@aifabrix/builder 2.49.2 → 2.51.0

package/lib/schema/external-system.schema.json

@@ -7,12 +7,12 @@
       "key": "external-system-schema",
       "name": "External System Configuration Schema",
       "description": "JSON schema for validating ExternalSystem configuration files",
-      "version": "1.9.0",
+      "version": "1.13.1",
       "type": "schema",
       "category": "integration",
       "author": "AI Fabrix Team",
       "createdAt": "2024-01-01T00:00:00Z",
-      "updatedAt": "2026-06-15T00:00:00Z",
+      "updatedAt": "2026-07-22T00:00:00Z",
       "compatibility": {
          "minVersion": "1.4.0",
          "maxVersion": "2.0.0",
@@ -27,6 +27,46 @@
       ],
       "dependencies": [],
       "changelog": [
+         {
+            "version": "1.13.1",
+            "date": "2026-07-22T00:00:00Z",
+            "changes": [
+               "Added optional configuration[].category for portal UI grouping labels (parity with application-schema)."
+            ],
+            "breaking": false
+         },
+         {
+            "version": "1.13.0",
+            "date": "2026-07-02T00:00:00Z",
+            "changes": [
+               "Added authentications[] with usage enum (api, webhookInbound, syncExecution, messageInbound, messageOutbound, callback, provisioning). Legacy authentication retained with deprecation."
+            ],
+            "breaking": false
+         },
+         {
+            "version": "1.12.0",
+            "date": "2026-06-30T00:00:00Z",
+            "changes": [
+               "authentication.credential.formFields accepts array (allowlist) or object with defaults { visible, required, locked } and fields[] for allowlist/denylist projection."
+            ],
+            "breaking": false
+         },
+         {
+            "version": "1.11.0",
+            "date": "2026-06-30T00:00:00Z",
+            "changes": [
+               "authentication.credential.formFields[] items may set optional label and placeholder overrides per field."
+            ],
+            "breaking": false
+         },
+         {
+            "version": "1.10.0",
+            "date": "2026-06-30T00:00:00Z",
+            "changes": [
+               "Added optional authentication.credential.formFields[] for per-system Authentication tab field projection."
+            ],
+            "breaking": false
+         },
          {
             "version": "1.9.0",
             "date": "2026-06-15T00:00:00Z",
@@ -212,8 +252,7 @@
                   "compileCom",
                   "generateEnterpriseDatasources",
                   "generateRestContracts",
-                  "generateMcpContracts",
-                  "runDigitalWorkerTask"
+                  "generateMcpContracts"
                ],
                "description": "Platform task type executed when the subscription fires."
             },
@@ -222,104 +261,6 @@
                "minimum": 1,
                "default": 1,
                "description": "Task definition version snapshot for audit."
-            },
-            "digitalWorkerKey": {
-               "type": "string",
-               "minLength": 1,
-               "description": "Target digital worker system key (runDigitalWorkerTask)."
-            },
-            "taskType": {
-               "type": "string",
-               "minLength": 1,
-               "description": "Worker task type label (runDigitalWorkerTask)."
-            },
-            "objectiveTemplate": {
-               "type": "string",
-               "description": "Objective template with {{recordId}} placeholders."
-            },
-            "requiresApproval": {
-               "type": "boolean",
-               "default": false
-            },
-            "owner": {
-               "$ref": "#/$defs/subscriptionTaskOwner"
-            }
-         },
-         "additionalProperties": false
-      },
-      "subscriptionCondition": {
-         "type": "object",
-         "required": [
-            "field",
-            "operator"
-         ],
-         "properties": {
-            "field": {
-               "type": "string",
-               "minLength": 1,
-               "description": "Path against afterSummary (default) or before.* prefix."
-            },
-            "operator": {
-               "type": "string",
-               "enum": [
-                  "equals",
-                  "notEquals",
-                  "in",
-                  "notIn",
-                  "exists",
-                  "missing",
-                  "changed",
-                  "greaterThan",
-                  "lessThan"
-               ]
-            },
-            "value": {}
-         },
-         "additionalProperties": false
-      },
-      "subscriptionTriggerPolicy": {
-         "type": "object",
-         "required": [
-            "mode"
-         ],
-         "properties": {
-            "mode": {
-               "type": "string",
-               "enum": [
-                  "immediate",
-                  "debounce",
-                  "scheduled"
-               ]
-            },
-            "windowSeconds": {
-               "type": "integer",
-               "minimum": 1,
-               "description": "Required when mode is debounce."
-            }
-         },
-         "additionalProperties": false
-      },
-      "subscriptionTaskOwner": {
-         "type": "object",
-         "required": [
-            "mode"
-         ],
-         "properties": {
-            "mode": {
-               "type": "string",
-               "enum": [
-                  "explicit",
-                  "recordField"
-               ]
-            },
-            "userId": {
-               "type": "string",
-               "minLength": 1
-            },
-            "field": {
-               "type": "string",
-               "minLength": 1,
