@aifabrix/builder 2.46.0 → 2.47.1

package/lib/utils/worker-sidecars.js

@@ -0,0 +1,142 @@
+/**
+ * Worker sidecar resolution from application.yaml build settings.
+ *
+ * @fileoverview Generic worker/beat companions driven by build.worker and imageRun* fields
+ */
+
+'use strict';
+
+const { buildDefaultLocalContainerName } = require('./environment-scoped-resources');
+
+/**
+ * @param {object|null|undefined} build
+ * @param {string} field
+ * @returns {string|null}
+ */
+function readImageRunCommand(build, field) {
+  if (!build || typeof build !== 'object') {
+    return null;
+  }
+  const raw = build[field];
+  if (typeof raw !== 'string') {
+    return null;
+  }
+  const trimmed = raw.trim();
+  return trimmed ? trimmed : null;
+}
+
+/**
+ * @param {object|null|undefined} appConfig
+ * @returns {boolean}
+ */
+function isWorkerStackEnabled(appConfig) {
+  if (!appConfig || typeof appConfig !== 'object') {
+    return false;
+  }
+  return appConfig.build?.worker === true;
+}
+
+/**
+ * @param {string} appKey
+ * @param {object|null|undefined} appConfig
+ * @returns {{
+ *   enabled: boolean,
+ *   worker: { key: string, command: string }|null,
+ *   beat: { key: string, command: string }|null,
+ *   companions: Array<{ role: string, key: string, command: string }>
+ * }}
+ */
+function resolveWorkerSidecars(appKey, appConfig) {
+  const empty = { enabled: false, worker: null, beat: null, companions: [] };
+  if (!isWorkerStackEnabled(appConfig)) {
+    return empty;
+  }
+
+  const build = appConfig.build && typeof appConfig.build === 'object' ? appConfig.build : {};
+  const workerCommand = readImageRunCommand(build, 'imageRunWorker');
+  const beatCommand = readImageRunCommand(build, 'imageRunBeat');
+  const companions = [];
+
+  if (workerCommand) {
+    companions.push({ role: 'worker', key: `${appKey}-worker`, command: workerCommand });
+  }
+  if (beatCommand) {
+    companions.push({ role: 'beat', key: `${appKey}-beat`, command: beatCommand });
+  }
+
+  if (companions.length === 0) {
+    return empty;
+  }
+
+  const worker = companions.find((entry) => entry.role === 'worker') || null;
+  const beat = companions.find((entry) => entry.role === 'beat') || null;
+
+  return {
+    enabled: true,
+    worker,
+    beat,
+    companions
+  };
+}
+
+/**
+ * @param {string} appKey
+ * @param {object|null|undefined} appConfig
+ * @returns {string[]}
+ */
+function getWorkerCompanionAppKeys(appKey, appConfig) {
+  return resolveWorkerSidecars(appKey, appConfig).companions.map((entry) => entry.key);
+}
+
+/**
+ * @param {string} appKey
+ * @param {object} appConfig
+ * @param {{ devId: string|number, idNum: number }} ids
+ * @returns {{
+ *   enabled: boolean,
+ *   worker?: { key: string, containerName: string, command: string },
+ *   beat?: { key: string, containerName: string, command: string }
+ * }}
+ */
+function buildWorkerSidecarComposeContext(appKey, appConfig, ids) {
+  const sidecars = resolveWorkerSidecars(appKey, appConfig);
+  if (!sidecars.enabled) {
+    return { enabled: false };
+  }
+
+  const context = { enabled: true };
+  if (sidecars.worker) {
+    context.worker = {
+      key: sidecars.worker.key,
+      containerName: buildDefaultLocalContainerName(sidecars.worker.key, ids.devId, ids.idNum),
+      command: sidecars.worker.command
+    };
+  }
+  if (sidecars.beat) {
+    context.beat = {
+      key: sidecars.beat.key,
+      containerName: buildDefaultLocalContainerName(sidecars.beat.key, ids.devId, ids.idNum),
+      command: sidecars.beat.command
+    };
+  }
+  return context;
+}
+
+/**
+ * Azure startupCommand from compose imageRun (drops leading exec).
+ *
+ * @param {string} imageRun
+ * @returns {string}
+ */
+function imageRunToStartupCommand(imageRun) {
+  return imageRun.replace(/^exec\s+/i, '').trim();
+}
+
+module.exports = {
+  readImageRunCommand,
+  isWorkerStackEnabled,
+  resolveWorkerSidecars,
+  getWorkerCompanionAppKeys,
+  buildWorkerSidecarComposeContext,
+  imageRunToStartupCommand
+};

