@aifabrix/builder 2.60.0 → 2.62.0

package/lib/cli/setup-environment.js

@@ -118,6 +118,79 @@ Typical workflow:
 
 Subcommands:
   deploy <env>   Provision/update environment in Miso Controller (see env deploy --help)
+  secret         Installation configuration on the Controller (push, list)
+`;
+
+const SECRET_GROUP_HELP_AFTER = `
+Installation configuration held by the Controller. Push updates declared variables and secrets;
+list reads them for one application or every authorized application.
+
+Scope, compared with the other two stores:
+  aifabrix secret        your own local secrets.local.yaml (and the shared store)
+  aifabrix credential    a Connected System's credentials on the Dataplane
+  aifabrix env secret    this installation's secrets on the Controller
+
+Secret values are write-only: they can be set and never read back. Listing shows values only
+for rows the Controller authoritatively classifies as non-sensitive variables.
+
+The environment is a parameter. Omit it to use the one in config.yaml
+(aifabrix auth set-environment <env>).
+
+Examples:
+  $ aifabrix env secret list --app builder-api
+  $ aifabrix env secret list dev --app mori-controller
+  $ aifabrix env secret push --app mori-controller
+  $ af env secret push miso --app mori-controller --dry-run
+`;
+
+const SECRET_PUSH_HELP_AFTER = `
+Reads values from the application's ignored .env and matches each variable name to the
+Controller's declaration. Non-sensitive variables use configuration PUT; secrets use the
+protected system-secret PUT. Undeclared .env names are skipped.
+
+Secrets: pass paths only. The value is read from the file and never taken from the command
+line, so it cannot reach shell history or a process list. No value is printed or logged on
+any path, including failure.
+
+Environment: omit to use the configured one, or name it explicitly.
+--key is the variable name from .env, not the Controller declaration key.
+Without --key, an interactive terminal asks before pushing all declared values. Automation
+and AI usage must pass --yes explicitly. Dry-run never prompts and never writes.
+
+Examples:
+  Preview one value from mori-controller's default .env, then push it to dev:
+  $ aifabrix env secret push dev --app mori-controller --key NOTIFICATION_EVENT_WEBHOOK_SECRET --dry-run
+  $ aifabrix env secret push dev --app mori-controller --key NOTIFICATION_EVENT_WEBHOOK_SECRET
+
+  Preview every declared configuration value found in the app's default .env:
+  $ aifabrix env secret push dev --app mori-controller --dry-run
+
+  Push every declared value after reviewing the dry run (interactive confirmation):
+  $ aifabrix env secret push dev --app mori-controller
+
+  Push every declared value non-interactively after explicit approval:
+  $ aifabrix env secret push dev --app mori-controller --yes
+
+  Preview values from a different ignored env file:
+  $ af env secret push dev --app mori-controller --file ./path/to/ignored.env --dry-run
+`;
+
+const SECRET_LIST_HELP_AFTER = `
+Shows declared configuration in a compact table. Without --app, the Application column
+lists every authorized owner; with --app, only that exact owner is shown. Non-sensitive
+variable values are shown. Secret values, references, vault names and ciphertext are never shown.
+
+Environment: omit to use the configured one, or name it explicitly.
+--app optionally identifies one exact owner; * means the literal wildcard owner.
+--key searches that owner's secret key and environment-variable names by substring.
+The table has Status, Name, Type and Value headers (plus Application without --app).
+Rows use ✔ for configured, ⚠ for required missing, and ⏭ for optional unset.
+
+Examples:
+  $ aifabrix env secret list dev
+  $ aifabrix env secret list --app mori-controller
+  $ aifabrix env secret list dev --app builder-api
+  $ aifabrix env secret list --app mori-controller --key policy
 `;
 
