@aifabrix/builder 2.53.0 → 2.54.1

package/lib/commands/lifecycle-external.js

@@ -24,6 +24,8 @@ const {
   lifecycleGovernanceNeedsWork,
   buildGovernanceOptsFromLifecycle
 } = require('../lifecycle/lifecycle-governance-options');
+const { remapRoleAssistantGovernanceReport } = require('../lifecycle/role-assistant-governance');
+const { isRoleAssistantWorkspace } = require('../utils/platform-shell-package');
 
 /**
  * @async
@@ -76,6 +78,9 @@ async function runLifecycleGovernanceCombinedIfNeeded(
   dataplaneUrl,
   options
 ) {
+  if (options.skipConnectedSystemGovernance === true) {
+    return;
+  }
   if (!lifecycleHasGovernanceSubjects(options)) {
     return;
   }
@@ -100,16 +105,21 @@ async function runMissingVerifyStepsLocally(systemKey, report, options) {
   const runOpts = { ...options, noPublish: true };
   const pathsUtil = require('../utils/paths');
   const appType = await pathsUtil.detectAppType(systemKey).catch(() => null);
-  const isRoleAssistantPackage = appType?.baseDir === 'role-assistant';
-  // verify-operations is integration/-only; Role Assistant packages use dataplane lifecycle report.
+  const isRoleAssistantPackage =
+    options.skipConnectedSystemGovernance === true || isRoleAssistantWorkspace(appType && appType.baseDir);
+  // verify-operations / CS governance packs are integration/-only.
+  // Role Assistant isolation is Work Hub cases + role-assistant.yaml.
   if (report.operations?.verdict !== VERDICT.VERIFIED && !isRoleAssistantPackage) {
     await runVerifyOperationsForExternalSystem(systemKey, runOpts);
   }
-  if (report.trust?.verdict !== VERDICT.VERIFIED) {
+  if (report.trust?.verdict !== VERDICT.VERIFIED && !isRoleAssistantPackage) {
     await runVerifyTrustForExternalSystem(systemKey, runOpts);
   }
-  if (report.governance?.verdict !== VERDICT.VERIFIED
-    && report.governance?.verdict !== VERDICT.NOT_APPLICABLE) {
+  if (
+    !isRoleAssistantPackage &&
+    report.governance?.verdict !== VERDICT.VERIFIED &&
+    report.governance?.verdict !== VERDICT.NOT_APPLICABLE
+  ) {
     if (lifecycleHasGovernanceSubjects(options)) {
       const { runVerifyGovernanceCombined } = require('./verify-governance-combined-external');
       await runVerifyGovernanceCombined(
@@ -143,15 +153,17 @@ async function buildLifecycleResult(
   authConfig,
   extra = {}
 ) {
+  const mappedReport =
+    extra.roleAssistant === true ? remapRoleAssistantGovernanceReport(report) : report;
   const openApiPublished = await resolveOpenApiPublished(dataplaneUrl, authConfig, systemKey);
   return {
     systemKey,
     command: 'lifecycle',
-    report,
+    report: mappedReport,
     dataplaneUrl,
     dataplaneUiBaseUrl,
     openApiPublished,
-    certificationProgress: buildCertificationProgress(report, { openApiPublished }),
+    certificationProgress: buildCertificationProgress(mappedReport, { openApiPublished }),
     ...extra
   };
 }
@@ -191,7 +203,58 @@ async function runLifecycleViaDataplaneApi(
     dataplaneUrl,
     dataplaneUiBaseUrl,
     authConfig,
-    { stepsRun: runRes.stepsRun || [], source: 'api' }
+    {
+      stepsRun: runRes.stepsRun || [],
+      source: 'api',
+      roleAssistant: options.roleAssistant === true
+    }
+  );
+}
+
+function emptyRoleAssistantLifecycleReport(systemKey) {
+  return {
+    systemKey,
+    operations: { verdict: VERDICT.NOT_APPLICABLE },
+    trust: { verdict: VERDICT.NOT_APPLICABLE },
+    governance: { verdict: VERDICT.NOT_APPLICABLE },
+    recommendations: [],
+    warnings: [
+      {
+        code: 'ROLE_ASSISTANT_LIFECYCLE_REPORT_UNAVAILABLE',
+        message:
+          'Lifecycle report unavailable. Role Assistant cases still run against the published worker.'
+      }
+    ]
+  };
+}
+
+/**
+ * Role Assistant prove uses the published dataplane worker.
+ * Do not POST CS lifecycle/run or fall back to verify-trust (those paths need application.yaml).
+ * @async
+ */
+async function fetchRoleAssistantLifecycleResult(
+  systemKey,
+  authConfig,
+  dataplaneUrl,
+  dataplaneUiBaseUrl,
+  options
+) {
+  let report;
+  try {
+    report = await getSystemLifecycleReport(dataplaneUrl, authConfig, systemKey, {
+      details: options.verbose === true
+    });
+  } catch {
+    report = emptyRoleAssistantLifecycleReport(systemKey);
+  }
+  return buildLifecycleResult(
+    systemKey,
+    report,
+    dataplaneUrl,
+    dataplaneUiBaseUrl,
+    authConfig,
+    { source: 'api', roleAssistant: true }
   );
 }
 
