albus-cli 0.4.1__tar.gz → 0.7.0__tar.gz

{albus_cli-0.4.1 → albus_cli-0.7.0}/AGENTS.md

@@ -22,13 +22,20 @@ Run everything from `clients/albus-cli/`. `uv` owns the virtualenv and
 | `make test` | `pytest` |
 | `make check` | all of the above |
 | `./tools/check` | `make check`, and what a release runs |
+| `./tools/bump-sdk <sdk-version> <cli-version>` | Pin a published SDK version and relock, uncommitted |
 | `./tools/publish --dry-run <version>` | Validate a release without uploading |
 | `./tools/publish [--testpypi] <version>` | Upload, after explicit authorization |
+| `./tools/publish --non-interactive <version>` | Upload from GitHub Actions, where the dispatch is the authorization |
 | `./tools/mirror-release [--dry-run] <version> <checkout>` | Copy the released tree to the public mirror |
 
-See [`RELEASING.md`](RELEASING.md). Publishing is never implied by a merge: a
-version reaches PyPI only when it was explicitly authorized, and published
-versions are immutable.
+See [`RELEASING.md`](RELEASING.md) and
+[`client-release-automation.md`](../../.agents/plans/client-release-automation.md).
+Publishing is never implied by a merge: a version reaches PyPI only when it was
+explicitly authorized, and published versions are immutable. The release
+scripts also run in GitHub Actions, where `--non-interactive` and the
+`GITHUB_REF` release-state check apply, both keyed on `GITHUB_ACTIONS`. That
+keeps a local release on the prompt; it is not a boundary, since the token is
+what authorizes an upload.
 
 ## Conventions
 
@@ -72,7 +79,9 @@ versions are immutable.
 - The `albus-sdk` dependency is pinned to one version. The published CLI has
   to name an SDK version that exists on PyPI, so the pin is bumped
   deliberately in the pull request that needs the newer SDK — never floated to
-  whatever is latest at install time.
+  whatever is latest at install time. `tools/bump-sdk` makes that edit — the
+  pin, `uv.lock`, and the CLI's own version — and deliberately does not commit
+  it: a release opens it as a pull request for review.
 - The public repository accepts issues, not pull requests. A user-reported bug
   is fixed here and reaches them in the next release, which closes the issue
   via a `Mirror-Issue: albusgroup/albus-cli#<n>` trailer on the fix's commit.

{albus_cli-0.4.1 → albus_cli-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: albus-cli
-Version: 0.4.1
+Version: 0.7.0
 Summary: Command-line client for the Albus REST API
 Project-URL: Homepage, https://github.com/albusgroup/albus-cli
 Project-URL: Repository, https://github.com/albusgroup/albus-cli
@@ -9,7 +9,7 @@ Author: Albus
 License-Expression: MIT
 License-File: LICENSE
 Requires-Python: >=3.11
-Requires-Dist: albus-sdk==0.10.0
+Requires-Dist: albus-sdk==0.14.0
 Requires-Dist: typer<0.28,>=0.26.8
 Description-Content-Type: text/markdown
 
@@ -78,7 +78,11 @@ export ALBUS_BASE_URL=http://localhost:8080/api  # optional; defaults to prod
 ```
 
 `--base-url` overrides `ALBUS_BASE_URL`, and `--timeout` bounds each request
-(a waiting `sessions run` long-polls and is exempt).
+(a waiting `sessions run` long-polls and is exempt). A user who belongs to
+several organizations acts in the one joined first; `--org <organization id>`
+(or `ALBUS_ORG`) selects another, and `albus whoami` lists them under
+`organizations` with the selected one as `active_organization`. An API key is
+bound to its organization and ignores `--org`.
 
 `albus login` opens a browser on this machine and listens on
 `127.0.0.1:8484-8487`; on a headless host, forward those ports or export
@@ -115,8 +119,12 @@ albus sessions run my-session -p "and the follow-up?" \
 albus sessions list
 albus sessions get my-session --limit 20
 albus sessions audit my-session --after "$cursor"
+albus sessions cancel my-session
 albus sessions delete my-session
 
+albus traces list --agent-name support-triage --status FAILED
+albus traces get "$invocation_key" --no-payloads --attempts all
+
 albus secrets list
 albus secrets create gemini-key --value ...   # or pipe the value on stdin
 albus secrets get gemini-key
@@ -132,11 +140,32 @@ albus tokens create ci
 albus tokens get "$id"
 albus tokens delete "$id"
 
+albus invites list
 albus invites create teammate@example.com
+albus invites revoke "$id"
+
+albus organization get
+albus organization rename "Albus Labs"
+albus organization members
+albus organization set-role "$user_id" admin
+albus organization remove-member "$user_id"
+
+albus billing balance
+albus billing ledger --after "$cursor"
+albus billing checkout 20 --success-url https://... --cancel-url https://...
 
 albus models list
+
+albus memories groups
+albus memories list --group team-a
+albus memories delete "$id" --group team-a
+albus memories delete-group --group team-a
 ```
 
