@aifabrix/builder 2.45.0 → 2.45.5

package/lib/protection/run-protection-create-helpers.js

@@ -0,0 +1,134 @@
+/**
+ * @fileoverview Helpers for `runProtectionCreate` (auth, path checks, YAML).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { resolveControllerUrl } = require('../utils/controller-url');
+const { getConfig } = require('../core/config');
+const { writeConfigFile, jsonToYaml } = require('../utils/config-format');
+const { normalizeControllerUrl } = require('../core/config');
+const { getOrRefreshDeviceToken } = require('../utils/token-manager');
+const { getProtectionRoot } = require('./paths');
+const { assertNoDuplicateDatasourceKeys, listProtectionManifestPaths } = require('./resolve');
+const { loadProtectionManifest } = require('./load');
+
+/**
+ * @returns {Promise<{ controllerUrl: string, authConfig: Object }>}
+ */
+async function resolveControllerAuthForDimensions() {
+  const controllerUrl = await resolveControllerUrl();
+  if (!controllerUrl) {
+    throw new Error('Controller URL is required. Run "aifabrix login" first.');
+  }
+  const normalized = normalizeControllerUrl(controllerUrl);
+  const deviceToken = await getOrRefreshDeviceToken(normalized);
+  if (!deviceToken || !deviceToken.token) {
+    throw new Error(
+      `Not authenticated for controller: ${controllerUrl}. Run "aifabrix login" and try again.`
+    );
+  }
+  return {
+    controllerUrl: deviceToken.controller || normalized,
+    authConfig: { type: 'bearer', token: deviceToken.token }
+  };
+}
+
+/**
+ * @param {string} root
+ * @param {string} datasourceKey
+ * @param {string} outputPath
+ */
+function assertNoOtherFileClaimsDatasource(root, datasourceKey, outputPath) {
+  const key = String(datasourceKey || '').trim();
+  const out = path.resolve(outputPath);
+  for (const filePath of listProtectionManifestPaths(root)) {
+    if (path.resolve(filePath) === out) {
+      continue;
+    }
+    try {
+      const m = loadProtectionManifest(filePath);
+      if (String(m?.spec?.datasourceKey || '').trim() === key) {
+        throw new Error(
+          `Another manifest already claims datasource "${key}": ${filePath}. Remove it or use a different key.`
+        );
+      }
+    } catch (e) {
+      if (e.message && e.message.includes('Another manifest')) {
+        throw e;
+      }
+    }
+  }
+}
+
+/**
+ * @param {Object} manifest
+ * @returns {string}
+ */
+function protectionManifestToYaml(manifest) {
+  return protectionManifestToDisplayText(manifest, 'yaml');
+}
+
+/**
+ * @returns {Promise<'yaml'|'json'>}
+ */
+async function resolveProtectionOutputFormat() {
+  const config = await getConfig();
+  const raw = config && typeof config.format === 'string' ? config.format.trim().toLowerCase() : '';
+  return raw === 'json' ? 'json' : 'yaml';
+}
+
+/**
+ * @param {string} dsKey
+ * @param {boolean} force
+ * @returns {Promise<{ outputPath: string, format: 'yaml'|'json' }>}
+ */
+async function resolveOutputPathOrThrow(dsKey, force) {
+  const root = getProtectionRoot();
+  assertNoDuplicateDatasourceKeys(root);
+  const format = await resolveProtectionOutputFormat();
+  const ext = format === 'json' ? '.json' : '.yaml';
+  const outputPath = path.join(root, `${dsKey}${ext}`);
+  assertNoOtherFileClaimsDatasource(root, dsKey, outputPath);
+  if (fs.existsSync(outputPath) && !force) {
+    throw new Error(
+      `File already exists: ${outputPath}. Use --force to overwrite, or remove the file.`
+    );
+  }
+  return { outputPath, format };
+}
+
+/**
+ * @param {string} outputPath
+ * @param {Object} manifest
+ * @param {'yaml'|'json'} format
+ */
+function writeProtectionManifest(outputPath, manifest, format) {
+  fs.mkdirSync(path.dirname(outputPath), { recursive: true });
+  writeConfigFile(outputPath, manifest, format);
+}
+
+/**
+ * @param {Object} manifest
+ * @returns {string}
+ */
+function protectionManifestToDisplayText(manifest, format = 'yaml') {
+  if (format === 'json') {
+    return `${JSON.stringify(manifest, null, 2)}\n`;
+  }
+  return `${jsonToYaml(manifest).trim()}\n`;
+}
+
+module.exports = {
+  resolveControllerAuthForDimensions,
+  assertNoOtherFileClaimsDatasource,
+  protectionManifestToYaml,
+  protectionManifestToDisplayText,
+  resolveProtectionOutputFormat,
+  resolveOutputPathOrThrow,
+  writeProtectionManifest
+};

