@aifabrix/builder 2.45.0 → 2.45.5

package/lib/utils/datasource-test-run-capability-scope.js

@@ -1,12 +1,12 @@
 /**
- * @fileoverview Single-capability CLI contract when --capability is set.
+ * @fileoverview Single-capability CLI contract when positional [capabilityKey] is set.
  * @author AI Fabrix Team
  * @version 2.0.0
  */
 
 /**
  * @param {Object|null|undefined} envelope - DatasourceTestRun-like
- * @param {string|undefined|null} requestedCapabilityKey - From CLI --capability
+ * @param {string|undefined|null} requestedCapabilityKey - From positional [capabilityKey]
  * @returns {{ violated: boolean, message?: string, count?: number }}
  */
 function analyzeCapabilityScope(envelope, requestedCapabilityKey) {
@@ -34,7 +34,7 @@ function analyzeCapabilityScope(envelope, requestedCapabilityKey) {
   return {
     violated: true,
     count: caps.length,
-    message: `Capabilities scope: with --capability "${key}", expected a single row in capabilities[]; server returned ${caps.length} (${preview}${suffix}).`
+    message: `Capabilities scope: with capabilityKey "${key}", expected a single row in capabilities[]; server returned ${caps.length} (${preview}${suffix}).`
   };
 }
 

package/lib/utils/datasource-test-run-display.js

@@ -98,7 +98,7 @@ function colorStepLine(ok, body) {
 }
 
 /**
- * Normalize CLI --capability value for matching envelope.capabilities[].key
+ * Normalize positional [capabilityKey] for matching envelope.capabilities[].key
  * @param {*} focusCapabilityKey
  * @returns {string} trimmed or ''
  */
@@ -354,7 +354,7 @@ function pickExecutiveVerdictLine(envelope) {
 }
 
 /**
- * Plan §3.9: explicit line when E2E has no capability rows (skipped when --capability drill-down is active).
+ * Plan §3.9: explicit line when E2E has no capability rows (skipped when capability drill-down is active).
  * @param {string[]} lines
  * @param {Object} envelope
  * @param {{ focusCapabilityKey?: string }} [options]
@@ -428,7 +428,7 @@ function formatDatasourceTestRunSummary(envelope, options = {}) {
  *   focusCapabilityKey?: string,
  *   includeRefs?: boolean,
  *   includeDebugExecutionSummary?: boolean
- * }} [options] - When focusCapabilityKey set (e.g. --capability), append single-cap block (plan §2.3).
+ * }} [options] - When focusCapabilityKey set (positional [capabilityKey]), append single-cap block (plan §2.3).
  *   includeDebugExecutionSummary: show dataplane `debug.executionSummary` in header (TTY debug appendix uses CLI `--debug`).
  * @returns {string}
  */

package/lib/utils/datasource-test-run-tty-log.js

@@ -49,7 +49,11 @@ function printDatasourceTestRunForTTY(envelope, options = {}) {
     includeDebugExecutionSummary: Boolean(mode)
   };
   if (options.json) {
-    logger.log(JSON.stringify(envelope));
+    const payload =
+      options.auditEvidenceVerification && typeof options.auditEvidenceVerification === 'object'
+        ? { ...envelope, auditEvidenceVerification: options.auditEvidenceVerification }
+        : envelope;
+    logger.log(JSON.stringify(payload));
     return;
   }
   if (options.summary) {

