@aifabrix/builder 2.45.5 → 2.46.0

package/lib/lifecycle/scenario-upload.js

@@ -0,0 +1,191 @@
+/**
+ * @fileoverview Upload local governance scenario YAML packs to dataplane (419.0).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const {
+  existsSync,
+  readFileSync,
+  readdirSync,
+  mkdirSync,
+  writeFileSync
+} = require('../internal/fs-real-sync');
+const yaml = require('js-yaml');
+const logger = require('../utils/logger');
+const { getIntegrationPath } = require('../utils/paths');
+const { upsertDatasourceGovernancePack } = require('../api/governance-scenario-pack.api');
+const { formatSuccessLine, formatWarningLine } = require('../utils/cli-test-layout-chalk');
+const { shortGovernanceApiError } = require('../governance/governance-cli-errors');
+const { printGovernanceDownloadMisses } = require('../governance/governance-download-display');
+
+/**
+ * @param {string} scenariosDir
+ * @returns {string[]}
+ */
+function listScenarioYamlFiles(scenariosDir) {
+  if (!existsSync(scenariosDir)) return [];
+  return readdirSync(scenariosDir)
+    .filter(name => name.endsWith('.yaml') || name.endsWith('.yml'))
+    .map(name => path.join(scenariosDir, name));
+}
+
+/**
+ * Extract datasource keys referenced in a pack document.
+ * @param {Object} pack
+ * @returns {string[]}
+ */
+function datasourceKeysFromPack(pack) {
+  const keys = new Set();
+  const scenarios = pack?.spec?.scenarios || [];
+  for (const scenario of scenarios) {
+    const dsKeys = scenario?.search?.datasourceKeys || [];
+    for (const k of dsKeys) {
+      if (k && typeof k === 'string') keys.add(k.trim());
+    }
+  }
+  return [...keys];
+}
+
+/**
+ * @param {string} filePath
+ * @returns {Object}
+ */
+function loadPackFromFile(filePath) {
+  const raw = readFileSync(filePath, 'utf8');
+  const doc = yaml.load(raw);
+  if (!doc || typeof doc !== 'object') {
+    throw new Error(`Invalid scenario pack YAML: ${filePath}`);
+  }
+  return doc;
+}
+
+/**
+ * Upload scenario packs under integration/<systemKey>/scenarios/ to dataplane.
+ * @async
+ * @param {string} systemKey
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {{ silent?: boolean }} [opts]
+ * @returns {Promise<number>} count of packs uploaded
+ */
+async function uploadGovernanceScenarioPacks(systemKey, dataplaneUrl, authConfig, opts = {}) {
+  const scenariosDir = path.join(getIntegrationPath(systemKey), 'scenarios');
+  const files = listScenarioYamlFiles(scenariosDir);
+  if (files.length === 0) return 0;
+
+  let uploaded = 0;
+  for (const filePath of files) {
+    const pack = loadPackFromFile(filePath);
+    const dsKeys = datasourceKeysFromPack(pack);
+    if (dsKeys.length === 0) {
+      if (!opts.silent) {
+        logger.log(
+          formatWarningLine(
+            `Skipping ${path.basename(filePath)} — no datasourceKeys in scenarios`
+          )
+        );
+      }
+      continue;
+    }
+    for (const dsKey of dsKeys) {
+      await upsertDatasourceGovernancePack(dataplaneUrl, authConfig, dsKey, pack);
+      uploaded += 1;
+      if (!opts.silent) {
+        logger.log(
+          formatSuccessLine(
+            `Governance scenario pack uploaded for ${dsKey} (${path.basename(filePath)})`
+          )
+        );
+      }
+    }
+  }
+  return uploaded;
+}
+
+/**
+ * Write governance scenario packs from dataplane to integration/<systemKey>/scenarios/.
+ * @async
+ * @param {string} systemKey
+ * @param {string[]} datasourceKeys
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @returns {Promise<number>}
+ */
+async function downloadGovernanceScenarioPacks(
+  systemKey,
+  datasourceKeys,
+  dataplaneUrl,
+  authConfig
+) {
+  const { getDatasourceGovernancePack } = require('../api/governance-scenario-pack.api');
+  const scenariosDir = path.join(getIntegrationPath(systemKey), 'scenarios');
+  if (!existsSync(scenariosDir)) {
+    mkdirSync(scenariosDir, { recursive: true });
+  }
+
+  let written = 0;
+  const missing = [];
+  for (const dsKey of datasourceKeys) {
+    try {
+      const row = await getDatasourceGovernancePack(dataplaneUrl, authConfig, dsKey);
+      if (!row || !row.pack) {
+        missing.push({
+          datasourceKey: dsKey,
+          reason: 'No active pack on dataplane'
+        });
+        continue;
+      }
+      const outPath = path.join(scenariosDir, `${dsKey}.yaml`);
+      writeFileSync(outPath, yaml.dump(row.pack, { lineWidth: 120 }), 'utf8');
+      written += 1;
+      logger.log(formatSuccessLine(`Scenario pack saved: ${outPath}`));
+    } catch (err) {
+      missing.push({
+        datasourceKey: dsKey,
+        reason: shortGovernanceApiError(err)
+      });
+    }
+  }
+  printGovernanceDownloadMisses(missing);
+  return written;
+}
+
+/**
+ * Download governance packs for all datasource keys on a running manifest.
+ * @async
+ * @param {string} systemKey
+ * @param {Object} manifest
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @returns {Promise<number>}
+ */
+async function downloadGovernanceScenarioPacksFromManifest(
+  systemKey,
+  manifest,
+  dataplaneUrl,
+  authConfig
+) {
+  const dsKeys = (manifest.dataSources || []).map((ds) => ds && ds.key).filter(Boolean);
+  if (dsKeys.length === 0) {
+    return 0;
+  }
+  try {
+    return await downloadGovernanceScenarioPacks(systemKey, dsKeys, dataplaneUrl, authConfig);
+  } catch (err) {
+    logger.log(formatWarningLine(`Governance scenario download skipped: ${err.message}`));
+    return 0;
+  }
+}
+
+module.exports = {
+  listScenarioYamlFiles,
+  datasourceKeysFromPack,
+  loadPackFromFile,
+  uploadGovernanceScenarioPacks,
+  downloadGovernanceScenarioPacks,
+  downloadGovernanceScenarioPacksFromManifest
+};

