@aifabrix/builder 2.45.5 → 2.47.0

package/.cursor/rules/cli-layout.mdc

@@ -7,6 +7,8 @@ alwaysApply: false
 
 When you touch **CLI surface** (`bin/aifabrix.js`, `lib/cli.js`, `lib/cli/**`, `lib/commands/**`) or **shared CLI formatters**, you must keep behavior aligned with the canonical docs in this folder.
 
+**Product-neutral copy:** User-facing help, errors, and warnings must not reference internal plan IDs or hardcode lab-only integration names in generic code. See [cli-product-neutral.mdc](./cli-product-neutral.mdc).
+
 ## Sources of truth (read before shipping)
 
 | Document | Role |

package/.cursor/rules/cli-product-neutral.mdc

@@ -0,0 +1,43 @@
+---
+description: Apply when changing aifabrix CLI code, help text, errors, or user-facing docs under docs/commands. Keeps product output free of internal plans, training labs, and hardcoded integration names.
+alwaysApply: false
+---
+
+# CLI product-neutral output (Builder)
+
+The **aifabrix** CLI is a **product**. User-visible strings must not encode internal engineering artifacts.
+
+## Forbidden in product paths
+
+Applies to **`lib/cli/**`**, **`lib/commands/**`**, CLI help (Commander `.description()` / `.option()` / `addHelpText`), **`lib/utils/*-error*.js`**, terminal messages from **`lib/utils/cli-*`**, and **`docs/commands/**`** (see [docs-rules.mdc](./docs-rules.mdc)).
+
+| Do not use | Use instead |
+| ---------- | ----------- |
+| Internal plan IDs (`Plan 331`, `plan 148`, `BK-1`) | User terms: *active datasource schema guards*, *schema replacement*, *overlap* |
+| Training / lab-only system keys baked into `if` branches (`sharepoint-e2e`, `hubspot-demo` in runtime logic) | **Dynamic** behavior from `systemKey`, `appName`, manifest, env.template, or secrets map |
+| Hardcoded vendor or connector names in generic helpers | Generic rules (path suffix, namespace, configuration keys from disk) |
+| Cursor plan file paths in errors or help | Link only in `.cursor/plans/` and contributor docs |
+
+**Examples in docs/commands** may name real apps (`hubspot-e2e`) when illustrating a command; **library code** must not special-case those names unless the user passed them as arguments.
+
+## Required patterns
+
+- **Missing `kv://` secrets:** Compare requested paths to the loaded secrets map generically (e.g. same path segment under a different namespace). Never hardcode `sharepoint` / `sharepoint-e2e` (or any other lab pair) in `lib/`.
+- **`--force` messaging:** Describe dataplane behavior (*bypass active-datasource schema replacement guards*), not internal plan numbers. Do **not** append extra CLI hints by matching English substrings on API errors — the dataplane pipeline already returns remediation in the 400 body when schema replacement is blocked.
+- **No `upload-pipeline-error-hints`-style modules:** Prefer forwarding `formatApiError` output; optional hints belong in the API contract, not duplicated heuristics in the CLI.
+- **Auth / pipeline errors:** Describe what the user can do (`aifabrix login`, `AIFABRIX_DEPLOYMENT_AUTH=client-credentials`), not ticket or plan IDs.
+- **JSDoc `@fileoverview`:** No plan numbers; optional brief behavior description only.
+
+## Verification
+
+Before merging CLI UX changes:
+
+1. `rg -i 'plan [0-9]|BK-[0-9]|sharepoint-e2e' lib/cli lib/commands lib/utils --glob '*.js'` → no matches in generic helpers (fixture strings in tests are OK).
+2. New error hints must work for **any** integration folder name the user owns.
+3. [cli-layout.mdc](./cli-layout.mdc) and [docs-rules.mdc](./docs-rules.mdc) still apply for glyphs and user-doc scope.
+
+## Related
+
+- [cli-layout.mdc](./cli-layout.mdc) — terminal layout and output profiles
+- [docs-rules.mdc](./docs-rules.mdc) — public CLI documentation audience
+- [project-rules.mdc](./project-rules.mdc) — ISO / security baseline

package/.cursor/rules/project-rules.mdc

@@ -894,6 +894,7 @@ Define request/response types using JSDoc `@typedef`:
 
