@aifabrix/builder 2.44.6 → 2.45.5

package/.cursor/rules/cli-layout.mdc

@@ -12,7 +12,7 @@ When you touch **CLI surface** (`bin/aifabrix.js`, `lib/cli.js`, `lib/cli/**`, `
 | Document | Role |
 | -------- | ---- |
 | [layout.md](./layout.md) | Visual and semantic spec: colors, sections, glyphs, blocking vs warning, non-TTY/CI, helper map to `cli-test-layout-chalk.js`. |
-| [cli-output-command-matrix.md](./cli-output-command-matrix.md) | **One row per leaf command**: expected **output profile** (layout-blocks, tty-summary, stream-logs, json-opt, stdout-only, delegate). |
+| [cli-output-command-matrix.md](./cli-output-command-matrix.md) | **One row per leaf command**: expected **output profile** (layout-blocks, tty-summary, stream-logs, json-opt, stdout-only, delegate) and **Manifest roots (141)** (when to emit gray manifest path line — see plan 141). |
 
 If implementation and `layout.md` disagree, **fix implementation** or **update docs** in the same change so they stay one story.
 
@@ -27,9 +27,13 @@ Use the matrix row for your command to decide UX:
 - **stdout-only** — Stable, script-friendly stdout; minimal chalk; often used for diffs or piping.
 - **delegate** — Output comes from delegated library (wizard, etc.); still avoid forbidden glyphs and spurious decoration in anything you add.
 
-**New leaf command:** add a row to [cli-output-command-matrix.md](./cli-output-command-matrix.md) with the correct profile combination.
+**New leaf command:** add a row to [cli-output-command-matrix.md](./cli-output-command-matrix.md) with the correct profile combination and **Manifest roots (141)** code (`141`, `141+`, `int`, `cfg`, `—`).
 
-## Glyphs and semantics (terminal only)
+## Manifest path visibility (plan 141)
+
+When a command’s matrix cell is **141**, **141+**, or **int** and the implementation reads an `application.yaml` (or integration equivalent), print **one** gray metadata line for humans (e.g. `Manifest: cwd/builder — /abs/path/application.yaml`) using `metadata()` or a small helper from `cli-test-layout-chalk.js`. Do not spam per-substep. Follow [.cursor/plans/141-manifest-location.plan.md](../plans/141-manifest-location.plan.md).
+
+**`aifabrix setup`:** destructive / conflict prompts that list folders to be replaced must use **resolved absolute paths** for every directory (plan § Guided setup — not only `builder/<app>/` under an otherwise absolute builder root).
 
 From [layout.md](./layout.md) contributor appendix:
 

package/.cursor/rules/docs-rules.mdc

@@ -5,10 +5,12 @@ alwaysApply: true
 
 ## Audience
 
-Documents under **docs/** (including **docs/commands/**) are **CLI developer / user documentation**. The audience is people who use the AI Fabrix Builder CLI or integrate it into workflows. They do not need to know how the CLI talks to the Controller or Dataplane over HTTP.
+Documents under **docs/** (including **docs/commands/**) are **public CLI user documentation**. The audience is people who use the AI Fabrix Builder CLI or integrate it into workflows—they may **not** have access to private monorepos (dataplane, miso-controller, internal plans). They do not need to know how the CLI talks to the Controller or Dataplane over HTTP.
 
 ## Do Not Include in CLI User Docs
 
+- **Links or paths into other product repos (FORBIDDEN)** – No markdown links, examples, or prerequisites that point at private/sibling repositories or their trees: `../../../aifabrix-dataplane/...`, `../../aifabrix-miso/...`, `packages/miso-controller/...`, `integration/<fixture>/README.md` in another repo, `.cursor/plans/` anywhere, `/workspace/...` monorepo layouts, or “see the dataplane/miso-controller repo”. **Only** cross-link within **`docs/`** and use on-disk paths the user owns (`integration/<systemKey>/...`, `builder/<appKey>/...`, `~/.aifabrix/...`).
+- **Internal plan or ticket IDs** – No “Plan 407.1”, “plan section 2.3”, or similar; describe behavior in user terms.
 - **REST API details** – No HTTP methods, URL paths, or endpoint names (e.g. `GET /api/v1/...`, `POST .../pipeline/upload`).
 - **Request/response shapes** – No payload structures, status codes, or field names from backend APIs.
 - **Backend implementation terms** – Avoid referring to “pipeline config endpoint”, “upload endpoint”, or similar; describe what the **command** does from the user’s perspective.