package/lib/lifecycle/verify-step-progress.js

@@ -0,0 +1,87 @@
+/**
+ * Active progress (ora spinner or single ⏳ line) for verify-* orchestration steps.
+ *
+ * @fileoverview Verify step progress UI
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { formatProgress } = require('../utils/cli-test-layout-chalk');
+const { withQuietLogs } = require('./logger-quiet');
+
+/**
+ * @param {Object} [options]
+ * @returns {boolean}
+ */
+function shouldShowVerifyStepProgress(options = {}) {
+  return options.json !== true;
+}
+
+/**
+ * @param {Object} [options]
+ * @returns {boolean}
+ */
+function shouldUseVerifyStepSpinner(options = {}) {
+  if (!shouldShowVerifyStepProgress(options)) {
+    return false;
+  }
+  return Boolean(process && process.stdout && process.stdout.isTTY);
+}
+
+/**
+ * @param {string} label
+ * @returns {string}
+ */
+function formatVerifyStepLabel(label) {
+  const text = label && String(label).trim() ? String(label).trim() : 'Processing';
+  return text.endsWith('…') ? text : `${text}…`;
+}
+
+/**
+ * Run a verify step with one active progress indicator (spinner on TTY).
+ *
+ * @template T
+ * @async
+ * @param {string} label - Plain label without trailing ellipsis
+ * @param {(progress: { setLabel: (next: string) => void }) => Promise<T>} work
+ * @param {Object} [options]
+ * @param {boolean} [options.json]
+ * @returns {Promise<T>}
+ */
+async function runWithVerifyStepProgress(label, work, options = {}) {
+  if (!shouldShowVerifyStepProgress(options)) {
+    return withQuietLogs(() => work({ setLabel: () => {} }));
+  }
+
+  if (!shouldUseVerifyStepSpinner(options)) {
+    logger.log(formatProgress(formatVerifyStepLabel(label)));
+    return withQuietLogs(() => work({ setLabel: () => {} }));
+  }
+
+  const ora = require('ora');
+  const spinner = ora({
+    text: chalk.white(formatVerifyStepLabel(label)),
+    spinner: 'dots'
+  }).start();
+
+  const setLabel = (next) => {
+    spinner.text = chalk.white(formatVerifyStepLabel(next));
+  };
+
+  try {
+    return await withQuietLogs(() => work({ setLabel }));
+  } finally {
+    spinner.stop();
+  }
+}
+
+module.exports = {
+  shouldShowVerifyStepProgress,
+  shouldUseVerifyStepSpinner,
+  formatVerifyStepLabel,
+  runWithVerifyStepProgress
+};

