@aifabrix/builder 2.39.2 → 2.40.0

package/lib/commands/credential-list.js

@@ -1,6 +1,7 @@
 /**
- * Credential list command – list credentials from controller/dataplane
+ * Credential list command – list credentials from Dataplane
  * GET /api/v1/credential. Used by `aifabrix credential list`.
+ * The Controller does not expose this endpoint; credentials are listed from the Dataplane.
  *
  * @fileoverview Credential list command implementation
  * @author AI Fabrix Team
@@ -11,7 +12,8 @@ const chalk = require('chalk');
 const logger = require('../utils/logger');
 const { resolveControllerUrl } = require('../utils/controller-url');
 const { getOrRefreshDeviceToken } = require('../utils/token-manager');
-const { normalizeControllerUrl } = require('../core/config');
+const { normalizeControllerUrl, resolveEnvironment } = require('../core/config');
+const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
 const { listCredentials } = require('../api/credentials.api');
 
 const DEFAULT_PAGE_SIZE = 50;
@@ -48,10 +50,10 @@ function extractCredentials(response) {
 /**
  * Display credential list to user
  * @param {Array} list - Credentials array
- * @param {string} controllerUrl - Controller URL for header
+ * @param {string} baseUrl - Dataplane (or base) URL for header
  */
-function displayCredentialList(list, controllerUrl) {
-  logger.log(chalk.bold(`\n🔐 Credentials (${controllerUrl}):\n`));
+function displayCredentialList(list, baseUrl) {
+  logger.log(chalk.bold(`\n🔐 Credentials (${baseUrl}):\n`));
   if (list.length === 0) {
     logger.log(chalk.gray('  No credentials found.\n'));
     return;
@@ -65,36 +67,95 @@ function displayCredentialList(list, controllerUrl) {
 }
 
 /**
- * Run credential list command: call GET /api/v1/credential and display results
+ * Ensure controller URL and auth; exit on failure. Returns { controllerUrl, authConfig } when valid.
  * @async
- * @param {Object} options - CLI options
- * @param {string} [options.controller] - Controller URL override
- * @param {boolean} [options.activeOnly] - List only active credentials
- * @param {number} [options.pageSize] - Items per page
- * @returns {Promise<void>}
+ * @param {Object} options - CLI options with optional controller
+ * @returns {Promise<{controllerUrl: string, authConfig: Object}>}
  */
-async function runCredentialList(options = {}) {
+async function ensureControllerAndAuth(options) {
   const controllerUrl = options.controller || (await resolveControllerUrl());
   if (!controllerUrl) {
     logger.error(chalk.red('❌ Controller URL is required. Run "aifabrix login" first.'));
     process.exit(1);
-    return;
   }
   const authResult = await getCredentialListAuth(controllerUrl);
   if (!authResult || !authResult.token) {
     logger.error(chalk.red(`❌ No authentication token for controller: ${controllerUrl}`));
     logger.error(chalk.gray('Run: aifabrix login'));
     process.exit(1);
-    return;
   }
-  const authConfig = { type: 'bearer', token: authResult.token };
+  return {
+    controllerUrl,
+    authConfig: { type: 'bearer', token: authResult.token }
+  };
+}
+
+/**
+ * Resolve Dataplane URL for credential list (override or discover from controller + environment)
+ * @async
+ * @param {string} controllerUrl - Controller base URL
+ * @param {Object} authConfig - Auth config with token
+ * @param {Object} options - CLI options
+ * @param {string} [options.dataplane] - Optional Dataplane URL override
+ * @returns {Promise<string>} Dataplane base URL
+ * @throws {Error} When resolution fails (caller should exit)
+ */
+async function resolveCredentialListDataplaneUrl(controllerUrl, authConfig, options) {
+  if (options.dataplane) {
+    return options.dataplane.replace(/\/$/, '');
+  }
+  const environment = await resolveEnvironment();
+  return await resolveDataplaneUrl(controllerUrl, environment, authConfig);
+}
+
+/**
+ * Call Dataplane credential API and display results; exits on failure
+ * @param {string} dataplaneUrl - Dataplane base URL
+ * @param {Object} authConfig - Auth config
+ * @param {Object} listOptions - pageSize, activeOnly
+ */
+async function fetchAndDisplayCredentials(dataplaneUrl, authConfig, listOptions) {
+  const response = await listCredentials(dataplaneUrl, authConfig, listOptions);
+  displayCredentialList(extractCredentials(response), dataplaneUrl);
+}
+
+/**
+ * Resolve Dataplane URL or log error and exit
+ * @async
+ * @param {string} controllerUrl - Controller URL
+ * @param {Object} authConfig - Auth config
+ * @param {Object} options - CLI options
+ * @returns {Promise<string>} Dataplane URL (never returns on failure; process.exit(1))
+ */
+async function resolveDataplaneUrlOrExit(controllerUrl, authConfig, options) {
+  try {
+    return await resolveCredentialListDataplaneUrl(controllerUrl, authConfig, options);
+  } catch (err) {
+    logger.error(chalk.red(`❌ Could not resolve Dataplane URL: ${err.message}`));
+    logger.error(chalk.gray('Use --dataplane <url> to specify the Dataplane URL directly.'));
+    process.exit(1);
+  }
+}
+
+/**
+ * Run credential list command: call GET /api/v1/credential on Dataplane and display results
+ * @async
+ * @param {Object} options - CLI options
+ * @param {string} [options.controller] - Controller URL override
+ * @param {string} [options.dataplane] - Dataplane URL override (default: resolved from controller + environment)
+ * @param {boolean} [options.activeOnly] - List only active credentials
+ * @param {number} [options.pageSize] - Items per page
+ * @returns {Promise<void>}
+ */
+async function runCredentialList(options = {}) {
+  const { controllerUrl, authConfig } = await ensureControllerAndAuth(options);
+  const dataplaneUrl = await resolveDataplaneUrlOrExit(controllerUrl, authConfig, options);
   const listOptions = {
     pageSize: options.pageSize || DEFAULT_PAGE_SIZE,
     activeOnly: options.activeOnly
   };
   try {
-    const response = await listCredentials(authResult.controllerUrl, authConfig, listOptions);
-    displayCredentialList(extractCredentials(response), authResult.controllerUrl);
+    await fetchAndDisplayCredentials(dataplaneUrl, authConfig, listOptions);
   } catch (error) {
     logger.error(chalk.red(`❌ Failed to list credentials: ${error.message}`));
     process.exit(1);

