@aifabrix/builder 2.45.5 → 2.47.0

package/lib/commands/resource-type.js

@@ -0,0 +1,371 @@
+/**
+ * Resource type catalog commands (Controller).
+ *
+ * Commands:
+ * - aifabrix resource-type create
+ * - aifabrix resource-type import
+ * - aifabrix resource-type get
+ * - aifabrix resource-type list
+ *
+ * @fileoverview Resource type CLI commands
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { resolveControllerUrl } = require('../utils/controller-url');
+const { normalizeControllerUrl, resolveEnvironment } = require('../core/config');
+const { getOrRefreshDeviceToken } = require('../utils/token-manager');
+const {
+  readResourceTypeCreateFile,
+  readResourceTypeCatalogFile
+} = require('../resolvers/resource-type-file');
+const {
+  formatBlockingError,
+  formatSuccessLine,
+  infoLine,
+  headerKeyValue
+} = require('../utils/cli-layout-chalk');
+const {
+  listResourceTypes,
+  getResourceType,
+  createResourceTypeIdempotent
+} = require('../api/resource-types.api');
+
+const RESOURCE_TYPE_KEY_PATTERN = /^[a-z][a-z0-9-]*$/;
+
+/** Parent help for `aifabrix resource-type -h`. */
+const RESOURCE_TYPE_HELP_AFTER = `
+
+Examples:
+  $ aifabrix resource-type create --key customer --display-name "Customer"
+  $ aifabrix resource-type get customer
+  $ aifabrix resource-type list --search customer
+
+Per-command help:  aifabrix resource-type <command> --help
+`;
+
+const RESOURCE_TYPE_IMPORT_HELP_AFTER = `
+
+Examples:
+  $ aifabrix resource-type import --file ./baseline-resourcetypes.json
+  $ aifabrix resource-type import --file /path/to/catalog.json
+
+`;
+
+const RESOURCE_TYPE_CREATE_HELP_AFTER = `
+
+Examples:
+  $ aifabrix resource-type create --key customer --display-name "Customer"
+  $ aifabrix resource-type create --key deal --display-name "Deal" --category business --default-risk-level medium
+  $ aifabrix resource-type create --file ./customer.json
+
+`;
+
+const RESOURCE_TYPE_GET_HELP_AFTER = `
+
+Examples:
+  $ aifabrix resource-type get customer
+  $ aifabrix resource-type get clx1234567890abcdef
+
+`;
+
+const RESOURCE_TYPE_LIST_HELP_AFTER = `
+
+Examples:
+  $ aifabrix resource-type list
+  $ aifabrix resource-type list --page 1 --page-size 50
+  $ aifabrix resource-type list --search customer
+
+`;
+
+/**
+ * @param {string} raw
+ * @returns {string}
+ */
+function requireResourceTypeKey(raw) {
+  const key = String(raw || '').trim();
+  if (!key) {
+    throw new Error('Resource type key is required (--key <key> or --file <path>).');
+  }
+  if (!RESOURCE_TYPE_KEY_PATTERN.test(key)) {
+    throw new Error(
+      'Resource type key must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens.'
+    );
+  }
+  return key;
+}
+
+/**
+ * @param {Object} options
+ * @returns {Promise<{ controllerUrl: string, authConfig: Object }>}
+ */
+async function resolveControllerAndAuth(_options) {
+  const controllerUrl = await resolveControllerUrl();
+  if (!controllerUrl) {
+    throw new Error('Controller URL is required. Run "aifabrix login" first.');
+  }
+  const normalized = normalizeControllerUrl(controllerUrl);
+  const deviceToken = await getOrRefreshDeviceToken(normalized);
+  if (!deviceToken || !deviceToken.token) {
+    throw new Error(
+      `Not authenticated for controller: ${controllerUrl}. ` +
+        'Run "aifabrix login" and try again.'
