@aifabrix/builder 2.61.2 → 2.62.0

package/lib/utils/compose-generator.js

@@ -22,7 +22,8 @@ const { isVectorDatabaseName } = require('./compose-vector-helper');
 const { resolveMisoEnvironment } = require('./compose-miso-env');
 const {
   buildScopedLocalContainerName,
-  composeTraefikServiceKey
+  composeTraefikServiceKey,
+  isScopeActiveForOptions
 } = require('./environment-scoped-resources');
 const {
   derivePathFromPattern,
@@ -308,9 +309,7 @@ function buildServiceConfig(appName, config, port, devId, runExtras = {}) {
   const hostPort = port;
   const useTraefikScope =
     scopeOpts &&
-    scopeOpts.effectiveEnvironmentScopedResources &&
-    scopeOpts.runEnvKey &&
-    (scopeOpts.runEnvKey === 'dev' || scopeOpts.runEnvKey === 'tst');
+    isScopeActiveForOptions(scopeOpts);
   const composeAppKey = useTraefikScope
     ? composeTraefikServiceKey(appName, scopeOpts.runEnvKey)
     : null;
@@ -380,9 +379,7 @@ function buildNetworkAndContainerNames(appName, devId, idNum, scopeOpts = null)
   let containerName;
   if (
     scopeOpts &&
-    scopeOpts.effectiveEnvironmentScopedResources &&
-    scopeOpts.runEnvKey &&
-    (scopeOpts.runEnvKey === 'dev' || scopeOpts.runEnvKey === 'tst')
+    isScopeActiveForOptions(scopeOpts)
   ) {
     containerName = buildScopedLocalContainerName(appName, devId, idNum, scopeOpts.runEnvKey);
   } else {

package/lib/utils/compose-miso-env.js

@@ -8,11 +8,11 @@
 
 /**
  * @param {Object} options - Run options
- * @returns {'dev'|'tst'|'pro'}
+ * @returns {'miso'|'dev'|'tst'|'pro'}
  */
 function resolveMisoEnvironment(options) {
   const env = (options.env && typeof options.env === 'string') ? options.env.toLowerCase() : 'dev';
-  return (env === 'tst' || env === 'pro') ? env : 'dev';
+  return (env === 'miso' || env === 'tst' || env === 'pro') ? env : 'dev';
 }
 
 module.exports = { resolveMisoEnvironment };

package/lib/utils/compose-traefik-ingress-base.js

@@ -7,7 +7,8 @@
  */
 
 const {
-  buildEnvScopedTraefikPath
+  buildEnvScopedTraefikPath,
+  isScopeActiveForOptions
 } = require('./environment-scoped-resources');
 const { parseDeveloperIdNum } = require('./declarative-url-ports');
 const {
@@ -122,9 +123,7 @@ function buildTraefikIngressBase(config, devId, scopeOpts, remoteServer, develop
   let pathOut = basePath;
   if (
     scopeOpts &&
-    scopeOpts.effectiveEnvironmentScopedResources &&
-    scopeOpts.runEnvKey &&
-    (scopeOpts.runEnvKey === 'dev' || scopeOpts.runEnvKey === 'tst')
+    isScopeActiveForOptions(scopeOpts)
   ) {
     pathOut = buildEnvScopedTraefikPath(basePath, scopeOpts.runEnvKey);
   }

package/lib/utils/declarative-url-ports.js

@@ -59,6 +59,9 @@ function dataplaneDockerHostPort(appPort, developerIdNum, environmentKey = 'dev'
   if (env === 'tst') {
     return baseHostPort + 20;
   }
+  if (env === 'pro') {
+    return baseHostPort + 30;
+  }
   return id === 0 ? appPort : baseHostPort;
 }
 

