@aifabrix/builder 2.51.1 → 2.52.1

package/jest.isolated-projects.js

@@ -67,6 +67,11 @@ const ISOLATED_SUITE_ENTRIES = [
   ['role-assistant-knowledge-sync', ['**/tests/lib/role-assistant/knowledge-sync.test.js']],
   ['role-assistant-evidence-sync', ['**/tests/lib/role-assistant/evidence-sync.test.js']],
   ['role-assistant-test-cases', ['**/tests/lib/role-assistant/test-cases.test.js']],
+  ['role-assistant-test-suite', ['**/tests/lib/role-assistant/test-suite.test.js']],
+  [
+    'role-assistant-workhub-answers',
+    ['**/tests/lib/role-assistant/test-runner-workhub-answers.test.js']
+  ],
   ['governance-fixture-subjects', ['**/tests/lib/commands/governance-fixture-subjects.test.js']],
   ['enterprise-knowledge-generate-manifest', ['**/tests/lib/commands/enterprise-knowledge-generate-manifest.test.js']],
   ['plan-prevalidate-gates', ['**/tests/lib/plan-prevalidate-gates.test.js']],
@@ -152,7 +157,19 @@ const ISOLATED_SUITE_ENTRIES = [
     [
       '**/tests/lib/channels/channel-integration-generator.test.js',
       '**/tests/lib/channels/channel-artifact-generator.test.js',
-      '**/tests/lib/channels/channel-integration-template.test.js'
+      '**/tests/lib/channels/channel-integration-template.test.js',
+      '**/tests/lib/channels/add-channel.test.js',
+      '**/tests/lib/channels/microsoft-copilot-package-quality.test.js',
+      '**/tests/lib/channels/channel-branding.test.js'
+    ]
+  ],
+  [
+    'integration-definition-real-fs',
+    [
+      '**/tests/lib/validation/integration-definition-schema.test.js',
+      '**/tests/lib/integration-definition/apply.test.js',
+      '**/tests/lib/integration-definition/from-discovery.test.js',
+      '**/tests/lib/integration-definition/emit-suite-bid.test.js'
     ]
   ],
   [
@@ -175,6 +192,10 @@ const ISOLATED_SUITE_ENTRIES = [
       '**/tests/lib/scripts/sync-builder-api-template.test.js',
       '**/tests/lib/evidence/evidence-service.test.js'
     ]
+  ],
+  [
+    'enrich-openapi-operations',
+    ['**/tests/lib/integration-definition/enrich-openapi-operations.test.js']
   ]
 ];
 
@@ -224,7 +245,9 @@ function buildDefaultTestPathIgnorePatterns(includeLocalTests) {
     '/tests/integration/',
     '\\\\tests\\\\integration\\\\',
     '/tests/manual/',
-    '\\\\tests\\\\manual\\\\'
+    '\\\\tests\\\\manual\\\\',
+    '/builder/',
+    '\\\\builder\\\\'
   ];
   const globs = [
     ...ISOLATED_SUITE_ENTRIES.flatMap((entry) => entry[1]),

package/jest.projects.js

@@ -52,7 +52,10 @@ const defaultProject = {
   ],
   testPathIgnorePatterns: buildDefaultTestPathIgnorePatterns(),
   modulePathIgnorePatterns: [
-    '<rootDir>/docker-builder-api-staging/'
+    '<rootDir>/docker-builder-api-staging/',
+    // Generated app dirs under builder/ (except builder-api) — avoid haste/transform
+    // picking up junk written by generator/cli suites (e.g. builder/testapp).
+    '<rootDir>/builder/(?!builder-api(?:/|$))'
   ],
   setupFiles: ['<rootDir>/tests/capture-real-fs.js'],
   setupFilesAfterEnv: ['<rootDir>/tests/setup.js'],

