@wji.ai/cli 0.4.0 → 0.5.0

package/dist/commands/npc.js

@@ -0,0 +1,413 @@
+import { writeFile } from 'node:fs/promises';
+import { Command } from 'commander';
+import { isObjectId, WjiClient } from '../core/client.js';
+import { confirm, parseKeyValues, readJson, readValue } from '../core/prompt.js';
+import { color, detail, info, isJsonMode, printJson, render, relativeTime, success, table, truncate, warn } from '../core/output.js';
+import { NPC_JOB_TYPES, NPC_STATUSES, NPC_VISIBILITIES, RESIDENTS, npcLabel, parseJob, parsePositions, resolveNpc, updateJobs, } from '../core/npc.js';
+const TRANSFERS = '/npc-city/transfers';
+export function npcCommand(globals) {
+    const npc = new Command('npc')
+        .aliases(['npc-city'])
+        .description('Manage your NPC City residents (NPCs): profile, jobs, soul, character doc, transfers');
+    // ── residents ──────────────────────────────────────────────────────────
+    npc
+        .command('list', { isDefault: true })
+        .description('Your NPCs (org NPCs with --org); --public for the public directory')
+        .option('--public', 'list the public directory instead of yours')
+        .option('-k, --keyword <text>', 'search text')
+        .option('--status <status>', NPC_STATUSES.join(' | '))
+        .option('--visibility <v>', NPC_VISIBILITIES.join(' | '))
+        .option('--page <n>', 'page number', '1')
+        .option('--limit <n>', 'page size', '20')
+        .action(async (opts) => {
+        const client = new WjiClient(globals());
+        const result = await client.get(opts.public ? RESIDENTS : `${RESIDENTS}/mine`, {
+            keyword: opts.keyword,
+            status: opts.status,
+            visibility: opts.visibility,
+            page: Number(opts.page),
+            limit: Number(opts.limit),
+        });
+        render(result, (r) => {
+            table(r?.data || [], [
+                { header: 'id', value: (n) => n.id },
+                { header: 'name', value: (n) => truncate(n.name, 20) },
+                { header: 'handle', value: (n) => n.handle },
+                { header: 'role', value: (n) => truncate(n.role, 16) },
+                { header: 'genre', value: (n) => truncate(n.genre, 16) },
+                { header: 'status', value: (n) => n.status },
+                { header: 'vis', value: (n) => n.visibility },
+                { header: 'jobs', value: (n) => (n.jobs || []).length },
+                { header: 'updated', value: (n) => relativeTime(n.updatedAt) },
+            ]);
+            pageFooter(r);
+        });
+    });
+    npc
+        .command('get <npc>')
+        .description('Show an NPC and its jobs (id, @handle or name)')
+        .action(async (token) => {
+        const client = new WjiClient(globals());
+        const r = await resolveNpc(client, token);
+        render(r, () => printNpc(r));
+    });
+    residentOptions(npc
+        .command('create <name>')
+        .description('Create an NPC (private until you publish it). Needs NPC City spawn permission.')
