@indigoai-us/hq-cli 5.9.0 → 5.10.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [5.10.0] — 2026-05-04
+
+### Added
+
+- **`hq cloud demote company <slug>` subcommand** — inverse of
+  `hq cloud provision company`. Converts a cloud-backed company back to local-only
+  after its entity has been soft-tombstoned in hq-console (Settings → Delete company).
+  Removes `companies/<slug>/.hq/config.json`, flips `cloud: true → false` in
+  `companies/<slug>/company.yaml`, and strips `cloud_uid` + `bucket_name` from
+  `companies/manifest.yaml`. Default safety check verifies the cloud entity is
+  `deleted=true`; `--force` skips the check (used by AppBar HQ Sync's Path A after
+  it has already verified). All side-effects atomic + idempotent. Exit codes mirror
+  `cloud provision` (0 ok, 1 vault HTTP, 2 validation).
+
 ## [5.9.0] — 2026-05-04
 
 ### Added

package/dist/commands/cloud-demote.d.ts

@@ -0,0 +1,90 @@
+/**
+ * `hq cloud demote company <slug>` — convert a cloud-backed company back to
+ * local-only after hq-pro has soft-tombstoned its entity (Settings → Delete
+ * company in hq-console).
+ *
+ * Inverse of `hq cloud provision company <slug>`. Both commands live here in
+ * hq-cli so the file-touching contract (manifest patch + per-folder config
+ * write + company.yaml mutation) is single-sourced. AppBar HQ Sync's Path A
+ * shells out to this command on the `deleted=true` branch instead of
+ * re-implementing the file mutations in Rust.
+ *
+ * Side-effects (all atomic + idempotent):
+ *   1. Remove `companies/<slug>/.hq/config.json`.
+ *   2. Flip `cloud: true → false` in `companies/<slug>/company.yaml`. Without
+ *      this flip the next `provisionCompany` would re-mint a fresh cloud
+ *      company — exactly what the user just deleted.
+ *   3. Strip `cloud_uid` + `bucket_name` from `companies/manifest.yaml`'s
+ *      `companies.<slug>` entry. The slug entry + other fields stay.
+ *
+ * Safety check (default on): `findCompanyBySlug` MUST return an entity with
+ * `deleted: true`. A live entity, or no entity at all, refuses with code 2.
+ * `--force` skips the network call (AppBar passes it because Path A just
+ * checked).
+ *
+ * Exit codes (mirrors cloud-provision):
+ *   0 — success or idempotent no-op.
+ *   1 — vault HTTP failure during the safety check.
+ *   2 — validation (bad slug, missing dir/manifest, cloud not deleted).
+ */
+import { Command } from "commander";
+import { type VaultClient } from "./cloud-provision.js";
+/** Final stdout JSON shape. AppBar parses this. */
+export interface DemoteResult {
+    ok: boolean;
+    company_slug: string;
+    /** True if `.hq/config.json` was actually deleted (false if absent). */
+    config_removed: boolean;
+    /** True if `company.yaml`'s `cloud` was changed (true→false or absent→false). */
+    yaml_flipped: boolean;
+    /** True if manifest had `cloud_uid` / `bucket_name` to strip. */
+    manifest_stripped: boolean;
+    /**
+     * `true` when the cloud entity verified as `deleted=true`. `null` when
+     * `--force` was used and the verify was skipped. (`false` is unreachable —
+     * a non-deleted entity throws code 2 before reaching the result.)
+     */
+    cloud_was_deleted: boolean | null;
+}
+export interface DemoteCompanyOptions {
+    slug: string;
+    hqRoot: string;
+    vaultApiUrl: string;
+    /** Skip the `findCompanyBySlug` safety check. AppBar uses this. */
+    force?: boolean;
+    /** Injected vault HTTP client (override for tests). */
+    vaultClient?: VaultClient;
+    /** Injected access-token resolver (override for tests). */
+    resolveAccessToken?: () => Promise<string>;
+}
+/**
+ * Flip `cloud: true → false` in `companies/<slug>/company.yaml`. All other
+ * keys + ordering preserved (js-yaml round-trip). Atomic (tmp + rename).
