quoxcli 0.0.0-stage → 0.3.1

package/lib/commands/sso.js

@@ -0,0 +1,229 @@
+/**
+ * SSO commands: org SSO provider registry (OIDC + SAML admin CRUD)
+ *
+ * quox sso providers list|get|create|update|delete|saml-metadata
+ *
+ * Backend: services/auth/routes/sso.js, mounted at plain `/api`
+ * (org-scoped IN the URL for admin routes: /api/orgs/:orgId/sso/providers...).
+ * Enterprise-tier + ORG_MANAGE_SSO gated — expect 402/403 on non-enterprise
+ * orgs.
+ *
+ * `saml-metadata` is the one exception: its backend route has NO orgId
+ * segment (`/api/sso/providers/:providerId/saml-metadata`) and is public
+ * (no auth chain) — see endpoints/sso.js for the full finding. It only
+ * works for providers whose protocol is 'saml'.
+ *
+ * The browser-flow login/callback/discover routes are intentionally not
+ * exposed here — they're 302-redirect handshakes, not CLI-shaped.
+ */
+
+import { readFileSync } from 'node:fs';
+import { formatOutput, formatDetail, printSuccess, printWarning, printInfo } from '../core/output.js';
+import { resolveOrgId, parseJSON } from './helpers.js';
+import { resolveEndpoint } from '../api/endpoints.js';
+
+/** Build a create/update body from the shared provider flags. */
+function buildProviderBody(options) {
+  const body = {};
+  if (options.protocol) body.protocol = options.protocol;
+  if (options.key) body.provider_key = options.key;
+  if (options.displayName) body.display_name = options.displayName;
+  if (options.enabled) body.enabled = true;
+  if (options.disabled) body.enabled = false;
+  if (options.ssoOnly) body.sso_only = true;
+  if (options.emailDomains) {
+    body.email_domains = options.emailDomains.split(',').map(d => d.trim()).filter(Boolean);
+  }
+  // OIDC
+  if (options.issuer) body.issuer = options.issuer;
+  if (options.clientId) body.client_id = options.clientId;
+  if (options.clientSecret) body.client_secret = options.clientSecret;
+  if (options.authzUrl) body.authz_url = options.authzUrl;
+  if (options.tokenUrl) body.token_url = options.tokenUrl;
+  if (options.userinfoUrl) body.userinfo_url = options.userinfoUrl;
+  if (options.jwksUri) body.jwks_uri = options.jwksUri;
+  if (options.scopes) body.scopes = options.scopes.split(',').map(s => s.trim()).filter(Boolean);
+  // SAML
+  if (options.entityId) body.entity_id = options.entityId;
+  if (options.ssoUrl) body.sso_url = options.ssoUrl;
+  if (options.sloUrl) body.slo_url = options.sloUrl;
+  if (options.x509CertFile) body.x509_cert = readFileSync(options.x509CertFile, 'utf-8');
+  if (options.nameidFormat) body.nameid_format = options.nameidFormat;
+  if (options.attributeMap) body.attribute_map = parseJSON(options.attributeMap, '--attribute-map');
+  if (options.groupRoleMap) body.group_role_map = parseJSON(options.groupRoleMap, '--group-role-map');
+  return body;
+}
+
+function addProviderFlags(cmd) {
+  return cmd
+    .option('--protocol <protocol>', 'oidc|saml (create defaults to oidc)')
+    .option('--display-name <name>', 'human-readable name')
+    .option('--enabled', 'enable the provider')
+    .option('--disabled', 'disable the provider')
+    .option('--sso-only', 'require SSO for matching email domains (disable password login)')
+    .option('--email-domains <domains>', 'comma-separated email domains routed to this provider')
+    .option('--issuer <url>', '[oidc] issuer URL')
+    .option('--client-id <id>', '[oidc] client ID')
+    .option('--client-secret <secret>', '[oidc] client secret')
+    .option('--authz-url <url>', '[oidc] authorization endpoint (optional, discovered if omitted)')
+    .option('--token-url <url>', '[oidc] token endpoint')
+    .option('--userinfo-url <url>', '[oidc] userinfo endpoint')
+    .option('--jwks-uri <url>', '[oidc] JWKS URI')
+    .option('--scopes <scopes>', '[oidc] comma-separated scopes (default: openid,email,profile)')
+    .option('--entity-id <id>', '[saml] IdP entity ID')
