@aifabrix/builder 2.45.0 → 2.46.0

package/lib/protection/validate-local.js

@@ -0,0 +1,65 @@
+/**
+ * @fileoverview Local AJV validation for protection manifests (shape only).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const Ajv = require('ajv');
+const addFormats = require('ajv-formats');
+
+const SCHEMA_PATH = path.join(__dirname, '..', 'schema', 'protection.schema.json');
+
+let compiledValidator = null;
+
+/**
+ * Strip AI Fabrix schema file metadata (not part of JSON Schema validation).
+ * @param {Object} raw
+ * @returns {Object}
+ */
+function protectionSchemaForAjv(raw) {
+  if (!raw || typeof raw !== 'object') {
+    return raw;
+  }
+  const { metadata: _meta, ...schema } = raw;
+  if (schema.$schema && String(schema.$schema).includes('2020-12')) {
+    delete schema.$schema;
+  }
+  return schema;
+}
+
+function getValidator() {
+  if (compiledValidator) {
+    return compiledValidator;
+  }
+  const schema = protectionSchemaForAjv(require(SCHEMA_PATH));
+  const ajv = new Ajv({ allErrors: true, strict: false, strictSchema: false });
+  addFormats(ajv);
+  compiledValidator = ajv.compile(schema);
+  return compiledValidator;
+}
+
+/**
+ * @param {Object} manifest
+ * @returns {{ valid: boolean, errors: string[] }}
+ */
+function validateProtectionManifestLocal(manifest) {
+  const validate = getValidator();
+  const valid = validate(manifest);
+  if (valid) {
+    return { valid: true, errors: [] };
+  }
+  const errors = (validate.errors || []).map((err) => {
+    const at = err.instancePath || err.schemaPath || '';
+    return at ? `${at}: ${err.message}` : String(err.message || 'Schema validation failed');
+  });
+  return { valid: false, errors };
+}
+
+module.exports = {
+  validateProtectionManifestLocal,
+  getValidator,
+  protectionSchemaForAjv
+};

package/lib/resolvers/dimension-file.js

@@ -8,8 +8,8 @@
 
 'use strict';
 
-const fs = require('fs');
 const path = require('path');
+const { existsSync, readFileSync } = require('../internal/fs-real-sync');
 
 /**
  * @typedef {Object} DimensionCreateInput
@@ -17,10 +17,28 @@ const path = require('path');
  * @property {string} displayName
  * @property {string} [description]
  * @property {'string'|'number'|'boolean'} dataType
+ * @property {'static'|'dynamic'|'both'} [valueType]
  * @property {boolean} [isRequired]
  * @property {Array<{ value: string, displayName?: string, description?: string }>} [values]
  */
 
+const VALUE_TYPES = new Set(['static', 'dynamic', 'both']);
+
+/**
+ * @param {*} raw
+ * @returns {'static'|'dynamic'|'both'}
+ */
+function normalizeValueType(raw) {
+  if (raw === undefined || raw === null || raw === '') {
+    return 'static';
+  }
+  const vt = String(raw).trim();
+  if (!VALUE_TYPES.has(vt)) {
+    throw new Error('valueType must be one of: static, dynamic, both');
+  }
+  return /** @type {'static'|'dynamic'|'both'} */ (vt);
+}
+
 /**
  * @param {string} filePath
  * @returns {DimensionCreateInput}
@@ -30,10 +48,10 @@ function readDimensionCreateFile(filePath) {
   if (!p) {
     throw new Error('--file is required');
   }
-  if (!fs.existsSync(p)) {
+  if (!existsSync(p)) {
     throw new Error(`File not found: ${p}`);
   }
-  const raw = fs.readFileSync(p, 'utf8');
+  const raw = readFileSync(p, 'utf8');
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -43,10 +61,17 @@ function readDimensionCreateFile(filePath) {
   if (!parsed || typeof parsed !== 'object') {
     throw new Error(`Dimension file must be a JSON object: ${p}`);
   }
+  if (parsed.valueType !== undefined) {
+    parsed.valueType = normalizeValueType(parsed.valueType);
+  } else {
+    parsed.valueType = 'static';
+  }
   return parsed;
 }
 
 module.exports = {
-  readDimensionCreateFile
+  readDimensionCreateFile,
+  normalizeValueType,
+  VALUE_TYPES
 };
 

package/lib/schema/application-schema.json

@@ -34,7 +34,7 @@
         "version": "1.4.0",
         "date": "2026-04-06T00:00:00Z",
         "changes": [
-          "Removed build.localPort: local workstation PORT and localhost URL rewriting use the root-level manifest port only, with local host port = port + 10 + developerId*100 (developer id 0 → port+10). Docker published host port remains port + developerId*100.",
+          "Removed build.localPort: local workstation PORT and localhost URL rewriting use the root-level manifest port only, with host port = port + developerId*100 (developer id 0 → port). Same formula for Docker publish and aifabrix run.",
           "Migration: delete build.localPort from application.yaml; set or keep port as the single listen/container port. Use url://public, url://internal, or url://<app>-public|internal in env.template for declarative URLs (resolved after kv://)."
         ],
         "breaking": true

