@aifabrix/builder 2.59.0 → 2.60.0

package/lib/core/secrets-env-content.js

@@ -44,6 +44,7 @@ const { computeEffectiveEnvironmentScopedResources, redisDbIndexForScopedRunEnv
 const { applyRedisDbIndexToEnvContent } = require('../utils/redis-env-scope');
 const { expandDeclarativeUrlsIfPresent } = require('./secrets-env-declarative-expand');
 const {
+  mergeAdditionalPublishedPorts,
   mergeDockerManifestPublishedPort,
   rewriteDockerManifestPublicPortEnvLine
 } = require('../utils/docker-manifest-public-port');
@@ -154,6 +155,12 @@ async function getDockerRedisDbEndpoints() {
   return { redisHost, redisPort, dbHost, dbPort };
 }
 
+/** Host ports clients connect to: the manifest's own, plus any additionalPorts. */
+async function mergePublishedPorts(envVars, appDoc) {
+  await mergeDockerManifestPublishedPort(envVars, appDoc);
+  await mergeAdditionalPublishedPorts(envVars, appDoc);
+}
+
 /** Docker env transformations: ports, infra endpoints, PORT. */
 async function applyDockerTransformations(resolved, variablesPath) {
   resolved = await resolveServicePortsInEnvContent(resolved, 'docker');
@@ -164,7 +171,7 @@ async function applyDockerTransformations(resolved, variablesPath) {
   const containerPort = getContainerPortFromPath(variablesPath) ?? getContainerPortFromDockerEnv(dockerEnv) ?? 3000;
   const envVars = await buildEnvVarMap('docker', null, null, { appPort: containerPort });
   const appDoc = loadVariablesFromPath(variablesPath);
-  await mergeDockerManifestPublishedPort(envVars, appDoc);
+  await mergePublishedPorts(envVars, appDoc);
   envVars.REDIS_HOST = redisHost;
   envVars.REDIS_PORT = String(redisPort);
   envVars.DB_HOST = dbHost;
@@ -187,6 +194,32 @@ async function applyEnvironmentTransformations(resolved, environment, variablesP
   return resolved;
 }
 
+/**
+ * Expands manifest `{NAME}` values when the application declares platforms/environments.
+ * Local Builder runs pass no resource group, so they resolve as the local platform.
+ * @param {string} content - Env content after kv:// resolution
+ * @param {string|null} variablesPath - Application manifest path (null in env-only mode)
+ * @param {string} runEnvKey - Deployment environment key
+ * @param {Object} [options] - `resourceGroup` when a deployment target is known
+ * @returns {string}
+ */
+function expandPlatformNamesForApp(content, variablesPath, runEnvKey, options = {}) {
+  if (!variablesPath) return content;
+  const { expandPlatformNamesIfPresent } = require('./env-platform-expand');
+  const { loadConfigFile } = require('../utils/config-format');
+  let manifest = null;
+  try {
+    manifest = loadConfigFile(variablesPath);
+  } catch {
+    return content;
+  }
+  return expandPlatformNamesIfPresent(content, {
+    manifest,
+    environment: runEnvKey,
+    resourceGroup: options.resourceGroup
+  });
+}
+
 /**
  * Generate .env content from template and secrets (no disk write).
  * When options.envOnly is true, variablesPath is null (no application config).
@@ -210,15 +243,16 @@ async function generateEnvContent(appName, secretsPath, environment = 'local', f
   }
   const secrets = await loadSecrets(secretsPath, appName);
   const { runEnvKey, effective } = await buildScopedKvContext(appPath, options);
-  const scopedKv = { envKey: runEnvKey, effective };
   let resolved = await resolveKvReferences(template, secrets, environment, secretsPaths, appName, {
     envKey: runEnvKey,
     effective,
     envTemplatePath: templatePath
   });
   if (!secretsPath) {
-    await materializeResolvedKvSecretsToUserLocal(template, secrets, scopedKv, options);
+    await materializeResolvedKvSecretsToUserLocal(template, secrets, { envKey: runEnvKey, effective }, options);
   }
+  // Platform/environment {NAME} before url://, so a resolved value may carry a declarative URL.
+  resolved = expandPlatformNamesForApp(resolved, variablesPath, runEnvKey, options);
   resolved = await expandDeclarativeUrlsIfPresent(
     resolved,
     appName,

package/lib/deployment/installation/azure-infra-stage.js

@@ -24,7 +24,9 @@ const preflight = require('./azure-preflight');
 const readiness = require('./azure-readiness');
 const registryAuth = require('./registry-auth-mode');
 