+    .option('--sso-url <url>', '[saml] IdP SSO URL')
+    .option('--slo-url <url>', '[saml] IdP SLO URL')
+    .option('--x509-cert-file <path>', '[saml] path to the IdP\'s PEM-encoded x509 certificate')
+    .option('--nameid-format <format>', '[saml] NameID format')
+    .option('--attribute-map <json>', '[saml] attribute mapping as a JSON object')
+    .option('--group-role-map <json>', '[saml] group-to-role mapping as a JSON object');
+}
+
+export function registerSsoCommands(program, ctx) {
+  const { client, auth } = ctx;
+
+  const sso = program
+    .command('sso')
+    .description('Manage org SSO providers (enterprise — OIDC/SAML admin)');
+
+  const providers = sso
+    .command('providers')
+    .description('Manage SSO provider configurations');
+
+  // ── sso providers list ──────────────────────────────────────────────────────
+
+  providers
+    .command('list')
+    .description('List SSO providers for the active org')
+    .action(async () => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('sso.providers.list', { orgId });
+      const data = await client.get(ep.path, { service: ep.service });
+      const rows = data.providers || data || [];
+
+      formatOutput({
+        columns: ['id', 'protocol', 'provider_key', 'display_name', 'enabled', 'sso_only', 'created_at'],
+        headers: ['ID', 'Protocol', 'Key', 'Display Name', 'Enabled', 'SSO Only', 'Created'],
+        rows,
+      }, { format: program.opts().output, emptyMessage: 'No SSO providers configured.' });
+    });
+
+  // ── sso providers get ───────────────────────────────────────────────────────
+
+  providers
+    .command('get')
+    .description('Show SSO provider details')
+    .argument('<providerId>', 'provider ID')
+    .action(async (providerId) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('sso.providers.get', { orgId, providerId });
+      const data = await client.get(ep.path, { service: ep.service });
+      const provider = data.provider || data;
+
+      formatDetail(provider, {
+        format: program.opts().output,
+        title: `SSO Provider: ${provider.display_name || provider.provider_key || providerId}`,
+        fields: [
+          'id', 'protocol', 'provider_key', 'display_name', 'enabled', 'sso_only',
+          'issuer', 'client_id', 'authz_url', 'token_url', 'userinfo_url', 'jwks_uri', 'scopes',
+          'entity_id', 'sso_url', 'slo_url', 'nameid_format', 'attribute_map', 'group_role_map',
+          'email_domains', 'created_at', 'updated_at',
+        ],
+      });
+    });
+
+  // ── sso providers create ────────────────────────────────────────────────────
+
+  addProviderFlags(
+    providers
+      .command('create')
+      .description('Create an SSO provider')
+      .requiredOption('--key <providerKey>', 'unique provider key (e.g. "okta", "google-workspace")'),
+  ).action(async (options) => {
+    auth.requireAuth();
+    const orgId = resolveOrgId(auth, program);
+    const body = buildProviderBody(options);
+
+    const ep = resolveEndpoint('sso.providers.create', { orgId });
+    const data = await client.post(ep.path, { service: ep.service, body });
+    printSuccess(`SSO provider "${options.key}" created.`);
+    formatDetail(data.provider || data, { format: program.opts().output });
+  });
+
+  // ── sso providers update ────────────────────────────────────────────────────
+
+  addProviderFlags(
+    providers
+      .command('update')
+      .description('Update an SSO provider')
+      .argument('<providerId>', 'provider ID'),
+  ).action(async (providerId, options) => {
+    auth.requireAuth();
+    const orgId = resolveOrgId(auth, program);
+    const body = buildProviderBody(options);
+
+    if (Object.keys(body).length === 0) {
+      throw new Error('Specify at least one field to update.');
+    }
+
+    const ep = resolveEndpoint('sso.providers.update', { orgId, providerId });
