@aifabrix/builder 2.46.0 → 2.47.1

package/lib/identity/resolve-user-id.js

@@ -0,0 +1,129 @@
+/**
+ * @fileoverview Resolve controller user id from id, email, or username
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { getUser, listUsers } = require('../api/users.api');
+const { throwIfApiFailed, unwrapControllerData } = require('./identity-response-helpers');
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/**
+ * @param {string} value
+ * @returns {boolean}
+ */
+function isLikelyUuid(value) {
+  return UUID_RE.test(String(value || '').trim());
+}
+
+/**
+ * @param {Object} response
+ * @returns {Object[]}
+ */
+function extractUserListItems(response) {
+  const data = unwrapControllerData(response);
+  if (Array.isArray(data)) {
+    return data;
+  }
+  if (Array.isArray(data?.data)) {
+    return data.data;
+  }
+  return [];
+}
+
+/**
+ * @param {Object[]} items
+ * @param {string} value
+ * @returns {Object|null}
+ */
+function pickUserMatch(items, value) {
+  const trimmed = String(value || '').trim();
+  if (!trimmed) {
+    return null;
+  }
+  const lower = trimmed.toLowerCase();
+  return (
+    items.find(
+      (user) =>
+        String(user.email || '').toLowerCase() === lower || String(user.username || '') === trimmed
+    ) || null
+  );
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {string} idOrEmail
+ * @returns {Promise<Object|null>}
+ */
+async function lookupUserByIdOrEmail(controllerUrl, authConfig, idOrEmail) {
+  const value = String(idOrEmail || '').trim();
+  if (!value) {
+    return null;
+  }
+
+  if (isLikelyUuid(value)) {
+    const byId = await getUser(controllerUrl, authConfig, value);
+    if (byId && byId.success !== false) {
+      const row = unwrapControllerData(byId);
+      if (row?.id) {
+        return row;
+      }
+    }
+    return null;
+  }
+
+  if (value.includes('@')) {
+    const byEmailFilter = await listUsers(controllerUrl, authConfig, {
+      filter: `email:eq:${value}`,
+      pageSize: 1,
+      page: 1
+    });
+    throwIfApiFailed(byEmailFilter);
+    const filterMatch = pickUserMatch(extractUserListItems(byEmailFilter), value);
+    if (filterMatch?.id) {
+      return filterMatch;
+    }
+  }
+
+  const listed = await listUsers(controllerUrl, authConfig, {
+    search: value,
+    pageSize: 50,
+    page: 1
+  });
+  throwIfApiFailed(listed);
+  return pickUserMatch(extractUserListItems(listed), value);
+}
+
+/**
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {string} idOrEmail
+ * @returns {Promise<string>} Controller user id
+ * @throws {Error} When value is empty or no matching user exists
+ */
+async function resolveUserIdOrEmail(controllerUrl, authConfig, idOrEmail) {
+  const value = String(idOrEmail || '').trim();
+  if (!value) {
+    throw new Error('idOrEmail is required.');
+  }
+
+  const user = await lookupUserByIdOrEmail(controllerUrl, authConfig, value);
+  if (user?.id) {
+    return user.id;
+  }
+
+  throw new Error(`User not found: ${value}`);
+}
+
+module.exports = {
+  isLikelyUuid,
+  extractUserListItems,
+  lookupUserByIdOrEmail,
+  resolveUserIdOrEmail
+};

package/lib/identity/username-default.js

@@ -0,0 +1,31 @@
+/**
+ * Default controller username when callers omit --username.
+ * Matches users.csv UserPrincipalName (email) convention.
+ *
+ * @fileoverview Identity username resolution
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {{ username?: string, email?: string }} input
+ * @returns {string}
+ * @throws {Error} When neither username nor email is non-empty
+ */
+function resolveIdentityUsername(input) {
+  const username = String(input?.username || '').trim();
+  if (username) {
+    return username;
+  }
+  const email = String(input?.email || '').trim();
+  if (email) {
+    return email;
+  }
+  throw new Error('username or email is required');
+}
+
+module.exports = {
+  resolveIdentityUsername
+};

