@aifabrix/builder 2.44.0 → 2.44.2

package/lib/utils/app-service-env-from-builder.js

@@ -12,8 +12,21 @@
 const path = require('path');
 const yaml = require('js-yaml');
 const fsRealSync = require('../internal/fs-real-sync');
+const pathsUtil = require('./paths');
 const { localHostPort } = require('./declarative-url-ports');
 
+/**
+ * @param {string} p
+ * @returns {boolean}
+ */
+function isExistingDirSync(p) {
+  try {
+    return Boolean(p && fsRealSync.existsSync(p) && fsRealSync.statSync(p).isDirectory());
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Maps application.yaml `app.key` to env var prefix (MISO_HOST, DATAPLANE_PORT, …).
  * Generic keys not listed are skipped (no guessed PREFIX).
@@ -110,12 +123,11 @@ function mergeDocIntoOverlay(overlayDocker, overlayLocal, doc, folderName) {
 }
 
 /**
- * @param {string} projectRoot
+ * @param {string} builderDir
  * @returns {Array<{ doc: object, folderName: string }>}
  */
-function listBuilderApplicationDocs(projectRoot) {
-  const builderDir = path.join(projectRoot, 'builder');
-  if (!fsRealSync.existsSync(builderDir) || !fsRealSync.statSync(builderDir).isDirectory()) {
+function listBuilderApplicationDocsInDir(builderDir) {
+  if (!isExistingDirSync(builderDir)) {
     return [];
   }
   const out = [];
@@ -140,6 +152,33 @@ function listBuilderApplicationDocs(projectRoot) {
   return out;
 }
 
+/**
+ * Prefer projectRoot/builder when present (unit tests, in-repo runs). When missing but projectRoot
+ * is the detected CLI package root (global npm install omits builder/), fall back to
+ * {@link pathsUtil.getBuilderRoot}.
+ *
+ * @param {string} projectRoot
+ * @returns {string[]}
+ */
+function collectBuilderScanDirs(projectRoot) {
+  const legacy = path.join(projectRoot, 'builder');
+  if (isExistingDirSync(legacy)) {
+    return [legacy];
+  }
+  try {
+    const detected = pathsUtil.getProjectRoot();
+    if (detected && path.resolve(projectRoot) === path.resolve(detected)) {
+      const br = pathsUtil.getBuilderRoot();
+      if (isExistingDirSync(br)) {
+        return [br];
+      }
+    }
+  } catch {
+    /* ignore */
+  }
+  return [];
+}
+
 /**
  * @param {string|null|undefined} projectRoot
  * @returns {{ docker: Record<string, unknown>, local: Record<string, unknown> }}
@@ -150,8 +189,10 @@ function buildAppServiceEnvOverlay(projectRoot) {
   if (!projectRoot || !fsRealSync.existsSync(projectRoot)) {
     return { docker: overlayDocker, local: overlayLocal };
   }
-  for (const { doc, folderName } of listBuilderApplicationDocs(projectRoot)) {
-    mergeDocIntoOverlay(overlayDocker, overlayLocal, doc, folderName);
+  for (const builderDir of collectBuilderScanDirs(projectRoot)) {
+    for (const { doc, folderName } of listBuilderApplicationDocsInDir(builderDir)) {
+      mergeDocIntoOverlay(overlayDocker, overlayLocal, doc, folderName);
+    }
   }
   return { docker: overlayDocker, local: overlayLocal };
 }

package/lib/utils/config-paths.js

@@ -216,6 +216,10 @@ function createEnvConfigPathFunctions(getConfigFn, saveConfigFn) {
       if (fromProject) {
         return fromProject;
       }
+      const fromEffective = tryDir(pathsMod.getBuilderRoot());
+      if (fromEffective) {
+        return fromEffective;
+      }
       const work = pathsMod.getAifabrixWork();
       return tryDir(work);
     }

package/lib/utils/configuration-env-resolver.js

@@ -10,7 +10,7 @@
 const path = require('path');
 const fs = require('fs');
 const { getIntegrationPath } = require('./paths');
-const { parseEnvToMap, resolveKvValue } = require('./credential-secrets-env');
+const { parseEnvToMap } = require('./credential-secrets-env');
 const { loadSecrets, resolveKvReferences } = require('../core/secrets');
 const { loadEnvTemplate } = require('./secrets-helpers');
 const { getActualSecretsPath } = require('./secrets-path');
@@ -81,13 +81,13 @@ function substituteVarPlaceholders(value, envMap, systemKey) {
 
