@aifabrix/builder 2.45.0 → 2.46.0

package/.cursor/rules/cli-layout.mdc

@@ -7,6 +7,8 @@ alwaysApply: false
 
 When you touch **CLI surface** (`bin/aifabrix.js`, `lib/cli.js`, `lib/cli/**`, `lib/commands/**`) or **shared CLI formatters**, you must keep behavior aligned with the canonical docs in this folder.
 
+**Product-neutral copy:** User-facing help, errors, and warnings must not reference internal plan IDs or hardcode lab-only integration names in generic code. See [cli-product-neutral.mdc](./cli-product-neutral.mdc).
+
 ## Sources of truth (read before shipping)
 
 | Document | Role |

package/.cursor/rules/cli-product-neutral.mdc

@@ -0,0 +1,43 @@
+---
+description: Apply when changing aifabrix CLI code, help text, errors, or user-facing docs under docs/commands. Keeps product output free of internal plans, training labs, and hardcoded integration names.
+alwaysApply: false
+---
+
+# CLI product-neutral output (Builder)
+
+The **aifabrix** CLI is a **product**. User-visible strings must not encode internal engineering artifacts.
+
+## Forbidden in product paths
+
+Applies to **`lib/cli/**`**, **`lib/commands/**`**, CLI help (Commander `.description()` / `.option()` / `addHelpText`), **`lib/utils/*-error*.js`**, terminal messages from **`lib/utils/cli-*`**, and **`docs/commands/**`** (see [docs-rules.mdc](./docs-rules.mdc)).
+
+| Do not use | Use instead |
+| ---------- | ----------- |
+| Internal plan IDs (`Plan 331`, `plan 148`, `BK-1`) | User terms: *active datasource schema guards*, *schema replacement*, *overlap* |
+| Training / lab-only system keys baked into `if` branches (`sharepoint-e2e`, `hubspot-demo` in runtime logic) | **Dynamic** behavior from `systemKey`, `appName`, manifest, env.template, or secrets map |
+| Hardcoded vendor or connector names in generic helpers | Generic rules (path suffix, namespace, configuration keys from disk) |
+| Cursor plan file paths in errors or help | Link only in `.cursor/plans/` and contributor docs |
+
+**Examples in docs/commands** may name real apps (`hubspot-e2e`) when illustrating a command; **library code** must not special-case those names unless the user passed them as arguments.
+
+## Required patterns
+
+- **Missing `kv://` secrets:** Compare requested paths to the loaded secrets map generically (e.g. same path segment under a different namespace). Never hardcode `sharepoint` / `sharepoint-e2e` (or any other lab pair) in `lib/`.
+- **`--force` messaging:** Describe dataplane behavior (*bypass active-datasource schema replacement guards*), not internal plan numbers. Do **not** append extra CLI hints by matching English substrings on API errors — the dataplane pipeline already returns remediation in the 400 body when schema replacement is blocked.
+- **No `upload-pipeline-error-hints`-style modules:** Prefer forwarding `formatApiError` output; optional hints belong in the API contract, not duplicated heuristics in the CLI.
+- **Auth / pipeline errors:** Describe what the user can do (`aifabrix login`, `AIFABRIX_DEPLOYMENT_AUTH=client-credentials`), not ticket or plan IDs.
+- **JSDoc `@fileoverview`:** No plan numbers; optional brief behavior description only.
+
+## Verification
+
+Before merging CLI UX changes:
+
+1. `rg -i 'plan [0-9]|BK-[0-9]|sharepoint-e2e' lib/cli lib/commands lib/utils --glob '*.js'` → no matches in generic helpers (fixture strings in tests are OK).
+2. New error hints must work for **any** integration folder name the user owns.
+3. [cli-layout.mdc](./cli-layout.mdc) and [docs-rules.mdc](./docs-rules.mdc) still apply for glyphs and user-doc scope.
+
+## Related
+
+- [cli-layout.mdc](./cli-layout.mdc) — terminal layout and output profiles
+- [docs-rules.mdc](./docs-rules.mdc) — public CLI documentation audience
+- [project-rules.mdc](./project-rules.mdc) — ISO / security baseline

package/.cursor/rules/docs-rules.mdc

@@ -5,10 +5,12 @@ alwaysApply: true
 
 ## Audience
 
-Documents under **docs/** (including **docs/commands/**) are **CLI developer / user documentation**. The audience is people who use the AI Fabrix Builder CLI or integrate it into workflows. They do not need to know how the CLI talks to the Controller or Dataplane over HTTP.
+Documents under **docs/** (including **docs/commands/**) are **public CLI user documentation**. The audience is people who use the AI Fabrix Builder CLI or integrate it into workflows—they may **not** have access to private monorepos (dataplane, miso-controller, internal plans). They do not need to know how the CLI talks to the Controller or Dataplane over HTTP.
 
