@aifabrix/builder 2.47.4 → 2.48.0

package/lib/utils/promote-dev-docker-image.js

@@ -0,0 +1,170 @@
+/**
+ * Promote a developer-scoped local Docker image to the manifest base repository (tag only).
+ *
+ * @fileoverview Used by `aifabrix build --base --from-dev` and dev-promote workflows
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const config = require('../core/config');
+const { loadAndValidateConfig } = require('./build-helpers');
+const { resolveBuildDockerTagNames } = require('./build-resolve-image');
+const { execWithDockerEnv } = require('./docker-exec');
+const logger = require('./logger');
+const { formatSuccessLine } = require('./cli-test-layout-chalk');
+
+/**
+ * @param {string} value
+ * @returns {string}
+ */
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, '\'\\\'\'')}'`;
+}
+
+/**
+ * @param {string} imageRef - repository:tag
+ * @returns {Promise<boolean>}
+ */
+async function dockerImageRefExists(imageRef) {
+  try {
+    await execWithDockerEnv(`docker image inspect ${shellQuote(imageRef)}`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {string} imageRef
+ * @returns {Promise<string|null>}
+ */
+async function readDockerImageId(imageRef) {
+  try {
+    const { stdout } = await execWithDockerEnv(
+      `docker image inspect --format '{{.Id}}' ${shellQuote(imageRef)}`
+    );
+    const id = stdout.trim();
+    return id || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {string} sourceRef
+ * @param {string} targetRef
+ * @returns {Promise<void>}
+ */
+async function dockerTagImageRef(sourceRef, targetRef) {
+  await execWithDockerEnv(`docker tag ${shellQuote(sourceRef)} ${shellQuote(targetRef)}`);
+}
+
+/**
+ * @param {string} appName
+ * @param {Object} variables
+ * @param {string|number} developerId
+ * @param {Object} options - `tag` (base target), `fromDevTag` (dev source; default `latest`)
+ * @returns {Promise<{ devRef: string, baseRef: string, devTag: string, baseTag: string }>}
+ */
+async function resolveDevAndBaseImageRefs(appName, variables, developerId, options) {
+  const baseTag = options.tag || 'latest';
+  const devTag = options.fromDevTag || 'latest';
+  const { buildImageName: baseName } = await resolveBuildDockerTagNames(appName, variables, developerId, {
+    ...options,
+    base: true
+  });
+  const { buildImageName: devName } = await resolveBuildDockerTagNames(appName, variables, developerId, {
+    ...options,
+    base: false
+  });
+  return {
+    devRef: `${devName}:${devTag}`,
+    baseRef: `${baseName}:${baseTag}`,
+    devTag,
+    baseTag
+  };
+}
+
+/**
+ * Find a local developer-scoped image to promote (dev-build usually tags `latest`).
+ * @param {string} appName
+ * @param {Object} appConfig
+ * @param {string|number} developerId
+ * @param {Object} options
+ * @returns {Promise<{ devRef: string, baseRef: string }|null>}
+ */
+async function resolvePromoteSourceAndTargetRefs(appName, appConfig, developerId, options) {
+  const baseTag = options.tag || 'latest';
+  const devTagCandidates = ['latest'];
+  if (baseTag !== 'latest' && !devTagCandidates.includes(baseTag)) {
+    devTagCandidates.push(baseTag);
+  }
+  for (const fromDevTag of devTagCandidates) {
+    const refs = await resolveDevAndBaseImageRefs(appName, appConfig, developerId, {
+      ...options,
+      fromDevTag
+    });
+    if (await dockerImageRefExists(refs.devRef)) {
+      return { devRef: refs.devRef, baseRef: refs.baseRef };
+    }
+  }
+  return null;
+}
+
+/**
+ * Tag developer-scoped image as manifest base when present locally.
+ * @param {string} appName
+ * @param {Object} options - build options (`base`, `tag`, `registry`, `fromDev`)
+ * @returns {Promise<string|null>} base image ref when promoted/skipped; null when dev image missing
+ */
+async function tryPromoteDevImageToBase(appName, options = {}) {
+  if (options.base !== true) {
+    throw new Error('Promote-from-dev requires --base.');
+  }
+
+  const developerId = await config.getDeveloperId();
+  const idNum = typeof developerId === 'string' ? parseInt(developerId, 10) : Number(developerId);
+  if (!Number.isFinite(idNum) || idNum <= 0) {
+    return null;
+  }
+
+  const { config: appConfig } = await loadAndValidateConfig(appName);
+  const resolved = await resolvePromoteSourceAndTargetRefs(appName, appConfig, developerId, options);
+  if (!resolved) {
+    return null;
+  }
+  const { devRef, baseRef } = resolved;
+
+  const devId = await readDockerImageId(devRef);
+  if (await dockerImageRefExists(baseRef)) {
+    const baseId = await readDockerImageId(baseRef);
+    if (devId && baseId && devId === baseId) {
+      logger.log(formatSuccessLine(`Base image already matches dev build: ${baseRef}`));
+      return baseRef;
+    }
+  }
+
+  await dockerTagImageRef(devRef, baseRef);
+  logger.log(formatSuccessLine(`Promoted dev image to base (tag only): ${baseRef}`));
+  return baseRef;
+}
+
+/**
+ * @param {Object} options
+ * @returns {boolean}
+ */
+function shouldAttemptDevPromote(options) {
+  return options.fromDev === true && options.base === true;
+}
+
+module.exports = {
+  tryPromoteDevImageToBase,
+  shouldAttemptDevPromote,
+  resolveDevAndBaseImageRefs,
+  resolvePromoteSourceAndTargetRefs,
+  dockerImageRefExists,
+  readDockerImageId,
+  dockerTagImageRef
+};

