@aifabrix/builder 2.49.2 → 2.51.0

package/scripts/pnpm/lib/resolve-aifabrix-bin.mjs

@@ -0,0 +1,124 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../..');
+
+/** application.yaml / platform apps need manifest-aware builder (not variables.yaml-only CLIs). */
+const MIN_AIFABRIX_VERSION = '2.45.0';
+
+/**
+ * @param {string} version - Semver string.
+ * @returns {number[]} Parsed numeric semver segments.
+ */
+function parseSemver(version) {
+  return String(version)
+    .trim()
+    .split('.')
+    .map((part) => parseInt(part, 10) || 0);
+}
+
+/**
+ * @param {string} left - Left semver.
+ * @param {string} right - Right semver.
+ * @returns {number} Compare result (1, 0, -1).
+ */
+function compareSemver(left, right) {
+  const a = parseSemver(left);
+  const b = parseSemver(right);
+  for (let i = 0; i < Math.max(a.length, b.length); i += 1) {
+    const av = a[i] || 0;
+    const bv = b[i] || 0;
+    if (av > bv) return 1;
+    if (av < bv) return -1;
+  }
+  return 0;
+}
+
+/**
+ * @param {string} bin - Candidate executable path.
+ * @returns {string|null} CLI version output or null.
+ */
+function readAifabrixVersion(bin) {
+  try {
+    return execFileSync(bin, ['--version'], { encoding: 'utf8' }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @returns {string[]} Candidate aifabrix binary paths.
+ */
+function collectAifabrixCandidates() {
+  const candidates = [];
+  const seen = new Set();
+
+  const push = (candidate) => {
+    if (!candidate || seen.has(candidate)) {
+      return;
+    }
+    seen.add(candidate);
+    candidates.push(candidate);
+  };
+
+  push(path.join(repoRoot, 'bin', 'aifabrix.js'));
+
+  if (process.env.AIFABRIX_CLI) {
+    push(process.env.AIFABRIX_CLI);
+  }
+
+  const home = os.homedir();
+  push(path.join(home, '.npm-global', 'bin', 'aifabrix'));
+  push(path.join(home, '.local', 'bin', 'aifabrix'));
+
+  for (const dir of (process.env.PATH || '').split(path.delimiter)) {
+    if (!dir) continue;
+    push(path.join(dir, 'aifabrix'));
+  }
+
+  return candidates;
+}
+
+/**
+ * Prefer this repo's bin/aifabrix.js when developing the builder package locally.
+ *
+ * @returns {string} Resolved aifabrix executable path.
+ */
+export function resolveAifabrixBin() {
+  let bestBin = null;
+  let bestVersion = null;
+
+  for (const candidate of collectAifabrixCandidates()) {
+    let resolved;
+    try {
+      if (fs.existsSync(candidate)) {
+        resolved = fs.realpathSync(candidate);
+      } else {
+        continue;
+      }
+    } catch {
+      continue;
+    }
+
+    const version = readAifabrixVersion(resolved);
+    if (!version) {
+      continue;
+    }
+    if (!bestVersion || compareSemver(version, bestVersion) > 0) {
+      bestBin = resolved;
+      bestVersion = version;
+    }
+  }
+
+  if (!bestBin || !bestVersion || compareSemver(bestVersion, MIN_AIFABRIX_VERSION) < 0) {
+    throw new Error(
+      `@aifabrix/builder >= ${MIN_AIFABRIX_VERSION} is required (found ${bestVersion || 'none'}). ` +
+        'Install: npm run install:local — or set AIFABRIX_CLI to a newer aifabrix binary.'
+    );
+  }
+
+  return bestBin;
+}