package/lib/protection/run-protection-create-probes-flow.js

@@ -0,0 +1,43 @@
+/**
+ * @fileoverview Collect probe TTY lines for protection create.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const {
+  probeDatasourceForProtectionCreate,
+  probeDimensionForProtectionCreate
+} = require('./protection-create-probes');
+
+/**
+ * @param {Object} dpCtx
+ * @param {Object} dimCtx
+ * @param {string} dsKey
+ * @param {string} dimensionKey
+ * @param {boolean} verbose
+ * @returns {Promise<{lines: string[], datasource: Object, dimension: Object}>}
+ */
+async function collectProtectionCreateProbeContext(dpCtx, dimCtx, dsKey, dimensionKey, verbose) {
+  const lines = [];
+  const dsProbe = await probeDatasourceForProtectionCreate(
+    dpCtx.dataplaneUrl,
+    dpCtx.authConfig,
+    dsKey,
+    { verbose }
+  );
+  lines.push(...dsProbe.lines);
+  const dimProbe = await probeDimensionForProtectionCreate(
+    dimCtx.controllerUrl,
+    dimCtx.authConfig,
+    dimensionKey,
+    { verbose }
+  );
+  lines.push(...dimProbe.lines);
+  return { lines, datasource: dsProbe.row, dimension: dimProbe.row };
+}
+
+module.exports = {
+  collectProtectionCreateProbeContext
+};

