@aifabrix/builder 2.49.1 → 2.50.0

package/lib/app/show.js

@@ -20,16 +20,12 @@ const generator = require('../generator');
 const { getConfig, normalizeControllerUrl } = require('../core/config');
 const { getOrRefreshDeviceToken } = require('../utils/token-manager');
 const { resolveControllerUrl } = require('../utils/controller-url');
-const { resolveEnvironment } = require('../core/config');
-const { getApplication } = require('../api/applications.api');
 const {
   getExternalSystem,
   getExternalSystemConfig,
   listOpenAPIFiles,
   listOpenAPIEndpoints
 } = require('../api/external-systems.api');
-const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
-const { formatApiError } = require('../utils/api-error-handler');
 const { formatAuthenticationError } = require('../utils/error-formatters/http-status-errors');
 const { display: displayShow } = require('./show-display');
 const {
@@ -790,31 +786,27 @@ async function runOffline(appKey, json, permissionsOnly, verifyCert = false) {
   displayShow(summary, { permissionsOnly: !!permissionsOnly });
 }
 
-async function resolveOnlineAuth(controllerUrl) {
-  const config = await getConfig();
-  const authResult = await getShowAuthToken(controllerUrl, config);
-  return { authConfig: { type: 'bearer', token: authResult.token }, authResult };
-}
-
-function ensureApplicationResponse(response, appKey, authResult) {
-  if (!response.success) {
-    if (response.status === 404) {
-      throw new Error(`Application "${appKey}" not found on controller.`);
-    }
-    const formatted = response.formattedError || formatApiError(response, authResult.actualControllerUrl);
-    logger.error(formatted);
-    throw new Error('Failed to get application from controller.');
+async function showApp(appKey, options = {}) {
+  if (!appKey || typeof appKey !== 'string') {
+    throw new Error('appKey is required');
   }
-  return response.data || response;
-}
 
-async function fetchExternalSystemForOnline(controllerUrl, appKey, authConfig) {
-  try {
-    const environment = await resolveEnvironment();
-    const dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig);
-    return await fetchExternalSystemFromDataplane(dataplaneUrl, appKey, authConfig);
-  } catch (err) {
-    return { error: err.message || 'dataplane unreachable or not found' };
+  const online = Boolean(options.online);
+  const json = Boolean(options.json);
+  const permissions = Boolean(options.permissions);
+  const verifyCert = Boolean(options.verifyCert);
+  const appsOnly = Boolean(options.appsOnly);
+
+  if (online) {
+    const { runOnlineShow } = require('./show-online');
+    await runOnlineShow(appKey, {
+      json,
+      permissionsOnly: permissions,
+      verifyCert,
+      appsOnly
+    });
+  } else {
+    await runOffline(appKey, json, permissions, verifyCert);
   }
 }
 
@@ -861,6 +853,12 @@ function outputOnlineJson(summary, permissionsOnly, manifestSource) {
   if (summary.localRunProfile) {
     out.localRunProfile = summary.localRunProfile;
   }
+  if (summary.dataplaneUrl) {
+    out.dataplaneUrl = summary.dataplaneUrl;
+  }
+  if (summary.externalOnly) {
+    out.externalOnly = true;
+  }
   if (summary.externalSystem !== undefined && summary.externalSystem !== null) {
     out.externalSystem = summary.externalSystem && summary.externalSystem.error
       ? { error: summary.externalSystem.error }
@@ -872,67 +870,11 @@ function outputOnlineJson(summary, permissionsOnly, manifestSource) {
 
