@aifabrix/builder 2.49.1 → 2.50.0

package/lib/cli/setup-dev.js

@@ -21,6 +21,11 @@ const {
   handleDevPin,
   handleDevDelete
 } = require('../commands/dev-cli-handlers');
+const {
+  handlePlatformInstallCli,
+  handlePlatformUpdate,
+  handlePlatformInstall
+} = require('../commands/dev-host-ops');
 
 /** Appended to `dev update --help` (examples + partial-update behaviour). */
 const DEV_UPDATE_HELP_AFTER = `
@@ -49,7 +54,7 @@ const DEV_GROUP_HELP_AFTER = `
 Categories:
   Local config   show, set-id, set-scoped-resources, set-env-config, set-home, set-work, set-format, print-home, print-work
   Onboarding     init (PIN onboarding), refresh (sync settings / renew cert)
-  Remote admin   list, add, update, pin, delete  (need remote-server + client cert in ~/.aifabrix)
+  Remote admin   list, add, update, pin, delete, platform-install, platform-update, platform-install-cli  (need remote-server + client cert in ~/.aifabrix)
   Sync / stop    down  (Mutagen; optional --apps for containers)
 
 Use: aifabrix dev <command> --help
@@ -79,16 +84,37 @@ Examples:
   $ aifabrix dev pin 02 --hosts-ip 192.168.1.25
   $ aifabrix dev pin   (uses developer-id from config)
 
-Prints copy-paste commands for the developer: full dev init, hosts-file variant, and dev init --pin
-when their config already has remote-server + developer-id.
+Prints a shareable block for the developer: Node.js + Builder CLI install (Windows / Linux & macOS),
+then copy-paste dev init commands (standard, hosts-file variant, and dev init --pin when config exists).
 `;
 
 /** Appended to `dev delete --help`. */
 const DEV_DELETE_HELP_AFTER = `
-Example:
+Examples:
   $ aifabrix dev delete 02
+  $ aifabrix dev delete 02 -y
+  $ aifabrix dev delete 02 --db-only
+
+Default removes the developer from the host (OS user, containers) and server database. Use --db-only for database-only removal.
 `;
 
+/** Shared host-ops flags for platform commands and dev add provision. */
+function addHostOpsSharedOptions(cmd) {
+  return cmd
+    .option('--check', 'Preflight only (no changes)')
+    .option('-y, --yes', 'Non-interactive (skip prompts)')
+    .option('--wait', 'Poll until job completes', true)
+    .option('--no-wait', 'Return after job is queued')
+    .option('--json', 'JSON output (includes job result when --wait)')
+    .option('--include <ids>', 'Comma-separated developer ids (batch)')
+    .option('--exclude <ids>', 'Comma-separated developer ids to skip')
+    .option('--builder-version <ver>', 'Builder CLI / platform bundle version')
+    .option('--admin-email <email>', 'Platform admin email (install / provision)')
+    .option('--admin-password <password>', 'Platform admin password (never logged)')
+    .option('--platform <mode>', 'Platform mode (e.g. single-traefik)')
+    .option('--installation <profile>', 'Installation profile (e.g. dev)');
+}
+
 /** Appended to `dev down --help`. */
 const DEV_DOWN_HELP_AFTER = `
 Examples:
@@ -276,6 +302,17 @@ function setupDevListAddCommands(dev) {
     .requiredOption('--name <name>', 'Display name')
     .requiredOption('--email <email>', 'Email address')
     .option('--groups <items>', 'Comma-separated roles: admin, secret-manager, secret-reader, developer, docker', 'developer')
+    .option('--no-provision', 'Create user in database only (skip host provision job)')
+    .option('--builder-version <ver>', 'Builder CLI version for provision job')
+    .option('--admin-email <email>', 'Platform admin email for provision job')
+    .option('--admin-password <password>', 'Platform admin password for provision job')
+    .option('--platform <mode>', 'Platform mode for provision job')
+    .option('--installation <profile>', 'Installation profile for provision job')
+    .option('--skip-cert', 'Skip certificate step in provision job')
+    .option('--skip-platform', 'Skip platform install in provision job')
+    .option('--skip-cli', 'Skip Builder CLI install in provision job')
+    .option('--wait', 'Poll until provision job completes', true)
+    .option('--no-wait', 'Return after provision job is queued')
     .addHelpText('after', DEV_ADD_HELP_AFTER)
     .action(async(options) => {
       try {
@@ -287,6 +324,27 @@ function setupDevListAddCommands(dev) {
     });
 }
 
