@aifabrix/builder 2.45.0 → 2.46.0

package/lib/utils/token-manager.js

@@ -9,99 +9,19 @@
  * @version 2.0.0
  */
 
-const fs = require('fs');
-const yaml = require('js-yaml');
 const config = require('../core/config');
 const logger = require('./logger');
-const pathsUtil = require('./paths');
 const {
   refreshClientToken,
   refreshDeviceToken
 } = require('./token-manager-refresh');
 const { warnRefreshFailureOnce, warnRefreshTokenExpiredOnce } = require('./token-manager-messages');
-
-/** App key used for dataplane client credentials in secrets.local.yaml */
-const DATAPLANE_APP_KEY = 'dataplane';
-
-function getSecretsFilePath() {
-  return pathsUtil.getPrimaryUserSecretsLocalPath();
-}
-
-/**
- * Validate that secrets.local.yaml contains dataplane client credentials.
- * If missing, the developer should run: aifabrix app rotate-secret dataplane
- * @param {string} [secretsFilePath] - Path to secrets file; defaults to ~/.aifabrix/secrets.local.yaml
- * @returns {{ valid: boolean, hint?: string }}
- */
-function validateDataplaneSecrets(secretsFilePath) {
-  const filePath = secretsFilePath || getSecretsFilePath();
-  const hint = 'Dataplane credentials are missing. Run: aifabrix app rotate-secret dataplane';
-  try {
-    if (!fs.existsSync(filePath)) {
-      return { valid: false, hint };
-    }
-    const content = fs.readFileSync(filePath, 'utf8');
-    const secrets = yaml.load(content) || {};
-    const clientIdKey = `${DATAPLANE_APP_KEY}-client-idKeyVault`;
-    const clientSecretKey = `${DATAPLANE_APP_KEY}-client-secretKeyVault`;
-    const hasId = secrets[clientIdKey] !== null && secrets[clientIdKey] !== undefined && String(secrets[clientIdKey]).trim() !== '';
-    const hasSecret = secrets[clientSecretKey] !== null && secrets[clientSecretKey] !== undefined && String(secrets[clientSecretKey]).trim() !== '';
-    if (hasId && hasSecret) {
-      return { valid: true };
-    }
-    return { valid: false, hint };
-  } catch {
-    return { valid: false, hint };
-  }
-}
-
-/**
- * Load client credentials from secrets.local.yaml or process.env (e.g. integration/hubspot-test/.env).
- * Reads secrets file using pattern: <app-name>-client-idKeyVault and <app-name>-client-secretKeyVault.
- * If not found, checks process.env.CLIENTID and process.env.CLIENTSECRET (set when .env is loaded).
- * @param {string} appName - Application name
- * @returns {Promise<{clientId: string, clientSecret: string}|null>} Credentials or null if not found
- */
-async function loadClientCredentials(appName) {
-  if (!appName || typeof appName !== 'string') {
-    throw new Error('App name is required and must be a string');
-  }
-
-  try {
-    const secretsFile = getSecretsFilePath();
-    if (fs.existsSync(secretsFile)) {
-      const content = fs.readFileSync(secretsFile, 'utf8');
-      const secrets = yaml.load(content) || {};
-
-      const clientIdKey = `${appName}-client-idKeyVault`;
-      const clientSecretKey = `${appName}-client-secretKeyVault`;
-
-      const clientId = secrets[clientIdKey];
-      const clientSecret = secrets[clientSecretKey];
-
-      if (clientId && clientSecret) {
-        return {
-          clientId: String(clientId),
-          clientSecret: String(clientSecret)
-        };
-      }
-    }
-  } catch (error) {
-    logger.warn(`Failed to load credentials from secrets.local.yaml: ${error.message}`);
-  }
-
-  // Fallback: use CLIENTID/CLIENTSECRET from process.env (e.g. from integration/hubspot-test/.env)
-  const envClientId = process.env.CLIENTID || process.env.CLIENT_ID;
-  const envClientSecret = process.env.CLIENTSECRET || process.env.CLIENT_SECRET;
-  if (envClientId && envClientSecret) {
-    return {
-      clientId: String(envClientId).trim(),
-      clientSecret: String(envClientSecret).trim()
-    };
-  }
-
-  return null;
-}
+const {
+  DATAPLANE_APP_KEY,
+  validateDataplaneSecrets,
+  loadClientCredentials,
+  resolveCredentialAppForDeployment
+} = require('./token-manager-client-credentials');
 