-const INFRA_SECRETS = Object.freeze(['ADMIN_PASSWORD', 'ENCRYPTION_KEY', 'MORI_CALLBACK_API_KEY']);
+// The Marketplace template stopped accepting moriCallbackApiKey: the installation receives its
+// Mori key at licence registration instead, so infra no longer provisions or projects one.
+const INFRA_SECRETS = Object.freeze(['ADMIN_PASSWORD', 'ENCRYPTION_KEY']);
 
 function missingInputError(file, fields) {
   const error = new Error(

package/lib/deployment/installation/infra-catalog.js

@@ -100,8 +100,6 @@ const PARAMETER_CATALOG = Object.freeze({
   moriBaseUrl: { kind: 'file', source: 'registration', required: true, description: 'Mori service base URL.' },
   moriLicensePublicKey: { kind: 'file', source: 'registration', required: false, description: 'Mori licence issuer public key (SPKI PEM); empty leaves the installation unpinned and it then refuses every licence.' },
   moriLicenseIssuer: { kind: 'file', source: 'registration', required: false, description: 'Expected iss claim on a Mori licence.' },
-  moriCallbackApiKey: { kind: 'secretEnv', env: 'MORI_CALLBACK_API_KEY', required: true, description: 'Mori callback authentication key.' },
-  entraCallbackStateSecret: { kind: 'deferred', description: 'Not collected or sent by infra; issued/configured during later Entra provider onboarding.' },
   entraIdClientId: { kind: 'deferred', description: 'Not collected or sent by infra; issued/configured during later Entra provider onboarding.' },
   entraIdClientSecret: { kind: 'deferred', description: 'Not collected or sent by infra; issued/configured during later Entra provider onboarding.' },
   entraIdTenantId: { kind: 'deferred', description: 'Customer Entra provider tenant; distinct from the Azure subscription directory tenant and configured later.' },
@@ -146,14 +144,13 @@ const MORI_SERVICE_KEY = 'mori-controller-api-keyKeyVault';
 const SECRET_BINDINGS = Object.freeze({
   ADMIN_PASSWORD: { kv: 'miso-controller-admin-passwordKeyVault', required: true, generate: false, comment: 'Required installation administrator password; same canonical secret used by Miso onboarding.' },
   ENCRYPTION_KEY: { kv: 'miso-controller-secrets-encryptionKeyVault', required: true, generate: true, comment: 'Application/data encryption key.' },
-  MORI_CALLBACK_API_KEY: { kv: 'mori-callback-api-keyKeyVault', required: true, generate: true, comment: 'Mori callback credential.' },
   MISO_API_KEY: { kv: 'miso-controller-secrets-apiKeyVault', required: false, generate: false, comment: 'Temporary Miso deployment key; an existing login may be used instead.' },
   MORI_API_KEY: { kv: MORI_SERVICE_KEY, required: true, generate: false, comment: 'Mori installation service key stored by DOCKER registration.' }
 });
 
 const ENV_TEMPLATE_KEYS = Object.freeze({
-  AZURE: ['ADMIN_PASSWORD', 'ENCRYPTION_KEY', 'MORI_CALLBACK_API_KEY', 'MISO_API_KEY'],
-  DOCKER: ['ADMIN_PASSWORD', 'ENCRYPTION_KEY', 'MORI_CALLBACK_API_KEY', 'MORI_API_KEY']
+  AZURE: ['ADMIN_PASSWORD', 'ENCRYPTION_KEY', 'MISO_API_KEY'],
+  DOCKER: ['ADMIN_PASSWORD', 'ENCRYPTION_KEY', 'MORI_API_KEY']
 });
 
 /**

package/lib/generator/builders.js

@@ -362,6 +362,23 @@ function addSimpleOptionalFields(deployment, variables) {
   if (variables.required !== undefined && !(Array.isArray(variables.required) && variables.required.length === 0)) {
     deployment.required = variables.required;
   }
+  addPlatformSections(deployment, variables);
+}
+
+/**
+ * Carries the platform/environment declarations into the deployment manifest so the Controller can
+ * resolve `{NAME}` values per installation, which is the case Builder cannot resolve: one uploaded
+ * application serving many customer resource groups.
+ * @param {Object} deployment - Deployment manifest (mutated)
+ * @param {Object} variables - Application manifest
+ */
+function addPlatformSections(deployment, variables) {
+  if (Array.isArray(variables.platforms) && variables.platforms.length > 0) {
+    deployment.platforms = variables.platforms;
+  }
+  if (Array.isArray(variables.environments) && variables.environments.length > 0) {
+    deployment.environments = variables.environments;
+  }
 }
 
 function buildOptionalFields(deployment, variables, rbac) {

package/lib/generator/helpers.js

@@ -243,6 +243,27 @@ function determineVariableLocation(value) {
   return value.startsWith('kv://') ? 'keyvault' : 'variable';
 }
 
