@aifabrix/builder 2.45.5 → 2.47.0

package/lib/commands/setup.js

@@ -2,8 +2,8 @@
  * Top-level handler for `aifabrix setup`.
  *
  * Decides between:
- *   - fresh install (no infra running) — wizard for admin creds + AI tool, then up-infra + up-platform.
- *   - mode menu (infra already running) — dispatch one of four destructive/refresh paths.
+ *   - fresh install (no infra running) — wipe volumes, wizard for admin creds + AI tool, then up-infra + up-platform.
+ *   - mode menu (infra already running) — dispatch one of three destructive/refresh paths.
  *
  * The mode handlers live in `setup-modes.js`; the prompts live in
  * `setup-prompts.js`. This module is a thin orchestrator so it stays well
@@ -28,8 +28,12 @@ const {
 } = require('../utils/cli-test-layout-chalk');
 
 const setupPrompts = require('./setup-prompts');
+const setupPlatformModePrompts = require('./setup-prompts-platform-mode');
+const { flagsForSetupPlatformMode } = require('../core/setup-platform-mode');
 const setupModes = require('./setup-modes');
+const { syncPlatformControllerUrlsInConfig } = require('./setup-platform-auth');
 const installationLog = require('../utils/installation-log');
+const { beginSetupCommandFlow, endSetupCommandFlow } = require('./setup-run-context');
 
 const MODE = setupPrompts.MODE;
 
@@ -54,10 +58,24 @@ async function maybePinDeveloperIdForFreshInstall(rawDeveloper) {
   logger.log(infoLine(`Developer ID pinned to ${dev}.`));
 }
 
+async function applySetupPlatformMode(options) {
+  const mode = await setupPlatformModePrompts.promptSetupPlatformMode(options);
+  await config.setSetupPlatformMode(mode);
+  const derived = flagsForSetupPlatformMode(mode);
+  // These are the user gates that control full-mode behavior.
+  const cfg = await config.getConfig();
+  cfg.traefik = derived.traefik;
+  cfg.useEnvironmentScopedResources = derived.useEnvironmentScopedResources;
+  await config.saveConfig(cfg);
+  await syncPlatformControllerUrlsInConfig();
+  return mode;
+}
+
 async function runFreshInstallFlow(options) {
   await maybePinDeveloperIdForFreshInstall(options.developer);
   logger.log(infoLine('No infrastructure detected; starting fresh install.'));
-  const adminCreds = await setupPrompts.promptAdminCredentials();
+  await applySetupPlatformMode(options);
+  const adminCreds = await setupPrompts.promptAdminCredentials(options);
   await config.setAdminEmail(adminCreds.adminEmail);
   await setupModes.runFreshInstall(adminCreds);
   logger.log(formatSuccessParagraph('aifabrix setup complete (fresh install).'));
@@ -74,6 +92,10 @@ async function runExistingInfraFlow(assumeYes) {
     logger.log(chalk.yellow('Aborted by user.'));
     return { aborted: true, mode };
   }
+  // Re-install / wipe-data can change platform topology; re-prompt so the next up-platform matches intent.
+  if (mode === MODE.REINSTALL || mode === MODE.WIPE_DATA) {
+    await applySetupPlatformMode({});
+  }
   await dispatchMode(mode);
   logger.log(formatSuccessParagraph(`aifabrix setup complete (mode: ${mode}).`));
   return { aborted: false, mode };
@@ -114,8 +136,6 @@ async function dispatchMode(mode) {
     return setupModes.runReinstall();
   case MODE.WIPE_DATA:
     return setupModes.runWipeData();
-  case MODE.CLEAN_FILES:
-    return setupModes.runCleanInstallFiles();
   case MODE.UPDATE_IMAGES:
     return setupModes.runUpdateImages();
   default:
@@ -224,6 +244,7 @@ async function handleSetup(options = {}) {
   let setupMode = null;
   let err = null;
 
+  beginSetupCommandFlow();
   try {
     const main = await runSetupMainPath(options, assumeYes);
     outcome = main.outcome;
@@ -232,6 +253,7 @@ async function handleSetup(options = {}) {
     outcome = 'failure';
     err = e;
   } finally {
+    endSetupCommandFlow();
     await appendSetupInstallationRecord({
       outcome,
       startedAt,

package/lib/commands/teardown.js

@@ -118,6 +118,37 @@ function cleanAifabrixSystemDir() {
   return { removed, failed };
 }
 
