@aifabrix/builder 2.53.0 → 2.54.1

package/lib/commands/repair-orchestration-tag-merge.js

@@ -0,0 +1,339 @@
+/**
+ * Merge new tagged OpenAPI operations onto existing split orchestration datasources.
+ *
+ * @fileoverview --api follow-up for builder-api after OpenAPI export
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { CAPABILITIES } = require('../programmatic/capability-registry');
+const { buildOpenApiSpec } = require('../programmatic/openapi-spec');
+const { buildOperationXAfabrix } = require('../programmatic/orchestration-openapi-meta');
+const { getOperationDescription } = require('../programmatic/openapi-descriptions');
+const { isProgrammaticOrchestrationSystem } = require('./repair-openapi-export');
+const { loadConfigFile, writeConfigFile } = require('../utils/config-format');
+const { backupIntegrationFile } = require('../utils/integration-file-backup');
+const { trackRepairWrite } = require('./repair-changed-files');
+const { withInferredRestRuntime } = require('./repair-openapi-rest-runtime');
+
+const DEFAULT_SECURITY = Object.freeze([
+  { oauth2: ['business-transformation'] },
+  { oauth2: ['aifabrix-developer'] },
+  { oauth2: ['aifabrix-platform-admin'] }
+]);
+
+/**
+ * @param {string} handlerId
+ * @returns {string}
+ */
+function manifestKeyForHandler(handlerId) {
+  return String(handlerId || '').trim().toLowerCase();
+}
+
+/**
+ * @param {Object} parsed
+ * @returns {Set<string>}
+ */
+function existingOperationIds(parsed) {
+  const ids = new Set();
+  const ops = parsed && parsed.openapi && parsed.openapi.operations;
+  if (!ops || typeof ops !== 'object') {
+    return ids;
+  }
+  for (const entry of Object.values(ops)) {
+    if (entry && typeof entry.operationId === 'string' && entry.operationId.trim()) {
+      ids.add(entry.operationId.trim());
+    }
+  }
+  return ids;
+}
+
+/**
+ * Copy oauth2 security from a sibling operation on the same datasource.
+ * @param {Object} parsed
+ * @returns {Array<{ oauth2: string[] }>}
+ */
+function securityFromParsed(parsed) {
+  const ops = parsed && parsed.openapi && parsed.openapi.operations;
+  if (ops && typeof ops === 'object') {
+    for (const entry of Object.values(ops)) {
+      if (entry && Array.isArray(entry.security) && entry.security.length > 0) {
+        return entry.security.map((row) => ({
+          oauth2: Array.isArray(row.oauth2) ? [...row.oauth2] : []
+        }));
+      }
+    }
+  }
+  return DEFAULT_SECURITY.map((row) => ({ oauth2: [...row.oauth2] }));
+}
+
+/**
+ * @param {Object} spec
+ * @param {string} handlerId
+ * @returns {{ path: string, method: string, summary: string }|null}
+ */
+function findSpecOperation(spec, handlerId) {
+  const paths = spec && spec.paths && typeof spec.paths === 'object' ? spec.paths : {};
+  for (const [route, methods] of Object.entries(paths)) {
+    if (!methods || typeof methods !== 'object') {
+      continue;
+    }
+    for (const [method, operation] of Object.entries(methods)) {
+      if (operation && operation.operationId === handlerId) {
+        return {
+          path: route,
+          method: String(method).toUpperCase(),
+          summary:
+            (typeof operation.summary === 'string' && operation.summary.trim()) ||
+            getOperationDescription(handlerId).summary
+        };
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * @param {Object} specOp
+ * @param {string} handlerId
+ * @param {Object} parsed