package/scripts/pnpm/lib/resolve-app-url.mjs

@@ -0,0 +1,183 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+/**
+ * @typedef {Object} AppUrlProfile
+ * @property {string} appKey
+ * @property {number} portBase
+ * @property {string} [webServerUrlEnvKey]
+ * @property {string} [healthPath]
+ */
+
+/**
+ * @returns {string}
+ */
+function readDeveloperIdRaw() {
+  const configPath = path.join(os.homedir(), '.aifabrix', 'config.yaml');
+  if (!fs.existsSync(configPath)) {
+    return '0';
+  }
+  const match = fs.readFileSync(configPath, 'utf8').match(/^developer-id:\s*['"]?(\d+)['"]?\s*$/m);
+  return match ? match[1] : '0';
+}
+
+/**
+ * @param {string} appKey
+ * @param {string} developerIdRaw
+ * @returns {string}
+ */
+function buildContainerName(appKey, developerIdRaw) {
+  const idNum = Number.parseInt(developerIdRaw, 10) || 0;
+  if (idNum === 0) {
+    return `aifabrix-${appKey}`;
+  }
+  return `aifabrix-dev${developerIdRaw}-${appKey}`;
+}
+
+/**
+ * @param {string} filePath
+ * @returns {Record<string, string>}
+ */
+function parseEnvFile(filePath) {
+  const values = {};
+  for (const line of fs.readFileSync(filePath, 'utf8').split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) {
+      continue;
+    }
+    const eq = trimmed.indexOf('=');
+    if (eq === -1) {
+      continue;
+    }
+    const key = trimmed.slice(0, eq).trim();
+    let value = trimmed.slice(eq + 1).trim();
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1);
+    }
+    values[key] = value;
+  }
+  return values;
+}
+
+/**
+ * @param {string} raw
+ * @returns {string|null}
+ */
+function normalizeHttpUrl(raw) {
+  const trimmed = raw?.trim();
+  if (!trimmed || trimmed.startsWith('kv://')) {
+    return null;
+  }
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+      return null;
+    }
+    return parsed.toString().replace(/\/+$/, '');
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {string} repoRoot
+ * @param {string} appKey
+ * @param {string} envKey
+ * @returns {string|null}
+ */
+function readBuilderEnvUrl(repoRoot, appKey, envKey) {
+  const envPath = path.join(repoRoot, 'builder', appKey, '.env');
+  if (!fs.existsSync(envPath)) {
+    return null;
+  }
+  return normalizeHttpUrl(parseEnvFile(envPath)[envKey]);
+}
+
+/**
+ * @param {string} containerName
+ * @param {string} envKey
+ * @returns {string|null}
+ */
+function readContainerEnvUrl(containerName, envKey) {
+  const result = spawnSync('docker', ['exec', containerName, 'env'], {
+    encoding: 'utf8',
+    timeout: 8000
+  });
+  if (result.status !== 0) {
+    return null;
+  }
+  for (const line of result.stdout.split('\n')) {
+    if (!line.startsWith(`${envKey}=`)) {
+      continue;
+    }
+    return normalizeHttpUrl(line.slice(envKey.length + 1));
+  }
+  return null;
+}
+
+/**
+ * @param {string} containerName
+ * @returns {string|null}
+ */
+function readDockerPublishedUrl(containerName) {
+  const result = spawnSync(
+    'docker',
+    ['ps', '--filter', `name=^/${containerName}$`, '--format', '{{.Ports}}'],
+    { encoding: 'utf8', timeout: 8000 }
+  );
+  if (result.status !== 0) {
+    return null;
+  }
+  const portMatch = result.stdout.match(/:(\d+)->\d+\//);
+  if (!portMatch) {
+    return null;
+  }
+  return `http://localhost:${portMatch[1]}`;
+}
+
+/**
+ * @param {number} portBase
+ * @returns {number}
+ */
+function resolveHostPort(portBase) {
+  const devId = Number.parseInt(readDeveloperIdRaw(), 10) || 0;
+  return devId === 0 ? portBase : portBase + devId * 100;
+}
+
+/**
+ * @param {AppUrlProfile} profile
+ * @param {{ repoRoot: string }} options
+ * @returns {string}
+ */
+export function resolveAppUrl(profile, options) {
+  const { repoRoot } = options;
+  const envKey = profile.webServerUrlEnvKey;
+  const containerName = buildContainerName(profile.appKey, readDeveloperIdRaw());
+
+  if (envKey) {
+    const fromContainer = readContainerEnvUrl(containerName, envKey);
+    if (fromContainer) {
+      return `${fromContainer}/`;
+    }
+  }
+
+  const fromDockerPort = readDockerPublishedUrl(containerName);
+  if (fromDockerPort) {
+    return `${fromDockerPort}/`;
+  }
+
+  if (envKey) {
+    const fromBuilderEnv = readBuilderEnvUrl(repoRoot, profile.appKey, envKey);
+    if (fromBuilderEnv) {
+      return `${fromBuilderEnv}/`;
+    }
+  }
+
+  const port = resolveHostPort(profile.portBase);
+  return `http://localhost:${port}/`;
+}