package/integration/hubspot-test/test-artifacts/wizard-hubspot-credential-real.yaml

@@ -2,7 +2,7 @@ appName: wizard-e2e-credential-real
 mode: create-system
 source:
   type: openapi-file
-  filePath: /workspace/aifabrix-builder/integration/hubspot-test/companies.json
+  filePath: ./integration/hubspot-test/companies.json
 credential:
   action: create
   config:

package/integration/hubspot-test/test-artifacts/wizard-hubspot-env-vars.yaml

@@ -2,7 +2,7 @@ appName: wizard-e2e-env-vars
 mode: create-system
 source:
   type: openapi-file
-  filePath: /workspace/aifabrix-builder/integration/hubspot-test/companies.json
+  filePath: ./integration/hubspot-test/companies.json
 deployment:
   controller: ${CONTROLLER_URL}
   dataplane: ${DATAPLANE_URL}

package/integration/hubspot-test/wizard-hubspot-e2e.yaml

@@ -2,7 +2,7 @@ appName: wizard-e2e-e2e
 mode: create-system
 source:
   type: openapi-file
-  filePath: /workspace/aifabrix-builder/integration/hubspot-test/companies.json
+  filePath: ./integration/hubspot-test/companies.json
 credential:
   action: skip
 preferences:

package/jest.projects.js

@@ -141,6 +141,34 @@ const defaultProject = {
       '\\\\tests\\\\lib\\\\utils\\\\url-declarative-vdir-inactive-env.test.js',
       'lib/utils/url-declarative-vdir-inactive-env.test.js',
       'url-declarative-vdir-inactive-env\\.test\\.js',
+      '/tests/lib/utils/url-declarative-user-cfg-per-app-proxy.test.js',
+      '\\\\tests\\\\lib\\\\utils\\\\url-declarative-user-cfg-per-app-proxy.test.js',
+      'lib/utils/url-declarative-user-cfg-per-app-proxy.test.js',
+      'url-declarative-user-cfg-per-app-proxy\\.test\\.js',
+      '/tests/lib/utils/url-declarative-expand-traefik-off-no-usercfg.test.js',
+      '\\\\tests\\\\lib\\\\utils\\\\url-declarative-expand-traefik-off-no-usercfg.test.js',
+      'lib/utils/url-declarative-expand-traefik-off-no-usercfg.test.js',
+      'url-declarative-expand-traefik-off-no-usercfg\\.test\\.js',
+      '/tests/lib/core/secrets-env-declarative-show-urls.test.js',
+      '\\\\tests\\\\lib\\\\core\\\\secrets-env-declarative-show-urls.test.js',
+      'lib/core/secrets-env-declarative-show-urls.test.js',
+      'secrets-env-declarative-show-urls\\.test\\.js',
+      '/tests/lib/utils/url-declarative-registry-internal-docker-origin.test.js',
+      '\\\\tests\\\\lib\\\\utils\\\\url-declarative-registry-internal-docker-origin.test.js',
+      'lib/utils/url-declarative-registry-internal-docker-origin.test.js',
+      'url-declarative-registry-internal-docker-origin\\.test\\.js',
+      '/tests/lib/commands/platform-urls-registry.validation.test.js',
+      '\\\\tests\\\\lib\\\\commands\\\\platform-urls-registry.validation.test.js',
+      'lib/commands/platform-urls-registry.validation.test.js',
+      'platform-urls-registry\\.validation\\.test\\.js',
+      '/tests/lib/utils/env-copy-resolve-output.test.js',
+      '\\\\tests\\\\lib\\\\utils\\\\env-copy-resolve-output.test.js',
+      'lib/utils/env-copy-resolve-output.test.js',
+      'env-copy-resolve-output\\.test\\.js',
+      '/tests/lib/utils/write-env-output-reload.test.js',
+      '\\\\tests\\\\lib\\\\utils\\\\write-env-output-reload.test.js',
