@aifabrix/builder 2.49.1 → 2.50.0

package/lib/cli/setup-app.js

@@ -13,6 +13,10 @@ const app = require('../app');
 const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
 const { setupInstallTestE2eLintCommands } = require('./setup-app.test-commands');
+const {
+  prepareExternalCreateOptions,
+  validateNonInteractiveExternalOptions
+} = require('./setup-app-external-create');
 
 const CREATE_HELP_AFTER = `
 Examples:
@@ -46,13 +50,13 @@ Examples:
   $ aifabrix push myapp --registry $ACR_REGISTRY --tag $IMAGE_TAG
   $ aifabrix deploy myapp \\
       --client-id "$DEV_MISO_CLIENTID" \\
-      --client-secret "$DEV_MISO_CLIENTSECRET" \\
-      --no-poll
+      --client-secret "$DEV_MISO_CLIENTSECRET"
 
   # CI/CD — external integration (after upload/tests; promote to controller)
   $ aifabrix validate hubspot-demo
   $ aifabrix upload hubspot-demo --probe
-  $ aifabrix deploy hubspot-demo --probe --no-poll
+  $ aifabrix deploy hubspot-demo --probe -v
+  $ aifabrix deploy ek-sales --gate full --subject-email ops@example.com
 
 Notes:
   - Login or set MISO_CONTROLLER_URL + environment (aifabrix login / aifabrix auth).
@@ -79,106 +83,6 @@ Notes:
   - Use -t 0 (--tail 0) for the full buffered log; default is 100 lines.
 `;
 
-/**
- * Normalize options for external system creation
- * @param {Object} options - Raw CLI options
- * @returns {Object} Normalized options
- */
-const VALID_ENTITY_TYPES = ['recordStorage', 'documentStorage', 'vectorStore', 'messageService', 'none'];
-
-function normalizeExternalOptions(options) {
-  const normalized = { ...options };
-  if (options.displayName) normalized.systemDisplayName = options.displayName;
-  if (options.description) normalized.systemDescription = options.description;
-  if (options.systemType) normalized.systemType = options.systemType;
-  if (options.authType) normalized.authType = options.authType;
-  if (options.entityType) {
-    if (!VALID_ENTITY_TYPES.includes(options.entityType)) {
-      throw new Error(`Invalid --entity-type. Must be one of: ${VALID_ENTITY_TYPES.join(', ')}`);
-    }
-    normalized.entityType = options.entityType;
-  }
-  if (options.datasources !== undefined) {
-    const parsedCount = parseInt(options.datasources, 10);
-    if (Number.isNaN(parsedCount) || parsedCount < 1 || parsedCount > 10) {
-      throw new Error('Datasources count must be a number between 1 and 10');
-    }
-    normalized.datasourceCount = parsedCount;
-  }
-  if (options.controller) {
-    normalized.controller = true;
-    normalized.controllerUrl = options.controller;
-  }
-  return normalized;
-}
-
-/**
- * Whether normalized options include all external CLI fields for headless create.
- * @param {Object} normalized - Normalized external create options
- * @returns {boolean}
- */
-function hasFullExternalCliOptions(normalized) {
-  return Boolean(
-    normalized.systemKey &&
-    normalized.systemDisplayName &&
-    normalized.systemDescription &&
-    normalized.systemType &&
-    normalized.authType &&
-    normalized.entityType &&
-    normalized.datasourceCount
-  );
-}
-
-/**
- * Map positional systemKey and apply headless defaults for external create.
- * @param {string} appName - Positional appKey or systemKey from CLI
- * @param {Object} options - Raw CLI options
- * @returns {Object} Normalized options ready for createApp
- */
-function prepareExternalCreateOptions(appName, options) {
-  const normalized = normalizeExternalOptions(options);
-  const isExternalType = options.type === 'external' || !options.type;
-
-  if (isExternalType && appName) {
-    normalized.systemKey = appName;
-  }
-
-  if (isExternalType && hasFullExternalCliOptions(normalized)) {
-    if (!Object.prototype.hasOwnProperty.call(normalized, 'github')) {
-      normalized.github = false;
-    }
-    if (!Object.prototype.hasOwnProperty.call(normalized, 'controller')) {
-      normalized.controller = false;
-    }
-  }
-
-  return normalized;
-}
-
-/**
- * Validate required options for non-interactive external creation
- * @param {Object} normalizedOptions - Normalized options
- * @throws {Error} If required options are missing
- */
-function validateNonInteractiveExternalOptions(normalizedOptions) {
-  const missing = [];
-  if (!normalizedOptions.systemDisplayName) missing.push('--display-name');
-  if (!normalizedOptions.systemDescription) missing.push('--description');
-  if (!normalizedOptions.systemType) missing.push('--system-type');
-  if (!normalizedOptions.authType) missing.push('--auth-type');
-  if (!normalizedOptions.entityType) missing.push('--entity-type');
-  if (!normalizedOptions.datasourceCount) missing.push('--datasources');
-  if (missing.length > 0) {
-    throw new Error(`Missing required options for non-interactive external create: ${missing.join(', ')}`);
-  }
-  if (!Object.prototype.hasOwnProperty.call(normalizedOptions, 'github')) {
-    normalizedOptions.github = false;
-  }
-  if (!Object.prototype.hasOwnProperty.call(normalizedOptions, 'controller')) {
-    normalizedOptions.controller = false;
-  }
-}
-
 /**
  * Handle create command execution
  * @async
@@ -419,21 +323,7 @@ function setupDockerfileGenerateCommand(program) {
     });
 }
 