package/lib/commands/datasource.js

@@ -16,18 +16,8 @@ const { listDatasources } = require('../datasource/list');
 const { compareDatasources } = require('../datasource/diff');
 const { deployDatasource } = require('../datasource/deploy');
 
-/**
- * Setup datasource management commands
- * @param {Command} program - Commander program instance
- */
-function setupDatasourceCommands(program) {
-  const datasource = program
-    .command('datasource')
-    .description('Manage external data sources');
-
-  // Validate command
-  datasource
-    .command('validate <file>')
+function setupDatasourceValidateCommand(datasource) {
+  datasource.command('validate <file>')
     .description('Validate external datasource JSON file')
     .action(async(file) => {
       try {
@@ -36,9 +26,7 @@ function setupDatasourceCommands(program) {
           logger.log(chalk.green(`\n✓ Datasource file is valid: ${file}`));
         } else {
           logger.log(chalk.red(`\n✗ Datasource file has errors: ${file}`));
-          result.errors.forEach(error => {
-            logger.log(chalk.red(`  • ${error}`));
-          });
+          result.errors.forEach(error => logger.log(chalk.red(`  • ${error}`)));
           process.exit(1);
         }
       } catch (error) {
@@ -46,10 +34,10 @@ function setupDatasourceCommands(program) {
         process.exit(1);
       }
     });
+}
 
-  // List command
-  datasource
-    .command('list')
+function setupDatasourceListCommand(datasource) {
+  datasource.command('list')
     .description('List datasources from environment (uses environment from config.yaml)')
     .action(async() => {
       try {
@@ -59,10 +47,10 @@ function setupDatasourceCommands(program) {
         process.exit(1);
       }
     });
+}
 
-  // Diff command
-  datasource
-    .command('diff <file1> <file2>')
+function setupDatasourceDiffCommand(datasource) {
+  datasource.command('diff <file1> <file2>')
     .description('Compare two datasource configuration files (for dataplane)')
     .action(async(file1, file2) => {
       try {
@@ -72,10 +60,10 @@ function setupDatasourceCommands(program) {
         process.exit(1);
       }
     });
+}
 
