@formigio/fazemos-cli 0.10.45 → 0.10.47

package/dist/approvals.d.ts

@@ -0,0 +1,35 @@
+/**
+ * FC-B — Founder Console: Close the Loop
+ *
+ * Exports `registerApprovalsCommands(program)` which wires two sub-commands
+ * into the root Commander program (mirrors src/governance.ts:518
+ * registerGovernanceCommands pattern):
+ *
+ *   fazemos approvals list [--project <slug>] [--json]
+ *     → GET /api/control-plane/approvals
+ *       Returns pending approval gates for the active org.
+ *
+ *   fazemos approvals resolve <id> --decision approve|reject --reason <text> [--json]
+ *     → POST /api/control-plane/approvals/:id/resolve
+ *       Resolves an approval gate; sends surface='cli' for audit trail.
+ *       --reason is mandatory (min 4 chars) — this is the CLI typed-token
+ *       equivalent (OBD #1 / rul_cli_resolve_terminal_explicit_is_typed_token_equivalent).
+ *
+ * Auth:  requireAuth + org membership (X-Org-Id via api() helper).
+ *        Both commands are org-scoped (noProjectHeader: true on resolve;
+ *        list passes project_id as query param when --project provided).
+ *
+ * Rule:  Server enforces reject + missing reason → 422 REJECT_REQUIRES_REASON.
+ *        CLI also validates locally so the error is surfaced before any HTTP call.
+ *
+ * Spec:  FC-B-founder-console-close-the-loop-manifest.yaml §cli
+ * Tech:  FC-B-founder-console-close-the-loop-tech-spec.md §cli
+ */
+import type { Command } from 'commander';
+/**
+ * Register `approvals list` and `approvals resolve` into the root Commander program.
+ * Called from index.ts alongside registerGovernanceCommands.
+ *
+ * Pattern: mirrors registerGovernanceCommands at fazemos-cli/src/governance.ts:518.
+ */
+export declare function registerApprovalsCommands(program: Command): void;

package/dist/approvals.js

@@ -0,0 +1,279 @@
+/**
+ * FC-B — Founder Console: Close the Loop
+ *
+ * Exports `registerApprovalsCommands(program)` which wires two sub-commands
+ * into the root Commander program (mirrors src/governance.ts:518
+ * registerGovernanceCommands pattern):
+ *
+ *   fazemos approvals list [--project <slug>] [--json]
+ *     → GET /api/control-plane/approvals
+ *       Returns pending approval gates for the active org.
+ *
+ *   fazemos approvals resolve <id> --decision approve|reject --reason <text> [--json]
+ *     → POST /api/control-plane/approvals/:id/resolve
+ *       Resolves an approval gate; sends surface='cli' for audit trail.
+ *       --reason is mandatory (min 4 chars) — this is the CLI typed-token
+ *       equivalent (OBD #1 / rul_cli_resolve_terminal_explicit_is_typed_token_equivalent).
+ *
+ * Auth:  requireAuth + org membership (X-Org-Id via api() helper).
+ *        Both commands are org-scoped (noProjectHeader: true on resolve;
+ *        list passes project_id as query param when --project provided).
+ *
+ * Rule:  Server enforces reject + missing reason → 422 REJECT_REQUIRES_REASON.
+ *        CLI also validates locally so the error is surfaced before any HTTP call.
+ *
+ * Spec:  FC-B-founder-console-close-the-loop-manifest.yaml §cli
+ * Tech:  FC-B-founder-console-close-the-loop-tech-spec.md §cli
+ */
+import chalk from 'chalk';
+import { api, ApiError, resolveProjectIdBySlug } from './api.js';
+// ── Helpers ────────────────────────────────────────────────────────────────────
+/**
+ * Validate that the --decision flag is one of the allowed values.
+ * Throws a user-facing error otherwise.
+ */
+function validateDecision(value) {
+    if (value !== 'approve' && value !== 'reject') {
+        throw new Error(`--decision must be 'approve' or 'reject', got: ${value}`);
+    }
+    return value;
+}
+/**
+ * Validate that --reason meets the minimum length requirement (4 chars).
+ * Throws a user-facing error otherwise.
+ * This is the CLI side of rul_cli_resolve_terminal_explicit_is_typed_token_equivalent.
