@aifabrix/builder 2.46.0 → 2.47.1

package/lib/utils/dev-platform-tls.js

@@ -0,0 +1,148 @@
+/**
+ * Dev platform HTTPS: builder-server nginx front door uses TLS while infra `tlsEnabled` may be off.
+ *
+ * @fileoverview Self-signed TLS allowance for remote dev platform URLs
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const https = require('https');
+const config = require('../core/config');
+const { isLocalhostPublicSchemeHostname } = require('./localhost-public-host');
+
+/**
+ * @param {string} url
+ * @returns {boolean}
+ */
+function isHttpsNonLocalhostUrl(url) {
+  try {
+    const u = new URL(url);
+    return u.protocol === 'https:' && !isLocalhostPublicSchemeHostname(u.hostname);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {string} requestHostname
+ * @param {string} remoteServerUrl
+ * @returns {boolean}
+ */
+function hostnameMatchesRemoteDevPlatform(requestHostname, remoteServerUrl) {
+  let remoteHost = '';
+  try {
+    remoteHost = new URL(remoteServerUrl).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  const host = String(requestHostname || '').trim().toLowerCase();
+  if (!host || !remoteHost) {
+    return false;
+  }
+  return host === remoteHost || host.endsWith(`.${remoteHost}`);
+}
+
+/**
+ * True when URL is a remote dev platform HTTPS endpoint (builder-server nginx / Traefik front door).
+ *
+ * @async
+ * @param {string} url
+ * @returns {Promise<boolean>}
+ */
+async function shouldAllowInsecureDevPlatformTls(url) {
+  if (!isHttpsNonLocalhostUrl(url)) {
+    return false;
+  }
+  try {
+    const remote = await config.getRemoteServer();
+    const remoteTrimmed = remote && String(remote).trim();
+    if (!remoteTrimmed) {
+      return false;
+    }
+    const hostname = new URL(url).hostname;
+    return hostnameMatchesRemoteDevPlatform(hostname, remoteTrimmed);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Minimal fetch for self-signed dev platform HTTPS (Node global fetch cannot set rejectUnauthorized).
+ *
+ * @param {string} url
+ * @param {Object} options
+ * @returns {Promise<{ status: number, statusText: string, headers: { get: Function }, text: Function, json: Function }>}
+ */
+function nodeHttpsFetchInsecure(url, options = {}) {
+  return new Promise((resolve, reject) => {
+    const u = new URL(url);
+    const method = String(options.method || 'GET').toUpperCase();
+    const headers = { ...(options.headers || {}) };
+    const body = options.body;
+    const reqOpts = {
+      hostname: u.hostname,
+      port: u.port || 443,
+      path: `${u.pathname}${u.search}`,
+      method,
+      headers,
+      rejectUnauthorized: false
+    };
+
+    const req = https.request(reqOpts, (res) => {
+      const chunks = [];
+      res.on('data', (chunk) => chunks.push(chunk));
+      res.on('end', () => {
+        const raw = Buffer.concat(chunks).toString('utf8');
+        const status = res.statusCode || 0;
+        resolve({
+          ok: status >= 200 && status < 300,
+          status,
+          statusText: res.statusMessage || '',
+          headers: {
+            get: (name) => res.headers[String(name || '').toLowerCase()] || null
+          },
+          text: async() => raw,
+          json: async() => JSON.parse(raw)
+        });
+      });
+    });
+
+    req.on('error', reject);
+    if (options.signal) {
+      const onAbort = () => {
+        req.destroy(new Error('The operation was aborted'));
+      };
+      if (options.signal.aborted) {
+        onAbort();
+        return;
+      }
+      options.signal.addEventListener('abort', onAbort, { once: true });
+    }
+    if (body !== undefined && body !== null) {
+      req.write(typeof body === 'string' ? body : String(body));
+    }
+    req.end();
+  });
+}
+
+/**
+ * @async
+ * @param {string} url
+ * @param {Object} options
+ * @returns {Promise<Response>}
+ */
+async function fetchWithOptionalDevPlatformTls(url, options = {}) {
+  if (await shouldAllowInsecureDevPlatformTls(url)) {
+    return nodeHttpsFetchInsecure(url, options);
+  }
+  return fetch(url, options);
+}
+
+module.exports = {
+  isHttpsNonLocalhostUrl,
+  hostnameMatchesRemoteDevPlatform,
+  shouldAllowInsecureDevPlatformTls,
+  fetchWithOptionalDevPlatformTls
+};