+`memories groups` lists the organization's memory groups with their active
+counts; `memories list --group` reads one group's memories, newest first. Both
+page with `--after` and `--limit`.
+
 `models list` gives the model names `sessions run --model` takes, each with
 the provider it runs on — which is the provider the `--credential` secret has
 to be for.
@@ -144,9 +173,19 @@ to be for.
 `tokens create` prints the only copy of the key value the API ever returns;
 `list` and `get` return metadata alone.
 
-`invites create` invites a person by email, and they get their own
-organization on first sign-in. `CreateInviteRequest`'s `role` and
-`organization_id` have no flags: one user is one organization for the beta.
+`invites create` invites a person by email to join your active organization,
+as a `member` unless `--role admin` says otherwise. `invites list` and
+`invites revoke`, like the `organization` member commands, need the admin
+role.
+
+`billing checkout` starts a credit purchase and prints the payment page URL
+to send the buyer to; like `tokens` and `invites`, it needs `albus login`
+rather than an API key. `billing balance` and `billing ledger` take either.
+
+`traces list` searches the last 31 days of invocations unless `--since` and
+`--until` say otherwise; `traces get` reads one with a page of its spans, and
+`--no-payloads` returns the shape without what each span was given and
+produced.
 
 `sessions run` waits for the assistant response by default; pass `--no-wait`
 to return as soon as the invocation is accepted, or `--wait-timeout` to bound
@@ -154,10 +193,10 @@ the wait server-side. The response carries `message` once the invocation has
 answered, and omits it otherwise — with `--no-wait`, or when the wait ended
 first; `albus sessions get` reads the message later.
 
-Pass `--idempotency-key` to make a run retry-safe. The JSON output carries the
-effective `idempotency_key`, whether supplied by the caller or generated by
-the server — absent only if something between the CLI and Albus strips the
-response header on a run that supplied no key.
+Pass `--invocation-key` to name the invocation and make the run retry-safe.
+The JSON output carries the effective `invocation_key`, whether supplied by
+the caller or generated by the server — absent only if something between the
+CLI and Albus strips the response header on a run that supplied no key.
 
 `--agent-file` takes a JSON object shaped like the API's `AgentConfig` and
 covers what the flags do not (MCP servers, provider URL overrides):

{albus_cli-0.4.1 → albus_cli-0.7.0}/README.md

@@ -63,7 +63,11 @@ export ALBUS_BASE_URL=http://localhost:8080/api  # optional; defaults to prod
 ```
 
 `--base-url` overrides `ALBUS_BASE_URL`, and `--timeout` bounds each request
-(a waiting `sessions run` long-polls and is exempt).
+(a waiting `sessions run` long-polls and is exempt). A user who belongs to
+several organizations acts in the one joined first; `--org <organization id>`
+(or `ALBUS_ORG`) selects another, and `albus whoami` lists them under
+`organizations` with the selected one as `active_organization`. An API key is
+bound to its organization and ignores `--org`.
 
 `albus login` opens a browser on this machine and listens on
 `127.0.0.1:8484-8487`; on a headless host, forward those ports or export
@@ -100,8 +104,12 @@ albus sessions run my-session -p "and the follow-up?" \
 albus sessions list
 albus sessions get my-session --limit 20
 albus sessions audit my-session --after "$cursor"
+albus sessions cancel my-session
 albus sessions delete my-session
 
+albus traces list --agent-name support-triage --status FAILED
+albus traces get "$invocation_key" --no-payloads --attempts all
+
 albus secrets list
 albus secrets create gemini-key --value ...   # or pipe the value on stdin
 albus secrets get gemini-key
@@ -117,11 +125,32 @@ albus tokens create ci
 albus tokens get "$id"
 albus tokens delete "$id"
 
+albus invites list
 albus invites create teammate@example.com
+albus invites revoke "$id"
+
+albus organization get
+albus organization rename "Albus Labs"
+albus organization members
+albus organization set-role "$user_id" admin
+albus organization remove-member "$user_id"
+
+albus billing balance
+albus billing ledger --after "$cursor"
+albus billing checkout 20 --success-url https://... --cancel-url https://...
 
 albus models list
+
+albus memories groups
+albus memories list --group team-a
+albus memories delete "$id" --group team-a
+albus memories delete-group --group team-a
 ```
 