 /**
  * Run show in online mode: getApplication, optionally dataplane for external, display or JSON.
- * @param {string} appKey - Application key
- * @param {boolean} json - Output as JSON
- * @param {boolean} [permissionsOnly] - When true, output only permissions
- * @param {boolean} [verifyCert] - When true, attempt dataplane verify for external apps
- * @throws {Error} On auth failure, 404, or API error
+ * @deprecated Use ./show-online runOnlineShow
  */
-async function runOnline(appKey, json, permissionsOnly, verifyCert = false) {
-  const controllerUrl = await resolveControllerUrl();
-  if (!controllerUrl) {
-    throw new Error('Controller URL is required for --online. Run aifabrix login to set the controller URL in config.yaml.');
-  }
-  const { authConfig, authResult } = await resolveOnlineAuth(controllerUrl);
-  const response = await getApplication(controllerUrl, appKey, authConfig);
-  const apiApp = ensureApplicationResponse(response, appKey, authResult);
-  const appData = apiApp.data || apiApp;
-  const cfg = appData.configuration && typeof appData.configuration === 'object' ? appData.configuration : {};
-  const isExternalApp = appData.type === 'external' || cfg.type === 'external';
-  const externalSystem = isExternalApp
-    ? await fetchExternalSystemForOnline(controllerUrl, appKey, authConfig)
-    : null;
-  const summary = buildOnlineSummary(apiApp, authResult.actualControllerUrl, externalSystem);
-  await enrichExternalShowSummary(summary, appKey, verifyCert, {
-    token: authConfig.token,
-    controllerUrl: authResult.actualControllerUrl
-  });
-  attachRunDefaultsFromUserConfig(summary, appKey, await getConfig());
-  await attachDeclarativeUrlsToShowApplication(summary, appKey);
-  if (json) {
-    const manifestSource = await tryGetLocalManifestSourceForJson(appKey);
-    outputOnlineJson(summary, permissionsOnly, manifestSource);
-    return;
-  }
-  displayShow(summary, { permissionsOnly: !!permissionsOnly });
-}
-
-/**
- * Show application info (offline by default, or from controller with --online).
- * @async
- * @param {string} appKey - Application key
- * @param {Object} options - Options
- * @param {boolean} [options.online] - Fetch from controller
- * @param {boolean} [options.json] - Output as JSON
- * @param {boolean} [options.permissions] - When true, output only permissions (app show --permissions)
- * @param {boolean} [options.verifyCert] - When true, attach dataplane certificate verify rows (external)
- * @throws {Error} If file missing/invalid (offline) or API/auth error (online)
- */
-async function showApp(appKey, options = {}) {
-  if (!appKey || typeof appKey !== 'string') {
-    throw new Error('appKey is required');
-  }
-
-  const online = Boolean(options.online);
-  const json = Boolean(options.json);
-  const permissions = Boolean(options.permissions);
-  const verifyCert = Boolean(options.verifyCert);
-
-  if (online) {
-    await runOnline(appKey, json, permissions, verifyCert);
-  } else {
-    await runOffline(appKey, json, permissions, verifyCert);
-  }
+async function runOnline(appKey, json, permissionsOnly, verifyCert = false, appsOnly = false) {
+  const { runOnlineShow } = require('./show-online');
+  await runOnlineShow(appKey, { json, permissionsOnly, verifyCert, appsOnly });
 }
 
 module.exports = {
@@ -944,5 +886,12 @@ module.exports = {
   buildOnlineSummary,
   formatHealthCheckForDisplay,
   formatBuildForDisplay,
-  getShowAuthToken
+  getShowAuthToken,
+  fetchExternalSystemFromDataplane,
+  enrichExternalShowSummary,
+  attachRunDefaultsFromUserConfig,
+  attachDeclarativeUrlsToShowApplication,
+  outputOnlineJson,
+  tryGetLocalManifestSourceForJson,
+  runOnline
 };

package/lib/build/builder-api-docker-staging.js

@@ -0,0 +1,47 @@
+/**
+ * Pre-build staging for builder-api Docker images.
+ * @fileoverview Runs scripts/stage_builder_api_for_docker.js before docker build
+ */
+
+'use strict';
+
+const fsSync = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const logger = require('../utils/logger');
+const { formatProgress, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+
+/**
+ * @param {string} contextPath
+ * @returns {void}
+ */
+function runBuilderApiDockerStaging(contextPath) {
+  const scriptPath = path.join(contextPath, 'scripts/stage_builder_api_for_docker.js');
+  if (!fsSync.existsSync(scriptPath)) {
+    throw new Error(`Missing builder-api staging script: ${scriptPath}`);
+  }
+  logger.log(formatProgress('Staging builder-api runtime tree for Docker…'));
+  const result = spawnSync(process.execPath, [scriptPath], {
+    cwd: contextPath,
+    encoding: 'utf8'
+  });
+  if (result.status !== 0) {
+    const detail = (result.stderr || result.stdout || '').trim();
+    throw new Error(detail || 'builder-api Docker staging failed');
+  }
+  logger.log(formatSuccessLine('Builder-api runtime staging ready'));
+}
+
+/**
+ * @param {string} contextPath
+ * @param {string} appName
+ * @returns {Promise<void>}
+ */
+async function maybeStageBuilderApiForDockerBuild(contextPath, appName) {
+  if (String(appName || '').trim() !== 'builder-api') {
+    return;
+  }
+  runBuilderApiDockerStaging(contextPath);
+}
+
+module.exports = { maybeStageBuilderApiForDockerBuild, runBuilderApiDockerStaging };

package/lib/build/miso-controller-npm-sdk-guard.js

@@ -4,8 +4,8 @@
  */
 
 const { execFileSync } = require('child_process');
-const fs = require('fs');
 const path = require('path');
+const { existsSync } = require('../internal/fs-real-sync');
 
 /**
  * @param {string} repoRoot - aifabrix-miso repo root (Docker build context)
@@ -16,7 +16,7 @@ function assertMisoControllerNpmSdkDeps(repoRoot) {
     repoRoot,
     'packages/miso-controller/scripts/assert-npm-sdk-deps.js'
   );
-  if (!fs.existsSync(script)) {
+  if (!existsSync(script)) {
     throw new Error(`miso-controller SDK guard not found: ${script}`);
   }
   execFileSync('node', [script], { cwd: repoRoot, stdio: 'inherit' });

package/lib/build/standard-docker-build.js

@@ -14,6 +14,7 @@ const { ensureRunSecretsForApp } = require('../app/run-env-compose');
 const { formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
 const { resolveDockerBuildArgsForApp } = require('./docker-build-args');
 const { maybeStageIntegrationForDockerBuild } = require('./integration-docker-staging');
+const { maybeStageBuilderApiForDockerBuild } = require('./builder-api-docker-staging');
 
 /**
  * Lazy require breaks circular dependency with lib/build/index.js.
@@ -70,6 +71,7 @@ async function executeDockerImageBuild(appName, options, buildConfig) {
   );
   const contextPath = prepareBuildContext(buildConfig, devDir);
   await maybeStageIntegrationForDockerBuild(contextPath);
+  await maybeStageBuilderApiForDockerBuild(contextPath, appName);
   const dockerfilePath = await handleDockerfileGeneration(
     appName,
     { devDir, buildConfig, contextPath, appConfig },

package/lib/certification/post-unified-cert-sync.js

@@ -1,44 +1,17 @@
 /**
- * @fileoverview After successful unified datasource validation, optionally sync system certification.
+ * @fileoverview Post-unified-test certification sync (removed — use validate --cert-sync).
  * @author AI Fabrix Team
  * @version 2.0.0
  */
 
 'use strict';
 
-const chalk = require('chalk');
-const logger = require('../utils/logger');
-const { trySyncCertificationFromDataplaneForExternalApp } = require('./sync-after-external-command');
-const { cliOptsSkipCertSync } = require('./cli-cert-sync-skip');
-const { resolveDebugDisplayMode } = require('../utils/datasource-test-run-debug-display');
-
 /**
- * @async
- * @param {number} exitCode
- * @param {string} datasourceKey
- * @param {Object} options - CLI flags (app, noCertSync)
- * @param {string} label - Log label
- * @param {Object|null} [envelope] - Last DatasourceTestRun (optional); used for certificateIssuance failed hint
+ * No-op: local certification block sync is opt-in via `aifabrix validate --cert-sync` only.
  * @returns {Promise<void>}
  */
-async function afterUnifiedValidationCertSync(exitCode, datasourceKey, options, label, envelope = null) {
-  if (exitCode !== 0 || cliOptsSkipCertSync(options)) return;
-  try {
-    const { resolveAppKeyForDatasource } = require('../datasource/resolve-app');
-    const { appKey } = await resolveAppKeyForDatasource(datasourceKey, options.app);
-    let issuanceFailureHint = null;
-    if (envelope && envelope.certificateIssuance && envelope.certificateIssuance.status === 'failed') {
-      const ci = envelope.certificateIssuance;
-      issuanceFailureHint = [ci.reasonCode, ci.message].filter(Boolean).join(': ');
-    }
-    const verboseCertHints = resolveDebugDisplayMode(options.debug) !== null;
-    await trySyncCertificationFromDataplaneForExternalApp(appKey, label, {
-      issuanceFailureHint,
-      verboseCertHints
-    });
-  } catch (e) {
-    logger.log(chalk.yellow(`⚠ Certification sync (${label}) skipped: ${e.message}`));
-  }
+async function afterUnifiedValidationCertSync() {
+  return undefined;
 }
 
 module.exports = { afterUnifiedValidationCertSync };

package/lib/certification/sync-after-external-command.js

@@ -39,7 +39,6 @@ async function trySyncCertificationFromDataplaneForExternalApp(appKey, label, ex
     const dsKeys = (manifest.dataSources || []).map((ds) => ds && ds.key).filter(Boolean);
     await maybeSyncSystemCertificationFromDataplane({
       label,
-      noCertSync: false,
       systemKey: manifest.key,
       dataplaneUrl,
       authConfig,

package/lib/certification/sync-system-certification.js

@@ -185,7 +185,6 @@ async function syncSystemCertificationFromDataplane(params) {
  * @async
  * @param {Object} params
  * @param {string} [params.label] - e.g. "upload"
- * @param {boolean} [params.noCertSync]
  * @returns {Promise<void>}
  */
 function logCertificationSyncNotWritten(r, label, verboseCertHints = false) {
@@ -205,7 +204,6 @@ function logCertificationSyncNotWritten(r, label, verboseCertHints = false) {
 async function maybeSyncSystemCertificationFromDataplane(params) {
   const {
     label,
-    noCertSync,
     systemKey,
     dataplaneUrl,
     authConfig,
@@ -214,7 +212,6 @@ async function maybeSyncSystemCertificationFromDataplane(params) {
     verboseCertHints,
     silent
   } = params;
-  if (noCertSync === true) return;
   try {
     const r = await syncSystemCertificationFromDataplane({
       systemKey,

package/lib/channels/add-channel.js

@@ -1,5 +1,5 @@
 /**
- * Orchestrate aifabrix app add-channel (plan 152).
+ * Orchestrate aifabrix channel add (plan 152).
  *
  * @fileoverview Channel install after communication external system deploy
  * @author AI Fabrix Team
@@ -9,6 +9,7 @@
 'use strict';
 
 const { getChannelTarget, getDefaultChannelDescription } = require('./channel-targets');
+const { resolveAppDescription } = require('./channel-description');
 const { resolveChannelRuntimeValues } = require('./channel-runtime-resolver');
 const { generateChannelArtifact } = require('./channel-artifact-generator');
 const {
@@ -27,6 +28,10 @@ const {
 const { runChannelProbe } = require('./channel-probe');
 const { resolveChannelAuthContext } = require('./channel-auth-context');
 const { ensureChannelCredential } = require('./channel-credential');
+const {
+  buildChannelApprovalGuide,
+  resolveApprovalPortalUrl
+} = require('./channel-approval-guide');
 const {
   normalizeBaseChannelName,
   resolveChannelDisplayName
@@ -40,24 +45,6 @@ const {
 /**
  * @param {typeof import('./channel-targets').CHANNEL_TARGETS[string]} target
  * @param {Object} channelExt
- * @param {Object} [context]
- * @returns {string|null}
- */
-function resolveApprovalUrl(target, channelExt, context = {}) {
-  if (!target.approvalRequired) return null;
-  if (channelExt?.status === 'installed' || channelExt?.status === 'validated') return null;
-  if (target.key === 'slack' && context.artifactPath) {
-    return `https://api.slack.com/apps/new — upload manifest: ${context.artifactPath}`;
-  }
-  if (target.key === 'teams-bot') {
-    return 'https://admin.teams.microsoft.com/ — configure Bot Channel Registration for this tenant';
-  }
-  return `https://platform-admin.example/configure/${target.key}`;
-}
-
-/**
- * @param {Object} target
- * @param {Object} channelExt
  * @param {boolean} dryRun
  * @returns {string}
  */
@@ -88,7 +75,7 @@ function toValidationDisplay(validation) {
  * @returns {Object|null}
  */
 function showExistingChannelStatus(params) {
-  const { existing, options, target, channelTarget, name, baseName } = params;
+  const { existing, options, channelTarget, name, baseName, ctx } = params;
   if (!existing || options.force || options.dryRun) return null;
   const sameInstall =
     (existing.baseName && existing.baseName === baseName) ||
@@ -99,11 +86,21 @@ function showExistingChannelStatus(params) {
         `Use --force to replace with "${name}".`
     );
   }
+  const projectRoot = options.projectRoot || process.cwd();
+  const approvalGuide =
+    existing.status === 'approvalRequired'
+      ? buildChannelApprovalGuide(channelTarget, {
+        projectRoot,
+        name: existing.name || name,
+        baseName,
+        dataplaneBaseUrl: ctx?.dataplaneUrl
+      })
+      : null;
   displayExistingChannelStatus({
     channelTarget,
     name: existing.name || name,
     channelExt: existing,
-    approvalUrl: resolveApprovalUrl(target, existing)
+    approvalGuide
   });
   return { skipped: true, channelExt: existing };
 }
@@ -183,16 +180,17 @@ async function prepareChannelContext(channelTarget, options) {
     );
   }
   if (!options.name || typeof options.name !== 'string' || !options.name.trim()) {
-    throw new Error('--name is required for app add-channel');
+    throw new Error('--name is required for channel add');
   }
 
   const baseName = normalizeBaseChannelName(options.name);
   const ctx = await resolveChannelAuthContext(channelTarget, { silent: options.quiet });
   const name = resolveChannelDisplayName(baseName, ctx.environment);
-  const description =
+  const rawDescription =
     options.description && String(options.description).trim()
       ? String(options.description).trim()
       : getDefaultChannelDescription();
+  const description = resolveAppDescription(channelTarget, rawDescription);
 
   const system = await fetchCommunicationSystem({
     dataplaneUrl: ctx.dataplaneUrl,
@@ -219,12 +217,19 @@ async function completeLiveInstall(params) {
 
   await patchConfigWithAudit(ctx, channelTarget, channelBlock, status, artifact.artifactHash);
 
-  const approvalUrl =
+  const projectRoot = options.projectRoot || process.cwd();
+  const approvalGuide =
     status === 'approvalRequired'
-      ? resolveApprovalUrl(target, channelBlock, { artifactPath: artifact.outputPath })
+      ? buildChannelApprovalGuide(channelTarget, {
+        projectRoot,
+        name,
+        baseName,
+        artifactPath: artifact.outputPath,
+        dataplaneBaseUrl: ctx.dataplaneUrl
+      })
       : null;
-  if (approvalUrl) {
-    auditApprovalRequired(channelTarget, { approvalUrl });
+  if (approvalGuide?.portalUrl) {
+    auditApprovalRequired(channelTarget, { approvalUrl: approvalGuide.portalUrl });
   }
 
   const validation = await maybeRunProbe(ctx, channelBlock, channelTarget, options.probe);
@@ -239,10 +244,10 @@ async function completeLiveInstall(params) {
     artifactPath: artifact.outputPath,
     installGuidePath: artifact.installPath,
     validation: toValidationDisplay(validation),
-    approvalUrl
+    approvalGuide
   });
 