 function setupEnvironmentCommands(program) {
@@ -136,6 +209,89 @@ function setupEnvironmentCommands(program) {
     .option('--no-poll', 'Do not poll for status'))
     .addHelpText('after', DEPLOY_EXAMPLES)
     .action(deployEnvHandler);
+
+  setupEnvSecretCommands(env);
+}
+
+/**
+ * @param {string|undefined} envKey - Positional environment
+ * @param {Object} options - CLI options
+ * @returns {Promise<void>} Exits non-zero on failure
+ */
+async function envSecretPushHandler(envKey, options) {
+  try {
+    const { resolveEnvSecretContext, resolveAppPaths } = require('../commands/env-secret-context');
+    const { runEnvSecretPush } = require('../commands/env-secret-push-run');
+    const { confirmBulkSecretPush } = require('../commands/env-secret-push-confirm');
+    const base = await resolveEnvSecretContext(envKey, options);
+    const paths = resolveAppPaths(options.app, options);
+    const confirmed = await confirmBulkSecretPush(base, options);
+    if (!confirmed) return;
+    const { exitCode } = await runEnvSecretPush({ ...base, ...paths }, {
+      key: options.key,
+      application: options.app,
+      dryRun: options.dryRun === true
+    });
+    if (exitCode !== 0) {
+      process.exit(exitCode);
+    }
+  } catch (error) {
+    handleCommandError(error, 'env secret push');
+    process.exit(1);
+  }
+}
+
+/**
+ * @param {string|undefined} envKey - Positional environment
+ * @param {Object} options - CLI options
+ * @returns {Promise<void>} Exits non-zero on failure
+ */
+async function envSecretListHandler(envKey, options) {
+  try {
+    const { resolveEnvSecretContext } = require('../commands/env-secret-context');
+    const { runEnvSecretList } = require('../commands/env-secret-list');
+    const ctx = await resolveEnvSecretContext(envKey, options);
+    const { exitCode } = await runEnvSecretList(ctx, { key: options.key, application: options.app });
+    if (exitCode !== 0) {
+      process.exit(exitCode);
+    }
+  } catch (error) {
+    handleCommandError(error, 'env secret list');
+    process.exit(1);
+  }
+}
+
+/**
+ * `aifabrix env secret` — installation secrets on the Controller.
+ * @param {import('commander').Command} env - The env command group
+ * @returns {void}
+ */
+function setupEnvSecretCommands(env) {
+  const secret = env
+    .command('secret')
+    .description('Installation configuration on the Controller (secret values remain write-only)')
+    .addHelpText('after', SECRET_GROUP_HELP_AFTER);
+
+  // The API takes the environment in the path, so both commands accept it; omitted, it falls
+  // back to the one in config.yaml. Push and list have distinct resource contracts.
+  secret
+    .command('push [env]')
+    .description('Push declared configuration from an app env file (values are never arguments)')
+    .option('--app <appKey>', 'Exact application owner of the configuration declarations')
+    .option('--file <path>', 'Env file to read values from (default: the app\'s .env)')
+    .option('--key <variable>', 'Push one .env variable name')
+    .option('--dry-run', 'Show what would be pushed and write nothing')
+    .option('-y, --yes', 'Confirm bulk push without prompting (automation / AI usage)')
+    .addHelpText('after', SECRET_PUSH_HELP_AFTER)
+    .action(envSecretPushHandler);
+
+  secret
+    .command('list [env]')
+    .description('List configuration types, safe values and status by application')
+    .option('--app <appKey>', 'Only this exact application owner (* is the wildcard owner)')
+    .option('--key <text>', 'Search key and environment-variable names')
+    .addHelpText('after', SECRET_LIST_HELP_AFTER)
+    .action(envSecretListHandler);
 }
 
 module.exports = { setupEnvironmentCommands, deployEnvHandler, addMarketplaceOptions };

package/lib/cli/setup-infra-up-platform-action.js

@@ -17,6 +17,10 @@ const { handleLogin } = require('../commands/login');
 const { handleUpMiso } = require('../commands/up-miso');
 const { handleUpDataplane } = require('../commands/up-dataplane');
 const { handleUpBuilderApi } = require('../commands/up-builder-api');
+const {
+  handleUpIntegrationServer,
+  isIntegrationServerSelected
+} = require('../commands/up-integration-server');
 const {
   applyUpPlatformForceConfig,
   cleanBuilderAppDirs,
@@ -26,7 +30,13 @@ const {
 const { runGuidedUpPlatform } = require('./infra-guided');
 const { recordInfraInstallationCommand } = require('./installation-log-command');
 
