@aifabrix/builder 2.45.0 → 2.45.5

package/lib/datasource/agent-trust-fetch.js

@@ -0,0 +1,115 @@
+/**
+ * @fileoverview Dataplane fetch paths for agent trust runs (POST validate / GET latest).
+ */
+
+'use strict';
+
+const {
+  runAgentMetadataValidation,
+  getLatestAgentMetadataValidation
+} = require('../api/agent-metadata-validation.api');
+const { parseTrustTimeoutMs } = require('./agent-trust-timeout');
+const { isAgentTrustMockEnabled, buildMockTrustRun } = require('./agent-trust-mock');
+const { mapRunResponseToTrustRun, mapLatestResultToTrustRun } = require('./agent-trust-map');
+const {
+  runWithAgentTrustWaitSpinner,
+  logAgentTrustWaitHintOnce
+} = require('../utils/agent-trust-wait-ui');
+
+function unwrapApiData(response) {
+  if (response && response.data !== undefined) return response.data;
+  return response;
+}
+
+/**
+ * @param {Object} options
+ * @returns {boolean}
+ */
+function shouldPreferLatestRead(options = {}) {
+  if (options.revalidate === true) return false;
+  return options.summary === true;
+}
+
+/**
+ * @param {Error} err
+ * @returns {boolean}
+ */
+function isLatestNotFoundError(err) {
+  const code = err && (err.statusCode || err.status);
+  if (code === 404) return true;
+  const msg = err && err.message ? String(err.message) : '';
+  return /no agent metadata validation/i.test(msg);
+}
+
+/**
+ * @async
+ * @param {Object} params
+ * @returns {Promise<Object>}
+ */
+async function postValidateTrustRun(params) {
+  const { dataplaneUrl, datasourceKey, systemKey, authConfig, body, options } = params;
+  const timeoutMs = parseTrustTimeoutMs(options);
+  logAgentTrustWaitHintOnce(datasourceKey, timeoutMs);
+  const raw = await runWithAgentTrustWaitSpinner(
+    () =>
+      runAgentMetadataValidation(dataplaneUrl, datasourceKey, authConfig, body, { timeoutMs }),
+    { datasourceKey, timeoutMs }
+  );
+  return mapRunResponseToTrustRun({
+    datasourceKey,
+    systemKey,
+    runResponse: unwrapApiData(raw)
+  });
+}
+
+/**
+ * @async
+ * @param {Object} params
+ * @returns {Promise<Object>}
+ */
+async function getLatestTrustRun(params) {
+  const { dataplaneUrl, datasourceKey, systemKey, authConfig, options } = params;
+  const timeoutMs = parseTrustTimeoutMs(options);
+  const raw = await getLatestAgentMetadataValidation(dataplaneUrl, datasourceKey, authConfig, {
+    timeoutMs
+  });
+  return mapLatestResultToTrustRun({
+    datasourceKey,
+    systemKey,
+    latestResult: unwrapApiData(raw)
+  });
+}
+
+/**
+ * @async
+ * @param {Object} params
+ * @returns {Promise<Object>}
+ */
+async function fetchTrustRunFromDataplane(params) {
+  const { datasourceKey, systemKey, dataplaneUrl, authConfig, options } = params;
+  if (isAgentTrustMockEnabled()) {
+    return buildMockTrustRun(datasourceKey, systemKey);
+  }
+
+  const body = { forceRevalidate: options.revalidate === true };
+  if (options.peerDatasourceConfigs && typeof options.peerDatasourceConfigs === 'object') {
+    body.peerDatasourceConfigs = options.peerDatasourceConfigs;
+  }
+
+  if (!shouldPreferLatestRead(options)) {
+    return postValidateTrustRun({ dataplaneUrl, datasourceKey, systemKey, authConfig, body, options });
+  }
+
+  try {
+    return await getLatestTrustRun({ dataplaneUrl, datasourceKey, systemKey, authConfig, options });
+  } catch (err) {
+    if (!isLatestNotFoundError(err)) throw err;
+    return postValidateTrustRun({ dataplaneUrl, datasourceKey, systemKey, authConfig, body, options });
+  }
+}
+
+module.exports = {
+  shouldPreferLatestRead,
+  fetchTrustRunFromDataplane,
+  isLatestNotFoundError
+};

