@aifabrix/builder 2.51.0 → 2.52.0

package/lib/protection/auth-context.js

@@ -13,11 +13,38 @@ const { getDeploymentAuthMode } = require('../utils/deployment-auth-mode');
 const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
 
 /**
- * @param {Object} [options]
- * @param {string} [options.env]
+ * Prefer caller-injected Bearer + dataplane URL (builder-api programmatic path).
+ * @param {Object} options
+ * @returns {Promise<{ environment: string, controllerUrl: string, dataplaneUrl: string, authConfig: Object }|null>}
+ */
+async function tryResolveInjectedProtectionContext(options) {
+  if (!(options.authConfig && options.authConfig.token && options.dataplaneUrl)) {
+    return null;
+  }
+  const environment =
+    options.env || options.environment || (await resolveEnvironment().catch(() => 'dev'));
+  let controllerUrl = options.controllerUrl || '';
+  if (!controllerUrl) {
+    try {
+      controllerUrl = (await resolveControllerUrl()) || '';
+    } catch {
+      controllerUrl = '';
+    }
+  }
+  return {
+    environment,
+    controllerUrl,
+    dataplaneUrl: options.dataplaneUrl,
+    authConfig: options.authConfig
+  };
+}
+
+/**
+ * CLI / device-token resolution when no programmatic inject is present.
+ * @param {Object} options
  * @returns {Promise<{ environment: string, controllerUrl: string, dataplaneUrl: string, authConfig: Object }>}
  */
-async function resolveProtectionDataplaneContext(options = {}) {
+async function resolveCliProtectionDataplaneContext(options) {
   const environment = options.env || (await resolveEnvironment());
   const controllerUrl = await resolveControllerUrl();
   if (!controllerUrl) {
@@ -37,15 +64,30 @@ async function resolveProtectionDataplaneContext(options = {}) {
   }
 
   if (!authConfig?.token) {
-    throw new Error(
-      'Authentication required. Run "aifabrix login" and try again.'
-    );
+    throw new Error('Authentication required. Run "aifabrix login" and try again.');
   }
 
   const dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig);
   return { environment, controllerUrl, dataplaneUrl, authConfig };
 }
 
+/**
+ * @param {Object} [options]
+ * @param {string} [options.env]
+ * @param {string} [options.environment]
+ * @param {string} [options.dataplaneUrl]
+ * @param {Object} [options.authConfig]
+ * @param {string} [options.controllerUrl]
+ * @returns {Promise<{ environment: string, controllerUrl: string, dataplaneUrl: string, authConfig: Object }>}
+ */
+async function resolveProtectionDataplaneContext(options = {}) {
+  const injected = await tryResolveInjectedProtectionContext(options);
+  if (injected) {
+    return injected;
+  }
+  return resolveCliProtectionDataplaneContext(options);
+}
+
 module.exports = {
   resolveProtectionDataplaneContext
 };

package/lib/protection/paths.js

@@ -89,10 +89,32 @@ function protectionRootHasManifestFiles(root) {
   }
 }
 
+/**
+ * Prefer builder-api workspace scope when present (concurrent-safe; no process.env).
+ * @returns {string|null}
+ */
+function getScopedProtectionRoot() {
+  try {
+    const { getIntegrationPathScope } = require('../programmatic/integration-path-scope');
+    const scope = getIntegrationPathScope();
+    if (scope && typeof scope.getProtectionRoot === 'function') {
+      return scope.getProtectionRoot();
+    }
+  } catch {
+    // programmatic module optional for CLI-only usage
+  }
+  return null;
+}
+
 /**
  * @returns {string} Absolute path to protection manifests directory
  */
 function getProtectionRoot() {
+  const scoped = getScopedProtectionRoot();
+  if (scoped) {
+    return scoped;
+  }
+
   const explicit = process.env.AIFABRIX_PROTECTION_ROOT;
   if (explicit && typeof explicit === 'string' && explicit.trim()) {
     return path.resolve(explicit.trim());

package/lib/protection/run-protection-create-helpers.js

@@ -18,9 +18,30 @@ const { assertNoDuplicateDatasourceKeys, listProtectionManifestPaths } = require
 const { loadProtectionManifest } = require('./load');
 