+/**
+ * Register dev down command.
+ * @param {Command} dev - dev subcommand group
+ */
+function setupDevDownCommand(dev) {
+  dev
+    .command('down')
+    .description('Stop Mutagen sync; --apps also stops app containers')
+    .addHelpText('after', DEV_DOWN_HELP_AFTER)
+    .option('--apps', 'Also stop running app containers for this developer')
+    .action(async(options) => {
+      try {
+        const { handleDevDown } = require('../commands/dev-down');
+        await handleDevDown(options);
+      } catch (error) {
+        handleCommandError(error, 'dev down');
+        process.exit(1);
+      }
+    });
+}
+
 /**
  * Register dev update/pin/delete commands (remote only).
  * @param {Command} dev - dev subcommand group
@@ -325,31 +383,71 @@ function setupDevUpdatePinDeleteCommands(dev) {
 
   dev
     .command('delete <developerId>')
-    .description('Remove developer from server (admin)')
+    .description('Remove developer from host and server (admin)')
+    .option('--db-only', 'Remove from server database only (legacy behaviour)')
+    .option('-y, --yes', 'Skip confirmation prompt')
+    .option('--wait', 'Poll until removal completes on the host', true)
+    .option('--no-wait', 'Return after removal job is queued')
+    .option('--json', 'JSON output (includes job result when --wait)')
     .addHelpText('after', DEV_DELETE_HELP_AFTER)
-    .action(async(developerId) => {
+    .action(async(developerId, options) => {
       try {
-        await handleDevDelete(developerId);
+        await handleDevDelete(developerId, options);
       } catch (error) {
         handleCommandError(error, 'dev delete');
         process.exit(1);
       }
     });
 
-  dev
-    .command('down')
-    .description('Stop Mutagen sync; --apps also stops app containers')
-    .addHelpText('after', DEV_DOWN_HELP_AFTER)
-    .option('--apps', 'Also stop running app containers for this developer')
-    .action(async(options) => {
+  setupDevDownCommand(dev);
+}
+
+/**
+ * Register platform lifecycle commands (host-ops).
+ * @param {Command} dev - dev subcommand group
+ */
+function setupDevPlatformCommands(dev) {
+  addHostOpsSharedOptions(
+    dev
+      .command('platform-install-cli [developerId]')
+      .description('Install or upgrade Builder CLI on dev host(s) (admin)')
+  )
+    .option('--force', 'Reinstall even when CLI is present')
+    .action(async(developerId, options) => {
       try {
-        const { handleDevDown } = require('../commands/dev-down');
-        await handleDevDown(options);
+        await handlePlatformInstallCli(developerId, options);
       } catch (error) {
-        handleCommandError(error, 'dev down');
+        handleCommandError(error, 'dev platform-install-cli');
         process.exit(1);
       }
     });
+
+  addHostOpsSharedOptions(
+    dev
+      .command('platform-update [developerId]')
+      .description('Refresh dev platform images (admin)')
+  ).action(async(developerId, options) => {
+    try {
+      await handlePlatformUpdate(developerId, options);
+    } catch (error) {
+      handleCommandError(error, 'dev platform-update');
+      process.exit(1);
+    }
+  });
+
+  addHostOpsSharedOptions(
+    dev
+      .command('platform-install <developerId>')
+      .description('Install dev platform for one developer (admin)')
+      .option('--force', 'Remove existing platform then reinstall')
+  ).action(async(developerId, options) => {
+    try {
+      await handlePlatformInstall(developerId, options);
+    } catch (error) {
+      handleCommandError(error, 'dev platform-install');
+      process.exit(1);
+    }
+  });
 }
 
