@aifabrix/builder 2.49.1 → 2.50.0

package/lib/programmatic/workspace-context.js

@@ -0,0 +1,145 @@
+/**
+ * Multi-user workspace context for builder-api programmatic flows.
+ *
+ * @fileoverview WorkspaceContext paths under WORKSPACE_ROOT/{userId}/integration/{systemKey}/
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const fs = require('../internal/fs-real-sync');
+const { assertValidSystemKey, assertValidUserId } = require('./system-key');
+const { runWithIntegrationPathScope } = require('./integration-path-scope');
+
+/** Server-side workspace integrations use JSON manifests (plan 154.0). */
+const WORKSPACE_INTEGRATION_FORMAT = 'json';
+
+/**
+ * @typedef {Object} WorkspaceContext
+ * @property {string} userId
+ * @property {string} workspaceRoot
+ * @property {string} systemKey
+ * @property {string} environment
+ * @property {string} controllerUrl
+ * @property {string} dataplaneUrl
+ * @property {string} bearerToken
+ */
+
+/**
+ * @param {string} segment
+ * @returns {string}
+ */
+function resolveWorkspaceRoot(segment) {
+  if (segment && typeof segment === 'string' && segment.trim()) {
+    return path.resolve(segment.trim());
+  }
+  const fromEnv = process.env.WORKSPACE_ROOT;
+  if (fromEnv && typeof fromEnv === 'string' && fromEnv.trim()) {
+    return path.resolve(fromEnv.trim());
+  }
+  return path.resolve(process.cwd(), '.temp', 'builder-workspaces');
+}
+
+/**
+ * @param {Object} params
+ * @param {string} params.userId
+ * @param {string} params.systemKey
+ * @param {string} params.bearerToken
+ * @param {string} [params.workspaceRoot]
+ * @param {string} [params.environment]
+ * @param {string} [params.controllerUrl]
+ * @param {string} [params.dataplaneUrl]
+ * @returns {WorkspaceContext}
+ */
+function createWorkspaceContext(params) {
+  const userId = assertValidUserId(params.userId);
+  const systemKey = assertValidSystemKey(params.systemKey);
+  const bearerToken = params.bearerToken;
+  if (!bearerToken || typeof bearerToken !== 'string') {
+    throw new Error('bearerToken is required');
+  }
+
+  const workspaceRoot = resolveWorkspaceRoot(params.workspaceRoot);
+  const userRoot = path.join(workspaceRoot, userId);
+  const integrationRoot = path.join(userRoot, 'integration');
+  const useExplicitIntegration = Boolean(params.integrationPath);
+  const integrationPath = useExplicitIntegration
+    ? path.resolve(params.integrationPath)
+    : path.join(integrationRoot, systemKey);
+
+  if (useExplicitIntegration) {
+    if (path.basename(integrationPath) !== systemKey) {
+      throw new Error(`integrationPath must end with systemKey "${systemKey}"`);
+    }
+  } else {
+    assertPathContained(integrationPath, workspaceRoot);
+  }
+
+  return {
+    userId,
+    workspaceRoot,
+    systemKey,
+    environment: params.environment || process.env.DEFAULT_ENVIRONMENT || 'dev',
+    controllerUrl:
+      params.controllerUrl ||
+      process.env.MISO_CONTROLLER_URL ||
+      process.env.CONTROLLER_URL ||
+      '',
+    dataplaneUrl: params.dataplaneUrl || process.env.DATAPLANE_URL || '',
+    bearerToken,
+    getUserRoot: () => userRoot,
+    getIntegrationRoot: () => integrationRoot,
+    getIntegrationPath: () => integrationPath
+  };
+}
+
+/**
+ * @param {string} targetPath
+ * @param {string} workspaceRoot
+ */
+function assertPathContained(targetPath, workspaceRoot) {
+  const resolvedTarget = path.resolve(targetPath);
+  const resolvedRoot = path.resolve(workspaceRoot);
+  const rootWithSep = resolvedRoot.endsWith(path.sep) ? resolvedRoot : `${resolvedRoot}${path.sep}`;
+  if (resolvedTarget !== resolvedRoot && !resolvedTarget.startsWith(rootWithSep)) {
+    throw new Error('Path escapes workspace root');
+  }
+}
+
+/**
+ * @param {WorkspaceContext} ctx
+ * @param {() => Promise<*> | *} fn
+ * @returns {Promise<*>}
+ */
+function runWithWorkspaceContext(ctx, fn) {
+  const scope = {
+    resolveIntegrationPath: (systemKey) => {
+      assertValidSystemKey(systemKey);
+      if (systemKey !== ctx.systemKey) {
+        const alt = path.join(ctx.getIntegrationRoot(), systemKey);
+        assertPathContained(alt, ctx.workspaceRoot);
+        return alt;
+      }
+      return ctx.getIntegrationPath();
+    }
+  };
+  return runWithIntegrationPathScope(scope, fn);
+}
+
+/**
+ * @param {WorkspaceContext} ctx
+ */
+function ensureIntegrationDirectory(ctx) {
+  fs.mkdirSync(ctx.getIntegrationPath(), { recursive: true });
+}
+
+module.exports = {
+  WORKSPACE_INTEGRATION_FORMAT,
+  createWorkspaceContext,
+  runWithWorkspaceContext,
+  ensureIntegrationDirectory,
+  resolveWorkspaceRoot,
+  assertPathContained
+};