package/lib/utils/help-builder.js

@@ -26,10 +26,10 @@ const CATEGORIES = [
       { name: 'up-platform' },
       { name: 'up-miso' },
       { name: 'up-dataplane' },
-      { name: 'down-infra', term: 'down-infra [service|app]' },
+      { name: 'down-infra', term: 'down-infra [service|appKey]' },
       { name: 'doctor' },
       { name: 'status' },
-      { name: 'restart', term: 'restart <service|app>' }
+      { name: 'restart', term: 'restart <service|appKey>' }
     ]
   },
   {
@@ -43,23 +43,22 @@ const CATEGORIES = [
   {
     name: 'Applications (Create & Develop)',
     commands: [
-      { name: 'create', term: 'create <app>' },
-      { name: 'wizard' },
-      { name: 'build', term: 'build <app>' },
-      { name: 'run', term: 'run <app>' },
-      { name: 'shell', term: 'shell <app>' },
-      { name: 'install', term: 'install <app>' },
-      { name: 'lint', term: 'lint <app>' },
-      { name: 'logs', term: 'logs <app>' },
-      { name: 'stop', term: 'stop <app>' },
-      { name: 'dockerfile', term: 'dockerfile <app>' }
+      { name: 'create', term: 'create <appKey|systemKey>' },
+      { name: 'build', term: 'build <appKey>' },
+      { name: 'run', term: 'run <appKey>' },
+      { name: 'shell', term: 'shell <appKey>' },
+      { name: 'install', term: 'install <appKey>' },
+      { name: 'lint', term: 'lint <appKey>' },
+      { name: 'logs', term: 'logs <appKey>' },
+      { name: 'stop', term: 'stop <appKey>' },
+      { name: 'dockerfile', term: 'dockerfile <appKey>' }
     ]
   },
   {
     name: 'Deployment',
     commands: [
-      { name: 'push', term: 'push <app>' },
-      { name: 'deploy', term: 'deploy <app>' }
+      { name: 'push', term: 'push <appKey>' },
+      { name: 'deploy', term: 'deploy <appKey|systemKey>' }
     ]
   },
   {
@@ -80,12 +79,12 @@ const CATEGORIES = [
   {
     name: 'Configuration & Validation',
     commands: [
-      { name: 'resolve', term: 'resolve <app>' },
-      { name: 'json', term: 'json <app>' },
-      { name: 'split-json', term: 'split-json <app>' },
-      { name: 'convert', term: 'convert <app>' },
-      { name: 'show', term: 'show <app>' },
-      { name: 'validate', term: 'validate <appOrFile>' },
+      { name: 'resolve', term: 'resolve <appKey|systemKey>' },
+      { name: 'json', term: 'json <appKey|systemKey>' },
+      { name: 'split-json', term: 'split-json <appKey|systemKey>' },
+      { name: 'convert', term: 'convert <appKey|systemKey>' },
+      { name: 'show', term: 'show <appKey|systemKey>' },
+      { name: 'validate', term: 'validate [appKey|systemKey|file]' },
       { name: 'parameters', term: 'parameters validate' },
       { name: 'diff', term: 'diff <file1> <file2>' }
     ]
@@ -93,16 +92,23 @@ const CATEGORIES = [
   {
     name: 'External Systems',
     commands: [
+      { name: 'wizard', term: 'wizard [systemKey]' },
       { name: 'download', term: 'download <systemKey>' },
       { name: 'upload', term: 'upload <systemKey>' },
       { name: 'delete', term: 'delete <systemKey>' },
       { name: 'repair', term: 'repair <systemKey>' },
       { name: 'datasource' },
+      { name: 'datasource load', term: 'datasource load <datasourceKey>' },
+      { name: 'datasource export', term: 'datasource export <datasourceKey>' },
       { name: 'dimension' },
-      { name: 'dimension-value' },
-      { name: 'test', term: 'test <app>' },
-      { name: 'test-e2e', term: 'test-e2e <app>' },
-      { name: 'test-integration', term: 'test-integration <app>' }
+      { name: 'dimension value', term: 'dimension value <command>' },
+      { name: 'identity' },
+      { name: 'protection' },
+      { name: 'test', term: 'test <appKey|systemKey>' },
+      { name: 'test-e2e', term: 'test-e2e <appKey|systemKey>' },
+      { name: 'test-governance', term: 'test-governance <appKey|systemKey>' },
+      { name: 'test-trust', term: 'test-trust <appKey|systemKey>' },
+      { name: 'test-integration', term: 'test-integration <appKey|systemKey>' }
     ]
   },
   {

package/lib/utils/manifest-source-emit.js

@@ -151,8 +151,30 @@ function emitAllPlatformSystemManifestLinesIfTTY(logger, opts = {}) {
   }
 }
 
+/**
+ * Integration load/export manifest line (plan 144).
+ *
+ * @param {{ tier?: string, configPath?: string, labelPrefix?: string }} opts
+ * @returns {void}
+ */
+function emitManifestSourceMetadata(opts = {}) {
+  if (!isStdoutTty()) return;
+  const log = require('./logger');
+  const tier = opts.tier && typeof opts.tier === 'string' ? opts.tier : 'resolved';
+  const configPath =
+    opts.configPath && typeof opts.configPath === 'string' ? opts.configPath : '';
+  const labelPrefix =
+    opts.labelPrefix && typeof opts.labelPrefix === 'string' ? opts.labelPrefix : '';
+  const tierLabel = tier === 'int' ? 'integration' : humanTierLabel(tier);
+  const line = labelPrefix
+    ? metadata(`${labelPrefix} — ${tierLabel} — ${configPath}`)
+    : formatManifestSourceMetadataLine({ tier: tierLabel, configPath });
+  log.log(line);
+}
+
 module.exports = {
   emitManifestMetadataLineIfTTY,
+  emitManifestSourceMetadata,
   emitSystemBuilderAppManifestLineIfTTY,
   emitAllPlatformSystemManifestLinesIfTTY,
   formatManifestSourceMetadataLine,