+        .requiredOption('--role <role>', 'role, e.g. Singer')
+        .requiredOption('--genre <genre>', 'genre, e.g. City pop')).action(async (name, opts) => {
+        const client = new WjiClient(globals());
+        const body = await residentBody(client, opts);
+        if (body.handle)
+            await assertHandle(client, body.handle);
+        const created = await client.post(RESIDENTS, { name, ...body });
+        render(created, (r) => success(`Created ${npcLabel(r)} — ${r.id} (${r.visibility})`));
+    });
+    residentOptions(npc
+        .command('set <npc>')
+        .description('Update NPC fields; only the flags you pass change')
+        .option('-n, --name <name>', 'rename')
+        .option('--role <role>', 'role')
+        .option('--genre <genre>', 'genre')).action(async (token, opts) => {
+        const client = new WjiClient(globals());
+        const current = await resolveNpc(client, token);
+        const body = await residentBody(client, opts, current);
+        if (opts.name)
+            body.name = opts.name;
+        if (!Object.keys(body).length)
+            throw new Error('Nothing to change — pass at least one field flag');
+        if (body.handle)
+            await assertHandle(client, body.handle, current.id);
+        const updated = await client.patch(`${RESIDENTS}/${current.id}`, body);
+        render(updated, (r) => success(`Updated ${npcLabel(r)}: ${Object.keys(body).join(', ')}`));
+    });
+    for (const [cmd, visibility] of [['publish', 'public'], ['unpublish', 'private']]) {
+        npc
+            .command(`${cmd} <npc>`)
+            .description(`Make an NPC ${visibility}`)
+            .action(async (token) => {
+            const client = new WjiClient(globals());
+            const r = await resolveNpc(client, token);
+            const updated = await client.patch(`${RESIDENTS}/${r.id}`, { visibility });
+            render(updated, (u) => success(`${npcLabel(u)} is now ${u.visibility}`));
+        });
+    }
+    npc
+        .command('rm <npc>')
+        .description('Delete an NPC')
+        .option('-y, --yes', 'skip confirmation')
+        .action(async (token, opts) => {
+        const client = new WjiClient(globals());
+        const r = await resolveNpc(client, token);
+        if (!(await confirm(`Delete NPC ${npcLabel(r)} (${r.id})?`, opts.yes)))
+            return info('Aborted');
+        const result = await client.delete(`${RESIDENTS}/${r.id}`);
+        render(result, () => success(`Deleted ${npcLabel(r)}`));
+    });
+    npc
+        .command('handle <handle>')
+        .description('Check whether a @handle is free')
+        .option('--exclude <npc>', "ignore this NPC's own handle")
+        .action(async (handle, opts) => {
+        const client = new WjiClient(globals());
+        const excludeId = opts.exclude ? (await resolveNpc(client, opts.exclude)).id : undefined;
+        const result = await client.get(`${RESIDENTS}/handle-available`, { handle, excludeId });
+        render(result, (r) => r.available ? success(`${r.handle} is available`) : warn(`${r.handle} is not available (${r.reason})`));
+    });
+    // ── jobs (work history) ────────────────────────────────────────────────
+    const job = npc.command('job').aliases(['jobs']).description("An NPC's work history: concerts, releases, ads…");
+    job
+        .command('list <npc>', { isDefault: true })
+        .description('Numbered work history')
+        .action(async (token) => {
+        const client = new WjiClient(globals());
+        const r = await resolveNpc(client, token);
+        render(r.jobs || [], (jobs) => printJobs(jobs));
+    });
+    jobOptions(job
+        .command('add <npc>')
+        .description('Add a job')
+        .requiredOption('-t, --type <type>', NPC_JOB_TYPES.join(' | '))
+        .requiredOption('--title <text>', 'title')
+        .requiredOption('--date <YYYY-MM-DD>', 'date')).action(async (token, opts) => {
+        const client = new WjiClient(globals());
+        const r = await resolveNpc(client, token);
+        const entry = parseJob(opts);
+        const updated = await updateJobs(client, r.id, (jobs) => [...jobs, entry]);
+        render(updated.jobs, () => success(`Added "${entry.title}" to ${npcLabel(r)} (#${updated.jobs.length})`));
+    });
+    jobOptions(job
+        .command('set <npc> <n>')
+        .description('Change job #n (see `npc job list`)')
+        .option('-t, --type <type>', NPC_JOB_TYPES.join(' | '))
+        .option('--title <text>', 'title')
+        .option('--date <YYYY-MM-DD>', 'date')).action(async (token, n, opts) => {
+        const client = new WjiClient(globals());
+        const r = await resolveNpc(client, token);
+        const updated = await updateJobs(client, r.id, (jobs) => {
+            const [i] = parsePositions([n], jobs.length);
+            jobs[i] = parseJob(opts, jobs[i]);
+            return jobs;
+        });
+        render(updated.jobs, () => success(`Updated job #${n} of ${npcLabel(r)}`));
+    });
+    job
+        .command('rm <npc> <n...>')
+        .description('Remove jobs by number')
+        .option('-y, --yes', 'skip confirmation')
+        .action(async (token, ns, opts) => {
+        const client = new WjiClient(globals());
+        const r = await resolveNpc(client, token);
+        const positions = parsePositions(ns, (r.jobs || []).length);
+        const titles = positions.map((i) => `#${i + 1} ${r.jobs[i].title}`).join(', ');
+        if (!(await confirm(`Remove ${titles} from ${npcLabel(r)}?`, opts.yes)))
+            return info('Aborted');
+        // Re-check against a fresh read so a concurrent edit can't shift the numbers.
