@aifabrix/builder 2.45.0 → 2.46.0

package/lib/lifecycle/scenario-upload.js

@@ -0,0 +1,191 @@
+/**
+ * @fileoverview Upload local governance scenario YAML packs to dataplane (419.0).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const {
+  existsSync,
+  readFileSync,
+  readdirSync,
+  mkdirSync,
+  writeFileSync
+} = require('../internal/fs-real-sync');
+const yaml = require('js-yaml');
+const logger = require('../utils/logger');
+const { getIntegrationPath } = require('../utils/paths');
+const { upsertDatasourceGovernancePack } = require('../api/governance-scenario-pack.api');
+const { formatSuccessLine, formatWarningLine } = require('../utils/cli-test-layout-chalk');
+const { shortGovernanceApiError } = require('../governance/governance-cli-errors');
+const { printGovernanceDownloadMisses } = require('../governance/governance-download-display');
+
+/**
+ * @param {string} scenariosDir
+ * @returns {string[]}
+ */
+function listScenarioYamlFiles(scenariosDir) {
+  if (!existsSync(scenariosDir)) return [];
+  return readdirSync(scenariosDir)
+    .filter(name => name.endsWith('.yaml') || name.endsWith('.yml'))
+    .map(name => path.join(scenariosDir, name));
+}
+
+/**
+ * Extract datasource keys referenced in a pack document.
+ * @param {Object} pack
+ * @returns {string[]}
+ */
+function datasourceKeysFromPack(pack) {
+  const keys = new Set();
+  const scenarios = pack?.spec?.scenarios || [];
+  for (const scenario of scenarios) {
+    const dsKeys = scenario?.search?.datasourceKeys || [];
+    for (const k of dsKeys) {
+      if (k && typeof k === 'string') keys.add(k.trim());
+    }
+  }
+  return [...keys];
+}
+
+/**
+ * @param {string} filePath
+ * @returns {Object}
+ */
+function loadPackFromFile(filePath) {
+  const raw = readFileSync(filePath, 'utf8');
+  const doc = yaml.load(raw);
+  if (!doc || typeof doc !== 'object') {
+    throw new Error(`Invalid scenario pack YAML: ${filePath}`);
+  }
+  return doc;
+}
+
+/**
+ * Upload scenario packs under integration/<systemKey>/scenarios/ to dataplane.
+ * @async
+ * @param {string} systemKey
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {{ silent?: boolean }} [opts]
+ * @returns {Promise<number>} count of packs uploaded
+ */
+async function uploadGovernanceScenarioPacks(systemKey, dataplaneUrl, authConfig, opts = {}) {
+  const scenariosDir = path.join(getIntegrationPath(systemKey), 'scenarios');
+  const files = listScenarioYamlFiles(scenariosDir);
+  if (files.length === 0) return 0;
+
+  let uploaded = 0;
+  for (const filePath of files) {
+    const pack = loadPackFromFile(filePath);
+    const dsKeys = datasourceKeysFromPack(pack);
+    if (dsKeys.length === 0) {
+      if (!opts.silent) {
+        logger.log(
+          formatWarningLine(
+            `Skipping ${path.basename(filePath)} — no datasourceKeys in scenarios`
+          )
+        );
+      }
+      continue;
+    }
+    for (const dsKey of dsKeys) {
+      await upsertDatasourceGovernancePack(dataplaneUrl, authConfig, dsKey, pack);
+      uploaded += 1;
+      if (!opts.silent) {
+        logger.log(
+          formatSuccessLine(
+            `Governance scenario pack uploaded for ${dsKey} (${path.basename(filePath)})`
+          )
+        );
+      }
+    }
+  }
+  return uploaded;
+}
+
+/**
+ * Write governance scenario packs from dataplane to integration/<systemKey>/scenarios/.
+ * @async
+ * @param {string} systemKey
+ * @param {string[]} datasourceKeys
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @returns {Promise<number>}
+ */
+async function downloadGovernanceScenarioPacks(
+  systemKey,
+  datasourceKeys,
+  dataplaneUrl,
+  authConfig
+) {
+  const { getDatasourceGovernancePack } = require('../api/governance-scenario-pack.api');
+  const scenariosDir = path.join(getIntegrationPath(systemKey), 'scenarios');
+  if (!existsSync(scenariosDir)) {
+    mkdirSync(scenariosDir, { recursive: true });
+  }
+
+  let written = 0;
+  const missing = [];
+  for (const dsKey of datasourceKeys) {
+    try {
+      const row = await getDatasourceGovernancePack(dataplaneUrl, authConfig, dsKey);
+      if (!row || !row.pack) {
+        missing.push({
+          datasourceKey: dsKey,
+          reason: 'No active pack on dataplane'
+        });
+        continue;
+      }
+      const outPath = path.join(scenariosDir, `${dsKey}.yaml`);
+      writeFileSync(outPath, yaml.dump(row.pack, { lineWidth: 120 }), 'utf8');
+      written += 1;
+      logger.log(formatSuccessLine(`Scenario pack saved: ${outPath}`));
+    } catch (err) {
+      missing.push({
+        datasourceKey: dsKey,
+        reason: shortGovernanceApiError(err)
+      });
+    }
+  }
+  printGovernanceDownloadMisses(missing);
+  return written;
+}
+
+/**
+ * Download governance packs for all datasource keys on a running manifest.
+ * @async
+ * @param {string} systemKey
+ * @param {Object} manifest
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @returns {Promise<number>}
+ */
+async function downloadGovernanceScenarioPacksFromManifest(
+  systemKey,
+  manifest,
+  dataplaneUrl,
+  authConfig
+) {
+  const dsKeys = (manifest.dataSources || []).map((ds) => ds && ds.key).filter(Boolean);
+  if (dsKeys.length === 0) {
+    return 0;
+  }
+  try {
+    return await downloadGovernanceScenarioPacks(systemKey, dsKeys, dataplaneUrl, authConfig);
+  } catch (err) {
+    logger.log(formatWarningLine(`Governance scenario download skipped: ${err.message}`));
+    return 0;
+  }
+}
+
+module.exports = {
+  listScenarioYamlFiles,
+  datasourceKeysFromPack,
+  loadPackFromFile,
+  uploadGovernanceScenarioPacks,
+  downloadGovernanceScenarioPacks,
+  downloadGovernanceScenarioPacksFromManifest
+};

