@aifabrix/builder 2.52.0 → 2.53.0

package/scripts/stage_builder_api_for_docker.js

@@ -1,65 +0,0 @@
-#!/usr/bin/env node
-/**
- * Stage builder-api runtime files for Docker image build (plan 154.3).
- *
- * @fileoverview Host-side staging before `docker build`
- * @author AI Fabrix Team
- * @version 1.0.0
- */
-
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const {
-  discoverRuntimeFiles,
-  findManifestViolations
-} = require('./lib/builder-api-docker-staging-core');
-const { stageFiles } = require('./lib/builder-api-docker-staging-copy');
-
-const REPO_ROOT = path.resolve(__dirname, '..');
-
-/**
- * @param {string[]} argv
- * @returns {number}
- */
-function main(argv) {
-  const args = argv.slice(2);
-  let destination = path.join(REPO_ROOT, 'docker-builder-api-staging');
-  let manifestPath = '';
-
-  for (let i = 0; i < args.length; i += 1) {
-    if (args[i] === '--destination' && args[i + 1]) {
-      destination = path.resolve(args[i + 1]);
-      i += 1;
-    } else if (args[i] === '--manifest' && args[i + 1]) {
-      manifestPath = path.resolve(args[i + 1]);
-      i += 1;
-    }
-  }
-
-  const manifest = discoverRuntimeFiles(REPO_ROOT);
-  const violations = findManifestViolations(manifest);
-  if (violations.length > 0) {
-    console.error('Staging manifest contains forbidden paths:');
-    for (const item of violations) {
-      console.error(`  - ${item}`);
-    }
-    return 1;
-  }
-
-  const staged = stageFiles(REPO_ROOT, destination, manifest);
-  if (manifestPath) {
-    fs.mkdirSync(path.dirname(manifestPath), { recursive: true });
-    fs.writeFileSync(manifestPath, `${JSON.stringify(staged, null, 2)}\n`, 'utf8');
-  }
-
-  console.log(`OK: staged ${staged.length} files → ${destination}`);
-  return 0;
-}
-
-if (require.main === module) {
-  process.exit(main(process.argv));
-}
-
-module.exports = { main };

package/scripts/sync-builder-api-template.js

@@ -1,44 +0,0 @@
-#!/usr/bin/env node
-/**
- * Publish builder/builder-api/ SSOT → templates/applications/builder-api/
- * (manifest files only — no README; use builder/builder-api/README.md and packages/builder-api/README.md)
- *
- * @fileoverview sync-json for builder-api platform app (plan 154.2)
- * @author AI Fabrix Team
- * @version 1.0.0
- */
-
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-
-const REPO_ROOT = path.resolve(__dirname, '..');
-const SSOT_DIR = path.join(REPO_ROOT, 'builder', 'builder-api');
-const TEMPLATE_DIR = path.join(REPO_ROOT, 'templates', 'applications', 'builder-api');
-
-const SYNC_FILES = ['application.yaml', 'Dockerfile', 'env.template'];
-
-/**
- * Publish builder/builder-api/ SSOT → templates/applications/builder-api/
- * @returns {void}
- */
-function main() {
-  if (!fs.existsSync(SSOT_DIR)) {
-    console.error(`Missing SSOT directory: ${SSOT_DIR}`);
-    process.exit(1);
-  }
-  fs.mkdirSync(TEMPLATE_DIR, { recursive: true });
-  for (const name of SYNC_FILES) {
-    const src = path.join(SSOT_DIR, name);
-    const dest = path.join(TEMPLATE_DIR, name);
-    if (!fs.existsSync(src)) {
-      console.error(`Missing SSOT file: ${src}`);
-      process.exit(1);
-    }
-    fs.copyFileSync(src, dest);
-    console.log(`sync-json: ${path.relative(REPO_ROOT, src)} → ${path.relative(REPO_ROOT, dest)}`);
-  }
-}
-
-main();

package/scripts/test-dataplane-bootstrap.js

@@ -1,331 +0,0 @@
-#!/usr/bin/env node
-/* eslint-disable no-console, require-jsdoc, max-lines-per-function, max-statements */
-
-/**
- * Diagnose and optionally exercise dataplane bootstrap provisioning (plan 197.0).
