@aifabrix/builder 2.45.5 → 2.47.0

package/lib/lifecycle/verify-step-progress.js

@@ -0,0 +1,87 @@
+/**
+ * Active progress (ora spinner or single ⏳ line) for verify-* orchestration steps.
+ *
+ * @fileoverview Verify step progress UI
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { formatProgress } = require('../utils/cli-test-layout-chalk');
+const { withQuietLogs } = require('./logger-quiet');
+
+/**
+ * @param {Object} [options]
+ * @returns {boolean}
+ */
+function shouldShowVerifyStepProgress(options = {}) {
+  return options.json !== true;
+}
+
+/**
+ * @param {Object} [options]
+ * @returns {boolean}
+ */
+function shouldUseVerifyStepSpinner(options = {}) {
+  if (!shouldShowVerifyStepProgress(options)) {
+    return false;
+  }
+  return Boolean(process && process.stdout && process.stdout.isTTY);
+}
+
+/**
+ * @param {string} label
+ * @returns {string}
+ */
+function formatVerifyStepLabel(label) {
+  const text = label && String(label).trim() ? String(label).trim() : 'Processing';
+  return text.endsWith('…') ? text : `${text}…`;
+}
+
+/**
+ * Run a verify step with one active progress indicator (spinner on TTY).
+ *
+ * @template T
+ * @async
+ * @param {string} label - Plain label without trailing ellipsis
+ * @param {(progress: { setLabel: (next: string) => void }) => Promise<T>} work
+ * @param {Object} [options]
+ * @param {boolean} [options.json]
+ * @returns {Promise<T>}
+ */
+async function runWithVerifyStepProgress(label, work, options = {}) {
+  if (!shouldShowVerifyStepProgress(options)) {
+    return withQuietLogs(() => work({ setLabel: () => {} }));
+  }
+
+  if (!shouldUseVerifyStepSpinner(options)) {
+    logger.log(formatProgress(formatVerifyStepLabel(label)));
+    return withQuietLogs(() => work({ setLabel: () => {} }));
+  }
+
+  const ora = require('ora');
+  const spinner = ora({
+    text: chalk.white(formatVerifyStepLabel(label)),
+    spinner: 'dots'
+  }).start();
+
+  const setLabel = (next) => {
+    spinner.text = chalk.white(formatVerifyStepLabel(next));
+  };
+
+  try {
+    return await withQuietLogs(() => work({ setLabel }));
+  } finally {
+    spinner.stop();
+  }
+}
+
+module.exports = {
+  shouldShowVerifyStepProgress,
+  shouldUseVerifyStepSpinner,
+  formatVerifyStepLabel,
+  runWithVerifyStepProgress
+};

package/lib/parameters/infra-kv-discovery.js

@@ -6,7 +6,10 @@
 
 const fsRealSync = require('../internal/fs-real-sync');
 const path = require('path');
-const { loadRequiresDatabasesArray } = require('./database-secret-values');
+const { loadRequiresDatabasesArray, loadShippedRequiresDatabases } = require('./database-secret-values');
+
+/** Platform apps from shipped templates (setup/up-infra before builder/ is copied). */
+const SHIPPED_PLATFORM_APP_KEYS = ['keycloak', 'miso-controller', 'dataplane'];
 
 /**
  * Extract kv:// secret key names from env template content (active lines only).
@@ -90,6 +93,25 @@ function deriveDatabaseKvKeysFromWorkspace(pathsUtil) {
   return [...keys];
 }
 