package/lib/validation/external-manifest-validator.js

@@ -16,6 +16,7 @@ const path = require('path');
 const { formatValidationErrors } = require('../utils/error-formatter');
 const { validateFieldReferences } = require('../datasource/field-reference-validator');
 const { validateAbac } = require('../datasource/abac-validator');
+const { validateManifestRuntimeConfiguration } = require('./runtime-configuration-rules');
 
 /**
  * Load and normalize external-system + external-datasource schema objects for manifest AJV.
@@ -247,6 +248,7 @@ async function validateControllerManifest(manifest) {
   validateInlineSystem(manifest, ajv, externalSystemSchema, errors);
   validateDatasources(manifest, ajv, externalDatasourceSchema, errors, warnings);
   validateDatasourceSystemKeyAlignment(manifest, errors);
+  errors.push(...validateManifestRuntimeConfiguration(manifest));
   validateConditionalRequirements(manifest, errors, warnings);
   validateRequiredFields(manifest, errors);
 

package/lib/validation/runtime-configuration-rules.js

@@ -0,0 +1,98 @@
+/**
+ * Runtime configuration validation for external system manifests.
+ *
+ * @fileoverview Datasource override rules (v1: no keyvault overrides)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+/**
+ * @param {Array<{ name?: string, location?: string }>|undefined} systemConfiguration
+ * @returns {Map<string, { name?: string, location?: string }>}
+ */
+function systemConfigDefsByName(systemConfiguration) {
+  const defsByName = new Map();
+  for (const item of systemConfiguration || []) {
+    if (item && item.name) {
+      defsByName.set(String(item.name).trim(), item);
+    }
+  }
+  return defsByName;
+}
+
+/**
+ * @param {string} prefix
+ * @param {Map<string, { name?: string, location?: string }>} defsByName
+ * @param {{ name?: string, value?: string }} override
+ * @returns {string[]}
+ */
+function validateOverrideEntry(prefix, defsByName, override) {
+  if (!override || !override.name) {
+    return [];
+  }
+  const name = String(override.name).trim();
+  const def = defsByName.get(name);
+  if (!def) {
+    return [`${prefix}configuration override '${name}' is not declared on the parent system.`];
+  }
+  const errors = [];
+  if (String(def.location || 'variable').toLowerCase() === 'keyvault') {
+    errors.push(
+      `${prefix}configuration override '${name}' targets a keyvault system definition (not allowed in v1).`
+    );
+  }
+  const extraKeys = Object.keys(override).filter((key) => key !== 'name' && key !== 'value');
+  if (extraKeys.length > 0) {
+    errors.push(
+      `${prefix}configuration override '${name}' must contain only name and value (found: ${extraKeys.join(', ')}).`
+    );
+  }
+  return errors;
+}
+
+/**
+ * Validates datasource configuration[] overrides against parent system definitions.
+ *
+ * @param {Array<{ name?: string, location?: string }>|undefined} systemConfiguration
+ * @param {Array<{ name?: string, value?: string }>|undefined} datasourceConfiguration
+ * @param {string} [datasourceKey] - For error prefixes
+ * @returns {string[]} Validation errors
+ */
+function validateDatasourceConfigurationOverrides(
+  systemConfiguration,
+  datasourceConfiguration,
+  datasourceKey
+) {
+  if (!Array.isArray(datasourceConfiguration) || datasourceConfiguration.length === 0) {
+    return [];
+  }
+  const prefix = datasourceKey ? `Datasource '${datasourceKey}': ` : '';
+  const defsByName = systemConfigDefsByName(systemConfiguration);
+  return datasourceConfiguration.flatMap((override) =>
+    validateOverrideEntry(prefix, defsByName, override)
+  );
+}
+
+/**
+ * @param {{ system?: { configuration?: unknown[] }, dataSources?: Array<{ key?: string, configuration?: unknown[] }> }} manifest
+ * @returns {string[]}
+ */
+function validateManifestRuntimeConfiguration(manifest) {
+  const errors = [];
+  const systemConfiguration = manifest?.system?.configuration;
+  for (const ds of manifest?.dataSources || []) {
+    errors.push(
+      ...validateDatasourceConfigurationOverrides(
+        systemConfiguration,
+        ds?.configuration,
+        ds?.key
+      )
+    );
+  }
+  return errors;
+}
+
+module.exports = {
+  validateDatasourceConfigurationOverrides,
+  validateManifestRuntimeConfiguration
+};