+        const updated = await updateJobs(client, r.id, (jobs) => {
+            if (JSON.stringify(jobs) !== JSON.stringify(r.jobs)) {
+                throw new Error('The job list changed since it was read — list it again and retry');
+            }
+            return jobs.filter((_, i) => !positions.includes(i));
+        });
+        render(updated.jobs, () => success(`Removed ${positions.length} job(s); ${updated.jobs.length} left`));
+    });
+    // ── soul ───────────────────────────────────────────────────────────────
+    const soul = npc.command('soul').description("An NPC's soul config (persona, protocols, voice, assets)");
+    soul
+        .command('get <npc>', { isDefault: true })
+        .description('Print the soul config as JSON')
+        .action(async (token) => {
+        const client = new WjiClient(globals());
+        const r = await resolveNpc(client, token);
+        printJson(await client.getFresh(`${RESIDENTS}/${r.id}/soul`));
+    });
+    soul
+        .command('set <npc> <json>')
+        .description('Merge top-level soul keys (inline JSON, @file or -); nested objects are replaced whole')
+        .action(async (token, json) => {
+        const client = new WjiClient(globals());
+        const r = await resolveNpc(client, token);
+        const soulConfig = await readJson(json);
+        if (!soulConfig || typeof soulConfig !== 'object' || Array.isArray(soulConfig)) {
+            throw new Error('Soul config must be a JSON object');
+        }
+        const updated = await client.patch(`${RESIDENTS}/${r.id}/soul`, { soulConfig });
+        render(updated, () => success(`Updated soul of ${npcLabel(r)}: ${Object.keys(soulConfig).join(', ')}`));
+    });
+    // ── character document ────────────────────────────────────────────────
+    const doc = npc.command('doc').description('Export / apply the character document (profile + soul in one file)');
+    doc
+        .command('export <npc>')
+        .description('Print or save the character document')
+        .option('--format <format>', 'md | json', 'md')
+        .option('-o, --out <file>', 'write to a file instead of stdout')
+        .action(async (token, opts) => {
+        const client = new WjiClient(globals());
+        const r = await resolveNpc(client, token);
+        const result = await client.getFresh(`${RESIDENTS}/${r.id}/document`, { format: opts.format });
+        if (opts.out) {
+            await writeFile(opts.out, result.text);
+            return render({ file: opts.out, format: result.format }, () => success(`Wrote ${opts.out}`));
+        }
+        render(result, () => process.stdout.write(result.text.endsWith('\n') ? result.text : `${result.text}\n`));
+    });
+    doc
+        .command('apply <npc> <text>')
+        .description('Preview the changes a document makes (@file or -), confirm, then apply')
+        .option('--dry-run', 'only show the changes')
+        .option('-y, --yes', 'skip confirmation')
+        .action(async (token, source, opts) => {
+        const client = new WjiClient(globals());
+        const r = await resolveNpc(client, token);
+        const text = await readValue(source);
+        const base = `${RESIDENTS}/${r.id}/document`;
+        const preview = await client.post(`${base}/preview`, { text });
+        const changes = preview.changes || [];
+        if (opts.dryRun || !changes.length) {
+            return render(preview, () => {
+                printChanges(changes, preview.warnings);
+                if (!changes.length)
+                    info('Nothing to apply');
+            });
+        }
+        if (!isJsonMode())
+            printChanges(changes, preview.warnings);
+        if (!(await confirm(`Apply ${changes.length} change(s) to ${npcLabel(r)}?`, opts.yes)))
