@aifabrix/builder 2.46.0 → 2.47.1

package/lib/commands/repair-datasource.js

@@ -12,6 +12,12 @@
 const { repairOpenapiSection } = require('./repair-datasource-openapi');
 const { normalizeAutoRbacOperationKeys } = require('./repair-datasource-auto-rbac');
 const { repairTestPayload } = require('./repair-datasource-test-payload');
+const { repairComV2Manifest } = require('./repair-datasource-com-v2');
+const {
+  isDeprecatedNoneLlmManifest,
+  repairNoneLlmToServiceContract,
+  stripDeprecatedServiceCategory
+} = require('./repair-datasource-service-contract');
 
 const DEFAULT_SYNC = {
   mode: 'pull',
@@ -380,6 +386,41 @@ function sanitizeTestPayloadTopLevel(parsed, changes) {
   return true;
 }
 
+/**
+ * @param {Object} parsed
+ * @param {Object} options
+ * @returns {boolean}
+ */
+function shouldApplyServiceContractRepair(parsed, options) {
+  return (
+    isDeprecatedNoneLlmManifest(parsed) ||
+    (options.serviceContract && parsed?.resourceType === 'llm')
+  );
+}
+
+/**
+ * @param {Object} parsed
+ * @param {Object} options
+ * @param {boolean} none
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function applyOptionalDatasourceRepairs(parsed, options, none, changes) {
+  let updated = false;
+  if (options.expose) {
+    updated = repairExposeFromAttributes(parsed, changes) || updated;
+  }
+  if (!none && options.sync) {
+    updated = repairSyncSection(parsed, changes) || updated;
+  }
+  if (options.test) {
+    sanitizeTestPayloadTopLevel(parsed, changes);
+    updated = repairTestPayload(parsed, changes) || updated;
+    updated = sanitizeTestPayloadTopLevel(parsed, changes) || updated;
+  }
+  return updated;
+}
+
 /**
  * Runs all requested datasource repairs.
  *
@@ -390,32 +431,24 @@ function sanitizeTestPayloadTopLevel(parsed, changes) {
  */
 function repairDatasourceFile(parsed, options = {}, changes = []) {
   const out = Array.isArray(changes) ? changes : [];
-  let updated = false;
-  const none = isNoneEntityType(parsed?.entityType);
+  let updated = stripDeprecatedServiceCategory(parsed, out);
 
-  updated = applyBaseDatasourceRepairs(parsed, none, out) || updated;
-  updated = applyOpenapiDatasourceRepairs(parsed, out) || updated;
-
-  if (options.expose) {
-    updated = repairExposeFromAttributes(parsed, out) || updated;
+  if (shouldApplyServiceContractRepair(parsed, options)) {
+    updated = repairNoneLlmToServiceContract(parsed, out) || updated;
   }
 
-  if (!none && options.sync) {
-    updated = repairSyncSection(parsed, out) || updated;
-  }
+  const none = isNoneEntityType(parsed?.entityType);
 
-  if (options.test) {
-    sanitizeTestPayloadTopLevel(parsed, out);
-    updated = repairTestPayload(parsed, out) || updated;
-    updated = sanitizeTestPayloadTopLevel(parsed, out) || updated;
-  }
+  updated = applyBaseDatasourceRepairs(parsed, none, out) || updated;
+  updated = applyOpenapiDatasourceRepairs(parsed, out) || updated;
+  updated = applyOptionalDatasourceRepairs(parsed, options, none, out) || updated;
 
   return { updated, changes: out };
 }
 
 function applyBaseDatasourceRepairs(parsed, none, changes) {
-  if (none) return false;
-  let updated = false;
+  let updated = repairComV2Manifest(parsed, changes);
+  if (none) return updated;
   updated = repairDimensionBindingShape(parsed, changes) || updated;
   updated = repairRootDimensionsFromAttributes(parsed, changes) || updated;
   updated = repairMetadataSchemaFromAttributes(parsed, changes) || updated;
@@ -444,5 +477,7 @@ module.exports = {
   DEFAULT_SYNC,
   MINIMAL_METADATA_SCHEMA,
   TEST_PAYLOAD_TOP_LEVEL_ALLOW,
-  isNoneEntityType
+  isNoneEntityType,
+  isDeprecatedNoneLlmManifest,
+  repairNoneLlmToServiceContract
 };