 ### Must Not Do (❌)
 - ❌ Never hardcode secrets, passwords, or tokens
+- ❌ Never hardcode lab/training integration names, vendor names, or internal plan IDs in generic CLI/helpers (`lib/commands/**`, `lib/cli/**`, shared `lib/utils/*-error*.js`); use dynamic keys from user input, manifests, and secrets — see [cli-product-neutral.mdc](cli-product-neutral.mdc)
 - ❌ Never expose sensitive data in error messages
 - ❌ Never use synchronous file operations in async functions (unless necessary)
 - ❌ Never ignore errors or use empty catch blocks

package/.npmrc.token

@@ -0,0 +1 @@
+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

package/.temp/jest-protection-convert/run-IFN2nv/.protection/hubspot-companies.json

@@ -0,0 +1 @@
+{"apiVersion":"dataplane.aifabrix.ai/v1","kind":"Protection","metadata":{"key":"hubspot-country-sales","displayName":"HubSpot Country Sales Access"},"spec":{"enabled":true,"datasourceKey":"hubspot-companies","mode":"replaceForSource","rules":[{"key":"sales-country-users","principal":{"type":"group","expression":"Sales {{fk.country.metadata.iso3}} Users"},"grants":[{"dimensionKey":"country","valueExpression":"{{fk.country.metadata.iso2}}"}]}]}}

package/.temp/jest-protection-convert/run-IvmKLO/.protection/hubspot-companies.yaml

@@ -0,0 +1,17 @@
+apiVersion: dataplane.aifabrix.ai/v1
+kind: Protection
+metadata:
+  key: hubspot-country-sales
+  displayName: HubSpot Country Sales Access
+spec:
+  enabled: true
+  datasourceKey: hubspot-companies
+  mode: replaceForSource
+  rules:
+    - key: sales-country-users
+      principal:
+        type: group
+        expression: "Sales {{fk.country.metadata.iso3}} Users"
+      grants:
+        - dimensionKey: country
+          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-convert/run-SdvblF/.protection/hubspot-companies.json

@@ -0,0 +1 @@
+{"kind":"Protection"}

package/.temp/jest-protection-convert/run-b51TsW/.protection/hubspot-companies.json

@@ -0,0 +1 @@
+{"apiVersion":"dataplane.aifabrix.ai/v1","kind":"Protection","metadata":{"key":"hubspot-country-sales","displayName":"HubSpot Country Sales Access"},"spec":{"enabled":true,"datasourceKey":"hubspot-companies","mode":"replaceForSource","rules":[{"key":"sales-country-users","principal":{"type":"group","expression":"Sales {{fk.country.metadata.iso3}} Users"},"grants":[{"dimensionKey":"country","valueExpression":"{{fk.country.metadata.iso2}}"}]}]}}

package/.temp/jest-protection-convert/run-fiLmb1/.protection/hubspot-companies.json

@@ -0,0 +1 @@
+{"kind":"Protection"}

package/.temp/jest-protection-convert/run-qYGHMU/.protection/hubspot-companies.yaml

@@ -0,0 +1,17 @@
+apiVersion: dataplane.aifabrix.ai/v1
+kind: Protection
+metadata:
+  key: hubspot-country-sales
+  displayName: HubSpot Country Sales Access
+spec:
+  enabled: true
+  datasourceKey: hubspot-companies
+  mode: replaceForSource
+  rules:
+    - key: sales-country-users
+      principal:
+        type: group
+        expression: "Sales {{fk.country.metadata.iso3}} Users"
+      grants:
+        - dimensionKey: country
+          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-Mq5re8/hubspot-companies.yaml