package/lib/protection/run-protection-create.js

@@ -0,0 +1,191 @@
+/**
+ * @fileoverview `aifabrix protection create` — online probes, scaffold, write YAML.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const { resolveProtectionDataplaneContext } = require('./auth-context');
+const { validateProtectionManifestLocal } = require('./validate-local');
+const { buildPresetProtectionManifest } = require('./protection-create-scaffold');
+const { requireProtectionPreset } = require('./protection-preset-registry');
+const {
+  sectionTitle,
+  formatSuccessLine,
+  formatNextActions,
+  formatBlockingError,
+  metadata
+} = require('../utils/cli-test-layout-chalk');
+const {
+  resolveControllerAuthForDimensions,
+  protectionManifestToDisplayText,
+  resolveProtectionOutputFormat,
+  resolveOutputPathOrThrow,
+  writeProtectionManifest
+} = require('./run-protection-create-helpers');
+const { collectProtectionCreateProbeContext } = require('./run-protection-create-probes-flow');
+
+const SEP = chalk.gray('────────────────────────────────────────');
+
+/**
+ * @param {Object} opts
+ * @param {string} dsKey
+ * @param {string} dimensionKey
+ * @param {Object} logger
+ */
+function logCreateHeader(opts, dsKey, dimensionKey, logger) {
+  logger.log(sectionTitle('Protection create'));
+  logger.log(SEP);
+  logger.log(metadata(`Environment: ${opts.environment}`));
+  logger.log(metadata(`Datasource key: ${dsKey}`));
+  logger.log(metadata(`Dimension key: ${dimensionKey}`));
+  if (opts.type) {
+    logger.log(metadata(`Type preset: ${opts.type}`));
+  }
+  logger.log('');
+}
+
+/**
+ * @param {string} dsKey
+ * @param {string} dimensionKey
+ * @param {Object} opts
+ * @param {Object} probeContext
+ * @returns {Object}
+ */
+function buildManifestForCreate(dsKey, dimensionKey, opts, probeContext) {
+  return buildPresetProtectionManifest({
+    datasourceKey: dsKey,
+    dimensionKey,
+    type: opts.type,
+    field: opts.field,
+    fkName: opts.fkName,
+    protectionKey: opts.protectionKey,
+    displayName: opts.displayName,
+    ruleKey: opts.ruleKey,
+    principalExpression: opts.principalExpression,
+    valueExpression: opts.valueExpression,
+    enabled: opts.disabled !== true,
+    datasource: probeContext.datasource,
+    dimension: probeContext.dimension
+  });
+}
+
+/**
+ * @param {Object} manifest
+ * @param {Object} logger
+ */
+function assertLocalSchemaOrThrow(manifest, logger) {
+  const local = validateProtectionManifestLocal(manifest);
+  if (!local.valid) {
+    logger.error(formatBlockingError('Local schema validation failed after scaffold:'));
+    local.errors.forEach((e) => logger.error(chalk.gray(`  ${e}`)));
+    throw new Error('Scaffolded manifest failed AJV');
+  }
+}
+
+/**
+ * @param {Object} logger
+ * @param {string[]} lines
+ */
+function logProbeLines(logger, lines) {
+  for (const line of lines) {
+    logger.log(line);
+  }
+}
+
+/**
+ * @param {Object} logger
+ */
+function logManifestSection(logger) {
+  logger.log(sectionTitle('Protection manifest'));
+  logger.log(SEP);
+  logger.log(formatSuccessLine('Local schema check passed (AJV)'));
+}
+
+/**
+ * @param {Object} args
+ * @param {string} args.dsKey
+ * @param {boolean} args.dryRun
+ * @param {boolean} args.force
+ * @param {Object} args.manifest
+ * @param {Object} args.logger
+ * @returns {Promise<number>}
+ */
+async function finalizeProtectionCreateWrite({ dsKey, dryRun, force, manifest, logger }) {
+  const format = await resolveProtectionOutputFormat();
+  const body = protectionManifestToDisplayText(manifest, format);
+  if (dryRun) {
+    logger.log(metadata('Dry run: no file written'));
+    process.stdout.write(body);
+    return 0;
+  }
+  const { outputPath } = await resolveOutputPathOrThrow(dsKey, force);
+  writeProtectionManifest(outputPath, manifest, format);
+  logger.log(formatSuccessLine(`Wrote ${outputPath}`));
+  logger.log('');
+  logger.log(
+    formatNextActions([
+      `aifabrix protection validate ${dsKey}`,
+      `aifabrix protection upload ${dsKey}`
+    ])
+  );
+  return 0;
+}
+
+/**
+ * @param {string} datasourceKey
+ * @param {Object} opts
+ * @returns {{ dsKey: string, dimensionKey: string, preset: Object|null }}
+ */
+function resolveCreateKeys(datasourceKey, opts) {
+  const dsKey = String(datasourceKey || '').trim();
+  if (!dsKey) {
+    throw new Error('Datasource key is required');
+  }
+  const preset = requireProtectionPreset(opts.type);
+  const dimensionKey = String(opts.dimensionKey || preset?.dimensionKey || '').trim();
+  if (!dimensionKey) {
+    throw new Error('--dimension-key is required unless --type supplies a preset dimension');
+  }
+  return { dsKey, dimensionKey, preset };
+}
+
+/**
+ * @param {string} datasourceKey
+ * @param {Object} opts
+ * @param {Object} logger
+ * @returns {Promise<number>}
+ */
+async function runProtectionCreate(datasourceKey, opts, logger) {
+  const { dsKey, dimensionKey, preset } = resolveCreateKeys(datasourceKey, opts);
+  const dryRun = opts.dryRun === true;
+  const force = opts.force === true;
+  const verbose = opts.verbose === true;
+
+  const dpCtx = await resolveProtectionDataplaneContext(opts);
+  const dimCtx = await resolveControllerAuthForDimensions();
+
+  logCreateHeader({ environment: dpCtx.environment, type: preset?.type }, dsKey, dimensionKey, logger);
+
+  const probeContext = await collectProtectionCreateProbeContext(
+    dpCtx,
+    dimCtx,
+    dsKey,
+    dimensionKey,
+    verbose
+  );
+  logProbeLines(logger, probeContext.lines);
+
+  const manifest = buildManifestForCreate(dsKey, dimensionKey, opts, probeContext);
+  assertLocalSchemaOrThrow(manifest, logger);
+  logManifestSection(logger);
+
+  return finalizeProtectionCreateWrite({ dsKey, dryRun, force, manifest, logger });
+}
+
+module.exports = {
+  runProtectionCreate,
+  resolveControllerAuthForDimensions: require('./run-protection-create-helpers').resolveControllerAuthForDimensions
+};

