@aifabrix/builder 2.50.0 → 2.51.1

package/lib/generator/wizard.js

@@ -213,12 +213,21 @@ async function generateWizardFiles(appName, systemConfig, datasourceConfigs, sys
     const fmt = format === 'json' ? 'json' : 'yaml';
     const ext = FORMAT_EXT[fmt] || '.yaml';
     const { appPath, finalSystemKey, updatedSystemConfig, updatedDatasourceConfigs } = await prepareWizardContext(appName, systemConfig, datasourceConfigs);
+    const newDatasourceFileNames = await writeDatasourceYamlFiles(appPath, finalSystemKey, updatedDatasourceConfigs, fmt);
+    const existingDatasourceFileNames = listExistingDatasourceFileNames(appPath, finalSystemKey, ext);
+    const datasourceFileNames = [...new Set([...existingDatasourceFileNames, ...newDatasourceFileNames])];
+    const existingDatasourceKeys = datasourceFileNames
+      .map((name) => datasourceFileNameToKey(name, finalSystemKey, ext))
+      .filter(Boolean);
     const systemConfigWithDataSourcesKeys = {
       ...updatedSystemConfig,
-      dataSources: updatedDatasourceConfigs.map(ds => ds.key)
+      dataSources: [...new Set([
+        ...(Array.isArray(updatedSystemConfig.dataSources) ? updatedSystemConfig.dataSources : []),
+        ...existingDatasourceKeys,
+        ...updatedDatasourceConfigs.map((ds) => ds.key).filter(Boolean)
+      ])]
     };
     const systemFilePath = await writeSystemYamlFile(appPath, finalSystemKey, systemConfigWithDataSourcesKeys, fmt);
-    const datasourceFileNames = await writeDatasourceYamlFiles(appPath, finalSystemKey, updatedDatasourceConfigs, fmt);
     const systemFileName = `${finalSystemKey}-system${ext}`;
     const configFiles = await generateConfigFilesForWizard({
       appPath,
@@ -234,7 +243,7 @@ async function generateWizardFiles(appName, systemConfig, datasourceConfigs, sys
     return {
       appPath,
       systemFilePath,
-      datasourceFilePaths: datasourceFileNames.map(name => path.join(appPath, name)),
+      datasourceFilePaths: newDatasourceFileNames.map(name => path.join(appPath, name)),
       ...configFiles
     };
   } catch (error) {
@@ -242,6 +251,40 @@ async function generateWizardFiles(appName, systemConfig, datasourceConfigs, sys
   }
 }
 
+/**
+ * List existing datasource files so add-datasource merges instead of replacing.
+ * @param {string} appPath
+ * @param {string} finalSystemKey
+ * @param {string} ext
+ * @returns {string[]}
+ */
+function listExistingDatasourceFileNames(appPath, finalSystemKey, ext) {
+  const fsSync = require('fs');
+  if (!fsSync.existsSync(appPath)) {
+    return [];
+  }
+  const prefix = `${finalSystemKey}-datasource-`;
+  return fsSync
+    .readdirSync(appPath)
+    .filter((name) => name.startsWith(prefix) && name.endsWith(ext));
+}
+
+/**
+ * Map `systemKey-datasource-companies.json` → `systemKey-companies`.
+ * @param {string} fileName
+ * @param {string} finalSystemKey
+ * @param {string} ext
+ * @returns {string|null}
+ */
+function datasourceFileNameToKey(fileName, finalSystemKey, ext) {
+  const prefix = `${finalSystemKey}-datasource-`;
+  if (!fileName.startsWith(prefix) || !fileName.endsWith(ext)) {
+    return null;
+  }
+  const segment = fileName.slice(prefix.length, fileName.length - ext.length);
+  return segment ? `${finalSystemKey}-${segment}` : null;
+}
+
 function mergeAppAndExternalIntegration(variables, appName, systemFileName, datasourceFileNames, systemConfig) {
   if (!variables.app) {
     variables.app = {
@@ -257,10 +300,14 @@ function mergeAppAndExternalIntegration(variables, appName, systemFileName, data
   if (!variables.deployment) {
     variables.deployment = { controllerUrl: '', environment: 'dev' };
   }
+  const existingDs = Array.isArray(variables.externalIntegration?.dataSources)
+    ? variables.externalIntegration.dataSources
+    : [];
+  const mergedDataSources = [...new Set([...existingDs, ...datasourceFileNames])];
   variables.externalIntegration = {
     schemaBasePath: './',
     systems: [systemFileName],
-    dataSources: datasourceFileNames,
+    dataSources: mergedDataSources,
     autopublish: true,
     version: systemConfig.version || '1.0.0'
   };