package/lib/datasource/agent-trust-map.js

@@ -0,0 +1,101 @@
+/**
+ * @fileoverview Map dataplane agent metadata validation API payloads to CLI trust runs.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {string} trustDecision
+ * @returns {'ok'|'warn'|'fail'}
+ */
+function trustDecisionToRowStatus(trustDecision) {
+  const td = String(trustDecision || '').trim();
+  if (td === 'trusted') return 'ok';
+  if (td === 'usableWithWarnings') return 'warn';
+  return 'fail';
+}
+
+/**
+ * @param {Object} result - AgentMetadataValidationResult from dataplane
+ * @returns {string[]}
+ */
+function highLevelWarningsFromResult(result) {
+  if (!result || !Array.isArray(result.findings)) return [];
+  return result.findings
+    .filter(f => f && (f.severity === 'warning' || f.severity === 'error'))
+    .slice(0, 8)
+    .map(f => {
+      const code = f.code ? String(f.code) : 'FINDING';
+      const msg = f.message ? String(f.message) : '';
+      return msg ? `${code} — ${msg}` : code;
+    });
+}
+
+/**
+ * @param {Object} params
+ * @param {string} params.datasourceKey
+ * @param {string} params.systemKey
+ * @param {Object} params.runResponse - POST run response body
+ * @returns {Object} AgentTrustRun-shaped object for CLI display/exit
+ */
+function mapRunResponseToTrustRun({ datasourceKey, systemKey, runResponse }) {
+  const body = runResponse && typeof runResponse === 'object' ? runResponse : {};
+  const result = body.result && typeof body.result === 'object' ? body.result : {};
+  const trustDecision = result.trustDecision || 'pending';
+  return {
+    datasourceKey,
+    systemKey,
+    status: trustDecisionToRowStatus(trustDecision),
+    trustDecision,
+    validationStatus: result.status || 'pending',
+    confidence: typeof result.confidence === 'number' ? result.confidence : 0,
+    summary: result.summary || '',
+    validatedAt: result.validatedAt || '',
+    inputHash: result.inputHash || '',
+    contractVersion: result.contractVersion || '',
+    cacheHit: body.reused === true,
+    highLevelWarnings: highLevelWarningsFromResult(result),
+    findings: Array.isArray(result.findings) ? result.findings : [],
+    observedBusinessModel: result.observedBusinessModel || null,
+    runId: body.id || null
+  };
+}
+
+/**
+ * @param {Object} params
+ * @param {string} params.datasourceKey
+ * @param {string} params.systemKey
+ * @param {Object} params.latestResult - GET /agent-validation body
+ * @returns {Object}
+ */
+function mapLatestResultToTrustRun({ datasourceKey, systemKey, latestResult }) {
+  const result = latestResult && typeof latestResult === 'object' ? latestResult : {};
+  const trustDecision = result.trustDecision || 'pending';
+  return {
+    datasourceKey,
+    systemKey,
+    status: trustDecisionToRowStatus(trustDecision),
+    trustDecision,
+    validationStatus: result.status || 'pending',
+    confidence: typeof result.confidence === 'number' ? result.confidence : 0,
+    summary: result.summary || '',
+    validatedAt: result.validatedAt || '',
+    inputHash: result.inputHash || '',
+    contractVersion: result.contractVersion || '',
+    cacheHit: true,
+    highLevelWarnings: highLevelWarningsFromResult(result),
+    findings: Array.isArray(result.findings) ? result.findings : [],
+    observedBusinessModel: result.observedBusinessModel || null,
+    runId: null,
+    readLatest: true
+  };
+}
+
+module.exports = {
+  trustDecisionToRowStatus,
+  highLevelWarningsFromResult,
+  mapRunResponseToTrustRun,
+  mapLatestResultToTrustRun
+};