package/lib/validation/validate-display-dimensions.js

@@ -0,0 +1,154 @@
+/**
+ * @fileoverview Dimensions (ABAC) display helpers for validate-display.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { loadConfigFile } = require('../utils/config-format');
+const { flattenRootDimensionsForDisplay } = require('./dimension-display-helpers');
+const { formatDatasourceListRow } = require('../utils/cli-test-layout-chalk');
+const logger = require('../utils/logger');
+const {
+  logSectionTitle,
+  logWarnRow,
+  logDimLine
+} = require('./validate-display-log-helpers');
+
+/**
+ * True when datasource is orchestration-only (no ABAC dimensions contract).
+ * @param {string} filePath - Path to datasource JSON
+ * @returns {boolean}
+ */
+function isOrchestrationOnlyDatasource(filePath) {
+  try {
+    const parsed = loadConfigFile(filePath);
+    return String(parsed?.entityType || '').trim() === 'none';
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Extracts dimensions from a datasource file for CLI display.
+ * Local bindings become `metadata.<field>`; FK bindings become `fk:<fk>→<dimension>...` plus optional `(actor: ...)`.
+ * @function extractDimensionsFromDatasource
+ * @param {string} filePath - Path to datasource file
+ * @returns {Object} Dimensions info { dimensions: Object, dimensionKeys: string[], hasDimensions: boolean }
+ */
+function extractDimensionsFromDatasource(filePath) {
+  try {
+    const parsed = loadConfigFile(filePath);
+
+    const rootFlat = flattenRootDimensionsForDisplay(parsed.dimensions);
+    const abacDimensions = parsed.abac?.dimensions || {};
+    const allDimensions = { ...rootFlat, ...abacDimensions };
+    const dimensionKeys = Object.keys(allDimensions);
+
+    return {
+      dimensions: allDimensions,
+      dimensionKeys,
+      hasDimensions: dimensionKeys.length > 0
+    };
+  } catch {
+    return { dimensions: {}, dimensionKeys: [], hasDimensions: false };
+  }
+}
+
+/**
+ * Displays Dimensions (ABAC) validation results for datasources
+ * @function displayDimensionsValidation
+ * @param {Array} externalFiles - External files validation results
+ * @returns {Array} Warnings to add to aggregated warnings
+ */
+function displayDimensionsValidation(externalFiles) {
+  if (!externalFiles || externalFiles.length === 0) {
+    return [];
+  }
+
+  const datasourceFiles = externalFiles.filter(f =>
+    f.type === 'datasource' || f.type === 'external-datasource'
+  );
+
+  if (datasourceFiles.length === 0) {
+    return [];
+  }
+
+  logSectionTitle('Dimensions (ABAC)');
