@aifabrix/builder 2.45.0 → 2.45.5

package/lib/commands/datasource.js

@@ -2,7 +2,7 @@
  * AI Fabrix Builder - Datasource Commands
  *
  * Handles datasource validation, listing, comparison, deployment, and online validation runs.
- * Subcommands `test`, `test-integration`, and `test-e2e` call the dataplane unified validation API; `log-test` / `log-integration` / `log-e2e` read saved debug JSON locally. Permissions are summarized in `docs/commands/permissions.md`.
+ * Subcommands `test`, `test-integration`, `test-e2e`, and `test-trust` call the dataplane; `log-*` read saved debug JSON locally; `clean-logs` removes those files. Permissions are summarized in `docs/commands/permissions.md`.
  *
  * @fileoverview Datasource management commands for AI Fabrix Builder
  * @author AI Fabrix Team
@@ -18,11 +18,15 @@ const { listDatasources } = require('../datasource/list');
 const { compareDatasources } = require('../datasource/diff');
 const { deployDatasource } = require('../datasource/deploy');
 const { runLogViewer } = require('../datasource/log-viewer');
+const { runCleanLogs } = require('../datasource/log-cleaner');
 const {
   setupDatasourceTestCommand,
   setupDatasourceTestIntegrationCommand,
   setupDatasourceTestE2ECommand
 } = require('./datasource-unified-test-cli');
+const { setupDatasourceTestTrustCommand } = require('./datasource-test-trust-cli');
+const { setupDatasourceVerifyAuditCommand } = require('./datasource-verify-audit-cli');
+const { setupDatasourceLoadExportCommands } = require('./datasource-load-export-cli');
 const { setupDatasourceCapabilityCommands } = require('./datasource-capability');
 
 /**
@@ -38,10 +42,17 @@ Examples:
   $ af ds upload <datasourceKey>                    # same as: aifabrix datasource upload …
   $ af ds test <datasourceKey> --app <integrationFolder> --debug
   $ af ds test-e2e <datasourceKey> --app <integrationFolder> -v
+  $ af ds test-e2e <datasourceKey> --verify-audit
+  $ af ds verify-audit <datasourceKey>
+  $ af ds test-trust <datasourceKey> --app <integrationFolder> -v
+  $ af ds load <datasourceKey> --app <integrationFolder> --dry-run
+  $ af ds export <datasourceKey> --app <integrationFolder> --format ndjson -v
   $ aifabrix datasource capability copy <file-or-key> --from create --as createBasicTrial --dry-run
   $ aifabrix datasource capability remove <file-or-key> --capability createTrial --dry-run
   $ aifabrix datasource capability diff ./a.json ./b.json --capability list
   $ aifabrix datasource capability edit <file-or-key> --capability create --section openapi
+  $ aifabrix datasource clean-logs --app test-e2e-hubspot --dry-run
+  $ aifabrix datasource clean-logs --all --type e2e
 
 Per-command help:  aifabrix datasource <command> --help
 Shorthand:         af ds (alias for datasource)
@@ -220,6 +231,57 @@ function setupDatasourceLogTestCommand(datasource) {
     });
 }
 