-               "description": "Record summary field for recordField mode."
             }
          },
          "additionalProperties": false
@@ -350,24 +291,11 @@
             "event": {
                "type": "string",
                "minLength": 1,
-               "description": "V1 event namespace (platform.*, schedule.*, or record.*)."
+               "description": "V1 event namespace (platform.* or schedule.*)."
             },
             "filter": {
                "$ref": "#/$defs/subscriptionFilter"
             },
-            "conditions": {
-               "type": "array",
-               "items": {
-                  "$ref": "#/$defs/subscriptionCondition"
-               }
-            },
-            "triggerPolicy": {
-               "$ref": "#/$defs/subscriptionTriggerPolicy"
-            },
-            "deduplicationKeyTemplate": {
-               "type": "string",
-               "description": "Default: {{subscriptionId}}:{{resourceType}}:{{recordId}}:{{task.taskType}}"
-            },
             "task": {
                "$ref": "#/$defs/subscriptionTask"
             },
@@ -587,7 +515,7 @@
                },
                {
                   "key": "clientId",
-                  "required": true
+                  "required": false
                },
                {
                   "key": "expectedIssuer",
@@ -611,7 +539,12 @@
                   "description": "Optional URL used when testing the credential (GET). Full URL or path. For OIDC, discovery URL is typically used if testEndpoint omitted."
                }
             ],
-            "security": []
+            "security": [
+               {
+                  "key": "clientSecret",
+                  "required": false
+               }
+            ]
          },
          "hmac": {
             "variables": [
@@ -645,6 +578,14 @@
                {
                   "key": "signingSecret",
                   "required": true
+               },
+               {
+                  "key": "botToken",
+                  "required": false
+               },
+               {
+                  "key": "clientSecret",
+                  "required": false
                }
             ]
          },
@@ -703,6 +644,117 @@
                "type": "boolean",
                "description": "Template is immutable after first deploy.",
                "default": true
+            },
+            "formFields": {
+               "description": "Optional Authentication tab field projection. Omitted: security keys only; variables hidden. Array: allowlist. Object: defaults.visible false = allowlist on fields[]; defaults.visible true = registry denylist.",
+               "oneOf": [
+                  {
+                     "type": "array",
+                     "items": {
+                        "type": "object",
+                        "required": [
+                           "name"
+                        ],
+                        "properties": {
+                           "name": {
+                              "type": "string",
+                              "minLength": 1,
+                              "description": "Registry field name for authentication.credential.method."
+                           },
+                           "required": {
+                              "type": "boolean",
+                              "description": "Override registry required flag for this field."
+                           },
+                           "visible": {
+                              "type": "boolean",
+                              "description": "When false, exclude this field from the projected form."
+                           },
+                           "locked": {
+                              "type": "boolean",
+                              "description": "When true, show read-only (prefilled from variables or stored config)."
+                           },
+                           "label": {
+                              "type": "string",
+                              "minLength": 1,
+                              "description": "Override registry display label for this field on the Authentication tab."
+                           },
+                           "placeholder": {
+                              "type": "string",
+                              "description": "Override registry placeholder for this field on the Authentication tab."
+                           }
+                        },
+                        "additionalProperties": false
+                     }
+                  },
+                  {
+                     "type": "object",
+                     "required": [
+                        "fields"
+                     ],
+                     "properties": {
+                        "defaults": {
+                           "type": "object",
+                           "properties": {
+                              "visible": {
+                                 "type": "boolean"
+                              },
+                              "required": {
+                                 "type": "boolean"
+                              },
+                              "locked": {
+                                 "type": "boolean"
+                              }
+                           },
+                           "additionalProperties": false
+                        },
+                        "visible": {
+                           "type": "boolean",
+                           "description": "Default visible flag for entries in fields[] (false = allowlist mode)."
+                        },
+                        "required": {
+                           "type": "boolean",
+                           "description": "Default required flag for entries in fields[]."