 ## Do Not Include in CLI User Docs
 
+- **Links or paths into other product repos (FORBIDDEN)** – No markdown links, examples, or prerequisites that point at private/sibling repositories or their trees: `../../../aifabrix-dataplane/...`, `../../aifabrix-miso/...`, `packages/miso-controller/...`, `integration/<fixture>/README.md` in another repo, `.cursor/plans/` anywhere, `/workspace/...` monorepo layouts, or “see the dataplane/miso-controller repo”. **Only** cross-link within **`docs/`** and use on-disk paths the user owns (`integration/<systemKey>/...`, `builder/<appKey>/...`, `~/.aifabrix/...`).
+- **Internal plan or ticket IDs** – No “Plan 407.1”, “plan section 2.3”, or similar; describe behavior in user terms.
 - **REST API details** – No HTTP methods, URL paths, or endpoint names (e.g. `GET /api/v1/...`, `POST .../pipeline/upload`).
 - **Request/response shapes** – No payload structures, status codes, or field names from backend APIs.
 - **Backend implementation terms** – Avoid referring to “pipeline config endpoint”, “upload endpoint”, or similar; describe what the **command** does from the user’s perspective.

package/.cursor/rules/project-rules.mdc

@@ -894,6 +894,7 @@ Define request/response types using JSDoc `@typedef`:
 
 ### Must Not Do (❌)
 - ❌ Never hardcode secrets, passwords, or tokens
+- ❌ Never hardcode lab/training integration names, vendor names, or internal plan IDs in generic CLI/helpers (`lib/commands/**`, `lib/cli/**`, shared `lib/utils/*-error*.js`); use dynamic keys from user input, manifests, and secrets — see [cli-product-neutral.mdc](cli-product-neutral.mdc)
 - ❌ Never expose sensitive data in error messages
 - ❌ Never use synchronous file operations in async functions (unless necessary)
 - ❌ Never ignore errors or use empty catch blocks

package/README.md

@@ -23,12 +23,12 @@ Open developer runtime for AI Fabrix ecosystem. Install the AI Fabrix platform a
 ## Prerequisites
 
 - **Node.js 18+** – Recommended for running the CLI.
-- **AI Fabrix Azure / platform:** Install from **Azure Marketplace** or run via **Docker** (e.g. `aifabrix up-platform`). You need **full access to Docker** (docker commands) where applicable.
-- **Secrets before platform:** Add secrets (e.g. OpenAI or Azure OpenAI) **before** running `aifabrix up-platform`; the platform reads them from the place you configure. See [Infrastructure](docs/infrastructure.md) and secrets configuration.
+- **Docker Desktop** – Full access to Docker (containers for infra and platform).
+- **Secrets before platform:** Add an AI tool key (OpenAI or Azure OpenAI) in setup or with `aifabrix secret set` **before** the platform needs them. See [Infrastructure](docs/infrastructure.md).
 
 ---
 
-## Install
+## Install the CLI
 
 ```bash
 npm install -g @aifabrix/builder
@@ -38,33 +38,59 @@ npm install -g @aifabrix/builder
 
 ---
 
-## Goal 1: Start and test the AI Fabrix platform
+## Goal 1: Install the platform (one command)
 
-Get the platform running locally so you can try it.
-
-**One-shot install:**
+Get Postgres, Redis, Keycloak, Miso Controller, and Dataplane running on your machine.
 