package/lib/lifecycle/certification-progress.js

@@ -49,7 +49,7 @@ const SILVER_TO_GOLD_CRITERIA = [
   {
     id: 'aiTrust',
     label: 'AI Trust ≥ 95%',
-    evaluate: ctx => (ctx.report.trust?.businessContextConfidencePercent ?? 0) >= 95
+    evaluate: ctx => (ctx.report.trust?.aiTrustPercent ?? 0) >= 95
   },
   {
     id: 'activeWarnings',
@@ -164,7 +164,7 @@ function buildCertificationProgress(report, options = {}) {
  */
 function formatCriterionCurrentHint(id, report, openApiPublished) {
   if (id === 'aiTrust') {
-    const p = report.trust?.businessContextConfidencePercent;
+    const p = report.trust?.aiTrustPercent;
     return typeof p === 'number' ? `(current: ${p}%)` : null;
   }
   if (id === 'operationalReadiness') {

package/lib/lifecycle/report-display-trust.js

@@ -0,0 +1,70 @@
+/**
+ * @fileoverview Trust pillar TTY display helpers for verify-trust (433.0).
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { successGlyph, failureGlyph } = require('../utils/cli-test-layout-chalk');
+const { VERDICT } = require('./product-model');
+
+const SEP = '────────────────────────';
+
+/**
+ * @param {string} label
+ * @param {number|undefined} percent
+ */
+function displaySubMetricLine(label, percent) {
+  logger.log(chalk.white(label));
+  logger.log(
+    typeof percent === 'number'
+      ? chalk.cyan.bold(`${percent}%`)
+      : chalk.gray('—')
+  );
+  logger.log('');
+}
+
+/**
+ * @param {Array<{ severity?: string, code?: string, message?: string }>|undefined} findings
+ */
+function displayTrustFindings(findings) {
+  if (!Array.isArray(findings) || findings.length === 0) {
+    return;
+  }
+  logger.log('');
+  logger.log(chalk.white('Findings'));
+  logger.log(chalk.gray(SEP));
+  for (const finding of findings) {
+    const glyph =
+      finding.severity === 'error'
+        ? failureGlyph()
+        : finding.severity === 'warning'
+          ? chalk.yellow('⚠')
+          : successGlyph();
+    const msg = finding.message || finding.code || '';
+    logger.log(`  ${glyph} ${msg}`);
+  }
+}
+
+/**
+ * @param {Array<{ datasourceKey?: string, verdict?: string, trustDecision?: string }>|undefined} datasourceRows
+ */
+function displayTrustDatasourceRows(datasourceRows) {
+  if (!Array.isArray(datasourceRows) || datasourceRows.length === 0) {
+    return;
+  }
+  logger.log('');
+  logger.log(chalk.white('Datasources'));
+  logger.log(chalk.gray(SEP));
+  for (const row of datasourceRows) {
+    const glyph = row.verdict === VERDICT.VERIFIED ? successGlyph() : failureGlyph();
+    logger.log(`  ${row.datasourceKey}`.padEnd(36) + `${glyph} ${row.trustDecision || '—'}`);
+  }
+}
+
+module.exports = {
+  displaySubMetricLine,
+  displayTrustFindings,
+  displayTrustDatasourceRows
+};

package/lib/lifecycle/report-display.js

@@ -34,6 +34,11 @@ const {
   resolveNextStepCommand,
   formatProgressBar
 } = require('./certification-progress');
+const {
+  displaySubMetricLine,
+  displayTrustFindings,
+  displayTrustDatasourceRows
+} = require('./report-display-trust');
 
 const SEP = '────────────────────────';
 
@@ -158,19 +163,15 @@ function displayVerifyOperationsTTY(systemKey, result, opts = {}) {
  * @param {{ details?: boolean }} opts
  */
 function displayVerifyTrustTTY(systemKey, result, opts = {}) {
-  displayPillarHeader(systemKey, 'AI TRUST');
-  displayHeroMetric('AI Business Context Confidence', result.businessContextConfidencePercent);
+  displayPillarHeader(systemKey, 'AI TRUST REPORT');
+  displayHeroMetric('Overall', result.aiTrustPercent);
+  logger.log('');
+  displaySubMetricLine('Access Confidence', result.accessConfidencePercent);
+  displaySubMetricLine('Business Confidence', result.businessConfidencePercent);
   displayVerdictLine(result.verdict, 'AI TRUST VERIFIED', 'AI TRUST FAILED');
-  if (opts.details === true && Array.isArray(result.datasourceRows)) {
-    logger.log('');
-    logger.log(chalk.white('Datasources'));
-    logger.log(chalk.gray(SEP));
-    for (const row of result.datasourceRows) {
-      const conf =
-        typeof row.confidencePercent === 'number' ? `${row.confidencePercent}%` : '—';
-      const glyph = row.verdict === VERDICT.VERIFIED ? successGlyph() : failureGlyph();
-      logger.log(`  ${row.datasourceKey}`.padEnd(36) + `${glyph} ${conf}`);
-    }
+  displayTrustFindings(result.findings);
+  if (opts.details === true) {
+    displayTrustDatasourceRows(result.datasourceRows);
   }
 }
 