package/lib/infrastructure/helpers-docker-check.js

@@ -53,6 +53,12 @@ function formatDockerInfrastructureFailure(detail) {
  */
 async function checkDockerAvailability() {
   await ensureDevCertsIfNeededForRemoteDocker();
+  try {
+    const { ensureDevCertFreshIfDue } = require('../commands/dev-refresh');
+    await ensureDevCertFreshIfDue({ quiet: true });
+  } catch {
+    // Best-effort renew for remote Docker TLS; docker check reports real failures
+  }
   try {
     await dockerUtils.ensureDockerAndCompose();
   } catch (error) {

package/lib/infrastructure/helpers.js

@@ -181,7 +181,7 @@ function generatePgAdminConfig(infraDir, postgresPassword) {
  * @returns {string} Escaped string
  */
 function escapePgString(s) {
-  if (s === null || s === undefined || typeof s !== 'string') return '';
+  if (typeof s !== 'string') return '';
   return s.replace(/'/g, '\'\'');
 }
 

package/lib/lifecycle/access-control-abac.js

@@ -0,0 +1,121 @@
+/**
+ * @fileoverview Parse accessControl.abac from local integration datasource files (505.0).
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { resolveExternalSystemPath } = require('../utils/app-path-resolve');
+const { resolveApplicationConfigPath } = require('../utils/app-config-resolver');
+const { loadConfigFile } = require('../utils/config-format');
+const { discoverIntegrationFiles, buildEffectiveDatasourceFiles } = require('../commands/repair-internal');
+
+/**
+ * @param {Object|null|undefined} config
+ * @returns {{ applicability: 'required'|'notApplicable', rationale: string|null }}
+ */
+function parseAccessControlAbac(config) {
+  const access = config && typeof config === 'object' ? config.accessControl : null;
+  const abac = access && typeof access === 'object' ? access.abac : null;
+  if (!abac || typeof abac !== 'object') {
+    return { applicability: 'required', rationale: null };
+  }
+  const raw = String(abac.applicability || '').trim();
+  const applicability = raw === 'notApplicable' ? 'notApplicable' : 'required';
+  const rationale =
+    typeof abac.rationale === 'string' && abac.rationale.trim()
+      ? abac.rationale.trim()
+      : null;
+  return { applicability, rationale };
+}
+
+/**
+ * @param {string} appPath
+ * @returns {Object}
+ */
+function loadApplicationVariables(appPath) {
+  try {
+    const configPath = resolveApplicationConfigPath(appPath);
+    if (!fs.existsSync(configPath)) {
+      return {};
+    }
+    return loadConfigFile(configPath) || {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * @param {string} filePath
+ * @param {Map<string, Object>} map
+ */
+function putDatasourceConfig(filePath, map) {
+  if (!fs.existsSync(filePath)) {
+    return;
+  }
+  try {
+    const parsed = loadConfigFile(filePath);
+    const key = parsed && typeof parsed.key === 'string' ? parsed.key.trim() : '';
+    if (key) {
+      map.set(key, parsed);
+    }
+  } catch {
+    // skip unreadable datasource files
+  }
+}
+
+/**
+ * @param {string} systemKey
+ * @returns {Map<string, Object>}
+ */
+function loadDatasourceConfigsByKey(systemKey) {
+  const appPath = resolveExternalSystemPath(systemKey);
+  const map = new Map();
+  if (!fs.existsSync(appPath)) {
+    return map;
+  }
+  const variables = loadApplicationVariables(appPath);
+  const { datasourceFiles: discovered } = discoverIntegrationFiles(appPath);
+  const datasourceFiles = buildEffectiveDatasourceFiles(
+    appPath,
+    discovered,
+    variables.externalIntegration?.dataSources
+  );
+  for (const fileName of datasourceFiles) {
+    putDatasourceConfig(path.join(appPath, fileName), map);
+  }
+  return map;
+}
+
+/**
+ * @param {string} systemKey
+ * @param {string[]} keys
+ * @returns {string[]}
+ */
+function filterAbacRequiredDatasourceKeys(systemKey, keys) {
+  const configs = loadDatasourceConfigsByKey(systemKey);
+  return (keys || []).filter(key => {
+    const abac = parseAccessControlAbac(configs.get(key) || null);
+    return abac.applicability !== 'notApplicable';
+  });
+}
+
+/**
+ * @param {string} systemKey
+ * @param {string[]} keys
+ * @returns {boolean}
+ */
+function allDatasourcesAbacNotApplicable(systemKey, keys) {
+  if (!keys || keys.length === 0) {
+    return false;
+  }
+  return filterAbacRequiredDatasourceKeys(systemKey, keys).length === 0;
+}
+
+module.exports = {
+  parseAccessControlAbac,
+  loadDatasourceConfigsByKey,
+  filterAbacRequiredDatasourceKeys,
+  allDatasourcesAbacNotApplicable
+};