+ */
+function validateReason(value) {
+    const trimmed = value.trim();
+    if (trimmed.length < 4) {
+        throw new Error(`--reason must be at least 4 characters (got ${trimmed.length}). ` +
+            `Provide a meaningful reason — it lands in the audit trail.`);
+    }
+    return trimmed;
+}
+/**
+ * Extract the approval gates array from the API response envelope.
+ * The API may return the array under different keys depending on version.
+ */
+function extractGates(data) {
+    if (Array.isArray(data.approvalRequests))
+        return data.approvalRequests;
+    if (Array.isArray(data.approval_requests))
+        return data.approval_requests;
+    if (Array.isArray(data.gates))
+        return data.gates;
+    // Some responses may return the array directly at a named key — scan.
+    for (const val of Object.values(data)) {
+        if (Array.isArray(val) && val.length > 0 && typeof val[0] === 'object' && 'id' in val[0]) {
+            return val;
+        }
+    }
+    return [];
+}
+/**
+ * Render a human-readable table for approval gates.
+ * Format mirrors the governance waiting_on_me approval block (F34 pattern).
+ */
+function renderGatesList(gates) {
+    if (gates.length === 0) {
+        console.log(chalk.dim('  No pending approval requests.'));
+        return;
+    }
+    console.log(chalk.bold(`Pending Approvals (${gates.length}):`));
+    console.log();
+    for (const gate of gates) {
+        console.log(`  ${chalk.bold(gate.description || chalk.dim('(no description)'))}`);
+        console.log(`    id:      ${chalk.dim(gate.id)}`);
+        console.log(`    status:  ${chalk.yellow(gate.status)}`);
+        if (gate.pipeline_name) {
+            console.log(`    pipeline: ${chalk.cyan(gate.pipeline_name)}`);
+        }
+        if (gate.step_name) {
+            console.log(`    step:     ${chalk.cyan(gate.step_name)}`);
+        }
+        if (gate.deadline_at) {
+            console.log(`    deadline: ${new Date(gate.deadline_at).toLocaleString()}`);
+        }
+        console.log(`    created:  ${new Date(gate.created_at).toLocaleString()}`);
+        if (gate.project_id) {
+            console.log(`    project:  ${chalk.dim(gate.project_id)}`);
+        }
+        console.log();
+    }
+    console.log(chalk.dim(`To resolve: fazemos approvals resolve <id> --decision approve|reject --reason "<text>"`));
+}
+// ── Command registration ───────────────────────────────────────────────────────
+/**
+ * Register `approvals list` and `approvals resolve` into the root Commander program.
+ * Called from index.ts alongside registerGovernanceCommands.
+ *
+ * Pattern: mirrors registerGovernanceCommands at fazemos-cli/src/governance.ts:518.
+ */
+export function registerApprovalsCommands(program) {
+    // ── `fazemos approvals` ───────────────────────────────────────────────────
+    //
+    // Parent command hosting list + resolve sub-commands.
+    // Org-scoped (X-Org-Id sent by api() helper; no X-Fazemos-Project-Id).
+    // Auth: requireAuth + org membership (server-side, F37 shipped).
+    const approvalsCmd = program
+        .command('approvals')
+        .description('Approval gate management — list pending gates and resolve them from the CLI.\n\n' +
+        'Sub-commands:\n' +
+        '  list       List pending approval gates for your org\n' +
+        '  resolve    Approve or reject an approval gate\n\n' +
+        'Auth: your org is resolved via X-Org-Id (your active org); ' +
+        'only gate approvers (per F37) may resolve.\n\n' +
+        'Rule (OBD #1): --reason is mandatory for resolve — it is the CLI equivalent\n' +
+        'of the typed-token ceremony (fully auditable via via=\'cli\' in audit trail).');
+    // ── `fazemos approvals list` ──────────────────────────────────────────────
+    //
+    // GET /api/control-plane/approvals
+    //
+    // Returns pending approval gates. Optional --project <slug> restricts to
+    // gates belonging to a specific project. No X-Fazemos-Project-Id header
+    // (control-plane endpoint); project_id passed as query param when provided.