package/lib/utils/docker-build.js

@@ -264,10 +264,7 @@ async function executeDockerBuildWithTag(effectiveImageName, imageName, dockerfi
 
   await executeBuild(effectiveImageName, dockerfilePath, contextPath, tag, options);
 
-  const wantCompatTag =
-    effectiveImageName !== imageName &&
-    options &&
-    options.base === true;
+  const wantCompatTag = effectiveImageName !== imageName && imageName;
   if (!wantCompatTag) {
     return;
   }

package/lib/utils/external-env-template.js

@@ -13,6 +13,7 @@ const path = require('path');
 const fs = require('fs');
 const Handlebars = require('handlebars');
 const { systemKeyToKvPrefix, kvEnvKeyToPath, securityKeyToVar } = require('./credential-secrets-env');
+const { getAuthCredentialTemplate } = require('./authentication-shape');
 
 /**
  * Builds hint string from portalInput (options → enum, validation → min-max or pattern).
@@ -63,9 +64,15 @@ function buildAuthSecureVarsFromSystem(system) {
   const systemKey = system?.key || 'external-system';
   const prefix = systemKeyToKvPrefix(systemKey);
   if (!prefix) return authSecureVars;
-  const security = system?.authentication?.security || system?.auth?.security;
-  const authMethod = (system?.authentication?.method || system?.authentication?.type ||
-    system?.auth?.method || system?.auth?.type || 'apikey').toLowerCase();
+  const authBlock = system?.authentication || system?.auth;
+  const credential = getAuthCredentialTemplate(authBlock);
+  const security = credential?.security || authBlock?.security;
+  const authMethod = (
+    credential?.method ||
+    authBlock?.method ||
+    authBlock?.type ||
+    'apikey'
+  ).toLowerCase();
   if (security && typeof security === 'object' && Object.keys(security).length > 0) {
     for (const key of Object.keys(security)) {
       const envName = `KV_${prefix}_${securityKeyToVar(key)}`;

package/lib/utils/external-system-validators.js

@@ -392,8 +392,7 @@ function validateAgainstSchema(data, schema) {
     validateSchema: false
   });
   addFormats(ajv);
-  // Some schemas (e.g. external-datasource.schema.json) reference these by $id (aifabrix://schema/type/*).
-  // Adding them up-front keeps validation offline-safe and avoids unresolved $ref failures.
+  // Type schemas are referenced by $id from external-system and external-datasource manifests.
   ajv.addSchema(require('../schema/type/document-storage.json'));
   ajv.addSchema(require('../schema/type/message-service.json'));
   ajv.addSchema(require('../schema/type/vector-store.json'));
@@ -404,6 +403,13 @@ function validateAgainstSchema(data, schema) {
   }
   // Normalize schema to handle nullable without type
   const normalizedSchema = normalizeSchema(schemaCopy);
+  const schemaId = normalizedSchema.$id || '';
+  if (schemaId.includes('external-datasource')) {
+    const externalSystemSchema = require('../schema/external-system.schema.json');
+    if (!ajv.getSchema(externalSystemSchema.$id)) {
+      ajv.addSchema(externalSystemSchema, externalSystemSchema.$id);
+    }
+  }
   const validate = ajv.compile(normalizedSchema);
   const valid = validate(data);
 

