@aifabrix/builder 2.45.5 → 2.47.0

package/jest.projects.js

@@ -4,6 +4,9 @@
  * @fileoverview
  */
 
+const { globalLiveFabrixHooks } = require('./jest.global-live-fabrix-hooks');
+const { buildIsolatedProjects } = require('./jest.isolated-projects');
+
 // Detect CI environment (GitHub Actions, CI simulation, etc.)
 const isCI = process.env.CI === 'true' || process.env.CI_SIMULATION === 'true';
 
@@ -31,7 +34,7 @@ function makeIsolatedProject(displayName, testMatch) {
     testPathIgnorePatterns: ['/node_modules/', '\\\\node_modules\\\\'],
     setupFiles: ['<rootDir>/tests/capture-real-fs.js'],
     setupFilesAfterEnv: ['<rootDir>/tests/setup.js'],
-    testTimeout: isCI ? 10000 : 5000,
+    testTimeout: isCI ? 15000 : 8000,
     maxWorkers: 1
   };
 }
@@ -79,10 +82,18 @@ const defaultProject = {
       'lib/datasource/log-viewer-structural.test.js',
       'lib/datasource/log-viewer-run.test.js',
       'log-viewer-run\\.test\\.js',
+      '/tests/lib/datasource/audit-evidence-extract.test.js',
+      '\\\\tests\\\\lib\\\\datasource\\\\audit-evidence-extract.test.js',
+      'lib/datasource/audit-evidence-extract.test.js',
+      'audit-evidence-extract\\.test\\.js',
       '/tests/lib/commands/parameters-validate.test.js',
       '\\\\tests\\\\lib\\\\commands\\\\parameters-validate.test.js',
       'lib/commands/parameters-validate.test.js',
       'parameters-validate\\.test\\.js',
+      '/tests/lib/commands/test-e2e-external.test.js',
+      '\\\\tests\\\\lib\\\\commands\\\\test-e2e-external.test.js',
+      'lib/commands/test-e2e-external.test.js',
+      'test-e2e-external\\.test\\.js',
       '/tests/lib/commands/repair-openapi-sync.test.js',
       '\\\\tests\\\\lib\\\\commands\\\\repair-openapi-sync.test.js',
       'lib/commands/repair-openapi-sync.test.js',
@@ -105,6 +116,10 @@ const defaultProject = {
       '\\\\tests\\\\lib\\\\parameters\\\\infra-parameter-catalog.test.js',
       'lib/parameters/infra-parameter-catalog.test.js',
       'infra-parameter-catalog\\.test\\.js',
+      '/tests/lib/utils/platform-kv-ref.test.js',
+      '\\\\tests\\\\lib\\\\utils\\\\platform-kv-ref.test.js',
+      'lib/utils/platform-kv-ref.test.js',
+      'platform-kv-ref\\.test\\.js',
       '/tests/lib/utils/urls-local-registry.test.js',
       '\\\\tests\\\\lib\\\\utils\\\\urls-local-registry.test.js',
       'lib/utils/urls-local-registry.test.js',
@@ -221,10 +236,6 @@ const defaultProject = {
       '\\\\tests\\\\lib\\\\utils\\\\secrets-generator.test.js',
       'lib/utils/secrets-generator.test.js',
       'secrets-generator\\.test\\.js',
-      '/tests/lib/app/app-uncovered-lines.test.js',
-      '\\\\tests\\\\lib\\\\app\\\\app-uncovered-lines.test.js',
-      'lib/app/app-uncovered-lines.test.js',
-      'app-uncovered-lines\\.test\\.js',
       '/tests/lib/utils/ensure-dev-certs-for-remote-docker.test.js',
       '\\\\tests\\\\lib\\\\utils\\\\ensure-dev-certs-for-remote-docker.test.js',
       'lib/utils/ensure-dev-certs-for-remote-docker.test.js',
@@ -245,6 +256,14 @@ const defaultProject = {
       '\\\\tests\\\\lib\\\\validation\\\\schema-241-alignment.test.js',
       'lib/validation/schema-241-alignment.test.js',
       'schema-241-alignment\\.test\\.js',
+      '/tests/lib/validation/hubspot-e2e-com-v2.test.js',
+      '\\\\tests\\\\lib\\\\validation\\\\hubspot-e2e-com-v2.test.js',
+      'lib/validation/hubspot-e2e-com-v2.test.js',
