@aifabrix/builder 2.45.0 → 2.46.0

package/lib/core/secrets-env-content.js

@@ -15,7 +15,6 @@ const config = require('./config');
 const {
   interpolateEnvVars,
   collectMissingSecrets,
-  formatMissingSecretsFileInfo,
   replaceKvInContent,
   loadEnvTemplate,
   adjustLocalEnvPortsInContent,
@@ -43,6 +42,8 @@ const {
   rewriteDockerManifestPublicPortEnvLine
 } = require('../utils/docker-manifest-public-port');
 const { loadSecrets } = require('./secrets-load');
+const { buildMissingSecretsErrorMessage } = require('../utils/secrets-missing-error');
+const { commentOrphanKvEnvLines } = require('../utils/env-kv-orphan-lines');
 
 /**
  * Resolves kv:// references in environment template
@@ -54,10 +55,24 @@ const { loadSecrets } = require('./secrets-load');
  * @param {string} [environment='local'] - Environment context (docker/local)
  * @param {Object|string|null} [secretsFilePaths] - Paths object with userPath and buildPath, or string path (for backward compatibility)
  * @param {string} [appName] - Application name (optional, for error messages)
+ * @param {Object|null} [resolveOpts] - Scoped kv (`envKey`, `effective`) and/or `envTemplatePath` for error hints
  * @returns {Promise<string>} Resolved environment content
  * @throws {Error} If kv:// reference cannot be resolved
  */
-async function resolveKvReferences(envTemplate, secrets, environment = 'local', secretsFilePaths = null, appName = null, scopedKv = null) {
+async function resolveKvReferences(
+  envTemplate,
+  secrets,
+  environment = 'local',
+  secretsFilePaths = null,
+  appName = null,
+  resolveOpts = null
+) {
+  const envTemplatePath =
+    resolveOpts && typeof resolveOpts === 'object' ? resolveOpts.envTemplatePath || null : null;
+  const scopedKv =
+    resolveOpts && typeof resolveOpts === 'object' && (resolveOpts.envKey !== undefined || resolveOpts.effective !== undefined)
+      ? { envKey: resolveOpts.envKey, effective: resolveOpts.effective }
+      : null;
   const os = require('os');
 
   let developerId = null;
@@ -77,9 +92,16 @@ async function resolveKvReferences(envTemplate, secrets, environment = 'local',
   const resolved = interpolateEnvVars(envTemplate, envVars);
   const missing = collectMissingSecrets(resolved, secrets, scopedKv);
   if (missing.length > 0) {
-    const fileInfo = formatMissingSecretsFileInfo(secretsFilePaths);
-    const resolveCommand = appName ? `aifabrix resolve ${appName}` : 'aifabrix resolve <app-name>';
-    throw new Error(`Missing secrets: ${missing.join(', ')}${fileInfo}\n\nRun "${resolveCommand}" to generate missing secrets.`);
+    throw new Error(
+      buildMissingSecretsErrorMessage({
+        missing,
+        secrets,
+        secretsFilePaths,
+        appName,
+        envTemplatePath,
+        envTemplate
+      })
+    );
   }
   return replaceKvInContent(resolved, secrets, envVars, scopedKv);
 }
@@ -178,7 +200,11 @@ async function generateEnvContent(appName, secretsPath, environment = 'local', f
   const secrets = await loadSecrets(secretsPath, appName);
   const { runEnvKey, effective } = await buildScopedKvContext(appPath, options);
   const scopedKv = { envKey: runEnvKey, effective };
-  let resolved = await resolveKvReferences(template, secrets, environment, secretsPaths, appName, scopedKv);
+  let resolved = await resolveKvReferences(template, secrets, environment, secretsPaths, appName, {
+    envKey: runEnvKey,
+    effective,
+    envTemplatePath: templatePath
+  });
   if (!secretsPath) {
     await materializeResolvedKvSecretsToUserLocal(template, secrets, scopedKv, options);
   }
@@ -227,42 +253,6 @@ function parseEnvContentToMap(content) {
   return map;
 }
 