package/lib/utils/remote-docker-env.js

@@ -6,10 +6,12 @@
  * @version 2.0.0
  */
 
+const fs = require('fs');
 const path = require('path');
 const config = require('../core/config');
-const { getCertDir } = require('./dev-cert-helper');
+const { getCertDir, readServerCaPem } = require('./dev-cert-helper');
 const { getConfigDirForPaths } = require('./paths');
+const { resolveRemoteDockerDaemonVerify } = require('./docker-daemon-tls-ca');
 
 function devTlsCertPaths(certDir) {
   return {
@@ -43,10 +45,13 @@ function missingCaError(trimmed, certDir) {
  * When docker-endpoint is set, we do not fall back to the local daemon without that endpoint
  * (avoids accidentally using Docker Desktop while the dev profile targets a remote engine).
  *
- * When **TLS skip-verify** is enabled (config or env) and **ca.pem is missing**, client cert/key are
- * optional: Docker can use DOCKER_TLS_VERIFY=0 with no client certs if the daemon allows it.
- * If **ca.pem is present** (e.g. from Builder Server issue-cert), the daemon certificate is always
- * verified (DOCKER_TLS_VERIFY=1) even when skip-verify is set — better security once a trust anchor exists.
+ * When **TLS skip-verify** is enabled (config or `AIFABRIX_DOCKER_TLS_SKIP_VERIFY`), Docker uses
+ * DOCKER_TLS_VERIFY=0 (client cert/key still sent when present). Skip-verify applies even when ca.pem
+ * exists — ca.pem may hold the internal issue-cert CA while the Docker daemon uses a public/wildcard cert.
+ *
+ * When skip-verify is off and ca.pem exists, the CLI verifies the daemon only if ca.pem includes the
+ * Docker daemon trust chain (merged at dev init/refresh or lazily on first Docker use). Otherwise it
+ * falls back to DOCKER_TLS_VERIFY=0 with client mTLS (public CA daemon on a trusted builder host).
  *
  * Without skip-verify, cert.pem, key.pem, and ca.pem are required in the dev cert directory.
  *
@@ -61,7 +66,6 @@ async function getRemoteDockerEnv() {
   const trimmed = endpoint.trim();
   const certDir = getCertDir(getConfigDirForPaths(), await config.getDeveloperId());
   const { certPath, keyPath, caPath } = devTlsCertPaths(certDir);
-  const fs = require('fs');
   const skipVerify = await config.getDockerTlsSkipVerify();
   const hasClient = fs.existsSync(certPath) && fs.existsSync(keyPath);
   const hasCa = fs.existsSync(caPath);
@@ -71,7 +75,18 @@ async function getRemoteDockerEnv() {
     return { DOCKER_HOST: trimmed, DOCKER_TLS_VERIFY: '0' };
   }
   if (!hasCa && !skipVerify) throw missingCaError(trimmed, certDir);
-  const verifyDaemon = hasCa;
+
+  let verifyDaemon = false;
+  if (!skipVerify && hasCa) {
+    verifyDaemon = await resolveRemoteDockerDaemonVerify({
+      certDir,
+      existingCaPem: readServerCaPem(certDir),
+      dockerEndpoint: trimmed,
+      remoteServerUrl: await config.getRemoteServer(),
+      skipVerify: false
+    });
+  }
+
   return {
     DOCKER_HOST: trimmed,
     DOCKER_TLS_VERIFY: verifyDaemon ? '1' : '0',