+/**
+ * Remove materialized `builder/` trees (aifabrix-work, aifabrix-home / config dir, cwd).
+ * Complements {@link cleanAifabrixSystemDir} when `builder/` lives under `aifabrix-work` outside
+ * the config directory.
+ *
+ * @returns {{ removed: string[], failed: string[] }}
+ */
+function cleanMaterializedBuilderTrees() {
+  const candidates = [
+    pathsUtil.getBuilderRoot(),
+    path.join(pathsUtil.getAifabrixSystemDir(), 'builder'),
+    path.join(process.cwd(), 'builder')
+  ];
+  const seen = new Set();
+  const removed = [];
+  const failed = [];
+  for (const candidate of candidates) {
+    const resolved = path.resolve(candidate);
+    if (seen.has(resolved)) continue;
+    seen.add(resolved);
+    if (!fs.existsSync(resolved)) continue;
+    try {
+      fs.rmSync(resolved, { recursive: true, force: true });
+      removed.push(resolved);
+    } catch {
+      failed.push(resolved);
+    }
+  }
+  return { removed, failed };
+}
+
 /**
  * Stop infra with `down-infra -v` semantics. Tolerates already-down state.
  * @async
@@ -259,6 +290,13 @@ async function handleTeardown(options = {}) {
   try {
     await stopInfraQuietly();
     const { removed, failed } = cleanFilesWithSpinner();
+    const builderClean = cleanMaterializedBuilderTrees();
+    for (const p of builderClean.removed) {
+      removed.push(p);
+    }
+    for (const p of builderClean.failed) {
+      failed.push(p);
+    }
     const devStr = await buildDeveloperLabel();
     logTeardownFooter({ devStr, removedCount: removed.length, failedCount: failed.length });
 
@@ -271,6 +309,7 @@ async function handleTeardown(options = {}) {
 module.exports = {
   handleTeardown,
   cleanAifabrixSystemDir,
+  cleanMaterializedBuilderTrees,
   stopInfraQuietly,
   PRESERVE_FILE,
   PRESERVE_CERTS_DIR

package/lib/commands/test-e2e-external.js

@@ -19,6 +19,7 @@ const { loadConfigFile } = require('../utils/config-format');
 const { discoverIntegrationFiles, buildEffectiveDatasourceFiles } = require('./repair-internal');
 const { runDatasourceTestE2E } = require('../datasource/test-e2e');
 const { cliOptsSkipSync } = require('../utils/cli-sync-options');
+const { buildMinimalUploadSyncOptions, isQuietMinimalSync } = require('../utils/upload-sync-options');
 const { getConfig } = require('../core/config');
 const { setupIntegrationTestAuth } = require('../external-system/test-auth');
 
@@ -96,13 +97,12 @@ function getDatasourceKeys(appPath, configPath, variables, systemKey, systemPars
  */
 async function syncLocalIfRequested(systemKey, options) {
   if (cliOptsSkipSync(options)) return null;
-  logger.log(chalk.cyan('Syncing local config to dataplane…'));
   const { uploadExternalSystem } = require('./upload');
-  const uploadCtx = await uploadExternalSystem(systemKey, {
-    verbose: !!options.verbose,
-    minimal: true
-  });
-  logger.log(formatSuccessLine('Sync complete'));
+  const uploadOpts = buildMinimalUploadSyncOptions(options);
+  const uploadCtx = await uploadExternalSystem(systemKey, uploadOpts);
+  if (uploadCtx?.uploadSkipped !== true && !isQuietMinimalSync(uploadOpts)) {
+    logger.log(formatSuccessLine('Sync complete'));
+  }
   return uploadCtx && uploadCtx.dataplaneUrl && uploadCtx.authConfig ? uploadCtx : null;
 }
 
