@aifabrix/builder 2.60.0 → 2.62.0

package/lib/commands/env-secret-list.js

@@ -0,0 +1,200 @@
+/**
+ * Show compact configuration status without exposing sensitive values.
+ *
+ * @fileoverview aifabrix env secret list
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { listEnvironmentConfiguration } = require('../api/configuration.api');
+const {
+  colorAggregateGlyph,
+  metadata,
+  sectionTitle
+} = require('../utils/cli-layout-chalk');
+
+const FORBIDDEN_FIELDS = ['data', 'ciphertext', 'reference', 'vaultName', 'secretValue'];
+const WIDTHS = Object.freeze({ status: 6, application: 20, name: 28, type: 8, value: 48 });
+const GLYPHS = Object.freeze({ ok: '✔', warn: '⚠', skipped: '⏭' });
+
+/**
+ * @param {Object} row - Configuration metadata row
+ * @param {string} application - Optional expected owner
+ * @returns {void} Throws when unsafe or contradictory
+ */
+function assertSafeRow(row, application) {
+  if (!row || typeof row !== 'object') {
+    throw new Error('Configuration list returned invalid or unsafe metadata');
+  }
+  const owner = String(row.application || '').trim();
+  const name = String(row.name || row.key || '').trim();
+  const hasValue = Object.prototype.hasOwnProperty.call(row, 'value');
+  const safeValue = [!hasValue, row.sensitive === false && typeof row.value === 'string']
+    .some(Boolean);
+  const forbidden = FORBIDDEN_FIELDS.some(field =>
+    Object.prototype.hasOwnProperty.call(row, field)
+  );
+  const exactOwner = [!application, owner === application].some(Boolean);
+  const booleans = ['sensitive', 'configured', 'required']
+    .every(field => typeof row[field] === 'boolean');
+  const valid = [owner, name, exactOwner, booleans, safeValue, !forbidden].every(Boolean);
+  if (!valid) {
+    throw new Error('Configuration list returned invalid or unsafe metadata');
+  }
+}
+
+/**
+ * @param {Object} row - Configuration metadata row
+ * @param {string} application - Optional expected exact owner
+ * @returns {Object} Safe normalized row
+ */
+function normalizeRow(row, application) {
+  assertSafeRow(row, application);
+  const owner = String(row.application).trim();
+  const name = String(row.name || row.key).trim();
+  const hasValue = Object.prototype.hasOwnProperty.call(row, 'value');
+  const state = row.configured ? 'ok' : (row.required ? 'warn' : 'skipped');
+  const normalized = {
+    application: owner,
+    name,
+    type: row.sensitive ? 'secret' : 'variable',
+    configured: row.configured,
+    required: row.required,
+    state
+  };
+  if (!row.sensitive && hasValue) normalized.value = row.value;
+  return normalized;
+}
+
+/**
+ * @param {unknown} value - Cell value
+ * @returns {string} Safe single-line cell value
+ */
+function cleanCell(value) {
+  const noControls = [...String(value ?? '')]
+    .map(char => char.charCodeAt(0) <= 31 || char.charCodeAt(0) === 127 ? ' ' : char)
+    .join('');
+  return noControls.replace(/\s+/g, ' ').trim();
+}
+
+/**
+ * @param {unknown} value - Cell value
+ * @param {number} width - Visible cell width
+ * @returns {string} Single-line padded or truncated cell
+ */
+function formatCell(value, width) {
+  const clean = cleanCell(value);
+  const visible = clean.length > width ? `${clean.slice(0, width - 1)}…` : clean;
+  return visible.padEnd(width);
+}
+
+/**
+ * Keep identifiers complete while retaining compact minimum widths.
+ * @param {Array<Object>} rows - Safe normalized rows
+ * @returns {Object} Widths for this result set
+ */
+function tableWidths(rows) {
+  return {
+    ...WIDTHS,
+    application: Math.max(WIDTHS.application, ...rows.map(row => cleanCell(row.application).length)),
+    name: Math.max(WIDTHS.name, ...rows.map(row => cleanCell(row.name).length))
+  };
+}
+
+/**
+ * @param {Object} row - Safe normalized row
+ * @param {boolean} includeApplication - Include owner column