@@ -267,7 +268,7 @@ function displayPillarScores(report) {
   logger.log(
     formatPillarScoreLine(
       'AI Trust',
-      report.trust?.businessContextConfidencePercent,
+      report.trust?.aiTrustPercent,
       report.trust?.verdict
     )
   );

package/lib/resolvers/datasource-resolver.js

@@ -10,7 +10,7 @@
 
 'use strict';
 
-const fs = require('fs');
+const { loadConfigFile } = require('../utils/config-format');
 const { resolveValidateInputPath, resolvePathFromIntegrationDatasourceKey } = require('../datasource/validate');
 
 /**
@@ -41,8 +41,7 @@ function tryResolveDatasourceKeyToLocalPath(datasourceKey) {
  * @returns {any}
  */
 function readJsonFile(jsonPath) {
-  const raw = fs.readFileSync(jsonPath, 'utf8');
-  return JSON.parse(raw);
+  return loadConfigFile(jsonPath);
 }
 
 module.exports = {

package/lib/resolvers/resource-type-file.js

@@ -0,0 +1,159 @@
+/**
+ * Resource type file helpers for `aifabrix resource-type create --file`.
+ *
+ * @fileoverview Resource type file parsing
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const { existsSync, readFileSync } = require('../internal/fs-real-sync');
+
+/**
+ * @typedef {Object} ResourceTypeCreateInput
+ * @property {string} key
+ * @property {string} displayName
+ * @property {string} [description]
+ * @property {string} [category]
+ * @property {string} [defaultRiskLevel]
+ * @property {string} [status]
+ */
+
+const CATEGORIES = new Set([
+  'business',
+  'collaboration',
+  'governance',
+  'content',
+  'communication',
+  'people'
+]);
+
+const RISK_LEVELS = new Set(['low', 'medium', 'high', 'critical']);
+const STATUSES = new Set(['draft', 'active', 'deprecated', 'retired']);
+
+/**
+ * @param {string} filePath
+ * @returns {object}
+ */
+function loadResourceTypeJsonObject(filePath) {
+  const p = path.resolve(String(filePath || '').trim());
+  if (!p) {
+    throw new Error('--file is required');
+  }
+  if (!existsSync(p)) {
+    throw new Error(`File not found: ${p}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(p, 'utf8'));
+  } catch (e) {
+    throw new Error(`Invalid JSON in ${p}: ${e.message}`);
+  }
+  if (!parsed || typeof parsed !== 'object') {
+    throw new Error(`Resource type file must be a JSON object: ${p}`);
+  }
+  return parsed;
+}
+
+/**
+ * @param {object} parsed
+ * @param {string} field
+ * @param {Set<string>} allowedValues
+ * @param {string} label
+ * @returns {void}
+ */
+function applyOptionalEnumField(parsed, field, allowedValues, label) {
+  if (parsed[field] === undefined) {
+    return;
+  }
+  const value = String(parsed[field]).trim();
+  if (!allowedValues.has(value)) {
+    throw new Error(`${label} must be one of: ${[...allowedValues].join(', ')}`);
+  }
+  parsed[field] = value;
+}
+
+/**
+ * @param {object} parsed
+ * @returns {void}
+ */
+function rejectBaselineCatalogShape(parsed) {
+  if (parsed && typeof parsed === 'object' && Array.isArray(parsed.resourceTypes) && !parsed.key) {
+    throw new Error(
+      'File is a baseline catalog (resourceTypes[]). ' +
+        'Use `aifabrix resource-type import --file <path>` to seed all entries, ' +
+        'or pass a single resource type object with key and displayName.'
+    );
+  }
+}
+
+/**
+ * @param {object} row
+ * @param {number} index
+ * @returns {ResourceTypeCreateInput}
+ */
+function normalizeResourceTypeCreateRow(row, index) {
+  if (!row || typeof row !== 'object') {
+    throw new Error(`resourceTypes[${index}] must be a JSON object`);
+  }
+  const entry = { ...row };
+  applyOptionalEnumField(entry, 'category', CATEGORIES, 'category');
+  applyOptionalEnumField(entry, 'defaultRiskLevel', RISK_LEVELS, 'defaultRiskLevel');
+  applyOptionalEnumField(entry, 'status', STATUSES, 'status');
+  const key = String(entry.key || '').trim();
+  if (!key) {
+    throw new Error(`resourceTypes[${index}].key is required`);
+  }
+  const displayName = String(entry.displayName || '').trim();
+  if (!displayName) {
+    throw new Error(`resourceTypes[${index}].displayName is required`);
+  }
+  entry.key = key;
+  entry.displayName = displayName;
+  return entry;
+}
+
+/**
+ * @param {string} filePath
+ * @returns {ResourceTypeCreateInput}
+ */
+function readResourceTypeCreateFile(filePath) {
+  const parsed = loadResourceTypeJsonObject(filePath);
+  rejectBaselineCatalogShape(parsed);
+  return normalizeResourceTypeCreateRow(parsed, 0);
+}
+
+/**
+ * Read baseline catalog or array file for `resource-type import`.
+ * Accepts `baseline-resourcetypes.json` shape or a top-level JSON array.
+ *
+ * @param {string} filePath
+ * @returns {ResourceTypeCreateInput[]}
+ */
+function readResourceTypeCatalogFile(filePath) {
+  const parsed = loadResourceTypeJsonObject(filePath);
+  let rows;
+  if (Array.isArray(parsed)) {
+    rows = parsed;
+  } else if (Array.isArray(parsed.resourceTypes)) {
+    rows = parsed.resourceTypes;
+  } else {
+    throw new Error(
+      'Import file must be a baseline catalog with resourceTypes[] or a JSON array of resource types.'
+    );
+  }
+  if (rows.length === 0) {
+    throw new Error('Import file contains no resource types');
+  }
+  return rows.map((row, index) => normalizeResourceTypeCreateRow(row, index));
+}
+
+module.exports = {
+  readResourceTypeCreateFile,
+  readResourceTypeCatalogFile,
+  CATEGORIES,
+  RISK_LEVELS,
+  STATUSES
+};