 ```bash
 aifabrix setup
 ```
 
-`aifabrix setup` detects your local state and either runs a fresh-install wizard (admin email/password, optional AI tool keys) or shows a mode menu (re-install, wipe data, clean files, update images). It then runs `up-infra` and `up-platform` for you. Use `aifabrix teardown` to fully remove the local installation. See [Infrastructure commands](docs/commands/infrastructure.md#aifabrix-setup) for details and CI flags.
+That is the whole story for most developers. The command detects whether infra is already running:
+
+| Situation | What happens |
+| --- | --- |
+| **Fresh machine** | Short wizard → pull images → `up-infra` → `up-platform` |
+| **Already installed** | Mode menu (3 choices): **re-install** (destroys volumes), **wipe data** (DBs only), or **update images** (keeps data) — each path pulls fresh Docker images before restart |
+
+**Grab a coffee** — setup pulls infrastructure and platform images (a few minutes on first run or after image updates). When setup finishes, the CLI stores **`platform-controller`** in `config.yaml` (absolute Miso URL for your machine). Sign in with username **`admin`** and your admin password. If you were already logged in to that controller URL, setup keeps your session; otherwise it prompts for device login like a fresh install.
+
+**Controller URL:** Local Docker without Traefik uses `http://localhost:` + port `3000 + developerId×100`. With Traefik and `remote-server`, use the public URL shown in the **Platform Ready** footer (path `/miso/*`). See [Infrastructure guide](docs/infrastructure.md#install-the-platform-one-command).
+
+→ Step-by-step detail, ports, and **dev / pro** installation profiles: **[Infrastructure guide](docs/infrastructure.md#install-the-platform-one-command)**
+
+### Dev vs pro installation (setup profile)
+
+These names match how we talk about **environments** elsewhere (**dev**, **tst**, **pro**). Here they mean **how you install locally**, not which cloud environment you deploy to later.
+
+| Profile | Best for | Admin email | Admin passwords |
+| --- | --- | --- | --- |
+| **dev** (default) | Local development, training, labs | You enter once | **One password** for Postgres, pgAdmin, Keycloak, and platform login |
+| **pro** | Production-style or hardened installs | Same | **Autogenerate** strong passwords (shown once) **or** enter manually |
 
-If you prefer to set the AI tool key outside the wizard, use one of:
+**Default:** **dev** (one email, one password). **Pro** is available in the setup wizard or non-interactively:
 
-- **OpenAI:** set your API key:
+```bash
+aifabrix setup --installation pro --pro-password-mode autogen
+```
+
+Use `--pro-password-mode manual` to enter passwords yourself (one password for all roles, or separate infra / Keycloak / platform passwords via `up-infra` flags).
+
+Admin credentials are stored in **`~/.aifabrix/admin-secrets.env`** (encrypted when you configure a secrets encryption key). App and integration secrets stay in **`~/.aifabrix/secrets.local.yaml`**.
+
+### Optional: set AI keys outside the wizard
+
+- **OpenAI:**
   ```bash
   aifabrix secret set secrets-openaiApiKeyVault <your-openai-secret-key>
   ```
-- **Azure OpenAI:** set endpoint and API key:
+- **Azure OpenAI:**
   ```bash
   aifabrix secret set azure-openaiapi-urlKeyVault <your-azure-openai-endpoint-url>
   aifabrix secret set secrets-azureOpenaiApiKeyVault <your-azure-openai-secret-key>
   ```
 
-Secrets are stored in `~/.aifabrix/secrets.local.yaml` or the file from `aifabrix-secrets` in your config (e.g. `builder/secrets.local.yaml`).
-
-→ [Infrastructure guide](docs/infrastructure.md)
+Remove the platform completely: `aifabrix teardown`. Command details: [Infrastructure commands](docs/commands/infrastructure.md#aifabrix-setup).
 
 ---
 
@@ -72,7 +98,7 @@ Secrets are stored in `~/.aifabrix/secrets.local.yaml` or the file from `aifabri
 
 Create and deploy an external system (e.g. HubSpot): wizard or manual setup, then validate and deploy.
 
-**Example: HubSpot**
+**Example: HubSpot:**
 
 - Create: `aifabrix create hubspot-test` (external is the default; or `aifabrix wizard` for guided setup). For a web app use `aifabrix create my-app --type webapp`.
 - Configure auth and datasources under `integration/hubspot-test/`.
@@ -96,7 +122,7 @@ Create, configure, and run your own AI Fabrix application locally or deploy it (
 All guides and references are listed in **[docs/README.md](docs/README.md)** (table of contents).
 
 - [CLI Commands Reference](docs/commands/README.md) – All commands
-- [Infrastructure](docs/infrastructure.md) – What runs and why
