@aifabrix/builder 2.54.1 → 2.55.2

package/lib/commands/governance-command-action.js

@@ -6,6 +6,7 @@
 
 const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
+const { writeJsonEnvelopeAndExit } = require('../utils/cli-json-exit');
 const { runGovernanceGenerateForExternalSystem } = require('./governance-generate-external');
 const { runGovernanceVerifyForExternalSystem } = require('./governance-verify-external');
 const { runGovernanceUploadForExternalSystem } = require('./governance-upload-external');
@@ -75,12 +76,12 @@ async function governanceVerifyHandler(systemKey, options, cmd) {
   try {
     const opts = normalizeGovernanceOptions(options, cmd);
     const result = await runGovernanceVerifyForExternalSystem(systemKey, opts);
+    const exitCode = exitCodeFromVerdict(result.verdict);
     if (opts.json) {
-      logger.log(JSON.stringify(buildJsonEnvelope(result, opts.verbose), null, 2));
-    } else {
-      displayVerifyGovernanceTTY(result.systemKey, result, { details: opts.verbose });
+      await writeJsonEnvelopeAndExit(buildJsonEnvelope(result, opts.verbose), exitCode);
+      return;
     }
-    const exitCode = exitCodeFromVerdict(result.verdict);
+    displayVerifyGovernanceTTY(result.systemKey, result, { details: opts.verbose });
     if (exitCode !== 0) {
       process.exit(exitCode);
     }

package/lib/commands/identity-membership-role-cache.js

@@ -35,7 +35,12 @@ const ROLE_LIST_COLUMNS = [
     label: 'Groups',
     width: 44,
     value: (r) => {
-      const groups = Array.isArray(r.groups) ? r.groups.filter(Boolean) : [];
+      const groups = Array.isArray(r.groups)
+        ? r.groups.filter(Boolean)
+        : (r.mappings || [])
+          .filter((mapping) => mapping?.isActive !== false)
+          .map((mapping) => mapping?.groupName)
+          .filter(Boolean);
       return groups.length > 0 ? groups.join(', ') : '—';
     }
   }

package/lib/commands/lifecycle-command-action.js

@@ -6,8 +6,8 @@
 
 'use strict';
 
-const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
+const { writeJsonEnvelopeAndExit } = require('../utils/cli-json-exit');
 const { cliOptsSkipPublish } = require('../utils/cli-sync-options');
 const { runLifecycleForExternalSystem } = require('./lifecycle-external');
 const { displayLifecycleReportTTY } = require('../lifecycle/report-display');
@@ -65,6 +65,12 @@ async function runLifecycleCommandAction(appName, options, cmd) {
   const result = await runLifecycleForExternalSystem(appName, opts);
   const report = result.report;
 
+  const pillarVerdict = lifecycleVerdictFromReport(report);
+  const exitCode =
+    pillarVerdict === VERDICT.VERIFIED
+      ? 0
+      : exitCodeFromVerdict(pillarVerdict, { partial: pillarVerdict === VERDICT.NOT_VERIFIED });
+
   if (opts.json) {
     const envelope = {
       systemKey: result.systemKey,
@@ -82,22 +88,17 @@ async function runLifecycleCommandAction(appName, options, cmd) {
     if (opts.verbose) {
       envelope.datasources = report.datasources;
     }
-    logger.log(JSON.stringify(envelope, null, 2));
-  } else {
-    displayLifecycleReportTTY(result.systemKey, report, {
-      details: opts.verbose,
-      openApiPublished: result.openApiPublished === true,
-      certificationProgress: result.certificationProgress ?? null,
-      dataplaneUrl: result.dataplaneUrl ?? null,
-      dataplaneUiBaseUrl: result.dataplaneUiBaseUrl ?? null
-    });
+    await writeJsonEnvelopeAndExit(envelope, exitCode);
+    return;
   }
 
-  const pillarVerdict = lifecycleVerdictFromReport(report);
-  const exitCode =
-    pillarVerdict === VERDICT.VERIFIED
-      ? 0
-      : exitCodeFromVerdict(pillarVerdict, { partial: pillarVerdict === VERDICT.NOT_VERIFIED });
+  displayLifecycleReportTTY(result.systemKey, report, {
+    details: opts.verbose,
+    openApiPublished: result.openApiPublished === true,
+    certificationProgress: result.certificationProgress ?? null,
+    dataplaneUrl: result.dataplaneUrl ?? null,
+    dataplaneUiBaseUrl: result.dataplaneUiBaseUrl ?? null
+  });
   if (exitCode !== 0) {
     process.exit(exitCode);
   }

package/lib/commands/login-credentials.js

@@ -15,6 +15,7 @@ const { getToken } = require('../api/auth.api');
 const { formatApiError } = require('../utils/api-error-handler');
 const { loadClientCredentials } = require('../utils/token-manager');
 const logger = require('../utils/logger');
+const { writeStreamAndWait } = require('../utils/write-stream-and-wait');
 