+
+  const warnings = [];
+  let anyDatasourceHasDimensions = false;
+
+  datasourceFiles.forEach(file => {
+    if (file.path && isOrchestrationOnlyDatasource(file.path)) {
+      logger.log(formatDatasourceListRow('ok', file.file, file.type));
+      logDimLine('orchestration-only (entityType=none) — dimensions N/A');
+      return;
+    }
+    const dimensionsInfo = extractDimensionsFromDatasource(file.path);
+
+    if (dimensionsInfo.hasDimensions) {
+      anyDatasourceHasDimensions = true;
+      logger.log(formatDatasourceListRow('ok', file.file, file.type));
+      dimensionsInfo.dimensionKeys.forEach(key => {
+        const mapping = dimensionsInfo.dimensions[key];
+        logDimLine(`${key} → ${mapping}`);
+      });
+    } else {
+      logWarnRow(`${file.file} — no dimensions configured`);
+      warnings.push(`${file.file} - no dimensions configured, ABAC filtering disabled`);
+    }
+  });
+
+  if (!anyDatasourceHasDimensions && datasourceFiles.some(
+    (file) => !(file.path && isOrchestrationOnlyDatasource(file.path))
+  )) {
+    logWarnRow('No dimensions configured — ABAC filtering disabled for all datasources');
+  }
+
+  return warnings;
+}
+
+/**
+ * Displays dimensions validation for datasources
+ * @function displayDimensionsStep
+ * @param {Array} datasourceFiles - Datasource files
+ * @returns {void}
+ */
+function displayDimensionsStep(datasourceFiles) {
+  if (datasourceFiles.length === 0) {
+    return;
+  }
+
+  logSectionTitle('Dimensions (ABAC)');
+  datasourceFiles.forEach(file => {
+    try {
+      const dsPath = file.path || file.file;
+      if (dsPath && isOrchestrationOnlyDatasource(dsPath)) {
+        logger.log(formatDatasourceListRow('ok', file.file, file.type));
+        logDimLine('orchestration-only (entityType=none) — dimensions N/A');
+        return;
+      }
+      const dimensionsInfo = extractDimensionsFromDatasource(dsPath);
+      if (dimensionsInfo.hasDimensions) {
+        logger.log(formatDatasourceListRow('ok', file.file, file.type));
+        dimensionsInfo.dimensionKeys.forEach(key => {
+          const mapping = dimensionsInfo.dimensions[key];
+          logDimLine(`${key} → ${mapping}`);
+        });
+      } else {
+        logWarnRow(`${file.file} — no dimensions configured`);
+      }
+    } catch {
+      // Skip if file path not available
+    }
+  });
+}
+
+module.exports = {
+  isOrchestrationOnlyDatasource,
+  extractDimensionsFromDatasource,
+  displayDimensionsValidation,
+  displayDimensionsStep
+};

package/lib/validation/validate-display-sections.js

@@ -0,0 +1,276 @@
+/**
+ * @fileoverview Section renderers for validate-display (application, files, RBAC, manifest).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const {
+  headerKeyValue,
+  formatDatasourceListRow,
+  formatBlockingError,
+  successGlyph,
+  failureGlyph
+} = require('../utils/cli-test-layout-chalk');
+const {
+  logSectionTitle,
+  logOkRowRest,
+  logErrorDetail
+} = require('./validate-display-log-helpers');
+
+/**
+ * Displays application validation results
+ * @function displayApplicationValidation
+ * @param {Object} application - Application validation result
+ */
+function displayApplicationValidation(application) {
+  if (!application) {
+    return;
+  }
+
+  logSectionTitle('Application');
+  if (application.valid) {
+    logOkRowRest('Application configuration is valid');
+  } else {
+    logger.log(`  ${failureGlyph()} ${chalk.red('Application configuration has errors:')}`);
+    if (application.errors && application.errors.length > 0) {
+      application.errors.forEach(error => {
+        logErrorDetail(error);
+      });
+    }
+  }
+  if (application.warnings && application.warnings.length > 0) {
+    application.warnings.forEach(warning => {
+      logger.log(`    ${chalk.yellow('⚠')} ${chalk.white(warning)}`);
+    });
+  }
+}
+
+/**
+ * Displays external files validation results
+ * @function displayExternalFilesValidation
+ * @param {Array} externalFiles - External files validation results
+ */
+function displayExternalFilesValidation(externalFiles) {
+  if (!externalFiles || externalFiles.length === 0) {
+    return;
+  }
+
+  logSectionTitle('External integration files');
+  externalFiles.forEach(file => {
+    if (file.valid) {
+      logger.log(formatDatasourceListRow('ok', file.file, file.type));
+    } else {
+      logger.log(formatDatasourceListRow('fail', file.file, file.type));
+      file.errors.forEach(error => {
+        logErrorDetail(error);
+      });
+    }
+    if (file.warnings && file.warnings.length > 0) {
+      file.warnings.forEach(warning => {
+        logger.log(`    ${chalk.yellow('⚠')} ${chalk.white(warning)}`);
+      });
+    }
+  });
+}
+
+/**
+ * Displays RBAC validation results
+ * @function displayRbacValidation
+ * @param {Object} rbac - RBAC validation result
+ */
+function displayRbacValidation(rbac) {
+  if (!rbac) {
+    return;
+  }
+
+  logSectionTitle('RBAC configuration');
+  if (rbac.valid) {
+    logOkRowRest('RBAC configuration is valid');
+  } else {
+    logger.log(`  ${failureGlyph()} ${chalk.red('RBAC configuration has errors:')}`);
+    rbac.errors.forEach(error => {
+      logErrorDetail(error);
+    });
+  }
+  if (rbac.warnings && rbac.warnings.length > 0) {
+    rbac.warnings.forEach(warning => {
+      logger.log(`    ${chalk.yellow('⚠')} ${chalk.white(warning)}`);
+    });
+  }
+}
+
+/**
+ * Displays file validation results (for direct file validation)
+ * @function displayFileValidation
+ * @param {Object} result - Validation result
+ */
+function displayFileValidation(result) {
+  if (!result.file) {
+    return;
+  }
+
+  logSectionTitle('File');
+  logger.log(`  ${headerKeyValue('Path:', result.file)}`);
+  logger.log(`  ${headerKeyValue('Type:', String(result.type))}`);
+  if (result.valid) {
+    logOkRowRest('File is valid');
+  } else {
+    logger.log(`  ${failureGlyph()} ${chalk.red('File has errors:')}`);
+    result.errors.forEach(error => {
+      logErrorDetail(error);
+    });
+  }
+  if (result.warnings && result.warnings.length > 0) {
+    result.warnings.forEach(warning => {
+      logger.log(`    ${chalk.yellow('⚠')} ${chalk.white(warning)}`);
+    });
+  }
+}
+
+/**
+ * Displays aggregated warnings
+ * @function displayAggregatedWarnings
+ * @param {Array} warnings - Array of warning messages
+ */
+function displayAggregatedWarnings(warnings) {
+  if (!warnings || warnings.length === 0) {
+    return;
+  }
+
+  logSectionTitle('Warnings');
+  warnings.forEach(warning => {
+    logger.log(`  ${chalk.yellow('⚠')} ${chalk.white(warning)}`);
+  });
+}
+
+/**
+ * Displays application validation step
+ * @function displayApplicationStep
+ * @param {Object} application - Application validation result