@@ -205,6 +268,16 @@ async function executeLifecycleWork(systemKey, options = {}) {
   const { authConfig, dataplaneUrl } = await resolveLifecycleAuth(systemKey, options);
   const dataplaneUiBaseUrl = await resolveLifecycleDataplaneUiBaseUrl(dataplaneUrl);
 
+  if (options.roleAssistant === true) {
+    return fetchRoleAssistantLifecycleResult(
+      systemKey,
+      authConfig,
+      dataplaneUrl,
+      dataplaneUiBaseUrl,
+      options
+    );
+  }
+
   if (options.run === true) {
     try {
       return await runLifecycleViaDataplaneApi(
@@ -235,7 +308,10 @@ async function executeLifecycleWork(systemKey, options = {}) {
     dataplaneUrl,
     dataplaneUiBaseUrl,
     authConfig,
-    { source: options.run ? 'local-fallback' : 'api' }
+    {
+      source: options.run ? 'local-fallback' : 'api',
+      roleAssistant: options.roleAssistant === true
+    }
   );
 }
 
@@ -251,26 +327,22 @@ async function runLifecycleForExternalSystem(systemKey, options = {}) {
   const appType = await pathsUtil.detectAppType(systemKey).catch(() => null);
   assertCertifyExternalWorkspace(appType && appType.baseDir, 'lifecycle');
 
-  let resolvedKey = systemKey;
-  if (appType.baseDir === 'role-assistant') {
-    const { resolveExternalIntegrationContext } = require('./test-e2e-external');
-    const { roleAssistantSystemKey } = require('../utils/role-assistant-paths');
-    try {
-      resolvedKey = resolveExternalIntegrationContext(systemKey).systemKey;
-    } catch {
-      resolvedKey = roleAssistantSystemKey(systemKey);
-    }
-  }
+  const roleAssistant = isRoleAssistantWorkspace(appType && appType.baseDir);
+  const workOpts = {
+    ...options,
+    roleAssistant,
+    skipConnectedSystemGovernance: roleAssistant
+  };
 
   if (options.run === true) {
     return runWithVerifyStepProgress(
       'Processing',
-      async(progress) => executeLifecycleWork(resolvedKey, { ...options, lifecycleProgress: progress }),
+      async(progress) => executeLifecycleWork(systemKey, { ...workOpts, lifecycleProgress: progress }),
       { json: options.json === true }
     );
   }
 
