@aifabrix/builder 2.45.5 → 2.47.0

package/lib/utils/postgres-wipe.js

@@ -22,6 +22,7 @@ const dockerExec = require('./docker-exec');
 const logger = require('./logger');
 const chalk = require('chalk');
 const { successGlyph } = require('./cli-test-layout-chalk');
+const { isSetupQuietOutput } = require('./setup-quiet-output');
 
 /** Roles that must never be dropped (Postgres-managed predefined roles). */
 const PROTECTED_ROLES = new Set([
@@ -190,15 +191,21 @@ async function wipePostgresData() {
   }
 
   const databases = await listUserDatabases(container, password);
+  const quiet = isSetupQuietOutput();
+
   for (const dbName of databases) {
     await dropDatabase(container, dbName, password);
-    logger.log(chalk.gray(` ${successGlyph()} Dropped database ${dbName}`));
+    if (!quiet) {
+      logger.log(chalk.gray(` ${successGlyph()} Dropped database ${dbName}`));
+    }
   }
 
   const roles = await listDropableRoles(container, password);
   for (const role of roles) {
     await dropRole(container, role, password);
-    logger.log(chalk.gray(` ${successGlyph()} Dropped role ${role}`));
+    if (!quiet) {
+      logger.log(chalk.gray(` ${successGlyph()} Dropped role ${role}`));
+    }
   }
 
   return { databases, roles };

package/lib/utils/resolve-env-mode.js

@@ -0,0 +1,47 @@
+/**
+ * Chooses `local` vs `docker` for `generateEnvFile` / `resolve` (integration → local, no Docker rewrite).
+ *
+ * @fileoverview Resolve environment mode for env generation
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+
+/** Platform builder apps that run in Docker and need docker host/port transforms on resolve. */
+const PLATFORM_DOCKER_APP_KEYS = new Set(['keycloak', 'miso-controller', 'dataplane']);
+
+/**
+ * @param {string} appPath - Resolved app directory from getResolveAppPath
+ * @returns {boolean}
+ */
+function isIntegrationAppPath(appPath) {
+  if (!appPath || typeof appPath !== 'string') return false;
+  const normalized = path.resolve(appPath);
+  const marker = `${path.sep}integration${path.sep}`;
+  return normalized.includes(marker);
+}
+
+/**
+ * @param {string} appPath - Resolved application directory
+ * @param {string} [appName] - App or system key
+ * @returns {'local'|'docker'}
+ */
+function resolveGenerateEnvEnvironment(appPath, appName) {
+  if (isIntegrationAppPath(appPath)) {
+    return 'local';
+  }
+  const key = String(appName || '').trim().toLowerCase();
+  if (PLATFORM_DOCKER_APP_KEYS.has(key)) {
+    return 'docker';
+  }
+  return 'docker';
+}
+
+module.exports = {
+  PLATFORM_DOCKER_APP_KEYS,
+  isIntegrationAppPath,
+  resolveGenerateEnvEnvironment
+};