+            return info('Aborted');
+        const applied = await client.post(base, { text });
+        render(applied, (a) => {
+            for (const w of a.warnings || [])
+                warn(w);
+            success(`Applied ${(a.applied || []).length} change(s) to ${npcLabel(r)}`);
+        });
+    });
+    // ── transfers ─────────────────────────────────────────────────────────
+    const transfer = npc
+        .command('transfer')
+        .description('Hand an NPC to another user; they accept within 7 days');
+    transfer
+        .command('send <npc>')
+        .description('Offer an NPC to another user')
+        .requiredOption('--to <user>', 'recipient email or user id')
+        .option('-y, --yes', 'skip confirmation')
+        .action(async (token, opts) => {
+        const client = new WjiClient(globals());
+        const r = await resolveNpc(client, token);
+        if (!(await confirm(`Offer ${npcLabel(r)} to ${opts.to}? You lose it once they accept.`, opts.yes))) {
+            return info('Aborted');
+        }
+        const target = isObjectId(opts.to) ? { toUserId: opts.to } : { email: opts.to };
+        const result = await client.post(`${RESIDENTS}/${r.id}/transfer`, target);
+        render(result, (t) => success(`Transfer ${t.id} to ${t.toOwner?.name || opts.to} pending until ${t.expiresAt}`));
+    });
+    transfer
+        .command('list', { isDefault: true })
+        .description('Pending transfers, incoming and outgoing')
+        .action(async () => {
+        const client = new WjiClient(globals());
+        const [incoming, outgoing] = await Promise.all([
+            client.getFresh(`${TRANSFERS}/incoming`),
+            client.getFresh(`${TRANSFERS}/outgoing`),
+        ]);
+        const rows = [
+            ...(incoming || []).map((t) => ({ ...t, direction: 'in' })),
+            ...(outgoing || []).map((t) => ({ ...t, direction: 'out' })),
+        ];
+        render(rows, () => table(rows, [
+            { header: 'id', value: (t) => t.id },
+            { header: 'dir', value: (t) => t.direction },
+            { header: 'npc', value: (t) => (t.resident ? npcLabel(t.resident) : null) },
+            { header: 'from', value: (t) => t.fromOwner?.name },
+            { header: 'to', value: (t) => t.toOwner?.name },
+            { header: 'expires', value: (t) => relativeTime(t.expiresAt) },
+        ]));
+    });
+    for (const action of ['accept', 'reject', 'cancel']) {
+        transfer
+            .command(`${action} <transferId>`)
+            .description(action === 'cancel' ? 'Withdraw a transfer you sent' : `${action[0].toUpperCase()}${action.slice(1)} a transfer sent to you`)
+            .action(async (id) => {
+            const client = new WjiClient(globals());
+            const result = await client.post(`${TRANSFERS}/${id}/${action}`);
+            render(result, (t) => success(`Transfer ${id}: ${t.status}${t.resident ? ` (${npcLabel(t.resident)})` : ''}`));
+        });
+    }
+    return npc;
+}
+// ── helpers ──────────────────────────────────────────────────────────────
+function residentOptions(cmd) {
+    return cmd
+        .option('--handle <handle>', '@handle (a-z 0-9 . _ -, 2–32)')
+        .option('--tagline <text>', 'one-line tagline')
+        .option('--bio <text>', 'bio (@file / - supported)')
+        .option('--image <url|assetId>', 'avatar image')
+        .option('--hero-image <url|assetId>', 'hero image')
+        .option('--color <hex>', 'accent color')
+        .option('--status <status>', NPC_STATUSES.join(' | '))
+        .option('--visibility <v>', NPC_VISIBILITIES.join(' | '))
+        .option('--social <key=url...>', 'ig / yt / tw / web')
+        .option('--tag <key=value...>', 'card tags: rating, type, role, gender, tier, language…')