@@ -0,0 +1,17 @@
+apiVersion: dataplane.aifabrix.ai/v1
+kind: Protection
+metadata:
+  key: hubspot-country-sales
+  displayName: HubSpot Country Sales Access
+spec:
+  enabled: true
+  datasourceKey: hubspot-companies
+  mode: replaceForSource
+  rules:
+    - key: sales-country-users
+      principal:
+        type: group
+        expression: "Sales {{fk.country.metadata.iso3}} Users"
+      grants:
+        - dimensionKey: country
+          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-f3u4YL/hubspot-companies.yaml

@@ -0,0 +1,17 @@
+apiVersion: dataplane.aifabrix.ai/v1
+kind: Protection
+metadata:
+  key: hubspot-country-sales
+  displayName: HubSpot Country Sales Access
+spec:
+  enabled: true
+  datasourceKey: hubspot-companies
+  mode: replaceForSource
+  rules:
+    - key: sales-country-users
+      principal:
+        type: group
+        expression: "Sales {{fk.country.metadata.iso3}} Users"
+      grants:
+        - dimensionKey: country
+          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-iQtd1O/hubspot-companies.yaml

@@ -0,0 +1,17 @@
+apiVersion: dataplane.aifabrix.ai/v1
+kind: Protection
+metadata:
+  key: hubspot-country-sales
+  displayName: HubSpot Country Sales Access
+spec:
+  enabled: true
+  datasourceKey: hubspot-companies
+  mode: replaceForSource
+  rules:
+    - key: sales-country-users
+      principal:
+        type: group
+        expression: "Sales {{fk.country.metadata.iso3}} Users"
+      grants:
+        - dimensionKey: country
+          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-mdmz5M/hubspot-companies.yaml

@@ -0,0 +1,17 @@
+apiVersion: dataplane.aifabrix.ai/v1
+kind: Protection
+metadata:
+  key: hubspot-country-sales
+  displayName: HubSpot Country Sales Access
+spec:
+  enabled: true
+  datasourceKey: hubspot-companies
+  mode: replaceForSource
+  rules:
+    - key: sales-country-users
+      principal:
+        type: group
+        expression: "Sales {{fk.country.metadata.iso3}} Users"
+      grants:
+        - dimensionKey: country
+          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-qbKYxQ/hubspot-companies.yaml

@@ -0,0 +1,17 @@
+apiVersion: dataplane.aifabrix.ai/v1
+kind: Protection
+metadata:
+  key: hubspot-country-sales
+  displayName: HubSpot Country Sales Access
+spec:
+  enabled: true
+  datasourceKey: hubspot-companies
+  mode: replaceForSource
+  rules:
+    - key: sales-country-users
+      principal:
+        type: group
+        expression: "Sales {{fk.country.metadata.iso3}} Users"
+      grants:
+        - dimensionKey: country
+          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-yzlJy6/hubspot-companies.yaml

@@ -0,0 +1,17 @@
+apiVersion: dataplane.aifabrix.ai/v1
+kind: Protection
+metadata:
+  key: hubspot-country-sales
+  displayName: HubSpot Country Sales Access
+spec:
+  enabled: true
+  datasourceKey: hubspot-companies
+  mode: replaceForSource
+  rules:
+    - key: sales-country-users
+      principal:
+        type: group
+        expression: "Sales {{fk.country.metadata.iso3}} Users"
+      grants:
+        - dimensionKey: country
+          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/validation/summary.txt

@@ -0,0 +1,5 @@
+lint:fix exit=0
+lint exit=0
+test exit=0
+miso typecheck exit=0
+miso build exit=0

package/README.md

@@ -23,12 +23,12 @@ Open developer runtime for AI Fabrix ecosystem. Install the AI Fabrix platform a
 ## Prerequisites
 