package/lib/utils/secrets-helpers.js

@@ -19,7 +19,7 @@ const { updateContainerPortInEnvFile } = require('./env-ports');
 const { buildEnvVarMap } = require('./env-map');
 const { getLocalPortFromPath } = require('./port-resolver');
 const { readYamlAtPath, applyCanonicalSecretsOverride } = require('./secrets-canonical');
-const { collectUniqueKvPathStrings } = require('./secrets-kv-refs');
+const { collectUniqueKvPathStrings, isCommentOrEmptyLine, activeEnvLineForKvScan, envLineWithoutInlineComment } = require('./secrets-kv-refs');
 
 /**
  * Interpolate ${VAR} occurrences with values from envVars map
@@ -34,16 +34,6 @@ function interpolateEnvVars(content, envVars) {
   });
 }
 
-/**
- * Returns true if the line is a comment or empty (should be skipped for kv:// resolution)
- * @param {string} line - Single line
- * @returns {boolean}
- */
-function isCommentOrEmptyLine(line) {
-  const t = line.trim();
-  return t === '' || t.startsWith('#');
-}
-
 /** Regex for kv:// path (allows slashes, e.g. kv://hubspot/clientId) */
 const KV_REF_PATTERN = /kv:\/\/([a-zA-Z0-9_\-/]+)/g;
 
@@ -162,10 +152,11 @@ function collectMissingSecrets(content, secrets, scopedKv = null) {
   const seen = new Set();
   const missing = [];
   for (const line of content.split('\n')) {
-    if (isCommentOrEmptyLine(line)) continue;
+    const scanLine = activeEnvLineForKvScan(line);
+    if (!scanLine) continue;
     let match;
     KV_REF_PATTERN.lastIndex = 0;
-    while ((match = KV_REF_PATTERN.exec(line)) !== null) {
+    while ((match = KV_REF_PATTERN.exec(scanLine)) !== null) {
       const pathStr = match[1];
       if (seen.has(pathStr)) continue;
       seen.add(pathStr);
@@ -222,7 +213,10 @@ function replaceKvInContent(content, secrets, envVars, scopedKv = null) {
   const lines = content.split('\n');
   const result = lines.map(line => {
     if (isCommentOrEmptyLine(line)) return line;
-    return line.replace(KV_REF_PATTERN, (match, pathStr) => {
+    const scanLine = envLineWithoutInlineComment(line);
+    if (!scanLine.trim()) return line;
+    const suffix = line.slice(scanLine.length);
+    const replaced = scanLine.replace(KV_REF_PATTERN, (match, pathStr) => {
       let value = resolveKvRefValue(secretsMap, pathStr, scopedKv?.envKey, effective);
       if ((value === undefined || value === null) && isKvKeyAllowedEmptyWhenAbsent(pathStr)) {
         value = '';
@@ -234,6 +228,7 @@ function replaceKvInContent(content, secrets, envVars, scopedKv = null) {
       }
       return value !== null && value !== undefined ? String(value) : match;
     });
+    return replaced + suffix;
   });
   return result.join('\n');
 }

package/lib/utils/secrets-kv-refs.js

@@ -7,11 +7,51 @@
 
 const KV_REF_PATTERN = /kv:\/\/([a-zA-Z0-9_\-/]+)/g;
 