-function setupPushDeployDockerfileCommands(program) {
-  program.command('push <appKey>')
-    .description('Push builder appKey image to Azure Container Registry')
-    .addHelpText('after', PUSH_HELP_AFTER)
-    .option('-r, --registry <registry>', 'ACR registry URL (overrides application.yaml)')
-    .option('-t, --tag <tag>', 'Image tag(s) - comma-separated for multiple (default: latest)')
-    .action(async(appName, options) => {
-      try {
-        await app.pushApp(appName, options);
-      } catch (error) {
-        handleCommandError(error, 'push');
-        process.exit(1);
-      }
-    });
-
+function setupDeployCommand(program) {
   program.command('deploy <appKey|systemKey>')
     .description('Deploy builder app or external system via Miso Controller (Azure or --local)')
     .addHelpText('after', DEPLOY_HELP_AFTER)
@@ -441,13 +331,20 @@ function setupPushDeployDockerfileCommands(program) {
     .option('--client-id <id>', 'Client ID (overrides config)')
     .option('--client-secret <secret>', 'Client Secret (overrides config)')
     .option('--repository-url <url>', 'Repository URL for pipeline validation (default: application.yaml repository.repositoryUrl, else https://github.com/aifabrix/<appKey>)')
-    .option('--poll', 'Poll for deployment status', true)
-    .option('--no-poll', 'Do not poll for status')
+    .option('-v, --verbose', 'Expanded deploy summary and preflight progress')
     .option('--probe', 'After external deploy, run dataplane runtime checks (validation/run); slower')
     .option('--probe-timeout <ms>', 'Timeout for --probe on external deploy (default: 120000)', '120000')
     .option(
-      '--no-cert-sync',
-      'Skip updating integration certification in the system file from the dataplane after external deploy'
+      '--sync',
+      'After deploy, run full datasource data sync for every datasource on the system (default: bootstrap-if-empty only)'
+    )
+    .option(
+      '--gate <gates>',
+      'Optional pre-promote gates (comma-separated): operations, trust, governance, full'
+    )
+    .option(
+      '--subject-email <emails>',
+      'Subject email(s) for governance gate (comma-separated; used with --gate governance|full)'
     )
     .action(async(appName, options) => {
       try {
@@ -458,6 +355,7 @@ function setupPushDeployDockerfileCommands(program) {
         const opts = {
           ...options,
           local: !!options.local,
+          verbose: options.verbose === true,
           probeTimeout: Number.isFinite(probeTimeout) ? probeTimeout : 120000
         };
         const outcome = await app.deployApp(appName, opts);
@@ -470,7 +368,24 @@ function setupPushDeployDockerfileCommands(program) {
         process.exit(1);
       }
     });
+}
 