+    //
+    // Usage:
+    //   fazemos approvals list
+    //   fazemos approvals list --project my-project
+    //   fazemos approvals list --json
+    approvalsCmd
+        .command('list')
+        .description('List pending approval gates for your org.\n\n' +
+        'Calls GET /api/control-plane/approvals (listOpenApprovals — F37 shipped).\n\n' +
+        'Use --project to restrict results to a specific project.\n' +
+        'Use --json for machine-readable output (raw API response).\n\n' +
+        'To resolve a gate: fazemos approvals resolve <id> --decision approve|reject --reason "<text>"')
+        .option('--project <slug>', 'filter to a specific project (slug or id)')
+        .option('--json', 'output machine-readable JSON (raw API response)')
+        .action(async (opts) => {
+        try {
+            // Build the query string. project_id is passed as a query param
+            // (not via X-Fazemos-Project-Id header — this is a control-plane call).
+            let path = '/api/control-plane/approvals';
+            if (opts.project) {
+                // Resolve slug → id (handles UUID pass-through transparently).
+                // resolveProjectIdBySlug uses cached /auth/me; refreshes on miss.
+                const projectId = await resolveProjectIdBySlug(opts.project);
+                if (projectId) {
+                    path += `?project_id=${encodeURIComponent(projectId)}`;
+                }
+            }
+            const data = await api('GET', path, undefined, { noProjectHeader: true });
+            if (opts.json) {
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            const gates = extractGates(data);
+            renderGatesList(gates);
+        }
+        catch (err) {
+            if (err instanceof ApiError) {
+                console.error(chalk.red(`Error (${err.status}): ${err.message}`));
+                if (err.code) {
+                    console.error(chalk.dim(`  code: ${err.code}`));
+                }
+            }
+            else {
+                const msg = err instanceof Error ? err.message : String(err);
+                console.error(chalk.red(`Error: ${msg}`));
+            }
+            process.exit(1);
+        }
+    });
+    // ── `fazemos approvals resolve <id>` ─────────────────────────────────────
+    //
+    // POST /api/control-plane/approvals/:id/resolve
+    //
+    // Resolves an approval gate (approve or reject). Sends surface='cli' so the
+    // audit trail records via='cli' (rul_via_cli_landed_in_audit_trail).
+    //
+    // --decision and --reason are both required. --reason must be ≥ 4 chars.
+    // This constitutes the CLI typed-token equivalent (OBD #1):
+    //   "Terminal-explicit command + mandatory --reason IS the CLI equivalent
+    //    of typed-token ceremony. No hidden state. Fully auditable via='cli'."
+    //
+    // Server additionally enforces: reject + missing/empty reason_note → 422
+    // REJECT_REQUIRES_REASON (rul_cli_terminal_explicit_mandatory_reason).
+    //
+    // Usage:
+    //   fazemos approvals resolve <id> --decision approve --reason "Looks good, ship it"
+    //   fazemos approvals resolve <id> --decision reject --reason "Missing QA sign-off"
+    //   fazemos approvals resolve <id> --decision approve --reason "ok" --json
+    approvalsCmd
+        .command('resolve')
+        .description('Approve or reject an approval gate.\n\n' +
+        'Calls POST /api/control-plane/approvals/:id/resolve with surface=\'cli\'.\n' +
+        'Sends via=\'cli\' to the audit trail (rul_via_cli_landed_in_audit_trail).\n\n' +
+        'Both --decision and --reason are required.\n' +
+        '--reason must be at least 4 characters and is recorded in the audit trail.\n' +
+        'This is the CLI equivalent of the typed-token ceremony (OBD #1).\n\n' +
+        'Exit codes:\n' +
+        '  0  — resolved successfully\n' +
+        '  1  — API error (see error message)\n' +
+        '  2  — validation error (missing/invalid flag)')
+        .argument('<id>', 'Approval gate ID (UUID)')
+        .requiredOption('--decision <approve|reject>', 'Decision: approve or reject')
+        .requiredOption('--reason <text>', 'Reason for the decision (min 4 chars; recorded in audit trail)')
+        .option('--json', 'output machine-readable JSON (raw API response)')
+        .action(async (id, opts) => {
+        try {
+            // ── Client-side validation ─────────────────────────────────────────
+            // Validate before making any HTTP call (fast fail, clear messages).
+            // Server-side re-validates as well (defense-in-depth).