package/lib/parameters/infra-kv-discovery.js

@@ -6,7 +6,10 @@
 
 const fsRealSync = require('../internal/fs-real-sync');
 const path = require('path');
-const { loadRequiresDatabasesArray } = require('./database-secret-values');
+const { loadRequiresDatabasesArray, loadShippedRequiresDatabases } = require('./database-secret-values');
+
+/** Platform apps from shipped templates (setup/up-infra before builder/ is copied). */
+const SHIPPED_PLATFORM_APP_KEYS = ['keycloak', 'miso-controller', 'dataplane'];
 
 /**
  * Extract kv:// secret key names from env template content (active lines only).
@@ -90,6 +93,25 @@ function deriveDatabaseKvKeysFromWorkspace(pathsUtil) {
   return [...keys];
 }
 
+/**
+ * Database kv keys from shipped platform templates when builder/ apps are not copied yet
+ * (e.g. `aifabrix setup` fresh install before `up-platform`).
+ *
+ * @returns {string[]}
+ */
+function deriveDatabaseKvKeysFromShippedPlatformTemplates() {
+  const keys = new Set();
+  for (const appKey of SHIPPED_PLATFORM_APP_KEYS) {
+    const dbs = loadShippedRequiresDatabases(appKey);
+    if (!Array.isArray(dbs) || dbs.length === 0) continue;
+    for (let i = 0; i < dbs.length; i++) {
+      keys.add(`databases-${appKey}-${i}-urlKeyVault`);
+      keys.add(`databases-${appKey}-${i}-passwordKeyVault`);
+    }
+  }
+  return [...keys];
+}
+
 /**
  * Keys from env.template files whose catalog entry includes the given hook (e.g. upInfra).
  * @param {object} pathsUtil - paths module
@@ -132,6 +154,7 @@ function getAllInfraEnsureKeys(catalog, pathsUtil) {
   const set = new Set();
   for (const k of catalog.getStandardUpInfraBootstrapKeys()) set.add(k);
   for (const k of deriveDatabaseKvKeysFromWorkspace(pathsUtil)) set.add(k);
+  for (const k of deriveDatabaseKvKeysFromShippedPlatformTemplates()) set.add(k);
   for (const k of discoverKvKeysFromEnvTemplatesForHook(pathsUtil, 'upInfra', catalog)) set.add(k);
   return [...set].sort();
 }
@@ -139,8 +162,10 @@ function getAllInfraEnsureKeys(catalog, pathsUtil) {
 module.exports = {
   extractKvKeysFromEnvContent,
   deriveDatabaseKvKeysFromWorkspace,
+  deriveDatabaseKvKeysFromShippedPlatformTemplates,
   discoverKvKeysFromEnvTemplatesForHook,
   getAllInfraEnsureKeys,
   listAppDirsForDiscovery,
-  listBuilderAppDirsForDiscovery
+  listBuilderAppDirsForDiscovery,
+  SHIPPED_PLATFORM_APP_KEYS
 };

package/lib/protection/auth-context.js

@@ -9,6 +9,7 @@
 const { resolveControllerUrl } = require('../utils/controller-url');
 const { resolveEnvironment } = require('../core/config');
 const { getDeviceOnlyAuth, getDeploymentAuth } = require('../utils/token-manager');
+const { getDeploymentAuthMode } = require('../utils/deployment-auth-mode');
 const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
 
