@aifabrix/builder 2.45.0 → 2.46.0

package/lib/cli/setup-utility-validate.js

@@ -0,0 +1,197 @@
+/**
+ * `aifabrix validate` and `diff` command wiring (split from setup-utility for size limits).
+ *
+ * @fileoverview Validate and diff CLI commands
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { handleCommandError } = require('../utils/cli-utils');
+const { VALIDATE_HELP_AFTER } = require('./setup-utility-help-after');
+
+/**
+ * @param {string} appOrFile
+ * @param {object} result
+ * @param {string} outFormat
+ */
+function emitManifestAfterValidateIfApplicable(appOrFile, result, outFormat) {
+  if (outFormat === 'json' || !result?.appPath || !appOrFile || typeof appOrFile !== 'string') {
+    return;
+  }
+  try {
+    if (fs.existsSync(appOrFile) && fs.statSync(appOrFile).isFile()) {
+      return;
+    }
+    const { emitManifestMetadataLineIfTTY } = require('../utils/manifest-source-emit');
+    emitManifestMetadataLineIfTTY(logger, {
+      appKey: appOrFile,
+      appPath: result.appPath,
+      envOnly: false,
+      json: false
+    });
+  } catch {
+    /* ignore emit failures */
+  }
+}
+
+/**
+ * @param {object} validate
+ * @param {object} opts
+ * @returns {Promise<boolean>}
+ */
+async function runValidateBatchBranch(validate, opts) {
+  const integration = opts.integration === true;
+  const builder = opts.builder === true;
+  if (!integration && !builder) {
+    return false;
+  }
+  const outFormat = (opts.format || 'default').toLowerCase();
+  const batchResult = integration && builder
+    ? await validate.validateAll(opts)
+    : integration
+      ? await validate.validateAllIntegrations(opts)
+      : await validate.validateAllBuilderApps(opts);
+  if (outFormat === 'json') {
+    logger.log(JSON.stringify(batchResult, null, 2));
+  } else {
+    validate.displayBatchValidationResults(batchResult);
+  }
+  if (!batchResult.valid) process.exit(1);
+  return true;
+}
+
+/**
+ * @param {string} appOrFile
+ * @param {object} opts
+ * @returns {Promise<void>}
+ */
+async function runProtectionValidateBranch(appOrFile, opts) {
+  const { validateProtectionBatchCommand } = require('../protection/validate-batch');
+  const code = await validateProtectionBatchCommand(
+    {
+      env: opts.env,
+      json: (opts.format || '').toLowerCase() === 'json',
+      warningsAsErrors: opts.warningsAsErrors === true,
+      simulate: opts.simulate === true,
+      verbose: opts.verbose === true
+    },
+    logger
+  );
+  if (code !== 0) {
+    process.exit(code);
+  }
+}
+
+/**
+ * @param {object} result
+ * @param {string} appOrFile
+ * @returns {object}
+ */
+function buildValidateJsonPayload(result, appOrFile) {
+  let payload = result;
+  try {
+    if (result?.appPath && appOrFile && typeof appOrFile === 'string') {
+      if (!(fs.existsSync(appOrFile) && fs.statSync(appOrFile).isFile())) {
+        const { getManifestSourcePayload } = require('../utils/manifest-source-emit');
+        payload = { ...result, manifestSource: getManifestSourcePayload(appOrFile, result.appPath) };
+      }
+    }
+  } catch {
+    /* keep plain result */
+  }
+  return payload;
+}
+
+/**
+ * @param {string} appOrFile
+ * @param {object} result
+ * @param {string} outFormat
+ * @param {object} validate
+ */
+function displaySingleValidateResult(appOrFile, result, outFormat, validate) {
+  emitManifestAfterValidateIfApplicable(appOrFile, result, outFormat);
+  if (outFormat === 'json') {
+    logger.log(JSON.stringify(buildValidateJsonPayload(result, appOrFile), null, 2));
+    return;
+  }
+  validate.displayValidationResults(result);
+}
+
+/**
+ * @param {string} appOrFile
+ * @param {object} options
+ * @returns {Promise<void>}
+ */
+async function runValidateCommand(appOrFile, options) {
+  const validate = require('../validation/validate');
+  const opts = options.opts ? options.opts() : options;
+  const { isProtectionScope } = require('../protection/scope');
+  if (isProtectionScope(appOrFile)) {
+    await runProtectionValidateBranch(appOrFile, opts);
+    return;
+  }
+  if (await runValidateBatchBranch(validate, opts)) {
+    return;
+  }
+  const outFormat = (opts.format || 'default').toLowerCase();
+  if (!appOrFile || typeof appOrFile !== 'string') {
+    logger.log(chalk.red('App name or file path is required, or use --integration / --builder'));
+    process.exit(1);
+  }
+  const result = await validate.validateAppOrFile(appOrFile, {
+    ...opts,
+    certSync: opts.certSync === true
+  });
+  displaySingleValidateResult(appOrFile, result, outFormat, validate);
+  if (!result.valid) process.exit(1);
+}
+
+/**
+ * @param {import('commander').Command} program
+ */
+function setupValidateDiffCommands(program) {
+  program.command('validate [appKey|systemKey|file]')
+    .description('Validate appKey, systemKey, file path, .protection batch, or all under integration/ and builder/')
+    .addHelpText('after', VALIDATE_HELP_AFTER)
+    .option('--format <format>', 'Output format: json | default (human-readable)')
+    .option('--integration', 'Validate all applications under integration/')
+    .option('--builder', 'Validate all applications under builder/')
+    .option('--warnings-as-errors', 'For .protection: pass strict=true to dataplane validate')
+    .option('--simulate', 'For .protection: run simulate after validate')
+    .option(
+      '--cert-sync',
+      'After successful validation of an external integration, refresh the system file certification block from the dataplane (requires login)'
+    )
+    .action((appOrFile, options) => {
+      runValidateCommand(appOrFile, options).catch((error) => {
+        handleCommandError(error, 'validate');
+        process.exit(1);
+      });
+    });
+
+  program.command('diff <file1> <file2>')
+    .description('Diff two config files (optional schema validate)')
+    .option('--no-validate', 'Skip schema validation (type check still applied)')
+    .action(async(file1, file2, cmd) => {
+      try {
+        const diff = require('../core/diff');
+        const opts = cmd.opts();
+        const result = await diff.compareFiles(file1, file2, { validate: opts.validate !== false });
+        diff.formatDiffOutput(result);
+        if (!result.identical) process.exit(1);
+      } catch (error) {
+        handleCommandError(error, 'diff');
+        process.exit(1);
+      }
+    });
+}
+
+module.exports = {
+  setupValidateDiffCommands,
+  runValidateCommand
+};