+/**
+ * Database kv keys from shipped platform templates when builder/ apps are not copied yet
+ * (e.g. `aifabrix setup` fresh install before `up-platform`).
+ *
+ * @returns {string[]}
+ */
+function deriveDatabaseKvKeysFromShippedPlatformTemplates() {
+  const keys = new Set();
+  for (const appKey of SHIPPED_PLATFORM_APP_KEYS) {
+    const dbs = loadShippedRequiresDatabases(appKey);
+    if (!Array.isArray(dbs) || dbs.length === 0) continue;
+    for (let i = 0; i < dbs.length; i++) {
+      keys.add(`databases-${appKey}-${i}-urlKeyVault`);
+      keys.add(`databases-${appKey}-${i}-passwordKeyVault`);
+    }
+  }
+  return [...keys];
+}
+
 /**
  * Keys from env.template files whose catalog entry includes the given hook (e.g. upInfra).
  * @param {object} pathsUtil - paths module
@@ -132,6 +154,7 @@ function getAllInfraEnsureKeys(catalog, pathsUtil) {
   const set = new Set();
   for (const k of catalog.getStandardUpInfraBootstrapKeys()) set.add(k);
   for (const k of deriveDatabaseKvKeysFromWorkspace(pathsUtil)) set.add(k);
+  for (const k of deriveDatabaseKvKeysFromShippedPlatformTemplates()) set.add(k);
   for (const k of discoverKvKeysFromEnvTemplatesForHook(pathsUtil, 'upInfra', catalog)) set.add(k);
   return [...set].sort();
 }
@@ -139,8 +162,10 @@ function getAllInfraEnsureKeys(catalog, pathsUtil) {
 module.exports = {
   extractKvKeysFromEnvContent,
   deriveDatabaseKvKeysFromWorkspace,
+  deriveDatabaseKvKeysFromShippedPlatformTemplates,
   discoverKvKeysFromEnvTemplatesForHook,
   getAllInfraEnsureKeys,
   listAppDirsForDiscovery,
-  listBuilderAppDirsForDiscovery
+  listBuilderAppDirsForDiscovery,
+  SHIPPED_PLATFORM_APP_KEYS
 };

package/lib/protection/auth-context.js

@@ -9,6 +9,7 @@
 const { resolveControllerUrl } = require('../utils/controller-url');
 const { resolveEnvironment } = require('../core/config');
 const { getDeviceOnlyAuth, getDeploymentAuth } = require('../utils/token-manager');
+const { getDeploymentAuthMode } = require('../utils/deployment-auth-mode');
 const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
 
 /**
@@ -23,11 +24,16 @@ async function resolveProtectionDataplaneContext(options = {}) {
     throw new Error('Controller URL is required. Run "aifabrix login" first.');
   }
 
+  const authMode = getDeploymentAuthMode(options);
   let authConfig;
-  try {
-    authConfig = await getDeviceOnlyAuth(controllerUrl);
-  } catch {
-    authConfig = await getDeploymentAuth(controllerUrl, environment, 'dataplane');
+  if (authMode === 'client-credentials') {
+    authConfig = await getDeploymentAuth(controllerUrl, environment, 'dataplane', options);
+  } else {
+    try {
+      authConfig = await getDeviceOnlyAuth(controllerUrl);
+    } catch {
+      authConfig = await getDeploymentAuth(controllerUrl, environment, 'dataplane', options);
+    }
   }
 
   if (!authConfig?.token) {

package/lib/resolvers/datasource-resolver.js

@@ -10,7 +10,7 @@
 
 'use strict';
 
-const fs = require('fs');
+const { loadConfigFile } = require('../utils/config-format');
 const { resolveValidateInputPath, resolvePathFromIntegrationDatasourceKey } = require('../datasource/validate');
 
 /**
@@ -41,8 +41,7 @@ function tryResolveDatasourceKeyToLocalPath(datasourceKey) {
  * @returns {any}
  */
 function readJsonFile(jsonPath) {
-  const raw = fs.readFileSync(jsonPath, 'utf8');
-  return JSON.parse(raw);
+  return loadConfigFile(jsonPath);
 }
 
