@aifabrix/builder 2.50.0 → 2.51.0

package/lib/schema/external-datasource.schema.json

@@ -7,12 +7,12 @@
          "key":"external-datasource-schema",
          "name":"External Data Source Configuration Schema",
          "description":"JSON schema for validating ExternalDataSource configuration files",
-     "version":"2.9.2",
+     "version":"2.9.4",
          "type":"schema",
          "category":"integration",
          "author":"AI Fabrix Team",
          "createdAt":"2024-01-01T00:00:00Z",
-         "updatedAt":"2026-06-16T00:00:00Z",
+         "updatedAt":"2026-07-18T00:00:00Z",
          "compatibility":{
             "minVersion":"1.0.0",
             "maxVersion":"3.0.0",
@@ -31,6 +31,22 @@
          "external-system.schema.json"
       ],
       "changelog":[
+         {
+            "version":"2.9.4",
+            "date":"2026-07-18T00:00:00Z",
+            "changes":[
+               "Removed root statusMaps (superseded by dimensions.*.map {dimensionValue, rawValue} only — 346 §7.1)."
+            ],
+            "breaking":true
+         },
+         {
+            "version":"2.9.3",
+            "date":"2026-07-18T00:00:00Z",
+            "changes":[
+               "Added optional dimensionBinding.map array of {dimensionValue, rawValue} for static Dimension raw→enterprise translation on normalize (346 §7.1)."
+            ],
+            "breaking":false
+         },
          {
             "version":"2.9.2",
             "date":"2026-07-02T00:00:00Z",
@@ -1514,6 +1530,10 @@
                "type":"boolean",
                "description":"Filterability hint for metadata-driven query planning."
             },
+            "observer":{
+               "type":"boolean",
+               "description":"When true, a committed change to this normalized first-level scalar field is eligible for Enterprise Runtime observation wake-up."
+            },
             "nullable":{
                "type":"boolean"
             },
@@ -1694,6 +1714,45 @@
                   }
                }
             },
+            {
+               "if":{
+                  "properties":{
+                     "observer":{
+                        "const":true
+                     }
+                  },
+                  "required":[
+                     "observer"
+                  ]
+               },
+               "then":{
+                  "properties":{
+                     "type":{
+                        "type":"string",
+                        "enum":[
+                           "string",
+                           "number",
+                           "integer",
+                           "boolean"
+                        ]
+                     }
+                  },
+                  "not":{
+                     "anyOf":[
+                        {
+                           "required":[
+                              "properties"
+                           ]
+                        },
+                        {
+                           "required":[
+                              "items"
+                           ]
+                        }
+                     ]
+                  }
+               }
+            },
             {
                "if":{
                   "required":[
@@ -1845,6 +1904,30 @@
                "type":"boolean",
                "default":true,
                "description":"When false, this dimension binding is not used for protection/RSS dimension enforcement or governance visibility checks. Catalog binding and metadata materialization may still apply. Use object form to disable; string shorthand bindings are always enforcement-enabled."
+            },
+            "map":{
+               "type":"array",
+               "description":"Optional raw→enterprise value map for static Dimensions. Each entry has only dimensionValue and rawValue. Datasource and field are implied by this binding. CIP normalize persists dimensionValue for ABAC/MCP.",
+               "items":{
+                  "type":"object",
+                  "additionalProperties":false,
+                  "required":[
+                     "dimensionValue",
+                     "rawValue"
+                  ],
+                  "properties":{
+                     "dimensionValue":{
+                        "type":"string",
+                        "minLength":1,
+                        "description":"Enterprise Dimension catalog value."
+                     },
+                     "rawValue":{
+                        "type":"string",
+                        "minLength":1,
+                        "description":"Connected-system token for this binding's field."
+                     }
+                  }
+               }
             }
          },
          "oneOf":[