package/lib/cli/setup-utility.js

@@ -1,4 +1,3 @@
-const { formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
 /**
  * CLI utility command setup (resolve, json, split-json, show, validate, diff).
  *
@@ -10,45 +9,15 @@ const { formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
 const path = require('path');
 const fs = require('fs');
 const chalk = require('chalk');
+const { formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
 const generator = require('../generator');
 const logger = require('../utils/logger');
 const { handleCommandError, logOfflinePathWhenType } = require('../utils/cli-utils');
 const { detectAppType, getDeployJsonPath, getResolveAppPath } = require('../utils/paths');
 const { setupResolveCommand } = require('./setup-utility-resolve');
-
-const JSON_HELP_AFTER = `
-Example:
-  $ aifabrix json myapp
-Generates *-deploy.json (or application-schema.json) for commit before deploy.
-`;
-
-const VALIDATE_HELP_AFTER = `
-Examples:
-  $ aifabrix validate myapp
-  $ aifabrix validate myapp --cert-sync
-  $ aifabrix validate --integration
-  $ aifabrix validate --builder
-`;
-
-const REPAIR_HELP_AFTER = `
-Examples:
-  $ aifabrix repair hubspot-demo
-    Align manifest, system/datasource files, RBAC extract, env.template, and deploy JSON under integration/<systemKey>/.
-
-  $ aifabrix repair hubspot-demo --dry-run
-    Show what would change without writing files.
-
-  $ aifabrix repair hubspot-demo --auth oauth2
-    Set authentication method; updates the system file and env.template (oauth2, aad, apikey, basic, …).
-
-  $ aifabrix repair hubspot-demo --rbac --expose --sync --test
-    Optional datasource fixes: RBAC roles/permissions, exposed.schema from attributes, default sync block, testPayload stubs.
-
-  $ aifabrix repair hubspot-demo --doc
-    Regenerate README.md from the current deployment manifest only (other drift fixes unchanged).
-
-  Before overwriting files, repair writes timestamped backups under integration/<systemKey>/backup/ (same as datasource capability copy). Use --no-backup to skip.
-`;
+const { setupRepairCommand } = require('./setup-utility-repair');
+const { setupValidateDiffCommands } = require('./setup-utility-validate');
+const { JSON_HELP_AFTER } = require('./setup-utility-help-after');
 
