@formigio/fazemos-cli 0.10.52 → 0.10.54

package/dist/api.d.ts

@@ -71,6 +71,30 @@ export declare function resolveOrgIdMaybeSlug(value: string): Promise<string>;
  * archive) and needs subsequent lookups to see the new data.
  */
 export declare function refreshAuthMeCache(): Promise<AuthMeResponse | null>;
+/**
+ * F49 CHG-2 — Cross-org API key resolver.
+ *
+ * In agent execution contexts (Fargate tasks), the launcher injects env vars:
+ *   FAZEMOS_API_KEY       — primary org fzm_ key (always present for agents)
+ *   FAZEMOS_ORG_ID        — primary org UUID
+ *   FAZEMOS_API_KEY__{ORG_SLUG_UPPER_SNAKE} — cross-org key(s), one per target org
+ *
+ * Resolution order (BD-2 enforcement — no disk write, env-var-only):
+ *   1. If FAZEMOS_API_KEY is present → agent context (API key auth)
+ *      a. If active org UUID differs from FAZEMOS_ORG_ID → cross-org call
+ *         - Resolve active org slug from authMeCache
+ *         - Look up FAZEMOS_API_KEY__{SLUG.toUpperCase().replace(/-/g,'_')}
+ *         - If found → return cross-org key
+ *         - If absent → fall through to FAZEMOS_API_KEY (server returns natural 404)
+ *      b. Otherwise (primary org or no org context) → return FAZEMOS_API_KEY
+ *   2. No FAZEMOS_API_KEY → human Cognito-token context → return null (caller uses getToken)
+ *
+ * Slug normalization is EXACTLY `.toUpperCase().replace(/-/g, '_')` per BD-4
+ * (no other transformation). Example: "never-behind" → "NEVER_BEHIND".
+ *
+ * NEVER writes anything to disk — reads process.env only (BD-2 hard property).
+ */
+export declare function resolveBearerToken(activeOrgId: string | null): string | null;
 /**
  * Core API helper. Always authenticates, always sends X-Org-Id when one is
  * active, and sends X-Fazemos-Project-Id when a project is active (or one

