@velaro/cli 1.4.94 → 1.4.96

package/lib/avatar-motion.js

@@ -0,0 +1,32 @@
+// Avatar body-motion settings (velaro-messaging AvatarExperienceSettings): shared validation for the CLI.
+// level: off | subtle | natural | expressive ("" = reset to the platform default, "natural");
+// intensity: whole percent 25..150 multiplying every motion amplitude.
+export const MOTION_LEVELS = ['off', 'subtle', 'natural', 'expressive'];
+export const MOTION_INTENSITY_MIN = 25;
+export const MOTION_INTENSITY_MAX = 150;
+
+/** Returns the normalized level ('' allowed = reset) or throws a readable error. */
+export function parseMotionLevelArg(raw) {
+  if (raw === undefined) return undefined;
+  const v = String(raw).trim().toLowerCase();
+  if (v === '') return '';
+  if (!MOTION_LEVELS.includes(v)) throw new Error(`--motion-level must be one of ${MOTION_LEVELS.join(', ')} (or empty to reset to the default)`);
+  return v;
+}
+
+export function parseMotionIntensityArg(raw) {
+  if (raw === undefined) return undefined;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < MOTION_INTENSITY_MIN || n > MOTION_INTENSITY_MAX)
+    throw new Error(`--motion-intensity must be a whole number between ${MOTION_INTENSITY_MIN} and ${MOTION_INTENSITY_MAX}`);
+  return n;
+}
+
+/** Adds motionLevel / motionIntensityPercent to a request body only when the caller passed them. */
+export function applyMotionArgs(body, argv) {
+  const level = parseMotionLevelArg(argv['motion-level']);
+  const intensity = parseMotionIntensityArg(argv['motion-intensity']);
+  if (level !== undefined) body.motionLevel = level;
+  if (intensity !== undefined) body.motionIntensityPercent = intensity;
+  return body;
+}

package/lib/avatar-motion.test.js

@@ -0,0 +1,35 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import { applyMotionArgs, parseMotionLevelArg, parseMotionIntensityArg } from './avatar-motion.js';
+
+test('level accepts the four presets, normalizes case, and empty resets', () => {
+  assert.equal(parseMotionLevelArg('Expressive'), 'expressive');
+  assert.equal(parseMotionLevelArg(''), '');
+  assert.equal(parseMotionLevelArg(undefined), undefined);
+  assert.throws(() => parseMotionLevelArg('wild'), /off, subtle, natural, expressive/);
+});
+
+test('intensity must be a whole number 25-150', () => {
+  assert.equal(parseMotionIntensityArg(25), 25);
+  assert.equal(parseMotionIntensityArg(150), 150);
+  assert.throws(() => parseMotionIntensityArg(24), /25 and 150/);
+  assert.throws(() => parseMotionIntensityArg(151), /25 and 150/);
+  assert.throws(() => parseMotionIntensityArg(80.5), /whole number/);
+});
+
+test('only supplied motion args reach the request body', () => {
+  assert.deepEqual(applyMotionArgs({}, {}), {});
+  assert.deepEqual(applyMotionArgs({ enabled: true }, { 'motion-level': 'subtle' }), { enabled: true, motionLevel: 'subtle' });
+  assert.deepEqual(applyMotionArgs({}, { 'motion-level': '', 'motion-intensity': 60 }), { motionLevel: '', motionIntensityPercent: 60 });
+});
+
+test('avatar command wires the helper on enable and set, and override accepts --motion-level', async () => {
+  const src = fs.readFileSync(new URL('./commands/avatar.js', import.meta.url), 'utf8');
+  assert.match(src, /applyMotionArgs\(body, argv\)/);
+  assert.match(src, /'motion-level'/);
+  const { overrideBody } = await import('./avatar-override.js');
+  assert.deepEqual(overrideBody({ 'motion-level': 'Subtle' }), { merge: true, motionLevel: 'subtle' });
+  assert.deepEqual(overrideBody({ 'motion-level': '' }), { merge: true, motionLevel: '' });
+  assert.throws(() => overrideBody({ 'motion-level': 'wild' }), /off, subtle, natural, expressive/);
+});

package/lib/avatar-override.js

@@ -2,6 +2,8 @@
 // Per-group / per-workflow avatar + backdrop overrides live in velaro-messaging (VelaroAvatarController);
 // effective = perWorkflow ?? perGroup ?? perSite. Kept dependency-free so it is unit-testable.
 
+import { parseMotionLevelArg } from './avatar-motion.js';
+
 export const BACKDROP_MODES = ['none', 'color', 'gradient', 'image'];
 
 const HEX = /^#[0-9a-fA-F]{3,8}$/;
@@ -33,15 +35,17 @@ export function overrideBody(argv) {
     'display-name': 'displayName',
     backdrop: 'backgroundMode',
     'backdrop-value': 'backgroundValue',
+    'motion-level': 'motionLevel',
   };
   for (const [flag, key] of Object.entries(map)) {
     if (argv[flag] !== undefined) body[key] = String(argv[flag]);
   }
+  if (body.motionLevel !== undefined) body.motionLevel = parseMotionLevelArg(body.motionLevel);
   const err = validateBackdrop(body.backgroundMode, body.backgroundValue);
   if (err) throw new Error(err);
   if (body.backgroundMode === undefined && body.backgroundValue !== undefined && body.backgroundValue !== '')
     throw new Error('--backdrop-value needs --backdrop (none | color | gradient | image)');
-  if (Object.keys(body).length === 1) throw new Error('Pass at least one of --avatar --personality --voice --display-name --backdrop --backdrop-value --provider');
+  if (Object.keys(body).length === 1) throw new Error('Pass at least one of --avatar --personality --voice --display-name --backdrop --backdrop-value --provider --motion-level');
   return body;
 }
 

package/lib/commands/avatar.js

@@ -1,5 +1,6 @@
 import { request, messagingGet, messagingPut, messagingDel } from '../api.js';
 import { overrideBody, scopePath } from '../avatar-override.js';
+import { applyMotionArgs } from '../avatar-motion.js';
 import { runCommand } from '../run.js';
 