package/lib/utils/health-check-request.js

@@ -0,0 +1,114 @@
+/**
+ * HTTP(S) health probe request helpers.
+ *
+ * @fileoverview Low-level health endpoint HTTP client
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const http = require('http');
+const https = require('https');
+const chalk = require('chalk');
+const logger = require('./logger');
+const { shouldAllowInsecureDevPlatformTls } = require('./dev-platform-tls');
+
+/**
+ * @param {string} data
+ * @param {number} statusCode
+ * @returns {boolean}
+ */
+function parseHealthResponse(data, statusCode) {
+  try {
+    const health = JSON.parse(data);
+    if (health.status === 'UP') {
+      return true;
+    }
+    if (health.status === 'ok') {
+      return health.database === 'connected' || !health.database;
+    }
+    if (health.status === 'healthy') {
+      return true;
+    }
+    if (health.success === true) {
+      return true;
+    }
+    return false;
+  } catch {
+    return statusCode === 200;
+  }
+}
+
+function handleHealthResponse(res, data, debug, resolve) {
+  const isHealthy = parseHealthResponse(data, res.statusCode);
+  if (debug) {
+    const truncatedData = data.length > 200 ? data.substring(0, 200) + '...' : data;
+    logger.log(chalk.gray(`[DEBUG] Response body: ${truncatedData}`));
+    logger.log(chalk.gray(`[DEBUG] Health check result: ${isHealthy ? 'healthy' : 'unhealthy'}`));
+  }
+  resolve(isHealthy);
+}
+
+function doHealthCheckRequest(healthCheckUrl, debug, resolve, reject, allowInsecureTls = false) {
+  try {
+    const urlObj = new URL(healthCheckUrl);
+    const transport = urlObj.protocol === 'https:' ? https : http;
+    const options = {
+      hostname: urlObj.hostname,
+      port: urlObj.port || (urlObj.protocol === 'https:' ? 443 : 80),
+      path: urlObj.pathname + urlObj.search,
+      method: 'GET',
+      ...(allowInsecureTls ? { rejectUnauthorized: false } : {})
+    };
+    if (debug) {
+      logger.log(chalk.gray(`[DEBUG] Health check request: ${healthCheckUrl}`));
+      logger.log(chalk.gray(`[DEBUG] Request options: ${JSON.stringify(options, null, 2)}`));
+    }
+    const timer = { id: null };
+    const req = transport.request(options, (res) => {
+      clearTimeout(timer.id);
+      let data = '';
+      if (debug) {
+        logger.log(chalk.gray(`[DEBUG] Response status code: ${res.statusCode}`));
+        logger.log(chalk.gray(`[DEBUG] Response headers: ${JSON.stringify(res.headers, null, 2)}`));
+      }
+      res.on('data', (chunk) => {
+        data += chunk;
+      });
+      res.on('end', () => handleHealthResponse(res, data, debug, resolve));
+    });
+    timer.id = setTimeout(() => {
+      if (debug) logger.log(chalk.gray('[DEBUG] Health check request timeout after 5 seconds'));
+      req.destroy();
+      resolve(false);
+    }, 5000);
+    req.on('error', (error) => {
+      clearTimeout(timer.id);
+      if (debug) logger.log(chalk.gray(`[DEBUG] Health check request error: ${error.message}`));
+      resolve(false);
+    });
+    req.end();
+  } catch (error) {
+    if (debug) logger.log(chalk.gray(`[DEBUG] Health check exception: ${error.message}`));
+    reject(error);
+  }
+}
+
+/**
+ * @async
+ * @param {string} healthCheckUrl
+ * @param {boolean} [debug=false]
+ * @returns {Promise<boolean>}
+ */
+async function checkHealthEndpoint(healthCheckUrl, debug = false) {
+  const allowInsecureTls = await shouldAllowInsecureDevPlatformTls(healthCheckUrl);
+  return new Promise((resolve, reject) => {
+    doHealthCheckRequest(healthCheckUrl, debug, resolve, reject, allowInsecureTls);
+  });
+}
+
+module.exports = {
+  parseHealthResponse,
+  checkHealthEndpoint
+};

package/lib/utils/health-check-url.js

@@ -92,6 +92,7 @@ async function computeTraefikPublicAppUrl(_appName, _healthCheckPort, appConfig)
   const remoteServer = await coreConfig.getRemoteServer();
   const developerIdRaw = await coreConfig.getDeveloperId();
   const developerIdNum = parseDeveloperIdNum(developerIdRaw);
+  const setupPlatformMode = await coreConfig.getSetupPlatformMode();
 
