@aifabrix/builder 2.50.0 → 2.51.1

package/lib/programmatic/run-evidence-authoring.js

@@ -0,0 +1,80 @@
+/**
+ * Programmatic Evidence authoring wrappers (plan 162.0 BTA-facing APIs).
+ *
+ * @fileoverview HTTP handlers → lib/api/evidence-authoring.api.js
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const {
+  getEvidenceMetadata: getEvidenceMetadataApi,
+  downloadEvidence: downloadEvidenceApi,
+  uploadEvidenceCandidates: uploadEvidenceCandidatesApi,
+  activateEvidenceCandidates: activateEvidenceCandidatesApi
+} = require('../api/evidence-authoring.api');
+const { mergeProgrammaticOptions } = require('./command-options');
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @param {Object} [options]
+ * @returns {{ dataplaneUrl: string, authConfig: Object, apiOptions: Object }}
+ */
+function resolveEvidenceCallContext(ctx, options = {}) {
+  const merged = mergeProgrammaticOptions(ctx, options);
+  return {
+    dataplaneUrl: merged.dataplaneUrl,
+    authConfig: merged.authConfig,
+    apiOptions: {
+      controllerUrl: merged.controllerUrl || options.controllerUrl || null
+    }
+  };
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @param {string} roleKey
+ * @param {Object} [options]
+ */
+async function getEvidenceMetadata(ctx, roleKey, options = {}) {
+  const call = resolveEvidenceCallContext(ctx, options);
+  return getEvidenceMetadataApi(call.dataplaneUrl, call.authConfig, roleKey, call.apiOptions);
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @param {Object} params
+ * @param {Object} [options]
+ */
+async function downloadEvidence(ctx, params = {}, options = {}) {
+  const call = resolveEvidenceCallContext(ctx, options);
+  return downloadEvidenceApi(call.dataplaneUrl, call.authConfig, params, call.apiOptions);
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @param {Object|Object[]} payload
+ * @param {Object} [options]
+ */
+async function uploadEvidenceCandidates(ctx, payload = {}, options = {}) {
+  const call = resolveEvidenceCallContext(ctx, options);
+  return uploadEvidenceCandidatesApi(call.dataplaneUrl, call.authConfig, payload, call.apiOptions);
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @param {Object} payload
+ * @param {Object} [options]
+ */
+async function activateEvidenceCandidates(ctx, payload = {}, options = {}) {
+  const call = resolveEvidenceCallContext(ctx, options);
+  return activateEvidenceCandidatesApi(call.dataplaneUrl, call.authConfig, payload, call.apiOptions);
+}
+
+module.exports = {
+  getEvidenceMetadata,
+  downloadEvidence,
+  uploadEvidenceCandidates,
+  activateEvidenceCandidates
+};