 /**
  * Get device token for controller
@@ -201,8 +121,12 @@ async function getOrRefreshDeviceToken(controllerUrl) {
   // Token needs refresh (expired or within 15 minutes of expiry)
   // Try to refresh if refresh token exists
   if (!tokenInfo.refreshToken) {
-    // No refresh token available
-    logger.warn('Access token expired and no refresh token available. Please login again using: aifabrix login');
+    const { isSetupPlatformFlow } = require('../commands/setup-run-context');
+    if (!isSetupPlatformFlow()) {
+      logger.warn(
+        'Access token expired and no refresh token available. Please login again using: aifabrix login'
+      );
+    }
     return null;
   }
 
@@ -302,27 +226,34 @@ async function tryClientTokenAuth(environment, appName, controllerUrl) {
  * @returns {Promise<{type: 'bearer'|'client-token', token: string, controller: string}>} Auth config: bearer = user token, client-token = app token (x-client-token header)
  * @throws {Error} If no authentication method is available
  */
-async function getDeploymentAuth(controllerUrl, environment, appName) {
+async function getDeploymentAuth(controllerUrl, environment, appName, options = {}) {
+  const { getDeploymentAuthMode, shouldUseDeviceTokenForDeployment } = require('./deployment-auth-mode');
   validateDeploymentAuthParams(controllerUrl, environment, appName);
+  const mode = getDeploymentAuthMode(options);
 
-  // Priority 1: Try device token (for user-level audit)
-  const deviceAuth = await tryDeviceTokenAuth(controllerUrl);
-  if (deviceAuth) {
-    return deviceAuth;
+  if (shouldUseDeviceTokenForDeployment(mode)) {
+    const deviceAuth = await tryDeviceTokenAuth(controllerUrl);
+    if (deviceAuth) {
+      return deviceAuth;
+    }
+    if (mode === 'device') {
+      throw new Error(
+        'Device token required (AIFABRIX_DEPLOYMENT_AUTH=device). Run: aifabrix login'
+      );
+    }
   }
 
-  // Priority 2: Try client token (application-level)
-  const clientTokenAuth = await tryClientTokenAuth(environment, appName, controllerUrl);
+  const { credentialApp, credentials } = await resolveCredentialAppForDeployment(appName);
+
+  const clientTokenAuth = await tryClientTokenAuth(environment, credentialApp, controllerUrl);
   if (clientTokenAuth) {
     return clientTokenAuth;
   }
 
-  // Priority 3: Exchange client credentials for a token (never return client-credentials for app endpoints)
-  const credentials = await loadClientCredentials(appName);
-  if (credentials && credentials.clientId && credentials.clientSecret) {
+  if (credentials?.clientId && credentials?.clientSecret) {
     try {
-      const refreshed = await refreshClientToken(environment, appName, controllerUrl);
-      if (refreshed && refreshed.token) {
+      const refreshed = await refreshClientToken(environment, credentialApp, controllerUrl);
+      if (refreshed?.token) {
         return {
           type: 'client-token',
           token: refreshed.token,
@@ -334,7 +265,11 @@ async function getDeploymentAuth(controllerUrl, environment, appName) {
     }
   }
 
-  throw new Error(`No authentication method available. Run 'aifabrix login' for device token, or add credentials to ~/.aifabrix/secrets.local.yaml as '${appName}-client-idKeyVault' and '${appName}-client-secretKeyVault'`);
+  throw new Error(
+    'No authentication method available. For CI: set AIFABRIX_DEPLOYMENT_AUTH=client-credentials and ' +
+      `MISO_CLIENTID/MISO_CLIENTSECRET in .env or '${credentialApp}-client-idKeyVault' in secrets.local.yaml. ` +
+      'For interactive use: aifabrix login'
+  );
 }
 