 /**
+ * @param {Object} [options]
+ * @param {string} [options.controllerUrl]
+ * @param {Object} [options.authConfig]
  * @returns {Promise<{ controllerUrl: string, authConfig: Object }>}
  */
-async function resolveControllerAuthForDimensions() {
+async function resolveControllerAuthForDimensions(options = {}) {
+  if (options.authConfig && options.authConfig.token) {
+    let controllerUrl = options.controllerUrl || '';
+    if (!controllerUrl) {
+      try {
+        controllerUrl = (await resolveControllerUrl()) || '';
+      } catch {
+        controllerUrl = '';
+      }
+    }
+    if (!controllerUrl) {
+      throw new Error('Controller URL is required for dimension probe.');
+    }
+    return {
+      controllerUrl: normalizeControllerUrl(controllerUrl),
+      authConfig: options.authConfig
+    };
+  }
+
   const controllerUrl = await resolveControllerUrl();
   if (!controllerUrl) {
     throw new Error('Controller URL is required. Run "aifabrix login" first.');

package/lib/protection/run-protection-create.js

@@ -165,7 +165,7 @@ async function runProtectionCreate(datasourceKey, opts, logger) {
   const verbose = opts.verbose === true;
 
   const dpCtx = await resolveProtectionDataplaneContext(opts);
-  const dimCtx = await resolveControllerAuthForDimensions();
+  const dimCtx = await resolveControllerAuthForDimensions(opts);
 
   logCreateHeader({ environment: dpCtx.environment, type: preset?.type }, dsKey, dimensionKey, logger);
 

package/lib/protection/sync-after-upload.js

@@ -22,7 +22,7 @@ async function syncDatasourceAfterProtectionUpload(dataplaneUrl, authConfig, dat
   }
   try {
     const created = unwrapApiData(
-      await createSyncJob(dataplaneUrl, key, authConfig, {})
+      await createSyncJob(dataplaneUrl, key, authConfig, { syncType: 'bulk' })
     );
     const syncJobId =
       created?.id || created?.syncJobId || created?.data?.id || null;