-/**
- * Merges new .env content with existing .env: newly resolved content wins for keys it
- * defines (so project secrets take effect when re-running). Keys only in existing .env
- * are appended so manual additions are kept.
- *
- * @param {string} newContent - Newly generated .env content (from template + loadSecrets)
- * @param {Object.<string, string>} existingMap - Existing key-to-value map from current .env
- * @returns {string} Merged content: new values for keys in newContent, plus extra existing keys
- */
-function mergeEnvContentPreservingExisting(newContent, existingMap) {
-  const lines = newContent.split(/\r?\n/);
-  const newKeys = new Set();
-  const out = [];
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith('#')) {
-      out.push(line);
-      continue;
-    }
-    const eq = trimmed.indexOf('=');
-    if (eq > 0) {
-      const key = trimmed.substring(0, eq).trim();
-      newKeys.add(key);
-    }
-    out.push(line);
-  }
-  if (existingMap && Object.keys(existingMap).length > 0) {
-    for (const key of Object.keys(existingMap)) {
-      if (!newKeys.has(key)) {
-        out.push(`${key}=${existingMap[key]}`);
-      }
-    }
-  }
-  return out.join('\n');
-}
-
 /**
  * Merges a key-value map into existing .env file content, preserving comments and blank lines.
  * For each KEY=value line in existing content, replaces value with newMap[KEY] when the key exists
@@ -320,15 +310,27 @@ function mergeEnvMapIntoContent(existingContent, newMap, options = {}) {
 
 /**
  * Resolves content to write for .env: merges with existing file when present.
+ * Uses {@link mergeEnvMapIntoContent} so new template keys are appended and comments in the
+ * existing file are preserved (unlike a full replace).
+ *
  * @param {string} resolved - Newly generated content
  * @param {string} pathToPreserve - Path to existing .env to merge from (or null)
+ * @param {Object} [options]
+ * @param {boolean} [options.freshEnv=false] - When true, write full resolved content (no merge)
  * @returns {string} Content to write
  */
-function resolveEnvContentToWrite(resolved, pathToPreserve) {
-  if (!pathToPreserve || !fs.existsSync(pathToPreserve)) return resolved;
+function resolveEnvContentToWrite(resolved, pathToPreserve, options = {}) {
+  if (options.freshEnv === true || !pathToPreserve || !fs.existsSync(pathToPreserve)) {
+    return resolved;
+  }
   const existingContent = fs.readFileSync(pathToPreserve, 'utf8');
-  const existingMap = parseEnvContentToMap(existingContent);
-  return mergeEnvContentPreservingExisting(resolved, existingMap);
+  const resolvedMap = parseEnvContentToMap(resolved);
+  let merged = mergeEnvMapIntoContent(existingContent, resolvedMap, { appendMissingFromNewMap: true });
+  if (options.pruneOrphanKv === true) {
+    const { content: pruned } = commentOrphanKvEnvLines(merged, new Set(Object.keys(resolvedMap)));
+    merged = pruned;
+  }
+  return merged;
 }
 
 /**
@@ -381,14 +383,18 @@ function resolveEnvContentToWrite(resolved, pathToPreserve) {
 async function writeResolvedEnv({ appName, envPath, resolved, variablesPath, secretsPath, opts }) {
   const preservePath = opts.preserveFromPath !== undefined && opts.preserveFromPath !== null ? opts.preserveFromPath : null;
   const pathToPreserve = preservePath !== null ? preservePath : envPath;
-  const toWrite = resolveEnvContentToWrite(resolved, pathToPreserve);
+  const toWrite = resolveEnvContentToWrite(resolved, pathToPreserve, {
+    freshEnv: opts.freshEnv === true,
+    pruneOrphanKv: opts.envOnly === true && opts.freshEnv !== true
+  });
   fs.writeFileSync(envPath, toWrite, { mode: 0o600 });
 
