docs: see and answer invitations from the CLI

[eseidel]

Why

Shorebird CLI 1.6.130 adds shorebird invitations list | accept | decline (shorebirdtech/shorebird#4113). Until now an invitation could only be answered from the link in its email. The docs say how to send an invitation but not how to accept one, so this adds that, with the CLI path.

Changes

• account/orgs.mdx: a new "Accept an invitation" section under "Managing members". It covers the email link, shorebird invitations list, accept and decline, signing in as the invited address, which keys can't answer, and the 1.6.130 minimum. "Managing per app collaborators" links to it.
• account/cli.mdx: an "Answer invitations" pointer under the account commands.
• code-push/ci/scripting.mdx: a shorebird invitations row in the JSON output table.
• changelog/invitations-commands.md: a new entry for 1.6.130, dated October 17, the day it shipped.

Companion to #736 (merged), which covers the other CLI changes in 1.6.130.

Checks

Prettier, cspell, Vale, the component label lint and npm run build pass.

Landing

As soon as CI is green. CLI 1.6.130 is out (https://github.com/shorebirdtech/shorebird/releases/tag/v1.6.130) and _shorebird#3623 is live on prod.

🤖 Generated with Claude Code

[eseidel]

Adversarial review

Checked against shorebirdtech/shorebird main (packages/shorebird_cli/lib/src/commands/invitations/, after #4113 merged) and the server routes from shorebirdtech/_shorebird#3623. The commands, the <id> argument, the column order in the list description, the email-mismatch hint (shorebird account whoami / shorebird login), and the #accept-an-invitation anchor all match. Vale: 0 errors, 0 warnings.

Blockers

• src/content/changelog/invitations-commands.md: date: 2026-10-16 should be 2026-10-19, the planned 1.6.130 release date. The template asks for the CLI release date. docs: auth status, account update and notifications, patches promote, --channel, api --paginate #736 already uses 2026-10-19 for its six 1.6.130 entries, so the PR description's "As in docs: auth status, account update and notifications, patches promote, --channel, api --paginate #736, ... assume 1.6.130 ships on 2026-10-16" is out of date too.

Should-fix

• src/content/docs/code-push/ci/scripting.mdx (missed page): the "JSON output" table lists every command group that returns JSON, and invitations list | accept | decline all support --json. They need a shorebird invitations row (list, accept, decline) linking to /account/orgs/#accept-an-invitation. docs: auth status, account update and notifications, patches promote, --channel, api --paginate #736 edits this same table, so either add the row in docs: auth status, account update and notifications, patches promote, --channel, api --paginate #736 or add it here after docs: auth status, account update and notifications, patches promote, --channel, api --paginate #736 lands, so the two PRs don't conflict.
• src/content/docs/account/cli.mdx (missed page): this is the page that documents the CLI's account commands, and it doesn't mention shorebird invitations. A short pointer under "Account management commands" to the new orgs.mdx section would cover it. This file is also edited by docs: auth status, account update and notifications, patches promote, --channel, api --paginate #736, so the same ordering applies.
• src/content/docs/account/orgs.mdx: the new section doesn't say which version it needs. On 1.6.129 and older, shorebird invitations is an unknown command. docs: auth status, account update and notifications, patches promote, --channel, api --paginate #736 adds "needs Shorebird 1.6.130 or newer" to each new command, so add the same line here.
• src/content/changelog/invitations-commands.md, --json bullet: the list of fields leaves out organization_id and app_id. invitations_list_command.dart emits both, and for a script they're the fields worth having, because they let it act on the org or app after accepting. Either list them or say "including" instead of giving a list that looks complete.
• src/content/changelog/invitations-commands.md, "Service account keys can't answer invitations": this is true but incomplete. Release and patch only API keys also can't accept or decline (the routes require .accept(.invitations) / .decline(.invitations), as personal-access-token-limits.md says). Service accounts also can't list invitations, because humanGuard covers the whole /invitations directory. Suggested wording: "Use your own login or a full access API key. Service account keys and release and patch only keys can't."

Nits

• src/content/docs/account/orgs.mdx: cut "which helps when you're setting up a new machine or working through an agent". Setting up a new machine has nothing to do with invitations, and the sentence works without the clause.
• src/content/docs/account/orgs.mdx: the section sits under "Managing members" (an org admin's task) but also covers app invitations, which this page explains later under "Managing per app collaborators". A one-line link from that section to #accept-an-invitation would help collaborators find it.
• src/content/docs/account/orgs.mdx: "your invitations" could be "your pending invitations". list (and GET /api/v1/invitations) leaves out accepted, declined, revoked and expired ones, and the CLI prints "No pending invitations." when there are none.

[eseidel]

lgtm

[eseidel]

Holding this until CLI 1.6.130 is published. The prep PR (shorebirdtech/shorebird#4108) has merged, but the tag and stable push won't happen before Monday 2026-10-19. When it ships I'll set the changelog dates to the real release day and land this.

[eseidel]

Shorebird 1.6.130 shipped on October 17 (https://github.com/shorebirdtech/shorebird/releases/tag/v1.6.130), so I've set the changelog dates to 2026-10-17. This is ready to land once approved.

[eseidel]

Replies to the adversarial review, all in cf1ccea (on top of the merge from main, which brought in #736):

• Blocker (date): Set to 2026-10-17, the day 1.6.130 shipped.
• Should-fix, scripting.mdx: Added a shorebird invitations row (list, accept, decline) to the JSON output table.
• Should-fix, cli.mdx: Added an "Answer invitations" pointer under the account commands, linking to the new orgs section.
• Should-fix, version: The orgs section now says shorebird invitations needs 1.6.130 or newer. So does the cli.mdx pointer.
• Should-fix, --json fields: Added organization_id and app_id, which match invitations_list_command.dart.
• Should-fix, which keys: Now "Use your own login or a full access API key. Service account keys and release and patch only keys can't." I checked humanGuard on /invitations and the .accept/.decline(.invitations) scopes. The orgs section says the same.
• Nits: Cut the "new machine or agent" clause, said "pending invitations", and linked "Managing per app collaborators" to the section.

Prettier, cspell, Vale, the component label lint and npm run build pass.

[eseidel]

Landed with --admin: this repo requires an approving review and the review bot doesn't run here. The adversarial review was posted and every finding fixed (see above), Eric LGTM'd, and CI was green at cf1ccea.