+      'lib/utils/write-env-output-reload.test.js',
+      'write-env-output-reload\\.test\\.js',
       '/tests/lib/utils/app-service-env-from-builder.test.js',
       '\\\\tests\\\\lib\\\\utils\\\\app-service-env-from-builder.test.js',
       'lib/utils/app-service-env-from-builder.test.js',
@@ -165,6 +193,18 @@ const defaultProject = {
       '\\\\tests\\\\lib\\\\utils\\\\paths-system-builder-resolution.test.js',
       'lib/utils/paths-system-builder-resolution.test.js',
       'paths-system-builder-resolution\\.test\\.js',
+      '/tests/lib/utils/manifest-location.test.js',
+      '\\\\tests\\\\lib\\\\utils\\\\manifest-location.test.js',
+      'lib/utils/manifest-location.test.js',
+      'manifest-location\\.test\\.js',
+      '/tests/lib/utils/installation-log.test.js',
+      '\\\\tests\\\\lib\\\\utils\\\\installation-log.test.js',
+      'lib/utils/installation-log.test.js',
+      'installation-log\\.test\\.js',
+      '/tests/lib/utils/manifest-source-emit.test.js',
+      '\\\\tests\\\\lib\\\\utils\\\\manifest-source-emit.test.js',
+      'lib/utils/manifest-source-emit.test.js',
+      'manifest-source-emit\\.test\\.js',
       '/tests/lib/utils/secrets-ancestor-paths.test.js',
       '\\\\tests\\\\lib\\\\utils\\\\secrets-ancestor-paths.test.js',
       'lib/utils/secrets-ancestor-paths.test.js',
@@ -238,7 +278,35 @@ const defaultProject = {
       '/tests/lib/datasource/run-capability-remove.test.js',
       '\\\\tests\\\\lib\\\\datasource\\\\run-capability-remove.test.js',
       'lib/datasource/run-capability-remove.test.js',
-      'run-capability-remove\\.test\\.js'
+      'run-capability-remove\\.test\\.js',
+      '/tests/lib/datasource/log-cleaner.test.js',
+      '\\\\tests\\\\lib\\\\datasource\\\\log-cleaner.test.js',
+      'lib/datasource/log-cleaner.test.js',
+      'log-cleaner\\.test\\.js',
+      '/tests/lib/datasource/datasource-exporter-service.test.js',
+      '\\\\tests\\\\lib\\\\datasource\\\\datasource-exporter-service.test.js',
+      'lib/datasource/datasource-exporter-service.test.js',
+      'datasource-exporter-service\\.test\\.js',
+      '/tests/lib/protection/paths.test.js',
+      '\\\\tests\\\\lib\\\\protection\\\\paths.test.js',
+      'lib/protection/paths.test.js',
+      'protection/paths\\.test\\.js',
+      '/tests/lib/protection/protection-resolve.test.js',
+      '\\\\tests\\\\lib\\\\protection\\\\protection-resolve.test.js',
+      'lib/protection/protection-resolve.test.js',
+      'protection-resolve\\.test\\.js',
+      '/tests/lib/protection/run-protection-create-helpers.test.js',
+      '\\\\tests\\\\lib\\\\protection\\\\run-protection-create-helpers.test.js',
+      'lib/protection/run-protection-create-helpers.test.js',
+      'run-protection-create-helpers\\.test\\.js',
+      '/tests/lib/governance/governance-pack-loader.test.js',
+      '\\\\tests\\\\lib\\\\governance\\\\governance-pack-loader.test.js',
+      'lib/governance/governance-pack-loader.test.js',
+      'governance-pack-loader\\.test\\.js',
+      '/tests/lib/protection/validate-batch.test.js',
+      '\\\\tests\\\\lib\\\\protection\\\\validate-batch.test.js',
+      'lib/protection/validate-batch.test.js',
+      'validate-batch\\.test\\.js'
     ];