+function setupDatasourceCleanLogsCommand(datasource) {
+  datasource
+    .command('clean-logs')
+    .description('Remove saved test debug JSON under integration/<app>/logs/')
+    .option('-a, --app <app>', 'Integration folder name (system key)')
+    .option('--all', 'Clean logs under every integration/<app>/logs/ folder')
+    .option(
+      '-t, --type <type>',
+      'Log kind: test, integration, e2e, trust, or all (default: all)',
+      'all'
+    )
+    .option('--dry-run', 'List files that would be removed without deleting')
+    .option('--json', 'Machine-readable summary on stdout')
+    .action(async options => {
+      try {
+        await runCleanLogs({
+          app: options.app,
+          all: options.all,
+          type: options.type,
+          dryRun: options.dryRun,
+          json: options.json
+        });
+      } catch (error) {
+        logger.error(formatBlockingError('clean-logs failed:'), error.message);
+        process.exit(1);
+      }
+    });
+}
+
+function setupDatasourceLogTrustCommand(datasource) {
+  datasource.command('log-trust <datasourceKey>')
+    .description('Show agent trust log from datasource test-trust (latest test-trust-*.json or --file)')
+    .option(
+      '-a, --app <app>',
+      'Integration folder name (optional: resolve from cwd or datasource key if single match)'
+    )
+    .option('-f, --file <path>', 'Path to log file (default: latest test-trust log in app logs folder)')
+    .action(async(datasourceKey, options) => {
+      try {
+        await runLogViewer(datasourceKey, {
+          app: options.app,
+          file: options.file,
+          logType: 'test-trust'
+        });
+      } catch (error) {
+        logger.error(formatBlockingError('log-trust failed:'), error.message);
+        process.exit(1);
+      }
+    });
+}
+
 /**
  * Setup datasource management commands
  * @param {Command} program - Commander program instance
@@ -237,12 +299,17 @@ function setupDatasourceCommands(program) {
   setupDatasourceListCommand(datasource);
   setupDatasourceDiffCommand(datasource);
   setupDatasourceUploadCommand(datasource);
+  setupDatasourceLoadExportCommands(datasource);
   setupDatasourceTestCommand(datasource);
   setupDatasourceTestIntegrationCommand(datasource);
   setupDatasourceTestE2ECommand(datasource);
+  setupDatasourceVerifyAuditCommand(datasource);
+  setupDatasourceTestTrustCommand(datasource);
   setupDatasourceLogE2ECommand(datasource);
   setupDatasourceLogIntegrationCommand(datasource);
   setupDatasourceLogTestCommand(datasource);
+  setupDatasourceLogTrustCommand(datasource);
+  setupDatasourceCleanLogsCommand(datasource);
 }
 
 module.exports = { setupDatasourceCommands };

package/lib/commands/dimension-value.js

@@ -2,9 +2,9 @@
  * Dimension value commands (Controller).
  *
  * Commands:
- * - aifabrix dimension-value create
- * - aifabrix dimension-value list
- * - aifabrix dimension-value delete
+ * - aifabrix dimension value create
+ * - aifabrix dimension value list
+ * - aifabrix dimension value delete
  *
  * @fileoverview Dimension value CLI commands
  * @author AI Fabrix Team
@@ -25,29 +25,39 @@ const {
   deleteDimensionValue
 } = require('../api/dimension-values.api');
 
+const DIMENSION_VALUE_HELP_AFTER = `
+
+Examples:
+  $ aifabrix dimension value create customerRegion --value emea --display-name "EMEA"
+  $ aifabrix dimension value list customerRegion
+  $ aifabrix dimension value delete clx1234567890abcdef
+
+Per-command help:  aifabrix dimension value <command> --help
+`;
+
 const DIMENSION_VALUE_CREATE_HELP_AFTER = `
 
 Examples:
-  $ aifabrix dimension-value create customerRegion --value emea --display-name "EMEA"
-  $ aifabrix dimension-value create customerRegion --value na --display-name "North America"
+  $ aifabrix dimension value create customerRegion --value emea --display-name "EMEA"
+  $ aifabrix dimension value create customerRegion --value na --display-name "North America"
 
 `;
 
 const DIMENSION_VALUE_LIST_HELP_AFTER = `
 
 Examples:
-  $ aifabrix dimension-value list customerRegion
-  $ aifabrix dimension-value list customerRegion --page 1 --page-size 50
-  $ aifabrix dimension-value list customerRegion --search emea
+  $ aifabrix dimension value list customerRegion
+  $ aifabrix dimension value list customerRegion --page 1 --page-size 50
+  $ aifabrix dimension value list customerRegion --search emea
 
 `;
 
 const DIMENSION_VALUE_DELETE_HELP_AFTER = `
 
 Examples:
-  $ aifabrix dimension-value delete clx1234567890abcdef
+  $ aifabrix dimension value delete clx1234567890abcdef
 
-Tip: Find ids via "aifabrix dimension get <key>" (it prints values) or "aifabrix dimension-value list <key>".
+Tip: Find ids via "aifabrix dimension get <key>" (it prints values) or "aifabrix dimension value list <key>".
 