@@ -176,11 +176,18 @@ async function runTestE2EForExternalSystem(externalSystem, options = {}) {
   let dataplaneUrl;
   if (uploadCtx) {
     ({ authConfig, dataplaneUrl } = uploadCtx);
+  } else if (options.authConfig && options.dataplaneUrl) {
+    ({ authConfig, dataplaneUrl } = options);
   } else {
     const configObj = await getConfig();
     ({ authConfig, dataplaneUrl } = await setupIntegrationTestAuth(
       externalSystem,
-      { environment: options.env },
+      {
+        environment: options.env,
+        authConfig: options.authConfig,
+        dataplaneUrl: options.dataplaneUrl,
+        silentResolve: options.silentResolve === true
+      },
       configObj
     ));
   }
@@ -193,9 +200,18 @@ async function runTestE2EForExternalSystem(externalSystem, options = {}) {
     verbose: options.verbose,
     async: options.async !== false,
     authConfig,
-    dataplaneUrl
+    dataplaneUrl,
+    quietPollUi: options.quietPollUi === true,
+    onPollProgress: options.onPollProgress
   };
   for (const key of keys) {
+    if (typeof options.onDatasourceProgress === 'function') {
+      options.onDatasourceProgress({
+        key,
+        index: results.length,
+        total: keys.length
+      });
+    }
     try {
       const data = await runDatasourceTestE2E(key, opts);
       const steps = data.steps || data.completedActions || [];

package/lib/commands/test-governance-external.js

@@ -6,9 +6,6 @@
 
 'use strict';
 
-const chalk = require('chalk');
-const logger = require('../utils/logger');
-const { cliOptsSkipSync } = require('../utils/cli-sync-options');
 const { getConfig } = require('../core/config');
 const { setupIntegrationTestAuth } = require('../external-system/test-auth');
 const { runGovernanceScenarios } = require('../api/governance-scenarios.api');
@@ -16,25 +13,7 @@ const {
   resolveGovernancePackPath,
   loadGovernancePackYaml
 } = require('../governance/governance-pack-loader');
-
-/**
- * @param {string} systemKey
- * @param {Object} options
- * @returns {Promise<{ authConfig: Object, dataplaneUrl: string }|null>}
- */
-async function syncLocalIfRequested(systemKey, options) {
-  if (cliOptsSkipSync(options)) {
-    return null;
-  }
-  const { uploadExternalSystem } = require('./upload');
-  logger.log(chalk.cyan('Syncing local config to dataplane…'));
-  const uploadCtx = await uploadExternalSystem(systemKey, {
-    minimal: true,
-    verbose: !!options.verbose
-  });
-  logger.log(chalk.green('✔ Sync complete'));
-  return uploadCtx && uploadCtx.dataplaneUrl && uploadCtx.authConfig ? uploadCtx : null;
-}
+const { syncLocalIfRequested } = require('./test-e2e-external');
 
 /**
  * @async
@@ -47,7 +26,7 @@ async function runTestGovernanceForExternalSystem(externalSystem, options = {})
   const appType = await pathsUtil.detectAppType(externalSystem).catch(() => null);
   if (!appType || appType.baseDir !== 'integration') {
     throw new Error(
-      'test-governance applies to external integration folders only (integration/<systemKey>/).'
+      'verify-governance applies to external integration folders only (integration/<systemKey>/).'
     );
   }
 
@@ -79,7 +58,7 @@ async function runTestGovernanceForExternalSystem(externalSystem, options = {})
     scenarios: options.scenarioIds
   };
   const result = await runGovernanceScenarios(dataplaneUrl, authConfig, body);
-  return { result, packPath, systemKey };
+  return { result, packPath, systemKey, packDocument: pack };
 }
 
 module.exports = {

package/lib/commands/test-trust-external.js

@@ -1,125 +1,73 @@
 /**
- * @fileoverview test-trust <systemKey> — semantic agent metadata validation for all datasources.
+ * @fileoverview verify-trust <systemKey> — dual-confidence AI Trust via dataplane (433.0).
  * @author AI Fabrix Team
- * @version 1.0.0
+ * @version 2.0.0
  */
 