package/lib/datasource/agent-trust-mock.js

@@ -0,0 +1,44 @@
+/**
+ * @fileoverview Dev-only mock trust runs when AIFABRIX_AGENT_TRUST_MOCK=1 (plan 143).
+ * Not documented in user-facing CLI docs; for local CLI development without dataplane 404.5.
+ */
+
+'use strict';
+
+/**
+ * @returns {boolean}
+ */
+function isAgentTrustMockEnabled() {
+  return String(process.env.AIFABRIX_AGENT_TRUST_MOCK || '').trim() === '1';
+}
+
+/**
+ * @param {string} datasourceKey
+ * @param {string} systemKey
+ * @returns {Object}
+ */
+function buildMockTrustRun(datasourceKey, systemKey) {
+  return {
+    datasourceKey,
+    systemKey,
+    status: 'warn',
+    trustDecision: 'usableWithWarnings',
+    validationStatus: 'warning',
+    confidence: 0.72,
+    summary: 'Mock trust run (AIFABRIX_AGENT_TRUST_MOCK=1)',
+    validatedAt: new Date().toISOString(),
+    inputHash: 'mock-input-hash',
+    contractVersion: '1.0.0',
+    cacheHit: false,
+    highLevelWarnings: ['MOCK_TRUST — set AIFABRIX_AGENT_TRUST_MOCK=0 for live dataplane validation'],
+    findings: [],
+    observedBusinessModel: null,
+    runId: 'mock-run-id',
+    mock: true
+  };
+}
+
+module.exports = {
+  isAgentTrustMockEnabled,
+  buildMockTrustRun
+};

package/lib/datasource/agent-trust-run.js

@@ -0,0 +1,93 @@
+/**
+ * @fileoverview Run dataplane agent metadata validation for one datasource (404.5 / plan 143).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+const { getConfig } = require('../core/config');
+const { setupIntegrationTestAuth } = require('../external-system/test-auth');
+const { resolveAppKeyForDatasource } = require('./resolve-app');
+const { getSystemKeyFromAppKey } = require('./integration-context');
+const { requireBearerForDataplanePipeline } = require('../utils/token-manager');
+const { fetchTrustRunFromDataplane } = require('./agent-trust-fetch');
+
+async function maybeSyncBeforeTrust({ noSync, authConfig, systemKey }) {
+  if (noSync === true) return;
+  requireBearerForDataplanePipeline(authConfig);
+  logger.log(chalk.cyan('Syncing local config to dataplane…'));
+  const { uploadExternalSystem } = require('../commands/upload');
+  await uploadExternalSystem(systemKey, { minimal: true });
+  logger.log(formatSuccessLine('Sync complete'));
+}
+
+function buildTransportFailureTrustRun(datasourceKey, systemKey, err) {
+  return {
+    datasourceKey,
+    systemKey,
+    status: 'fail',
+    trustDecision: 'notTrusted',
+    validationStatus: 'failed',
+    confidence: 0,
+    summary: err && err.message ? String(err.message) : 'Request failed',
+    transportError: true
+  };
+}
+
+/**
+ * @async
+ * @param {string} datasourceKey
+ * @param {Object} options
+ * @returns {Promise<{ trustRun: Object, apiError: Object|null }>}
+ */
+async function runDatasourceAgentTrust(datasourceKey, options = {}) {
+  if (!datasourceKey || typeof datasourceKey !== 'string') {
+    throw new Error('Datasource key is required');
+  }
+  const { appKey } = await resolveAppKeyForDatasource(datasourceKey, options.app);
+  const systemKey = await getSystemKeyFromAppKey(appKey);
+
+  let authConfig = options.authConfig;
+  let dataplaneUrl = options.dataplaneUrl || options.dataplane;
+  if (!authConfig || !dataplaneUrl) {
+    const configObj = await getConfig();
+    const auth = await setupIntegrationTestAuth(
+      appKey,
+      { environment: options.environment, dataplane: options.dataplane },
+      configObj
+    );
+    authConfig = auth.authConfig;
+    dataplaneUrl = auth.dataplaneUrl;
+  }
+
+  await maybeSyncBeforeTrust({
+    noSync: options.noSync === true,
+    authConfig,
+    systemKey
+  });
+
+  try {
+    const trustRun = await fetchTrustRunFromDataplane({
+      datasourceKey,
+      systemKey,
+      dataplaneUrl,
+      authConfig,
+      options
+    });
+    return { trustRun, apiError: null };
+  } catch (err) {
+    return {
+      trustRun: buildTransportFailureTrustRun(datasourceKey, systemKey, err),
+      apiError: err
+    };
+  }
+}
+
+module.exports = {
+  runDatasourceAgentTrust,
+  maybeSyncBeforeTrust
+};