package/lib/lifecycle/lifecycle-governance-options.js

@@ -21,7 +21,10 @@ function lifecycleHasGovernanceSubjects(options) {
  * @returns {boolean}
  */
 function lifecycleGovernanceNeedsWork(report) {
-  return report?.governance?.verdict !== VERDICT.VERIFIED;
+  const verdict = report?.governance?.verdict;
+  return (
+    verdict !== VERDICT.VERIFIED && verdict !== VERDICT.NOT_APPLICABLE
+  );
 }
 
 /**

package/lib/lifecycle/product-model.js

@@ -7,7 +7,7 @@
 
 'use strict';
 
-/** @typedef {'VERIFIED'|'FAILED'|'NOT_VERIFIED'} LifecycleVerdict */
+/** @typedef {'VERIFIED'|'FAILED'|'NOT_VERIFIED'|'NOT_APPLICABLE'} LifecycleVerdict */
 
 /** @typedef {'BRONZE'|'SILVER'|'GOLD'|'PLATINUM'|'NONE'} CertificationLevel */
 
@@ -16,7 +16,8 @@
 const VERDICT = Object.freeze({
   VERIFIED: 'VERIFIED',
   FAILED: 'FAILED',
-  NOT_VERIFIED: 'NOT_VERIFIED'
+  NOT_VERIFIED: 'NOT_VERIFIED',
+  NOT_APPLICABLE: 'NOT_APPLICABLE'
 });
 
 const CERTIFICATION_LEVEL = Object.freeze({

package/lib/lifecycle/report-display.js

@@ -58,9 +58,13 @@ function displayHeroMetric(label, percent) {
   logger.log('');
 }
 