   if (!opts.skipOutputPath) {
     const { processEnvVariables } = require('../utils/env-copy');
     await processEnvVariables(envPath, variablesPath, appName, secretsPath, {
       preferLocalEnvOutputPath: opts.preferLocalEnvOutputPath === true,
-      appPath: opts.appPath || null
+      appPath: opts.appPath || null,
+      freshEnv: opts.freshEnv === true
     });
   }
   return envPath;

package/lib/core/secrets-env-write.js

@@ -207,7 +207,16 @@ async function resolveAndGetEnvMap(appName, options = {}) {
   let content = await secrets.generateEnvContent(appName, secretsPath, environment, force);
   content = await injectRegistryTokens(content, secretsPath, appName);
   content = await injectBashPrefixedExportLines(content, secretsPath, appName);
-  return parseEnvContentToMap(content);
+  const map = parseEnvContentToMap(content);
+  try {
+    const adminSecrets = require('./admin-secrets');
+    const { applyAdminSecretsPlatformOverlay } = require('./admin-secrets-env-overlay');
+    const adminObj = await adminSecrets.readAndDecryptAdminSecrets();
+    applyAdminSecretsPlatformOverlay(map, adminObj);
+  } catch {
+    // admin-secrets.env optional until up-infra/setup
+  }
+  return map;
 }
 
 module.exports = { resolveAndWriteEnvFile, resolveAndGetEnvMap };

package/lib/core/secrets-infra-placeholder-sync.js

@@ -43,6 +43,8 @@ async function syncLiteralKvSecretsFromCliOverrides(
       const val = ipc.generateValueFromCatalogEntry(key, entry, crypto, placeholderContext);
       await setSecretInStore(key, val);
     }
+    const { isSetupQuietOutput } = require('../utils/setup-quiet-output');
+    if (isSetupQuietOutput()) return;
     logger.log(
       `Updated ${keys.length} secret(s) in store (catalog literals using {{${placeholder}}}).`
     );

package/lib/core/setup-installation-profile.js

@@ -0,0 +1,43 @@
+/**
+ * Setup installation profile identifiers (`dev` / `pro`).
+ *
+ * @fileoverview Normalization for setup wizard profile (local install, not login environment)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/** @enum {string} */
+const INSTALLATION_PROFILE = Object.freeze({
+  DEV: 'dev',
+  PRO: 'pro'
+});
+
+/**
+ * @param {unknown} value
+ * @returns {'dev'|'pro'}
+ */
+function normalizeInstallationProfile(value) {
+  const raw = String(value ?? '')
+    .trim()
+    .toLowerCase();
+  if (raw === INSTALLATION_PROFILE.PRO || raw === 'production') {
+    return INSTALLATION_PROFILE.PRO;
+  }
+  return INSTALLATION_PROFILE.DEV;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+function isProInstallationProfile(value) {
+  return normalizeInstallationProfile(value) === INSTALLATION_PROFILE.PRO;
+}
+
+module.exports = {
+  INSTALLATION_PROFILE,
+  normalizeInstallationProfile,
+  isProInstallationProfile
+};