+`memories groups` lists the organization's memory groups with their active
+counts; `memories list --group` reads one group's memories, newest first. Both
+page with `--after` and `--limit`.
+
 `models list` gives the model names `sessions run --model` takes, each with
 the provider it runs on — which is the provider the `--credential` secret has
 to be for.
@@ -129,9 +158,19 @@ to be for.
 `tokens create` prints the only copy of the key value the API ever returns;
 `list` and `get` return metadata alone.
 
-`invites create` invites a person by email, and they get their own
-organization on first sign-in. `CreateInviteRequest`'s `role` and
-`organization_id` have no flags: one user is one organization for the beta.
+`invites create` invites a person by email to join your active organization,
+as a `member` unless `--role admin` says otherwise. `invites list` and
+`invites revoke`, like the `organization` member commands, need the admin
+role.
+
+`billing checkout` starts a credit purchase and prints the payment page URL
+to send the buyer to; like `tokens` and `invites`, it needs `albus login`
+rather than an API key. `billing balance` and `billing ledger` take either.
+
+`traces list` searches the last 31 days of invocations unless `--since` and
+`--until` say otherwise; `traces get` reads one with a page of its spans, and
+`--no-payloads` returns the shape without what each span was given and
+produced.
 
 `sessions run` waits for the assistant response by default; pass `--no-wait`
 to return as soon as the invocation is accepted, or `--wait-timeout` to bound
@@ -139,10 +178,10 @@ the wait server-side. The response carries `message` once the invocation has
 answered, and omits it otherwise — with `--no-wait`, or when the wait ended
 first; `albus sessions get` reads the message later.
 
-Pass `--idempotency-key` to make a run retry-safe. The JSON output carries the
-effective `idempotency_key`, whether supplied by the caller or generated by
-the server — absent only if something between the CLI and Albus strips the
-response header on a run that supplied no key.
+Pass `--invocation-key` to name the invocation and make the run retry-safe.
+The JSON output carries the effective `invocation_key`, whether supplied by
+the caller or generated by the server — absent only if something between the
+CLI and Albus strips the response header on a run that supplied no key.
 
 `--agent-file` takes a JSON object shaped like the API's `AgentConfig` and
 covers what the flags do not (MCP servers, provider URL overrides):

{albus_cli-0.4.1 → albus_cli-0.7.0}/RELEASING.md

@@ -1,10 +1,12 @@
 # Releasing the Albus CLI
 
-A release is a maintainer running the scripts below from a clean, up-to-date
-`master` checkout of the private Albus repository: they run `./tools/check`,
-upload to PyPI or TestPyPI, push the released tree to the public mirror as a
-single tagged commit, and close the mirror issues the release fixes. Nothing
-publishes from CI, on push, on tag, or on merge.
+A release runs the scripts below from a clean, up-to-date `master` checkout of
+the private Albus repository — by a maintainer locally, or by the dispatched
+release workflow described in
+[Releasing from GitHub Actions](#releasing-from-github-actions). Either way they
+run `./tools/check`, upload to PyPI or TestPyPI, push the released tree to the
+public mirror as a single tagged commit, and close the mirror issues the release
+fixes. Nothing publishes on push, on tag, or on merge.
 
 ## One-time PyPI setup
 
@@ -29,6 +31,18 @@ Bump the `albus-sdk==…` pin in the same pull request when the CLI needs a newe
 SDK, and release that SDK version first: the pin must name a version that is on
 PyPI, or the published CLI is uninstallable.
 