package/lib/utils/runtime-configuration-download.js

@@ -0,0 +1,189 @@
+/**
+ * Sync runtime configuration_values from dataplane on download (values → env.template; manifest → placeholders).
+ *
+ * @fileoverview Download-time runtime configuration sync
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+const fs = require('fs');
+const fsPromises = require('fs').promises;
+const path = require('path');
+const yaml = require('js-yaml');
+
+const {
+  getExternalSystemConfigurationResolved,
+  getExternalDataSourceConfigurationResolved
+} = require('../api/runtime-configuration.api');
+const {
+  retemplateAllVariableDefinitions,
+  retemplateDatasourceConfigurationOverrides
+} = require('./configuration-env-resolver');
+const { mergeEnvTemplateWithExisting } = require('../generator/split');
+
+/**
+ * @param {Object} response - Dataplane API client response
+ * @returns {Record<string, string>}
+ */
+function extractResolvedVariableValues(response) {
+  if (!response || !response.success) {
+    return {};
+  }
+  const body = response.data && typeof response.data === 'object' ? response.data : {};
+  const variables = body.variables && typeof body.variables === 'object' ? body.variables : {};
+  const out = {};
+  for (const [name, entry] of Object.entries(variables)) {
+    if (!entry || typeof entry.value !== 'string') {
+      continue;
+    }
+    const value = entry.value.trim();
+    if (!value || value.startsWith('kv://')) {
+      continue;
+    }
+    out[name] = value;
+  }
+  return out;
+}
+
+/**
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {string} systemKey
+ * @param {Array<{ key?: string }>} dataSources
+ * @returns {Promise<Record<string, string>>}
+ */
+async function collectResolvedConfigurationEnvUpdates(
+  dataplaneUrl,
+  authConfig,
+  systemKey,
+  dataSources
+) {
+  const updates = {};
+  const systemResponse = await getExternalSystemConfigurationResolved(
+    dataplaneUrl,
+    systemKey,
+    authConfig
+  );
+  Object.assign(updates, extractResolvedVariableValues(systemResponse));
+
+  for (const ds of dataSources || []) {
+    if (!ds?.key) {
+      continue;
+    }
+    const dsResponse = await getExternalDataSourceConfigurationResolved(
+      dataplaneUrl,
+      ds.key,
+      authConfig
+    );
+    Object.assign(updates, extractResolvedVariableValues(dsResponse));
+  }
+  return updates;
+}
+
+/**
+ * @param {string} integrationPath
+ * @param {Record<string, string>} updates
+ * @returns {Promise<boolean>}
+ */
+async function mergeConfigurationUpdatesIntoEnvTemplate(integrationPath, updates) {
+  const keys = Object.keys(updates || {});
+  if (!keys.length) {
+    return false;
+  }
+  const envTemplatePath = path.join(integrationPath, 'env.template');
+  const expectedByKey = new Map();
+  for (const key of keys) {
+    expectedByKey.set(key, `${key}=${updates[key]}`);
+  }
+  const existingContent = fs.existsSync(envTemplatePath)
+    ? await fsPromises.readFile(envTemplatePath, 'utf8')
+    : '';
+  const merged = mergeEnvTemplateWithExisting(existingContent, expectedByKey);
+  await fsPromises.writeFile(envTemplatePath, merged, { mode: 0o644, encoding: 'utf8' });
+  return true;
+}
+
+/**
+ * @param {string} filePath
+ * @returns {Promise<boolean>}
+ */
+async function retemplateConfigurationFile(filePath, { system = false } = {}) {
+  if (!filePath || !fs.existsSync(filePath)) {
+    return false;
+  }
+  const raw = await fsPromises.readFile(filePath, 'utf8');
+  const isJson = filePath.endsWith('.json');
+  const parsed = isJson ? JSON.parse(raw) : yaml.load(raw);
+  if (!parsed || typeof parsed !== 'object') {
+    return false;
+  }
+  if (system) {
+    retemplateAllVariableDefinitions(parsed.configuration);
+  } else {
+    retemplateDatasourceConfigurationOverrides(parsed.configuration);
+  }
+  const next = isJson ? `${JSON.stringify(parsed, null, 2)}\n` : yaml.dump(parsed, { indent: 2, lineWidth: -1 });
+  await fsPromises.writeFile(filePath, next, { mode: 0o644, encoding: 'utf8' });
+  return true;
+}
+
+/**
+ * @param {string} integrationPath
+ * @param {string} systemKey
+ * @returns {Promise<void>}
+ */
+async function retemplateDownloadedConfigurationFiles(integrationPath, systemKey) {
+  for (const ext of ['yaml', 'json']) {
+    const systemPath = path.join(integrationPath, `${systemKey}-system.${ext}`);
+    if (fs.existsSync(systemPath)) {
+      await retemplateConfigurationFile(systemPath, { system: true });
+    }
+  }
+  const entries = await fsPromises.readdir(integrationPath);
+  for (const name of entries) {
+    if (!name.includes('-datasource-') || (!name.endsWith('.yaml') && !name.endsWith('.json'))) {
+      continue;
+    }
+    await retemplateConfigurationFile(path.join(integrationPath, name), { system: false });
+  }
+}
+
+/**
+ * Pulls configuration_values from dataplane, merges env.template, and re-templates manifests.
+ *
+ * @param {Object} params
+ * @param {string} params.dataplaneUrl
+ * @param {Object} params.authConfig
+ * @param {string} params.systemKey
+ * @param {string} params.integrationPath
+ * @param {Array<{ key?: string }>} params.dataSources
+ * @returns {Promise<{ merged: number, names: string[] }>}
+ */
+async function syncRuntimeConfigurationFromDataplane({
+  dataplaneUrl,
+  authConfig,
+  systemKey,
+  integrationPath,
+  dataSources
+}) {
+  const updates = await collectResolvedConfigurationEnvUpdates(
+    dataplaneUrl,
+    authConfig,
+    systemKey,
+    dataSources
+  );
+  const names = Object.keys(updates);
+  if (names.length) {
+    await mergeConfigurationUpdatesIntoEnvTemplate(integrationPath, updates);
+  }
+  await retemplateDownloadedConfigurationFiles(integrationPath, systemKey);
+  return { merged: names.length, names };
+}
+
+module.exports = {
+  extractResolvedVariableValues,
+  collectResolvedConfigurationEnvUpdates,
+  mergeConfigurationUpdatesIntoEnvTemplate,
+  retemplateDownloadedConfigurationFiles,
+  syncRuntimeConfigurationFromDataplane
+};