package/lib/protection/scope.js

@@ -0,0 +1,22 @@
+/**
+ * @fileoverview `.protection` scope token for top-level CLI commands.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const PROTECTION_SCOPE = '.protection';
+
+/**
+ * @param {string} arg
+ * @returns {boolean}
+ */
+function isProtectionScope(arg) {
+  return String(arg || '').trim() === PROTECTION_SCOPE;
+}
+
+module.exports = {
+  PROTECTION_SCOPE,
+  isProtectionScope
+};

package/lib/protection/sync-after-upload.js

@@ -0,0 +1,64 @@
+/**
+ * @fileoverview Trigger datasource sync after protection upload.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { createSyncJob, executeSyncJob } = require('../api/datasources-extended.api');
+const { unwrapApiData } = require('../utils/external-system-readiness-core');
+
+/**
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {string} datasourceKey
+ * @returns {Promise<{ syncJobId: string|null, warning: string|null }>}
+ */
+async function syncDatasourceAfterProtectionUpload(dataplaneUrl, authConfig, datasourceKey) {
+  const key = String(datasourceKey || '').trim();
+  if (!key) {
+    return { syncJobId: null, warning: 'Missing datasource key for sync' };
+  }
+  try {
+    const created = unwrapApiData(
+      await createSyncJob(dataplaneUrl, key, authConfig, {})
+    );
+    const syncJobId =
+      created?.id || created?.syncJobId || created?.data?.id || null;
+    if (syncJobId) {
+      await executeSyncJob(dataplaneUrl, key, syncJobId, authConfig);
+    }
+    return { syncJobId: syncJobId ? String(syncJobId) : null, warning: null };
+  } catch (err) {
+    return {
+      syncJobId: null,
+      warning: err?.message || String(err)
+    };
+  }
+}
+
+/**
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {string[]} datasourceKeys
+ * @returns {Promise<Array<{ datasourceKey: string, syncJobId: string|null, warning: string|null }>>}
+ */
+async function syncUniqueDatasourcesAfterUpload(dataplaneUrl, authConfig, datasourceKeys) {
+  const unique = [...new Set(datasourceKeys.map((k) => String(k || '').trim()).filter(Boolean))];
+  const out = [];
+  for (const datasourceKey of unique) {
+    const result = await syncDatasourceAfterProtectionUpload(
+      dataplaneUrl,
+      authConfig,
+      datasourceKey
+    );
+    out.push({ datasourceKey, ...result });
+  }
+  return out;
+}
+
+module.exports = {
+  syncDatasourceAfterProtectionUpload,
+  syncUniqueDatasourcesAfterUpload
+};