 // ── velaro avatar ─────────────────────────────────────────────────────────────
@@ -34,6 +35,7 @@ export const avatarCommand = {
         console.log(`  Display name:  ${data.displayName || '(AI)'}`);
         console.log(`  Badge shown:   ${data.showBadge ? 'yes' : 'no'}`);
         console.log(`  Size:          ${data.sizePx}px`);
+        console.log(`  Body motion:   ${data.motionLevel || '(default: natural)'} @ ${data.motionIntensityPercent ?? 100}%`);
         console.log(`  Max minutes/mo:   ${data.maxAvatarMinutesPerMonth ?? '(plan default)'}`);
         console.log(`  Max TTS chars/mo: ${data.maxAvatarTtsChars ?? '(plan default)'}\n`);
       }),
@@ -50,7 +52,9 @@ export const avatarCommand = {
         .option('call-me',  { type: 'boolean', describe: 'Show the "Call me instead" option. Omit on a re-run to leave it untouched.' })
         .option('display-name', { type: 'string', describe: 'Visitor-facing avatar name on the badge (e.g. Moshky). Empty string resets to "AI".' })
         .option('show-badge',   { type: 'boolean', describe: 'Show the name badge over the avatar video.' })
-        .option('size',         { type: 'number', describe: 'Avatar panel max width in px (160-640). Default 360.' }),
+        .option('size',         { type: 'number', describe: 'Avatar panel max width in px (160-640). Default 360.' })
+        .option('motion-level', { type: 'string', describe: 'Body motion: off | subtle | natural | expressive. Empty string resets to the default (natural).' })
+        .option('motion-intensity', { type: 'number', describe: 'Body motion strength percent (25-150). Default 100.' }),
       handler:  runCommand(async argv => {
         if (argv.bot) {
           console.log(`\nNote: --bot is not yet supported by this endpoint — this sets the SITE-level avatar config only. Use the admin UI's per-bot override toggle for bot-specific control.\n`);
@@ -66,6 +70,7 @@ export const avatarCommand = {
         if (argv['display-name'] !== undefined) body.displayName = argv['display-name'];
         if (argv['show-badge'] !== undefined) body.showBadge = argv['show-badge'];
         if (argv.size !== undefined) body.sizePx = argv.size;
+        applyMotionArgs(body, argv);
         const data = await request('POST', `/Avatar/superadmin/config?siteId=${argv.site}`, body);
         if (!data.success) throw new Error(data.error || 'Configure failed');
         console.log(`\n✓ AI Video Avatar enabled for site ${argv.site}`);
@@ -89,18 +94,22 @@ export const avatarCommand = {
       builder:  y => y
         .option('site',          { type: 'number', demandOption: true, describe: 'Site ID' })
         .option('max-minutes',   { type: 'number', describe: 'Monthly avatar video minutes cap (whole number 1-100000)' })
-        .option('max-tts-chars', { type: 'number', describe: 'Monthly avatar TTS character cap (whole number 1-100000000)' }),
+        .option('max-tts-chars', { type: 'number', describe: 'Monthly avatar TTS character cap (whole number 1-100000000)' })
+        .option('motion-level', { type: 'string', describe: 'Body motion: off | subtle | natural | expressive. Empty string resets to the default.' })
+        .option('motion-intensity', { type: 'number', describe: 'Body motion strength percent (25-150).' }),
       handler:  runCommand(async argv => {
         const body = {};
+        applyMotionArgs(body, argv);
         for (const [opt, key, max] of [['max-minutes', 'maxAvatarMinutesPerMonth', 100000], ['max-tts-chars', 'maxAvatarTtsChars', 100000000]]) {
           if (argv[opt] === undefined) continue;
           if (!Number.isInteger(argv[opt]) || argv[opt] < 1 || argv[opt] > max) throw new Error(`--${opt} must be a whole number between 1 and ${max} (never unlimited)`);
           body[key] = argv[opt];
         }
-        if (!Object.keys(body).length) throw new Error('Provide --max-minutes and/or --max-tts-chars');
+        if (!Object.keys(body).length) throw new Error('Provide --max-minutes, --max-tts-chars, --motion-level and/or --motion-intensity');
         const data = await request('POST', `/Avatar/superadmin/config?siteId=${argv.site}`, body);
         if (!data.success) throw new Error(data.error || 'Set avatar caps failed');
-        console.log(`\n✓ Avatar caps updated for site ${argv.site}`);
+        console.log(`\n✓ Avatar settings updated for site ${argv.site}`);
+        console.log(`  Body motion:      ${data.motionLevel || '(default: natural)'} @ ${data.motionIntensityPercent ?? 100}%`);
         console.log(`  Max minutes/mo:   ${data.maxAvatarMinutesPerMonth}`);
         console.log(`  Max TTS chars/mo: ${data.maxAvatarTtsChars}\n`);
       }),
@@ -118,6 +127,7 @@ export const avatarCommand = {
         .option('backdrop',       { type: 'string', choices: ['none', 'color', 'gradient', 'image', ''], describe: 'Backdrop type. none = explicitly no backdrop; empty string = inherit.' })
         .option('backdrop-value', { type: 'string', describe: 'Hex color, "#a,#b" gradient, or https image URL' })
         .option('provider',       { type: 'string', describe: 'Provider slug (a library avatar implies velaro)' })
+        .option('motion-level',   { type: 'string', describe: 'Body motion: off | subtle | natural | expressive. Empty string clears back to inherit.' })
         .option('replace',        { type: 'boolean', describe: 'Replace the whole override instead of changing only the flags passed' }),
       handler:  runCommand(async argv => {
         const base = scopePath(argv);
@@ -125,7 +135,7 @@ export const avatarCommand = {
         if (!data?.success) throw new Error(data?.error || 'Override failed');
         const eff = await messagingGet(`${base}/effective`);
         console.log(`
-✓ Override saved. Effective now: avatar=${eff.avatarId ?? '(default)'} backdrop=${eff.backgroundMode}${eff.backgroundValue ? ' ' + eff.backgroundValue : ''} name=${eff.displayName ?? '(AI)'} layer=${eff.layer}
+✓ Override saved. Effective now: motion=${eff.motionLevel ?? '(default)'} avatar=${eff.avatarId ?? '(default)'} backdrop=${eff.backgroundMode}${eff.backgroundValue ? ' ' + eff.backgroundValue : ''} name=${eff.displayName ?? '(AI)'} layer=${eff.layer}
 `);
       }),
     })

package/lib/commands/logs.js

@@ -1,5 +1,6 @@
 import { getCredentials }          from '../api.js';
 import { readConfig, ENVS }        from '../config.js';
+import { completeLogSearch, describeCompleteness, describeRawMeta } from '../log-search.js';
 
 // ── helpers ──────────────────────────────────────────────────────────────────
 
@@ -60,39 +61,61 @@ async function searchLogs(argv) {
   await requireAdmin(creds);
   const msgBase = await getMsgBase(argv);
 