package/lib/utils/semver-compare.js

@@ -0,0 +1,127 @@
+/**
+ * Internal semver comparator (no `semver` npm dependency).
+ *
+ * Supports `MAJOR.MINOR.PATCH` and optional prerelease suffix
+ * `-<prerelease>` (e.g. `2.45.0-beta.1`). Optional leading `v` is tolerated.
+ * Prerelease versions always rank **before** the same MAJOR.MINOR.PATCH
+ * without a prerelease (semver §11.3).
+ *
+ * @fileoverview Internal semver compare for Builder CLI compatibility gate
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const SEMVER_PATTERN = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z][-0-9A-Za-z.]*))?$/;
+
+/**
+ * Parse a semver-like string into a comparable structure.
+ * @param {string} input - Version string (e.g. "2.45.0" or "v2.45.0-beta.1")
+ * @returns {{ major:number, minor:number, patch:number, prerelease:string[] }|null}
+ *          Parsed parts or null when input does not match the supported grammar
+ */
+function parseSemver(input) {
+  if (typeof input !== 'string') {
+    return null;
+  }
+  const match = SEMVER_PATTERN.exec(input.trim());
+  if (!match) {
+    return null;
+  }
+  const [, major, minor, patch, prerelease] = match;
+  return {
+    major: Number(major),
+    minor: Number(minor),
+    patch: Number(patch),
+    prerelease: prerelease ? prerelease.split('.') : []
+  };
+}
+
+/**
+ * Check whether a string is a supported semver (incl. optional prerelease).
+ * @param {string} input
+ * @returns {boolean}
+ */
+function isValidSemver(input) {
+  return parseSemver(input) !== null;
+}
+
+/**
+ * Compare two prerelease identifier arrays per semver §11.4.
+ * @private
+ * @param {string[]} a
+ * @param {string[]} b
+ * @returns {-1|0|1}
+ */
+function comparePrereleaseIds(a, b) {
+  const len = Math.max(a.length, b.length);
+  for (let i = 0; i < len; i += 1) {
+    if (a[i] === undefined) return -1;
+    if (b[i] === undefined) return 1;
+    const aNum = /^\d+$/.test(a[i]);
+    const bNum = /^\d+$/.test(b[i]);
+    if (aNum && bNum) {
+      const diff = Number(a[i]) - Number(b[i]);
+      if (diff !== 0) return diff > 0 ? 1 : -1;
+    } else if (aNum) {
+      return -1;
+    } else if (bNum) {
+      return 1;
+    } else if (a[i] !== b[i]) {
+      return a[i] > b[i] ? 1 : -1;
+    }
+  }
+  return 0;
+}
+
+/**
+ * Compare two semver strings.
+ *
+ * @param {string} a
+ * @param {string} b
+ * @returns {-1|0|1}  `-1` when `a < b`, `0` when equal, `1` when `a > b`
+ * @throws {Error} When either argument is not a valid semver
+ *
+ * @example
+ *   compareSemver('2.44.0', '2.45.0') === -1
+ *   compareSemver('2.45.0', '2.45.0') === 0
+ *   compareSemver('2.45.0-beta.1', '2.45.0') === -1
+ */
+function compareSemver(a, b) {
+  const parsedA = parseSemver(a);
+  const parsedB = parseSemver(b);
+  if (!parsedA) throw new Error(`Invalid semver: "${a}"`);
+  if (!parsedB) throw new Error(`Invalid semver: "${b}"`);
+
+  if (parsedA.major !== parsedB.major) return parsedA.major > parsedB.major ? 1 : -1;
+  if (parsedA.minor !== parsedB.minor) return parsedA.minor > parsedB.minor ? 1 : -1;
+  if (parsedA.patch !== parsedB.patch) return parsedA.patch > parsedB.patch ? 1 : -1;
+
+  // §11.3 — Prerelease has lower precedence than the same MAJOR.MINOR.PATCH release.
+  if (parsedA.prerelease.length === 0 && parsedB.prerelease.length === 0) return 0;
+  if (parsedA.prerelease.length === 0) return 1;
+  if (parsedB.prerelease.length === 0) return -1;
+
+  return comparePrereleaseIds(parsedA.prerelease, parsedB.prerelease);
+}
+
+/**
+ * Convenience: true when `current >= required`.
+ * Returns `true` when `required` is empty/null/undefined (no enforcement).
+ * @param {string} current
+ * @param {string} [required]
+ * @returns {boolean}
+ * @throws {Error} If either provided value is not valid semver
+ */
+function isAtLeast(current, required) {
+  if (required === undefined || required === null || required === '') return true;
+  return compareSemver(current, required) >= 0;
+}
+
+module.exports = {
+  parseSemver,
+  isValidSemver,
+  compareSemver,
+  isAtLeast
+};