+      'hubspot-e2e-com-v2\\.test\\.js',
+      '/tests/lib/utils/runtime-configuration-download.test.js',
+      '\\\\tests\\\\lib\\\\utils\\\\runtime-configuration-download.test.js',
+      'lib/utils/runtime-configuration-download.test.js',
+      'runtime-configuration-download\\.test\\.js',
       '/tests/lib/utils/schema-resolver-order.test.js',
       '\\\\tests\\\\lib\\\\utils\\\\schema-resolver-order.test.js',
       'lib/utils/schema-resolver-order.test.js',
@@ -303,10 +322,46 @@ const defaultProject = {
       '\\\\tests\\\\lib\\\\governance\\\\governance-pack-loader.test.js',
       'lib/governance/governance-pack-loader.test.js',
       'governance-pack-loader\\.test\\.js',
+      '/tests/lib/lifecycle/scenario-upload.test.js',
+      '\\\\tests\\\\lib\\\\lifecycle\\\\scenario-upload.test.js',
+      'lib/lifecycle/scenario-upload.test.js',
+      'scenario-upload\\.test\\.js',
+      '/tests/lib/commands/governance-generate-external.test.js',
+      '\\\\tests\\\\lib\\\\commands\\\\governance-generate-external.test.js',
+      'lib/commands/governance-generate-external.test.js',
+      'governance-generate-external\\.test\\.js',
       '/tests/lib/protection/validate-batch.test.js',
       '\\\\tests\\\\lib\\\\protection\\\\validate-batch.test.js',
       'lib/protection/validate-batch.test.js',
-      'validate-batch\\.test\\.js'
+      'validate-batch\\.test\\.js',
+      '/tests/helpers/aifabrix-runtime-sandbox.test.js',
+      '\\\\tests\\\\helpers\\\\aifabrix-runtime-sandbox.test.js',
+      'helpers/aifabrix-runtime-sandbox\\.test\\.js',
+      '/tests/helpers/aifabrix-runtime-backup.test.js',
+      '\\\\tests\\\\helpers\\\\aifabrix-runtime-backup.test.js',
+      'helpers/aifabrix-runtime-backup\\.test\\.js',
+      '/tests/lib/utils/paths-jest-sandbox-integration.test.js',
+      '\\\\tests\\\\lib\\\\utils\\\\paths-jest-sandbox-integration.test.js',
+      'paths-jest-sandbox-integration\\.test\\.js',
+      '/tests/lib/commands/secrets-remove-all-guard.test.js',
+      '\\\\tests\\\\lib\\\\commands\\\\secrets-remove-all-guard.test.js',
+      'lib/commands/secrets-remove-all-guard.test.js',
+      'secrets-remove-all-guard\\.test\\.js',
+      '/tests/lib/commands/app-logs.test.js',
+      '\\\\tests\\\\lib\\\\commands\\\\app-logs.test.js',
+      'lib/commands/app-logs.test.js',
+      'app-logs\\.test\\.js',
+      '/tests/lib/channels/channel-integration-generator.test.js',
+      '\\\\tests\\\\lib\\\\channels\\\\channel-integration-generator.test.js',
+      'lib/channels/channel-integration-generator.test.js',
+      'channel-integration-generator\\.test\\.js',
+      '/tests/lib/channels/channel-artifact-generator.test.js',
+      '\\\\tests\\\\lib\\\\channels\\\\channel-artifact-generator.test.js',
+      'lib/channels/channel-artifact-generator.test.js',
+      'channel-artifact-generator\\.test\\.js',
+      '/tests/setup-ci-live-fabrix-guard.test.js',
+      '\\\\tests\\\\setup-ci-live-fabrix-guard.test.js',
+      'setup-ci-live-fabrix-guard\\.test\\.js'
     ];
     if (process.env.INCLUDE_LOCAL_TESTS !== 'true') {
       patterns.push('/tests/local/');
@@ -316,139 +371,12 @@ const defaultProject = {
   })(),
   setupFiles: ['<rootDir>/tests/capture-real-fs.js'],
   setupFilesAfterEnv: ['<rootDir>/tests/setup.js'],
-  testTimeout: isCI ? 10000 : 5000,
+  testTimeout: isCI ? 15000 : 8000,
   detectOpenHandles: true,
   maxWorkers: 1
 };
 