-  const from = new Date(Date.now() - parseDuration(argv.last ?? '2h'));
-  const params = new URLSearchParams({ from: from.toISOString(), take: String(argv.take ?? 50) });
-  if (argv.query)         params.set('q',             argv.query);
-  if (argv.level)         params.set('level',         argv.level.toUpperCase());
-  if (argv.integration)   params.set('integration',   argv.integration);
-  if (argv.site)          params.set('siteId',        String(argv.site));
-  if (argv.source)        params.set('source',        argv.source);
-  if (argv.platform)      params.set('platform',      argv.platform);
-  if (argv.environment)   params.set('environment',   argv.environment);
-  if (argv.correlationId) params.set('correlationId', argv.correlationId);
-  if (argv.regex)         params.set('regex',         'true');
-
-  const res = await fetch(`${msgBase}/superadmin/logs/search?${params}`, {
-    headers: {
-      Authorization:       `Bearer ${creds.velaroToken}`,
-      'X-Internal-SiteId': String(creds.siteId),
-    },
-    signal: AbortSignal.timeout(20000),
-  });
-
-  if (!res.ok) {
-    console.error(`HTTP ${res.status}: ${await res.text().catch(() => '')}`);
+  const to   = argv.to   ? new Date(argv.to)   : new Date();
+  const from = argv.from ? new Date(argv.from) : new Date(to.getTime() - parseDuration(argv.last ?? '2h'));
+  if (Number.isNaN(from.getTime()) || Number.isNaN(to.getTime()) || to <= from) {
+    console.error('Invalid time window: --from/--to must be ISO timestamps with --to after --from.');
     process.exit(1);
   }
+  const headers = { Authorization: `Bearer ${creds.velaroToken}`, 'X-Internal-SiteId': String(creds.siteId) };
+  const getJson = async (query) => {
+    const res = await fetch(`${msgBase}/superadmin/logs/search?${query}`, { headers, signal: AbortSignal.timeout(30000) });
+    if (!res.ok) {
+      console.error(`HTTP ${res.status}: ${await res.text().catch(() => '')}`);
+      process.exit(1);
+    }
+    return res.json();
+  };
 
-  const entries = extractLogEntries(await res.json());
-  if (!entries.length) {
-    console.log('No results.');
+  // --raw: the server's own q= search (kept for parity). Proven 2026-10-14 to under-report (q=[HttpFallback]
+  // returned 0-2 rows while 136 existed), so it now always prints the server's searchPath/scannedRows/truncated.
+  if (argv.raw) {
+    const params = new URLSearchParams({ from: from.toISOString(), to: to.toISOString(), take: String(argv.take ?? 50) });
+    if (argv.query)         params.set('q',             argv.query);
+    if (argv.level)         params.set('level',         argv.level.toUpperCase());
+    if (argv.integration)   params.set('integration',   argv.integration);
+    if (argv.site)          params.set('siteId',        String(argv.site));
+    if (argv.source)        params.set('source',        argv.source);
+    if (argv.platform)      params.set('platform',      argv.platform);
+    if (argv.environment)   params.set('environment',   argv.environment);
+    if (argv.correlationId) params.set('correlationId', argv.correlationId);
+    if (argv.regex)         params.set('regex',         'true');
+    const resp = await getJson(params.toString());
+    const entries = extractLogEntries(resp);
+    console.log(`${DIM}${describeRawMeta(resp)}${RESET}`);
+    if (!entries.length) { console.log('No results (raw server search; see the line above before trusting that).'); return; }
+    console.log(`\n${DIM}${entries.length} result(s) from ${from.toISOString().slice(0, 16)} UTC${RESET}\n`);
+    for (const e of entries) printEntry(e);
+    console.log('');
     return;
   }
 
-  console.log(`\n${DIM}${entries.length} result(s) from ${from.toISOString().slice(0, 16)} UTC${RESET}\n`);
-  for (const e of entries) printEntry(e);
+  // Default: COMPLETE read. Never sends q=: filters level/site/source/... server side, bisects any slice the
+  // server reports as capped (includeTotal), filters text client side, and says COMPLETE or INCOMPLETE.
+  const result = await completeLogSearch({
+    fetchJson: getJson,
+    from, to,
+    params: { level: argv.level, siteId: argv.site, source: argv.source, integration: argv.integration, platform: argv.platform, environment: argv.environment, correlationId: argv.correlationId },
+    contains: argv.regex ? undefined : argv.query,
+    regex:    argv.regex ? argv.query : undefined,
+    logger:   argv.logger,
+    maxRequests: argv.maxRequests ?? 200,
+  });
+  console.log(`${result.complete ? DIM : YEL}${describeCompleteness(result)}${RESET}`);
+  if (!result.entries.length) { console.log('No results.'); return; }
+  const shown = result.entries.slice(0, argv.take ?? 50);
+  console.log(`\n${DIM}showing ${shown.length} of ${result.entries.length} (newest first) from ${from.toISOString().slice(0, 16)} UTC${RESET}\n`);
+  for (const e of shown) printEntry(e);
   console.log('');
 }
 
@@ -696,7 +719,12 @@ export const logsCommand = {
         .option('correlationId', { describe: 'Exact correlation/trace ID filter', type: 'string' })
         .option('last',          { describe: 'Time window: 30m, 2h, 1d', default: '2h', type: 'string' })
         .option('regex',         { describe: 'Treat query as regex', boolean: true, default: false })
-        .option('take',          { describe: 'Max results (max 500)', default: 50, type: 'number' })
+        .option('logger',        { describe: 'Logger-name substring (client side)', type: 'string' })
+        .option('from',          { describe: 'ISO start time (overrides --last)', type: 'string' })
+        .option('to',            { describe: 'ISO end time (default now)', type: 'string' })
+        .option('raw',           { describe: 'Use the server q= search (can under-report; prints searchPath/scannedRows/truncated)', boolean: true, default: false })
+        .option('max-requests',  { describe: 'Request budget for the complete read', default: 200, type: 'number' })
+        .option('take',          { describe: 'Max lines to print (complete read) / server page size (--raw, max 500)', default: 50, type: 'number' })
         .option('env',           { describe: 'staging or prod', type: 'string' }),
       handler: searchLogs,
     })

