@aifabrix/builder 2.46.0 → 2.47.0

package/lib/commands/repair-datasource-service-contract.js

@@ -0,0 +1,206 @@
+/**
+ * serviceContract repair helpers — migrate deprecated none+llm manifests (439.1).
+ *
+ * @fileoverview repair-datasource-service-contract
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const LLM_CANONICAL_METADATA_SCHEMA = {
+  type: 'object',
+  properties: {
+    successContent: { type: 'string', nullable: true },
+    successEmbedding: {
+      type: 'array',
+      items: { type: 'number' },
+      nullable: true
+    },
+    successRole: { type: 'string', nullable: true },
+    successModel: { type: 'string', nullable: true },
+    successFinishReason: { type: 'string', nullable: true },
+    errorCode: { type: 'string', nullable: true },
+    errorMessage: { type: 'string', nullable: true },
+    errorType: { type: 'string', nullable: true },
+    usagePromptTokens: { type: 'integer', nullable: true },
+    usageCompletionTokens: { type: 'integer', nullable: true },
+    usageTotalTokens: { type: 'integer', nullable: true },
+    metadataProvider: { type: 'string', nullable: true },
+    metadataOperation: { type: 'string', nullable: true }
+  }
+};
+
+const LLM_CANONICAL_EXPOSED_SCHEMA = {
+  success: {
+    content: 'metadata.successContent',
+    embedding: 'metadata.successEmbedding',
+    role: 'metadata.successRole',
+    model: 'metadata.successModel',
+    finishReason: 'metadata.successFinishReason'
+  },
+  error: {
+    code: 'metadata.errorCode',
+    message: 'metadata.errorMessage',
+    type: 'metadata.errorType'
+  },
+  usage: {
+    promptTokens: 'metadata.usagePromptTokens',
+    completionTokens: 'metadata.usageCompletionTokens',
+    totalTokens: 'metadata.usageTotalTokens'
+  },
+  metadata: {
+    provider: 'metadata.metadataProvider',
+    operation: 'metadata.metadataOperation'
+  }
+};
+
+const LLM_STUB_FIELD_MAPPINGS = {
+  successContent: { expression: '{{raw}}' },
+  metadataProvider: { expression: '{{inline.metadataProvider}}' },
+  metadataOperation: { expression: '{{inline.metadataOperation}}' }
+};
+
+/**
+ * @param {Object} parsed - Parsed datasource manifest
+ * @returns {boolean}
+ */
+function isDeprecatedNoneLlmManifest(parsed) {
+  return parsed?.entityType === 'none' && parsed?.resourceType === 'llm';
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function stripStorageKeysForServiceContract(parsed, changes) {
+  let updated = false;
+  for (const key of ['primaryKey', 'labelKey', 'sync']) {
+    if (parsed[key] !== undefined) {
+      delete parsed[key];
+      changes.push(`Removed ${key} (not allowed on serviceContract)`);
+      updated = true;
+    }
+  }
+  return updated;
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string} systemKey
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function ensureLlmCipMapSteps(parsed, systemKey, changes) {
+  const operations = parsed?.execution?.cip?.operations;
+  if (!operations || typeof operations !== 'object') return false;
+  let updated = false;
+  for (const opKey of ['call', 'embed']) {
+    const op = operations[opKey];
+    if (!op || !Array.isArray(op.steps)) continue;
+    if (op.steps.some((step) => step && step.map)) continue;
+    const fetchIdx = op.steps.findIndex((step) => step && step.fetch);
+    if (fetchIdx < 0) continue;
+    const mapStep = {
+      map: {
+        useFieldMappings: true,
+        inputPath: '$',
+        inline: {
+          metadataProvider: systemKey || parsed.systemKey || 'provider',
+          metadataOperation: opKey
+        }
+      }
+    };
+    op.steps.splice(fetchIdx + 1, 0, mapStep);
+    if (!op.steps.some((step) => step && step.output)) {
+      op.steps.push({ output: { mode: 'records' } });
+    }
+    changes.push(`Inserted map+output steps for CIP operation "${opKey}"`);
+    updated = true;
+  }
+  return updated;
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function stripDeprecatedServiceCategory(parsed, changes) {
+  if (parsed?.serviceCategory === undefined) return false;
+  delete parsed.serviceCategory;
+  changes.push('Removed deprecated serviceCategory (use resourceType for classification)');
+  return true;
+}
+
+/**
+ * @param {*} value
+ * @returns {*}
+ */
+function deepClone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function applyCanonicalLlmSchemaStubs(parsed, changes) {
+  parsed.entityType = 'serviceContract';
+  changes.push('Migrated entityType none → serviceContract');
+
+  parsed.metadataSchema = deepClone(LLM_CANONICAL_METADATA_SCHEMA);
+  changes.push('Set canonical LLM metadataSchema stub');
+
+  if (!parsed.exposed) parsed.exposed = {};
+  parsed.exposed.schema = deepClone(LLM_CANONICAL_EXPOSED_SCHEMA);
+  if (parsed.exposed.attributes !== undefined) {
+    delete parsed.exposed.attributes;
+  }
+  changes.push('Set canonical LLM exposed.schema envelope');
+  return true;
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function applyStubFieldMappingsIfMissing(parsed, changes) {
+  const attrs = parsed.fieldMappings?.attributes;
+  if (attrs && typeof attrs === 'object' && Object.keys(attrs).length > 0) {
+    return false;
+  }
+  if (!parsed.fieldMappings) parsed.fieldMappings = {};
+  parsed.fieldMappings.attributes = deepClone(LLM_STUB_FIELD_MAPPINGS);
+  changes.push(
+    'Added stub fieldMappings.attributes — customize provider raw.* expressions'
+  );
+  return true;
+}
+
+/**
+ * Migrate deprecated none+llm manifest to serviceContract canonical stub.
+ *
+ * @param {Object} parsed - Parsed datasource (mutated)
+ * @param {string[]} changes - Change log
+ * @returns {boolean}
+ */
+function repairNoneLlmToServiceContract(parsed, changes) {
+  if (!isDeprecatedNoneLlmManifest(parsed)) return false;
+  let updated = applyCanonicalLlmSchemaStubs(parsed, changes);
+  updated = applyStubFieldMappingsIfMissing(parsed, changes) || updated;
+  updated = stripStorageKeysForServiceContract(parsed, changes) || updated;
+  updated = ensureLlmCipMapSteps(parsed, parsed.systemKey, changes) || updated;
+  return updated;
+}
+
+module.exports = {
+  LLM_CANONICAL_METADATA_SCHEMA,
+  LLM_CANONICAL_EXPOSED_SCHEMA,
+  isDeprecatedNoneLlmManifest,
+  stripDeprecatedServiceCategory,
+  repairNoneLlmToServiceContract
+};

