@aifabrix/builder 2.53.1 → 2.55.0

package/lib/commands/channel-configure.js

@@ -0,0 +1,118 @@
+/**
+ * Register `channel configure` (callback URL on the existing Integration Client).
+ *
+ * @fileoverview Thin wrapper over Integration Client redirect URI update
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const {
+  formatWarningLine,
+  formatBlockingError
+} = require('../utils/cli-layout-chalk');
+const { printCallbackRegistered } = require('../channels/channel-add-tty');
+const { isChannelTargetKey, formatUnknownChannelTargetError } = require('../channels/channel-targets');
+const { resolveChannelAuthContext } = require('../channels/channel-auth-context');
+const { registerChatGptCallbackUrl } = require('../channels/chatgpt-callback');
+const { runChatGptConfigureValidate } = require('../channels/chatgpt-channel-add');
+const { registerClaudeCallbackUrl } = require('../channels/claude-callback');
+const { runClaudeConfigureValidate } = require('../channels/claude-channel-add');
+
+const CONFIGURE_TARGETS = new Set(['chatgpt', 'claude']);
+
+const CHANNEL_CONFIGURE_HELP_AFTER = `
+Examples:
+  $ aifabrix channel configure chatgpt --callback-url "https://chatgpt.com/connector/oauth/callback"
+  $ aifabrix channel configure claude --callback-url "https://claude.ai/api/mcp/auth_callback"
+
+Registers an HTTPS OAuth callback on the existing ChatGPT or Claude Integration Client.
+Does not rotate the client secret. Extra redirect URIs are preserved.
+
+Requires: aifabrix login and integration-client:read plus integration-client:update
+`;
+
+/**
+ * @param {string} channelTarget
+ * @param {Object} ctx
+ * @param {string} callbackUrl
+ * @returns {Promise<Object>}
+ */
+async function registerConfigureCallback(channelTarget, ctx, callbackUrl) {
+  if (channelTarget === 'claude') {
+    return registerClaudeCallbackUrl({ ctx, callbackUrl });
+  }
+  return registerChatGptCallbackUrl({ ctx, callbackUrl });
+}
+
+/**
+ * @param {string} channelTarget
+ * @param {Object} ctx
+ * @returns {Promise<void>}
+ */
+async function validateAfterConfigure(channelTarget, ctx) {
+  if (channelTarget === 'claude') {
+    await runClaudeConfigureValidate(ctx);
+    return;
+  }
+  await runChatGptConfigureValidate(ctx);
+}
+
+/**
+ * @param {string} channelTarget
+ * @param {Object} options
+ * @returns {Promise<void>}
+ */
+async function runChannelConfigure(channelTarget, options = {}) {
+  if (!isChannelTargetKey(channelTarget)) {
+    throw new Error(formatUnknownChannelTargetError(channelTarget));
+  }
+  if (!CONFIGURE_TARGETS.has(channelTarget)) {
+    throw new Error(
+      `channel configure currently supports chatgpt and claude. Received "${channelTarget}".`
+    );
+  }
+  const callbackUrl =
+    typeof options.callbackUrl === 'string' ? options.callbackUrl.trim() : '';
+  if (!callbackUrl) {
+    throw new Error(`--callback-url is required for channel configure ${channelTarget}.`);
+  }
+  const ctx = await resolveChannelAuthContext(channelTarget, { silent: true });
+  const result = await registerConfigureCallback(channelTarget, ctx, callbackUrl);
+  if (result.fallback) {
+    logger.log(
+      formatWarningLine(
+        `Missing integration-client:update. Add the callback on the ${channelTarget} profile: ${result.profileUrl}`
+      )
+    );
+    return;
+  }
+  printCallbackRegistered();
+  await validateAfterConfigure(channelTarget, ctx);
+}
+
+/**
+ * @param {import('commander').Command} parent
+ * @returns {import('commander').Command}
+ */
+function registerChannelConfigureCommand(parent) {
+  return parent
+    .command('configure <channelTarget>')
+    .description('Register a ChatGPT or Claude callback URL on the existing OAuth2 profile')
+    .option('--callback-url <url>', 'HTTPS redirect URI from ChatGPT or Claude OAuth')
+    .addHelpText('after', CHANNEL_CONFIGURE_HELP_AFTER)
+    .action(async(channelTarget, options) => {
+      try {
+        await runChannelConfigure(channelTarget, options);
+      } catch (error) {
+        logger.error(formatBlockingError(error.message || String(error)));
+        process.exit(1);
+      }
+    });
+}
+
+module.exports = {
+  CHANNEL_CONFIGURE_HELP_AFTER,
+  registerChannelConfigureCommand,
+  runChannelConfigure
+};