-const PLATFORM_APPS = ['keycloak', 'miso-controller', 'dataplane', 'builder-api'];
+const PLATFORM_APPS = [
+  'keycloak',
+  'miso-controller',
+  'dataplane',
+  'builder-api',
+  'integration-server'
+];
 
 /**
  * @param {Object} options
@@ -59,6 +69,9 @@ async function runUpPlatformWork(options) {
     await handleUpMiso(options);
     await handleUpDataplane(options);
     await handleUpBuilderApi({ ...options, platformInstall: true });
+    if (await isIntegrationServerSelected()) {
+      await handleUpIntegrationServer({ ...options, platformInstall: true });
+    }
   }
   return cleanedAppKeys;
 }

package/lib/cli/setup-platform.js

@@ -61,6 +61,8 @@ function registerSetup(program) {
     .option('--pro-password-mode <mode>', 'Pro profile only: autogen or manual')
     .option('--admin-email <email>', 'Admin email (non-interactive fresh install)')
     .option('--admin-password <password>', 'Admin password for dev or pro manual-single (non-interactive)')
+    .option('--integration-server', 'Install the integration server (runs once in the miso environment)')
+    .option('--no-integration-server', 'Do not install the integration server (default)')
     .option('--mode <mode>', 'Non-interactive mode: fresh (no infra) or update-images (infra running)')
     .option('-y, --yes', 'Skip destructive confirmation prompts (re-install, wipe data, teardown)')
     .addHelpText('after', SETUP_HELP_AFTER)

package/lib/commands/auth-config.js

@@ -23,6 +23,7 @@ const {
   checkUserLoggedIn
 } = require('../utils/auth-config-validator');
 const { hasStoredDeviceTokenForController } = require('../utils/controller-url');
+const { assertEnvironmentAllowedForCurrentMode } = require('../core/environment-mode-policy');
 const logger = require('../utils/logger');
 
 /**
@@ -166,6 +167,7 @@ async function handleSetEnvironment(environment) {
   try {
     // Validate environment format
     validateEnvironment(environment);
+    await assertEnvironmentAllowedForCurrentMode(environment);
 
     // Get current controller from config
     const controllerUrl = await getControllerUrl();