package/lib/commands/repair-datasource.js

@@ -12,6 +12,12 @@
 const { repairOpenapiSection } = require('./repair-datasource-openapi');
 const { normalizeAutoRbacOperationKeys } = require('./repair-datasource-auto-rbac');
 const { repairTestPayload } = require('./repair-datasource-test-payload');
+const { repairComV2Manifest } = require('./repair-datasource-com-v2');
+const {
+  isDeprecatedNoneLlmManifest,
+  repairNoneLlmToServiceContract,
+  stripDeprecatedServiceCategory
+} = require('./repair-datasource-service-contract');
 
 const DEFAULT_SYNC = {
   mode: 'pull',
@@ -380,6 +386,41 @@ function sanitizeTestPayloadTopLevel(parsed, changes) {
   return true;
 }
 
+/**
+ * @param {Object} parsed
+ * @param {Object} options
+ * @returns {boolean}
+ */
+function shouldApplyServiceContractRepair(parsed, options) {
+  return (
+    isDeprecatedNoneLlmManifest(parsed) ||
+    (options.serviceContract && parsed?.resourceType === 'llm')
+  );
+}
+
+/**
+ * @param {Object} parsed
+ * @param {Object} options
+ * @param {boolean} none
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function applyOptionalDatasourceRepairs(parsed, options, none, changes) {
+  let updated = false;
+  if (options.expose) {
+    updated = repairExposeFromAttributes(parsed, changes) || updated;
+  }
+  if (!none && options.sync) {
+    updated = repairSyncSection(parsed, changes) || updated;
+  }
+  if (options.test) {
+    sanitizeTestPayloadTopLevel(parsed, changes);
+    updated = repairTestPayload(parsed, changes) || updated;
+    updated = sanitizeTestPayloadTopLevel(parsed, changes) || updated;
+  }
+  return updated;
+}
+
 /**
  * Runs all requested datasource repairs.
  *
@@ -390,32 +431,24 @@ function sanitizeTestPayloadTopLevel(parsed, changes) {
  */
 function repairDatasourceFile(parsed, options = {}, changes = []) {
   const out = Array.isArray(changes) ? changes : [];
-  let updated = false;
-  const none = isNoneEntityType(parsed?.entityType);
+  let updated = stripDeprecatedServiceCategory(parsed, out);
 