 `;
 
@@ -62,6 +72,17 @@ function requireNonEmpty(raw, label) {
   return s;
 }
 
+/**
+ * @param {Object} response - Controller API response
+ * @throws {Error} When response.success === false
+ */
+function throwIfApiFailed(response) {
+  if (!response || response.success !== false) {
+    return;
+  }
+  throw new Error(response.formattedError || response.error || 'Request failed');
+}
+
 async function resolveControllerAndAuth() {
   const controllerUrl = await resolveControllerUrl();
   if (!controllerUrl) {
@@ -100,6 +121,7 @@ function setupDimensionValueCreateCommand(cmd) {
           displayName: options.displayName,
           description: options.description
         });
+        throwIfApiFailed(res);
         const row = unwrapControllerData(res);
         logger.log(formatSuccessLine(`Dimension value created: ${dimKey}.${row.value}`));
       } catch (e) {
@@ -126,6 +148,7 @@ function setupDimensionValueListCommand(cmd) {
           pageSize: options.pageSize,
           search: options.search
         });
+        throwIfApiFailed(res);
         const payload = unwrapControllerData(res);
         const items = payload?.data ?? payload ?? [];
         logger.log(chalk.bold('\n🏷 Dimension values:\n'));
@@ -157,7 +180,8 @@ function setupDimensionValueDeleteCommand(cmd) {
       try {
         const { controllerUrl, authConfig } = await resolveControllerAndAuth();
         const id = requireNonEmpty(dimensionValueId, 'dimensionValueId');
-        await deleteDimensionValue(controllerUrl, authConfig, id);
+        const res = await deleteDimensionValue(controllerUrl, authConfig, id);
+        throwIfApiFailed(res);
         logger.log(formatSuccessLine(`Dimension value deleted: ${id}`));
       } catch (e) {
         logger.error(formatBlockingError(e.message));
@@ -166,8 +190,14 @@ function setupDimensionValueDeleteCommand(cmd) {
     });
 }
 
-function setupDimensionValueCommands(program) {
-  const cmd = program.command('dimension-value').description('Manage dimension values (static dimensions)');
+/**
+ * @param {import('commander').Command} dimensionCmd - Parent `dimension` command
+ */
+function setupDimensionValueCommands(dimensionCmd) {
+  const cmd = dimensionCmd
+    .command('value')
+    .description('Manage dimension values (static dimensions)')
+    .addHelpText('after', DIMENSION_VALUE_HELP_AFTER);
   setupDimensionValueCreateCommand(cmd);
   setupDimensionValueListCommand(cmd);
   setupDimensionValueDeleteCommand(cmd);

package/lib/commands/dimension.js

@@ -5,6 +5,7 @@
  * - aifabrix dimension create
  * - aifabrix dimension get
  * - aifabrix dimension list
+ * - aifabrix dimension value create|list|delete
  *
  * @fileoverview Dimension CLI commands
  * @author AI Fabrix Team
@@ -18,7 +19,7 @@ const logger = require('../utils/logger');
 const { resolveControllerUrl } = require('../utils/controller-url');
 const { normalizeControllerUrl, resolveEnvironment } = require('../core/config');
 const { getOrRefreshDeviceToken } = require('../utils/token-manager');
-const { readDimensionCreateFile } = require('../resolvers/dimension-file');
+const { readDimensionCreateFile, normalizeValueType } = require('../resolvers/dimension-file');
 const {
   formatBlockingError,
   formatSuccessLine,
@@ -31,8 +32,23 @@ const {
   createDimensionIdempotent
 } = require('../api/dimensions.api');
 const { createDimensionValue } = require('../api/dimension-values.api');
+const { setupDimensionValueCommands } = require('./dimension-value');
 
 const DIMENSION_KEY_PATTERN = /^[a-zA-Z][a-zA-Z0-9-_]*$/;
+
+/** Parent help for `aifabrix dimension -h` (leaf commands have their own Examples blocks). */
+const DIMENSION_HELP_AFTER = `
+
+Examples:
+  $ aifabrix dimension create --key customerRegion --display-name "Customer Region" --data-type string
+  $ aifabrix dimension get customerRegion
+  $ aifabrix dimension list --search region
+  $ aifabrix dimension value create customerRegion --value emea --display-name "EMEA"
+  $ aifabrix dimension value list customerRegion
+
+Per-command help:  aifabrix dimension <command> --help
+`;
+
 const DATA_TYPES = new Set(['string', 'number', 'boolean']);
 