-const isolatedProjects = [
-  makeIsolatedProject('cli-utils', ['**/tests/lib/utils/cli-utils.test.js']),
-  makeIsolatedProject('external-system-display', ['**/tests/lib/utils/external-system-display.test.js']),
-  makeIsolatedProject('dev-hosts-helper', ['**/tests/lib/utils/dev-hosts-helper.test.js']),
-  makeIsolatedProject('parameters-validate', ['**/tests/lib/commands/parameters-validate.test.js']),
-  makeIsolatedProject('repair-openapi-sync', ['**/tests/lib/commands/repair-openapi-sync.test.js']),
-  makeIsolatedProject('paths-app-listing', ['**/tests/lib/utils/paths-app-listing.test.js']),
-  makeIsolatedProject('paths-system-builder-resolution', [
-    '**/tests/lib/utils/paths-system-builder-resolution.test.js'
-  ]),
-  makeIsolatedProject('manifest-location', ['**/tests/lib/utils/manifest-location.test.js']),
-  makeIsolatedProject('installation-log', ['**/tests/lib/utils/installation-log.test.js']),
-  makeIsolatedProject('secrets-ancestor-paths', ['**/tests/lib/utils/secrets-ancestor-paths.test.js']),
-  makeIsolatedProject('datasource-validation-watch', [
-    '**/tests/lib/utils/datasource-validation-watch.test.js'
-  ]),
-  makeIsolatedProject('log-viewer', [
-    '**/tests/lib/datasource/log-viewer.test.js',
-    '**/tests/lib/datasource/log-viewer-structural.test.js',
-    '**/tests/lib/datasource/log-viewer-run.test.js'
-  ]),
-  makeIsolatedProject('manifest-source-emit', ['**/tests/lib/utils/manifest-source-emit.test.js']),
-  makeIsolatedProject('register-aifabrix-shell-env', [
-    '**/tests/lib/utils/register-aifabrix-shell-env.test.js'
-  ]),
-  makeIsolatedProject('datasource-test-run-schema-sync', [
-    '**/tests/lib/utils/datasource-test-run-schema-sync.test.js'
-  ]),
-  makeIsolatedProject('infra-platform-contract', [
-    '**/tests/lib/parameters/infra-platform-contract.test.js'
-  ]),
-  makeIsolatedProject('application-frontdoor-paths-contract', [
-    '**/tests/lib/templates/application-frontdoor-paths.contract.test.js'
-  ]),
-  makeIsolatedProject('database-secret-values', [
-    '**/tests/lib/parameters/database-secret-values.test.js'
-  ]),
-  makeIsolatedProject('infra-parameter-validate', [
-    '**/tests/lib/parameters/infra-parameter-validate.test.js'
-  ]),
-  makeIsolatedProject('infra-parameter-catalog', [
-    '**/tests/lib/parameters/infra-parameter-catalog.test.js'
-  ]),
-  makeIsolatedProject('urls-local-registry', ['**/tests/lib/utils/urls-local-registry.test.js']),
-  makeIsolatedProject('aifabrix-runtime-config-dir', [
-    '**/tests/lib/utils/aifabrix-runtime-config-dir.test.js'
-  ]),
-  makeIsolatedProject('platform-env-template-kv-catalog', [
-    '**/tests/lib/parameters/platform-env-template-kv-catalog.test.js'
-  ]),
-  makeIsolatedProject('resolve-infra-state-paths', [
-    '**/tests/lib/infrastructure/resolve-infra-state-paths.test.js'
-  ]),
-  makeIsolatedProject('dev-ssh-config-helper', [
-    '**/tests/lib/utils/dev-ssh-config-helper.test.js'
-  ]),
-  makeIsolatedProject('ssh-key-helper', ['**/tests/lib/utils/ssh-key-helper.test.js']),
-  makeIsolatedProject('secrets-ensure-catalog-fallback', [
-    '**/tests/lib/core/secrets-ensure-catalog-fallback.test.js'
-  ]),
-  makeIsolatedProject('secrets-ensure', ['**/tests/lib/core/secrets-ensure.test.js']),
-  makeIsolatedProject('url-declarative-vdir-inactive-env', [
-    '**/tests/lib/utils/url-declarative-vdir-inactive-env.test.js'
-  ]),
-  makeIsolatedProject('url-declarative-user-cfg-per-app-proxy', [
-    '**/tests/lib/utils/url-declarative-user-cfg-per-app-proxy.test.js'
-  ]),
-  makeIsolatedProject('declarative-url-paths-spy-suites', [