+        .option('--set <key=value...>', 'any other field, e.g. liveEnabled=true');
+}
+function jobOptions(cmd) {
+    return cmd
+        .option('--detail <text>', 'what happened')
+        .option('--location <text>', 'where')
+        .option('--url <url>', 'link');
+}
+/** The resident fields a create / set carries, from flags. `current` merges socials / tags. */
+async function residentBody(client, opts, current) {
+    const body = {};
+    if (opts.role)
+        body.role = opts.role;
+    if (opts.genre)
+        body.genre = opts.genre;
+    if (opts.handle)
+        body.handle = opts.handle;
+    if (opts.tagline !== undefined)
+        body.tagline = opts.tagline;
+    if (opts.bio !== undefined)
+        body.bio = await readValue(opts.bio);
+    if (opts.image)
+        body.image = await imageUrl(client, opts.image);
+    if (opts.heroImage)
+        body.heroImage = await imageUrl(client, opts.heroImage);
+    if (opts.color)
+        body.color = opts.color;
+    if (opts.status)
+        body.status = oneOf(opts.status, NPC_STATUSES, '--status');
+    if (opts.visibility)
+        body.visibility = oneOf(opts.visibility, NPC_VISIBILITIES, '--visibility');
+    if (opts.social)
+        body.socials = { ...(current?.socials || {}), ...parseKeyValues(opts.social) };
+    if (opts.tag)
+        body.tags = { ...(current?.tags || {}), ...parseKeyValues(opts.tag) };
+    Object.assign(body, parseKeyValues(opts.set));
+    return body;
+}
+/** Residents store image URLs; an asset id is swapped for its ready URL. */
+async function imageUrl(client, value) {
+    if (!isObjectId(value))
+        return value;
+    const [asset] = await client.checkAssetStatus([value]);
+    if (!asset?.url)
+        throw new Error(`Asset ${value} has no URL yet (missing, not yours, or still pending)`);
+    return asset.url;
+}
+async function assertHandle(client, handle, excludeId) {
+    const r = await client.get(`${RESIDENTS}/handle-available`, { handle, excludeId });
+    if (!r.available)
+        throw new Error(`Handle ${r.handle || handle} is not available (${r.reason})`);
+}
+function oneOf(value, allowed, flag) {
+    if (!allowed.includes(value))
+        throw new Error(`${flag} must be one of ${allowed.join(', ')}`);
+    return value;
+}
+function pageFooter(r) {
+    const p = r?.pagination;
+    if (!p)
+        return;
+    info(color.dim(`${p.total} total · page ${p.page}${p.hasNext ? ` · more: --page ${p.page + 1}` : ''}`));
+}
+function printNpc(r) {
+    detail([
+        ['id', r.id],
+        ['name', r.name],
+        ['handle', r.handle],
+        ['role', r.role],
+        ['genre', r.genre],
+        ['status', r.status],
+        ['visibility', r.visibility],
+        ['tagline', r.tagline],
+        ['bio', truncate(r.bio, 120)],
+        ['image', r.image],
+        ['owner', r.owner?.name || r.owner],
+        ['organization', r.organization?.name || r.organization],
+        ['tags', r.tags && Object.keys(r.tags).length ? r.tags : null],
+        ['socials', r.socials && Object.keys(r.socials).length ? r.socials : null],
+        ['live', r.liveEnabled ? (r.livePublic ? 'enabled, public' : 'enabled') : null],
+        ['updated', relativeTime(r.updatedAt)],
+    ]);
+    process.stdout.write('\n');
+    printJobs(r.jobs || []);
+}
+function printJobs(jobs) {
+    table(jobs.map((j, i) => ({ ...j, n: i + 1 })), [
+        { header: '#', value: (j) => j.n },
+        { header: 'date', value: (j) => j.date },
+        { header: 'type', value: (j) => j.type },
+        { header: 'title', value: (j) => truncate(j.title, 32) },
+        { header: 'detail', value: (j) => truncate(j.detail, 32) },
+        { header: 'location', value: (j) => truncate(j.location, 20) },
+    ]);
+}
+function printChanges(changes, warnings = []) {