package/lib/programmatic/run-protection.js

@@ -0,0 +1,124 @@
+/**
+ * Programmatic protection wrappers for builder-api.
+ *
+ * @fileoverview POST …/protection/upload and …/protection/create
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const {
+  runProtectionUpload: uploadProtectionCli
+} = require('../protection/run-commands');
+const { runProtectionCreate: createProtectionCli } = require('../protection/run-protection-create');
+const { resolveProtectionArgument } = require('../protection/resolve');
+const { runWithWorkspaceContext } = require('./workspace-context');
+const { mergeProgrammaticOptions } = require('./command-options');
+const { touchWorkspaceMeta } = require('./workspace-meta');
+
+/**
+ * Quiet logger for programmatic (non-TTY) protection calls.
+ * @returns {{ log: Function, error: Function, warn: Function }}
+ */
+function programmaticLogger() {
+  return {
+    log() {},
+    error() {},
+    warn() {}
+  };
+}
+
+/**
+ * @param {number} code
+ * @param {string} operation
+ */
+function assertExitOk(code, operation) {
+  if (code === 0 || code === null || code === undefined) {
+    return;
+  }
+  const err = new Error(`${operation} failed (exit ${code})`);
+  err.statusCode = 422;
+  throw err;
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @param {string} datasourceKey
+ * @param {Object} [options]
+ * @param {boolean} [options.dryRun]
+ * @param {boolean} [options.sync]
+ * @param {boolean} [options.verbose]
+ * @returns {Promise<{ datasourceKey: string, uploaded: boolean, dryRun: boolean }>}
+ */
+async function runProtectionUpload(ctx, datasourceKey, options = {}) {
+  const merged = mergeProgrammaticOptions(ctx, options);
+  const logger = programmaticLogger();
+  return runWithWorkspaceContext(ctx, async() => {
+    const resolved = resolveProtectionArgument(datasourceKey);
+    const code = await uploadProtectionCli(resolved.datasourceKey, resolved.manifest, {
+      ...merged,
+      manifestPath: resolved.manifestPath,
+      dryRun: options.dryRun === true,
+      sync: options.sync === true,
+      verbose: options.verbose === true
+    }, logger);
+    assertExitOk(code, 'Protection upload');
+    if (!options.dryRun) {
+      touchWorkspaceMeta(ctx, { lastOperation: 'protection:upload' });
+    }
+    return {
+      datasourceKey: resolved.datasourceKey,
+      uploaded: options.dryRun !== true,
+      dryRun: options.dryRun === true
+    };
+  });
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @param {string} datasourceKey
+ * @param {Object} [options]
+ * @returns {Promise<{ datasourceKey: string, created: boolean, dryRun: boolean }>}
+ */
+async function runProtectionCreate(ctx, datasourceKey, options = {}) {
+  const merged = mergeProgrammaticOptions(ctx, options);
+  const logger = programmaticLogger();
+  return runWithWorkspaceContext(ctx, async() => {
+    const code = await createProtectionCli(
+      datasourceKey,
+      {
+        ...merged,
+        type: options.type,
+        dimensionKey: options.dimensionKey,
+        field: options.field,
+        fkName: options.fkName,
+        protectionKey: options.protectionKey,
+        displayName: options.displayName,
+        ruleKey: options.ruleKey,
+        principalExpression: options.principalExpression,
+        valueExpression: options.valueExpression,
+        dryRun: options.dryRun === true,
+        force: options.force === true,
+        verbose: options.verbose === true,
+        disabled: options.disabled === true
+      },
+      logger
+    );
+    assertExitOk(code, 'Protection create');
+    if (!options.dryRun) {
+      touchWorkspaceMeta(ctx, { lastOperation: 'protection:create' });
+    }
+    return {
+      datasourceKey,
+      created: options.dryRun !== true,
+      dryRun: options.dryRun === true
+    };
+  });
+}
+
+module.exports = {
+  runProtectionUpload,
+  runProtectionCreate,
+  programmaticLogger
+};

package/lib/programmatic/run-repository-emcp.js

@@ -9,8 +9,8 @@
 'use strict';
 
 const { runEnterpriseMcpCapability } = require('./run-enterprise-mcp');
-const { invokeEnterpriseMcpCapability } = require('./enterprise-mcp-client');
 const { runWithWorkspaceContext } = require('./workspace-context');
+const { getSystemManifest } = require('./workspace-ops');
 
 /**
  * @param {import('./workspace-context').WorkspaceContext} ctx
@@ -33,8 +33,16 @@ async function runRepositoryCreateReview(ctx, body = {}) {
  */
 async function getRepositoryStatus(ctx) {
   return runWithWorkspaceContext(ctx, async() => {
-    const result = await invokeEnterpriseMcpCapability(ctx, 'repository.status', {});
-    return { capabilityKey: 'repository.status', result };
+    // Local-first status: COM currently composes enterprise-repository from
+    // builder-api-repository, so EMCP → this route deadlocks.
+    // Mutating repository.* still go through EMCP (sync/review/dispatch).
+    const local = getSystemManifest(ctx);
+    return {
+      capabilityKey: 'repository.status',
+      source: 'local',
+      local,
+      synced: Boolean(local && local.systemKey)
+    };
   });
 }
 

package/lib/programmatic/run-template-workspace.js

@@ -12,13 +12,27 @@ const { runEnterpriseMcpCapability } = require('./run-enterprise-mcp');
 const { getSystemManifest } = require('./workspace-ops');
 const { invokeEnterpriseMcpCapability } = require('./enterprise-mcp-client');
 const { runWithWorkspaceContext } = require('./workspace-context');
+const { touchWorkspaceMeta } = require('./workspace-meta');
 