     if (process.env.INCLUDE_LOCAL_TESTS !== 'true') {
       patterns.push('/tests/local/');
@@ -263,6 +331,8 @@ const isolatedProjects = [
   makeIsolatedProject('paths-system-builder-resolution', [
     '**/tests/lib/utils/paths-system-builder-resolution.test.js'
   ]),
+  makeIsolatedProject('manifest-location', ['**/tests/lib/utils/manifest-location.test.js']),
+  makeIsolatedProject('installation-log', ['**/tests/lib/utils/installation-log.test.js']),
   makeIsolatedProject('secrets-ancestor-paths', ['**/tests/lib/utils/secrets-ancestor-paths.test.js']),
   makeIsolatedProject('datasource-validation-watch', [
     '**/tests/lib/utils/datasource-validation-watch.test.js'
@@ -272,6 +342,7 @@ const isolatedProjects = [
     '**/tests/lib/datasource/log-viewer-structural.test.js',
     '**/tests/lib/datasource/log-viewer-run.test.js'
   ]),
+  makeIsolatedProject('manifest-source-emit', ['**/tests/lib/utils/manifest-source-emit.test.js']),
   makeIsolatedProject('register-aifabrix-shell-env', [
     '**/tests/lib/utils/register-aifabrix-shell-env.test.js'
   ]),
@@ -314,6 +385,19 @@ const isolatedProjects = [
   makeIsolatedProject('url-declarative-vdir-inactive-env', [
     '**/tests/lib/utils/url-declarative-vdir-inactive-env.test.js'
   ]),
+  makeIsolatedProject('url-declarative-user-cfg-per-app-proxy', [
+    '**/tests/lib/utils/url-declarative-user-cfg-per-app-proxy.test.js'
+  ]),
+  makeIsolatedProject('declarative-url-paths-spy-suites', [
+    '**/tests/lib/utils/url-declarative-expand-traefik-off-no-usercfg.test.js',
+    '**/tests/lib/core/secrets-env-declarative-show-urls.test.js',
+    '**/tests/lib/utils/url-declarative-registry-internal-docker-origin.test.js'
+  ]),
+  makeIsolatedProject('platform-urls-registry-validation', [
+    '**/tests/lib/commands/platform-urls-registry.validation.test.js'
+  ]),
+  makeIsolatedProject('env-copy-resolve-output', ['**/tests/lib/utils/env-copy-resolve-output.test.js']),
+  makeIsolatedProject('write-env-output-reload', ['**/tests/lib/utils/write-env-output-reload.test.js']),
   makeIsolatedProject('app-service-env-from-builder', [
     '**/tests/lib/utils/app-service-env-from-builder.test.js'
   ]),
@@ -348,6 +432,21 @@ const isolatedProjects = [
     '**/tests/lib/datasource/run-capability-diff.test.js',
     '**/tests/lib/datasource/run-capability-edit.test.js',
     '**/tests/lib/datasource/run-capability-remove.test.js'
+  ]),
+  makeIsolatedProject('log-cleaner', ['**/tests/lib/datasource/log-cleaner.test.js']),
+  makeIsolatedProject('datasource-exporter-service', [
+    '**/tests/lib/datasource/datasource-exporter-service.test.js'
+  ]),
+  makeIsolatedProject('protection-paths', ['**/tests/lib/protection/paths.test.js']),
+  makeIsolatedProject('protection-resolve', ['**/tests/lib/protection/protection-resolve.test.js']),
+  makeIsolatedProject('protection-create-helpers', [
+    '**/tests/lib/protection/run-protection-create-helpers.test.js'
+  ]),
+  makeIsolatedProject('governance-pack-loader', [
+    '**/tests/lib/governance/governance-pack-loader.test.js'
+  ]),
+  makeIsolatedProject('protection-validate-batch', [
+    '**/tests/lib/protection/validate-batch.test.js'
   ])
 ];
 