+`tools/bump-sdk` makes that edit:
+
+```bash
+./tools/bump-sdk 0.11.0 0.2.0
+```
+
+It rewrites the pin and `project.version`, relocks, and checks that `uv.lock`
+resolved the SDK version you named — which is also how an SDK release that did
+not actually reach PyPI is caught. It leaves the edit uncommitted, because the
+edit is a pull request. The release workflow runs the same script and opens
+that pull request itself.
+
 ## Validate
 
 From `clients/albus-cli/`, on the branch that carries the version bump:
@@ -68,6 +82,27 @@ uv tool install albus-cli==0.2.0
 albus --help
 ```
 
+## Releasing from GitHub Actions
+
+A release running in GitHub Actions passes `--non-interactive`, which skips the
+confirmation prompt because the dispatch already authorized the upload: a
+maintainer with write access typed the version in and turned `dry_run` off.
+The flag is refused when `GITHUB_ACTIONS` is unset: a phrase a script can type
+is not a confirmation, so a local release keeps the prompt.
+Deciding that from the environment is a guard against skipping the prompt out
+of habit, not a boundary — `UV_PUBLISH_TOKEN` is what authorizes an upload, and
+a maintainer holding it can already publish.
+
+Actions checks out a detached `HEAD` with no upstream configured, so there the
+publisher proves the same invariant against `GITHUB_REF` instead — the ref must
+be a branch, `origin` must have it, and it must point at the commit being
+released. Uploads still only run from `master`.
+
+The CLI is published by its own dispatch, after the pull request that bumps the
+`albus-sdk` pin and the CLI version has been reviewed and merged: the pin has
+to name an SDK version that is already on PyPI. See
+[`client-release-automation.md`](../../.agents/plans/client-release-automation.md).
+
 ## Copy the release to the public mirror
 
 ```bash
@@ -91,9 +126,10 @@ and this one, and closes each issue with the version that carries the fix. A
 reporter cannot see the private fix, so the release closing the issue is the
 only signal they get.
 
-Your own `git` and `gh` credentials do the push and the issue closing; there is
-no stored mirror token. Pushing `.github/workflows/` to the mirror needs a
-credential with workflow scope.
+A maintainer's own `git` and `gh` credentials do the push and the issue
+closing; in Actions they come from the release workflow's token. Pushing
+`.github/workflows/` to the mirror needs a credential allowed to write workflow
+files.
 
 The checkout you pass is only read: the release commit is built in a throwaway
 clone of it, so a rejected push — the likely first-release outcome, since the

{albus_cli-0.4.1 → albus_cli-0.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "albus-cli"
-version = "0.4.1"
+version = "0.7.0"
 description = "Command-line client for the Albus REST API"
 readme = "README.md"
 license = "MIT"
@@ -13,7 +13,7 @@ authors = [{ name = "Albus" }]
 dependencies = [
     # Pinned, not floated: the published CLI states the one SDK version it was
     # tested against, and bumping it is a reviewed edit made when releasing.
-    "albus-sdk==0.10.0",
+    "albus-sdk==0.14.0",
     "typer>=0.26.8,<0.28",
 ]
 

{albus_cli-0.4.1 → albus_cli-0.7.0}/src/albus_cli/client.py

@@ -18,6 +18,11 @@ from albus_cli.credentials import Credential
 
 API_KEY_ENV = "ALBUS_API_KEY"
 BASE_URL_ENV = "ALBUS_BASE_URL"
+ORGANIZATION_ENV = "ALBUS_ORG"
+
+# Selects among the signed-in user's organizations. An API key is bound to
+# one already, and the server ignores the header for it.
+ORGANIZATION_HEADER = "X-Albus-Organization"
 
 # Renew slightly early: an access token that outlives the request it is
 # sent on is not worth the 401.
@@ -53,22 +58,29 @@ def api_key() -> str | None:
     return os.environ.get(API_KEY_ENV)
 
 
-def client(base_url: str, timeout: float | None) -> Albus:
-    """Build an SDK client. A timeout of None disables the read timeout."""
+def client(
+    base_url: str, timeout: float | None, organization: str | None
+) -> Albus:
+    """Build an SDK client. A timeout of None disables the read timeout;
+    an organization selects which of the user's the requests act in."""
     key = api_key()
     if key:
         # The environment wins over a stored session deliberately, so CI
         # and agent harnesses inject a credential without touching disk.
-        return _client(base_url, timeout, api_key=key)
+        return _client(base_url, timeout, organization, api_key=key)
 
     stored = credentials.load(base_url)
     if stored is None:
         raise _signed_out(base_url)
 