package/lib/programmatic/workspace-lock.js

@@ -0,0 +1,75 @@
+/**
+ * In-memory workspace lock (userId + systemKey) — V1 single replica.
+ *
+ * @fileoverview 409 Conflict when concurrent mutating access
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/** @type {Map<string, { acquiredAt: number }>} */
+const locks = new Map();
+
+/**
+ * @param {string} userId
+ * @param {string} systemKey
+ * @returns {string}
+ */
+function lockKey(userId, systemKey) {
+  return `${userId}:${systemKey}`;
+}
+
+/**
+ * @param {string} userId
+ * @param {string} systemKey
+ * @returns {boolean}
+ */
+function tryAcquireWorkspaceLock(userId, systemKey) {
+  const key = lockKey(userId, systemKey);
+  if (locks.has(key)) {
+    return false;
+  }
+  locks.set(key, { acquiredAt: Date.now() });
+  return true;
+}
+
+/**
+ * @param {string} userId
+ * @param {string} systemKey
+ */
+function releaseWorkspaceLock(userId, systemKey) {
+  locks.delete(lockKey(userId, systemKey));
+}
+
+/**
+ * @param {string} userId
+ * @param {string} systemKey
+ * @param {() => Promise<*>} fn
+ * @returns {Promise<*>}
+ */
+async function withWorkspaceLock(userId, systemKey, fn) {
+  if (!tryAcquireWorkspaceLock(userId, systemKey)) {
+    const err = new Error('Workspace is locked by another request');
+    err.statusCode = 409;
+    err.retryAfter = 5;
+    throw err;
+  }
+  try {
+    return await fn();
+  } finally {
+    releaseWorkspaceLock(userId, systemKey);
+  }
+}
+
+/** Test helper */
+function clearWorkspaceLocks() {
+  locks.clear();
+}
+
+module.exports = {
+  tryAcquireWorkspaceLock,
+  releaseWorkspaceLock,
+  withWorkspaceLock,
+  clearWorkspaceLocks
+};