package/lib/api/agent-metadata-validation.api.js

@@ -0,0 +1,93 @@
+/**
+ * @fileoverview Agent metadata validation API (dataplane 404.5)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+const { createDataplaneApiClient } = require('./index');
+
+/**
+ * Run agent metadata validation for a datasource.
+ * POST /api/v1/external/{sourceIdOrKey}/agent-metadata-validation
+ * @requiresPermission {Dataplane} external-data-source:update
+ * @async
+ * @function runAgentMetadataValidation
+ * @param {string} dataplaneUrl - Dataplane base URL
+ * @param {string} sourceIdOrKey - Datasource key or ID
+ * @param {Object} authConfig - Authentication configuration
+ * @param {import('./types/agent-metadata-validation.types').AgentMetadataValidationRunRequest} [body]
+ * @returns {Promise<import('./types/agent-metadata-validation.types').AgentMetadataValidationRunResponse>}
+ */
+async function runAgentMetadataValidation(
+  dataplaneUrl,
+  sourceIdOrKey,
+  authConfig,
+  body = {},
+  opts = {}
+) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const requestOpts = { body };
+  if (opts.timeoutMs !== undefined && opts.timeoutMs !== null) {
+    requestOpts.timeoutMs = opts.timeoutMs;
+  }
+  return await client.post(
+    `/api/v1/external/${encodeURIComponent(sourceIdOrKey)}/agent-metadata-validation`,
+    requestOpts
+  );
+}
+
+/**
+ * Get latest agent metadata validation result.
+ * GET /api/v1/external/{sourceIdOrKey}/agent-validation
+ * @requiresPermission {Dataplane} external-data-source:read
+ * @async
+ * @function getLatestAgentMetadataValidation
+ * @param {string} dataplaneUrl - Dataplane base URL
+ * @param {string} sourceIdOrKey - Datasource key or ID
+ * @param {Object} authConfig - Authentication configuration
+ * @returns {Promise<import('./types/agent-metadata-validation.types').AgentMetadataValidationResult>}
+ */
+async function getLatestAgentMetadataValidation(
+  dataplaneUrl,
+  sourceIdOrKey,
+  authConfig,
+  opts = {}
+) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const requestOpts = {};
+  if (opts.timeoutMs !== undefined && opts.timeoutMs !== null) {
+    requestOpts.timeoutMs = opts.timeoutMs;
+  }
+  return await client.get(
+    `/api/v1/external/${encodeURIComponent(sourceIdOrKey)}/agent-validation`,
+    requestOpts
+  );
+}
+
+/**
+ * List agent metadata validation history.
+ * GET /api/v1/external/{sourceIdOrKey}/agent-validation/history
+ * @requiresPermission {Dataplane} external-data-source:read
+ * @async
+ * @function listAgentMetadataValidationHistory
+ * @param {string} dataplaneUrl - Dataplane base URL
+ * @param {string} sourceIdOrKey - Datasource key or ID
+ * @param {Object} authConfig - Authentication configuration
+ * @returns {Promise<import('./types/agent-metadata-validation.types').AgentMetadataValidationHistoryItem[]>}
+ */
+async function listAgentMetadataValidationHistory(
+  dataplaneUrl,
+  sourceIdOrKey,
+  authConfig
+) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  return await client.get(
+    `/api/v1/external/${encodeURIComponent(sourceIdOrKey)}/agent-validation/history`
+  );
+}
+
+module.exports = {
+  runAgentMetadataValidation,
+  getLatestAgentMetadataValidation,
+  listAgentMetadataValidationHistory
+};

package/lib/api/audit-api-helpers.js

@@ -0,0 +1,68 @@
+/**
+ * @fileoverview Shared helpers for dataplane audit API responses
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { unwrapApiData } = require('../utils/external-system-readiness-core');
+
+/**
+ * @param {*} res
+ * @throws {Error}
+ */
+function assertAuditApiSuccess(res) {
+  if (!res || typeof res !== 'object') {
+    throw new Error('Audit API returned an empty response');
+  }
+  if (res.success === false) {
+    const msg =
+      (res.error && (res.error.formattedError || res.error.error || res.error.message)) ||
+      res.formattedError ||
+      'Audit API request failed';
+    const err = new Error(msg);
+    if (res.status) err.status = res.status;
+    throw err;
+  }
+}
+
+/**
+ * @param {*} res
+ * @returns {{ data: Array, meta: Object|null, raw: Object|null }}
+ */
+function unwrapPaginatedAuditList(res) {
+  assertAuditApiSuccess(res);
+  const body = unwrapApiData(res);
+  if (!body || typeof body !== 'object') {
+    return { data: [], meta: null, raw: null };
+  }
+  const data = Array.isArray(body.data)
+    ? body.data
+    : Array.isArray(body.items)
+      ? body.items
+      : [];
+  const meta = body.meta && typeof body.meta === 'object' ? body.meta : null;
+  return { data, meta, raw: body };
+}
+
+/**
+ * Unwrap execution sub-resource envelope `{ root: T }`.
+ * @param {*} res
+ * @returns {*|null}
+ */
+function unwrapExecutionSubresource(res) {
+  assertAuditApiSuccess(res);
+  const body = unwrapApiData(res);
+  if (body === null || body === undefined) return null;
+  if (typeof body === 'object' && Object.prototype.hasOwnProperty.call(body, 'root')) {
+    return body.root;
+  }
+  return body;
+}
+
+module.exports = {
+  assertAuditApiSuccess,
+  unwrapPaginatedAuditList,
+  unwrapExecutionSubresource
+};