package/lib/commands/channel.js

@@ -22,15 +22,23 @@ const {
 } = require('../channels/channel-targets');
 const { scaffoldChannelIntegration } = require('../channels/channel-integration-generator');
 const { registerChannelAddCommand } = require('./channel-add-setup');
+const { registerChannelConfigureCommand } = require('./channel-configure');
 
 const CHANNEL_HELP_AFTER = `
 Subcommands:
-  add <target>        One command: scaffold (if needed) → upload (if needed/--force) → install
+  add [target]        One command: scaffold (if needed) → upload (if needed/--force) → install
+  configure chatgpt   Register the ChatGPT callback URL on the existing OAuth2 profile
   scaffold <target>   Optional: create integration/<target>/ files only (local)
 
 ${formatSupportedChannelTargetsHelp()}
 
+Examples:
+  $ aifabrix channel add
+  $ aifabrix channel add slack --name "Elsa" --probe
+  $ aifabrix channel configure chatgpt --callback-url "https://chatgpt.com/connector/oauth/callback"
+
 Typical flow:
+  aifabrix channel add
   aifabrix channel add slack --name "Elsa" --probe
 
   # Force re-upload of the communication system, then reinstall channel
@@ -102,6 +110,7 @@ function setupChannelCommands(program) {
     });
 
   registerChannelAddCommand(channel);
+  registerChannelConfigureCommand(channel);
 }
 
 module.exports = { setupChannelCommands };

package/lib/commands/datasource-capability-relate-cli.js

@@ -18,9 +18,10 @@ const { runCapabilityRelate } = require('../datasource/capability/run-capability
 const { printCapabilitySuccessFooter } = require('./datasource-capability-output');
 
 const CAP_RELATE_HELP = `
-Adds or replaces one **foreignKeys[]** row (metadata-only; no pipeline). Optional **metadataSchema.properties** stub unless **--skip-metadata-property**.
+Adds or replaces one **foreignKeys[]** row (metadata-only; no pipeline). Optional **metadataSchema.properties** stub unless **--skip-metadata-property**. **--relation-name** defaults to the carrier **--field**.
 
-  $ aifabrix datasource capability relate hubspot-deals --relation-name company --to hubspot-companies --field companyId --target-field externalId
+  $ aifabrix datasource capability relate pkg-a-facts --to pkg-b-persons --field personId
+  $ aifabrix datasource capability relate pkg-a-facts --relation-name personId --to pkg-b-persons --field personId --target-field externalId
 `;
 
 function parseTargetFields(raw) {
@@ -103,8 +104,8 @@ function setupCapabilityRelateCommand(cap) {
     .description(
       'Add or replace foreignKeys[] metadata (+ optional metadataSchema property for relation name)'
     )
-    .requiredOption('--relation-name <name>', 'FK name (camelCase; unique per datasource)')
-    .requiredOption('--to <targetDatasource>', 'Target datasource key (cross-system JSON key)')
+    .option('--relation-name <name>', 'FK name (camelCase; defaults to --field)')
+    .requiredOption('--to <targetDatasource>', 'Target datasource key (sibling packages resolve by key)')
     .requiredOption('--field <name>', 'Local normalized attribute (foreignKeys.fields[])')
     .option('--description <text>', 'FK description (defaults to a generated description)')
     .option('--required', 'Mark FK required (foreignKeys[].required=true)')

package/lib/commands/governance-upload-external.js

@@ -4,7 +4,10 @@
 
 'use strict';
 
-const { uploadGovernanceScenarioPacks } = require('../lifecycle/scenario-upload');
+const {
+  uploadGovernanceScenarioPacks,
+  normalizeGovernanceUploadResult
+} = require('../lifecycle/scenario-upload');
 const { resolveGovernanceIntegrationContext } = require('./governance-cli-shared');
 