package/lib/programmatic/workspace-meta.js

@@ -0,0 +1,64 @@
+/**
+ * `.builder-workspace-meta.json` helpers for builder-api workspaces.
+ *
+ * @fileoverview Workspace metadata (no secret fields)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('../internal/fs-real-sync');
+const path = require('path');
+
+const META_FILENAME = '.builder-workspace-meta.json';
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @returns {string}
+ */
+function getMetaPath(ctx) {
+  return path.join(ctx.getIntegrationPath(), META_FILENAME);
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @returns {Object|null}
+ */
+function readWorkspaceMeta(ctx) {
+  const metaPath = getMetaPath(ctx);
+  if (!fs.existsSync(metaPath)) {
+    return null;
+  }
+  const raw = fs.readFileSync(metaPath, 'utf8');
+  return JSON.parse(raw);
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @param {{ lastOperation?: string, lastUploadId?: string|null }} patch
+ * @returns {Object}
+ */
+function touchWorkspaceMeta(ctx, patch = {}) {
+  const metaPath = getMetaPath(ctx);
+  const now = new Date().toISOString();
+  const existing = readWorkspaceMeta(ctx);
+  const next = {
+    ownerUserId: ctx.userId,
+    systemKey: ctx.systemKey,
+    createdAt: existing?.createdAt || now,
+    lastModifiedAt: now,
+    lastOperation: patch.lastOperation || existing?.lastOperation || 'init',
+    lastUploadId: patch.lastUploadId !== undefined ? patch.lastUploadId : existing?.lastUploadId ?? null
+  };
+  fs.mkdirSync(path.dirname(metaPath), { recursive: true });
+  fs.writeFileSync(metaPath, `${JSON.stringify(next, null, 2)}\n`, 'utf8');
+  return next;
+}
+
+module.exports = {
+  META_FILENAME,
+  getMetaPath,
+  readWorkspaceMeta,
+  touchWorkspaceMeta
+};

package/lib/programmatic/workspace-ops.js

@@ -0,0 +1,149 @@
+/**
+ * Workspace CRUD for builder-api (list, create, manifest, delete).
+ *
+ * @fileoverview Multi-user integration folder operations
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('../internal/fs-real-sync');
+const path = require('path');
+const { assertValidSystemKey } = require('./system-key');
+const { ensureIntegrationDirectory } = require('./workspace-context');
+const { readWorkspaceMeta, touchWorkspaceMeta, META_FILENAME } = require('./workspace-meta');
+
+const SECRET_FILE_NAMES = new Set(['.env', 'secrets.local.yaml']);
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @returns {string[]}
+ */
+function listSystemKeys(ctx) {
+  const root = ctx.getIntegrationRoot();
+  if (!fs.existsSync(root)) {
+    return [];
+  }
+  return fs
+    .readdirSync(root, { withFileTypes: true })
+    .filter((d) => d.isDirectory() && !d.name.startsWith('.'))
+    .map((d) => d.name)
+    .sort();
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @returns {{ systems: Object[] }}
+ */
+function listSystems(ctx) {
+  const keys = listSystemKeys(ctx);
+  const systems = keys.map((systemKey) => ({
+    systemKey,
+    meta: readWorkspaceMetaForKey(ctx, systemKey)
+  }));
+  return { systems };
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @param {string} systemKey
+ * @returns {Object|null}
+ */
+function readWorkspaceMetaForKey(ctx, systemKey) {
+  const metaPath = path.join(ctx.getIntegrationRoot(), systemKey, META_FILENAME);
+  if (!fs.existsSync(metaPath)) {
+    return null;
+  }
+  return JSON.parse(fs.readFileSync(metaPath, 'utf8'));
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @param {string} [systemKey]
+ */
+function createSystem(ctx, systemKey = ctx.systemKey) {
+  assertValidSystemKey(systemKey);
+  const prior = ctx.systemKey;
+  if (systemKey !== prior) {
+    throw new Error('createSystem systemKey must match workspace context for V1');
+  }
+  ensureIntegrationDirectory(ctx);
+  const meta = touchWorkspaceMeta(ctx, { lastOperation: 'create' });
+  return { systemKey, meta };
+}
+
+/**
+ * @param {string} filePath
+ * @param {string} integrationPath
+ * @returns {boolean}
+ */
+function isSecretPath(filePath, integrationPath) {
+  const rel = path.relative(integrationPath, filePath);
+  const base = path.basename(filePath);
+  if (SECRET_FILE_NAMES.has(base)) {
+    return true;
+  }
+  return rel.includes('secrets') && base.endsWith('.yaml');
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @returns {{ systemKey: string, files: Object[], meta: Object|null }}
+ */
+function getSystemManifest(ctx) {
+  const integrationPath = ctx.getIntegrationPath();
+  if (!fs.existsSync(integrationPath)) {
+    const err = new Error('System workspace not found');
+    err.statusCode = 404;
+    throw err;
+  }
+  const files = [];
+  const walk = (dir, prefix = '') => {
+    for (const name of fs.readdirSync(dir)) {
+      if (name === META_FILENAME && !prefix) {
+        continue;
+      }
+      const full = path.join(dir, name);
+      const rel = prefix ? `${prefix}/${name}` : name;
+      if (isSecretPath(full, integrationPath)) {
+        files.push({ path: rel, redacted: true });
+        continue;
+      }
+      const stat = fs.statSync(full);
+      if (stat.isDirectory()) {
+        files.push({ path: rel, isDirectory: true });
+        walk(full, rel);
+      } else {
+        files.push({ path: rel, sizeBytes: stat.size });
+      }
+    }
+  };
+  walk(integrationPath);
+  return {
+    systemKey: ctx.systemKey,
+    meta: readWorkspaceMeta(ctx),
+    files
+  };
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ */
+function deleteSystem(ctx) {
+  const integrationPath = ctx.getIntegrationPath();
+  if (!fs.existsSync(integrationPath)) {
+    const err = new Error('System workspace not found');
+    err.statusCode = 404;
+    throw err;
+  }
+  fs.rmSync(integrationPath, { recursive: true, force: true });
+  return { systemKey: ctx.systemKey, deleted: true };
+}
+
+module.exports = {
+  listSystems,
+  createSystem,
+  getSystemManifest,
+  deleteSystem
+};

