@aifabrix/builder 2.45.5 → 2.46.0

package/lib/utils/external-system-readiness-display.js

@@ -128,25 +128,94 @@ function logServerValidationWarnings(validationBody) {
   }
 }
 
+/**
+ * @param {Object[]} results - Probe result rows
+ * @returns {boolean}
+ */
+function connectivityCheckFailed(results) {
+  return results.some(
+    row =>
+      row?.endpointTestResults?.success === false
+      || row?.endpointTestResults?.endpointReachable === false
+  );
+}
+
 /**
  * @param {Object} results - Probe result rows
  * @param {Object} summary - summarizeProbeResults output
  */
 function logProbeCredentialLine(results, summary) {
   logSeparator();
-  logSectionTitle('Credential Test:');
-  const anyEndpointFail = results.some(row => row?.endpointTestResults?.success === false);
-  if (anyEndpointFail) {
+  logSectionTitle('Connectivity check:');
+  if (connectivityCheckFailed(results)) {
     logger.log(formatBlockingError('Failed (see Key Issues / endpoint test)'));
-  } else if (summary.failed > 0) {
-    logger.log(formatBlockingError('Some datasource checks failed'));
-  } else if (summary.partial > 0) {
-    logger.log(chalk.yellow('⚠ Completed with warnings'));
   } else {
-    logger.log(formatSuccessLine('Passed'));
+    logger.log(formatSuccessLine('Passed (system credential / testEndpoint)'));
+  }
+  if (summary.partial > 0 || summary.failed > 0) {
+    logSeparator();
+    logSectionTitle('Datasource readiness:');
+    if (summary.failed > 0) {
+      logger.log(formatBlockingError('Some datasource checks failed'));
+    } else {
+      logger.log(
+        chalk.yellow(
+          '⚠ Partial — validation or certification warnings (not a failed credential test)'
+        )
+      );
+    }
+    logger.log(
+      chalk.gray(
+        '  Upload --probe runs structural validation + certification tiers; live .env connectivity is separate.'
+      )
+    );
+  }
+}
+
+/**
+ * @param {Object[]} results
+ */
+function logProbeEmptyResultsWarningIfNeeded(results) {
+  if (results.length === 0) {
+    logger.log(chalk.yellow('⚠ No runtime datasource results were returned by the dataplane probe.'));
+    logger.log(chalk.gray('   Endpoint credential test may still pass even if datasource checks were not reported.'));
   }
 }
 
+/**
+ * @param {Array<{ key: string, lines: string[] }>} issues
+ */
+function logProbeKeyIssues(issues) {
+  if (issues.length === 0) return;
+  logSeparator();
+  logSectionTitle('Key Issues:');
+  for (const { key, lines } of issues) {
+    logger.log(chalk.white(key));
+    for (const line of lines) {
+      logger.log(chalk.red(`- ${line}`));
+    }
+  }
+}
+
+/**
+ * @param {Object[]} results
+ * @param {Object} summary
+ * @returns {string[]}
+ */
+function buildProbeNextActionHints(results, summary) {
+  const hints = [];
+  if (connectivityCheckFailed(results)) {
+    hints.push('Fix API credentials or permissions (connectivity check failed)');
+  }
+  if (summary.failed > 0) {
+    hints.push('Fix datasource errors listed under Key Issues');
+  }
+  if (summary.partial > 0 && summary.failed === 0) {
+    hints.push('Review Key Issues for certification/validation warnings (ICC, MCP, dimensions)');
+  }
+  return hints;
+}
+
 /**
  * @param {Object} probeRaw - Unwrapped POST /validation/run body
  * @param {string} systemKey
@@ -156,25 +225,13 @@ function logProbeRuntimeBlock(probeRaw, systemKey) {
   const summary = summarizeProbeResults(results);
   logSeparator();
   logger.log(chalk.bold('Runtime Readiness:'));
-  if (results.length === 0) {
-    logger.log(chalk.yellow('⚠ No runtime datasource results were returned by the dataplane probe.'));
-    logger.log(chalk.gray('   Endpoint credential test may still pass even if datasource checks were not reported.'));
-  }
+  logProbeEmptyResultsWarningIfNeeded(results);
   logDatasourceTable(summary.rows, summary);
-  if (summary.issues.length > 0) {
-    logSeparator();
-    logSectionTitle('Key Issues:');
-    for (const { key, lines } of summary.issues) {
-      logger.log(chalk.white(key));
-      for (const line of lines) {
-        logger.log(chalk.red(`- ${line}`));
-      }
-    }
-  }
+  logProbeKeyIssues(summary.issues);
   logProbeCredentialLine(results, summary);
   logSeparator();
   logNextActions(
-    ['Fix API credentials or permissions if endpoint tests failed'],
+    buildProbeNextActionHints(results, summary),
     `Run: aifabrix datasource test-e2e <datasourceKey> --app ${systemKey}`
   );
 }