+ * @returns {Object}
+ */
+function buildOpenapiOperation(specOp, handlerId, parsed) {
+  return withInferredRestRuntime({
+    operationId: handlerId,
+    path: specOp.path,
+    method: specOp.method,
+    security: securityFromParsed(parsed)
+  });
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string} key
+ * @param {Object} openapiOp
+ * @returns {boolean}
+ */
+function fillMissingRestRuntime(parsed, key, openapiOp) {
+  const existing = parsed.openapi && parsed.openapi.operations && parsed.openapi.operations[key];
+  if (!existing || existing.restRuntime || !openapiOp || !openapiOp.restRuntime) {
+    return false;
+  }
+  existing.restRuntime = openapiOp.restRuntime;
+  return true;
+}
+
+/**
+ * @param {string} key
+ * @param {string} description
+ * @returns {Object}
+ */
+function buildCipPassthrough(key, description) {
+  return {
+    enabled: true,
+    description,
+    steps: [
+      { fetch: { source: 'openapi', openapiRef: key, query: {} } },
+      { map: { useFieldMappings: true, inputPath: '$' } },
+      { output: { mode: 'records' } }
+    ]
+  };
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string} key
+ * @param {string} description
+ * @returns {boolean}
+ */
+function ensureCapability(parsed, key, description) {
+  if (!Array.isArray(parsed.capabilities)) {
+    parsed.capabilities = [];
+  }
+  if (parsed.capabilities.some((row) => row && row.key === key)) {
+    return false;
+  }
+  parsed.capabilities.push({
+    key,
+    description,
+    riskLevel: 'medium',
+    approvalRequired: false
+  });
+  return true;
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string} key
+ * @param {Object} openapiOp
+ * @param {string} description
+ * @returns {string[]}
+ */
+function ensureCipScaffold(parsed) {
+  if (!parsed.openapi || typeof parsed.openapi !== 'object') {
+    parsed.openapi = {};
+  }
+  if (!parsed.openapi.operations || typeof parsed.openapi.operations !== 'object') {
+    parsed.openapi.operations = {};
+  }
+  if (!parsed.execution) {
+    parsed.execution = { engine: 'cip', cip: { version: '1.0', operations: {} } };
+  }
+  if (!parsed.execution.cip) {
+    parsed.execution.cip = { version: '1.0', operations: {} };
+  }
+  if (!parsed.execution.cip.operations) {
+    parsed.execution.cip.operations = {};
+  }
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string} key
+ * @param {Object} openapiOp
+ * @param {string} description
+ * @returns {string[]}
+ */
+function mergeOneOperation(parsed, key, openapiOp, description) {
+  const added = [];
+  ensureCipScaffold(parsed);
+  if (ensureCapability(parsed, key, description)) {
+    added.push(`capabilities.${key}`);
+  }
+  if (!parsed.openapi.operations[key]) {
+    parsed.openapi.operations[key] = withInferredRestRuntime(openapiOp);
+    added.push(`openapi.operations.${key}`);
+  } else if (fillMissingRestRuntime(parsed, key, withInferredRestRuntime(openapiOp))) {
+    added.push(`openapi.operations.${key}.restRuntime`);
+  }
+  if (!parsed.execution.cip.operations[key]) {
+    parsed.execution.cip.operations[key] = buildCipPassthrough(key, description);
+    added.push(`execution.cip.operations.${key}`);
+  }
+  return added;
+}
+
+/**
+ * @param {string} appPath
+ * @param {string} systemKey
+ * @param {string} tag
+ * @returns {string}
+ */
+function tagDatasourcePath(appPath, systemKey, tag) {
+  return path.join(appPath, `${systemKey}-datasource-${tag}.json`);