package/lib/commands/recruiting-employers.js

@@ -0,0 +1,163 @@
+import { messagingGet, messagingPost, messagingPut, messagingDel } from '../api.js';
+import { runCommand } from '../run.js';
+import { buildEmployerBody, buildInviteBody, buildKeywordsBody, buildListingBody, buildReasonBody, employerPath, memberPath, moderationPath, normalizeRole } from '../recruiting-employers.js';
+
+// -- velaro recruiting employers | moderation ----------------------------------
+// Job Board Stage 5 (package job-board-employers; 403 job_board_employers_not_entitled without it). siteId is applied
+// server-side from the vmsg-siteId header, never a CLI arg.
+// Backend contract: server/Velaro.Messaging/Controllers/RecruitingEmployersController.cs
+//   GET Recruiting/Employers ; POST Recruiting/Employers { name, verifiedDomain? } ; PUT Recruiting/Employers/{id} { name?, verifiedDomain? }
+//   POST Recruiting/Employers/{id}/Suspend { reason } | /Reactivate ; GET Recruiting/Employers/{id}/Members
+//   POST Recruiting/Employers/{id}/Invite { email, displayName?, role } ; PUT|DELETE Recruiting/Employers/{id}/Members/{memberId}
+//   GET|POST Recruiting/Employers/{id}/Listings (POST may submit: goes through the same moderation as the employer portal)
+//   GET Recruiting/Moderation ; POST Recruiting/Moderation/{id}/Approve | /Reject { reason } ; GET .../{id}/Events ; GET|PUT Recruiting/Moderation/Keywords
+
+const BOLD = '\x1b[1m';
+const DIM = '\x1b[2m';
+const RST = '\x1b[0m';
+
+const show = (r) => console.log(JSON.stringify(r, null, 2));
+
+async function listHandler() {
+  const rows = await messagingGet('/Recruiting/Employers');
+  if (!Array.isArray(rows) || !rows.length) return console.log('\n  No employers yet.\n');
+  console.log(`\n${BOLD}Employers${RST} (${rows.length})\n`);
+  for (const e of rows) {
+    console.log(`  ${DIM}#${e.id}${RST}  ${e.name}  ${DIM}${e.status}${e.trusted ? ', trusted' : ', first posting under review'} / members ${e.memberCount} / live ${e.liveListingCount} of ${e.listingCount} / pending ${e.pendingModerationCount}${RST}`);
+  }
+  console.log('');
+}
+
+const employersCommand = {
+  command: 'employers <subcommand>',
+  describe: 'Job board employers: invite-only accounts that manage only their own listings (package job-board-employers)',
+  builder: (y) => y
+    .command({ command: 'list', describe: 'List employers with member, listing and pending counts', handler: runCommand(listHandler) })
+    .command({
+      command: 'create',
+      describe: 'Create an employer',
+      builder: (y2) => y2.option('name', { type: 'string', demandOption: true }).option('domain', { describe: 'Verified email domain (optional)', type: 'string' }),
+      handler: runCommand(async (a) => show(await messagingPost('/Recruiting/Employers', buildEmployerBody({ name: a.name, domain: a.domain })))),
+    })
+    .command({
+      command: 'update <employerId>',
+      describe: 'Rename an employer or change its verified domain',
+      builder: (y2) => y2.positional('employerId', { type: 'number' }).option('name', { type: 'string' }).option('domain', { type: 'string' }),
+      handler: runCommand(async (a) => show(await messagingPut(employerPath(a.employerId), buildEmployerBody({ name: a.name, domain: a.domain })))),
+    })
+    .command({
+      command: 'suspend <employerId>',
+      describe: 'Suspend an employer: members are signed out and published listings are paused',
+      builder: (y2) => y2.positional('employerId', { type: 'number' }).option('reason', { type: 'string', demandOption: true }),
+      handler: runCommand(async (a) => show(await messagingPost(employerPath(a.employerId, 'Suspend'), buildReasonBody(a.reason)))),
+    })
+    .command({
+      command: 'reactivate <employerId>',
+      describe: 'Reactivate a suspended employer (its paused listings stay paused)',
+      builder: (y2) => y2.positional('employerId', { type: 'number' }),
+      handler: runCommand(async (a) => show(await messagingPost(employerPath(a.employerId, 'Reactivate'), {}))),
+    })
+    .command({
+      command: 'members <employerId>',
+      describe: 'List an employer\'s members',
+      builder: (y2) => y2.positional('employerId', { type: 'number' }),
+      handler: runCommand(async (a) => show(await messagingGet(employerPath(a.employerId, 'Members')))),
+    })
+    .command({
+      command: 'invite <employerId>',
+      describe: 'Email a single-use invitation (valid 7 days)',
+      builder: (y2) => y2.positional('employerId', { type: 'number' })
+        .option('email', { type: 'string', demandOption: true })
+        .option('name', { type: 'string' })
+        .option('role', { describe: 'Owner | Recruiter | Viewer (default Recruiter)', type: 'string' }),
+      handler: runCommand(async (a) => show(await messagingPost(employerPath(a.employerId, 'Invite'), buildInviteBody({ email: a.email, name: a.name, role: a.role })))),
+    })
+    .command({
+      command: 'remove-member <employerId> <memberId>',
+      describe: 'Remove a member (their sessions end immediately)',
+      builder: (y2) => y2.positional('employerId', { type: 'number' }).positional('memberId', { type: 'number' }),
+      handler: runCommand(async (a) => show(await messagingDel(memberPath(a.employerId, a.memberId)))),
+    })
+    .command({
+      command: 'set-role <employerId> <memberId> <role>',
+      describe: 'Change a member role (Owner | Recruiter | Viewer)',
+      builder: (y2) => y2.positional('employerId', { type: 'number' }).positional('memberId', { type: 'number' }).positional('role', { type: 'string' }),
+      handler: runCommand(async (a) => show(await messagingPut(memberPath(a.employerId, a.memberId), { role: normalizeRole(a.role) }))),
+    })
+    .command({
+      command: 'listings <employerId>',
+      describe: 'List an employer\'s listings with status',
+      builder: (y2) => y2.positional('employerId', { type: 'number' }),
+      handler: runCommand(async (a) => show(await messagingGet(employerPath(a.employerId, 'Listings')))),
+    })
+    .command({
+      command: 'create-listing <employerId>',
+      describe: 'Create a listing for an employer (add --submit to publish; first postings and scam signals go to moderation)',
+      builder: (y2) => y2.positional('employerId', { type: 'number' })
+        .option('title', { type: 'string', demandOption: true })
+        .option('description', { type: 'string', demandOption: true })
+        .option('department', { type: 'string' })
+        .option('location', { type: 'string' })
+        .option('employment-type', { type: 'string' })
+        .option('apply-url', { type: 'string' })
+        .option('min', { type: 'number' })
+        .option('max', { type: 'number' })
+        .option('currency', { type: 'string' })
+        .option('period', { type: 'string' })
+        .option('submit', { type: 'boolean' }),
+      handler: runCommand(async (a) => show(await messagingPost(employerPath(a.employerId, 'Listings'), buildListingBody({
+        title: a.title, description: a.description, department: a.department, location: a.location, employmentType: a.employmentType,
+        applyUrl: a.applyUrl, min: a.min, max: a.max, currency: a.currency, period: a.period, submit: a.submit,
+      })))),
+    })
+    .demandCommand(1, 'Specify an employers subcommand: list | create | update | suspend | reactivate | members | invite | remove-member | set-role | listings | create-listing'),
+  handler: () => {},
+};
+
+const moderationCommand = {
+  command: 'moderation <subcommand>',
+  describe: 'Job board moderation queue: approve or reject employer listings, and the scam keyword list',
+  builder: (y) => y
+    .command({
+      command: 'list',
+      describe: 'Listings waiting for a decision',
+      handler: runCommand(async () => {
+        const rows = await messagingGet('/Recruiting/Moderation');
+        if (!Array.isArray(rows) || !rows.length) return console.log('\n  Nothing is waiting for review.\n');
+        console.log(`\n${BOLD}Moderation queue${RST} (${rows.length})\n`);
+        for (const q of rows) {
+          console.log(`  ${DIM}#${q.id}${RST}  ${q.title}  ${DIM}${q.employerName}${q.firstPosting ? ' / first posting' : ''}${q.flags ? ' / flags: ' + q.flags : ''}${RST}`);
+        }
+        console.log('');
+      }),
+    })
+    .command({
+      command: 'approve <listingId>',
+      describe: 'Approve a pending listing (it goes live and the employer becomes trusted)',
+      builder: (y2) => y2.positional('listingId', { type: 'number' }),
+      handler: runCommand(async (a) => show(await messagingPost(moderationPath(a.listingId, 'Approve'), {}))),
+    })
+    .command({
+      command: 'reject <listingId>',
+      describe: 'Reject a pending listing with a reason the employer will see',
+      builder: (y2) => y2.positional('listingId', { type: 'number' }).option('reason', { type: 'string', demandOption: true }),
+      handler: runCommand(async (a) => show(await messagingPost(moderationPath(a.listingId, 'Reject'), buildReasonBody(a.reason)))),
+    })
+    .command({
+      command: 'events <listingId>',
+      describe: 'Audit trail of one listing',
+      builder: (y2) => y2.positional('listingId', { type: 'number' }),
+      handler: runCommand(async (a) => show(await messagingGet(moderationPath(a.listingId, 'Events')))),
+    })
+    .command({ command: 'keywords', describe: 'Show the site\'s extra scam keywords and the built-in defaults', handler: runCommand(async () => show(await messagingGet('/Recruiting/Moderation/Keywords'))) })
+    .command({
+      command: 'set-keywords',
+      describe: 'Replace the site\'s extra keywords (added to the built-in list, which cannot be removed)',
+      builder: (y2) => y2.option('keywords', { describe: 'Comma or newline separated phrases; empty clears', type: 'string', demandOption: true }),
+      handler: runCommand(async (a) => show(await messagingPut('/Recruiting/Moderation/Keywords', buildKeywordsBody(a.keywords)))),
+    })
+    .demandCommand(1, 'Specify a moderation subcommand: list | approve | reject | events | keywords | set-keywords'),
+  handler: () => {},
+};
+
+export { employersCommand, moderationCommand };