package/lib/api/datasources-extended.api.js

@@ -69,28 +69,28 @@ async function detachPolicy(dataplaneUrl, sourceIdOrKey, policyIdOrKey, authConf
   const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.delete(`/api/v1/external/${sourceIdOrKey}/policies/${policyIdOrKey}`);
 }
-/** @requiresPermission {Dataplane} external-system:read (sync) */
+/** @requiresPermission {Dataplane} external-data-source:read (sync under /data-storage) */
 async function listSyncJobs(dataplaneUrl, sourceIdOrKey, authConfig, options = {}) {
   const client = createDataplaneApiClient(dataplaneUrl, authConfig);
-  return await client.get(`/api/v1/external/${sourceIdOrKey}/sync`, { params: options });
+  return await client.get(`/api/v1/data-storage/${sourceIdOrKey}/sync`, { params: options });
 }
 async function createSyncJob(dataplaneUrl, sourceIdOrKey, authConfig, syncData) {
   const client = createDataplaneApiClient(dataplaneUrl, authConfig);
-  return await client.post(`/api/v1/external/${sourceIdOrKey}/sync`, { body: syncData });
+  return await client.post(`/api/v1/data-storage/${sourceIdOrKey}/sync`, { body: syncData });
 }
-/** @requiresPermission {Dataplane} external-system:read */
+/** @requiresPermission {Dataplane} external-data-source:read */
 async function getSyncJob(dataplaneUrl, sourceIdOrKey, syncJobId, authConfig) {
   const client = createDataplaneApiClient(dataplaneUrl, authConfig);
-  return await client.get(`/api/v1/external/${sourceIdOrKey}/sync/${syncJobId}`);
+  return await client.get(`/api/v1/data-storage/${sourceIdOrKey}/sync/${syncJobId}`);
 }
-/** @requiresPermission {Dataplane} external-system:update */
+/** @requiresPermission {Dataplane} external-data-source:sync */
 async function updateSyncJob(dataplaneUrl, sourceIdOrKey, syncJobId, authConfig, updateData) {
   const client = createDataplaneApiClient(dataplaneUrl, authConfig);
-  return await client.put(`/api/v1/external/${sourceIdOrKey}/sync/${syncJobId}`, { body: updateData });
+  return await client.put(`/api/v1/data-storage/${sourceIdOrKey}/sync/${syncJobId}`, { body: updateData });
 }
 async function executeSyncJob(dataplaneUrl, sourceIdOrKey, syncJobId, authConfig) {
   const client = createDataplaneApiClient(dataplaneUrl, authConfig);
-  return await client.post(`/api/v1/external/${sourceIdOrKey}/sync/${syncJobId}/execute`);
+  return await client.post(`/api/v1/data-storage/${sourceIdOrKey}/sync/${syncJobId}/execute`);
 }
 /** @requiresPermission {Dataplane} external-data-source:sync */
 async function validateDocuments(dataplaneUrl, sourceIdOrKey, authConfig, validateData) {