 /**
@@ -23,11 +24,16 @@ async function resolveProtectionDataplaneContext(options = {}) {
     throw new Error('Controller URL is required. Run "aifabrix login" first.');
   }
 
+  const authMode = getDeploymentAuthMode(options);
   let authConfig;
-  try {
-    authConfig = await getDeviceOnlyAuth(controllerUrl);
-  } catch {
-    authConfig = await getDeploymentAuth(controllerUrl, environment, 'dataplane');
+  if (authMode === 'client-credentials') {
+    authConfig = await getDeploymentAuth(controllerUrl, environment, 'dataplane', options);
+  } else {
+    try {
+      authConfig = await getDeviceOnlyAuth(controllerUrl);
+    } catch {
+      authConfig = await getDeploymentAuth(controllerUrl, environment, 'dataplane', options);
+    }
   }
 
   if (!authConfig?.token) {

package/lib/schema/application-schema.json

@@ -34,7 +34,7 @@
         "version": "1.4.0",
         "date": "2026-04-06T00:00:00Z",
         "changes": [
-          "Removed build.localPort: local workstation PORT and localhost URL rewriting use the root-level manifest port only, with local host port = port + 10 + developerId*100 (developer id 0 → port+10). Docker published host port remains port + developerId*100.",
+          "Removed build.localPort: local workstation PORT and localhost URL rewriting use the root-level manifest port only, with host port = port + developerId*100 (developer id 0 → port). Same formula for Docker publish and aifabrix run.",
           "Migration: delete build.localPort from application.yaml; set or keep port as the single listen/container port. Use url://public, url://internal, or url://<app>-public|internal in env.template for declarative URLs (resolved after kv://)."
         ],
         "breaking": true