-    '**/tests/lib/utils/url-declarative-expand-traefik-off-no-usercfg.test.js',
-    '**/tests/lib/core/secrets-env-declarative-show-urls.test.js',
-    '**/tests/lib/utils/url-declarative-registry-internal-docker-origin.test.js'
-  ]),
-  makeIsolatedProject('platform-urls-registry-validation', [
-    '**/tests/lib/commands/platform-urls-registry.validation.test.js'
-  ]),
-  makeIsolatedProject('env-copy-resolve-output', ['**/tests/lib/utils/env-copy-resolve-output.test.js']),
-  makeIsolatedProject('write-env-output-reload', ['**/tests/lib/utils/write-env-output-reload.test.js']),
-  makeIsolatedProject('app-service-env-from-builder', [
-    '**/tests/lib/utils/app-service-env-from-builder.test.js'
-  ]),
-  makeIsolatedProject('infra-kv-discovery', ['**/tests/lib/parameters/infra-kv-discovery.test.js']),
-  makeIsolatedProject('infra-env-defaults', ['**/tests/lib/utils/infra-env-defaults.test.js']),
-  makeIsolatedProject('compose-traefik-template', [
-    '**/tests/lib/infrastructure/compose-traefik-template.test.js'
-  ]),
-  makeIsolatedProject('generator-external-rbac', [
-    '**/tests/lib/generator/generator-external-rbac.test.js'
-  ]),
-  makeIsolatedProject('helpers-ensure-admin-secrets', [
-    '**/tests/lib/infrastructure/helpers-ensure-admin-secrets.test.js'
-  ]),
-  makeIsolatedProject('secrets-generator', ['**/tests/lib/utils/secrets-generator.test.js']),
-  makeIsolatedProject('app-uncovered-lines', ['**/tests/lib/app/app-uncovered-lines.test.js']),
-  makeIsolatedProject('ensure-dev-certs-for-remote-docker', [
-    '**/tests/lib/utils/ensure-dev-certs-for-remote-docker.test.js'
-  ]),
-  makeIsolatedProject('generator-error-paths', ['**/tests/lib/generator/generator-error-paths.test.js']),
-  makeIsolatedProject('generator-validation', ['**/tests/lib/generator/generator-validation.test.js']),
-  makeIsolatedProject('secrets-databaselog', ['**/tests/lib/core/secrets-databaselog.test.js']),
-  makeIsolatedProject('schema-241-alignment', ['**/tests/lib/validation/schema-241-alignment.test.js']),
-  makeIsolatedProject('schema-resolver-order', ['**/tests/lib/utils/schema-resolver-order.test.js']),
-  makeIsolatedProject('app-module', ['**/tests/lib/app/app.test.js']),
-  makeIsolatedProject('admin-secrets', ['**/tests/lib/core/admin-secrets.test.js']),
-  makeIsolatedProject('validate-datasource-parsed', [
-    '**/tests/lib/datasource/validate-datasource-parsed.test.js'
-  ]),
-  makeIsolatedProject('capability-run-real-fs', [
-    '**/tests/lib/datasource/run-capability-copy.test.js',
-    '**/tests/lib/datasource/run-capability-diff.test.js',
-    '**/tests/lib/datasource/run-capability-edit.test.js',
-    '**/tests/lib/datasource/run-capability-remove.test.js'
-  ]),
-  makeIsolatedProject('log-cleaner', ['**/tests/lib/datasource/log-cleaner.test.js']),
-  makeIsolatedProject('datasource-exporter-service', [
-    '**/tests/lib/datasource/datasource-exporter-service.test.js'
-  ]),
-  makeIsolatedProject('protection-paths', ['**/tests/lib/protection/paths.test.js']),
-  makeIsolatedProject('protection-resolve', ['**/tests/lib/protection/protection-resolve.test.js']),
-  makeIsolatedProject('protection-create-helpers', [
-    '**/tests/lib/protection/run-protection-create-helpers.test.js'
-  ]),
-  makeIsolatedProject('governance-pack-loader', [
-    '**/tests/lib/governance/governance-pack-loader.test.js'
-  ]),
-  makeIsolatedProject('protection-validate-batch', [
-    '**/tests/lib/protection/validate-batch.test.js'
-  ])
-];
+const isolatedProjects = buildIsolatedProjects(makeIsolatedProject, isCI, sharedTransform);
 
