@aifabrix/builder 2.49.0 → 2.49.1

package/.cursor/skills/README.md

@@ -0,0 +1,14 @@
+# aifabrix-builder Cursor skills
+
+| Skill | Command | Purpose |
+| ----- | ------- | ------- |
+| [builder-push-github](builder-push-github/SKILL.md) | `/push-github` | Release branch CI + optional NPM deploy PR |
+| [builder-repair-release](builder-repair-release/SKILL.md) | `/repair-release` | Version bump + CHANGELOG |
+| [builder-validate-tests](builder-validate-tests/SKILL.md) | `/validate-tests` | Lint + Jest fix loop |
+| [builder-validate-tests-ci](builder-validate-tests-ci/SKILL.md) | `/validate-tests.ci` | `build:ci` / GitHub parity |
+| [builder-validate-code](builder-validate-code/SKILL.md) | `/validate-code` | Code analysis → improvement plans |
+| [builder-validate-plan](builder-validate-plan/SKILL.md) | `/validate-plan` | Pre-implementation plan validation |
+| [builder-validate-implementation](builder-validate-implementation/SKILL.md) | `/validate-implementation` | Post-implementation plan validation |
+| [builder-validate-knowledgebase](builder-validate-knowledgebase/SKILL.md) | `/validate-knowledgebase` | `docs/` + schema validation |
+
+Commands live in `.cursor/commands/`.

package/lib/cli/infra-guided-auth.js

@@ -123,10 +123,14 @@ async function runGuidedDataplaneWithAuthRecovery(
   ui = {}
 ) {
   const onSpinnerText = typeof ui.onSpinnerText === 'function' ? ui.onSpinnerText : null;
+  const dataplaneOpts = {
+    ...options,
+    platformInstall: true,
+    skipInfraCheck: true,
+    ...(onSpinnerText ? { onPollText: onSpinnerText } : {})
+  };
   try {
-    await withMutedLogger(() =>
-      handleUpDataplane({ ...options, platformInstall: true, skipInfraCheck: true })
-    );
+    await withMutedLogger(() => handleUpDataplane(dataplaneOpts));
   } catch (error) {
     if (!isAuthenticationError(error)) {
       throw error;
@@ -154,9 +158,7 @@ async function runGuidedDataplaneWithAuthRecovery(
     if (onSpinnerText) {
       onSpinnerText('Validating Dataplane...');
     }
-    await withMutedLogger(() =>
-      handleUpDataplane({ ...options, platformInstall: true, skipInfraCheck: true })
-    );
+    await withMutedLogger(() => handleUpDataplane(dataplaneOpts));
   }
 }
 

package/lib/cli/infra-guided.js

@@ -104,6 +104,9 @@ async function waitForAppReady(appName, opts = {}) {
   if (userCfg && userCfg.traefik === true) {
     healthRunOpts.traefikEnabled = true;
   }
+  if (typeof opts.onPollText === 'function') {
+    healthRunOpts.onPollText = opts.onPollText;
+  }
   await healthCheck.waitForHealthCheck(appName, timeoutSeconds, hostPort, appConfig, false, healthRunOpts);
 }
 
@@ -180,7 +183,10 @@ async function runGuidedUpMiso(options, handleUpMiso) {
   stopSpinnerSuccess(kcSpin, 'Keycloak ready');
   logger.log('');
   const mcSpin = startSpinner('Starting Miso Controller...');
-  await waitForAppReady('miso-controller', { timeoutSeconds: 120 });
+  await waitForAppReady('miso-controller', {
+    timeoutSeconds: 120,
+    onPollText: createSpinnerTextUpdater(mcSpin)
+  });
   stopSpinnerSuccess(mcSpin, 'Miso Controller ready');
   await logMisoReadyFooter();
   await validateAppErrorLogs(['miso-controller']);
@@ -242,7 +248,10 @@ async function runGuidedKeycloakAndMisoControllerPhase(options, handleUpMiso) {
   logger.log('');
   emitSystemBuilderAppManifestLineIfTTY(logger, 'miso-controller');
   const mcSpin = startSpinner('Starting Miso Controller...');
-  await waitForAppReady('miso-controller', { timeoutSeconds: 120 });
+  await waitForAppReady('miso-controller', {
+    timeoutSeconds: 120,
+    onPollText: createSpinnerTextUpdater(mcSpin)
+  });
   stopSpinnerSuccess(mcSpin, 'Miso Controller ready');
   logger.log('');
 }