 /**
  * Resolves configuration array values in place by location: variable → {{VAR}} from envMap;
- * keyvault → kv:// from secrets. Does not log or expose secret values.
+ * keyvault → leaves kv:// as-is (secret value pushed separately by CLI). Does not log or expose secret values.
  *
  * @param {Array<{ name?: string, value?: string, location?: string }>} configArray - Configuration array (mutated)
  * @param {Object.<string, string>} envMap - Resolved env map from buildResolvedEnvMapForIntegration
- * @param {Object} secrets - Loaded secrets for kv:// resolution
+ * @param {Object} secrets - Loaded secrets (unused for keyvault config values; kept for backward compatibility)
  * @param {string} [systemKey] - System key for error messages
- * @throws {Error} If variable env is missing or keyvault secret unresolved (message never contains secret values)
+ * @throws {Error} If variable env is missing or keyvault value is not a kv:// reference (message never contains secret values)
  */
 function resolveConfigurationValues(configArray, envMap, secrets, systemKey) {
   if (!Array.isArray(configArray)) return;
@@ -101,11 +101,14 @@ function resolveConfigurationValues(configArray, envMap, secrets, systemKey) {
       }
       item.value = substituteVarPlaceholders(item.value, envMap, systemKey);
     } else if (location === 'keyvault') {
-      const resolved = resolveKvValue(secrets, item.value);
-      if (resolved === null || resolved === undefined) {
-        throw new Error(`Unresolved keyvault reference for configuration '${item.name || 'unknown'}'.${hint}`);
+      if (!item.value.trim().startsWith('kv://')) {
+        throw new Error(
+          `Configuration entry '${item.name || 'unknown'}' has location 'keyvault' but value is not kv://. ` +
+            `Set value to a kv:// reference and push the secret with KV_* env vars.${hint}`
+        );
       }
-      item.value = resolved;
+      // Intentionally do not resolve kv:// here. Upload keeps kv:// references in config and
+      // pushes secret values separately via the credential secret API.
     }
   }
 }

package/lib/utils/credential-secrets-env.js

@@ -132,7 +132,7 @@ function kvEnvKeyToPath(envKey, systemKey) {
  * @param {Object.<string, string>} envMap - Key-value map from .env
  * @returns {Array<{ key: string, value: string }>} Items (key = kv://..., value = raw)
  */
-function collectKvEnvVarsAsSecretItems(envMap) {
+function collectKvEnvVarsAsSecretItems(envMap, systemKey) {
   if (!envMap || typeof envMap !== 'object') {
     return [];
   }
@@ -144,7 +144,7 @@ function collectKvEnvVarsAsSecretItems(envMap) {
     if (value.startsWith('kv://') && isValidKvPath(value)) {
       kvPath = value;
     }
-    if (!kvPath) kvPath = kvEnvKeyToPath(envKey);
+    if (!kvPath) kvPath = kvEnvKeyToPath(envKey, systemKey) || kvEnvKeyToPath(envKey);
     if (!kvPath) continue;
     items.push({ key: kvPath, value });
   }
@@ -223,12 +223,12 @@ function isValidKvPath(key) {
  * @param {Object} secrets - Loaded secrets
  * @param {Map<string, string>} itemsByKey - Mutable map to add items to
  */
-function buildItemsFromEnv(envFilePath, secrets, itemsByKey) {
+function buildItemsFromEnv(envFilePath, secrets, itemsByKey, systemKey) {
   if (!envFilePath || typeof envFilePath !== 'string' || !fs.existsSync(envFilePath)) return;
   try {
     const content = fs.readFileSync(envFilePath, 'utf8');
     const envMap = parseEnvToMap(content);
-    const fromEnv = collectKvEnvVarsAsSecretItems(envMap);
+    const fromEnv = collectKvEnvVarsAsSecretItems(envMap, systemKey);
     for (const { key, value } of fromEnv) {
       const resolved = resolveKvValue(secrets, value);
       // Skip placeholder: value that equals the kv path (e.g. from env.template) must not be pushed as the secret
@@ -320,7 +320,7 @@ async function pushCredentialSecrets(dataplaneUrl, authConfig, options = {}) {
     secrets = {};
   }
   const itemsByKey = new Map();
-  buildItemsFromEnv(envFilePath, secrets, itemsByKey);
+  buildItemsFromEnv(envFilePath, secrets, itemsByKey, appName);
   buildItemsFromPayload(payload, secrets, itemsByKey);
 