 /**
@@ -451,19 +386,63 @@ async function getDeviceOnlyAuth(controllerUrl) {
 }
 
 /**
- * Ensures auth config has a Bearer token for Dataplane pipeline endpoints.
- * Dataplane pipeline (upload, validate, publish, test) accepts OAuth2 (Bearer) or API_KEY only;
- * client id/secret are rejected. Call this before invoking pipeline API functions.
+ * Ensures auth config has a token Dataplane pipeline endpoints accept (Bearer or x-client-token).
+ * Dataplane pipeline rejects raw client id/secret; use POST /api/v1/auth/token first.
+ * When {@link process.env.AIFABRIX_DEPLOYMENT_AUTH} is `client-credentials`, keep application
+ * `x-client-token` auth (do not substitute API_KEY).
  * @param {Object} authConfig - Authentication configuration (may have token, clientId, clientSecret)
  * @throws {Error} If authConfig has only client id/secret (no token)
  */
+/**
+ * Lab bypass: records/search accepts Bearer API_KEY but rejects x-client-token on some stacks.
+ * @param {Object} authConfig
+ * @returns {Object}
+ */
+function applyLabDataplaneApiKeyBearer(authConfig) {
+  const labKey = process.env.AIFABRIX_DATAPLANE_API_KEY || '';
+  if (!labKey) {
+    return authConfig;
+  }
+  authConfig.type = 'bearer';
+  authConfig.token = String(labKey);
+  return authConfig;
+}
+
 function requireBearerForDataplanePipeline(authConfig) {
+  if (authConfig.type === 'client-token' && authConfig.token) {
+    return;
+  }
+
+  const preferAppClientToken =
+    String(process.env.AIFABRIX_DEPLOYMENT_AUTH || '').toLowerCase() === 'client-credentials';
+
+  if (!preferAppClientToken && process.env.API_KEY) {
+    const apiKey = String(process.env.API_KEY);
+    if (authConfig.type === 'bearer' && authConfig.token !== apiKey) {
+      authConfig.token = apiKey;
+      return;
+    }
+    if (authConfig.type === 'client-token') {
+      authConfig.type = 'bearer';
+      authConfig.token = apiKey;
+      return;
+    }
+  }
+
   if (authConfig.token) {
     return;
   }
+
+  if (!preferAppClientToken && process.env.API_KEY) {
+    authConfig.type = 'bearer';
+    authConfig.token = String(process.env.API_KEY);
+    return;
+  }
+
   if (authConfig.clientId || authConfig.clientSecret) {
     throw new Error(
-      'Dataplane pipeline endpoints require OAuth2 (Bearer token). Client id/secret are not accepted. Run "aifabrix login" to authenticate, then retry.'
+      'Dataplane pipeline endpoints require OAuth2 (Bearer token) or x-client-token. ' +
+        'Client id/secret are not accepted. Run "aifabrix login" to authenticate, then retry.'
     );
   }
 }
@@ -477,6 +456,7 @@ module.exports = {
   refreshClientToken,
   refreshDeviceToken,
   loadClientCredentials,
+  resolveCredentialAppForDeployment,
   getOrRefreshClientToken,
   getOrRefreshDeviceToken,
   forceRefreshDeviceToken,
@@ -484,5 +464,6 @@ module.exports = {
   getDeviceOnlyAuth,
   extractClientCredentials,
   requireBearerForDataplanePipeline,
+  applyLabDataplaneApiKeyBearer,
   validateDataplaneSecrets
 };