package/lib/commands/recruiting.js

@@ -1,6 +1,7 @@
 import { readFileSync, writeFileSync } from 'fs';
 import { messagingGet, messagingPost, messagingPut, messagingDel, getCredentials } from '../api.js';
 import { runCommand } from '../run.js';
+import { employersCommand, moderationCommand } from './recruiting-employers.js';
 import { buildAssignBody, buildNoteBody, buildPipelineBody, buildRetentionBody, buildStageBody, applicationIdPath, buildApplySettingsBody, buildBotSettingsBody, buildHostedBody, buildJobPayBody, buildRenewBody, jobLifecyclePath, jobPayPath } from '../recruiting-apply.js';
 
 // -- velaro recruiting --------------------------------------------------------
@@ -19,6 +20,7 @@ import { buildAssignBody, buildNoteBody, buildPipelineBody, buildRetentionBody,
 //   GET    Recruiting/Jobs?includeAll=true             -> every status (needs the Job Board lifecycle package)
 //   POST   Recruiting/Jobs/{id}/close | /renew { days? } ; GET Recruiting/Lifecycle -> { entitled, defaultListingDays } (403 without the package)
 //   GET/PUT Recruiting/Hosted { enabled?, regenerateSlug? } ; POST Recruiting/Hosted/FeedKey/Rotate ; PUT Recruiting/Jobs/{id}/Pay -> hosted job pages (package job-board-hosted, 403 without it)
+//   GET    Recruiting/Applicants                       -> { entitled, hostedEnabled, signInUrl, accounts, signedInLast30Days, deletionPending, savedJobs, linkedApplications } (package job-board-applicant-accounts; counts only)
 //   GET    Recruiting/Applications                     -> candidateApplication[]
 //   GET    Recruiting/Applications/AtsFailures; POST Recruiting/Applications/{id}/AtsRetry; PUT Recruiting/ApplySettings { publicApplyEnabled?, autoCreateCaseTypeId?, defaultListingDays? }; GET Recruiting/Applications/{id}/Resume (binary)
 //   GET    Recruiting/Applications/ExportEeoc           -> text/csv (Professional tier+, EnableRecruitingBotEeoc)
@@ -146,6 +148,27 @@ async function hostedHandler(argv) {
   printHosted(r);
 }
 
+function printApplicants(r) {
+  console.log(`\n${BOLD}Job Board applicant accounts${RST}`);
+  if (!r.entitled) {
+    console.log(`  Package:  not included (applicant sign-in, my applications, saved jobs and the resume library are off)\n`);
+    return;
+  }
+  console.log(`  Package:             ${GRN}included${RST}`);
+  console.log(`  Hosted pages:        ${r.hostedEnabled ? 'published' : 'not published (sign-in needs the hosted pages on)'}`);
+  if (r.signInUrl) console.log(`  Sign-in page:        ${r.signInUrl}`);
+  console.log(`  Accounts:            ${r.accounts ?? 0}`);
+  console.log(`  Signed in, 30 days:  ${r.signedInLast30Days ?? 0}`);
+  console.log(`  Deletion pending:    ${r.deletionPending ?? 0}`);
+  console.log(`  Saved jobs:          ${r.savedJobs ?? 0}`);
+  console.log(`  Linked applications: ${r.linkedApplications ?? 0}`);
+  console.log(`  ${DIM}Counts only. Applicant emails and resumes are never listed here.${RST}\n`);
+}
+
+async function applicantsHandler() {
+  printApplicants(await messagingGet('/Recruiting/Applicants'));
+}
+
 async function hostedRotateKeyHandler() {
   const r = await messagingPost('/Recruiting/Hosted/FeedKey/Rotate', {});
   console.log(`\n${GRN}OK${RST} Feed key rotated; the previous Indeed and Google feed URLs no longer work.`);
@@ -336,6 +359,12 @@ const hostedCommand = {
   handler: runCommand(hostedHandler),
 };
 
+const applicantsCommand = {
+  command:  'applicants',
+  describe: 'Applicant accounts on the hosted job board: package status, sign-in page and account counts (needs the Job Board applicant accounts package)',
+  handler:  runCommand(applicantsHandler),
+};
+
 const applicationsCommand = {
   command:  'applications <subcommand>',
   describe: 'List candidate applications or export EEOC voluntary self-ID data',
@@ -710,12 +739,15 @@ export const recruitingCommand = {
     .command(configCommand)
     .command(jobsCommand)
     .command(hostedCommand)
+    .command(applicantsCommand)
     .command(applicationsCommand)
     .command(sourcesCommand)
     .command(pipelineCommand)
     .command(applicationCommand)
     .command(retentionCommand)
-    .demandCommand(1, 'Specify a recruiting subcommand: sync | config | jobs | hosted | applications | application | sources | pipeline | retention')
+    .command(employersCommand)
+    .command(moderationCommand)
+    .demandCommand(1, 'Specify a recruiting subcommand: sync | config | jobs | hosted | applicants | applications | application | sources | pipeline | retention | employers | moderation')
     .strict(),
   handler: () => {},
 };