+function setupPushDeployDockerfileCommands(program) {
+  program.command('push <appKey>')
+    .description('Push builder appKey image to Azure Container Registry')
+    .addHelpText('after', PUSH_HELP_AFTER)
+    .option('-r, --registry <registry>', 'ACR registry URL (overrides application.yaml)')
+    .option('-t, --tag <tag>', 'Image tag(s) - comma-separated for multiple (default: latest)')
+    .action(async(appName, options) => {
+      try {
+        await app.pushApp(appName, options);
+      } catch (error) {
+        handleCommandError(error, 'push');
+        process.exit(1);
+      }
+    });
+
+  setupDeployCommand(program);
   setupDockerfileGenerateCommand(program);
 }
 
@@ -489,7 +404,5 @@ function setupAppCommands(program) {
 
 module.exports = {
   setupAppCommands,
-  normalizeExternalOptions,
-  prepareExternalCreateOptions,
-  validateNonInteractiveExternalOptions
+  ...require('./setup-app-external-create')
 };

package/lib/cli/setup-app.test-commands.js

@@ -7,7 +7,6 @@
 const chalk = require('chalk');
 const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
-const { cliOptsSkipCertSync } = require('../certification/cli-cert-sync-skip');
 const {
   TEST_HELP_AFTER,
   TEST_E2E_HELP_AFTER
@@ -18,7 +17,7 @@ function setupTestCommand(program) {
     .description('Tests: builder appKey in container; external systemKey = local validation')
     .option('-e, --env <env>', 'For builder app: dev (running container) or tst (ephemeral)', 'dev')
     .option('-v, --verbose', 'Verbose output')
-    .option('-d, --debug', 'Write debug log to integration/<systemKey>/logs/ (external only)')
+    .option('-d, --debug', 'Certification debug + log to integration/<systemKey>/logs/ (external only)')
     .option(
       '--sync',
       'Not supported for this command (local validation only). Use aifabrix upload <systemKey> or dataplane test commands with --sync.'
@@ -58,45 +57,22 @@ function setupTestCommand(program) {
 }
 
 /**
- * First failed `certificateIssuance` across E2E datasource rows (for cert-sync hint).
- * @param {Array<{ key?: string, datasourceTestRun?: { certificateIssuance?: { status?: string, reasonCode?: string, message?: string } } }>} results
- * @returns {string|null}
- */
-function firstIssuanceFailureHintFromE2eResults(results) {
-  const failed = [];
-  for (const row of results || []) {
-    const ci = row.datasourceTestRun && row.datasourceTestRun.certificateIssuance;
-    if (ci && ci.status === 'failed') {
-      failed.push({ key: row.key, ci });
-    }
-  }
-  if (failed.length === 0) return null;
-  const firstRc = failed[0].ci.reasonCode;
-  const sameAll = failed.every(f => f.ci.reasonCode === firstRc);
-  if (sameAll && failed.length > 1) {
-    const parts = [firstRc, failed[0].ci.message].filter(Boolean);
-    return `${parts.join(': ')} (${failed.length} datasource scopes; first: ${failed[0].key})`;
-  }
-  const parts = [failed[0].ci.reasonCode, failed[0].ci.message].filter(Boolean);
-  return `[${failed[0].key}] ${parts.join(': ')}`.trim();
-}
-
-/**
- * External integration E2E: run, display, exit on aggregate, optional cert sync.
+ * External integration E2E: run, display, exit on aggregate.
  * @param {string} appName
  * @param {Object} options
  * @returns {Promise<void>}
  */
-async function runExternalIntegrationE2EAndCertSync(appName, options, cmd) {
-  const { cliOptsSkipSync } = require('../utils/cli-sync-options');
+async function runExternalIntegrationE2EAndExit(appName, options, cmd) {
+  const { cliOptsSkipPublish } = require('../utils/cli-sync-options');
   const { runTestE2EForExternalSystem } = require('../commands/test-e2e-external');
-  const noSync = cliOptsSkipSync(options, cmd);
+  const noPublish = cliOptsSkipPublish(options, cmd);
   const { success, results } = await runTestE2EForExternalSystem(appName, {
     env: options.env,
     debug: options.debug,
     verbose: options.verbose,
     async: options.async !== false,
-    noSync
+    noPublish,
+    syncMode: options.syncMode
   });
   const { displayIntegrationTestResults } = require('../utils/external-system-display');
   const datasourceResults = results.map(r => ({
@@ -117,25 +93,21 @@ async function runExternalIntegrationE2EAndCertSync(appName, options, cmd) {
     requireCert: options.requireCert === true
   });
   if (exitCode !== 0) process.exit(exitCode);
-  if (cliOptsSkipCertSync(options)) return;
-  const { trySyncCertificationFromDataplaneForExternalApp } = require('../certification/sync-after-external-command');
-  const issuanceFailureHint = firstIssuanceFailureHintFromE2eResults(results);
-  await trySyncCertificationFromDataplaneForExternalApp(appName, 'test-e2e', { issuanceFailureHint });
 }
 