package/lib/utils/upload-pipeline-ui.js

@@ -0,0 +1,98 @@
+/**
+ * @fileoverview Progress line + optional ora spinner for dataplane pipeline upload/publish.
+ * @author AI Fabrix Team
+ * @version 1.1.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('./logger');
+const { formatProgress } = require('./cli-test-layout-chalk');
+
+/**
+ * @param {Object} [options]
+ * @param {boolean} [options.json] - When true, skip progress line and spinner
+ * @returns {boolean}
+ */
+function shouldShowUploadPipelineProgress(options = {}) {
+  if (options.suppressPipelineSpinner === true) {
+    return false;
+  }
+  return options.json !== true;
+}
+
+/**
+ * @param {Object} [options]
+ * @returns {boolean}
+ */
+function shouldUseUploadPipelineSpinner(options = {}) {
+  if (!shouldShowUploadPipelineProgress(options)) {
+    return false;
+  }
+  return Boolean(process && process.stdout && process.stdout.isTTY);
+}
+
+/**
+ * Plain label for spinner / progress (no glyph).
+ * @param {string} systemKey
+ * @returns {string}
+ */
+function buildUploadPipelineSpinnerLabel(systemKey, opts = {}) {
+  if (opts.syncMode === true) {
+    return 'Checking config on dataplane…';
+  }
+  const key = systemKey && String(systemKey).trim() ? String(systemKey).trim() : 'integration';
+  return `Publishing ${key} to dataplane…`;
+}
+
+/**
+ * @param {string} systemKey
+ * @param {Object} [opts]
+ * @returns {string}
+ */
+function buildUploadPipelineProgressText(systemKey, opts = {}) {
+  return formatProgress(buildUploadPipelineSpinnerLabel(systemKey, opts));
+}
+
+/**
+ * Run pipeline upload + OpenAPI sync with visible progress (⏳ line or ora with label on TTY).
+ *
+ * @async
+ * @param {Function} work - Zero-arg async function (publish + follow-up I/O)
+ * @param {Object} [opts]
+ * @param {string} [opts.systemKey]
+ * @param {boolean} [opts.json]
+ * @returns {Promise<*>}
+ */
+async function runWithUploadPipelineSpinner(work, opts = {}) {
+  if (!shouldShowUploadPipelineProgress(opts)) {
+    return work();
+  }
+
+  if (!shouldUseUploadPipelineSpinner(opts)) {
+    logger.log(buildUploadPipelineProgressText(opts.systemKey, opts));
+    return work();
+  }
+
+  const ora = require('ora');
+  const label = buildUploadPipelineSpinnerLabel(opts.systemKey, opts);
+  const spinner = ora({
+    text: chalk.white(label),
+    spinner: 'dots'
+  }).start();
+
+  try {
+    return await work();
+  } finally {
+    spinner.stop();
+  }
+}
+
+module.exports = {
+  shouldShowUploadPipelineProgress,
+  shouldUseUploadPipelineSpinner,
+  buildUploadPipelineSpinnerLabel,
+  buildUploadPipelineProgressText,
+  runWithUploadPipelineSpinner
+};

package/lib/utils/upload-sync-options.js

@@ -0,0 +1,42 @@
+/**
+ * Build options for `uploadExternalSystem` on test-command --sync paths.
+ *
+ * @fileoverview Minimal upload sync options (force, verbose)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {Object} [options] - CLI options from test / sync callers
+ * @returns {{ minimal: true, verbose: boolean, silentResolve: true, syncMode: true, force?: true }}
+ */
+function buildMinimalUploadSyncOptions(options = {}) {
+  const out = {
+    minimal: true,
+    // CLI -v on verify-* / test-* is for run output, not preflight upload banners.
+    verbose: false,
+    silentResolve: true,
+    syncMode: true,
+    suppressPipelineSpinner: options.suppressPipelineSpinner === true
+  };
+  if (options.force === true) {
+    out.force = true;
+  }
+  return out;
+}
+
+/**
+ * Minimal sync paths (verify-*, test --sync) always suppress upload sidecar chatter.
+ * @param {Object} [options]
+ * @returns {boolean}
+ */
+function isQuietMinimalSync(options = {}) {
+  return options.minimal === true || options.syncMode === true;
+}
+
+module.exports = {
+  buildMinimalUploadSyncOptions,
+  isQuietMinimalSync
+};

package/lib/utils/url-declarative-public-base.js

@@ -51,6 +51,12 @@ function hostPortForProfile(profile, listenPort, developerIdNum) {
     : localHostPort(listenPort, developerIdNum);
 }
 