package/lib/log-search.js

@@ -0,0 +1,100 @@
+// Complete Velaro Logger reads (2026-10-14).
+//
+// WHY: velaro-messaging's /superadmin/logs/search and /internal/logs/search silently under-report text queries.
+// Proven live that day: q=[HttpFallback] over 3.9 h returned 0-2 rows while 136 existed, and q=AsrsNegotiateFailed
+// (no level) returned 0 while 4 existed. The AI-search path only sees the newest 1,000 candidates and its answer was
+// final; the exact path only sees the newest 5,000 rows of the window before filtering. Neither said so.
+//
+// HOW (no q= ever sent): level/siteId/source/integration/platform/environment/correlationId are pushed to the
+// server (Table Storage OData, cheap and exact); includeTotal=true makes the server report totalCountCapped when a
+// slice hit its scan cap; a capped slice is bisected until none is capped; text (contains/regex/logger) is
+// filtered client side. The result says whether it is COMPLETE, so a 0 is never ambiguous.
+//
+// KEEP IN SYNC: this file is duplicated byte for byte in mcp/log-search.js (the npm packages ship separately);
+// cli/lib/log-search.test.js fails if the two copies drift.
+
+const MIN_SLICE_MS = 2000;
+
+/**
+ * @param {object} o
+ * @param {(query: string) => Promise<any>} o.fetchJson  GET `...search?<query>` and return parsed JSON (caller adds auth)
+ * @param {Date} o.from
+ * @param {Date} o.to
+ * @param {object} [o.params]  server-side filters: level, siteId, source, integration, platform, environment, correlationId
+ * @param {string} [o.contains] case-insensitive substring of the message (client side)
+ * @param {string} [o.regex]    regex on the message (client side)
+ * @param {string} [o.logger]   substring of the logger name (client side)
+ * @param {number} [o.maxRequests=200]
+ */
+export async function completeLogSearch({ fetchJson, from, to, params = {}, contains, regex, logger, maxRequests = 200 }) {
+  const server = {};
+  for (const k of ['level', 'siteId', 'source', 'integration', 'platform', 'environment', 'correlationId']) {
+    if (params[k] !== undefined && params[k] !== null && params[k] !== '') server[k] = String(k === 'level' ? String(params[k]).toUpperCase() : params[k]);
+  }
+  const byId = new Map();
+  const unresolved = [];
+  let requests = 0;
+  let slices = 0;
+  let scanned = 0;
+  let budgetExhausted = false;
+
+  const call = async (a, b, cursor, total) => {
+    if (requests >= maxRequests) { budgetExhausted = true; return null; }
+    requests++;
+    const q = new URLSearchParams({ from: a.toISOString(), to: b.toISOString(), take: '500', ...server });
+    if (total) q.set('includeTotal', 'true');
+    if (cursor) q.set('cursor', cursor);
+    const r = await fetchJson(q.toString());
+    return Array.isArray(r) ? { entries: r } : (r || {});
+  };
+
+  const walk = async (a, b) => {
+    const r = await call(a, b, null, true);
+    if (!r) { unresolved.push(`${a.toISOString()}..${b.toISOString()} (request budget)`); return; }
+    if (r.totalCountCapped === true && (b - a) > MIN_SLICE_MS) {
+      const mid = new Date(a.getTime() + Math.floor((b - a) / 2));
+      await walk(a, mid);
+      await walk(mid, b);
+      return;
+    }
+    if (r.totalCountCapped === true) unresolved.push(`${a.toISOString()}..${b.toISOString()} (still capped at <=2s)`);
+    slices++;
+    scanned += Number(r.totalCount ?? (r.entries?.length ?? 0));
+    for (const e of r.entries ?? []) byId.set(e.id ?? `${e.timestamp}|${e.message}`, e);
+    let cursor = r.nextCursor;
+    while (cursor) {
+      const r2 = await call(a, b, cursor, false);
+      if (!r2) { unresolved.push(`${a.toISOString()}..${b.toISOString()} (request budget while paging)`); break; }
+      for (const e of r2.entries ?? []) byId.set(e.id ?? `${e.timestamp}|${e.message}`, e);
+      cursor = r2.nextCursor;
+    }
+  };
+
+  await walk(from, to);
+
+  let rows = [...byId.values()];
+  const msg = (e) => String(e.message ?? e.Message ?? '');
+  if (contains) { const c = contains.toLowerCase(); rows = rows.filter((e) => msg(e).toLowerCase().includes(c)); }
+  if (regex) { const re = new RegExp(regex, 'i'); rows = rows.filter((e) => re.test(msg(e))); }
+  if (logger) { const l = logger.toLowerCase(); rows = rows.filter((e) => String(e.logger ?? e.Logger ?? '').toLowerCase().includes(l)); }
+  rows.sort((x, y) => String(y.timestamp ?? '').localeCompare(String(x.timestamp ?? '')));
+
+  return { entries: rows, fetched: byId.size, scanned, requests, slices, complete: unresolved.length === 0 && !budgetExhausted, unresolved, budgetExhausted };
+}
+
+/** One line a human or an LLM can trust: says COMPLETE or INCOMPLETE and how much was examined. */
+export function describeCompleteness(r) {
+  const base = `${r.entries.length} matched of ${r.fetched} fetched (server scanned ${r.scanned}) in ${r.requests} request(s)/${r.slices} slice(s)`;
+  return r.complete
+    ? `${base}; COMPLETE (no slice hit the server scan cap), so 0 matches means nothing was logged.`
+    : `${base}; INCOMPLETE (${r.unresolved.length} slice(s) unresolved${r.budgetExhausted ? ', request budget exhausted' : ''}): narrow the window or add level/site; a short or empty result is NOT proof of absence.`;
+}
+
+/** For raw (server-side q=) responses: surfaces searchPath/scannedRows/truncated so a 0 is never ambiguous. */
+export function describeRawMeta(resp) {
+  if (!resp || Array.isArray(resp) || resp.scannedRows === undefined) {
+    return 'server did not report scan metadata (older deploy): treat an empty or short result as unverified, use the complete mode.';
+  }
+  const t = resp.truncated === true;
+  return `searchPath=${resp.searchPath} scannedRows=${resp.scannedRows} truncated=${t}${t ? ' (NOT proof of absence; continue with nextCursor or narrow the window)' : ''}${resp.nextCursor ? ' nextCursor=present' : ''}`;
+}