 async function runTestE2ECommand(appName, options, cmd) {
-  const { cliOptsSkipSync } = require('../utils/cli-sync-options');
-  const noSync = cliOptsSkipSync(options, cmd);
+  const { cliOptsSkipPublish } = require('../utils/cli-sync-options');
+  const noPublish = cliOptsSkipPublish(options, cmd);
   const pathsUtil = require('../utils/paths');
   const appType = await pathsUtil.detectAppType(appName).catch(() => null);
-  if (noSync && appType && appType.baseDir === 'builder') {
+  if (noPublish && appType && appType.baseDir === 'builder') {
     throw new Error(
-      'Option --no-sync applies only to external integration E2E (integration/<systemKey>/). ' +
-        'Remove --no-sync for builder app E2E.'
+      'Option --no-publish applies only to external integration E2E (integration/<systemKey>/). ' +
+        'Remove --no-publish for builder app E2E.'
     );
   }
   if (appType && appType.baseDir === 'integration') {
-    await runExternalIntegrationE2EAndCertSync(appName, options, cmd);
+    await runExternalIntegrationE2EAndExit(appName, options, cmd);
     return;
   }
   const { runAppTestE2e } = require('../commands/app-test');
@@ -170,21 +142,24 @@ function setupTestE2eCommand(program) {
     .description('E2E: builder appKey in container; external systemKey = all datasources via dataplane')
     .option('-e, --env <env>', 'Environment: dev, tst, or pro (builder: dev/tst for container)', 'dev')
     .option('-v, --verbose', 'Show detailed step output and poll progress')
-    .option('-d, --debug', 'Include debug output and write log to integration/<systemKey>/logs/')
-    .option(
-      '--no-sync',
-      'Skip publishing local integration files; E2E uses the system config already on the dataplane (external integration only)'
-    )
+    .option('-d, --debug', 'Certification debug + log to integration/<systemKey>/logs/')
+    .option('--no-publish', 'Skip publishing local integration files before E2E')
     .option(
       '--force',
       'With default sync, pass force to upload (bypass active-datasource schema replacement guards; same as aifabrix upload --force)'
     )
-    .option('--warnings-as-errors', 'Treat aggregate warn as failure (exit 1)')
-    .option('--require-cert', 'Require certification passed on every datasource (exit 2 if not)')
     .option(
-      '--no-cert-sync',
-      'Skip updating the system file certification block from the dataplane after a successful run'
+      '--version <target>',
+      'Manifest version for E2E (latest, running, or explicit version id)',
+      'latest'
     )
+    .option(
+      '--sync-mode <mode>',
+      'Sync policy during E2E: auto (default), never, or force. Distinct from default pre-run publish.',
+      'auto'
+    )
+    .option('--warnings-as-errors', 'Treat aggregate warn as failure (exit 1)')
+    .option('--require-cert', 'Require certification passed on every datasource (exit 2 if not)')
     .addHelpText('after', TEST_E2E_HELP_AFTER)
     .action(async(appName, options, cmd) => {
       try {
@@ -232,7 +207,6 @@ function setupInstallTestE2eLintCommands(program) {
 }
 