package/lib/commands/teardown.js

@@ -120,17 +120,15 @@ function cleanAifabrixSystemDir() {
 }
 
 /**
- * Remove materialized `builder/` trees (aifabrix-work, aifabrix-home / config dir, cwd).
- * Complements {@link cleanAifabrixSystemDir} when `builder/` lives under `aifabrix-work` outside
- * the config directory.
+ * Remove materialized `builder/` trees under home/work and config dir only.
+ * Does not remove `cwd/builder` in product repos (e.g. aifabrix-dataplane/builder/dataplane).
  *
  * @returns {{ removed: string[], failed: string[] }}
  */
 function cleanMaterializedBuilderTrees() {
   const candidates = [
     pathsUtil.getBuilderRoot(),
-    path.join(pathsUtil.getAifabrixSystemDir(), 'builder'),
-    path.join(process.cwd(), 'builder')
+    path.join(pathsUtil.getAifabrixSystemDir(), 'builder')
   ];
   const seen = new Set();
   const removed = [];

package/lib/commands/up-common.js

@@ -242,26 +242,21 @@ function isUnderAllowedBuilderRoot(resolvedAppPath, allowedRoots) {
 }
 
 /**
- * Removes builder app directories for the given app names. Only removes paths under an allowed
- * builder root (project `builder/` or `~/.aifabrix/builder/`) to prevent path traversal.
- * Uses {@link pathsUtil.getBuilderPath} for each app (system apps may resolve under the config dir).
+ * Removes platform app directories under the home/work materialized `builder/` root only.
+ * Never deletes `cwd/builder` trees in product repos (e.g. aifabrix-miso/builder/miso-controller).
  *
  * @param {string[]} appNames - Application names (e.g. ['keycloak', 'miso-controller', 'dataplane'])
  * @returns {Promise<void>}
- * @throws {Error} If any path is outside allowed builder roots (path traversal attempt)
+ * @throws {Error} If any path is outside the home builder root (path traversal attempt)
  */
 async function cleanBuilderAppDirs(appNames, opts = {}) {
   const silent = Boolean(opts.silent);
   if (!Array.isArray(appNames) || appNames.length === 0) return;
-  const allowedRoots = uniqueResolvedRoots([
-    path.join(process.cwd(), 'builder'),
-    pathsUtil.getBuilderRoot(),
-    pathsUtil.getSystemBuilderRoot()
-  ]);
+  const allowedRoots = uniqueResolvedRoots([pathsUtil.getSystemBuilderRoot()]);
   const cleaned = [];
   for (const appName of appNames) {
     if (!appName || typeof appName !== 'string') continue;
-    const appPath = path.resolve(pathsUtil.getBuilderPath(appName));
+    const appPath = path.resolve(pathsUtil.getHomeBuilderAppPath(appName));
     if (!isUnderAllowedBuilderRoot(appPath, allowedRoots)) {
       throw new Error(
         `Path ${appPath} is outside allowed builder roots (${allowedRoots.join(', ')}); refusing to clean`
@@ -303,7 +298,9 @@ async function ensureAppFromTemplate(appName, opts = {}) {
   }
   const silent = Boolean(opts.silent);
 
-  const appPath = pathsUtil.getBuilderPath(appName);
+  const appPath = pathsUtil.isSystemBuilderAppName(appName)
+    ? pathsUtil.getHomeBuilderAppPath(appName)
+    : pathsUtil.getBuilderPath(appName);
   const primaryCopied = await ensureTemplateAtPath(appName, appPath);
   if (primaryCopied && !silent) {
     logger.log(chalk.blue(`Creating builder/${appName} from template...`));

package/lib/commands/up-dataplane.js

@@ -41,6 +41,17 @@ const {
 } = require('./up-dataplane-bootstrap');
 
 const CONTROLLER_HEALTH_PATH = '/health';
+/** Automation / af-server: wait for edge routing before dataplane (nginx + Traefik). */
+const CONTROLLER_HEALTH_RETRY_ATTEMPTS = 30;
+const CONTROLLER_HEALTH_RETRY_DELAY_MS = 2000;
+
+/**
+ * @param {number} ms
+ * @returns {Promise<void>}
+ */
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 
 /**
  * Check if controller is reachable (health endpoint).
@@ -76,19 +87,46 @@ function promptForControllerUrl(currentUrl) {
 }
 