 const DIMENSION_CREATE_HELP_AFTER = `
@@ -139,6 +155,11 @@ function buildCreatePayload(options) {
   if (options.displayName) payload.displayName = options.displayName;
   if (options.description !== undefined) payload.description = options.description;
   if (options.dataType) payload.dataType = options.dataType;
+  if (options.valueType) {
+    payload.valueType = normalizeValueType(options.valueType);
+  } else if (payload.valueType === undefined) {
+    payload.valueType = 'static';
+  }
   if (options.required !== undefined && options.required !== null) {
     payload.isRequired = Boolean(options.required);
   }
@@ -197,6 +218,7 @@ function setupDimensionCreateCommand(dim) {
     .option('--display-name <name>', 'Display name')
     .option('--description <text>', 'Description')
     .option('--data-type <type>', 'string | number | boolean')
+    .option('--value-type <mode>', 'static | dynamic | both (catalog assignment mode)')
     .option('--required', 'Mark dimension required (isRequired=true)')
     .option('--no-required', 'Mark dimension not required (isRequired=false)')
     .action(async(options) => {
@@ -206,11 +228,12 @@ function setupDimensionCreateCommand(dim) {
         const out = await createDimensionIdempotent(controllerUrl, authConfig, payload);
         const dimRow = unwrapControllerData(out.response);
         await maybeCreateValuesFromFile(controllerUrl, authConfig, payload);
+        const vt = dimRow.valueType || payload.valueType || 'static';
         if (out.created) {
-          logger.log(formatSuccessLine(`Dimension created: ${dimRow.key}`));
+          logger.log(formatSuccessLine(`Dimension created: ${dimRow.key} (valueType: ${vt})`));
           return;
         }
-        logger.log(formatSuccessLine(`Dimension exists: ${dimRow.key}`));
+        logger.log(formatSuccessLine(`Dimension exists: ${dimRow.key} (valueType: ${vt})`));
         logger.log(infoLine('No changes were needed.'));
       } catch (e) {
         logger.error(formatBlockingError(e.message));
@@ -236,6 +259,7 @@ function setupDimensionGetCommand(dim) {
         logger.log(headerKeyValue('Key:', row.key || '—'));
         logger.log(headerKeyValue('Display:', row.displayName || '—'));
         logger.log(headerKeyValue('Type:', row.dataType || '—'));
+        logger.log(headerKeyValue('Value type:', row.valueType || '—'));
         logger.log(headerKeyValue('Required:', String(row.isRequired)));
         if (row.description) {
           logger.log(headerKeyValue('Description:', row.description));
@@ -268,22 +292,25 @@ function setupDimensionListCommand(dim) {
     const KEY_WIDTH = 26;
     const DISPLAY_WIDTH = 34;
     const TYPE_WIDTH = 10;
+    const VTYPE_WIDTH = 8;
     const REQ_WIDTH = 10;
-    const SEP_LEN = KEY_WIDTH + DISPLAY_WIDTH + TYPE_WIDTH + REQ_WIDTH;
+    const SEP_LEN = KEY_WIDTH + DISPLAY_WIDTH + TYPE_WIDTH + VTYPE_WIDTH + REQ_WIDTH;
 
     const keyCol = 'Key'.padEnd(KEY_WIDTH);
     const displayCol = 'Display'.padEnd(DISPLAY_WIDTH);
     const typeCol = 'Type'.padEnd(TYPE_WIDTH);
+    const vtypeCol = 'VType'.padEnd(VTYPE_WIDTH);
     const reqCol = 'Required'.padEnd(REQ_WIDTH);
-    logger.log(chalk.gray(`${keyCol}${displayCol}${typeCol}${reqCol}`));
+    logger.log(chalk.gray(`${keyCol}${displayCol}${typeCol}${vtypeCol}${reqCol}`));
     logger.log(chalk.gray('-'.repeat(SEP_LEN)));
 
     items.forEach((d) => {
       const key = (d?.key ?? '—').toString().padEnd(KEY_WIDTH);
       const displayName = (d?.displayName ?? '—').toString().padEnd(DISPLAY_WIDTH);
       const dataType = (d?.dataType ?? '—').toString().padEnd(TYPE_WIDTH);
+      const valueType = (d?.valueType ?? '—').toString().padEnd(VTYPE_WIDTH);
       const required = (d?.isRequired ?? '—').toString().padEnd(REQ_WIDTH);
-      logger.log(`${key}${displayName}${dataType}${required}`);
+      logger.log(`${key}${displayName}${dataType}${valueType}${required}`);
     });
     logger.log('');
   }
@@ -318,10 +345,14 @@ function setupDimensionListCommand(dim) {
  * @param {import('commander').Command} program
  */
 function setupDimensionCommands(program) {
-  const dim = program.command('dimension').description('Manage the Controller Dimension Catalog');
+  const dim = program
+    .command('dimension')
+    .description('Manage the Controller Dimension Catalog')
+    .addHelpText('after', DIMENSION_HELP_AFTER);
   setupDimensionCreateCommand(dim);
   setupDimensionGetCommand(dim);
   setupDimensionListCommand(dim);
+  setupDimensionValueCommands(dim);
 }
 