-  updated = applyBaseDatasourceRepairs(parsed, none, out) || updated;
-  updated = applyOpenapiDatasourceRepairs(parsed, out) || updated;
-
-  if (options.expose) {
-    updated = repairExposeFromAttributes(parsed, out) || updated;
+  if (shouldApplyServiceContractRepair(parsed, options)) {
+    updated = repairNoneLlmToServiceContract(parsed, out) || updated;
   }
 
-  if (!none && options.sync) {
-    updated = repairSyncSection(parsed, out) || updated;
-  }
+  const none = isNoneEntityType(parsed?.entityType);
 
-  if (options.test) {
-    sanitizeTestPayloadTopLevel(parsed, out);
-    updated = repairTestPayload(parsed, out) || updated;
-    updated = sanitizeTestPayloadTopLevel(parsed, out) || updated;
-  }
+  updated = applyBaseDatasourceRepairs(parsed, none, out) || updated;
+  updated = applyOpenapiDatasourceRepairs(parsed, out) || updated;
+  updated = applyOptionalDatasourceRepairs(parsed, options, none, out) || updated;
 
   return { updated, changes: out };
 }
 
 function applyBaseDatasourceRepairs(parsed, none, changes) {
-  if (none) return false;
-  let updated = false;
+  let updated = repairComV2Manifest(parsed, changes);
+  if (none) return updated;
   updated = repairDimensionBindingShape(parsed, changes) || updated;
   updated = repairRootDimensionsFromAttributes(parsed, changes) || updated;
   updated = repairMetadataSchemaFromAttributes(parsed, changes) || updated;
@@ -444,5 +477,7 @@ module.exports = {
   DEFAULT_SYNC,
   MINIMAL_METADATA_SCHEMA,
   TEST_PAYLOAD_TOP_LEVEL_ALLOW,
-  isNoneEntityType
+  isNoneEntityType,
+  isDeprecatedNoneLlmManifest,
+  repairNoneLlmToServiceContract
 };

package/lib/commands/repair-env-template.js

@@ -77,9 +77,16 @@ function addFromConfiguration(effective, config, prefix, seenNames, systemKey) {
  * @param {string} systemKey - System key for path namespace
  */
 function addFromAuthSecurity(effective, systemParsed, prefix, seenNames, systemKey) {
-  const security = systemParsed.authentication?.security;
+  const { getAuthCredentialTemplate } = require('../utils/authentication-shape');
+  const { isPlatformCatalogKvRef } = require('../utils/platform-kv-ref');
+  const credential = getAuthCredentialTemplate(systemParsed.authentication);
+  const security = credential?.security ?? systemParsed.authentication?.security;
   if (!security || typeof security !== 'object') return;
   for (const key of Object.keys(security)) {
+    const securityVal = security[key];
+    if (typeof securityVal === 'string' && isPlatformCatalogKvRef(securityVal)) {
+      continue;
+    }
     const envName = `KV_${prefix}_${securityKeyToVar(key)}`;
     if (seenNames.has(envName)) continue;
     const pathVal = kvEnvKeyToPath(envName, systemKey);
@@ -316,16 +323,7 @@ function repairEnvTemplate(appPath, systemParsed, systemKey, dryRun, changes, ba
   return true;
 }
 