 module.exports = {

package/lib/resolvers/resource-type-file.js

@@ -0,0 +1,159 @@
+/**
+ * Resource type file helpers for `aifabrix resource-type create --file`.
+ *
+ * @fileoverview Resource type file parsing
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const { existsSync, readFileSync } = require('../internal/fs-real-sync');
+
+/**
+ * @typedef {Object} ResourceTypeCreateInput
+ * @property {string} key
+ * @property {string} displayName
+ * @property {string} [description]
+ * @property {string} [category]
+ * @property {string} [defaultRiskLevel]
+ * @property {string} [status]
+ */
+
+const CATEGORIES = new Set([
+  'business',
+  'collaboration',
+  'governance',
+  'content',
+  'communication',
+  'people'
+]);
+
+const RISK_LEVELS = new Set(['low', 'medium', 'high', 'critical']);
+const STATUSES = new Set(['draft', 'active', 'deprecated', 'retired']);
+
+/**
+ * @param {string} filePath
+ * @returns {object}
+ */
+function loadResourceTypeJsonObject(filePath) {
+  const p = path.resolve(String(filePath || '').trim());
+  if (!p) {
+    throw new Error('--file is required');
+  }
+  if (!existsSync(p)) {
+    throw new Error(`File not found: ${p}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(p, 'utf8'));
+  } catch (e) {
+    throw new Error(`Invalid JSON in ${p}: ${e.message}`);
+  }
+  if (!parsed || typeof parsed !== 'object') {
+    throw new Error(`Resource type file must be a JSON object: ${p}`);
+  }
+  return parsed;
+}
+
+/**
+ * @param {object} parsed
+ * @param {string} field
+ * @param {Set<string>} allowedValues
+ * @param {string} label
+ * @returns {void}
+ */
+function applyOptionalEnumField(parsed, field, allowedValues, label) {
+  if (parsed[field] === undefined) {
+    return;
+  }
+  const value = String(parsed[field]).trim();
+  if (!allowedValues.has(value)) {
+    throw new Error(`${label} must be one of: ${[...allowedValues].join(', ')}`);
+  }
+  parsed[field] = value;
+}
+
+/**
+ * @param {object} parsed
+ * @returns {void}
+ */
+function rejectBaselineCatalogShape(parsed) {
+  if (parsed && typeof parsed === 'object' && Array.isArray(parsed.resourceTypes) && !parsed.key) {
+    throw new Error(
+      'File is a baseline catalog (resourceTypes[]). ' +
+        'Use `aifabrix resource-type import --file <path>` to seed all entries, ' +
+        'or pass a single resource type object with key and displayName.'
+    );
+  }
+}
+
+/**
+ * @param {object} row
+ * @param {number} index
+ * @returns {ResourceTypeCreateInput}
+ */
+function normalizeResourceTypeCreateRow(row, index) {
+  if (!row || typeof row !== 'object') {
+    throw new Error(`resourceTypes[${index}] must be a JSON object`);
+  }
+  const entry = { ...row };
+  applyOptionalEnumField(entry, 'category', CATEGORIES, 'category');
+  applyOptionalEnumField(entry, 'defaultRiskLevel', RISK_LEVELS, 'defaultRiskLevel');
+  applyOptionalEnumField(entry, 'status', STATUSES, 'status');
+  const key = String(entry.key || '').trim();
+  if (!key) {
+    throw new Error(`resourceTypes[${index}].key is required`);
+  }
+  const displayName = String(entry.displayName || '').trim();
+  if (!displayName) {
+    throw new Error(`resourceTypes[${index}].displayName is required`);
+  }
+  entry.key = key;
+  entry.displayName = displayName;
+  return entry;
+}
+
+/**
+ * @param {string} filePath
+ * @returns {ResourceTypeCreateInput}
+ */
+function readResourceTypeCreateFile(filePath) {
+  const parsed = loadResourceTypeJsonObject(filePath);
+  rejectBaselineCatalogShape(parsed);
+  return normalizeResourceTypeCreateRow(parsed, 0);
+}
+
+/**
+ * Read baseline catalog or array file for `resource-type import`.
+ * Accepts `baseline-resourcetypes.json` shape or a top-level JSON array.
+ *
+ * @param {string} filePath
+ * @returns {ResourceTypeCreateInput[]}
+ */
+function readResourceTypeCatalogFile(filePath) {
+  const parsed = loadResourceTypeJsonObject(filePath);
+  let rows;
+  if (Array.isArray(parsed)) {
+    rows = parsed;
+  } else if (Array.isArray(parsed.resourceTypes)) {
+    rows = parsed.resourceTypes;
+  } else {
+    throw new Error(
+      'Import file must be a baseline catalog with resourceTypes[] or a JSON array of resource types.'
+    );
+  }
+  if (rows.length === 0) {
+    throw new Error('Import file contains no resource types');
+  }
+  return rows.map((row, index) => normalizeResourceTypeCreateRow(row, index));
+}
+
+module.exports = {
+  readResourceTypeCreateFile,
+  readResourceTypeCatalogFile,
+  CATEGORIES,
+  RISK_LEVELS,
+  STATUSES
+};

