@aifabrix/builder 2.49.2 → 2.50.0

package/lib/utils/configuration-env-resolver.js

@@ -9,54 +9,223 @@
 
 const path = require('path');
 const fs = require('fs');
-const { getIntegrationPath } = require('./paths');
+const { resolveExternalSystemPath } = require('./app-path-resolve');
 const { parseEnvToMap } = require('./credential-secrets-env');
 const { loadSecrets, resolveKvReferences } = require('../core/secrets');
+const { expandDeclarativeUrlsIfPresent } = require('../core/secrets-env-declarative-expand');
+const { resolveApplicationConfigPath } = require('./app-config-resolver');
 const { loadEnvTemplate } = require('./secrets-helpers');
 const { getActualSecretsPath } = require('./secrets-path');
 
 const VAR_PLACEHOLDER_REGEX = /\{\{([^}]+)\}\}/g;
 
+/**
+ * Env.template keys whose RHS uses declarative url:// (upload overlay candidates).
+ *
+ * @param {string} envTemplateContent
+ * @returns {Set<string>}
+ */
+function getUrlDeclarativeEnvKeysFromTemplateContent(envTemplateContent) {
+  const keys = new Set();
+  if (!envTemplateContent || typeof envTemplateContent !== 'string') {
+    return keys;
+  }
+  for (const line of envTemplateContent.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) {
+      continue;
+    }
+    const eq = trimmed.indexOf('=');
+    if (eq <= 0) {
+      continue;
+    }
+    const key = trimmed.substring(0, eq).trim();
+    const value = trimmed.substring(eq + 1);
+    if (key && value.includes('url://')) {
+      keys.add(key);
+    }
+  }
+  return keys;
+}
+
+/**
+ * @param {string} systemKey
+ * @param {string} templateContent
+ * @param {Object} secrets
+ * @returns {Promise<Object.<string, string>>}
+ */
+async function resolveDockerTemplateMap(systemKey, templateContent, secrets, options = {}) {
+  const appPath = resolveExternalSystemPath(systemKey, options);
+  const secretsPaths = await getActualSecretsPath(undefined, systemKey);
+  let resolved = await resolveKvReferences(
+    templateContent,
+    secrets,
+    'docker',
+    secretsPaths,
+    systemKey,
+    { envTemplatePath: path.join(appPath, 'env.template') }
+  );
+
+  let variablesPath = null;
+  try {
+    variablesPath = resolveApplicationConfigPath(appPath);
+  } catch {
+    variablesPath = null;
+  }
+
+  resolved = await expandDeclarativeUrlsIfPresent(
+    resolved,
+    systemKey,
+    appPath,
+    variablesPath,
+    'docker',
+    false
+  );
+  return parseEnvToMap(resolved);
+}
+
+/**
+ * @param {Object.<string, string>} envMap
+ * @param {Set<string>} urlKeys
+ * @param {Object.<string, string>} dockerMap
+ * @returns {Object.<string, string>}
+ */
+function mergeUrlKeysIntoEnvMap(envMap, urlKeys, dockerMap) {
+  const out = { ...envMap };
+  for (const key of urlKeys) {
+    const raw = dockerMap[key];
+    if (raw === undefined || raw === null) {
+      continue;
+    }
+    const value = String(raw).trim();
+    if (value && !value.includes('url://')) {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+
+/**
+ * Overlays docker-profile expansions for env.template url:// keys onto an env map.
+ * Host `.env` may use local profile URLs; dataplane CIP runs in Docker and needs internal service URLs.
+ *
+ * @param {string} systemKey