package/lib/utils/env-environment-file-paths.js

@@ -0,0 +1,105 @@
+/**
+ * Per-environment env file names (plan 210.0).
+ *
+ * One host runs several environments, so the env file an environment is given has to be its
+ * own. The suffix order is **environment before profile**:
+ *
+ * ```text
+ * .env            .env.local            dev
+ * .env.tst        .env.tst.local        tst
+ * .env.pro        .env.pro.local        pro
+ * ```
+ *
+ * Two properties make that ordering the right one. `dev` keeps the names it has, so nothing
+ * existing is renamed and no tooling that looks for `.env` stops finding it. And `.local`
+ * stays the last segment, so the rule "a `.local` file is host-only and is never mounted
+ * into a container" is still readable from the name alone — `.env.local.tst` would have
+ * quietly broken that, since the profile would no longer be where every existing check looks
+ * for it.
+ *
+ * Pure: no filesystem access. The environment comes from the caller.
+ *
+ * @fileoverview Environment-suffixed env and env.local file paths
+ */
+
+'use strict';
+
+const path = require('path');
+const { isPromotionOnlyEnvironment } = require('../core/environment-mode-policy');
+
+/** The host-only profile suffix, which must stay last. */
+const LOCAL_PROFILE_SUFFIX = '.local';
+
+/**
+ * The environment segment for an env file name.
+ *
+ * Empty for `dev` and for an absent environment, which is what keeps `.env` meaning what it
+ * has always meant.
+ *
+ * @param {string} [envKey] - Environment key
+ * @returns {string} `''`, `.tst` or `.pro`
+ */
+function environmentEnvFileSegment(envKey) {
+  return isPromotionOnlyEnvironment(envKey) ? `.${String(envKey).trim().toLowerCase()}` : '';
+}
+
+/**
+ * The env file an environment is given.
+ *
+ * @param {string} envOutputPath - Resolved path ending in `.env`
+ * @param {string} [envKey] - Environment key
+ * @returns {string} Path ending in `.env`, `.env.tst` or `.env.pro`
+ * @throws {Error} When no base path is given
+ */
+function resolveEnvOutputPathForEnvironment(envOutputPath, envKey) {
+  const base = typeof envOutputPath === 'string' ? envOutputPath.trim() : '';
+  if (!base) {
+    throw new Error('envOutputPath is required to resolve an environment env file');
+  }
+  const segment = environmentEnvFileSegment(envKey);
+  if (!segment || base.endsWith(segment)) {
+    return base;
+  }
+  return `${base}${segment}`;
+}
+
+/**
+ * The host-only sibling of an environment's env file.
+ *
+ * Built from the environment path so the profile suffix is always last, whichever
+ * environment it belongs to.
+ *
+ * @param {string} envOutputPath - Resolved path ending in `.env`
+ * @param {string} [envKey] - Environment key
+ * @returns {string} Path ending in `.local`
+ * @throws {Error} When no base path is given
+ */
+function resolveEnvLocalOutputPathForEnvironment(envOutputPath, envKey) {
+  const base = typeof envOutputPath === 'string' ? envOutputPath.trim() : '';
+  if (!base) {
+    throw new Error('envOutputPath is required to resolve an environment .local env file');
+  }
+  const withoutProfile = base.endsWith(LOCAL_PROFILE_SUFFIX)
+    ? base.slice(0, -LOCAL_PROFILE_SUFFIX.length)
+    : base;
+  const forEnvironment = resolveEnvOutputPathForEnvironment(withoutProfile, envKey);
+  return `${forEnvironment}${LOCAL_PROFILE_SUFFIX}`;
+}
+
+/**
+ * Whether a file name is the host-only profile, for any environment.
+ *
+ * @param {string} filePath - Path or file name
+ * @returns {boolean}
+ */
+function isHostOnlyEnvFile(filePath) {
+  return path.basename(String(filePath ?? '')).endsWith(LOCAL_PROFILE_SUFFIX);
+}
+
+module.exports = {
+  LOCAL_PROFILE_SUFFIX,
+  environmentEnvFileSegment,
+  resolveEnvOutputPathForEnvironment,
+  resolveEnvLocalOutputPathForEnvironment,
+  isHostOnlyEnvFile
+};

package/lib/utils/environment-scoped-resources.js

@@ -1,6 +1,6 @@
 /**
  * Environment-scoped resource naming (shared infra: dev/tst on same Postgres/Redis/Docker).
- * Effective only when user gate AND app flag AND run env is dev|tst.
+ * Effective only when user gate AND app flag AND run env is dev|tst|pro.
  *
  * @fileoverview environmentScopedResources + useEnvironmentScopedResources helpers
  * @author AI Fabrix Team
@@ -10,14 +10,44 @@
 'use strict';
 
 /**
- * Run/env keys that participate in resource prefixing (not pro).
+ * Run/env keys that participate in resource prefixing.
+ *
+ * `pro` is included (plan 210.0). It was excluded while `tst` was the only promotion target,
+ * which left `/pro/data` ungenerated and every pro resource sharing dev's name, Redis index
+ * and port. On a shared developer host that is a collision, not an absence.
+ *
+ * Callers must use this predicate rather than comparing keys inline: the same `dev || tst`
+ * test was written out in five other modules, and every one of them had to be found to add
+ * a single environment.
+ */
+const SCOPED_RUN_ENVIRONMENTS = Object.freeze(['dev', 'tst', 'pro']);
+
+/** Redis logical DB per environment on one shared instance. Distinct by construction. */
+const REDIS_DB_INDEX_BY_ENV = Object.freeze({ dev: 0, tst: 1, pro: 2 });
+
+/**
  * @param {string} envKey - Normalized lowercase env key
  * @returns {boolean}
  */
 function isScopedRunEnvironmentKey(envKey) {
   if (!envKey || typeof envKey !== 'string') return false;
-  const k = envKey.toLowerCase();
-  return k === 'dev' || k === 'tst';
+  return SCOPED_RUN_ENVIRONMENTS.includes(envKey.toLowerCase());
+}
+
+/**
+ * Whether a scope context carries both the gate and a scopable environment.
+ *
+ * The five call sites that need this each combined `effectiveEnvironmentScopedResources`
+ * with their own copy of the environment test; this is that combination, once.
+ *
+ * @param {{ effectiveEnvironmentScopedResources?: boolean, runEnvKey?: string }|null} scopeOpts
+ * @returns {boolean}
+ */
+function isScopeActiveForOptions(scopeOpts) {
+  if (!scopeOpts || !scopeOpts.effectiveEnvironmentScopedResources) {
+    return false;
+  }
+  return isScopedRunEnvironmentKey(scopeOpts.runEnvKey);
 }
 
 /**
@@ -42,17 +72,18 @@ function computeEffectiveEnvironmentScopedResources(
 
 /**
  * Redis logical DB index when env-scoped resources are effective.
- * dev → 0, tst → 1 (single shared Redis instance).
+ * dev → 0, tst → 1, pro → 2 (single shared Redis instance).
+ *
+ * Returning null for a scoped environment would put it on DB 0 alongside dev, so this must
+ * cover every key in {@link SCOPED_RUN_ENVIRONMENTS}.
  *
- * @param {string} runEnvKey - dev | tst
+ * @param {string} runEnvKey - dev | tst | pro
  * @returns {number|null} Index or null if not applicable
  */
 function redisDbIndexForScopedRunEnv(runEnvKey) {
   if (!runEnvKey || typeof runEnvKey !== 'string') return null;
-  const k = runEnvKey.toLowerCase();
-  if (k === 'dev') return 0;
-  if (k === 'tst') return 1;
-  return null;
+  const index = REDIS_DB_INDEX_BY_ENV[runEnvKey.toLowerCase()];
+  return index === undefined ? null : index;
 }
 
 /**
@@ -61,7 +92,7 @@ function redisDbIndexForScopedRunEnv(runEnvKey) {
  * @param {string} appName - Application key
  * @param {string|number} devId - Developer id
  * @param {number} idNum - Parsed numeric developer id
- * @param {string} envKey - dev | tst
+ * @param {string} envKey - dev | tst | pro
  * @returns {string}
  */
 function buildScopedLocalContainerName(appName, devId, idNum, envKey) {
@@ -93,7 +124,7 @@ function buildDefaultLocalContainerName(appName, devId, idNum) {
  * @param {string} appName - Application key
  * @param {string|number} developerId - Developer id
  * @param {boolean} effectiveScoped - From {@link computeEffectiveEnvironmentScopedResources}
- * @param {string} [runEnvKey] - dev | tst (required when effectiveScoped)
+ * @param {string} [runEnvKey] - dev | tst | pro (required when effectiveScoped)
  * @returns {string}
  */
 function resolveRunContainerName(appName, developerId, effectiveScoped, runEnvKey) {
@@ -108,7 +139,7 @@ function resolveRunContainerName(appName, developerId, effectiveScoped, runEnvKe
  * Traefik PathPrefix: prefix /{envKey} before pattern base (e.g. /api → /dev/api).
  *
  * @param {string} basePath - From derivePathFromPattern
- * @param {string} envKey - dev | tst
+ * @param {string} envKey - dev | tst | pro
  * @returns {string}
  */
 function buildEnvScopedTraefikPath(basePath, envKey) {
@@ -125,7 +156,7 @@ function buildEnvScopedTraefikPath(basePath, envKey) {
  * Compose service + Traefik router key when env-scoped (unique per env on shared host).
  *
  * @param {string} appName - Application key
- * @param {string} envKey - dev | tst
+ * @param {string} envKey - dev | tst | pro
  * @returns {string}
  */
 function composeTraefikServiceKey(appName, envKey) {
@@ -133,7 +164,10 @@ function composeTraefikServiceKey(appName, envKey) {
 }
 
 module.exports = {
+  SCOPED_RUN_ENVIRONMENTS,
+  REDIS_DB_INDEX_BY_ENV,
   isScopedRunEnvironmentKey,
+  isScopeActiveForOptions,
   computeEffectiveEnvironmentScopedResources,
   redisDbIndexForScopedRunEnv,
   buildScopedLocalContainerName,

package/lib/utils/paths-system-builder-keys.js

@@ -8,7 +8,13 @@
 
 'use strict';
 
-const SYSTEM_BUILDER_APP_KEYS = Object.freeze(['keycloak', 'miso-controller', 'dataplane', 'builder-api']);
+const SYSTEM_BUILDER_APP_KEYS = Object.freeze([
+  'keycloak',
+  'miso-controller',
+  'dataplane',
+  'builder-api',
+  'integration-server'
+]);
 
 /**
  * @param {string} appName

package/lib/utils/paths.js

@@ -473,7 +473,13 @@ function getBuilderRoot() {
  * {@link getSystemBuilderRoot} (= {@link getAppsMaterializationParent}`/builder`), never the global CLI package tree.
  * @readonly
  */
-const SYSTEM_BUILDER_APP_KEYS = Object.freeze(['keycloak', 'miso-controller', 'dataplane', 'builder-api']);
+const SYSTEM_BUILDER_APP_KEYS = Object.freeze([
+  'keycloak',
+  'miso-controller',
+  'dataplane',
+  'builder-api',
+  'integration-server'
+]);
 
 /**
  * @param {string} appName
@@ -1156,4 +1162,3 @@ module.exports = {
   resolveAppWorkspace: require('./app-path-resolve').resolveAppWorkspace,
   resolveExternalSystemPath: require('./app-path-resolve').resolveExternalSystemPath
 };
-

package/lib/utils/postgres-platform-bootstrap.js

@@ -164,6 +164,35 @@ async function ensurePlatformDatabaseSlot(container, slot, secrets, adminPasswor
   return slot.dbName;
 }
 
+/**
+ * Databases this server already has.
+ *
+ * Read before anything is created, so an environment can adopt a database an older
+ * installation left behind instead of renaming it — a rename here means dropping and
+ * recreating, which means losing the data.
+ *
+ * @async
+ * @param {string} container - Postgres container name
+ * @param {string} adminPassword - Superuser password
+ * @returns {Promise<string[]>} Database names, empty when the server cannot be listed
+ */
+async function listExistingDatabaseNames(container, adminPassword) {
+  try {
+    const result = await dockerExec.execWithDockerEnv(
+      `docker exec -e PGPASSWORD -i ${container} psql -U ${SUPERUSER_ROLE} -d postgres -tAc "SELECT datname FROM pg_database WHERE datistemplate = false"`,
+      { env: { PGPASSWORD: adminPassword } }
+    );
+    return String((result && result.stdout) || '')
+      .split('\n')
+      .map((line) => line.trim())
+      .filter(Boolean);
+  } catch {
+    // An unreadable server adopts nothing and creates under the contract name. Failing here
+    // would block a fresh install, where there is nothing to list in the first place.
+    return [];
+  }
+}
+
 /**
  * @async
  * @returns {Promise<{ container: string, adminPassword: string, secrets: Object }>}
@@ -202,5 +231,10 @@ module.exports = {
   PLATFORM_DATABASE_SLOTS,
   bootstrapPlatformPostgresDatabases,
   pgRoleName,
-  extractPasswordFromUrlOrValue
+  extractPasswordFromUrlOrValue,
+  // Reused by the local environment stage, which needs the same primitives under
+  // environment-scoped names rather than the unprefixed defaults this module creates.
+  resolveBootstrapContext,
+  listExistingDatabaseNames,
+  ensureRoleAndDatabase
 };