+ * @returns {string} One compact table row
+ */
+function formatRow(row, includeApplication, widths = WIDTHS) {
+  const glyph = colorAggregateGlyph(row.state, GLYPHS[row.state]);
+  const value = row.type === 'variable'
+    ? (row.value === '' ? '""' : (row.value ?? ''))
+    : '';
+  const cells = [glyph + ' '.repeat(widths.status - 1)];
+  if (includeApplication) cells.push(formatCell(row.application, widths.application));
+  cells.push(formatCell(row.name, widths.name));
+  cells.push(formatCell(row.type, widths.type));
+  cells.push(formatCell(value, widths.value).trimEnd());
+  return `  ${cells.join('  ')}`;
+}
+
+/**
+ * @param {boolean} includeApplication - Include owner column
+ * @returns {string[]} Header and divider
+ */
+function tableHeader(includeApplication, widths = WIDTHS) {
+  const headers = [formatCell('Status', widths.status)];
+  const dividers = ['-'.repeat(widths.status)];
+  if (includeApplication) {
+    headers.push(formatCell('Application', widths.application));
+    dividers.push('-'.repeat(widths.application));
+  }
+  headers.push(formatCell('Name', widths.name), formatCell('Type', widths.type), 'Value');
+  dividers.push('-'.repeat(widths.name), '-'.repeat(widths.type), '-'.repeat(12));
+  return [`  ${headers.join('  ')}`, `  ${dividers.join('  ')}`];
+}
+
+/**
+ * @param {Array<Object>} rows - Safe rows
+ * @returns {string} Compact totals
+ */
+function formatSummary(rows) {
+  const configured = rows.filter(row => row.configured).length;
+  const requiredMissing = rows.filter(row => !row.configured && row.required).length;
+  const optionalUnset = rows.length - configured - requiredMissing;
+  const ok = colorAggregateGlyph('ok', GLYPHS.ok);
+  const warn = colorAggregateGlyph('warn', GLYPHS.warn);
+  const skipped = colorAggregateGlyph('skipped', GLYPHS.skipped);
+  const label = rows.length === 1 ? 'entry' : 'entries';
+  return `${rows.length} ${label} · ${ok} ${configured} configured · ` +
+    `${warn} ${requiredMissing} required missing · ${skipped} ${optionalUnset} optional unset`;
+}
+
+/**
+ * List Parameter declarations for an environment or exact application owner.
+ * @param {Object} ctx - controllerUrl, authConfig, envKey
+ * @param {Object} [options] - `api` for injection, application and key search
+ * @returns {Promise<{ exitCode: number, rows: Array<Object> }>} Safe normalized rows
+ */
+async function runEnvSecretList(ctx, options = {}) {
+  const application = String(options.application || '').trim();
+  const api = options.api || { listEnvironmentConfiguration };
+  const raw = await api.listEnvironmentConfiguration(
+    ctx.controllerUrl, ctx.authConfig, ctx.envKey, application || undefined,
+    options.key ? { search: String(options.key).trim() } : {}
+  );
+  if (!Array.isArray(raw)) throw new Error('Configuration list response is not an array');
+  const rows = raw.map(row => normalizeRow(row, application)).sort((left, right) =>
+    left.application.localeCompare(right.application) || left.name.localeCompare(right.name)
+  );
+  const title = application ? `${application} (${ctx.envKey})` : ctx.envKey;
+  logger.log(sectionTitle(`Configuration: ${title}`));
+  logger.log(metadata(`Controller: ${ctx.controllerUrl}`));
+  logger.log('');
+  if (rows.length === 0) {
+    const suffix = options.key ? ` matching "${options.key}"` : '';
+    logger.log(metadata(`  No configuration entries${suffix}.`));
+    return { exitCode: 0, rows };
+  }
+  const widths = tableWidths(rows);
+  tableHeader(!application, widths).forEach(line => logger.log(line));
+  rows.forEach(row => logger.log(formatRow(row, !application, widths)));
+  logger.log('');
+  logger.log(metadata(formatSummary(rows)));
+  return { exitCode: 0, rows };
+}
+
+module.exports = {
+  normalizeRow,
+  cleanCell,
+  formatCell,
+  tableWidths,
+  formatRow,
+  tableHeader,
+  formatSummary,
+  runEnvSecretList
+};