 /**
@@ -359,6 +457,7 @@ function setupDevUpdatePinDeleteCommands(dev) {
 function setupDevUserCommands(dev) {
   setupDevListAddCommands(dev);
   setupDevUpdatePinDeleteCommands(dev);
+  setupDevPlatformCommands(dev);
 }
 
 /**

package/lib/cli/setup-external-system-help.js

@@ -8,24 +8,22 @@ const UPLOAD_HELP_AFTER = `
 Examples:
   # Publish integration/<systemKey>/ to the dataplane (typical lab flow after validate + resolve)
   $ aifabrix upload hubspot-demo
-  $ aifabrix upload hubspot-demo --verbose
+  $ aifabrix upload hubspot-demo -v
   $ aifabrix upload hubspot-demo --probe
 
   # Build and validate payload only (no API calls)
   $ aifabrix upload hubspot-demo --dry-run
 
-  # Short summary after publish
-  $ aifabrix upload hubspot-demo --minimal
-
   # Protection manifests (integration/.protection/ at repo root)
   $ aifabrix upload .protection
-  $ aifabrix upload .protection --warnings-as-errors --no-sync
+  $ aifabrix upload .protection --warnings-as-errors
 
 Notes:
   - Requires login (aifabrix auth status).
   - Reads files under integration/<systemKey>/ (system JSON, datasources, credentials).
+  - Default output is a compact readiness summary; use -v for expanded detail and server-side validate warnings.
   - --probe runs dataplane runtime checks after publish (slower; common in Session 1).
-  - test-e2e and test-integration publish local files first by default; use --no-sync on those commands to skip.
+  - test-e2e and test-integration publish local files first by default; use --no-publish on those commands to skip.
   - After dimension/FK edits on active datasources, use --force (or test-e2e / test-integration / datasource test-* with --sync --force).
   - For one datasource only: aifabrix datasource upload <datasourceKey>
 `;

package/lib/cli/setup-external-system.js

@@ -15,8 +15,7 @@
  */
 
 const { handleCommandError } = require('../utils/cli-utils');
-const { cliOptsSkipSync } = require('../utils/cli-sync-options');
-const { cliOptsSkipCertSync } = require('../certification/cli-cert-sync-skip');
+const { cliOptsSkipPublish } = require('../utils/cli-sync-options');
 const { TEST_INTEGRATION_HELP_AFTER } = require('./setup-app.help');
 const {
   UPLOAD_HELP_AFTER,
@@ -24,6 +23,39 @@ const {
   DELETE_HELP_AFTER
 } = require('./setup-external-system-help');
 