+function localhostFrontDoorBaseForMissingRemote(opts) {
+  const { profile, developerIdNum } = opts || {};
+  const port = hostPortForProfile(profile, 3000, developerIdNum);
+  return `http://localhost:${port}`.replace(/\/+$/, '');
+}
+
 /**
  * Scheme for `declarativePublicUrlsUseLocalhost` bases: always **http** for loopback reachability
  * (ignore `tlsEnabled` / `remote-server` https — localhost URLs are not served with TLS in dev).
@@ -155,14 +161,26 @@ function templateUsesRemoteHostPlaceholder(hostTemplate) {
  * @returns {string|null}
  */
 function buildTraefikPublicBaseIfApplicable(opts) {
-  const { traefik, pathActive, hostTemplate, developerIdRaw, remoteServer, infraTlsEnabled } =
-    opts;
+  const {
+    traefik,
+    pathActive,
+    hostTemplate,
+    developerIdRaw,
+    remoteServer,
+    infraTlsEnabled,
+    profile,
+    developerIdNum
+  } = opts;
   // Plan 124: Traefik host authority only when pathActive (traefik ∧ frontDoorRouting.enabled)
   if (!traefik || !pathActive || !hostTemplate || !String(hostTemplate).trim()) {
     return null;
   }
   if (templateUsesRemoteHostPlaceholder(hostTemplate) && !String(remoteServer || '').trim()) {
-    return null;
+    // Local full-platform (no remote domain): use the single localhost front door port (3000 + devId×100).
+    return localhostFrontDoorBaseForMissingRemote({
+      profile,
+      developerIdNum
+    });
   }
   const expanded = expandFrontDoorHostTemplateForUrls(hostTemplate, {
     developerIdRaw,

package/lib/utils/url-declarative-vdir-inactive-env.js

@@ -15,6 +15,7 @@ const yaml = require('js-yaml');
 const { existsSync, readFileSync } = require('../internal/fs-real-sync');
 const { DECLARATIVE_URL_INFRA_DEFAULTS } = require('./infra-env-defaults');
 const { computePathActive } = require('./url-declarative-url-flags');
+const { resolveInactiveVdirRewriteEnvKeys } = require('./app-relative-path-env');
 
 /**
  * Treat common YAML / string forms as enabled (strict `=== true` alone missed some parsers).
@@ -52,16 +53,22 @@ const INACTIVE_VDIR_PUBLIC_ENV_FALLBACK =
 /**
  * @param {string} content - .env template fragment
  * @param {string} replacement
+ * @param {ReadonlySet<string>} rewriteKeys
  * @returns {string}
  */
-function applyInactiveVdirPublicTokenRewrite(content, replacement) {
+function applyInactiveVdirPublicTokenRewrite(content, replacement, rewriteKeys) {
   if (!content || !content.includes(URL_DECLARATIVE_VDIR_PUBLIC_TOKEN)) {
     return content;
   }
   const escaped = URL_DECLARATIVE_VDIR_PUBLIC_TOKEN.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
   // End line with [ \t]* only — \s would consume \n and strip line endings from the file.
-  const lineRe = new RegExp(`^(\\s*[A-Z][A-Z0-9_]*)\\s*=\\s*${escaped}[ \t]*$`, 'gm');
-  return content.replace(lineRe, (_, lhs) => `${lhs}=${replacement}`);
+  const lineRe = new RegExp(`^(\\s*)([A-Z][A-Z0-9_]*)\\s*=\\s*${escaped}[ \t]*$`, 'gm');
+  return content.replace(lineRe, (match, indent, key) => {
+    if (!rewriteKeys.has(key)) {
+      return match;
+    }
+    return `${indent}${key}=${replacement}`;
+  });
 }
 
 /**
@@ -88,12 +95,15 @@ function rewriteInactiveDeclarativeVdirPublicContent(content, variablesPath, use
   if (pathActive) {
     return content;
   }
-  return applyInactiveVdirPublicTokenRewrite(content, INACTIVE_VDIR_PUBLIC_ENV_FALLBACK);
+  const appKey = doc && doc.app && doc.app.key;
+  const rewriteKeys = resolveInactiveVdirRewriteEnvKeys(appKey);
+  return applyInactiveVdirPublicTokenRewrite(content, INACTIVE_VDIR_PUBLIC_ENV_FALLBACK, rewriteKeys);
 }
 
 module.exports = {
   URL_DECLARATIVE_VDIR_PUBLIC_TOKEN,
   INACTIVE_VDIR_PUBLIC_ENV_FALLBACK,
+  loadApplicationYamlDoc,
   applyInactiveVdirPublicTokenRewrite,
   rewriteInactiveDeclarativeVdirPublicContent,
   isFrontDoorRoutingEnabledInDoc