package/lib/commands/env-secret-push-confirm.js

@@ -0,0 +1,54 @@
+/**
+ * Confirmation gate for bulk installation-secret writes.
+ *
+ * @fileoverview Prevent accidental env secret bulk pushes
+ */
+
+'use strict';
+
+const readline = require('readline');
+const logger = require('../utils/logger');
+const { formatWarningLine } = require('../utils/cli-test-layout-chalk');
+
+/**
+ * @param {string} question - Prompt text
+ * @param {Object} [streams] - Injectable input/output streams
+ * @returns {Promise<string>} User response
+ */
+function promptLine(question, streams = {}) {
+  const input = streams.input || process.stdin;
+  const output = streams.output || process.stdout;
+  const rl = readline.createInterface({ input, output });
+  return new Promise(resolve => {
+    rl.question(question, answer => {
+      rl.close();
+      resolve(String(answer || '').trim());
+    });
+  });
+}
+
+/**
+ * Require explicit approval only when every mapped secret would be written.
+ * @param {Object} ctx - Resolved environment context
+ * @param {Object} options - CLI options
+ * @param {Object} [deps] - Injectable prompt and TTY state
+ * @returns {Promise<boolean>} True when execution may continue
+ */
+async function confirmBulkSecretPush(ctx, options = {}, deps = {}) {
+  if (options.key || options.dryRun || options.yes) return true;
+  const isTTY = deps.isTTY === undefined
+    ? Boolean(process.stdin.isTTY && process.stdout.isTTY) : deps.isTTY;
+  if (!isTTY) {
+    throw new Error('Bulk configuration push requires --yes in non-interactive or AI usage');
+  }
+  logger.log(formatWarningLine(
+    `Push all declared configuration from the .env for ${options.app} to ${ctx.envKey}?`
+  ));
+  const prompt = deps.prompt || promptLine;
+  const answer = await prompt('Type "yes" to confirm (anything else cancels): ');
+  if (String(answer).trim().toLowerCase() === 'yes') return true;
+  logger.log('Cancelled. No configuration values were pushed.');
+  return false;
+}
+
+module.exports = { promptLine, confirmBulkSecretPush };