+async function handleUploadCommandAction(systemKey, options) {
+  const { isProtectionScope } = require('../protection/scope');
+  if (isProtectionScope(systemKey)) {
+    const { uploadProtectionBatchCommand } = require('../protection/upload-batch');
+    const logger = require('../utils/logger');
+    const code = await uploadProtectionBatchCommand(
+      {
+        env: options.env,
+        dryRun: options.dryRun === true,
+        sync: options.sync === true,
+        json: options.json === true,
+        verbose: options.verbose === true,
+        warningsAsErrors: options.warningsAsErrors === true
+      },
+      logger
+    );
+    if (code !== 0) {
+      process.exit(code);
+    }
+    return;
+  }
+  const upload = require('../commands/upload');
+  const probeTimeout =
+    options.probeTimeout === undefined || options.probeTimeout === null
+      ? 120000
+      : Number(options.probeTimeout);
+  await upload.uploadExternalSystem(systemKey, {
+    ...options,
+    probeTimeout: Number.isFinite(probeTimeout) ? probeTimeout : 120000,
+    pathOptions: {}
+  });
+}
+
 function setupDownloadCommand(program) {
   program.command('download <systemKey>')
     .description('Pull external system from dataplane into integration/<key>/')
@@ -31,6 +63,11 @@ function setupDownloadCommand(program) {
     .option('--format <format>', 'Output format: json | yaml (default: yaml or config format)')
     .option('--dry-run', 'Show what would be downloaded without actually downloading')
     .option('--force', 'Overwrite existing README.md without prompting')
+    .option(
+      '--version <target>',
+      'Manifest version to download (running default; latest or explicit id when supported)',
+      'running'
+    )
     .action(async(systemKey, options) => {
       try {
         const config = require('../core/config');
@@ -52,53 +89,22 @@ function setupUploadCommand(program) {
     .description('Validate, publish to dataplane, and register with controller (draft application); or upload .protection batch')
     .addHelpText('after', UPLOAD_HELP_AFTER)
     .option('--dry-run', 'Validate and build payload only; no API calls')
-    .option('--no-sync', 'For .protection: skip datasource sync after upload')
+    .option(
+      '--sync',
+      'After publish, run full datasource data sync for every datasource on the system (default: bootstrap-if-empty only)'
+    )
     .option('--json', 'For .protection: JSON output')
     .option('--warnings-as-errors', 'For .protection: pass strict=true to dataplane validate')
-    .option('-v, --verbose', 'Run server-side pipeline validate and print warnings before publish')
+    .option('-v, --verbose', 'Expanded upload summary and server-side pipeline validate warnings before publish')
     .option('--probe', 'After publish, run dataplane runtime checks (validation/run); slower')
-    .option('--minimal', 'Print only a short readiness summary after upload')
     .option('--probe-timeout <ms>', 'Timeout for --probe (default: 120000)', '120000')
-    .option(
-      '--no-cert-sync',
-      'Skip updating the system file certification block from the dataplane active certificate after publish'
-    )
     .option(
       '--force',
       'Bypass schema guards on active datasources during publish (dangerous; shows a warning)'
     )
     .action(async(systemKey, options) => {
       try {
-        const { isProtectionScope } = require('../protection/scope');
-        if (isProtectionScope(systemKey)) {
-          const { uploadProtectionBatchCommand } = require('../protection/upload-batch');
-          const logger = require('../utils/logger');
-          const code = await uploadProtectionBatchCommand(
-            {
-              env: options.env,
-              dryRun: options.dryRun === true,
-              noSync: options.noSync === true,
-              json: options.json === true,
-              verbose: options.verbose === true,
-              warningsAsErrors: options.warningsAsErrors === true
-            },
-            logger
-          );
-          if (code !== 0) {
-            process.exit(code);
-          }
-          return;
-        }
-        const upload = require('../commands/upload');
-        const probeTimeout =
-          options.probeTimeout === undefined || options.probeTimeout === null
-            ? 120000
-            : Number(options.probeTimeout);
-        await upload.uploadExternalSystem(systemKey, {
-          ...options,
-          noCertSync: cliOptsSkipCertSync(options),
-          probeTimeout: Number.isFinite(probeTimeout) ? probeTimeout : 120000
-        });
+        await handleUploadCommandAction(systemKey, options);
       } catch (error) {
         handleCommandError(error, 'upload');
         process.exit(1);
@@ -181,7 +187,7 @@ async function runExternalSystemTestIntegration(appName, options) {
     environment: options.env || options.environment,
     debug: options.debug,
     perDatasource: options.perDatasource,
-    noSync: cliOptsSkipSync(options)
+    noPublish: cliOptsSkipPublish(options)
   };
   const results = await test.testExternalSystemIntegration(appName, opts);
   test.displayIntegrationTestResults(results, options.verbose, { debug: options.debug, runType: 'integration' });
@@ -192,9 +198,6 @@ async function runExternalSystemTestIntegration(appName, options) {
     requireCert: options.requireCert === true
   });
   if (exitCode !== 0) process.exit(exitCode);
-  if (cliOptsSkipCertSync(options)) return;
-  const { trySyncCertificationFromDataplaneForExternalApp } = require('../certification/sync-after-external-command');
-  await trySyncCertificationFromDataplaneForExternalApp(appName, 'test-integration');
 }
 