package/lib/schema/external-system.schema.json

@@ -7,12 +7,12 @@
       "key": "external-system-schema",
       "name": "External System Configuration Schema",
       "description": "JSON schema for validating ExternalSystem configuration files",
-      "version": "1.13.0",
+      "version": "1.13.1",
       "type": "schema",
       "category": "integration",
       "author": "AI Fabrix Team",
       "createdAt": "2024-01-01T00:00:00Z",
-      "updatedAt": "2026-06-15T00:00:00Z",
+      "updatedAt": "2026-07-22T00:00:00Z",
       "compatibility": {
          "minVersion": "1.4.0",
          "maxVersion": "2.0.0",
@@ -27,6 +27,14 @@
       ],
       "dependencies": [],
       "changelog": [
+         {
+            "version": "1.13.1",
+            "date": "2026-07-22T00:00:00Z",
+            "changes": [
+               "Added optional configuration[].category for portal UI grouping labels (parity with application-schema)."
+            ],
+            "breaking": false
+         },
          {
             "version": "1.13.0",
             "date": "2026-07-02T00:00:00Z",
@@ -1163,6 +1171,12 @@
                "required": {
                   "type": "boolean"
                },
+               "category": {
+                  "type": "string",
+                  "description": "Optional UI grouping label for portal/deployment wizard Configuration tab",
+                  "minLength": 1,
+                  "maxLength": 100
+               },
                "portalInput": {
                   "type": "object",
                   "required": [

package/lib/schema/infra.parameter.yaml

@@ -204,6 +204,19 @@ parameters:
       notes: >-
         JWT signing secret; generated on first ensure. Azure Bicep typically uses `${prefix}-secrets-jwtKeyVault`.
 
+  # LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault — local default skips Mori/JWT license checks.
+  # Controller ignores DEVELOPMENT when DEPLOYMENT=azure.
+  - key: miso-controller-jwt-licenseKeyVault
+    scope: app
+    generator:
+      type: literal
+      value: 'DEVELOPMENT'
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      notes: >-
+        Local/dev default DEVELOPMENT disables license validation (no Mori/JWT required).
+        Ignored when DEPLOYMENT=azure. Override with a real offline license JWT (or empty for Mori) in non-dev.
+
   # Exact entry so this is not caught by *KeyVault → randomBytes32 (invalid email).
   - key: miso-controller-admin-emailKeyVault
     scope: app
@@ -327,7 +340,18 @@ parameters:
       vaultSecretName: dataplane-client-secretKeyVault
       notes: Per-app OAuth client secret for dataplane; generated on first ensure.
 
-  # Mori / telemetry: optional locally (LICENSE_JWT=DEVELOPMENT skips Mori); empty until integrated.
+  # Mori / telemetry: optional locally (LICENSE_JWT via miso-controller-jwt-licenseKeyVault=DEVELOPMENT skips Mori).
+  # MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault — local default apiKey.
+  - key: mori-controller-auth-methodKeyVault
+    scope: infra
+    generator:
+      type: literal
+      value: 'apiKey'
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      notes: >-
+        Local/dev default apiKey. Override when using Mori basic auth or other methods.
+
   - key: mori-controller-api-keyKeyVault
     scope: infra
     generator:

package/lib/schema/type/credential-field-registry.json

@@ -1,5 +1,5 @@
 {
-  "version": 6,
+  "version": 8,
   "semantics": {
     "visibility.show": "When false, the field name is omitted from default portal field lists, embedded credential form field lists, and from public API credentialConfig read models (GET/list with decrypt=false), in addition to any omission driven by encrypted. GET with decrypt=true returns the full decrypted config for authorized callers and does not apply this visibility filter.",
     "visibility.showValue": "UI-only: whether stored values may be shown versus placeholders in form flows that honor this flag. Does not control encryption at rest or public API stripping.",
@@ -114,10 +114,12 @@
           "display": {
             "label": "Tenant ID",
             "control": "text",
-            "enabled": true
+            "enabled": true,
+            "placeholder": "Azure AD directory (tenant) ID",
+            "description": "Used for Microsoft identity platforms. May also appear in tokenUrl as {{tenantId}}."
           },
           "visibility": {
-            "show": false,
+            "show": true,
             "showValue": true
           },
           "encrypted": false
@@ -149,6 +151,20 @@
             "showValue": false
           },
           "encrypted": true
+        },
+        {
+          "name": "accessTokenExpiresAt",
+          "required": false,
+          "display": {
+            "label": "Access Token Expires At",
+            "control": "text",
+            "enabled": false
+          },
+          "visibility": {
+            "show": false,
+            "showValue": false
+          },
+          "encrypted": false
         }
       ]
     },

package/lib/utils/api.js

@@ -426,8 +426,14 @@ async function authenticatedApiCall(url, options = {}, tokenOrAuthConfig) {
     headers
   });
 