-  return { channelBlock, artifact, validation, approvalUrl };
+  return { channelBlock, artifact, validation, approvalGuide };
 }
 
 /**
@@ -277,10 +282,10 @@ async function runAddChannel(channelTarget, options = {}) {
   const skipped = showExistingChannelStatus({
     existing,
     options,
-    target,
     channelTarget,
     name,
-    baseName
+    baseName,
+    ctx
   });
   if (skipped) return skipped;
 
@@ -291,7 +296,8 @@ async function runAddChannel(channelTarget, options = {}) {
     baseName,
     environment: ctx.environment,
     appDescription: description,
-    icon: options.icon
+    icon: options.icon,
+    commandPrefix: options.commandPrefix
   });
 
   const projectRoot = options.projectRoot || process.cwd();
@@ -341,8 +347,8 @@ async function addChannelCommand(channelTarget, options = {}) {
 module.exports = {
   runAddChannel,
   addChannelCommand,
-  resolveApprovalUrl,
   resolveInstallStatus,
   normalizeBaseChannelName,
-  resolveChannelDisplayName
+  resolveChannelDisplayName,
+  resolveApprovalPortalUrl
 };

package/lib/channels/approval-guides/chatgpt.js

@@ -0,0 +1,33 @@
+/**
+ * ChatGPT enterprise channel admin approval steps (plan 152).
+ *
+ * @fileoverview OpenAI Platform / workspace connector guide
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { formatCredentialPortalStep } = require('./credential-portal');
+
+/**
+ * @param {Object} ctx
+ * @returns {{ portalUrl: string, steps: string[] }}
+ */
+function buildChatGptApprovalGuide(ctx) {
+  return {
+    portalUrl: 'https://platform.openai.com/',
+    steps: [
+      'Sign in to OpenAI Platform (https://platform.openai.com/) or your ChatGPT Enterprise workspace admin console.',
+      'Create a custom GPT, workspace connector, or MCP integration using the generated manifest (path shown below).',
+      'Configure the OpenAPI specification URL and MCP endpoint from INSTALL.md (dataplane ChatGPT routes).',
+      'Complete OAuth or API key setup as required by your ChatGPT deployment model.',
+      formatCredentialPortalStep(ctx, 'the API key or OAuth client credentials'),
+      'Publish the connector to your workspace and complete admin approval if your org requires it.',
+      `After ChatGPT lists the connector as active, re-run: ${ctx.resumeCommand}`,
+      'Optional: add --probe when dataplane ChatGPT runtime routes are live on your environment.'
+    ]
+  };
+}
+
+module.exports = { buildChatGptApprovalGuide };

package/lib/channels/approval-guides/credential-portal.js

@@ -0,0 +1,38 @@
+/**
+ * Dataplane Connected Systems authentication portal URLs (plan 152).
+ *
+ * @fileoverview Credential UI deep links for channel install guides
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { joinUrl, normalizeBaseUrl } = require('../channel-runtime-resolver');
+
+/**
+ * @param {string} dataplaneBaseUrl
+ * @param {string} channelTarget
+ * @returns {string}
+ */
+function buildCredentialPortalUrl(dataplaneBaseUrl, channelTarget) {
+  const base = normalizeBaseUrl(dataplaneBaseUrl);
+  return joinUrl(base, `/connected-systems/${channelTarget}?tab=authentication`);
+}
+
+/**
+ * @param {Object} ctx
+ * @param {string} secretHint - e.g. "the Bot User OAuth Token and Signing Secret"
+ * @returns {string}
+ */
+function formatCredentialPortalStep(ctx, secretHint) {
+  if (ctx.credentialPortalUrl) {
+    return `In AI Fabrix, open ${ctx.credentialPortalUrl} and save ${secretHint}.`;
+  }
+  return `In AI Fabrix, open Connected Systems → ${ctx.channelTarget} → Authentication and save ${secretHint}.`;
+}
+
+module.exports = {
+  buildCredentialPortalUrl,
+  formatCredentialPortalStep
+};