 'use strict';
 
 const chalk = require('chalk');
 const logger = require('../utils/logger');
-const { cliOptsSkipSync } = require('../utils/cli-sync-options');
 const { getConfig } = require('../core/config');
 const { setupIntegrationTestAuth } = require('../external-system/test-auth');
-const { runDatasourceAgentTrust } = require('../datasource/agent-trust-run');
-const { resolveExternalIntegrationContext } = require('./test-e2e-external');
-
-/**
- * @param {string} systemKey
- * @param {Object} options
- * @returns {Promise<{ authConfig: Object, dataplaneUrl: string }|null>}
- */
-async function syncLocalIfRequested(systemKey, options) {
-  if (cliOptsSkipSync(options)) return null;
-  const { uploadExternalSystem } = require('./upload');
-  logger.log(chalk.cyan('Syncing local config to dataplane…'));
-  const uploadCtx = await uploadExternalSystem(systemKey, {
-    minimal: true,
-    verbose: !!options.verbose
-  });
-  logger.log(chalk.green('✔ Sync complete'));
-  return uploadCtx && uploadCtx.dataplaneUrl && uploadCtx.authConfig ? uploadCtx : null;
-}
-
-function pushTrustResult(results, key, trustRun, apiError) {
-  const failed =
-    apiError ||
-    !trustRun ||
-    trustRun.trustDecision === 'notTrusted' ||
-    trustRun.validationStatus === 'failed';
-  results.push({
-    key,
-    success: !failed,
-    error: failed
-      ? apiError
-        ? apiError.message || String(apiError)
-        : trustRun.summary || 'Trust validation failed'
-      : undefined,
-    trustRun
-  });
-}
-
-/**
- * @async
- * @param {Object|null} uploadCtx
- * @param {string} externalSystem
- * @param {Object} options
- * @returns {Promise<{ authConfig: Object, dataplaneUrl: string }>}
- */
-async function resolveTrustAuthContext(uploadCtx, externalSystem, options) {
-  if (uploadCtx) {
-    return { authConfig: uploadCtx.authConfig, dataplaneUrl: uploadCtx.dataplaneUrl };
-  }
-  const configObj = await getConfig();
-  return setupIntegrationTestAuth(externalSystem, { environment: options.env }, configObj);
-}
-
-/**
- * @async
- * @param {string[]} keys
- * @param {Object} runOpts
- * @param {Array<Object>} results
- */
-async function runTrustForDatasourceKeys(keys, runOpts, results) {
-  for (const key of keys) {
-    try {
-      const { trustRun, apiError } = await runDatasourceAgentTrust(key, runOpts);
-      pushTrustResult(results, key, trustRun, apiError);
-    } catch (err) {
-      results.push({ key, success: false, error: err.message, trustRun: null });
-    }
-  }
-}
+const { runSystemVerifyTrust } = require('../api/lifecycle.api');
+const {
+  resolveExternalIntegrationContext,
+  syncLocalIfRequested
+} = require('./test-e2e-external');
 
 /**
  * @async
  * @param {string} externalSystem
  * @param {Object} options
- * @returns {Promise<{ success: boolean, results: Array<Object>, systemKey: string }>}
+ * @returns {Promise<{ success: boolean, results: Array<Object>, systemKey: string, trustReport?: Object }>}
  */
 async function runTestTrustForExternalSystem(externalSystem, options = {}) {
-  const { systemKey, keys } = resolveExternalIntegrationContext(externalSystem);
-  if (keys.length === 0) {
-    logger.log(chalk.yellow(`No datasources found for ${externalSystem}.`));
-    return { success: true, results: [], systemKey };
-  }
+  const { systemKey } = resolveExternalIntegrationContext(externalSystem);
 
   const uploadCtx = await syncLocalIfRequested(systemKey, options);
+  if (uploadCtx?.authConfig && uploadCtx?.dataplaneUrl) {
+    options.authConfig = uploadCtx.authConfig;
+    options.dataplaneUrl = uploadCtx.dataplaneUrl;
+    options.silentResolve = true;
+  }
   if (options.revalidate === true) {
-    logger.log(chalk.cyan('Forcing revalidation (cache bypass) for each datasource…'));
+    logger.log(chalk.cyan('Forcing revalidation (cache bypass)…'));
+  }
+
+  let authConfig = options.authConfig;
+  let dataplaneUrl = options.dataplaneUrl;
+  if (!authConfig || !dataplaneUrl) {
+    const configObj = await getConfig();
+    const auth = await setupIntegrationTestAuth(
+      externalSystem,
+      {
+        environment: options.env,
+        authConfig: options.authConfig,
+        dataplaneUrl: options.dataplaneUrl,
+        silentResolve: options.silentResolve === true
+      },
+      configObj
+    );
+    authConfig = auth.authConfig;
+    dataplaneUrl = auth.dataplaneUrl;
   }
 