package/lib/protection/run-commands-upload-sync.js

@@ -0,0 +1,35 @@
+/**
+ * @fileoverview Protection upload sync step after manifest publish.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { resolveSyncPlan, executeSyncPlan } = require('../commands/datasource-sync-policy');
+const { logDatasourceSyncSummary } = require('../commands/datasource-sync-display');
+
+/**
+ * @param {Object} ctx
+ * @param {string} datasourceKey
+ * @param {Object} opts
+ * @returns {Promise<void>}
+ */
+async function runProtectionUploadDataSync(ctx, datasourceKey, opts) {
+  const plan = await resolveSyncPlan({
+    syncExplicit: opts.sync === true,
+    skipSync: false,
+    datasourceKeys: [datasourceKey],
+    dataplaneUrl: ctx.dataplaneUrl,
+    authConfig: ctx.authConfig
+  });
+  const syncResult = await executeSyncPlan(plan, ctx.dataplaneUrl, ctx.authConfig);
+  logDatasourceSyncSummary(syncResult, {
+    label: 'Protection upload data sync',
+    syncExplicit: opts.sync === true
+  });
+}
+
+module.exports = {
+  runProtectionUploadDataSync
+};

package/lib/protection/run-commands.js

@@ -19,7 +19,7 @@ const {
   findProtectionKeyByDatasource
 } = require('../api/protection.api');
 const { preflightDatasourceReady } = require('./preflight-datasource-ready');
-const { syncDatasourceAfterProtectionUpload } = require('./sync-after-upload');
+const { runProtectionUploadDataSync } = require('./run-commands-upload-sync');
 const {
   formatProtectionListTTY,
   formatProtectionShowTTY,
@@ -69,25 +69,7 @@ async function runProtectionUpload(datasourceKey, manifest, opts, logger) {
     )
   );
 