 - **Node.js 18+** – Recommended for running the CLI.
-- **AI Fabrix Azure / platform:** Install from **Azure Marketplace** or run via **Docker** (e.g. `aifabrix up-platform`). You need **full access to Docker** (docker commands) where applicable.
-- **Secrets before platform:** Add secrets (e.g. OpenAI or Azure OpenAI) **before** running `aifabrix up-platform`; the platform reads them from the place you configure. See [Infrastructure](docs/infrastructure.md) and secrets configuration.
+- **Docker Desktop** – Full access to Docker (containers for infra and platform).
+- **Secrets before platform:** Add an AI tool key (OpenAI or Azure OpenAI) in setup or with `aifabrix secret set` **before** the platform needs them. See [Infrastructure](docs/infrastructure.md).
 
 ---
 
-## Install
+## Install the CLI
 
 ```bash
 npm install -g @aifabrix/builder
@@ -38,33 +38,59 @@ npm install -g @aifabrix/builder
 
 ---
 
-## Goal 1: Start and test the AI Fabrix platform
+## Goal 1: Install the platform (one command)
 
-Get the platform running locally so you can try it.
-
-**One-shot install:**
+Get Postgres, Redis, Keycloak, Miso Controller, and Dataplane running on your machine.
 
 ```bash
 aifabrix setup
 ```
 
-`aifabrix setup` detects your local state and either runs a fresh-install wizard (admin email/password, optional AI tool keys) or shows a mode menu (re-install, wipe data, clean files, update images). It then runs `up-infra` and `up-platform` for you. Use `aifabrix teardown` to fully remove the local installation. See [Infrastructure commands](docs/commands/infrastructure.md#aifabrix-setup) for details and CI flags.
+That is the whole story for most developers. The command detects whether infra is already running:
+
+| Situation | What happens |
+| --- | --- |
+| **Fresh machine** | Short wizard → pull images → `up-infra` → `up-platform` |
+| **Already installed** | Mode menu (3 choices): **re-install** (destroys volumes), **wipe data** (DBs only), or **update images** (keeps data) — each path pulls fresh Docker images before restart |
+
+**Grab a coffee** — setup pulls infrastructure and platform images (a few minutes on first run or after image updates). When setup finishes, the CLI stores **`platform-controller`** in `config.yaml` (absolute Miso URL for your machine). Sign in with username **`admin`** and your admin password. If you were already logged in to that controller URL, setup keeps your session; otherwise it prompts for device login like a fresh install.
+
+**Controller URL:** Local Docker without Traefik uses `http://localhost:` + port `3000 + developerId×100`. With Traefik and `remote-server`, use the public URL shown in the **Platform Ready** footer (path `/miso/*`). See [Infrastructure guide](docs/infrastructure.md#install-the-platform-one-command).
+
+→ Step-by-step detail, ports, and **dev / pro** installation profiles: **[Infrastructure guide](docs/infrastructure.md#install-the-platform-one-command)**
+
+### Dev vs pro installation (setup profile)
+
+These names match how we talk about **environments** elsewhere (**dev**, **tst**, **pro**). Here they mean **how you install locally**, not which cloud environment you deploy to later.
+
+| Profile | Best for | Admin email | Admin passwords |
+| --- | --- | --- | --- |
+| **dev** (default) | Local development, training, labs | You enter once | **One password** for Postgres, pgAdmin, Keycloak, and platform login |