package/lib/role-assistant/evidence-sync.js

@@ -0,0 +1,450 @@
+/**
+ * Role Assistant evidence import/export for dataplane evidence lifecycle.
+ *
+ * @fileoverview Sync local role-assistant evidence rows with dataplane evidence APIs
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const fs = require('../internal/fs-real-sync');
+const yaml = require('js-yaml');
+const logger = require('../utils/logger');
+const { formatSuccessLine, formatWarningLine, metadata } = require('../utils/cli-test-layout-chalk');
+const {
+  listEvidence,
+  loadEvidenceBulk,
+  validateEvidenceCandidate,
+  certifyEvidenceCandidate,
+  activateEvidenceCandidate
+} = require('../api/evidence.api');
+const { resolveExternalSystemPath } = require('../utils/app-path-resolve');
+const { SYSTEM_KIND_DIGITAL_WORKER } = require('./settings');
+
+const EVIDENCE_DIR_NAME = 'evidence';
+const EVIDENCE_EXPORT_FILE = 'evidence.json';
+const VALIDATION_FAILED = 'failed';
+const VALIDATION_PASSED = 'passed';
+
+const EVIDENCE_MUTABLE_KEYS = [
+  'key',
+  'resourceType',
+  'roleKey',
+  'kindKey',
+  'kindVersion',
+  'aspect',
+  'knowledgeType',
+  'originalLanguage',
+  'structuredContent',
+  'title',
+  'description',
+  'when',
+  'expectedBehavior',
+  'order',
+  'status',
+  'generationConfidence',
+  'suggestionExplanation',
+  'contributionOverrides',
+  'approval'
+];
+
+/** Read-only projections exported for Builder visibility (ignored on load). */
+const EVIDENCE_EXPORT_PROJECTION_KEYS = [
+  'valueProposal',
+  'contributionProjection',
+  'fingerprint',
+  'provenanceSummary',
+  'trustProjections'
+];
+
+function resolveSystemNode(input) {
+  if (!input || typeof input !== 'object') {
+    return null;
+  }
+  return input.system || input.application || null;
+}
+
+function isDigitalWorkerModel(input) {
+  const systemNode = resolveSystemNode(input);
+  if (!systemNode || typeof systemNode.systemKind !== 'string') {
+    return false;
+  }
+  return systemNode.systemKind.trim() === SYSTEM_KIND_DIGITAL_WORKER;
+}
+
+function isEvidenceFileName(fileName) {
+  const lower = String(fileName || '').toLowerCase();
+  return lower.endsWith('.json') || lower.endsWith('.yaml') || lower.endsWith('.yml');
+}
+
+function collectEvidenceFiles(dirPath) {
+  if (!fs.existsSync(dirPath)) {
+    return [];
+  }
+  const entries = fs.readdirSync(dirPath, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    const fullPath = path.join(dirPath, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...collectEvidenceFiles(fullPath));
+      continue;
+    }
+    if (isEvidenceFileName(entry.name)) {
+      files.push(fullPath);
+    }
+  }
+  return files.sort();
+}
+
+function parseEvidenceFile(filePath) {
+  const raw = fs.readFileSync(filePath, 'utf8');
+  if (filePath.toLowerCase().endsWith('.json')) {
+    return JSON.parse(raw);
+  }
+  return yaml.load(raw);
+}
+
+function extractEvidenceRows(payload) {
+  if (Array.isArray(payload)) {
+    return payload;
+  }
+  if (!payload || typeof payload !== 'object') {
+    return [];
+  }
+  if (Array.isArray(payload.data)) {
+    return payload.data;
+  }
+  if (Array.isArray(payload.rows)) {
+    return payload.rows;
+  }
+  if (Array.isArray(payload.evidence)) {
+    return payload.evidence;
+  }
+  return [payload];
+}
+
+function sanitizeEvidenceRow(row, systemKey, options = {}) {
+  const includeProjections = options.includeProjections === true;
+  const out = {};
+  const keys = includeProjections
+    ? [...EVIDENCE_MUTABLE_KEYS, ...EVIDENCE_EXPORT_PROJECTION_KEYS]
+    : EVIDENCE_MUTABLE_KEYS;
+  for (const key of keys) {
+    if (typeof row[key] !== 'undefined') {
+      out[key] = row[key];
+    }
+  }
+  if (typeof out.roleKey !== 'string' || !out.roleKey.trim()) {
+    out.roleKey = systemKey;
+  }
+  // Import path: clients cannot load status=active; lifecycle activates after certify.
+  if (!includeProjections) {
+    out.status = 'candidate';
+  }
+  if (!out.title || !out.when || !out.expectedBehavior) {
+    return null;
+  }
+  return out;
+}
+
+function loadEvidenceRowsFromFolder(evidencePath, systemKey) {
+  const files = collectEvidenceFiles(evidencePath);
+  const rows = [];
+  for (const filePath of files) {
+    const parsed = parseEvidenceFile(filePath);
+    const extractedRows = extractEvidenceRows(parsed);
+    for (const row of extractedRows) {
+      if (!row || typeof row !== 'object' || Array.isArray(row)) {
+        continue;
+      }
+      const normalized = sanitizeEvidenceRow(row, systemKey);
+      if (!normalized) {
+        const shortName = path.relative(evidencePath, filePath);
+        throw new Error(
+          `Evidence row in ${shortName} is missing required fields title/when/expectedBehavior.`