package/lib/core/setup-platform-mode.js

@@ -0,0 +1,55 @@
+/**
+ * Setup platform topology mode (`single` | `full`).
+ *
+ * This is distinct from `setupInstallationProfile` (dev/pro password bundle) and from
+ * the login/run environment (`dev` | `tst` | `pro`).
+ *
+ * @fileoverview Setup platform mode normalization and defaults
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/** @enum {string} */
+const SETUP_PLATFORM_MODE = Object.freeze({
+  SINGLE: 'single',
+  FULL: 'full'
+});
+
+/**
+ * @param {unknown} value
+ * @returns {'single'|'full'}
+ */
+function normalizeSetupPlatformMode(value) {
+  const raw = String(value ?? '')
+    .trim()
+    .toLowerCase();
+  if (raw === SETUP_PLATFORM_MODE.FULL) return SETUP_PLATFORM_MODE.FULL;
+  if (raw === 'all' || raw === 'full-platform' || raw === 'platform-full') return SETUP_PLATFORM_MODE.FULL;
+  return SETUP_PLATFORM_MODE.SINGLE;
+}
+
+/**
+ * Derived config flags for a chosen platform mode.
+ *
+ * - single: direct ports, no front door ingress
+ * - full: enable Traefik ingress + env-scoped resources
+ *
+ * @param {'single'|'full'} mode
+ * @returns {{ traefik: boolean, useEnvironmentScopedResources: boolean }}
+ */
+function flagsForSetupPlatformMode(mode) {
+  const m = normalizeSetupPlatformMode(mode);
+  return {
+    traefik: m === SETUP_PLATFORM_MODE.FULL,
+    useEnvironmentScopedResources: m === SETUP_PLATFORM_MODE.FULL
+  };
+}
+
+module.exports = {
+  SETUP_PLATFORM_MODE,
+  normalizeSetupPlatformMode,
+  flagsForSetupPlatformMode
+};
+

package/lib/datasource/agent-trust-debug-log.js

@@ -0,0 +1,45 @@
+/**
+ * @fileoverview Debug log writer for agent trust CLI runs (plan 143).
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const path = require('path');
+const logger = require('../utils/logger');
+const { getIntegrationPath } = require('../utils/paths');
+const { writeTestLog } = require('../utils/test-log-writer');
+
+/**
+ * @async
+ * @param {string} appKey - Integration folder key
+ * @param {string} datasourceKey
+ * @param {Object} payload
+ * @returns {Promise<string|null>} Log path or null when skipped
+ */
+async function writeTrustDebugLog(appKey, datasourceKey, payload) {
+  const logPath = await writeTestLog(
+    appKey,
+    payload,
+    `verify-trust-${datasourceKey}`,
+    path.dirname(getIntegrationPath(appKey))
+  );
+  return logPath;
+}
+
+/**
+ * @async
+ * @param {string} appKey
+ * @param {string} datasourceKey
+ * @param {Object} payload
+ */
+async function writeTrustDebugLogAndPrint(appKey, datasourceKey, payload) {
+  const logPath = await writeTrustDebugLog(appKey, datasourceKey, payload);
+  logger.log(chalk.gray(`  Debug log: ${logPath}`));
+  return logPath;
+}
+
+module.exports = {
+  writeTrustDebugLog,
+  writeTrustDebugLogAndPrint
+};