package/lib/commands/datasource-capability-upsert-cli.js

@@ -0,0 +1,112 @@
+/**
+ * `datasource capability upsert` command registration.
+ *
+ * @fileoverview Explicit upsert candidate authoring CLI
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const {
+  formatBlockingError,
+  headerKeyValue,
+  infoLine,
+  formatWarningLine,
+  formatNextActions
+} = require('../utils/cli-test-layout-chalk');
+const { runCapabilityUpsert } = require('../datasource/capability/run-capability-upsert');
+const { printCapabilitySuccessFooter } = require('./datasource-capability-output');
+
+const HELP = `
+Authors a manifest-declared upsert candidate only when create, update, business
+identity, and an exact vendor lookup are already declared. This is static
+authoring eligibility, not live readiness certification.
+
+  $ aifabrix datasource capability upsert my-datasource --dry-run --json
+  $ aifabrix datasource capability upsert ./datasource.yaml --identity domain
+`;
+
+function printHumanResult(result) {
+  if (result.dryRun) {
+    logger.log(infoLine('Dry run — planned JSON Patch operations:'));
+    logger.log('');
+    logger.log(JSON.stringify(result.patchOperations, null, 2));
+  } else {
+    if (result.backupPath) logger.log(headerKeyValue('Backup:', result.backupPath));
+    printCapabilitySuccessFooter(result.resolvedPath, result.updatedSections);
+  }
+  logger.log(formatWarningLine('Candidate authored — live readiness is not yet verified'));
+  logger.log(formatNextActions(result.nextActions));
+}
+
+function printUpsertIssues(issues) {
+  (issues || []).forEach((issue) => {
+    const code = issue.code ? `[${issue.code}] ` : '';
+    logger.log(formatWarningLine(`${code}${issue.message}`));
+    const details = [
+      ['Consequence', issue.consequence],
+      ['Can AI fix?', issue.aiFixable === true ? 'Yes, with an authorized local manifest change' : 'No automatic fix is safe'],
+      ['Safe action', issue.remediation],
+      ['Prevention', issue.prevention],
+      ['Residual risk', issue.residualRisk]
+    ];
+    details.forEach(([label, value]) => {
+      const values = Array.isArray(value) ? value : [value];
+      values.filter(Boolean).forEach((item) => logger.log(`  ${label}: ${item}`));
+    });
+  });
+}
+
+async function runUpsertAction(fileOrKey, options) {
+  const result = await runCapabilityUpsert({
+    fileOrKey,
+    as: options.as,
+    create: options.create,
+    update: options.update,
+    identity: options.identity,
+    test: Boolean(options.test),
+    dryRun: Boolean(options.dryRun),
+    overwrite: Boolean(options.overwrite),
+    noBackup: Boolean(options.noBackup)
+  });
+  if (options.json) {
+    logger.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  printHumanResult(result);
+}
+
+function setupCapabilityUpsertCommand(cap) {
+  cap.command('upsert <file-or-key>')
+    .description('Author an upsert candidate from declared identity and exact OpenAPI coverage')
+    .option('--as <key>', 'Target capability key', 'upsert')
+    .option('--create <key>', 'Existing create-shaped capability', 'create')
+    .option('--update <key>', 'Existing update-shaped capability', 'update')
+    .option('--identity <fields>', 'Comma-separated mapped business identity fields')
+    .option('--test', 'Add proof scaffolding when existing safe fixture facts are sufficient')
+    .option('--dry-run', 'Print JSON Patch operations; do not write')
+    .option('--overwrite', 'Replace only the target upsert slice after full analysis')
+    .option('--no-backup', 'Skip backup copy under integration/<app>/backup/')
+    .option('--json', 'Print a machine-readable result envelope')
+    .addHelpText('after', HELP)
+    .action(async(fileOrKey, options) => {
+      try {
+        await runUpsertAction(fileOrKey, options);
+      } catch (error) {
+        if (options.json) {
+          logger.log(JSON.stringify({ eligible: false, issues: error.analysis?.issues || [], error: error.message }, null, 2));
+        } else {
+          logger.error(formatBlockingError(`capability upsert failed: ${error.message}`));
+          printUpsertIssues(error.analysis?.issues);
+        }
+        process.exit(1);
+      }
+    });
+}
+
+module.exports = {
+  setupCapabilityUpsertCommand,
+  runUpsertAction,
+  printHumanResult,
+  printUpsertIssues
+};

package/lib/commands/datasource-capability.js

@@ -1,5 +1,5 @@
 /**
- * Datasource capability subcommands (copy, remove, create, diff, edit, validate).
+ * Datasource capability subcommands (copy, create, upsert, remove, diff, edit, validate).
  *
  * @fileoverview Nested `aifabrix datasource capability` CLI (copy, relate, …)
  * @author AI Fabrix Team
@@ -26,6 +26,7 @@ const pathMod = require('path');
 const { printCapabilitySuccessFooter } = require('./datasource-capability-output');
 const { setupCapabilityRelateCommand } = require('./datasource-capability-relate-cli');
 const { setupCapabilityDimensionCommand } = require('./datasource-capability-dimension-cli');
+const { setupCapabilityUpsertCommand } = require('./datasource-capability-upsert-cli');
 
 const CAP_COPY_HELP = `
 Examples:
@@ -386,7 +387,7 @@ function setupDatasourceCapabilityCommands(datasource) {
   const cap = datasource
     .command('capability')
     .description(
-      'Copy, remove, relate (FK metadata), diff, edit, or validate per-capability slices in datasource JSON'
+      'Copy, create, upsert, remove, relate, diff, edit, or validate datasource capability slices'
     );
   if (typeof cap.alias === 'function') {
     cap.alias('cap');
@@ -395,6 +396,7 @@ function setupDatasourceCapabilityCommands(datasource) {
   setupCapabilityCopyCommand(cap);
   setupCapabilityRemoveCommand(cap);
   setupCapabilityCreateCommand(cap);
+  setupCapabilityUpsertCommand(cap);
   setupCapabilityRelateCommand(cap);
   setupCapabilityDimensionCommand(cap);
   setupCapabilityDiffCommand(cap);