+ *
+ * Returns true if the file was changed, false if no-op (file missing, or
+ * `cloud` was already `false`).
+ *
+ * NOTE: js-yaml doesn't preserve comments, but this matches what
+ * `patchManifest` already does — accepted trade-off.
+ */
+export declare function flipCompanyYamlCloudOff(hqRoot: string, slug: string): boolean;
+/**
+ * Remove `cloud_uid` + `bucket_name` from `companies.<slug>` in
+ * `companies/manifest.yaml`. The slug entry is preserved (other fields like
+ * `name`/`status`/`path` stay). Atomic (tmp + rename).
+ *
+ * Returns true if the file was changed, false if no-op (manifest missing,
+ * slug missing, or both fields already absent).
+ */
+export declare function stripManifestCloudForSlug(hqRoot: string, slug: string): boolean;
+/**
+ * Run the full demote flow. Returns a `DemoteResult` on success; throws
+ * `ProvisionError` (codes 1 or 2) on any failure.
+ */
+export declare function demoteCompany(options: DemoteCompanyOptions): Promise<DemoteResult>;
+/**
+ * Register `demote company <slug>` under the `cloud` command group. Wired in
+ * `src/index.ts` alongside `registerCloudProvisionCommands(cloudCmd)`.
+ */
+export declare function registerCloudDemoteCommands(program: Command): void;
+//# sourceMappingURL=cloud-demote.d.ts.map

package/dist/commands/cloud-demote.js

@@ -0,0 +1,193 @@
+/**
+ * `hq cloud demote company <slug>` — convert a cloud-backed company back to
+ * local-only after hq-pro has soft-tombstoned its entity (Settings → Delete
+ * company in hq-console).
+ *
+ * Inverse of `hq cloud provision company <slug>`. Both commands live here in
+ * hq-cli so the file-touching contract (manifest patch + per-folder config
+ * write + company.yaml mutation) is single-sourced. AppBar HQ Sync's Path A
+ * shells out to this command on the `deleted=true` branch instead of
+ * re-implementing the file mutations in Rust.
+ *
+ * Side-effects (all atomic + idempotent):
+ *   1. Remove `companies/<slug>/.hq/config.json`.
+ *   2. Flip `cloud: true → false` in `companies/<slug>/company.yaml`. Without
+ *      this flip the next `provisionCompany` would re-mint a fresh cloud
+ *      company — exactly what the user just deleted.
+ *   3. Strip `cloud_uid` + `bucket_name` from `companies/manifest.yaml`'s
+ *      `companies.<slug>` entry. The slug entry + other fields stay.
+ *
+ * Safety check (default on): `findCompanyBySlug` MUST return an entity with
+ * `deleted: true`. A live entity, or no entity at all, refuses with code 2.
+ * `--force` skips the network call (AppBar passes it because Path A just
+ * checked).
+ *
+ * Exit codes (mirrors cloud-provision):
+ *   0 — success or idempotent no-op.
+ *   1 — vault HTTP failure during the safety check.
+ *   2 — validation (bad slug, missing dir/manifest, cloud not deleted).
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6b5cd717-bba0-5dd4-a743-a070e8a62a6b")}catch(e){}}();
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as yaml from "js-yaml";
+import chalk from "chalk";
+import { ProvisionError, companyConfigPath, companyDirPath, createDefaultVaultClient, manifestPath, validateManifestAndDir, validateSlug, } from "./cloud-provision.js";
+import { DEFAULT_HQ_ROOT, DEFAULT_VAULT_API_URL, ensureCognitoToken, } from "../utils/cognito-session.js";
+// ── Helpers ──────────────────────────────────────────────────────────────────
+/**
+ * Flip `cloud: true → false` in `companies/<slug>/company.yaml`. All other
+ * keys + ordering preserved (js-yaml round-trip). Atomic (tmp + rename).