+    );
+  }
+  return {
+    controllerUrl: deviceToken.controller || normalized,
+    authConfig: { type: 'bearer', token: deviceToken.token }
+  };
+}
+
+async function resolveHeaderContext() {
+  const env = await resolveEnvironment();
+  const controllerUrl = await resolveControllerUrl();
+  const normalized = normalizeControllerUrl(controllerUrl);
+  return { environment: env || 'dev', controllerUrl: normalized };
+}
+
+/**
+ * @param {Object} options
+ * @returns {Object}
+ */
+function buildCreatePayload(options) {
+  let base = {};
+  if (options.file) {
+    base = readResourceTypeCreateFile(options.file);
+  }
+  const payload = { ...base };
+  if (options.key) payload.key = options.key;
+  if (options.displayName) payload.displayName = options.displayName;
+  if (options.description !== undefined) payload.description = options.description;
+  if (options.category) payload.category = options.category;
+  if (options.defaultRiskLevel) payload.defaultRiskLevel = options.defaultRiskLevel;
+  if (options.status) payload.status = options.status;
+  payload.key = requireResourceTypeKey(payload.key);
+  if (!payload.displayName) {
+    throw new Error('displayName is required (--display-name <name> or in --file).');
+  }
+  return payload;
+}
+
+/**
+ * @param {Object} response
+ * @returns {any}
+ */
+function unwrapControllerData(response) {
+  return response?.data?.data ?? response?.data ?? response;
+}
+
+/**
+ * @param {import('commander').Command} rt
+ */
+/**
+ * @param {Object[]} rows
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @returns {Promise<{ created: number, existed: number, total: number }>}
+ */
+async function importResourceTypeRows(rows, controllerUrl, authConfig) {
+  let created = 0;
+  let existed = 0;
+  for (const row of rows) {
+    const payload = { ...row };
+    payload.key = requireResourceTypeKey(payload.key);
+    const out = await createResourceTypeIdempotent(controllerUrl, authConfig, payload);
+    if (out.created) {
+      created += 1;
+      continue;
+    }
+    existed += 1;
+  }
+  return { created, existed, total: rows.length };
+}
+
+function setupResourceTypeImportCommand(rt) {
+  rt
+    .command('import')
+    .description('Import resource types from baseline catalog JSON (idempotent)')
+    .addHelpText('after', RESOURCE_TYPE_IMPORT_HELP_AFTER)
+    .requiredOption('--file <path>', 'Baseline catalog (resourceTypes[]) or JSON array')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth(options);
+        const rows = readResourceTypeCatalogFile(options.file);
+        const summary = await importResourceTypeRows(rows, controllerUrl, authConfig);
+        logger.log(
+          formatSuccessLine(
+            `Resource types imported: ${summary.total} total ` +
+              `(${summary.created} created, ${summary.existed} already existed)`
+          )
+        );
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function setupResourceTypeCreateCommand(rt) {
+  rt
+    .command('create')
+    .description('Create resource type (idempotent; success if it already exists)')
+    .addHelpText('after', RESOURCE_TYPE_CREATE_HELP_AFTER)
+    .option('--file <path>', 'Read resource type create payload from JSON file')
+    .option('--key <key>', 'Catalog key (lowercase letters, digits, hyphens)')
+    .option('--display-name <name>', 'Display name')
+    .option('--description <text>', 'Description')
+    .option(
+      '--category <category>',
+      'business | collaboration | governance | content | communication | people'
+    )
+    .option('--default-risk-level <level>', 'low | medium | high | critical')
+    .option('--status <status>', 'draft | active | deprecated | retired')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth(options);
+        const payload = buildCreatePayload(options);
+        const out = await createResourceTypeIdempotent(controllerUrl, authConfig, payload);
+        const row = unwrapControllerData(out.response);
+        const category = row.category || payload.category || 'business';