   const items = Array.from(itemsByKey.entries())

package/lib/utils/datasource-test-run-certificate-tty.js

@@ -0,0 +1,82 @@
+/**
+ * @fileoverview Certificate / certification tier lines for DatasourceTestRun TTY output.
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const { sectionTitle } = require('./cli-test-layout-chalk');
+
+function trimCertificateField(v) {
+  if (v === undefined || v === null) return '';
+  return String(v).trim();
+}
+
+function certificateEnvelopeGlyph(statusRaw) {
+  if (statusRaw === 'passed') return '✔';
+  if (statusRaw === 'not_passed') return '✖';
+  return statusRaw ? '⚠' : ' ';
+}
+
+function certificateTTYHasContent(levelRaw, stRaw, summaryRaw, blockerCount) {
+  return Boolean(levelRaw || stRaw || summaryRaw || blockerCount > 0);
+}
+
+/**
+ * @param {string[]} lines
+ * @param {string} stRaw
+ * @param {string} levelRaw
+ * @param {string} summaryRaw
+ */
+function appendCertificateStatusAndSummaryLines(lines, stRaw, levelRaw, summaryRaw) {
+  if (stRaw || levelRaw) {
+    const cg = certificateEnvelopeGlyph(stRaw);
+    const tier = levelRaw ? ` — tier ${levelRaw}` : '';
+    lines.push(chalk.white(`  ${cg} ${stRaw || 'unknown'}${tier}`));
+  }
+  if (summaryRaw) {
+    lines.push(chalk.gray(`  ${summaryRaw}`));
+  }
+}
+
+/**
+ * @param {string[]} lines
+ * @param {Object[]} blockers
+ * @param {number} maxVisible
+ */
+function appendCertificateBlockerLines(lines, blockers, maxVisible) {
+  const cap = Math.min(maxVisible, blockers.length);
+  for (let i = 0; i < cap; i += 1) {
+    const b = blockers[i];
+    const msg = b && b.message ? String(b.message) : '';
+    if (msg) lines.push(chalk.yellow(`  • ${msg}`));
+  }
+  if (blockers.length > cap) {
+    lines.push(chalk.gray(`  … and ${blockers.length - cap} more`));
+  }
+}
+
+/**
+ * Certification / certificate tier (integration engine or E2E envelope after active cert attach).
+ * @param {string[]} lines
+ * @param {Object} envelope
+ */
+function appendCertificateTTY(lines, envelope) {
+  const cert = envelope && envelope.certificate;
+  if (!cert || typeof cert !== 'object') return;
+  const levelRaw = trimCertificateField(cert.level);
+  const stRaw = trimCertificateField(cert.status);
+  const summaryRaw = trimCertificateField(cert.summary);
+  const blockers = Array.isArray(cert.blockers) ? cert.blockers : [];
+  if (!certificateTTYHasContent(levelRaw, stRaw, summaryRaw, blockers.length)) return;
+  lines.push('');
+  lines.push(sectionTitle('Certification:'));
+  appendCertificateStatusAndSummaryLines(lines, stRaw, levelRaw, summaryRaw);
+  appendCertificateBlockerLines(lines, blockers, 5);
+}
+
+module.exports = {
+  appendCertificateTTY
+};

package/lib/utils/datasource-test-run-display.js

@@ -6,6 +6,7 @@
 
 const chalk = require('chalk');
 const { sectionTitle, headerKeyValue, colorAggregateGlyph, successGlyph, failureGlyph } = require('./cli-test-layout-chalk');
+const { appendCertificateTTY } = require('./datasource-test-run-certificate-tty');
 
 const SEP = '────────────────────────────────';
 
@@ -235,6 +236,16 @@ function appendDebugPayloadRefLines(lines, dbg, maxRefChars) {
  */
 function appendDebugMetaLines(lines, dbg, maxRefChars) {
   let added = false;
+  function formatSecondsText(s) {
+    const txt = String(s);
+    // UI-only: reduce noisy float seconds to 3 decimals, e.g. "1.1713749s" -> "1.171s".
+    // Applies only to number tokens immediately followed by "s".
+    return txt.replace(/(\d+\.\d+)(?=s\b)/g, m => {
+      const n = Number(m);
+      if (!Number.isFinite(n)) return m;
+      return n.toFixed(3);
+    });
+  }
   if (dbg.mode) {
     lines.push(
       `${chalk.blue.bold('debug.mode:')} ${chalk.white(String(dbg.mode))}`
@@ -244,7 +255,7 @@ function appendDebugMetaLines(lines, dbg, maxRefChars) {
   if (dbg.executionSummary) {
     lines.push(
       `${chalk.blue.bold('debug.executionSummary:')} ${chalk.white(
-        truncateRefLine(String(dbg.executionSummary), maxRefChars)
+        truncateRefLine(formatSecondsText(dbg.executionSummary), maxRefChars)
       )}`
     );
     added = true;
@@ -326,9 +337,14 @@ function appendIntegrationStepLines(lines, envelope) {
 