+ *
+ * Returns true if the file was changed, false if no-op (file missing, or
+ * `cloud` was already `false`).
+ *
+ * NOTE: js-yaml doesn't preserve comments, but this matches what
+ * `patchManifest` already does — accepted trade-off.
+ */
+export function flipCompanyYamlCloudOff(hqRoot, slug) {
+    const yPath = path.join(companyDirPath(hqRoot, slug), "company.yaml");
+    if (!fs.existsSync(yPath))
+        return false;
+    const raw = fs.readFileSync(yPath, "utf-8");
+    const parsed = yaml.load(raw) ?? {};
+    if (parsed.cloud === false)
+        return false;
+    parsed.cloud = false;
+    const dump = yaml.dump(parsed, { lineWidth: -1, noRefs: true });
+    const tmp = `${yPath}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, dump);
+    fs.renameSync(tmp, yPath);
+    return true;
+}
+/**
+ * Remove `cloud_uid` + `bucket_name` from `companies.<slug>` in
+ * `companies/manifest.yaml`. The slug entry is preserved (other fields like
+ * `name`/`status`/`path` stay). Atomic (tmp + rename).
+ *
+ * Returns true if the file was changed, false if no-op (manifest missing,
+ * slug missing, or both fields already absent).
+ */
+export function stripManifestCloudForSlug(hqRoot, slug) {
+    const mPath = manifestPath(hqRoot);
+    if (!fs.existsSync(mPath))
+        return false;
+    const raw = fs.readFileSync(mPath, "utf-8");
+    const parsed = yaml.load(raw) ?? {};
+    const companies = parsed.companies;
+    if (!companies || !(slug in companies))
+        return false;
+    const entry = companies[slug];
+    if (!entry || typeof entry !== "object")
+        return false;
+    const obj = entry;
+    const hadCloudUid = "cloud_uid" in obj;
+    const hadBucketName = "bucket_name" in obj;
+    if (!hadCloudUid && !hadBucketName)
+        return false;
+    delete obj.cloud_uid;
+    delete obj.bucket_name;
+    const dump = yaml.dump(parsed, { lineWidth: -1, noRefs: true });
+    const tmp = `${mPath}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, dump);
+    fs.renameSync(tmp, mPath);
+    return true;
+}
+// ── Orchestrator ─────────────────────────────────────────────────────────────
+/**
+ * Run the full demote flow. Returns a `DemoteResult` on success; throws
+ * `ProvisionError` (codes 1 or 2) on any failure.
+ */
+export async function demoteCompany(options) {
+    validateSlug(options.slug);
+    // Fails with code 2 if the manifest is missing/malformed, the slug is not
+    // present under `.companies`, or `companies/<slug>/` doesn't exist on disk.
+    // Without this, a `--force` demote against a missing or renamed slug would
+    // be a silent no-op (all helpers return false but we'd still report ok=true).
+    validateManifestAndDir(options.hqRoot, options.slug);
+    let cloudWasDeleted = null;
+    if (!options.force) {
+        const accessToken = options.resolveAccessToken
+            ? await options.resolveAccessToken()
+            : await ensureCognitoToken();
+        const client = options.vaultClient ??
+            createDefaultVaultClient(options.vaultApiUrl, accessToken);
+        let entity;
+        try {
+            entity = await client.findCompanyBySlug(options.slug);
+        }
+        catch (err) {
+            if (err instanceof ProvisionError)
+                throw err;
+            throw new ProvisionError(1, `Vault GET by-slug failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (!entity) {
+            throw new ProvisionError(2, `Refusing to demote '${options.slug}': no cloud entity found. Pass --force to demote anyway.`);
+        }
+        // `deleted` is added by hq-pro and isn't in the static VaultEntity type.
