@aifabrix/builder 2.50.0 → 2.51.1

package/lib/utils/app-path-resolve.js

@@ -15,6 +15,11 @@ const {
   SYSTEM_KIND_ENTERPRISE_KNOWLEDGE,
   getEnterpriseKnowledgePath
 } = require('./enterprise-knowledge-paths');
+const {
+  WORKSPACE_ROLE_ASSISTANT,
+  SYSTEM_KIND_DIGITAL_WORKER,
+  getRoleAssistantPath
+} = require('./role-assistant-paths');
 
 const WORKSPACE_INTEGRATION = 'integration';
 
@@ -62,10 +67,14 @@ function normalizeWorkspaceOverride(raw) {
     return null;
   }
   const v = String(raw).trim().toLowerCase();
-  if (v === WORKSPACE_INTEGRATION || v === WORKSPACE_ENTERPRISE_KNOWLEDGE) {
+  if (
+    v === WORKSPACE_INTEGRATION ||
+    v === WORKSPACE_ENTERPRISE_KNOWLEDGE ||
+    v === WORKSPACE_ROLE_ASSISTANT
+  ) {
     return v;
   }
-  throw new Error(`Unknown workspace "${raw}". Use integration or enterprise-knowledge.`);
+  throw new Error(`Unknown workspace "${raw}". Use integration, enterprise-knowledge, or role-assistant.`);
 }
 
 function workspacePair(appPath, baseDir) {
@@ -76,47 +85,84 @@ function resolveFromWorkspaceOverride(workspaceOverride, appName, getIntegration
   if (workspaceOverride === WORKSPACE_ENTERPRISE_KNOWLEDGE) {
     return workspacePair(getEnterpriseKnowledgePath(appName), WORKSPACE_ENTERPRISE_KNOWLEDGE);
   }
+  if (workspaceOverride === WORKSPACE_ROLE_ASSISTANT) {
+    return workspacePair(getRoleAssistantPath(appName), WORKSPACE_ROLE_ASSISTANT);
+  }
   if (workspaceOverride === WORKSPACE_INTEGRATION) {
     return workspacePair(getIntegrationPath(appName), WORKSPACE_INTEGRATION);
   }
   return null;
 }
 
-function resolveAmbiguousWorkspace(ekPath, intPath, explicitKind, appName) {
-  const kind =
-    explicitKind ||
-    readSystemKindFromAppDir(ekPath, appName) ||
-    readSystemKindFromAppDir(intPath, appName);
+function resolveWorkspaceFromSystemKind(kind, ekPath, intPath, roleAssistantPath) {
   if (kind === SYSTEM_KIND_ENTERPRISE_KNOWLEDGE) {
     return workspacePair(ekPath, WORKSPACE_ENTERPRISE_KNOWLEDGE);
   }
+  if (kind === SYSTEM_KIND_DIGITAL_WORKER) {
+    return workspacePair(roleAssistantPath, WORKSPACE_ROLE_ASSISTANT);
+  }
   return workspacePair(intPath, WORKSPACE_INTEGRATION);
 }
 