+        const risk = row.defaultRiskLevel || payload.defaultRiskLevel || 'medium';
+        if (out.created) {
+          logger.log(
+            formatSuccessLine(`Resource type created: ${row.key} (category: ${category}, risk: ${risk})`)
+          );
+          return;
+        }
+        logger.log(formatSuccessLine(`Resource type exists: ${row.key} (category: ${category}, risk: ${risk})`));
+        logger.log(infoLine('No changes were needed.'));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function setupResourceTypeGetCommand(rt) {
+  rt
+    .command('get <resourceTypeIdOrKey>')
+    .description('Get resource type by id or key')
+    .addHelpText('after', RESOURCE_TYPE_GET_HELP_AFTER)
+    .action(async(resourceTypeIdOrKey, options) => {
+      try {
+        const { environment, controllerUrl: headerControllerUrl } = await resolveHeaderContext();
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth(options);
+        const res = await getResourceType(controllerUrl, authConfig, String(resourceTypeIdOrKey).trim());
+        const row = unwrapControllerData(res);
+        logger.log(
+          chalk.bold(`\n🏷️  Resource type in ${environment} environment (${headerControllerUrl}):\n`)
+        );
+        logger.log(headerKeyValue('Key:', row.key || '—'));
+        logger.log(headerKeyValue('Display:', row.displayName || '—'));
+        logger.log(headerKeyValue('Category:', row.category || '—'));
+        logger.log(headerKeyValue('Default risk:', row.defaultRiskLevel || '—'));
+        logger.log(headerKeyValue('Status:', row.status || '—'));
+        if (row.description) {
+          logger.log(headerKeyValue('Description:', row.description));
+        }
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {Array<Object>} items
+ * @param {string} environment
+ * @param {string} controllerUrl
+ */
+function displayResourceTypeList(items, environment, controllerUrl) {
+  logger.log(
+    chalk.bold(`\n🏷️  Resource types in ${environment} environment (${controllerUrl}):\n`)
+  );
+  if (!Array.isArray(items) || items.length === 0) {
+    logger.log(chalk.gray('  No resource types found.\n'));
+    return;
+  }
+
+  const KEY_WIDTH = 22;
+  const DISPLAY_WIDTH = 30;
+  const CATEGORY_WIDTH = 16;
+  const RISK_WIDTH = 10;
+  const STATUS_WIDTH = 12;
+  const SEP_LEN = KEY_WIDTH + DISPLAY_WIDTH + CATEGORY_WIDTH + RISK_WIDTH + STATUS_WIDTH;
+
+  const keyCol = 'Key'.padEnd(KEY_WIDTH);
+  const displayCol = 'Display'.padEnd(DISPLAY_WIDTH);
+  const categoryCol = 'Category'.padEnd(CATEGORY_WIDTH);
+  const riskCol = 'Risk'.padEnd(RISK_WIDTH);
+  const statusCol = 'Status'.padEnd(STATUS_WIDTH);
+  logger.log(chalk.gray(`${keyCol}${displayCol}${categoryCol}${riskCol}${statusCol}`));
+  logger.log(chalk.gray('-'.repeat(SEP_LEN)));
+
+  items.forEach((d) => {
+    const key = (d?.key ?? '—').toString().padEnd(KEY_WIDTH);
+    const displayName = (d?.displayName ?? '—').toString().padEnd(DISPLAY_WIDTH);
+    const category = (d?.category ?? '—').toString().padEnd(CATEGORY_WIDTH);
+    const risk = (d?.defaultRiskLevel ?? '—').toString().padEnd(RISK_WIDTH);
+    const status = (d?.status ?? '—').toString().padEnd(STATUS_WIDTH);
+    logger.log(`${key}${displayName}${category}${risk}${status}`);
+  });
+  logger.log('');
+}
+
+function setupResourceTypeListCommand(rt) {
+  rt
+    .command('list')
+    .description('List resource types')
+    .addHelpText('after', RESOURCE_TYPE_LIST_HELP_AFTER)
+    .option('--page <n>', 'Page', (v) => parseInt(v, 10))
+    .option('--page-size <n>', 'Page size', (v) => parseInt(v, 10))
+    .option('--search <text>', 'Search by key/displayName/description')
+    .option('--category <category>', 'Filter by category')
+    .option('--status <status>', 'Filter by status')
+    .action(async(options) => {
+      try {
+        const { environment, controllerUrl: headerControllerUrl } = await resolveHeaderContext();
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth(options);
+        const res = await listResourceTypes(controllerUrl, authConfig, {
+          page: options.page,
+          pageSize: options.pageSize,