 module.exports = {

package/lib/commands/identity-apply-sync.js

@@ -0,0 +1,131 @@
+/**
+ * @fileoverview Identity apply and sync commands
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatBlockingError, formatSuccessLine } = require('../utils/cli-layout-chalk');
+const {
+  resolveControllerAndAuth,
+  resolveEnvKey,
+  requireNonEmpty,
+  unwrapControllerData,
+  throwIfApiFailed,
+  assertSyncStatsOk
+} = require('./identity-shared');
+const { clearAuthCache } = require('../api/auth-cache.api');
+const { fullSyncToDataplane } = require('../api/dataplane-sync.api');
+const { runIdentityApply } = require('../identity/identity-apply-service');
+
+function printJson(data) {
+  logger.log(JSON.stringify(data, null, 2));
+}
+
+/**
+ * @param {import('commander').Command} identityCmd
+ */
+function setupIdentityApplyCommand(identityCmd) {
+  identityCmd
+    .command('apply')
+    .description('Apply users/groups/memberships from a CSV file (users.csv shape)')
+    .requiredOption('--file <path>', 'CSV file path')
+    .option('-e, --env <key>', 'Environment for --sync')
+    .option('--filter-prefix <prefix>', 'Only rows whose Id starts with this prefix')
+    .option('--dry-run', 'Parse and plan only; no writes')
+    .option('--sync', 'Run dataplane full sync after apply')
+    .option('--purge-cache', 'Clear controller cache before sync')
+    .option('--allow-empty-sync', 'Do not fail when sync reports usersProcessed=0')
+    .option('--json', 'JSON summary')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const envKey = options.sync ? await resolveEnvKey(options) : undefined;
+        const summary = await runIdentityApply(controllerUrl, authConfig, {
+          filePath: requireNonEmpty(options.file, 'file'),
+          filterPrefix: options.filterPrefix,
+          dryRun: Boolean(options.dryRun),
+          purgeCache: Boolean(options.purgeCache),
+          sync: Boolean(options.sync),
+          envKey,
+          allowEmptySync: Boolean(options.allowEmptySync)
+        });
+        if (options.json) {
+          printJson(summary);
+          return;
+        }
+        logger.log(formatSuccessLine('Identity apply finished'));
+        logger.log(
+          `  groups: ${summary.groupsProcessed} processed (${summary.groupsCreated} created)`
+        );
+        logger.log(`  users: ${summary.usersProcessed} processed (${summary.usersCreated} created)`);
+        logger.log(
+          `  memberships: ${summary.membershipsProcessed} processed (${summary.membershipsCreated} created, ${summary.membershipsSkipped} skipped)`
+        );
+        if (summary.syncStats) {
+          logger.log(
+            `  sync: usersProcessed=${summary.syncStats.usersProcessed ?? 0} groupsProcessed=${summary.syncStats.groupsProcessed ?? 0}`
+          );
+        }
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} identityCmd
+ */
+function setupIdentitySyncCommand(identityCmd) {
+  identityCmd
+    .command('sync')
+    .description('Full identity sync from controller to dataplane')
+    .option('-e, --env <key>', 'Environment key')
+    .option('--purge-cache', 'Clear controller cache before sync')
+    .option('--allow-empty-sync', 'Do not fail when usersProcessed=0')
+    .option('--json', 'JSON stats')
+    .action(async(options) => runIdentitySyncAction(options));
+}
+
+/**
+ * @param {Object} options
+ * @returns {Promise<void>}
+ */
+async function maybePurgeCache(controllerUrl, authConfig, purgeCache) {
+  if (!purgeCache) {
+    return;
+  }
+  const cacheRes = await clearAuthCache(controllerUrl, authConfig);
+  throwIfApiFailed(cacheRes);
+  logger.log(formatSuccessLine('Controller cache cleared'));
+}
+
+async function runIdentitySyncAction(options) {
+  try {
+    const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+    const envKey = await resolveEnvKey(options);
+    await maybePurgeCache(controllerUrl, authConfig, options.purgeCache);
+    const res = await fullSyncToDataplane(controllerUrl, authConfig, envKey);
+    throwIfApiFailed(res);
+    const stats = unwrapControllerData(res);
+    assertSyncStatsOk(stats, { allowEmptySync: options.allowEmptySync });
+    if (options.json) {
+      printJson(stats);
+      return;
+    }
+    logger.log(formatSuccessLine(`Identity synced to dataplane (${envKey})`));
+    logger.log(`  usersProcessed=${stats?.usersProcessed ?? 0}`);
+    logger.log(`  groupsProcessed=${stats?.groupsProcessed ?? 0}`);
+  } catch (e) {
+    logger.error(formatBlockingError(e.message));
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  setupIdentityApplyCommand,
+  setupIdentitySyncCommand
+};