+        const deleted = entity.deleted === true;
+        if (!deleted) {
+            throw new ProvisionError(2, `Refusing to demote '${options.slug}': cloud entity is not deleted (uid=${entity.uid}). Pass --force to demote anyway.`);
+        }
+        cloudWasDeleted = true;
+    }
+    const cPath = companyConfigPath(options.hqRoot, options.slug);
+    let configRemoved = false;
+    if (fs.existsSync(cPath)) {
+        fs.rmSync(cPath);
+        configRemoved = true;
+    }
+    const yamlFlipped = flipCompanyYamlCloudOff(options.hqRoot, options.slug);
+    const manifestStripped = stripManifestCloudForSlug(options.hqRoot, options.slug);
+    return {
+        ok: true,
+        company_slug: options.slug,
+        config_removed: configRemoved,
+        yaml_flipped: yamlFlipped,
+        manifest_stripped: manifestStripped,
+        cloud_was_deleted: cloudWasDeleted,
+    };
+}
+// ── Commander wiring ─────────────────────────────────────────────────────────
+/**
+ * Register `demote company <slug>` under the `cloud` command group. Wired in
+ * `src/index.ts` alongside `registerCloudProvisionCommands(cloudCmd)`.
+ */
+export function registerCloudDemoteCommands(program) {
+    const demoteCmd = program
+        .command("demote")
+        .description("Demote a cloud-backed entity back to local-only");
+    demoteCmd
+        .command("company")
+        .description("Demote a cloud-backed company to local-only after the cloud entity " +
+        "has been soft-tombstoned in hq-console. Removes .hq/config.json, " +
+        "flips company.yaml `cloud: false`, and strips the manifest cloud refs.")
+        .argument("<slug>", "Company slug")
+        .option("--hq-root <path>", `Local HQ tree root (default: ${DEFAULT_HQ_ROOT})`, DEFAULT_HQ_ROOT)
+        .option("--vault-api-url <url>", `Vault API URL (default: ${DEFAULT_VAULT_API_URL})`, DEFAULT_VAULT_API_URL)
+        .option("--force", "Skip the safety check that the cloud entity is actually deleted=true. " +
+        "AppBar HQ Sync passes this because its Path A just verified.")
+        .action(async (slug, options) => {
+        try {
+            const result = await demoteCompany({
+                slug,
+                hqRoot: options.hqRoot,
+                vaultApiUrl: options.vaultApiUrl,
+                force: options.force,
+            });
+            process.stdout.write(JSON.stringify(result) + "\n");
+            process.exit(0);
+        }
+        catch (err) {
+            if (err instanceof ProvisionError) {
+                process.stderr.write(chalk.red(`[hq cloud demote] ${err.message}\n`));
+                process.exit(err.code);
+            }
+            process.stderr.write(chalk.red(`[hq cloud demote] Unexpected error: ${err instanceof Error ? err.message : String(err)}\n`));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=cloud-demote.js.map
+//# debugId=6b5cd717-bba0-5dd4-a743-a070e8a62a6b

package/dist/commands/members.d.ts

@@ -0,0 +1,53 @@
+import { Command } from "commander";
+export declare const VALID_ROLES: Set<string>;
+export type Role = "owner" | "admin" | "member" | "guest";
+export interface PendingInvite {
+    membershipKey: string;
+    personUid?: string;
+    inviteeEmail?: string;
+    companyUid: string;
+    role: string;
+    status: string;
+    inviteToken?: string;
+    invitedBy: string;
+    invitedAt: string;
+}
+export interface InviteOptions {
+    target: string;
+    role: string;
+    paths?: string;
+    companyUid: string;
+    callerUid: string;
+    token: string;
+}
+export interface InviteResult {
+    inviteToken: string;
+    magicLink: string;
+    membership: {
+        role: string;
+        status: string;
+    };
+}
+export interface DetectedTarget {
+    type: "email" | "person";
+    value: string;
+}
+export declare function detectTarget(target: string): DetectedTarget | null;
+export declare function shortDate(iso: string): string;
+/**
+ * Resolve the caller's personUid by reading their own membership list.