+                        },
+                        "locked": {
+                           "type": "boolean",
+                           "description": "Default locked flag for entries in fields[]."
+                        },
+                        "fields": {
+                           "type": "array",
+                           "items": {
+                              "type": "object",
+                              "required": [
+                                 "name"
+                              ],
+                              "properties": {
+                                 "name": {
+                                    "type": "string",
+                                    "minLength": 1
+                                 },
+                                 "required": {
+                                    "type": "boolean"
+                                 },
+                                 "visible": {
+                                    "type": "boolean"
+                                 },
+                                 "locked": {
+                                    "type": "boolean"
+                                 },
+                                 "label": {
+                                    "type": "string",
+                                    "minLength": 1
+                                 },
+                                 "placeholder": {
+                                    "type": "string"
+                                 }
+                              },
+                              "additionalProperties": false
+                           }
+                        }
+                     },
+                     "additionalProperties": false
+                  }
+               ]
             }
          },
          "additionalProperties": false
@@ -721,6 +773,80 @@
             }
          },
          "additionalProperties": false
+      },
+      "authenticationUsageEntry": {
+         "type": "object",
+         "description": "Authentication slot with usage separation. Reuses authType branches from legacy authentication.",
+         "required": [
+            "key",
+            "usage",
+            "authType"
+         ],
+         "properties": {
+            "key": {
+               "type": "string",
+               "pattern": "^[a-zA-Z0-9_-]+$",
+               "minLength": 1,
+               "maxLength": 64
+            },
+            "usage": {
+               "type": "string",
+               "enum": [
+                  "api",
+                  "webhookInbound",
+                  "syncExecution",
+                  "messageInbound",
+                  "messageOutbound",
+                  "callback",
+                  "provisioning"
+               ]
+            },
+            "authType": {
+               "type": "string",
+               "enum": [
+                  "credential",
+                  "apiProvider",
+                  "none"
+               ]
+            },
+            "credential": {
+               "$ref": "#/$defs/credentialTemplate"
+            },
+            "apiProvider": {
+               "$ref": "#/$defs/apiProviderReference"
+            }
+         },
+         "additionalProperties": false,
+         "allOf": [
+            {
+               "if": {
+                  "properties": {
+                     "authType": {
+                        "const": "credential"
+                     }
+                  }
+               },
+               "then": {
+                  "required": [
+                     "credential"
+                  ]
+               }
+            },
+            {
+               "if": {
+                  "properties": {
+                     "authType": {
+                        "const": "apiProvider"
+                     }
+                  }
+               },
+               "then": {
+                  "required": [
+                     "apiProvider"
+                  ]
+               }
+            }
+         ]
       }
    },
    "x-systemKindCatalog": {
@@ -913,7 +1039,7 @@
          "default": false
       },
       "authentication": {
-         "description": "Nested authentication: authType credential (local template), apiProvider (Miso delegated), or none.",
+         "description": "Nested authentication: authType credential (local template), apiProvider (Miso delegated), or none. Deprecated — prefer authentications[] with usage.",
          "oneOf": [
             {
                "type": "object",
@@ -961,6 +1087,14 @@
             }
          ]
       },
+      "authentications": {
+         "type": "array",
+         "description": "Multi-slot authentication with usage separation. One authentication normalizes to [{key:default, usage:api, ...}].",
+         "items": {
+            "$ref": "#/$defs/authenticationUsageEntry"
+         },
+         "uniqueItems": true
+      },
       "openapi": {
          "type": "object",
          "description": "System-level connectivity and bootstrap hints for OpenAPI-backed systems (e.g. default specUrl for discovery, documentKey alignment with shared registry entries). Not the authoritative per-datasource vendor OpenAPI contract; that is declared on the datasource via externalSpec and validated against imported material.",
@@ -1037,6 +1171,12 @@
                "required": {
                   "type": "boolean"
                },
+               "category": {
+                  "type": "string",
+                  "description": "Optional UI grouping label for portal/deployment wizard Configuration tab",
+                  "minLength": 1,
+                  "maxLength": 100
+               },
                "portalInput": {
                   "type": "object",
                   "required": [