+- [Infrastructure](docs/infrastructure.md) – Install the platform, services, dev/pro setup
 - [Configuration reference](docs/configuration/README.md) – Config files (deployment key, application.yaml, env.template, secrets)
 
 ---
@@ -111,6 +137,6 @@ All guides and references are listed in **[docs/README.md](docs/README.md)** (ta
 
 ## License
 
-© eSystems Nordic Ltd 2025 - All Rights Reserved
+© eSystems Nordic Ltd 2026 - All Rights Reserved
 
 `@aifabrix/builder` is part of the AI Fabrix platform.

package/integration/hubspot-test/wizard-hubspot-e2e.yaml

@@ -2,7 +2,7 @@ appName: wizard-e2e-e2e
 mode: create-system
 source:
   type: openapi-file
-  filePath: /workspace/aifabrix-builder/integration/hubspot-test/companies.json
+  filePath: ./integration/hubspot-test/companies.json
 credential:
   action: skip
 preferences:

package/jest.config.default.js

@@ -3,8 +3,9 @@
  * @fileoverview
  */
 
-const { defaultProject } = require('./jest.projects');
+const { defaultProject, globalLiveFabrixHooks } = require('./jest.projects');
 
 module.exports = {
+  ...globalLiveFabrixHooks,
   projects: [defaultProject]
 };

package/jest.config.isolated.js

@@ -3,8 +3,9 @@
  * @fileoverview
  */
 
-const { isolatedProjects } = require('./jest.projects');
+const { isolatedProjects, globalLiveFabrixHooks } = require('./jest.projects');
 
 module.exports = {
+  ...globalLiveFabrixHooks,
   projects: isolatedProjects
 };

package/jest.global-live-fabrix-hooks.js

@@ -0,0 +1,36 @@
+/**
+ * Global Jest hooks and CI guard project for live ~/.aifabrix protection.
+ * @fileoverview
+ */
+
+/** Once per Jest process — protects live ~/.aifabrix (incl. /workspace/.aifabrix). */
+const globalLiveFabrixHooks = {
+  globalSetup: '<rootDir>/tests/global-live-fabrix-backup.js',
+  globalTeardown: '<rootDir>/tests/global-live-fabrix-backup.js'
+};
+
+/**
+ * @param {object} opts - CI flag and Babel transform config from jest.projects.js
+ * @param {boolean} opts.isCI - Whether CI or CI simulation is active
+ * @param {object} opts.sharedTransform - Shared babel-jest transform map
+ * @returns {object} Jest project configuration
+ */
+function createSetupCiLiveFabrixGuardProject({ isCI, sharedTransform }) {
+  return {
+    displayName: 'setup-ci-live-fabrix-guard',
+    testEnvironment: 'node',
+    transform: sharedTransform,
+    testMatch: ['**/tests/setup-ci-live-fabrix-guard.test.js'],
+    testPathIgnorePatterns: ['/node_modules/', '\\\\node_modules\\\\'],
+    setupFiles: ['<rootDir>/tests/capture-real-fs.js', '<rootDir>/tests/setup-ci-env.js'],
+    setupFilesAfterEnv: ['<rootDir>/tests/setup.js'],
+    testTimeout: isCI ? 15000 : 8000,
+    maxWorkers: 1,
+    ...globalLiveFabrixHooks
+  };
+}
+
+module.exports = {
+  globalLiveFabrixHooks,
+  createSetupCiLiveFabrixGuardProject
+};

package/jest.isolated-projects.js

@@ -0,0 +1,130 @@
+/**
+ * Jest isolated project list (separate process per suite when run via jest.config.isolated.js).
+ * @fileoverview
+ */
+
+'use strict';
+
+const { createSetupCiLiveFabrixGuardProject } = require('./jest.global-live-fabrix-hooks');
+
+/** @type {[string, string[]][]} displayName and testMatch globs */
+const ISOLATED_SUITE_ENTRIES = [
+  ['cli-utils', ['**/tests/lib/utils/cli-utils.test.js']],
+  ['external-system-display', ['**/tests/lib/utils/external-system-display.test.js']],
+  ['dev-hosts-helper', ['**/tests/lib/utils/dev-hosts-helper.test.js']],
+  ['parameters-validate', ['**/tests/lib/commands/parameters-validate.test.js']],
+  ['test-e2e-external', ['**/tests/lib/commands/test-e2e-external.test.js']],
+  ['repair-openapi-sync', ['**/tests/lib/commands/repair-openapi-sync.test.js']],
+  ['paths-app-listing', ['**/tests/lib/utils/paths-app-listing.test.js']],
+  ['paths-system-builder-resolution', ['**/tests/lib/utils/paths-system-builder-resolution.test.js']],
+  ['manifest-location', ['**/tests/lib/utils/manifest-location.test.js']],
+  ['installation-log', ['**/tests/lib/utils/installation-log.test.js']],
+  ['secrets-ancestor-paths', ['**/tests/lib/utils/secrets-ancestor-paths.test.js']],
+  ['datasource-validation-watch', ['**/tests/lib/utils/datasource-validation-watch.test.js']],
+  [
+    'log-viewer',
+    [
+      '**/tests/lib/datasource/log-viewer.test.js',
+      '**/tests/lib/datasource/log-viewer-structural.test.js',
+      '**/tests/lib/datasource/log-viewer-run.test.js'
+    ]
+  ],
+  ['audit-evidence-extract', ['**/tests/lib/datasource/audit-evidence-extract.test.js']],
+  ['manifest-source-emit', ['**/tests/lib/utils/manifest-source-emit.test.js']],