package/lib/lifecycle/verify-step-progress.js

@@ -0,0 +1,87 @@
+/**
+ * Active progress (ora spinner or single ⏳ line) for verify-* orchestration steps.
+ *
+ * @fileoverview Verify step progress UI
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { formatProgress } = require('../utils/cli-test-layout-chalk');
+const { withQuietLogs } = require('./logger-quiet');
+
+/**
+ * @param {Object} [options]
+ * @returns {boolean}
+ */
+function shouldShowVerifyStepProgress(options = {}) {
+  return options.json !== true;
+}
+
+/**
+ * @param {Object} [options]
+ * @returns {boolean}
+ */
+function shouldUseVerifyStepSpinner(options = {}) {
+  if (!shouldShowVerifyStepProgress(options)) {
+    return false;
+  }
+  return Boolean(process && process.stdout && process.stdout.isTTY);
+}
+
+/**
+ * @param {string} label
+ * @returns {string}
+ */
+function formatVerifyStepLabel(label) {
+  const text = label && String(label).trim() ? String(label).trim() : 'Processing';
+  return text.endsWith('…') ? text : `${text}…`;
+}
+
+/**
+ * Run a verify step with one active progress indicator (spinner on TTY).
+ *
+ * @template T
+ * @async
+ * @param {string} label - Plain label without trailing ellipsis
+ * @param {(progress: { setLabel: (next: string) => void }) => Promise<T>} work
+ * @param {Object} [options]
+ * @param {boolean} [options.json]
+ * @returns {Promise<T>}
+ */
+async function runWithVerifyStepProgress(label, work, options = {}) {
+  if (!shouldShowVerifyStepProgress(options)) {
+    return withQuietLogs(() => work({ setLabel: () => {} }));
+  }
+
+  if (!shouldUseVerifyStepSpinner(options)) {
+    logger.log(formatProgress(formatVerifyStepLabel(label)));
+    return withQuietLogs(() => work({ setLabel: () => {} }));
+  }
+
+  const ora = require('ora');
+  const spinner = ora({
+    text: chalk.white(formatVerifyStepLabel(label)),
+    spinner: 'dots'
+  }).start();
+
+  const setLabel = (next) => {
+    spinner.text = chalk.white(formatVerifyStepLabel(next));
+  };
+
+  try {
+    return await withQuietLogs(() => work({ setLabel }));
+  } finally {
+    spinner.stop();
+  }
+}
+
+module.exports = {
+  shouldShowVerifyStepProgress,
+  shouldUseVerifyStepSpinner,
+  formatVerifyStepLabel,
+  runWithVerifyStepProgress
+};

package/lib/parameters/infra-kv-discovery.js

@@ -6,7 +6,10 @@
 
 const fsRealSync = require('../internal/fs-real-sync');
 const path = require('path');
-const { loadRequiresDatabasesArray } = require('./database-secret-values');
+const { loadRequiresDatabasesArray, loadShippedRequiresDatabases } = require('./database-secret-values');
+
+/** Platform apps from shipped templates (setup/up-infra before builder/ is copied). */
+const SHIPPED_PLATFORM_APP_KEYS = ['keycloak', 'miso-controller', 'dataplane'];
 