package/lib/schema/application-schema.json

@@ -801,6 +801,22 @@
           "type": "string",
           "description": "When running with --reload, override the container command with this command (run from the mounted app root /app). Examples: TypeScript pnpm run reloadStart, Python make reloadStart."
         },
+        "imageRun": {
+          "type": "string",
+          "description": "Compose command when using a pulled image without bind-mount (prepended with cd /app && exec in generated compose)."
+        },
+        "worker": {
+          "type": "boolean",
+          "description": "When true, local compose and Azure companion manifests may start additional containers from the same image. Non-empty build.imageRunWorker starts <appKey>-worker; non-empty build.imageRunBeat starts <appKey>-beat. Empty imageRunWorker or imageRunBeat skips that role."
+        },
+        "imageRunWorker": {
+          "type": "string",
+          "description": "Compose/Azure startup command for the worker sidecar (<appKey>-worker) when build.worker is true. Omit or set to empty string to skip the worker role."
+        },
+        "imageRunBeat": {
+          "type": "string",
+          "description": "Compose/Azure startup command for the beat sidecar (<appKey>-beat) when build.worker is true. Omit or set to empty string to skip the beat role."
+        },
         "scripts": {
           "type": "object",
           "description": "Override CLI script commands (aifabrix test, install, lint, test-e2e, test-integration). When a key is missing, language default is used (TypeScript: pnpm test/install/lint/test:e2e/test:integration, Python: make test/install/lint/test:e2e/test-integration).",

package/lib/schema/deployment-rules.yaml

@@ -120,9 +120,10 @@ externalDataSource:
       - validation
       - quality
       - indexing
-      - context
       - documentStorage
       - capabilities
+      - authority
+      - foreignKeys
       - execution
       - config
       - openapi