-    return bearer_client(base_url, timeout, _current(base_url, stored))
+    return bearer_client(
+        base_url, timeout, organization, _current(base_url, stored)
+    )
 
 
-def signed_in_client(base_url: str, timeout: float | None) -> Albus:
+def signed_in_client(
+    base_url: str, timeout: float | None, organization: str | None
+) -> Albus:
     """A client on the browser session. The operations Albus accepts
     only a human bearer token for use it directly: an API key is a 401
     there, and the environment winning would be a 401 nobody asked
@@ -81,7 +93,9 @@ def signed_in_client(base_url: str, timeout: float | None) -> Albus:
             "`albus login`."
         )
 
-    return bearer_client(base_url, timeout, _current(base_url, stored))
+    return bearer_client(
+        base_url, timeout, organization, _current(base_url, stored)
+    )
 
 
 def public_client(base_url: str, timeout: float | None) -> Albus:
@@ -94,15 +108,20 @@ def public_client(base_url: str, timeout: float | None) -> Albus:
     sign-in changes."""
     global _used
     _used = None
-    return _built(base_url, timeout)
+    return _built(base_url, timeout, None)
 
 
 def bearer_client(
-    base_url: str, timeout: float | None, credential: Credential
+    base_url: str,
+    timeout: float | None,
+    organization: str | None,
+    credential: Credential,
 ) -> Albus:
     """A client on one credential, for `login` reading back the session
     it just stored rather than whatever precedence would pick."""
-    return _client(base_url, timeout, access_token=credential.access_token)
+    return _client(
+        base_url, timeout, organization, access_token=credential.access_token
+    )
 
 
 def credential(tokens: oauth.Tokens, replacing: Credential | None) -> Credential:
@@ -206,6 +225,7 @@ def _shadowing(consequence: str) -> str | None:
 def _client(
     base_url: str,
     timeout: float | None,
+    organization: str | None,
     *,
     api_key: str | None = None,
     access_token: str | None = None,
@@ -215,6 +235,7 @@ def _client(
     return _built(
         base_url,
         timeout,
+        organization,
         api_key=api_key,
         access_token=access_token,
     )
@@ -223,15 +244,19 @@ def _client(
 def _built(
     base_url: str,
     timeout: float | None,
+    organization: str | None,
     *,
     api_key: str | None = None,
     access_token: str | None = None,
 ) -> Albus:
+    headers = {ORGANIZATION_HEADER: organization} if organization else {}
     return Albus(
         api_key=api_key,
         access_token=access_token,
         server_url=base_url,
-        client=httpx.Client(follow_redirects=True, timeout=timeout),
+        client=httpx.Client(
+            follow_redirects=True, timeout=timeout, headers=headers
+        ),
     )
 
 

{albus_cli-0.4.1 → albus_cli-0.7.0}/src/albus_cli/commands/auth.py

@@ -8,9 +8,10 @@ SDK operation: they talk to Auth0 rather than to Albus. See
 from typing import Annotated
 
 import typer
+from albus_sdk import models
 
 from albus_cli import client, credentials, docs, oauth, output
-from albus_cli.context import base_url, sdk, timeout
+from albus_cli.context import base_url, organization, sdk, timeout
 
 NoBrowser = Annotated[
     bool,
@@ -39,11 +40,13 @@ def login(ctx: typer.Context, no_browser: NoBrowser = False) -> None:
 
     # Read the account back through the session just stored, not through
     # precedence: naming the API key's account would be a false report.
-    signed_in = client.bearer_client(api, timeout(ctx), session)
+    signed_in = client.bearer_client(
+        api, timeout(ctx), organization(ctx), session
+    )
     # A browser session authenticates a user, so `/whoami` names one;
     # an account it did not name is not one to claim under "Signed in".
     user = signed_in.auth.whoami().user
-    output.done("Signed in" if user is None else f"Signed in as {user.email}")
+    output.done(_signed_in(user))
     output.field("API", api)
     output.field("Credential", output.abbreviated(credentials.path()))
     if session.refresh_token is None:
@@ -69,6 +72,18 @@ def whoami(ctx: typer.Context) -> None:
     output.emit(sdk(ctx).auth.whoami())
 