+            const decision = validateDecision(opts.decision);
+            const reason = validateReason(opts.reason);
+            // ── POST /api/control-plane/approvals/:id/resolve ──────────────────
+            // Body matches the FC-B modified contract:
+            //   { decision, reason_note, surface: 'cli' }
+            // surface='cli' propagates to via='cli' in the audit trail.
+            const body = {
+                decision,
+                reason_note: reason,
+                surface: 'cli',
+            };
+            const data = await api('POST', `/api/control-plane/approvals/${encodeURIComponent(id)}/resolve`, body, { noProjectHeader: true });
+            if (opts.json) {
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            // ── Human output ───────────────────────────────────────────────────
+            const decisionLabel = decision === 'approve'
+                ? chalk.green('approved')
+                : chalk.red('rejected');
+            console.log(chalk.bold(`Approval ${decisionLabel}`));
+            console.log();
+            console.log(`  id:          ${chalk.dim(data.id)}`);
+            console.log(`  decision:    ${decisionLabel}`);
+            console.log(`  via:         ${chalk.dim(data.via)}`);
+            console.log(`  resolved_at: ${new Date(data.resolved_at).toLocaleString()}`);
+            if (data.downstream_queued) {
+                console.log();
+                console.log(`  ${chalk.cyan('→ downstream step queued:')} ${chalk.dim(data.downstream_queued)}`);
+            }
+            console.log();
+        }
+        catch (err) {
+            if (err instanceof ApiError) {
+                // Surface server-enforced errors clearly (e.g., 422 REJECT_REQUIRES_REASON,
+                // 409 APPROVAL_ALREADY_RESOLVED, 404 APPROVAL_GATE_NOT_FOUND).
+                console.error(chalk.red(`Error (${err.status}): ${err.message}`));
+                if (err.code) {
+                    console.error(chalk.dim(`  code: ${err.code}`));
+                }
+                if (err.code === 'APPROVAL_ALREADY_RESOLVED') {
+                    console.error(chalk.dim('  This gate was already resolved — nothing changed.'));
+                }
+                else if (err.code === 'REJECT_REQUIRES_REASON') {
+                    console.error(chalk.dim('  Server requires a reason for rejection. Pass --reason "<text>" (min 4 chars).'));
+                }
+            }
+            else {
+                const msg = err instanceof Error ? err.message : String(err);
+                console.error(chalk.red(`Error: ${msg}`));
+            }
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=approvals.js.map

package/dist/approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../src/approvals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAuCjE,kFAAkF;AAElF;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kDAAkD,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAyB,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,+CAA+C,OAAO,CAAC,MAAM,KAAK;YAClE,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,IAA2B;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC;IACvE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACjD,sEAAsE;IACtE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,IAAK,GAAG,CAAC,CAAC,CAAY,EAAE,CAAC;YACrG,OAAO,GAAqB,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,KAAqB;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,wFAAwF,CAAC,CACpG,CAAC;AACJ,CAAC;AAED,kFAAkF;AAElF;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IAExD,6EAA6E;IAC7E,EAAE;IACF,sDAAsD;IACtD,uEAAuE;IACvE,iEAAiE;IAEjE,MAAM,YAAY,GAAG,OAAO;SACzB,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CACV,kFAAkF;QAClF,iBAAiB;QACjB,yDAAyD;QACzD,qDAAqD;QACrD,6DAA6D;QAC7D,gDAAgD;QAChD,+EAA+E;QAC/E,+EAA+E,CAChF,CAAC;IAEJ,6EAA6E;IAC7E,EAAE;IACF,mCAAmC;IACnC,EAAE;IACF,yEAAyE;IACzE,wEAAwE;IACxE,4EAA4E;IAC5E,EAAE;IACF,SAAS;IACT,2BAA2B;IAC3B,gDAAgD;IAChD,kCAAkC;IAElC,YAAY;SACT,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,+CAA+C;QAC/C,+EAA+E;QAC/E,4DAA4D;QAC5D,gEAAgE;QAChE,+FAA+F,CAChG;SACA,MAAM,CAAC,kBAAkB,EAAE,2CAA2C,CAAC;SACvE,MAAM,CAAC,QAAQ,EAAE,iDAAiD,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,IAA0C,EAAE,EAAE;QAC3D,IAAI,CAAC;YACH,gEAAgE;YAChE,wEAAwE;YACxE,IAAI,IAAI,GAAG,8BAA8B,CAAC;YAE1C