package/lib/utils/upload-pipeline-ui.js

@@ -0,0 +1,91 @@
+/**
+ * @fileoverview Progress line + optional ora spinner for dataplane pipeline upload/publish.
+ * @author AI Fabrix Team
+ * @version 1.1.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('./logger');
+const { formatProgress } = require('./cli-test-layout-chalk');
+
+/**
+ * @param {Object} [options]
+ * @param {boolean} [options.json] - When true, skip progress line and spinner
+ * @returns {boolean}
+ */
+function shouldShowUploadPipelineProgress(options = {}) {
+  return options.json !== true;
+}
+
+/**
+ * @param {Object} [options]
+ * @returns {boolean}
+ */
+function shouldUseUploadPipelineSpinner(options = {}) {
+  if (!shouldShowUploadPipelineProgress(options)) {
+    return false;
+  }
+  return Boolean(process && process.stdout && process.stdout.isTTY);
+}
+
+/**
+ * Plain label for spinner / progress (no glyph).
+ * @param {string} systemKey
+ * @returns {string}
+ */
+function buildUploadPipelineSpinnerLabel(systemKey) {
+  const key = systemKey && String(systemKey).trim() ? String(systemKey).trim() : 'integration';
+  return `Publishing ${key} to dataplane…`;
+}
+
+/**
+ * @param {string} systemKey
+ * @returns {string}
+ */
+function buildUploadPipelineProgressText(systemKey) {
+  return formatProgress(buildUploadPipelineSpinnerLabel(systemKey));
+}
+
+/**
+ * Run pipeline upload + OpenAPI sync with visible progress (⏳ line or ora with label on TTY).
+ *
+ * @async
+ * @param {Function} work - Zero-arg async function (publish + follow-up I/O)
+ * @param {Object} [opts]
+ * @param {string} [opts.systemKey]
+ * @param {boolean} [opts.json]
+ * @returns {Promise<*>}
+ */
+async function runWithUploadPipelineSpinner(work, opts = {}) {
+  if (!shouldShowUploadPipelineProgress(opts)) {
+    return work();
+  }
+
+  if (!shouldUseUploadPipelineSpinner(opts)) {
+    logger.log(buildUploadPipelineProgressText(opts.systemKey));
+    return work();
+  }
+
+  const ora = require('ora');
+  const label = buildUploadPipelineSpinnerLabel(opts.systemKey);
+  const spinner = ora({
+    text: chalk.white(label),
+    spinner: 'dots'
+  }).start();
+
+  try {
+    return await work();
+  } finally {
+    spinner.stop();
+  }
+}
+
+module.exports = {
+  shouldShowUploadPipelineProgress,
+  shouldUseUploadPipelineSpinner,
+  buildUploadPipelineSpinnerLabel,
+  buildUploadPipelineProgressText,
+  runWithUploadPipelineSpinner
+};

package/lib/utils/validation-poll-ui.js

@@ -23,10 +23,12 @@ function shouldUseValidationPollSpinner() {
  * @param {number} deadlineMs - Wall-clock deadline (Date.now() + remaining budget)
  * @returns {string}
  */
-function buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs) {
+function buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs, subject) {
   const remainingSec = Math.max(0, Math.ceil((deadlineMs - Date.now()) / 1000));
+  const label =
+    subject && String(subject).trim() ? String(subject).trim() : 'validation run';
   if (!envelope || typeof envelope !== 'object') {
-    return `Waiting for validation run… starting (budget ~${remainingSec}s)`;
+    return `Waiting for ${label}… starting (budget ~${remainingSec}s)`;
   }
   const c =
     envelope.reportCompleteness !== undefined && envelope.reportCompleteness !== null
@@ -34,26 +36,29 @@ function buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs) {
       : '?';
   const st =
     envelope.status !== undefined && envelope.status !== null ? String(envelope.status) : '?';
-  return `Waiting for validation run… completeness=${c} status=${st} (poll ${attemptIndex + 1} · ~${remainingSec}s left)`;
+  return `Waiting for ${label}… completeness=${c} status=${st} (poll ${attemptIndex + 1} · ~${remainingSec}s left)`;
 }
 
 const NON_TTY_THROTTLE_MS = 5000;
 