 /**
- * Resolve controller URL and ensure it is healthy; if not, prompt once for new URL.
- * @returns {Promise<string>} Controller URL to use
- * @throws {Error} If controller unavailable and user aborts or new URL still unhealthy
+ * Poll controller /health until success or attempts exhausted.
+ * @param {string} baseUrl - Controller base URL (no trailing slash)
+ * @param {{ attempts?: number, delayMs?: number }} [opts]
+ * @returns {Promise<boolean>}
  */
-async function resolveControllerUrlWithHealthCheck() {
-  let controllerUrl = await resolveControllerUrl();
-  controllerUrl = controllerUrl.replace(/\/+$/, '');
-
-  let healthy = await isControllerHealthy(controllerUrl);
-  if (healthy) {
-    return controllerUrl;
+async function waitForControllerHealthy(baseUrl, opts = {}) {
+  const attempts = opts.attempts ?? CONTROLLER_HEALTH_RETRY_ATTEMPTS;
+  const delayMs = opts.delayMs ?? CONTROLLER_HEALTH_RETRY_DELAY_MS;
+  const normalized = baseUrl.replace(/\/+$/, '');
+  for (let i = 0; i < attempts; i += 1) {
+    if (await isControllerHealthy(normalized)) {
+      return true;
+    }
+    if (i < attempts - 1) {
+      await sleep(delayMs);
+    }
   }
+  return false;
+}
+
+/**
+ * @param {string} controllerUrl
+ * @returns {string}
+ */
+function buildControllerUnavailableMessage(controllerUrl) {
+  return (
+    `Controller at ${controllerUrl} is not responding after ${CONTROLLER_HEALTH_RETRY_ATTEMPTS} health checks ` +
+    `(~${Math.round((CONTROLLER_HEALTH_RETRY_ATTEMPTS * CONTROLLER_HEALTH_RETRY_DELAY_MS) / 1000)}s). ` +
+    'Miso may be up on localhost before nginx/Traefik routes are ready. ' +
+    'On the builder host run: sudo systemctl start aifabrix-sync-dev-traefik-nginx.service ' +
+    'then retry: aifabrix up-dataplane --force'
+  );
+}
 
+/**
+ * Prompt for a new controller URL and verify it responds to health checks.
+ * @param {string} controllerUrl - URL that failed the initial health check
+ * @returns {Promise<string>} Verified controller URL
+ */
+async function promptForHealthyControllerUrl(controllerUrl) {
   logger.log(chalk.yellow(`\nController at ${controllerUrl} is not responding (health check failed).\n`));
   const newUrl = await promptForControllerUrl(controllerUrl);
   if (!newUrl) {
@@ -103,7 +141,7 @@ async function resolveControllerUrlWithHealthCheck() {
 
   await setControllerUrl(newUrl);
   const normalizedNew = newUrl.trim().replace(/\/+$/, '');
-  healthy = await isControllerHealthy(normalizedNew);
+  const healthy = await isControllerHealthy(normalizedNew);
   if (!healthy) {
     throw new Error(`Controller at ${normalizedNew} is not responding. Ensure the controller is running and reachable, then run "aifabrix up-dataplane" again.`);
   }
@@ -112,6 +150,28 @@ async function resolveControllerUrlWithHealthCheck() {
   return normalizedNew;
 }
 
+/**
+ * Resolve controller URL and ensure it is healthy; if not, prompt once for new URL (TTY only).
+ * @returns {Promise<string>} Controller URL to use
+ * @throws {Error} If controller unavailable and user aborts or new URL still unhealthy
+ */
+async function resolveControllerUrlWithHealthCheck() {
+  let controllerUrl = await resolveControllerUrl();
+  controllerUrl = controllerUrl.replace(/\/+$/, '');
+
+  const healthy = await waitForControllerHealthy(controllerUrl);
+  if (healthy) {
+    return controllerUrl;
+  }
+
+  const isInteractive = Boolean(process.stdin && process.stdin.isTTY);
+  if (!isInteractive) {
+    throw new Error(buildControllerUnavailableMessage(controllerUrl));
+  }
+
+  return promptForHealthyControllerUrl(controllerUrl);
+}
+
 async function resolveUpDataplaneAuthContext(options, environmentKey) {
   if (options.skipInfraCheck !== true) {
     await assertDevInfraUp();
@@ -327,14 +387,22 @@ async function handleUpDataplane(options = {}) {
 
   const { runEnvKey, portOverride } = await computeDataplaneRunOverrides(options);
 