 /**
@@ -18,7 +21,7 @@ async function runGovernanceUploadForExternalSystem(systemKey, options = {}) {
     systemKey,
     options
   );
-  const uploaded = await uploadGovernanceScenarioPacks(
+  const result = await uploadGovernanceScenarioPacks(
     resolvedKey,
     dataplaneUrl,
     authConfig,
@@ -27,7 +30,7 @@ async function runGovernanceUploadForExternalSystem(systemKey, options = {}) {
   return {
     systemKey: resolvedKey,
     command: 'governance upload',
-    uploaded
+    ...normalizeGovernanceUploadResult(result)
   };
 }
 

package/lib/commands/lifecycle-command-action.js

@@ -14,6 +14,7 @@ const { displayLifecycleReportTTY } = require('../lifecycle/report-display');
 const { VERDICT } = require('../lifecycle/product-model');
 const { exitCodeFromVerdict } = require('../lifecycle/exit-codes');
 const { lifecycleHasGovernanceSubjects } = require('../lifecycle/lifecycle-governance-options');
+const { lifecyclePillarSatisfied } = require('../lifecycle/role-assistant-governance');
 
 /**
  * @param {Object} options
@@ -48,11 +49,7 @@ function lifecycleVerdictFromReport(report) {
   if (ops === VERDICT.FAILED || trust === VERDICT.FAILED || gov === VERDICT.FAILED) {
     return VERDICT.FAILED;
   }
-  if (
-    ops === VERDICT.VERIFIED &&
-    trust === VERDICT.VERIFIED &&
-    gov === VERDICT.VERIFIED
-  ) {
+  if (lifecyclePillarSatisfied(ops) && lifecyclePillarSatisfied(trust) && lifecyclePillarSatisfied(gov)) {
     return VERDICT.VERIFIED;
   }
   return VERDICT.NOT_VERIFIED;

package/lib/commands/lifecycle-external.js

@@ -24,6 +24,8 @@ const {
   lifecycleGovernanceNeedsWork,
   buildGovernanceOptsFromLifecycle
 } = require('../lifecycle/lifecycle-governance-options');
+const { remapRoleAssistantGovernanceReport } = require('../lifecycle/role-assistant-governance');
+const { isRoleAssistantWorkspace } = require('../utils/platform-shell-package');
 
 /**
  * @async
@@ -76,6 +78,9 @@ async function runLifecycleGovernanceCombinedIfNeeded(
   dataplaneUrl,
   options
 ) {
+  if (options.skipConnectedSystemGovernance === true) {
+    return;
+  }
   if (!lifecycleHasGovernanceSubjects(options)) {
     return;
   }
@@ -100,16 +105,21 @@ async function runMissingVerifyStepsLocally(systemKey, report, options) {
   const runOpts = { ...options, noPublish: true };
   const pathsUtil = require('../utils/paths');
   const appType = await pathsUtil.detectAppType(systemKey).catch(() => null);
-  const isRoleAssistantPackage = appType?.baseDir === 'role-assistant';
-  // verify-operations is integration/-only; Role Assistant packages use dataplane lifecycle report.
+  const isRoleAssistantPackage =
+    options.skipConnectedSystemGovernance === true || isRoleAssistantWorkspace(appType && appType.baseDir);
+  // verify-operations / CS governance packs are integration/-only.
+  // Role Assistant isolation is Work Hub cases + role-assistant.yaml.
   if (report.operations?.verdict !== VERDICT.VERIFIED && !isRoleAssistantPackage) {
     await runVerifyOperationsForExternalSystem(systemKey, runOpts);
   }
-  if (report.trust?.verdict !== VERDICT.VERIFIED) {
+  if (report.trust?.verdict !== VERDICT.VERIFIED && !isRoleAssistantPackage) {
     await runVerifyTrustForExternalSystem(systemKey, runOpts);
   }
-  if (report.governance?.verdict !== VERDICT.VERIFIED
-    && report.governance?.verdict !== VERDICT.NOT_APPLICABLE) {
+  if (
+    !isRoleAssistantPackage &&
+    report.governance?.verdict !== VERDICT.VERIFIED &&
+    report.governance?.verdict !== VERDICT.NOT_APPLICABLE
+  ) {
     if (lifecycleHasGovernanceSubjects(options)) {
       const { runVerifyGovernanceCombined } = require('./verify-governance-combined-external');
       await runVerifyGovernanceCombined(
@@ -143,15 +153,17 @@ async function buildLifecycleResult(
   authConfig,
   extra = {}
 ) {
+  const mappedReport =
+    extra.roleAssistant === true ? remapRoleAssistantGovernanceReport(report) : report;
   const openApiPublished = await resolveOpenApiPublished(dataplaneUrl, authConfig, systemKey);
   return {
     systemKey,
     command: 'lifecycle',
-    report,
+    report: mappedReport,
     dataplaneUrl,
     dataplaneUiBaseUrl,
     openApiPublished,
-    certificationProgress: buildCertificationProgress(report, { openApiPublished }),
+    certificationProgress: buildCertificationProgress(mappedReport, { openApiPublished }),
     ...extra
   };
 }
@@ -191,7 +203,58 @@ async function runLifecycleViaDataplaneApi(
     dataplaneUrl,
     dataplaneUiBaseUrl,
     authConfig,
-    { stepsRun: runRes.stepsRun || [], source: 'api' }
+    {
+      stepsRun: runRes.stepsRun || [],
+      source: 'api',
+      roleAssistant: options.roleAssistant === true
+    }
+  );
+}
+
+function emptyRoleAssistantLifecycleReport(systemKey) {
+  return {
+    systemKey,
+    operations: { verdict: VERDICT.NOT_APPLICABLE },
+    trust: { verdict: VERDICT.NOT_APPLICABLE },
+    governance: { verdict: VERDICT.NOT_APPLICABLE },
+    recommendations: [],
+    warnings: [
+      {
+        code: 'ROLE_ASSISTANT_LIFECYCLE_REPORT_UNAVAILABLE',
+        message:
+          'Lifecycle report unavailable. Role Assistant cases still run against the published worker.'
+      }
+    ]
+  };
+}
+
+/**
+ * Role Assistant prove uses the published dataplane worker.
+ * Do not POST CS lifecycle/run or fall back to verify-trust (those paths need application.yaml).
+ * @async
+ */
+async function fetchRoleAssistantLifecycleResult(
+  systemKey,
+  authConfig,
+  dataplaneUrl,
+  dataplaneUiBaseUrl,
+  options
+) {
+  let report;
+  try {
+    report = await getSystemLifecycleReport(dataplaneUrl, authConfig, systemKey, {
+      details: options.verbose === true
+    });
+  } catch {
+    report = emptyRoleAssistantLifecycleReport(systemKey);
+  }
+  return buildLifecycleResult(
+    systemKey,
+    report,
+    dataplaneUrl,
+    dataplaneUiBaseUrl,
+    authConfig,
+    { source: 'api', roleAssistant: true }
   );
 }
 