+        );
+      }
+      rows.push(normalized);
+    }
+  }
+  return { files, rows };
+}
+
+function resolveEvidenceDirectory(systemKey, pathOptions = {}) {
+  const appPath = resolveExternalSystemPath(systemKey, pathOptions);
+  return path.join(appPath, EVIDENCE_DIR_NAME);
+}
+
+function normalizeEvidenceRef(row) {
+  if (!row || typeof row !== 'object') {
+    return '';
+  }
+  const candidates = [row.id, row.key];
+  for (const candidate of candidates) {
+    if (typeof candidate === 'string' && candidate.trim()) {
+      return candidate.trim();
+    }
+  }
+  return '';
+}
+
+function toMatchKey(row) {
+  return `${String(row.title || '').trim()}|${String(row.when || '').trim()}|${String(row.expectedBehavior || '').trim()}`;
+}
+
+function dedupeRefs(refs) {
+  const out = [];
+  const seen = new Set();
+  for (const ref of refs) {
+    if (!ref || seen.has(ref)) {
+      continue;
+    }
+    seen.add(ref);
+    out.push(ref);
+  }
+  return out;
+}
+
+function resolveRefsFromLoadedRows(rows) {
+  return dedupeRefs((rows || []).map((row) => normalizeEvidenceRef(row)).filter(Boolean));
+}
+
+function buildRoleEvidenceIndex(rows) {
+  const byKey = new Map();
+  for (const row of rows || []) {
+    if (!row || typeof row !== 'object') {
+      continue;
+    }
+    const ref = normalizeEvidenceRef(row);
+    if (!ref) {
+      continue;
+    }
+    const matchKey = toMatchKey(row);
+    if (matchKey !== '||' && !byKey.has(matchKey)) {
+      byKey.set(matchKey, ref);
+    }
+  }
+  return byKey;
+}
+
+async function resolveEvidenceLifecycleRefs(dataplaneUrl, authConfig, systemKey, loadedRows, preparedRows) {
+  const refs = resolveRefsFromLoadedRows(loadedRows);
+  if (refs.length >= preparedRows.length || preparedRows.length === 0) {
+    return refs;
+  }
+  const roleRows = await listEvidence(dataplaneUrl, authConfig, { roleKey: systemKey });
+  const roleByKey = buildRoleEvidenceIndex(roleRows);
+  for (const row of preparedRows) {
+    const matchRef = roleByKey.get(toMatchKey(row));
+    if (matchRef) {
+      refs.push(matchRef);
+    }
+  }
+  return dedupeRefs(refs);
+}
+
+function validationFailed(validationResponse) {
+  const status = String(validationResponse?.status || '').trim().toLowerCase();
+  return status === VALIDATION_FAILED;
+}
+
+function isActivatedEvidenceRow(row) {
+  const status = String(row?.status || '').trim().toLowerCase();
+  return !status || status === 'active';
+}
+
+async function runEvidenceLifecycleForRef(dataplaneUrl, authConfig, evidenceRef) {
+  const validation = await validateEvidenceCandidate(dataplaneUrl, authConfig, evidenceRef);
+  if (validationFailed(validation)) {
+    const issues = Array.isArray(validation?.issues) ? validation.issues.length : 0;
+    throw new Error(`Validation failed for evidence ${evidenceRef} (${issues} issue${issues === 1 ? '' : 's'}).`);
+  }
+  if (String(validation?.status || '').trim().toLowerCase() !== VALIDATION_PASSED) {
+    throw new Error(`Validation status for evidence ${evidenceRef} is "${validation?.status || 'unknown'}".`);
+  }
+  await certifyEvidenceCandidate(dataplaneUrl, authConfig, evidenceRef, {});
+  const activated = await activateEvidenceCandidate(dataplaneUrl, authConfig, evidenceRef);
+  if (!isActivatedEvidenceRow(activated)) {
+    throw new Error(`Evidence ${evidenceRef} did not become active after activation.`);
+  }
+}
+
+function buildFailureSummary(failures) {
+  const preview = failures.slice(0, 3).join('; ');
+  const more = failures.length > 3 ? ` (and ${failures.length - 3} more)` : '';
+  return `${preview}${more}`;
+}
+
+function buildEvidenceDryRunSummary(evidencePath, files, rows) {
+  return {
+    skipped: false,
+    dryRun: true,
+    evidencePath,
+    filesDiscovered: files.length,
+    discovered: rows.length
+  };
+}
+
+function buildEvidenceImportSummary(evidencePath, files, rows, loadResult) {
+  return {
+    skipped: false,
+    evidencePath,
+    filesDiscovered: files.length,
+    discovered: rows.length,
+    loaded: Number(loadResult.inserted || 0) + Number(loadResult.updated || 0),
+    validated: 0,
+    certified: 0,
+    productionReady: 0,
+    failed: 0
+  };
+}
+
+async function loadEvidenceAndResolveRefs(dataplaneUrl, authConfig, systemKey, rows) {
+  const loadResult = await loadEvidenceBulk(dataplaneUrl, authConfig, rows, {});
+  const refs = await resolveEvidenceLifecycleRefs(dataplaneUrl, authConfig, systemKey, loadResult.data, rows);
+  return { loadResult, refs };
+}
+
+async function runEvidenceLifecycleBatch(dataplaneUrl, authConfig, refs, summary) {
+  const failures = [];
+  for (const evidenceRef of refs) {
+    try {