-  // Only attempt device token refresh on 401 when user Bearer token was used (not for client-token)
-  if (!response.success && response.status === 401 && authType !== 'client-token') {
+  // Only attempt device token refresh on 401 when user Bearer token was used (not for client-token).
+  // Token-forward (builder-api): never refresh from mount device store — keep the caller JWT.
+  if (
+    !response.success &&
+    response.status === 401 &&
+    authType !== 'client-token' &&
+    !(typeof tokenOrAuthConfig === 'object' && tokenOrAuthConfig?.preserveBearer)
+  ) {
     try {
       const { forceRefreshDeviceToken } = require('./token-manager');
       const refreshedToken = await forceRefreshDeviceToken(authControllerUrl || extractControllerUrl(url));

package/lib/utils/app-register-config.js

@@ -228,11 +228,11 @@ async function extractExternalAppConfiguration(appKey, variables, appKeyFromFile
  * @returns {Object} Webapp configuration
  */
 function extractWebappConfiguration(variables, appKeyFromFile, displayName, description, options) {
-  const appType = variables.build?.language === 'typescript' ? 'webapp' : 'service';
+  const appType = variables.app?.type || 'webapp';
   const registryMode = variables.image?.registryMode || 'external';
   const port = options.port ?? getContainerPort(variables);
   const localPort = port;
-  const language = variables.build?.language || 'typescript';
+  const language = variables.build?.language || variables.app?.language || 'typescript';
   const image = buildImageReference(variables, appKeyFromFile);
   const url = variables.app?.url || variables.deployment?.dataplaneUrl || variables.deployment?.appUrl || null;
 
@@ -252,7 +252,8 @@ function extractWebappConfiguration(variables, appKeyFromFile, displayName, desc
 
 async function extractAppConfiguration(variables, appKey, options) {
   const appKeyFromFile = variables.app?.key || appKey;
-  const displayName = variables.app?.name || options.name || appKey;
+  const displayName =
+    variables.app?.displayName || variables.app?.name || options.name || appKey;
   const description = variables.app?.description || '';
 
   if (variables.app?.type === 'external') {

package/lib/utils/cli-sync-options.js

@@ -6,9 +6,60 @@
 
 'use strict';
 
+/**
+ * True when `node` looks like a Commander command (or a test double), not a plain opts bag.
+ *
+ * @param {*} node
+ * @returns {boolean}
+ */
+function isCommanderLike(node) {
+  if (!node || typeof node !== 'object') {
+    return false;
+  }
+  return (
+    Array.isArray(node.rawArgs) ||
+    typeof node.opts === 'function' ||
+    (Object.prototype.hasOwnProperty.call(node, 'parent') &&
+      (node.parent === null ||
+        node.parent === undefined ||
+        typeof node.parent === 'object'))
+  );
+}
+
+/**
+ * Collect argv-like arrays from a Commander command and its parents.
+ * Subcommand `rawArgs` is often empty; the flag lives on the root command.
+ * Safely no-ops for null/undefined or plain options objects (not Command-like).
+ *
+ * @param {import('commander').Command|null|undefined} cmd
+ * @returns {string[]}
+ */
+function collectCommanderRawArgs(cmd) {
+  if (!isCommanderLike(cmd)) {
+    return [];
+  }
+  const chunks = [];
+  const seen = new Set();
+  let current = cmd;
+  while (isCommanderLike(current)) {
+    if (seen.has(current)) {
+      break;
+    }
+    seen.add(current);
+    if (Array.isArray(current.rawArgs) && current.rawArgs.length > 0) {
+      chunks.push(...current.rawArgs);
+    }
+    current = current.parent;
+  }
+  return chunks;
+}
+
 /**
  * True when the user passed `--no-publish` or set `noPublish: true` (programmatic).
  *
+ * Commander maps `.option('--no-publish', …)` to `publish: false` (default `true`),
+ * not `noPublish: true`. Detect that shape as well as programmatic `noPublish`.
+ *
  * @param {Object|null|undefined} options - Commander-parsed options
  * @param {import('commander').Command} [cmd] - Commander command (for rawArgs fallback)
  * @returns {boolean}
@@ -20,10 +71,15 @@ function cliOptsSkipPublish(options, cmd) {
   if (options.noPublish === true) {
     return true;
   }
-  const raw = cmd && Array.isArray(cmd.rawArgs) ? cmd.rawArgs : [];
-  return raw.includes('--no-publish');
+  // Commander `--no-X` → property `X` defaults true; flag sets it false
+  if (options.publish === false) {
+    return true;
+  }
+  return collectCommanderRawArgs(cmd).includes('--no-publish');
 }
 