+/**
+ * True when the line is empty or a full-line comment (# after trim).
+ *
+ * @param {string} line
+ * @returns {boolean}
+ */
 function isCommentOrEmptyLine(line) {
-  const t = line.trim();
+  const t = String(line).trim();
   return t === '' || t.startsWith('#');
 }
 
+/**
+ * Active env line for kv:// scanning: drop inline `#` comments (not inside quotes).
+ *
+ * @param {string} line
+ * @returns {string}
+ */
+function envLineWithoutInlineComment(line) {
+  if (isCommentOrEmptyLine(line)) {
+    return '';
+  }
+  let inSingle = false;
+  let inDouble = false;
+  const raw = String(line);
+  for (let i = 0; i < raw.length; i++) {
+    const c = raw[i];
+    if (c === '\'' && !inDouble) {
+      inSingle = !inSingle;
+    } else if (c === '"' && !inSingle) {
+      inDouble = !inDouble;
+    } else if (c === '#' && !inSingle && !inDouble) {
+      return raw.slice(0, i);
+    }
+  }
+  return raw;
+}
+
+/**
+ * @param {string} line
+ * @returns {string}
+ */
+function activeEnvLineForKvScan(line) {
+  return envLineWithoutInlineComment(line).trim();
+}
+
 /**
  * @param {string} content
  * @returns {string[]}
@@ -23,10 +63,11 @@ function collectUniqueKvPathStrings(content) {
     return out;
   }
   for (const line of content.split('\n')) {
-    if (isCommentOrEmptyLine(line)) continue;
+    const scanLine = activeEnvLineForKvScan(line);
+    if (!scanLine) continue;
     let match;
     KV_REF_PATTERN.lastIndex = 0;
-    while ((match = KV_REF_PATTERN.exec(line)) !== null) {
+    while ((match = KV_REF_PATTERN.exec(scanLine)) !== null) {
       const pathStr = match[1];
       if (!seen.has(pathStr)) {
         seen.add(pathStr);
@@ -38,5 +79,8 @@ function collectUniqueKvPathStrings(content) {
 }
 
 module.exports = {
+  isCommentOrEmptyLine,
+  envLineWithoutInlineComment,
+  activeEnvLineForKvScan,
   collectUniqueKvPathStrings
 };

package/lib/utils/secrets-missing-error.js

@@ -9,15 +9,7 @@
 'use strict';
 
 const { formatMissingSecretsFileInfo } = require('./secrets-helpers');
-
-/**
- * @param {string} line
- * @returns {boolean}
- */
-function isCommentOrEmptyLine(line) {
-  const t = String(line).trim();
-  return t === '' || t.startsWith('#');
-}
+const { isCommentOrEmptyLine } = require('./secrets-kv-refs');
 
 /**
  * @param {string} kvRef - e.g. kv://hubspot-demo/clientSecret

package/lib/utils/token-manager-client-credentials.js

@@ -183,12 +183,22 @@ async function resolveCredentialAppForDeployment(appName) {
 
 /**
  * @param {string} appName
+ * @param {{ secretsFileOnly?: boolean }} [options]
  * @returns {Promise<{ clientId: string, clientSecret: string }|null>}
  */
-async function loadClientCredentials(appName) {
+async function loadClientCredentials(appName, options = {}) {
   if (!appName || typeof appName !== 'string') {
     throw new Error('App name is required and must be a string');
   }
+  if (options.secretsFileOnly === true) {
+    for (const key of credentialAppKeysToTry(appName)) {
+      const fromFile = await readClientCredentialsFromSecretsFileDecrypted(key);
+      if (fromFile) {
+        return fromFile;
+      }
+    }
+    return null;
+  }
   const resolved = await resolveCredentialAppForDeployment(appName);
   return resolved.credentials;
 }

package/lib/utils/worker-sidecars.js

@@ -6,6 +6,8 @@
 
 'use strict';
 
+const fs = require('fs');
+
 const { buildDefaultLocalContainerName } = require('./environment-scoped-resources');
 