-  await app.runApp('dataplane', {
+  const runAppOpts = {
     skipEnvOutputPath: true,
     env: runEnvKey,
     port: portOverride,
     registry: options.registry || undefined,
     base: options.base !== false,
     skipManifestMetadataLine: true
-  });
+  };
+  if (options.platformInstall === true) {
+    if (typeof options.onPollText === 'function') {
+      runAppOpts.onPollText = options.onPollText;
+    } else {
+      runAppOpts.silentPoll = true;
+    }
+  }
+  await app.runApp('dataplane', runAppOpts);
 
   if (options.platformInstall !== true) {
     logger.log(formatSuccessParagraph('up-dataplane complete. Dataplane is registered, deployed in dev, and running locally.'));

package/lib/commands/up-miso.js

@@ -57,11 +57,15 @@ async function runMisoApps(options) {
     base: useBaseImage,
     skipManifestMetadataLine: true
   };
-  const keycloakRunOpts = { ...common };
+  const platformPollOpts =
+    options.platformInstall === true
+      ? { silentPoll: true }
+      : {};
+  const keycloakRunOpts = { ...common, ...platformPollOpts };
   if (imageMap.keycloak) {
     keycloakRunOpts.image = imageMap.keycloak;
   }
-  const misoRunOpts = { ...common };
+  const misoRunOpts = { ...common, ...platformPollOpts };
   if (imageMap['miso-controller']) {
     misoRunOpts.image = imageMap['miso-controller'];
   }

package/lib/utils/health-check-poll-ui.js

@@ -26,36 +26,50 @@ function buildHealthCheckPollText(attemptIndex, maxAttempts) {
   );
 }
 
-/**
- * @param {number} maxAttempts
- * @returns {{ usesSpinner: boolean, onWaiting: (attemptIndex: number) => void, finish: () => void }}
- */
-function createHealthCheckPollHandlers(maxAttempts) {
-  if (shouldUseHealthCheckPollSpinner()) {
-    const ora = require('ora');
-    const spinner = ora({
-      text: buildHealthCheckPollText(0, maxAttempts),
-      spinner: 'dots'
-    });
-    let started = false;
-    return {
-      usesSpinner: true,
-      onWaiting: (attemptIndex) => {
-        if (!started) {
-          spinner.start();
-          started = true;
-        }
-        spinner.text = buildHealthCheckPollText(attemptIndex, maxAttempts);
-      },
-      finish: () => {
-        if (started) {
-          spinner.stop();
-          process.stdout.write('\n');
-        }
+function createSilentHealthCheckPollHandlers() {
+  return {
+    usesSpinner: false,
+    onWaiting: () => {},
+    finish: () => {}
+  };
+}
+
+function createDelegatedHealthCheckPollHandlers(maxAttempts, onPollText) {
+  return {
+    usesSpinner: false,
+    onWaiting: (attemptIndex) => {
+      onPollText(buildHealthCheckPollText(attemptIndex, maxAttempts));
+    },
+    finish: () => {}
+  };
+}
+
+function createOraHealthCheckPollHandlers(maxAttempts) {
+  const ora = require('ora');
+  const spinner = ora({
+    text: buildHealthCheckPollText(0, maxAttempts),
+    spinner: 'dots'
+  });
+  let started = false;
+  return {
+    usesSpinner: true,
+    onWaiting: (attemptIndex) => {
+      if (!started) {
+        spinner.start();
+        started = true;
       }
-    };
-  }
+      spinner.text = buildHealthCheckPollText(attemptIndex, maxAttempts);
+    },
+    finish: () => {
+      if (started) {
+        spinner.stop();
+        process.stdout.write('\n');
+      }
+    }
+  };
+}
 
+function createCarriageReturnHealthCheckPollHandlers(maxAttempts) {
   let lastLine = '';
   return {
     usesSpinner: false,
@@ -77,6 +91,27 @@ function createHealthCheckPollHandlers(maxAttempts) {
   };
 }
 