+    for (const w of warnings)
+        warn(w);
+    table(changes, [
+        { header: 'path', value: (c) => c.path },
+        { header: 'from', value: (c) => truncate(JSON.stringify(c.from ?? null), 40) },
+        { header: 'to', value: (c) => truncate(JSON.stringify(c.to ?? null), 40) },
+    ]);
+}

package/dist/commands/workspace.js

@@ -3,6 +3,7 @@ import { WjiClient } from '../core/client.js';
 import { updateProfile } from '../core/config.js';
 import { confirm, parseKeyValues } from '../core/prompt.js';
 import { color, detail, info, relativeTime, render, success, table, truncate } from '../core/output.js';
+import { loadMembers, memberLabel, resolveMember } from '../core/members.js';
 /** App tokens accepted by `--app`; mirrors WorkspaceApplication on the backend. */
 const APPS = {
     dataset: 'Dataset',
@@ -212,47 +213,131 @@ export function workspaceCommand(globals) {
         render(result, () => success(`Removed ${appId}`));
     });
     // ── members ────────────────────────────────────────────────────────────────
-    const members = ws.command('member').description('Manage workspace members');
+    const members = ws.command('member').description('Manage workspace members and invitations');
+    const who = 'member: name, email, user id or membership id';
     members
         .command('list [id]')
         .description('List members')
-        .action(async (id) => {
+        .option('-r, --role <role>', 'only this role: owner | editor | viewer')
+        .action(async (id, opts) => {
         const client = new WjiClient(globals());
-        const w = await client.get(`/workspace/list/${client.requireWorkspace(id)}`);
-        render(w.members || [], (rows) => table(rows, [
-            { header: 'memberId', value: (m) => m.id },
-            { header: 'user', value: (m) => m.user?.id || m.user },
-            { header: 'name', value: (m) => m.user?.name },
+        const { members: rows } = await loadMembers(client, client.requireWorkspace(id));
+        const shown = rows.filter((m) => !opts.role || m.role === opts.role);
+        render(shown, () => table(shown, [
+            { header: 'name', value: (m) => m.name },
+            { header: 'email', value: (m) => m.email },
             { header: 'role', value: (m) => m.role },
+            { header: 'user', value: (m) => color.dim(m.userId) },
+            { header: 'memberId', value: (m) => color.dim(m.memberId) },
         ]));
     });
     members
-        .command('add <userId> [id]')
-        .description('Add a member (editor by default)')
+        .command('add <userIds...>')
+        .description('Add registered users by user id (at most 50; existing members are skipped). Invite by email with `member invite`.')
+        .option('-r, --role <role>', 'editor | viewer', 'editor')
+        .option('-w, --workspace <id>', 'workspace (defaults to the selected one)')
+        .action(async (userIds, opts) => {
+        if (userIds.length > 50)
+            throw new Error('At most 50 users per call');
+        const client = new WjiClient(globals());
+        const result = await client.post(`/workspace/list/${client.requireWorkspace(opts.workspace)}/member/add-batch`, {
+            users: userIds,
+            role: opts.role,
+        });
+        render(result, (r) => {
+            success(`Added ${r.added?.length ?? 0} as ${opts.role}`);
+            if (r.skipped?.length)
+                info(color.dim(`Already members: ${r.skipped.join(', ')}`));
+        });
+    });
+    members
+        .command('invite <emails...>')
+        .description('Invite by email (at most 50, owner only): registered users join at once, the others get an invitation email. ' +
+        'Emailing an invitation replaces the current share link.')