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,+DAA+D;gBAC/D,kEAAkE;gBAClE,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC7D,IAAI,SAAS,EAAE,CAAC;oBACd,IAAI,IAAI,eAAe,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzD,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAA0B,CAAC;YAEnG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACjC,eAAe,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;gBAC5B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,EAAE;IACF,gDAAgD;IAChD,EAAE;IACF,4EAA4E;IAC5E,qEAAqE;IACrE,EAAE;IACF,yEAAyE;IACzE,4DAA4D;IAC5D,0EAA0E;IAC1E,2EAA2E;IAC3E,EAAE;IACF,yEAAyE;IACzE,uEAAuE;IACvE,EAAE;IACF,SAAS;IACT,qFAAqF;IACrF,oFAAoF;IACpF,2EAA2E;IAE3E,YAAY;SACT,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,yCAAyC;QACzC,6EAA6E;QAC7E,+EAA+E;QAC/E,8CAA8C;QAC9C,8EAA8E;QAC9E,sEAAsE;QACtE,eAAe;QACf,gCAAgC;QAChC,wCAAwC;QACxC,gDAAgD,CACjD;SACA,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;SAC3C,cAAc,CAAC,6BAA6B,EAAE,6BAA6B,CAAC;SAC5E,cAAc,CAAC,iBAAiB,EAAE,gEAAgE,CAAC;SACnG,MAAM,CAAC,QAAQ,EAAE,iDAAiD,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAA0D,EAAE,EAAE;QACvF,IAAI,CAAC;YACH,sEAAsE;YACtE,oEAAoE;YACpE,uDAAuD;YAEvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAE3C,sEAAsE;YACtE,2CAA2C;YAC3C,8CAA8C;YAC9C,4DAA4D;YAE5D,MAAM,IAAI,GAAG;gBACX,QAAQ;gBACR,WAAW,EAAE,MAAM;gBACnB,OAAO,EAAE,KAAc;aACxB,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,MAAM,EACN,gCAAgC,kBAAkB,CAAC,EAAE,CAAC,UAAU,EAChE,IAAI,EACJ,EAAE,eAAe,EAAE,IAAI,EAAE,CACC,CAAC;YAE7B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,sEAAsE;YACtE,MAAM,aAAa,GAAG,QAAQ,KAAK,SAAS;gBAC1C,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;gBACzB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAE1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC,CAAC,CAAC;YACrD,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,kBAAkB,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAE7E,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;gBAC5B,4EAA4E;gBAC5E,+DAA+D;gBAC/D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAClE,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClD,CAAC;gBACD,IAAI,GAAG,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;oBAC7C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAC;gBAClF,CAAC;qBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;oBACjD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC,CAAC;gBAC9G,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/config.d.ts

@@ -84,6 +84,17 @@ export declare function addEnvironment(name: string, env: {
     cognitoRegion: string;
 }): void;
 export declare function hasEnvironments(): boolean;
+/** Set the in-memory environment override from the global `--env` flag (or null to clear). */
+export declare function setEnvOverride(name: string | null): void;
+export type EnvSource = 'flag' | 'session' | 'persisted' | 'none';
+/** Where the effective environment name came from, for display in whoami/env. */
+export declare function getActiveEnvSource(): EnvSource;
+/**
+ * The effective environment name for this process, honoring the precedence
+ * chain above. Returns '' when nothing is configured (callers surface a clear
+ * "no environment" error via getEnv).
+ */
+export declare function getActiveEnvName(): string;
 export declare function getEnv(): {
     apiUrl: string;
     cognitoPoolId: string;

package/dist/config.js

@@ -22,15 +22,58 @@ export function addEnvironment(name, env) {
 export function hasEnvironments() {
     return Object.keys(config.get('environments')).length > 0;
 }
+// ── Session-scoped environment override ─────────────────────
+//
+// The persisted `activeEnv` lives in a single on-disk `conf` file shared by
+// every session on the machine, so a bare `fazemos env <name>` in one session
+// clobbers another. To let concurrent agents target different environments
+// without stomping each other (the CLI-DX-1 "credentials keyed only by env"
+// gap), the effective environment is resolved per-process:
+//
+//   --env <name> flag  >  FAZEMOS_ENV env var  >  persisted activeEnv
+//
+// The flag override is set once at CLI bootstrap (see the preAction hook in
+// src/index.ts). Environment is deliberately session-scoped — not written into
+// a git-committable `.fazemos.json` like org/project — because dev/prod is a
+// per-session choice that shouldn't be pinned in a shared repo file.