 module.exports = {
-  cliOptsSkipPublish
+  cliOptsSkipPublish,
+  collectCommanderRawArgs,
+  isCommanderLike
 };

package/lib/utils/cli-utils.js

@@ -219,9 +219,14 @@ function formatAzureError(errorMsg) {
   if (errorMsg.includes('Docker build failed') || errorMsg.includes('Build failed: Docker')) {
     return null;
   }
-  // Only match ACR-specific authentication errors, not general authentication failures
-  if (errorMsg.includes('ACR') || errorMsg.includes('azurecr.io') ||
-      (errorMsg.includes('authenticate') && (errorMsg.includes('registry') || errorMsg.includes('container')))) {
+  const lowerMsg = String(errorMsg || '').toLowerCase();
+  const hasAcrDomain = /\b[a-z0-9.-]+\.azurecr\.io\b/i.test(errorMsg);
+  const hasAcrKeyword = /\bacr\b/.test(lowerMsg);
+  const hasAuthAndRegistryContext =
+    /\bauthenticate\b/.test(lowerMsg) &&
+    (/\bregistry\b/.test(lowerMsg) || /\bcontainer\b/.test(lowerMsg));
+  // Only match ACR-specific authentication errors, not general authentication failures.
+  if (hasAcrKeyword || hasAcrDomain || hasAuthAndRegistryContext) {
     return [
       '   Azure Container Registry authentication failed.',
       '   Run: az acr login --name <registry-name>',
@@ -414,6 +419,9 @@ function isAuthenticationError(error) {
  * @param {string} command - Command that failed
  */
 function handleCommandError(error, command) {
+  if (error && error.compactGateAbortLogged === true) {
+    return;
+  }
   const errorMessages = formatError(error);
   const skipDoctor = isMissingSecretsErrorMessage(error && error.message);
   logError(command, errorMessages, { skipDoctor });

package/lib/utils/dev-ca-install.js

@@ -1,7 +1,7 @@
 /**
  * Dev CA Install – SSL untrusted detection, fetch CA from Builder Server, install into OS trust store.
- * Used by `aifabrix dev init` when the server certificate is self-signed. Only /install-ca uses
- * rejectUnauthorized: false; all other requests use default TLS verification.
+ * Used by `aifabrix dev init` when the server certificate is self-signed.
+ * Requests keep TLS verification enabled by default.
  *
  * @fileoverview CA install utilities for development Builder Server
  * @author AI Fabrix Team
@@ -163,7 +163,7 @@ function finalizeInstallCaResponse(res, absoluteUrl, chunks, resolve, reject) {
 }
 
 /**
- * GET absolute install-ca URL with insecure TLS; follow redirects (resolve relative Location).
+ * GET absolute install-ca URL with TLS verification enabled; follow redirects.
  * @param {string} absoluteUrl - Full https URL
  * @param {number} redirectCount - Redirect depth
  * @returns {Promise<Buffer>} CA PEM
@@ -179,10 +179,9 @@ function fetchInstallCaAbsolute(absoluteUrl, redirectCount) {
       reject(new Error('install-ca requires https URL'));
       return;
     }
-    const agent = new https.Agent({ rejectUnauthorized: false });
     const req = https.get(
       absoluteUrl,
-      { agent },
+      {},
       (res) => {
         if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
           res.destroy();
@@ -208,7 +207,7 @@ function fetchInstallCaAbsolute(absoluteUrl, redirectCount) {
 