package/lib/utils/runtime-configuration-values.js

@@ -0,0 +1,119 @@
+/**
+ * Push runtime configuration_values to dataplane after publish (never logs values).
+ *
+ * @fileoverview Post-publish configuration PUT helpers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+const {
+  putExternalSystemConfiguration,
+  putExternalDataSourceConfiguration
+} = require('../api/runtime-configuration.api');
+const { buildResolvedEnvMapForIntegration } = require('./configuration-env-resolver');
+
+/**
+ * @param {Array<{ name?: string, location?: string }>|undefined} systemConfiguration
+ * @param {Object.<string, string>} envMap
+ * @returns {Array<{ name: string, value: string }>}
+ */
+function collectSystemVariablePutRequests(systemConfiguration, envMap) {
+  if (!Array.isArray(systemConfiguration)) {
+    return [];
+  }
+  const requests = [];
+  for (const item of systemConfiguration) {
+    if (!item || !item.name) {
+      continue;
+    }
+    const location = String(item.location || 'variable').toLowerCase();
+    if (location !== 'variable') {
+      continue;
+    }
+    const name = String(item.name).trim();
+    const raw = envMap[name];
+    if (raw === undefined || raw === null) {
+      continue;
+    }
+    const value = String(raw).trim();
+    if (!value || value.startsWith('kv://') || value.includes('{{')) {
+      continue;
+    }
+    requests.push({ name, value });
+  }
+  return requests;
+}
+
+/**
+ * Datasource overrides are name+value only; values may already be resolved in upload payload.
+ *
+ * @param {Array<{ name?: string, value?: string }>|undefined} datasourceConfiguration
+ * @returns {Array<{ name: string, value: string }>}
+ */
+function collectDatasourceOverridePutRequests(datasourceConfiguration) {
+  if (!Array.isArray(datasourceConfiguration)) {
+    return [];
+  }
+  const requests = [];
+  for (const item of datasourceConfiguration) {
+    if (!item || !item.name) {
+      continue;
+    }
+    const name = String(item.name).trim();
+    const raw = item.value;
+    if (typeof raw !== 'string') {
+      continue;
+    }
+    const value = raw.trim();
+    if (!value || value.startsWith('kv://') || value.includes('{{')) {
+      continue;
+    }
+    requests.push({ name, value });
+  }
+  return requests;
+}
+
+/**
+ * Upserts system-scoped and datasource-scoped configuration values after publish.
+ *
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {string} systemKey
+ * @param {{ application?: { configuration?: unknown[] }, dataSources?: Array<{ key?: string, configuration?: unknown[] }> }} payload
+ * @returns {Promise<{ pushed: number, names: string[] }>}
+ */
+async function pushRuntimeConfigurationValues(dataplaneUrl, authConfig, systemKey, payload) {
+  const { envMap } = await buildResolvedEnvMapForIntegration(systemKey);
+  const names = [];
+  let pushed = 0;
+
+  const systemRequests = collectSystemVariablePutRequests(
+    payload?.application?.configuration,
+    envMap
+  );
+  for (const body of systemRequests) {
+    await putExternalSystemConfiguration(dataplaneUrl, systemKey, authConfig, body);
+    names.push(body.name);
+    pushed += 1;
+  }
+
+  for (const ds of payload?.dataSources || []) {
+    if (!ds?.key) {
+      continue;
+    }
+    const dsRequests = collectDatasourceOverridePutRequests(ds.configuration);
+    for (const body of dsRequests) {
+      await putExternalDataSourceConfiguration(dataplaneUrl, ds.key, authConfig, body);
+      names.push(`${ds.key}:${body.name}`);
+      pushed += 1;
+    }
+  }
+
+  return { pushed, names };
+}
+
+module.exports = {
+  collectSystemVariablePutRequests,
+  collectDatasourceOverridePutRequests,
+  pushRuntimeConfigurationValues
+};

