@formigio/fazemos-cli 0.10.41 → 0.10.43

package/dist/index.js

@@ -7959,20 +7959,34 @@ apiKeys
     .requiredOption('-n, --name <name>', 'Key name (e.g., joe-orchestrator)')
     .requiredOption('-m, --member <id>', 'Member ID to bind the key to')
     .option('-d, --description <desc>', 'Description')
+    .option('--scope <scope>', 'Key scope: org (cross-project, owner/admin only) or project (default, today\'s behavior). --scope org mints a key that works across all projects the member belongs to; active project is ignored.', 'project')
     .action(async (opts) => {
     try {
         const body = { name: opts.name, memberId: opts.member };
         if (opts.description)
             body.description = opts.description;
+        // F45 — pass scope in POST body; 'project' preserves today's back-compat behavior
+        body.scope = opts.scope;
         const data = await api('POST', '/api/api-keys', body);
+        const scope = data.apiKey.scope ?? opts.scope;
         console.log(chalk.green(`API key created: ${opts.name}`));
-        console.log(`  Key:  ${chalk.yellow(data.rawKey)}`);
-        console.log(`  ID:   ${data.apiKey.id}`);
+        console.log(`  Key:   ${chalk.yellow(data.rawKey)}`);
+        console.log(`  ID:    ${data.apiKey.id}`);
+        console.log(`  Scope: ${scope === 'org' ? chalk.cyan('org') : scope}`);
         console.log('');
         console.log(chalk.red('  ⚠ Save this key now — it will not be shown again.'));
     }
     catch (err) {
-        console.error(chalk.red(err.message));
+        // F45 — map specific API error codes to friendly messages
+        if (err.code === 'INSUFFICIENT_ROLE') {
+            console.error(chalk.red('Error: Only org owners and admins can mint org-scoped keys'));
+        }
+        else if (err.code === 'INVALID_SCOPE') {
+            console.error(chalk.red("Error: --scope must be 'org' or 'project'"));
+        }
+        else {
+            console.error(chalk.red(err.message));
+        }
         process.exit(1);
     }
 });
@@ -7987,7 +8001,9 @@ apiKeys
             return;
         }
         for (const k of data.apiKeys) {
-            console.log(`  ${chalk.cyan(k.name)} — ${k.id} (created ${k.created_at})`);
+            // F45 — show scope field (org or project) alongside existing fields
+            const scopeLabel = k.scope === 'org' ? ` [${chalk.cyan('org-scoped')}]` : '';
+            console.log(`  ${chalk.cyan(k.name)}${scopeLabel} — ${k.id} (created ${k.created_at})`);
         }
     }
     catch (err) {
@@ -9136,11 +9152,61 @@ Types: question | task | signal | response | flag | decision | direction`)
                 `Run from inside a Fazemos-aware workspace.`);
         }
         // Resolve recipient
+        // rul_dispatch_cli_fallthrough_on_local_unresolved
         const resolved = resolveRole(to, localRegistry);
         if (!resolved) {
-            throw new Error(`Role "${to}" not found in local registry or any cross-workspace ref. ` +
-                `Check .fazemos/roles.json.`);
+            // Registry-less path: recipient not found in local workspace registry
+            // (e.g. cross-workspace human role like `founder` in a peer workspace).
+            // Fall through to server-side DB resolution via POST /api/dispatches.
+            // The server resolves the recipient via role_registrations (workspace-agnostic).
+            // rul_dispatch_cli_fallthrough_on_local_unresolved
+            const unresolvedDepth = computeChildDispatchDepth(process.env.FAZEMOS_ORIGINATING_DISPATCH_DEPTH);
+            const unresolvedReqBody = {
+                to,
+                from: opts.from,
+                type,
+                priority: opts.priority ?? 'normal',
+                body,
+                thread_id: opts.thread ?? null,
+                re: opts.re ? [opts.re] : null,
+                expires_at: opts.expiresAt ?? null,
+                source: 'cli',
+                runbook_ref: opts.runbookRef ?? null,
+                params: runbookParams ?? null,
+                dispatch_depth: unresolvedDepth,
+            };
+            let unresolvedResp;
+            try {
+                unresolvedResp = await api('POST', '/api/dispatches', unresolvedReqBody);
+            }
+            catch (err) {
+                // rul_dispatch_4xx_still_hard_fails (BUG53 semantics preserved)
+                // Deliberate 4xx (FROM_ROLE_FORBIDDEN, depth ceiling, validation) hard-fails
+                // in the registry-less path too. No local file fallback — no role.inbox
+                // available (no resolved role entry). Preserves the BUG53 loud-failure contract.
+                // rul_dispatch_local_file_best_effort_cross_workspace
+                const status = err instanceof ApiError ? err.status : undefined;
+                if (!shouldFallBackToFile(status)) {
+                    const code = err instanceof ApiError && err.code ? ` ${err.code}` : '';
+                    console.error(chalk.red(`✗ Dispatch refused (${status}${code}): ${err instanceof Error ? err.message : String(err)}`));
+                    console.error(chalk.gray('  Not falling back to file-only — a deliberate refusal must not be bypassed.'));
+                    process.exitCode = 1;
+                    return;
+                }
+                // Transient failure (network / 5xx) — no local file fallback in registry-less path.
+                // rul_dispatch_local_file_best_effort_cross_workspace
+                throw err;
+            }
+            // 2xx — server resolved the recipient. Print UX §4.4 stdout copy verbatim.
+            // rul_dispatch_local_file_best_effort_cross_workspace
+            console.log(chalk.green(`✓ Dispatched to ${to} (server-resolved) — id: ${unresolvedResp.id}`));
+            console.log(`  Local inbox mirror skipped: '${to}' is not in this workspace's registry;`);
+            console.log(`  the durable artifact is the DB row + Slack notification.`);
+            // SKIP local inbox-file write (no role.inbox) — rul_dispatch_local_file_best_effort_cross_workspace
+            // SKIP agent-mode commit+push (no relPath) — rul_dispatch_local_file_best_effort_cross_workspace
+            return;
         }
+        // ── Resolved path: existing behavior unchanged ──────────────────────────
         const { role, registry } = resolved;
         const input = {
             to,