 module.exports = {
-  setupInstallTestE2eLintCommands,
-  firstIssuanceFailureHintFromE2eResults
+  setupInstallTestE2eLintCommands
 };
 

package/lib/cli/setup-certification-commands.js

@@ -20,7 +20,7 @@ function setupVerifyOperationsCommand(program) {
     .option('-e, --env <env>', 'Environment: dev, tst, or pro', 'dev')
     .option('-v, --verbose', 'Readiness breakdown and verification step checklist')
     .option('-d, --debug', 'Write debug logs under integration/<systemKey>/logs/')
-    .option('--no-sync', 'Skip publishing local integration files before dataplane steps')
+    .option('--no-publish', 'Skip publishing local integration files before dataplane steps')
     .option(
       '--force',
       'With default sync, pass force to upload (same as aifabrix upload --force)'
@@ -39,7 +39,7 @@ function setupVerifyTrustCommand(program) {
     .option('-e, --env <env>', 'Environment: dev, tst, or pro', 'dev')
     .option('-v, --verbose', 'Per-datasource breakdown')
     .option('-d, --debug', 'Write debug log under integration/<systemKey>/logs/')
-    .option('--no-sync', 'Skip publishing local integration files before validate')
+    .option('--no-publish', 'Skip publishing local integration files before validate')
     .option(
       '--force',
       'With default sync, pass force to upload (same as aifabrix upload --force)'
@@ -61,7 +61,7 @@ function setupVerifyGovernanceCommand(program) {
     .option('-e, --env <env>', 'Environment: dev, tst, or pro', 'dev')
     .option('-v, --verbose', 'Per-datasource breakdown and pipeline detail')
     .option('-d, --debug', 'Write debug logs under integration/<systemKey>/logs/')
-    .option('--no-sync', 'Skip publishing local integration files before dataplane steps')
+    .option('--no-publish', 'Skip publishing local integration files before dataplane steps')
     .option(
       '--force',
       'With default sync, pass force to upload (same as aifabrix upload --force)'
@@ -108,7 +108,7 @@ function setupLifecycleCommand(program) {
     .option('-v, --verbose', 'Per-datasource breakdown in the report')
     .option('-d, --debug', 'Write debug logs under integration/<systemKey>/logs/ when --run')
     .option('--run', 'Run missing verify steps, then print certification report')
-    .option('--no-sync', 'With --run, skip publishing local integration files before verify')
+    .option('--no-publish', 'With --run, skip publishing local integration files before verify')
     .option(
       '--force',
       'With default sync on --run, pass force to upload (same as aifabrix upload --force)'

package/lib/cli/setup-certification.help.js

@@ -8,7 +8,7 @@ const VERIFY_OPERATIONS_HELP_AFTER = `
 Examples:
   $ aifabrix verify-operations hubspot
   $ aifabrix verify-operations hubspot -v
-  $ aifabrix verify-operations hubspot --no-sync
+  $ aifabrix verify-operations hubspot --no-publish
 
 Notes:
   - Orchestrates validate → test → test-integration → test-e2e for the system.
@@ -23,12 +23,12 @@ const VERIFY_TRUST_HELP_AFTER = `
 Examples:
   $ aifabrix verify-trust hubspot
   $ aifabrix verify-trust hubspot -v --revalidate
-  $ aifabrix verify-trust hubspot --no-sync --json
+  $ aifabrix verify-trust hubspot --no-publish --json
 
 Notes:
   - For one datasource: aifabrix datasource verify-trust <datasourceKey>
   - Does not call external vendor APIs (use verify-operations / test-e2e for connectivity).
-  - Local integration files are published before run unless --no-sync.
+  - Local integration files are published before run unless --no-publish.
 `;
 
 const VERIFY_GOVERNANCE_HELP_AFTER = `
@@ -38,7 +38,7 @@ Examples:
   $ aifabrix verify-governance hubspot-e2e --certification-profile gold --json
 