+ * @param {Object.<string, string>} envMap
+ * @param {Object} secrets
+ * @returns {Promise<Object.<string, string>>}
+ */
+async function overlayDataplaneRuntimeEnvFromTemplate(systemKey, envMap, secrets, options = {}) {
+  const appPath = resolveExternalSystemPath(systemKey, options);
+  const envTemplatePath = path.join(appPath, 'env.template');
+  if (!fs.existsSync(envTemplatePath)) {
+    return envMap;
+  }
+
+  const templateContent = loadEnvTemplate(envTemplatePath);
+  const urlKeys = getUrlDeclarativeEnvKeysFromTemplateContent(templateContent);
+  if (urlKeys.size === 0) {
+    return envMap;
+  }
+
+  const dockerMap = await resolveDockerTemplateMap(systemKey, templateContent, secrets, options);
+  return mergeUrlKeysIntoEnvMap(envMap, urlKeys, dockerMap);
+}
+
+async function loadIntegrationSecrets(systemKey) {
+  try {
+    return await loadSecrets(undefined, systemKey);
+  } catch {
+    return {};
+  }
+}
+
+async function readIntegrationEnvMap(integrationPath, systemKey, secrets) {
+  const envPath = path.join(integrationPath, '.env');
+  const envTemplatePath = path.join(integrationPath, 'env.template');
+  if (fs.existsSync(envPath)) {
+    return parseEnvToMap(fs.readFileSync(envPath, 'utf8'));
+  }
+  if (!fs.existsSync(envTemplatePath)) {
+    return {};
+  }
+  const templateContent = loadEnvTemplate(envTemplatePath);
+  const secretsPaths = await getActualSecretsPath(undefined, systemKey);
+  const resolvedContent = await resolveKvReferences(
+    templateContent,
+    secrets,
+    'local',
+    secretsPaths,
+    systemKey
+  );
+  return parseEnvToMap(resolvedContent);
+}
+
 /**
  * Builds resolved env map and secrets for an integration app (for configuration resolution).
  * If .env exists, parses it; otherwise resolves env.template with secrets and parses the result.
  *
  * @param {string} systemKey - External system key (e.g. 'my-sharepoint')
+ * @param {Object} [options]
+ * @param {boolean} [options.dataplaneRuntime=false] - When true, overlay docker-profile url:// values from env.template for publish/runtime config push
  * @returns {Promise<{ envMap: Object.<string, string>, secrets: Object }>} envMap for {{VAR}} substitution, secrets for kv://
  * @throws {Error} If env.template is missing when .env is missing (only when building from template)
  */
-async function buildResolvedEnvMapForIntegration(systemKey) {
+async function buildResolvedEnvMapForIntegration(systemKey, options = {}) {
   if (!systemKey || typeof systemKey !== 'string') {
     throw new Error('systemKey is required and must be a string');
   }
-  const integrationPath = getIntegrationPath(systemKey);
-  const envPath = path.join(integrationPath, '.env');
-  const envTemplatePath = path.join(integrationPath, 'env.template');
+  const integrationPath = resolveExternalSystemPath(systemKey, options);
+  const secrets = await loadIntegrationSecrets(systemKey);
+  let envMap = await readIntegrationEnvMap(integrationPath, systemKey, secrets);
+  if (options.dataplaneRuntime === true) {
+    envMap = await overlayDataplaneRuntimeEnvFromTemplate(systemKey, envMap, secrets);
+  }
+  applyPathParamEnvAliases(envMap);
+  return { envMap, secrets };
+}
 