package/lib/utils/health-check.js

@@ -357,7 +357,10 @@ async function performHealthCheckAttempt(healthCheckUrl, attempt, maxAttempts, d
     }
     const healthCheckPassed = await checkHealthEndpoint(healthCheckUrl, debug);
     if (healthCheckPassed) {
-      logger.log(formatSuccessLine('Application is healthy'));
+      const { isSetupQuietOutput } = require('./setup-quiet-output');
+      if (!isSetupQuietOutput()) {
+        logger.log(formatSuccessLine('Application is healthy'));
+      }
       if (debug) {
         logger.log(chalk.gray(`[DEBUG] Health check passed after ${attempt + 1} attempt(s)`));
       }

package/lib/utils/help-builder.js

@@ -73,7 +73,11 @@ const CATEGORIES = [
       { name: 'app' },
       { name: 'credential' },
       { name: 'deployment' },
-      { name: 'integration-client' }
+      { name: 'integration-client' },
+      { name: 'dimension' },
+      { name: 'dimension value', term: 'dimension value <command>' },
+      { name: 'identity' },
+      { name: 'protection' }
     ]
   },
   {
@@ -100,15 +104,14 @@ const CATEGORIES = [
       { name: 'datasource' },
       { name: 'datasource load', term: 'datasource load <datasourceKey>' },
       { name: 'datasource export', term: 'datasource export <datasourceKey>' },
-      { name: 'dimension' },
-      { name: 'dimension value', term: 'dimension value <command>' },
-      { name: 'identity' },
-      { name: 'protection' },
       { name: 'test', term: 'test <appKey|systemKey>' },
+      { name: 'test-integration', term: 'test-integration <appKey|systemKey>' },
       { name: 'test-e2e', term: 'test-e2e <appKey|systemKey>' },
-      { name: 'test-governance', term: 'test-governance <appKey|systemKey>' },
-      { name: 'test-trust', term: 'test-trust <appKey|systemKey>' },
-      { name: 'test-integration', term: 'test-integration <appKey|systemKey>' }
+      { name: 'verify-operations', term: 'verify-operations <systemKey>' },
+      { name: 'verify-trust', term: 'verify-trust <systemKey>' },
+      { name: 'verify-governance', term: 'verify-governance <systemKey>' },
+      { name: 'governance', term: 'governance <generate|verify|download|upload> <systemKey>' },
+      { name: 'lifecycle', term: 'lifecycle <systemKey>' }
     ]
   },
   {