+ * The server infers the JWT identity, so this returns the canonical
+ * personUid attached to the caller's active memberships.
+ */
+export declare function getCallerPersonUid(token: string): Promise<string>;
+/** Send a `/membership/invite` request and return the magic link. */
+export declare function inviteMember(options: InviteOptions): Promise<InviteResult>;
+export declare class InviteHttpError extends Error {
+    status: number;
+    constructor(status: number, message: string);
+}
+export declare function formatInviteHttpError(status: number, fallback: string): string;
+export declare function listPendingInvites(token: string, companyUid: string): Promise<PendingInvite[]>;
+export declare function revokeInvite(token: string, tokenOrKey: string, companyUid: string): Promise<void>;
+export declare function registerMembersCommand(program: Command): void;
+//# sourceMappingURL=members.d.ts.map

package/dist/commands/members.js

@@ -0,0 +1,240 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1b3646e3-32c8-5601-9dba-1d7c0f6cf972")}catch(e){}}();
+import chalk from "chalk";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
+const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
+const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
+export const VALID_ROLES = new Set(["owner", "admin", "member", "guest"]);
+export function detectTarget(target) {
+    if (EMAIL_PATTERN.test(target)) {
+        return { type: "email", value: target.trim().toLowerCase() };
+    }
+    if (PERSON_UID_PATTERN.test(target)) {
+        return { type: "person", value: target };
+    }
+    return null;
+}
+export function shortDate(iso) {
+    return iso.slice(0, 10);
+}
+/**
+ * Resolve the caller's personUid by reading their own membership list.
+ * The server infers the JWT identity, so this returns the canonical
+ * personUid attached to the caller's active memberships.
+ */
+export async function getCallerPersonUid(token) {
+    const res = await vaultApiFetch({ token, path: "/membership/me" });
+    if (!res.ok) {
+        throw new Error("Failed to resolve caller identity — run `hq login` and try again");
+    }
+    const data = (await res.json());
+    const personUid = data.memberships.find((m) => m.personUid)?.personUid;
+    if (!personUid) {
+        throw new Error("Your account has no person entity yet. Run `hq onboard create-company` or accept an invite first.");
+    }
+    return personUid;
+}
+/** Send a `/membership/invite` request and return the magic link. */
+export async function inviteMember(options) {
+    if (!VALID_ROLES.has(options.role)) {
+        throw new Error(`Invalid role '${options.role}': must be one of owner, admin, member, guest`);
+    }
+    if (options.paths && options.role !== "guest") {
+        throw new Error("--paths is only valid with --role guest (allowedPrefixes are only meaningful for the guest role)");
+    }
+    const detected = detectTarget(options.target);
+    if (!detected) {
+        throw new Error(`Invalid target '${options.target}': must be an email address or a personUid matching prs_<alphanumeric>`);
+    }
+    const allowedPrefixes = options.paths
+        ? options.paths.split(",").map((p) => p.trim()).filter(Boolean)
+        : undefined;
+    const body = {
+        companyUid: options.companyUid,
+        role: options.role,
+        invitedBy: options.callerUid,
+    };
+    if (detected.type === "email")
+        body.inviteeEmail = detected.value;
+    else
+        body.personUid = detected.value;
+    if (allowedPrefixes)
+        body.allowedPrefixes = allowedPrefixes;
+    const res = await vaultApiFetch({
+        token: options.token,
+        path: "/membership/invite",
+        method: "POST",
+        body,
+    });
+    if (!res.ok) {
+        const err = (await res.json().catch(() => ({})));
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText);
+    }
+    const data = (await res.json());
+    return {
+        inviteToken: data.inviteToken,
+        magicLink: `hq://accept/${data.inviteToken}`,
+        membership: data.membership,
+    };
+}
+export class InviteHttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = "InviteHttpError";
+    }
+}
+export function formatInviteHttpError(status, fallback) {
+    if (status === 401)
+        return "Not authenticated — please run `hq login`";