-  const { authConfig, dataplaneUrl } = await resolveTrustAuthContext(
-    uploadCtx,
-    externalSystem,
-    options
-  );
-  const results = [];
-  await runTrustForDatasourceKeys(
-    keys,
-    {
-      app: externalSystem,
-      environment: options.env,
-      noSync: true,
-      revalidate: options.revalidate === true,
-      summary: options.summary === true,
-      timeout: options.timeout,
-      authConfig,
-      dataplaneUrl
-    },
-    results
-  );
-  return { success: results.every(r => r.success), results, systemKey };
+  const trustReport = await runSystemVerifyTrust(dataplaneUrl, authConfig, systemKey, {
+    forceRevalidate: options.revalidate === true
+  });
+
+  const results = (trustReport.datasourceRows || []).map(row => ({
+    key: row.datasourceKey,
+    success: trustReport.verdict === 'VERIFIED' || trustReport.verdict !== 'FAILED',
+    trustRun: {
+      trustDecision: row.trustDecision,
+      validationStatus: row.validationStatus
+    }
+  }));
+
+  const success = trustReport.verdict === 'VERIFIED';
+  return { success, results, systemKey, trustReport };
 }
 
 module.exports = {

package/lib/commands/up-common.js

@@ -14,7 +14,7 @@ const fs = require('fs');
 const chalk = require('chalk');
 const logger = require('../utils/logger');
 const config = require('../core/config');
-const { getDefaultControllerUrl } = require('../utils/controller-url');
+const { resolvePlatformControllerUrl } = require('../utils/platform-controller-url');
 const pathsUtil = require('../utils/paths');
 const { loadConfigFile, writeConfigFile } = require('../utils/config-format');
 const { isYamlPath } = require('../utils/config-format');
@@ -189,19 +189,29 @@ function patchEnvOutputPathForDeployOnly(appName) {
 
 /**
  * For ``up-platform --force`` only: clear all stored auth tokens, set ``environment`` to ``dev``,
- * set ``controller`` to the default URL for the current ``developer-id`` (``http://localhost`` +
- * app port = 3000 + developerId × 100), and persist config. Does not change ``developer-id``.
+ * set ``controller`` and ``platform-controller`` to the default URL (or ``defaultControllerUrl`` when
+ * provided), and persist config. Does not change ``developer-id``. Pass ``clearTokens: false`` to
+ * keep device/client tokens (setup when already logged in to the platform controller).
  * Builder dirs (keycloak, miso-controller, dataplane) are cleaned separately.
  *
  * @returns {Promise<void>}
  */
 async function applyUpPlatformForceConfig(opts = {}) {
   const silent = Boolean(opts.silent);
-  const deviceCleared = await config.clearAllDeviceTokens();
-  const clientCleared = await config.clearAllClientTokens();
+  const clearTokens = opts.clearTokens !== false;
+  let deviceCleared = 0;
+  let clientCleared = 0;
+  if (clearTokens) {
+    deviceCleared = await config.clearAllDeviceTokens();
+    clientCleared = await config.clearAllClientTokens();
+  }
   await config.setCurrentEnvironment('dev');
-  const defaultControllerUrl = await getDefaultControllerUrl();
+  const defaultControllerUrl =
+    opts.defaultControllerUrl && typeof opts.defaultControllerUrl === 'string'
+      ? String(opts.defaultControllerUrl).replace(/\/+$/, '')
+      : await resolvePlatformControllerUrl();
   await config.setControllerUrl(defaultControllerUrl);
+  await config.setPlatformControllerUrl(defaultControllerUrl);
 