-  // Deploy command
-  datasource
-    .command('deploy <myapp> <file>')
+function setupDatasourceDeployCommand(datasource) {
+  datasource.command('deploy <myapp> <file>')
     .description('Deploy datasource to dataplane')
     .action(async(myapp, file, options) => {
       try {
@@ -87,5 +75,17 @@ function setupDatasourceCommands(program) {
     });
 }
 
+/**
+ * Setup datasource management commands
+ * @param {Command} program - Commander program instance
+ */
+function setupDatasourceCommands(program) {
+  const datasource = program.command('datasource').description('Manage external data sources');
+  setupDatasourceValidateCommand(datasource);
+  setupDatasourceListCommand(datasource);
+  setupDatasourceDiffCommand(datasource);
+  setupDatasourceDeployCommand(datasource);
+}
+
 module.exports = { setupDatasourceCommands };
 

package/lib/commands/deployment-list.js

@@ -36,13 +36,19 @@ async function getDeploymentListAuth(controllerUrl) {
 }
 
 /**
- * Extract deployments array from API response
- * @param {Object} response - API response
+ * Extract deployments array from API response.
+ * Supports OpenAPI/SDK paginated format: { meta, data: Deployment[], links }
+ * and legacy shapes: { data: { items } }, { data: { deployments } }, or { data: [] }.
+ * @param {Object} response - API response (from ApiClient: { success, data: body, status })
  * @returns {Array}
  */
 function extractDeployments(response) {
-  const data = response?.data ?? response;
-  const items = data?.items ?? data?.deployments ?? (Array.isArray(data) ? data : []);
+  const body = response?.data ?? response;
+  const items =
+    (Array.isArray(body?.data) ? body.data : undefined) ??
+    body?.items ??
+    body?.deployments ??
+    (Array.isArray(body) ? body : []);
   return Array.isArray(items) ? items : [];
 }
 
@@ -60,10 +66,11 @@ function displayDeploymentList(deployments, environment, controllerUrl) {
   }
   deployments.forEach((d) => {
     const id = d.id ?? d.deploymentId ?? '-';
-    const appKey = d.applicationKey ?? d.appKey ?? d.application?.key ?? '-';
+    const target =
+      d.applicationKey ?? d.appKey ?? d.targetId ?? d.application?.key ?? '-';
     const status = d.status ?? '-';
     const createdAt = d.createdAt ?? d.created ?? '';
-    logger.log(`  ${chalk.cyan(id)} ${appKey} ${status} ${chalk.gray(createdAt)}`);
+    logger.log(`  ${chalk.cyan(id)} ${target} ${status} ${chalk.gray(createdAt)}`);
   });
   logger.log('');
 }

package/lib/commands/up-common.js

@@ -10,24 +10,27 @@
 
 const path = require('path');
 const fs = require('fs');
-const yaml = require('js-yaml');
 const chalk = require('chalk');
 const logger = require('../utils/logger');
 const pathsUtil = require('../utils/paths');
+const { loadConfigFile, writeConfigFile } = require('../utils/config-format');
+const { isYamlPath } = require('../utils/config-format');
 const { copyTemplateFiles } = require('../validation/template');
 const { ensureReadmeForAppPath, ensureReadmeForApp } = require('../app/readme');
 
 /**
- * Copy template to a target path if variables.yaml is missing there.
+ * Copy template to a target path if application config is missing there.
  * After copy, generates README.md from templates/applications/README.md.hbs.
  * @param {string} appName - Application name
  * @param {string} targetAppPath - Target directory (e.g. builder/keycloak)
  * @returns {Promise<boolean>} True if template was copied, false if already present
  */
 async function ensureTemplateAtPath(appName, targetAppPath) {
-  const variablesPath = path.join(targetAppPath, 'variables.yaml');
-  if (fs.existsSync(variablesPath)) {
+  try {
+    pathsUtil.resolveApplicationConfigPath(targetAppPath);
     return false;
+  } catch {
+    // No application config; copy template
   }
   await copyTemplateFiles(appName, targetAppPath);
   await ensureReadmeForAppPath(targetAppPath, appName);
@@ -37,18 +40,55 @@ async function ensureTemplateAtPath(appName, targetAppPath) {
 /**
  * Resolve the directory (folder) that would contain the .env file for envOutputPath.
  * @param {string} envOutputPath - Value from build.envOutputPath (e.g. ../../.env)
- * @param {string} variablesPath - Path to variables.yaml
+ * @param {string} configPath - Path to application config file
  * @returns {string} Absolute path to the folder that would contain the output .env file
  */
-function getEnvOutputPathFolder(envOutputPath, variablesPath) {
-  const variablesDir = path.dirname(variablesPath);
-  const resolvedFile = path.resolve(variablesDir, envOutputPath);
+function getEnvOutputPathFolder(envOutputPath, configPath) {
+  const configDir = path.dirname(configPath);
+  const resolvedFile = path.resolve(configDir, envOutputPath);
   return path.dirname(resolvedFile);
 }
 