-function resolveFromExistingPaths(ekPath, intPath, ekExists, intExists, explicitKind, appName) {
-  if (ekExists && !intExists) {
-    return workspacePair(ekPath, WORKSPACE_ENTERPRISE_KNOWLEDGE);
-  }
-  if (intExists && !ekExists) {
+function resolveAmbiguousWorkspace(ekPath, intPath, roleAssistantPath, explicitKind, appName) {
+  const kind =
+    explicitKind ||
+    readSystemKindFromAppDir(roleAssistantPath, appName) ||
+    readSystemKindFromAppDir(ekPath, appName) ||
+    readSystemKindFromAppDir(intPath, appName);
+  return resolveWorkspaceFromSystemKind(kind, ekPath, intPath, roleAssistantPath);
+}
+
+function resolveFromExistingPaths(paths, existence, explicitKind, appName) {
+  const { ekPath, intPath, roleAssistantPath } = paths;
+  const { ekExists, intExists, roleAssistantExists } = existence;
+  const existingCount = [ekExists, intExists, roleAssistantExists].filter(Boolean).length;
+  if (existingCount === 1) {
+    if (ekExists) {
+      return workspacePair(ekPath, WORKSPACE_ENTERPRISE_KNOWLEDGE);
+    }
+    if (roleAssistantExists) {
+      return workspacePair(roleAssistantPath, WORKSPACE_ROLE_ASSISTANT);
+    }
     return workspacePair(intPath, WORKSPACE_INTEGRATION);
   }
-  if (ekExists && intExists) {
-    return resolveAmbiguousWorkspace(ekPath, intPath, explicitKind, appName);
+  if (existingCount > 1) {
+    return resolveAmbiguousWorkspace(ekPath, intPath, roleAssistantPath, explicitKind, appName);
   }
-  const kind = explicitKind || readSystemKindFromAppDir(intPath, appName);
-  if (kind === SYSTEM_KIND_ENTERPRISE_KNOWLEDGE) {
-    return workspacePair(ekPath, WORKSPACE_ENTERPRISE_KNOWLEDGE);
-  }
-  return workspacePair(intPath, WORKSPACE_INTEGRATION);
+  const kind =
+    explicitKind ||
+    readSystemKindFromAppDir(roleAssistantPath, appName) ||
+    readSystemKindFromAppDir(ekPath, appName) ||
+    readSystemKindFromAppDir(intPath, appName);
+  return resolveWorkspaceFromSystemKind(kind, ekPath, intPath, roleAssistantPath);
+}
+
+function resolveFromExistingPathsBackwardCompatible(
+  ekPath,
+  intPath,
+  roleAssistantPath,
+  explicitKind,
+  appName
+) {
+  return resolveFromExistingPaths(
+    { ekPath, intPath, roleAssistantPath },
+    {
+      ekExists: isExistingDirectory(ekPath),
+      intExists: isExistingDirectory(intPath),
+      roleAssistantExists: isExistingDirectory(roleAssistantPath)
+    },
+    explicitKind,
+    appName
+  );
 }
 
 /**
  * Resolves authoring tree for an external system or Enterprise Knowledge anchor.
  * @param {string} appName - App or anchor key
  * @param {Object} [options]
- * @param {string} [options.workspace] - integration | enterprise-knowledge
+ * @param {string} [options.workspace] - integration | enterprise-knowledge | role-assistant
  * @param {string} [options.systemKind] - Explicit systemKind override
- * @returns {{ appPath: string, baseDir: 'integration' | 'enterprise-knowledge' }}
+ * @returns {{ appPath: string, baseDir: 'integration' | 'enterprise-knowledge' | 'role-assistant' }}
  */
 function resolveAppWorkspace(appName, options = {}) {
   if (!appName || typeof appName !== 'string') {
@@ -137,11 +183,11 @@ function resolveAppWorkspace(appName, options = {}) {
 
   const ekPath = getEnterpriseKnowledgePath(appName);
   const intPath = getIntegrationPath(appName);
-  return resolveFromExistingPaths(
+  const roleAssistantPath = getRoleAssistantPath(appName);
+  return resolveFromExistingPathsBackwardCompatible(
     ekPath,
     intPath,
-    isExistingDirectory(ekPath),
-    isExistingDirectory(intPath),
+    roleAssistantPath,
     explicitKind,
     appName
   );
@@ -160,7 +206,9 @@ function resolveExternalSystemPath(appName, options = {}) {
 module.exports = {
   WORKSPACE_INTEGRATION,
   WORKSPACE_ENTERPRISE_KNOWLEDGE,
+  WORKSPACE_ROLE_ASSISTANT,
   SYSTEM_KIND_ENTERPRISE_KNOWLEDGE,
+  SYSTEM_KIND_DIGITAL_WORKER,
   readSystemKindFromAppDir,
   normalizeWorkspaceOverride,
   resolveAppWorkspace,

package/lib/utils/app-register-config.js

@@ -228,11 +228,11 @@ async function extractExternalAppConfiguration(appKey, variables, appKeyFromFile
  * @returns {Object} Webapp configuration
  */
 function extractWebappConfiguration(variables, appKeyFromFile, displayName, description, options) {
-  const appType = variables.build?.language === 'typescript' ? 'webapp' : 'service';
+  const appType = variables.app?.type || 'webapp';
   const registryMode = variables.image?.registryMode || 'external';
   const port = options.port ?? getContainerPort(variables);
   const localPort = port;
-  const language = variables.build?.language || 'typescript';
+  const language = variables.build?.language || variables.app?.language || 'typescript';
   const image = buildImageReference(variables, appKeyFromFile);
   const url = variables.app?.url || variables.deployment?.dataplaneUrl || variables.deployment?.appUrl || null;
 