package/lib/schema/datasource-test-run.schema.json

@@ -2,20 +2,25 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "aifabrix://schema/datasource-test-run.schema.json",
   "title": "DatasourceTestRun",
-  "description": "Canonical datasource-root test report (plans 362/365). Public success shape for POST /api/v1/validation/run (and async poll GET /validation/run/{testRunId}). runType=test|integration|e2e; CLI/docs may say test | test-integration | test-e2e; public JSON uses runType only. Includes validation layer (machine/explain), certificate snapshot, optional integration pipeline results, capability E2Es, debug by reference, plural audit refs, developer summaries. Forward-compatible: minor reportVersion bumps may add fields.",
+  "description": "Canonical datasource-root test report (plans 362/365, 370.06, 370.07 stage). Public success shape for POST /api/v1/validation/run (and async poll GET /validation/run/{testRunId}). runType=test|integration|e2e; stage=readiness|simulation|integration|e2e. reportVersion 1.5.0 adds required stage (minor bump). Older clients must tolerate absent stage when reportVersion < 1.5.0.",
   "type": "object",
-  "required": ["reportVersion", "datasourceKey", "systemKey", "runType", "status"],
+  "required": ["reportVersion", "datasourceKey", "systemKey", "runType", "stage", "status"],
   "properties": {
     "reportVersion": {
       "type": "string",
       "description": "Semver-style contract version for this envelope. Policy: additive fields => minor bump within same major; removed/renamed fields => major bump. Route migrations must cite target reportVersion.",
-      "example": "1.3.0"
+      "example": "1.5.0"
     },
     "runType": {
       "type": "string",
-      "description": "Kind of run. Maps to CLI/commands: test=test, test-integration=integration, test-e2e=e2e. Do not use kebab strings inside runType.",
+      "description": "Legacy kind of run. Maps to CLI: test, test-integration, test-e2e. Prefer stage for new clients.",
       "enum": ["test", "integration", "e2e"]
     },
+    "stage": {
+      "type": "string",
+      "description": "Contract validation stage aligned with contracts/rules stage and concept appliesTo.",
+      "enum": ["readiness", "simulation", "integration", "e2e"]
+    },
     "status": {
       "type": "string",
       "description": "Root rollup across validation, integration, certificate, and capabilities for this datasource run: ok | warn | fail | skipped.",
@@ -252,7 +257,7 @@
         "level": {
           "type": "string",
           "description": "Achieved certification tier when applicable.",
-          "enum": ["bronze", "silver", "gold"]
+          "enum": ["bronze", "silver", "gold", "platinum"]
         },
         "summary": {
           "type": "string",
@@ -388,6 +393,61 @@
         }
       }
     },
+    "FixInstruction": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["step"],
+      "description": "One deterministic repair step (370.03 fixInstruction vocabulary).",
+      "properties": {
+        "step": {
+          "type": "string",
+          "enum": [
+            "locate_file",
+            "update_path",
+            "add_mapping",
+            "set_value",
+            "remove_value",
+            "add_item",
+            "remove_item",
+            "explain"
+          ]
+        },
+        "value": {
+          "type": "string",
+          "description": "Brace tokens only in authored YAML: {datasource}, {systemKey}, {field}, {raw.*}."
+        },
+        "path": { "type": "string" },
+        "template": { "type": "string" },
+        "note": { "type": "string" }
+      }
+    },
+    "IssueFix": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["type", "instructions"],
+      "description": "Structured remediation on Issue (370.06; aligned with rule YAML fix).",
+      "properties": {
+        "type": {
+          "type": "string",
+          "enum": [
+            "add_mapping",
+            "edit_schema",
+            "edit_exposure",
+            "edit_governance",
+            "edit_execution",
+            "generic"
+          ]
+        },
+        "instructions": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/FixInstruction" }
+        },
+        "example": {
+          "description": "Optional structured or scalar example for authors/tooling."
+        }
+      }
+    },
     "Issue": {
       "type": "object",
       "required": ["message"],
@@ -395,7 +455,7 @@
       "properties": {
         "code": {
           "type": "string",
-          "description": "Stable code: DP-VAL-* (structural/config), DP-CIP-* (execution/CIP), DP-SEC-* (auth/RBAC/exposure), DP-CONN-* (REST/MCP/connectivity), DP-E2E-* (end-to-end live); warnings DP-*-Wnn. Mapped from engine errorCode in DatasourceTestRun builders.",
+          "description": "Stable code: DP-VAL-* (structural/config), DP-CIP-* (execution/CIP), DP-SEC-* (auth/RBAC/exposure), DP-CONN-* (REST/MCP/connectivity), DP-E2E-* (end-to-end live); warnings DP-*-Wnn. Prefer stableCode when present; otherwise mapped from engine errorCode.",
           "example": "DP-CIP-010"
         },
         "message": {
@@ -410,6 +470,29 @@
         "hint": {
           "type": "string",
           "description": "Remediation or next-step hint."
+        },
+        "conceptId": {
+          "type": "string",
+          "description": "Concept catalog id (370.02) for concept-first organization."
+        },
+        "ruleId": {
+          "type": "string",
+          "description": "YAML rule id when the finding came from the contract rule set.",
+          "example": "VAL-PIL-001"
+        },
+        "stableCode": {
+          "type": "string",
+          "description": "Frozen DP-* stable code from rule YAML.",
+          "example": "DP-VAL-097"
+        },
+        "ruleRefs": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Legacy or supplemental rule references; prefer ruleId + stableCode for YAML rules."
+        },
+        "fix": {
+          "$ref": "#/$defs/IssueFix",
+          "description": "Structured fix instructions when the emitting rule supplies them."
         }
       }
     },