 /**
- * Validates envOutputPath: if the target folder does not exist, patches variables.yaml to set envOutputPath to null.
+ * Patches envOutputPath to null in raw YAML content so comments and formatting are preserved.
+ * Only touches the line that sets envOutputPath under build.
+ *
+ * @param {string} content - Raw file content (YAML)
+ * @returns {string|null} Patched content, or null if no change
+ */
+function patchEnvOutputPathInYamlContent(content) {
+  const re = /^(\s*)envOutputPath\s*:\s*.+$/m;
+  const match = content.match(re);
+  if (!match) return null;
+  const indent = match[1];
+  return content.replace(re, `${indent}envOutputPath: null`);
+}
+
+/**
+ * Patches config file to set build.envOutputPath to null, preserving comments (YAML only).
+ * For JSON or when in-place patch fails, falls back to full write.
+ *
+ * @param {string} configPath - Path to application config file
+ * @returns {boolean} True if file was modified
+ */
+function patchEnvOutputPathInFile(configPath) {
+  if (!isYamlPath(configPath)) {
+    const variables = loadConfigFile(configPath);
+    const updated = { ...variables, build: { ...(variables.build || {}), envOutputPath: null } };
+    writeConfigFile(configPath, updated);
+    return true;
+  }
+  const content = fs.readFileSync(configPath, 'utf8');
+  const patched = patchEnvOutputPathInYamlContent(content);
+  if (patched === null) return false;
+  fs.writeFileSync(configPath, patched, 'utf8');
+  return true;
+}
+
+/**
+ * Validates envOutputPath: if the target folder does not exist, patches application config to set envOutputPath to null.
  * Used by up-platform, up-miso, up-dataplane so we do not keep a path that points outside an existing tree.
+ * Patches in place for YAML to preserve comments.
  *
  * @param {string} appName - Application name (e.g. keycloak, miso-controller, dataplane)
  */
@@ -59,48 +99,44 @@ function validateEnvOutputPathFolderOrNull(appName) {
   if (path.resolve(cwdBuilderPath) !== path.resolve(pathsToPatch[0])) {
     pathsToPatch.push(cwdBuilderPath);
   }
-  const envOutputPathLine = /^(\s*envOutputPath:)\s*.*$/m;
-  const replacement = '$1 null  # deploy only, no copy';
   for (const appPath of pathsToPatch) {
-    const variablesPath = path.join(appPath, 'variables.yaml');
-    if (!fs.existsSync(variablesPath)) continue;
+    let configPath;
+    try {
+      configPath = pathsUtil.resolveApplicationConfigPath(appPath);
+    } catch {
+      continue;
+    }
     try {
-      const content = fs.readFileSync(variablesPath, 'utf8');
-      const variables = yaml.load(content);
+      const variables = loadConfigFile(configPath);
       const value = variables?.build?.envOutputPath;
       if (value === null || value === undefined || value === '') continue;
-      const folder = getEnvOutputPathFolder(String(value).trim(), variablesPath);
+      const folder = getEnvOutputPathFolder(String(value).trim(), configPath);
       if (fs.existsSync(folder)) continue;
-      const newContent = content.replace(envOutputPathLine, replacement);
-      fs.writeFileSync(variablesPath, newContent, 'utf8');
+      patchEnvOutputPathInFile(configPath);
     } catch (err) {
-      logger.warn(chalk.yellow(`Could not validate envOutputPath in ${variablesPath}: ${err.message}`));
+      logger.warn(chalk.yellow(`Could not validate envOutputPath in ${configPath}: ${err.message}`));
     }
   }
 }
 