+    if (status === 403) {
+        return "Not authorized — only admins and owners can invite members";
+    }
+    if (status === 409) {
+        return "This person already has a membership or pending invite for this company";
+    }
+    if (status >= 500)
+        return `Server error: ${fallback}`;
+    return fallback;
+}
+export async function listPendingInvites(token, companyUid) {
+    const res = await vaultApiFetch({
+        token,
+        path: `/membership/company/${encodeURIComponent(companyUid)}/pending`,
+    });
+    if (!res.ok) {
+        const err = (await res.json().catch(() => ({})));
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText);
+    }
+    const data = (await res.json());
+    return data.invites;
+}
+export async function revokeInvite(token, tokenOrKey, companyUid) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/membership/revoke",
+        method: "POST",
+        body: { membershipKey: tokenOrKey, companyUid },
+    });
+    if (!res.ok) {
+        const err = (await res.json().catch(() => ({})));
+        throw new InviteHttpError(res.status, err.message ?? err.error ?? res.statusText);
+    }
+}
+export function registerMembersCommand(program) {
+    const members = program
+        .command("members")
+        .description("Manage company memberships and invites")
+        .option("--company <slug>", "Company slug (resolves to companyUid)");
+    members
+        .command("invite <target>")
+        .description("Invite a person to the company by email or personUid (prints a magic link)")
+        .option("--role <role>", "Role for the invitee: owner, admin, member, or guest", "member")
+        .option("--paths <prefixes>", "Comma-separated allowed prefixes (only valid with --role guest)")
+        .action(async (target, opts) => {
+        try {
+            const token = await ensureCognitoToken();
+            const companySlug = members.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const callerUid = await getCallerPersonUid(token);
+            const result = await inviteMember({
+                target,
+                role: opts.role,
+                paths: opts.paths,
+                companyUid,
+                callerUid,
+                token,
+            });
+            console.log(chalk.green(`Invited ${target} as ${result.membership.role} (status: ${result.membership.status})`));
+            console.log();
+            console.log(chalk.bold("Magic link:"));
+            console.log(`  ${result.magicLink}`);
+            console.log();
+            console.log(chalk.dim("Share this link with the invitee. They can run `hq onboard join --invite-token <token>` to accept."));
+        }
+        catch (err) {
+            if (err instanceof InviteHttpError) {
+                console.error(chalk.red(formatInviteHttpError(err.status, err.message)));
+                process.exit(1);
+            }
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    members
+        .command("list")
+        .description("List pending invites for the company")
+        .action(async () => {
+        try {
+            const token = await ensureCognitoToken();
+            const companySlug = members.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            const invites = await listPendingInvites(token, companyUid);
+            if (invites.length === 0) {
+                console.log(chalk.gray("No pending invites for this company."));
+                return;
+            }
+            const targetW = Math.max(6, ...invites.map((i) => (i.inviteeEmail ?? i.personUid ?? "").length));
+            const roleW = Math.max(4, ...invites.map((i) => i.role.length));
+            const byW = Math.max(10, ...invites.map((i) => i.invitedBy.length));
+            const keyW = Math.max(14, ...invites.map((i) => i.membershipKey.length));
+            console.log(chalk.bold([
+                "TARGET".padEnd(targetW),
+                "ROLE".padEnd(roleW),
+                "INVITED_BY".padEnd(byW),
+                "INVITED_AT",
+                "MEMBERSHIP_KEY".padEnd(keyW),
+            ].join("  ")));
+            for (const inv of invites) {
+                const target = inv.inviteeEmail ?? inv.personUid ?? "";
+                console.log([
+                    target.padEnd(targetW),