   const summary = { deviceCleared, clientCleared, defaultControllerUrl, environment: 'dev' };
   if (!silent) {
@@ -287,14 +297,15 @@ async function cleanBuilderAppDirs(appNames, opts = {}) {
  * @example
  * await ensureAppFromTemplate('keycloak');
  */
-async function ensureAppFromTemplate(appName) {
+async function ensureAppFromTemplate(appName, opts = {}) {
   if (!appName || typeof appName !== 'string') {
     throw new Error('Application name is required and must be a string');
   }
+  const silent = Boolean(opts.silent);
 
   const appPath = pathsUtil.getBuilderPath(appName);
   const primaryCopied = await ensureTemplateAtPath(appName, appPath);
-  if (primaryCopied) {
+  if (primaryCopied && !silent) {
     logger.log(chalk.blue(`Creating builder/${appName} from template...`));
     logger.log(formatSuccessLine(`Copied template for ${appName}`));
   }
@@ -307,7 +318,7 @@ async function ensureAppFromTemplate(appName) {
     !pathsUtil.isSystemBuilderAppName(appName)
   ) {
     const cwdCopied = await ensureTemplateAtPath(appName, cwdBuilderPath);
-    if (cwdCopied) {
+    if (cwdCopied && !silent) {
       logger.log(chalk.blue(`Creating builder/${appName} in project (from template)...`));
       logger.log(formatSuccessLine(`Copied template for ${appName} into builder/`));
     }
@@ -317,6 +328,35 @@ async function ensureAppFromTemplate(appName) {
   return primaryCopied;
 }
 
+/** Dataplane app key materialized for dataplane install (worker/beat are compose sidecars). */
+const DATAPLANE_BUILDER_APP_KEYS = Object.freeze(['dataplane']);
+
+/** Builder dirs removed on up-platform / setup force (includes Celery companions). */
+const PLATFORM_BUILDER_CLEAN_APP_KEYS = Object.freeze([
+  'keycloak',
+  'miso-controller',
+  ...DATAPLANE_BUILDER_APP_KEYS
+]);
+
+/**
+ * Ensure dataplane application manifest exists under the builder root.
+ * Worker/beat sidecars are resolved from parent application.yaml at run/compose time.
+ *
+ * @param {object} [opts]
+ * @param {boolean} [opts.silent]
+ * @returns {Promise<boolean>} True if any app template was copied
+ */
+async function ensureDataplaneAppsFromTemplate(opts = {}) {
+  let anyCopied = false;
+  for (const appName of DATAPLANE_BUILDER_APP_KEYS) {
+    const copied = await ensureAppFromTemplate(appName, opts);
+    if (copied) {
+      anyCopied = true;
+    }
+  }
+  return anyCopied;
+}
+
 /**
  * Merge builder/packages `application.yaml` into `~/.aifabrix/urls.local.yaml`.
  * Same scan as the end of {@link prepareUrlsLocalRegistryForUpPlatform}; call after platform app
@@ -339,17 +379,21 @@ function refreshUrlsLocalRegistryForCurrentProject() {
  *
  * @returns {Promise<void>}
  */
-async function prepareUrlsLocalRegistryForUpPlatform() {
-  await ensureAppFromTemplate('keycloak');
-  await ensureAppFromTemplate('miso-controller');
-  await ensureAppFromTemplate('dataplane');
+async function prepareUrlsLocalRegistryForUpPlatform(opts = {}) {
+  const templateOpts = { silent: Boolean(opts.silent) };
+  await ensureAppFromTemplate('keycloak', templateOpts);
+  await ensureAppFromTemplate('miso-controller', templateOpts);
+  await ensureDataplaneAppsFromTemplate(templateOpts);
   refreshUrlsLocalRegistryForCurrentProject();
 }
 
 module.exports = {
   applyUpPlatformForceConfig,
   cleanBuilderAppDirs,
+  DATAPLANE_BUILDER_APP_KEYS,
+  PLATFORM_BUILDER_CLEAN_APP_KEYS,
   ensureAppFromTemplate,
+  ensureDataplaneAppsFromTemplate,
   patchEnvOutputPathForDeployOnly,
   validateEnvOutputPathFolderOrNull,
   getEnvOutputPathFolder,