package/lib/commands/env-secret-push-run.js

@@ -0,0 +1,227 @@
+/**
+ * Orchestration and reporting for `aifabrix env secret push`.
+ *
+ * Reporting is the security-sensitive half: every line names a variable, a catalog key and
+ * an outcome, and there is no branch that can print a value. Kept separate from the row
+ * mechanics so the redaction rule is easy to read in one place.
+ *
+ * @fileoverview env secret push: run, report, exit code
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const {
+  OUTCOME, readEnvFile, pushRow
+} = require('./env-secret-push');
+const { parseEnvAssignments } = require('../utils/system-secret-mapping');
+const {
+  listEnvironmentConfiguration,
+  putEnvironmentConfiguration
+} = require('../api/configuration.api');
+const { putSystemSecret } = require('../api/system-secrets.api');
+
+const GLYPH = Object.freeze({ ok: '✔', fail: '✖', skip: '·' });
+
+/**
+ * @param {Object} row - Reported row
+ * @returns {string} One aligned line naming the variable, key and outcome
+ */
+function formatRow(row, widths = { name: 34, key: 44 }) {
+  const glyph = row.outcome === OUTCOME.updated ? chalk.green(GLYPH.ok)
+    : row.outcome === OUTCOME.skipped ? chalk.gray(GLYPH.skip)
+      : chalk.red(GLYPH.fail);
+  const name = String(row.name).padEnd(widths.name);
+  const key = String(row.catalogKey || '—').padEnd(widths.key);
+  const detail = row.reason ? `${row.outcome} (${row.reason})` : row.outcome;
+  return `  ${name}-> ${key}${glyph} ${detail}`;
+}
+
+/**
+ * Keep variable and declaration names complete and aligned.
+ * @param {Array<Object>} rows - Report rows
+ * @returns {{ name: number, key: number }} Result-specific widths
+ */
+function reportWidths(rows) {
+  return {
+    name: Math.max(34, ...rows.map(row => String(row.name).length)),
+    key: Math.max(44, ...rows.map(row => String(row.catalogKey || '—').length))
+  };
+}
+
+/**
+ * Print the installation before the first write. Pushing into the wrong installation is
+ * silent and unrecoverable, because no value can be read back to show what was overwritten.
+ * @param {Object} ctx - controllerUrl, envKey
+ * @returns {void}
+ */
+function reportTarget(ctx) {
+  logger.log(`Controller: ${ctx.controllerUrl}   environment: ${ctx.envKey}`);
+  logger.log('');
+}
+
+/**
+ * @param {Array<Object>} results - Reported rows
+ * @param {boolean} dryRun - Whether anything was written
+ * @returns {number} Exit code: non-zero when any row failed
+ */
+function reportSummary(results, dryRun) {
+  const failed = results.filter(row => row.outcome !== OUTCOME.updated && row.outcome !== OUTCOME.skipped);
+  const updated = results.filter(row => row.outcome === OUTCOME.updated);
+  const skipped = results.filter(row => row.outcome === OUTCOME.skipped);
+  // Count only the rows that would actually be written. Counting skipped rows as "would be
+  // pushed" overstates what the command does, which is the one thing a dry run must not do.
+  const considered = results.length - skipped.length;
+  logger.log('');
+  if (dryRun) {
+    const tail = skipped.length > 0 ? ` ${skipped.length} skipped.` : '';
+    logger.log(`Dry run: ${updated.length} of ${considered} configuration value(s) would be pushed.${tail} Nothing was written.`);
+    return 0;
+  }
+  if (failed.length === 0) {
+    logger.log(`${updated.length} of ${considered} pushed.`);
+    return 0;
+  }
+  logger.log(`${updated.length} of ${considered} pushed; ${failed.length} failed.`);
+  reportRemediation(failed);
+  return 1;
+}
+
+/**
+ * One hint per failure class, because each has a different owner.
+ * @param {Array<Object>} failed - Failing rows
+ * @returns {void}
+ */
+function reportRemediation(failed) {
+  if (failed.some(row => row.outcome === OUTCOME.notInCatalog)) {
+    logger.log('The controller no longer recognizes those configuration declarations.');
+    logger.log('Refresh with aifabrix env secret list, then retry using the current declaration.');
+  }
+  if (failed.some(row => row.outcome === OUTCOME.forbidden)) {
+    logger.log('Setting a system secret requires the controller:admin scope. Run: aifabrix login');
+  }
+  if (failed.some(row => row.outcome === OUTCOME.unreachable)) {
+    logger.log('Nothing was written for those keys. Check the controller URL above and retry.');
+  }
+  if (failed.some(row => row.outcome === OUTCOME.conflict)) {