 /**
  * Extract kv:// secret key names from env template content (active lines only).
@@ -90,6 +93,25 @@ function deriveDatabaseKvKeysFromWorkspace(pathsUtil) {
   return [...keys];
 }
 
+/**
+ * Database kv keys from shipped platform templates when builder/ apps are not copied yet
+ * (e.g. `aifabrix setup` fresh install before `up-platform`).
+ *
+ * @returns {string[]}
+ */
+function deriveDatabaseKvKeysFromShippedPlatformTemplates() {
+  const keys = new Set();
+  for (const appKey of SHIPPED_PLATFORM_APP_KEYS) {
+    const dbs = loadShippedRequiresDatabases(appKey);
+    if (!Array.isArray(dbs) || dbs.length === 0) continue;
+    for (let i = 0; i < dbs.length; i++) {
+      keys.add(`databases-${appKey}-${i}-urlKeyVault`);
+      keys.add(`databases-${appKey}-${i}-passwordKeyVault`);
+    }
+  }
+  return [...keys];
+}
+
 /**
  * Keys from env.template files whose catalog entry includes the given hook (e.g. upInfra).
  * @param {object} pathsUtil - paths module
@@ -132,6 +154,7 @@ function getAllInfraEnsureKeys(catalog, pathsUtil) {
   const set = new Set();
   for (const k of catalog.getStandardUpInfraBootstrapKeys()) set.add(k);
   for (const k of deriveDatabaseKvKeysFromWorkspace(pathsUtil)) set.add(k);
+  for (const k of deriveDatabaseKvKeysFromShippedPlatformTemplates()) set.add(k);
   for (const k of discoverKvKeysFromEnvTemplatesForHook(pathsUtil, 'upInfra', catalog)) set.add(k);
   return [...set].sort();
 }
@@ -139,8 +162,10 @@ function getAllInfraEnsureKeys(catalog, pathsUtil) {
 module.exports = {
   extractKvKeysFromEnvContent,
   deriveDatabaseKvKeysFromWorkspace,
+  deriveDatabaseKvKeysFromShippedPlatformTemplates,
   discoverKvKeysFromEnvTemplatesForHook,
   getAllInfraEnsureKeys,
   listAppDirsForDiscovery,
-  listBuilderAppDirsForDiscovery
+  listBuilderAppDirsForDiscovery,
+  SHIPPED_PLATFORM_APP_KEYS
 };

package/lib/protection/auth-context.js

@@ -0,0 +1,51 @@
+/**
+ * @fileoverview Dataplane auth/url resolution for protection commands.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { resolveControllerUrl } = require('../utils/controller-url');
+const { resolveEnvironment } = require('../core/config');
+const { getDeviceOnlyAuth, getDeploymentAuth } = require('../utils/token-manager');
+const { getDeploymentAuthMode } = require('../utils/deployment-auth-mode');
+const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
+
+/**
+ * @param {Object} [options]
+ * @param {string} [options.env]
+ * @returns {Promise<{ environment: string, controllerUrl: string, dataplaneUrl: string, authConfig: Object }>}
+ */
+async function resolveProtectionDataplaneContext(options = {}) {
+  const environment = options.env || (await resolveEnvironment());
+  const controllerUrl = await resolveControllerUrl();
+  if (!controllerUrl) {
+    throw new Error('Controller URL is required. Run "aifabrix login" first.');
+  }
+
+  const authMode = getDeploymentAuthMode(options);
+  let authConfig;
+  if (authMode === 'client-credentials') {
+    authConfig = await getDeploymentAuth(controllerUrl, environment, 'dataplane', options);
+  } else {
+    try {
+      authConfig = await getDeviceOnlyAuth(controllerUrl);
+    } catch {
+      authConfig = await getDeploymentAuth(controllerUrl, environment, 'dataplane', options);
+    }
+  }
+
+  if (!authConfig?.token) {
+    throw new Error(
+      'Authentication required. Run "aifabrix login" and try again.'
+    );
+  }
+
+  const dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig);
+  return { environment, controllerUrl, dataplaneUrl, authConfig };
+}
+
+module.exports = {
+  resolveProtectionDataplaneContext
+};