 /**
  * Resolve app path and type for split-json (integration first, then builder).
@@ -122,7 +91,7 @@ function logSplitJsonResult(result) {
 }
 
 function setupJsonCommand(program) {
-  program.command('json <app>')
+  program.command('json <appKey|systemKey>')
     .description('Write deployment JSON to disk for version control')
     .addHelpText('after', JSON_HELP_AFTER)
     .action(async(appName, options) => {
@@ -156,7 +125,7 @@ function setupJsonCommand(program) {
 }
 
 function setupSplitJsonCommand(program) {
-  program.command('split-json <app>')
+  program.command('split-json <appKey|systemKey>')
     .description('Split deploy JSON into env.template, application.yaml, rbac, README, …')
     .option('-o, --output <dir>', 'Output directory for component files (defaults to same directory as JSON)')
     .action(async(appName, options) => {
@@ -169,126 +138,54 @@ function setupSplitJsonCommand(program) {
     });
 }
 
-function buildRepairExternalIntegrationOptions(appName, options, format) {
-  const all = options.all === true;
-  return {
-    auth: options.auth,
-    doc: options.doc || all,
-    dryRun: options.dryRun,
-    format,
-    rbac: options.rbac || all,
-    expose: options.expose || all,
-    sync: options.sync || all,
-    api: options.api || all,
-    test: options.test || all,
-    backup: options.backup,
-    noBackup: options.noBackup
-  };
-}
-
-function logRepairResult(options, result) {
-  if (options.dryRun && result.updated && result.changes.length > 0) {
-    logger.log(chalk.yellow('\nWould apply:'));
-    result.changes.forEach(c => logger.log(chalk.gray(`  ${c}`)));
-    return;
-  }
-  if (Array.isArray(result.backupPaths) && result.backupPaths.length > 0) {
-    result.backupPaths.forEach((p) => logger.log(chalk.gray(`Backup: ${p}`)));
-  }
-  if (result.updated) {
-    logger.log(formatSuccessParagraph('Repaired external integration config.'));
-    return;
-  }
-  if (Array.isArray(result.changes) && result.changes.length > 0) {
-    logger.log(formatSuccessParagraph('Repair actions completed.'));
-    result.changes.forEach(c => logger.log(chalk.gray(`  ${c}`)));
-    return;
+async function resolveConvertTargetFormat(options) {
+  const config = require('../core/config');
+  const effectiveFormat = options.format || (await config.getFormat());
+  if (!effectiveFormat) {
+    throw new Error(
+      'Option --format is required and must be \'json\' or \'yaml\' (or set default with aifabrix dev set-format)'
+    );
   }
-  if (result.readmeRegenerated) {
-    logger.log(formatSuccessParagraph('Regenerated README.md from deployment manifest.'));
-    return;
+  const normalized = effectiveFormat.trim().toLowerCase();
+  if (normalized !== 'json' && normalized !== 'yaml') {
+    throw new Error('Option --format must be \'json\' or \'yaml\'');
   }
-  logger.log(chalk.gray('No changes needed; config already matches files on disk.'));
+  return normalized;
 }
 
-/**
- * Handler for `aifabrix repair <systemKey>`.
- * @param {string} appName
- * @param {object} options - Commander options
- * @returns {Promise<void>}
- */
-async function handleRepairCommand(appName, options) {
-  const { repairExternalIntegration } = require('../commands/repair');
-  const { detectAppType } = require('../utils/paths');
-  const { appPath } = await detectAppType(appName);
-  logOfflinePathWhenType(appPath);
-  let format = 'yaml';
-  try {
-    const config = require('../core/config');
-    format = (await config.getFormat()) || format;
-  } catch (_) {
-    /* default yaml when config unavailable */
+function logConvertCommandResults(converted, deleted) {
+  logger.log(formatSuccessParagraph('Convert complete.'));
+  converted.forEach((p) => logger.log(`  • ${p}`));
+  if (deleted.length > 0) {
+    logger.log(chalk.gray('  Removed old files:'));
+    deleted.forEach((p) => logger.log(chalk.gray(`    ${p}`)));
   }
-  const result = await repairExternalIntegration(
-    appName,
-    buildRepairExternalIntegrationOptions(appName, options, format)
-  );
-  logRepairResult(options, result);
 }
 