+          search: options.search,
+          category: options.category,
+          status: options.status
+        });
+        const payload = unwrapControllerData(res);
+        const items = payload?.data ?? payload ?? [];
+        displayResourceTypeList(items, environment, headerControllerUrl);
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} program
+ */
+function setupResourceTypeCommands(program) {
+  const rt = program
+    .command('resource-type')
+    .description('Manage the Controller Resource Type Catalog (COM)')
+    .addHelpText('after', RESOURCE_TYPE_HELP_AFTER);
+  setupResourceTypeCreateCommand(rt);
+  setupResourceTypeImportCommand(rt);
+  setupResourceTypeGetCommand(rt);
+  setupResourceTypeListCommand(rt);
+}
+
+module.exports = {
+  setupResourceTypeCommands,
+  requireResourceTypeKey,
+  buildCreatePayload,
+  unwrapControllerData,
+  importResourceTypeRows
+};

package/lib/commands/secrets-get.js

@@ -0,0 +1,184 @@
+/**
+ * @fileoverview aifabrix secret get – read one secret (local user file or shared-only)
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+const path = require('path');
+const { getAifabrixSecretsPath } = require('../core/config');
+const { decryptSecretsObject } = require('../core/secrets-load');
+const { loadPrimaryUserSecrets } = require('../utils/secrets-utils');
+const { loadConfiguredSharedSecretsStore } = require('../utils/remote-secrets-loader');
+const remoteDevAuth = require('../utils/remote-dev-auth');
+const devApi = require('../api/dev.api');
+const logger = require('../utils/logger');
+
+const REMOTE_NOT_CONFIGURED_MSG =
+  'Remote server is not configured. Set remote-server and run "aifabrix dev init" first.';
+
+/**
+ * Human-readable label for which store(s) were queried (paths included for file stores).
+ * @param {{ shared?: boolean }} options
+ * @returns {Promise<string>}
+ */
+async function resolveSecretsScopeLabel(options) {
+  const useSharedOnly = Boolean(options.shared || options['shared']);
+  const generalSecretsPath = await getAifabrixSecretsPath();
+
+  if (useSharedOnly) {
+    if (!generalSecretsPath) {
+      return 'shared secrets (aifabrix-secrets not configured; run aifabrix secret set-secrets-file <path>)';
+    }
+    const target = await remoteDevAuth.resolveSharedSecretsEndpoint(generalSecretsPath);
+    if (remoteDevAuth.isRemoteSecretsUrl(target)) {
+      const host = remoteDevAuth.getSharedSecretsRemoteHostname(target) || target;
+      return `shared secrets API (${host})`;
+    }
+    const resolved = path.isAbsolute(target) ? target : path.resolve(process.cwd(), target);
+    return `shared secrets file ${resolved}`;
+  }
+
+  const pathsUtil = require('../utils/paths');
+  const userPath = pathsUtil.getPrimaryUserSecretsLocalPath();
+  return `local secrets file ${userPath}`;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+function isSecretPresent(value) {
+  if (value === undefined || value === null) {
+    return false;
+  }
+  return String(value).trim() !== '';
+}
+
+/**
+ * @param {Array<{ name?: string, key?: string, value?: unknown }>} items
+ * @returns {Record<string, string>}
+ */
+function remoteSecretItemsToMap(items) {
+  const raw = {};
+  for (const item of items) {
+    const name = item?.name || item?.key;
+    if (typeof name === 'string' && item.value !== undefined) {
+      raw[name] = String(item.value);
+    }
+  }
+  return raw;
+}
+
+/**
+ * @param {string} target
+ * @returns {Promise<Record<string, string>>}
+ */
+async function loadRemoteSharedSecretsDecrypted(target) {
+  const auth = await remoteDevAuth.getRemoteDevAuth();
+  if (!auth) {
+    throw new Error(REMOTE_NOT_CONFIGURED_MSG);
+  }
+  const items = await devApi.listSecrets(
+    auth.serverUrl,
+    auth.clientCertPem,
+    auth.serverCaPem || undefined,
+    target
+  );
+  const label = remoteDevAuth.getSharedSecretsRemoteHostname(target) || 'shared secrets API';
+  return decryptSecretsObject(remoteSecretItemsToMap(items), { defaultSourceLabel: label });
+}
+
+/**
+ * Load shared secrets (file or remote), decrypted.