-  return executeLifecycleWork(resolvedKey, options);
+  return executeLifecycleWork(systemKey, workOpts);
 }
 
 module.exports = {

package/lib/commands/repair-datasource-test-payload.js

@@ -1,7 +1,7 @@
 /**
- * Schema-aware testPayload repair (payloadTemplate / expectedResult).
+ * Schema-aware testPayload repair (payloadTemplate / expectedResult only).
  *
- * @fileoverview Helpers for repair-datasource testPayload generation
+ * @fileoverview Mapping-shape testPayload generation; does not write scenario gold
  * @author AI Fabrix Team
  * @version 2.0.0
  */
@@ -288,6 +288,8 @@ function buildTemplatesFromPathEntries(parsed, pathEntries) {
 
 /**
  * Builds minimal payloadTemplate and expectedResult from attributes + metadataSchema.
+ * Does not generate or rewrite testPayload.scenarios (including nested expectedRows).
+ * Placeholder zeros on expectedResult are mapping-shape only — not capacity row gold.
  *
  * @param {Object} parsed - Parsed datasource (mutated)
  * @param {string[]} changes - Change log

package/lib/commands/repair-datasource-webhooks-sync-bridge.js

@@ -6,6 +6,8 @@
 
 'use strict';
 
+const { listCapabilityKeys } = require('../datasource/capability/capability-manifest');
+
 const AUTH_USAGE_WEBHOOK_INBOUND = 'webhookInbound';
 
 /**
@@ -23,6 +25,23 @@ function systemHasWebhookInboundAuth(systemParsed) {
   return false;
 }
 
+/**
+ * True when every webhook.events[] entry is a capability key (CIP invoke, not change-signal get).
+ * @param {object} parsed
+ * @returns {boolean}
+ */
+function webhookEventsAreCapabilityKeys(parsed) {
+  const events = parsed?.webhook?.events;
+  if (!Array.isArray(events) || events.length === 0) {
+    return false;
+  }
+  const keys = new Set(listCapabilityKeys(parsed.capabilities));
+  if (keys.size === 0) {
+    return false;
+  }
+  return events.every((event) => keys.has(String(event || '').trim()));
+}
+
 /**
  * @param {object} parsed
  * @param {string[]} changes
@@ -37,7 +56,8 @@ function repairWebhookSection(parsed, changes, warnings) {
   let updated = false;
 
   if (webhook.enabled === true) {
-    if (!webhook.idPath || !String(webhook.idPath).trim()) {
+    const needsIdPath = !webhookEventsAreCapabilityKeys(parsed);
+    if (needsIdPath && (!webhook.idPath || !String(webhook.idPath).trim())) {
       warnings.push(
         'webhook.enabled is true but idPath is missing — set idPath (for example $.objectId) before upload.'
       );
@@ -168,5 +188,6 @@ module.exports = {
   repairSyncBridgeSection,
   defaultSyncBridgeForSyncRepair,
   collectWebhookSyncBridgeSystemWarnings,
-  systemHasWebhookInboundAuth
+  systemHasWebhookInboundAuth,
+  webhookEventsAreCapabilityKeys
 };

package/lib/commands/repair-datasource.js

@@ -365,6 +365,9 @@ function repairSyncSection(parsed, changes) {
 
 /**
  * Removes unknown top-level keys from testPayload (v2.4.1 closed root).
+ * Nested keys under scenarios (including author-owned row gold) are not stripped.
+ * Do not add a nested scenario allowlist unless it is derived from the published
+ * external-datasource.schema.json testPayload.scenarios.items.properties.
  * @param {Object} parsed - Parsed datasource (mutated)
  * @param {string[]} changes - Change log
  * @returns {boolean}