package/lib/datasource/agent-trust-timeout.js

@@ -0,0 +1,25 @@
+/**
+ * @fileoverview HTTP timeout parsing for agent trust CLI (plan 143).
+ */
+
+'use strict';
+
+const DEFAULT_TRUST_TIMEOUT_MS = 120000;
+
+/**
+ * @param {Object} [options]
+ * @returns {number}
+ */
+function parseTrustTimeoutMs(options = {}) {
+  const raw = options.timeout;
+  if (raw !== undefined && raw !== null && raw !== '') {
+    const n = parseInt(String(raw), 10);
+    if (Number.isFinite(n) && n > 0) return n;
+  }
+  return DEFAULT_TRUST_TIMEOUT_MS;
+}
+
+module.exports = {
+  DEFAULT_TRUST_TIMEOUT_MS,
+  parseTrustTimeoutMs
+};

package/lib/datasource/audit-evidence-display.js

@@ -0,0 +1,80 @@
+/**
+ * @fileoverview TTY and JSON output for audit evidence verification (407.3)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const {
+  sectionTitle,
+  formatSuccessLine,
+  formatBlockingError,
+  successGlyph,
+  failureGlyph
+} = require('../utils/cli-test-layout-chalk');
+
+const SEP = '────────────────────────────────';
+
+/**
+ * @param {'passed'|'failed'} status
+ * @returns {string}
+ */
+function rowGlyph(status) {
+  return status === 'passed' ? successGlyph() : failureGlyph();
+}
+
+/**
+ * @param {import('../api/types/audit.types').AuditEvidenceVerification} result
+ * @param {boolean} [verbose]
+ */
+function displayAuditEvidenceMatrixTTY(result, verbose = false) {
+  logger.log(SEP);
+  logger.log(sectionTitle('Audit evidence matrix'));
+  logger.log(chalk.gray(`  Datasource: ${result.datasourceKey}`));
+  if (result.correlationId) {
+    logger.log(chalk.gray(`  Correlation: ${result.correlationId}`));
+  }
+  if (verbose && result.executionIds.length) {
+    logger.log(chalk.gray(`  Execution ids: ${result.executionIds.length}`));
+  }
+  logger.log('');
+  for (const row of result.matrix || []) {
+    logger.log(`  ${rowGlyph(row.status)} Row ${row.row}: ${row.detail}`);
+    if (verbose && row.code) {
+      logger.log(chalk.gray(`      code: ${row.code}`));
+    }
+  }
+  logger.log('');
+  if (result.status === 'passed') {
+    logger.log(formatSuccessLine('Audit evidence verification passed'));
+  } else {
+    const failed = (result.matrix || []).filter(r => r.status === 'failed').length;
+    logger.log(formatBlockingError(`Audit evidence verification failed (${failed} row(s))`));
+  }
+  logger.log(SEP);
+}
+
+/**
+ * @param {import('../api/types/audit.types').AuditEvidenceVerification} result
+ */
+function printAuditEvidenceVerificationJson(result) {
+  logger.log(
+    JSON.stringify({
+      auditEvidenceVerification: {
+        status: result.status,
+        datasourceKey: result.datasourceKey,
+        correlationId: result.correlationId,
+        executionIds: result.executionIds,
+        matrix: result.matrix
+      }
+    })
+  );
+}
+
+module.exports = {
+  displayAuditEvidenceMatrixTTY,
+  printAuditEvidenceVerificationJson
+};