 /**
  * @param {import('./workspace-context').WorkspaceContext} ctx
  * @param {Object} body
  */
 async function materializeTemplate(ctx, body = {}) {
-  return runEnterpriseMcpCapability(ctx, 'template.materializeWorkspace', body);
+  return runWithWorkspaceContext(ctx, async() => {
+    // Local-first: COM currently maps template.materializeWorkspace → template.runwizard
+    // which re-enters builder-api wizard and can 409 (workspace lock) under E2E.
+    const local = getSystemManifest(ctx);
+    if (local && local.systemKey) {
+      return {
+        capabilityKey: 'template.materializeWorkspace',
+        source: 'local',
+        materialized: true,
+        local
+      };
+    }
+    return runEnterpriseMcpCapability(ctx, 'template.materializeWorkspace', body);
+  });
 }
 
 /**
@@ -38,11 +52,37 @@ async function getWorkspaceStatus(ctx) {
 }
 
 /**
+ * Diff local draft vs remote/template baseline.
+ * Local-first when Enterprise MCP workspace DS is not published
+ * (default ENTERPRISE_MCP_SYSTEM_KEY=enterprise-integration-lifecycle has no workspace DS).
+ *
  * @param {import('./workspace-context').WorkspaceContext} ctx
  * @param {Object} body
  */
 async function runWorkspaceDiff(ctx, body = {}) {
-  return runEnterpriseMcpCapability(ctx, 'workspace.diff', body);
+  return runWithWorkspaceContext(ctx, async() => {
+    const local = getSystemManifest(ctx);
+    try {
+      const result = await invokeEnterpriseMcpCapability(ctx, 'workspace.diff', body);
+      touchWorkspaceMeta(ctx, { lastOperation: 'workspace.diff' });
+      return {
+        capabilityKey: 'workspace.diff',
+        source: 'enterprise-mcp',
+        result,
+        local
+      };
+    } catch (err) {
+      touchWorkspaceMeta(ctx, { lastOperation: 'workspace.diff' });
+      return {
+        capabilityKey: 'workspace.diff',
+        source: 'local',
+        local,
+        remote: { unavailable: true, message: err.message },
+        note:
+          'Enterprise MCP workspace.diff unavailable; returning local draft snapshot only'
+      };
+    }
+  });
 }
 
 /**

package/lib/programmatic/workspace-context.js

@@ -123,6 +123,12 @@ function runWithWorkspaceContext(ctx, fn) {
         return alt;
       }
       return ctx.getIntegrationPath();
+    },
+    /** Workspace-scoped protection manifests: integration/.protection next to system folders. */
+    getProtectionRoot: () => {
+      const root = path.join(ctx.getIntegrationRoot(), '.protection');
+      assertPathContained(root, ctx.workspaceRoot);
+      return root;
     }
   };
   return runWithIntegrationPathScope(scope, fn);

package/lib/protection/auth-context.js

@@ -13,11 +13,38 @@ const { getDeploymentAuthMode } = require('../utils/deployment-auth-mode');
 const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
 
 /**
- * @param {Object} [options]
- * @param {string} [options.env]
+ * Prefer caller-injected Bearer + dataplane URL (builder-api programmatic path).
+ * @param {Object} options
+ * @returns {Promise<{ environment: string, controllerUrl: string, dataplaneUrl: string, authConfig: Object }|null>}
+ */
+async function tryResolveInjectedProtectionContext(options) {
+  if (!(options.authConfig && options.authConfig.token && options.dataplaneUrl)) {
+    return null;
+  }
+  const environment =
+    options.env || options.environment || (await resolveEnvironment().catch(() => 'dev'));
+  let controllerUrl = options.controllerUrl || '';
+  if (!controllerUrl) {
+    try {
+      controllerUrl = (await resolveControllerUrl()) || '';
+    } catch {
+      controllerUrl = '';
+    }
+  }
+  return {
+    environment,
+    controllerUrl,
+    dataplaneUrl: options.dataplaneUrl,
+    authConfig: options.authConfig
+  };
+}
+
+/**
+ * CLI / device-token resolution when no programmatic inject is present.
+ * @param {Object} options
  * @returns {Promise<{ environment: string, controllerUrl: string, dataplaneUrl: string, authConfig: Object }>}
  */
-async function resolveProtectionDataplaneContext(options = {}) {
+async function resolveCliProtectionDataplaneContext(options) {
   const environment = options.env || (await resolveEnvironment());
   const controllerUrl = await resolveControllerUrl();
   if (!controllerUrl) {
@@ -37,15 +64,30 @@ async function resolveProtectionDataplaneContext(options = {}) {
   }
 
   if (!authConfig?.token) {
-    throw new Error(
-      'Authentication required. Run "aifabrix login" and try again.'
-    );
+    throw new Error('Authentication required. Run "aifabrix login" and try again.');
   }
 
   const dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig);
   return { environment, controllerUrl, dataplaneUrl, authConfig };
 }
 