package/lib/api/audit.api.js

@@ -0,0 +1,119 @@
+/**
+ * @fileoverview Dataplane audit read API (Plan 407.1 / 407.3 evidence matrix)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { createDataplaneApiClient } = require('./index');
+const { unwrapPaginatedAuditList, unwrapExecutionSubresource } = require('./audit-api-helpers');
+
+const AUDIT_BASE = '/api/v1/audit';
+const DEFAULT_PAGE_SIZE = 100;
+
+/**
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {Object} [query]
+ * @returns {Promise<{ data: import('./types/audit.types').AuditExecutionListItem[], meta: import('./types/audit.types').AuditListMeta|null }>}
+ * @requiresPermission {Dataplane} audit:read
+ */
+async function queryExecutions(dataplaneUrl, authConfig, query = {}) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const res = await client.get(`${AUDIT_BASE}/executions`, {
+    params: {
+      page: 1,
+      pageSize: DEFAULT_PAGE_SIZE,
+      ...query
+    }
+  });
+  return unwrapPaginatedAuditList(res);
+}
+
+/**
+ * @requiresPermission {Dataplane} audit:read
+ */
+async function queryRbacDecisions(dataplaneUrl, authConfig, query = {}) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const res = await client.get(`${AUDIT_BASE}/rbac-decisions`, {
+    params: {
+      page: 1,
+      pageSize: DEFAULT_PAGE_SIZE,
+      sort: '-timestamp',
+      ...query
+    }
+  });
+  return unwrapPaginatedAuditList(res);
+}
+
+/**
+ * @requiresPermission {Dataplane} audit:read
+ */
+async function queryAbacTraces(dataplaneUrl, authConfig, query = {}) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const res = await client.get(`${AUDIT_BASE}/abac-traces`, {
+    params: {
+      page: 1,
+      pageSize: DEFAULT_PAGE_SIZE,
+      ...query
+    }
+  });
+  return unwrapPaginatedAuditList(res);
+}
+
+/**
+ * @requiresPermission {Dataplane} audit:read
+ */
+async function getExecutionRbac(dataplaneUrl, authConfig, executionId) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const res = await client.get(`${AUDIT_BASE}/executions/${executionId}/rbac`);
+  return unwrapExecutionSubresource(res);
+}
+
+/**
+ * @requiresPermission {Dataplane} audit:read
+ */
+async function getExecutionAbac(dataplaneUrl, authConfig, executionId) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const res = await client.get(`${AUDIT_BASE}/executions/${executionId}/abac`);
+  return unwrapExecutionSubresource(res);
+}
+
+/**
+ * @requiresPermission {Dataplane} audit:read
+ */
+async function getExecutionTrace(dataplaneUrl, authConfig, executionId) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const res = await client.get(`${AUDIT_BASE}/executions/${executionId}/trace`);
+  return unwrapExecutionSubresource(res);
+}
+
+/**
+ * @requiresPermission {Dataplane} audit:read
+ */
+async function getExecutionSteps(dataplaneUrl, authConfig, executionId) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const res = await client.get(`${AUDIT_BASE}/executions/${executionId}/steps`);
+  return unwrapExecutionSubresource(res);
+}
+
+/**
+ * @requiresPermission {Dataplane} audit:read
+ */
+async function getExecutionErrors(dataplaneUrl, authConfig, executionId) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const res = await client.get(`${AUDIT_BASE}/executions/${executionId}/errors`);
+  return unwrapExecutionSubresource(res);
+}
+
+module.exports = {
+  queryExecutions,
+  queryRbacDecisions,
+  queryAbacTraces,
+  getExecutionRbac,
+  getExecutionAbac,
+  getExecutionTrace,
+  getExecutionSteps,
+  getExecutionErrors
+};