package/scripts/pnpm/lib/spinner.mjs

@@ -0,0 +1,42 @@
+/** Minimal TTY spinner (no extra dependencies). */
+
+const FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+
+/**
+ * @param {string} label
+ * @returns {{ start: () => void, stop: (finalLine?: string) => void }}
+ */
+export function createSpinner(label) {
+  let frameIndex = 0;
+  /** @type {NodeJS.Timeout | null} */
+  let timer = null;
+  const enabled = process.stdout.isTTY && process.env.CI !== 'true';
+
+  function clearLine() {
+    if (enabled) {
+      process.stdout.write('\r\x1b[K');
+    }
+  }
+
+  return {
+    start() {
+      if (!enabled) {
+        console.log(label);
+        return;
+      }
+      timer = setInterval(() => {
+        process.stdout.write(`\r${FRAMES[frameIndex++ % FRAMES.length]} ${label}`);
+      }, 80);
+    },
+    stop(finalLine) {
+      if (timer) {
+        clearInterval(timer);
+        timer = null;
+      }
+      clearLine();
+      if (finalLine) {
+        console.log(finalLine);
+      }
+    }
+  };
+}

package/scripts/stage_builder_api_for_docker.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+/**
+ * Stage builder-api runtime files for Docker image build (plan 154.3).
+ *
+ * @fileoverview Host-side staging before `docker build`
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const {
+  discoverRuntimeFiles,
+  findManifestViolations
+} = require('./lib/builder-api-docker-staging-core');
+const { stageFiles } = require('./lib/builder-api-docker-staging-copy');
+
+const REPO_ROOT = path.resolve(__dirname, '..');
+
+/**
+ * @param {string[]} argv
+ * @returns {number}
+ */
+function main(argv) {
+  const args = argv.slice(2);
+  let destination = path.join(REPO_ROOT, 'docker-builder-api-staging');
+  let manifestPath = '';
+
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === '--destination' && args[i + 1]) {
+      destination = path.resolve(args[i + 1]);
+      i += 1;
+    } else if (args[i] === '--manifest' && args[i + 1]) {
+      manifestPath = path.resolve(args[i + 1]);
+      i += 1;
+    }
+  }
+
+  const manifest = discoverRuntimeFiles(REPO_ROOT);
+  const violations = findManifestViolations(manifest);
+  if (violations.length > 0) {
+    console.error('Staging manifest contains forbidden paths:');
+    for (const item of violations) {
+      console.error(`  - ${item}`);
+    }
+    return 1;
+  }
+
+  const staged = stageFiles(REPO_ROOT, destination, manifest);
+  if (manifestPath) {
+    fs.mkdirSync(path.dirname(manifestPath), { recursive: true });
+    fs.writeFileSync(manifestPath, `${JSON.stringify(staged, null, 2)}\n`, 'utf8');
+  }
+
+  console.log(`OK: staged ${staged.length} files → ${destination}`);
+  return 0;
+}
+
+if (require.main === module) {
+  process.exit(main(process.argv));
+}
+
+module.exports = { main };