package/lib/schema/flag-map-validation-run.json

@@ -9,6 +9,9 @@
     { "cliFlag": "-e, --env <env>", "requestField": null, "note": "Controller/dataplane URL and token selection" },
     { "cliFlag": "-p, --payload <file>", "requestField": "payloadTemplate", "note": "Loaded object merged into request when integration-style test" },
     { "cliFlag": "--timeout <ms>", "requestField": null, "note": "Client aggregate HTTP budget (POST + polls)" },
+    { "cliFlag": "--version <target>", "requestField": "e2eOptions.versionTarget", "runType": "e2e", "default": "latest", "values": ["latest", "running", "<versionId>"] },
+    { "cliFlag": "--sync-mode <mode>", "requestField": "e2eOptions.syncMode", "runType": "e2e", "default": "auto", "values": ["auto", "never", "force"], "note": "Distinct from --sync (publish local files before test)" },
+    { "cliFlag": "--sync", "requestField": null, "note": "Publish local integration files before test (upload); not the same as --sync-mode" },
     { "cliFlag": "--debug [level]", "requestField": "includeDebug", "default": false, "note": "summary|full|raw affects TTY appendix only; any presence sets includeDebug" },
     { "cliFlag": "--no-async", "requestField": "asyncRun", "note": "When true on CLI, omit asyncRun or set false; sync-only POST" },
     { "cliFlag": "--no-run-scenarios", "requestField": "e2eOptions.runScenarios", "runType": "e2e" },

package/lib/schema/infra.parameter.yaml

@@ -204,6 +204,19 @@ parameters:
       notes: >-
         JWT signing secret; generated on first ensure. Azure Bicep typically uses `${prefix}-secrets-jwtKeyVault`.
 
+  # LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault — local default skips Mori/JWT license checks.
+  # Controller ignores DEVELOPMENT when DEPLOYMENT=azure.
+  - key: miso-controller-jwt-licenseKeyVault
+    scope: app
+    generator:
+      type: literal
+      value: 'DEVELOPMENT'
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      notes: >-
+        Local/dev default DEVELOPMENT disables license validation (no Mori/JWT required).
+        Ignored when DEPLOYMENT=azure. Override with a real offline license JWT (or empty for Mori) in non-dev.
+
   # Exact entry so this is not caught by *KeyVault → randomBytes32 (invalid email).
   - key: miso-controller-admin-emailKeyVault
     scope: app
@@ -327,7 +340,18 @@ parameters:
       vaultSecretName: dataplane-client-secretKeyVault
       notes: Per-app OAuth client secret for dataplane; generated on first ensure.
 