+  ['register-aifabrix-shell-env', ['**/tests/lib/utils/register-aifabrix-shell-env.test.js']],
+  ['datasource-test-run-schema-sync', ['**/tests/lib/utils/datasource-test-run-schema-sync.test.js']],
+  ['infra-platform-contract', ['**/tests/lib/parameters/infra-platform-contract.test.js']],
+  [
+    'application-frontdoor-paths-contract',
+    ['**/tests/lib/templates/application-frontdoor-paths.contract.test.js']
+  ],
+  ['database-secret-values', ['**/tests/lib/parameters/database-secret-values.test.js']],
+  ['infra-parameter-validate', ['**/tests/lib/parameters/infra-parameter-validate.test.js']],
+  ['infra-parameter-catalog', ['**/tests/lib/parameters/infra-parameter-catalog.test.js']],
+  ['urls-local-registry', ['**/tests/lib/utils/urls-local-registry.test.js']],
+  ['aifabrix-runtime-config-dir', ['**/tests/lib/utils/aifabrix-runtime-config-dir.test.js']],
+  ['platform-env-template-kv-catalog', ['**/tests/lib/parameters/platform-env-template-kv-catalog.test.js']],
+  ['resolve-infra-state-paths', ['**/tests/lib/infrastructure/resolve-infra-state-paths.test.js']],
+  ['dev-ssh-config-helper', ['**/tests/lib/utils/dev-ssh-config-helper.test.js']],
+  ['ssh-key-helper', ['**/tests/lib/utils/ssh-key-helper.test.js']],
+  ['secrets-ensure-catalog-fallback', ['**/tests/lib/core/secrets-ensure-catalog-fallback.test.js']],
+  ['secrets-ensure', ['**/tests/lib/core/secrets-ensure.test.js']],
+  ['url-declarative-vdir-inactive-env', ['**/tests/lib/utils/url-declarative-vdir-inactive-env.test.js']],
+  [
+    'url-declarative-user-cfg-per-app-proxy',
+    ['**/tests/lib/utils/url-declarative-user-cfg-per-app-proxy.test.js']
+  ],
+  [
+    'declarative-url-paths-spy-suites',
+    [
+      '**/tests/lib/utils/url-declarative-expand-traefik-off-no-usercfg.test.js',
+      '**/tests/lib/core/secrets-env-declarative-show-urls.test.js',
+      '**/tests/lib/utils/url-declarative-registry-internal-docker-origin.test.js'
+    ]
+  ],
+  ['platform-urls-registry-validation', ['**/tests/lib/commands/platform-urls-registry.validation.test.js']],
+  ['env-copy-resolve-output', ['**/tests/lib/utils/env-copy-resolve-output.test.js']],
+  ['write-env-output-reload', ['**/tests/lib/utils/write-env-output-reload.test.js']],
+  ['app-service-env-from-builder', ['**/tests/lib/utils/app-service-env-from-builder.test.js']],
+  ['infra-kv-discovery', ['**/tests/lib/parameters/infra-kv-discovery.test.js']],
+  ['infra-env-defaults', ['**/tests/lib/utils/infra-env-defaults.test.js']],
+  ['compose-traefik-template', ['**/tests/lib/infrastructure/compose-traefik-template.test.js']],
+  ['generator-external-rbac', ['**/tests/lib/generator/generator-external-rbac.test.js']],
+  ['helpers-ensure-admin-secrets', ['**/tests/lib/infrastructure/helpers-ensure-admin-secrets.test.js']],
+  ['secrets-generator', ['**/tests/lib/utils/secrets-generator.test.js']],
+  ['ensure-dev-certs-for-remote-docker', ['**/tests/lib/utils/ensure-dev-certs-for-remote-docker.test.js']],
+  ['generator-error-paths', ['**/tests/lib/generator/generator-error-paths.test.js']],
+  ['generator-validation', ['**/tests/lib/generator/generator-validation.test.js']],
+  ['secrets-databaselog', ['**/tests/lib/core/secrets-databaselog.test.js']],
+  ['schema-241-alignment', ['**/tests/lib/validation/schema-241-alignment.test.js']],
+  ['schema-resolver-order', ['**/tests/lib/utils/schema-resolver-order.test.js']],
+  ['app-module', ['**/tests/lib/app/app.test.js']],
+  ['admin-secrets', ['**/tests/lib/core/admin-secrets.test.js']],
+  ['validate-datasource-parsed', ['**/tests/lib/datasource/validate-datasource-parsed.test.js']],
+  [
+    'capability-run-real-fs',
+    [
+      '**/tests/lib/datasource/run-capability-copy.test.js',
+      '**/tests/lib/datasource/run-capability-diff.test.js',
+      '**/tests/lib/datasource/run-capability-edit.test.js',
+      '**/tests/lib/datasource/run-capability-remove.test.js'
+    ]
+  ],
+  ['log-cleaner', ['**/tests/lib/datasource/log-cleaner.test.js']],
+  ['datasource-exporter-service', ['**/tests/lib/datasource/datasource-exporter-service.test.js']],
+  ['protection-paths', ['**/tests/lib/protection/paths.test.js']],
+  ['protection-resolve', ['**/tests/lib/protection/protection-resolve.test.js']],
+  ['protection-create-helpers', ['**/tests/lib/protection/run-protection-create-helpers.test.js']],
+  [
+    'governance-pack-loader',
+    [
+      '**/tests/lib/governance/governance-pack-loader.test.js',
+      '**/tests/lib/lifecycle/scenario-upload.test.js'
+    ]
+  ],
+  [
+    'governance-generate-external',
+    ['**/tests/lib/commands/governance-generate-external.test.js']
+  ],