package/lib/datasource/agent-trust-fetch.js

@@ -0,0 +1,115 @@
+/**
+ * @fileoverview Dataplane fetch paths for agent trust runs (POST validate / GET latest).
+ */
+
+'use strict';
+
+const {
+  runAgentMetadataValidation,
+  getLatestAgentMetadataValidation
+} = require('../api/agent-metadata-validation.api');
+const { parseTrustTimeoutMs } = require('./agent-trust-timeout');
+const { isAgentTrustMockEnabled, buildMockTrustRun } = require('./agent-trust-mock');
+const { mapRunResponseToTrustRun, mapLatestResultToTrustRun } = require('./agent-trust-map');
+const {
+  runWithAgentTrustWaitSpinner,
+  logAgentTrustWaitHintOnce
+} = require('../utils/agent-trust-wait-ui');
+
+function unwrapApiData(response) {
+  if (response && response.data !== undefined) return response.data;
+  return response;
+}
+
+/**
+ * @param {Object} options
+ * @returns {boolean}
+ */
+function shouldPreferLatestRead(options = {}) {
+  if (options.revalidate === true) return false;
+  return options.summary === true;
+}
+
+/**
+ * @param {Error} err
+ * @returns {boolean}
+ */
+function isLatestNotFoundError(err) {
+  const code = err && (err.statusCode || err.status);
+  if (code === 404) return true;
+  const msg = err && err.message ? String(err.message) : '';
+  return /no agent metadata validation/i.test(msg);
+}
+
+/**
+ * @async
+ * @param {Object} params
+ * @returns {Promise<Object>}
+ */
+async function postValidateTrustRun(params) {
+  const { dataplaneUrl, datasourceKey, systemKey, authConfig, body, options } = params;
+  const timeoutMs = parseTrustTimeoutMs(options);
+  logAgentTrustWaitHintOnce(datasourceKey, timeoutMs);
+  const raw = await runWithAgentTrustWaitSpinner(
+    () =>
+      runAgentMetadataValidation(dataplaneUrl, datasourceKey, authConfig, body, { timeoutMs }),
+    { datasourceKey, timeoutMs }
+  );
+  return mapRunResponseToTrustRun({
+    datasourceKey,
+    systemKey,
+    runResponse: unwrapApiData(raw)
+  });
+}
+
+/**
+ * @async
+ * @param {Object} params
+ * @returns {Promise<Object>}
+ */
+async function getLatestTrustRun(params) {
+  const { dataplaneUrl, datasourceKey, systemKey, authConfig, options } = params;
+  const timeoutMs = parseTrustTimeoutMs(options);
+  const raw = await getLatestAgentMetadataValidation(dataplaneUrl, datasourceKey, authConfig, {
+    timeoutMs
+  });
+  return mapLatestResultToTrustRun({
+    datasourceKey,
+    systemKey,
+    latestResult: unwrapApiData(raw)
+  });
+}
+
+/**
+ * @async
+ * @param {Object} params
+ * @returns {Promise<Object>}
+ */
+async function fetchTrustRunFromDataplane(params) {
+  const { datasourceKey, systemKey, dataplaneUrl, authConfig, options } = params;
+  if (isAgentTrustMockEnabled()) {
+    return buildMockTrustRun(datasourceKey, systemKey);
+  }
+
+  const body = { forceRevalidate: options.revalidate === true };
+  if (options.peerDatasourceConfigs && typeof options.peerDatasourceConfigs === 'object') {
+    body.peerDatasourceConfigs = options.peerDatasourceConfigs;
+  }
+
+  if (!shouldPreferLatestRead(options)) {
+    return postValidateTrustRun({ dataplaneUrl, datasourceKey, systemKey, authConfig, body, options });
+  }
+
+  try {
+    return await getLatestTrustRun({ dataplaneUrl, datasourceKey, systemKey, authConfig, options });
+  } catch (err) {
+    if (!isLatestNotFoundError(err)) throw err;
+    return postValidateTrustRun({ dataplaneUrl, datasourceKey, systemKey, authConfig, body, options });
+  }
+}
+
+module.exports = {
+  shouldPreferLatestRead,
+  fetchTrustRunFromDataplane,
+  isLatestNotFoundError
+};