+    const data = await client.patch(ep.path, { service: ep.service, body });
+    printSuccess('SSO provider updated.');
+    formatDetail(data.provider || data, { format: program.opts().output });
+  });
+
+  // ── sso providers delete ────────────────────────────────────────────────────
+
+  providers
+    .command('delete')
+    .description('Delete an SSO provider')
+    .argument('<providerId>', 'provider ID')
+    .option('--force', 'skip confirmation')
+    .action(async (providerId, options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+
+      if (!options.force && !program.opts().yes) {
+        const { default: inquirer } = await import('inquirer');
+        const ans = await inquirer.prompt([{
+          type: 'confirm',
+          name: 'confirm',
+          message: `Delete SSO provider ${providerId}? Users routed to it will fall back to password login.`,
+          default: false,
+        }]);
+        if (!ans.confirm) {
+          printInfo('Cancelled.');
+          return;
+        }
+      }
+
+      const ep = resolveEndpoint('sso.providers.delete', { orgId, providerId });
+      await client.delete(ep.path, { service: ep.service });
+      printSuccess('SSO provider deleted.');
+    });
+
+  // ── sso providers saml-metadata ─────────────────────────────────────────────
+
+  providers
+    .command('saml-metadata')
+    .description('Fetch the SP metadata XML for a SAML provider (paste into your IdP)')
+    .argument('<providerId>', 'provider ID (must be a SAML provider)')
+    .action(async (providerId) => {
+      auth.requireAuth();
+      // This backend route is public and NOT org-scoped in the URL — see
+      // endpoints/sso.js's header note. No orgId is sent.
+      const ep = resolveEndpoint('sso.providers.saml-metadata', { providerId });
+      const data = await client.get(ep.path, { service: ep.service });
+      // The route returns `application/xml`, so client.get() hands back
+      // `{ success: true, text: '<...xml...>' }` (its non-JSON-content-type
+      // fallback) rather than a parsed body.
+      const xml = data?.text ?? data;
+      if (program.opts().output === 'json') {
+        console.log(JSON.stringify({ metadata: xml }, null, 2));
+      } else {
+        console.log(typeof xml === 'string' ? xml : JSON.stringify(xml, null, 2));
+      }
+    });
+}

package/lib/commands/status.js

@@ -0,0 +1,137 @@
+/**
+ * quox status — Platform Pulse
+ *
+ * Displays a one-screen overview of the entire Quox platform:
+ * services, fleet, sessions, vault, memory, AEE, workflows.
+ *
+ * CLI-3a (Stream CLI Phase 3)
+ */
+
+import chalk from 'chalk';
+import { emitCliEvent } from '../core/aee.js';
+import { resolveEndpoint } from '../api/endpoints.js';
+
+const STATUS_ICON = {
+  ok: chalk.green('●'),
+  degraded: chalk.yellow('●'),
+  down: chalk.red('●'),
+};
+
+function statusDot(status) {
+  return STATUS_ICON[status] || chalk.dim('○');
+}
+
+function renderPulse(data) {
+  const lines = [];
+
+  // Header
+  const scoreColor = data.score >= 90 ? chalk.green : data.score >= 70 ? chalk.yellow : chalk.red;
+  lines.push('');
+  lines.push(chalk.bold(` QUOX PLATFORM STATUS`) + chalk.dim(`  ${scoreColor(`Health: ${data.score}%`)}  ${data.timestamp || ''}`));
+  lines.push(chalk.dim(' ' + '─'.repeat(60)));
+
+  // Services
+  const svcLine = Object.entries(data.services || {})
+    .map(([name, s]) => `${statusDot(s.status)} ${name}`)
+    .join('  ');
+  lines.push(` Services    ${svcLine}`);
+
+  // Fleet
+  const f = data.fleet || {};
+  lines.push(` Fleet       ${f.total || 0} agents  (${chalk.green(f.healthy || 0)} healthy, ${chalk.yellow(f.degraded || 0)} degraded, ${chalk.red(f.down || 0)} down)`);
+
+  // Sessions
+  const s = data.sessions || {};
+  const providers = Object.entries(s.providers || {}).map(([k, v]) => `${v} ${k}`).join(', ');