 /**
@@ -238,10 +241,7 @@ function setupExternalSystemTestCommands(program) {
     .option('-e, --env <env>', 'Environment: dev, tst, or pro (builder: dev/tst for container)', 'dev')
     .option('-v, --verbose', 'Show detailed test output')
     .option('-d, --debug', 'Include debug output and write log to integration/<systemKey>/logs/')
-    .option(
-      '--no-sync',
-      'Skip publishing local integration files; use system config already on the dataplane'
-    )
+    .option('--no-publish', 'Skip publishing local integration files before tests')
     .option(
       '--sync',
       'Publish local system and datasource files before tests (default for external integration; same as upload)'
@@ -250,12 +250,18 @@ function setupExternalSystemTestCommands(program) {
       '--force',
       'With --sync, pass force to upload (bypass active-datasource schema replacement guards; same as aifabrix upload --force)'
     )
-    .option('--warnings-as-errors', 'Treat aggregate warn as failure (exit 1)')
-    .option('--require-cert', 'Require certification passed on every datasource (exit 2 if not)')
     .option(
-      '--no-cert-sync',
-      'Skip updating the system file certification block from the dataplane after a successful run'
+      '--version <target>',
+      'Manifest version for test (latest, running, or explicit version id)',
+      'latest'
     )
+    .option(
+      '--sync-mode <mode>',
+      'Sync policy during test: auto (default), never, or force. Distinct from --sync (publish local files).',
+      'auto'
+    )
+    .option('--warnings-as-errors', 'Treat aggregate warn as failure (exit 1)')
+    .option('--require-cert', 'Require certification passed on every datasource (exit 2 if not)')
     .addHelpText('after', TEST_INTEGRATION_HELP_AFTER)
     .action(async(appName, options, cmd) => {
       try {
@@ -264,7 +270,7 @@ function setupExternalSystemTestCommands(program) {
         const opts = {
           ...options,
           env: envExplicit ? options.env : undefined,
-          noSync: cliOptsSkipSync(options, cmd)
+          noPublish: cliOptsSkipPublish(options, cmd)
         };
         await runTestIntegrationCommand(appName, opts);
       } catch (error) {

package/lib/cli/setup-infra-up-builder-api-action.js

@@ -0,0 +1,64 @@
+/**
+ * `aifabrix up-builder-api` action body.
+ *
+ * @fileoverview up-builder-api CLI action
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { handleCommandError } = require('../utils/cli-utils');
+const { handleUpBuilderApi } = require('../commands/up-builder-api');
+const { cleanBuilderAppDirs, BUILDER_API_APP_KEYS } = require('../commands/up-common');
+const { recordInfraInstallationCommand } = require('./installation-log-command');
+
+/**
+ * @param {Object} options
+ * @returns {Promise<string[]>}
+ */
+async function runUpBuilderApiWork(options) {
+  let cleanedAppKeys = [];
+  if (options.force) {
+    const cleaned = await cleanBuilderAppDirs([...BUILDER_API_APP_KEYS]);
+    cleanedAppKeys = Array.isArray(cleaned) ? cleaned : [];
+  }
+  await handleUpBuilderApi(options);
+  return cleanedAppKeys;
+}
+
+/**
+ * @param {Object} options
+ * @returns {Promise<void>}
+ */
+async function handleUpBuilderApiCliAction(options) {
+  const startedAt = new Date();
+  let cleanedAppKeys = [];
+  try {
+    cleanedAppKeys = await runUpBuilderApiWork(options);
+    await recordInfraInstallationCommand({
+      command: 'up-builder-api',
+      options,
+      startedAt,
+      outcome: 'success',
+      platformAppList: ['builder-api'],
+      cleanup: cleanedAppKeys.length > 0 ? { cleanedAppKeys } : undefined
+    });
+  } catch (error) {
+    await recordInfraInstallationCommand({
+      command: 'up-builder-api',
+      options,
+      startedAt,
+      outcome: 'failure',
+      error,
+      platformAppList: ['builder-api'],
+      cleanup: cleanedAppKeys.length > 0 ? { cleanedAppKeys } : undefined
+    });
+    handleCommandError(error, 'up-builder-api');
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  handleUpBuilderApiCliAction
+};

