@aifabrix/builder 2.49.1 → 2.50.0

package/lib/schema/external-datasource.schema.json

@@ -7,7 +7,7 @@
          "key":"external-datasource-schema",
          "name":"External Data Source Configuration Schema",
          "description":"JSON schema for validating ExternalDataSource configuration files",
-     "version":"2.8.1",
+     "version":"2.9.2",
          "type":"schema",
          "category":"integration",
          "author":"AI Fabrix Team",
@@ -31,6 +31,41 @@
          "external-system.schema.json"
       ],
       "changelog":[
+         {
+            "version":"2.9.2",
+            "date":"2026-07-02T00:00:00Z",
+            "changes":[
+               "Removed webhook.eventTypeHeader and webhook.vendorDeliveryIdHeader — inbound HTTP header names belong on webhookInbound credential config only.",
+               "Retained optional webhook.eventTypePath and webhook.vendorDeliveryIdPath for payload JSONPath routing and idempotency."
+            ],
+            "breaking":false
+         },
+         {
+            "version":"2.9.1",
+            "date":"2026-07-02T00:00:00Z",
+            "changes":[
+               "Added optional webhook.eventTypeHeader, webhook.eventTypePath, webhook.vendorDeliveryIdHeader, and webhook.vendorDeliveryIdPath for manifest-driven routing and idempotency."
+            ],
+            "breaking":false
+         },
+         {
+            "version":"2.9.0",
+            "date":"2026-07-02T00:00:00Z",
+            "changes":[
+               "Added webhook object (enabled, endpointMode, events, deleteEvents, idPath) for vendor change signals.",
+               "Documented syncBridge enum (disabled|master|bidirectional) for Enterprise Synchronization Fabrix."
+            ],
+            "breaking":false
+         },
+         {
+            "version":"2.8.2",
+            "date":"2026-06-29T00:00:00Z",
+            "changes":[
+               "Documented entityType none MUST NOT bind vendor openapi (439.2); use serviceContract for HTTP facades.",
+               "Staged validator migration NONE_OPENAPI phases 1–3; JSON Schema hard gate planned for phase 3."
+            ],
+            "breaking":false
+         },
          {
             "version":"2.8.1",
             "date":"2026-06-15T00:00:00Z",
@@ -417,6 +452,68 @@
          },
          "uniqueItems":true
       },
+      "syncBridge":{
+         "type":"string",
+         "enum":[
+            "disabled",
+            "master",
+            "bidirectional"
+         ],
+         "default":"disabled",
+         "description":"Enterprise Synchronization Fabrix participation mode (454.0). Generated on supply datasource during Enterprise Knowledge compile; default disabled on vendor integrations."
+      },
+      "webhook":{
+         "type":"object",
+         "description":"Vendor webhook change-signal configuration (454.0). Webhook is trigger-only; business data comes from CIP get.",
+         "additionalProperties":false,
+         "properties":{
+            "enabled":{
+               "type":"boolean",
+               "default":false
+            },
+            "endpointMode":{
+               "type":"string",
+               "enum":[
+                  "system",
+                  "datasource",
+                  "event"
+               ],
+               "description":"Controls generated POST receiver path scope."
+            },
+            "events":{
+               "type":"array",
+               "minItems":1,
+               "items":{
+                  "type":"string",
+                  "minLength":1
+               },
+               "description":"Vendor event names that trigger SyncIntent creation."
+            },
+            "deleteEvents":{
+               "type":"array",
+               "items":{
+                  "type":"string",
+                  "minLength":1
+               },
+               "description":"Optional subset of events that signal local soft delete only (no provider delete in V1)."
+            },
+            "idPath":{
+               "type":"string",
+               "minLength":1,
+               "description":"JSONPath to extract vendor object id from webhook payload, e.g. $.objectId"
+            },
+            "eventTypePath":{
+               "type":"string",
+               "minLength":1,
+               "description":"JSONPath to vendor event type in payload when endpointMode is not event and webhook.events has multiple entries."
+            },
+            "vendorDeliveryIdPath":{
+               "type":"string",
+               "minLength":1,
+               "description":"JSONPath to vendor delivery id in payload for idempotent deduplication."
+            }
+         }
+      },
       "dimensions":{
          "type":"object",
          "description":"Canonical dimension bindings for this datasource. Keys must exist in Dimension Catalog when catalog validation runs. For recordStorage/documentStorage, at least one binding is recommended (application validator may warn if missing or empty).",
@@ -2433,6 +2530,15 @@
             "lineage":{
                "$ref":"#/$defs/cipLineage"
             },
+            "enabled":{
+               "type":"boolean",
+               "default":true,
+               "description":"When false, the CIP executor skips this step during operation execution."
+            },
+            "order":{
+               "type":"number",
+               "description":"Optional execution order within the operation; lower values run first when any step defines order."
+            },
             "stepId":{
                "type":"string",
                "pattern":"^[a-z0-9-_]+$",
@@ -2498,6 +2604,15 @@
             "lineage":{
                "$ref":"#/$defs/cipLineage"
             },
+            "enabled":{
+               "type":"boolean",
+               "default":true,
+               "description":"When false, the CIP executor skips this step during operation execution."
+            },
+            "order":{
+               "type":"number",
+               "description":"Optional execution order within the operation; lower values run first when any step defines order."
+            },
             "stepId":{
                "type":"string",
                "pattern":"^[a-z0-9-_]+$",
@@ -2539,6 +2654,15 @@
                },
                "additionalProperties":false
             },
+            "enabled":{
+               "type":"boolean",
+               "default":true,
+               "description":"When false, the CIP executor skips this step during operation execution."
+            },
+            "order":{
+               "type":"number",
+               "description":"Optional execution order within the operation; lower values run first when any step defines order."
+            },
             "stepId":{
                "type":"string",
                "description":"Optional stable step identifier."
@@ -2583,6 +2707,15 @@
             "lineage":{
                "$ref":"#/$defs/cipLineage"
             },
+            "enabled":{
+               "type":"boolean",
+               "default":true,
+               "description":"When false, the CIP executor skips this step during operation execution."
+            },
+            "order":{
+               "type":"number",
+               "description":"Optional execution order within the operation; lower values run first when any step defines order."
+            },
             "stepId":{
                "type":"string",
                "pattern":"^[a-z0-9-_]+$",
@@ -2655,6 +2788,15 @@
             "lineage":{
                "$ref":"#/$defs/cipLineage"
             },
+            "enabled":{
+               "type":"boolean",
+               "default":true,
+               "description":"When false, the CIP executor skips this step during operation execution."
+            },
+            "order":{
+               "type":"number",
+               "description":"Optional execution order within the operation; lower values run first when any step defines order."
+            },
             "stepId":{
                "type":"string",
                "pattern":"^[a-z0-9-_]+$",
@@ -2699,6 +2841,15 @@
             "lineage":{
                "$ref":"#/$defs/cipLineage"
             },
+            "enabled":{
+               "type":"boolean",
+               "default":true,
+               "description":"When false, the CIP executor skips this step during operation execution."
+            },
+            "order":{
+               "type":"number",
+               "description":"Optional execution order within the operation; lower values run first when any step defines order."
+            },
             "stepId":{
                "type":"string",
                "pattern":"^[a-z0-9-_]+$",
@@ -2733,6 +2884,15 @@
             "lineage":{
                "$ref":"#/$defs/cipLineage"
             },
+            "enabled":{
+               "type":"boolean",
+               "default":true,
+               "description":"When false, the CIP executor skips this step during operation execution."
+            },
+            "order":{
+               "type":"number",
+               "description":"Optional execution order within the operation; lower values run first when any step defines order."
+            },
             "stepId":{
                "type":"string",
                "pattern":"^[a-z0-9-_]+$",

package/lib/schema/external-system.schema.json

@@ -7,7 +7,7 @@
       "key": "external-system-schema",
       "name": "External System Configuration Schema",
       "description": "JSON schema for validating ExternalSystem configuration files",
-      "version": "1.9.0",
+      "version": "1.13.0",
       "type": "schema",
       "category": "integration",
       "author": "AI Fabrix Team",
@@ -27,6 +27,38 @@
       ],
       "dependencies": [],
       "changelog": [
+         {
+            "version": "1.13.0",
+            "date": "2026-07-02T00:00:00Z",
+            "changes": [
+               "Added authentications[] with usage enum (api, webhookInbound, syncExecution, messageInbound, messageOutbound, callback, provisioning). Legacy authentication retained with deprecation."
+            ],
+            "breaking": false
+         },
+         {
+            "version": "1.12.0",
+            "date": "2026-06-30T00:00:00Z",
+            "changes": [
+               "authentication.credential.formFields accepts array (allowlist) or object with defaults { visible, required, locked } and fields[] for allowlist/denylist projection."
+            ],
+            "breaking": false
+         },
+         {
+            "version": "1.11.0",
+            "date": "2026-06-30T00:00:00Z",
+            "changes": [
+               "authentication.credential.formFields[] items may set optional label and placeholder overrides per field."
+            ],
+            "breaking": false
+         },
+         {
+            "version": "1.10.0",
+            "date": "2026-06-30T00:00:00Z",
+            "changes": [
+               "Added optional authentication.credential.formFields[] for per-system Authentication tab field projection."
+            ],
+            "breaking": false
+         },
          {
             "version": "1.9.0",
             "date": "2026-06-15T00:00:00Z",
@@ -475,7 +507,7 @@
                },
                {
                   "key": "clientId",
-                  "required": true
+                  "required": false
                },
                {
                   "key": "expectedIssuer",
@@ -499,7 +531,12 @@
                   "description": "Optional URL used when testing the credential (GET). Full URL or path. For OIDC, discovery URL is typically used if testEndpoint omitted."
                }
             ],
-            "security": []
+            "security": [
+               {
+                  "key": "clientSecret",
+                  "required": false
+               }
+            ]
          },
          "hmac": {
             "variables": [
@@ -533,6 +570,14 @@
                {
                   "key": "signingSecret",
                   "required": true
+               },
+               {
+                  "key": "botToken",
+                  "required": false
+               },
+               {
+                  "key": "clientSecret",
+                  "required": false
                }
             ]
          },
@@ -591,6 +636,117 @@
                "type": "boolean",
                "description": "Template is immutable after first deploy.",
                "default": true
+            },
+            "formFields": {
+               "description": "Optional Authentication tab field projection. Omitted: security keys only; variables hidden. Array: allowlist. Object: defaults.visible false = allowlist on fields[]; defaults.visible true = registry denylist.",
+               "oneOf": [
+                  {
+                     "type": "array",
+                     "items": {
+                        "type": "object",
+                        "required": [
+                           "name"
+                        ],
+                        "properties": {
+                           "name": {
+                              "type": "string",
+                              "minLength": 1,
+                              "description": "Registry field name for authentication.credential.method."
+                           },
+                           "required": {
+                              "type": "boolean",
+                              "description": "Override registry required flag for this field."
+                           },
+                           "visible": {
+                              "type": "boolean",
+                              "description": "When false, exclude this field from the projected form."
+                           },
+                           "locked": {
+                              "type": "boolean",
+                              "description": "When true, show read-only (prefilled from variables or stored config)."
+                           },
+                           "label": {
+                              "type": "string",
+                              "minLength": 1,
+                              "description": "Override registry display label for this field on the Authentication tab."
+                           },
+                           "placeholder": {
+                              "type": "string",
+                              "description": "Override registry placeholder for this field on the Authentication tab."
+                           }
+                        },
+                        "additionalProperties": false
+                     }
+                  },
+                  {
+                     "type": "object",
+                     "required": [
+                        "fields"
+                     ],
+                     "properties": {
+                        "defaults": {
+                           "type": "object",
+                           "properties": {
+                              "visible": {
+                                 "type": "boolean"
+                              },
+                              "required": {
+                                 "type": "boolean"
+                              },