+  lines.push(` Sessions    ${s.active || 0} active  ${providers ? `(${providers})` : ''}  ${chalk.dim(`$${(s.cost_today_usd || 0).toFixed(2)} today`)}`);
+
+  // Workflows
+  const w = data.workflows || {};
+  const wfParts = [];
+  if (w.running) wfParts.push(`${w.running} running`);
+  if (w.pending_approval) wfParts.push(`${w.pending_approval} pending approval`);
+  if (wfParts.length) lines.push(` Workflows   ${wfParts.join(', ')}`);
+
+  // Vault
+  const v = data.vault || {};
+  if (v.total) {
+    const vaultWarn = v.expiring_soon > 0 ? chalk.yellow(` (${v.expiring_soon} expiring soon)`) : '';
+    lines.push(` Vault       ${v.total} creds  (${chalk.green(v.healthy)} healthy)${vaultWarn}`);
+  }
+
+  // Memory
+  const m = data.memory || {};
+  if (m.entries) {
+    const size = m.vector_size_gb ? `  ${m.vector_size_gb}GB vectors` : '';
+    lines.push(` Memory      ${m.entries.toLocaleString()} entries${size}`);
+  }
+
+  // AEE
+  const a = data.aee || {};
+  if (a.envelopes_today) {
+    const integrity = a.chain_ok ? chalk.green('✓') : chalk.red('✗');
+    lines.push(` AEE         ${a.envelopes_today.toLocaleString()} envelopes today  chain integrity ${integrity}`);
+  }
+
+  lines.push('');
+  return lines.join('\n');
+}
+
+export function registerStatusCommand(program, ctx) {
+  const { client } = ctx;
+
+  program
+    .command('status')
+    .description('Show platform health and status overview')
+    .action(async (opts, cmd) => {
+      const outputFormat = cmd.parent?.opts()?.output || 'table';
+      const isJson = outputFormat === 'json' || cmd.parent?.opts()?.json;
+
+      try {
+        // fleet #602: this used to pass noAuth: true, which suppressed the
+        // Authorization header the client would otherwise attach. The TUI's
+        // useHealth/HealthView poll this same endpoint WITH the normal client
+        // auth, as does a comparable authenticated route (backup.js).
+        // (monitoring.js's `health` verb had the identical noAuth bug — fixed
+        // in the same change.) Dropping noAuth here matches that pattern: the
+        // request still works
+        // for a logged-out session (client.js sends no Authorization header
+        // when there's nothing stored), but a logged-in session's token now
+        // actually reaches the collector instead of being withheld.
+        const data = await client.get(resolveEndpoint('v1.health.aggregate.list').path, {
+          service: resolveEndpoint('v1.health.aggregate.list').service,
+          timeout: 15000, // #930: the aggregate fans out to several services; 5s was too tight under load
+        });
+
+        if (isJson) {
+          console.log(JSON.stringify(data, null, 2));
+        } else {
+          console.log(renderPulse(data));
+        }
+
+        emitCliEvent(client, {
+          command: 'status',
+          intent: 'quox.cli.status',
+          payload: { score: data.score, services: Object.keys(data.services || {}).length },
+        });
+      } catch (err) {
+        if (isJson) {
+          console.log(JSON.stringify({ error: 'collector_unavailable', message: err.message }));
+        } else {
+          console.log('');
+          console.log(chalk.red(' Platform status unavailable'));
+          console.log(chalk.dim(` Collector not reachable: ${err.message}`));
+          console.log('');
+        }
+        // fleet #602: a real request failure (network error, non-2xx from
+        // the collector) was printing the message above and still exiting
+        // 0, hiding the failure from scripts/CI that check the exit code.
+        // client.get only reaches this catch on an actual error (thrown
+        // QuoxApiError / QuoxNetworkError / QuoxAuthError, see
+        // lib/core/client.js) — never on a successful 2xx — so it's safe to
+        // fail the process here without risking a false failure on a
+        // legitimately-empty-but-200 status payload.