package/lib/datasource/agent-trust-map.js

@@ -0,0 +1,101 @@
+/**
+ * @fileoverview Map dataplane agent metadata validation API payloads to CLI trust runs.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {string} trustDecision
+ * @returns {'ok'|'warn'|'fail'}
+ */
+function trustDecisionToRowStatus(trustDecision) {
+  const td = String(trustDecision || '').trim();
+  if (td === 'trusted') return 'ok';
+  if (td === 'usableWithWarnings') return 'warn';
+  return 'fail';
+}
+
+/**
+ * @param {Object} result - AgentMetadataValidationResult from dataplane
+ * @returns {string[]}
+ */
+function highLevelWarningsFromResult(result) {
+  if (!result || !Array.isArray(result.findings)) return [];
+  return result.findings
+    .filter(f => f && (f.severity === 'warning' || f.severity === 'error'))
+    .slice(0, 8)
+    .map(f => {
+      const code = f.code ? String(f.code) : 'FINDING';
+      const msg = f.message ? String(f.message) : '';
+      return msg ? `${code} — ${msg}` : code;
+    });
+}
+
+/**
+ * @param {Object} params
+ * @param {string} params.datasourceKey
+ * @param {string} params.systemKey
+ * @param {Object} params.runResponse - POST run response body
+ * @returns {Object} AgentTrustRun-shaped object for CLI display/exit
+ */
+function mapRunResponseToTrustRun({ datasourceKey, systemKey, runResponse }) {
+  const body = runResponse && typeof runResponse === 'object' ? runResponse : {};
+  const result = body.result && typeof body.result === 'object' ? body.result : {};
+  const trustDecision = result.trustDecision || 'pending';
+  return {
+    datasourceKey,
+    systemKey,
+    status: trustDecisionToRowStatus(trustDecision),
+    trustDecision,
+    validationStatus: result.status || 'pending',
+    confidence: typeof result.confidence === 'number' ? result.confidence : 0,
+    summary: result.summary || '',
+    validatedAt: result.validatedAt || '',
+    inputHash: result.inputHash || '',
+    contractVersion: result.contractVersion || '',
+    cacheHit: body.reused === true,
+    highLevelWarnings: highLevelWarningsFromResult(result),
+    findings: Array.isArray(result.findings) ? result.findings : [],
+    observedBusinessModel: result.observedBusinessModel || null,
+    runId: body.id || null
+  };
+}
+
+/**
+ * @param {Object} params
+ * @param {string} params.datasourceKey
+ * @param {string} params.systemKey
+ * @param {Object} params.latestResult - GET /agent-validation body
+ * @returns {Object}
+ */
+function mapLatestResultToTrustRun({ datasourceKey, systemKey, latestResult }) {
+  const result = latestResult && typeof latestResult === 'object' ? latestResult : {};
+  const trustDecision = result.trustDecision || 'pending';
+  return {
+    datasourceKey,
+    systemKey,
+    status: trustDecisionToRowStatus(trustDecision),
+    trustDecision,
+    validationStatus: result.status || 'pending',
+    confidence: typeof result.confidence === 'number' ? result.confidence : 0,
+    summary: result.summary || '',
+    validatedAt: result.validatedAt || '',
+    inputHash: result.inputHash || '',
+    contractVersion: result.contractVersion || '',
+    cacheHit: true,
+    highLevelWarnings: highLevelWarningsFromResult(result),
+    findings: Array.isArray(result.findings) ? result.findings : [],
+    observedBusinessModel: result.observedBusinessModel || null,
+    runId: null,
+    readLatest: true
+  };
+}
+
+module.exports = {
+  trustDecisionToRowStatus,
+  highLevelWarningsFromResult,
+  mapRunResponseToTrustRun,
+  mapLatestResultToTrustRun
+};

package/lib/datasource/agent-trust-mock.js

@@ -0,0 +1,44 @@
+/**
+ * @fileoverview Dev-only mock trust runs when AIFABRIX_AGENT_TRUST_MOCK=1 (plan 143).
+ * Not documented in user-facing CLI docs; for local CLI development without dataplane 404.5.
+ */
+
+'use strict';
+
+/**
+ * @returns {boolean}
+ */
+function isAgentTrustMockEnabled() {
+  return String(process.env.AIFABRIX_AGENT_TRUST_MOCK || '').trim() === '1';
+}
+
+/**
+ * @param {string} datasourceKey
+ * @param {string} systemKey
+ * @returns {Object}
+ */
+function buildMockTrustRun(datasourceKey, systemKey) {
+  return {
+    datasourceKey,
+    systemKey,
+    status: 'warn',
+    trustDecision: 'usableWithWarnings',
+    validationStatus: 'warning',
+    confidence: 0.72,
+    summary: 'Mock trust run (AIFABRIX_AGENT_TRUST_MOCK=1)',
+    validatedAt: new Date().toISOString(),
+    inputHash: 'mock-input-hash',
+    contractVersion: '1.0.0',
+    cacheHit: false,
+    highLevelWarnings: ['MOCK_TRUST — set AIFABRIX_AGENT_TRUST_MOCK=0 for live dataplane validation'],
+    findings: [],
+    observedBusinessModel: null,
+    runId: 'mock-run-id',
+    mock: true
+  };
+}
+
+module.exports = {
+  isAgentTrustMockEnabled,
+  buildMockTrustRun
+};