+/**
+ * Expands manifest `{NAME}` values into the env template before it becomes configuration items.
+ * Lenient by design: with no deployment target the tokens stay in the manifest for the Controller
+ * to resolve per installation, which is what the SaaS case needs. A known target resolves fully.
+ * @param {string} envTemplate - Raw env template
+ * @param {Object|null} variablesConfig - Application manifest
+ * @param {Object|null} target - `environment` and `resourceGroup` when known
+ * @returns {string}
+ */
+function expandManifestNames(envTemplate, variablesConfig, target) {
+  const { expandPlatformNamesIfPresent } = require('../core/env-platform-expand');
+  const known = target && (target.resourceGroup || target.environment);
+  if (!known) return envTemplate;
+  return expandPlatformNamesIfPresent(envTemplate, {
+    manifest: variablesConfig,
+    environment: target.environment,
+    resourceGroup: target.resourceGroup,
+    strict: Boolean(target.resourceGroup)
+  });
+}
+
 /**
  * Creates a configuration item from parsed variable
  * @function createConfigItem
@@ -282,9 +303,9 @@ function createConfigItem(key, value, location, applicationConfigMap) {
   return configItem;
 }
 
-function parseEnvironmentVariables(envTemplate, variablesConfig = null) {
+function parseEnvironmentVariables(envTemplate, variablesConfig = null, target = null) {
   const configuration = [];
-  const lines = envTemplate.split('\n');
+  const lines = expandManifestNames(envTemplate, variablesConfig, target).split('\n');
   const applicationConfigMap = createApplicationConfigMap(variablesConfig);
   for (const line of lines) {
     const parsed = parseEnvironmentVariableLine(line);

package/lib/generator/index.js

@@ -175,8 +175,9 @@ function substituteEnvVarsInDeployment(obj, envVarMap, fieldPath = '') {
  * @throws {Error} If validation fails
  */
 function buildAndValidateDeployment(appName, variables, envTemplate, rbac, options = null) {
-  // Parse environment variables from template and merge portalInput from application config
-  const configuration = parseEnvironmentVariables(envTemplate, variables);
+  // Parse environment variables from template and merge portalInput from application config.
+  // A known deployment target resolves manifest {NAME} values; otherwise they stay for the Controller.
+  const configuration = parseEnvironmentVariables(envTemplate, variables, options && options.target);
 
   // Build deployment manifest (Controller computes deploymentKey from schema)
   const deployment = builders.buildManifestStructure(appName, variables, configuration, rbac);
@@ -236,7 +237,7 @@ async function buildDeploymentManifestInMemory(appName, options = {}) {
     ...variables,
     app: { ...variables.app, version: resolved.version }
   };
-  const configuration = parseEnvironmentVariables(envTemplate, variables);
+  const configuration = parseEnvironmentVariables(envTemplate, variables, options && options.target);
   const deployment = builders.buildManifestStructure(appName, variablesWithVersion, configuration, rbac);
 
   const effectivePort = getEffectivePortForSubstitution(variablesWithVersion, 3000);
@@ -290,7 +291,7 @@ async function writeExternalDeployJson(appName, appPath, options) {
  * @param {string} appType - Application type
  * @returns {Promise<string>} Path to written deploy JSON
  */
-async function writeRegularDeployJson(appName, appPath, appType) {
+async function writeRegularDeployJson(appName, appPath, appType, options = {}) {
   const { variables, envTemplate, rbac, jsonPath } = loadDeploymentConfigFiles(appPath, appType, appName);
   const resolved = await resolveVersionForApp(appName, variables, { updateBuilder: false });
   const variablesWithVersion = {
@@ -299,7 +300,10 @@ async function writeRegularDeployJson(appName, appPath, appType) {
   };
   const effectivePort = getEffectivePortForSubstitution(variablesWithVersion, 3000);
   const envVarMap = await buildEnvVarMap('docker', null, null, { appPort: effectivePort });
-  const deployment = buildAndValidateDeployment(appName, variablesWithVersion, envTemplate, rbac, { envVarMap });
+  const deployment = buildAndValidateDeployment(appName, variablesWithVersion, envTemplate, rbac, {
+    envVarMap,
+    target: options.target
+  });
   const jsonContent = JSON.stringify(deployment, null, 2);
   fs.writeFileSync(jsonPath, jsonContent, { mode: 0o644 });
   return jsonPath;
@@ -333,7 +337,7 @@ async function generateDeployJson(appName, options = {}) {
   if (isExternal) {
     return writeExternalDeployJson(appName, appPath, options);
   }
-  return await writeRegularDeployJson(appName, appPath, appType);
+  return await writeRegularDeployJson(appName, appPath, appType, options);
 }
 