@@ -252,7 +252,8 @@ function extractWebappConfiguration(variables, appKeyFromFile, displayName, desc
 
 async function extractAppConfiguration(variables, appKey, options) {
   const appKeyFromFile = variables.app?.key || appKey;
-  const displayName = variables.app?.name || options.name || appKey;
+  const displayName =
+    variables.app?.displayName || variables.app?.name || options.name || appKey;
   const description = variables.app?.description || '';
 
   if (variables.app?.type === 'external') {

package/lib/utils/authentication-shape.js

@@ -64,7 +64,9 @@ function buildFlatCredentialTemplate(systemKey, authType) {
       security: { clientId: kvPath('clientId'), clientSecret: kvPath('clientSecret') }
     },
     apikey: {
-      variables: { baseUrl: base, headerName: 'X-API-Key' },
+      // Match credential-field-registry placeholders (Authorization + Bearer).
+      // Integrations that need a literal custom header set headerName after repair.
+      variables: { baseUrl: base, headerName: 'Authorization', prefix: 'Bearer' },
       security: { apiKey: kvPath('apiKey') }
     },
     bearerToken: {

package/lib/utils/cli-sync-options.js

@@ -6,9 +6,60 @@
 
 'use strict';
 
+/**
+ * True when `node` looks like a Commander command (or a test double), not a plain opts bag.
+ *
+ * @param {*} node
+ * @returns {boolean}
+ */
+function isCommanderLike(node) {
+  if (!node || typeof node !== 'object') {
+    return false;
+  }
+  return (
+    Array.isArray(node.rawArgs) ||
+    typeof node.opts === 'function' ||
+    (Object.prototype.hasOwnProperty.call(node, 'parent') &&
+      (node.parent === null ||
+        node.parent === undefined ||
+        typeof node.parent === 'object'))
+  );
+}
+
+/**
+ * Collect argv-like arrays from a Commander command and its parents.
+ * Subcommand `rawArgs` is often empty; the flag lives on the root command.
+ * Safely no-ops for null/undefined or plain options objects (not Command-like).
+ *
+ * @param {import('commander').Command|null|undefined} cmd
+ * @returns {string[]}
+ */
+function collectCommanderRawArgs(cmd) {
+  if (!isCommanderLike(cmd)) {
+    return [];
+  }
+  const chunks = [];
+  const seen = new Set();
+  let current = cmd;
+  while (isCommanderLike(current)) {
+    if (seen.has(current)) {
+      break;
+    }
+    seen.add(current);
+    if (Array.isArray(current.rawArgs) && current.rawArgs.length > 0) {
+      chunks.push(...current.rawArgs);
+    }
+    current = current.parent;
+  }
+  return chunks;
+}
+
 /**
  * True when the user passed `--no-publish` or set `noPublish: true` (programmatic).
  *
+ * Commander maps `.option('--no-publish', …)` to `publish: false` (default `true`),
+ * not `noPublish: true`. Detect that shape as well as programmatic `noPublish`.
+ *
  * @param {Object|null|undefined} options - Commander-parsed options
  * @param {import('commander').Command} [cmd] - Commander command (for rawArgs fallback)
  * @returns {boolean}
@@ -20,10 +71,15 @@ function cliOptsSkipPublish(options, cmd) {
   if (options.noPublish === true) {
     return true;
   }
-  const raw = cmd && Array.isArray(cmd.rawArgs) ? cmd.rawArgs : [];
-  return raw.includes('--no-publish');
+  // Commander `--no-X` → property `X` defaults true; flag sets it false
+  if (options.publish === false) {
+    return true;
+  }
+  return collectCommanderRawArgs(cmd).includes('--no-publish');
 }
 
 module.exports = {
-  cliOptsSkipPublish
+  cliOptsSkipPublish,
+  collectCommanderRawArgs,
+  isCommanderLike
 };