 /**
  * Fetch CA PEM from Builder Server via GET {baseUrl}/install-ca.
- * Uses rejectUnauthorized: false only for this endpoint (dev setup).
+ * Uses default TLS verification for this endpoint.
  * @param {string} baseUrl - Builder Server base URL (no trailing slash)
  * @returns {Promise<Buffer>} CA certificate PEM
  */

package/lib/utils/dev-config.js

@@ -44,8 +44,8 @@ function getDevPorts(developerId) {
     throw new Error('Developer ID must be a positive number');
   }
 
-  // Handle invalids
-  if (developerId === undefined || developerId === null || Number.isNaN(developerId)) {
+  // Handle invalid numeric values
+  if (Number.isNaN(developerId)) {
     throw new Error('Developer ID must be a positive number');
   }
   if (developerId < 0 || !Number.isInteger(developerId)) {

package/lib/utils/dev-list-sort.js

@@ -0,0 +1,145 @@
+/**
+ * @fileoverview Client-side sort for aifabrix dev list (--sort field / -field).
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+const ALLOWED_SORT_FIELDS = Object.freeze(['id', 'name', 'email', 'until']);
+
+/**
+ * @param {unknown} id
+ * @returns {string}
+ */
+function normalizeIdKey(id) {
+  const trimmed = String(id ?? '').trim();
+  if (!/^\d+$/.test(trimmed)) {
+    return trimmed;
+  }
+  return String(parseInt(trimmed, 10)).padStart(2, '0');
+}
+
+/**
+ * @param {unknown} a
+ * @param {unknown} b
+ * @returns {number}
+ */
+function compareIds(a, b) {
+  const sa = String(a ?? '').trim();
+  const sb = String(b ?? '').trim();
+  if (/^\d+$/.test(sa) && /^\d+$/.test(sb)) {
+    return parseInt(sa, 10) - parseInt(sb, 10);
+  }
+  return normalizeIdKey(sa).localeCompare(normalizeIdKey(sb), undefined, { sensitivity: 'base' });
+}
+
+/**
+ * @param {string} a
+ * @param {string} b
+ * @returns {number}
+ */
+function compareText(a, b) {
+  return a.localeCompare(b, undefined, { sensitivity: 'base' });
+}
+
+/**
+ * @param {Object} user
+ * @returns {string}
+ */
+function untilValue(user) {
+  const raw = user && user.certificateValidNotAfter;
+  return typeof raw === 'string' ? raw.trim() : '';
+}
+
+/**
+ * Parse --sort option. Default: name ascending.
+ * @param {string|undefined|null} sortOption
+ * @returns {{ field: string, descending: boolean }}
+ * @throws {Error} When field is empty or not allowed
+ */
+function parseSortSpec(sortOption) {
+  if (sortOption === undefined || sortOption === null) {
+    return { field: 'name', descending: false };
+  }
+  const trimmed = String(sortOption).trim();
+  if (!trimmed) {
+    throw new Error(
+      'Invalid --sort value "". Allowed: id, name, email, until (prefix - for descending).'
+    );
+  }
+  let descending = false;
+  let fieldPart = trimmed;
+  if (fieldPart.startsWith('-')) {
+    descending = true;
+    fieldPart = fieldPart.slice(1).trim();
+  }
+  if (!fieldPart) {
+    throw new Error(
+      'Invalid --sort value "-". Allowed: id, name, email, until (prefix - for descending).'
+    );
+  }
+  const field = fieldPart.toLowerCase();
+  if (!ALLOWED_SORT_FIELDS.includes(field)) {
+    throw new Error(
+      `Invalid --sort value "${trimmed}". Allowed: id, name, email, until (prefix - for descending).`
+    );
+  }
+  return { field, descending };
+}
+
+/**
+ * @param {Object} a
+ * @param {Object} b
+ * @param {string} field
+ * @returns {number}
+ */
+function compareByField(a, b, field) {
+  if (field === 'id') {
+    return compareIds(a.id, b.id);
+  }
+  if (field === 'name') {
+    return compareText(String(a.name || ''), String(b.name || ''));
+  }
+  if (field === 'email') {
+    return compareText(String(a.email || ''), String(b.email || ''));
+  }
+  const ua = untilValue(a);
+  const ub = untilValue(b);
+  if (!ua && !ub) {
+    return 0;
+  }
+  if (!ua) {
+    return 1;
+  }
+  if (!ub) {
+    return -1;
+  }
+  return compareText(ua, ub);
+}
+
+/**
+ * Sort developer users without mutating the input array.
+ * @param {Object[]} users
+ * @param {string|undefined|null} sortOption
+ * @returns {Object[]}
+ */
+function sortDevUsers(users, sortOption) {
+  const { field, descending } = parseSortSpec(sortOption);
+  const list = Array.isArray(users) ? [...users] : [];
+  list.sort((a, b) => {
+    let cmp = compareByField(a, b, field);
+    if (descending) {
+      cmp = -cmp;
+    }
+    if (cmp !== 0) {
+      return cmp;
+    }
+    return compareIds(a.id, b.id);
+  });
+  return list;
+}
+
+module.exports = {
+  ALLOWED_SORT_FIELDS,
+  parseSortSpec,
+  sortDevUsers
+};