-  let secrets = {};
-  try {
-    secrets = await loadSecrets(undefined, systemKey);
-  } catch {
-    secrets = {};
+function applyPathParamEnvAliases(envMap) {
+  if (!envMap || typeof envMap !== 'object') {
+    return envMap;
+  }
+  const systemKey = envMap.systemKey;
+  if (
+    (!systemKey || String(systemKey).includes('{{')) &&
+    envMap.E2E_SYSTEM_KEY &&
+    !String(envMap.E2E_SYSTEM_KEY).includes('{{')
+  ) {
+    envMap.systemKey = String(envMap.E2E_SYSTEM_KEY).trim();
+  }
+  const pillar = envMap.pillar;
+  if (
+    (!pillar || String(pillar).includes('{{')) &&
+    envMap.E2E_CERTIFY_PILLAR &&
+    !String(envMap.E2E_CERTIFY_PILLAR).includes('{{')
+  ) {
+    envMap.pillar = String(envMap.E2E_CERTIFY_PILLAR).trim();
   }
+  return envMap;
+}
 
-  let envMap = {};
-  if (fs.existsSync(envPath)) {
-    const content = fs.readFileSync(envPath, 'utf8');
-    envMap = parseEnvToMap(content);
-  } else if (fs.existsSync(envTemplatePath)) {
-    const templateContent = loadEnvTemplate(envTemplatePath);
-    const secretsPaths = await getActualSecretsPath(undefined, systemKey);
-    const resolvedContent = await resolveKvReferences(
-      templateContent,
-      secrets,
-      'local',
-      secretsPaths,
-      systemKey
-    );
-    envMap = parseEnvToMap(resolvedContent);
+/**
+ * True when value is `{{pathParam}}` pointing at an OpenAPI path segment (camelCase), not env self-ref.
+ * @param {string} value
+ * @param {string} [configName]
+ * @returns {boolean}
+ */
+function isOpenApiPathParamAliasTemplate(value, configName) {
+  if (typeof value !== 'string') {
+    return false;
   }
-  return { envMap, secrets };
+  const match = value.trim().match(/^\{\{(\w+)\}\}$/);
+  if (!match) {
+    return false;
+  }
+  const alias = match[1];
+  if (!alias || alias === configName) {
+    return false;
+  }
+  return /^[a-z]/.test(alias);
 }
 
 /**
@@ -99,6 +268,9 @@ function resolveConfigurationValues(configArray, envMap, secrets, systemKey) {
       if (item.value.trim().startsWith('kv://')) {
         throw new Error(`Configuration entry '${item.name || 'unknown'}' has location 'variable' but value is kv://. Use location 'keyvault' for secrets.`);
       }
+      if (isOpenApiPathParamAliasTemplate(item.value, item.name)) {
+        continue;
+      }
       item.value = substituteVarPlaceholders(item.value, envMap, systemKey);
     } else if (location === 'keyvault') {
       if (!item.value.trim().startsWith('kv://')) {
@@ -234,7 +406,7 @@ function retemplateDatasourceConfigurationOverrides(configArray) {
  */
 async function retemplateConfigurationForDownload(systemKey, configArray) {
   if (!systemKey || typeof systemKey !== 'string' || !Array.isArray(configArray)) return false;
-  const integrationPath = getIntegrationPath(systemKey);
+  const integrationPath = resolveExternalSystemPath(systemKey, {});
   const envTemplatePath = path.join(integrationPath, 'env.template');
   if (!fs.existsSync(envTemplatePath)) return false;
   const content = fs.readFileSync(envTemplatePath, 'utf8');
@@ -245,6 +417,10 @@ async function retemplateConfigurationForDownload(systemKey, configArray) {
 
 module.exports = {
   buildResolvedEnvMapForIntegration,
+  getUrlDeclarativeEnvKeysFromTemplateContent,
+  overlayDataplaneRuntimeEnvFromTemplate,
+  applyPathParamEnvAliases,
+  isOpenApiPathParamAliasTemplate,
   resolveConfigurationValues,
   collectResolvedVariableConfigurationNames,
   getEnvTemplateVariableNames,

package/lib/utils/datasource-test-run-certificate-tty.js

@@ -50,14 +50,39 @@ function appendCertificateBlockerLines(lines, blockers, maxVisible) {
   const cap = Math.min(maxVisible, blockers.length);
   for (let i = 0; i < cap; i += 1) {
     const b = blockers[i];
+    const code = b && b.code ? String(b.code) : '';
     const msg = b && b.message ? String(b.message) : '';
-    if (msg) lines.push(chalk.yellow(`  • ${msg}`));
+    const tail = [code, msg].filter(Boolean).join(' — ');
+    if (tail) lines.push(chalk.yellow(`  • ${tail}`));
   }
   if (blockers.length > cap) {
     lines.push(chalk.gray(`  … and ${blockers.length - cap} more`));
   }
 }
 
+/**
+ * Auto-issue outcome when dataplane could not write an integration certificate.
+ * @param {string[]} lines
+ * @param {Object} envelope
+ */
+function appendCertificateIssuanceTTY(lines, envelope) {
+  const issuance = envelope && envelope.certificateIssuance;
+  if (!issuance || typeof issuance !== 'object') return;
+  const status = issuance.status !== undefined && issuance.status !== null ? String(issuance.status) : '';
+  if (!status || status === 'issued' || status === 'reusedActive' || status === 'skipped') return;
+
+  lines.push('');
+  lines.push(sectionTitle('Certificate issuance:'));
+  const reason = issuance.reasonCode ? String(issuance.reasonCode) : '';
+  lines.push(chalk.white(`  ✖ ${status}${reason ? ` (${reason})` : ''}`));
+  if (issuance.message) {
+    lines.push(chalk.yellow(`  ${String(issuance.message)}`));
+  }
+  if (issuance.validationHint) {
+    lines.push(chalk.gray(`  ${String(issuance.validationHint)}`));
+  }
+}
+
 /**
  * Certification / certificate tier (integration engine or E2E envelope after active cert attach).
  * @param {string[]} lines
@@ -78,5 +103,6 @@ function appendCertificateTTY(lines, envelope) {
 }
 