package/lib/cli/setup-infra-up-platform-action.js

@@ -16,6 +16,7 @@ const { resolveControllerUrl } = require('../utils/controller-url');
 const { handleLogin } = require('../commands/login');
 const { handleUpMiso } = require('../commands/up-miso');
 const { handleUpDataplane } = require('../commands/up-dataplane');
+const { handleUpBuilderApi } = require('../commands/up-builder-api');
 const {
   applyUpPlatformForceConfig,
   cleanBuilderAppDirs,
@@ -25,7 +26,7 @@ const {
 const { runGuidedUpPlatform } = require('./infra-guided');
 const { recordInfraInstallationCommand } = require('./installation-log-command');
 
-const PLATFORM_APPS = ['keycloak', 'miso-controller', 'dataplane'];
+const PLATFORM_APPS = ['keycloak', 'miso-controller', 'dataplane', 'builder-api'];
 
 /**
  * @param {Object} options
@@ -57,6 +58,7 @@ async function runUpPlatformWork(options) {
     await prepareUrlsLocalRegistryForUpPlatform();
     await handleUpMiso(options);
     await handleUpDataplane(options);
+    await handleUpBuilderApi({ ...options, platformInstall: true });
   }
   return cleanedAppKeys;
 }

package/lib/cli/setup-infra.js

@@ -285,6 +285,20 @@ function setupUpDataplaneCommand(program) {
     });
 }
 
+function setupUpBuilderApiCommand(program) {
+  program.command('up-builder-api')
+    .description('Materialize and run builder-api locally (dev env; needs up-infra; dataplane recommended)')
+    .option('-r, --registry <url>', 'Override registry for builder-api image')
+    .option('--registry-mode <mode>', 'Override registry mode (acr|external)')
+    .option('-i, --image <ref>', 'Override builder-api image reference')
+    .option('-f, --force', 'Clean builder/builder-api and re-fetch from templates')
+    .option('--verbose', 'Show full orchestration output')
+    .action((options) => {
+      const { handleUpBuilderApiCliAction } = require('./setup-infra-up-builder-api-action');
+      return handleUpBuilderApiCliAction(options);
+    });
+}
+
 function setupDownInfraCommand(program) {
   program.command('down-infra [service|app]')
     .description('Stop all infra, or stop one app; use -v to remove volumes')
@@ -418,6 +432,7 @@ function setupInfraCommands(program) {
   setupUpPlatformCommand(program);
   setupUpMisoCommand(program);
   setupUpDataplaneCommand(program);
+  setupUpBuilderApiCommand(program);
   setupDownInfraCommand(program);
   setupDoctorCommand(program);
   setupStatusCommand(program);

package/lib/cli/setup-list.js

@@ -0,0 +1,43 @@
+/**
+ * Top-level connected-system list command.
+ *
+ * @fileoverview aifabrix list — dataplane external systems
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { listExternalSystemsOnDataplane } = require('../app/list-external-systems');
+
+const LIST_HELP_AFTER = `
+Lists connected systems published on the dataplane (not controller pipeline applications).
+
+Examples:
+  aifabrix list
+  aifabrix list --json
+
+Controller applications only: aifabrix app list
+Show one system: aifabrix show <systemKey> --online
+`;
+
+/**
+ * @param {import('commander').Command} program
+ */
+function setupListCommand(program) {
+  program
+    .command('list')
+    .description('List connected systems on the dataplane')
+    .option('--json', 'Output as JSON')
+    .addHelpText('after', LIST_HELP_AFTER)
+    .action(async(options) => {
+      try {
+        await listExternalSystemsOnDataplane({ json: options.json === true });
+      } catch (error) {
+        logger.error(chalk.red(`Error: ${error.message}`));
+        process.exit(1);
+      }
+    });
+}
+
+module.exports = { setupListCommand };

package/lib/cli/setup-utility-repair.js

@@ -34,7 +34,11 @@ function buildRepairExternalIntegrationOptions(appName, options, format) {
     api: options.api || all,
     test: options.test || all,
     backup: options.backup,
-    noBackup: options.noBackup
+    noBackup: options.noBackup,
+    splitDatasources: options.splitDatasources === true,
+    rbacPreset: options.rbacPreset,
+    authWebhook: options.authWebhook === true,
+    authSync: options.authSync === true
   };
 }
 