package/lib/schema/application-schema.json

@@ -34,7 +34,7 @@
         "version": "1.4.0",
         "date": "2026-04-06T00:00:00Z",
         "changes": [
-          "Removed build.localPort: local workstation PORT and localhost URL rewriting use the root-level manifest port only, with local host port = port + 10 + developerId*100 (developer id 0 → port+10). Docker published host port remains port + developerId*100.",
+          "Removed build.localPort: local workstation PORT and localhost URL rewriting use the root-level manifest port only, with host port = port + developerId*100 (developer id 0 → port). Same formula for Docker publish and aifabrix run.",
           "Migration: delete build.localPort from application.yaml; set or keep port as the single listen/container port. Use url://public, url://internal, or url://<app>-public|internal in env.template for declarative URLs (resolved after kv://)."
         ],
         "breaking": true
@@ -801,6 +801,22 @@
           "type": "string",
           "description": "When running with --reload, override the container command with this command (run from the mounted app root /app). Examples: TypeScript pnpm run reloadStart, Python make reloadStart."
         },
+        "imageRun": {
+          "type": "string",
+          "description": "Compose command when using a pulled image without bind-mount (prepended with cd /app && exec in generated compose)."
+        },
+        "worker": {
+          "type": "boolean",
+          "description": "When true, local compose and Azure companion manifests may start additional containers from the same image. Non-empty build.imageRunWorker starts <appKey>-worker; non-empty build.imageRunBeat starts <appKey>-beat. Empty imageRunWorker or imageRunBeat skips that role."
+        },
+        "imageRunWorker": {
+          "type": "string",
+          "description": "Compose/Azure startup command for the worker sidecar (<appKey>-worker) when build.worker is true. Omit or set to empty string to skip the worker role."
+        },
+        "imageRunBeat": {
+          "type": "string",
+          "description": "Compose/Azure startup command for the beat sidecar (<appKey>-beat) when build.worker is true. Omit or set to empty string to skip the beat role."
+        },
         "scripts": {
           "type": "object",
           "description": "Override CLI script commands (aifabrix test, install, lint, test-e2e, test-integration). When a key is missing, language default is used (TypeScript: pnpm test/install/lint/test:e2e/test:integration, Python: make test/install/lint/test:e2e/test-integration).",