-function displayVerdictLine(verdict, verifiedLabel, failedLabel) {
+function displayVerdictLine(verdict, verifiedLabel, failedLabel, notApplicableLabel) {
   if (verdict === VERDICT.VERIFIED) {
     logger.log(formatSuccessParagraph(verifiedLabel));
+  } else if (verdict === VERDICT.NOT_APPLICABLE) {
+    logger.log(
+      formatSuccessParagraph(notApplicableLabel || 'NOT APPLICABLE')
+    );
   } else {
     logger.log(formatBlockingError(failedLabel));
   }
@@ -196,7 +200,12 @@ function displayVerifyGovernanceTTY(systemKey, result, opts = {}) {
   logger.log(chalk.white('Enforcement Scenarios'));
   logger.log(chalk.cyan.bold(`${passed}/${total} Passed`));
   logger.log('');
-  displayVerdictLine(result.verdict, 'GOVERNANCE VERIFIED', 'GOVERNANCE FAILED');
+  displayVerdictLine(
+    result.verdict,
+    'GOVERNANCE VERIFIED',
+    'GOVERNANCE FAILED',
+    'GOVERNANCE NOT APPLICABLE'
+  );
   if (opts.details === true) {
     displayGovernanceVerboseDetails(result);
   }
@@ -209,6 +218,9 @@ function formatPillarLine(label, verdict) {
   if (verdict === VERDICT.FAILED) {
     return `${label.padEnd(24)}${failureGlyph()} FAILED`;
   }
+  if (verdict === VERDICT.NOT_APPLICABLE) {
+    return `${label.padEnd(24)}— NOT APPLICABLE`;
+  }
   return `${label.padEnd(24)}— NOT VERIFIED`;
 }
 

package/lib/programmatic/auth-config.js

@@ -10,7 +10,7 @@
 
 /**
  * @param {string} bearerToken
- * @returns {{ type: 'bearer', token: string }}
+ * @returns {{ type: 'bearer', token: string, preserveBearer: true }}
  */
 function buildBearerAuthConfig(bearerToken) {
   if (!bearerToken || typeof bearerToken !== 'string') {
@@ -20,7 +20,8 @@ function buildBearerAuthConfig(bearerToken) {
   if (!token) {
     throw new Error('Bearer token is required');
   }
-  return { type: 'bearer', token };
+  // Token-forward: caller JWT must reach dataplane CIP/pipeline unchanged (no API_KEY swap).
+  return { type: 'bearer', token, preserveBearer: true };
 }
 
 /**

package/lib/programmatic/bearer-auth.js

@@ -20,7 +20,7 @@ function extractBearerToken(req) {
   if (!auth || typeof auth !== 'string') {
     return null;
   }
-  const match = auth.match(/^Bearer\s+(.+)$/i);
+  const match = auth.match(/^Bearer\s+([^\s]+)\s*$/i);
   return match ? match[1].trim() : null;
 }
 

package/lib/programmatic/capability-registry.js

@@ -40,6 +40,21 @@ const CAPABILITIES = Object.freeze([
   { method: 'POST', route: '/systems/:systemKey/certify/:pillar', handlerId: 'runCertifyPillar', operationType: 'certify', mutating: true },
   { method: 'GET', route: '/systems/:systemKey/lifecycle', handlerId: 'getLifecycleReport', operationType: 'certify.read', mutating: false },
   { method: 'POST', route: '/systems/:systemKey/upload', handlerId: 'runUpload', operationType: 'apply.dev', mutating: true },
+  { method: 'POST', route: '/systems/:systemKey/deploy', handlerId: 'runDeploySystem', operationType: 'apply.prod', mutating: true },
+  {
+    method: 'POST',
+    route: '/systems/:systemKey/datasources/:datasourceKey/protection/upload',
+    handlerId: 'runProtectionUpload',
+    operationType: 'apply.protection',
+    mutating: true
+  },
+  {
+    method: 'POST',
+    route: '/systems/:systemKey/datasources/:datasourceKey/protection/create',
+    handlerId: 'runProtectionCreate',
+    operationType: 'apply.protection',
+    mutating: true
+  },
   { method: 'POST', route: '/systems/:systemKey/template/materialize', handlerId: 'materializeTemplate', operationType: 'template', mutating: true },
   { method: 'GET', route: '/systems/:systemKey/workspace/status', handlerId: 'getWorkspaceStatus', operationType: 'workspace.read', mutating: false },
   { method: 'POST', route: '/systems/:systemKey/workspace/diff', handlerId: 'runWorkspaceDiff', operationType: 'workspace.read', mutating: false },
@@ -49,7 +64,11 @@ const CAPABILITIES = Object.freeze([
   { method: 'GET', route: '/systems/:systemKey/repository/status', handlerId: 'getRepositoryStatus', operationType: 'repository.read', mutating: false },
   { method: 'POST', route: '/systems/:systemKey/repository/dispatch-pipeline', handlerId: 'runRepositoryDispatchPipeline', operationType: 'repository', mutating: true },
   { method: 'GET', route: '/health', handlerId: 'health', operationType: 'infra', mutating: false },
-  { method: 'GET', route: '/health/ready', handlerId: 'ready', operationType: 'infra', mutating: false }
+  { method: 'GET', route: '/health/ready', handlerId: 'ready', operationType: 'infra', mutating: false },
+  { method: 'GET', route: '/evidence/:roleKey/metadata', handlerId: 'getEvidenceMetadata', operationType: 'evidence.read', mutating: false },
+  { method: 'GET', route: '/evidence/:roleKey/download', handlerId: 'downloadEvidence', operationType: 'evidence.read', mutating: false },
+  { method: 'POST', route: '/evidence/:roleKey/upload', handlerId: 'uploadEvidenceCandidates', operationType: 'evidence.write', mutating: true },
+  { method: 'POST', route: '/evidence/:roleKey/activate', handlerId: 'activateEvidenceCandidates', operationType: 'evidence.activate', mutating: true }
 ]);
 