package/lib/utils/redis-env-scope.js

@@ -59,4 +59,24 @@ function applyRedisDbIndexToEnvContent(content, dbIndex) {
   return out.join('\n');
 }
 
-module.exports = { applyRedisDbIndexToEnvContent, setRedisUrlDbIndex };
+/**
+ * Point a scoped environment at its own Redis logical database.
+ *
+ * Here rather than at the call site because this module already owns the rewrite, and the
+ * caller is a 500-line file whose budget this would spend. Separating it is honest anyway:
+ * it is the only step that rewrites a resolved value instead of resolving one.
+ *
+ * @param {string} content - Resolved env content
+ * @param {string} runEnvKey - Run environment key
+ * @param {boolean} effective - Whether env-scoped resources apply
+ * @returns {string} Content, unchanged when scoping does not apply
+ */
+function applyScopedRedisDbIndex(content, runEnvKey, effective) {
+  if (!effective) {
+    return content;
+  }
+  const { redisDbIndexForScopedRunEnv } = require('./environment-scoped-resources');
+  return applyRedisDbIndexToEnvContent(content, redisDbIndexForScopedRunEnv(runEnvKey));
+}
+
+module.exports = { applyRedisDbIndexToEnvContent, setRedisUrlDbIndex, applyScopedRedisDbIndex };