package/lib/api/keycloak.api.js

@@ -0,0 +1,92 @@
+/**
+ * @fileoverview Keycloak status API (Controller) — Entra IdP ids for packaging
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { ApiClient } = require('./index');
+
+const KEYCLOAK_STATUS_PATH = '/api/v1/keycloak/status';
+
+/**
+ * @param {Object} response
+ * @returns {import('./types/keycloak.types').KeycloakStatus|null}
+ */
+function extractKeycloakStatus(response) {
+  if (!response || typeof response !== 'object' || response.success === false) {
+    return null;
+  }
+  const body = response.data ?? response;
+  const data = body?.data !== undefined ? body.data : body;
+  if (!data || typeof data !== 'object' || Array.isArray(data)) {
+    return null;
+  }
+  return data;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {string|null}
+ */
+function trimNonEmptyString(value) {
+  if (typeof value !== 'string') {
+    return null;
+  }
+  const trimmed = value.trim();
+  return trimmed || null;
+}
+
+/**
+ * @param {import('./types/keycloak.types').KeycloakStatus|null} status
+ * @returns {import('./types/keycloak.types').KeycloakEntraIdentityProvider|null}
+ */
+function extractEntraIdentityProvider(status) {
+  const raw = status?.entraIdentityProvider;
+  if (!raw || typeof raw !== 'object') {
+    return null;
+  }
+  const enterpriseAppId = trimNonEmptyString(raw.enterpriseAppId);
+  if (!enterpriseAppId) {
+    return null;
+  }
+  const tenantId = trimNonEmptyString(raw.tenantId);
+  return tenantId ? { enterpriseAppId, tenantId } : { enterpriseAppId };
+}
+
+/**
+ * GET /api/v1/keycloak/status
+ * @requiresPermission {Controller} admin:keycloak
+ * @async
+ * @param {string} controllerUrl - Miso Controller base URL
+ * @param {Object} authConfig - Authentication configuration (device Bearer)
+ * @returns {Promise<import('./types/keycloak.types').KeycloakStatus|null>}
+ */
+async function getKeycloakStatus(controllerUrl, authConfig) {
+  const client = new ApiClient(controllerUrl, authConfig);
+  const response = await client.get(KEYCLOAK_STATUS_PATH);
+  return extractKeycloakStatus(response);
+}
+
+/**
+ * Resolve Entra SSO enterprise app id from Keycloak status, or null when missing.
+ * Does not invent ids.
+ * @requiresPermission {Controller} admin:keycloak
+ * @async
+ * @param {string} controllerUrl - Miso Controller base URL
+ * @param {Object} authConfig - Authentication configuration
+ * @returns {Promise<import('./types/keycloak.types').KeycloakEntraIdentityProvider|null>}
+ */
+async function getKeycloakEntraIdentityProvider(controllerUrl, authConfig) {
+  const status = await getKeycloakStatus(controllerUrl, authConfig);
+  return extractEntraIdentityProvider(status);
+}
+
+module.exports = {
+  KEYCLOAK_STATUS_PATH,
+  getKeycloakStatus,
+  getKeycloakEntraIdentityProvider,
+  extractKeycloakStatus,
+  extractEntraIdentityProvider
+};

package/lib/api/token-providers.api.js

@@ -0,0 +1,77 @@
+/**
+ * @fileoverview Admin token providers API (Controller Trust sources)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { ApiClient } = require('./index');
+
+const ADMIN_BASE = '/api/v1/admin/token-providers';
+const MICROSOFT_ENTRA_ID_KEY = 'microsoft-entra-id';
+
+/**
+ * @param {Object} response
+ * @returns {import('./types/token-providers.types').TokenProvider[]}
+ */
+function extractTokenProviders(response) {
+  const body = response?.data ?? response;
+  const data = body?.data ?? body;
+  if (Array.isArray(data)) {
+    return data;
+  }
+  if (Array.isArray(data?.items)) {
+    return data.items;
+  }
+  return [];
+}
+
+/**
+ * List admin token providers (paginated).
+ * GET /api/v1/admin/token-providers
+ * @requiresPermission {Controller} token-provider:read
+ * @async
+ * @param {string} controllerUrl - Miso Controller base URL
+ * @param {Object} authConfig - Authentication configuration (device Bearer)
+ * @param {import('./types/token-providers.types').ListAdminTokenProvidersOptions} options
+ * @returns {Promise<Object>} Controller list response
+ * @throws {Error} If direction is missing or request fails
+ */
+async function listAdminTokenProviders(controllerUrl, authConfig, options = {}) {
+  const direction = options?.direction;
+  if (direction !== 'inbound' && direction !== 'outbound') {
+    throw new Error('direction is required and must be "inbound" or "outbound"');
+  }
+  const client = new ApiClient(controllerUrl, authConfig);
+  const params = { ...options, direction };
+  return await client.get(ADMIN_BASE, { params });
+}
+
+/**
+ * Resolve inbound Microsoft Entra ID Trust source, or null when missing.
+ * Does not invent issuer, audience, or scopes.
+ * @requiresPermission {Controller} token-provider:read
+ * @async
+ * @param {string} controllerUrl - Miso Controller base URL
+ * @param {Object} authConfig - Authentication configuration
+ * @returns {Promise<import('./types/token-providers.types').TokenProvider|null>}
+ */
+async function getInboundMicrosoftEntraIdProvider(controllerUrl, authConfig) {
+  const response = await listAdminTokenProviders(controllerUrl, authConfig, {
+    direction: 'inbound',
+    search: MICROSOFT_ENTRA_ID_KEY,
+    page: 1,
+    pageSize: 50
+  });
+  const items = extractTokenProviders(response);
+  const exact = items.find((item) => item && item.key === MICROSOFT_ENTRA_ID_KEY);
+  return exact || null;
+}
+
+module.exports = {
+  listAdminTokenProviders,
+  getInboundMicrosoftEntraIdProvider,
+  extractTokenProviders,
+  MICROSOFT_ENTRA_ID_KEY
+};