@@ -205,6 +268,16 @@ async function executeLifecycleWork(systemKey, options = {}) {
   const { authConfig, dataplaneUrl } = await resolveLifecycleAuth(systemKey, options);
   const dataplaneUiBaseUrl = await resolveLifecycleDataplaneUiBaseUrl(dataplaneUrl);
 
+  if (options.roleAssistant === true) {
+    return fetchRoleAssistantLifecycleResult(
+      systemKey,
+      authConfig,
+      dataplaneUrl,
+      dataplaneUiBaseUrl,
+      options
+    );
+  }
+
   if (options.run === true) {
     try {
       return await runLifecycleViaDataplaneApi(
@@ -235,7 +308,10 @@ async function executeLifecycleWork(systemKey, options = {}) {
     dataplaneUrl,
     dataplaneUiBaseUrl,
     authConfig,
-    { source: options.run ? 'local-fallback' : 'api' }
+    {
+      source: options.run ? 'local-fallback' : 'api',
+      roleAssistant: options.roleAssistant === true
+    }
   );
 }
 
@@ -251,26 +327,22 @@ async function runLifecycleForExternalSystem(systemKey, options = {}) {
   const appType = await pathsUtil.detectAppType(systemKey).catch(() => null);
   assertCertifyExternalWorkspace(appType && appType.baseDir, 'lifecycle');
 
-  let resolvedKey = systemKey;
-  if (appType.baseDir === 'role-assistant') {
-    const { resolveExternalIntegrationContext } = require('./test-e2e-external');
-    const { roleAssistantSystemKey } = require('../utils/role-assistant-paths');
-    try {
-      resolvedKey = resolveExternalIntegrationContext(systemKey).systemKey;
-    } catch {
-      resolvedKey = roleAssistantSystemKey(systemKey);
-    }
-  }
+  const roleAssistant = isRoleAssistantWorkspace(appType && appType.baseDir);
+  const workOpts = {
+    ...options,
+    roleAssistant,
+    skipConnectedSystemGovernance: roleAssistant
+  };
 
   if (options.run === true) {
     return runWithVerifyStepProgress(
       'Processing',
-      async(progress) => executeLifecycleWork(resolvedKey, { ...options, lifecycleProgress: progress }),
+      async(progress) => executeLifecycleWork(systemKey, { ...workOpts, lifecycleProgress: progress }),
       { json: options.json === true }
     );
   }
 