package/scripts/sync-builder-api-template.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+/**
+ * Publish builder/builder-api/ SSOT → templates/applications/builder-api/
+ * (manifest files only — no README; use builder/builder-api/README.md and packages/builder-api/README.md)
+ *
+ * @fileoverview sync-json for builder-api platform app (plan 154.2)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const REPO_ROOT = path.resolve(__dirname, '..');
+const SSOT_DIR = path.join(REPO_ROOT, 'builder', 'builder-api');
+const TEMPLATE_DIR = path.join(REPO_ROOT, 'templates', 'applications', 'builder-api');
+
+const SYNC_FILES = ['application.yaml', 'Dockerfile', 'env.template'];
+
+/**
+ * Publish builder/builder-api/ SSOT → templates/applications/builder-api/
+ * @returns {void}
+ */
+function main() {
+  if (!fs.existsSync(SSOT_DIR)) {
+    console.error(`Missing SSOT directory: ${SSOT_DIR}`);
+    process.exit(1);
+  }
+  fs.mkdirSync(TEMPLATE_DIR, { recursive: true });
+  for (const name of SYNC_FILES) {
+    const src = path.join(SSOT_DIR, name);
+    const dest = path.join(TEMPLATE_DIR, name);
+    if (!fs.existsSync(src)) {
+      console.error(`Missing SSOT file: ${src}`);
+      process.exit(1);
+    }
+    fs.copyFileSync(src, dest);
+    console.log(`sync-json: ${path.relative(REPO_ROOT, src)} → ${path.relative(REPO_ROOT, dest)}`);
+  }
+}
+
+main();

package/templates/README.md

@@ -13,6 +13,9 @@ Application templates are folder-based and located under `templates/applications
 **Example:**
 - `templates/applications/miso-controller/` - Miso Controller application template
 - `templates/applications/keycloak/` - Keycloak application template
+- `templates/applications/builder-api/` - Builder API platform webapp (published from `builder/builder-api/` via `npm run sync-json`)
+
+**Platform SSOT (builder-api, plan 154.2):** Edit `builder/builder-api/` in the aifabrix-builder repo, then run `npm run sync-json` to publish `application.yaml`, `Dockerfile`, and `env.template` into `templates/applications/builder-api/`. Install with `aifabrix up-platform` or `aifabrix up-builder-api` — not hand-editing the template copy.
 
 **Template Validation:**
 - Template folder must exist in `templates/applications/<name>/`

package/templates/applications/builder-api/Dockerfile

@@ -0,0 +1,38 @@
+# Builder API production image — explicit runtime COPY only (plan 154.3).
+# SSOT: builder/builder-api/Dockerfile — publish with `npm run sync-json`
+# Staging: node scripts/stage_builder_api_for_docker.js (also runs via `aifabrix build builder-api`)
+# Build context: repo root (application.yaml build.context ../..). .dockerignore is second line of defense.
+# Never ship: .cursor/, integration/, tests/, templates/applications|github|infra|*, bin/aifabrix.js, packages/.
+# Allowed templates in image: templates/openapi/, templates/external-system/ (via staging manifest only).
+
+FROM node:20-bookworm-slim
+
+ENV NODE_ENV=production \
+    PORT=3005
+
+WORKDIR /app
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends dumb-init \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev && npm cache clean --force
+
+COPY docker-builder-api-staging/lib ./lib
+COPY docker-builder-api-staging/bin/builder-api-spike.js ./bin/builder-api-spike.js
+COPY docker-builder-api-staging/bin/builder-api-cleanup.js ./bin/builder-api-cleanup.js
+COPY docker-builder-api-staging/templates ./templates
+
+RUN addgroup --system appgroup \
+    && adduser --system --ingroup appgroup --home /app appuser \
+    && chown -R appuser:appgroup /app
+USER appuser
+
+EXPOSE 3005
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
+  CMD node -e "require('http').get('http://127.0.0.1:'+(process.env.PORT||3005)+'/api/v1/builder/health',(r)=>process.exit(r.statusCode===200?0:1)).on('error',()=>process.exit(1))"
+
+ENTRYPOINT ["dumb-init", "--"]
+CMD ["node", "bin/builder-api-spike.js"]