-/**
- * Returns true if a kv value looks like legacy format (KeyVault suffix or no path segments).
- * @param {string} val - Value from authentication.security or configuration
- * @returns {boolean}
- */
-function isLegacyKvValue(val) {
-  if (typeof val !== 'string' || !val.trim().toLowerCase().startsWith('kv://')) return false;
-  const after = val.trim().slice(5); // after 'kv://'
-  return after.includes('KeyVault') || !after.includes('/');
-}
+const { isLegacyKvValue } = require('../utils/platform-kv-ref');
 
 /**
  * Normalizes authentication.security values to path-style kv:// (kv://systemKey/variable).
@@ -392,7 +390,9 @@ function normalizeConfigurationSection(config, prefix, systemKey, changes) {
 function normalizeSystemFileAuthAndConfig(systemParsed, systemKey, changes) {
   const prefix = systemKeyToKvPrefix(systemKey);
   if (!prefix) return false;
-  const security = systemParsed.authentication?.security;
+  const { getAuthCredentialTemplate } = require('../utils/authentication-shape');
+  const credential = getAuthCredentialTemplate(systemParsed.authentication);
+  const security = credential?.security ?? systemParsed.authentication?.security;
   let updated = (security && typeof security === 'object' && normalizeSecuritySection(security, prefix, systemKey, changes));
   const config = systemParsed.configuration;
   if (Array.isArray(config)) {

package/lib/commands/repair-openapi-sync.js

@@ -15,10 +15,15 @@ const path = require('path');
 const fs = require('fs');
 
 const { resolveControllerUrl } = require('../utils/controller-url');
-const { getDeploymentAuth, requireBearerForDataplanePipeline } = require('../utils/token-manager');
+const {
+  getDeploymentAuth,
+  requireBearerForDataplanePipeline,
+  applyLabDataplaneApiKeyBearer
+} = require('../utils/token-manager');
 const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
 const { uploadFileAs } = require('../utils/file-upload');
 const { listOpenAPIFiles } = require('../api/external-systems.api');
+const { resolveLabDataplaneApiKey } = require('../utils/credential-secrets-env');
 
 async function fileExistsAsync(filePath) {
   try {
@@ -29,11 +34,25 @@ async function fileExistsAsync(filePath) {
   }
 }
 
-async function resolveDataplaneAndAuth(systemKey) {
+function authForJwtOnlyDataplaneRoutes(authConfig) {
+  const copy = { ...(authConfig || {}) };
+  if (copy.type === 'client-token' && resolveLabDataplaneApiKey()) {
+    return applyLabDataplaneApiKeyBearer(copy);
+  }
+  return copy;
+}
+
+async function resolveDataplaneAndAuth(systemKey, preResolved = {}) {
+  if (preResolved.dataplaneUrl && preResolved.authConfig) {
+    const authConfig = authForJwtOnlyDataplaneRoutes(preResolved.authConfig);
+    return { dataplaneUrl: preResolved.dataplaneUrl, authConfig };
+  }
   const { resolveEnvironment } = require('../core/config');
   const environment = await resolveEnvironment();
   const controllerUrl = await resolveControllerUrl();
-  const authConfig = await getDeploymentAuth(controllerUrl, environment, systemKey);
+  const authConfig = authForJwtOnlyDataplaneRoutes(
+    await getDeploymentAuth(controllerUrl, environment, systemKey)
+  );
   requireBearerForDataplanePipeline(authConfig);
   const dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig, { silent: true });
   return { dataplaneUrl, authConfig };
@@ -115,7 +134,10 @@ async function syncOpenApiFilesForMcp(opts) {
   const openapiDir = path.join(appPath, 'openapi');
   if (!(await fileExistsAsync(openapiDir))) return { uploaded: 0, skipped: 0 };
 
-  const { dataplaneUrl, authConfig } = await resolveDataplaneAndAuth(systemKey);
+  const { dataplaneUrl, authConfig } = await resolveDataplaneAndAuth(systemKey, {
+    dataplaneUrl: opts.dataplaneUrl,
+    authConfig: opts.authConfig
+  });
   const existingKeys = await getExistingOpenApiKeys(dataplaneUrl, systemKey, authConfig);
   const uploadedKeys = new Set(existingKeys);
   let uploaded = 0;

package/lib/commands/repair-steps.js

@@ -26,7 +26,9 @@ const {
   buildAuthenticationForRepair,
   mergePreservedAuthVariables,
   repairAuthChangeLabel,
-  auditRepairAuthenticationWarnings
+  auditRepairAuthenticationWarnings,
+  normalizeAuthenticationSchemaShape,
+  getAuthCredentialTemplate
 } = require('./repair-auth-apply');
 