+}
+
+/**
+ * @param {Map<string, Object|null>} cache
+ * @param {string} appPath
+ * @param {string} systemKey
+ * @param {string} tag
+ * @returns {{ filePath: string, parsed: Object, dirty: boolean }|null}
+ */
+function loadTagEntry(cache, appPath, systemKey, tag) {
+  const filePath = tagDatasourcePath(appPath, systemKey, tag);
+  if (cache.has(filePath)) {
+    return cache.get(filePath);
+  }
+  if (!fs.existsSync(filePath)) {
+    cache.set(filePath, null);
+    return null;
+  }
+  const entry = { filePath, parsed: loadConfigFile(filePath), dirty: false };
+  cache.set(filePath, entry);
+  return entry;
+}
+
+/**
+ * @param {Map<string, Object|null>} cache
+ * @param {boolean} dryRun
+ * @param {Object} backupCtx
+ * @returns {void}
+ */
+function persistDirtyEntries(cache, dryRun, backupCtx) {
+  for (const entry of cache.values()) {
+    if (!entry || !entry.dirty) {
+      continue;
+    }
+    if (!dryRun) {
+      backupIntegrationFile(entry.filePath, backupCtx);
+      writeConfigFile(entry.filePath, entry.parsed);
+    }
+    trackRepairWrite(entry.filePath, { ...(backupCtx || {}), dryRun: Boolean(dryRun) });
+  }
+}
+
+/**
+ * @param {Map<string, Object|null>} cache
+ * @param {Object} spec
+ * @param {Object} capability
+ * @param {string} appPath
+ * @param {string} systemKey
+ * @returns {string[]}
+ */
+function mergeCapabilityIntoCache(cache, spec, capability, appPath, systemKey) {
+  const tag = buildOperationXAfabrix(capability).datasourceTag;
+  if (tag !== 'infra') {
+    return [];
+  }
+  const entry = loadTagEntry(cache, appPath, systemKey, tag);
+  if (!entry) {
+    return [];
+  }
+  const specOp = findSpecOperation(spec, capability.handlerId);
+  if (!specOp) {
+    return [];
+  }
+  const key = manifestKeyForHandler(capability.handlerId);
+  const openapiOp = buildOpenapiOperation(specOp, capability.handlerId, entry.parsed);
+  if (existingOperationIds(entry.parsed).has(capability.handlerId)) {
+    if (!fillMissingRestRuntime(entry.parsed, key, openapiOp)) {
+      return [];
+    }
+    entry.dirty = true;
+    return [`${path.basename(entry.filePath)}: openapi.operations.${key}.restRuntime`];
+  }
+  const added = mergeOneOperation(entry.parsed, key, openapiOp, specOp.summary);
+  if (added.length > 0) {
+    entry.dirty = true;
+  }
+  return added.map((part) => `${path.basename(entry.filePath)}: ${part}`);
+}
+
+/**
+ * Merge missing infra-tagged OpenAPI operations onto the existing infra datasource.
+ * Does not create new split files (package/branding stay on the channel tag).
+ * @param {Object} params
+ * @returns {string[]}
+ */
+function mergeOrchestrationTagOperations(params) {
+  const { appPath, systemKey, dryRun, changes, backupCtx, options } = params;
+  if (!isProgrammaticOrchestrationSystem(systemKey)) {
+    return [];
+  }
+  if (!options || !options.api) {
+    return [];
+  }
+  const spec = buildOpenApiSpec();
+  const cache = new Map();
+  const added = [];
+  for (const capability of CAPABILITIES) {
+    added.push(...mergeCapabilityIntoCache(cache, spec, capability, appPath, systemKey));
+  }
+  persistDirtyEntries(cache, dryRun, backupCtx);
+  if (Array.isArray(changes)) {
+    added.forEach((line) => changes.push(line));
+  }
+  return added;
+}
+
+module.exports = {
+  manifestKeyForHandler,
+  existingOperationIds,
+  mergeOneOperation,
+  mergeOrchestrationTagOperations
+};