package/lib/protection/convert-batch.js

@@ -0,0 +1,90 @@
+/**
+ * @fileoverview Convert all protection manifests in `.protection/` between JSON and YAML.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const { existsSync, unlinkSync } = require('../internal/fs-real-sync');
+const { getProtectionRoot } = require('./paths');
+const { listProtectionManifestPaths } = require('./resolve');
+const { promptConfirm, targetFileName, convertOneFile } = require('../commands/convert');
+
+/**
+ * @param {string} root
+ * @param {string} format
+ * @returns {string[]}
+ */
+function listFilesNeedingConvert(root, format) {
+  const targetExt = format === 'json' ? '.json' : '.yaml';
+  return listProtectionManifestPaths(root).filter((p) => {
+    return path.extname(p).toLowerCase() !== targetExt;
+  });
+}
+
+/**
+ * @param {string[]} toConvert
+ * @param {string} format
+ * @param {boolean} force
+ * @returns {Promise<void>}
+ */
+async function confirmProtectionConvert(toConvert, format, force) {
+  if (force) {
+    return;
+  }
+  const lines = toConvert.map((p) => `  • ${path.basename(p)} → ${targetFileName(p, format)}`);
+  const confirmed = await promptConfirm(
+    `Convert all protection manifests to ${format}?\n${lines.join('\n')}\nAre you sure? (y/N) `
+  );
+  if (!confirmed) {
+    throw new Error('Convert cancelled.');
+  }
+}
+
+/**
+ * @param {string} root
+ * @param {string[]} toConvert
+ * @param {string} format
+ * @returns {{ converted: string[], deleted: string[] }}
+ */
+function convertProtectionFiles(root, toConvert, format) {
+  const converted = [];
+  const deleted = [];
+  for (const sourcePath of toConvert) {
+    const targetPath = path.join(root, targetFileName(sourcePath, format));
+    convertOneFile(sourcePath, targetPath, format);
+    converted.push(targetPath);
+    if (path.normalize(sourcePath) !== path.normalize(targetPath)) {
+      unlinkSync(sourcePath);
+      deleted.push(sourcePath);
+    }
+  }
+  return { converted, deleted };
+}
+
+/**
+ * @param {string} format - `yaml` | `json`
+ * @param {Object} opts
+ * @returns {Promise<{ converted: string[], deleted: string[] }>}
+ */
+async function runConvertProtectionBatch(format, opts = {}) {
+  const root = opts.root || getProtectionRoot();
+  if (!existsSync(root)) {
+    throw new Error(`Protection folder not found: ${root}`);
+  }
+  const toConvert = listFilesNeedingConvert(root, format);
+  if (!toConvert.length) {
+    return { converted: [], deleted: [] };
+  }
+  await confirmProtectionConvert(toConvert, format, opts.force === true);
+  return convertProtectionFiles(root, toConvert, format);
+}
+
+module.exports = {
+  runConvertProtectionBatch,
+  listFilesNeedingConvert,
+  confirmProtectionConvert,
+  convertProtectionFiles
+};

package/lib/protection/load.js

@@ -0,0 +1,41 @@
+/**
+ * @fileoverview Load protection manifest YAML files (v1).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const { existsSync, readFileSync } = require('../internal/fs-real-sync');
+const { yamlToJson } = require('../utils/config-format');
+
+/**
+ * @param {string} manifestPath - Absolute path to `.yaml` manifest
+ * @returns {Object} Parsed manifest object
+ */
+function loadProtectionManifest(manifestPath) {
+  const p = path.resolve(String(manifestPath || '').trim());
+  if (!p) {
+    throw new Error('Protection manifest path is required');
+  }
+  if (!existsSync(p)) {
+    throw new Error(`Protection manifest not found: ${p}`);
+  }
+  const ext = path.extname(p).toLowerCase();
+  if (ext !== '.yaml' && ext !== '.yml' && ext !== '.json') {
+    throw new Error(
+      `Protection manifest must be .yaml, .yml, or .json (got ${ext || '(none)'}).`
+    );
+  }
+  const content = readFileSync(p, 'utf8');
+  if (ext === '.json') {
+    const parsed = JSON.parse(content);
+    return parsed === undefined || parsed === null ? {} : parsed;
+  }
+  return yamlToJson(content);
+}
+
+module.exports = {
+  loadProtectionManifest
+};