   // URLs are resolved for the CLI on the host, not from inside a container.
   const profile = 'local';
@@ -107,7 +108,8 @@ async function computeTraefikPublicAppUrl(_appName, _healthCheckPort, appConfig)
     profile,
     listenPort,
     developerIdNum,
-    infraTlsEnabled
+    infraTlsEnabled,
+    setupPlatformMode
   });
 
   return joinUrlPath(publicBase, mountPath);

package/lib/utils/health-check.js

@@ -9,9 +9,8 @@ const { formatSuccessLine } = require('./cli-test-layout-chalk');
  * @version 2.0.0
  */
 
-const http = require('http');
-const https = require('https');
 const net = require('net');
+const { checkHealthEndpoint } = require('./health-check-request');
 const dns = require('dns');
 const chalk = require('chalk');
 const logger = require('./logger');
@@ -192,117 +191,6 @@ async function getContainerPort(appName, debug = false) {
   return 3000;
 }
 
-/**
- * Parses health check response
- * @function parseHealthResponse
- * @param {string} data - Response data
- * @param {number} statusCode - HTTP status code
- * @returns {boolean} True if healthy
- */
-function parseHealthResponse(data, statusCode) {
-  try {
-    const health = JSON.parse(data);
-    if (health.status === 'UP') {
-      return true;
-    }
-    if (health.status === 'ok') {
-      return health.database === 'connected' || !health.database;
-    }
-    if (health.status === 'healthy') {
-      return true;
-    }
-    if (health.success === true) {
-      return true;
-    }
-    return false;
-  } catch (error) {
-    return statusCode === 200;
-  }
-}
-
-function handleHealthResponse(res, data, debug, resolve) {
-  const isHealthy = parseHealthResponse(data, res.statusCode);
-  if (debug) {
-    const truncatedData = data.length > 200 ? data.substring(0, 200) + '...' : data;
-    logger.log(chalk.gray(`[DEBUG] Response body: ${truncatedData}`));
-    logger.log(chalk.gray(`[DEBUG] Health check result: ${isHealthy ? 'healthy' : 'unhealthy'}`));
-  }
-  resolve(isHealthy);
-}
-
-function doHealthCheckRequest(healthCheckUrl, debug, resolve, reject) {
-  try {
-    const urlObj = new URL(healthCheckUrl);
-    const transport = urlObj.protocol === 'https:' ? https : http;
-    const options = {
-      hostname: urlObj.hostname,
-      port: urlObj.port || (urlObj.protocol === 'https:' ? 443 : 80),
-      path: urlObj.pathname + urlObj.search,
-      method: 'GET'
-    };
-    if (debug) {
-      logger.log(chalk.gray(`[DEBUG] Health check request: ${healthCheckUrl}`));
-      logger.log(chalk.gray(`[DEBUG] Request options: ${JSON.stringify(options, null, 2)}`));
-    }
-    const timer = { id: null };
-    const req = transport.request(options, (res) => {
-      clearTimeout(timer.id);
-      let data = '';
-      if (debug) {
-        logger.log(chalk.gray(`[DEBUG] Response status code: ${res.statusCode}`));
-        logger.log(chalk.gray(`[DEBUG] Response headers: ${JSON.stringify(res.headers, null, 2)}`));
-      }
-      res.on('data', (chunk) => {
-        data += chunk;
-      });
-      res.on('end', () => handleHealthResponse(res, data, debug, resolve));
-    });
-    timer.id = setTimeout(() => {
-      if (debug) logger.log(chalk.gray('[DEBUG] Health check request timeout after 5 seconds'));
-      req.destroy();
-      resolve(false);
-    }, 5000);
-    req.on('error', (error) => {
-      clearTimeout(timer.id);
-      if (debug) logger.log(chalk.gray(`[DEBUG] Health check request error: ${error.message}`));
-      resolve(false);
-    });
-    req.end();
-  } catch (error) {
-    if (debug) logger.log(chalk.gray(`[DEBUG] Health check exception: ${error.message}`));
-    reject(error);
-  }
-}
-
-/**
- * Checks health endpoint
- * @async
- * @function checkHealthEndpoint
- * @param {string} healthCheckUrl - Health check URL
- * @param {boolean} [debug=false] - Enable debug logging
- * @returns {Promise<boolean>} True if healthy
- * @throws {Error} If request fails with exception
- */
-async function checkHealthEndpoint(healthCheckUrl, debug = false) {
-  return new Promise((resolve, reject) => {
-    doHealthCheckRequest(healthCheckUrl, debug, resolve, reject);
-  });
-}
-
-/**
- * Waits for application health check to pass
- * Checks HTTP endpoint and waits for healthy response
- *
- * @async
- * @function waitForHealthCheck
- * @param {string} appName - Application name
- * @param {number} timeout - Timeout in seconds (default: 90)
- * @param {number} [port] - Application port (auto-detected if not provided)
- * @param {Object} [config] - Application configuration
- * @param {boolean} [debug=false] - Enable debug logging
- * @returns {Promise<void>} Resolves when health check passes
- * @throws {Error} If health check times out
- */
 /**
  * Determines health check port
  * @async

