@aifabrix/builder 2.46.0 → 2.47.1

package/lib/schema/external-system.schema.json

@@ -7,12 +7,12 @@
       "key": "external-system-schema",
       "name": "External System Configuration Schema",
       "description": "JSON schema for validating ExternalSystem configuration files",
-      "version": "1.7.0",
+      "version": "1.9.0",
       "type": "schema",
       "category": "integration",
       "author": "AI Fabrix Team",
       "createdAt": "2024-01-01T00:00:00Z",
-      "updatedAt": "2026-05-20T00:00:00Z",
+      "updatedAt": "2026-06-15T00:00:00Z",
       "compatibility": {
          "minVersion": "1.4.0",
          "maxVersion": "2.0.0",
@@ -27,6 +27,23 @@
       ],
       "dependencies": [],
       "changelog": [
+         {
+            "version": "1.9.0",
+            "date": "2026-06-15T00:00:00Z",
+            "changes": [
+               "Added systemKind digitalWorker to x-systemKindCatalog (enterpriseContext group).",
+               "Extended subscriptionFilter with roleKeys, includeSystemKinds, and excludeSystemKinds for Digital Worker generation inputs."
+            ],
+            "breaking": false
+         },
+         {
+            "version": "1.8.0",
+            "date": "2026-06-11T00:00:00Z",
+            "changes": [
+               "Added x-systemKindCatalog as single source of truth for systemKind keys, displayName labels, and UX filter groups (enterpriseContext, externalSystems, platformServices)."
+            ],
+            "breaking": false
+         },
          {
             "version": "1.7.0",
             "date": "2026-05-20T00:00:00Z",
@@ -125,6 +142,141 @@
       ]
    },
    "$defs": {
+      "subscriptionFilter": {
+         "type": "object",
+         "description": "Shared filter engine shape for subscription triggers and Digital Worker generation inputs.",
+         "properties": {
+            "resourceTypes": {
+               "type": "array",
+               "items": {
+                  "type": "string",
+                  "minLength": 1
+               },
+               "minItems": 1
+            },
+            "systemKeys": {
+               "type": "array",
+               "items": {
+                  "type": "string",
+                  "minLength": 1
+               },
+               "minItems": 1
+            },
+            "datasourceKeys": {
+               "type": "array",
+               "items": {
+                  "type": "string",
+                  "minLength": 1
+               },
+               "minItems": 1
+            },
+            "roleKeys": {
+               "type": "array",
+               "items": {
+                  "type": "string",
+                  "minLength": 1
+               },
+               "minItems": 1,
+               "description": "Role keys that scope Digital Worker or subscription generation."
+            },
+            "includeSystemKinds": {
+               "type": "array",
+               "items": {
+                  "type": "string",
+                  "minLength": 1
+               },
+               "minItems": 1,
+               "description": "Include external systems whose systemKind matches any listed value."
+            },
+            "excludeSystemKinds": {
+               "type": "array",
+               "items": {
+                  "type": "string",
+                  "minLength": 1
+               },
+               "minItems": 1,
+               "description": "Exclude external systems whose systemKind matches any listed value."
+            }
+         },
+         "additionalProperties": false
+      },
+      "subscriptionTask": {
+         "type": "object",
+         "required": [
+            "type"
+         ],
+         "properties": {
+            "type": {
+               "type": "string",
+               "enum": [
+                  "compileCom",
+                  "generateEnterpriseDatasources",
+                  "generateRestContracts",
+                  "generateMcpContracts"
+               ],
+               "description": "Platform task type executed when the subscription fires."
+            },
+            "version": {
+               "type": "integer",
+               "minimum": 1,
+               "default": 1,
+               "description": "Task definition version snapshot for audit."
+            }
+         },
+         "additionalProperties": false
+      },
+      "subscriptionEntry": {
+         "type": "object",
+         "required": [
+            "key",
+            "event",
+            "task"
+         ],
+         "properties": {
+            "key": {
+               "type": "string",
+               "pattern": "^[a-z][a-z0-9-]*$",
+               "minLength": 1,
+               "maxLength": 100,
+               "description": "Unique subscription key within the external system."
+            },
+            "displayName": {
+               "type": "string",
+               "maxLength": 255
+            },
+            "description": {
+               "type": "string",
+               "maxLength": 2000
+            },
+            "event": {
+               "type": "string",
+               "minLength": 1,
+               "description": "V1 event namespace (platform.* or schedule.*)."
+            },
+            "filter": {
+               "$ref": "#/$defs/subscriptionFilter"
+            },
+            "task": {
+               "$ref": "#/$defs/subscriptionTask"
+            },
+            "priority": {
+               "type": "string",
+               "enum": [
+                  "low",
+                  "normal",
+                  "high",
+                  "critical"
+               ],
+               "default": "normal"
+            },
+            "runOnCreate": {
+               "type": "boolean",
+               "default": false,
+               "description": "When true, run the subscription task once after publish/sync."