package/lib/utils/cli-utils.js

@@ -219,9 +219,14 @@ function formatAzureError(errorMsg) {
   if (errorMsg.includes('Docker build failed') || errorMsg.includes('Build failed: Docker')) {
     return null;
   }
-  // Only match ACR-specific authentication errors, not general authentication failures
-  if (errorMsg.includes('ACR') || errorMsg.includes('azurecr.io') ||
-      (errorMsg.includes('authenticate') && (errorMsg.includes('registry') || errorMsg.includes('container')))) {
+  const lowerMsg = String(errorMsg || '').toLowerCase();
+  const hasAcrDomain = /\b[a-z0-9.-]+\.azurecr\.io\b/i.test(errorMsg);
+  const hasAcrKeyword = /\bacr\b/.test(lowerMsg);
+  const hasAuthAndRegistryContext =
+    /\bauthenticate\b/.test(lowerMsg) &&
+    (/\bregistry\b/.test(lowerMsg) || /\bcontainer\b/.test(lowerMsg));
+  // Only match ACR-specific authentication errors, not general authentication failures.
+  if (hasAcrKeyword || hasAcrDomain || hasAuthAndRegistryContext) {
     return [
       '   Azure Container Registry authentication failed.',
       '   Run: az acr login --name <registry-name>',
@@ -414,6 +419,9 @@ function isAuthenticationError(error) {
  * @param {string} command - Command that failed
  */
 function handleCommandError(error, command) {
+  if (error && error.compactGateAbortLogged === true) {
+    return;
+  }
   const errorMessages = formatError(error);
   const skipDoctor = isMissingSecretsErrorMessage(error && error.message);
   logError(command, errorMessages, { skipDoctor });

package/lib/utils/deployment-validation.js

@@ -8,6 +8,27 @@
  * @version 2.0.0
  */
 
+/**
+ * True when URL is http to a Docker Compose service DNS name (single hostname label).
+ * Example: http://miso-controller:3000/miso — used by builder-api in compose, not public HTTP.
+ *
+ * @param {string} url
+ * @returns {boolean}
+ */
+function isDockerComposeServiceHttpUrl(url) {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== 'http:') {
+      return false;
+    }
+    const host = parsed.hostname || '';
+    // Compose DNS: one label, no dots (miso-controller, dataplane, …)
+    return Boolean(host) && !host.includes('.') && host !== 'localhost';
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Validates and sanitizes controller URL
  * Enforces HTTPS-only communication for security
@@ -20,9 +41,13 @@ function validateControllerUrl(url) {
     throw new Error('Controller URL is required and must be a string');
   }
 
-  // Must use HTTPS for security (allow http://localhost for local development)
-  if (!url.startsWith('https://') && !url.startsWith('http://localhost')) {
-    throw new Error('Controller URL must use HTTPS (https://) or http://localhost');
+  // HTTPS required in public networks; allow localhost and compose-service HTTP for local Docker
+  const allowedHttp =
+    url.startsWith('http://localhost') || isDockerComposeServiceHttpUrl(url);
+  if (!url.startsWith('https://') && !allowedHttp) {
+    throw new Error(
+      'Controller URL must use HTTPS (https://), http://localhost, or a Docker Compose service HTTP URL'
+    );
   }
 
   // Basic URL format validation

package/lib/utils/dev-ca-install.js

@@ -1,7 +1,7 @@
 /**
  * Dev CA Install – SSL untrusted detection, fetch CA from Builder Server, install into OS trust store.
- * Used by `aifabrix dev init` when the server certificate is self-signed. Only /install-ca uses
- * rejectUnauthorized: false; all other requests use default TLS verification.
+ * Used by `aifabrix dev init` when the server certificate is self-signed.
+ * Requests keep TLS verification enabled by default.
  *
  * @fileoverview CA install utilities for development Builder Server
  * @author AI Fabrix Team
@@ -163,7 +163,7 @@ function finalizeInstallCaResponse(res, absoluteUrl, chunks, resolve, reject) {
 }
 