+| **pro** | Production-style or hardened installs | Same | **Autogenerate** strong passwords (shown once) **or** enter manually |
 
-If you prefer to set the AI tool key outside the wizard, use one of:
+**Default:** **dev** (one email, one password). **Pro** is available in the setup wizard or non-interactively:
 
-- **OpenAI:** set your API key:
+```bash
+aifabrix setup --installation pro --pro-password-mode autogen
+```
+
+Use `--pro-password-mode manual` to enter passwords yourself (one password for all roles, or separate infra / Keycloak / platform passwords via `up-infra` flags).
+
+Admin credentials are stored in **`~/.aifabrix/admin-secrets.env`** (encrypted when you configure a secrets encryption key). App and integration secrets stay in **`~/.aifabrix/secrets.local.yaml`**.
+
+### Optional: set AI keys outside the wizard
+
+- **OpenAI:**
   ```bash
   aifabrix secret set secrets-openaiApiKeyVault <your-openai-secret-key>
   ```
-- **Azure OpenAI:** set endpoint and API key:
+- **Azure OpenAI:**
   ```bash
   aifabrix secret set azure-openaiapi-urlKeyVault <your-azure-openai-endpoint-url>
   aifabrix secret set secrets-azureOpenaiApiKeyVault <your-azure-openai-secret-key>
   ```
 
-Secrets are stored in `~/.aifabrix/secrets.local.yaml` or the file from `aifabrix-secrets` in your config (e.g. `builder/secrets.local.yaml`).
-
-→ [Infrastructure guide](docs/infrastructure.md)
+Remove the platform completely: `aifabrix teardown`. Command details: [Infrastructure commands](docs/commands/infrastructure.md#aifabrix-setup).
 
 ---
 
@@ -72,7 +98,7 @@ Secrets are stored in `~/.aifabrix/secrets.local.yaml` or the file from `aifabri
 
 Create and deploy an external system (e.g. HubSpot): wizard or manual setup, then validate and deploy.
 
-**Example: HubSpot**
+**Example: HubSpot:**
 
 - Create: `aifabrix create hubspot-test` (external is the default; or `aifabrix wizard` for guided setup). For a web app use `aifabrix create my-app --type webapp`.
 - Configure auth and datasources under `integration/hubspot-test/`.
@@ -96,7 +122,7 @@ Create, configure, and run your own AI Fabrix application locally or deploy it (
 All guides and references are listed in **[docs/README.md](docs/README.md)** (table of contents).
 
 - [CLI Commands Reference](docs/commands/README.md) – All commands
-- [Infrastructure](docs/infrastructure.md) – What runs and why
+- [Infrastructure](docs/infrastructure.md) – Install the platform, services, dev/pro setup
 - [Configuration reference](docs/configuration/README.md) – Config files (deployment key, application.yaml, env.template, secrets)
 
 ---
@@ -111,6 +137,6 @@ All guides and references are listed in **[docs/README.md](docs/README.md)** (ta
 
 ## License
 
-© eSystems Nordic Ltd 2025 - All Rights Reserved
+© eSystems Nordic Ltd 2026 - All Rights Reserved
 
 `@aifabrix/builder` is part of the AI Fabrix platform.

package/integration/hubspot-test/test-artifacts/wizard-hubspot-credential-real.yaml

@@ -2,7 +2,7 @@ appName: wizard-e2e-credential-real
 mode: create-system
 source:
   type: openapi-file
-  filePath: ./integration/hubspot-test/companies.json
+  filePath: /workspace/aifabrix-builder/integration/hubspot-test/companies.json
 credential:
   action: create
   config:

package/integration/hubspot-test/test-artifacts/wizard-hubspot-env-vars.yaml

@@ -2,7 +2,7 @@ appName: wizard-e2e-env-vars
 mode: create-system
 source:
   type: openapi-file
-  filePath: ./integration/hubspot-test/companies.json
+  filePath: /workspace/aifabrix-builder/integration/hubspot-test/companies.json
 deployment:
   controller: ${CONTROLLER_URL}
   dataplane: ${DATAPLANE_URL}

package/jest.config.default.js

@@ -3,8 +3,9 @@
  * @fileoverview
  */
 
-const { defaultProject } = require('./jest.projects');
+const { defaultProject, globalLiveFabrixHooks } = require('./jest.projects');
 
 module.exports = {
+  ...globalLiveFabrixHooks,
   projects: [defaultProject]
 };

package/jest.config.isolated.js

@@ -3,8 +3,9 @@
  * @fileoverview
  */
 
-const { isolatedProjects } = require('./jest.projects');
+const { isolatedProjects, globalLiveFabrixHooks } = require('./jest.projects');
 
 module.exports = {
+  ...globalLiveFabrixHooks,
   projects: isolatedProjects
 };

package/jest.global-live-fabrix-hooks.js

@@ -0,0 +1,36 @@
+/**
+ * Global Jest hooks and CI guard project for live ~/.aifabrix protection.
+ * @fileoverview
+ */
+
+/** Once per Jest process — protects live ~/.aifabrix (incl. /workspace/.aifabrix). */
+const globalLiveFabrixHooks = {
+  globalSetup: '<rootDir>/tests/global-live-fabrix-backup.js',
+  globalTeardown: '<rootDir>/tests/global-live-fabrix-backup.js'
+};
+
+/**
+ * @param {object} opts - CI flag and Babel transform config from jest.projects.js
+ * @param {boolean} opts.isCI - Whether CI or CI simulation is active
+ * @param {object} opts.sharedTransform - Shared babel-jest transform map
+ * @returns {object} Jest project configuration
+ */
+function createSetupCiLiveFabrixGuardProject({ isCI, sharedTransform }) {
+  return {
+    displayName: 'setup-ci-live-fabrix-guard',
+    testEnvironment: 'node',
+    transform: sharedTransform,
+    testMatch: ['**/tests/setup-ci-live-fabrix-guard.test.js'],
+    testPathIgnorePatterns: ['/node_modules/', '\\\\node_modules\\\\'],
+    setupFiles: ['<rootDir>/tests/capture-real-fs.js', '<rootDir>/tests/setup-ci-env.js'],
+    setupFilesAfterEnv: ['<rootDir>/tests/setup.js'],
+    testTimeout: isCI ? 15000 : 8000,
+    maxWorkers: 1,
+    ...globalLiveFabrixHooks
+  };
+}
+
+module.exports = {
+  globalLiveFabrixHooks,
+  createSetupCiLiveFabrixGuardProject
+};

package/jest.isolated-projects.js

@@ -0,0 +1,146 @@
+/**
+ * Jest isolated project list (separate process per suite when run via jest.config.isolated.js).
+ * @fileoverview
+ */
+
+'use strict';
+
+const { createSetupCiLiveFabrixGuardProject } = require('./jest.global-live-fabrix-hooks');
+
+/** @type {[string, string[]][]} displayName and testMatch globs */
+const ISOLATED_SUITE_ENTRIES = [
+  ['cli-utils', ['**/tests/lib/utils/cli-utils.test.js']],
+  ['external-system-display', ['**/tests/lib/utils/external-system-display.test.js']],
+  ['dev-hosts-helper', ['**/tests/lib/utils/dev-hosts-helper.test.js']],
+  ['parameters-validate', ['**/tests/lib/commands/parameters-validate.test.js']],
+  ['test-e2e-external', ['**/tests/lib/commands/test-e2e-external.test.js']],
+  ['repair-openapi-sync', ['**/tests/lib/commands/repair-openapi-sync.test.js']],
+  ['paths-app-listing', ['**/tests/lib/utils/paths-app-listing.test.js']],
+  ['paths-system-builder-resolution', ['**/tests/lib/utils/paths-system-builder-resolution.test.js']],
+  ['manifest-location', ['**/tests/lib/utils/manifest-location.test.js']],
+  ['installation-log', ['**/tests/lib/utils/installation-log.test.js']],
