@aifabrix/builder 2.50.0 → 2.51.1

package/lib/schema/external-datasource.schema.json

@@ -7,12 +7,12 @@
          "key":"external-datasource-schema",
          "name":"External Data Source Configuration Schema",
          "description":"JSON schema for validating ExternalDataSource configuration files",
-     "version":"2.9.2",
+     "version":"2.9.5",
          "type":"schema",
          "category":"integration",
          "author":"AI Fabrix Team",
          "createdAt":"2024-01-01T00:00:00Z",
-         "updatedAt":"2026-06-16T00:00:00Z",
+         "updatedAt":"2026-07-31T00:00:00Z",
          "compatibility":{
             "minVersion":"1.0.0",
             "maxVersion":"3.0.0",
@@ -31,6 +31,30 @@
          "external-system.schema.json"
       ],
       "changelog":[
+         {
+            "version":"2.9.5",
+            "date":"2026-07-31T00:00:00Z",
+            "changes":[
+               "Added optional root accessControl.abac with applicability (required | notApplicable) and optional rationale for governance certification (scenario packs) — distinct from CIP filter.abac.mode."
+            ],
+            "breaking":false
+         },
+         {
+            "version":"2.9.4",
+            "date":"2026-07-18T00:00:00Z",
+            "changes":[
+               "Removed root statusMaps (superseded by dimensions.*.map {dimensionValue, rawValue} only — 346 §7.1)."
+            ],
+            "breaking":true
+         },
+         {
+            "version":"2.9.3",
+            "date":"2026-07-18T00:00:00Z",
+            "changes":[
+               "Added optional dimensionBinding.map array of {dimensionValue, rawValue} for static Dimension raw→enterprise translation on normalize (346 §7.1)."
+            ],
+            "breaking":false
+         },
          {
             "version":"2.9.2",
             "date":"2026-07-02T00:00:00Z",
@@ -70,7 +94,7 @@
             "version":"2.8.1",
             "date":"2026-06-15T00:00:00Z",
             "changes":[
-               "Added composition.datasources for composed enterprise and Digital Worker datasources (438.6).",
+               "Added composition.datasources for composed enterprise and Role Assistant datasources (438.6).",
                "Added optional subscriptionFilter (roleKeys, includeSystemKinds, excludeSystemKinds, resourceTypes, systemKeys, datasourceKeys) on datasource manifests."
             ],
             "breaking":false
@@ -387,6 +411,32 @@
          "minimum":1,
          "description":"Optional sort order of this datasource within its external system (1 = first) for agent and integrator workflows when multiple record-storage datasources exist. Does not control CIP step execution order. Published to OpenAPI governance / optional runtime meta.business.businessOrder when epic 404.2 is enabled. foreignKeys alone do not define this order."
       },
+      "accessControl":{
+         "type":"object",
+         "additionalProperties":false,
+         "description":"Datasource-level access-control declarations for certification and product surfaces. Distinct from CIP filter.abac.mode (runtime filter step).",
+         "properties":{
+            "abac":{
+               "type":"object",
+               "additionalProperties":false,
+               "description":"Whether record-scoped ABAC governance scenario packs apply to this datasource.",
+               "required":["applicability"],
+               "properties":{
+                  "applicability":{
+                     "type":"string",
+                     "enum":["required","notApplicable"],
+                     "description":"required (default when accessControl.abac omitted): verify-governance / scenario packs expected. notApplicable: governance pillar is NOT_APPLICABLE for this datasource; packs and subject emails not required."
+                  },
+                  "rationale":{
+                     "type":"string",
+                     "minLength":1,
+                     "maxLength":500,
+                     "description":"Human-readable reason shown in Overview Governance Validation and CLI when applicability is notApplicable. Recommended when notApplicable."
