe("formatInviteHttpError", () => {
-  it("maps 401 to a login hint", () => {
-    expect(formatInviteHttpError(401, "ignored")).toMatch(/run `hq login`/);
-  });
-  it("maps 403 to admin/owner hint", () => {
-    expect(formatInviteHttpError(403, "ignored")).toMatch(/admins and owners/);
-  });
-  it("maps 409 to duplicate-invite hint", () => {
-    expect(formatInviteHttpError(409, "ignored")).toMatch(/already has a membership/);
-  });
-  it("prefixes 5xx with 'Server error:'", () => {
-    expect(formatInviteHttpError(500, "boom")).toBe("Server error: boom");
-  });
-  it("falls through to the message for unmapped statuses", () => {
-    expect(formatInviteHttpError(400, "bad input")).toBe("bad input");
-  });
-});