package/lib/commands/identity-group-cli.js

@@ -0,0 +1,146 @@
+/**
+ * @fileoverview Identity group subcommands
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatBlockingError, formatSuccessLine, headerKeyValue } = require('../utils/cli-layout-chalk');
+const {
+  resolveControllerAndAuth,
+  requireNonEmpty,
+  unwrapControllerData,
+  throwIfApiFailed
+} = require('./identity-shared');
+const { listGroups, getGroup, createGroup, listGroupMembers } = require('../api/groups.api');
+
+function printJson(data) {
+  logger.log(JSON.stringify(data, null, 2));
+}
+
+function registerGroupCreate(groupCmd) {
+  groupCmd
+    .command('create')
+    .description('Create a group')
+    .requiredOption('--name <name>', 'Group name (unique key)')
+    .requiredOption('--display-name <name>', 'Display name')
+    .option('--description <text>', 'Description')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await createGroup(controllerUrl, authConfig, {
+          name: requireNonEmpty(options.name, 'name'),
+          displayName: requireNonEmpty(options.displayName, 'display-name'),
+          description: options.description
+        });
+        throwIfApiFailed(res);
+        const row = unwrapControllerData(res);
+        logger.log(formatSuccessLine(`Group created: ${row.id} (${row.name})`));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function registerGroupList(groupCmd) {
+  groupCmd
+    .command('list')
+    .description('List groups')
+    .option('--page <n>', 'Page', (v) => parseInt(v, 10))
+    .option('--page-size <n>', 'Page size', (v) => parseInt(v, 10))
+    .option('--search <text>', 'Search groups')
+    .option('--json', 'JSON output')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await listGroups(controllerUrl, authConfig, {
+          page: options.page,
+          pageSize: options.pageSize,
+          search: options.search
+        });
+        throwIfApiFailed(res);
+        const data = unwrapControllerData(res);
+        if (options.json) {
+          printJson(data);
+          return;
+        }
+        const items = Array.isArray(data) ? data : data?.data || [];
+        items.forEach((g) => logger.log(`  ${g.id}  ${g.name}`));
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function registerGroupGet(groupCmd) {
+  groupCmd
+    .command('get <idOrName>')
+    .description('Get group by id or name')
+    .option('--json', 'JSON output')
+    .action(async(idOrName, options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await getGroup(controllerUrl, authConfig, requireNonEmpty(idOrName, 'idOrName'));
+        throwIfApiFailed(res);
+        const row = unwrapControllerData(res);
+        if (options.json) {
+          printJson(row);
+          return;
+        }
+        logger.log(headerKeyValue('Id:', row.id));
+        logger.log(headerKeyValue('Name:', row.name));
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function registerGroupMembers(groupCmd) {
+  groupCmd
+    .command('members <idOrName>')
+    .description('List members of a group')
+    .option('--json', 'JSON output')
+    .action(async(idOrName, options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth();
+        const res = await listGroupMembers(
+          controllerUrl,
+          authConfig,
+          requireNonEmpty(idOrName, 'idOrName')
+        );
+        throwIfApiFailed(res);
+        const data = unwrapControllerData(res);
+        if (options.json) {
+          printJson(data);
+          return;
+        }
+        const items = Array.isArray(data) ? data : data?.data || [];
+        items.forEach((m) => logger.log(`  ${m.userId || m.id}  ${m.email || ''}`));
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} groupCmd
+ */
+function setupIdentityGroupCommands(groupCmd) {
+  registerGroupCreate(groupCmd);
+  registerGroupList(groupCmd);
+  registerGroupGet(groupCmd);
+  registerGroupMembers(groupCmd);
+}
+
+module.exports = {
+  setupIdentityGroupCommands
+};