 const allProjects = [defaultProject, ...isolatedProjects];
 
@@ -458,5 +386,6 @@ module.exports = {
   makeIsolatedProject,
   defaultProject,
   isolatedProjects,
-  allProjects
+  allProjects,
+  globalLiveFabrixHooks
 };

package/lib/api/api-response-errors.js

@@ -0,0 +1,124 @@
+/**
+ * Throw CLI errors from ApiClient responses with formatted output preserved.
+ *
+ * @fileoverview Dataplane/controller API failure helpers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { formatApiError } = require('../utils/api-error-handler');
+const {
+  enrichUnresolvableGovernanceSubjectsError
+} = require('../governance/governance-cli-errors');
+const { inferServiceLabelFromUrl } = require('../utils/service-url-label');
+
+/**
+ * @param {Object|undefined} res - ApiClient response
+ * @param {string} fallbackMessage
+ * @returns {string}
+ */
+function resolveApiErrorMessage(res, fallbackMessage) {
+  if (!res) {
+    return fallbackMessage;
+  }
+  const fromError =
+    res.error &&
+    (res.error.formattedError || res.error.error || res.error.message);
+  return (
+    res.formattedError ||
+    fromError ||
+    (typeof res.error === 'string' ? res.error : null) ||
+    fallbackMessage
+  );
+}
+
+/**
+ * @param {Object|undefined} res
+ * @param {string} endpointUrl
+ * @returns {{ endpoint: string, serviceLabel: string }}
+ */
+function resolveApiFailureEndpointContext(res, endpointUrl) {
+  const endpoint =
+    (res && res.errorData && res.errorData.endpointUrl) || endpointUrl || '';
+  const serviceLabel =
+    (res && res.errorData && res.errorData.serviceLabel) ||
+    inferServiceLabelFromUrl(endpoint);
+  return { endpoint, serviceLabel };
+}
+
+/**
+ * @param {Object|undefined} res
+ * @param {string} endpoint
+ * @param {string} serviceLabel
+ * @returns {Object}
+ */
+function buildEnrichedApiFailureResponse(res, endpoint, serviceLabel) {
+  return {
+    ...res,
+    errorData: {
+      ...(res && res.errorData),
+      endpointUrl: endpoint,
+      serviceLabel
+    }
+  };
+}
+
+/**
+ * @param {Error} err
+ * @param {Object|undefined} res
+ * @param {string} endpoint
+ * @param {string} serviceLabel
+ * @param {Object} enriched
+ */
+function assignApiFailureErrorFields(err, res, endpoint, serviceLabel, enriched) {
+  err.formatted =
+    res && res.formattedError ? res.formattedError : formatApiError(enriched, null);
+  err.network = Boolean(res && res.network === true);
+  err.status = res && typeof res.status === 'number' ? res.status : 0;
+  err.endpointUrl = endpoint;
+  err.serviceLabel = serviceLabel;
+}
+
+/**
+ * @param {Object|undefined} res
+ * @param {string} endpointUrl
+ * @returns {Error}
+ */
+function buildApiFailureError(res, endpointUrl, context = {}) {
+  const message = resolveApiErrorMessage(res, 'Request failed');
+  const err = new Error(message);
+  const { endpoint, serviceLabel } = resolveApiFailureEndpointContext(res, endpointUrl);
+  const enriched = buildEnrichedApiFailureResponse(res, endpoint, serviceLabel);
+  assignApiFailureErrorFields(err, res, endpoint, serviceLabel, enriched);
+  if (
+    typeof endpoint === 'string' &&
+    endpoint.includes('/governance-scenarios/generate')
+  ) {
+    enrichUnresolvableGovernanceSubjectsError(err, context);
+  }
+  return err;
+}
+
+/**
+ * @param {Object} res - ApiClient response (`success: false`)
+ * @param {{ fallbackMessage?: string, endpointUrl?: string }} [context]
+ * @throws {Error}
+ */
+function throwIfApiFailed(res, context = {}) {
+  if (!res || res.success !== false) {
+    return;
+  }
+  const endpointUrl =
+    context.endpointUrl ||
+    (res.errorData && res.errorData.endpointUrl) ||
+    '';
+  throw buildApiFailureError(res, endpointUrl || context.endpointUrl || '', context);
+}
+
+module.exports = {
+  throwIfApiFailed,
+  buildApiFailureError,
+  resolveApiErrorMessage
+};