package/lib/datasource/audit-evidence-extract-debug.js

@@ -0,0 +1,103 @@
+/**
+ * @fileoverview Extract execution ids from DatasourceTestRun debug / async E2E payloads
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {Array<*>} ids
+ * @returns {string[]}
+ */
+function dedupeIds(ids) {
+  if (!Array.isArray(ids)) return [];
+  const out = [];
+  const seen = new Set();
+  for (const raw of ids) {
+    const id = raw !== null && raw !== undefined ? String(raw).trim() : '';
+    if (!id || seen.has(id)) continue;
+    seen.add(id);
+    out.push(id);
+  }
+  return out;
+}
+
+/**
+ * @param {*} node
+ * @param {string[]} out
+ */
+function collectExecutionIdFields(node, out) {
+  if (!node || typeof node !== 'object') return;
+  if (typeof node.executionId === 'string' && node.executionId.trim()) {
+    out.push(node.executionId.trim());
+  }
+  if (Array.isArray(node.jobs)) {
+    for (const job of node.jobs) collectExecutionIdFields(job, out);
+  }
+  if (Array.isArray(node.datasources)) {
+    for (const ds of node.datasources) collectExecutionIdFields(ds, out);
+  }
+  if (node.audit && typeof node.audit === 'object') {
+    collectExecutionIdFields(node.audit, out);
+  }
+  if (node.evidence && typeof node.evidence === 'object') {
+    collectExecutionIdFields(node.evidence, out);
+  }
+}
+
+/**
+ * @param {Object|null|undefined} envelope
+ * @returns {string[]}
+ */
+function executionIdsFromDebugEnvelope(envelope) {
+  const dbg = envelope && envelope.debug;
+  if (!dbg || typeof dbg !== 'object') return [];
+  const found = [];
+  if (dbg.executionIds) {
+    found.push(...(Array.isArray(dbg.executionIds) ? dbg.executionIds : [dbg.executionIds]));
+  }
+  const asyncDbg = dbg.e2eAsyncDebug;
+  if (asyncDbg && Array.isArray(asyncDbg.stepDebug)) {
+    for (const step of asyncDbg.stepDebug) {
+      if (step && step.evidence) collectExecutionIdFields(step.evidence, found);
+    }
+  }
+  return dedupeIds(found);
+}
+
+/**
+ * CIP operation names from capacity step (insert, update, list, …).
+ * @param {Object|null|undefined} envelope
+ * @returns {string[]}
+ */
+function cipOperationsFromDebugEnvelope(envelope) {
+  const dbg = envelope && envelope.debug;
+  const asyncDbg = dbg && dbg.e2eAsyncDebug;
+  if (!asyncDbg || !Array.isArray(asyncDbg.stepDebug)) return [];
+  const capStep = asyncDbg.stepDebug.find(s => s && s.name === 'capacity');
+  if (!capStep || !capStep.evidence) return [];
+  const ops = new Set();
+  const details = capStep.evidence.datasources;
+  if (!Array.isArray(details)) return [];
+  for (const ds of details) {
+    if (!ds || !Array.isArray(ds.capabilityDetails)) continue;
+    for (const item of ds.capabilityDetails) {
+      const key = item && item.key ? String(item.key) : '';
+      const m = key.match(/^capacity:([a-zA-Z]+)/);
+      if (m && m[1]) {
+        let op = m[1] === 'updateBasic' ? 'updatebasic' : m[1].toLowerCase();
+        if (op === 'create') op = 'insert';
+        ops.add(op);
+      }
+    }
+  }
+  return [...ops];
+}
+
+module.exports = {
+  dedupeIds,
+  executionIdsFromDebugEnvelope,
+  cipOperationsFromDebugEnvelope,
+  collectExecutionIdFields
+};