package/lib/log-search.test.js

@@ -0,0 +1,129 @@
+// Regression (2026-10-14): velaro-messaging's logs search under-reported text queries (q=[HttpFallback] returned 0-2 rows
+// while 136 existed; q=AsrsNegotiateFailed with no level returned 0 while 4 existed) because each scan only examined the
+// newest N rows of the window and never said so. completeLogSearch must find rows behind an arbitrary pile of newer
+// rows, say COMPLETE only when no slice hit the server cap, and never send q=.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { completeLogSearch, describeCompleteness, describeRawMeta } from './log-search.js';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+
+/** Mock of the messaging search endpoint: newest-first scan capped at `cap` rows BEFORE any filter other than level/site. */
+function mockServer(rows, cap = 5000) {
+  const calls = [];
+  const fetchJson = async (query) => {
+    const p = new URLSearchParams(query);
+    calls.push(p);
+    assert.equal(p.get('q'), null, 'the complete read must never send q=');
+    assert.equal(p.get('regex'), null);
+    const from = new Date(p.get('from')).getTime();
+    const to = new Date(p.get('to')).getTime();
+    const lvl = p.get('level');
+    const site = p.get('siteId');
+    // newest first, server-side filters first, then the fetch cap (the real bug), then in-window filter
+    let pool = rows.filter((r) => (!lvl || r.level === lvl) && (!site || String(r.siteId) === site));
+    pool = pool.filter((r) => new Date(r.timestamp).getTime() >= from && new Date(r.timestamp).getTime() <= to);
+    pool.sort((a, b) => b.timestamp.localeCompare(a.timestamp));
+    const capped = pool.length >= cap;
+    const fetched = pool.slice(0, cap);
+    const take = Number(p.get('take'));
+    let start = 0;
+    if (p.get('cursor')) start = fetched.findIndex((r) => r.id === p.get('cursor')) + 1;
+    const page = fetched.slice(start, start + take);
+    const more = start + take < fetched.length;
+    const out = { entries: page, nextCursor: more ? page[page.length - 1].id : null };
+    if (p.get('includeTotal') === 'true') { out.totalCount = fetched.length; out.totalCountCapped = capped; }
+    return out;
+  };
+  return { fetchJson, calls };
+}
+
+function makeRows(n, needles) {
+  const base = Date.UTC(2026, 9, 14, 13, 45, 0);
+  const rows = [];
+  for (let i = 0; i < n; i++) {
+    rows.push({ id: `r${String(i).padStart(7, '0')}`, timestamp: new Date(base - i * 1000).toISOString(), level: 'WARN', siteId: 20519, logger: 'VisitorLoggingService', message: needles.has(i) ? '[AsrsNegotiateFailed] site=20715' : `noise ${i}` });
+  }
+  return rows;
+}
+const W = (rows) => [new Date(rows[rows.length - 1].timestamp), new Date(rows[0].timestamp)];
+
+test('the single raw call misses a needle behind 9,000 newer rows (the live bug shape)', async () => {
+  const rows = makeRows(12000, new Set([9000]));
+  const { fetchJson } = mockServer(rows, 5000);
+  const [from, to] = W(rows);
+  const raw = await fetchJson(new URLSearchParams({ from: from.toISOString(), to: to.toISOString(), take: '500', includeTotal: 'true' }).toString());
+  assert.equal(raw.totalCountCapped, true);
+  assert.equal(raw.entries.some((e) => e.message.includes('AsrsNegotiate')), false);
+});
+
+test('completeLogSearch finds the needle behind 9,000 newer rows and reports COMPLETE', async () => {
+  const rows = makeRows(12000, new Set([9000, 11000]));
+  const { fetchJson } = mockServer(rows, 5000);
+  const [from, to] = W(rows);
+  const r = await completeLogSearch({ fetchJson, from, to, contains: '[AsrsNegotiateFailed]', maxRequests: 200 });
+  assert.equal(r.entries.length, 2);
+  assert.equal(r.complete, true);
+  assert.ok(r.slices > 1, 'capped slices must have been bisected');
+  assert.match(describeCompleteness(r), /COMPLETE/);
+  assert.doesNotMatch(describeCompleteness(r), /INCOMPLETE/);
+});
+
+test('a request budget that runs out is INCOMPLETE, never a silent partial', async () => {
+  const rows = makeRows(12000, new Set([9000]));
+  const { fetchJson } = mockServer(rows, 5000);
+  const [from, to] = W(rows);
+  const r = await completeLogSearch({ fetchJson, from, to, contains: '[AsrsNegotiateFailed]', maxRequests: 2 });
+  assert.equal(r.complete, false);
+  assert.equal(r.budgetExhausted, true);
+  assert.match(describeCompleteness(r), /INCOMPLETE/);
+  assert.match(describeCompleteness(r), /NOT proof of absence/);
+});
+
+test('level and siteId are pushed server side; contains/regex/logger filter client side', async () => {
+  const rows = makeRows(300, new Set([10, 20]));
+  rows[5].logger = 'Other.Logger';
+  const { fetchJson, calls } = mockServer(rows, 5000);
+  const [from, to] = W(rows);
+  const r = await completeLogSearch({ fetchJson, from, to, params: { level: 'warn', siteId: 20519 }, regex: 'Asrs.*Failed', logger: 'visitorlogging' });
+  assert.equal(r.entries.length, 2);
+  assert.equal(calls[0].get('level'), 'WARN');
+  assert.equal(calls[0].get('siteId'), '20519');
+  assert.equal(r.complete, true);
+});
+
+test('a genuine 0 on a complete scan says so (0 means nothing was logged)', async () => {
+  const rows = makeRows(500, new Set());
+  const { fetchJson } = mockServer(rows, 5000);
+  const [from, to] = W(rows);
+  const r = await completeLogSearch({ fetchJson, from, to, contains: 'nope' });
+  assert.equal(r.entries.length, 0);
+  assert.match(describeCompleteness(r), /0 matches means nothing was logged/);
+});
+
+test('describeRawMeta surfaces searchPath/scannedRows/truncated and warns on old deploys', () => {
+  assert.match(describeRawMeta({ entries: [], searchPath: 'ai-search', scannedRows: 1000, truncated: true }), /truncated=true.*NOT proof of absence/);
+  assert.match(describeRawMeta({ entries: [], searchPath: 'table-storage', scannedRows: 911, truncated: false }), /scannedRows=911 truncated=false/);
+  assert.match(describeRawMeta([]), /older deploy/);
+  assert.match(describeRawMeta({ entries: [] }), /older deploy/);
+});
+
+test('cli/lib/log-search.js and mcp/log-search.js are byte-identical (the npm packages ship separately)', () => {
+  const a = fs.readFileSync(path.join(here, 'log-search.js'), 'utf8');
+  const b = fs.readFileSync(path.join(here, '..', '..', 'mcp', 'log-search.js'), 'utf8');
+  assert.equal(a, b, 'copy cli/lib/log-search.js to mcp/log-search.js (or the reverse)');
+});
+
+test('neither the CLI search handler nor the MCP tool sends q= in complete mode', () => {
+  const cli = fs.readFileSync(path.join(here, 'commands', 'logs.js'), 'utf8');
+  const mcp = fs.readFileSync(path.join(here, '..', '..', 'mcp', 'staff-server.js'), 'utf8');
+  for (const [name, src, marker] of [['cli', cli, 'Default: COMPLETE read'], ['mcp', mcp, 'Default: COMPLETE read']]) {
+    const tail = src.slice(src.indexOf(marker));
+    const handler = tail.slice(0, 1200);
+    assert.ok(handler.includes('completeLogSearch('), `${name}: complete mode must call completeLogSearch`);
+    assert.ok(!/params\.set\('q'/.test(handler), `${name}: complete mode must not set q=`);
+  }
+});