package/lib/commands/repair-rbac-catalog-defaults.js

@@ -0,0 +1,96 @@
+/**
+ * Catalog Admin/Observer defaults for Connected System RBAC.
+ *
+ * @fileoverview Upload requires COM catalog keys — never invent {systemKey}-admin
+ */
+
+'use strict';
+
+const {
+  listPlatformRoles,
+  ROLE_PLATFORM_ADMIN,
+  ROLE_OBSERVER
+} = require('../programmatic/platform-rbac-catalog');
+
+const CATALOG_ADMIN_ROLE = ROLE_PLATFORM_ADMIN;
+const CATALOG_READER_ROLE = ROLE_OBSERVER;
+
+/**
+ * @returns {Array<{ name: string, value: string, description: string, groups: string[] }>}
+ */
+function catalogAdminReaderRoles() {
+  const all = listPlatformRoles();
+  const admin = all.find((r) => r.value === CATALOG_ADMIN_ROLE);
+  const reader = all.find((r) => r.value === CATALOG_READER_ROLE);
+  return [admin, reader].filter(Boolean);
+}
+
+/**
+ * @param {string[]} roleValuesList
+ * @param {string} [systemKey]
+ * @param {string|null} [fallback]
+ * @returns {string|null}
+ */
+function pickCatalogAdminRoleValue(roleValuesList, systemKey, fallback) {
+  const values = Array.isArray(roleValuesList) ? roleValuesList : [];
+  return (
+    values.find((v) => v === CATALOG_ADMIN_ROLE) ||
+    (systemKey ? values.find((v) => v === `${systemKey}-admin`) : undefined) ||
+    values.find((v) => typeof v === 'string' && v.endsWith('-admin')) ||
+    fallback ||
+    values[0] ||
+    null
+  );
+}
+
+/**
+ * @param {string[]} roleValuesList
+ * @param {string} [systemKey]
+ * @param {string|null} [fallback]
+ * @returns {string|null}
+ */
+function pickCatalogReaderRoleValue(roleValuesList, systemKey, fallback) {
+  const values = Array.isArray(roleValuesList) ? roleValuesList : [];
+  return (
+    values.find((v) => v === CATALOG_READER_ROLE) ||
+    (systemKey ? values.find((v) => v === `${systemKey}-reader`) : undefined) ||
+    values.find((v) => typeof v === 'string' && v.endsWith('-reader')) ||
+    fallback ||
+    null
+  );
+}
+
+/**
+ * Ensures catalog Admin/Reader roles if rbac.roles is empty. Mutates rbac.
+ * @param {Object} rbac
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function ensureDefaultRoles(rbac, changes) {
+  const hasRoles = Array.isArray(rbac.roles) && rbac.roles.length > 0;
+  if (hasRoles) return false;
+  const seeded = catalogAdminReaderRoles();
+  if (seeded.length < 2) return false;
+  rbac.roles = seeded;
+  const listGetPerms = (rbac.permissions || [])
+    .filter((p) => p?.name && (p.name.split(':')[1] === 'list' || p.name.split(':')[1] === 'get'))
+    .map((p) => p.name);
+  for (const p of rbac.permissions || []) {
+    if (!p.roles) p.roles = [];
+    if (p.name && listGetPerms.includes(p.name) && !p.roles.includes(CATALOG_READER_ROLE)) {
+      p.roles.push(CATALOG_READER_ROLE);
+    }
+    if (!p.roles.includes(CATALOG_ADMIN_ROLE)) p.roles.push(CATALOG_ADMIN_ROLE);
+  }
+  changes.push('Added catalog Admin and Reader roles to rbac file');
+  return true;
+}
+
+module.exports = {
+  CATALOG_ADMIN_ROLE,
+  CATALOG_READER_ROLE,
+  catalogAdminReaderRoles,
+  pickCatalogAdminRoleValue,
+  pickCatalogReaderRoleValue,
+  ensureDefaultRoles
+};