-  return executeLifecycleWork(resolvedKey, options);
+  return executeLifecycleWork(systemKey, workOpts);
 }
 
 module.exports = {

package/lib/commands/repair-auth-apply.js

@@ -117,7 +117,7 @@ function repairAuthChangeLabel(authOption) {
 }
 
 const MISSING_TEST_ENDPOINT_WARNING =
-  'authentication.variables.testEndpoint is missing for apikey/bearerToken auth — add a GET URL for credential/E2E tests (e.g. /crm/v3/objects/contacts?limit=1, or a path resolved against baseUrl).';
+  'authentication.variables.testEndpoint is missing for apikey/bearerToken auth — add a GET URL for credential/E2E tests (use the OpenAPI minimum for required page-size query params, or a path resolved against baseUrl).';
 
 /**
  * Warn when apikey auth (including bearerToken preset) has no testEndpoint.

package/lib/commands/repair-datasource-key-skip.js

@@ -0,0 +1,39 @@
+/**
+ * Skip repair key prefix when a datasource key is already unique scoped kebab-case.
+ *
+ * @fileoverview Unique kebab datasource keys stay as-is during repair
+ */
+
+'use strict';
+
+const SCOPED_KEBAB = /^[a-z0-9]+(-[a-z0-9]+)+$/;
+
+/**
+ * @param {string} key
+ * @returns {boolean}
+ */
+function isScopedKebabKey(key) {
+  return SCOPED_KEBAB.test(String(key || '').trim());
+}
+
+/**
+ * True when key already contains a hyphen and appears once in the package.
+ * Single-token keys (persons) must still be prefixed with the system key.
+ *
+ * @param {string} key
+ * @param {string[]} allKeys
+ * @returns {boolean}
+ */
+function shouldSkipSystemKeyPrefix(key, allKeys) {
+  const trimmed = String(key || '').trim();
+  if (!isScopedKebabKey(trimmed) || trimmed.endsWith('-datasource')) {
+    return false;
+  }
+  const hits = (allKeys || []).filter((item) => String(item || '').trim() === trimmed);
+  return hits.length === 1;
+}
+
+module.exports = {
+  isScopedKebabKey,
+  shouldSkipSystemKeyPrefix
+};

package/lib/commands/repair-datasource-keys.js

@@ -17,6 +17,7 @@ const fs = require('fs');
 const { loadConfigFile, writeConfigFile } = require('../utils/config-format');
 const { backupIntegrationFile } = require('../utils/integration-file-backup');
 const { trackRepairWrite } = require('./repair-changed-files');
+const { shouldSkipSystemKeyPrefix } = require('./repair-datasource-key-skip');
 
 /**
  * Returns suffix from a canonical-format filename: <systemKey>-datasource-<suffix>.<ext>.
@@ -53,6 +54,9 @@ function isKeyAlreadyCanonical(key, systemKey, fileName) {
       return true;
     }
   }
+  if (shouldSkipSystemKeyPrefix(key, [key])) {
+    return true;
+  }
   if (!key.startsWith(systemKey + '-')) return false;
   const suffix = key.slice(systemKey.length + 1);
   if (!suffix) return false;
@@ -126,6 +130,7 @@ function normalizeDatasourceKeysAndFilenames(appPath, datasourceFiles, systemKey
 
   const slugCounts = new Map();
   const fileInfos = [];
+  const packageKeys = [];
 
   for (const fileName of datasourceFiles) {
     const filePath = path.join(appPath, fileName);
@@ -138,23 +143,30 @@ function normalizeDatasourceKeysAndFilenames(appPath, datasourceFiles, systemKey
       continue;
     }
     const key = (parsed && typeof parsed.key === 'string' && parsed.key.trim()) ? parsed.key.trim() : null;
-    if (isKeyAlreadyCanonical(key, systemKey, fileName) && isFilenameAlreadyCanonical(fileName, systemKey)) {
-      fileInfos.push({ fileName, key, skip: true });
+    if (key) packageKeys.push(key);
+    fileInfos.push({ fileName, parsed, key, skip: false, slug: null, canonicalKey: null });
+  }
+
+  for (const info of fileInfos) {
+    if (info.skip) continue;
+    const filenameCanonical = isFilenameAlreadyCanonical(info.fileName, systemKey);
+    const keyCanonical = isKeyAlreadyCanonical(info.key, systemKey, info.fileName);
+    const skipPrefix =
+      shouldSkipSystemKeyPrefix(info.key, packageKeys) &&
+      !String(info.key || '').endsWith('-datasource');
+    if ((keyCanonical || skipPrefix) && filenameCanonical) {
+      info.skip = true;
+      continue;
+    }
+    if (skipPrefix) {
+      info.canonicalKey = info.key;
       continue;
     }
-    const slug = slugFromKey(key || fileName, systemKey);
-    fileInfos.push({
-      fileName,
-      parsed,
-      key,
-      slug,
-      canonicalKey: null,
-      skip: false
-    });
+    info.slug = slugFromKey(info.key || info.fileName, systemKey);
   }
 