 module.exports = {
-  appendCertificateTTY
+  appendCertificateTTY,
+  appendCertificateIssuanceTTY
 };

package/lib/utils/datasource-test-run-certification-debug.js

@@ -0,0 +1,130 @@
+/**
+ * @fileoverview Certification / certificate issuance debug helpers for DatasourceTestRun.
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const { sectionTitle } = require('./cli-test-layout-chalk');
+
+/**
+ * @param {Object|undefined|null} output
+ * @returns {Object|undefined}
+ */
+function sliceCertificationOutput(output) {
+  if (!output || typeof output !== 'object') return undefined;
+  return {
+    summaryText: output.summaryText,
+    summaryLines: Array.isArray(output.summaryLines) ? output.summaryLines.slice(0, 40) : undefined,
+    explainText: output.explainText,
+    explainLines: Array.isArray(output.explainLines) ? output.explainLines.slice(0, 80) : undefined,
+    passed: output.passed,
+    level: output.level,
+    blockers: Array.isArray(output.blockers) ? output.blockers.slice(0, 30) : undefined
+  };
+}
+
+/**
+ * @param {Object|undefined|null} issuance
+ * @returns {Object|undefined}
+ */
+function sliceCertificateIssuance(issuance) {
+  if (!issuance || typeof issuance !== 'object') return undefined;
+  return {
+    status: issuance.status,
+    reasonCode: issuance.reasonCode,
+    message: issuance.message,
+    validationHint: issuance.validationHint,
+    systemKey: issuance.systemKey,
+    datasourceKey: issuance.datasourceKey
+  };
+}
+
+function certificationOutputFromEnvelope(envelope) {
+  const v = envelope && envelope.validation;
+  return v && typeof v === 'object' ? v.certificationOutput : null;
+}
+
+function blockerCode(blocker) {
+  if (!blocker || typeof blocker !== 'object') return '';
+  const code = blocker.code;
+  return code !== undefined && code !== null ? String(code).trim() : '';
+}
+
+function blockerMessage(blocker) {
+  if (!blocker || typeof blocker !== 'object') return '';
+  const msg = blocker.message;
+  return msg !== undefined && msg !== null ? String(msg).trim() : '';
+}
+
+/**
+ * @param {string[]} lines
+ * @param {Object} output
+ * @param {number} maxBlockers
+ */
+function pushCertificationOutputSummary(lines, output, maxBlockers) {
+  const passed = output.passed === true;
+  const level = output.level !== undefined && output.level !== null ? String(output.level) : '';
+  const glyph = passed ? '✔' : '✖';
+  const tier = level ? ` tier ${level}` : '';
+  lines.push(`Certification engine: ${glyph} ${passed ? 'passed' : 'not passed'}${tier}`);
+  const blockers = Array.isArray(output.blockers) ? output.blockers : [];
+  const cap = Math.min(maxBlockers, blockers.length);
+  for (let i = 0; i < cap; i += 1) {
+    const code = blockerCode(blockers[i]);
+    const msg = blockerMessage(blockers[i]);
+    const tail = [code, msg].filter(Boolean).join(' — ');
+    if (tail) lines.push(`  • ${tail}`);
+  }
+  if (blockers.length > cap) {
+    lines.push(`  … and ${blockers.length - cap} more blocker(s)`);
+  }
+  const summaryLines = Array.isArray(output.summaryLines) ? output.summaryLines : [];
+  const summaryCap = Math.min(6, summaryLines.length);
+  for (let i = 0; i < summaryCap; i += 1) {
+    const line = String(summaryLines[i] || '').trim();
+    if (line) lines.push(chalk.gray(`  ${line}`));
+  }
+}
+
+/**
+ * @param {string[]} lines
+ * @param {Object} issuance
+ */
+function pushCertificateIssuanceSummary(lines, issuance) {
+  const status = issuance.status !== undefined && issuance.status !== null ? String(issuance.status) : '';
+  const reason = issuance.reasonCode ? String(issuance.reasonCode) : '';
+  const msg = issuance.message ? String(issuance.message) : '';
+  lines.push(`Certificate issuance: ${status || 'unknown'}${reason ? ` (${reason})` : ''}`);
+  if (msg) lines.push(chalk.yellow(`  ${msg}`));
+  if (issuance.validationHint) {
+    lines.push(chalk.gray(`  Hint: ${String(issuance.validationHint)}`));
+  }
+}
+
+/**
+ * Summary debug lines for certification + issuance (plan §3.7 debug appendix).
+ * @param {string[]} lines
+ * @param {Object|null|undefined} envelope
+ */
+function pushCertificationDebugSummaryLines(lines, envelope) {
+  if (!envelope || typeof envelope !== 'object') return;
+  const output = certificationOutputFromEnvelope(envelope);
+  const issuance = envelope.certificateIssuance;
+  const hasOutput = output && typeof output === 'object';
+  const hasIssuance = issuance && typeof issuance === 'object';
+  if (!hasOutput && !hasIssuance) return;
+
+  lines.push(sectionTitle('Certification debug:'));
+  if (hasOutput) pushCertificationOutputSummary(lines, output, 5);
+  if (hasIssuance) pushCertificateIssuanceSummary(lines, issuance);
+}
+
+module.exports = {
+  sliceCertificationOutput,
+  sliceCertificateIssuance,
+  pushCertificationDebugSummaryLines,
+  certificationOutputFromEnvelope
+};