 /**

package/lib/programmatic/command-options.js

@@ -22,6 +22,7 @@ function mergeProgrammaticOptions(ctx, options = {}) {
     authConfig: auth.authConfig,
     dataplaneUrl: auth.dataplaneUrl,
     environment: auth.environment,
+    controllerUrl: ctx.controllerUrl || options.controllerUrl,
     silentResolve: true,
     minimal: options.minimal !== false
   };

package/lib/programmatic/enterprise-mcp-client.js

@@ -19,6 +19,21 @@ function resolveEnterpriseMcpSystemKey() {
   return (process.env.ENTERPRISE_MCP_SYSTEM_KEY || 'enterprise-integration-lifecycle').trim();
 }
 
+/**
+ * COM-generated Enterprise MCP tools sometimes use OpenAPI operationId forms
+ * (e.g. repository.getrepositorystatus) instead of canonical capability keys
+ * (repository.status). Map canonical → published name when present.
+ *
+ * @type {Record<string, string>}
+ */
+const ENTERPRISE_MCP_TOOL_ALIASES = {
+  'repository.status': 'repository.getrepositorystatus',
+  'repository.sync': 'repository.runrepositorysync',
+  'repository.createReview': 'repository.runrepositorycreatereview',
+  'repository.dispatchPipeline': 'repository.runrepositorydispatchpipeline',
+  'template.materializeWorkspace': 'template.runwizard'
+};
+
 /**
  * @param {string} capabilityKey
  * @returns {{ resourceType: string, toolName: string }}
@@ -29,9 +44,10 @@ function parseCapabilityKey(capabilityKey) {
   if (dotIndex <= 0) {
     throw new Error('capabilityKey must be resourceType.operation form');
   }
+  const toolName = ENTERPRISE_MCP_TOOL_ALIASES[key] || key;
   return {
     resourceType: key.slice(0, dotIndex),
-    toolName: key
+    toolName
   };
 }
 
@@ -42,7 +58,7 @@ function parseCapabilityKey(capabilityKey) {
  * @returns {string}
  */
 function buildMcpExecutePath(systemKey, resourceType, toolName) {
-  return `/api/v1/mcp/${encodeURIComponent(systemKey)}/${encodeURIComponent(resourceType)}/tools/${encodeURIComponent(toolName)}/execute`;
+  return `/api/v1/mcp/servers/${encodeURIComponent(systemKey)}/${encodeURIComponent(resourceType)}/tools/${encodeURIComponent(toolName)}/execute`;
 }
 