+                              "locked": {
+                                 "type": "boolean"
+                              }
+                           },
+                           "additionalProperties": false
+                        },
+                        "visible": {
+                           "type": "boolean",
+                           "description": "Default visible flag for entries in fields[] (false = allowlist mode)."
+                        },
+                        "required": {
+                           "type": "boolean",
+                           "description": "Default required flag for entries in fields[]."
+                        },
+                        "locked": {
+                           "type": "boolean",
+                           "description": "Default locked flag for entries in fields[]."
+                        },
+                        "fields": {
+                           "type": "array",
+                           "items": {
+                              "type": "object",
+                              "required": [
+                                 "name"
+                              ],
+                              "properties": {
+                                 "name": {
+                                    "type": "string",
+                                    "minLength": 1
+                                 },
+                                 "required": {
+                                    "type": "boolean"
+                                 },
+                                 "visible": {
+                                    "type": "boolean"
+                                 },
+                                 "locked": {
+                                    "type": "boolean"
+                                 },
+                                 "label": {
+                                    "type": "string",
+                                    "minLength": 1
+                                 },
+                                 "placeholder": {
+                                    "type": "string"
+                                 }
+                              },
+                              "additionalProperties": false
+                           }
+                        }
+                     },
+                     "additionalProperties": false
+                  }
+               ]
             }
          },
          "additionalProperties": false
@@ -609,6 +765,80 @@
             }
          },
          "additionalProperties": false
+      },
+      "authenticationUsageEntry": {
+         "type": "object",
+         "description": "Authentication slot with usage separation. Reuses authType branches from legacy authentication.",
+         "required": [
+            "key",
+            "usage",
+            "authType"
+         ],
+         "properties": {
+            "key": {
+               "type": "string",
+               "pattern": "^[a-zA-Z0-9_-]+$",
+               "minLength": 1,
+               "maxLength": 64
+            },
+            "usage": {
+               "type": "string",
+               "enum": [
+                  "api",
+                  "webhookInbound",
+                  "syncExecution",
+                  "messageInbound",
+                  "messageOutbound",
+                  "callback",
+                  "provisioning"
+               ]
+            },
+            "authType": {
+               "type": "string",
+               "enum": [
+                  "credential",
+                  "apiProvider",
+                  "none"
+               ]
+            },
+            "credential": {
+               "$ref": "#/$defs/credentialTemplate"
+            },
+            "apiProvider": {
+               "$ref": "#/$defs/apiProviderReference"
+            }
+         },
+         "additionalProperties": false,
+         "allOf": [
+            {
+               "if": {
+                  "properties": {
+                     "authType": {
+                        "const": "credential"
+                     }
+                  }
+               },
+               "then": {
+                  "required": [
+                     "credential"
+                  ]
+               }
+            },
+            {
+               "if": {
+                  "properties": {
+                     "authType": {
+                        "const": "apiProvider"
+                     }
+                  }
+               },
+               "then": {
+                  "required": [
+                     "apiProvider"
+                  ]
+               }
+            }
+         ]
       }
    },
    "x-systemKindCatalog": {
@@ -801,7 +1031,7 @@
          "default": false
       },
       "authentication": {
-         "description": "Nested authentication: authType credential (local template), apiProvider (Miso delegated), or none.",
+         "description": "Nested authentication: authType credential (local template), apiProvider (Miso delegated), or none. Deprecated — prefer authentications[] with usage.",
          "oneOf": [
             {
                "type": "object",
@@ -849,6 +1079,14 @@
             }
          ]
       },
+      "authentications": {
+         "type": "array",
+         "description": "Multi-slot authentication with usage separation. One authentication normalizes to [{key:default, usage:api, ...}].",
+         "items": {
+            "$ref": "#/$defs/authenticationUsageEntry"
+         },
+         "uniqueItems": true
+      },
       "openapi": {
          "type": "object",
          "description": "System-level connectivity and bootstrap hints for OpenAPI-backed systems (e.g. default specUrl for discovery, documentKey alignment with shared registry entries). Not the authoritative per-datasource vendor OpenAPI contract; that is declared on the datasource via externalSpec and validated against imported material.",

