@aifabrix/builder 2.45.0 → 2.46.0

package/lib/core/config-attach-extensions.js

@@ -41,6 +41,9 @@ function attachConfigExtensions(exportsObj, deps) {
 
   const { createScopedResourcesPreferenceFunctions } = require('../utils/config-scoped-resources-preference');
   Object.assign(exportsObj, createScopedResourcesPreferenceFunctions(getConfig, saveConfig));
+
+  const { createSecretsPathFunctions } = require('../utils/config-secrets-path');
+  Object.assign(exportsObj, createSecretsPathFunctions(getConfig, saveConfig));
 }
 
 module.exports = { attachConfigExtensions };

package/lib/core/config-device-dataplane.js

@@ -0,0 +1,185 @@
+/**
+ * Persist dataplane version metadata under `device.<controllerUrl>` in
+ * `~/.aifabrix/config.yaml` for the Builder CLI compatibility gate (plan 142.0).
+ *
+ * Only public dataplane fields are written here. Token / refresh-token entries
+ * on the same device entry are preserved untouched.
+ *
+ * Schema additions (kebab-case, matching `developer-id` style):
+ *   - `dataplane-version`         ← health `version`
+ *   - `dataplane-min-cli-version` ← health `minBuilderCliVersion` (omitted when not enforced)
+ *   - `dataplane-checked-at`      ← ISO timestamp for cache TTL (default 5 min)
+ *
+ * @fileoverview Cache dataplane health under existing `device.<controllerUrl>` entry
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const { getConfig, saveConfig, normalizeControllerUrl } = require('./config');
+
+const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1000;
+
+/**
+ * Resolve the device entry key matching `controllerUrl`, taking URL
+ * normalization into account so callers do not need to worry about trailing
+ * slashes or scheme differences.
+ * @private
+ * @param {Object} deviceMap - `config.device` map
+ * @param {string} normalizedUrl
+ * @returns {string|null} The key under `config.device` or null when missing
+ */
+function findDeviceKey(deviceMap, normalizedUrl) {
+  if (!deviceMap || typeof deviceMap !== 'object') return null;
+  if (deviceMap[normalizedUrl]) return normalizedUrl;
+  for (const storedUrl of Object.keys(deviceMap)) {
+    if (normalizeControllerUrl(storedUrl) === normalizedUrl) {
+      return storedUrl;
+    }
+  }
+  return null;
+}
+
+/**
+ * Read the dataplane cache currently persisted under `device.<controllerUrl>`.
+ *
+ * @async
+ * @param {string} controllerUrl
+ * @returns {Promise<{
+ *   version?: string,
+ *   minBuilderCliVersion?: string,
+ *   checkedAt?: string
+ * }|null>} The cached snapshot, or null when no entry exists
+ * @throws {Error} If controllerUrl is missing
+ */
+async function getDeviceDataplaneVersions(controllerUrl) {
+  if (!controllerUrl || typeof controllerUrl !== 'string') {
+    throw new Error('controllerUrl is required and must be a string');
+  }
+  const config = await getConfig();
+  const normalizedUrl = normalizeControllerUrl(controllerUrl);
+  const key = findDeviceKey(config.device, normalizedUrl);
+  if (!key) return null;
+  const entry = config.device[key];
+  if (!entry || typeof entry !== 'object') return null;
+  const snapshot = {};
+  if (typeof entry['dataplane-version'] === 'string') {
+    snapshot.version = entry['dataplane-version'];
+  }
+  if (typeof entry['dataplane-min-cli-version'] === 'string') {
+    snapshot.minBuilderCliVersion = entry['dataplane-min-cli-version'];
+  }
+  if (typeof entry['dataplane-checked-at'] === 'string') {
+    snapshot.checkedAt = entry['dataplane-checked-at'];
+  }
+  if (Object.keys(snapshot).length === 0) return null;
+  return snapshot;
+}
+
+/**
+ * Apply the `dataplane-version` field to a device entry in-place.
+ * @private
+ * @param {Object} entry
+ * @param {string|null|undefined} version
+ */
+function applyDataplaneVersionField(entry, version) {
+  if (typeof version === 'string' && version.trim()) {
+    entry['dataplane-version'] = version.trim();
+  } else if (version === null || version === '') {
+    delete entry['dataplane-version'];
+  }
+}
+
+/**
+ * Apply the `dataplane-min-cli-version` field to a device entry in-place.
+ * Treat absent / empty as "no enforcement" → clear the cached floor so an
+ * older value never lingers after the operator removes the env variable.
+ * @private
+ * @param {Object} entry
+ * @param {string|null|undefined} minCli
+ */
+function applyMinCliField(entry, minCli) {
+  if (typeof minCli === 'string' && minCli.trim()) {
+    entry['dataplane-min-cli-version'] = minCli.trim();
+    return;
+  }
+  if (minCli === null || minCli === '' || minCli === undefined) {
+    delete entry['dataplane-min-cli-version'];
+  }
+}
+
+/**
+ * Compute the timestamp persisted as `dataplane-checked-at`.
+ * @private
+ * @param {string|undefined} checkedAt
+ * @returns {string} ISO timestamp
+ */
+function resolveCheckedAt(checkedAt) {
+  if (typeof checkedAt === 'string' && checkedAt.trim()) {
+    return checkedAt.trim();
+  }
+  return new Date().toISOString();
+}
+
+/**
+ * Persist dataplane version metadata under the device entry for `controllerUrl`.
+ *
+ * Token / refresh-token entries are preserved; only the `dataplane-*` keys are
+ * written. When `versions.minBuilderCliVersion` is empty/undefined the cache
+ * key is removed (dataplane does not enforce a minimum).
+ *
+ * @async
+ * @param {string} controllerUrl - Controller URL (will be normalized)
+ * @param {{
+ *   version?: string,
+ *   minBuilderCliVersion?: string|null,
+ *   checkedAt?: string
+ * }} versions
+ * @returns {Promise<void>}
+ * @throws {Error} If controllerUrl is missing
+ */
+async function updateDeviceDataplaneVersions(controllerUrl, versions = {}) {
+  if (!controllerUrl || typeof controllerUrl !== 'string') {
+    throw new Error('controllerUrl is required and must be a string');
+  }
+  const config = await getConfig();
+  if (!config.device || typeof config.device !== 'object') {
+    config.device = {};
+  }
+  const normalizedUrl = normalizeControllerUrl(controllerUrl);
+  const key = findDeviceKey(config.device, normalizedUrl) || normalizedUrl;
+  if (!config.device[key] || typeof config.device[key] !== 'object') {
+    config.device[key] = {};
+  }
+  const entry = config.device[key];
+
+  applyDataplaneVersionField(entry, versions.version);
+  applyMinCliField(entry, versions.minBuilderCliVersion);
+  entry['dataplane-checked-at'] = resolveCheckedAt(versions.checkedAt);
+
+  await saveConfig(config);
+}
+
+/**
+ * True when the cached snapshot is older than the configured TTL (or missing).
+ *
+ * @param {{checkedAt?: string}|null} snapshot
+ * @param {number} [ttlMs] - TTL in milliseconds (defaults to 5 minutes)
+ * @param {Date|number} [now] - Override "now" for tests
+ * @returns {boolean}
+ */
+function isCacheStale(snapshot, ttlMs = DEFAULT_CACHE_TTL_MS, now = Date.now()) {
+  if (!snapshot || !snapshot.checkedAt) return true;
+  const checkedAtMs = Date.parse(snapshot.checkedAt);
+  if (Number.isNaN(checkedAtMs)) return true;
+  const reference = typeof now === 'number' ? now : now.getTime();
+  return reference - checkedAtMs >= ttlMs;
+}
+
+module.exports = {
+  getDeviceDataplaneVersions,
+  updateDeviceDataplaneVersions,
+  isCacheStale,
+  DEFAULT_CACHE_TTL_MS
+};