package/lib/commands/repair-env-template.js

@@ -77,9 +77,16 @@ function addFromConfiguration(effective, config, prefix, seenNames, systemKey) {
  * @param {string} systemKey - System key for path namespace
  */
 function addFromAuthSecurity(effective, systemParsed, prefix, seenNames, systemKey) {
-  const security = systemParsed.authentication?.security;
+  const { getAuthCredentialTemplate } = require('../utils/authentication-shape');
+  const { isPlatformCatalogKvRef } = require('../utils/platform-kv-ref');
+  const credential = getAuthCredentialTemplate(systemParsed.authentication);
+  const security = credential?.security ?? systemParsed.authentication?.security;
   if (!security || typeof security !== 'object') return;
   for (const key of Object.keys(security)) {
+    const securityVal = security[key];
+    if (typeof securityVal === 'string' && isPlatformCatalogKvRef(securityVal)) {
+      continue;
+    }
     const envName = `KV_${prefix}_${securityKeyToVar(key)}`;
     if (seenNames.has(envName)) continue;
     const pathVal = kvEnvKeyToPath(envName, systemKey);
@@ -316,16 +323,7 @@ function repairEnvTemplate(appPath, systemParsed, systemKey, dryRun, changes, ba
   return true;
 }
 
-/**
- * Returns true if a kv value looks like legacy format (KeyVault suffix or no path segments).
- * @param {string} val - Value from authentication.security or configuration
- * @returns {boolean}
- */
-function isLegacyKvValue(val) {
-  if (typeof val !== 'string' || !val.trim().toLowerCase().startsWith('kv://')) return false;
-  const after = val.trim().slice(5); // after 'kv://'
-  return after.includes('KeyVault') || !after.includes('/');
-}
+const { isLegacyKvValue } = require('../utils/platform-kv-ref');
 
 /**
  * Normalizes authentication.security values to path-style kv:// (kv://systemKey/variable).
@@ -392,7 +390,9 @@ function normalizeConfigurationSection(config, prefix, systemKey, changes) {
 function normalizeSystemFileAuthAndConfig(systemParsed, systemKey, changes) {
   const prefix = systemKeyToKvPrefix(systemKey);
   if (!prefix) return false;
-  const security = systemParsed.authentication?.security;
+  const { getAuthCredentialTemplate } = require('../utils/authentication-shape');
+  const credential = getAuthCredentialTemplate(systemParsed.authentication);
+  const security = credential?.security ?? systemParsed.authentication?.security;
   let updated = (security && typeof security === 'object' && normalizeSecuritySection(security, prefix, systemKey, changes));
   const config = systemParsed.configuration;
   if (Array.isArray(config)) {

package/lib/commands/repair-openapi-sync.js

@@ -15,10 +15,15 @@ const path = require('path');
 const fs = require('fs');
 
 const { resolveControllerUrl } = require('../utils/controller-url');
-const { getDeploymentAuth, requireBearerForDataplanePipeline } = require('../utils/token-manager');
+const {
+  getDeploymentAuth,
+  requireBearerForDataplanePipeline,
+  applyLabDataplaneApiKeyBearer
+} = require('../utils/token-manager');
 const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
 const { uploadFileAs } = require('../utils/file-upload');
 const { listOpenAPIFiles } = require('../api/external-systems.api');
+const { resolveLabDataplaneApiKey } = require('../utils/credential-secrets-env');
 
 async function fileExistsAsync(filePath) {
   try {
@@ -29,11 +34,25 @@ async function fileExistsAsync(filePath) {
   }
 }
 