+                    inv.role.padEnd(roleW),
+                    inv.invitedBy.padEnd(byW),
+                    shortDate(inv.invitedAt),
+                    inv.membershipKey.padEnd(keyW),
+                ].join("  "));
+            }
+        }
+        catch (err) {
+            if (err instanceof InviteHttpError) {
+                const msg = err.status === 403
+                    ? "Not authorized — only admins and owners can list invites"
+                    : formatInviteHttpError(err.status, err.message);
+                console.error(chalk.red(msg));
+                process.exit(1);
+            }
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    members
+        .command("revoke <tokenOrKey>")
+        .description("Revoke a pending invite (accepts the inviteToken or membershipKey)")
+        .action(async (tokenOrKey) => {
+        try {
+            const token = await ensureCognitoToken();
+            const companySlug = members.opts().company;
+            const companyUid = await getCompanyUid(token, companySlug);
+            await revokeInvite(token, tokenOrKey, companyUid);
+            console.log(chalk.green(`Revoked invite '${tokenOrKey}'`));
+        }
+        catch (err) {
+            if (err instanceof InviteHttpError) {
+                const msg = err.status === 403
+                    ? "Not authorized — only admins and owners can revoke invites"
+                    : err.status === 404
+                        ? "Invite not found — it may have already been accepted or revoked"
+                        : formatInviteHttpError(err.status, err.message);
+                console.error(chalk.red(msg));
+                process.exit(1);
+            }
+            console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=members.js.map
+//# debugId=1b3646e3-32c8-5601-9dba-1d7c0f6cf972

package/dist/index.js

@@ -3,7 +3,7 @@
  * HQ CLI - Module management, package management, and cloud sync for HQ
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ad8b9496-9cb2-5e12-ae08-5b29ef77c209")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e834c407-cd5c-5dc1-af3b-7f041af651ef")}catch(e){}}();
 import { Command } from "commander";
 import { initSentry, Sentry } from "./sentry.js";
 import { registerAddCommand } from "./commands/add.js";
@@ -12,6 +12,7 @@ import { registerListCommand } from "./commands/list.js";
 import { registerUpdateCommand } from "./commands/update.js";
 import { registerCloudCommands } from "./commands/cloud.js";
 import { registerCloudProvisionCommands } from "./commands/cloud-provision.js";
+import { registerCloudDemoteCommands } from "./commands/cloud-demote.js";
 import { registerLoginCommand } from "./commands/login.js";
 import { registerLogoutCommand } from "./commands/logout.js";
 import { registerWhoamiCommand } from "./commands/whoami.js";
@@ -26,6 +27,7 @@ import { registerSecretsCommand } from "./commands/secrets.js";
 import { registerRunCommand } from "./commands/run.js";
 import { registerGroupsCommand } from "./commands/groups.js";
 import { registerFilesCommand } from "./commands/files.js";
+import { registerMembersCommand } from "./commands/members.js";
 initSentry();
 const program = new Command();
 program
@@ -64,6 +66,7 @@ const cloudCmd = program
     .command("cloud")
     .description("Cloud commands — provision entities and manage cloud-backed companies");
 registerCloudProvisionCommands(cloudCmd);
+registerCloudDemoteCommands(cloudCmd);
 // Team commands (top-level)
 registerTeamSyncCommand(program);
 // Auth commands (top-level — Cognito OAuth)
@@ -79,6 +82,8 @@ registerRunCommand(program);
 registerGroupsCommand(program);
 // Files ACL management (subcommand group — hq files share|unshare|acl)
 registerFilesCommand(program);
+// Membership management (subcommand group — hq members invite|list|revoke)
+registerMembersCommand(program);
 // Onboarding (top-level — Cognito + vault-service provisioning)
 registerOnboardCommand(program);
 (async () => {
@@ -94,4 +99,4 @@ registerOnboardCommand(program);
     }
 })();
 //# sourceMappingURL=index.js.map
-//# debugId=ad8b9496-9cb2-5e12-ae08-5b29ef77c209
+//# debugId=e834c407-cd5c-5dc1-af3b-7f041af651ef

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.9.0",
+  "version": "5.10.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {