@aifabrix/builder 2.46.0 → 2.47.0

package/lib/identity/identity-display.js

@@ -0,0 +1,243 @@
+/**
+ * @fileoverview TTY layout helpers for aifabrix identity commands (plan 151)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const {
+  formatBlockingError,
+  formatNextActions,
+  headerKeyValue,
+  sectionTitle
+} = require('../utils/cli-layout-chalk');
+const { readFkId, readFkKey, readFkName, formatFkLabel } = require('./fk-reference');
+const { unwrapControllerData } = require('./identity-response-helpers');
+
+/**
+ * @param {Object|null|undefined} response
+ * @returns {{ items: Object[], meta: Object|null }}
+ */
+function extractPaginatedList(response) {
+  if (!response || response.success === false) {
+    return { items: [], meta: null };
+  }
+  const body = response.data;
+  if (body && Array.isArray(body.data)) {
+    return { items: body.data, meta: body.meta ?? null };
+  }
+  const unwrapped = unwrapControllerData(response);
+  if (Array.isArray(unwrapped)) {
+    return { items: unwrapped, meta: null };
+  }
+  if (unwrapped && Array.isArray(unwrapped.data)) {
+    return { items: unwrapped.data, meta: unwrapped.meta ?? null };
+  }
+  return { items: [], meta: null };
+}
+
+/**
+ * @param {Object} user
+ * @returns {string}
+ */
+function formatUserDisplayName(user) {
+  const display = String(user?.displayName || '').trim();
+  if (display) {
+    return display;
+  }
+  const parts = [user?.firstName, user?.lastName].filter(Boolean).map(String);
+  const joined = parts.join(' ').trim();
+  return joined || '—';
+}
+
+/**
+ * @param {string} value
+ * @param {number} width
+ * @returns {string}
+ */
+function padCell(value, width) {
+  const text = String(value ?? '—');
+  if (text.length <= width) {
+    return text.padEnd(width);
+  }
+  if (width <= 1) {
+    return text.slice(0, width);
+  }
+  return `${text.slice(0, width - 1)}…`;
+}
+
+/**
+ * @param {{ emoji?: string, title: string, context?: string, shown?: number, total?: number|null }} opts
+ */
+function printIdentityListHeader(opts) {
+  const emoji = opts.emoji ? `${opts.emoji} ` : '';
+  const context = opts.context ? ` (${opts.context})` : '';
+  const shown = Number.isFinite(opts.shown) ? opts.shown : 0;
+  const total = Number.isFinite(opts.total) ? opts.total : null;
+  const count =
+    total !== null && total >= shown ? `${shown} shown of ${total}` : `${shown} shown`;
+  logger.log(chalk.bold(`\n${emoji}${opts.title}${context} — ${count}:\n`));
+}
+
+/**
+ * @param {Array<{ label: string, width: number, value: (row: Object) => string }>} columns
+ * @param {Object[]} rows
+ */
+function printIdentityTable(columns, rows) {
+  const header = columns.map((col) => padCell(col.label, col.width)).join('');
+  logger.log(chalk.gray(header));
+  logger.log(chalk.gray('-'.repeat(columns.reduce((sum, col) => sum + col.width, 0))));
+  rows.forEach((row) => {
+    const line = columns.map((col) => padCell(col.value(row), col.width)).join('');
+    logger.log(line);
+  });
+  logger.log('');
+}
+
+/**
+ * @param {Object|null|undefined} meta
+ */
+function printListPaginationFooter(meta) {
+  if (!meta || !Number.isFinite(meta.totalItems)) {
+    return;
+  }
+  const page = meta.currentPage ?? meta.page ?? 1;
+  const pageSize = meta.pageSize ?? meta.page_size;
+  const totalPages = meta.totalPages ?? meta.total_pages;
+  const parts = [`total ${meta.totalItems}`];
+  if (pageSize) {
+    parts.unshift(`page ${page}`);
+  }
+  if (totalPages) {
+    parts.push(`${totalPages} pages`);
+  }
+  logger.log(chalk.gray(`  ${parts.join(' · ')}\n`));
+}
+
+/**
+ * @param {string} title
+ * @param {Array<{ label: string, value: string }>} fields
+ */
+function printIdentityRecord(title, fields) {
+  logger.log(sectionTitle(title));
+  fields.forEach(({ label, value }) => {
+    logger.log(`  ${headerKeyValue(`${label}:`, value || '—')}`);
+  });
+  logger.log('');
+}
+
+/**
+ * @param {string} message
+ * @param {string[]} [hints]
+ */
+function printIdentityEmpty(message, hints = []) {
+  logger.log(chalk.gray(`  ${message}\n`));
+  if (hints.length > 0) {
+    logger.log(formatNextActions(hints));
+    logger.log('');
+  }
+}
+
+/**
+ * @param {string} entity
+ * @param {string} query
+ * @param {string[]} [hints]
+ */
+function printIdentityNotFound(entity, query, hints = []) {
+  logger.error(formatBlockingError(`${entity} not found: ${query}`));
+  if (hints.length > 0) {
+    logger.log(formatNextActions(hints));
+  }
+}
+
+const USER_LIST_COLUMNS = [
+  { label: 'Id', width: 38, value: (u) => u.id || '—' },
+  { label: 'Username', width: 16, value: (u) => u.username || '—' },
+  { label: 'Name', width: 22, value: (u) => formatUserDisplayName(u) },
+  { label: 'Email', width: 34, value: (u) => u.email || '—' },
+  { label: 'Status', width: 10, value: (u) => u.status || '—' }
+];
+
+const GROUP_LIST_COLUMNS = [
+  { label: 'Id', width: 38, value: (g) => g.id || '—' },
+  { label: 'Name', width: 28, value: (g) => g.name || '—' },
+  { label: 'Display name', width: 28, value: (g) => g.displayName || '—' }
+];
+
+/**
+ * @param {Object[]} memberships
+ */
+function printUserGroupsTable(memberships) {
+  printIdentityTable(
+    [
+      { label: 'Group key', width: 28, value: (m) => readFkKey(m.groupId) || '—' },
+      { label: 'Group name', width: 28, value: (m) => formatFkLabel(m.groupId) },
+      { label: 'Group id', width: 38, value: (m) => readFkId(m.groupId) || '—' },
+      { label: 'Role hint', width: 12, value: (m) => m.roleHint || '—' }
+    ],
+    memberships
+  );
+}
+
+/**
+ * @param {Object[]} memberships
+ */
+function printGroupMembersTable(memberships) {
+  printIdentityTable(
+    [
+      { label: 'User key', width: 22, value: (m) => readFkKey(m.userId) || '—' },
+      { label: 'User name', width: 24, value: (m) => formatFkLabel(m.userId) },
+      { label: 'User id', width: 38, value: (m) => readFkId(m.userId) || '—' },
+      { label: 'Role hint', width: 12, value: (m) => m.roleHint || '—' }
+    ],
+    memberships
+  );
+}
+
+/**
+ * @param {Object} user
+ */
+function printUserRecord(user) {
+  printIdentityRecord('User', [
+    { label: 'Id', value: user.id },
+    { label: 'Email', value: user.email },
+    { label: 'Username', value: user.username },
+    { label: 'Name', value: formatUserDisplayName(user) },
+    { label: 'Display name', value: user.displayName },
+    { label: 'Status', value: user.status },
+    { label: 'Verified', value: user.emailVerified ? 'yes' : 'no' }
+  ]);
+}
+
+/**
+ * @param {Object} group
+ */
+function printGroupRecord(group) {
+  printIdentityRecord('Group', [
+    { label: 'Id', value: group.id },
+    { label: 'Name', value: group.name },
+    { label: 'Display name', value: group.displayName },
+    { label: 'Description', value: group.description }
+  ]);
+}
+
+module.exports = {
+  extractPaginatedList,
+  formatUserDisplayName,
+  printIdentityListHeader,
+  printIdentityTable,
+  printListPaginationFooter,
+  printIdentityRecord,
+  printIdentityEmpty,
+  printIdentityNotFound,
+  USER_LIST_COLUMNS,
+  GROUP_LIST_COLUMNS,
+  printUserGroupsTable,
+  printGroupMembersTable,
+  printUserRecord,
+  printGroupRecord,
+  readFkName
+};

package/lib/identity/identity-response-helpers.js

@@ -0,0 +1,52 @@
+/**
+ * @fileoverview Shared controller response helpers for identity modules
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {Object} response
+ * @returns {any}
+ */
+function unwrapControllerData(response) {
+  if (!response || response.success === false) {
+    return null;
+  }
+  return response?.data?.data ?? response?.data ?? response;
+}
+
+/**
+ * @param {Object} response
+ * @returns {string}
+ */
+function apiErrorMessage(response) {
+  if (!response) {
+    return 'Request failed';
+  }
+  const err = response.error;
+  if (typeof err === 'string') {
+    return err;
+  }
+  if (err && typeof err === 'object') {
+    return err.formattedError || err.message || err.error || 'Request failed';
+  }
+  return response.formattedError || response.message || 'Request failed';
+}
+
+/**
+ * @param {Object} response
+ * @throws {Error}
+ */
+function throwIfApiFailed(response) {
+  if (!response || response.success === false) {
+    throw new Error(apiErrorMessage(response));
+  }
+}
+
+module.exports = {
+  unwrapControllerData,
+  apiErrorMessage,
+  throwIfApiFailed
+};

package/lib/identity/identity-sync-errors.js

@@ -0,0 +1,62 @@
+/**
+ * @fileoverview User-facing identity sync failure messages
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {Object|null|undefined} stats
+ * @returns {boolean}
+ */
+function isZeroProgressSyncFailure(stats) {
+  const usersProcessed = Number(stats?.usersProcessed ?? 0);
+  const groupsProcessed = Number(stats?.groupsProcessed ?? 0);
+  return usersProcessed === 0 && groupsProcessed === 0;
+}
+
+/**
+ * Build a multi-line CLI message when controller sync stats report errors.
+ *
+ * @param {Object|null|undefined} stats
+ * @returns {string}
+ */
+function buildSyncStatsFailureMessage(stats) {
+  const syncErrors = Number(stats?.errors ?? 0);
+  const usersProcessed = Number(stats?.usersProcessed ?? 0);
+  const groupsProcessed = Number(stats?.groupsProcessed ?? 0);
+
+  const lines = [
+    `Dataplane full sync reported ${syncErrors} error(s).`,
+    `usersProcessed=${usersProcessed} groupsProcessed=${groupsProcessed}.`
+  ];
+
+  if (isZeroProgressSyncFailure(stats)) {
+    lines.push(
+      '',
+      'The controller accepted the sync request, but no identity data reached the dataplane.',
+      'Common causes:',
+      '  • Expired or invalid dataplane client token (controller → dataplane auth)',
+      '  • Dataplane unreachable or unhealthy',
+      '  • Dataplane MISO_CLIENTID / MISO_CLIENTSECRET out of sync with the controller',
+      '',
+      'Try:',
+      '  aifabrix auth status',
+      '  aifabrix run dataplane --reload',
+      'Then retry:',
+      '  aifabrix identity sync -e dev --purge-cache',
+      '',
+      'If it still fails, check miso-controller logs for the sync request.'
+    );
+  } else {
+    lines.push('Check miso-controller logs for the sync request.');
+  }
+
+  return lines.join('\n');
+}
+
+module.exports = {
+  isZeroProgressSyncFailure,
+  buildSyncStatsFailureMessage
+};

package/lib/identity/resolve-user-id.js

@@ -0,0 +1,129 @@
+/**
+ * @fileoverview Resolve controller user id from id, email, or username
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { getUser, listUsers } = require('../api/users.api');
+const { throwIfApiFailed, unwrapControllerData } = require('./identity-response-helpers');
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/**
+ * @param {string} value
+ * @returns {boolean}
+ */
+function isLikelyUuid(value) {
+  return UUID_RE.test(String(value || '').trim());
+}
+
+/**
+ * @param {Object} response
+ * @returns {Object[]}
+ */
+function extractUserListItems(response) {
+  const data = unwrapControllerData(response);
+  if (Array.isArray(data)) {
+    return data;
+  }
+  if (Array.isArray(data?.data)) {
+    return data.data;
+  }
+  return [];
+}
+
+/**
+ * @param {Object[]} items
+ * @param {string} value
+ * @returns {Object|null}
+ */
+function pickUserMatch(items, value) {
+  const trimmed = String(value || '').trim();
+  if (!trimmed) {
+    return null;
+  }
+  const lower = trimmed.toLowerCase();
+  return (
+    items.find(
+      (user) =>
+        String(user.email || '').toLowerCase() === lower || String(user.username || '') === trimmed
+    ) || null
+  );
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {string} idOrEmail
+ * @returns {Promise<Object|null>}
+ */
+async function lookupUserByIdOrEmail(controllerUrl, authConfig, idOrEmail) {
+  const value = String(idOrEmail || '').trim();
+  if (!value) {
+    return null;
+  }
+
+  if (isLikelyUuid(value)) {
+    const byId = await getUser(controllerUrl, authConfig, value);
+    if (byId && byId.success !== false) {
+      const row = unwrapControllerData(byId);
+      if (row?.id) {
+        return row;
+      }
+    }
+    return null;
+  }
+
+  if (value.includes('@')) {
+    const byEmailFilter = await listUsers(controllerUrl, authConfig, {
+      filter: `email:eq:${value}`,
+      pageSize: 1,
+      page: 1
+    });
+    throwIfApiFailed(byEmailFilter);
+    const filterMatch = pickUserMatch(extractUserListItems(byEmailFilter), value);
+    if (filterMatch?.id) {
+      return filterMatch;
+    }
+  }
+
+  const listed = await listUsers(controllerUrl, authConfig, {
+    search: value,
+    pageSize: 50,
+    page: 1
+  });
+  throwIfApiFailed(listed);
+  return pickUserMatch(extractUserListItems(listed), value);
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {string} idOrEmail
+ * @returns {Promise<string>} Controller user id
+ * @throws {Error} When value is empty or no matching user exists
+ */
+async function resolveUserIdOrEmail(controllerUrl, authConfig, idOrEmail) {
+  const value = String(idOrEmail || '').trim();
+  if (!value) {
+    throw new Error('idOrEmail is required.');
+  }
+
+  const user = await lookupUserByIdOrEmail(controllerUrl, authConfig, value);
+  if (user?.id) {
+    return user.id;
+  }
+
+  throw new Error(`User not found: ${value}`);
+}
+
+module.exports = {
+  isLikelyUuid,
+  extractUserListItems,
+  lookupUserByIdOrEmail,
+  resolveUserIdOrEmail
+};

package/lib/identity/username-default.js

@@ -0,0 +1,31 @@
+/**
+ * Default controller username when callers omit --username.
+ * Matches users.csv UserPrincipalName (email) convention.
+ *
+ * @fileoverview Identity username resolution
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {{ username?: string, email?: string }} input
+ * @returns {string}
+ * @throws {Error} When neither username nor email is non-empty
+ */
+function resolveIdentityUsername(input) {
+  const username = String(input?.username || '').trim();
+  if (username) {
+    return username;
+  }
+  const email = String(input?.email || '').trim();
+  if (email) {
+    return email;
+  }
+  throw new Error('username or email is required');
+}
+
+module.exports = {
+  resolveIdentityUsername
+};

package/lib/lifecycle/certification-progress.js

@@ -49,7 +49,7 @@ const SILVER_TO_GOLD_CRITERIA = [
   {
     id: 'aiTrust',
     label: 'AI Trust ≥ 95%',
-    evaluate: ctx => (ctx.report.trust?.businessContextConfidencePercent ?? 0) >= 95
+    evaluate: ctx => (ctx.report.trust?.aiTrustPercent ?? 0) >= 95
   },
   {
     id: 'activeWarnings',
@@ -164,7 +164,7 @@ function buildCertificationProgress(report, options = {}) {
  */
 function formatCriterionCurrentHint(id, report, openApiPublished) {
   if (id === 'aiTrust') {
-    const p = report.trust?.businessContextConfidencePercent;
+    const p = report.trust?.aiTrustPercent;
     return typeof p === 'number' ? `(current: ${p}%)` : null;
   }
   if (id === 'operationalReadiness') {

package/lib/lifecycle/report-display-trust.js

@@ -0,0 +1,70 @@
+/**
+ * @fileoverview Trust pillar TTY display helpers for verify-trust (433.0).
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { successGlyph, failureGlyph } = require('../utils/cli-test-layout-chalk');
+const { VERDICT } = require('./product-model');
+
+const SEP = '────────────────────────';
+
+/**
+ * @param {string} label
+ * @param {number|undefined} percent
+ */
+function displaySubMetricLine(label, percent) {
+  logger.log(chalk.white(label));
+  logger.log(
+    typeof percent === 'number'
+      ? chalk.cyan.bold(`${percent}%`)
+      : chalk.gray('—')
+  );
+  logger.log('');
+}
+
+/**
+ * @param {Array<{ severity?: string, code?: string, message?: string }>|undefined} findings
+ */
+function displayTrustFindings(findings) {
+  if (!Array.isArray(findings) || findings.length === 0) {
+    return;
+  }
+  logger.log('');
+  logger.log(chalk.white('Findings'));
+  logger.log(chalk.gray(SEP));
+  for (const finding of findings) {
+    const glyph =
+      finding.severity === 'error'
+        ? failureGlyph()
+        : finding.severity === 'warning'
+          ? chalk.yellow('⚠')
+          : successGlyph();
+    const msg = finding.message || finding.code || '';
+    logger.log(`  ${glyph} ${msg}`);
+  }
+}
+
+/**
+ * @param {Array<{ datasourceKey?: string, verdict?: string, trustDecision?: string }>|undefined} datasourceRows
+ */
+function displayTrustDatasourceRows(datasourceRows) {
+  if (!Array.isArray(datasourceRows) || datasourceRows.length === 0) {
+    return;
+  }
+  logger.log('');
+  logger.log(chalk.white('Datasources'));
+  logger.log(chalk.gray(SEP));
+  for (const row of datasourceRows) {
+    const glyph = row.verdict === VERDICT.VERIFIED ? successGlyph() : failureGlyph();
+    logger.log(`  ${row.datasourceKey}`.padEnd(36) + `${glyph} ${row.trustDecision || '—'}`);
+  }
+}
+
+module.exports = {
+  displaySubMetricLine,
+  displayTrustFindings,
+  displayTrustDatasourceRows
+};

package/lib/lifecycle/report-display.js

@@ -34,6 +34,11 @@ const {
   resolveNextStepCommand,
   formatProgressBar
 } = require('./certification-progress');
+const {
+  displaySubMetricLine,
+  displayTrustFindings,
+  displayTrustDatasourceRows
+} = require('./report-display-trust');
 
 const SEP = '────────────────────────';
 
@@ -158,19 +163,15 @@ function displayVerifyOperationsTTY(systemKey, result, opts = {}) {
  * @param {{ details?: boolean }} opts
  */
 function displayVerifyTrustTTY(systemKey, result, opts = {}) {
-  displayPillarHeader(systemKey, 'AI TRUST');
-  displayHeroMetric('AI Business Context Confidence', result.businessContextConfidencePercent);
+  displayPillarHeader(systemKey, 'AI TRUST REPORT');
+  displayHeroMetric('Overall', result.aiTrustPercent);
+  logger.log('');
+  displaySubMetricLine('Access Confidence', result.accessConfidencePercent);
+  displaySubMetricLine('Business Confidence', result.businessConfidencePercent);
   displayVerdictLine(result.verdict, 'AI TRUST VERIFIED', 'AI TRUST FAILED');
-  if (opts.details === true && Array.isArray(result.datasourceRows)) {
-    logger.log('');
-    logger.log(chalk.white('Datasources'));
-    logger.log(chalk.gray(SEP));
-    for (const row of result.datasourceRows) {
-      const conf =
-        typeof row.confidencePercent === 'number' ? `${row.confidencePercent}%` : '—';
-      const glyph = row.verdict === VERDICT.VERIFIED ? successGlyph() : failureGlyph();
-      logger.log(`  ${row.datasourceKey}`.padEnd(36) + `${glyph} ${conf}`);
-    }
+  displayTrustFindings(result.findings);
+  if (opts.details === true) {
+    displayTrustDatasourceRows(result.datasourceRows);
   }
 }
 
@@ -267,7 +268,7 @@ function displayPillarScores(report) {
   logger.log(
     formatPillarScoreLine(
       'AI Trust',
-      report.trust?.businessContextConfidencePercent,
+      report.trust?.aiTrustPercent,
       report.trust?.verdict
     )
   );

package/lib/resolvers/datasource-resolver.js

@@ -10,7 +10,7 @@
 
 'use strict';
 
-const fs = require('fs');
+const { loadConfigFile } = require('../utils/config-format');
 const { resolveValidateInputPath, resolvePathFromIntegrationDatasourceKey } = require('../datasource/validate');
 
 /**
@@ -41,8 +41,7 @@ function tryResolveDatasourceKeyToLocalPath(datasourceKey) {
  * @returns {any}
  */
 function readJsonFile(jsonPath) {
-  const raw = fs.readFileSync(jsonPath, 'utf8');
-  return JSON.parse(raw);
+  return loadConfigFile(jsonPath);
 }
 
 module.exports = {