-async function resolveDataplaneAndAuth(systemKey) {
+function authForJwtOnlyDataplaneRoutes(authConfig) {
+  const copy = { ...(authConfig || {}) };
+  if (copy.type === 'client-token' && resolveLabDataplaneApiKey()) {
+    return applyLabDataplaneApiKeyBearer(copy);
+  }
+  return copy;
+}
+
+async function resolveDataplaneAndAuth(systemKey, preResolved = {}) {
+  if (preResolved.dataplaneUrl && preResolved.authConfig) {
+    const authConfig = authForJwtOnlyDataplaneRoutes(preResolved.authConfig);
+    return { dataplaneUrl: preResolved.dataplaneUrl, authConfig };
+  }
   const { resolveEnvironment } = require('../core/config');
   const environment = await resolveEnvironment();
   const controllerUrl = await resolveControllerUrl();
-  const authConfig = await getDeploymentAuth(controllerUrl, environment, systemKey);
+  const authConfig = authForJwtOnlyDataplaneRoutes(
+    await getDeploymentAuth(controllerUrl, environment, systemKey)
+  );
   requireBearerForDataplanePipeline(authConfig);
   const dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig, { silent: true });
   return { dataplaneUrl, authConfig };
@@ -115,7 +134,10 @@ async function syncOpenApiFilesForMcp(opts) {
   const openapiDir = path.join(appPath, 'openapi');
   if (!(await fileExistsAsync(openapiDir))) return { uploaded: 0, skipped: 0 };
 
-  const { dataplaneUrl, authConfig } = await resolveDataplaneAndAuth(systemKey);
+  const { dataplaneUrl, authConfig } = await resolveDataplaneAndAuth(systemKey, {
+    dataplaneUrl: opts.dataplaneUrl,
+    authConfig: opts.authConfig
+  });
   const existingKeys = await getExistingOpenApiKeys(dataplaneUrl, systemKey, authConfig);
   const uploadedKeys = new Set(existingKeys);
   let uploaded = 0;

package/lib/commands/repair-steps.js

@@ -26,7 +26,9 @@ const {
   buildAuthenticationForRepair,
   mergePreservedAuthVariables,
   repairAuthChangeLabel,
-  auditRepairAuthenticationWarnings
+  auditRepairAuthenticationWarnings,
+  normalizeAuthenticationSchemaShape,
+  getAuthCredentialTemplate
 } = require('./repair-auth-apply');
 
 /**
@@ -45,19 +47,24 @@ function applyAuthMethod(ctx) {
   }
   const existingAuth = ctx.systemParsed.authentication || ctx.systemParsed.auth || {};
   const newAuth = buildAuthenticationForRepair(ctx.systemKey, authOption);
-  const existingVars =
-    existingAuth.variables && typeof existingAuth.variables === 'object'
-      ? existingAuth.variables
-      : {};
-  const mergedVariables = { ...newAuth.variables };
-  mergePreservedAuthVariables(mergedVariables, existingVars);
-  ctx.systemParsed.authentication = {
-    ...newAuth,
-    variables: mergedVariables
-  };
-  if (existingAuth.displayName !== undefined) {
-    ctx.systemParsed.authentication.displayName = existingAuth.displayName;
+  const existingCredential = getAuthCredentialTemplate(existingAuth) || {};
+  const mergedVariables = { ...(newAuth.credential?.variables || {}) };
+  mergePreservedAuthVariables(
+    mergedVariables,
+    existingCredential.variables && typeof existingCredential.variables === 'object'
+      ? existingCredential.variables
+      : existingAuth.variables
+  );
+  if (newAuth.authType === 'credential' && newAuth.credential) {
+    newAuth.credential.variables = mergedVariables;
+    if (existingCredential.displayName !== undefined) {
+      newAuth.credential.displayName = existingCredential.displayName;
+    } else if (existingAuth.displayName !== undefined) {
+      newAuth.credential.displayName = existingAuth.displayName;
+    }
   }
+  ctx.systemParsed.authentication = newAuth;
+  delete ctx.systemParsed.auth;
   ctx.changes.push(`Set authentication method to ${repairAuthChangeLabel(authOption)}`);
   return true;
 }
@@ -70,6 +77,7 @@ function applyAuthMethod(ctx) {
 function persistSystemFileRepair(ctx, flags) {
   const systemFileUpdated =
     flags.authReplaced ||
+    flags.authShapeNormalized ||
     flags.systemAuthConfigNormalized ||
     flags.systemDataSourcesAligned ||
     flags.authVarsRemoved;
@@ -95,6 +103,12 @@ function runRepairSteps(ctx) {
   );
   const authReplaced = applyAuthMethod(ctx);
   updated = updated || authReplaced;
+  const authShapeNormalized = normalizeAuthenticationSchemaShape(
+    ctx.systemParsed,
+    ctx.systemKey,
+    ctx.changes
+  );
+  updated = updated || authShapeNormalized;
   const systemAuthConfigNormalized = normalizeSystemFileAuthAndConfig(
     ctx.systemParsed, ctx.systemKey, ctx.changes
   );
@@ -106,6 +120,7 @@ function runRepairSteps(ctx) {
   );
   const systemFileUpdated = persistSystemFileRepair(ctx, {
     authReplaced,
+    authShapeNormalized,
     systemAuthConfigNormalized,
     systemDataSourcesAligned,
     authVarsRemoved