-function setupRepairCommand(program) {
-  program.command('repair <systemKey>')
-    .description('Fix external integration drift (files, RBAC, manifest, …)')
-    .option('--all', 'Run all repair actions (api, doc, expose, rbac, sync, test)')
-    .option(
-      '--api',
-      'Validate and sync API contracts needed for OpenAPI/MCP (uses local OpenAPI specs at integration/<systemKey>/openapi/*.json when present)'
-    )
-    .option('--auth <method>', 'Set authentication method (oauth2, aad, apikey, basic, queryParam, oidc, hmac, none); updates system file and env.template')
-    .option('--doc', 'Regenerate README.md from deployment manifest')
-    .option('--expose', 'Set exposed.schema on each datasource from all fieldMappings.attributes keys (metadata.<key>); removes deprecated exposed.attributes if present')
-    .option('--rbac', 'Ensure RBAC permissions per datasource and add default Admin/Reader roles if none exist')
-    .option('--sync', 'Add default sync section to datasources that lack it')
-    .option('--test', 'Generate testPayload.payloadTemplate and testPayload.expectedResult from attributes')
-    .option('--no-backup', 'Skip timestamped copies under integration/<systemKey>/backup/')
-    .option('--dry-run', 'Report changes only; do not write')
-    .addHelpText('after', REPAIR_HELP_AFTER)
-    .action(async(appName, options) => {
-      try {
-        await handleRepairCommand(appName, options);
-      } catch (error) {
-        handleCommandError(error, 'repair');
-        process.exit(1);
-      }
+async function runConvertCommandForApp(appName, options) {
+  const normalized = await resolveConvertTargetFormat(options);
+  const { isProtectionScope } = require('../protection/scope');
+  if (isProtectionScope(appName)) {
+    const { runConvertProtectionBatch } = require('../protection/convert-batch');
+    const { converted, deleted } = await runConvertProtectionBatch(normalized, {
+      force: options.force
     });
+    logConvertCommandResults(converted, deleted);
+    return;
+  }
+  const { runConvert } = require('../commands/convert');
+  const { converted, deleted } = await runConvert(appName, { format: normalized, force: options.force });
+  logConvertCommandResults(converted, deleted);
 }
 
 function setupConvertCommand(program) {
-  program.command('convert <app>')
-    .description('Convert integration config files between JSON and YAML')
+  program.command('convert <appKey|systemKey>')
+    .description('Convert config files between JSON and YAML (builder/<appKey>/ or integration/<systemKey>/)')
     .option('--format <format>', 'Target format: json | yaml (required unless config format is set)')
     .option('-f, --force', 'Skip confirmation prompt')
     .action(async(appName, options) => {
       try {
-        const config = require('../core/config');
-        const effectiveFormat = options.format || (await config.getFormat());
-        if (!effectiveFormat) {
-          throw new Error(
-            'Option --format is required and must be \'json\' or \'yaml\' (or set default with aifabrix dev set-format)'
-          );
-        }
-        const normalized = effectiveFormat.trim().toLowerCase();
-        if (normalized !== 'json' && normalized !== 'yaml') {
-          throw new Error('Option --format must be \'json\' or \'yaml\'');
-        }
-        const { runConvert } = require('../commands/convert');
-        const { converted, deleted } = await runConvert(appName, { format: normalized, force: options.force });
-        logger.log(formatSuccessParagraph('Convert complete.'));
-        converted.forEach(p => logger.log(`  • ${p}`));
-        if (deleted.length > 0) {
-          logger.log(chalk.gray('  Removed old files:'));
-          deleted.forEach(p => logger.log(chalk.gray(`    ${p}`)));
-        }
+        await runConvertCommandForApp(appName, options);
       } catch (error) {
         handleCommandError(error, 'convert');
         process.exit(1);
@@ -297,8 +194,8 @@ function setupConvertCommand(program) {
 }
 
 function setupShowCommand(program) {
-  program.command('show <app>')
-    .description('Show app from local tree (default) or controller (--online)')
+  program.command('show <appKey|systemKey>')
+    .description('Show builder app or external system from local tree (default) or controller (--online)')
     .option('--online', 'Fetch application data from the controller')
     .option('--json', 'Output as JSON')
     .option(
@@ -327,120 +224,6 @@ function setupSplitJsonConvertShowCommands(program) {
   setupShowCommand(program);
 }
 