package/lib/schema/datasource-test-run.schema.json

@@ -2,20 +2,25 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "aifabrix://schema/datasource-test-run.schema.json",
   "title": "DatasourceTestRun",
-  "description": "Canonical datasource-root test report (plans 362/365). Public success shape for POST /api/v1/validation/run (and async poll GET /validation/run/{testRunId}). runType=test|integration|e2e; CLI/docs may say test | test-integration | test-e2e; public JSON uses runType only. Includes validation layer (machine/explain), certificate snapshot, optional integration pipeline results, capability E2Es, debug by reference, plural audit refs, developer summaries. Forward-compatible: minor reportVersion bumps may add fields.",
+  "description": "Canonical datasource-root test report (plans 362/365, 370.06, 370.07 stage). Public success shape for POST /api/v1/validation/run (and async poll GET /validation/run/{testRunId}). runType=test|integration|e2e; stage=readiness|simulation|integration|e2e. reportVersion 1.5.0 adds required stage (minor bump). Older clients must tolerate absent stage when reportVersion < 1.5.0.",
   "type": "object",
-  "required": ["reportVersion", "datasourceKey", "systemKey", "runType", "status"],
+  "required": ["reportVersion", "datasourceKey", "systemKey", "runType", "stage", "status"],
   "properties": {
     "reportVersion": {
       "type": "string",
       "description": "Semver-style contract version for this envelope. Policy: additive fields => minor bump within same major; removed/renamed fields => major bump. Route migrations must cite target reportVersion.",
-      "example": "1.3.0"
+      "example": "1.5.0"
     },
     "runType": {
       "type": "string",
-      "description": "Kind of run. Maps to CLI/commands: test=test, test-integration=integration, test-e2e=e2e. Do not use kebab strings inside runType.",
+      "description": "Legacy kind of run. Maps to CLI: test, test-integration, test-e2e. Prefer stage for new clients.",
       "enum": ["test", "integration", "e2e"]
     },
+    "stage": {
+      "type": "string",
+      "description": "Contract validation stage aligned with contracts/rules stage and concept appliesTo.",
+      "enum": ["readiness", "simulation", "integration", "e2e"]
+    },
     "status": {
       "type": "string",
       "description": "Root rollup across validation, integration, certificate, and capabilities for this datasource run: ok | warn | fail | skipped.",
@@ -252,7 +257,7 @@
         "level": {
           "type": "string",
           "description": "Achieved certification tier when applicable.",
-          "enum": ["bronze", "silver", "gold"]
+          "enum": ["bronze", "silver", "gold", "platinum"]
         },
         "summary": {
           "type": "string",
@@ -388,6 +393,61 @@
         }
       }
     },
+    "FixInstruction": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["step"],
+      "description": "One deterministic repair step (370.03 fixInstruction vocabulary).",
+      "properties": {
+        "step": {
+          "type": "string",
+          "enum": [
+            "locate_file",
+            "update_path",
+            "add_mapping",
+            "set_value",
+            "remove_value",
+            "add_item",
+            "remove_item",
+            "explain"
+          ]
+        },
+        "value": {
+          "type": "string",
+          "description": "Brace tokens only in authored YAML: {datasource}, {systemKey}, {field}, {raw.*}."
+        },
+        "path": { "type": "string" },
+        "template": { "type": "string" },
+        "note": { "type": "string" }
+      }
+    },
+    "IssueFix": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["type", "instructions"],
+      "description": "Structured remediation on Issue (370.06; aligned with rule YAML fix).",
+      "properties": {
+        "type": {
+          "type": "string",
+          "enum": [
+            "add_mapping",
+            "edit_schema",
+            "edit_exposure",
+            "edit_governance",
+            "edit_execution",
+            "generic"
+          ]
+        },
+        "instructions": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/FixInstruction" }
+        },
+        "example": {
+          "description": "Optional structured or scalar example for authors/tooling."
+        }
+      }
+    },
     "Issue": {
       "type": "object",
       "required": ["message"],
@@ -395,7 +455,7 @@
       "properties": {
         "code": {
           "type": "string",
-          "description": "Stable code: DP-VAL-* (structural/config), DP-CIP-* (execution/CIP), DP-SEC-* (auth/RBAC/exposure), DP-CONN-* (REST/MCP/connectivity), DP-E2E-* (end-to-end live); warnings DP-*-Wnn. Mapped from engine errorCode in DatasourceTestRun builders.",
+          "description": "Stable code: DP-VAL-* (structural/config), DP-CIP-* (execution/CIP), DP-SEC-* (auth/RBAC/exposure), DP-CONN-* (REST/MCP/connectivity), DP-E2E-* (end-to-end live); warnings DP-*-Wnn. Prefer stableCode when present; otherwise mapped from engine errorCode.",
           "example": "DP-CIP-010"
         },
         "message": {
@@ -410,6 +470,29 @@
         "hint": {
           "type": "string",
           "description": "Remediation or next-step hint."
+        },
+        "conceptId": {
+          "type": "string",
+          "description": "Concept catalog id (370.02) for concept-first organization."
+        },
+        "ruleId": {
+          "type": "string",
+          "description": "YAML rule id when the finding came from the contract rule set.",
+          "example": "VAL-PIL-001"
+        },
+        "stableCode": {
+          "type": "string",
+          "description": "Frozen DP-* stable code from rule YAML.",
+          "example": "DP-VAL-097"
+        },
+        "ruleRefs": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Legacy or supplemental rule references; prefer ruleId + stableCode for YAML rules."
+        },
+        "fix": {
+          "$ref": "#/$defs/IssueFix",
+          "description": "Structured fix instructions when the emitting rule supplies them."
         }
       }
     },