+                  }
+               }
+            }
+         }
+      },
       "composition":{
          "type":"object",
          "description":"Declares upstream datasources merged into this composed datasource. Generator owns merged metadata, exposedSchema, capabilities, and REST/MCP contract.",
@@ -407,7 +457,7 @@
       },
       "subscriptionFilter":{
          "$ref":"aifabrix://schema/external-system.schema.json#/$defs/subscriptionFilter",
-         "description":"Optional role and systemKind filters for Digital Worker generation inputs on datasource manifests."
+         "description":"Optional role and systemKind filters for Role Assistant generation inputs on datasource manifests."
       },
       "agentExposure":{
          "type":"object",
@@ -1514,6 +1564,10 @@
                "type":"boolean",
                "description":"Filterability hint for metadata-driven query planning."
             },
+            "observer":{
+               "type":"boolean",
+               "description":"When true, a committed change to this normalized first-level scalar field is eligible for Enterprise Runtime observation wake-up."
+            },
             "nullable":{
                "type":"boolean"
             },
@@ -1694,6 +1748,45 @@
                   }
                }
             },
+            {
+               "if":{
+                  "properties":{
+                     "observer":{
+                        "const":true
+                     }
+                  },
+                  "required":[
+                     "observer"
+                  ]
+               },
+               "then":{
+                  "properties":{
+                     "type":{
+                        "type":"string",
+                        "enum":[
+                           "string",
+                           "number",
+                           "integer",
+                           "boolean"
+                        ]
+                     }
+                  },
+                  "not":{
+                     "anyOf":[
+                        {
+                           "required":[
+                              "properties"
+                           ]
+                        },
+                        {
+                           "required":[
+                              "items"
+                           ]
+                        }
+                     ]
+                  }
+               }
+            },
             {
                "if":{
                   "required":[
@@ -1845,6 +1938,30 @@
                "type":"boolean",
                "default":true,
                "description":"When false, this dimension binding is not used for protection/RSS dimension enforcement or governance visibility checks. Catalog binding and metadata materialization may still apply. Use object form to disable; string shorthand bindings are always enforcement-enabled."
+            },
+            "map":{
+               "type":"array",
+               "description":"Optional raw→enterprise value map for static Dimensions. Each entry has only dimensionValue and rawValue. Datasource and field are implied by this binding. CIP normalize persists dimensionValue for ABAC/MCP.",
+               "items":{
+                  "type":"object",
+                  "additionalProperties":false,
+                  "required":[
+                     "dimensionValue",
+                     "rawValue"
+                  ],
+                  "properties":{
+                     "dimensionValue":{
+                        "type":"string",
+                        "minLength":1,
+                        "description":"Enterprise Dimension catalog value."
+                     },
+                     "rawValue":{
+                        "type":"string",
+                        "minLength":1,
+                        "description":"Connected-system token for this binding's field."
+                     }
+                  }
+               }
             }
          },
          "oneOf":[