package/lib/commands/repair-rbac-platform-preset.js

@@ -1,5 +1,5 @@
 /**
- * Platform RBAC preset for orchestration facade external systems (plan 154.7).
+ * Platform RBAC preset for orchestration facade external systems.
  *
  * @fileoverview Replace per-system admin/reader with dataplane platform roles
  * @author AI Fabrix Team
@@ -13,29 +13,40 @@ const fs = require('fs');
 const { loadConfigFile, writeConfigFile } = require('../utils/config-format');
 const { backupIntegrationFile } = require('../utils/integration-file-backup');
 const { CAPABILITIES } = require('../programmatic/capability-registry');
-const { listPlatformRoles, PLATFORM_ROLE_VALUES } = require('../programmatic/platform-rbac-catalog');
+const {
+  listPlatformRoles,
+  PLATFORM_ROLE_VALUES,
+  ROLE_OBSERVER,
+  ROLE_EXTERNAL_SYSTEM_DISCOVERER,
+  ROLE_DEVELOPER,
+  ROLE_DEPLOYMENT_ADMIN,
+  ROLE_PLATFORM_ADMIN,
+  ROLE_SECURITY_ADMIN,
+  ROLE_COMPLIANCE_ADMIN,
+  ROLE_AI_TRUST_OPERATOR
+} = require('../programmatic/platform-rbac-catalog');
 
 const READ_ROLES = Object.freeze([
-  'aifabrix-observer',
-  'aifabrix-external-system-discoverer',
-  'aifabrix-developer',
-  'aifabrix-deployment-admin',
-  'aifabrix-platform-admin'
+  ROLE_OBSERVER,
+  ROLE_EXTERNAL_SYSTEM_DISCOVERER,
+  ROLE_DEVELOPER,
+  ROLE_DEPLOYMENT_ADMIN,
+  ROLE_PLATFORM_ADMIN
 ]);
 
 const WRITE_ROLES = Object.freeze([
-  'aifabrix-developer',
-  'aifabrix-deployment-admin',
-  'aifabrix-platform-admin'
+  ROLE_DEVELOPER,
+  ROLE_DEPLOYMENT_ADMIN,
+  ROLE_PLATFORM_ADMIN
 ]);
 
-const APPLY_ROLES = Object.freeze(['aifabrix-deployment-admin', 'aifabrix-platform-admin']);
+const APPLY_ROLES = Object.freeze([ROLE_DEPLOYMENT_ADMIN, ROLE_PLATFORM_ADMIN]);
 
 const CERTIFY_ROLES = Object.freeze([
-  'aifabrix-security-admin',
-  'aifabrix-compliance-admin',
-  'aifabrix-ai-trust-operator',
-  'aifabrix-platform-admin'
+  ROLE_SECURITY_ADMIN,
+  ROLE_COMPLIANCE_ADMIN,
+  ROLE_AI_TRUST_OPERATOR,
+  ROLE_PLATFORM_ADMIN
 ]);
 
 /** @type {ReadonlyMap<string, string>} */

package/lib/commands/repair-rbac-reader-roles.js

@@ -11,6 +11,10 @@
 const fs = require('fs');
 const path = require('path');
 const { loadConfigFile } = require('../utils/config-format');
+const {
+  pickCatalogAdminRoleValue,
+  pickCatalogReaderRoleValue
+} = require('./repair-rbac-catalog-defaults');
 
 const READ_ONLY_HTTP_METHODS = new Set(['GET', 'HEAD']);
 
@@ -19,23 +23,6 @@ function roleValues(rbac) {
   return roles.map((r) => r?.value).filter((v) => typeof v === 'string' && v.trim());
 }
 
-function pickAdminRoleValue(roleValuesList, systemKey) {
-  return (
-    roleValuesList.find((v) => v === `${systemKey}-admin`) ||
-    roleValuesList.find((v) => /-admin$/.test(v)) ||
-    roleValuesList[0] ||
-    null
-  );
-}
-
-function pickReaderRoleValue(roleValuesList, systemKey) {
-  return (
-    roleValuesList.find((v) => v === `${systemKey}-reader`) ||
-    roleValuesList.find((v) => /-reader$/.test(v)) ||
-    null
-  );
-}
-
 function capabilityFromPermissionName(name) {
   if (typeof name !== 'string' || !name.includes(':')) return null;
   return name.split(':')[1] || null;
@@ -71,8 +58,8 @@ function ensureNonEmptyPermissionRoles(rbac, systemKey, changes) {
   const values = roleValues(rbac);
   if (!Array.isArray(rbac.permissions) || values.length === 0) return false;
 