package/lib/api/dataplane-health.api.js

@@ -90,6 +90,17 @@ function parseGeneralHealthResponse(response, endpoint) {
  *          Snapshot, or null when both endpoints fail
  * @throws {Error} When dataplaneUrl is missing or not a string
  */
+/**
+ * @param {'v1-first'|'legacy-first'} [endpointOrder]
+ * @returns {[string, string]}
+ */
+function healthEndpointOrder(endpointOrder) {
+  if (endpointOrder === 'legacy-first') {
+    return [FALLBACK_ENDPOINT, PRIMARY_ENDPOINT];
+  }
+  return [PRIMARY_ENDPOINT, FALLBACK_ENDPOINT];
+}
+
 async function fetchDataplaneGeneralHealth(dataplaneUrl, options = {}) {
   if (!dataplaneUrl || typeof dataplaneUrl !== 'string') {
     throw new Error('dataplaneUrl is required and must be a string');
@@ -100,13 +111,14 @@ async function fetchDataplaneGeneralHealth(dataplaneUrl, options = {}) {
     requestOpts.timeoutMs = options.timeoutMs;
   }
 
-  const primary = await safeGet(client, PRIMARY_ENDPOINT, requestOpts);
-  const primarySnapshot = parseGeneralHealthResponse(primary, PRIMARY_ENDPOINT);
-  if (primarySnapshot) return primarySnapshot;
-
-  const fallback = await safeGet(client, FALLBACK_ENDPOINT, requestOpts);
-  const fallbackSnapshot = parseGeneralHealthResponse(fallback, FALLBACK_ENDPOINT);
-  if (fallbackSnapshot) return fallbackSnapshot;
+  const endpoints = healthEndpointOrder(options.endpointOrder);
+  for (const endpoint of endpoints) {
+    const response = await safeGet(client, endpoint, requestOpts);
+    const snapshot = parseGeneralHealthResponse(response, endpoint);
+    if (snapshot) {
+      return snapshot;
+    }
+  }
 