package/lib/utils/schema-loader.js

@@ -28,6 +28,23 @@ function resetValidators() {
   externalDataSourceValidator = null;
 }
 
+/**
+ * Register AJV schemas required to compile or validate external-datasource manifests.
+ * Includes type schemas and external-system (for $defs/subscriptionFilter cross-ref).
+ *
+ * @function registerExternalDatasourceAjvDependencies
+ * @param {import('ajv').default} ajv - AJV instance
+ */
+function registerExternalDatasourceAjvDependencies(ajv) {
+  ajv.addSchema(require('../schema/type/document-storage.json'));
+  ajv.addSchema(require('../schema/type/message-service.json'));
+  ajv.addSchema(require('../schema/type/vector-store.json'));
+  const externalSystemSchema = require('../schema/external-system.schema.json');
+  if (!ajv.getSchema(externalSystemSchema.$id)) {
+    ajv.addSchema(externalSystemSchema, externalSystemSchema.$id);
+  }
+}
+
 /**
  * Loads and compiles external-system schema
  * Caches the compiled validator for performance
@@ -115,10 +132,7 @@ function loadExternalDataSourceSchema() {
 
   const ajv = new Ajv({ allErrors: true, strict: false, strictSchema: false });
   addFormats(ajv);
-  // external-datasource.schema.json references these by $id (aifabrix://schema/type/*)
-  ajv.addSchema(require('../schema/type/document-storage.json'));
-  ajv.addSchema(require('../schema/type/message-service.json'));
-  ajv.addSchema(require('../schema/type/vector-store.json'));
+  registerExternalDatasourceAjvDependencies(ajv);
   externalDataSourceValidator = ajv.compile(schemaToCompile);
 
   return externalDataSourceValidator;
@@ -333,6 +347,7 @@ function detectSchemaType(filePath, content) {
 module.exports = {
   loadExternalSystemSchema,
   loadExternalDataSourceSchema,
+  registerExternalDatasourceAjvDependencies,
   detectSchemaType,
   detectSchemaTypeFromParsed,
   resetValidators

package/lib/utils/secrets-generator.js

@@ -77,42 +77,44 @@ function loadYamlTolerantOfDuplicateKeys(content) {
 }
 
 /**
- * Skips commented or empty lines when scanning env.template
- * @param {string} line - Single line
+ * True when secrets map already has a non-empty value for a kv path (flat or nested).
+ * @param {Object} secrets
+ * @param {string} pathStr - Path after kv:// (e.g. hubspot-demo/token)
  * @returns {boolean}
  */
-function isCommentOrEmptyLine(line) {
-  const t = line.trim();
-  return t === '' || t.startsWith('#');
+function secretPathExistsInStore(secrets, pathStr) {
+  if (!secrets || typeof secrets !== 'object' || !pathStr) {
+    return false;
+  }
+  const direct = secrets[pathStr];
+  if (direct !== undefined && direct !== null && String(direct).trim() !== '') {
+    return true;
+  }
+  if (!pathStr.includes('/')) {
+    return false;
+  }
+  let current = secrets;
+  for (const segment of pathStr.split('/')) {
+    if (current === null || current === undefined || typeof current !== 'object' || !(segment in current)) {
+      return false;
+    }
+    current = current[segment];
+  }
+  return current !== undefined && current !== null && String(current).trim() !== '';
 }
 