package/lib/commands/repair-external-run.js

@@ -18,6 +18,7 @@ const { persistChangesAndRegenerate, regenerateReadmeIfRequested, regenerateDepl
 const { runRepairSteps } = require('./repair-steps');
 const { runDatasourceRepairs } = require('./repair-datasource-run');
 const { repairSplitOrchestrationDatasources } = require('./repair-orchestration-datasource-split');
+const { mergeOrchestrationTagOperations } = require('./repair-orchestration-tag-merge');
 const { maybeRepairRbac } = require('./repair-rbac');
 const { collectCapabilityOpenApiDriftWarnings } = require('./repair-capability-openapi-warnings');
 const { maybeRunOpenApiSyncForMcp } = require('./repair-openapi-sync');
@@ -169,7 +170,62 @@ async function runDatasourceOpenApiRepairs(ws) {
     changes: ws.changes,
     backupCtx: ws.backupCtx
   });
-  return { datasourceRepairUpdated: datasourceRepairUpdated || splitResult.updated, openapiActionsPerformed };
+  const tagMerge = mergeOrchestrationTagOperations({
+    appPath: ws.appPath,
+    systemKey: ws.systemKey,
+    dryRun: ws.dryRun,
+    changes: ws.changes,
+    backupCtx: ws.backupCtx,
+    options: ws.options
+  });
+  return {
+    datasourceRepairUpdated: datasourceRepairUpdated || splitResult.updated || tagMerge.length > 0,
+    openapiActionsPerformed
+  };
+}
+
+/**
+ * @param {Object} ws
+ * @returns {Promise<Object>}
+ */
+/**
+ * @param {Object} ws
+ * @returns {Object}
+ */
+function runRepairRbacStep(ws) {
+  return maybeRepairRbac(
+    ws.appPath,
+    ws.systemFilePath,
+    ws.systemParsed,
+    ws.datasourceFiles,
+    {
+      rbac: Boolean(ws.options.rbac),
+      rbacFmt: ws.rbacFmt,
+      rbacPreset: ws.options.rbacPreset,
+      dryRun: ws.dryRun,
+      changes: ws.changes,
+      backupCtx: ws.backupCtx
+    }
+  );
+}
+
+/**
+ * @param {Object} ws
+ * @param {Object} steps
+ * @param {boolean} datasourceRepairUpdated
+ * @param {Object} rbac
+ * @returns {boolean}
+ */
+function anyRepairLocalUpdated(ws, steps, datasourceRepairUpdated, rbac) {
+  return Boolean(
+    ws.keysNormalized ||
+      steps.updated ||
+      datasourceRepairUpdated ||
+      rbac.rbacMigratedFromSystem ||
+      rbac.rbacMergeUpdated ||
+      rbac.rbacSyncedIntoSystem ||
+      rbac.rbacSecurityBound
+  );
 }
 
 /**
@@ -198,32 +254,10 @@ async function runRepairIntegrationFileSteps(ws) {
     collectCapabilityOpenApiDriftWarnings(ws.appPath, ws.datasourceFiles, ws.warnings);
   }
   const { datasourceRepairUpdated, openapiActionsPerformed } = await runDatasourceOpenApiRepairs(ws);
-  const { rbacMigratedFromSystem, rbacMergeUpdated, rbacSyncedIntoSystem, rbacSecurityBound } =
-    maybeRepairRbac(
-      ws.appPath,
-      ws.systemFilePath,
-      ws.systemParsed,
-      ws.datasourceFiles,
-      {
-        rbac: Boolean(ws.options.rbac),
-        rbacFmt: ws.rbacFmt,
-        rbacPreset: ws.options.rbacPreset,
-        dryRun: ws.dryRun,
-        changes: ws.changes,
-        backupCtx: ws.backupCtx
-      }
-    );
-  const anyLocalUpdated =
-    ws.keysNormalized ||
-    steps.updated ||
-    datasourceRepairUpdated ||
-    rbacMigratedFromSystem ||
-    rbacMergeUpdated ||
-    rbacSyncedIntoSystem ||
-    rbacSecurityBound;
+  const rbac = runRepairRbacStep(ws);
   return {
     steps,
-    anyLocalUpdated,
+    anyLocalUpdated: anyRepairLocalUpdated(ws, steps, datasourceRepairUpdated, rbac),
     changes: ws.changes,
     warnings: ws.warnings,
     openapiActionsPerformed,