package/lib/protection/upload-batch.js

@@ -0,0 +1,127 @@
+/**
+ * @fileoverview Batch upload all manifests in `integration/.protection/` (yaml, yml, json).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const { getProtectionRoot } = require('./paths');
+const { loadProtectionManifest } = require('./load');
+const { validateProtectionManifestLocal } = require('./validate-local');
+const { resolveProtectionDataplaneContext } = require('./auth-context');
+const { validateProtection, uploadProtection } = require('../api/protection.api');
+const { exitCodeFromProtectionReport } = require('./report-exit');
+const { preflightDatasourceReady } = require('./preflight-datasource-ready');
+const { syncUniqueDatasourcesAfterUpload } = require('./sync-after-upload');
+const { formatProtectionBatchUploadTTY } = require('./protection-display');
+
+/**
+ * @param {string} manifestPath
+ * @param {Object} ctx
+ * @param {Object} opts
+ * @returns {Promise<{ stop: boolean, row: Object, uploadedKey?: string }>}
+ */
+async function processProtectionUploadFile(manifestPath, ctx, opts) {
+  const manifest = loadProtectionManifest(manifestPath);
+  const datasourceKey = String(manifest?.spec?.datasourceKey || '').trim();
+  const local = validateProtectionManifestLocal(manifest);
+  if (!local.valid) {
+    return {
+      stop: true,
+      row: {
+        datasourceKey: datasourceKey || path.basename(manifestPath),
+        ok: false,
+        error: local.errors.join('; ')
+      }
+    };
+  }
+
+  try {
+    await preflightDatasourceReady(ctx.dataplaneUrl, ctx.authConfig, manifest);
+  } catch (err) {
+    return { stop: true, row: { datasourceKey, ok: false, error: err.message } };
+  }
+
+  const report = await validateProtection(ctx.dataplaneUrl, ctx.authConfig, manifest, {
+    strict: opts.warningsAsErrors === true
+  });
+  if (exitCodeFromProtectionReport(report, opts) !== 0) {
+    const firstFail = (report?.results || []).find((r) => String(r?.status).toUpperCase() === 'FAIL');
+    return {
+      stop: true,
+      row: {
+        datasourceKey,
+        ok: false,
+        error: firstFail?.message || 'Dataplane validation failed'
+      }
+    };
+  }
+
+  if (opts.dryRun) {
+    return { stop: false, row: { datasourceKey, ok: true, dryRun: true } };
+  }
+
+  await uploadProtection(ctx.dataplaneUrl, ctx.authConfig, manifest);
+  return { stop: false, row: { datasourceKey, ok: true }, uploadedKey: datasourceKey };
+}
+
+/**
+ * @param {Object} opts
+ * @returns {Promise<{ ok: boolean, results: Object[], exitCode: number, syncResults: Object[] }>}
+ */
+async function runUploadProtectionBatch(opts = {}) {
+  const root = getProtectionRoot();
+  const { listProtectionManifestPaths } = require('./resolve');
+  const files = listProtectionManifestPaths(root);
+  const ctx = await resolveProtectionDataplaneContext(opts);
+  const results = [];
+  const uploadedDatasourceKeys = [];
+
+  for (const manifestPath of files) {
+    const { stop, row, uploadedKey } = await processProtectionUploadFile(manifestPath, ctx, opts);
+    results.push(row);
+    if (uploadedKey) uploadedDatasourceKeys.push(uploadedKey);
+    if (stop) break;
+  }
+
+  let syncResults = [];
+  if (!opts.dryRun && !opts.noSync && uploadedDatasourceKeys.length) {
+    syncResults = await syncUniqueDatasourcesAfterUpload(
+      ctx.dataplaneUrl,
+      ctx.authConfig,
+      uploadedDatasourceKeys
+    );
+  }
+
+  const ok = results.length > 0 && results.every((r) => r.ok);
+  return {
+    ok,
+    results,
+    exitCode: ok ? 0 : 1,
+    root,
+    ctx,
+    syncResults
+  };
+}
+
+/**
+ * @param {Object} opts
+ * @param {Object} logger
+ * @returns {Promise<number>}
+ */
+async function uploadProtectionBatchCommand(opts, logger) {
+  const batch = await runUploadProtectionBatch(opts);
+  if (opts.json) {
+    process.stdout.write(JSON.stringify(batch, null, 2));
+    return batch.exitCode;
+  }
+  logger.log(formatProtectionBatchUploadTTY(batch.results, { folder: batch.root }));
+  return batch.exitCode;
+}
+
+module.exports = {
+  runUploadProtectionBatch,
+  uploadProtectionBatchCommand
+};

