Inviting teammates

Invites are single-use URLs scoped to a focus area (ideally) or the whole backend (if no scope is set). When a teammate consumes an invite:

• They get a new user account + a long-lived access token.
• If the invite had a focus area, they're automatically added as a member.
• The invite is consumed; the same URL can't be used twice.

Creating an invite

In the app: right-click any row in the tree and choose Invite. The level you clicked is the scope - a whole workspace, a product, a focus area or a single feature. Click Create invite link and copy the URL that appears.

Via CLI (admin only):

curl -X POST \\
  -H "Authorization: Bearer <your-admin-token>" \\
  -H "Content-Type: application/json" \\
  -d '{"expires_in_hours": 168, "focus_area_id": "<uuid>"}' \\
  http://your-server/invites

Invites default to 7-day expiry; override with expires_in_hours.

Your teammate joins

They run, on their machine:

rememd join <the-url-you-sent> --name "Dev B"
# relaunch rememd

They appear in your Navigator as a small initial-avatar next to the product row. A green dot on the avatar means they're connected right now.

Membership model

• Memberships are per focus area, not per workspace or per feature.
• A user is a member of a workspace if and only if they're a member of at least one focus area in it. Workspaces, feature PRDs, and task claims are gated by this check.
• Admins are implicit members of every focus area. You never need to add an admin manually; both the backfill migration and the PutIndex hook ensure every focus area in every workspace has every admin attached.
• Solo owner (only the admin, no collaborators) → the Navigator shows no avatar pill. Avatars only appear when there are 2+ members, since otherwise it's just telling you your own name.

Managing members

The Invite panel lists the level's current members as chips. Admins get a ⋯ menu per chip:

• Remove from <focus area> - kicks them out of just that FA.
• Remove from team (revokes tokens) - drops the user from all FAs and revokes every one of their tokens, so they can no longer authenticate. The user row is kept (they may still be referenced as the author of notes or the holder of old claims).

Revocation - under the hood