+/**
+ * @param {number} maxAttempts
+ * @param {{ silent?: boolean, onPollText?: (text: string) => void }} [options]
+ * @returns {{ usesSpinner: boolean, onWaiting: (attemptIndex: number) => void, finish: () => void }}
+ */
+function createHealthCheckPollHandlers(maxAttempts, options = {}) {
+  const silent = options && options.silent === true;
+  const onPollText = options && typeof options.onPollText === 'function' ? options.onPollText : null;
+
+  if (silent) {
+    return createSilentHealthCheckPollHandlers();
+  }
+  if (onPollText) {
+    return createDelegatedHealthCheckPollHandlers(maxAttempts, onPollText);
+  }
+  if (shouldUseHealthCheckPollSpinner()) {
+    return createOraHealthCheckPollHandlers(maxAttempts);
+  }
+  return createCarriageReturnHealthCheckPollHandlers(maxAttempts);
+}
+
 module.exports = {
   buildHealthCheckPollText,
   createHealthCheckPollHandlers,

package/lib/utils/health-check.js

@@ -331,29 +331,26 @@ async function performHealthCheckAttemptForUrls(
   return { ok: false, resolvedIndex: -1 };
 }
 
-async function waitForHealthCheck(appName, timeout = 90, port = null, config = null, debug = false, runOptions = {}) {
-  await waitForDbInit(appName);
-
-  const healthCheckPort = await determineHealthCheckPort(port, appName, debug);
-  const { maxAttempts } = buildHealthCheckConfig(healthCheckPort, config, timeout, debug);
-  const { urlsToTry, skippedPublicHealthUrl } = await computePreferredHealthCheckUrls(
-    appName,
-    healthCheckPort,
-    config,
-    runOptions,
-    debug
-  );
-
-  if (skippedPublicHealthUrl && urlsToTry.length === 1 && debug) {
-    logger.log(
-      chalk.gray(
-        `ℹ Health check: public URL not used (DNS): ${skippedPublicHealthUrl}. ` +
-          `Probing ${urlsToTry[0]} only until the app responds.`
-      )
-    );
+function resolveHealthCheckPollOptions(runOptions = {}) {
+  const pollOptions = {};
+  if (runOptions.silentPoll === true) {
+    pollOptions.silent = true;
+  }
+  if (typeof runOptions.onPollText === 'function') {
+    pollOptions.onPollText = runOptions.onPollText;
   }
+  return pollOptions;
+}
 
-  const poll = createHealthCheckPollHandlers(maxAttempts);
+async function pollUntilHealthCheckPasses({
+  urlsToTry,
+  maxAttempts,
+  timeout,
+  debug,
+  skippedPublicHealthUrl,
+  pollOptions = {}
+}) {
+  const poll = createHealthCheckPollHandlers(maxAttempts, pollOptions);
   const pollAttemptOpts = { suppressSuccessLog: true };
 
   for (let attempts = 0; attempts < maxAttempts; attempts++) {
@@ -389,6 +386,38 @@ async function waitForHealthCheck(appName, timeout = 90, port = null, config = n
   throw new Error(`Health check timeout after ${timeout} seconds`);
 }
 
+async function waitForHealthCheck(appName, timeout = 90, port = null, config = null, debug = false, runOptions = {}) {
+  await waitForDbInit(appName);
+
+  const healthCheckPort = await determineHealthCheckPort(port, appName, debug);
+  const { maxAttempts } = buildHealthCheckConfig(healthCheckPort, config, timeout, debug);
+  const { urlsToTry, skippedPublicHealthUrl } = await computePreferredHealthCheckUrls(
+    appName,
+    healthCheckPort,
+    config,
+    runOptions,
+    debug
+  );
+
+  if (skippedPublicHealthUrl && urlsToTry.length === 1 && debug) {
+    logger.log(
+      chalk.gray(
+        `ℹ Health check: public URL not used (DNS): ${skippedPublicHealthUrl}. ` +
+          `Probing ${urlsToTry[0]} only until the app responds.`
+      )
+    );
+  }
+
+  await pollUntilHealthCheckPasses({
+    urlsToTry,
+    maxAttempts,
+    timeout,
+    debug,
+    skippedPublicHealthUrl,
+    pollOptions: resolveHealthCheckPollOptions(runOptions)
+  });
+}
+
 /**
  * Checks if port is available
  * @param {number} port - Port number to check

package/lib/utils/paths.js

@@ -459,13 +459,23 @@ function isSystemBuilderAppName(appName) {
 }
 
 /**
- * `builder/<appName>` under {@link getAppsMaterializationParent} (same tree as {@link getSystemBuilderRoot}).
+ * Home / work materialization path: `(aifabrix-work | aifabrix-home)/builder/<appName>`.
+ * Used by setup, teardown, and template copy — never the product-repo `cwd/builder` tree.
  *
  * @param {string} appName
  * @returns {string}
  */
+function getHomeBuilderAppPath(appName) {
+  return path.join(getAppsMaterializationParent(), 'builder', appName);
+}
+
+/**
+ * @deprecated Prefer {@link getHomeBuilderAppPath}; same path.
+ * @param {string} appName
+ * @returns {string}
+ */
 function getProjectBuilderAppPath(appName) {
-  return path.join(getIntegrationBuilderBaseDir(), 'builder', appName);
+  return getHomeBuilderAppPath(appName);
 }
 