package/lib/schema/flag-map-validation-run.json

@@ -9,6 +9,9 @@
     { "cliFlag": "-e, --env <env>", "requestField": null, "note": "Controller/dataplane URL and token selection" },
     { "cliFlag": "-p, --payload <file>", "requestField": "payloadTemplate", "note": "Loaded object merged into request when integration-style test" },
     { "cliFlag": "--timeout <ms>", "requestField": null, "note": "Client aggregate HTTP budget (POST + polls)" },
+    { "cliFlag": "--version <target>", "requestField": "e2eOptions.versionTarget", "runType": "e2e", "default": "latest", "values": ["latest", "running", "<versionId>"] },
+    { "cliFlag": "--sync-mode <mode>", "requestField": "e2eOptions.syncMode", "runType": "e2e", "default": "auto", "values": ["auto", "never", "force"], "note": "Distinct from --sync (publish local files before test)" },
+    { "cliFlag": "--sync", "requestField": null, "note": "Publish local integration files before test (upload); not the same as --sync-mode" },
     { "cliFlag": "--debug [level]", "requestField": "includeDebug", "default": false, "note": "summary|full|raw affects TTY appendix only; any presence sets includeDebug" },
     { "cliFlag": "--no-async", "requestField": "asyncRun", "note": "When true on CLI, omit asyncRun or set false; sync-only POST" },
     { "cliFlag": "--no-run-scenarios", "requestField": "e2eOptions.runScenarios", "runType": "e2e" },

package/lib/schema/type/credential-field-registry.json

@@ -394,7 +394,7 @@
       ]
     },
     "oidc": {
-      "active": false,
+      "active": true,
       "display": {
         "label": "OIDC",
         "order": 5
@@ -485,7 +485,7 @@
       ]
     },
     "hmac": {
-      "active": false,
+      "active": true,
       "display": {
         "label": "HMAC",
         "order": 6

package/lib/schema/type/document-storage.json

@@ -279,6 +279,15 @@
             }
           },
           "additionalProperties": false
+        },
+        "fieldHints": {
+          "type": "object",
+          "description": "Optional per-field extraction hints for governed FK review (plan 441.1).",
+          "additionalProperties": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 512
+          }
         }
       },
       "additionalProperties": false

package/lib/utils/agent-trust-run-display.js

@@ -90,7 +90,7 @@ function logTrustWarningsAndFindings(run, opts) {
 function logTrustFooter(run, opts) {
   logger.log('');
   logger.log(metaGray('  ── Integration reality (informative) ──'));
-  logger.log(metaGray(`  Local manifest:  ${opts.noSync ? 'not uploaded (--no-sync)' : 'uploaded before run'}`));
+  logger.log(metaGray(`  Local manifest:  ${opts.noPublish ? 'not uploaded (--no-publish)' : 'uploaded before run'}`));
   logger.log(metaGray(`  Publish gate:    ${publishGateLine(run.trustDecision, opts.strict === true)}`));
   logger.log(SEP);
 }