package/lib/commands/repair-system-alignment.js

@@ -177,13 +177,16 @@ function alignSystemFileDataSources(appPath, systemParsed, datasourceFiles, syst
 function buildAuthVarNames(systemParsed, _systemKey) {
   const names = new Set();
   const auth = systemParsed.authentication;
-  if (auth && typeof auth.variables === 'object') {
-    for (const k of Object.keys(auth.variables)) {
+  if (!auth || typeof auth !== 'object') return names;
+  const credential =
+    auth.credential && typeof auth.credential === 'object' ? auth.credential : auth;
+  if (typeof credential.variables === 'object') {
+    for (const k of Object.keys(credential.variables)) {
       names.add(String(k).toUpperCase().replace(/_/g, ''));
     }
   }
-  if (auth && typeof auth.security === 'object') {
-    for (const k of Object.keys(auth.security)) {
+  if (typeof credential.security === 'object') {
+    for (const k of Object.keys(credential.security)) {
       names.add(securityKeyToVar(k));
     }
   }

package/lib/commands/resource-type.js

@@ -0,0 +1,371 @@
+/**
+ * Resource type catalog commands (Controller).
+ *
+ * Commands:
+ * - aifabrix resource-type create
+ * - aifabrix resource-type import
+ * - aifabrix resource-type get
+ * - aifabrix resource-type list
+ *
+ * @fileoverview Resource type CLI commands
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { resolveControllerUrl } = require('../utils/controller-url');
+const { normalizeControllerUrl, resolveEnvironment } = require('../core/config');
+const { getOrRefreshDeviceToken } = require('../utils/token-manager');
+const {
+  readResourceTypeCreateFile,
+  readResourceTypeCatalogFile
+} = require('../resolvers/resource-type-file');
+const {
+  formatBlockingError,
+  formatSuccessLine,
+  infoLine,
+  headerKeyValue
+} = require('../utils/cli-layout-chalk');
+const {
+  listResourceTypes,
+  getResourceType,
+  createResourceTypeIdempotent
+} = require('../api/resource-types.api');
+
+const RESOURCE_TYPE_KEY_PATTERN = /^[a-z][a-z0-9-]*$/;
+
+/** Parent help for `aifabrix resource-type -h`. */
+const RESOURCE_TYPE_HELP_AFTER = `
+
+Examples:
+  $ aifabrix resource-type create --key customer --display-name "Customer"
+  $ aifabrix resource-type get customer
+  $ aifabrix resource-type list --search customer
+
+Per-command help:  aifabrix resource-type <command> --help
+`;
+
+const RESOURCE_TYPE_IMPORT_HELP_AFTER = `
+
+Examples:
+  $ aifabrix resource-type import --file ./baseline-resourcetypes.json
+  $ aifabrix resource-type import --file /path/to/catalog.json
+
+`;
+
+const RESOURCE_TYPE_CREATE_HELP_AFTER = `
+
+Examples:
+  $ aifabrix resource-type create --key customer --display-name "Customer"
+  $ aifabrix resource-type create --key deal --display-name "Deal" --category business --default-risk-level medium
+  $ aifabrix resource-type create --file ./customer.json
+
+`;
+
+const RESOURCE_TYPE_GET_HELP_AFTER = `
+
+Examples:
+  $ aifabrix resource-type get customer
+  $ aifabrix resource-type get clx1234567890abcdef
+
+`;
+
+const RESOURCE_TYPE_LIST_HELP_AFTER = `
+
+Examples:
+  $ aifabrix resource-type list
+  $ aifabrix resource-type list --page 1 --page-size 50
+  $ aifabrix resource-type list --search customer
+
+`;
+
+/**
+ * @param {string} raw
+ * @returns {string}
+ */
+function requireResourceTypeKey(raw) {
+  const key = String(raw || '').trim();
+  if (!key) {
+    throw new Error('Resource type key is required (--key <key> or --file <path>).');
+  }
+  if (!RESOURCE_TYPE_KEY_PATTERN.test(key)) {