+        .option('-r, --role <role>', 'editor | viewer (students who generate need editor)', 'editor')
+        .option('-w, --workspace <id>', 'workspace (defaults to the selected one)')
+        .action(async (emails, opts) => {
+        const list = emails.flatMap((e) => e.split(/[\s,;]+/)).filter(Boolean);
+        if (list.length > 50)
+            throw new Error(`At most 50 emails per call (got ${list.length}) — split the list`);
+        const client = new WjiClient(globals());
+        const r = await client.post(`/invitation/workspace/${client.requireWorkspace(opts.workspace)}/invite-emails`, {
+            emails: list,
+            role: opts.role,
+        });
+        render(r, () => {
+            detail([
+                ['added', r.added?.length ? r.added.join(', ') : undefined],
+                ['invited', r.invited?.length ? r.invited.join(', ') : undefined],
+                ['skipped', r.skipped?.length ? `${r.skipped.join(', ')} ${color.dim('(already members)')}` : undefined],
+                ['invalid', r.invalid?.length ? color.red(r.invalid.join(', ')) : undefined],
+            ]);
+            if (r.invited?.length)
+                info(color.dim('Invited people join once they sign up and open the emailed link.'));
+        });
+    });
+    members
+        .command('link [id]')
+        .description('Create the workspace share link (owner only, valid 7 days). A new link revokes the previous one; anyone with it can join until it expires.')
         .option('-r, --role <role>', 'editor | viewer', 'editor')
-        .action(async (userId, id, opts) => {
+        .option('--show', 'show the active link instead of creating a new one')
+        .action(async (id, opts) => {
         const client = new WjiClient(globals());
-        const result = await client.post(`/workspace/list/${client.requireWorkspace(id)}/member/add`, { user: userId, role: opts.role });
-        render(result, () => success(`Added ${userId} as ${opts.role}`));
+        const wsId = client.requireWorkspace(id);
+        if (opts.show) {
+            const rows = await client.getFresh(`/invitation/workspace/${wsId}`);
+            return render(rows, (list) => list.length
+                ? table(list, [
+                    { header: 'url', value: (it) => it.url },
+                    { header: 'role', value: (it) => it.role },
+                    { header: 'expires', value: (it) => relativeTime(it.expiredAt) },
+                ])
+                : info('No active link. Create one with `wji ws member link`.'));
+        }
+        if (opts.role === 'owner')
+            throw new Error('A share link cannot make owners');
+        // No expiredAt: the DTO converts it to a Date before checking it is a string, so any value is
+        // rejected (400 "expiredAt must be a string"); the server default is 7 days.
+        const it = await client.post('/invitation/create', { targetType: 'workspace', targetId: wsId, role: opts.role });
+        render(it, () => {
+            success(`Share link (${it.role}, expires ${relativeTime(it.expiredAt)}):`);
+            process.stdout.write(`${it.url}\n`);
+        });
     });
     members
-        .command('role <memberId> <role> [id]')
-        .description('Change a member role')
-        .action(async (memberId, role, id) => {
+        .command('role <member> <role>')
+        .description(`Change a member role (editor | viewer); ${who}`)
+        .option('-w, --workspace <id>', 'workspace (defaults to the selected one)')
+        .action(async (token, role, opts) => {
+        if (!['editor', 'viewer'].includes(role))
+            throw new Error('Role must be editor or viewer (ownership transfers from the web)');
         const client = new WjiClient(globals());
-        const result = await client.put(`/workspace/list/${client.requireWorkspace(id)}/member/${memberId}/role`, { role });
-        render(result, () => success(`${memberId} is now ${role}`));
+        const wsId = client.requireWorkspace(opts.workspace);
+        const m = resolveMember((await loadMembers(client, wsId)).members, token);
+        if (m.role === 'owner')
+            throw new Error(`${memberLabel(m)} is the owner; their role cannot change`);