 function pickExecutiveVerdictLine(envelope) {
   const dev = envelope.developer;
+  const cert = envelope.certificate;
+  if (envelope.runType === 'e2e' && cert && typeof cert === 'object') {
+    const cs = cert.summary;
+    if (cs && String(cs).trim()) return String(cs).trim();
+  }
   return (
     (dev && dev.executiveSummary) ||
-    (envelope.certificate && envelope.certificate.summary) ||
+    (cert && cert.summary) ||
     (envelope.validation && envelope.validation.summary) ||
     (envelope.integration && envelope.integration.summary) ||
     `Run finished with status ${envelope.status}.`
@@ -416,6 +432,7 @@ function formatDatasourceTestRunTTY(envelope, options = {}) {
   lines.push('');
   lines.push(sectionTitle('Verdict:'));
   lines.push(chalk.white(pickExecutiveVerdictLine(envelope)));
+  appendCertificateTTY(lines, envelope);
   lines.push('');
   lines.push(chalk.gray(SEP));
   if (appendReferenceLayoutLines(lines, envelope, { maxRefChars: 160 })) {

package/lib/utils/datasource-test-run-exit.js

@@ -52,7 +52,32 @@ function exitCodeForPollTimeout(lastBody) {
   return 3;
 }
 
+const {
+  deriveSystemStatus,
+  systemCertStatus
+} = require('./external-system-system-test-tty');
+
+/**
+ * System-level exit code from per-datasource result rows (same matrix as §3.1 on synthetic rollup).
+ * @param {Array<{ skipped?: boolean, success?: boolean, datasourceTestRun?: Object|null }>} rows
+ * @param {Object} [opts]
+ * @param {boolean} [opts.warningsAsErrors]
+ * @param {boolean} [opts.requireCert]
+ * @returns {number}
+ */
+function computeSystemExitCodeFromDatasourceRows(rows, opts = {}) {
+  const list = Array.isArray(rows) ? rows : [];
+  const status = deriveSystemStatus(list);
+  const certAgg = systemCertStatus(list);
+  const body = {
+    status,
+    certificate: certAgg ? { status: certAgg === 'passed' ? 'passed' : 'not_passed' } : undefined
+  };
+  return computeExitCodeFromDatasourceTestRun(body, opts);
+}
+
 module.exports = {
   computeExitCodeFromDatasourceTestRun,
+  computeSystemExitCodeFromDatasourceRows,
   exitCodeForPollTimeout
 };

package/lib/utils/external-system-display.js

@@ -24,6 +24,7 @@ const {
   successGlyph,
   failureGlyph
 } = require('./cli-test-layout-chalk');
+const { displaySystemAggregateDatasourceTestRuns } = require('./external-system-system-test-tty');
 
 /**
  * Displays formatted test results (local external `aifabrix test` — structured report layout).
@@ -269,6 +270,13 @@ function displayServerDatasourceTestRunResults(results, verbose, opts = {}) {
     return;
   }
 
+  // Plan §17: system-level overview for multi-datasource results (no full §16 dump per datasource by default).
+  // Keep legacy per-datasource full envelope available only via datasource commands.
+  if (integrationResultsHaveEnvelope(results)) {
+    displaySystemAggregateDatasourceTestRuns(results, { runType, verbose: Boolean(verbose) });
+    return;
+  }
+
   const agg = deriveAggregateServerStatus(results);
   logServerDatasourceTestRunHeader(results, runType, agg);
 