+            }
+         },
+         "additionalProperties": false
+      },
       "authenticationVariablesByMethod": {
          "oauth2": {
             "variables": [
@@ -459,6 +611,145 @@
          "additionalProperties": false
       }
    },
+   "x-systemKindCatalog": {
+      "description": "Single source of truth for systemKind keys, display labels, and UX filter groups. Runtime catalog API and validators derive from this block.",
+      "groups": [
+         {
+            "key": "enterpriseContext",
+            "displayName": "Enterprise Context"
+         },
+         {
+            "key": "externalSystems",
+            "displayName": "External Systems"
+         },
+         {
+            "key": "platformServices",
+            "displayName": "Platform Services"
+         }
+      ],
+      "kinds": [
+         {
+            "key": "crm",
+            "displayName": "CRM",
+            "group": "externalSystems"
+         },
+         {
+            "key": "erp",
+            "displayName": "ERP",
+            "group": "externalSystems"
+         },
+         {
+            "key": "hr",
+            "displayName": "HR",
+            "group": "externalSystems"
+         },
+         {
+            "key": "finance",
+            "displayName": "Finance",
+            "group": "externalSystems"
+         },
+         {
+            "key": "projectManagement",
+            "displayName": "Project Management",
+            "group": "externalSystems"
+         },
+         {
+            "key": "customerService",
+            "displayName": "Customer Service",
+            "group": "externalSystems"
+         },
+         {
+            "key": "marketing",
+            "displayName": "Marketing",
+            "group": "externalSystems"
+         },
+         {
+            "key": "procurement",
+            "displayName": "Procurement",
+            "group": "externalSystems"
+         },
+         {
+            "key": "supplyChain",
+            "displayName": "Supply Chain",
+            "group": "externalSystems"
+         },
+         {
+            "key": "collaboration",
+            "displayName": "Collaboration",
+            "group": "externalSystems"
+         },
+         {
+            "key": "communication",
+            "displayName": "Communication",
+            "group": "externalSystems"
+         },
+         {
+            "key": "documentManagement",
+            "displayName": "Document Management",
+            "group": "externalSystems"
+         },
+         {
+            "key": "identity",
+            "displayName": "Identity",
+            "group": "platformServices"
+         },
+         {
+            "key": "analytics",
+            "displayName": "Analytics",
+            "group": "platformServices"
+         },
+         {
+            "key": "dataPlatform",
+            "displayName": "Data Platform",
+            "group": "platformServices"
+         },
+         {
+            "key": "database",
+            "displayName": "Database",
+            "group": "platformServices"
+         },
+         {
+            "key": "vectorStore",
+            "displayName": "Vector Store",
+            "group": "platformServices"
+         },
+         {
+            "key": "llm",
+            "displayName": "LLM",
+            "group": "platformServices"
+         },
+         {
+            "key": "workflow",
+            "displayName": "Workflow",
+            "group": "platformServices"
+         },
+         {
+            "key": "integration",
+            "displayName": "Integration",
+            "group": "platformServices"
+         },
+         {
+            "key": "monitoring",
+            "displayName": "Monitoring",
+            "group": "platformServices"
+         },
+         {
+            "key": "enterpriseKnowledge",
+            "displayName": "Enterprise Knowledge",
+            "group": "enterpriseContext"
+         },
+         {
+            "key": "digitalWorker",
+            "displayName": "Digital Worker",
+            "group": "enterpriseContext"
+         },
+         {
+            "key": "custom",
+            "displayName": "Custom",
+            "group": null
+         }
+      ]
+   },
    "type": "object",
    "required": [
       "key",
@@ -1016,6 +1307,44 @@
          },
          "additionalProperties": false
       },
+      "systemKind": {
+         "type": "string",
+         "enum": [
+            "crm",
+            "erp",
+            "hr",
+            "finance",
+            "projectManagement",
+            "customerService",
+            "marketing",
+            "procurement",
+            "supplyChain",
+            "collaboration",
+            "communication",
+            "documentManagement",
+            "identity",
+            "analytics",
+            "dataPlatform",
+            "database",
+            "vectorStore",
+            "llm",
+            "workflow",
+            "integration",
+            "monitoring",
+            "enterpriseKnowledge",
+            "digitalWorker",
+            "custom"
+         ],
+         "default": "custom",
+         "description": "Enterprise system classification metadata (CRM, LLM, enterprise knowledge, etc.). Does not affect execution or routing. Valid keys, display labels, and UX groups are defined in x-systemKindCatalog at schema root — not stored per row."
+      },
+      "subscriptions": {
+         "type": "array",
+         "description": "Event subscriptions that bootstrap platform tasks on publish/sync. Runtime uses persisted Subscription rows after sync.",
+         "items": {
+            "$ref": "#/$defs/subscriptionEntry"
+         }
+      },
       "certification": {
          "type": "object",
          "description": "Public certification settings for external system version verification.",