 /**
  * @param {number} deadlineMs - Absolute deadline for poll budget display
+ * @param {Object} [opts]
+ * @param {string} [opts.subject] - Datasource key or label shown in poll text
  * @returns {{ usesSpinner: boolean, onPollProgress: Function, finish: () => void }}
  */
-function createValidationPollHandlers(deadlineMs) {
+function createValidationPollHandlers(deadlineMs, opts = {}) {
+  const subject = opts.subject;
   if (shouldUseValidationPollSpinner()) {
     const ora = require('ora');
     const spinner = ora({
-      text: buildValidationPollSpinnerText(null, 0, deadlineMs),
+      text: buildValidationPollSpinnerText(null, 0, deadlineMs, subject),
       spinner: 'dots'
     }).start();
     return {
       usesSpinner: true,
       onPollProgress: (envelope, attemptIndex, _meta) => {
-        spinner.text = buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs);
+        spinner.text = buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs, subject);
       },
       finish: () => {
         spinner.stop();
@@ -68,7 +73,9 @@ function createValidationPollHandlers(deadlineMs) {
       const now = Date.now();
       if (now - lastNonTtyLogAt < NON_TTY_THROTTLE_MS) return;
       lastNonTtyLogAt = now;
-      logger.log(chalk.gray(buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs)));
+      logger.log(
+        chalk.gray(buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs, subject))
+      );
     },
     finish: () => {}
   };

package/lib/validation/wizard-config-validator.js

@@ -164,36 +164,73 @@ function validateWizardConfigSchema(config) {
   };
 }
 
+/**
+ * Candidate bases for relative openapi-file paths (first existing wins).
+ * @param {string} configPath - Path to wizard.yaml
+ * @returns {string[]}
+ */
+function wizardOpenApiFilePathCandidates(filePath, configPath) {
+  const raw = String(filePath || '').trim();
+  if (!raw) {
+    return [];
+  }
+  if (path.isAbsolute(raw)) {
+    return [path.resolve(raw)];
+  }
+  const configDir = path.dirname(path.resolve(configPath));
+  return [...new Set([
+    path.resolve(process.cwd(), raw),
+    path.resolve(configDir, raw)
+  ])];
+}
+
+/**
+ * Resolve openapi-file path for wizard config (absolute path).
+ * Relative paths: process.cwd() first, then wizard.yaml directory.
+ * @param {string} filePath
+ * @param {string} configPath
+ * @returns {Promise<string>}
+ */
+async function resolveWizardOpenApiFilePath(filePath, configPath) {
+  const candidates = wizardOpenApiFilePathCandidates(filePath, configPath);
+  if (candidates.length === 0) {
+    return '';
+  }
+  for (const candidate of candidates) {
+    try {
+      await fs.access(candidate);
+      return candidate;
+    } catch (error) {
+      if (error.code !== 'ENOENT') {
+        throw error;
+      }
+    }
+  }
+  return candidates[0];
+}
+
 /**
  * Validate file path exists (for openapi-file source type)
  * @function validateFilePath
  * @param {string} filePath - Path to validate
- * @param {string} basePath - Base path for relative paths
- * @returns {Promise<Object>} Validation result with valid flag and errors
+ * @param {string} configPath - Path to wizard.yaml (relative paths resolve from cwd, then config dir)
+ * @returns {Promise<Object>} Validation result with valid flag, errors, and resolvedPath
  */
-async function validateFilePath(filePath, basePath) {
-  const baseDir = path.resolve(basePath);
-  const resolvedPath = path.isAbsolute(filePath)
-    ? path.resolve(filePath)
-    : path.resolve(baseDir, filePath);
-  if (!path.isAbsolute(filePath)) {
-    const baseWithSep = baseDir.endsWith(path.sep) ? baseDir : `${baseDir}${path.sep}`;
-    if (!resolvedPath.startsWith(baseWithSep)) {
-      return {
-        valid: false,
-        errors: [`OpenAPI file path must be within: ${baseDir}`]
-      };
-    }
+async function validateFilePath(filePath, configPath) {
+  const resolvedPath = await resolveWizardOpenApiFilePath(filePath, configPath);
+  if (!resolvedPath) {
+    return { valid: false, errors: ['OpenAPI file path is required'], resolvedPath: '' };
   }
   try {
     await fs.access(resolvedPath);
   } catch (error) {
     return {
       valid: false,
-      errors: [`OpenAPI file not found: ${resolvedPath}`]
+      errors: [`OpenAPI file not found: ${resolvedPath}`],
+      resolvedPath
     };
   }
-  return { valid: true, errors: [] };
+  return { valid: true, errors: [], resolvedPath };
 }
 