package/lib/schema/external-system.schema.json

@@ -7,12 +7,12 @@
       "key": "external-system-schema",
       "name": "External System Configuration Schema",
       "description": "JSON schema for validating ExternalSystem configuration files",
-      "version": "1.13.0",
+      "version": "1.13.1",
       "type": "schema",
       "category": "integration",
       "author": "AI Fabrix Team",
       "createdAt": "2024-01-01T00:00:00Z",
-      "updatedAt": "2026-06-15T00:00:00Z",
+      "updatedAt": "2026-07-22T00:00:00Z",
       "compatibility": {
          "minVersion": "1.4.0",
          "maxVersion": "2.0.0",
@@ -27,6 +27,14 @@
       ],
       "dependencies": [],
       "changelog": [
+         {
+            "version": "1.13.1",
+            "date": "2026-07-22T00:00:00Z",
+            "changes": [
+               "Added optional configuration[].category for portal UI grouping labels (parity with application-schema)."
+            ],
+            "breaking": false
+         },
          {
             "version": "1.13.0",
             "date": "2026-07-02T00:00:00Z",
@@ -64,7 +72,7 @@
             "date": "2026-06-15T00:00:00Z",
             "changes": [
                "Added systemKind digitalWorker to x-systemKindCatalog (enterpriseContext group).",
-               "Extended subscriptionFilter with roleKeys, includeSystemKinds, and excludeSystemKinds for Digital Worker generation inputs."
+               "Extended subscriptionFilter with roleKeys, includeSystemKinds, and excludeSystemKinds for Role Assistant generation inputs."
             ],
             "breaking": false
          },
@@ -176,7 +184,7 @@
    "$defs": {
       "subscriptionFilter": {
          "type": "object",
-         "description": "Shared filter engine shape for subscription triggers and Digital Worker generation inputs.",
+         "description": "Shared filter engine shape for subscription triggers and Role Assistant generation inputs.",
          "properties": {
             "resourceTypes": {
                "type": "array",
@@ -209,7 +217,7 @@
                   "minLength": 1
                },
                "minItems": 1,
-               "description": "Role keys that scope Digital Worker or subscription generation."
+               "description": "Role keys that scope Role Assistant or subscription generation."
             },
             "includeSystemKinds": {
                "type": "array",
@@ -970,7 +978,7 @@
          },
          {
             "key": "digitalWorker",
-            "displayName": "Digital Worker",
+            "displayName": "Role Assistant",
             "group": "enterpriseContext"
          },
          {
@@ -1163,6 +1171,12 @@
                "required": {
                   "type": "boolean"
                },
+               "category": {
+                  "type": "string",
+                  "description": "Optional UI grouping label for portal/deployment wizard Configuration tab",
+                  "minLength": 1,
+                  "maxLength": 100
+               },
                "portalInput": {
                   "type": "object",
                   "required": [

package/lib/schema/infra.parameter.yaml

@@ -204,6 +204,19 @@ parameters:
       notes: >-
         JWT signing secret; generated on first ensure. Azure Bicep typically uses `${prefix}-secrets-jwtKeyVault`.
 
+  # LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault — local default skips Mori/JWT license checks.
+  # Controller ignores DEVELOPMENT when DEPLOYMENT=azure.
+  - key: miso-controller-jwt-licenseKeyVault
+    scope: app
+    generator:
+      type: literal
+      value: 'DEVELOPMENT'
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      notes: >-
+        Local/dev default DEVELOPMENT disables license validation (no Mori/JWT required).
+        Ignored when DEPLOYMENT=azure. Override with a real offline license JWT (or empty for Mori) in non-dev.
+
   # Exact entry so this is not caught by *KeyVault → randomBytes32 (invalid email).
   - key: miso-controller-admin-emailKeyVault
     scope: app
@@ -327,7 +340,38 @@ parameters:
       vaultSecretName: dataplane-client-secretKeyVault
       notes: Per-app OAuth client secret for dataplane; generated on first ensure.
 
-  # Mori / telemetry: optional locally (LICENSE_JWT=DEVELOPMENT skips Mori); empty until integrated.
+  - key: mori-controller-client-idKeyVault
+    scope: app
+    generator:
+      type: literal
+      value: 'miso-controller-dev-mori-controller'
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      notes: >-
+        Per-app OAuth client id from controller registration; literal default matches
+        {controllerId}-{environmentKey}-{applicationKey} (override per environment).
+
+  - key: mori-controller-client-secretKeyVault
+    scope: app
+    generator:
+      type: randomBytes32
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      vaultSecretName: mori-controller-client-secretKeyVault
+      notes: Per-app OAuth client secret for mori-controller; generated on first ensure.
+
+  # Mori / telemetry: optional locally (LICENSE_JWT via miso-controller-jwt-licenseKeyVault=DEVELOPMENT skips Mori).
+  # MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault — local default apiKey.
+  - key: mori-controller-auth-methodKeyVault
+    scope: infra
+    generator:
+      type: literal
+      value: 'apiKey'
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      notes: >-
+        Local/dev default apiKey. Override when using Mori basic auth or other methods.
+
   - key: mori-controller-api-keyKeyVault
     scope: infra
     generator:

package/lib/schema/role-assistant-settings.schema.json

@@ -0,0 +1,108 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "aifabrix://schema/role-assistant-settings",
+  "title": "Role Assistant Settings",
+  "description": "Schema for role-assistant.yaml used by digitalWorker packages.",
+  "type": "object",
+  "required": [
+    "apiVersion",
+    "version",
+    "kind",
+    "roleKey"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "apiVersion": {
+      "type": "string",
+      "const": "aifabrix.ai/v1"
+    },
+    "version": {
+      "type": "string",
+      "pattern": "^\\d+\\.\\d+\\.\\d+$"
+    },
+    "kind": {
+      "type": "string",
+      "const": "RoleAssistantSettings"
+    },
+    "roleKey": {
+      "type": "string",
+      "pattern": "^[a-z0-9-_]+$"
+    },
+    "dev": {
+      "$ref": "#/$defs/environmentSettings"
+    },
+    "tst": {
+      "$ref": "#/$defs/environmentSettings"
+    },
+    "pro": {
+      "$ref": "#/$defs/environmentSettings"
+    }
+  },
+  "$defs": {
+    "environmentSettings": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "runtime": {
+          "$ref": "#/$defs/runtime"
+        },
+        "debug": {
+          "$ref": "#/$defs/debug"
+        },
+        "knowledge": {
+          "$ref": "#/$defs/knowledge"
+        }
+      }
+    },
+    "runtime": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "provider": {
+          "type": "string"
+        },
+        "model": {
+          "type": "string"
+        },
+        "temperature": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 2
+        },
+        "maxLoops": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 1000
+        }
+      }
+    },
+    "debug": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": {
+          "type": "boolean"
+        },
+        "includeRuntimeLog": {
+          "type": "boolean"
+        },
+        "includePromptTrace": {
+          "type": "boolean"
+        },
+        "includeCapabilityTrace": {
+          "type": "boolean"
+        }
+      }
+    },
+    "knowledge": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "documentStorageKey": {
+          "type": "string",
+          "pattern": "^[a-z0-9-_]+$"
+        }
+      }
+    }
+  }
+}

package/lib/schema/type/credential-field-registry.json

@@ -1,5 +1,5 @@
 {
-  "version": 6,
+  "version": 8,
   "semantics": {
     "visibility.show": "When false, the field name is omitted from default portal field lists, embedded credential form field lists, and from public API credentialConfig read models (GET/list with decrypt=false), in addition to any omission driven by encrypted. GET with decrypt=true returns the full decrypted config for authorized callers and does not apply this visibility filter.",
     "visibility.showValue": "UI-only: whether stored values may be shown versus placeholders in form flows that honor this flag. Does not control encryption at rest or public API stripping.",
@@ -114,10 +114,12 @@
           "display": {
             "label": "Tenant ID",
             "control": "text",
-            "enabled": true
+            "enabled": true,
+            "placeholder": "Azure AD directory (tenant) ID",
+            "description": "Used for Microsoft identity platforms. May also appear in tokenUrl as {{tenantId}}."
           },
           "visibility": {
-            "show": false,
+            "show": true,
             "showValue": true
           },
           "encrypted": false
@@ -149,6 +151,20 @@
             "showValue": false
           },
           "encrypted": true
+        },
+        {
+          "name": "accessTokenExpiresAt",
+          "required": false,
+          "display": {
+            "label": "Access Token Expires At",
+            "control": "text",
+            "enabled": false
+          },
+          "visibility": {
+            "show": false,
+            "showValue": false
+          },
+          "encrypted": false
         }
       ]
     },