 async function generateDeployJsonWithValidation(appName, options = {}) {

package/lib/role-assistant/test-cases-search.js

@@ -142,6 +142,9 @@ function evaluateSearchExpectations(expectedSearch, observation) {
 
 function skillsResourceEntry(skillsPayload, resourceType) {
   const root = skillsEnvelope(skillsPayload) || asObject(skillsPayload);
+  if (String(root.resourceType || '').trim() === resourceType) {
+    return root;
+  }
   const rts = asObject(asObject(root).search).resourceTypes;
   return asObject(asObject(rts)[resourceType]);
 }

package/lib/role-assistant/test-job-runner.js

@@ -0,0 +1,125 @@
+/**
+ * Run one published Role Assistant case as an explicitly selected subject.
+ *
+ * @fileoverview Async test-job isolation for the Role Assistant CLI
+ */
+
+'use strict';
+
+const { resolveControllerUrl } = require('../utils/controller-url');
+const { resolveUserIdOrEmail } = require('../identity/resolve-user-id');
+const {
+  enqueueRoleAssistantTestJob,
+  getRoleAssistantTestJob
+} = require('../api/role-assistant-test-job.api');
+const { roleAssistantSystemKey } = require('../utils/role-assistant-paths');
+
+function selectedSubject(opts) {
+  const ids = Array.isArray(opts.subjectUserId)
+    ? opts.subjectUserId.map((value) => String(value || '').trim()).filter(Boolean)
+    : [];
+  const emails = Array.isArray(opts.subjectEmail)
+    ? opts.subjectEmail.map((value) => String(value || '').trim()).filter(Boolean)
+    : [];
+  if (ids.length + emails.length > 1) {
+    throw new Error('Role Assistant case execution accepts exactly one isolation subject.');
+  }
+  return { userId: ids[0] || '', email: emails[0] || '' };
+}
+
+function hasRoleAssistantTestSubject(opts) {
+  const subject = selectedSubject(opts);
+  return Boolean(subject.userId || subject.email);
+}
+
+async function resolveSubjectUserId(opts, authConfig) {
+  const subject = selectedSubject(opts);
+  if (subject.userId) {
+    return subject.userId;
+  }
+  const controllerUrl = await resolveControllerUrl();
+  return resolveUserIdOrEmail(controllerUrl, authConfig, subject.email);
+}
+
+function waitFor(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+
+async function pollJob(roleKey, authContext, jobId, opts) {
+  const timeoutMs = Number(opts.pollTimeoutMs) || 180000;
+  const intervalMs = Number(opts.pollIntervalMs) || 750;
+  const startedAt = Date.now();
+  let job = null;
+  while (Date.now() - startedAt < timeoutMs) {
+    job = await getRoleAssistantTestJob(
+      authContext.dataplaneUrl,
+      authContext.authConfig,
+      roleAssistantSystemKey(roleKey),
+      jobId
+    );
+    const status = String(job?.status || '').trim().toLowerCase();
+    if (['completed', 'failed', 'cancelled'].includes(status)) {
+      return job;
+    }
+    await waitFor(intervalMs);
+  }
+  throw new Error(`Role Assistant test job ${jobId} did not finish within ${timeoutMs} ms.`);
+}
+
+function evaluationFromJobCase(roleCase, job, row, fallbackJobId = null) {
+  const assertions = Array.isArray(row?.assertions)
+    ? row.assertions.map((assertion) => ({
+      ...assertion,
+      passed: String(assertion?.kind || '').toLowerCase() !== 'fail'
+    }))
+    : [];
+  return {
+    caseId: row?.caseId || roleCase.caseId,
+    sourceFile: roleCase.sourceFile || null,
+    passed: row?.passed === true,
+    lifecycleState: row?.lifecycleState || String(job?.status || 'failed'),
+    assertions,
+    failedAssertions: assertions.filter((assertion) => assertion.passed === false),
+    warnings: assertions.filter((assertion) => assertion.kind === 'warn'),
+    execution: {
+      processExecutionId: row?.processExecutionId || null,
+      finalStatus: row?.lifecycleState || job?.status || null,
+      waitReason: null,
+      interactions: [],
+      workResultError: job?.errorMessage || null,
+      testJobId: job?.jobId || job?.id || fallbackJobId || null
+    }
+  };
+}
+
+async function runPublishedCaseAsSubject(roleKey, roleCase, opts, authContext) {
+  const subjectUserId = await resolveSubjectUserId(opts, authContext.authConfig);
+  const accepted = await enqueueRoleAssistantTestJob(
+    authContext.dataplaneUrl,
+    authContext.authConfig,
+    roleAssistantSystemKey(roleKey),
+    { caseId: roleCase.caseId, subjectUserId }
+  );
+  const jobId = String(accepted?.jobId || '').trim();
+  if (!jobId) {
+    throw new Error('Role Assistant test job enqueue did not return jobId.');
+  }
+  const job = await pollJob(roleKey, authContext, jobId, opts);
+  const row = Array.isArray(job?.cases)
+    ? job.cases.find((candidate) => candidate?.caseId === roleCase.caseId)
+    : null;
+  if (!row) {
+    throw new Error(
+      job?.errorMessage ||
+        `Published Role Assistant case '${roleCase.caseId}' returned no result in job ${jobId}.`
+    );
+  }
+  return evaluationFromJobCase(roleCase, job, row, jobId);
+}
+
+module.exports = {
+  hasRoleAssistantTestSubject,
+  runPublishedCaseAsSubject,
+  evaluationFromJobCase,
+  selectedSubject
+};