package/lib/utils/keycloak-realm-ready.js

@@ -0,0 +1,101 @@
+/**
+ * Poll Keycloak until the `aifabrix` realm is available (post-wipe / fresh install).
+ *
+ * @fileoverview Keycloak realm readiness for setup auth
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { computeAppBaseUrl } = require('./platform-controller-url');
+const config = require('../core/config');
+const { readUrlsLocalRegistrySync } = require('./urls-local-registry');
+const { normalizeFrontDoorPatternForHealth } = require('./health-check-url');
+
+/**
+ * @param {string} keycloakBase
+ * @returns {string}
+ */
+function buildRealmWellKnownUrl(keycloakBase) {
+  const base = String(keycloakBase || '').replace(/\/+$/, '');
+  return `${base}/realms/aifabrix/.well-known/openid-configuration`;
+}
+
+/**
+ * @async
+ * @param {string} url
+ * @returns {Promise<boolean>}
+ */
+async function probeRealmWellKnown(url) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 8000);
+  try {
+    const res = await fetch(url, { method: 'GET', signal: controller.signal });
+    return res.ok;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function computeKeycloakDirectBaseUrlFromRegistry(registry, developerIdNum) {
+  const portRaw = registry && registry['keycloak-port'];
+  const port =
+    typeof portRaw === 'number'
+      ? portRaw
+      : typeof portRaw === 'string' && /^\d+$/.test(portRaw.trim())
+        ? parseInt(portRaw.trim(), 10)
+        : null;
+  if (!port || port <= 0) {
+    return null;
+  }
+  const patternRaw = registry && registry['keycloak-pattern'];
+  const pattern = typeof patternRaw === 'string' && patternRaw.trim() ? patternRaw.trim() : null;
+  const mount = pattern ? normalizeFrontDoorPatternForHealth(pattern) : null;
+  const adjusted = port + (Number.isFinite(developerIdNum) ? developerIdNum : 0) * 100;
+  return `http://localhost:${adjusted}${mount || ''}`;
+}
+
+/**
+ * Wait until Keycloak serves the aifabrix realm OIDC metadata.
+ *
+ * @async
+ * @param {{ timeoutSeconds?: number, intervalMs?: number }} [opts]
+ * @returns {Promise<void>}
+ * @throws {Error} On timeout
+ */
+async function waitForKeycloakRealmReady(opts = {}) {
+  const timeoutSeconds = Number.isFinite(opts.timeoutSeconds) ? opts.timeoutSeconds : 180;
+  const intervalMs = Number.isFinite(opts.intervalMs) ? opts.intervalMs : 3000;
+  const keycloakBase = await computeAppBaseUrl('keycloak');
+  const url = buildRealmWellKnownUrl(keycloakBase);
+  const registry = readUrlsLocalRegistrySync();
+  const developerIdRaw = await config.getDeveloperId();
+  const developerIdNum = typeof developerIdRaw === 'string' ? parseInt(developerIdRaw, 10) : developerIdRaw;
+  const directBase = computeKeycloakDirectBaseUrlFromRegistry(registry, developerIdNum);
+  const directUrl = directBase ? buildRealmWellKnownUrl(directBase) : null;
+  const deadline = Date.now() + timeoutSeconds * 1000;
+
+  while (Date.now() < deadline) {
+    if (await probeRealmWellKnown(url)) {
+      return;
+    }
+    if (directUrl && (await probeRealmWellKnown(directUrl))) {
+      return;
+    }
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+
+  throw new Error(
+    `Keycloak realm "aifabrix" was not ready within ${timeoutSeconds}s (checked ${url}${directUrl ? ` and ${directUrl}` : ''}). ` +
+      'Ensure Miso Controller finished onboarding after the database wipe.'
+  );
+}
+
+module.exports = {
+  buildRealmWellKnownUrl,
+  waitForKeycloakRealmReady,
+  computeKeycloakDirectBaseUrlFromRegistry
+};

package/lib/utils/load-cip-capacity-display-config.js

@@ -8,8 +8,8 @@
 
 'use strict';
 
-const fs = require('fs');
 const path = require('path');
+const { existsSync, readFileSync } = require('../internal/fs-real-sync');
 
 /**
  * @param {object|null} schema - Parsed external-datasource.schema.json
@@ -33,8 +33,8 @@ function extractStandardOperationOrderFromSchema(schema) {
  */
 function tryReadJsonFile(p) {
   try {
-    if (!p || !fs.existsSync(p)) return null;
-    return JSON.parse(fs.readFileSync(p, 'utf8'));
+    if (!p || !existsSync(p)) return null;
+    return JSON.parse(readFileSync(p, 'utf8'));
   } catch {
     return null;
   }
@@ -48,25 +48,74 @@ function tryReadJsonFile(p) {
 function resolveExternalDatasourceSchemaPath() {
   if (process.env.AIFABRIX_EXTERNAL_DATASOURCE_SCHEMA) {
     const envPath = String(process.env.AIFABRIX_EXTERNAL_DATASOURCE_SCHEMA).trim();
-    if (envPath && fs.existsSync(envPath)) return envPath;
+    if (envPath && existsSync(envPath)) return envPath;
   }
   const candidates = [
+    path.join(__dirname, '../schema/external-datasource.schema.json'),
     path.join(process.cwd(), 'app/schemas/json/external-datasource.schema.json'),
     path.join(process.cwd(), 'aifabrix-dataplane/app/schemas/json/external-datasource.schema.json'),
     path.join(process.cwd(), '..', 'aifabrix-dataplane', 'app/schemas/json/external-datasource.schema.json'),
     path.join(__dirname, '../../../aifabrix-dataplane/app/schemas/json/external-datasource.schema.json')
   ];
   for (const c of candidates) {
-    if (c && fs.existsSync(c)) return c;
+    if (c && existsSync(c)) return c;
   }
   return null;
 }
 
 const FALLBACK_PATH = path.join(__dirname, '../schema/cip-capacity-display.fallback.json');
 