package/dist/api.js

@@ -1,4 +1,4 @@
-import { getEnv, getToken, getActiveOrgId, getActiveProjectId, findProjectBySlug, findOrgBySlug, setAuthMeCache, clearAuthMeCache, } from './config.js';
+import { getEnv, getToken, getActiveOrgId, getActiveProjectId, findProjectBySlug, findOrgBySlug, findOrgById, setAuthMeCache, clearAuthMeCache, } from './config.js';
 import { refreshSession } from './auth.js';
 /**
  * Error thrown when an API request returns a non-2xx response. Carries the
@@ -100,6 +100,54 @@ export async function refreshAuthMeCache() {
     }
     return null;
 }
+/**
+ * F49 CHG-2 — Cross-org API key resolver.
+ *
+ * In agent execution contexts (Fargate tasks), the launcher injects env vars:
+ *   FAZEMOS_API_KEY       — primary org fzm_ key (always present for agents)
+ *   FAZEMOS_ORG_ID        — primary org UUID
+ *   FAZEMOS_API_KEY__{ORG_SLUG_UPPER_SNAKE} — cross-org key(s), one per target org
+ *
+ * Resolution order (BD-2 enforcement — no disk write, env-var-only):
+ *   1. If FAZEMOS_API_KEY is present → agent context (API key auth)
+ *      a. If active org UUID differs from FAZEMOS_ORG_ID → cross-org call
+ *         - Resolve active org slug from authMeCache
+ *         - Look up FAZEMOS_API_KEY__{SLUG.toUpperCase().replace(/-/g,'_')}
+ *         - If found → return cross-org key
+ *         - If absent → fall through to FAZEMOS_API_KEY (server returns natural 404)
+ *      b. Otherwise (primary org or no org context) → return FAZEMOS_API_KEY
+ *   2. No FAZEMOS_API_KEY → human Cognito-token context → return null (caller uses getToken)
+ *
+ * Slug normalization is EXACTLY `.toUpperCase().replace(/-/g, '_')` per BD-4
+ * (no other transformation). Example: "never-behind" → "NEVER_BEHIND".
+ *
+ * NEVER writes anything to disk — reads process.env only (BD-2 hard property).
+ */
+export function resolveBearerToken(activeOrgId) {
+    const primaryApiKey = process.env.FAZEMOS_API_KEY;
+    if (!primaryApiKey) {
+        // Cognito-token path — caller falls back to getToken() / refreshSession()
+        return null;
+    }
+    const primaryOrgId = process.env.FAZEMOS_ORG_ID;
+    if (activeOrgId && primaryOrgId && activeOrgId !== primaryOrgId) {
+        // Active org differs from the primary key's org — look for a cross-org key.
+        // Slug normalization: EXACT rule per manifest BD-4 and Dex checklist:
+        //   .toUpperCase().replace(/-/g, '_')
+        const activeOrg = findOrgById(activeOrgId);
+        if (activeOrg?.slug) {
+            const upperSnake = activeOrg.slug.toUpperCase().replace(/-/g, '_');
+            const crossOrgKey = process.env[`FAZEMOS_API_KEY__${upperSnake}`];
+            if (crossOrgKey) {
+                return crossOrgKey;
+            }
+            // Cross-org key absent (EC3 — env var not yet injected, or SSM mint lagged):
+            // fall through to primary key; server returns natural 404. No client-side error.
+        }
+    }
+    // Primary org call, or cross-org slug unresolvable → use primary API key
+    return primaryApiKey;
+}
 /**
  * Core API helper. Always authenticates, always sends X-Org-Id when one is
  * active, and sends X-Fazemos-Project-Id when a project is active (or one
@@ -118,20 +166,27 @@ export async function refreshAuthMeCache() {
  */
 export async function api(method, path, body, opts = {}) {
     const env = getEnv();
-    let token = getToken();
     const orgId = getActiveOrgId();
-    // Auto-refresh if token is expired
-    if (!token) {
-        token = await refreshSession();
+    // F49 CHG-2: resolve bearer token — API key (agent context) or Cognito JWT (human context)
+    const apiKey = resolveBearerToken(orgId);
+    let token = null;
+    if (!apiKey) {
+        // Cognito auth path — human users / local dev
+        token = getToken();
+        // Auto-refresh if token is expired
         if (!token) {
-            throw new Error('Session expired. Run: fazemos auth login');
+            token = await refreshSession();
+            if (!token) {
+                throw new Error('Session expired. Run: fazemos auth login');
+            }
         }
     }
     const headers = {
         'Content-Type': 'application/json',
     };
-    if (token) {
-        headers['Authorization'] = `Bearer ${token}`;
+    const bearer = apiKey ?? token;
+    if (bearer) {
+        headers['Authorization'] = `Bearer ${bearer}`;
     }
     if (orgId) {
         headers['X-Org-Id'] = orgId;