 /**
@@ -229,10 +266,11 @@ function validateSchemaAndResolveEnvVars(config, shouldResolveEnvVars) {
 async function performSemanticValidations(config, configPath, validateFilePaths) {
   const errors = [];
   if (validateFilePaths && config.source?.type === 'openapi-file' && config.source?.filePath) {
-    const basePath = path.dirname(path.resolve(configPath));
-    const fileResult = await validateFilePath(config.source.filePath, basePath);
+    const fileResult = await validateFilePath(config.source.filePath, configPath);
     if (!fileResult.valid) {
       errors.push(...fileResult.errors);
+    } else if (fileResult.resolvedPath) {
+      config.source.filePath = fileResult.resolvedPath;
     }
   }
   if (config.mode === 'add-datasource' && !config.systemIdOrKey) {
@@ -296,6 +334,7 @@ module.exports = {
   wizardConfigExists,
   validateWizardConfig,
   validateWizardConfigSchema,
+  resolveWizardOpenApiFilePath,
   resolveEnvVar,
   resolveEnvVarsInObject,
   formatValidationErrors,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.45.0",
+  "version": "2.45.5",
   "description": "AI Fabrix Local Fabric & Deployment SDK",
   "main": "lib/index.js",
   "bin": {

package/templates/applications/dataplane/env.template

@@ -21,7 +21,7 @@ LOG_FORMAT=json
 # Production with persistent logs: use /mnt/data/logs/app.log and mount a volume at /mnt/data.
 LOG_FILE_PATH=/mnt/data/logs/app.log
 # If true, run without Redis/Celery (single process)
-LOCAL_MODE=false
+LOCAL_MODE=true
 
 # When API_KEY is set, a matching Bearer token bypasses OAuth2 validation
 # Same kv:// as miso-controller API_KEY so pipeline Bearer bypass uses one secrets.local entry
@@ -30,6 +30,9 @@ API_KEY=kv://miso-controller-secrets-apiKeyVault
 # API Configuration
 API_V1_STR=/api/v1
 VERSION=1.9.5
+# Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
+# MIN_BUILDER_CLI_VERSION=2.45.0
+MIN_BUILDER_CLI_VERSION=2.45.0
 # Base URL for the dataplane web server (used for default OAuth2 callback URL when redirectUri is omitted)
 # url:// resolves after kv://; includes front-door path from application.yaml (e.g. /data)
 DATAPLANE_WEB_SERVER_URL=url://public
@@ -165,6 +168,15 @@ RBAC_EXPLAIN_MODE_ENABLED=false
 # validates only (no second DB write). Default false.
 AUDIT_ASYNC_SHADOW_ENQUEUE=false
 
+# Policy Library management HTTP API gate. When false (default), management
+# routes are not registered (404): /api/v1/policies/*, /api/v1/external/{key}/policies,
+# /api/v1/users/{id}/policies, /api/v1/groups/{id}/policies, IDE /validate/policy and
+# /simulate/policy-impact/{datasourceKey}. ABAC runtime evaluation is unaffected.
+# Set to true for local dev when iterating on policy CRUD APIs.
+# Policy Library management HTTP APIs (default false → routes not registered, 404).
+# Set true for local dev policy CRUD; pair with VITE_POLICY_MANAGEMENT_ENABLED=true in app-ui.
+POLICY_MANAGEMENT_API_ENABLED=false
+
 # =============================================================================
 # OBSERVABILITY CONFIGURATION
 # =============================================================================

package/templates/applications/dataplane/rbac.yaml

@@ -280,6 +280,10 @@ permissions:
   - name: "record:search"
     roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-deployment-admin", "aifabrix-compliance-admin", "aifabrix-developer", "aifabrix-observer"]
     description: "Search records"
+
+  - name: "governance:evaluate"
+    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-developer"]
+    description: "Run governance scenario acceptance (subject impersonation for ABAC proof)"
   
   # IDE simulation operations
   - name: "dataplane:abac-simulate"