 /**
- * Finds missing secret keys from template (skips commented and empty lines)
+ * Finds missing secret keys from template (skips commented and empty lines).
+ * Uses full kv:// paths (e.g. hubspot-demo/token), aligned with collectMissingSecrets.
  * @function findMissingSecretKeys
  * @param {string} envTemplate - Environment template content
  * @param {Object} existingSecrets - Existing secrets object
  * @returns {string[]} Array of missing secret keys
  */
 function findMissingSecretKeys(envTemplate, existingSecrets) {
-  const kvPattern = /kv:\/\/([a-zA-Z0-9-_]+)/g;
-  const missingKeys = [];
-  const seenKeys = new Set();
-  const lines = envTemplate.split('\n');
-
-  for (const line of lines) {
-    if (isCommentOrEmptyLine(line)) continue;
-    let match;
-    kvPattern.lastIndex = 0;
-    while ((match = kvPattern.exec(line)) !== null) {
-      const secretKey = match[1];
-      if (!seenKeys.has(secretKey) && !(secretKey in existingSecrets)) {
-        missingKeys.push(secretKey);
-        seenKeys.add(secretKey);
-      }
-    }
-  }
-
-  return missingKeys;
+  const { collectUniqueKvPathStrings } = require('./secrets-kv-refs');
+  const paths = collectUniqueKvPathStrings(envTemplate);
+  return paths.filter(pathStr => !secretPathExistsInStore(existingSecrets, pathStr));
 }
 
 /**
@@ -275,6 +277,8 @@ function loadExistingSecrets(resolvedPath) {
  * @throws {Error} If save fails
  */
 function saveSecretsFile(resolvedPath, secrets) {
+  const { assertWritableSecretsPathForTests } = require('./aifabrix-test-runtime-guard');
+  assertWritableSecretsPathForTests(resolvedPath);
   const dir = path.dirname(resolvedPath);
   if (!fs.existsSync(dir)) {
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -356,6 +360,8 @@ function appendSecretsToFile(resolvedPath, secrets) {
   if (!secrets || typeof secrets !== 'object' || Object.keys(secrets).length === 0) {
     return;
   }
+  const { assertWritableSecretsPathForTests } = require('./aifabrix-test-runtime-guard');
+  assertWritableSecretsPathForTests(resolvedPath);
   const dir = path.dirname(resolvedPath);
   if (!fs.existsSync(dir)) {
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });

package/lib/utils/secrets-missing-error.js

@@ -0,0 +1,164 @@
+/**
+ * Build missing-secrets errors with remediation hints (no secret values).
+ *
+ * @fileoverview Missing kv:// error message for resolve and env generation
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { formatMissingSecretsFileInfo } = require('./secrets-helpers');
+
+/**
+ * @param {string} line
+ * @returns {boolean}
+ */
+function isCommentOrEmptyLine(line) {
+  const t = String(line).trim();
+  return t === '' || t.startsWith('#');
+}
+
+/**
+ * @param {string} kvRef - e.g. kv://hubspot-demo/clientSecret
+ * @returns {string}
+ */
+function kvRefToSecretSetKey(kvRef) {
+  const s = String(kvRef || '').trim();
+  return s.replace(/^kv:\/\//i, '');
+}
+
+/**
+ * @param {string} envTemplate
+ * @param {string} kvRef
+ * @returns {string|null}
+ */
+function findActiveEnvLineForKvRef(envTemplate, kvRef) {
+  if (!envTemplate || !kvRef) return null;
+  const needle = String(kvRef).trim();
+  for (const line of envTemplate.split('\n')) {
+    if (isCommentOrEmptyLine(line)) continue;
+    if (line.includes(needle)) return line.trim();
+  }
+  return null;
+}
+
+const OAUTH_STALE_KV_PATH_RE = /\/(clientId|clientSecret|tokenUrl|authorizationUrl)$/i;
+
+/**
+ * @param {string[]} missing
+ * @returns {boolean}
+ */
+function hasStaleOAuthTemplatePaths(missing) {
+  return missing.some((ref) => OAUTH_STALE_KV_PATH_RE.test(String(ref)));
+}
+
+/**
+ * @param {string} key
+ * @param {Object} secrets
+ * @returns {boolean}
+ */
+function isPopulatedSecretKey(key, secrets) {
+  const value = secrets[key];
+  return value !== undefined && value !== null && String(value).trim() !== '';
+}
+
+/**
+ * Other populated secret paths that share the same path segment after the namespace.
+ *
+ * @param {string} pathStr - Secret path without kv:// (e.g. my-app-e2e/clientId)
+ * @param {Object} secrets
+ * @returns {string[]}
+ */
+function findPopulatedAlternateKvPaths(pathStr, secrets) {
+  if (!secrets || typeof secrets !== 'object' || !pathStr) {
+    return [];
+  }
+  const slash = pathStr.indexOf('/');
+  if (slash <= 0) {
+    return [];
+  }
+  const missingNamespace = pathStr.slice(0, slash);
+  const segment = pathStr.slice(slash + 1);
+  return Object.keys(secrets).filter((key) => {
+    if (typeof key !== 'string' || !key.includes('/')) {
+      return false;
+    }
+    const keySlash = key.indexOf('/');
+    const namespace = key.slice(0, keySlash);
+    const keySegment = key.slice(keySlash + 1);
+    return (
+      keySegment === segment &&
+      namespace !== missingNamespace &&
+      isPopulatedSecretKey(key, secrets)
+    );
+  });
+}
+
+/**
+ * @param {string[]} missing - kv:// refs
+ * @param {Object} [secrets]
+ * @param {string} [appName]
+ * @returns {string[]}
+ */
+function buildKvNamespaceAlternateHints(missing, secrets, appName) {
+  const lines = [];
+  const seen = new Set();
+  for (const ref of missing) {
+    const pathStr = kvRefToSecretSetKey(ref);
+    for (const alt of findPopulatedAlternateKvPaths(pathStr, secrets)) {
+      const line = `Found kv://${alt} in secrets; env.template references kv://${pathStr}.`;
+      if (seen.has(line)) {
+        continue;
+      }
+      seen.add(line);
+      lines.push(line);
+    }
+  }
+  if (lines.length === 0) {
+    return [];
+  }
+  const repairTail = appName
+    ? `Use aifabrix secret set <key> for each missing path, or aifabrix repair ${appName} to align env.template.`
+    : 'Use aifabrix secret set <key> for each missing path, or repair to align env.template.';
+  lines.push(repairTail);
+  return lines;
+}
+
+/**
+ * @param {Object} opts
+ * @param {string[]} opts.missing
+ * @param {Object|string|null} [opts.secretsFilePaths]
+ * @param {string} [opts.appName]
+ * @param {string} [opts.envTemplatePath]
+ * @param {string} [opts.envTemplate]
+ * @param {Object} [opts.secrets]
+ * @returns {string}
+ */
+function buildMissingSecretsErrorMessage(opts) {
+  const { missing, secretsFilePaths, appName, envTemplatePath, envTemplate, secrets } = opts;
+  const fileInfo = formatMissingSecretsFileInfo(secretsFilePaths);
+  const lines = [`Missing secrets: ${missing.join(', ')}`];
+  if (fileInfo) lines.push(fileInfo.trim());
+  if (envTemplatePath) lines.push(`Env-template-path: ${envTemplatePath}`);
+  for (const ref of missing) {
+    const templateLine = findActiveEnvLineForKvRef(envTemplate, ref);
+    if (templateLine) lines.push(`Env-template-line: ${ref}|${templateLine}`);
+  }
+  if (appName) lines.push(`App-name: ${appName}`);
+  if (hasStaleOAuthTemplatePaths(missing) && appName) {
+    lines.push(`Stale-template-hint: oauth-leftover | repair ${appName}`);
+  }
+  for (const hint of buildKvNamespaceAlternateHints(missing, secrets, appName)) {
+    lines.push(`Alternate-kv-hint: ${hint}`);
+  }
+  lines.push('Remediation-hint: comment-or-delete-template-line | secret-set');
+  return `${lines.join('\n')}\n`;
+}
+
+module.exports = {
+  kvRefToSecretSetKey,
+  findActiveEnvLineForKvRef,
+  findPopulatedAlternateKvPaths,
+  buildMissingSecretsErrorMessage
+};