- *
- * @fileoverview Manual test / diagnostic for dataplane bootstrap API
- *
- * Usage (from aifabrix-builder repo root):
- *   node scripts/test-dataplane-bootstrap.js
- *   node scripts/test-dataplane-bootstrap.js --probe-api
- *   node scripts/test-dataplane-bootstrap.js --call-bootstrap
- *   node scripts/test-dataplane-bootstrap.js --controller-url http://localhost:3100 --probe-api
- */
-
-'use strict';
-
-const path = require('path');
-
-const ROOT = path.join(__dirname, '..');
-
-function parseArgs(argv) {
-  const out = {
-    controllerUrl: null,
-    envKey: 'dev',
-    probeApi: false,
-    callBootstrap: false,
-    help: false
-  };
-  for (let i = 2; i < argv.length; i += 1) {
-    const arg = argv[i];
-    if (arg === '--help' || arg === '-h') {
-      out.help = true;
-    } else if (arg === '--probe-api') {
-      out.probeApi = true;
-    } else if (arg === '--call-bootstrap') {
-      out.callBootstrap = true;
-      out.probeApi = true;
-    } else if (arg === '--controller-url' && argv[i + 1]) {
-      out.controllerUrl = String(argv[++i]).trim();
-    } else if (arg === '--env-key' && argv[i + 1]) {
-      out.envKey = String(argv[++i]).trim().toLowerCase();
-    } else {
-      throw new Error(`Unknown argument: ${arg}`);
-    }
-  }
-  return out;
-}
-
-function printHelp() {
-  console.log(`\
-Dataplane bootstrap diagnostic
-
-  node scripts/test-dataplane-bootstrap.js [options]
-
-Options:
-  --controller-url <url>  Override controller base URL (default: ~/.aifabrix/config.yaml)
-  --env-key <key>         Environment for bootstrap (default: dev)
-  --probe-api             POST .../applications/bootstrap (idempotent register/check)
-  --call-bootstrap        Same as --probe-api + save credentials locally (up-dataplane path)
-  -h, --help              Show this help
-
-Default (no flags): read-only gate checks — no API mutation.
-
-Bootstrap avoids device login when ALL are true:
-  - environment is dev
-  - Docker CLI + Compose on this machine
-  - merged secrets have miso-controller-secrets-encryptionKeyVault (= controller ENCRYPTION_KEY)
-  - controller /health OK
-`);
-}
-
-function line(label, value, ok) {
-  const mark = ok === true ? 'OK' : ok === false ? 'FAIL' : '—';
-  console.log(`  [${mark}] ${label}: ${value}`);
-}
-
-function loadBuilderModules() {
-  return {
-    config: require(path.join(ROOT, 'lib/core/config')),
-    docker: require(path.join(ROOT, 'lib/utils/docker')),
-    loadSecrets: require(path.join(ROOT, 'lib/core/secrets-load')).loadSecrets,
-    checkHealthEndpoint: require(path.join(ROOT, 'lib/utils/health-check-request')).checkHealthEndpoint,
-    resolveControllerUrl: require(path.join(ROOT, 'lib/utils/controller-url')).resolveControllerUrl,
-    canUseBootstrapProvision: require(path.join(ROOT, 'lib/commands/up-dataplane-bootstrap'))
-      .canUseBootstrapProvision,
-    resolveBootstrapEncryptionKey: require(path.join(ROOT, 'lib/commands/up-dataplane-bootstrap'))
-      .resolveBootstrapEncryptionKey,
-    bootstrapDataplaneApplication: require(path.join(ROOT, 'lib/commands/up-dataplane-bootstrap'))
-      .bootstrapDataplaneApplication,
-    buildDataplaneImageRef: require(path.join(ROOT, 'lib/commands/up-dataplane')).buildDataplaneImageRef,
-    bootstrapApplication: require(path.join(ROOT, 'lib/api/applications.api')).bootstrapApplication,
-    loadVariablesYaml: require(path.join(ROOT, 'lib/utils/app-register-config')).loadVariablesYaml,
-    extractAppConfiguration: require(path.join(ROOT, 'lib/utils/app-register-config')).extractAppConfiguration,
-    buildRegistrationData: require(path.join(ROOT, 'lib/app/register')).buildRegistrationData,
-    applyLocalhostPortAdjustment: require(path.join(ROOT, 'lib/app/register')).applyLocalhostPortAdjustment
-  };
-}
-
-async function runGateChecks(mods, controllerOverride) {
-  console.log('Prerequisites (canUseBootstrapProvision gates):');
-  const gates = {
-    devEnv: await checkEnvironmentGate(mods.config),