 /**

package/lib/programmatic/index.js

@@ -6,6 +6,8 @@
 
 const workspaceContext = require('./workspace-context');
 const runUpload = require('./run-upload');
+const runDeploy = require('./run-deploy');
+const runProtection = require('./run-protection');
 const runWizard = require('./run-wizard');
 const runRepair = require('./run-repair');
 const runValidate = require('./run-validate');
@@ -29,6 +31,8 @@ const enterpriseMcpClient = require('./enterprise-mcp-client');
 module.exports = {
   ...workspaceContext,
   ...runUpload,
+  ...runDeploy,
+  ...runProtection,
   ...runWizard,
   ...runRepair,
   ...runValidate,

package/lib/programmatic/manifest-patch-section.js

@@ -33,7 +33,7 @@ const { runWithWorkspaceContext } = require('./workspace-context');
 
 /**
  * @param {import('./workspace-context').WorkspaceContext} ctx
- * @param {{ sectionKey: string, datasourceKey?: string, intent: string, patch: Object, mode: string, sectionReadToken: string, dryRun?: boolean }} body
+ * @param {{ sectionKey: string, datasourceKey?: string, intent: string, patch: Object, mode: string, sectionReadToken?: string, dryRun?: boolean }} body
  */
 async function patchManifestSection(ctx, body) {
   return runWithWorkspaceContext(ctx, async() => {
@@ -43,10 +43,11 @@ async function patchManifestSection(ctx, body) {
 
     const loaded = loadTargetDocument(ctx, def.target, body.datasourceKey);
     const beforeValue = extractSectionValue(loaded.doc, def);
-    verifyReadToken(body, beforeValue);
+    assertSectionReadToken(body, beforeValue);
 
     const draft = JSON.parse(JSON.stringify(loaded.doc));
-    injectSectionValue(draft, def, body.patch, body.mode === 'replace' ? 'replace' : 'merge');
+    const patchValue = normalizeSectionPatch(def, body.patch);
+    injectSectionValue(draft, def, patchValue, body.mode === 'replace' ? 'replace' : 'merge');
     validateDraftDocument(def.target, draft);
 
     const afterValue = extractSectionValue(draft, def);
@@ -58,6 +59,47 @@ async function patchManifestSection(ctx, body) {
   });
 }
 
+/**
+ * Scalar single-path sections (resourceType, entityType, syncBridge, …) accept
+ * `{ value: <scalar> }` or `{ <leaf>: <scalar> }` because OpenAPI types `patch` as object.
+ *
+ * @param {import('./manifest-section-registry-data').SectionDefinition} def
+ * @param {Object} patch
+ * @returns {*}
+ */
+function normalizeSectionPatch(def, patch) {
+  if (!def || !Array.isArray(def.paths) || def.paths.length !== 1) {
+    return patch;
+  }
+  if (!patch || typeof patch !== 'object' || Array.isArray(patch)) {
+    return patch;
+  }
+  const keys = Object.keys(patch);
+  if (keys.length !== 1) {
+    return patch;
+  }
+  const leaf = def.paths[0].includes('.') ? def.paths[0].split('.').pop() : def.paths[0];
+  if (keys[0] === 'value' || keys[0] === leaf) {
+    return patch[keys[0]];
+  }
+  return patch;
+}
+
+/**
+ * When sectionReadToken is omitted, trust the freshly loaded section value
+ * (CLI patch-section parity — plan 496.2). Explicit tokens still verify.
+ *
+ * @param {Object} body
+ * @param {*} beforeValue
+ */
+function assertSectionReadToken(body, beforeValue) {
+  const token = typeof body.sectionReadToken === 'string' ? body.sectionReadToken.trim() : '';
+  if (!token) {
+    return;
+  }
+  verifyReadToken({ ...body, sectionReadToken: token }, beforeValue);
+}
+
 /**
  * @param {Object} body
  * @param {*} beforeValue
@@ -162,11 +204,6 @@ function assertPatchRequest(body) {
     err.statusCode = 400;
     throw err;
   }
-  if (!body.sectionReadToken) {
-    const err = new Error('sectionReadToken is required — GET the section first');
-    err.statusCode = 400;
-    throw err;
-  }
   if (body.mode !== 'merge' && body.mode !== 'replace') {
     const err = new Error('mode must be merge or replace');
     err.statusCode = 400;
@@ -248,5 +285,7 @@ function buildRiskHints(sectionKey, patch, downstream) {
 }
 