 /**
@@ -88,10 +90,31 @@ function getWorkerCompanionAppKeys(appKey, appConfig) {
   return resolveWorkerSidecars(appKey, appConfig).companions.map((entry) => entry.key);
 }
 
+/**
+ * @param {string|undefined|null} envFilePath
+ * @returns {boolean}
+ */
+function isLocalModeFromEnvFile(envFilePath) {
+  if (!envFilePath || typeof envFilePath !== 'string') {
+    return false;
+  }
+  try {
+    const content = fs.readFileSync(envFilePath, 'utf8');
+    const match = content.match(/^LOCAL_MODE=(.+)$/m);
+    if (!match) {
+      return false;
+    }
+    const value = match[1].trim().replace(/^["']|["']$/g, '').toLowerCase();
+    return value === 'true' || value === '1' || value === 'yes';
+  } catch {
+    return false;
+  }
+}
+
 /**
  * @param {string} appKey
  * @param {object} appConfig
- * @param {{ devId: string|number, idNum: number }} ids
+ * @param {{ devId: string|number, idNum: number, envFilePath?: string }} ids
  * @returns {{
  *   enabled: boolean,
  *   worker?: { key: string, containerName: string, command: string },
@@ -99,6 +122,9 @@ function getWorkerCompanionAppKeys(appKey, appConfig) {
  * }}
  */
 function buildWorkerSidecarComposeContext(appKey, appConfig, ids) {
+  if (isLocalModeFromEnvFile(ids.envFilePath)) {
+    return { enabled: false };
+  }
   const sidecars = resolveWorkerSidecars(appKey, appConfig);
   if (!sidecars.enabled) {
     return { enabled: false };
@@ -133,6 +159,7 @@ function imageRunToStartupCommand(imageRun) {
 }
 
 module.exports = {
+  isLocalModeFromEnvFile,
   readImageRunCommand,
   isWorkerStackEnabled,
   resolveWorkerSidecars,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.47.4",
+  "version": "2.48.0",
   "description": "AI Fabrix Local Fabric & Deployment SDK",
   "main": "lib/index.js",
   "bin": {

package/.temp/jest-protection-convert/run-IFN2nv/.protection/hubspot-companies.json

@@ -1 +0,0 @@
-{"apiVersion":"dataplane.aifabrix.ai/v1","kind":"Protection","metadata":{"key":"hubspot-country-sales","displayName":"HubSpot Country Sales Access"},"spec":{"enabled":true,"datasourceKey":"hubspot-companies","mode":"replaceForSource","rules":[{"key":"sales-country-users","principal":{"type":"group","expression":"Sales {{fk.country.metadata.iso3}} Users"},"grants":[{"dimensionKey":"country","valueExpression":"{{fk.country.metadata.iso2}}"}]}]}}

package/.temp/jest-protection-convert/run-IvmKLO/.protection/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-convert/run-SdvblF/.protection/hubspot-companies.json

@@ -1 +0,0 @@
-{"kind":"Protection"}

package/.temp/jest-protection-convert/run-b51TsW/.protection/hubspot-companies.json

@@ -1 +0,0 @@
-{"apiVersion":"dataplane.aifabrix.ai/v1","kind":"Protection","metadata":{"key":"hubspot-country-sales","displayName":"HubSpot Country Sales Access"},"spec":{"enabled":true,"datasourceKey":"hubspot-companies","mode":"replaceForSource","rules":[{"key":"sales-country-users","principal":{"type":"group","expression":"Sales {{fk.country.metadata.iso3}} Users"},"grants":[{"dimensionKey":"country","valueExpression":"{{fk.country.metadata.iso2}}"}]}]}}

package/.temp/jest-protection-convert/run-fiLmb1/.protection/hubspot-companies.json

@@ -1 +0,0 @@
-{"kind":"Protection"}

package/.temp/jest-protection-convert/run-qYGHMU/.protection/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-Mq5re8/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-f3u4YL/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-iQtd1O/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-mdmz5M/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-qbKYxQ/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-yzlJy6/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/validation/summary.txt

@@ -1,5 +0,0 @@
-lint:fix exit=0
-lint exit=0
-test exit=0
-miso typecheck exit=0
-miso build exit=0