+    throw new Error(
+      'Resource type key must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens.'
+    );
+  }
+  return key;
+}
+
+/**
+ * @param {Object} options
+ * @returns {Promise<{ controllerUrl: string, authConfig: Object }>}
+ */
+async function resolveControllerAndAuth(_options) {
+  const controllerUrl = await resolveControllerUrl();
+  if (!controllerUrl) {
+    throw new Error('Controller URL is required. Run "aifabrix login" first.');
+  }
+  const normalized = normalizeControllerUrl(controllerUrl);
+  const deviceToken = await getOrRefreshDeviceToken(normalized);
+  if (!deviceToken || !deviceToken.token) {
+    throw new Error(
+      `Not authenticated for controller: ${controllerUrl}. ` +
+        'Run "aifabrix login" and try again.'
+    );
+  }
+  return {
+    controllerUrl: deviceToken.controller || normalized,
+    authConfig: { type: 'bearer', token: deviceToken.token }
+  };
+}
+
+async function resolveHeaderContext() {
+  const env = await resolveEnvironment();
+  const controllerUrl = await resolveControllerUrl();
+  const normalized = normalizeControllerUrl(controllerUrl);
+  return { environment: env || 'dev', controllerUrl: normalized };
+}
+
+/**
+ * @param {Object} options
+ * @returns {Object}
+ */
+function buildCreatePayload(options) {
+  let base = {};
+  if (options.file) {
+    base = readResourceTypeCreateFile(options.file);
+  }
+  const payload = { ...base };
+  if (options.key) payload.key = options.key;
+  if (options.displayName) payload.displayName = options.displayName;
+  if (options.description !== undefined) payload.description = options.description;
+  if (options.category) payload.category = options.category;
+  if (options.defaultRiskLevel) payload.defaultRiskLevel = options.defaultRiskLevel;
+  if (options.status) payload.status = options.status;
+  payload.key = requireResourceTypeKey(payload.key);
+  if (!payload.displayName) {
+    throw new Error('displayName is required (--display-name <name> or in --file).');
+  }
+  return payload;
+}
+
+/**
+ * @param {Object} response
+ * @returns {any}
+ */
+function unwrapControllerData(response) {
+  return response?.data?.data ?? response?.data ?? response;
+}
+
+/**
+ * @param {import('commander').Command} rt
+ */
+/**
+ * @param {Object[]} rows
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @returns {Promise<{ created: number, existed: number, total: number }>}
+ */
+async function importResourceTypeRows(rows, controllerUrl, authConfig) {
+  let created = 0;
+  let existed = 0;
+  for (const row of rows) {
+    const payload = { ...row };
+    payload.key = requireResourceTypeKey(payload.key);
+    const out = await createResourceTypeIdempotent(controllerUrl, authConfig, payload);
+    if (out.created) {
+      created += 1;
+      continue;
+    }
+    existed += 1;
+  }
+  return { created, existed, total: rows.length };
+}
+
+function setupResourceTypeImportCommand(rt) {
+  rt
+    .command('import')
+    .description('Import resource types from baseline catalog JSON (idempotent)')
+    .addHelpText('after', RESOURCE_TYPE_IMPORT_HELP_AFTER)
+    .requiredOption('--file <path>', 'Baseline catalog (resourceTypes[]) or JSON array')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth(options);
+        const rows = readResourceTypeCatalogFile(options.file);
+        const summary = await importResourceTypeRows(rows, controllerUrl, authConfig);
+        logger.log(
+          formatSuccessLine(
+            `Resource types imported: ${summary.total} total ` +