-  const adminValue = pickAdminRoleValue(values, systemKey);
-  const readerValue = pickReaderRoleValue(values, systemKey);
+  const adminValue = pickCatalogAdminRoleValue(values, systemKey);
+  const readerValue = pickCatalogReaderRoleValue(values, systemKey);
   let updated = false;
 
   for (const perm of rbac.permissions) {
@@ -103,8 +90,8 @@ function ensureNonEmptyPermissionRoles(rbac, systemKey, changes) {
  */
 function ensureReaderRoleOnReadPermissions(rbac, appPath, datasourceFiles, systemKey, changes) {
   const values = roleValues(rbac);
-  const readerValue = pickReaderRoleValue(values, systemKey);
-  const adminValue = pickAdminRoleValue(values, systemKey);
+  const readerValue = pickCatalogReaderRoleValue(values, systemKey);
+  const adminValue = pickCatalogAdminRoleValue(values, systemKey);
   if (!readerValue || !adminValue) return false;
   if (!Array.isArray(rbac.permissions) || rbac.permissions.length === 0) return false;
 

package/lib/commands/repair-rbac.js

@@ -29,6 +29,7 @@ const {
   ensureOrchestrationResourceType
 } = require('./repair-rbac-platform-preset');
 const { trackRepairWrite } = require('./repair-changed-files');
+const { ensureDefaultRoles } = require('./repair-rbac-catalog-defaults');
 
 const DEFAULT_CAPABILITIES = ['list', 'get', 'create', 'update', 'delete'];
 
@@ -269,48 +270,23 @@ function addMissingPermissions(rbac, permissionNames, changes) {
   return updated;
 }
 
-/**
- * Ensures default Admin and Reader roles if rbac.roles is empty. Mutates rbac.
- * @param {Object} rbac - RBAC object (mutated)
- * @param {string} systemKey - System key
- * @param {string} displayName - Display name
- * @param {string[]} changes - Array to append to
- * @returns {boolean}
- */
-function ensureDefaultRoles(rbac, systemKey, displayName, changes) {
-  const hasRoles = Array.isArray(rbac.roles) && rbac.roles.length > 0;
-  if (hasRoles) return false;
-  const adminValue = `${systemKey}-admin`;
-  const readerValue = `${systemKey}-reader`;
-  rbac.roles = [
-    { name: `${displayName} Admin`, value: adminValue, description: `Full access to all ${displayName} operations`, groups: [] },
-    { name: `${displayName} Reader`, value: readerValue, description: `Read-only access to all ${displayName} data`, groups: [] }
-  ];
-  const listGetPerms = (rbac.permissions || [])
-    .filter(p => p?.name && (p.name.split(':')[1] === 'list' || p.name.split(':')[1] === 'get'))
-    .map(p => p.name);
-  for (const p of rbac.permissions || []) {
-    if (!p.roles) p.roles = [];
-    if (p.name && listGetPerms.includes(p.name) && !p.roles.includes(readerValue)) p.roles.push(readerValue);
-    if (!p.roles.includes(adminValue)) p.roles.push(adminValue);
-  }
-  changes.push('Added default Admin and Reader roles to rbac file');
-  return true;
-}
-
 /**
  * @param {Object} opts
  * @returns {boolean}
  */
 function applyRbacPresetRoles(opts) {
-  const { rbac, rbacPreset, systemKey, displayName, appPath, datasourceFiles, changes } = opts;
+  const { rbac, rbacPreset, appPath, datasourceFiles, changes } = opts;
   if (rbacPreset === 'platform') {
-    return (
-      ensurePlatformRolesOnRbac(rbac, changes) ||
-      applyPlatformRolesToPermissions(rbac, appPath, datasourceFiles, changes)
+    const rolesUpdated = ensurePlatformRolesOnRbac(rbac, changes);
+    const permsUpdated = applyPlatformRolesToPermissions(
+      rbac,
+      appPath,
+      datasourceFiles,
+      changes
     );
+    return rolesUpdated || permsUpdated;
   }
-  return ensureDefaultRoles(rbac, systemKey, displayName, changes);
+  return ensureDefaultRoles(rbac, changes);
 }
 