package/lib/utils/external-system-system-test-tty-overview.js

@@ -0,0 +1,120 @@
+/**
+ * @fileoverview Plan §17 blocks: capabilities overview and integration health (split for file-size limits).
+ */
+
+'use strict';
+
+/**
+ * @param {Object|null|undefined} env
+ * @returns {'ok'|'warn'|'fail'}
+ */
+function integrationRollupStatus(env) {
+  const integ = env && env.integration;
+  if (!integ || typeof integ !== 'object') return 'ok';
+  if (typeof integ.status === 'string') {
+    const s = integ.status.toLowerCase();
+    if (s === 'fail' || s === 'failed' || s === 'error') return 'fail';
+    if (s === 'warn' || s === 'warning') return 'warn';
+    if (s === 'ok' || s === 'passed' || s === 'success') return 'ok';
+  }
+  const steps = Array.isArray(integ.stepResults) ? integ.stepResults : [];
+  if (steps.some(s => s && (s.success === false || s.error))) return 'fail';
+  return 'ok';
+}
+
+function buildCapabilityBlocks(rows, statusGlyph) {
+  const blocks = [];
+  for (const r of rows) {
+    if (r && r.skipped) continue;
+    const env = r && r.datasourceTestRun;
+    if (!env || !Array.isArray(env.capabilities) || env.capabilities.length === 0) continue;
+    const dkey = env.datasourceKey || r.key || 'datasource';
+    const caps = [...env.capabilities]
+      .filter(c => c && c.key)
+      .sort((a, b) => String(a.key).localeCompare(String(b.key)))
+      .slice(0, 4);
+    const parts = caps.map(c => `${statusGlyph(c.status)} ${c.key}`);
+    if (parts.length === 0) continue;
+    blocks.push({ dkey: String(dkey), line: parts.join(' ') });
+  }
+  return blocks;
+}
+
+function emitSectionHeader(io, title) {
+  const { log, metaGray, sectionTitle, SEP } = io;
+  log('');
+  log(metaGray(SEP));
+  log('');
+  log(sectionTitle(title));
+  log('');
+}
+
+/**
+ * @param {Array} rows
+ * @param {{ log: Function, chalk: object, metaGray: Function, sectionTitle: Function, statusGlyph: Function, SEP: string }} io
+ * @returns {boolean}
+ */
+function logCapabilitiesOverview(rows, io) {
+  const blocks = buildCapabilityBlocks(rows, io.statusGlyph);
+  if (blocks.length === 0) return false;
+  emitSectionHeader(io, 'Capabilities overview:');
+  for (const b of blocks) {
+    io.log(io.chalk.white(`${b.dkey}:`));
+    io.log(io.chalk.white(`  ${b.line}`));
+  }
+  return true;
+}
+
+function badIntegrationSteps(integ) {
+  if (!integ || !Array.isArray(integ.stepResults)) return [];
+  return integ.stepResults.filter(s => s && (s.success === false || s.error)).slice(0, 2);
+}
+
+function buildIntegrationBlocks(rows) {
+  const blocks = [];
+  for (const r of rows) {
+    if (r && r.skipped) continue;
+    const env = r && r.datasourceTestRun;
+    if (!env) continue;
+    const dkey = env.datasourceKey || r.key || 'datasource';
+    const st = integrationRollupStatus(env);
+    const integ = env.integration && typeof env.integration === 'object' ? env.integration : null;
+    blocks.push({ dkey: String(dkey), st, badSteps: badIntegrationSteps(integ) });
+  }
+  return blocks;
+}
+
+function emitFailedSteps(block, io) {
+  if (block.st !== 'fail' && block.st !== 'warn') return;
+  const { log, chalk, statusGlyph } = io;
+  for (const stp of block.badSteps) {
+    const nm = stp.name || stp.step || 'step';
+    const hint = stp.error || stp.message || '';
+    log(chalk.white(`  ${statusGlyph('fail')} ${nm}${hint ? `: ${hint}` : ''}`));
+  }
+}
+
+/**
+ * @param {Array} rows
+ * @param {'integration'|'e2e'} runType
+ * @param {{ log: Function, chalk: object, metaGray: Function, sectionTitle: Function, statusGlyph: Function, SEP: string }} io
+ * @returns {boolean}
+ */
+function logIntegrationHealthSection(rows, runType, io) {
+  if (runType !== 'integration') return false;
+  const blocks = buildIntegrationBlocks(rows);
+  if (blocks.length === 0) return false;
+  emitSectionHeader(io, 'Integration health:');
+  const { log, chalk, statusGlyph } = io;
+  for (const b of blocks) {
+    log(chalk.white(`${b.dkey}: ${statusGlyph(b.st)} ${b.st}`));
+    emitFailedSteps(b, io);
+  }
+  return true;
+}
+
+module.exports = {
+  integrationRollupStatus,
+  logCapabilitiesOverview,
+  logIntegrationHealthSection
+};