+/**
+ * @param {Object} [options]
+ * @param {string} [options.env]
+ * @param {string} [options.environment]
+ * @param {string} [options.dataplaneUrl]
+ * @param {Object} [options.authConfig]
+ * @param {string} [options.controllerUrl]
+ * @returns {Promise<{ environment: string, controllerUrl: string, dataplaneUrl: string, authConfig: Object }>}
+ */
+async function resolveProtectionDataplaneContext(options = {}) {
+  const injected = await tryResolveInjectedProtectionContext(options);
+  if (injected) {
+    return injected;
+  }
+  return resolveCliProtectionDataplaneContext(options);
+}
+
 module.exports = {
   resolveProtectionDataplaneContext
 };

package/lib/protection/paths.js

@@ -89,10 +89,32 @@ function protectionRootHasManifestFiles(root) {
   }
 }
 
+/**
+ * Prefer builder-api workspace scope when present (concurrent-safe; no process.env).
+ * @returns {string|null}
+ */
+function getScopedProtectionRoot() {
+  try {
+    const { getIntegrationPathScope } = require('../programmatic/integration-path-scope');
+    const scope = getIntegrationPathScope();
+    if (scope && typeof scope.getProtectionRoot === 'function') {
+      return scope.getProtectionRoot();
+    }
+  } catch {
+    // programmatic module optional for CLI-only usage
+  }
+  return null;
+}
+
 /**
  * @returns {string} Absolute path to protection manifests directory
  */
 function getProtectionRoot() {
+  const scoped = getScopedProtectionRoot();
+  if (scoped) {
+    return scoped;
+  }
+
   const explicit = process.env.AIFABRIX_PROTECTION_ROOT;
   if (explicit && typeof explicit === 'string' && explicit.trim()) {
     return path.resolve(explicit.trim());

package/lib/protection/run-protection-create-helpers.js

@@ -18,9 +18,30 @@ const { assertNoDuplicateDatasourceKeys, listProtectionManifestPaths } = require
 const { loadProtectionManifest } = require('./load');
 
 /**
+ * @param {Object} [options]
+ * @param {string} [options.controllerUrl]
+ * @param {Object} [options.authConfig]
  * @returns {Promise<{ controllerUrl: string, authConfig: Object }>}
  */
-async function resolveControllerAuthForDimensions() {
+async function resolveControllerAuthForDimensions(options = {}) {
+  if (options.authConfig && options.authConfig.token) {
+    let controllerUrl = options.controllerUrl || '';
+    if (!controllerUrl) {
+      try {
+        controllerUrl = (await resolveControllerUrl()) || '';
+      } catch {
+        controllerUrl = '';
+      }
+    }
+    if (!controllerUrl) {
+      throw new Error('Controller URL is required for dimension probe.');
+    }
+    return {
+      controllerUrl: normalizeControllerUrl(controllerUrl),
+      authConfig: options.authConfig
+    };
+  }
+
   const controllerUrl = await resolveControllerUrl();
   if (!controllerUrl) {
     throw new Error('Controller URL is required. Run "aifabrix login" first.');

package/lib/protection/run-protection-create.js

@@ -165,7 +165,7 @@ async function runProtectionCreate(datasourceKey, opts, logger) {
   const verbose = opts.verbose === true;
 
   const dpCtx = await resolveProtectionDataplaneContext(opts);
-  const dimCtx = await resolveControllerAuthForDimensions();
+  const dimCtx = await resolveControllerAuthForDimensions(opts);
 
   logCreateHeader({ environment: dpCtx.environment, type: preset?.type }, dsKey, dimensionKey, logger);
 

package/lib/protection/sync-after-upload.js

@@ -22,7 +22,7 @@ async function syncDatasourceAfterProtectionUpload(dataplaneUrl, authConfig, dat
   }
   try {
     const created = unwrapApiData(
-      await createSyncJob(dataplaneUrl, key, authConfig, {})
+      await createSyncJob(dataplaneUrl, key, authConfig, { syncType: 'bulk' })
     );
     const syncJobId =
       created?.id || created?.syncJobId || created?.data?.id || null;