package/lib/schema/type/document-storage.json

@@ -7,7 +7,7 @@
     "key": "document-storage-schema",
     "name": "Document Storage Configuration Schema",
     "description": "JSON schema for validating document storage configurations",
-    "version": "1.7.0",
+    "version": "1.8.0",
     "type": "schema",
     "category": "document-storage",
     "author": "AI Fabrix Team",
@@ -103,6 +103,14 @@
           "Added optional maxBinaryFetchConcurrency (integer >= 1, default 1) to bound parallel binary fetches in two-phase sync phase 3"
         ],
         "breaking": false
+      },
+      {
+        "version": "1.8.0",
+        "date": "2026-06-15T00:00:00Z",
+        "changes": [
+          "Removed processing.aiPrompt — use COM field hints (441.1) instead; no backward compatibility"
+        ],
+        "breaking": true
       }
     ]
   },
@@ -223,10 +231,6 @@
           },
           "additionalProperties": false
         },
-        "aiPrompt": {
-          "type": "string",
-          "description": "Approved AI prompt text stored in the manifest."
-        },
         "spacyEnrichment": {
           "type": "object",
           "description": "spaCy enrichment configuration.",

package/lib/utils/api.js

@@ -12,6 +12,7 @@
 
 const { parseErrorResponse, formatNetworkError } = require('./api-error-handler');
 const { inferServiceLabelFromUrl } = require('./service-url-label');
+const { fetchWithOptionalDevPlatformTls } = require('./dev-platform-tls');
 const auditLogger = require('../core/audit-logger');
 
 /** Default timeout for HTTP requests (ms). Prevents hanging when the controller is unreachable. 30s allows Azure Web App cold start to complete. */
@@ -350,7 +351,7 @@ async function makeApiCall(url, options = {}) {
   const { fetchOptions, singleRequestTimeoutMs } = prepareFetchOptionsForRequest(options);
 
   try {
-    const response = await fetch(url, fetchOptions);
+    const response = await fetchWithOptionalDevPlatformTls(url, fetchOptions);
     const duration = Date.now() - startTime;
 
     if (!response.ok) {

package/lib/utils/app-run-containers.js

@@ -85,6 +85,27 @@ async function logContainerDebugInfo(containerName) {
   logger.log(chalk.gray(`[DEBUG] Container ports: ${ports.trim()}`));
 }
 
+/**
+ * @param {string} stdout - `docker ps --format "{{.Names}}"` output
+ * @returns {string[]}
+ */
+function parseDockerPsNameLines(stdout) {
+  return String(stdout || '')
+    .split('\n')
+    .map((line) => line.trim())
+    .filter(Boolean);
+}
+
+/**
+ * True when an exact container name appears in docker ps output (not a substring sibling).
+ * @param {string} containerName
+ * @param {string} stdout
+ * @returns {boolean}
+ */
+function isExactContainerNameInPsOutput(containerName, stdout) {
+  return parseDockerPsNameLines(stdout).includes(containerName);
+}
+
 async function checkContainerRunning(appName, developerId, debug = false, scopeOpts = null) {
   try {
     const containerName = getContainerName(appName, developerId, scopeOpts);
@@ -93,7 +114,7 @@ async function checkContainerRunning(appName, developerId, debug = false, scopeO
       logger.log(chalk.gray(`[DEBUG] Executing: ${cmd}`));
     }
     const { stdout } = await execWithDockerEnv(cmd);
-    const isRunning = stdout.trim() === containerName;
+    const isRunning = isExactContainerNameInPsOutput(containerName, stdout);
     if (debug) {
       logger.log(chalk.gray(`[DEBUG] Container ${containerName} running: ${isRunning}`));
       if (isRunning) {
@@ -161,6 +182,8 @@ module.exports = {
   checkContainerRunning,
   stopAndRemoveContainer,
   logContainerStatus,
-  getContainerName
+  getContainerName,
+  parseDockerPsNameLines,
+  isExactContainerNameInPsOutput
 };
 