 /**
@@ -45,19 +47,24 @@ function applyAuthMethod(ctx) {
   }
   const existingAuth = ctx.systemParsed.authentication || ctx.systemParsed.auth || {};
   const newAuth = buildAuthenticationForRepair(ctx.systemKey, authOption);
-  const existingVars =
-    existingAuth.variables && typeof existingAuth.variables === 'object'
-      ? existingAuth.variables
-      : {};
-  const mergedVariables = { ...newAuth.variables };
-  mergePreservedAuthVariables(mergedVariables, existingVars);
-  ctx.systemParsed.authentication = {
-    ...newAuth,
-    variables: mergedVariables
-  };
-  if (existingAuth.displayName !== undefined) {
-    ctx.systemParsed.authentication.displayName = existingAuth.displayName;
+  const existingCredential = getAuthCredentialTemplate(existingAuth) || {};
+  const mergedVariables = { ...(newAuth.credential?.variables || {}) };
+  mergePreservedAuthVariables(
+    mergedVariables,
+    existingCredential.variables && typeof existingCredential.variables === 'object'
+      ? existingCredential.variables
+      : existingAuth.variables
+  );
+  if (newAuth.authType === 'credential' && newAuth.credential) {
+    newAuth.credential.variables = mergedVariables;
+    if (existingCredential.displayName !== undefined) {
+      newAuth.credential.displayName = existingCredential.displayName;
+    } else if (existingAuth.displayName !== undefined) {
+      newAuth.credential.displayName = existingAuth.displayName;
+    }
   }
+  ctx.systemParsed.authentication = newAuth;
+  delete ctx.systemParsed.auth;
   ctx.changes.push(`Set authentication method to ${repairAuthChangeLabel(authOption)}`);
   return true;
 }
@@ -70,6 +77,7 @@ function applyAuthMethod(ctx) {
 function persistSystemFileRepair(ctx, flags) {
   const systemFileUpdated =
     flags.authReplaced ||
+    flags.authShapeNormalized ||
     flags.systemAuthConfigNormalized ||
     flags.systemDataSourcesAligned ||
     flags.authVarsRemoved;
@@ -95,6 +103,12 @@ function runRepairSteps(ctx) {
   );
   const authReplaced = applyAuthMethod(ctx);
   updated = updated || authReplaced;
+  const authShapeNormalized = normalizeAuthenticationSchemaShape(
+    ctx.systemParsed,
+    ctx.systemKey,
+    ctx.changes
+  );
+  updated = updated || authShapeNormalized;
   const systemAuthConfigNormalized = normalizeSystemFileAuthAndConfig(
     ctx.systemParsed, ctx.systemKey, ctx.changes
   );
@@ -106,6 +120,7 @@ function runRepairSteps(ctx) {
   );
   const systemFileUpdated = persistSystemFileRepair(ctx, {
     authReplaced,
+    authShapeNormalized,
     systemAuthConfigNormalized,
     systemDataSourcesAligned,
     authVarsRemoved

package/lib/commands/repair-system-alignment.js

@@ -177,13 +177,16 @@ function alignSystemFileDataSources(appPath, systemParsed, datasourceFiles, syst
 function buildAuthVarNames(systemParsed, _systemKey) {
   const names = new Set();
   const auth = systemParsed.authentication;
-  if (auth && typeof auth.variables === 'object') {
-    for (const k of Object.keys(auth.variables)) {
+  if (!auth || typeof auth !== 'object') return names;
+  const credential =
+    auth.credential && typeof auth.credential === 'object' ? auth.credential : auth;
+  if (typeof credential.variables === 'object') {
+    for (const k of Object.keys(credential.variables)) {
       names.add(String(k).toUpperCase().replace(/_/g, ''));
     }
   }
-  if (auth && typeof auth.security === 'object') {
-    for (const k of Object.keys(auth.security)) {
+  if (typeof credential.security === 'object') {
+    for (const k of Object.keys(credential.security)) {
       names.add(securityKeyToVar(k));
     }
   }