+    logger.log('The configuration changed before the write. Run the push again to use a fresh revision.');
+  }
+}
+
+/**
+ * Map .env variable names to authoritative Controller declarations.
+ * @param {string} envContent - Application .env content
+ * @param {Array<Object>} declarations - Controller configuration rows
+ * @param {string} [only] - Optional exact .env variable name
+ * @param {string} [application] - Expected exact application owner
+ * @returns {{ pushable: Array<Object>, skipped: Array<Object> }} Revision-bound rows
+ */
+function mapEnvConfiguration(envContent, declarations, only, application) {
+  const pushable = [];
+  const skipped = [];
+  const values = parseEnvAssignments(envContent);
+  for (const [name, value] of values) {
+    if (only && name !== only) continue;
+    const matches = declarations.filter(item => item && item.name === name &&
+      (!application || item.application === application));
+    if (matches.length !== 1) {
+      skipped.push({ name, reason: matches.length ? 'ambiguous declaration' : 'not declared' });
+      continue;
+    }
+    const match = matches[0];
+    if (typeof match.sensitive !== 'boolean' || !match.key || !match.application || !match.revision) {
+      skipped.push({ name, catalogKey: match.key, reason: 'incomplete declaration metadata' });
+      continue;
+    }
+    if (match.sensitive && !value) {
+      skipped.push({ name, catalogKey: match.key, reason: 'no secret value in the env file' });
+      continue;
+    }
+    pushable.push({
+      name, value, catalogKey: match.key, application: match.application,
+      revision: match.revision, sensitive: match.sensitive
+    });
+  }
+  if (only && !values.has(only)) skipped.push({ name: only, reason: 'not present in the env file' });
+  return { pushable, skipped };
+}
+
+/**
+ * @param {Object} deps - Injected api
+ * @param {Object} ctx - controllerUrl, authConfig, envKey
+ * @param {Array<Object>} ready - Rows to push
+ * @returns {Promise<Array<Object>>} Reported rows
+ */
+async function pushAll(deps, ctx, ready) {
+  const results = [];
+  for (const row of ready) {
+    const result = await pushRow(deps, ctx, row);
+    results.push(result);
+    if (result.fatal) {
+      // 403 fails identically for every remaining key; report them rather than retry.
+      for (const remaining of ready.slice(results.length)) {
+        results.push({ name: remaining.name, catalogKey: remaining.catalogKey, outcome: result.outcome });
+      }
+      break;
+    }
+  }
+  return results;
+}
+
+/**
+ * Run the push.
+ * @param {Object} ctx - controllerUrl, authConfig, envKey, envFilePath
+ * @param {Object} [options] - `key`, `dryRun`, `api`
+ * @returns {Promise<{ exitCode: number, results: Array<Object> }>} Outcome per row
+ */
+async function runEnvSecretPush(ctx, options = {}) {
+  const envContent = readEnvFile(ctx.envFilePath, options);
+  const api = options.api || {
+    listEnvironmentConfiguration, putSystemSecret, putEnvironmentConfiguration
+  };
+  const declarations = await api.listEnvironmentConfiguration(
+    ctx.controllerUrl, ctx.authConfig, ctx.envKey, options.application
+  );
+  const { pushable, skipped } = mapEnvConfiguration(
+    envContent, declarations, options.key, options.application
+  );
+  reportTarget(ctx);
+  // Every mapped row is attempted. Whether an unlisted key can be written differs by
+  // installation, so only the server can answer it.
+  const results = options.dryRun
+    ? dryRunRows(pushable)
+    : await pushAll(options, ctx, pushable);
+  const reported = results.concat(skipped.map(row => ({ ...row, outcome: OUTCOME.skipped })));
+  const widths = reportWidths(reported);
+  for (const row of reported) {
+    logger.log(formatRow(row, widths));
+  }
+  return { exitCode: reportSummary(reported, options.dryRun === true), results: reported };
+}
+
+/**
+ * Dry-run rows: what would be attempted. Catalog validity is decided by PUT on a real run.
+ * @param {Array<Object>} pushable - Mapped rows
+ * @returns {Array<Object>} Reportable rows that write nothing
+ */
+function dryRunRows(pushable) {
+  return pushable.map(row => ({
+    name: row.name,
+    catalogKey: row.catalogKey,
+    outcome: OUTCOME.updated
+  }));
+}
+
+module.exports = {
+  formatRow,
+  reportWidths,
+  reportTarget,
+  reportSummary,
+  dryRunRows,
+  pushAll,
+  mapEnvConfiguration,
+  runEnvSecretPush
+};