+  ['protection-validate-batch', ['**/tests/lib/protection/validate-batch.test.js']],
+  ['aifabrix-runtime-sandbox', ['**/tests/helpers/aifabrix-runtime-sandbox.test.js']],
+  ['aifabrix-runtime-backup', ['**/tests/helpers/aifabrix-runtime-backup.test.js']],
+  ['paths-jest-sandbox-integration', ['**/tests/lib/utils/paths-jest-sandbox-integration.test.js']],
+  ['secrets-remove-all-guard', ['**/tests/lib/commands/secrets-remove-all-guard.test.js']]
+];
+
+/**
+ * @param {Function} makeIsolatedProject - Factory from jest.projects.js
+ * @param {boolean} isCI - True when CI or CI_SIMULATION is set
+ * @param {object} sharedTransform - Babel-jest transform shared with default project
+ * @returns {object[]} Jest multi-project entries
+ */
+function buildIsolatedProjects(makeIsolatedProject, isCI, sharedTransform) {
+  const projects = ISOLATED_SUITE_ENTRIES.map(([name, testMatch]) =>
+    makeIsolatedProject(name, testMatch)
+  );
+  projects.push(createSetupCiLiveFabrixGuardProject({ isCI, sharedTransform }));
+  return projects;
+}
+
+module.exports = { buildIsolatedProjects, ISOLATED_SUITE_ENTRIES };

package/jest.projects.js

@@ -4,6 +4,9 @@
  * @fileoverview
  */
 
+const { globalLiveFabrixHooks } = require('./jest.global-live-fabrix-hooks');
+const { buildIsolatedProjects } = require('./jest.isolated-projects');
+
 // Detect CI environment (GitHub Actions, CI simulation, etc.)
 const isCI = process.env.CI === 'true' || process.env.CI_SIMULATION === 'true';
 
@@ -31,7 +34,7 @@ function makeIsolatedProject(displayName, testMatch) {
     testPathIgnorePatterns: ['/node_modules/', '\\\\node_modules\\\\'],
     setupFiles: ['<rootDir>/tests/capture-real-fs.js'],
     setupFilesAfterEnv: ['<rootDir>/tests/setup.js'],
-    testTimeout: isCI ? 10000 : 5000,
+    testTimeout: isCI ? 15000 : 8000,
     maxWorkers: 1
   };
 }
@@ -79,10 +82,18 @@ const defaultProject = {
       'lib/datasource/log-viewer-structural.test.js',
       'lib/datasource/log-viewer-run.test.js',
       'log-viewer-run\\.test\\.js',
+      '/tests/lib/datasource/audit-evidence-extract.test.js',
+      '\\\\tests\\\\lib\\\\datasource\\\\audit-evidence-extract.test.js',
+      'lib/datasource/audit-evidence-extract.test.js',
+      'audit-evidence-extract\\.test\\.js',
       '/tests/lib/commands/parameters-validate.test.js',
       '\\\\tests\\\\lib\\\\commands\\\\parameters-validate.test.js',
       'lib/commands/parameters-validate.test.js',
       'parameters-validate\\.test\\.js',
+      '/tests/lib/commands/test-e2e-external.test.js',
+      '\\\\tests\\\\lib\\\\commands\\\\test-e2e-external.test.js',
+      'lib/commands/test-e2e-external.test.js',
+      'test-e2e-external\\.test\\.js',
       '/tests/lib/commands/repair-openapi-sync.test.js',
       '\\\\tests\\\\lib\\\\commands\\\\repair-openapi-sync.test.js',
       'lib/commands/repair-openapi-sync.test.js',
@@ -221,10 +232,6 @@ const defaultProject = {
       '\\\\tests\\\\lib\\\\utils\\\\secrets-generator.test.js',
       'lib/utils/secrets-generator.test.js',
       'secrets-generator\\.test\\.js',
-      '/tests/lib/app/app-uncovered-lines.test.js',
-      '\\\\tests\\\\lib\\\\app\\\\app-uncovered-lines.test.js',
-      'lib/app/app-uncovered-lines.test.js',
-      'app-uncovered-lines\\.test\\.js',
       '/tests/lib/utils/ensure-dev-certs-for-remote-docker.test.js',
       '\\\\tests\\\\lib\\\\utils\\\\ensure-dev-certs-for-remote-docker.test.js',
       'lib/utils/ensure-dev-certs-for-remote-docker.test.js',
@@ -278,7 +285,59 @@ const defaultProject = {
       '/tests/lib/datasource/run-capability-remove.test.js',
       '\\\\tests\\\\lib\\\\datasource\\\\run-capability-remove.test.js',
       'lib/datasource/run-capability-remove.test.js',
-      'run-capability-remove\\.test\\.js'
+      'run-capability-remove\\.test\\.js',
+      '/tests/lib/datasource/log-cleaner.test.js',
+      '\\\\tests\\\\lib\\\\datasource\\\\log-cleaner.test.js',
+      'lib/datasource/log-cleaner.test.js',
+      'log-cleaner\\.test\\.js',
+      '/tests/lib/datasource/datasource-exporter-service.test.js',
+      '\\\\tests\\\\lib\\\\datasource\\\\datasource-exporter-service.test.js',
+      'lib/datasource/datasource-exporter-service.test.js',
+      'datasource-exporter-service\\.test\\.js',
+      '/tests/lib/protection/paths.test.js',
+      '\\\\tests\\\\lib\\\\protection\\\\paths.test.js',
+      'lib/protection/paths.test.js',
+      'protection/paths\\.test\\.js',
+      '/tests/lib/protection/protection-resolve.test.js',
+      '\\\\tests\\\\lib\\\\protection\\\\protection-resolve.test.js',
+      'lib/protection/protection-resolve.test.js',