 /**
@@ -630,38 +640,25 @@ function resolveBuildContext(configDir, buildContext) {
 }
 
 /**
- * `cwd/builder/<appName>` when present as a directory and allowed (platform empty stubs skipped).
+ * `cwd/builder/<appName>` when the running folder has a resolvable application manifest.
  *
  * @param {string} appName
  * @returns {string|null}
  */
-function tryCwdBuilderPathOrNull(appName) {
-  const cwdApp = path.join(path.resolve(process.cwd()), 'builder', appName);
-  try {
-    if (!nodeFs().existsSync(cwdApp)) {
-      return null;
-    }
-    const st = nodeFs().statSync(cwdApp);
-    if (!st || typeof st.isDirectory !== 'function' || !st.isDirectory()) {
-      return null;
-    }
-    if (isSystemBuilderAppName(appName) && !isProjectBuilderAppDirectory(cwdApp)) {
-      return null;
-    }
-    return cwdApp;
-  } catch {
+function getCwdBuilderAppPath(appName) {
+  if (!appName || typeof appName !== 'string') {
     return null;
   }
+  const cwdApp = path.join(path.resolve(process.cwd()), 'builder', appName);
+  return isProjectBuilderAppDirectory(cwdApp) ? cwdApp : null;
 }
 
 /**
- * Gets the builder folder path:
- * 1. Plan 141 Tier‑1: `cwd/builder/<app>` or `cwd/integration/<app>` when a resolvable application manifest exists.
- * 2. Else **`cwd/builder/<app>`** when that directory exists. For **platform** apps (`keycloak`,
- *    `miso-controller`, `dataplane`), an **empty** cwd stub is ignored so materialization under
- *    `(work|home)/builder` still wins.
- * 3. Else **`(aifabrix-work or aifabrix-home)/builder/<appName>`** — used by setup / `up-platform` /
- *    `up-miso` / `up-dataplane` for template materialization.
+ * Gets the builder folder path for run/deploy/register:
+ * 1. **`cwd/builder/<app>`** when a resolvable application manifest exists in the running folder.
+ * 2. Else **`(aifabrix-work | aifabrix-home)/builder/<app>`** (setup materializes templates there).
+ *
+ * Teardown and setup `--force` clean use {@link getHomeBuilderAppPath} only (never product-repo trees).
  *
  * @param {string} appName - Application name
  * @returns {string} Absolute path to builder directory
@@ -670,20 +667,11 @@ function getBuilderPath(appName) {
   if (!appName || typeof appName !== 'string') {
     throw new Error('App name is required and must be a string');
   }
-  const { resolveApplicationManifestPathSync } = require('./manifest-location');
-  const manifestHit = resolveApplicationManifestPathSync({
-    targetKey: appName,
-    mode: 'auto',
-    cwd: process.cwd()
-  });
-  if (manifestHit && (manifestHit.tier === 'cwd-builder' || manifestHit.tier === 'cwd-integration')) {
-    return manifestHit.absolutePath;
-  }
-  const cwdHit = tryCwdBuilderPathOrNull(appName);
+  const cwdHit = getCwdBuilderAppPath(appName);
   if (cwdHit) {
     return cwdHit;
   }
-  return path.join(getAppsMaterializationParent(), 'builder', appName);
+  return getHomeBuilderAppPath(appName);
 }
 
 /**
@@ -918,6 +906,8 @@ module.exports = {
   getIntegrationBuilderBaseDir,
   SYSTEM_BUILDER_APP_KEYS,
   isSystemBuilderAppName,
+  getHomeBuilderAppPath,
+  getCwdBuilderAppPath,
   getProjectBuilderAppPath,
   getSystemPlatformMaterializationParent,
   getSystemBuilderRoot,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.49.0",
+  "version": "2.49.1",
   "description": "AI Fabrix Local Fabric & Deployment SDK",
   "main": "lib/index.js",
   "bin": {