 Notes:
-  - All-in-one: publishes local integration (unless --no-sync), generates packs on the dataplane,
+  - All-in-one: publishes local integration (unless --no-publish), generates packs on the dataplane,
     then runs governance verification (dataplane-first; no local YAML upload).
   - Requires at least one --subject-user-id or --subject-email (repeatable or comma-separated).
   - Prefer this over separate generate + verify when certifying an integration.
@@ -50,12 +50,12 @@ const GOVERNANCE_GENERATE_HELP_AFTER = `
 Examples:
   $ aifabrix governance generate hubspot-e2e --subject-email us.sales@example.com
   $ aifabrix governance generate hubspot-e2e --subject-user-id user-a --subject-user-id user-b -v
-  $ aifabrix governance generate hubspot-e2e --certification-profile gold --no-sync
+  $ aifabrix governance generate hubspot-e2e --certification-profile gold --no-publish
 
 Notes:
   - Dataplane generates keys, coverage, and generationState; the CLI never authors partitions locally.
   - Requires at least one --subject-user-id or --subject-email per datasource fan-out.
-  - Publishes local integration files before generate unless --no-sync.
+  - Publishes local integration files before generate unless --no-publish.
 `;
 
 const GOVERNANCE_VERIFY_HELP_AFTER = `
@@ -74,7 +74,7 @@ Notes:
 const GOVERNANCE_UPLOAD_HELP_AFTER = `
 Examples:
   $ aifabrix governance upload hubspot-e2e
-  $ aifabrix governance upload hubspot-e2e --no-sync
+  $ aifabrix governance upload hubspot-e2e --no-publish
 
 Notes:
   - Expert path: pushes integration/<systemKey>/scenarios/*.yaml to the dataplane.
@@ -98,13 +98,13 @@ Examples:
   $ aifabrix lifecycle hubspot
   $ aifabrix lifecycle hubspot -v
   $ aifabrix lifecycle hubspot --run
-  $ aifabrix lifecycle hubspot --run --no-sync
+  $ aifabrix lifecycle hubspot --run --no-publish
   $ aifabrix lifecycle hubspot-e2e --run --subject-email us.sales@example.com
   $ aifabrix lifecycle hubspot-e2e --run --subject-email a@x.com,b@y.com -v
 
 Notes:
   - Default: certification report only (GET persisted pillar results from dataplane).
-  - --run executes missing verify steps, then prints the report (publishes local files first unless --no-sync).
+  - --run executes missing verify steps, then prints the report (publishes local files first unless --no-publish).
   - With --run, --subject-email / --subject-user-id generate and verify governance packs (same as verify-governance).
   - Repeat the flag or use comma-separated values: --subject-email a@x.com,b@y.com
   - One-shot cert path: lifecycle <systemKey> --run --subject-email <email>

package/lib/cli/setup-dev-path-commands.js

@@ -44,6 +44,29 @@ async function runShellEnvRegistration() {
   }
 }
 
+function addSetEnvConfigCommand(dev) {
+  dev
+    .command('set-env-config <path>')
+    .description('Set or clear aifabrix-env-config path in ~/.aifabrix/config.yaml')
+    .action(async(envConfigPath) => {
+      try {
+        const trimmed = (envConfigPath || '').trim();
+        await config.setAifabrixEnvConfigPath(trimmed);
+        logger.log(
+          trimmed === ''
+            ? formatSuccessLine('Env config path cleared')
+            : formatSuccessLine(`Env config path set to ${trimmed}`)
+        );
+        const devId = await config.getDeveloperId();
+        const { displayDevConfig } = require('../commands/dev-show-display');
+        await displayDevConfig(devId);
+      } catch (error) {
+        handleCommandError(error, 'dev set-env-config');
+        process.exit(1);
+      }
+    });
+}
+
 function addSetHomeCommand(dev) {
   dev
     .command('set-home <path>')
@@ -162,6 +185,7 @@ function addSetFormatCommand(dev, handleSetFormat) {
  * @returns {void}
  */
 function setupDevPathAndFormatCommands(dev, handleSetFormat) {
+  addSetEnvConfigCommand(dev);
   addSetHomeCommand(dev);
   addSetWorkCommand(dev);
   addPrintHomeWorkCommands(dev);