package/lib/commands/env-secret-context.js

@@ -0,0 +1,113 @@
+/**
+ * Resolve where `aifabrix env secret` reads from and writes to.
+ *
+ * The controller URL is resolved once and printed before any write, because pushing into
+ * the wrong installation is silent and unrecoverable — no value can be read back to show
+ * what was overwritten.
+ *
+ * @fileoverview env secret: controller, environment and file resolution
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { resolveControllerUrl } = require('../utils/controller-url');
+const { getOrRefreshDeviceToken } = require('../utils/token-manager');
+const { normalizeControllerUrl, resolveEnvironment } = require('../core/config');
+const { getAppPath, getIntegrationPath } = require('../utils/paths');
+
+/**
+ * @param {string} controllerUrl - Raw controller URL
+ * @returns {Promise<Object>} Auth config carrying a bearer token
+ * @throws {Error} When no usable token is stored
+ */
+async function resolveAuth(controllerUrl) {
+  const normalized = normalizeControllerUrl(controllerUrl);
+  const deviceToken = await getOrRefreshDeviceToken(normalized);
+  if (deviceToken && deviceToken.token) {
+    return { token: deviceToken.token, controllerUrl: deviceToken.controller || normalized };
+  }
+  throw new Error('Not signed in to the Controller. Run: aifabrix login');
+}
+
+/**
+ * Locate the application directory and env file holding the values.
+ * @param {string} appKey - Application key
+ * @param {Object} options - `file` overrides the env file path
+ * @returns {{ appPath: string, envFilePath: string }} Resolved paths
+ * @throws {Error} When the application cannot be located
+ */
+function resolveAppPaths(appKey, options = {}) {
+  if (!appKey) {
+    throw new Error('--app is required: the catalog keys are read from that application env.template');
+  }
+  // A platform application lives under builder/<appKey>/; an external system under
+  // integration/<systemKey>/. Prefer the candidate holding the default .env, then an existing
+  // application directory. An explicit --file supplies values but does not change ownership.
+  const candidates = [safePath(getAppPath, appKey), safePath(getIntegrationPath, appKey)]
+    .filter(Boolean);
+  const appPath = candidates.find(dir => fs.existsSync(path.join(dir, '.env'))) ||
+    candidates.find(dir => fs.existsSync(dir)) || candidates[0];
+  if (!appPath) {
+    throw new Error(`Application not found: ${appKey}`);
+  }
+  return {
+    appPath,
+    envFilePath: options.file ? path.resolve(options.file) : path.join(appPath, '.env')
+  };
+}
+
+/**
+ * @param {Function} resolver - Path helper
+ * @param {string} appKey - Application key
+ * @returns {string} Resolved path, or '' when the helper cannot resolve it
+ */
+function safePath(resolver, appKey) {
+  try {
+    return resolver(appKey) || '';
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * Build the context both subcommands share.
+ *
+ * The environment is the one recorded in config.yaml, not something a command accepts. It is
+ * changed deliberately with `aifabrix auth set-environment`, so a per-command override would
+ * let any string be treated as an environment and fail confusingly against the API.
+ *
+ * @param {Object} [options] - CLI options
+ * @returns {Promise<Object>} controllerUrl, authConfig, envKey
+ */
+async function resolveEnvSecretContext(envKey, options = {}) {
+  const controllerUrl = await resolveControllerUrl();
+  if (!controllerUrl) {
+    throw new Error('No Controller URL configured. Run: aifabrix auth set-controller <url>');
+  }
+  const auth = await resolveAuth(controllerUrl);
+  // The API takes the environment in the path and accepts `*` for every installed
+  // environment. Omitted, it falls back to the one recorded in config.yaml.
+  const explicit = envKey === undefined || envKey === null ? '' : String(envKey).trim();
+  const resolvedEnv = explicit || await resolveEnvironment(options);
+  if (!resolvedEnv) {
+    throw new Error(
+      'No environment given and none configured. Pass one, use * for all, ' +
+      'or set a default with: aifabrix auth set-environment <env>'
+    );
+  }
+  return {
+    controllerUrl: auth.controllerUrl || controllerUrl,
+    authConfig: { token: auth.token },
+    envKey: resolvedEnv
+  };
+}
+
+module.exports = {
+  resolveAuth,
+  resolveAppPaths,
+  resolveEnvSecretContext
+};