   for (const info of fileInfos) {
-    if (info.skip) continue;
+    if (info.skip || info.canonicalKey) continue;
     const slug = info.slug;
     const n = (slugCounts.get(slug) || 0) + 1;
     slugCounts.set(slug, n);

package/lib/commands/repair-datasource-test-payload.js

@@ -1,7 +1,7 @@
 /**
- * Schema-aware testPayload repair (payloadTemplate / expectedResult).
+ * Schema-aware testPayload repair (payloadTemplate / expectedResult only).
  *
- * @fileoverview Helpers for repair-datasource testPayload generation
+ * @fileoverview Mapping-shape testPayload generation; does not write scenario gold
  * @author AI Fabrix Team
  * @version 2.0.0
  */
@@ -288,6 +288,8 @@ function buildTemplatesFromPathEntries(parsed, pathEntries) {
 
 /**
  * Builds minimal payloadTemplate and expectedResult from attributes + metadataSchema.
+ * Does not generate or rewrite testPayload.scenarios (including nested expectedRows).
+ * Placeholder zeros on expectedResult are mapping-shape only — not capacity row gold.
  *
  * @param {Object} parsed - Parsed datasource (mutated)
  * @param {string[]} changes - Change log

package/lib/commands/repair-datasource-webhooks-sync-bridge.js

@@ -6,6 +6,8 @@
 
 'use strict';
 
+const { listCapabilityKeys } = require('../datasource/capability/capability-manifest');
+
 const AUTH_USAGE_WEBHOOK_INBOUND = 'webhookInbound';
 
 /**
@@ -23,6 +25,23 @@ function systemHasWebhookInboundAuth(systemParsed) {
   return false;
 }
 
+/**
+ * True when every webhook.events[] entry is a capability key (CIP invoke, not change-signal get).
+ * @param {object} parsed
+ * @returns {boolean}
+ */
+function webhookEventsAreCapabilityKeys(parsed) {
+  const events = parsed?.webhook?.events;
+  if (!Array.isArray(events) || events.length === 0) {
+    return false;
+  }
+  const keys = new Set(listCapabilityKeys(parsed.capabilities));
+  if (keys.size === 0) {
+    return false;
+  }
+  return events.every((event) => keys.has(String(event || '').trim()));
+}
+
 /**
  * @param {object} parsed
  * @param {string[]} changes
@@ -37,7 +56,8 @@ function repairWebhookSection(parsed, changes, warnings) {
   let updated = false;
 
   if (webhook.enabled === true) {
-    if (!webhook.idPath || !String(webhook.idPath).trim()) {
+    const needsIdPath = !webhookEventsAreCapabilityKeys(parsed);
+    if (needsIdPath && (!webhook.idPath || !String(webhook.idPath).trim())) {
       warnings.push(
         'webhook.enabled is true but idPath is missing — set idPath (for example $.objectId) before upload.'
       );
@@ -168,5 +188,6 @@ module.exports = {
   repairSyncBridgeSection,
   defaultSyncBridgeForSyncRepair,
   collectWebhookSyncBridgeSystemWarnings,
-  systemHasWebhookInboundAuth
+  systemHasWebhookInboundAuth,
+  webhookEventsAreCapabilityKeys
 };

package/lib/commands/repair-datasource.js

@@ -365,6 +365,9 @@ function repairSyncSection(parsed, changes) {
 
 /**
  * Removes unknown top-level keys from testPayload (v2.4.1 closed root).
+ * Nested keys under scenarios (including author-owned row gold) are not stripped.
+ * Do not add a nested scenario allowlist unless it is derived from the published
+ * external-datasource.schema.json testPayload.scenarios.items.properties.
  * @param {Object} parsed - Parsed datasource (mutated)
  * @param {string[]} changes - Change log
  * @returns {boolean}