+      'protection-resolve\\.test\\.js',
+      '/tests/lib/protection/run-protection-create-helpers.test.js',
+      '\\\\tests\\\\lib\\\\protection\\\\run-protection-create-helpers.test.js',
+      'lib/protection/run-protection-create-helpers.test.js',
+      'run-protection-create-helpers\\.test\\.js',
+      '/tests/lib/governance/governance-pack-loader.test.js',
+      '\\\\tests\\\\lib\\\\governance\\\\governance-pack-loader.test.js',
+      'lib/governance/governance-pack-loader.test.js',
+      'governance-pack-loader\\.test\\.js',
+      '/tests/lib/lifecycle/scenario-upload.test.js',
+      '\\\\tests\\\\lib\\\\lifecycle\\\\scenario-upload.test.js',
+      'lib/lifecycle/scenario-upload.test.js',
+      'scenario-upload\\.test\\.js',
+      '/tests/lib/commands/governance-generate-external.test.js',
+      '\\\\tests\\\\lib\\\\commands\\\\governance-generate-external.test.js',
+      'lib/commands/governance-generate-external.test.js',
+      'governance-generate-external\\.test\\.js',
+      '/tests/lib/protection/validate-batch.test.js',
+      '\\\\tests\\\\lib\\\\protection\\\\validate-batch.test.js',
+      'lib/protection/validate-batch.test.js',
+      'validate-batch\\.test\\.js',
+      '/tests/helpers/aifabrix-runtime-sandbox.test.js',
+      '\\\\tests\\\\helpers\\\\aifabrix-runtime-sandbox.test.js',
+      'helpers/aifabrix-runtime-sandbox\\.test\\.js',
+      '/tests/helpers/aifabrix-runtime-backup.test.js',
+      '\\\\tests\\\\helpers\\\\aifabrix-runtime-backup.test.js',
+      'helpers/aifabrix-runtime-backup\\.test\\.js',
+      '/tests/lib/utils/paths-jest-sandbox-integration.test.js',
+      '\\\\tests\\\\lib\\\\utils\\\\paths-jest-sandbox-integration.test.js',
+      'paths-jest-sandbox-integration\\.test\\.js',
+      '/tests/lib/commands/secrets-remove-all-guard.test.js',
+      '\\\\tests\\\\lib\\\\commands\\\\secrets-remove-all-guard.test.js',
+      'lib/commands/secrets-remove-all-guard.test.js',
+      'secrets-remove-all-guard\\.test\\.js',
+      '/tests/setup-ci-live-fabrix-guard.test.js',
+      '\\\\tests\\\\setup-ci-live-fabrix-guard.test.js',
+      'setup-ci-live-fabrix-guard\\.test\\.js'
     ];
     if (process.env.INCLUDE_LOCAL_TESTS !== 'true') {
       patterns.push('/tests/local/');
@@ -288,124 +347,12 @@ const defaultProject = {
   })(),
   setupFiles: ['<rootDir>/tests/capture-real-fs.js'],
   setupFilesAfterEnv: ['<rootDir>/tests/setup.js'],
-  testTimeout: isCI ? 10000 : 5000,
+  testTimeout: isCI ? 15000 : 8000,
   detectOpenHandles: true,
   maxWorkers: 1
 };
 
-const isolatedProjects = [
-  makeIsolatedProject('cli-utils', ['**/tests/lib/utils/cli-utils.test.js']),
-  makeIsolatedProject('external-system-display', ['**/tests/lib/utils/external-system-display.test.js']),
-  makeIsolatedProject('dev-hosts-helper', ['**/tests/lib/utils/dev-hosts-helper.test.js']),
-  makeIsolatedProject('parameters-validate', ['**/tests/lib/commands/parameters-validate.test.js']),
-  makeIsolatedProject('repair-openapi-sync', ['**/tests/lib/commands/repair-openapi-sync.test.js']),
-  makeIsolatedProject('paths-app-listing', ['**/tests/lib/utils/paths-app-listing.test.js']),
-  makeIsolatedProject('paths-system-builder-resolution', [
-    '**/tests/lib/utils/paths-system-builder-resolution.test.js'
-  ]),
-  makeIsolatedProject('manifest-location', ['**/tests/lib/utils/manifest-location.test.js']),
-  makeIsolatedProject('installation-log', ['**/tests/lib/utils/installation-log.test.js']),
-  makeIsolatedProject('secrets-ancestor-paths', ['**/tests/lib/utils/secrets-ancestor-paths.test.js']),
-  makeIsolatedProject('datasource-validation-watch', [
-    '**/tests/lib/utils/datasource-validation-watch.test.js'
-  ]),
-  makeIsolatedProject('log-viewer', [
-    '**/tests/lib/datasource/log-viewer.test.js',
-    '**/tests/lib/datasource/log-viewer-structural.test.js',
-    '**/tests/lib/datasource/log-viewer-run.test.js'
-  ]),
-  makeIsolatedProject('manifest-source-emit', ['**/tests/lib/utils/manifest-source-emit.test.js']),
-  makeIsolatedProject('register-aifabrix-shell-env', [
-    '**/tests/lib/utils/register-aifabrix-shell-env.test.js'
-  ]),
-  makeIsolatedProject('datasource-test-run-schema-sync', [
-    '**/tests/lib/utils/datasource-test-run-schema-sync.test.js'
-  ]),
-  makeIsolatedProject('infra-platform-contract', [
-    '**/tests/lib/parameters/infra-platform-contract.test.js'
-  ]),
-  makeIsolatedProject('application-frontdoor-paths-contract', [
-    '**/tests/lib/templates/application-frontdoor-paths.contract.test.js'
-  ]),
-  makeIsolatedProject('database-secret-values', [