package/lib/utils/validation-poll-ui.js

@@ -23,10 +23,12 @@ function shouldUseValidationPollSpinner() {
  * @param {number} deadlineMs - Wall-clock deadline (Date.now() + remaining budget)
  * @returns {string}
  */
-function buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs) {
+function buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs, subject) {
   const remainingSec = Math.max(0, Math.ceil((deadlineMs - Date.now()) / 1000));
+  const label =
+    subject && String(subject).trim() ? String(subject).trim() : 'validation run';
   if (!envelope || typeof envelope !== 'object') {
-    return `Waiting for validation run… starting (budget ~${remainingSec}s)`;
+    return `Waiting for ${label}… starting (budget ~${remainingSec}s)`;
   }
   const c =
     envelope.reportCompleteness !== undefined && envelope.reportCompleteness !== null
@@ -34,26 +36,37 @@ function buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs) {
       : '?';
   const st =
     envelope.status !== undefined && envelope.status !== null ? String(envelope.status) : '?';
-  return `Waiting for validation run… completeness=${c} status=${st} (poll ${attemptIndex + 1} · ~${remainingSec}s left)`;
+  return `Waiting for ${label}… completeness=${c} status=${st} (poll ${attemptIndex + 1} · ~${remainingSec}s left)`;
 }
 
 const NON_TTY_THROTTLE_MS = 5000;
 
 /**
  * @param {number} deadlineMs - Absolute deadline for poll budget display
+ * @param {Object} [opts]
+ * @param {string} [opts.subject] - Datasource key or label shown in poll text
  * @returns {{ usesSpinner: boolean, onPollProgress: Function, finish: () => void }}
  */
-function createValidationPollHandlers(deadlineMs) {
+function createValidationPollHandlers(deadlineMs, opts = {}) {
+  if (opts.quiet === true) {
+    return {
+      usesSpinner: false,
+      onPollProgress: () => {},
+      finish: () => {}
+    };
+  }
+
+  const subject = opts.subject;
   if (shouldUseValidationPollSpinner()) {
     const ora = require('ora');
     const spinner = ora({
-      text: buildValidationPollSpinnerText(null, 0, deadlineMs),
+      text: buildValidationPollSpinnerText(null, 0, deadlineMs, subject),
       spinner: 'dots'
     }).start();
     return {
       usesSpinner: true,
       onPollProgress: (envelope, attemptIndex, _meta) => {
-        spinner.text = buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs);
+        spinner.text = buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs, subject);
       },
       finish: () => {
         spinner.stop();
@@ -68,7 +81,9 @@ function createValidationPollHandlers(deadlineMs) {
       const now = Date.now();
       if (now - lastNonTtyLogAt < NON_TTY_THROTTLE_MS) return;
       lastNonTtyLogAt = now;
-      logger.log(chalk.gray(buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs)));
+      logger.log(
+        chalk.gray(buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs, subject))
+      );
     },
     finish: () => {}
   };

package/lib/utils/validation-run-stage.js

@@ -0,0 +1,45 @@
+/**
+ * @fileoverview Map legacy validation runType to contract stage (dataplane 370.07).
+ */
+
+'use strict';
+
+/** @typedef {'readiness'|'simulation'|'integration'|'e2e'} ValidationRunStage */
+
+/** @type {Record<string, ValidationRunStage>} */
+const RUN_TYPE_TO_STAGE = {
+  test: 'readiness',
+  integration: 'integration',
+  e2e: 'e2e'
+};
+
+/**
+ * Contract stage for a CLI/API runType (default product mapping).
+ * @param {string} runType - test | integration | e2e
+ * @returns {ValidationRunStage}
+ */
+function stageForRunType(runType) {
+  const key = String(runType || 'test');
+  return RUN_TYPE_TO_STAGE[key] || 'readiness';
+}
+
+/**
+ * Attach stage to a validation/run POST body when absent.
+ * @param {Object} body
+ * @param {string} [runType]
+ * @returns {Object}
+ */
+function withStageOnValidationRunBody(body, runType) {
+  const out = { ...body };
+  const rt = runType || out.runType || 'test';
+  if (!out.stage) {
+    out.stage = stageForRunType(rt);
+  }
+  return out;
+}
+
+module.exports = {
+  RUN_TYPE_TO_STAGE,
+  stageForRunType,
+  withStageOnValidationRunBody
+};