package/lib/commands/env-secret-push.js

@@ -0,0 +1,168 @@
+/**
+ * Push declared configuration values from an operator's env file into an installation.
+ *
+ * Every value in this module comes from a file and goes to one API call. It is never an
+ * argument (so it cannot reach shell history or a process list), never logged, and never
+ * placed in a message, a progress line or a JSON envelope — on success or on failure.
+ * Rows are reported by variable name, declaration key and outcome only.
+ *
+ * The command updates Controller declarations and cannot create a new declaration.
+ *
+ * @fileoverview aifabrix env secret push
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const { putSystemSecret } = require('../api/system-secrets.api');
+const {
+  listEnvironmentConfiguration,
+  putEnvironmentConfiguration
+} = require('../api/configuration.api');
+
+/** Outcome codes reported per row; none of them can carry a value. */
+const OUTCOME = Object.freeze({
+  updated: 'updated',
+  notInCatalog: 'not declared',
+  forbidden: 'not permitted',
+  conflict: 'configuration changed; retry',
+  unreachable: 'controller unreachable',
+  skipped: 'skipped'
+});
+
+/**
+ * HTTP status from an API client error, when it carries one.
+ * @param {Error} error - Thrown error
+ * @returns {number} Status code, or 0 when the failure was not an HTTP response
+ */
+function statusOf(error) {
+  const status = error && (error.status || error.statusCode ||
+    (error.response && error.response.status));
+  return Number.isInteger(status) ? status : 0;
+}
+
+/**
+ * The API client resolves non-2xx responses as `{ success: false, status }` rather than
+ * throwing, so a failure that is only caught in a try/catch is reported as success. Verified
+ * against the live controller: a PUT to an undefined catalog key resolves with status 404.
+ * @param {Object} response - Resolved API response
+ * @returns {boolean} True when the call did not succeed
+ */
+function isFailedResponse(response) {
+  if (!response || typeof response !== 'object') {
+    return false;
+  }
+  if (response.success === false) {
+    return true;
+  }
+  const status = statusOf(response);
+  return status >= 400;
+}
+
+/**
+ * Classify a failure by owner. 403, 404 and transport failures need different messages
+ * because different people fix them; collapsing them to "failed to push" helps nobody.
+ * @param {Error} error - Thrown error
+ * @returns {{ outcome: string, fatal: boolean }} Outcome and whether remaining keys are pointless
+ */
+function classifyFailure(error) {
+  const status = statusOf(error);
+  if (status === 403 || status === 401) {
+    // Every remaining key fails the same way, so stop rather than repeat it.
+    return { outcome: OUTCOME.forbidden, fatal: true };
+  }
+  if (status === 404) {
+    return { outcome: OUTCOME.notInCatalog, fatal: false };
+  }
+  if (status === 409) {
+    return { outcome: OUTCOME.conflict, fatal: true };
+  }
+  return { outcome: OUTCOME.unreachable, fatal: false };
+}
+
+/**
+ * A secrets file that git does not ignore is one `git add .` away from being committed, and
+ * a committed secret is disclosed no matter what happens afterwards. Refuse rather than
+ * read it. An untracked path outside any repository is fine — there is nothing to commit to.
+ *
+ * @param {string} filePath - Env file path
+ * @param {Object} [deps] - `execFileSync` for tests
+ * @returns {boolean} True when git ignores the file, or the path is not in a repository
+ */
+function isIgnoredByGit(filePath, deps = {}) {
+  const exec = deps.execFileSync || execFileSync;
+  const cwd = path.dirname(filePath);
+  try {
+    exec('git', ['check-ignore', '-q', '--', filePath], { cwd, stdio: 'ignore' });
+    return true;
+  } catch (error) {
+    // check-ignore exits 1 when the path is NOT ignored, and 128 outside a repository.
+    return statusOf(error) === 128 || (error && error.status === 128);
+  }
+}
+
+/**
+ * @param {string} filePath - Env file path
+ * @param {Object} [deps] - `execFileSync` for tests
+ * @returns {string} File content
+ * @throws {Error} When the file is missing or git does not ignore it
+ */
+function readEnvFile(filePath, deps = {}) {
+  if (!filePath || !fs.existsSync(filePath)) {
+    throw new Error(`Env file not found: ${filePath || '(no path resolved)'}`);
+  }
+  if (!isIgnoredByGit(filePath, deps)) {
+    throw new Error(
+      `Refusing to read ${filePath}: git does not ignore it. ` +
+      'A secrets file inside a tracked path can be committed by accident. ' +
+      'Add it to .gitignore, or pass --file with a path outside the repository.'
+    );
+  }
+  return fs.readFileSync(filePath, 'utf8');
+}
+
+/**
+ * Push one row. Returns an outcome; never returns or throws the value.
+ * @param {Object} deps - Injected api
+ * @param {Object} ctx - controllerUrl, authConfig, envKey
+ * @param {Object} row - name, catalogKey, value
+ * @returns {Promise<{ name: string, catalogKey: string, outcome: string, fatal?: boolean }>} Result
+ */
+async function pushRow(deps, ctx, row) {
+  const api = deps.api || {
+    putSystemSecret, listEnvironmentConfiguration, putEnvironmentConfiguration
+  };
+  try {
+    const common = [ctx.controllerUrl, ctx.authConfig, ctx.envKey];
+    const response = row.sensitive
+      ? await api.putSystemSecret(
+        ...common, row.catalogKey, row.value, row.revision
+      )
+      : await api.putEnvironmentConfiguration(
+        ...common, row.application, row.catalogKey,
+        { value: row.value, revision: row.revision }
+      );
+    if (isFailedResponse(response)) {
+      const { outcome, fatal } = classifyFailure(response);
+      return { name: row.name, catalogKey: row.catalogKey, outcome, fatal };
+    }
+    return { name: row.name, catalogKey: row.catalogKey, outcome: OUTCOME.updated };
+  } catch (error) {
+    const { outcome, fatal } = classifyFailure(error);
+    return { name: row.name, catalogKey: row.catalogKey, outcome, fatal };
+  }
+}
+
+module.exports = {
+  OUTCOME,
+  classifyFailure,
+  statusOf,
+  isIgnoredByGit,
+  isFailedResponse,
+  readEnvFile,
+  pushRow
+};