package/dist/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,QAAQ,EACR,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,gBAAgB,GAEjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAS;IACf,IAAI,CAAU;IACd,IAAI,CAAW;IACf,YAAY,OAAe,EAAE,MAAc,EAAE,IAAa,EAAE,IAAc;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AA4BD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,YAAqB;IAChE,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,mEAAmE;YACnE,kEAAkE;YAClE,oCAAoC;YACpC,MAAM,kBAAkB,EAAE,CAAC;YAC3B,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,oBAAoB,YAAY,EAAE,EAClC,GAAG,EACH,iBAAiB,CAClB,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED,oFAAoF;AACpF,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa;IACvD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,IAAI,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,kBAAkB,EAAE,CAAC;QAC3B,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,gBAAgB,KAAK,yEAAyE,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,EAAE,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAmB,CAAC;QAClG,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YACjD,cAAc,CAAC,EAAE,CAAC,CAAC;YACnB,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,gEAAgE;QAChE,iBAAiB;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,OAAmB,EAAE;IAErB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,mCAAmC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,mBAAmB;IACnB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,sBAAsB,CAAC,GAAG,SAAS,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,oCAAoC;IACpC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,qEAAqE;IACrE,oDAAoD;IACpD,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GAAgB;QAC3B,MAAM;QACN,OAAO;KACR,CAAC;IAEF,IAAI,IAAI,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEnC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,GAAG,GACP,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACvC,CAAC,CAAE,IAA0C;YAC7C,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,EAAE,KAAK,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QAEpD,+DAA+D;QAC/D,8DAA8D;QAC9D,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;YACvC,MAAM,IAAI,QAAQ,CAChB,8BAA8B,EAC9B,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,gBAAgB,EAAE,CAAC;AACrB,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,QAAQ,EACR,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,cAAc,EACd,gBAAgB,GAEjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAS;IACf,IAAI,CAAU;IACd,IAAI,CAAW;IACf,YAAY,OAAe,EAAE,MAAc,EAAE,IAAa,EAAE,IAAc;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AA4BD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,YAAqB;IAChE,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,mEAAmE;YACnE,kEAAkE;YAClE,oCAAoC;YACpC,MAAM,kBAAkB,EAAE,CAAC;YAC3B,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,oBAAoB,YAAY,EAAE,EAClC,GAAG,EACH,iBAAiB,CAClB,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED,oFAAoF;AACpF,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa;IACvD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,IAAI,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,kBAAkB,EAAE,CAAC;QAC3B,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,gBAAgB,KAAK,yEAAyE,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,EAAE,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAmB,CAAC;QAClG,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YACjD,cAAc,CAAC,EAAE,CAAC,CAAC;YACnB,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,gEAAgE;QAChE,iBAAiB;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAA0B;IAC3D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAClD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,0EAA0E;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAChD,IAAI,WAAW,IAAI,YAAY,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QAChE,4EAA4E;QAC5E,sEAAsE;QACtE,sCAAsC;QACtC,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,SAAS,EAAE,IAAI,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACnE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,UAAU,EAAE,CAAC,CAAC;YAClE,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,6EAA6E;YAC7E,iFAAiF;QACnF,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,OAAmB,EAAE;IAErB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,2FAA2F;IAC3F,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAEzC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,8CAA8C;QAC9C,KAAK,GAAG,QAAQ,EAAE,CAAC;QACnB,mCAAmC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,KAAK,CAAC;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,mBAAmB;IACnB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,sBAAsB,CAAC,GAAG,SAAS,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,oCAAoC;IACpC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,qEAAqE;IACrE,oDAAoD;IACpD,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GAAgB;QAC3B,MAAM;QACN,OAAO;KACR,CAAC;IAEF,IAAI,IAAI,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEnC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,GAAG,GACP,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACvC,CAAC,CAAE,IAA0C;YAC7C,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,EAAE,KAAK,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QAEpD,+DAA+D;QAC/D,8DAA8D;QAC9D,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;YACvC,MAAM,IAAI,QAAQ,CAChB,8BAA8B,EAC9B,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,gBAAgB,EAAE,CAAC;AACrB,CAAC"}