 /**
- * Patches a single variables.yaml to set build.envOutputPath to null for deploy-only.
+ * Patches a single application config file to set build.envOutputPath to null for deploy-only.
+ * Only writes when a change is needed (value is set and target folder does not exist).
+ * Uses in-place YAML patch when possible to preserve comments.
  *
- * @param {string} variablesPath - Path to variables.yaml
- * @param {RegExp} envOutputPathLine - Regex for envOutputPath line
- * @param {string} replacement - Replacement string
+ * @param {string} configPath - Path to application config file
  */
-function patchOneVariablesFileForDeployOnly(variablesPath, envOutputPathLine, replacement) {
-  const content = fs.readFileSync(variablesPath, 'utf8');
-  if (!envOutputPathLine.test(content)) return;
-  const variables = yaml.load(content);
+function patchOneVariablesFileForDeployOnly(configPath) {
+  const variables = loadConfigFile(configPath);
   const value = variables?.build?.envOutputPath;
-  if (value !== null && value !== undefined && value !== '') {
-    const folder = getEnvOutputPathFolder(String(value).trim(), variablesPath);
-    if (fs.existsSync(folder)) return;
-  }
-  const newContent = content.replace(envOutputPathLine, replacement);
-  fs.writeFileSync(variablesPath, newContent, 'utf8');
+  if (value === null || value === undefined || value === '') return;
+  const folder = getEnvOutputPathFolder(String(value).trim(), configPath);
+  if (fs.existsSync(folder)) return;
+  patchEnvOutputPathInFile(configPath);
 }
 
 /**
- * Patches variables.yaml to set build.envOutputPath to null for deploy-only (no local code).
+ * Patches application config to set build.envOutputPath to null for deploy-only (no local code).
  * Only patches when the target folder does NOT exist; when folder exists, keeps the value.
  * Use when running up-miso/up-platform so we do not copy .env to repo paths or show that message.
  * Patches both primary builder path and cwd/builder if different.
@@ -114,22 +150,24 @@ function patchEnvOutputPathForDeployOnly(appName) {
   if (path.resolve(cwdBuilderPath) !== path.resolve(pathsToPatch[0])) {
     pathsToPatch.push(cwdBuilderPath);
   }
-  const envOutputPathLine = /^(\s*envOutputPath:)\s*.*$/m;
-  const replacement = '$1 null  # deploy only, no copy';
   for (const appPath of pathsToPatch) {
-    const variablesPath = path.join(appPath, 'variables.yaml');
-    if (!fs.existsSync(variablesPath)) continue;
+    let configPath;
+    try {
+      configPath = pathsUtil.resolveApplicationConfigPath(appPath);
+    } catch {
+      continue;
+    }
     try {
-      patchOneVariablesFileForDeployOnly(variablesPath, envOutputPathLine, replacement);
+      patchOneVariablesFileForDeployOnly(configPath);
     } catch (err) {
-      logger.warn(chalk.yellow(`Could not patch envOutputPath in ${variablesPath}: ${err.message}`));
+      logger.warn(chalk.yellow(`Could not patch envOutputPath in ${configPath}: ${err.message}`));
     }
   }
 }
 
 /**
- * Ensures builder app directory exists from template if variables.yaml is missing.
- * If builder/<appName>/variables.yaml does not exist, copies from templates/applications/<appName>.
+ * Ensures builder app directory exists from template if application config is missing.
+ * If builder/<appName>/application config does not exist, copies from templates/applications/<appName>.
  * Uses AIFABRIX_BUILDER_DIR when set (e.g. by up-miso/up-dataplane from config aifabrix-env-config).
  * When using a custom builder dir, also populates cwd/builder/<appName> so the repo's builder/ is not empty.
  *

package/lib/commands/up-dataplane.js

@@ -3,7 +3,7 @@
  *
  * Always local deployment: registers or rotates dataplane app in dev, sends
  * deployment manifest to Miso Controller, then runs the dataplane app locally
- * (same as aifabrix deploy dataplane --deployment=local). If app is already
+ * (same as aifabrix deploy dataplane --local). If app is already
  * registered, uses rotate-secret; otherwise registers.
  *
  * @fileoverview up-dataplane command implementation
@@ -11,10 +11,9 @@
  * @version 2.0.0
  */
 