+let envOverride = null;
+/** Set the in-memory environment override from the global `--env` flag (or null to clear). */
+export function setEnvOverride(name) {
+    envOverride = name?.trim() || null;
+}
+/** Where the effective environment name came from, for display in whoami/env. */
+export function getActiveEnvSource() {
+    if (envOverride)
+        return 'flag';
+    if (process.env.FAZEMOS_ENV?.trim())
+        return 'session';
+    if (config.get('activeEnv'))
+        return 'persisted';
+    return 'none';
+}
+/**
+ * The effective environment name for this process, honoring the precedence
+ * chain above. Returns '' when nothing is configured (callers surface a clear
+ * "no environment" error via getEnv).
+ */
+export function getActiveEnvName() {
+    return envOverride || process.env.FAZEMOS_ENV?.trim() || config.get('activeEnv');
+}
 export function getEnv() {
-    const name = config.get('activeEnv');
+    const name = getActiveEnvName();
+    if (!name) {
+        throw new Error('No environment configured. Run: fazemos init <name> --api-url <url>');
+    }
     const env = config.get('environments')[name];
-    if (!env)
-        throw new Error(`Environment "${name}" not configured`);
+    if (!env) {
+        const src = getActiveEnvSource();
+        const via = src === 'flag' ? ' (from --env)' : src === 'session' ? ' (from FAZEMOS_ENV)' : '';
+        throw new Error(`Environment "${name}"${via} is not configured. Configure it with: fazemos init ${name} --api-url <url>`);
+    }
     return { name, ...env };
 }
 export function getToken() {
-    const env = config.get('activeEnv');
+    const env = getActiveEnvName();
     const auth = config.get('auth')[env];
     if (!auth)
         return null;
@@ -123,7 +166,7 @@ export function getAuthMeCache() {
     const cache = config.get('authMeCache');
     if (!cache)
         return null;
-    const activeEnv = config.get('activeEnv');
+    const activeEnv = getActiveEnvName();
     if (cache.activeEnv !== activeEnv)
         return null;
     if (Date.now() - cache.fetchedAt > AUTH_ME_CACHE_TTL_MS)
@@ -131,7 +174,7 @@ export function getAuthMeCache() {
     return cache.data;
 }
 export function setAuthMeCache(data) {
-    const activeEnv = config.get('activeEnv');
+    const activeEnv = getActiveEnvName();
     config.set('authMeCache', {
         activeEnv,
         fetchedAt: Date.now(),

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AA+ExB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAgB;IAC5C,WAAW,EAAE,aAAa;IAC1B,QAAQ,EAAE;QACR,YAAY,EAAE,EAAE;QAChB,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,EAAE;QACf,kBAAkB,EAAE,EAAE;QACtB,IAAI,EAAE,EAAE;KACT;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAA8F;IACzI,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;IACjB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACjC,iCAAiC;IACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,kBAAkB,CAAC,CAAC;IAClE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,+DAA+D;AAC/D,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAC9E,6EAA6E;AAC7E,4DAA4D;AAE5D,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,eAAe,GAAkB,IAAI,CAAC;AAC1C,IAAI,gBAAgB,GAA4D,IAAI,CAAC;AAErF,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAC,SAAwB;IACzD,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mBAAmB,CAAC,MAA+D;IACjG,gBAAgB,GAAG,MAAM,CAAC;AAC5B,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mBAAmB;IACjC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,KAAa,EAAE,OAAe,EAAE,YAAoB,EAAE,gBAAwB;IACjH,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,GAAG;QACV,KAAK;QACL,OAAO;QACP,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI;KAChD,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,+DAA+D;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAiB;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACnD,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IACvB,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,+DAA+D;AAE/D,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAoB;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE;QACxB,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,yEAAyE;IACzE,yEAAyE;IACzE,wBAAwB;IACxB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAY;IAC3D,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,SAAiB;IAC9D,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACpD,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AA+ExB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAgB;IAC5C,WAAW,EAAE,aAAa;IAC1B,QAAQ,EAAE;QACR,YAAY,EAAE,EAAE;QAChB,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,EAAE;QACf,kBAAkB,EAAE,EAAE;QACtB,IAAI,EAAE,EAAE;KACT;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAA8F;IACzI,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;IACjB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACjC,iCAAiC;IACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,+DAA+D;AAC/D,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,2DAA2D;AAC3D,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,qEAAqE;AAErE,IAAI,WAAW,GAAkB,IAAI,CAAC;AAEtC,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,WAAW,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACrC,CAAC;AAID,iFAAiF;AACjF,MAAM,UAAU,kBAAkB;IAChC,IAAI,WAAW;QAAE,OAAO,MAAM,CAAC;IAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAChD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,IAAI,GAAG,uDAAuD,IAAI,kBAAkB,CAAC,CAAC;IAC5H,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,+DAA+D;AAC/D,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAC9E,6EAA6E;AAC7E,4DAA4D;AAE5D,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,eAAe,GAAkB,IAAI,CAAC;AAC1C,IAAI,gBAAgB,GAA4D,IAAI,CAAC;AAErF,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAC,SAAwB;IACzD,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mBAAmB,CAAC,MAA+D;IACjG,gBAAgB,GAAG,MAAM,CAAC;AAC5B,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mBAAmB;IACjC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,KAAa,EAAE,OAAe,EAAE,YAAoB,EAAE,gBAAwB;IACjH,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,GAAG;QACV,KAAK;QACL,OAAO;QACP,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI;KAChD,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,+DAA+D;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAiB;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACnD,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IACvB,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,+DAA+D;AAE/D,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAoB;IACjD,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE;QACxB,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,yEAAyE;IACzE,yEAAyE;IACzE,wBAAwB;IACxB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAY;IAC3D,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,SAAiB;IAC9D,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACpD,CAAC"}

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { config, getEnv, getToken, getActiveOrgId, setActiveOrgId, addEnvironment, hasEnvironments, 
+import { config, getEnv, getToken, getActiveEnvName, getActiveEnvSource, setEnvOverride, getActiveOrgId, setActiveOrgId, addEnvironment, hasEnvironments, 
 // F15 — project context helpers
 getActiveProjectId, setActiveProjectId, clearActiveProjectId, findProjectBySlug, findProjectById, findOrgById, 
 // Directory-scoped context override (.fazemos.json)
@@ -24,6 +24,7 @@ import { registerGovernanceCommands } from './governance.js';
 import { registerAutoStartCommands } from './autostart.js';
 import { registerFtrCommand } from './ftr.js';
 import { registerScheduleCommands } from './schedule.js';
+import { registerApprovalsCommands } from './approvals.js';
 import { parseExecutionsJson, resolveWaitOptions, waitForPipelines, buildAwsCommand, validateExecutionEntry, } from './wait-for-pipeline.js';
 import { readFileSync, readdirSync, writeFileSync, mkdirSync, existsSync, statSync } from 'fs';
 import { fileURLToPath } from 'url';
@@ -198,7 +199,12 @@ const program = new Command();
 program
     .name('fazemos')
     .description('Fazemos CLI — Team Accomplishment Platform')
-    .version(pkg.version);
+    .version(pkg.version)
+    // Session-scoped environment override. Precedence: this flag > FAZEMOS_ENV
+    // env var > the persisted active env. Lets one command (or, via the env var,
+    // a whole session) target a different environment without a shared-disk
+    // `fazemos env` switch that would clobber a concurrent session.
+    .option('--env <name>', 'Environment to use for this invocation (overrides FAZEMOS_ENV and the persisted active env)');
 // ── Directory-scoped default org/project (.fazemos.json) ─────
 //
 // Before any command action runs, discover the nearest `.fazemos.json`
@@ -265,6 +271,11 @@ async function applyDirContext(topCommand) {
     }
 }
 program.hook('preAction', async (_thisCommand, actionCommand) => {
+    // Apply the global `--env` flag first so every downstream resolution (dir
+    // context slug lookups, auth, API calls) sees the right environment.
+    const envFlag = program.opts().env;
+    if (envFlag)
+        setEnvOverride(envFlag);
     // Resolve the top-level command name (e.g. `worksheets list` → `worksheets`).
     let c = actionCommand;
     let top = c?.name?.();
@@ -331,8 +342,8 @@ program
 // ── Environment ─────────────────────────────────────────────
 program
     .command('env')
-    .description('Show or switch environment')
-    .argument('[name]', 'Environment to switch to')
+    .description('Show or switch environment. The persisted switch is machine-global; for per-session isolation set FAZEMOS_ENV or pass --env.')