+              `(${summary.created} created, ${summary.existed} already existed)`
+          )
+        );
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function setupResourceTypeCreateCommand(rt) {
+  rt
+    .command('create')
+    .description('Create resource type (idempotent; success if it already exists)')
+    .addHelpText('after', RESOURCE_TYPE_CREATE_HELP_AFTER)
+    .option('--file <path>', 'Read resource type create payload from JSON file')
+    .option('--key <key>', 'Catalog key (lowercase letters, digits, hyphens)')
+    .option('--display-name <name>', 'Display name')
+    .option('--description <text>', 'Description')
+    .option(
+      '--category <category>',
+      'business | collaboration | governance | content | communication | people'
+    )
+    .option('--default-risk-level <level>', 'low | medium | high | critical')
+    .option('--status <status>', 'draft | active | deprecated | retired')
+    .action(async(options) => {
+      try {
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth(options);
+        const payload = buildCreatePayload(options);
+        const out = await createResourceTypeIdempotent(controllerUrl, authConfig, payload);
+        const row = unwrapControllerData(out.response);
+        const category = row.category || payload.category || 'business';
+        const risk = row.defaultRiskLevel || payload.defaultRiskLevel || 'medium';
+        if (out.created) {
+          logger.log(
+            formatSuccessLine(`Resource type created: ${row.key} (category: ${category}, risk: ${risk})`)
+          );
+          return;
+        }
+        logger.log(formatSuccessLine(`Resource type exists: ${row.key} (category: ${category}, risk: ${risk})`));
+        logger.log(infoLine('No changes were needed.'));
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+function setupResourceTypeGetCommand(rt) {
+  rt
+    .command('get <resourceTypeIdOrKey>')
+    .description('Get resource type by id or key')
+    .addHelpText('after', RESOURCE_TYPE_GET_HELP_AFTER)
+    .action(async(resourceTypeIdOrKey, options) => {
+      try {
+        const { environment, controllerUrl: headerControllerUrl } = await resolveHeaderContext();
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth(options);
+        const res = await getResourceType(controllerUrl, authConfig, String(resourceTypeIdOrKey).trim());
+        const row = unwrapControllerData(res);
+        logger.log(
+          chalk.bold(`\n🏷️  Resource type in ${environment} environment (${headerControllerUrl}):\n`)
+        );
+        logger.log(headerKeyValue('Key:', row.key || '—'));
+        logger.log(headerKeyValue('Display:', row.displayName || '—'));
+        logger.log(headerKeyValue('Category:', row.category || '—'));
+        logger.log(headerKeyValue('Default risk:', row.defaultRiskLevel || '—'));
+        logger.log(headerKeyValue('Status:', row.status || '—'));
+        if (row.description) {
+          logger.log(headerKeyValue('Description:', row.description));
+        }
+        logger.log('');
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {Array<Object>} items
+ * @param {string} environment
+ * @param {string} controllerUrl
+ */
+function displayResourceTypeList(items, environment, controllerUrl) {
+  logger.log(
+    chalk.bold(`\n🏷️  Resource types in ${environment} environment (${controllerUrl}):\n`)
+  );
+  if (!Array.isArray(items) || items.length === 0) {
+    logger.log(chalk.gray('  No resource types found.\n'));