 /**

package/lib/commands/repair-system-permissions.js

@@ -9,6 +9,11 @@
 const path = require('path');
 const fs = require('fs');
 const { loadConfigFile } = require('../utils/config-format');
+const {
+  catalogAdminReaderRoles,
+  pickCatalogAdminRoleValue,
+  pickCatalogReaderRoleValue
+} = require('./repair-rbac-catalog-defaults');
 
 function _safeString(v) {
   return typeof v === 'string' && v.trim() ? v.trim() : '';
@@ -23,32 +28,29 @@ function _normalizeOperationKey(opKey) {
   return cleaned.replace(/-+/g, '-').replace(/^-+|-+$/g, '');
 }
 
-function _ensureDefaultRoles(systemParsed, systemKey) {
+function _roleValuesFromSystem(systemParsed) {
+  const roles = Array.isArray(systemParsed.roles) ? systemParsed.roles : [];
+  return roles
+    .map((r) => (r && typeof r === 'object' ? _safeString(r.value) : ''))
+    .filter(Boolean);
+}
+
+function _ensureDefaultRoles(systemParsed) {
   if (Array.isArray(systemParsed.roles) && systemParsed.roles.length > 0) return false;
-  const key = _safeString(systemKey) || _safeString(systemParsed?.key) || 'system';
-  const display = _safeString(systemParsed?.displayName) || key;
-  systemParsed.roles = [
-    {
-      name: `${display} Admin`,
-      value: `${key}-admin`,
-      description: `Full access to all ${display} operations`,
-      groups: []
-    },
-    {
-      name: `${display} Reader`,
-      value: `${key}-reader`,
-      description: `Read-only access to all ${display} data`,
-      groups: []
-    }
-  ];
+  const seeded = catalogAdminReaderRoles();
+  if (seeded.length < 2) return false;
+  systemParsed.roles = seeded;
   return true;
 }
 
 function _pickRoleValue(systemParsed, suffix, fallback) {
-  const roles = Array.isArray(systemParsed.roles) ? systemParsed.roles : [];
-  const vals = roles
-    .map((r) => r && typeof r === 'object' ? _safeString(r.value) : '')
-    .filter(Boolean);
+  const vals = _roleValuesFromSystem(systemParsed);
+  if (suffix === '-admin') {
+    return pickCatalogAdminRoleValue(vals, undefined, fallback);
+  }
+  if (suffix === '-reader') {
+    return pickCatalogReaderRoleValue(vals, undefined, vals[0] || fallback);
+  }
   return vals.find((v) => v.endsWith(suffix)) || vals[0] || fallback;
 }
 
@@ -145,7 +147,7 @@ function ensureSystemPermissionsForAutoRbac(appPath, systemParsed, datasourceFil
   const desired = _collectAutoRbacOperationPermissions(appPath, datasourceFiles);
   if (desired.size === 0) return false;
 
-  const rolesAdded = _ensureDefaultRoles(systemParsed, systemParsed?.key);
+  const rolesAdded = _ensureDefaultRoles(systemParsed);
   if (rolesAdded) {
     changes.push('Added default Admin/Reader roles (required for RBAC permissions)');
   }