 /**
  * Tries to load credentials from secrets file
@@ -136,7 +137,7 @@ function handleLoginError(response, appName) {
  * @param {Object} response - API response
  * @returns {Object} Token data object
  */
-function extractTokenData(response) {
+async function extractTokenData(response) {
   // OpenAPI spec response: { success: boolean, token: string, expiresIn: number, expiresAt: string, ... }
   // Handle both flat and nested response structures (some APIs wrap in data field)
   // If response.data exists, use it; otherwise use response directly
@@ -146,7 +147,10 @@ function extractTokenData(response) {
   if (!responseData || !responseData.token) {
     logger.error(formatBlockingError('Invalid response: missing token'));
     if (responseData) {
-      logger.error(chalk.gray(`Response structure: ${JSON.stringify(responseData, null, 2)}`));
+      await writeStreamAndWait(
+        process.stderr,
+        `${chalk.gray(`Response structure: ${JSON.stringify(responseData, null, 2)}`)}\n`
+      );
     }
     process.exit(1);
   }
@@ -190,9 +194,10 @@ async function handleCredentialsLogin(controllerUrl, appName, clientId, clientSe
 
   if (!response.success) {
     handleLoginError(response, appName);
+    return;
   }
 
-  const responseData = extractTokenData(response);
+  const responseData = await extractTokenData(response);
   const expiresAt = calculateTokenExpiration(responseData);
 
   return {

package/lib/commands/login-device.js

@@ -15,6 +15,7 @@ const ora = require('ora');
 const { setCurrentEnvironment, saveDeviceToken, setControllerUrl } = require('../core/config');
 const { initiateDeviceCodeFlow } = require('../api/auth.api');
 const { pollDeviceCodeToken, displayDeviceCodeInfo } = require('../utils/api');
+const { resolveDeviceVisitUrl } = require('../utils/device-code');
 const logger = require('../utils/logger');
 const { formatSuccessLine } = require('../utils/cli-layout-chalk');
 
@@ -42,6 +43,10 @@ async function getEnvironmentKey(environment) {
     return envKey;
   }
 
+  if (!process.stdin || process.stdin.isTTY === false) {
+    return 'dev';
+  }
+
   const envPrompt = await inquirer.prompt([{
     type: 'input',
     name: 'environment',
@@ -255,10 +260,8 @@ function logDeviceFlowError(deviceError, opts) {
 }
 
 function printCompactDeviceUrl(deviceCodeResponse) {
-  const visitUrl =
-    deviceCodeResponse.verification_uri_complete ||
-    `${deviceCodeResponse.verification_uri}?user_code=${deviceCodeResponse.user_code}`;
-  logger.log('\nOpen browser to authenticate:');
+  const visitUrl = resolveDeviceVisitUrl(deviceCodeResponse);
+  logger.log('\nOpen this URL to authenticate:');
   logger.log(chalk.yellow(`${visitUrl}\n`));
 }
 
@@ -289,7 +292,13 @@ async function handleDeviceCodeLogin(controllerUrl, environment, online, scope,
     const deviceCodeResponse = convertDeviceCodeResponse(apiResponse);
 
     if (!opts.compact) {
-      displayDeviceCodeInfo(deviceCodeResponse.user_code, deviceCodeResponse.verification_uri, logger, chalk);
+      displayDeviceCodeInfo(
+        deviceCodeResponse.user_code,
+        deviceCodeResponse.verification_uri,
+        logger,
+        chalk,
+        deviceCodeResponse.verification_uri_complete
+      );
     } else {
       printCompactDeviceUrl(deviceCodeResponse);
     }

package/lib/commands/login.js

@@ -16,9 +16,13 @@ const { setCurrentEnvironment, saveClientToken, setControllerUrl } = require('..
 const logger = require('../utils/logger');
 const { handleCredentialsLogin } = require('./login-credentials');
 const { handleDeviceCodeLogin } = require('./login-device');
-const { resolveControllerUrl } = require('../utils/controller-url');
+const { resolveControllerUrl, discoverControllerBaseUrl } = require('../utils/controller-url');
 const { tryRefreshDataplaneVersionAfterLogin } = require('./auth-status-dataplane-version');
 