+/**
+ * When schema/fallback JSON cannot be read (missing file, parse error, or Jest fs mocks in a shared worker).
+ * Must stay aligned with `cip-capacity-display.fallback.json` and dataplane `cipDefinition.operations`.
+ */
+const HARDCODED_STANDARD_OPERATION_ORDER = ['list', 'get', 'create', 'update', 'delete'];
+const HARDCODED_DISPLAY_ALIASES = { create: 'insert (create)' };
+
 /** @type {{ standardOrder: string[], aliases: Record<string, string> }|null} */
 let _cache = null;
 
+/**
+ * @returns {{ standardOperationOrder: string[], displayAliases: Record<string, string> }}
+ */
+function readFallbackDisplayConfig() {
+  const fromFile = tryReadJsonFile(FALLBACK_PATH);
+  const order =
+    fromFile && Array.isArray(fromFile.standardOperationOrder) && fromFile.standardOperationOrder.length
+      ? fromFile.standardOperationOrder
+      : HARDCODED_STANDARD_OPERATION_ORDER;
+  const aliases =
+    fromFile && fromFile.displayAliases && typeof fromFile.displayAliases === 'object'
+      ? fromFile.displayAliases
+      : HARDCODED_DISPLAY_ALIASES;
+  return { standardOperationOrder: order, displayAliases: aliases };
+}
+
+/**
+ * Prefer schema key order, then append any fallback standard ops missing from the schema
+ * (guards partial/stale schema files and cross-test cache pollution in Jest).
+ * @param {string[]|null} fromSchema
+ * @param {string[]} fbOrder
+ * @returns {string[]}
+ */
+function mergeStandardOperationOrders(fromSchema, fbOrder) {
+  const schemaOps = Array.isArray(fromSchema)
+    ? fromSchema.map(op => String(op).trim().toLowerCase()).filter(Boolean)
+    : [];
+  const fallbackOps = Array.isArray(fbOrder)
+    ? fbOrder.map(op => String(op).trim().toLowerCase()).filter(Boolean)
+    : [];
+  if (!schemaOps.length) return fallbackOps;
+  const seen = new Set(schemaOps);
+  const merged = [...schemaOps];
+  for (const op of fallbackOps) {
+    if (seen.has(op)) continue;
+    seen.add(op);
+    merged.push(op);
+  }
+  return merged;
+}
+
 /**
  * @returns {{ standardOrder: string[], aliases: Record<string, string> }}
  */
@@ -75,16 +124,12 @@ function getCipCapacityDisplayConfig() {
   const schemaPath = resolveExternalDatasourceSchemaPath();
   const schema = schemaPath ? tryReadJsonFile(schemaPath) : null;
   const fromSchema = extractStandardOperationOrderFromSchema(schema);
-  const fallback = tryReadJsonFile(FALLBACK_PATH) || {};
-  const fbOrder = Array.isArray(fallback.standardOperationOrder)
-    ? fallback.standardOperationOrder
-    : [];
-  const standardOrder = fromSchema && fromSchema.length ? fromSchema : fbOrder;
-  const aliases =
-    fallback.displayAliases && typeof fallback.displayAliases === 'object'
-      ? fallback.displayAliases
-      : { create: 'insert (create)' };
-  _cache = { standardOrder, aliases };
+  const fallback = readFallbackDisplayConfig();
+  const standardOrder = mergeStandardOperationOrders(
+    fromSchema,
+    fallback.standardOperationOrder
+  );
+  _cache = { standardOrder, aliases: fallback.displayAliases };
   return _cache;
 }
 