package/lib/utils/api.js

@@ -381,12 +381,11 @@ function extractControllerUrl(url) {
     return match ? match[1] : url;
   }
 }
-
 /**
- * Set auth header on headers object: Bearer for user token, x-client-token for application token.
+ * Set auth header on headers object: Bearer for user token, x-client-token for app token.
  * @param {Object} headers - Headers object to mutate
  * @param {string} token - Token value
- * @param {string} authType - 'bearer' or 'client-token'
+ * @param {string} authType - 'bearer' | 'client-token'
  */
 function setAuthHeader(headers, token, authType) {
   if (!token) return;
@@ -396,7 +395,6 @@ function setAuthHeader(headers, token, authType) {
     headers['Authorization'] = `Bearer ${token}`;
   }
 }
-
 /**
  * Make an authenticated API call with user token (Bearer) or application token (x-client-token).
  * Automatically refreshes device token on 401 when user Bearer was used.
@@ -408,7 +406,48 @@ function setAuthHeader(headers, token, authType) {
  * @param {string} [tokenOrAuthConfig.controller] - Controller URL for token refresh (if object)
  * @returns {Promise<Object>} Response object
  */
-// eslint-disable-next-line max-statements
+/**
+ * Retry once after device-token refresh on 401 (Bearer only; never for client-token/preserveBearer).
+ * @param {Object} response
+ * @param {string} url
+ * @param {Object} options
+ * @param {Object} headers
+ * @param {string|null} authControllerUrl
+ * @returns {Promise<Object>}
+ */
+async function retryApiCallAfterDeviceTokenRefresh(
+  response,
+  url,
+  options,
+  headers,
+  authControllerUrl
+) {
+  try {
+    const { forceRefreshDeviceToken } = require('./token-manager');
+    const refreshedToken = await forceRefreshDeviceToken(
+      authControllerUrl || extractControllerUrl(url)
+    );
+    if (refreshedToken?.token) {
+      headers.Authorization = `Bearer ${refreshedToken.token}`;
+      return await makeApiCall(url, { ...options, headers });
+    }
+    const authError =
+      'Authentication failed: Token expired and refresh failed. Please login again using: aifabrix login';
+    return { ...response, error: authError, formattedError: authError };
+  } catch (refreshError) {
+    const authError = `Authentication failed: ${refreshError.message || String(refreshError)}. Please login again using: aifabrix login`;
+    return { ...response, error: authError, formattedError: authError };
+  }
+}
+function shouldRefreshBearerOn401(response, authType, tokenOrAuthConfig) {
+  return (
+    !response.success &&
+    response.status === 401 &&
+    authType !== 'client-token' &&
+    !(typeof tokenOrAuthConfig === 'object' && tokenOrAuthConfig?.preserveBearer)
+  );
+}
+
 async function authenticatedApiCall(url, options = {}, tokenOrAuthConfig) {
   const isStringToken = typeof tokenOrAuthConfig === 'string';
   const token = isStringToken ? tokenOrAuthConfig : tokenOrAuthConfig?.token;
@@ -426,26 +465,18 @@ async function authenticatedApiCall(url, options = {}, tokenOrAuthConfig) {
     headers
   });
 
-  // Only attempt device token refresh on 401 when user Bearer token was used (not for client-token)
-  if (!response.success && response.status === 401 && authType !== 'client-token') {
-    try {
-      const { forceRefreshDeviceToken } = require('./token-manager');
-      const refreshedToken = await forceRefreshDeviceToken(authControllerUrl || extractControllerUrl(url));
-      if (refreshedToken?.token) {
-        headers['Authorization'] = `Bearer ${refreshedToken.token}`;
-        return await makeApiCall(url, { ...options, headers });
-      }
-      const authError = 'Authentication failed: Token expired and refresh failed. Please login again using: aifabrix login';
-      return { ...response, error: authError, formattedError: authError };
-    } catch (refreshError) {
-      const authError = `Authentication failed: ${refreshError.message || String(refreshError)}. Please login again using: aifabrix login`;
-      return { ...response, error: authError, formattedError: authError };
-    }
+  if (shouldRefreshBearerOn401(response, authType, tokenOrAuthConfig)) {
+    return retryApiCallAfterDeviceTokenRefresh(
+      response,
+      url,
+      options,
+      headers,
+      authControllerUrl
+    );
   }
 
   return response;
 }
-
 const {
   initiateDeviceCodeFlow,
   pollDeviceCodeToken,