package/lib/messaging-routes.test.js

@@ -9,7 +9,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const dir = path.join(path.dirname(fileURLToPath(import.meta.url)), 'commands');
-const MESSAGING_ONLY = ['/Teams/List', '/Deployment', '/Users/List', '/Workflows/List', '/Rules', '/Ticket/knowledge-overrides', '/UserStatus/admin', '/api/ivr/config', '/WooCommerce/billing', '/WooCommerce/auth', '/diagnostics/test-magento', '/voice/admin', '/api/enterprise-reports', '/avatar/groups', '/avatar/workflows', '/avatar/group-overrides'];
+const MESSAGING_ONLY = ['/Teams/List', '/Deployment', '/Users/List', '/Workflows/List', '/Rules', '/Ticket/knowledge-overrides', '/UserStatus/admin', '/api/ivr/config', '/WooCommerce/billing', '/WooCommerce/auth', '/diagnostics/test-magento', '/voice/admin', '/api/enterprise-reports', '/avatar/groups', '/avatar/workflows', '/avatar/group-overrides', '/Recruiting'];
 
 test('messaging-only routes are never called through the admin api helpers', () => {
   const offenders = [];

package/lib/recruiting-employers.js

@@ -0,0 +1,78 @@
+// Pure request builders for the Job Board employer + moderation commands (Stage 5, package job-board-employers).
+// Kept free of I/O so cli/lib/recruiting-employers.test.js can pin the exact paths and bodies the messaging API expects.
+
+const trimOrNull = (v) => (v === undefined || v === null ? undefined : String(v).trim());
+
+export function employerPath(id, suffix = '') {
+  const n = Number(id);
+  if (!Number.isInteger(n) || n <= 0) throw new Error('employerId must be a positive integer');
+  return `/Recruiting/Employers/${n}${suffix ? '/' + suffix : ''}`;
+}
+
+export function memberPath(employerId, memberId) {
+  const m = Number(memberId);
+  if (!Number.isInteger(m) || m <= 0) throw new Error('memberId must be a positive integer');
+  return `${employerPath(employerId, 'Members')}/${m}`;
+}
+
+export function moderationPath(listingId, action) {
+  const n = Number(listingId);
+  if (!Number.isInteger(n) || n <= 0) throw new Error('listingId must be a positive integer');
+  return `/Recruiting/Moderation/${n}/${action}`;
+}
+
+export function buildEmployerBody({ name, domain }) {
+  const body = {};
+  const n = trimOrNull(name);
+  if (n !== undefined) body.name = n;
+  const d = trimOrNull(domain);
+  if (d !== undefined) body.verifiedDomain = d;
+  return body;
+}
+
+export function buildReasonBody(reason) {
+  const r = trimOrNull(reason);
+  if (!r || r.length < 3 || r.length > 500) throw new Error('--reason is required (3 to 500 characters)');
+  return { reason: r };
+}
+
+const ROLES = ['Owner', 'Recruiter', 'Viewer'];
+
+export function normalizeRole(role) {
+  if (role === undefined) return undefined;
+  const hit = ROLES.find((r) => r.toLowerCase() === String(role).trim().toLowerCase());
+  if (!hit) throw new Error(`role must be one of ${ROLES.join(', ')}`);
+  return hit;
+}
+
+export function buildInviteBody({ email, name, role }) {
+  const e = trimOrNull(email);
+  if (!e || !/^[^@\s]+@[^@\s]+\.[^@\s]{2,}$/.test(e)) throw new Error('--email must be a valid email address');
+  const body = { email: e, role: normalizeRole(role ?? 'Recruiter') };
+  const n = trimOrNull(name);
+  if (n) body.displayName = n;
+  return body;
+}
+
+export function buildListingBody(o) {
+  const body = {};
+  const map = { title: 'title', description: 'description', department: 'department', location: 'location', employmentType: 'employmentType', applyUrl: 'applyUrl', currency: 'salaryCurrency', period: 'salaryPeriod' };
+  for (const [from, to] of Object.entries(map)) if (o[from] !== undefined) body[to] = String(o[from]);
+  if (o.min !== undefined) body.salaryMin = Number(o.min);
+  if (o.max !== undefined) body.salaryMax = Number(o.max);
+  if (!body.title || !body.description) throw new Error('--title and --description are required');
+  if (o.submit) body.submit = true;
+  return body;
+}
+
+export function buildKeywordsBody(text) {
+  const seen = new Set();
+  const keywords = [];
+  for (const part of String(text ?? '').split(/[\n,]/)) {
+    const k = part.trim();
+    if (!k || seen.has(k.toLowerCase())) continue;
+    seen.add(k.toLowerCase());
+    keywords.push(k);
+  }
+  return { keywords };
+}

package/lib/recruiting-employers.test.js

@@ -0,0 +1,40 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { employerPath, memberPath, moderationPath, buildEmployerBody, buildReasonBody, buildInviteBody, buildListingBody, buildKeywordsBody, normalizeRole } from './recruiting-employers.js';
+
+test('paths address employers, members and moderation exactly as the messaging API routes them', () => {
+  assert.equal(employerPath(7), '/Recruiting/Employers/7');
+  assert.equal(employerPath(7, 'Suspend'), '/Recruiting/Employers/7/Suspend');
+  assert.equal(memberPath(7, 3), '/Recruiting/Employers/7/Members/3');
+  assert.equal(moderationPath(41, 'Approve'), '/Recruiting/Moderation/41/Approve');
+  assert.throws(() => employerPath('x'));
+  assert.throws(() => moderationPath(0, 'Reject'));
+});
+
+test('reject and suspend need a real reason', () => {
+  assert.deepEqual(buildReasonBody('  asks for a fee '), { reason: 'asks for a fee' });
+  assert.throws(() => buildReasonBody(''));
+  assert.throws(() => buildReasonBody('ab'));
+  assert.throws(() => buildReasonBody('x'.repeat(501)));
+});
+
+test('invite validates the email and role, defaulting to Recruiter', () => {
+  assert.deepEqual(buildInviteBody({ email: 'a@b.com' }), { email: 'a@b.com', role: 'Recruiter' });
+  assert.equal(buildInviteBody({ email: 'a@b.com', role: 'viewer', name: 'Ann' }).role, 'Viewer');
+  assert.throws(() => buildInviteBody({ email: 'nope' }));
+  assert.throws(() => normalizeRole('boss'));
+});
+
+test('employer and listing bodies map flags to API field names', () => {
+  assert.deepEqual(buildEmployerBody({ name: ' Acme ', domain: 'acme.com' }), { name: 'Acme', verifiedDomain: 'acme.com' });
+  assert.deepEqual(buildEmployerBody({}), {});
+  const l = buildListingBody({ title: 'T', description: 'D', min: '10', period: 'Hour', submit: true });
+  assert.equal(l.salaryMin, 10);
+  assert.equal(l.salaryPeriod, 'Hour');
+  assert.equal(l.submit, true);
+  assert.throws(() => buildListingBody({ title: 'T' }));
+});
+
+test('keywords are split on commas and newlines and de-duplicated', () => {
+  assert.deepEqual(buildKeywordsBody('Gift card, gift CARD\nwire\n'), { keywords: ['Gift card', 'wire'] });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@velaro/cli",
-  "version": "1.4.94",
+  "version": "1.4.96",
   "description": "Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.",
   "type": "module",
   "bin": {