+      await runEvidenceLifecycleForRef(dataplaneUrl, authConfig, evidenceRef);
+      summary.validated += 1;
+      summary.certified += 1;
+      summary.productionReady += 1;
+    } catch (error) {
+      summary.failed += 1;
+      failures.push(error.message || String(error));
+    }
+  }
+  return failures;
+}
+
+function appendUnresolvedEvidenceFailures(summary, failures, refCount, rowCount) {
+  if (refCount >= rowCount) {
+    return;
+  }
+  const unresolved = rowCount - refCount;
+  summary.failed += unresolved;
+  failures.push(`Could not resolve ${unresolved} evidence row(s) to dataplane ids after load.`);
+}
+
+function throwWhenEvidenceLifecycleFailed(summary, failures) {
+  if (summary.failed === 0) {
+    return;
+  }
+  const err = new Error(`Role assistant evidence lifecycle failed: ${buildFailureSummary(failures)}`);
+  err.evidenceSummary = summary;
+  throw err;
+}
+
+async function importRoleAssistantEvidence(params) {
+  const { systemKey, dataplaneUrl, authConfig, model, pathOptions = {}, dryRun = false } = params;
+  if (!isDigitalWorkerModel(model)) {
+    return { skipped: true, reason: 'not-role-assistant' };
+  }
+  const evidencePath = resolveEvidenceDirectory(systemKey, pathOptions);
+  const { files, rows } = loadEvidenceRowsFromFolder(evidencePath, systemKey);
+  if (rows.length === 0) {
+    return { skipped: true, reason: 'no-evidence-files', evidencePath };
+  }
+  if (dryRun) {
+    return buildEvidenceDryRunSummary(evidencePath, files, rows);
+  }
+  const { loadResult, refs } = await loadEvidenceAndResolveRefs(
+    dataplaneUrl,
+    authConfig,
+    systemKey,
+    rows
+  );
+  const summary = buildEvidenceImportSummary(evidencePath, files, rows, loadResult);
+  const failures = await runEvidenceLifecycleBatch(dataplaneUrl, authConfig, refs, summary);
+  appendUnresolvedEvidenceFailures(summary, failures, refs.length, rows.length);
+  throwWhenEvidenceLifecycleFailed(summary, failures);
+  return summary;
+}
+
+function sortEvidenceRows(rows) {
+  return [...rows].sort((left, right) => {
+    const titleCmp = String(left.title || '').localeCompare(String(right.title || ''));
+    if (titleCmp !== 0) {
+      return titleCmp;
+    }
+    return Number(left.order || 0) - Number(right.order || 0);
+  });
+}
+
+async function exportRoleAssistantEvidence(params) {
+  const { systemKey, dataplaneUrl, authConfig, manifest, pathOptions = {} } = params;
+  const model = { system: manifest?.application, dataSources: manifest?.dataSources || [] };
+  if (!isDigitalWorkerModel(model)) {
+    return { skipped: true, reason: 'not-role-assistant' };
+  }
+  const rows = await listEvidence(dataplaneUrl, authConfig, { roleKey: systemKey });
+  const normalized = sortEvidenceRows(
+    rows
+      .map((row) => sanitizeEvidenceRow(row, systemKey, { includeProjections: true }))
+      .filter(Boolean)
+  );
+  if (normalized.length === 0) {
+    return { skipped: true, reason: 'no-evidence-rows' };
+  }
+  const evidencePath = resolveEvidenceDirectory(systemKey, pathOptions);
+  fs.mkdirSync(evidencePath, { recursive: true });
+  const outPath = path.join(evidencePath, EVIDENCE_EXPORT_FILE);
+  fs.writeFileSync(outPath, `${JSON.stringify(normalized, null, 2)}\n`, 'utf8');
+  return {
+    skipped: false,
+    count: normalized.length,
+    evidencePath,
+    filePath: outPath
+  };
+}
+
+function logRoleAssistantEvidenceImportSummary(systemKey, result, options = {}) {
+  if (result.skipped) {
+    if (options.verbose === true) {
+      logger.log(metadata(`Role assistant evidence skipped (${systemKey}): ${result.reason}`));
+    }
+    return;
+  }
+  if (result.dryRun) {
+    logger.log(
+      formatWarningLine(
+        `Role assistant evidence dry-run: ${result.discovered} row(s) from ${result.filesDiscovered} file(s).`
+      )
+    );
+    return;
+  }
+  logger.log(
+    formatSuccessLine(
+      `Role assistant evidence applied: discovered ${result.discovered}, loaded ${result.loaded}, `
+        + `validated ${result.validated}, certified ${result.certified}, production-ready ${result.productionReady}.`
+    )
+  );
+}
+
+function logRoleAssistantEvidenceExportSummary(systemKey, result, options = {}) {
+  if (result.skipped) {
+    if (options.verbose === true) {
+      logger.log(metadata(`Role assistant evidence export skipped (${systemKey}): ${result.reason}`));
+    }
+    return;
+  }
+  logger.log(
+    formatSuccessLine(
+      `Role assistant evidence exported (${systemKey}): ${result.count} row(s) to ${result.filePath}.`
+    )
+  );
+}
+
+module.exports = {
+  isDigitalWorkerModel,
+  importRoleAssistantEvidence,
+  exportRoleAssistantEvidence,
+  logRoleAssistantEvidenceImportSummary,
+  logRoleAssistantEvidenceExportSummary
+};