@@ -122,6 +167,7 @@ function clearCipCapacityDisplayConfigCacheForTests() {
 
 module.exports = {
   extractStandardOperationOrderFromSchema,
+  mergeStandardOperationOrders,
   resolveExternalDatasourceSchemaPath,
   getCipCapacityDisplayConfig,
   standardOperationRank,

package/lib/utils/manifest-source-emit.js

@@ -104,6 +104,8 @@ function isStdoutTty() {
 function emitManifestMetadataLineIfTTY(logger, opts) {
   if (!logger || typeof logger.log !== 'function') return;
   if (!opts || opts.json || opts.envOnly) return;
+  const { isSetupQuietOutput } = require('./setup-quiet-output');
+  if (isSetupQuietOutput()) return;
   if (!isStdoutTty()) return;
   const appKey = opts.appKey && typeof opts.appKey === 'string' ? opts.appKey.trim() : '';
   const appPath = opts.appPath && typeof opts.appPath === 'string' ? opts.appPath.trim() : '';

package/lib/utils/pipeline-upload-auth-retry.js

@@ -0,0 +1,82 @@
+/**
+ * Retry dataplane pipeline upload with application client token when device Bearer fails.
+ *
+ * @fileoverview Pipeline publish auth fallback when device Bearer is rejected
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('./logger');
+const { uploadApplicationViaPipeline } = require('../api/pipeline.api');
+const { getDeploymentAuth } = require('./token-manager');
+const { resolveControllerUrl } = require('./controller-url');
+const config = require('../core/config');
+
+/**
+ * @param {Object} apiResponse
+ * @returns {boolean}
+ */
+function isPipelineAuthFailure(apiResponse) {
+  if (!apiResponse || apiResponse.success !== false) {
+    return false;
+  }
+  const status = Number(apiResponse.status) || 0;
+  if (status === 401 || status === 403) {
+    return true;
+  }
+  const text = String(
+    apiResponse.formattedError || apiResponse.error || apiResponse.message || ''
+  ).toLowerCase();
+  return text.includes('invalid token') || text.includes('unauthorized') || text.includes('authentication');
+}
+
+/**
+ * @param {string} systemKey
+ * @returns {Promise<Object|null>}
+ */
+async function resolveClientTokenAuthForPipelineRetry(systemKey) {
+  try {
+    const controllerUrl = await resolveControllerUrl();
+    const environment = await config.resolveEnvironment();
+    return await getDeploymentAuth(controllerUrl, environment, systemKey, {
+      deploymentAuth: 'client-credentials'
+    });
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * POST /api/v1/pipeline/upload with optional client-token retry after device Bearer 401.
+ *
+ * @async
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {Object} payload
+ * @param {string} systemKey - External system key for credential lookup on retry
+ * @returns {Promise<Object>}
+ */
+async function uploadApplicationViaPipelineWithAuthRetry(dataplaneUrl, authConfig, payload, systemKey) {
+  const first = await uploadApplicationViaPipeline(dataplaneUrl, authConfig, payload);
+  if (!isPipelineAuthFailure(first) || authConfig.type !== 'bearer') {
+    return first;
+  }
+  const clientAuth = await resolveClientTokenAuthForPipelineRetry(systemKey);
+  if (!clientAuth || clientAuth.type === 'bearer') {
+    return first;
+  }
+  logger.log(
+    chalk.yellow(
+      'Device login token was rejected for pipeline publish; retrying with application client token…'
+    )
+  );
+  return uploadApplicationViaPipeline(dataplaneUrl, clientAuth, payload);
+}
+
+module.exports = {
+  isPipelineAuthFailure,
+  uploadApplicationViaPipelineWithAuthRetry
+};