package/lib/commands/repair-openapi-rest-runtime.js

@@ -0,0 +1,127 @@
+/**
+ * Infer published REST restRuntime from a Builder OpenAPI path.
+ *
+ * @fileoverview CIP item routes bind one `{systemKey}` path param as recordIdentifier
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const APP_PACKAGE_ARTIFACT_ID = 'appPackage';
+const BUILDER_API_PREFIX = /^\/api\/v1\/builder/;
+
+/**
+ * Published REST cannot carry extra `{param}` segments except as restRuntime
+ * templates bound from the catch-all item subpath (only recordIdentifier is
+ * canonical). Channel ZIP downloads use the envelope artifact id `appPackage`.
+ * @param {string} segment
+ * @returns {string}
+ */
+function normalizeRestRuntimeSegment(segment) {
+  if (segment === '{artifactId}') {
+    return APP_PACKAGE_ARTIFACT_ID;
+  }
+  if (segment === '{systemKey}') {
+    return '{installationKey}';
+  }
+  return segment;
+}
+
+/**
+ * @param {string} tail
+ * @returns {string[]}
+ */
+function splitNormalizedSegments(tail) {
+  return tail.split('/').filter(Boolean).map(normalizeRestRuntimeSegment);
+}
+
+/**
+ * @param {string} stripped
+ * @returns {{ pathKind: string, subpathSegments: string[] }|undefined}
+ */
+function restRuntimeFromSystemsPath(stripped) {
+  const match = stripped.match(/^\/systems\/\{[^}]+\}\/(.+)$/);
+  if (!match) {
+    return undefined;
+  }
+  const segs = splitNormalizedSegments(match[1]);
+  if (segs.length === 0) {
+    return undefined;
+  }
+  return { pathKind: 'itemSubresource', subpathSegments: segs };
+}
+
+/**
+ * @param {string} stripped
+ * @returns {{ pathKind: string, subpathSegments?: string[] }|undefined}
+ */
+function restRuntimeFromChannelsPath(stripped) {
+  if (/^\/channels\/\{[^}]+\}$/.test(stripped)) {
+    return { pathKind: 'item' };
+  }
+  const match = stripped.match(/^\/channels\/\{[^}]+\}\/(.+)$/);
+  if (!match) {
+    return undefined;
+  }
+  const segs = splitNormalizedSegments(match[1]);
+  if (segs.length === 0) {
+    return undefined;
+  }
+  return { pathKind: 'itemSubresource', subpathSegments: segs };
+}
+
+/**
+ * @param {string} stripped
+ * @returns {{ pathKind: string, subpathSegments: string[] }|undefined}
+ */
+function restRuntimeFromCollectionPath(stripped) {
+  if (stripped.includes('{')) {
+    return undefined;
+  }
+  const match = stripped.match(/^\/[^/]+\/(.+)$/);
+  if (!match) {
+    return undefined;
+  }
+  const segs = match[1].split('/').filter(Boolean);
+  if (segs.length === 0) {
+    return undefined;
+  }
+  return { pathKind: 'collectionSubresource', subpathSegments: segs };
+}
+
+/**
+ * @param {string} vendorPath
+ * @returns {{ pathKind: string, subpathSegments?: string[] }|undefined}
+ */
+function restRuntimeFromVendorPath(vendorPath) {
+  if (typeof vendorPath !== 'string' || !vendorPath.trim()) {
+    return undefined;
+  }
+  const stripped = vendorPath.replace(BUILDER_API_PREFIX, '');
+  return (
+    restRuntimeFromSystemsPath(stripped) ||
+    restRuntimeFromChannelsPath(stripped) ||
+    restRuntimeFromCollectionPath(stripped)
+  );
+}
+
+/**
+ * @param {Object} openapiOp
+ * @returns {Object}
+ */
+function withInferredRestRuntime(openapiOp) {
+  if (!openapiOp || typeof openapiOp !== 'object' || openapiOp.restRuntime) {
+    return openapiOp;
+  }
+  const restRuntime = restRuntimeFromVendorPath(openapiOp.path);
+  if (!restRuntime) {
+    return openapiOp;
+  }
+  return { ...openapiOp, restRuntime };
+}
+
+module.exports = {
+  restRuntimeFromVendorPath,
+  withInferredRestRuntime
+};