package/lib/role-assistant/github-workflow.js

@@ -0,0 +1,96 @@
+/**
+ * Role Assistant GitHub workflow scaffolding.
+ *
+ * @fileoverview Generates a promotion workflow for role-assistant packages
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fsSync = require('../internal/fs-real-sync');
+const path = require('path');
+const { resolveExternalSystemPath } = require('../utils/app-path-resolve');
+
+const WORKFLOW_FILE_NAME = 'role-assistant-promote.yml';
+
+function buildRoleAssistantWorkflowContent(systemKey) {
+  return `name: Role Assistant Promotion
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: "Target environment"
+        required: true
+        type: choice
+        options:
+          - dev
+          - tst
+          - pro
+        default: dev
+
+jobs:
+  promote:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Install AI Fabrix Builder
+        run: npm install -g @aifabrix/builder
+
+      - name: Login to AI Fabrix
+        run: |
+          set -e
+          aifabrix login \\
+            --method credentials \\
+            --app ${systemKey} \\
+            --client-id \${{ secrets.AIFABRIX_CLIENT_ID }} \\
+            --client-secret \${{ secrets.AIFABRIX_CLIENT_SECRET }} \\
+            --controller \${{ secrets.AIFABRIX_CONTROLLER_URL }} \\
+            --environment \${{ inputs.environment }}
+
+      - name: Validate role assistant package
+        run: |
+          set -e
+          aifabrix validate ${systemKey}
+
+      - name: Upload role assistant package
+        run: |
+          set -e
+          aifabrix upload ${systemKey} --env \${{ inputs.environment }}
+
+      - name: Run role assistant lifecycle test
+        run: |
+          set -e
+          aifabrix role-assistant test ${systemKey} --env \${{ inputs.environment }} --json
+`;
+}
+
+function resolveRoleAssistantWorkflowPath(systemKey, options = {}) {
+  const rootDir = options.roleAssistantPath || resolveExternalSystemPath(systemKey, options.pathOptions || {});
+  return path.join(rootDir, '.github', 'workflows', WORKFLOW_FILE_NAME);
+}
+
+async function ensureRoleAssistantGithubWorkflow(systemKey, options = {}) {
+  const workflowPath = resolveRoleAssistantWorkflowPath(systemKey, options);
+  if (!options.force && fsSync.existsSync(workflowPath)) {
+    return { created: false, workflowPath, reason: 'already-exists' };
+  }
+  fsSync.mkdirSync(path.dirname(workflowPath), { recursive: true });
+  fsSync.writeFileSync(workflowPath, buildRoleAssistantWorkflowContent(systemKey), 'utf8');
+  return { created: true, workflowPath };
+}
+
+module.exports = {
+  WORKFLOW_FILE_NAME,
+  buildRoleAssistantWorkflowContent,
+  resolveRoleAssistantWorkflowPath,
+  ensureRoleAssistantGithubWorkflow
+};