-const path = require('path');
-const fs = require('fs');
-const yaml = require('js-yaml');
 const chalk = require('chalk');
+const pathsUtil = require('../utils/paths');
+const { loadConfigFile } = require('../utils/config-format');
 const logger = require('../utils/logger');
 const config = require('../core/config');
 const { checkAuthentication } = require('../utils/app-register-auth');
@@ -47,20 +46,22 @@ async function registerOrRotateDataplane(options, controllerUrl, environmentKey,
 }
 
 /**
- * Build full image ref from registry and dataplane variables (registry/name:tag)
+ * Build full image ref from registry and dataplane config (registry/name:tag)
  * @param {string} registry - Registry URL
  * @returns {string|undefined} Full image reference or undefined
  */
 function buildDataplaneImageRef(registry) {
-  const pathsUtil = require('../utils/paths');
-  const variablesPath = path.join(pathsUtil.getBuilderPath('dataplane'), 'variables.yaml');
-  if (!fs.existsSync(variablesPath)) return undefined;
-  const content = fs.readFileSync(variablesPath, 'utf8');
-  const variables = yaml.load(content);
-  const name = variables?.image?.name || variables?.app?.key || 'dataplane';
-  const tag = variables?.image?.tag || 'latest';
-  const base = (registry || '').replace(/\/+$/, '');
-  return base ? `${base}/${name}:${tag}` : undefined;
+  try {
+    const builderPath = pathsUtil.getBuilderPath('dataplane');
+    const configPath = pathsUtil.resolveApplicationConfigPath(builderPath);
+    const variables = loadConfigFile(configPath);
+    const name = variables?.image?.name || variables?.app?.key || 'dataplane';
+    const tag = variables?.image?.tag || 'latest';
+    const base = (registry || '').replace(/\/+$/, '');
+    return base ? `${base}/${name}:${tag}` : undefined;
+  } catch {
+    return undefined;
+  }
 }
 
 /**

package/lib/commands/up-miso.js

@@ -9,10 +9,9 @@
  * @version 2.0.0
  */
 
-const path = require('path');
-const fs = require('fs');
-const yaml = require('js-yaml');
 const chalk = require('chalk');
+const pathsUtil = require('../utils/paths');
+const { loadConfigFile } = require('../utils/config-format');
 const logger = require('../utils/logger');
 const config = require('../core/config');
 const secrets = require('../core/secrets');
@@ -21,7 +20,7 @@ const app = require('../app');
 const { saveLocalSecret } = require('../utils/local-secrets');
 const { ensureAppFromTemplate, patchEnvOutputPathForDeployOnly, validateEnvOutputPathFolderOrNull } = require('./up-common');
 
-/** Keycloak base port (from templates/applications/keycloak/variables.yaml) */
+/** Keycloak base port (from templates/applications/keycloak application config) */
 const KEYCLOAK_BASE_PORT = 8082;
 /** Miso controller base port (dev-config app base) */
 const MISO_BASE_PORT = 3000;
@@ -46,21 +45,23 @@ function parseImageOptions(imageOpts) {
 }
 
 /**
- * Build full image ref from registry and app variables (registry/name:tag)
+ * Build full image ref from registry and app config (registry/name:tag)
  * @param {string} appName - keycloak or miso-controller
  * @param {string} registry - Registry URL
  * @returns {string} Full image reference
  */
 function buildImageRefFromRegistry(appName, registry) {
-  const pathsUtil = require('../utils/paths');
-  const variablesPath = path.join(pathsUtil.getBuilderPath(appName), 'variables.yaml');
-  if (!fs.existsSync(variablesPath)) return undefined;
-  const content = fs.readFileSync(variablesPath, 'utf8');
-  const variables = yaml.load(content);
-  const name = variables?.image?.name || variables?.app?.key || appName;
-  const tag = variables?.image?.tag || 'latest';
-  const base = (registry || '').replace(/\/+$/, '');
-  return base ? `${base}/${name}:${tag}` : undefined;
+  try {
+    const builderPath = pathsUtil.getBuilderPath(appName);
+    const configPath = pathsUtil.resolveApplicationConfigPath(builderPath);
+    const variables = loadConfigFile(configPath);
+    const name = variables?.image?.name || variables?.app?.key || appName;
+    const tag = variables?.image?.tag || 'latest';
+    const base = (registry || '').replace(/\/+$/, '');
+    return base ? `${base}/${name}:${tag}` : undefined;
+  } catch {
+    return undefined;
+  }
 }
 
 /**