package/lib/api/auth-cache.api.js

@@ -0,0 +1,44 @@
+/**
+ * @fileoverview Controller auth/RBAC cache API
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { ApiClient } = require('./index');
+
+const CLEAR_PATH = '/api/v1/auth/cache/clear';
+const INVALIDATE_PATH = '/api/v1/auth/cache/invalidate';
+
+/**
+ * Clear all controller cache entries
+ * @requiresPermission {Controller} cache:admin
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @returns {Promise<Object>}
+ */
+async function clearAuthCache(controllerUrl, authConfig) {
+  const client = new ApiClient(controllerUrl, authConfig);
+  return await client.post(CLEAR_PATH);
+}
+
+/**
+ * Invalidate cache entries matching a pattern
+ * @requiresPermission {Controller} cache:admin
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {string} pattern
+ * @returns {Promise<Object>}
+ */
+async function invalidateAuthCache(controllerUrl, authConfig, pattern) {
+  const client = new ApiClient(controllerUrl, authConfig);
+  return await client.post(INVALIDATE_PATH, { body: { pattern } });
+}
+
+module.exports = {
+  clearAuthCache,
+  invalidateAuthCache
+};

package/lib/api/certificates.api.js

@@ -4,7 +4,7 @@
  * @version 2.0.0
  */
 
-const { ApiClient } = require('./index');
+const { createDataplaneApiClient } = require('./index');
 const { normalizeDataplaneAuth } = require('./validation-run.api');
 
 /**
@@ -36,7 +36,7 @@ function dataplaneAuthForBearerGet(authConfig) {
  * @returns {Promise<Object>} API envelope `{ success, data?, status, ... }`
  */
 async function getActiveIntegrationCertificate(dataplaneUrl, authConfig, systemKey, datasourceKey) {
-  const client = new ApiClient(dataplaneUrl, dataplaneAuthForBearerGet(authConfig));
+  const client = createDataplaneApiClient(dataplaneUrl, dataplaneAuthForBearerGet(authConfig));
   const path = `/api/v1/systems/${encodeURIComponent(systemKey)}/datasources/${encodeURIComponent(
     datasourceKey
   )}/certificates/active`;
@@ -54,7 +54,7 @@ async function getActiveIntegrationCertificate(dataplaneUrl, authConfig, systemK
  * @returns {Promise<Object>}
  */
 async function listIntegrationCertificates(dataplaneUrl, authConfig, params = {}) {
-  const client = new ApiClient(dataplaneUrl, dataplaneAuthForBearerGet(authConfig));
+  const client = createDataplaneApiClient(dataplaneUrl, dataplaneAuthForBearerGet(authConfig));
   return await client.get('/api/v1/certificates', { params });
 }
 
@@ -69,7 +69,7 @@ async function listIntegrationCertificates(dataplaneUrl, authConfig, params = {}
  * @returns {Promise<Object>}
  */
 async function verifyIntegrationCertificate(dataplaneUrl, authConfig, body) {
-  const client = new ApiClient(dataplaneUrl, dataplaneAuthForBearerGet(authConfig));
+  const client = createDataplaneApiClient(dataplaneUrl, dataplaneAuthForBearerGet(authConfig));
   return await client.post('/api/v1/certificates/verify', { body: body || {} });
 }
 

package/lib/api/credential.api.js

@@ -4,7 +4,7 @@
  * @version 2.0.0
  */
 
-const { ApiClient } = require('./index');
+const { createDataplaneApiClient } = require('./index');
 
 const CREDENTIAL_SECRET_ENDPOINT = '/api/v1/credential/secret';
 
@@ -29,7 +29,7 @@ async function storeCredentialSecrets(dataplaneUrl, authConfig, items) {
   if (!items || !Array.isArray(items) || items.length === 0) {
     return { stored: 0 };
   }
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post(CREDENTIAL_SECRET_ENDPOINT, {
     body: items
   });