package/lib/schema/datasource-test-run.schema.json

@@ -2,20 +2,25 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "aifabrix://schema/datasource-test-run.schema.json",
   "title": "DatasourceTestRun",
-  "description": "Canonical datasource-root test report (plans 362/365). Public success shape for POST /api/v1/validation/run (and async poll GET /validation/run/{testRunId}). runType=test|integration|e2e; CLI/docs may say test | test-integration | test-e2e; public JSON uses runType only. Includes validation layer (machine/explain), certificate snapshot, optional integration pipeline results, capability E2Es, debug by reference, plural audit refs, developer summaries. Forward-compatible: minor reportVersion bumps may add fields.",
+  "description": "Canonical datasource-root test report (plans 362/365, 370.06, 370.07 stage). Public success shape for POST /api/v1/validation/run (and async poll GET /validation/run/{testRunId}). runType=test|integration|e2e; stage=readiness|simulation|integration|e2e. reportVersion 1.5.0 adds required stage (minor bump). Older clients must tolerate absent stage when reportVersion < 1.5.0.",
   "type": "object",
-  "required": ["reportVersion", "datasourceKey", "systemKey", "runType", "status"],
+  "required": ["reportVersion", "datasourceKey", "systemKey", "runType", "stage", "status"],
   "properties": {
     "reportVersion": {
       "type": "string",
       "description": "Semver-style contract version for this envelope. Policy: additive fields => minor bump within same major; removed/renamed fields => major bump. Route migrations must cite target reportVersion.",
-      "example": "1.3.0"
+      "example": "1.5.0"
     },
     "runType": {
       "type": "string",
-      "description": "Kind of run. Maps to CLI/commands: test=test, test-integration=integration, test-e2e=e2e. Do not use kebab strings inside runType.",
+      "description": "Legacy kind of run. Maps to CLI: test, test-integration, test-e2e. Prefer stage for new clients.",
       "enum": ["test", "integration", "e2e"]
     },
+    "stage": {
+      "type": "string",
+      "description": "Contract validation stage aligned with contracts/rules stage and concept appliesTo.",
+      "enum": ["readiness", "simulation", "integration", "e2e"]
+    },
     "status": {
       "type": "string",
       "description": "Root rollup across validation, integration, certificate, and capabilities for this datasource run: ok | warn | fail | skipped.",
@@ -252,7 +257,7 @@
         "level": {
           "type": "string",
           "description": "Achieved certification tier when applicable.",
-          "enum": ["bronze", "silver", "gold"]
+          "enum": ["bronze", "silver", "gold", "platinum"]
         },
         "summary": {
           "type": "string",
@@ -388,6 +393,61 @@
         }
       }
     },
+    "FixInstruction": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["step"],
+      "description": "One deterministic repair step (370.03 fixInstruction vocabulary).",
+      "properties": {
+        "step": {
+          "type": "string",
+          "enum": [
+            "locate_file",
+            "update_path",
+            "add_mapping",
+            "set_value",
+            "remove_value",
+            "add_item",
+            "remove_item",
+            "explain"
+          ]
+        },
+        "value": {
+          "type": "string",
+          "description": "Brace tokens only in authored YAML: {datasource}, {systemKey}, {field}, {raw.*}."
+        },
+        "path": { "type": "string" },
+        "template": { "type": "string" },
+        "note": { "type": "string" }
+      }
+    },
+    "IssueFix": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["type", "instructions"],
+      "description": "Structured remediation on Issue (370.06; aligned with rule YAML fix).",
+      "properties": {
+        "type": {
+          "type": "string",
+          "enum": [
+            "add_mapping",
+            "edit_schema",
+            "edit_exposure",
+            "edit_governance",
+            "edit_execution",
+            "generic"
+          ]
+        },
+        "instructions": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/FixInstruction" }
+        },
+        "example": {
+          "description": "Optional structured or scalar example for authors/tooling."
+        }
+      }
+    },
     "Issue": {
       "type": "object",
       "required": ["message"],
@@ -395,7 +455,7 @@
       "properties": {
         "code": {
           "type": "string",
-          "description": "Stable code: DP-VAL-* (structural/config), DP-CIP-* (execution/CIP), DP-SEC-* (auth/RBAC/exposure), DP-CONN-* (REST/MCP/connectivity), DP-E2E-* (end-to-end live); warnings DP-*-Wnn. Mapped from engine errorCode in DatasourceTestRun builders.",
+          "description": "Stable code: DP-VAL-* (structural/config), DP-CIP-* (execution/CIP), DP-SEC-* (auth/RBAC/exposure), DP-CONN-* (REST/MCP/connectivity), DP-E2E-* (end-to-end live); warnings DP-*-Wnn. Prefer stableCode when present; otherwise mapped from engine errorCode.",
           "example": "DP-CIP-010"
         },
         "message": {
@@ -410,6 +470,29 @@
         "hint": {
           "type": "string",
           "description": "Remediation or next-step hint."
+        },
+        "conceptId": {
+          "type": "string",
+          "description": "Concept catalog id (370.02) for concept-first organization."
+        },
+        "ruleId": {
+          "type": "string",
+          "description": "YAML rule id when the finding came from the contract rule set.",
+          "example": "VAL-PIL-001"
+        },
+        "stableCode": {
+          "type": "string",
+          "description": "Frozen DP-* stable code from rule YAML.",
+          "example": "DP-VAL-097"
+        },
+        "ruleRefs": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Legacy or supplemental rule references; prefer ruleId + stableCode for YAML rules."
+        },
+        "fix": {
+          "$ref": "#/$defs/IssueFix",
+          "description": "Structured fix instructions when the emitting rule supplies them."
         }
       }
     },

package/lib/schema/deployment-rules.yaml

@@ -120,9 +120,10 @@ externalDataSource:
       - validation
       - quality
       - indexing
-      - context
       - documentStorage
       - capabilities
+      - authority
+      - foreignKeys
       - execution
       - config
       - openapi