-  if (!opts.noSync) {
-    logger.log(formatProgress(`Syncing datasource ${datasourceKey}...`));
-    const sync = await syncDatasourceAfterProtectionUpload(
-      ctx.dataplaneUrl,
-      ctx.authConfig,
-      datasourceKey
-    );
-    if (sync.syncJobId) {
-      logger.log(formatSuccessLine(`Sync started (syncJobId: ${sync.syncJobId})`));
-    } else if (sync.warning) {
-      logger.log(formatWarningLine(`Sync warning: ${sync.warning}`));
-    }
-  } else {
-    logger.log(
-      chalk.gray(
-        'Sync skipped (--no-sync). Protection active on dataplane; projections update on next datasource sync.'
-      )
-    );
-  }
+  await runProtectionUploadDataSync(ctx, datasourceKey, opts, logger);
   return 0;
 }
 

package/lib/protection/upload-batch.js

@@ -14,7 +14,7 @@ const { resolveProtectionDataplaneContext } = require('./auth-context');
 const { validateProtection, uploadProtection } = require('../api/protection.api');
 const { exitCodeFromProtectionReport } = require('./report-exit');
 const { preflightDatasourceReady } = require('./preflight-datasource-ready');
-const { syncUniqueDatasourcesAfterUpload } = require('./sync-after-upload');
+const { resolveSyncPlan, executeSyncPlan } = require('../commands/datasource-sync-policy');
 const { formatProtectionBatchUploadTTY } = require('./protection-display');
 
 /**
@@ -87,12 +87,16 @@ async function runUploadProtectionBatch(opts = {}) {
   }
 
   let syncResults = [];
-  if (!opts.dryRun && !opts.noSync && uploadedDatasourceKeys.length) {
-    syncResults = await syncUniqueDatasourcesAfterUpload(
-      ctx.dataplaneUrl,
-      ctx.authConfig,
-      uploadedDatasourceKeys
-    );
+  if (!opts.dryRun && uploadedDatasourceKeys.length) {
+    const plan = await resolveSyncPlan({
+      syncExplicit: opts.sync === true,
+      skipSync: false,
+      datasourceKeys: uploadedDatasourceKeys,
+      dataplaneUrl: ctx.dataplaneUrl,
+      authConfig: ctx.authConfig
+    });
+    const executed = await executeSyncPlan(plan, ctx.dataplaneUrl, ctx.authConfig);
+    syncResults = executed.executed;
   }
 
   const ok = results.length > 0 && results.every((r) => r.ok);

package/lib/resolvers/resource-type-file.js

@@ -19,6 +19,7 @@ const { existsSync, readFileSync } = require('../internal/fs-real-sync');
  * @property {string} [category]
  * @property {string} [defaultRiskLevel]
  * @property {string} [status]
+ * @property {string} domain
  */
 
 const CATEGORIES = new Set([
@@ -32,6 +33,7 @@ const CATEGORIES = new Set([
 
 const RISK_LEVELS = new Set(['low', 'medium', 'high', 'critical']);
 const STATUSES = new Set(['draft', 'active', 'deprecated', 'retired']);
+const DOMAIN_KEY_PATTERN = /^[a-z][a-z0-9-]*$/;
 
 /**
  * @param {string} filePath
@@ -75,6 +77,25 @@ function applyOptionalEnumField(parsed, field, allowedValues, label) {
   parsed[field] = value;
 }
 
+/**
+ * @param {object} entry
+ * @param {number} index
+ * @returns {void}
+ */
+function applyRequiredDomainField(entry, index) {
+  const raw = entry.domain;
+  const value = typeof raw === 'string' ? raw.trim().toLowerCase() : '';
+  if (!value) {
+    throw new Error(`resourceTypes[${index}].domain is required`);
+  }
+  if (!DOMAIN_KEY_PATTERN.test(value)) {
+    throw new Error(
+      'domain must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens'
+    );
+  }
+  entry.domain = value;
+}
+
 /**
  * @param {object} parsed
  * @returns {void}
@@ -102,6 +123,7 @@ function normalizeResourceTypeCreateRow(row, index) {
   applyOptionalEnumField(entry, 'category', CATEGORIES, 'category');
   applyOptionalEnumField(entry, 'defaultRiskLevel', RISK_LEVELS, 'defaultRiskLevel');
   applyOptionalEnumField(entry, 'status', STATUSES, 'status');
+  applyRequiredDomainField(entry, index);
   const key = String(entry.key || '').trim();
   if (!key) {
     throw new Error(`resourceTypes[${index}].key is required`);