+function isInteractiveStdin() {
+  return Boolean(process.stdin && process.stdin.isTTY);
+}
+
 /**
  * Determine and validate authentication method
  * @async
@@ -34,6 +38,10 @@ async function determineAuthMethod(method) {
     return method;
   }
 
+  if (!isInteractiveStdin()) {
+    return 'device';
+  }
+
   const authMethod = await inquirer.prompt([{
     type: 'list',
     name: 'method',
@@ -86,6 +94,8 @@ async function normalizeControllerUrl(options) {
     controllerUrl = await resolveControllerUrl();
   }
   controllerUrl = String(controllerUrl).trim().replace(/\/+$/, '');
+  const inputUrl = controllerUrl;
+  controllerUrl = await discoverControllerBaseUrl(controllerUrl);
   if (!options.skipControllerUrlPersist) {
     const persistUrl = options.tokenControllerUrl
       ? String(options.tokenControllerUrl).trim().replace(/\/+$/, '')
@@ -93,6 +103,9 @@ async function normalizeControllerUrl(options) {
     await setControllerUrl(persistUrl);
   }
   if (!options.compact) {
+    if (controllerUrl !== inputUrl) {
+      logger.log(chalk.gray(`Using controller ${controllerUrl}`));
+    }
     logger.log(chalk.gray(`Controller URL: ${controllerUrl}`));
   }
   return controllerUrl;

package/lib/commands/logout.js

@@ -132,11 +132,54 @@ async function clearClientTokens(options) {
   return 0;
 }
 
+function normalizeTokenType(value) {
+  const type = value && String(value).toLowerCase();
+  if (type && type !== 'device' && type !== 'client') {
+    throw new Error('--type must be either "device" or "client"');
+  }
+  return type;
+}
+
+function validateLogoutOptionCombination(options, type) {
+  if (options.app && !options.environment) {
+    throw new Error('--app requires --environment option');
+  }
+  if (type === 'client' && options.controller) {
+    throw new Error('--controller can only be used with --type device');
+  }
+  if (type === 'device' && (options.environment || options.app)) {
+    throw new Error('--environment and --app can only be used with --type client');
+  }
+}
+
+function validateLogoutSelectors(options) {
+  if ('controller' in options && options.controller !== undefined && options.controller !== null) {
+    validateControllerUrl(options.controller);
+  }
+  if ('environment' in options && options.environment !== undefined && options.environment !== null) {
+    validateEnvironmentKey(options.environment);
+  }
+}
+
+/**
+ * Validate logout option combinations and normalize the token type.
+ * @param {Object} options - Raw logout options
+ * @returns {Object} Validated options with a normalized type
+ * @throws {Error} If an option or option combination is invalid
+ */
+function normalizeLogoutOptions(options) {
+  const type = normalizeTokenType(options.type);
+  validateLogoutOptionCombination(options, type);
+  validateLogoutSelectors(options);
+  return { ...options, type };
+}
+
 /**
  * Handle logout command action
  * @async
  * @function handleLogout
  * @param {Object} options - Logout options
+ * @param {string} [options.type] - Token type to clear (device or client)
  * @param {string} [options.controller] - Clear device tokens for specific controller
  * @param {string} [options.environment] - Clear client tokens for specific environment
  * @param {string} [options.app] - Clear client tokens for specific app (requires --environment)
@@ -147,24 +190,17 @@ async function handleLogout(options) {
   const configPath = CONFIG_FILE;
   logger.log(chalk.blue('\n🔓 Clearing authentication tokens...\n'));
 
-  // Validate options
-  if (options.app && !options.environment) {
-    throw new Error('--app requires --environment option');
-  }
-
-  if ('controller' in options && options.controller !== undefined && options.controller !== null) {
-    validateControllerUrl(options.controller);
-  }
-
-  if ('environment' in options && options.environment !== undefined && options.environment !== null) {
-    validateEnvironmentKey(options.environment);
-  }
+  const normalizedOptions = normalizeLogoutOptions(options);
 
   // Clear device tokens
-  const deviceTokensCleared = await clearDeviceTokens(options);
+  const deviceTokensCleared = normalizedOptions.type === 'client'
+    ? 0
+    : await clearDeviceTokens(normalizedOptions);
 
   // Clear client tokens
-  const clientTokensCleared = await clearClientTokens(options);
+  const clientTokensCleared = normalizedOptions.type === 'device'
+    ? 0
+    : await clearClientTokens(normalizedOptions);
 