-    docker: await checkDockerGate(mods.docker),
-    encryptionKey: await checkEncryptionKeyGate(
-      mods.resolveBootstrapEncryptionKey,
-      mods.loadSecrets
-    )
-  };
-
-  const controllerUrl = await resolveControllerBaseUrl(
-    mods.config,
-    mods.resolveControllerUrl,
-    controllerOverride
-  );
-  line('controller URL', controllerUrl, null);
-  gates.controllerHealthy = await checkControllerHealth(controllerUrl, mods.checkHealthEndpoint);
-
-  const eligible = await mods.canUseBootstrapProvision({ skipInfraCheck: true });
-  console.log('');
-  line('canUseBootstrapProvision', eligible ? 'true' : 'false', eligible);
-  printDeviceLoginReasons(gates);
-
-  return { gates, controllerUrl, eligible };
-}
-
-async function checkEnvironmentGate(config) {
-  const cfg = await config.getConfig();
-  const env = cfg && cfg.environment ? String(cfg.environment) : 'dev';
-  const ok = env === 'dev';
-  line('config environment', env, ok);
-  if (!ok) {
-    console.log('    → Bootstrap only runs in dev. Set: aifabrix auth --set-environment dev');
-  }
-  return ok;
-}
-
-async function checkDockerGate(docker) {
-  try {
-    await docker.ensureDockerAndCompose();
-    line('Docker CLI + Compose', 'available', true);
-    return true;
-  } catch (err) {
-    line('Docker CLI + Compose', err.message || 'unavailable', false);
-    console.log('    → Bootstrap requires local Docker (same machine as aifabrix run dataplane).');
-    return false;
-  }
-}
-
-async function checkEncryptionKeyGate(resolveBootstrapEncryptionKey, loadSecrets) {
-  const key = await resolveBootstrapEncryptionKey();
-  const ok = Boolean(key && String(key).trim());
-  line(
-    'bootstrap ENCRYPTION_KEY (merged secrets)',
-    ok ? `present (${String(key).length} chars, not shown)` : 'missing',
-    ok
-  );
-  if (!ok) {
-    const secrets = await loadSecrets(undefined);
-    const keys = secrets && typeof secrets === 'object' ? Object.keys(secrets) : [];
-    const hints = keys.filter((k) => /encryption/i.test(k));
-    console.log(
-      '    → Need miso-controller-secrets-encryptionKeyVault in secrets (after up-miso resolve).'
-    );
-    if (hints.length) {
-      console.log(`    → Secret keys containing "encryption": ${hints.join(', ')}`);
-    }
-    console.log(
-      '    → config.yaml secrets-encryption is CLI file crypto only — not the bootstrap header key.'
-    );
-  }
-  return ok;
-}
-
-async function resolveControllerBaseUrl(config, resolveControllerUrl, override) {
-  if (override) {
-    return override.replace(/\/+$/, '');
-  }
-  const cfg = await config.getConfig();
-  const platform = cfg.platformController || cfg.controller;
-  if (platform && String(platform).trim()) {
-    return String(platform).trim().replace(/\/+$/, '');
-  }
-  return (await resolveControllerUrl()).replace(/\/+$/, '');
-}
-
-async function checkControllerHealth(controllerUrl, checkHealthEndpoint) {
-  const healthUrl = `${controllerUrl}/health`;
-  try {
-    const ok = await checkHealthEndpoint(healthUrl, false);
-    line('controller health', healthUrl, ok);
-    if (!ok) {
-      console.log('    → Start platform: aifabrix up-infra && aifabrix up-miso (or af setup).');
-    }
-    return ok;
-  } catch (err) {
-    line('controller health', `${healthUrl} (${err.message})`, false);
-    return false;
-  }
-}
-
-async function buildRegistrationPayload(mods, controllerUrl, envKey) {
-  const { variables } = await mods.loadVariablesYaml('dataplane');
-  const appConfig = await mods.extractAppConfiguration(variables, 'dataplane', {});
-  await mods.applyLocalhostPortAdjustment(appConfig, controllerUrl, {});
-  const imageOverride = mods.buildDataplaneImageRef({});
-  return mods.buildRegistrationData(appConfig, {
-    imageOverride,
-    image: imageOverride,
-    envKey
-  });
-}
-
-async function probeBootstrapApi(controllerUrl, encryptionKey, envKey, mods) {
-  const pathSuffix = `/api/v1/environments/${envKey}/applications/bootstrap`;