package/lib/utils/help-builder.js

@@ -76,6 +76,7 @@ const CATEGORIES = [
       { name: 'integration-client' },
       { name: 'dimension' },
       { name: 'dimension value', term: 'dimension value <command>' },
+      { name: 'resource-type' },
       { name: 'identity' },
       { name: 'protection' }
     ]
@@ -101,6 +102,7 @@ const CATEGORIES = [
       { name: 'upload', term: 'upload <systemKey>' },
       { name: 'delete', term: 'delete <systemKey>' },
       { name: 'repair', term: 'repair <systemKey>' },
+      { name: 'channel', term: 'channel scaffold <channelTarget>' },
       { name: 'datasource' },
       { name: 'datasource load', term: 'datasource load <datasourceKey>' },
       { name: 'datasource export', term: 'datasource export <datasourceKey>' },
@@ -119,6 +121,7 @@ const CATEGORIES = [
     commands: [
       { name: 'dev' },
       { name: 'secret' },
+      { name: 'npm', term: 'npm config' },
       { name: 'secure' }
     ]
   }

package/lib/utils/keycloak-realm-ready.js

@@ -31,7 +31,11 @@ async function probeRealmWellKnown(url) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), 8000);
   try {
-    const res = await fetch(url, { method: 'GET', signal: controller.signal });
+    const { fetchWithOptionalDevPlatformTls } = require('./dev-platform-tls');
+    const res = await fetchWithOptionalDevPlatformTls(url, {
+      method: 'GET',
+      signal: controller.signal
+    });
     return res.ok;
   } catch {
     return false;

package/lib/utils/localhost-public-host.js

@@ -0,0 +1,31 @@
+/**
+ * Loopback hostnames always use http for declarative public URLs.
+ *
+ * @fileoverview Localhost hostname detection for public URL scheme
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {string} hostname
+ * @returns {boolean}
+ */
+function isLocalhostPublicSchemeHostname(hostname) {
+  const h = String(hostname || '').trim().toLowerCase();
+  if (!h) {
+    return false;
+  }
+  if (h === 'localhost') {
+    return true;
+  }
+  if (h === '127.0.0.1') {
+    return true;
+  }
+  return h === '::1';
+}
+
+module.exports = {
+  isLocalhostPublicSchemeHostname
+};