 module.exports = {
-  patchManifestSection
+  patchManifestSection,
+  normalizeSectionPatch,
+  assertSectionReadToken
 };

package/lib/programmatic/manifest-section-registry-data.js

@@ -226,11 +226,12 @@ const SECTION_DEFINITIONS = Object.freeze({
   },
   'datasource.dimensions': {
     target: 'datasource',
-    paths: ['fieldMappings.dimensions'],
+    // Canonical root is top-level `dimensions` (fieldMappings.dimensions removed).
+    paths: ['dimensions'],
     mutable: true,
     required: false,
     sourceOfTruth: true,
-    repairHooks: ['fieldMappings']
+    repairHooks: []
   },
   'datasource.abac': {
     target: 'datasource',

package/lib/programmatic/manifest-section-registry.js

@@ -22,6 +22,15 @@ const SCHEMA_DIR = path.join(__dirname, '..', 'schema');
 let systemSchemaDoc = null;
 /** @type {Object|null} */
 let datasourceSchemaDoc = null;
+const PROTOTYPE_POLLUTION_KEYS = new Set(['__proto__', 'prototype', 'constructor']);
+
+/**
+ * @param {string} part
+ * @returns {boolean}
+ */
+function isSafePathPart(part) {
+  return typeof part === 'string' && part.length > 0 && !PROTOTYPE_POLLUTION_KEYS.has(part);
+}
 
 function getSystemSchemaDoc() {
   if (!systemSchemaDoc) {
@@ -90,10 +99,18 @@ function getPathValue(doc, dottedPath) {
  */
 function setPathValue(doc, dottedPath, value) {
   const parts = dottedPath.split('.');
+  for (const part of parts) {
+    if (!isSafePathPart(part)) {
+      const err = new Error(`Unsafe path segment: ${part}`);
+      err.statusCode = 400;
+      throw err;
+    }
+  }
   let current = doc;
   for (let i = 0; i < parts.length - 1; i += 1) {
     const part = parts[i];
-    if (current[part] === null || current[part] === undefined || typeof current[part] !== 'object') {
+    const next = Object.prototype.hasOwnProperty.call(current, part) ? current[part] : undefined;
+    if (next === null || next === undefined || typeof next !== 'object' || Array.isArray(next)) {
       current[part] = {};
     }
     current = current[part];

package/lib/programmatic/openapi-apply-result-schemas.js

@@ -0,0 +1,44 @@
+/**
+ * OpenAPI result schemas for deploy and protection apply routes.
+ *
+ * @fileoverview Split from openapi-result-schemas for file-size limits
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { frozenObject, schemaRef } = require('./openapi-schema-helpers');
+
+/** @type {Record<string, Object>} */
+const OPENAPI_APPLY_RESULT_SCHEMAS = {
+  DeployResultData: frozenObject(
+    {
+      deployed: { type: 'boolean' },
+      deploymentId: { type: 'string' },
+      environment: { type: 'string' },
+      systemKey: schemaRef('SystemKey')
+    },
+    ['deployed']
+  ),
+  ProtectionUploadData: frozenObject(
+    {
+      datasourceKey: schemaRef('DatasourceKey'),
+      uploaded: { type: 'boolean' },
+      dryRun: { type: 'boolean' }
+    },
+    ['datasourceKey', 'uploaded', 'dryRun']
+  ),
+  ProtectionCreateData: frozenObject(
+    {
+      datasourceKey: schemaRef('DatasourceKey'),
+      created: { type: 'boolean' },
+      dryRun: { type: 'boolean' }
+    },
+    ['datasourceKey', 'created', 'dryRun']
+  )
+};
+
+module.exports = {
+  OPENAPI_APPLY_RESULT_SCHEMAS
+};