   return null;
 }

package/lib/api/governance-scenario-pack.api.js

@@ -0,0 +1,159 @@
+/**
+ * @fileoverview Dataplane governance scenario pack CRUD + run API (419.0).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { createDataplaneApiClient } = require('./index');
+const { throwIfApiFailed } = require('./api-response-errors');
+const { unwrapApiData } = require('../utils/external-system-readiness-core');
+const {
+  governanceUploadSchemaHint,
+  isGovernanceCoverageSchemaError
+} = require('../governance/governance-cli-errors');
+
+/**
+ * @param {string} dataplaneUrl
+ * @param {string} datasourceKey
+ * @param {string} suffix
+ * @returns {string}
+ */
+function governanceScenarioEndpoint(dataplaneUrl, datasourceKey, suffix) {
+  const base = String(dataplaneUrl || '').replace(/\/$/, '');
+  return `${base}/api/v1/external/${encodeURIComponent(datasourceKey)}${suffix}`;
+}
+
+/**
+ * PUT /api/v1/external/{datasourceKey}/governance-scenarios
+ * @requiresPermission {Dataplane} external-data-source:update
+ * @async
+ */
+async function upsertDatasourceGovernancePack(dataplaneUrl, authConfig, datasourceKey, pack) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const res = await client.put(
+    `/api/v1/external/${encodeURIComponent(datasourceKey)}/governance-scenarios`,
+    { body: { pack } }
+  );
+  if (res && res.success === false) {
+    try {
+      throwIfApiFailed(res, {
+        endpointUrl: governanceScenarioEndpoint(
+          dataplaneUrl,
+          datasourceKey,
+          '/governance-scenarios'
+        )
+      });
+    } catch (err) {
+      if (isGovernanceCoverageSchemaError(err)) {
+        err.friendlyHint = governanceUploadSchemaHint(
+          (pack && pack.spec && pack.spec.systemKey) || datasourceKey
+        );
+      }
+      throw err;
+    }
+  }
+  return unwrapApiData(res);
+}
+
+/**
+ * GET /api/v1/external/{datasourceKey}/governance-scenarios
+ * @requiresPermission {Dataplane} external-data-source:read
+ * @async
+ */
+async function getDatasourceGovernancePack(dataplaneUrl, authConfig, datasourceKey) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const res = await client.get(
+    `/api/v1/external/${encodeURIComponent(datasourceKey)}/governance-scenarios`
+  );
+  throwIfApiFailed(res, {
+    endpointUrl: governanceScenarioEndpoint(dataplaneUrl, datasourceKey, '/governance-scenarios')
+  });
+  return unwrapApiData(res);
+}
+
+/**
+ * POST /api/v1/external/{datasourceKey}/governance-scenarios/run
+ * @requiresPermission {Dataplane} governance:evaluate
+ * @async
+ */
+async function runDatasourceGovernanceScenarios(dataplaneUrl, authConfig, datasourceKey) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const res = await client.post(
+    `/api/v1/external/${encodeURIComponent(datasourceKey)}/governance-scenarios/run`,
+    { body: {} }
+  );
+  throwIfApiFailed(res, {
+    endpointUrl: governanceScenarioEndpoint(
+      dataplaneUrl,
+      datasourceKey,
+      '/governance-scenarios/run'
+    )
+  });
+  const unwrapped = unwrapApiData(res);
+  if (!unwrapped || !unwrapped.summary) {
+    throw new Error('Governance scenario run returned an unexpected response shape');
+  }
+  return unwrapped;
+}
+
+/**
+ * POST /api/v1/external/{datasourceKey}/governance-scenarios/generate
+ * @requiresPermission {Dataplane} external-data-source:update
+ * @async
+ */
+async function generateDatasourceGovernancePack(
+  dataplaneUrl,
+  authConfig,
+  datasourceKey,
+  body
+) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const res = await client.post(
+    `/api/v1/external/${encodeURIComponent(datasourceKey)}/governance-scenarios/generate`,
+    { body }
+  );
+  const subjectEmails = Array.isArray(body.subjects)
+    ? body.subjects
+      .map(entry => entry && entry.subjectEmail)
+      .filter(email => typeof email === 'string' && email.trim())
+    : [];
+  throwIfApiFailed(res, {
+    endpointUrl: governanceScenarioEndpoint(
+      dataplaneUrl,
+      datasourceKey,
+      '/governance-scenarios/generate'
+    ),
+    subjectEmails
+  });
+  return unwrapApiData(res);
+}
+
+/**
+ * GET /api/v1/external/{datasourceKey}/governance-scenarios/versions
+ * @requiresPermission {Dataplane} external-data-source:read
+ * @async
+ */
+async function listDatasourceGovernancePackVersions(dataplaneUrl, authConfig, datasourceKey) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const res = await client.get(
+    `/api/v1/external/${encodeURIComponent(datasourceKey)}/governance-scenarios/versions`
+  );
+  throwIfApiFailed(res, {
+    endpointUrl: governanceScenarioEndpoint(
+      dataplaneUrl,
+      datasourceKey,
+      '/governance-scenarios/versions'
+    )
+  });
+  return unwrapApiData(res);
+}
+
+module.exports = {
+  upsertDatasourceGovernancePack,
+  getDatasourceGovernancePack,
+  runDatasourceGovernanceScenarios,
+  generateDatasourceGovernancePack,
+  listDatasourceGovernancePackVersions
+};