-    '**/tests/lib/parameters/database-secret-values.test.js'
-  ]),
-  makeIsolatedProject('infra-parameter-validate', [
-    '**/tests/lib/parameters/infra-parameter-validate.test.js'
-  ]),
-  makeIsolatedProject('infra-parameter-catalog', [
-    '**/tests/lib/parameters/infra-parameter-catalog.test.js'
-  ]),
-  makeIsolatedProject('urls-local-registry', ['**/tests/lib/utils/urls-local-registry.test.js']),
-  makeIsolatedProject('aifabrix-runtime-config-dir', [
-    '**/tests/lib/utils/aifabrix-runtime-config-dir.test.js'
-  ]),
-  makeIsolatedProject('platform-env-template-kv-catalog', [
-    '**/tests/lib/parameters/platform-env-template-kv-catalog.test.js'
-  ]),
-  makeIsolatedProject('resolve-infra-state-paths', [
-    '**/tests/lib/infrastructure/resolve-infra-state-paths.test.js'
-  ]),
-  makeIsolatedProject('dev-ssh-config-helper', [
-    '**/tests/lib/utils/dev-ssh-config-helper.test.js'
-  ]),
-  makeIsolatedProject('ssh-key-helper', ['**/tests/lib/utils/ssh-key-helper.test.js']),
-  makeIsolatedProject('secrets-ensure-catalog-fallback', [
-    '**/tests/lib/core/secrets-ensure-catalog-fallback.test.js'
-  ]),
-  makeIsolatedProject('secrets-ensure', ['**/tests/lib/core/secrets-ensure.test.js']),
-  makeIsolatedProject('url-declarative-vdir-inactive-env', [
-    '**/tests/lib/utils/url-declarative-vdir-inactive-env.test.js'
-  ]),
-  makeIsolatedProject('url-declarative-user-cfg-per-app-proxy', [
-    '**/tests/lib/utils/url-declarative-user-cfg-per-app-proxy.test.js'
-  ]),
-  makeIsolatedProject('declarative-url-paths-spy-suites', [
-    '**/tests/lib/utils/url-declarative-expand-traefik-off-no-usercfg.test.js',
-    '**/tests/lib/core/secrets-env-declarative-show-urls.test.js',
-    '**/tests/lib/utils/url-declarative-registry-internal-docker-origin.test.js'
-  ]),
-  makeIsolatedProject('platform-urls-registry-validation', [
-    '**/tests/lib/commands/platform-urls-registry.validation.test.js'
-  ]),
-  makeIsolatedProject('env-copy-resolve-output', ['**/tests/lib/utils/env-copy-resolve-output.test.js']),
-  makeIsolatedProject('write-env-output-reload', ['**/tests/lib/utils/write-env-output-reload.test.js']),
-  makeIsolatedProject('app-service-env-from-builder', [
-    '**/tests/lib/utils/app-service-env-from-builder.test.js'
-  ]),
-  makeIsolatedProject('infra-kv-discovery', ['**/tests/lib/parameters/infra-kv-discovery.test.js']),
-  makeIsolatedProject('infra-env-defaults', ['**/tests/lib/utils/infra-env-defaults.test.js']),
-  makeIsolatedProject('compose-traefik-template', [
-    '**/tests/lib/infrastructure/compose-traefik-template.test.js'
-  ]),
-  makeIsolatedProject('generator-external-rbac', [
-    '**/tests/lib/generator/generator-external-rbac.test.js'
-  ]),
-  makeIsolatedProject('helpers-ensure-admin-secrets', [
-    '**/tests/lib/infrastructure/helpers-ensure-admin-secrets.test.js'
-  ]),
-  makeIsolatedProject('secrets-generator', ['**/tests/lib/utils/secrets-generator.test.js']),
-  makeIsolatedProject('app-uncovered-lines', ['**/tests/lib/app/app-uncovered-lines.test.js']),
-  makeIsolatedProject('ensure-dev-certs-for-remote-docker', [
-    '**/tests/lib/utils/ensure-dev-certs-for-remote-docker.test.js'
-  ]),
-  makeIsolatedProject('generator-error-paths', ['**/tests/lib/generator/generator-error-paths.test.js']),
-  makeIsolatedProject('generator-validation', ['**/tests/lib/generator/generator-validation.test.js']),
-  makeIsolatedProject('secrets-databaselog', ['**/tests/lib/core/secrets-databaselog.test.js']),
-  makeIsolatedProject('schema-241-alignment', ['**/tests/lib/validation/schema-241-alignment.test.js']),
-  makeIsolatedProject('schema-resolver-order', ['**/tests/lib/utils/schema-resolver-order.test.js']),
-  makeIsolatedProject('app-module', ['**/tests/lib/app/app.test.js']),
-  makeIsolatedProject('admin-secrets', ['**/tests/lib/core/admin-secrets.test.js']),
-  makeIsolatedProject('validate-datasource-parsed', [
-    '**/tests/lib/datasource/validate-datasource-parsed.test.js'
-  ]),
-  makeIsolatedProject('capability-run-real-fs', [
-    '**/tests/lib/datasource/run-capability-copy.test.js',
-    '**/tests/lib/datasource/run-capability-diff.test.js',
-    '**/tests/lib/datasource/run-capability-edit.test.js',
-    '**/tests/lib/datasource/run-capability-remove.test.js'
-  ])
-];
+const isolatedProjects = buildIsolatedProjects(makeIsolatedProject, isCI, sharedTransform);
 
 const allProjects = [defaultProject, ...isolatedProjects];
 
@@ -415,5 +362,6 @@ module.exports = {
   makeIsolatedProject,
   defaultProject,
   isolatedProjects,
-  allProjects
+  allProjects,
+  globalLiveFabrixHooks
 };