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python  # Explicitly specify Python language
-  version: 1.9.5
+  version: 2.0.0
 
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build dataplane -t 1.0.0 then tag: 1.0.0)

package/templates/applications/dataplane/env.template

@@ -26,6 +26,7 @@ LOCAL_MODE=false
 # Celery worker process tuning (dataplane-worker container; optional overrides)
 # CELERY_WORKER_QUEUES=external_data,document_sync,document_processing,audit
 # CELERY_WORKER_CONCURRENCY=2
+# CELERY_WORKER_RUNTIME is set automatically by python -m app.core.celery_worker_main (NullPool per task).
 # CELERY_LOG_LEVEL=info
 
 # When API_KEY is set, a matching Bearer token bypasses OAuth2 validation
@@ -42,7 +43,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=1.9.5
+VERSION=2.0.0
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5

package/templates/applications/miso-controller/env.template

@@ -157,6 +157,8 @@ WAIT_FOR_KEYCLOAK=true
 # For production: use public domain (e.g., https://miso.example.com)
 # url://public includes front-door path from application.yaml (e.g. /controller).
 MISO_WEB_SERVER_URL=url://public
+# Provider-grant OAuth redirect_uri base (Azure/start-dev also set this explicitly; code falls back to MISO_WEB_SERVER_URL)
+CONTROLLER_BASE_URL=url://public
 MISO_CONTROLLER_URL=url://internal
 MISO_RELATIVE_PATH=url://vdir-public
 ALLOWED_ORIGINS=http://localhost:*,url://host-public,url://host-private,url://dataplane-host-public,url://dataplane-host-private

package/.temp/jest-protection-convert/run-IFN2nv/.protection/hubspot-companies.json

@@ -1 +0,0 @@
-{"apiVersion":"dataplane.aifabrix.ai/v1","kind":"Protection","metadata":{"key":"hubspot-country-sales","displayName":"HubSpot Country Sales Access"},"spec":{"enabled":true,"datasourceKey":"hubspot-companies","mode":"replaceForSource","rules":[{"key":"sales-country-users","principal":{"type":"group","expression":"Sales {{fk.country.metadata.iso3}} Users"},"grants":[{"dimensionKey":"country","valueExpression":"{{fk.country.metadata.iso2}}"}]}]}}

package/.temp/jest-protection-convert/run-IvmKLO/.protection/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-convert/run-SdvblF/.protection/hubspot-companies.json

@@ -1 +0,0 @@
-{"kind":"Protection"}

package/.temp/jest-protection-convert/run-b51TsW/.protection/hubspot-companies.json

@@ -1 +0,0 @@
-{"apiVersion":"dataplane.aifabrix.ai/v1","kind":"Protection","metadata":{"key":"hubspot-country-sales","displayName":"HubSpot Country Sales Access"},"spec":{"enabled":true,"datasourceKey":"hubspot-companies","mode":"replaceForSource","rules":[{"key":"sales-country-users","principal":{"type":"group","expression":"Sales {{fk.country.metadata.iso3}} Users"},"grants":[{"dimensionKey":"country","valueExpression":"{{fk.country.metadata.iso2}}"}]}]}}

package/.temp/jest-protection-convert/run-fiLmb1/.protection/hubspot-companies.json

@@ -1 +0,0 @@
-{"kind":"Protection"}

package/.temp/jest-protection-convert/run-qYGHMU/.protection/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-Mq5re8/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-f3u4YL/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-iQtd1O/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-mdmz5M/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-qbKYxQ/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/jest-protection-fixtures/hubspot-yzlJy6/hubspot-companies.yaml

@@ -1,17 +0,0 @@
-apiVersion: dataplane.aifabrix.ai/v1
-kind: Protection
-metadata:
-  key: hubspot-country-sales
-  displayName: HubSpot Country Sales Access
-spec:
-  enabled: true
-  datasourceKey: hubspot-companies
-  mode: replaceForSource
-  rules:
-    - key: sales-country-users
-      principal:
-        type: group
-        expression: "Sales {{fk.country.metadata.iso3}} Users"
-      grants:
-        - dimensionKey: country
-          valueExpression: "{{fk.country.metadata.iso2}}"

package/.temp/validation/summary.txt

@@ -1,5 +0,0 @@
-lint:fix exit=0
-lint exit=0
-test exit=0
-miso typecheck exit=0
-miso build exit=0