-  console.log('');
-  console.log('Bootstrap API probe (--probe-api):');
-  line('endpoint', `${controllerUrl}${pathSuffix}`, null);
-
-  const registrationData = await buildRegistrationPayload(mods, controllerUrl, envKey);
-  const response = await mods.bootstrapApplication(
-    controllerUrl,
-    envKey,
-    encryptionKey,
-    registrationData
-  );
-
-  if (!response.success) {
-    return reportBootstrapFailure(response);
-  }
-
-  const data = response.data?.data || response.data;
-  const status = data?.status || (data?.application ? 'created' : 'ok');
-  const appKey = data?.application?.key || registrationData.key;
-  line('bootstrap API', `OK (${status}, app: ${appKey})`, true);
-  return true;
-}
-
-function reportBootstrapFailure(response) {
-  const msg = response.formattedError || response.error || 'request failed';
-  if (/401|403|encryption|Unauthorized/i.test(String(msg))) {
-    line('x-encryption-key', 'rejected by controller', false);
-    console.log('    → Controller ENCRYPTION_KEY does not match merged secrets vault key.');
-    return false;
-  }
-  if (/503|not configured/i.test(String(msg))) {
-    line('bootstrap on controller', 'disabled (ENCRYPTION_KEY unset on controller)', false);
-    return false;
-  }
-  line('bootstrap API', msg, false);
-  return false;
-}
-
-function printDeviceLoginReasons(gates) {
-  console.log('');
-  console.log('Why setup may ask for device login instead of bootstrap:');
-  if (!gates.devEnv) console.log('  • environment is not dev');
-  if (!gates.docker) console.log('  • Docker/Compose not available on this host');
-  if (!gates.encryptionKey) console.log('  • bootstrap encryption key missing from merged secrets');
-  if (!gates.controllerHealthy) {
-    console.log('  • controller not healthy (setup may still run auth before dataplane step)');
-  }
-  if (gates.devEnv && gates.docker && gates.encryptionKey && gates.controllerHealthy) {
-    console.log('  • All bootstrap gates pass — setup should show "Bootstrap provision (no device login)"');
-    console.log('  • If dataplane still missing, check setup logs after "Starting Dataplane..."');
-  }
-}
-
-async function main() {
-  const args = parseArgs(process.argv);
-  if (args.help) {
-    printHelp();
-    process.exit(0);
-  }
-
-  console.log('Dataplane bootstrap diagnostic');
-  console.log('================================');
-  console.log('');
-
-  const mods = loadBuilderModules();
-  await mods.config.ensureSecretsEncryptionKey();
-
-  const { gates, controllerUrl, eligible } = await runGateChecks(mods, args.controllerUrl);
-
-  if (!gates.controllerHealthy || !gates.encryptionKey) {
-    console.log('');
-    console.log('Fix failing gates above, then re-run with --probe-api.');
-    process.exit(1);
-  }
-
-  if (!args.probeApi) {
-    console.log('');
-    console.log('Read-only checks done. To exercise bootstrap API:');
-    console.log('  node scripts/test-dataplane-bootstrap.js --probe-api');
-    process.exit(eligible ? 0 : 1);
-  }
-
-  const encryptionKey = await mods.resolveBootstrapEncryptionKey();
-  const apiOk = await probeBootstrapApi(controllerUrl, encryptionKey, args.envKey, mods);
-  if (!apiOk) {
-    process.exit(1);
-  }
-
-  if (!args.callBootstrap) {
-    process.exit(0);
-  }
-
-  if (!eligible) {
-    console.error('');
-    console.error('Refusing --call-bootstrap: canUseBootstrapProvision is false.');
-    process.exit(1);
-  }
-
-  console.log('');
-  console.log('Saving credentials via bootstrapDataplaneApplication...');
-  await mods.bootstrapDataplaneApplication(
-    { skipInfraCheck: true },
-    controllerUrl,
-    args.envKey,
-    mods.buildDataplaneImageRef
-  );
-  console.log('');
-  console.log('Done. Next: aifabrix deploy dataplane --local  or  aifabrix run dataplane');
-  process.exit(0);
-}
-
-main().catch((err) => {
-  console.error('');
-  console.error(`Error: ${err.message}`);
-  process.exit(1);
-});