+    return;
+  }
+
+  const KEY_WIDTH = 22;
+  const DISPLAY_WIDTH = 30;
+  const CATEGORY_WIDTH = 16;
+  const RISK_WIDTH = 10;
+  const STATUS_WIDTH = 12;
+  const SEP_LEN = KEY_WIDTH + DISPLAY_WIDTH + CATEGORY_WIDTH + RISK_WIDTH + STATUS_WIDTH;
+
+  const keyCol = 'Key'.padEnd(KEY_WIDTH);
+  const displayCol = 'Display'.padEnd(DISPLAY_WIDTH);
+  const categoryCol = 'Category'.padEnd(CATEGORY_WIDTH);
+  const riskCol = 'Risk'.padEnd(RISK_WIDTH);
+  const statusCol = 'Status'.padEnd(STATUS_WIDTH);
+  logger.log(chalk.gray(`${keyCol}${displayCol}${categoryCol}${riskCol}${statusCol}`));
+  logger.log(chalk.gray('-'.repeat(SEP_LEN)));
+
+  items.forEach((d) => {
+    const key = (d?.key ?? '—').toString().padEnd(KEY_WIDTH);
+    const displayName = (d?.displayName ?? '—').toString().padEnd(DISPLAY_WIDTH);
+    const category = (d?.category ?? '—').toString().padEnd(CATEGORY_WIDTH);
+    const risk = (d?.defaultRiskLevel ?? '—').toString().padEnd(RISK_WIDTH);
+    const status = (d?.status ?? '—').toString().padEnd(STATUS_WIDTH);
+    logger.log(`${key}${displayName}${category}${risk}${status}`);
+  });
+  logger.log('');
+}
+
+function setupResourceTypeListCommand(rt) {
+  rt
+    .command('list')
+    .description('List resource types')
+    .addHelpText('after', RESOURCE_TYPE_LIST_HELP_AFTER)
+    .option('--page <n>', 'Page', (v) => parseInt(v, 10))
+    .option('--page-size <n>', 'Page size', (v) => parseInt(v, 10))
+    .option('--search <text>', 'Search by key/displayName/description')
+    .option('--category <category>', 'Filter by category')
+    .option('--status <status>', 'Filter by status')
+    .action(async(options) => {
+      try {
+        const { environment, controllerUrl: headerControllerUrl } = await resolveHeaderContext();
+        const { controllerUrl, authConfig } = await resolveControllerAndAuth(options);
+        const res = await listResourceTypes(controllerUrl, authConfig, {
+          page: options.page,
+          pageSize: options.pageSize,
+          search: options.search,
+          category: options.category,
+          status: options.status
+        });
+        const payload = unwrapControllerData(res);
+        const items = payload?.data ?? payload ?? [];
+        displayResourceTypeList(items, environment, headerControllerUrl);
+      } catch (e) {
+        logger.error(formatBlockingError(e.message));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} program
+ */
+function setupResourceTypeCommands(program) {
+  const rt = program
+    .command('resource-type')
+    .description('Manage the Controller Resource Type Catalog (COM)')
+    .addHelpText('after', RESOURCE_TYPE_HELP_AFTER);
+  setupResourceTypeCreateCommand(rt);
+  setupResourceTypeImportCommand(rt);
+  setupResourceTypeGetCommand(rt);
+  setupResourceTypeListCommand(rt);
+}
+
+module.exports = {
+  setupResourceTypeCommands,
+  requireResourceTypeKey,
+  buildCreatePayload,
+  unwrapControllerData,
+  importResourceTypeRows
+};

package/lib/commands/setup-modes.js

@@ -263,7 +263,7 @@ async function runUpPlatform(opts = {}) {
   if (opts.force === true && opts.skipForceClean !== true) {
     const cleanedApps =
       preflight.skipClean !== true
-        ? await upCommon.cleanBuilderAppDirs(PLATFORM_APPS, { silent: true })
+        ? await upCommon.cleanBuilderAppDirs(upCommon.PLATFORM_BUILDER_CLEAN_APP_KEYS, { silent: true })
         : [];
     forceCleanSummary = { forceSummary: authCtx.forceSummary, cleanedApps };
   }