package/dist/index.js

@@ -532,7 +532,7 @@ program
 // ── Directory context (`fazemos use`) ───────────────────────
 program
     .command('use')
-    .description(`Set the default org/project for the current directory (writes ${DIR_CONFIG_FILENAME}). Running the CLI anywhere under that directory scopes calls to this org/project automatically.`)
+    .description(`Set the default org/project for the current directory (writes ${DIR_CONFIG_FILENAME}). Running the CLI anywhere under that directory scopes calls to this org/project automatically. Environment (dev/prod) is deliberately session-scoped, not directory-scoped — set FAZEMOS_ENV or pass --env instead.`)
     .option('-o, --org <slug>', 'Org slug to pin for this directory')
     .option('-p, --project <slug>', 'Project slug to pin for this directory')
     .option('--show', 'Show the directory context in effect and which file provides it')
@@ -3814,6 +3814,30 @@ function findPhaseById(definition, phaseId) {
     return (definition?.phases || []).find((p) => p.id === phaseId);
 }
 const VALID_STEP_TYPES = ['human', 'agent', 'script', 'gate', 'human_approval'];
+/**
+ * G15 — resolve a template identifier that may be a UUID *or* a template name
+ * to a UUID. The template-by-id endpoints (`GET/PUT/PATCH /api/pipeline-templates/:id`)
+ * require a UUID param (`requireUuidParam` middleware — a non-UUID arg returns
+ * "id must be a valid UUID" with empty stdout), so a name like "aiv-full-auto"
+ * must first be resolved via the project-scoped list. UUIDs pass through
+ * untouched (no extra API call). Names are matched within the active project
+ * (or `--project <slug>`); slug is also matched for forward-compatibility if the
+ * API ever adds one.
+ */
+async function resolveTemplateId(idOrName, opts = {}) {
+    if (UUID_RE.test(idOrName))
+        return idOrName;
+    const data = await api('GET', '/api/pipeline-templates', undefined, projectOpts(opts));
+    const matches = (data.templates ?? []).filter((t) => t.name === idOrName || t.slug === idOrName);
+    if (matches.length === 1)
+        return matches[0].id;
+    if (matches.length === 0) {
+        throw new Error(`No template named "${idOrName}" in the active project. ` +
+            `Run "tpl list" to see names/IDs, pass --project <slug> to look in another project, or use the template UUID.`);
+    }
+    throw new Error(`Multiple templates named "${idOrName}" (${matches.map((t) => t.id).join(', ')}). ` +
+        `Use the template UUID to disambiguate.`);
+}
 // ── Templates ──────────────────────────────────────────────
 const templates = program.command('templates').alias('tpl').description('Pipeline template commands.\n\n' +
     '  Templates define multi-step workflows: template → phases → steps → I/O.\n' +
@@ -3856,12 +3880,14 @@ templates
 templates
     .command('show')
     .description('Show template detail including phases, steps, I/O declarations, pipeline inputs, and revision number. Use this to inspect the full structure of a template and discover phase/step IDs needed by other commands.')
-    .argument('<id>', 'Template ID (use "tpl list" to find IDs)')
+    .argument('<id>', 'Template ID or name (use "tpl list" to find them)')
     .option('--json', 'Output the template definition as JSON (same as tpl export). Useful for piping/inspecting without a temp file.')
     .option('--show-sections', 'Print full sections content for all steps (default: truncated at 200 chars)')
+    .option('--project <slug>', 'Override active project when resolving a template name')
     .action(async (id, opts) => {
     try {
-        const data = await api('GET', `/api/pipeline-templates/${id}`);
+        const resolvedId = await resolveTemplateId(id, opts);
+        const data = await api('GET', `/api/pipeline-templates/${resolvedId}`);
         const t = data.template;
         // --json mode: emit definition JSON (same as tpl export)
         if (opts.json) {
@@ -3982,11 +4008,13 @@ templates
 templates
     .command('export')
     .description('Export a template\'s full definition JSON to stdout or a file. Includes all phases, steps, sections, verification, uat, agent_config, I/O wires, and pipeline inputs. The exported JSON is the canonical input to "tpl update-definition". Round-trip: tpl export <id> > def.json && tpl update-definition <id> def.json is a no-op.')
-    .argument('<id>', 'Template ID (use "tpl list" to find IDs)')
+    .argument('<id>', 'Template ID or name (use "tpl list" to find them)')
     .option('--out <file>', 'Write output to file instead of stdout')
+    .option('--project <slug>', 'Override active project when resolving a template name')
     .action(async (id, opts) => {
     try {
-        const data = await api('GET', `/api/pipeline-templates/${id}`);
+        const resolvedId = await resolveTemplateId(id, opts);
+        const data = await api('GET', `/api/pipeline-templates/${resolvedId}`);
         const t = data.template;
         const json = JSON.stringify(t.definition, null, 2);
         if (opts.out) {