package/lib/utils/registry-auth-sources.js

@@ -0,0 +1,154 @@
+/**
+ * Where a registry credential comes from when none is stored.
+ *
+ * Builder is registry-agnostic: Docker Hub, GHCR and ACR are all a host, a username and a
+ * password, and an individual identity, a registry token and an admin key all fit that
+ * shape. The only special case is that an `*.azurecr.io` host can also be authenticated by
+ * the Azure CLI, which is worth trying before asking a person to paste a secret.
+ *
+ * Order: the stored pair (handled by the caller), then `az acr login` for ACR, then a
+ * prompt. A non-interactive run never prompts — it fails naming the host and how to
+ * configure it, because a hung prompt in CI is worse than a clear failure.
+ *
+ * @fileoverview Credential source strategy for registries without a stored pair
+ */
+
+'use strict';
+
+/** Azure Container Registry login server suffix. */
+const ACR_HOST_SUFFIX = '.azurecr.io';
+
+/**
+ * @param {string} host - Registry host
+ * @returns {boolean} True for an Azure Container Registry login server
+ */
+function isAzureContainerRegistryHost(host) {
+  return String(host || '').trim().toLowerCase().endsWith(ACR_HOST_SUFFIX);
+}
+
+/**
+ * Message for a run that cannot ask for credentials.
+ *
+ * @param {string} host - Registry host
+ * @returns {string}
+ */
+function nonInteractiveCredentialMessage(host) {
+  const acrHint = isAzureContainerRegistryHost(host)
+    ? ` For Azure Container Registry you can instead run "az login" so "az acr login --name ${String(host).split('.')[0]}" succeeds.`
+    : '';
+  return (
+    `No credentials for ${host} and nothing to ask: this run is not interactive. ` +
+    `Store a pair with "aifabrix dev set-registry ${host} --username <username> --password-stdin".${acrHint}`
+  );
+}
+
+/**
+ * Build the fallback `ensureRegistryLogin` uses when no pair is stored.
+ *
+ * Dependencies are injected so the chain can be tested without a terminal, an Azure CLI or
+ * a Docker daemon.
+ *
+ * @param {Object} [deps] - Injectable dependencies
+ * @param {boolean} [deps.interactive] - Whether a person can be asked; defaults to TTY
+ * @param {Function} [deps.acrLogin] - async (host) => void, defaults to `az acr login`
+ * @param {Function} [deps.promptCredentials] - async (host) => { username, password }
+ * @param {Function} [deps.saveCredentials] - async (host, username, password) => void
+ * @param {Function} [deps.dockerLogin] - async (host, username, password) => void
+ * @returns {(host: string) => Promise<'acr'|'prompt'>} Fallback for ensureRegistryLogin
+ */
+/**
+ * An error that names the host it is about.
+ *
+ * Callers read `registryHost` off it to report which registry refused, so the property is
+ * attached in one place rather than at each throw.
+ *
+ * @param {string} message - Message
+ * @param {string} host - Registry host
+ * @returns {Error}
+ */
+function hostError(message, host) {
+  const err = new Error(message);
+  err.registryHost = host;
+  return err;
+}
+
+function buildRegistryAuthFallback(deps = {}) {
+  const interactive = deps.interactive === undefined
+    ? Boolean(process.stdin.isTTY && process.stdout.isTTY)
+    : Boolean(deps.interactive);
+
+  /**
+   * Try `az acr login` for an ACR host.
+   *
+   * Extracted so the fallback itself stays readable. A failure here is deliberately not
+   * fatal when a prompt is still possible: an expired or absent `az login` is an ordinary
+   * state, and a stored pair or an answered prompt can still authenticate the host.
+   *
+   * @param {string} host - Registry host
+   * @returns {Promise<boolean>} True when ACR login succeeded
+   */
+  async function tryAcrLogin(host) {
+    if (!isAzureContainerRegistryHost(host)) {
+      return false;
+    }
+    const acrLogin = deps.acrLogin
+      || ((target) => require('../deployment/push').authenticateACR(target));
+    try {
+      await acrLogin(host);
+      return true;
+    } catch (error) {
+      if (!interactive) {
+        throw hostError(`${nonInteractiveCredentialMessage(host)} (az acr login failed: ${error.message})`, host);
+      }
+      return false;
+    }
+  }
+
+  return async function registryAuthFallback(host) {
+    if (await tryAcrLogin(host)) {
+      return 'acr';
+    }
+    if (!interactive) {
+      throw hostError(nonInteractiveCredentialMessage(host), host);
+    }
+
+    const promptCredentials = deps.promptCredentials || promptForRegistryCredentials;
+    const { username, password } = await promptCredentials(host);
+    if (!username || !password) {
+      throw new Error(`Registry credentials for ${host} are required: both a username and a password.`);
+    }
+
+    const saveCredentials = deps.saveCredentials
+      || ((target, user, pass) => require('./registry-credentials').saveRegistryCredentials(target, user, pass));
+    // Store before logging in, so the answer is not asked for again on the next command
+    // even if the login itself fails for an unrelated reason.
+    await saveCredentials(host, username, password);
+
+    const dockerLogin = deps.dockerLogin
+      || ((target, user, pass) => require('../deployment/push').authenticateExternalRegistry(target, user, pass));
+    await dockerLogin(host, username, password);
+    return 'prompt';
+  };
+}
+
+/**
+ * Ask for a registry username and password. The password is never echoed.
+ *
+ * @param {string} host - Registry host
+ * @returns {Promise<{ username: string, password: string }>}
+ */
+async function promptForRegistryCredentials(host) {
+  const inquirer = require('inquirer');
+  return inquirer.prompt([
+    { type: 'input', name: 'username', message: `Username for ${host}:` },
+    { type: 'password', name: 'password', mask: '*', message: `Password or token for ${host}:` }
+  ]);
+}
+
+module.exports = {
+  ACR_HOST_SUFFIX,
+  isAzureContainerRegistryHost,
+  nonInteractiveCredentialMessage,
+  buildRegistryAuthFallback,
+  promptForRegistryCredentials
+};