package/lib/core/config-platform-controller.js

@@ -0,0 +1,44 @@
+/**
+ * `platform-controller` field in `config.yaml` — absolute Miso URL for setup / platform flows.
+ *
+ * @fileoverview config.yaml platform-controller helpers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {() => Promise<Object>} getConfig
+ * @returns {Promise<string|null>}
+ */
+async function getPlatformControllerUrlFromConfig(getConfig) {
+  const cfg = await getConfig();
+  const raw = cfg && cfg['platform-controller'];
+  if (typeof raw === 'string' && raw.trim()) {
+    return raw.trim().replace(/\/+$/, '');
+  }
+  return null;
+}
+
+/**
+ * @param {() => Promise<Object>} getConfig
+ * @param {(data: Object) => Promise<void>} saveConfig
+ * @param {(url: string) => string} normalizeControllerUrl
+ * @param {string} url
+ * @returns {Promise<void>}
+ */
+async function setPlatformControllerUrlInConfig(getConfig, saveConfig, normalizeControllerUrl, url) {
+  if (!url || typeof url !== 'string') {
+    throw new Error('Platform controller URL is required and must be a string');
+  }
+  const normalized = normalizeControllerUrl(url);
+  const cfg = await getConfig();
+  cfg['platform-controller'] = normalized;
+  await saveConfig(cfg);
+}
+
+module.exports = {
+  getPlatformControllerUrlFromConfig,
+  setPlatformControllerUrlInConfig
+};