-function emitManifestAfterValidateIfApplicable(appOrFile, result, outFormat) {
-  if (outFormat === 'json' || !result?.appPath || !appOrFile || typeof appOrFile !== 'string') {
-    return;
-  }
-  try {
-    if (fs.existsSync(appOrFile) && fs.statSync(appOrFile).isFile()) {
-      return;
-    }
-    const { emitManifestMetadataLineIfTTY } = require('../utils/manifest-source-emit');
-    emitManifestMetadataLineIfTTY(logger, {
-      appKey: appOrFile,
-      appPath: result.appPath,
-      envOnly: false,
-      json: false
-    });
-  } catch {
-    /* ignore emit failures */
-  }
-}
-
-async function runValidateBatchBranch(validate, opts) {
-  const integration = opts.integration === true;
-  const builder = opts.builder === true;
-  if (!integration && !builder) {
-    return false;
-  }
-  const outFormat = (opts.format || 'default').toLowerCase();
-  const batchResult = integration && builder
-    ? await validate.validateAll(opts)
-    : integration
-      ? await validate.validateAllIntegrations(opts)
-      : await validate.validateAllBuilderApps(opts);
-  if (outFormat === 'json') {
-    logger.log(JSON.stringify(batchResult, null, 2));
-  } else {
-    validate.displayBatchValidationResults(batchResult);
-  }
-  if (!batchResult.valid) process.exit(1);
-  return true;
-}
-
-async function runValidateCommand(appOrFile, options) {
-  const validate = require('../validation/validate');
-  const opts = options.opts ? options.opts() : options;
-  if (await runValidateBatchBranch(validate, opts)) {
-    return;
-  }
-
-  const outFormat = (opts.format || 'default').toLowerCase();
-
-  if (!appOrFile || typeof appOrFile !== 'string') {
-    logger.log(chalk.red('App name or file path is required, or use --integration / --builder'));
-    process.exit(1);
-  }
-
-  const result = await validate.validateAppOrFile(appOrFile, {
-    ...opts,
-    certSync: opts.certSync === true
-  });
-  emitManifestAfterValidateIfApplicable(appOrFile, result, outFormat);
-  if (outFormat === 'json') {
-    let payload = result;
-    try {
-      if (result?.appPath && appOrFile && typeof appOrFile === 'string') {
-        if (!(fs.existsSync(appOrFile) && fs.statSync(appOrFile).isFile())) {
-          const { getManifestSourcePayload } = require('../utils/manifest-source-emit');
-          payload = { ...result, manifestSource: getManifestSourcePayload(appOrFile, result.appPath) };
-        }
-      }
-    } catch {
-      /* keep plain result */
-    }
-    logger.log(JSON.stringify(payload, null, 2));
-  } else {
-    validate.displayValidationResults(result);
-  }
-  if (!result.valid) process.exit(1);
-}
-
-function setupValidateDiffCommands(program) {
-  program.command('validate [appOrFile]')
-    .description('Validate one app/file or all under integration/ or builder/')
-    .addHelpText('after', VALIDATE_HELP_AFTER)
-    .option('--format <format>', 'Output format: json | default (human-readable)')
-    .option('--integration', 'Validate all applications under integration/')
-    .option('--builder', 'Validate all applications under builder/')
-    .option(
-      '--cert-sync',
-      'After successful validation of an external integration, refresh the system file certification block from the dataplane (requires login)'
-    )
-    .action((appOrFile, options) => {
-      runValidateCommand(appOrFile, options).catch((error) => {
-        handleCommandError(error, 'validate');
-        process.exit(1);
-      });
-    });
-
-  program.command('diff <file1> <file2>')
-    .description('Diff two config files (optional schema validate)')
-    .option('--no-validate', 'Skip schema validation (type check still applied)')
-    .action(async(file1, file2, cmd) => {
-      try {
-        const diff = require('../core/diff');
-        const opts = cmd.opts();
-        const result = await diff.compareFiles(file1, file2, { validate: opts.validate !== false });
-        diff.formatDiffOutput(result);
-        if (!result.identical) process.exit(1);
-      } catch (error) {
-        handleCommandError(error, 'diff');
-        process.exit(1);
-      }
-    });
-}
-
 /**
  * Sets up utility commands
  * @param {Command} program - Commander program instance