package/lib/utils/dev-platform-tls.js

@@ -8,7 +8,6 @@
 
 'use strict';
 
-const https = require('https');
 const config = require('../core/config');
 const { isLocalhostPublicSchemeHostname } = require('./localhost-public-host');
 
@@ -68,65 +67,6 @@ async function shouldAllowInsecureDevPlatformTls(url) {
   }
 }
 
-/**
- * Minimal fetch for self-signed dev platform HTTPS (Node global fetch cannot set rejectUnauthorized).
- *
- * @param {string} url
- * @param {Object} options
- * @returns {Promise<{ status: number, statusText: string, headers: { get: Function }, text: Function, json: Function }>}
- */
-function nodeHttpsFetchInsecure(url, options = {}) {
-  return new Promise((resolve, reject) => {
-    const u = new URL(url);
-    const method = String(options.method || 'GET').toUpperCase();
-    const headers = { ...(options.headers || {}) };
-    const body = options.body;
-    const reqOpts = {
-      hostname: u.hostname,
-      port: u.port || 443,
-      path: `${u.pathname}${u.search}`,
-      method,
-      headers,
-      rejectUnauthorized: false
-    };
-
-    const req = https.request(reqOpts, (res) => {
-      const chunks = [];
-      res.on('data', (chunk) => chunks.push(chunk));
-      res.on('end', () => {
-        const raw = Buffer.concat(chunks).toString('utf8');
-        const status = res.statusCode || 0;
-        resolve({
-          ok: status >= 200 && status < 300,
-          status,
-          statusText: res.statusMessage || '',
-          headers: {
-            get: (name) => res.headers[String(name || '').toLowerCase()] || null
-          },
-          text: async() => raw,
-          json: async() => JSON.parse(raw)
-        });
-      });
-    });
-
-    req.on('error', reject);
-    if (options.signal) {
-      const onAbort = () => {
-        req.destroy(new Error('The operation was aborted'));
-      };
-      if (options.signal.aborted) {
-        onAbort();
-        return;
-      }
-      options.signal.addEventListener('abort', onAbort, { once: true });
-    }
-    if (body !== undefined && body !== null) {
-      req.write(typeof body === 'string' ? body : String(body));
-    }
-    req.end();
-  });
-}
-
 /**
  * @async
  * @param {string} url
@@ -134,9 +74,6 @@ function nodeHttpsFetchInsecure(url, options = {}) {
  * @returns {Promise<Response>}
  */
 async function fetchWithOptionalDevPlatformTls(url, options = {}) {
-  if (await shouldAllowInsecureDevPlatformTls(url)) {
-    return nodeHttpsFetchInsecure(url, options);
-  }
   return fetch(url, options);
 }