 
+def _signed_in(user: models.AuthenticatedUser | None) -> str:
+    """The account and the organization its commands act in, as Albus
+    reports them for the session just stored."""
+    if user is None:
+        return "Signed in"
+
+    if user.active_organization is None:
+        return f"Signed in as {user.email}"
+
+    return f"Signed in as {user.email} in {user.active_organization.name}"
+
+
 def _next_steps() -> None:
     """The last lines a successful sign-in prints, where attention is
     highest: the one command that runs an agent, and the sentence to

albus_cli-0.7.0/src/albus_cli/commands/billing.py

@@ -0,0 +1,67 @@
+"""`albus billing` — the organization's prepaid credits.
+
+`/billing/checkout` is `bearerAuth`-only: an API key cannot spend money, so
+`checkout` takes the browser session with `signed_in_sdk`. Reading the
+balance and the ledger accepts either credential.
+"""
+
+from typing import Annotated
+
+import typer
+
+from albus_cli.context import sdk, signed_in_sdk
+from albus_cli.output import emit
+
+app = typer.Typer(no_args_is_help=True, help="Read and top up prepaid credits.")
+
+After = Annotated[
+    str | None,
+    typer.Option("--after", help="Pagination cursor from a previous page."),
+]
+Limit = Annotated[int, typer.Option("--limit", help="Page size.")]
+
+
+@app.command("balance")
+def balance(ctx: typer.Context) -> None:
+    """Read the organization's credit balance in USD."""
+    emit(sdk(ctx).billing.get_credit_balance())
+
+
+@app.command("ledger")
+def ledger(ctx: typer.Context, after: After = None, limit: Limit = 100) -> None:
+    """List the credit ledger, newest first."""
+    emit(sdk(ctx).billing.list_credit_ledger(after=after, limit=limit))
+
+
+@app.command("checkout")
+def checkout(
+    ctx: typer.Context,
+    amount_usd: Annotated[
+        int,
+        typer.Argument(
+            metavar="AMOUNT_USD", help="Whole US dollars of credit to buy."
+        ),
+    ],
+    success_url: Annotated[
+        str,
+        typer.Option(
+            "--success-url",
+            help="Where the payment page sends the buyer after paying.",
+        ),
+    ],
+    cancel_url: Annotated[
+        str,
+        typer.Option(
+            "--cancel-url",
+            help="Where the payment page sends the buyer who backs out.",
+        ),
+    ],
+) -> None:
+    """Start a credit purchase and print the payment page URL."""
+    emit(
+        signed_in_sdk(ctx).billing.create_checkout(
+            amount_usd=amount_usd,
+            success_url=success_url,
+            cancel_url=cancel_url,
+        )
+    )

albus_cli-0.7.0/src/albus_cli/commands/invites.py

@@ -0,0 +1,54 @@
+"""`albus invites` — the pending invitations into the active organization.
+
+`/organization/invites` is `bearerAuth`-only, like `/tokens`: an API key
+cannot invite a user, so these commands take the browser session with
+`signed_in_sdk`.
+"""
+
+from typing import Annotated, Literal
+
+import typer
+
+from albus_cli.context import signed_in_sdk
+from albus_cli.output import emit
+
+app = typer.Typer(no_args_is_help=True, help="Invite users by email.")
+
+Role = Literal["admin", "member"]
+
+InviteID = Annotated[
+    str, typer.Argument(metavar="ID", help="The invitation ID.")
+]
+
+
+@app.command("list")
+def list_invites(ctx: typer.Context) -> None:
+    """List pending invitations. Requires the admin role."""
+    emit(signed_in_sdk(ctx).invites.list_invites())
+
+
+@app.command("create")
+def create(
+    ctx: typer.Context,
+    email: Annotated[
+        str,
+        typer.Argument(
+            metavar="EMAIL", help="Email address of the person to invite."
+        ),
+    ],
+    role: Annotated[
+        Role | None,
+        typer.Option(
+            "--role",
+            help="Role the invitee joins with. Defaults to member.",
+        ),
+    ] = None,
+) -> None:
+    """Invite a user to join your active organization."""
+    emit(signed_in_sdk(ctx).invites.create_invite(email=email, role=role))
+
+
+@app.command("revoke")
+def revoke(ctx: typer.Context, invite_id: InviteID) -> None:
+    """Revoke a pending invitation. Requires the admin role."""
+    signed_in_sdk(ctx).invites.revoke_invite(id=invite_id)