-  # Mori / telemetry: optional locally (LICENSE_JWT=DEVELOPMENT skips Mori); empty until integrated.
+  # Mori / telemetry: optional locally (LICENSE_JWT via miso-controller-jwt-licenseKeyVault=DEVELOPMENT skips Mori).
+  # MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault — local default apiKey.
+  - key: mori-controller-auth-methodKeyVault
+    scope: infra
+    generator:
+      type: literal
+      value: 'apiKey'
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      notes: >-
+        Local/dev default apiKey. Override when using Mori basic auth or other methods.
+
   - key: mori-controller-api-keyKeyVault
     scope: infra
     generator:

package/lib/schema/type/credential-field-registry.json

@@ -1,5 +1,5 @@
 {
-  "version": 6,
+  "version": 8,
   "semantics": {
     "visibility.show": "When false, the field name is omitted from default portal field lists, embedded credential form field lists, and from public API credentialConfig read models (GET/list with decrypt=false), in addition to any omission driven by encrypted. GET with decrypt=true returns the full decrypted config for authorized callers and does not apply this visibility filter.",
     "visibility.showValue": "UI-only: whether stored values may be shown versus placeholders in form flows that honor this flag. Does not control encryption at rest or public API stripping.",
@@ -114,10 +114,12 @@
           "display": {
             "label": "Tenant ID",
             "control": "text",
-            "enabled": true
+            "enabled": true,
+            "placeholder": "Azure AD directory (tenant) ID",
+            "description": "Used for Microsoft identity platforms. May also appear in tokenUrl as {{tenantId}}."
           },
           "visibility": {
-            "show": false,
+            "show": true,
             "showValue": true
           },
           "encrypted": false
@@ -149,6 +151,20 @@
             "showValue": false
           },
           "encrypted": true
+        },
+        {
+          "name": "accessTokenExpiresAt",
+          "required": false,
+          "display": {
+            "label": "Access Token Expires At",
+            "control": "text",
+            "enabled": false
+          },
+          "visibility": {
+            "show": false,
+            "showValue": false
+          },
+          "encrypted": false
         }
       ]
     },
@@ -394,7 +410,7 @@
       ]
     },
     "oidc": {
-      "active": false,
+      "active": true,
       "display": {
         "label": "OIDC",
         "order": 5
@@ -485,7 +501,7 @@
       ]
     },
     "hmac": {
-      "active": false,
+      "active": true,
       "display": {
         "label": "HMAC",
         "order": 6

package/lib/schema/type/document-storage.json

@@ -279,6 +279,15 @@
             }
           },
           "additionalProperties": false
+        },
+        "fieldHints": {
+          "type": "object",
+          "description": "Optional per-field extraction hints for governed FK review (plan 441.1).",
+          "additionalProperties": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 512
+          }
         }
       },
       "additionalProperties": false

package/lib/utils/agent-trust-run-display.js

@@ -90,7 +90,7 @@ function logTrustWarningsAndFindings(run, opts) {
 function logTrustFooter(run, opts) {
   logger.log('');
   logger.log(metaGray('  ── Integration reality (informative) ──'));
-  logger.log(metaGray(`  Local manifest:  ${opts.noSync ? 'not uploaded (--no-sync)' : 'uploaded before run'}`));
+  logger.log(metaGray(`  Local manifest:  ${opts.noPublish ? 'not uploaded (--no-publish)' : 'uploaded before run'}`));
   logger.log(metaGray(`  Publish gate:    ${publishGateLine(run.trustDecision, opts.strict === true)}`));
   logger.log(SEP);
 }

package/lib/utils/api.js

@@ -426,8 +426,14 @@ async function authenticatedApiCall(url, options = {}, tokenOrAuthConfig) {
     headers
   });
 
-  // Only attempt device token refresh on 401 when user Bearer token was used (not for client-token)
-  if (!response.success && response.status === 401 && authType !== 'client-token') {
+  // Only attempt device token refresh on 401 when user Bearer token was used (not for client-token).
+  // Token-forward (builder-api): never refresh from mount device store — keep the caller JWT.
+  if (
+    !response.success &&
+    response.status === 401 &&
+    authType !== 'client-token' &&
+    !(typeof tokenOrAuthConfig === 'object' && tokenOrAuthConfig?.preserveBearer)
+  ) {
     try {
       const { forceRefreshDeviceToken } = require('./token-manager');
       const refreshedToken = await forceRefreshDeviceToken(authControllerUrl || extractControllerUrl(url));