@@ -142,7 +146,7 @@ function logRepairResult(options, result) {
  */
 async function handleRepairCommand(appName, options) {
   const { repairExternalIntegration } = require('../commands/repair');
-  const { appPath } = await detectAppType(appName);
+  const { appPath } = await detectAppType(appName, {});
   logOfflinePathWhenType(appPath);
   let format = 'yaml';
   try {
@@ -151,10 +155,9 @@ async function handleRepairCommand(appName, options) {
   } catch (_) {
     /* default yaml when config unavailable */
   }
-  const result = await repairExternalIntegration(
-    appName,
-    buildRepairExternalIntegrationOptions(appName, options, format)
-  );
+  const result = await repairExternalIntegration(appName, {
+    ...buildRepairExternalIntegrationOptions(appName, options, format)
+  });
   logRepairResult(options, result);
 }
 
@@ -175,9 +178,25 @@ function setupRepairCommand(program) {
     )
     .option('--doc', 'Regenerate README.md from deployment manifest')
     .option('--expose', 'Set exposed.schema on each datasource from all fieldMappings.attributes keys (metadata.<key>); removes deprecated exposed.attributes if present')
-    .option('--rbac', 'Ensure RBAC permissions per datasource and add default Admin/Reader roles if none exist')
+    .option('--rbac', 'Ensure RBAC permissions per datasource and add default Admin/Reader roles if none exist; warns when capabilities lack openapi.operations (auto-syncs operations)')
     .option('--sync', 'Add default sync section to datasources that lack it')
+    .option(
+      '--auth-webhook',
+      'Ensure authentications[] slot usage=webhookInbound (454 webhook inbound auth)'
+    )
+    .option(
+      '--auth-sync',
+      'Ensure authentications[] slot usage=syncExecution (454 syncBridge propagation auth)'
+    )
     .option('--test', 'Generate testPayload.payloadTemplate and testPayload.expectedResult from attributes')
+    .option(
+      '--split-datasources',
+      'Split monolithic *-datasource-operations into per-OpenAPI-tag datasources (orchestration-api)'
+    )
+    .option(
+      '--rbac-preset <preset>',
+      'RBAC preset for facade APIs (e.g. platform — dataplane role catalog)'
+    )
     .option('--no-backup', 'Skip timestamped copies under integration/<systemKey>/backup/')
     .option('--dry-run', 'Report changes only; do not write')
     .addHelpText('after', REPAIR_HELP_AFTER)

package/lib/cli/setup-utility.js

@@ -96,7 +96,7 @@ function setupJsonCommand(program) {
     .addHelpText('after', JSON_HELP_AFTER)
     .action(async(appName, options) => {
       try {
-        const resolved = await getResolveAppPath(appName);
+        const resolved = await getResolveAppPath(appName, {});
         const { emitManifestMetadataLineIfTTY } = require('../utils/manifest-source-emit');
         emitManifestMetadataLineIfTTY(logger, {
           appKey: appName,
@@ -104,7 +104,9 @@ function setupJsonCommand(program) {
           envOnly: resolved.envOnly,
           json: false
         });
-        const result = await generator.generateDeployJsonWithValidation(appName, options);
+        const result = await generator.generateDeployJsonWithValidation(appName, {
+          ...options
+        });
         if (result.success) {
           const fileName = result.path.includes('application-schema.json') ? 'application-schema.json' : 'deployment JSON';
           logger.log(`✔ Generated ${fileName}: ${result.path}`);
@@ -195,7 +197,7 @@ function setupConvertCommand(program) {
 
 function setupShowCommand(program) {
   program.command('show <appKey|systemKey>')
-    .description('Show builder app or external system from local tree (default) or controller (--online)')
+    .description('Show builder app or connected system from local tree (default) or online (--online)')
     .option('--online', 'Fetch application data from the controller')
     .option('--json', 'Output as JSON')
     .option(