package/lib/utils/npm-user-config.js

@@ -0,0 +1,145 @@
+/**
+ * Merge npm user-global auth lines from BASH_NPM_TOKEN / NPM_TOKEN.
+ *
+ * @fileoverview User-level ~/.npmrc auth for @aifabrix scope (not repo .npmrc)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+/**
+ * Keys managed by aifabrix npm config (replaced or removed on each run).
+ * `always-auth` is legacy — npm 11+ warns at userconfig; auth uses scoped registry + _authToken.
+ */
+const MANAGED_KEYS = new Set([
+  '@aifabrix:registry',
+  'always-auth',
+  '//registry.npmjs.org/:_authToken'
+]);
+
+const REGISTRY_URL = 'https://registry.npmjs.org/';
+
+/**
+ * Resolve npm userconfig file path (~/.npmrc by default).
+ *
+ * @returns {string}
+ */
+function getUserNpmrcPath() {
+  const fromEnv = process.env.npm_config_userconfig || process.env.NPM_CONFIG_USERCONFIG;
+  if (fromEnv && typeof fromEnv === 'string' && fromEnv.trim()) {
+    return path.resolve(fromEnv.trim());
+  }
+  return path.join(os.homedir(), '.npmrc');
+}
+
+/**
+ * Parse a single .npmrc line into key/value (ignores comments and blanks).
+ *
+ * @param {string} line
+ * @returns {{ key: string, value: string }|null}
+ */
+function parseNpmrcLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith(';')) {
+    return null;
+  }
+  const eq = trimmed.indexOf('=');
+  if (eq === -1) {
+    return { key: trimmed, value: '' };
+  }
+  return {
+    key: trimmed.slice(0, eq).trim(),
+    value: trimmed.slice(eq + 1).trim()
+  };
+}
+
+/**
+ * Build managed auth lines for @aifabrix private registry.
+ *
+ * @param {string} token - Bare npm automation token (never logged by callers)
+ * @returns {string[]}
+ */
+function buildManagedLines(token) {
+  return [
+    `@aifabrix:registry=${REGISTRY_URL}`,
+    `//registry.npmjs.org/:_authToken=${token}`
+  ];
+}
+
+/**
+ * Merge managed lines into existing .npmrc content (idempotent).
+ *
+ * @param {string} existingContent
+ * @param {string} token
+ * @returns {string}
+ */
+function mergeNpmrcContent(existingContent, token) {
+  const kept = [];
+  const lines = (existingContent || '').split(/\r?\n/);
+  for (const line of lines) {
+    const parsed = parseNpmrcLine(line);
+    if (parsed && MANAGED_KEYS.has(parsed.key)) {
+      continue;
+    }
+    kept.push(line);
+  }
+  while (kept.length > 0 && kept[kept.length - 1] === '') {
+    kept.pop();
+  }
+  const managed = buildManagedLines(token);
+  if (kept.length > 0) {
+    return `${kept.join('\n')}\n${managed.join('\n')}\n`;
+  }
+  return `${managed.join('\n')}\n`;
+}
+
+/**
+ * Write merged user-global npm auth from token.
+ *
+ * @param {string} token
+ * @param {{ dryRun?: boolean, npmrcPath?: string }} [options]
+ * @returns {{ npmrcPath: string, managedKeys: string[], dryRun: boolean, wrote: boolean }}
+ */
+function writeUserNpmrcFromToken(token, options = {}) {
+  const npmrcPath = options.npmrcPath || getUserNpmrcPath();
+  const dryRun = Boolean(options.dryRun);
+  const managedKeys = [...MANAGED_KEYS];
+  if (!token || !String(token).trim()) {
+    throw new Error('NPM token is required to update user npm config');
+  }
+  const existing = fs.existsSync(npmrcPath) ? fs.readFileSync(npmrcPath, 'utf8') : '';
+  const merged = mergeNpmrcContent(existing, String(token).trim());
+  if (!dryRun) {
+    const dir = path.dirname(npmrcPath);
+    if (!fs.existsSync(dir)) {
+      fs.mkdirSync(dir, { recursive: true });
+    }
+    fs.writeFileSync(npmrcPath, merged, { mode: 0o600 });
+    try {
+      fs.chmodSync(npmrcPath, 0o600);
+    } catch {
+      // best-effort on platforms that restrict chmod
+    }
+  }
+  return {
+    npmrcPath,
+    managedKeys,
+    dryRun,
+    wrote: !dryRun
+  };
+}
+
+module.exports = {
+  MANAGED_KEYS,
+  REGISTRY_URL,
+  getUserNpmrcPath,
+  parseNpmrcLine,
+  buildManagedLines,
+  mergeNpmrcContent,
+  writeUserNpmrcFromToken
+};