package/lib/protection/paths.js

@@ -0,0 +1,158 @@
+/**
+ * @fileoverview Protection manifest directory under repo `integration/.protection/`.
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const {
+  getAppsMaterializationParent,
+  getCwdIntegrationRoot
+} = require('../utils/paths');
+const { nodeFs } = require('../internal/node-fs');
+
+/**
+ * Walk upward from cwd for the nearest directory containing `integration/`.
+ *
+ * @returns {string|null} Absolute path to `integration/` or null
+ */
+function findNearestIntegrationRootFromCwd() {
+  const disk = nodeFs();
+  let walk = path.resolve(process.cwd());
+  for (let i = 0; i < 64; i += 1) {
+    const integrationDir = path.join(walk, 'integration');
+    try {
+      if (disk.existsSync(integrationDir)) {
+        const st = disk.statSync(integrationDir);
+        if (st && typeof st.isDirectory === 'function' && st.isDirectory()) {
+          return integrationDir;
+        }
+      }
+    } catch {
+      // ignore
+    }
+    const parent = path.dirname(walk);
+    if (parent === walk) {
+      break;
+    }
+    walk = parent;
+  }
+  return null;
+}
+
+/**
+ * Canonical repo-local protection root: `integration/.protection/`.
+ *
+ * @returns {string}
+ */
+function getRepoProtectionRoot() {
+  const cwdInt = getCwdIntegrationRoot();
+  if (cwdInt) {
+    return path.join(cwdInt, '.protection');
+  }
+  const materializationParent = path.resolve(getAppsMaterializationParent());
+  const nearest = findNearestIntegrationRootFromCwd();
+  if (nearest) {
+    const resolvedNearest = path.resolve(nearest);
+    if (
+      resolvedNearest === materializationParent ||
+      resolvedNearest.startsWith(`${materializationParent}${path.sep}`)
+    ) {
+      return path.join(resolvedNearest, '.protection');
+    }
+  }
+  return path.join(materializationParent, 'integration', '.protection');
+}
+
+/**
+ * @returns {string}
+ */
+function getLegacyProtectionRoot() {
+  return path.join(getAppsMaterializationParent(), '.protection');
+}
+
+/**
+ * @param {string} root
+ * @returns {boolean}
+ */
+function protectionRootHasManifestFiles(root) {
+  if (!root || !fs.existsSync(root)) {
+    return false;
+  }
+  try {
+    return fs.readdirSync(root).some((name) => /\.(yaml|yml|json)$/i.test(name));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @returns {string} Absolute path to protection manifests directory
+ */
+function getProtectionRoot() {
+  const explicit = process.env.AIFABRIX_PROTECTION_ROOT;
+  if (explicit && typeof explicit === 'string' && explicit.trim()) {
+    return path.resolve(explicit.trim());
+  }
+
+  const legacyFlag =
+    process.env.AIFABRIX_PROTECTION_LEGACY === '1' ||
+    String(process.env.AIFABRIX_PROTECTION_LEGACY || '').toLowerCase() === 'true';
+
+  const repoRoot = getRepoProtectionRoot();
+  const legacyRoot = getLegacyProtectionRoot();
+
+  if (legacyFlag) {
+    return legacyRoot;
+  }
+
+  const repoHas = protectionRootHasManifestFiles(repoRoot);
+  const legacyHas = protectionRootHasManifestFiles(legacyRoot);
+
+  if (!repoHas && legacyHas && legacyRoot !== repoRoot) {
+    return legacyRoot;
+  }
+
+  return repoRoot;
+}
+
+/**
+ * Human-readable folder label for batch protection TTY output.
+ *
+ * @returns {{ root: string, label: string, usingLegacy: boolean, migrationHint: string|null }}
+ */
+function describeProtectionRoot() {
+  const root = getProtectionRoot();
+  const legacyRoot = getLegacyProtectionRoot();
+  const repoRoot = getRepoProtectionRoot();
+  const usingLegacy = path.resolve(root) === path.resolve(legacyRoot);
+  const legacyHas = protectionRootHasManifestFiles(legacyRoot);
+  const repoHas = protectionRootHasManifestFiles(repoRoot);
+
+  let label = 'integration/.protection';
+  if (usingLegacy) {
+    label = 'work/.protection (legacy)';
+  } else if (process.env.AIFABRIX_PROTECTION_ROOT) {
+    label = 'custom';
+  }
+
+  let migrationHint = null;
+  if (usingLegacy && legacyHas) {
+    migrationHint = `Move manifests to ${repoRoot} (git-friendly integration/.protection/).`;
+  } else if (!usingLegacy && legacyHas && !repoHas) {
+    migrationHint = `Legacy manifests remain under ${legacyRoot}; migrate to ${repoRoot}.`;
+  }
+
+  return { root, label, usingLegacy, migrationHint };
+}
+
+module.exports = {
+  getProtectionRoot,
+  describeProtectionRoot,
+  getRepoProtectionRoot,
+  getLegacyProtectionRoot,
+  findNearestIntegrationRootFromCwd
+};