   // Summary
   const totalCleared = deviceTokensCleared + clientTokensCleared;
@@ -178,4 +214,3 @@ async function handleLogout(options) {
 }
 
 module.exports = { handleLogout };
-

package/lib/commands/repair-auth-apply.js

@@ -117,7 +117,7 @@ function repairAuthChangeLabel(authOption) {
 }
 
 const MISSING_TEST_ENDPOINT_WARNING =
-  'authentication.variables.testEndpoint is missing for apikey/bearerToken auth — add a GET URL for credential/E2E tests (e.g. /crm/v3/objects/contacts?limit=1, or a path resolved against baseUrl).';
+  'authentication.variables.testEndpoint is missing for apikey/bearerToken auth — add a GET URL for credential/E2E tests (use the OpenAPI minimum for required page-size query params, or a path resolved against baseUrl).';
 
 /**
  * Warn when apikey auth (including bearerToken preset) has no testEndpoint.

package/lib/commands/repair-datasource-key-skip.js

@@ -0,0 +1,39 @@
+/**
+ * Skip repair key prefix when a datasource key is already unique scoped kebab-case.
+ *
+ * @fileoverview Unique kebab datasource keys stay as-is during repair
+ */
+
+'use strict';
+
+const SCOPED_KEBAB = /^[a-z0-9]+(-[a-z0-9]+)+$/;
+
+/**
+ * @param {string} key
+ * @returns {boolean}
+ */
+function isScopedKebabKey(key) {
+  return SCOPED_KEBAB.test(String(key || '').trim());
+}
+
+/**
+ * True when key already contains a hyphen and appears once in the package.
+ * Single-token keys (persons) must still be prefixed with the system key.
+ *
+ * @param {string} key
+ * @param {string[]} allKeys
+ * @returns {boolean}
+ */
+function shouldSkipSystemKeyPrefix(key, allKeys) {
+  const trimmed = String(key || '').trim();
+  if (!isScopedKebabKey(trimmed) || trimmed.endsWith('-datasource')) {
+    return false;
+  }
+  const hits = (allKeys || []).filter((item) => String(item || '').trim() === trimmed);
+  return hits.length === 1;
+}
+
+module.exports = {
+  isScopedKebabKey,
+  shouldSkipSystemKeyPrefix
+};

package/lib/commands/repair-datasource-keys.js

@@ -17,6 +17,7 @@ const fs = require('fs');
 const { loadConfigFile, writeConfigFile } = require('../utils/config-format');
 const { backupIntegrationFile } = require('../utils/integration-file-backup');
 const { trackRepairWrite } = require('./repair-changed-files');
+const { shouldSkipSystemKeyPrefix } = require('./repair-datasource-key-skip');
 
 /**
  * Returns suffix from a canonical-format filename: <systemKey>-datasource-<suffix>.<ext>.
@@ -53,6 +54,9 @@ function isKeyAlreadyCanonical(key, systemKey, fileName) {
       return true;
     }
   }
+  if (shouldSkipSystemKeyPrefix(key, [key])) {
+    return true;
+  }
   if (!key.startsWith(systemKey + '-')) return false;
   const suffix = key.slice(systemKey.length + 1);
   if (!suffix) return false;
@@ -126,6 +130,7 @@ function normalizeDatasourceKeysAndFilenames(appPath, datasourceFiles, systemKey
 
   const slugCounts = new Map();
   const fileInfos = [];
+  const packageKeys = [];
 
   for (const fileName of datasourceFiles) {
     const filePath = path.join(appPath, fileName);
@@ -138,23 +143,30 @@ function normalizeDatasourceKeysAndFilenames(appPath, datasourceFiles, systemKey
       continue;
     }
     const key = (parsed && typeof parsed.key === 'string' && parsed.key.trim()) ? parsed.key.trim() : null;
-    if (isKeyAlreadyCanonical(key, systemKey, fileName) && isFilenameAlreadyCanonical(fileName, systemKey)) {
-      fileInfos.push({ fileName, key, skip: true });
+    if (key) packageKeys.push(key);
+    fileInfos.push({ fileName, parsed, key, skip: false, slug: null, canonicalKey: null });
+  }
+
+  for (const info of fileInfos) {
+    if (info.skip) continue;
+    const filenameCanonical = isFilenameAlreadyCanonical(info.fileName, systemKey);
+    const keyCanonical = isKeyAlreadyCanonical(info.key, systemKey, info.fileName);
+    const skipPrefix =
+      shouldSkipSystemKeyPrefix(info.key, packageKeys) &&
+      !String(info.key || '').endsWith('-datasource');
+    if ((keyCanonical || skipPrefix) && filenameCanonical) {
+      info.skip = true;
+      continue;
+    }
+    if (skipPrefix) {
+      info.canonicalKey = info.key;
       continue;
     }
-    const slug = slugFromKey(key || fileName, systemKey);
-    fileInfos.push({
-      fileName,
-      parsed,
-      key,
-      slug,
-      canonicalKey: null,
-      skip: false
-    });
+    info.slug = slugFromKey(info.key || info.fileName, systemKey);
   }
 