 /**
- * GET absolute install-ca URL with insecure TLS; follow redirects (resolve relative Location).
+ * GET absolute install-ca URL with TLS verification enabled; follow redirects.
  * @param {string} absoluteUrl - Full https URL
  * @param {number} redirectCount - Redirect depth
  * @returns {Promise<Buffer>} CA PEM
@@ -179,10 +179,9 @@ function fetchInstallCaAbsolute(absoluteUrl, redirectCount) {
       reject(new Error('install-ca requires https URL'));
       return;
     }
-    const agent = new https.Agent({ rejectUnauthorized: false });
     const req = https.get(
       absoluteUrl,
-      { agent },
+      {},
       (res) => {
         if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
           res.destroy();
@@ -208,7 +207,7 @@ function fetchInstallCaAbsolute(absoluteUrl, redirectCount) {
 
 /**
  * Fetch CA PEM from Builder Server via GET {baseUrl}/install-ca.
- * Uses rejectUnauthorized: false only for this endpoint (dev setup).
+ * Uses default TLS verification for this endpoint.
  * @param {string} baseUrl - Builder Server base URL (no trailing slash)
  * @returns {Promise<Buffer>} CA certificate PEM
  */

package/lib/utils/dev-config.js

@@ -44,8 +44,8 @@ function getDevPorts(developerId) {
     throw new Error('Developer ID must be a positive number');
   }
 
-  // Handle invalids
-  if (developerId === undefined || developerId === null || Number.isNaN(developerId)) {
+  // Handle invalid numeric values
+  if (Number.isNaN(developerId)) {
     throw new Error('Developer ID must be a positive number');
   }
   if (developerId < 0 || !Number.isInteger(developerId)) {

package/lib/utils/dev-list-sort.js

@@ -0,0 +1,145 @@
+/**
+ * @fileoverview Client-side sort for aifabrix dev list (--sort field / -field).
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+const ALLOWED_SORT_FIELDS = Object.freeze(['id', 'name', 'email', 'until']);
+
+/**
+ * @param {unknown} id
+ * @returns {string}
+ */
+function normalizeIdKey(id) {
+  const trimmed = String(id ?? '').trim();
+  if (!/^\d+$/.test(trimmed)) {
+    return trimmed;
+  }
+  return String(parseInt(trimmed, 10)).padStart(2, '0');
+}
+
+/**
+ * @param {unknown} a
+ * @param {unknown} b
+ * @returns {number}
+ */
+function compareIds(a, b) {
+  const sa = String(a ?? '').trim();
+  const sb = String(b ?? '').trim();
+  if (/^\d+$/.test(sa) && /^\d+$/.test(sb)) {
+    return parseInt(sa, 10) - parseInt(sb, 10);
+  }
+  return normalizeIdKey(sa).localeCompare(normalizeIdKey(sb), undefined, { sensitivity: 'base' });
+}
+
+/**
+ * @param {string} a
+ * @param {string} b
+ * @returns {number}
+ */
+function compareText(a, b) {
+  return a.localeCompare(b, undefined, { sensitivity: 'base' });
+}
+
+/**
+ * @param {Object} user
+ * @returns {string}
+ */
+function untilValue(user) {
+  const raw = user && user.certificateValidNotAfter;
+  return typeof raw === 'string' ? raw.trim() : '';
+}
+
+/**
+ * Parse --sort option. Default: name ascending.
+ * @param {string|undefined|null} sortOption
+ * @returns {{ field: string, descending: boolean }}
+ * @throws {Error} When field is empty or not allowed
+ */
+function parseSortSpec(sortOption) {
+  if (sortOption === undefined || sortOption === null) {
+    return { field: 'name', descending: false };
+  }
+  const trimmed = String(sortOption).trim();
+  if (!trimmed) {
+    throw new Error(
+      'Invalid --sort value "". Allowed: id, name, email, until (prefix - for descending).'
+    );
+  }
+  let descending = false;
+  let fieldPart = trimmed;
+  if (fieldPart.startsWith('-')) {
+    descending = true;
+    fieldPart = fieldPart.slice(1).trim();
+  }
+  if (!fieldPart) {
+    throw new Error(
+      'Invalid --sort value "-". Allowed: id, name, email, until (prefix - for descending).'
+    );
+  }
+  const field = fieldPart.toLowerCase();
+  if (!ALLOWED_SORT_FIELDS.includes(field)) {
+    throw new Error(
+      `Invalid --sort value "${trimmed}". Allowed: id, name, email, until (prefix - for descending).`
+    );
+  }
+  return { field, descending };
+}
+
+/**
+ * @param {Object} a
+ * @param {Object} b
+ * @param {string} field
+ * @returns {number}
+ */
+function compareByField(a, b, field) {
+  if (field === 'id') {
+    return compareIds(a.id, b.id);
+  }
+  if (field === 'name') {
+    return compareText(String(a.name || ''), String(b.name || ''));
+  }
+  if (field === 'email') {
+    return compareText(String(a.email || ''), String(b.email || ''));
+  }
+  const ua = untilValue(a);
+  const ub = untilValue(b);
+  if (!ua && !ub) {
+    return 0;
+  }
+  if (!ua) {
+    return 1;
+  }
+  if (!ub) {
+    return -1;
+  }
+  return compareText(ua, ub);
+}
+
+/**
+ * Sort developer users without mutating the input array.
+ * @param {Object[]} users
+ * @param {string|undefined|null} sortOption
+ * @returns {Object[]}
+ */
+function sortDevUsers(users, sortOption) {
+  const { field, descending } = parseSortSpec(sortOption);
+  const list = Array.isArray(users) ? [...users] : [];
+  list.sort((a, b) => {
+    let cmp = compareByField(a, b, field);
+    if (descending) {
+      cmp = -cmp;
+    }
+    if (cmp !== 0) {
+      return cmp;
+    }
+    return compareIds(a.id, b.id);
+  });
+  return list;
+}
+
+module.exports = {
+  ALLOWED_SORT_FIELDS,
+  parseSortSpec,
+  sortDevUsers
+};