package/lib/commands/login.js

@@ -121,6 +121,10 @@ async function normalizeControllerUrl(options) {
 async function handleEnvironmentConfig(options) {
   if (options.environment) {
     const environment = options.environment.trim();
+    // `login -e tst` sets the environment without going through `auth set-environment`,
+    // so the mode rule has to be applied here too or it is trivially bypassed.
+    const { assertEnvironmentAllowedForCurrentMode } = require('../core/environment-mode-policy');
+    await assertEnvironmentAllowedForCurrentMode(environment);
     await setCurrentEnvironment(environment);
     if (!options.compact) {
       logger.log(chalk.gray(`Environment: ${environment}`));

package/lib/commands/repair-datasource-apply.js

@@ -8,6 +8,8 @@
 
 'use strict';
 
+const { repairLegacyDatasource } = require('./repair-datasource-legacy');
+const { repairKeyedDocument } = require('./repair-datasource-keyed-document');
 const { repairOpenapiSection } = require('./repair-datasource-openapi');
 const { repairSyncOperationsFromCapabilities } = require('./repair-datasource-sync-operations');
 const { normalizeAutoRbacOperationKeys } = require('./repair-datasource-auto-rbac');
@@ -121,7 +123,8 @@ function applyOpenapiDatasourceRepairs(parsed, changes) {
  */
 function runRepairDatasourceFile(parsed, options, changes, helpers) {
   const out = Array.isArray(changes) ? changes : [];
-  let updated = helpers.stripDeprecatedServiceCategory(parsed, out);
+  let updated = repairLegacyDatasource(parsed, out);
+  updated = helpers.stripDeprecatedServiceCategory(parsed, out) || updated;
 
   if (shouldApplyServiceContractRepair(parsed, options)) {
     updated = repairNoneLlmToServiceContract(parsed, out) || updated;
@@ -132,6 +135,7 @@ function runRepairDatasourceFile(parsed, options, changes, helpers) {
 
   const none = helpers.isNoneEntityType(parsed?.entityType);
 
+  updated = repairKeyedDocument(parsed, options, out) || updated;
   updated = applyBaseDatasourceRepairs(parsed, none, out, options, helpers) || updated;
   updated = applyOpenapiDatasourceRepairs(parsed, out) || updated;
   updated = applyOptionalDatasourceRepairs(parsed, options, none, out, helpers) || updated;