+  ['secrets-ancestor-paths', ['**/tests/lib/utils/secrets-ancestor-paths.test.js']],
+  ['datasource-validation-watch', ['**/tests/lib/utils/datasource-validation-watch.test.js']],
+  [
+    'log-viewer',
+    [
+      '**/tests/lib/datasource/log-viewer.test.js',
+      '**/tests/lib/datasource/log-viewer-structural.test.js',
+      '**/tests/lib/datasource/log-viewer-run.test.js'
+    ]
+  ],
+  ['audit-evidence-extract', ['**/tests/lib/datasource/audit-evidence-extract.test.js']],
+  ['manifest-source-emit', ['**/tests/lib/utils/manifest-source-emit.test.js']],
+  ['register-aifabrix-shell-env', ['**/tests/lib/utils/register-aifabrix-shell-env.test.js']],
+  ['datasource-test-run-schema-sync', ['**/tests/lib/utils/datasource-test-run-schema-sync.test.js']],
+  ['infra-platform-contract', ['**/tests/lib/parameters/infra-platform-contract.test.js']],
+  [
+    'application-frontdoor-paths-contract',
+    ['**/tests/lib/templates/application-frontdoor-paths.contract.test.js']
+  ],
+  ['database-secret-values', ['**/tests/lib/parameters/database-secret-values.test.js']],
+  ['infra-parameter-validate', ['**/tests/lib/parameters/infra-parameter-validate.test.js']],
+  [
+    'infra-parameter-catalog',
+    [
+      '**/tests/lib/parameters/infra-parameter-catalog.test.js',
+      '**/tests/lib/utils/platform-kv-ref.test.js'
+    ]
+  ],
+  ['urls-local-registry', ['**/tests/lib/utils/urls-local-registry.test.js']],
+  ['aifabrix-runtime-config-dir', ['**/tests/lib/utils/aifabrix-runtime-config-dir.test.js']],
+  ['platform-env-template-kv-catalog', ['**/tests/lib/parameters/platform-env-template-kv-catalog.test.js']],
+  ['resolve-infra-state-paths', ['**/tests/lib/infrastructure/resolve-infra-state-paths.test.js']],
+  ['dev-ssh-config-helper', ['**/tests/lib/utils/dev-ssh-config-helper.test.js']],
+  ['ssh-key-helper', ['**/tests/lib/utils/ssh-key-helper.test.js']],
+  ['secrets-ensure-catalog-fallback', ['**/tests/lib/core/secrets-ensure-catalog-fallback.test.js']],
+  ['secrets-ensure', ['**/tests/lib/core/secrets-ensure.test.js']],
+  ['url-declarative-vdir-inactive-env', ['**/tests/lib/utils/url-declarative-vdir-inactive-env.test.js']],
+  [
+    'url-declarative-user-cfg-per-app-proxy',
+    ['**/tests/lib/utils/url-declarative-user-cfg-per-app-proxy.test.js']
+  ],
+  [
+    'declarative-url-paths-spy-suites',
+    [
+      '**/tests/lib/utils/url-declarative-expand-traefik-off-no-usercfg.test.js',
+      '**/tests/lib/core/secrets-env-declarative-show-urls.test.js',
+      '**/tests/lib/utils/url-declarative-registry-internal-docker-origin.test.js'
+    ]
+  ],
+  ['platform-urls-registry-validation', ['**/tests/lib/commands/platform-urls-registry.validation.test.js']],
+  ['env-copy-resolve-output', ['**/tests/lib/utils/env-copy-resolve-output.test.js']],
+  ['write-env-output-reload', ['**/tests/lib/utils/write-env-output-reload.test.js']],
+  ['app-service-env-from-builder', ['**/tests/lib/utils/app-service-env-from-builder.test.js']],
+  ['infra-kv-discovery', ['**/tests/lib/parameters/infra-kv-discovery.test.js']],
+  ['infra-env-defaults', ['**/tests/lib/utils/infra-env-defaults.test.js']],
+  ['compose-traefik-template', ['**/tests/lib/infrastructure/compose-traefik-template.test.js']],
+  ['generator-external-rbac', ['**/tests/lib/generator/generator-external-rbac.test.js']],
+  ['helpers-ensure-admin-secrets', ['**/tests/lib/infrastructure/helpers-ensure-admin-secrets.test.js']],