package/lib/role-assistant/test-runner-search.js

@@ -17,7 +17,7 @@ const {
   wantsSkillsOnlyPath
 } = require('./test-runner-workhub-helpers');
 
-function operationKeys(spec) {
+function directOperationKeys(spec) {
   const raw = Array.isArray(spec && spec.operations) ? spec.operations : [];
   const keys = [];
   for (const item of raw) {
@@ -33,6 +33,42 @@ function operationKeys(spec) {
   return keys;
 }
 
+function operationClassKeys(spec) {
+  const classes = spec && typeof spec.operationClasses === 'object'
+    ? spec.operationClasses
+    : {};
+  const keys = [];
+  for (const rows of Object.values(classes)) {
+    if (!Array.isArray(rows)) {
+      continue;
+    }
+    for (const row of rows) {
+      const key = String(row || '').trim();
+      if (key && !keys.includes(key)) {
+        keys.push(key);
+      }
+    }
+  }
+  return keys;
+}
+
+function operationKeys(spec) {
+  return [...new Set([...directOperationKeys(spec), ...operationClassKeys(spec)])];
+}
+
+function skillsRequestOptions(testCase) {
+  if (!wantsSkillsOnlyPath(testCase)) {
+    return undefined;
+  }
+  const input = resolveInput(testCase);
+  const resourceType = String(input.resourceType || '').trim();
+  const operation = String(input.operation || '').trim();
+  if (operation) {
+    return { detail: 'operation', resourceType, operation };
+  }
+  return resourceType ? { detail: 'resource', resourceType } : undefined;
+}
+
 function pickResourceType(skillsPayload, operation) {
   const rts = resourceTypesMap(skillsPayload);
   const keys = Object.keys(rts);
@@ -139,7 +175,12 @@ async function runSearchCaseLifecycle(roleKey, testCase, runtimeContext) {
     throw new Error('Role assistant search case requires dataplane auth context.');
   }
   const roleRef = resolveRoleRef(roleKey, testCase);
-  const skillsRes = await getWorkSkills(dataplaneUrl, authConfig, roleRef);
+  const skillsRes = await getWorkSkills(
+    dataplaneUrl,
+    authConfig,
+    roleRef,
+    skillsRequestOptions(testCase)
+  );
   if (wantsSkillsOnlyPath(testCase)) {
     return searchLifecycleResult(roleKey, testCase, roleRef, skillsRes, null, null);
   }
@@ -157,6 +198,7 @@ module.exports = {
   wantsSearchPath,
   wantsSkillsOnlyPath,
   operationKeys,
+  skillsRequestOptions,
   pickResourceType,
   resolveRoleRef,
   buildSearchArguments,