+    .argument('[name]', 'Environment to switch to (persisted, machine-global)')
     .action((name) => {
     if (!hasEnvironments()) {
         console.log(chalk.yellow('No environments configured. Run: fazemos init <name> --api-url <url>'));
@@ -346,10 +357,25 @@ program
             process.exit(1);
         }
         config.set('activeEnv', name);
-        console.log(chalk.green(`Switched to ${name}`));
+        console.log(chalk.green(`Switched persisted environment to ${name}`));
+        // A persisted switch is machine-global. If this session is pinned to a
+        // different env via the override chain, the switch won't take effect here
+        // until the override is cleared — say so rather than silently no-op'ing.
+        const src = getActiveEnvSource();
+        if ((src === 'session' || src === 'flag') && getActiveEnvName() !== name) {
+            const via = src === 'flag' ? '--env' : 'FAZEMOS_ENV';
+            console.log(chalk.yellow(`Note: this session is pinned to "${getActiveEnvName()}" via ${via}; ` +
+                `the persisted switch won't take effect here until that override is cleared.`));
+        }
     }
     const env = getEnv();
-    console.log(`  Environment: ${chalk.cyan(env.name)}`);
+    const src = getActiveEnvSource();
+    const srcLabel = src === 'flag'
+        ? chalk.gray(' (this invocation, via --env)')
+        : src === 'session'
+            ? chalk.gray(' (this session, via FAZEMOS_ENV)')
+            : '';
+    console.log(`  Environment: ${chalk.cyan(env.name)}${srcLabel}`);
     console.log(`  API:         ${env.apiUrl}`);
     console.log(`  Cognito:     ${env.cognitoPoolId}`);
     const token = getToken();
@@ -432,11 +458,11 @@ auth
     .command('logout')
     .description('Clear stored credentials')
     .action(() => {
-    const env = config.get('activeEnv');
+    const env = getActiveEnvName();
     const auths = config.get('auth');
     delete auths[env];
     config.set('auth', auths);
-    console.log(chalk.green('Logged out'));
+    console.log(chalk.green(`Logged out of ${env}`));
 });
 // ── Whoami ──────────────────────────────────────────────────
 program
@@ -458,6 +484,13 @@ program
         }
         console.log(`  User:    ${chalk.cyan(data.user.email)}`);
         console.log(`  Member:  ${data.member.displayName} (${data.member.role})`);
+        const envSrc = getActiveEnvSource();
+        const envSrcLabel = envSrc === 'flag'
+            ? chalk.gray(' (this invocation, via --env)')
+            : envSrc === 'session'
+                ? chalk.gray(' (this session, via FAZEMOS_ENV)')
+                : '';
+        console.log(`  Env:     ${chalk.cyan(getActiveEnvName())}${envSrcLabel}`);
         const activeOrgId = getActiveOrgId() ?? data.activeOrgId;
         const activeOrg = data.orgs.find(o => o.id === activeOrgId);
         if (activeOrg) {
@@ -9620,6 +9653,13 @@ registerFtrCommand(program);
 // (does NOT pass noProjectHeader: true — greenfield fix per binding_decision.cli_header_scoping).
 // admin/owner required for set/unset/disable/enable/tz; any active member for list.
 registerScheduleCommands(program);
+// ── FC-B — Approval Gate CLI: approvals list / approvals resolve ──────────────
+// Registers `approvals` top-level command with `list` and `resolve` sub-commands.
+// Both calls are org-scoped (noProjectHeader: true); resolve sends surface='cli'
+// so the audit trail records via='cli' (rul_via_cli_landed_in_audit_trail).
+// --reason is mandatory for resolve — CLI typed-token equivalent (OBD #1).
+// Auth: requireAuth + org membership (server-side, F37 shipped).
+registerApprovalsCommands(program);
 // Skip auto-parse only when running under Vitest (which sets process.env.VITEST).
 // Tests import `program` and drive it via `program.parseAsync(...)` after mocking
 // `./api.js`. In every other context — direct invocation, npx tsx, OR the bin