package/lib/protection/validate-batch.js

@@ -0,0 +1,113 @@
+/**
+ * @fileoverview Batch validate all manifests in `integration/.protection/` (resolved protection root).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const { getProtectionRoot } = require('./paths');
+const { listProtectionManifestPaths } = require('./resolve');
+const { loadProtectionManifest } = require('./load');
+const { validateProtectionManifestLocal } = require('./validate-local');
+const { resolveProtectionDataplaneContext } = require('./auth-context');
+const { validateProtection, simulateProtection } = require('../api/protection.api');
+const { exitCodeFromProtectionReport } = require('./report-exit');
+const { formatProtectionBatchValidateTTY } = require('./protection-display');
+
+/**
+ * @param {string} manifestPath
+ * @param {Object|null} ctx
+ * @param {Object} opts
+ * @returns {Promise<{ ctx: Object|null, row: Object, stop: boolean }>}
+ */
+async function processProtectionValidateFile(manifestPath, ctx, opts) {
+  const manifest = loadProtectionManifest(manifestPath);
+  const datasourceKey = String(
+    manifest?.spec?.datasourceKey || path.basename(manifestPath, path.extname(manifestPath))
+  ).trim();
+  const local = validateProtectionManifestLocal(manifest);
+  if (!local.valid) {
+    return {
+      ctx,
+      stop: opts.stopOnFirstFailure !== false,
+      row: { datasourceKey, manifestPath, ok: false, error: local.errors.join('; ') }
+    };
+  }
+
+  if (opts.skipDataplane) {
+    return { ctx, stop: false, row: { datasourceKey, manifestPath, ok: true } };
+  }
+
+  let nextCtx = ctx;
+  if (!nextCtx) {
+    nextCtx = await resolveProtectionDataplaneContext(opts);
+  }
+  const report = await validateProtection(nextCtx.dataplaneUrl, nextCtx.authConfig, manifest, {
+    strict: opts.warningsAsErrors === true
+  });
+  if (opts.simulate && exitCodeFromProtectionReport(report, opts) === 0) {
+    await simulateProtection(nextCtx.dataplaneUrl, nextCtx.authConfig, manifest, {
+      strict: opts.warningsAsErrors === true
+    });
+  }
+  const code = exitCodeFromProtectionReport(report, opts);
+  if (code !== 0) {
+    const firstFail = (report?.results || []).find((r) => String(r?.status).toUpperCase() === 'FAIL');
+    return {
+      ctx: nextCtx,
+      stop: opts.stopOnFirstFailure !== false,
+      row: {
+        datasourceKey,
+        manifestPath,
+        ok: false,
+        error: firstFail?.message || 'Dataplane validation failed',
+        report
+      }
+    };
+  }
+  return { ctx: nextCtx, stop: false, row: { datasourceKey, manifestPath, ok: true, report } };
+}
+
+/**
+ * @param {Object} opts
+ * @returns {Promise<{ valid: boolean, results: Object[], exitCode: number }>}
+ */
+async function runValidateProtectionBatch(opts = {}) {
+  const root = getProtectionRoot();
+  const files = listProtectionManifestPaths(root);
+  const results = [];
+  let ctx = null;
+
+  for (const manifestPath of files) {
+    const outcome = await processProtectionValidateFile(manifestPath, ctx, opts);
+    ctx = outcome.ctx;
+    results.push(outcome.row);
+    if (outcome.stop) break;
+  }
+
+  const valid = results.every((r) => r.ok);
+  return { valid, results, exitCode: valid ? 0 : 1, root, ctx };
+}
+
+/**
+ * @param {Object} opts
+ * @param {Object} logger
+ * @returns {Promise<number>}
+ */
+async function validateProtectionBatchCommand(opts, logger) {
+  const batch = await runValidateProtectionBatch(opts);
+  if (opts.json) {
+    process.stdout.write(JSON.stringify(batch, null, 2));
+    return batch.exitCode;
+  }
+  logger.log(formatProtectionBatchValidateTTY(batch.results, { folder: batch.root }));
+  return batch.exitCode;
+}
+
+module.exports = {
+  processProtectionValidateFile,
+  runValidateProtectionBatch,
+  validateProtectionBatchCommand
+};