package/lib/utils/datasource-test-run-debug-display.js

@@ -12,6 +12,7 @@ const {
   parseCapacityDetailKey,
   formatCapacityOperationLabel
 } = require('./datasource-test-run-capacity-operations');
+const { pushCertificationDebugSummaryLines } = require('./datasource-test-run-certification-debug');
 
 const FULL_MAX_BYTES_PER_STRING = 8192;
 const RAW_MAX_STRING_TTY = 65536;
@@ -210,6 +211,7 @@ function pushSummaryRefLines(lines, envelope) {
   try {
     pushSyncSummaryLines(lines, envelope);
     pushE2eTimingSummaryLines(lines, envelope);
+    pushCertificationDebugSummaryLines(lines, envelope);
   } catch {
     // ignore best-effort debug summary extraction
   }

package/lib/utils/datasource-test-run-debug-slice.js

@@ -4,6 +4,11 @@
 
 'use strict';
 
+const {
+  sliceCertificationOutput,
+  sliceCertificateIssuance
+} = require('./datasource-test-run-certification-debug');
+
 /**
  * @param {Object|undefined|null} v
  * @returns {Object|undefined}
@@ -15,6 +20,7 @@ function sliceValidationLayer(v) {
     summary: v.summary,
     dataReadiness: v.dataReadiness,
     metricsOutput: v.metricsOutput,
+    certificationOutput: sliceCertificationOutput(v.certificationOutput),
     issues: Array.isArray(v.issues) ? v.issues.slice(0, 50) : undefined
   };
 }
@@ -85,6 +91,7 @@ function buildDebugEnvelopeSlice(envelope) {
     validation: sliceValidationLayer(envelope.validation),
     integration: sliceIntegration(envelope.integration),
     certificate: sliceCertificate(envelope.certificate),
+    certificateIssuance: sliceCertificateIssuance(envelope.certificateIssuance),
     capabilitySummary: envelope.capabilitySummary,
     capabilities: sliceCapabilities(envelope.capabilities)
   };

package/lib/utils/datasource-test-run-display.js

@@ -6,7 +6,7 @@
 
 const chalk = require('chalk');
 const { sectionTitle, headerKeyValue, colorAggregateGlyph, successGlyph, failureGlyph } = require('./cli-test-layout-chalk');
-const { appendCertificateTTY } = require('./datasource-test-run-certificate-tty');
+const { appendCertificateTTY, appendCertificateIssuanceTTY } = require('./datasource-test-run-certificate-tty');
 const { buildTtyMetaLines: buildTtyMetaLinesCore } = require('./datasource-test-run-tty-meta-lines');
 
 const SEP = '────────────────────────────────';
@@ -444,6 +444,7 @@ function formatDatasourceTestRunTTY(envelope, options = {}) {
   lines.push(sectionTitle('Verdict:'));
   lines.push(chalk.white(pickExecutiveVerdictLine(envelope)));
   appendCertificateTTY(lines, envelope);
+  appendCertificateIssuanceTTY(lines, envelope);
   appendRefsSectionIfEnabled(lines, envelope, options);
   appendValidationIssueLines(lines, envelope);
   appendIntegrationStepLines(lines, envelope);