+        const result = await client.put(`/workspace/list/${wsId}/member/${m.memberId}/role`, { role });
+        render(result, () => success(`${memberLabel(m)} is now ${role}`));
     });
     members
-        .command('rm <memberId> [id]')
-        .description('Remove a member')
+        .command('rm <members...>')
+        .description(`Remove members; ${who}. Their canvases stay.`)
+        .option('-w, --workspace <id>', 'workspace (defaults to the selected one)')
         .option('-y, --yes', 'skip confirmation')
-        .action(async (memberId, id, opts) => {
-        if (!(await confirm(`Remove member ${memberId}?`, opts.yes)))
-            return info('Aborted');
+        .action(async (tokens, opts) => {
         const client = new WjiClient(globals());
-        const result = await client.delete(`/workspace/list/${client.requireWorkspace(id)}/member/${memberId}`);
-        render(result, () => success(`Removed ${memberId}`));
+        const wsId = client.requireWorkspace(opts.workspace);
+        const all = (await loadMembers(client, wsId)).members;
+        const targets = tokens.map((t) => resolveMember(all, t));
+        const owner = targets.find((m) => m.role === 'owner');
+        if (owner)
+            throw new Error(`${memberLabel(owner)} is the owner and cannot be removed`);
+        const names = targets.map((m) => `${memberLabel(m)} (${m.role})`).join(', ');
+        if (!(await confirm(`Remove ${names} from the workspace?`, opts.yes)))
+            return info('Aborted');
+        for (const m of targets)
+            await client.delete(`/workspace/list/${wsId}/member/${m.memberId}`);
+        render({ removed: targets.map((m) => m.userId) }, () => success(`Removed ${names}`));
     });
     // ── quota / stats ──────────────────────────────────────────────────────────
     ws.command('quota [id]')

package/dist/core/members.js

@@ -0,0 +1,54 @@
+export async function loadMembers(client, workspaceId) {
+    const ws = await client.getFresh(`/workspace/list/${workspaceId}`);
+    const members = (ws.members || []).map((m) => ({
+        memberId: String(m.id),
+        userId: String(m.user?.id ?? m.user ?? ''),
+        name: String(m.user?.name || ''),
+        email: String(m.user?.email || ''),
+        role: m.role,
+    }));
+    return { workspace: ws, members };
+}
+/** What people call a member in a list: the name, else the email, else the id. */
+export const memberLabel = (m) => m.name || m.email || m.userId;
+/**
+ * One member from what a person would type: user id, membership id, email or
+ * name (case-insensitive), else a unique name prefix. Ambiguity is an error,
+ * never a guess.
+ */
+export function resolveMember(members, token) {
+    const t = token.trim();
+    const lower = t.toLowerCase();
+    const exact = members.find((m) => m.userId === t || m.memberId === t);
+    if (exact)
+        return exact;
+    const byEmail = members.filter((m) => m.email.toLowerCase() === lower);
+    if (byEmail.length === 1)
+        return byEmail[0];
+    const byName = members.filter((m) => m.name.toLowerCase() === lower);
+    if (byName.length === 1)
+        return byName[0];
+    if (byName.length > 1) {
+        throw new Error(`Several members are called "${t}": ${byName.map((m) => `${m.email || m.userId}`).join(', ')} — use the email or user id`);
+    }
+    const prefix = members.filter((m) => m.name.toLowerCase().startsWith(lower) || m.email.toLowerCase().startsWith(lower));
+    if (prefix.length === 1)
+        return prefix[0];
+    if (prefix.length > 1) {
+        throw new Error(`"${t}" matches several members: ${prefix.map(memberLabel).join(', ')}`);
+    }
+    throw new Error(`No member "${t}" in this workspace. See \`wji ws member list\`.`);
+}
+/** Run `fn` over `items` with at most `limit` in flight, keeping input order. */
+export async function mapLimit(items, limit, fn) {
+    const out = new Array(items.length);
+    let next = 0;
+    const worker = async () => {
+        while (next < items.length) {
+            const i = next++;
+            out[i] = await fn(items[i], i);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+    return out;
+}