package/lib/utils/authentication-shape.js

@@ -0,0 +1,224 @@
+/**
+ * External system authentication shape helpers (schema 2.4.x nested credential).
+ *
+ * @fileoverview Normalize flat legacy auth blocks to authType + credential template
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { getKvPathSegmentForSecurityKey } = require('./credential-secrets-env');
+
+/**
+ * @param {Object|null|undefined} authentication
+ * @returns {Object|null} Credential template (method, variables, security) or null
+ */
+function getAuthCredentialTemplate(authentication) {
+  if (!authentication || typeof authentication !== 'object') {
+    return null;
+  }
+  if (authentication.authType === 'credential' && authentication.credential) {
+    return authentication.credential;
+  }
+  if (authentication.method) {
+    return authentication;
+  }
+  return null;
+}
+
+/**
+ * @param {Object|null|undefined} authentication
+ * @returns {string}
+ */
+function getAuthMethodFromAuthentication(authentication) {
+  const credential = getAuthCredentialTemplate(authentication);
+  return String(credential?.method || authentication?.method || '').trim();
+}
+
+/**
+ * Builds flat credential template fields (method, variables, security) for a method.
+ * @param {string} systemKey
+ * @param {string} authType
+ * @returns {{ method: string, variables: Object, security: Object }}
+ */
+function buildFlatCredentialTemplate(systemKey, authType) {
+  const kvPath = (securityKey) => {
+    const segment = getKvPathSegmentForSecurityKey(securityKey);
+    return segment ? `kv://${systemKey}/${segment}` : null;
+  };
+  const method = authType || 'apikey';
+  const base = 'https://api.example.com';
+
+  const authMap = {
+    oauth2: {
+      variables: { baseUrl: base, tokenUrl: `${base}/oauth/token`, authorizationUrl: `${base}/oauth/authorize` },
+      security: { clientId: kvPath('clientId'), clientSecret: kvPath('clientSecret') }
+    },
+    aad: {
+      variables: {
+        baseUrl: base,
+        tokenUrl: 'https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token',
+        tenantId: '{tenant-id}'
+      },
+      security: { clientId: kvPath('clientId'), clientSecret: kvPath('clientSecret') }
+    },
+    apikey: {
+      variables: { baseUrl: base, headerName: 'X-API-Key' },
+      security: { apiKey: kvPath('apiKey') }
+    },
+    bearerToken: {
+      variables: { baseUrl: base, headerName: 'Authorization', prefix: 'Bearer' },
+      security: { token: kvPath('token') }
+    },
+    basic: {
+      variables: { baseUrl: base },
+      security: { username: kvPath('username'), password: kvPath('password') }
+    },
+    queryParam: {
+      variables: { baseUrl: base, paramName: 'api_key' },
+      security: { paramValue: kvPath('paramValue') }
+    },
+    oidc: {
+      variables: { openIdConfigUrl: 'https://example.com/.well-known/openid-configuration', clientId: 'app-id' },
+      security: {}
+    },
+    hmac: {
+      variables: { baseUrl: base, algorithm: 'sha256', signatureHeader: 'X-Signature' },
+      security: { signingSecret: kvPath('signingSecret') }
+    },
+    none: {
+      variables: {},
+      security: {}
+    }
+  };
+
+  const auth = authMap[method] || authMap.apikey;
+  return { method, variables: auth.variables, security: auth.security };
+}
+
+/**
+ * Builds schema-compliant authentication block for external-system.schema.json.
+ * @param {string} systemKey
+ * @param {string} authType - oauth2, apikey, bearerToken, none, …
+ * @returns {Object}
+ */
+function buildAuthenticationFromMethod(systemKey, authType) {
+  const method = authType || 'apikey';
+  if (method === 'none') {
+    return { authType: 'none' };
+  }
+  const flat = buildFlatCredentialTemplate(systemKey, method);
+  return {
+    authType: 'credential',
+    credential: {
+      credentialKey: `${systemKey}-cred`,
+      method: flat.method,
+      variables: flat.variables,
+      security: flat.security,