+  ['secrets-generator', ['**/tests/lib/utils/secrets-generator.test.js']],
+  ['ensure-dev-certs-for-remote-docker', ['**/tests/lib/utils/ensure-dev-certs-for-remote-docker.test.js']],
+  ['generator-error-paths', ['**/tests/lib/generator/generator-error-paths.test.js']],
+  ['generator-validation', ['**/tests/lib/generator/generator-validation.test.js']],
+  ['secrets-databaselog', ['**/tests/lib/core/secrets-databaselog.test.js']],
+  ['schema-241-alignment', ['**/tests/lib/validation/schema-241-alignment.test.js']],
+  ['hubspot-e2e-com-v2', ['**/tests/lib/validation/hubspot-e2e-com-v2.test.js']],
+  ['runtime-configuration-download', ['**/tests/lib/utils/runtime-configuration-download.test.js']],
+  ['schema-resolver-order', ['**/tests/lib/utils/schema-resolver-order.test.js']],
+  ['app-module', ['**/tests/lib/app/app.test.js']],
+  ['admin-secrets', ['**/tests/lib/core/admin-secrets.test.js']],
+  ['validate-datasource-parsed', ['**/tests/lib/datasource/validate-datasource-parsed.test.js']],
+  [
+    'capability-run-real-fs',
+    [
+      '**/tests/lib/datasource/run-capability-copy.test.js',
+      '**/tests/lib/datasource/run-capability-diff.test.js',
+      '**/tests/lib/datasource/run-capability-edit.test.js',
+      '**/tests/lib/datasource/run-capability-remove.test.js'
+    ]
+  ],
+  ['log-cleaner', ['**/tests/lib/datasource/log-cleaner.test.js']],
+  ['datasource-exporter-service', ['**/tests/lib/datasource/datasource-exporter-service.test.js']],
+  ['protection-paths', ['**/tests/lib/protection/paths.test.js']],
+  ['protection-resolve', ['**/tests/lib/protection/protection-resolve.test.js']],
+  ['protection-create-helpers', ['**/tests/lib/protection/run-protection-create-helpers.test.js']],
+  [
+    'governance-pack-loader',
+    [
+      '**/tests/lib/governance/governance-pack-loader.test.js',
+      '**/tests/lib/lifecycle/scenario-upload.test.js'
+    ]
+  ],
+  [
+    'governance-generate-external',
+    ['**/tests/lib/commands/governance-generate-external.test.js']
+  ],
+  ['protection-validate-batch', ['**/tests/lib/protection/validate-batch.test.js']],
+  ['aifabrix-runtime-sandbox', ['**/tests/helpers/aifabrix-runtime-sandbox.test.js']],
+  ['aifabrix-runtime-backup', ['**/tests/helpers/aifabrix-runtime-backup.test.js']],
+  ['paths-jest-sandbox-integration', ['**/tests/lib/utils/paths-jest-sandbox-integration.test.js']],
+  ['secrets-remove-all-guard', ['**/tests/lib/commands/secrets-remove-all-guard.test.js']],
+  ['app-logs', ['**/tests/lib/commands/app-logs.test.js']],
+  [
+    'channel-real-fs',
+    [
+      '**/tests/lib/channels/channel-integration-generator.test.js',
+      '**/tests/lib/channels/channel-artifact-generator.test.js'
+    ]
+  ]
+];
+
+/**
+ * @param {Function} makeIsolatedProject - Factory from jest.projects.js
+ * @param {boolean} isCI - True when CI or CI_SIMULATION is set
+ * @param {object} sharedTransform - Babel-jest transform shared with default project
+ * @returns {object[]} Jest multi-project entries
+ */
+function buildIsolatedProjects(makeIsolatedProject, isCI, sharedTransform) {
+  const projects = ISOLATED_SUITE_ENTRIES.map(([name, testMatch]) =>
+    makeIsolatedProject(name, testMatch)
+  );
+  projects.push(createSetupCiLiveFabrixGuardProject({ isCI, sharedTransform }));
+  return projects;
+}
+
+module.exports = { buildIsolatedProjects, ISOLATED_SUITE_ENTRIES };