   for (const info of fileInfos) {
-    if (info.skip) continue;
+    if (info.skip || info.canonicalKey) continue;
     const slug = info.slug;
     const n = (slugCounts.get(slug) || 0) + 1;
     slugCounts.set(slug, n);

package/lib/commands/repair-rbac.js

@@ -29,6 +29,7 @@ const {
   ensureOrchestrationResourceType
 } = require('./repair-rbac-platform-preset');
 const { trackRepairWrite } = require('./repair-changed-files');
+const { listCapabilityKeys } = require('../datasource/capability/capability-manifest');
 const { ensureDefaultRoles } = require('./repair-rbac-catalog-defaults');
 
 const DEFAULT_CAPABILITIES = ['list', 'get', 'create', 'update', 'delete'];
@@ -47,24 +48,29 @@ function _normalizeOperationKey(opKey) {
   return cleaned.replace(/-+/g, '-').replace(/^-+|-+$/g, '');
 }
 
+function defaultCapabilitiesForDatasource(parsed) {
+  if (String(parsed?.storageType || '') === 'view') {
+    return ['list', 'get'];
+  }
+  return [...DEFAULT_CAPABILITIES];
+}
+
 /**
- * Resolves capabilities from datasource (array or legacy object).
+ * Resolves capabilities from datasource (array, COM objects, or legacy map).
  * @param {Object} parsed - Parsed datasource
  * @returns {string[]}
  */
 function getCapabilitiesFromDatasource(parsed) {
-  const cap = parsed?.capabilities;
-  if (Array.isArray(cap)) {
-    const arr = cap.filter(c => typeof c === 'string');
-    if (arr.length > 0) return arr;
-    return [...DEFAULT_CAPABILITIES];
+  const fromList = listCapabilityKeys(parsed?.capabilities);
+  if (fromList.length > 0) {
+    return fromList;
   }
-  if (cap && typeof cap === 'object') {
-    const keys = Object.keys(cap).filter(k => cap[k] === true);
+  const cap = parsed?.capabilities;
+  if (cap && typeof cap === 'object' && !Array.isArray(cap)) {
+    const keys = Object.keys(cap).filter((k) => cap[k] === true);
     if (keys.length > 0) return keys;
-    return [...DEFAULT_CAPABILITIES];
   }
-  return [...DEFAULT_CAPABILITIES];
+  return defaultCapabilitiesForDatasource(parsed);
 }
 
 /**

package/lib/commands/role-assistant-copy-output.js

@@ -0,0 +1,61 @@
+/**
+ * TTY and --json output for role-assistant copy.
+ *
+ * @fileoverview Success and blocking copy envelopes
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatSuccessLine, formatBlockingError } = require('../utils/cli-layout-chalk');
+
+function copyWarnings(result) {
+  return Array.isArray(result.warnings) ? result.warnings : [];
+}
+
+function buildCopyEnvelope(result) {
+  const envelope = {
+    success: true,
+    path: result.path,
+    caseId: result.caseId,
+    suiteId: result.suiteId,
+    processExecutionId: result.processExecutionId
+  };
+  const warnings = copyWarnings(result);
+  if (warnings.length > 0) {
+    envelope.warnings = warnings;
+  }
+  if (result.dryRun === true) {
+    envelope.dryRun = true;
+    envelope.yaml = result.yaml;
+  }
+  return envelope;
+}
+
+function emitCopySuccess(options, result) {
+  if (options && options.json) {
+    logger.log(JSON.stringify(buildCopyEnvelope(result), null, 2));
+    return;
+  }
+  if (result.dryRun === true) {
+    logger.log(result.yaml);
+    logger.log(formatSuccessLine(`Would write ${result.path}`));
+    return;
+  }
+  logger.log(formatSuccessLine(`Wrote ${result.path}`));
+}
+
+function emitCopyFailure(options, error) {
+  const message = error && error.message ? error.message : String(error);
+  if (options && options.json) {
+    logger.log(JSON.stringify({ success: false, error: message }));
+    return;
+  }
+  logger.error(formatBlockingError(message));
+}
+
+module.exports = {
+  buildCopyEnvelope,
+  emitCopySuccess,
+  emitCopyFailure
+};