package/lib/utils/platform-controller-url.js

@@ -0,0 +1,156 @@
+/**
+ * Absolute public base URLs for platform apps (Keycloak, Miso Controller, Dataplane).
+ * Used by setup (`platform-controller`), guided footers, and declarative routing.
+ *
+ * @fileoverview Platform app public URL resolution (Traefik / localhost + dev ports)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const config = require('../core/config');
+const pathsUtil = require('./paths');
+const { loadConfigFile } = require('./config-format');
+const { computePublicUrlBaseString } = require('./url-declarative-public-base');
+const { joinUrlPath, normalizeFrontDoorPatternForHealth } = require('./health-check-url');
+const { getDevPorts } = require('./dev-config');
+
+const MISO_CONTROLLER_APP = 'miso-controller';
+
+/**
+ * Bundled `templates/applications/<app>/application.yaml` (fresh install has no builder copy yet).
+ *
+ * @param {string} appName
+ * @returns {Object|null}
+ */
+function loadBundledApplicationVariables(appName) {
+  const templateConfigPath = path.join(
+    pathsUtil.getProjectRoot(),
+    'templates',
+    'applications',
+    appName,
+    'application.yaml'
+  );
+  if (!fs.existsSync(templateConfigPath)) {
+    return null;
+  }
+  const variables = loadConfigFile(templateConfigPath);
+  return variables && typeof variables === 'object' ? variables : null;
+}
+
+/**
+ * Load platform app variables from materialized builder config, or from bundled template
+ * when `aifabrix setup` runs before `up-platform` has copied templates.
+ *
+ * @param {string} appName
+ * @returns {Object}
+ */
+function loadAppVariables(appName) {
+  const builderPath = pathsUtil.getBuilderPath(appName);
+  if (fs.existsSync(builderPath)) {
+    try {
+      const configPath = pathsUtil.resolveApplicationConfigPath(builderPath);
+      return loadConfigFile(configPath) || {};
+    } catch (err) {
+      const msg = err && err.message ? String(err.message) : '';
+      if (!msg.includes('Application config not found')) {
+        throw err;
+      }
+    }
+  }
+  const fromTemplate = loadBundledApplicationVariables(appName);
+  if (fromTemplate) {
+    return fromTemplate;
+  }
+  throw new Error(
+    `Application config not found for platform app "${appName}". ` +
+      'Run `aifabrix setup` or `aifabrix up-platform` to materialize builder templates.'
+  );
+}
+
+function computeLocalFullPlatformFrontDoorUrl(params) {
+  const { setupPlatformMode, remoteServer, developerIdNum, frontDoorRouting } = params;
+  if (setupPlatformMode !== 'full') {
+    return null;
+  }
+  if (remoteServer && String(remoteServer).trim()) {
+    return null;
+  }
+  const ports = getDevPorts(Number.isFinite(developerIdNum) ? developerIdNum : 0);
+  const mount = normalizeFrontDoorPatternForHealth(frontDoorRouting.pattern);
+  // Full local platform uses a single front-door port (3000 + devId×100), not the infra Traefik port.
+  return joinUrlPath(`http://localhost:${ports.app}`, mount);
+}
+
+/**
+ * Compute the absolute base URL for a platform app (same rules as guided `up-platform` footer).
+ *
+ * @async
+ * @param {string} appName - e.g. `miso-controller`, `keycloak`, `dataplane`
+ * @returns {Promise<string>}
+ */
+async function computeAppBaseUrl(appName) {
+  const variables = loadAppVariables(appName);
+  const basePort = Number(variables.port || 3000);
+  const developerIdRaw = await config.getDeveloperId();
+  const developerIdNum =
+    typeof developerIdRaw === 'string' ? parseInt(developerIdRaw, 10) : developerIdRaw;
+  const userCfg = await config.getConfig();
+  const remoteServer = await config.getRemoteServer();
+  const infraTlsEnabled = Boolean(userCfg && userCfg.tlsEnabled);
+
+  const fd = variables.frontDoorRouting || null;
+  const frontDoorEnabled = Boolean(fd && fd.enabled === true);
+  const traefikOn = Boolean(userCfg && userCfg.traefik);
+  const pathActive = Boolean(traefikOn && frontDoorEnabled);
+  const setupPlatformMode = await config.getSetupPlatformMode();
+
+  const publicBase = computePublicUrlBaseString({
+    traefik: traefikOn,
+    pathActive,
+    hostTemplate: fd ? fd.host : null,
+    tls: fd ? fd.tls : true,
+    developerIdRaw,
+    remoteServer,
+    profile: 'docker',
+    listenPort: basePort,
+    developerIdNum,
+    infraTlsEnabled
+  });
+
+  if (pathActive) {
+    const localFullUrl = computeLocalFullPlatformFrontDoorUrl({
+      setupPlatformMode,
+      remoteServer,
+      developerIdNum,
+      frontDoorRouting: fd
+    });
+    if (localFullUrl) return localFullUrl;
+    const mount = normalizeFrontDoorPatternForHealth(fd.pattern);
+    return joinUrlPath(publicBase, mount);
+  }
+
+  return String(publicBase).replace(/\/+$/, '');
+}
+
+/**
+ * Absolute Miso Controller URL for local platform install / setup auth.
+ *
+ * @async
+ * @returns {Promise<string>}
+ */
+async function resolvePlatformControllerUrl() {
+  return computeAppBaseUrl(MISO_CONTROLLER_APP);
+}
+
+module.exports = {
+  MISO_CONTROLLER_APP,
+  loadAppVariables,
+  loadBundledApplicationVariables,
+  computeAppBaseUrl,
+  resolvePlatformControllerUrl
+};