package/lib/api/index.js

@@ -14,11 +14,13 @@ const { makeApiCall, authenticatedApiCall } = require('../utils/api');
 class ApiClient {
   /**
    * Create an API client instance.
-   * App endpoints receive token-only auth (Bearer). x-client-id/x-client-secret are not sent to app endpoints.
+   * App endpoints receive token-only auth (Bearer). x-client-id/x-client-secret are used only for the controller token endpoint.
    * @param {string} baseUrl - Base URL for the API (controller URL)
    * @param {Object} [authConfig] - Authentication configuration
-   * @param {string} [authConfig.type] - Auth type ('bearer' | 'client-token')
+   * @param {string} [authConfig.type] - Auth type ('bearer' | 'client-token' | 'client-credentials')
    * @param {string} [authConfig.token] - Bearer token
+   * @param {string} [authConfig.clientId] - Client ID (client-credentials)
+   * @param {string} [authConfig.clientSecret] - Client secret (client-credentials)
    */
   constructor(baseUrl, authConfig = {}, clientOptions = {}) {
     if (baseUrl === null || baseUrl === undefined || typeof baseUrl !== 'string') {
@@ -87,6 +89,41 @@ class ApiClient {
     return headers;
   }
 
+  /**
+   * True when endpoint is the controller client-credentials token exchange.
+   * @private
+   * @param {string} endpoint - API endpoint path
+   * @returns {boolean}
+   */
+  _isClientCredentialsTokenEndpoint(endpoint) {
+    const path = endpoint.startsWith('/') ? endpoint : `/${endpoint}`;
+    return path === '/api/v1/auth/token';
+  }
+
+  /**
+   * Add x-client-id/x-client-secret only for POST /api/v1/auth/token (never for app endpoints).
+   * @private
+   * @param {string} endpoint - API endpoint path
+   * @param {Object} headers - Request headers built by _buildHeaders
+   * @returns {Object}
+   */
+  _applyClientCredentialHeadersForTokenEndpoint(endpoint, headers) {
+    if (this.authConfig.type !== 'client-credentials') {
+      return headers;
+    }
+    if (!this._isClientCredentialsTokenEndpoint(endpoint)) {
+      return headers;
+    }
+    const out = { ...headers };
+    if (this.authConfig.clientId) {
+      out['x-client-id'] = String(this.authConfig.clientId);
+    }
+    if (this.authConfig.clientSecret) {
+      out['x-client-secret'] = String(this.authConfig.clientSecret);
+    }
+    return out;
+  }
+
   /**
    * Make a GET request
    * @async
@@ -141,7 +178,10 @@ class ApiClient {
   async post(endpoint, options = {}) {
     await this._ensureDataplaneCliVersionGate();
     let url = this._buildUrl(endpoint);
-    const headers = this._buildHeaders(options.headers);
+    const headers = this._applyClientCredentialHeadersForTokenEndpoint(
+      endpoint,
+      this._buildHeaders(options.headers)
+    );
 
     // Add query parameters if provided
     if (options.params) {