package/lib/core/config-setup-installation-profile.js

@@ -0,0 +1,42 @@
+/**
+ * `setupInstallationProfile` field in `config.yaml` (`dev` | `pro`).
+ *
+ * @fileoverview Persists setup wizard installation profile
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { normalizeInstallationProfile, INSTALLATION_PROFILE } = require('./setup-installation-profile');
+
+/**
+ * @param {() => Promise<Object>} getConfig
+ * @returns {Promise<'dev'|'pro'>}
+ */
+async function getSetupInstallationProfileFromConfig(getConfig) {
+  const cfg = await getConfig();
+  if (cfg && cfg.setupInstallationProfile) {
+    return normalizeInstallationProfile(cfg.setupInstallationProfile);
+  }
+  return INSTALLATION_PROFILE.DEV;
+}
+
+/**
+ * @param {() => Promise<Object>} getConfig
+ * @param {(data: Object) => Promise<void>} saveConfig
+ * @param {unknown} profile
+ * @returns {Promise<'dev'|'pro'>}
+ */
+async function setSetupInstallationProfileInConfig(getConfig, saveConfig, profile) {
+  const normalized = normalizeInstallationProfile(profile);
+  const cfg = await getConfig();
+  cfg.setupInstallationProfile = normalized;
+  await saveConfig(cfg);
+  return normalized;
+}
+
+module.exports = {
+  getSetupInstallationProfileFromConfig,
+  setSetupInstallationProfileInConfig
+};

package/lib/core/config-setup-platform-mode.js

@@ -0,0 +1,46 @@
+/**
+ * `setupPlatformMode` field in `config.yaml` (`single` | `full`).
+ *
+ * @fileoverview Persists setup wizard platform mode
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const {
+  normalizeSetupPlatformMode,
+  SETUP_PLATFORM_MODE
+} = require('./setup-platform-mode');
+
+/**
+ * @param {() => Promise<Object>} getConfig
+ * @returns {Promise<'single'|'full'>}
+ */
+async function getSetupPlatformModeFromConfig(getConfig) {
+  const cfg = await getConfig();
+  if (cfg && cfg.setupPlatformMode) {
+    return normalizeSetupPlatformMode(cfg.setupPlatformMode);
+  }
+  return SETUP_PLATFORM_MODE.SINGLE;
+}
+
+/**
+ * @param {() => Promise<Object>} getConfig
+ * @param {(data: Object) => Promise<void>} saveConfig
+ * @param {unknown} mode
+ * @returns {Promise<'single'|'full'>}
+ */
+async function setSetupPlatformModeInConfig(getConfig, saveConfig, mode) {
+  const normalized = normalizeSetupPlatformMode(mode);
+  const cfg = await getConfig();
+  cfg.setupPlatformMode = normalized;
+  await saveConfig(cfg);
+  return normalized;
+}
+
+module.exports = {
+  getSetupPlatformModeFromConfig,
+  setSetupPlatformModeInConfig
+};
+