+        process.exitCode = 1;
+      }
+    });
+}

package/lib/commands/tag.js

@@ -0,0 +1,91 @@
+/**
+ * Tag commands
+ *
+ * quox tag list|create|update|delete
+ */
+
+import { formatOutput, formatDetail, printSuccess, printInfo } from '../core/output.js';
+import { resolveOrgId } from './helpers.js';
+import { resolveEndpoint } from '../api/endpoints.js';
+import { confirmDestructive } from '../core/confirm.js';
+
+export function registerTagCommands(program, ctx) {
+  const { client, auth } = ctx;
+
+  const tag = program
+    .command('tag')
+    .description('Manage tags');
+
+  tag
+    .command('list')
+    .description('List tags')
+    .action(async () => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      // fleet #392: the route only computes usage when include_counts=true,
+      // which was never sent — so Count was hardcoded 0 for every tag.
+      const data = await client.get(resolveEndpoint('tags.list', { orgId }).path, { service: resolveEndpoint('tags.list', { orgId }).service, query: { include_counts: 'true' } });
+      const tags = data.tags || data || [];
+      formatOutput({
+        columns: ['id', 'name', 'color', 'count'],
+        headers: ['ID', 'Name', 'Color', 'Count'],
+        rows: tags.map(t => ({ id: t.id, name: t.name, color: t.color || '-', count: t.total_usage ?? 0 })),
+      }, { format: program.opts().output });
+    });
+
+  tag
+    .command('create')
+    .description('Create a tag')
+    .requiredOption('--name <name>', 'Tag name')
+    .option('--color <color>', 'Tag color (hex)')
+    .action(async (opts) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const body = { name: opts.name };
+      if (opts.color) body.color = opts.color;
+      // fleet #399: the id wasn't surfaced, so a script had to call
+      // `tag list` to recover it after create.
+      const data = await client.post(resolveEndpoint('tags.create', { orgId }).path, { service: resolveEndpoint('tags.create', { orgId }).service, body });
+      const t = data.tag || data;
+      printSuccess(`Tag "${opts.name}" created (id: ${t.id}).`);
+      formatDetail(t, { format: program.opts().output });
+    });
+
+  tag
+    .command('update')
+    .argument('<tagId>', 'tag ID')
+    .description('Update a tag')
+    .option('--name <name>', 'New name')
+    .option('--color <color>', 'New color')
+    .action(async (tagId, opts) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const body = {};
+      if (opts.name) body.name = opts.name;
+      if (opts.color) body.color = opts.color;
+      await client.patch(resolveEndpoint('tags.update', { orgId, tagId }).path, { service: resolveEndpoint('tags.update', { orgId, tagId }).service, body });
+      printSuccess('Tag updated.');
+    });
+
+  tag
+    .command('delete')
+    .argument('<tagId>', 'tag ID')
+    .description('Delete a tag')
+    .option('--force', 'skip confirmation')
+    .action(async (tagId, options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+
+      // fleet #399: this deleted immediately with no confirmation and no
+      // --force option, inconsistent with `prompt delete` which is equally
+      // destructive.
+      const confirmed = await confirmDestructive(program, options, `Delete tag ${tagId}? This cannot be undone.`);
+      if (!confirmed) {
+        printInfo('Cancelled.');
+        return;
+      }
+
+      await client.delete(resolveEndpoint('tags.delete', { orgId, tagId }).path, { service: resolveEndpoint('tags.delete', { orgId, tagId }).service });
+      printSuccess('Tag deleted.');
+    });
+}

package/lib/commands/team.js

@@ -0,0 +1,142 @@
+/**
+ * Team commands: CRUD + members
+ */
+
+import { formatOutput, formatDetail, printSuccess } from '../core/output.js';
+import { resolveOrgId } from './helpers.js';
+import { resolveEndpoint } from '../api/endpoints.js';
+
+export function registerTeamCommands(program, ctx) {
+  const { client, auth } = ctx;
+
+  const team = program
+    .command('team')
+    .description('Manage teams');
+
+  team
+    .command('list')
+    .description('List teams')
+    .option('--division <divId>', 'filter by division')
+    .action(async (options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const query = {};
+      if (options.division) query.division_id = options.division;
+      // fleet #392: division_name and member_count only exist when
+      // includeStats=true, which was never sent — both columns were dashes.