package/templates/applications/builder-api/application.yaml

@@ -0,0 +1,75 @@
+# Application Metadata
+app:
+  key: builder-api
+  displayName: 'AI Fabrix Builder API'
+  description: 'Stateless HTTP orchestration for external-system workspace lifecycle. Provider-neutral integration flows via Dataplane Enterprise MCP and governance APIs (154.0 / 154.1).'
+  type: webapp
+  language: typescript
+  version: 1.0.0
+
+# Image Configuration
+image:
+  name: aifabrix/builder-api
+  tag: latest
+  registry: aifabrixdevacr.azurecr.io
+  registryMode: acr
+
+# Port Configuration (container port; host port = port + developer_id * 100)
+port: 3005
+
+frontDoorRouting:
+  enabled: false
+
+requires:
+  database: false
+  redis: false
+  storage: true
+
+healthCheck:
+  path: /api/v1/builder/health
+  interval: 30
+  bashProbe: true
+  probePath: /api/v1/builder/health
+  probeRequestType: GET
+  probeProtocol: Https
+  probeIntervalInSeconds: 120
+
+authentication:
+  enableSSO: false
+
+build:
+  context: ../..
+  dockerfile: builder/builder-api/Dockerfile
+  # Image policy (154.3): host staging → docker-builder-api-staging/; explicit COPY in Dockerfile;
+  # .dockerignore deny-by-default; verify with scripts/docker_image_content_gate.js builder-api.
+  envOutputPath: ../../.env
+  language: typescript
+  reloadStart: node bin/builder-api-spike.js
+  imageRun: exec node bin/builder-api-spike.js
+
+repository:
+  enabled: true
+  repositoryUrl: https://github.com/esystemsdev/aifabrix-builder
+
+configuration:
+  - name: LOG_LEVEL
+    portalInput:
+      field: select
+      label: 'Log Level'
+      options:
+        - debug
+        - info
+        - warn
+        - error
+
+  - name: WORKSPACE_DRAFT_TTL_DAYS
+    portalInput:
+      field: text
+      label: 'Draft workspace TTL (days)'
+      placeholder: '30'
+
+  - name: WORKSPACE_INACTIVE_MAX_DAYS
+    portalInput:
+      field: text
+      label: 'Inactive workspace purge threshold (days)'
+      placeholder: '90'

package/templates/applications/builder-api/env.template

@@ -0,0 +1,48 @@
+# Environment Variables Template — builder-api
+# SSOT: builder/builder-api/env.template — publish with `npm run sync-json`
+
+# =============================================================================
+# APPLICATION
+# =============================================================================
+
+PORT=${PORT}
+NODE_ENV=production
+LOG_LEVEL=info
+
+# Multi-user workspace root (persist via /mnt/data volume in Docker)
+WORKSPACE_ROOT=/mnt/data/builder-workspaces
+
+WORKSPACE_DRAFT_TTL_DAYS=30
+WORKSPACE_INACTIVE_MAX_DAYS=90
+
+MAX_BODY_BYTES=10485760
+MAX_UPLOAD_TIMEOUT_MS=300000
+
+# =============================================================================
+# PLATFORM URLS
+# =============================================================================
+# url:// resolves after kv:// at resolve time (see docs/configuration/resolve-running-urls.md)
+
+# Registered OAuth client (populated by aifabrix app register / bootstrap — same as dataplane)
+MISO_CLIENTID=kv://builder-api-client-idKeyVault
+MISO_CLIENTSECRET=kv://builder-api-client-secretKeyVault
+
+# Internal: controller API for token validation (supports all miso-controller auth modes)
+MISO_CONTROLLER_URL=url://miso-controller-internal
+
+# Internal: server-to-dataplane API (MCP execute, upload, governance)
+DATAPLANE_URL=url://dataplane-internal
+
+DEFAULT_ENVIRONMENT=dev
+
+# COM-generated Enterprise MCP owner system (normal MCP execute — no dataplane adapter)
+ENTERPRISE_MCP_SYSTEM_KEY=enterprise-integration-lifecycle
+
+# =============================================================================
+# RUNTIME CONFIG (Docker dev-reload)
+# =============================================================================
+# Resolves kv:// for workspace upload/validate. On the host, symlink or copy under
+# mount/aifabrix/ (bind-mounted at /mnt/data): config.yaml, secrets.local.yaml, certs/
+# from ~/.aifabrix. Symlinks to host paths work because the kernel resolves them on the host.
+
+AIFABRIX_CONFIG=/mnt/data/aifabrix/config.yaml