+ * @returns {Promise<Record<string, string>>}
+ */
+async function loadSharedSecretsDecrypted() {
+  const generalSecretsPath = await getAifabrixSecretsPath();
+  if (!generalSecretsPath) {
+    throw new Error('Shared secrets not configured. Set aifabrix-secrets in config.yaml.');
+  }
+
+  const target = await remoteDevAuth.resolveSharedSecretsEndpoint(generalSecretsPath);
+  if (remoteDevAuth.isRemoteSecretsUrl(target)) {
+    return loadRemoteSharedSecretsDecrypted(target);
+  }
+
+  const raw = await loadConfiguredSharedSecretsStore();
+  if (!raw || typeof raw !== 'object') {
+    return {};
+  }
+  const resolvedPath = path.isAbsolute(target) ? target : path.resolve(process.cwd(), target);
+  return decryptSecretsObject(raw, { defaultSourceLabel: resolvedPath });
+}
+
+/**
+ * Load and decrypt the primary user secrets file only (not aifabrix-secrets / shared).
+ * @returns {Promise<Record<string, string>>}
+ */
+async function loadLocalUserSecretsDecrypted() {
+  const pathsUtil = require('../utils/paths');
+  const userPath = pathsUtil.getPrimaryUserSecretsLocalPath();
+  const raw = loadPrimaryUserSecrets();
+  return decryptSecretsObject(raw || {}, { defaultSourceLabel: userPath });
+}
+
+/**
+ * Load secrets for lookup: local user file (default) or shared store only (--shared).
+ * @param {{ shared?: boolean }} options
+ * @returns {Promise<Record<string, string>>}
+ */
+async function loadSecretsForGet(options) {
+  if (options.shared || options['shared']) {
+    return loadSharedSecretsDecrypted();
+  }
+  return loadLocalUserSecretsDecrypted();
+}
+
+/**
+ * Handle secret get command.
+ * @param {string} key - Secret key (no kv:// prefix)
+ * @param {Object} options
+ * @param {boolean} [options.shared] - Shared store only (aifabrix-secrets); default is local user file only
+ * @param {boolean} [options.exists] - Exit 0 when present; no stdout (script-friendly)
+ * @param {boolean} [options.json] - JSON { key, exists, value }
+ * @returns {Promise<{ key: string, exists: boolean, value?: string }>}
+ */
+async function handleSecretsGet(key, options = {}) {
+  if (!key || typeof key !== 'string') {
+    throw new Error('Secret key is required and must be a string');
+  }
+  if (key.startsWith('kv://')) {
+    throw new Error(
+      'Secret key must not start with kv://. Use the key path without the prefix (e.g. hubspot-demo/token).'
+    );
+  }
+
+  const secrets = await loadSecretsForGet(options);
+  const value = secrets[key];
+  const present = isSecretPresent(value);
+
+  if (!present) {
+    const scope = await resolveSecretsScopeLabel(options);
+    throw new Error(`Secret '${key}' is missing or empty in ${scope}.`);
+  }
+
+  if (options.exists || options['exists']) {
+    return { key, exists: true };
+  }
+
+  if (options.json || options['json']) {
+    logger.log(JSON.stringify({ key, exists: true, value: String(value) }));
+    return { key, exists: true, value: String(value) };
+  }
+
+  logger.log(String(value));
+  return { key, exists: true, value: String(value) };
+}
+
+module.exports = {
+  handleSecretsGet,
+  isSecretPresent,
+  loadSecretsForGet,
+  loadLocalUserSecretsDecrypted,
+  resolveSecretsScopeLabel
+};

package/lib/commands/secrets-remove-all.js

@@ -56,6 +56,8 @@ function listKeysFromYamlFile(filePath) {
  * @param {string} filePath - Absolute path
  */
 function writeEmptySecretsFile(filePath) {
+  const { assertWritableSecretsPathForTests } = require('../utils/aifabrix-test-runtime-guard');
+  assertWritableSecretsPathForTests(filePath);
   const yamlContent = yaml.dump({}, { indent: 2, lineWidth: -1, noRefs: true, sortKeys: false });
   fs.writeFileSync(filePath, yamlContent, { mode: 0o600 });
 }
@@ -217,4 +219,4 @@ async function handleSecretsRemoveAll(options) {
   await removeAllSharedSecrets(generalSecretsPath, options);
 }
 
-module.exports = { handleSecretsRemoveAll };
+module.exports = { handleSecretsRemoveAll, writeEmptySecretsFile };