+      writeOnce: true
+    }
+  };
+}
+
+/**
+ * @param {Object} authentication
+ * @param {string} systemKey
+ * @returns {{ authentication: Object, changed: boolean }}
+ */
+function normalizeNestedCredentialBlock(authentication, systemKey) {
+  const credential = { ...authentication.credential };
+  let changed = Object.keys(authentication).some((k) => !['authType', 'credential'].includes(k));
+  if (!credential.credentialKey) {
+    credential.credentialKey = `${systemKey}-cred`;
+    changed = true;
+  }
+  if (credential.writeOnce === undefined) {
+    credential.writeOnce = true;
+    changed = true;
+  }
+  return { authentication: { authType: 'credential', credential }, changed };
+}
+
+/**
+ * @param {Object} flatAuth
+ * @param {string} systemKey
+ * @returns {{ authentication: Object, changed: boolean }}
+ */
+function wrapFlatAuthAsNested(flatAuth, systemKey) {
+  const credential = {
+    credentialKey: flatAuth.credentialKey || `${systemKey}-cred`,
+    method: flatAuth.method,
+    variables: flatAuth.variables && typeof flatAuth.variables === 'object' ? flatAuth.variables : {},
+    security: flatAuth.security && typeof flatAuth.security === 'object' ? flatAuth.security : {},
+    writeOnce: flatAuth.writeOnce !== false
+  };
+  if (flatAuth.displayName) {
+    credential.displayName = flatAuth.displayName;
+  }
+  return { authentication: { authType: 'credential', credential }, changed: true };
+}
+
+/**
+ * Migrates legacy flat authentication to nested authType + credential.
+ * @param {Object|null|undefined} authentication
+ * @param {string} systemKey
+ * @returns {{ authentication: Object, changed: boolean }}
+ */
+function migrateAuthenticationToNestedSchema(authentication, systemKey) {
+  if (!authentication || typeof authentication !== 'object') {
+    return { authentication: authentication || { authType: 'none' }, changed: false };
+  }
+  if (authentication.authType === 'none') {
+    return { authentication: { authType: 'none' }, changed: false };
+  }
+  if (authentication.authType === 'apiProvider' && authentication.apiProvider) {
+    return { authentication, changed: false };
+  }
+  if (authentication.authType === 'credential' && authentication.credential) {
+    return normalizeNestedCredentialBlock(authentication, systemKey);
+  }
+  if (authentication.method) {
+    return wrapFlatAuthAsNested(authentication, systemKey);
+  }
+  return { authentication, changed: false };
+}
+
+/**
+ * Align credential kv:// paths and credentialKey with the integration system key (wizard output).
+ * @param {Object|null|undefined} authentication
+ * @param {string} systemKey
+ * @param {string} [authDisplayName]
+ */
+function normalizeAuthenticationToSystemKey(authentication, systemKey, authDisplayName) {
+  if (!authentication || typeof authentication !== 'object') return;
+  const migrated = migrateAuthenticationToNestedSchema(authentication, systemKey);
+  Object.assign(authentication, migrated.authentication);
+  const credential = authentication.authType === 'credential' ? authentication.credential : null;
+  if (!credential) return;
+  credential.credentialKey = `${systemKey}-cred`;
+  const security = credential.security;
+  if (security && typeof security === 'object') {
+    for (const k of Object.keys(security)) {
+      const v = security[k];
+      if (typeof v === 'string' && v.startsWith('kv://')) {
+        const rest = v.slice(5);
+        const idx = rest.indexOf('/');
+        const suffix = idx >= 0 ? rest.slice(idx + 1) : '';
+        security[k] = suffix ? `kv://${systemKey}/${suffix}` : `kv://${systemKey}`;
+      }
+    }
+  }
+  if (authDisplayName) {
+    credential.displayName = authDisplayName;
+  }
+}
+
+module.exports = {
+  getAuthCredentialTemplate,
+  getAuthMethodFromAuthentication,
+  buildFlatCredentialTemplate,
+  buildAuthenticationFromMethod,
+  migrateAuthenticationToNestedSchema,
+  normalizeAuthenticationToSystemKey
+};