+      query.includeStats = 'true';
+      const data = await client.get(resolveEndpoint('teams.list', { orgId }).path, { service: resolveEndpoint('teams.list', { orgId }).service, query });
+      formatOutput({
+        columns: ['id', 'name', 'division_name', 'member_count', 'created_at'],
+        headers: ['ID', 'Name', 'Division', 'Members', 'Created'],
+        rows: data.teams || data,
+      }, { format: program.opts().output });
+    });
+
+  team
+    .command('get')
+    .description('Get team details')
+    .argument('<teamId>', 'team ID')
+    .action(async (teamId) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const data = await client.get(resolveEndpoint('teams.get', { orgId, teamId }).path, { service: resolveEndpoint('teams.get', { orgId, teamId }).service });
+      formatDetail(data.team || data, { format: program.opts().output, title: data.team?.name || data.name });
+    });
+
+  team
+    .command('create')
+    .description('Create a team')
+    .requiredOption('--name <name>', 'team name')
+    .option('--division <divId>', 'division ID')
+    .option('--department <deptId>', 'department ID')
+    .option('--description <desc>', 'description')
+    .action(async (options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      await client.post(resolveEndpoint('teams.create', { orgId }).path, {
+        service: resolveEndpoint('teams.create', { orgId }).service,
+        body: {
+          name: options.name,
+          division_id: options.division,
+          department_id: options.department,
+          description: options.description,
+        },
+      });
+      printSuccess(`Team "${options.name}" created.`);
+    });
+
+  team
+    .command('update')
+    .description('Update a team')
+    .argument('<teamId>', 'team ID')
+    .option('--name <name>', 'new name')
+    .option('--description <desc>', 'new description')
+    .action(async (teamId, options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const body = {};
+      if (options.name) body.name = options.name;
+      if (options.description) body.description = options.description;
+      await client.patch(resolveEndpoint('teams.update', { orgId, teamId }).path, { service: resolveEndpoint('teams.update', { orgId, teamId }).service, body });
+      printSuccess('Team updated.');
+    });
+
+  team
+    .command('delete')
+    .description('Delete a team')
+    .argument('<teamId>', 'team ID')
+    .action(async (teamId) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      await client.delete(resolveEndpoint('teams.delete', { orgId, teamId }).path, { service: resolveEndpoint('teams.delete', { orgId, teamId }).service });
+      printSuccess('Team deleted.');
+    });
+
+  team
+    .command('provision-room')
+    .description('Provision (or adopt) the governed Matrix room for a team')
+    .argument('<teamId>', 'team ID')
+    .action(async (teamId) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      const ep = resolveEndpoint('teams.provisionRoom', { orgId, teamId });
+      const data = await client.post(ep.path, { service: ep.service, body: {} });
+      printSuccess('Team Matrix room provisioned.');
+      const room = data.room || data;
+      formatDetail(room, { format: program.opts().output, title: 'Matrix Room' });
+    });
+
+  // Team members
+  const members = team
+    .command('members')
+    .description('Manage team members');
+
+  members
+    .command('add')
+    .description('Add a member to a team')
+    .argument('<teamId>', 'team ID')
+    .requiredOption('--user <userId>', 'user ID')
+    .option('--role <role>', 'team role', 'member')
+    .action(async (teamId, options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      await client.post(resolveEndpoint('teams.members.create', { orgId, teamId }).path, {
+        service: resolveEndpoint('teams.members.create', { orgId, teamId }).service,
+        body: { user_id: options.user, role: options.role },
+      });
+      printSuccess('Member added to team.');
+    });
+
+  members
+    .command('remove')
+    .description('Remove a member from a team')
+    .argument('<teamId>', 'team ID')
+    .requiredOption('--user <userId>', 'user ID')
+    .action(async (teamId, options) => {
+      auth.requireAuth();
+      const orgId = resolveOrgId(auth, program);
+      await client.delete(resolveEndpoint('teams.members.delete', { orgId, teamId, user: options.user }).path, { service: resolveEndpoint('teams.members.delete', { orgId, teamId, user: options.user }).service });
+      printSuccess('Member removed from team.');
+    });
+}