package/lib/core/config.js

@@ -9,14 +9,24 @@
  */
 
 const fs = require('fs').promises;
-const path = require('path');
 const yaml = require('js-yaml');
-const os = require('os');
 const { encryptToken, decryptToken, isTokenEncrypted } = require('../utils/token-encryption');
 const { ensureSecureFilePermissions, ensureSecureDirPermissions } = require('../utils/secure-file-permissions');
 const { getRuntimeConfigDir, getRuntimeConfigFile } = require('./config-runtime-paths');
 const { getAdminEmailFromConfig, setAdminEmailInConfig } = require('./config-admin-email');
+const {
+  getSetupInstallationProfileFromConfig,
+  setSetupInstallationProfileInConfig
+} = require('./config-setup-installation-profile');
+const {
+  getSetupPlatformModeFromConfig,
+  setSetupPlatformModeInConfig
+} = require('./config-setup-platform-mode');
 const { getRegisteredControllerUrlsWithLoader } = require('./config-registered-controller-urls');
+const {
+  getPlatformControllerUrlFromConfig,
+  setPlatformControllerUrlInConfig
+} = require('./config-platform-controller');
 const { normalizeControllerUrl, validateAndNormalizeDeveloperId } = require('./config-normalize');
 // Avoid importing paths.js here to prevent circular dependency; use shared runtime config dir helper.
 // Config location: AIFABRIX_CONFIG dirname → AIFABRIX_HOME (with ~/.aifabrix fallback when config lives there) → ~/.aifabrix
@@ -34,6 +44,9 @@ function applyConfigDefaults(config) {
   if (typeof config.environment === 'undefined') {
     config.environment = 'dev';
   }
+  if (typeof config.setupPlatformMode === 'undefined') {
+    config.setupPlatformMode = 'single';
+  }
   // Ensure environments object exists
   if (typeof config.environments !== 'object' || config.environments === null) {
     config.environments = {};
@@ -59,6 +72,7 @@ function getDefaultConfig() {
   return {
     'developer-id': '0',
     environment: 'dev',
+    setupPlatformMode: 'single',
     controller: undefined,
     environments: {},
     device: {},
@@ -230,6 +244,12 @@ async function setAdminEmail(email) {
   return setAdminEmailInConfig(getConfig, saveConfig, email);
 }
 
+/** @returns {Promise<'dev'|'pro'>} */
+const getSetupInstallationProfile = () => getSetupInstallationProfileFromConfig(getConfig);
+/** @param {unknown} profile @returns {Promise<'dev'|'pro'>} */
+const setSetupInstallationProfile = (profile) =>
+  setSetupInstallationProfileInConfig(getConfig, saveConfig, profile);
+
 /**
  * Whether Traefik is enabled (`traefik: true` in config; infra compose includes the proxy).
  * @returns {Promise<boolean>}
@@ -259,6 +279,21 @@ async function setCurrentEnvironment(environment) {
   await saveConfig(config);
 }
 
+/**
+ * @returns {Promise<'single'|'full'>}
+ */
+async function getSetupPlatformMode() {
+  return getSetupPlatformModeFromConfig(getConfig);
+}
+
+/**
+ * @param {unknown} mode
+ * @returns {Promise<'single'|'full'>}
+ */
+async function setSetupPlatformMode(mode) {
+  return setSetupPlatformModeInConfig(getConfig, saveConfig, mode);
+}
+
 /**
  * Set controller URL in configuration
  * @async
@@ -392,38 +427,11 @@ async function setSecretsEncryptionKey(key) {
  */
 async function ensureSecretsEncryptionKey() {
   const { ensureSecretsEncryptionKey: run } = require('./ensure-encryption-key');
+  const { createSecretsPathFunctions } = require('../utils/config-secrets-path');
+  const { getSecretsPath } = createSecretsPathFunctions(getConfig, saveConfig);
   await run({ getSecretsEncryptionKey, setSecretsEncryptionKey, getSecretsPath });
 }
 