+ * @returns {void}
+ */
+function displayApplicationStep(application) {
+  logSectionTitle('Application');
+  if (application.valid) {
+    logOkRowRest('Application configuration is valid');
+  } else {
+    logger.log(`  ${failureGlyph()} ${chalk.red('Application configuration has errors:')}`);
+    application.errors.forEach(error => {
+      logErrorDetail(error);
+    });
+  }
+  if (application.warnings && application.warnings.length > 0) {
+    application.warnings.forEach(warning => {
+      logger.log(`    ${chalk.yellow('⚠')} ${chalk.white(warning)}`);
+    });
+  }
+}
+
+/**
+ * Displays external integration files step
+ * @function displayComponentsStep
+ * @param {Object} components - Components validation result
+ * @returns {void}
+ */
+function displayComponentsStep(components) {
+  const hasFiles = components.files && components.files.length > 0;
+  const hasErrors = components.errors && components.errors.length > 0;
+  if (!hasFiles && !hasErrors) {
+    return;
+  }
+
+  logSectionTitle('External integration files');
+  if (hasFiles) {
+    components.files.forEach(file => {
+      if (file.valid) {
+        logger.log(formatDatasourceListRow('ok', file.file, file.type));
+      } else {
+        logger.log(formatDatasourceListRow('fail', file.file, file.type));
+      }
+    });
+  }
+  if (hasErrors) {
+    components.errors.forEach(error => {
+      logger.log(formatBlockingError(error));
+    });
+  }
+}
+
+/**
+ * Displays deployment manifest step
+ * @function displayManifestStep
+ * @param {Object} manifest - Manifest validation result
+ * @param {Array} componentFiles - Component files
+ * @returns {void}
+ */
+function displayManifestStep(manifest, componentFiles) {
+  logSectionTitle('Deployment manifest');
+  if (manifest.skipped) {
+    logger.log(`  ${chalk.gray('⏭')} ${chalk.white('Skipped (fix errors above first)')}`);
+  } else if (manifest.valid) {
+    logOkRowRest('Full deployment manifest is valid');
+    if (componentFiles) {
+      const datasourceFiles = componentFiles.filter(f => f.type === 'datasource' || f.type === 'external-datasource');
+      logger.log(`    ${successGlyph()} ${chalk.white('System configuration valid')}`);
+      logger.log(`    ${successGlyph()} ${chalk.white(`${datasourceFiles.length} datasource(s) valid`)}`);
+      logger.log(`    ${successGlyph()} ${chalk.white('Schema validation passed')}`);
+    }
+  } else {
+    logger.log(`  ${failureGlyph()} ${chalk.red('Full deployment manifest validation failed:')}`);
+    const errs = manifest.errors && manifest.errors.length > 0 ? manifest.errors : [];
+    if (errs.length > 0) {
+      errs.forEach(error => {
+        const msg = typeof error === 'string' ? error : String(error);
+        logErrorDetail(msg);
+      });
+    } else {
+      logErrorDetail('No error details available (check schema and manifest structure).');
+    }
+  }
+  if (manifest.warnings && manifest.warnings.length > 0) {
+    manifest.warnings.forEach(warning => {
+      logger.log(`    ${chalk.yellow('⚠')} ${chalk.white(warning)}`);
+    });
+  }
+}
+
+/**
+ * Displays overall validation status
+ * @param {Object} result - Validation result
+ */
+function displayOverallStatus(result) {
+  let hasErrors = result.errors && result.errors.length > 0;
+  if (!hasErrors && result.steps) {
+    const stepErrors = [result.steps.application, result.steps.components, result.steps.manifest]
+      .filter(Boolean)
+      .some(s => s.errors && s.errors.length > 0);
+    if (stepErrors) {
+      hasErrors = true;
+    }
+  }
+  const hasWarnings = result.warnings && result.warnings.length > 0;
+  logger.log('');
+  if (hasErrors) {
+    logger.log(headerKeyValue('Overall:', chalk.red('Failed')));
+  } else if (hasWarnings) {
+    logger.log(headerKeyValue('Overall:', chalk.yellow('Passed with warnings')));
+  } else {
+    logger.log(headerKeyValue('Overall:', chalk.green('Passed')));
+  }
+}
+
+module.exports = {
+  displayApplicationValidation,
+  displayExternalFilesValidation,
+  displayRbacValidation,
+  displayFileValidation,
+  displayAggregatedWarnings,
+  displayApplicationStep,
+  displayComponentsStep,
+  displayManifestStep,
+  displayOverallStatus
+};