package/lib/utils/dev-platform-tls.js

@@ -8,7 +8,6 @@
 
 'use strict';
 
-const https = require('https');
 const config = require('../core/config');
 const { isLocalhostPublicSchemeHostname } = require('./localhost-public-host');
 
@@ -68,65 +67,6 @@ async function shouldAllowInsecureDevPlatformTls(url) {
   }
 }
 
-/**
- * Minimal fetch for self-signed dev platform HTTPS (Node global fetch cannot set rejectUnauthorized).
- *
- * @param {string} url
- * @param {Object} options
- * @returns {Promise<{ status: number, statusText: string, headers: { get: Function }, text: Function, json: Function }>}
- */
-function nodeHttpsFetchInsecure(url, options = {}) {
-  return new Promise((resolve, reject) => {
-    const u = new URL(url);
-    const method = String(options.method || 'GET').toUpperCase();
-    const headers = { ...(options.headers || {}) };
-    const body = options.body;
-    const reqOpts = {
-      hostname: u.hostname,
-      port: u.port || 443,
-      path: `${u.pathname}${u.search}`,
-      method,
-      headers,
-      rejectUnauthorized: false
-    };
-
-    const req = https.request(reqOpts, (res) => {
-      const chunks = [];
-      res.on('data', (chunk) => chunks.push(chunk));
-      res.on('end', () => {
-        const raw = Buffer.concat(chunks).toString('utf8');
-        const status = res.statusCode || 0;
-        resolve({
-          ok: status >= 200 && status < 300,
-          status,
-          statusText: res.statusMessage || '',
-          headers: {
-            get: (name) => res.headers[String(name || '').toLowerCase()] || null
-          },
-          text: async() => raw,
-          json: async() => JSON.parse(raw)
-        });
-      });
-    });
-
-    req.on('error', reject);
-    if (options.signal) {
-      const onAbort = () => {
-        req.destroy(new Error('The operation was aborted'));
-      };
-      if (options.signal.aborted) {
-        onAbort();
-        return;
-      }
-      options.signal.addEventListener('abort', onAbort, { once: true });
-    }
-    if (body !== undefined && body !== null) {
-      req.write(typeof body === 'string' ? body : String(body));
-    }
-    req.end();
-  });
-}
-
 /**
  * @async
  * @param {string} url
@@ -134,9 +74,6 @@ function nodeHttpsFetchInsecure(url, options = {}) {
  * @returns {Promise<Response>}
  */
 async function fetchWithOptionalDevPlatformTls(url, options = {}) {
-  if (await shouldAllowInsecureDevPlatformTls(url)) {
-    return nodeHttpsFetchInsecure(url, options);
-  }
   return fetch(url, options);
 }