-/**
- * Expand leading ~ to home directory so config paths like ~/.aifabrix/secrets.local.yaml resolve correctly.
- * @param {string} filePath - Path that may start with ~ or ~/
- * @returns {string} Path with ~ expanded, or unchanged if no leading ~
- */
-function expandTilde(filePath) {
-  if (!filePath || typeof filePath !== 'string') return filePath;
-  if (filePath === '~') return os.homedir();
-  if (filePath.startsWith('~/') || filePath.startsWith('~' + path.sep)) {
-    return path.join(os.homedir(), filePath.slice(2));
-  }
-  return filePath;
-}
-
-async function getSecretsPath() {
-  const config = await getConfig();
-  const raw = config['aifabrix-secrets'] || config['secrets-path'] || null;
-  return raw ? expandTilde(raw) : null;
-}
-
-async function setSecretsPath(secretsPath) {
-  if (typeof secretsPath !== 'string') {
-    throw new Error('Secrets path is required and must be a string');
-  }
-  const config = await getConfig();
-  config['aifabrix-secrets'] = secretsPath.trim() || undefined;
-  await saveConfig(config);
-}
-
 // Create exports object
 const exportsObj = {
   getConfig,
@@ -436,6 +444,10 @@ const exportsObj = {
   getTlsEnabled,
   getAdminEmail,
   setAdminEmail,
+  getSetupInstallationProfile,
+  setSetupInstallationProfile,
+  getSetupPlatformMode,
+  setSetupPlatformMode,
   getTraefikEnabled,
   setCurrentEnvironment,
   resolveEnvironment,
@@ -446,11 +458,11 @@ const exportsObj = {
   getSecretsEncryptionKey,
   setSecretsEncryptionKey,
   ensureSecretsEncryptionKey,
-  getSecretsPath,
-  setSecretsPath,
   normalizeControllerUrl,
   setControllerUrl,
   getControllerUrl,
+  getPlatformControllerUrl: () => getPlatformControllerUrlFromConfig(getConfig),
+  setPlatformControllerUrl: (url) => setPlatformControllerUrlInConfig(getConfig, saveConfig, normalizeControllerUrl, url),
   getRegisteredControllerUrls,
   get CONFIG_DIR() {
     return getRuntimeConfigDir();
@@ -460,9 +472,7 @@ const exportsObj = {
   }
 };
 
-// Add developerId as a property getter for direct access
-// After getConfig() or getDeveloperId() is called, config.developerId will be available
-// Developer ID: 0 = default infra, > 0 = developer-specific
+// Developer ID: 0 = default infra, > 0 = developer-specific (getter after getConfig loads cache)
 Object.defineProperty(exportsObj, 'developerId', {
   get() {
     return cachedDeveloperId !== null ? cachedDeveloperId : '0'; // Default to "0" if not loaded yet

package/lib/core/secrets-admin-env.js

@@ -20,6 +20,7 @@ const {
 const { createDefaultSecrets } = require('../utils/secrets-generator');
 const pathsUtil = require('../utils/paths');
 const { loadSecrets } = require('./secrets-load');
+const { formatAdminEnvLine } = require('./admin-secrets');
 
 /**
  * Writes admin env key-value pairs to content; encrypts values when encryption key is set.
@@ -34,7 +35,7 @@ async function formatAdminSecretsContent(adminObj) {
   for (const [k, v] of Object.entries(adminObj)) {
     const value = (v === null || v === undefined) ? '' : String(v).replace(/\n/g, ' ').trim();
     const valueToWrite = encryptionKey ? encryptSecret(value, encryptionKey) : value;
-    lines.push(`${k}=${valueToWrite}`);
+    lines.push(formatAdminEnvLine(k, valueToWrite));
   }
   return lines.join('\n');
 }
@@ -76,7 +77,10 @@ function buildLocalAdminSecretsObject(secrets, infraDefaults) {
     PGADMIN_DEFAULT_PASSWORD: postgresPassword,
     REDIS_HOST: 'local:redis:6379:0:',
     REDIS_COMMANDER_USER: 'admin',
-    REDIS_COMMANDER_PASSWORD: postgresPassword
+    REDIS_COMMANDER_PASSWORD: postgresPassword,
+    KEYCLOAK_ADMIN_USERNAME: 'admin',
+    KEYCLOAK_ADMIN_PASSWORD: postgresPassword,
+    PLATFORM_ADMIN_PASSWORD: postgresPassword
   };
 }
 

package/lib/core/secrets-ensure.js

@@ -204,6 +204,8 @@ function summarizeSecretsStoreForLog(target) {
  */
 function logNewSecretValuesWritten(added, target) {
   if (!Array.isArray(added) || added.length === 0) return;
+  const { isSetupQuietOutput } = require('../utils/setup-quiet-output');
+  if (isSetupQuietOutput()) return;
   const where = summarizeSecretsStoreForLog(target);
   logger.log(
     formatSuccessLine(
@@ -352,6 +354,8 @@ async function ensureSecretsFromEnvTemplate(envTemplatePathOrContent, options =
  * @returns {Promise<void>}
  */
 async function writeSecretToStoreFile(filePath, key, strValue) {
+  const { assertWritableSecretsPathForTests } = require('../utils/aifabrix-test-runtime-guard');
+  assertWritableSecretsPathForTests(filePath);
   const existing = loadExistingSecrets(filePath);
   const encryptionKey = await config.getSecretsEncryptionKey();
   let valueToWrite = strValue;