package/lib/api/types/keycloak.types.js

@@ -0,0 +1,23 @@
+/**
+ * @fileoverview Keycloak status API type definitions (Controller)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+/**
+ * Entra identity provider fragment from Keycloak status.
+ * @typedef {Object} KeycloakEntraIdentityProvider
+ * @property {string} enterpriseAppId - Entra SSO application (client) id
+ * @property {string} [tenantId] - Entra tenant id when known
+ */
+
+/**
+ * Keycloak configuration status payload (`data` of GET /api/v1/keycloak/status).
+ * @typedef {Object} KeycloakStatus
+ * @property {string} [realm]
+ * @property {string} [status]
+ * @property {string} [controllerClientId]
+ * @property {KeycloakEntraIdentityProvider} [entraIdentityProvider]
+ */
+
+module.exports = {};

package/lib/api/types/token-providers.types.js

@@ -0,0 +1,65 @@
+/**
+ * @fileoverview Token provider API type definitions (Controller admin Trust sources)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+/**
+ * Token provider direction
+ * @typedef {'inbound'|'outbound'} TokenProviderDirection
+ */
+
+/**
+ * Token provider subject type
+ * @typedef {'user'|'service'|'both'} TokenProviderSubjectType
+ */
+
+/**
+ * Allowed operation on a token provider
+ * @typedef {'mcp.invoke'|'dataplane.read'|'dataplane.write'} TokenProviderAllowedOperation
+ */
+
+/**
+ * Admin token provider list item (Controller TokenProvider schema)
+ * @typedef {Object} TokenProvider
+ * @property {string} id - Unique identifier (cuid)
+ * @property {string} key - Unique slug (e.g. microsoft-entra-id)
+ * @property {string} displayName - Human-readable name
+ * @property {string} issuer - JWT issuer URL (iss claim)
+ * @property {string} jwksUri - JWKS endpoint for key verification
+ * @property {string|null} [audience] - Expected audience claim (may be null)
+ * @property {TokenProviderSubjectType} subjectType - Subject type
+ * @property {TokenProviderDirection} direction - inbound or outbound
+ * @property {string|null} [identityClaim] - Claim used for user identity
+ * @property {string|null} [emailClaim] - Claim used for email
+ * @property {boolean} [autoProvision] - Whether to auto-create users
+ * @property {string|null} [serviceUserKey] - Service user key for service flow
+ * @property {TokenProviderAllowedOperation[]} [allowedOperations] - Allowed operations
+ * @property {string[]} [allowedScopes] - OAuth scopes (may be empty)
+ * @property {boolean} enabled - Whether this provider is enabled
+ * @property {string} [createdAt] - Created at
+ * @property {string} [updatedAt] - Updated at
+ */
+
+/**
+ * List admin token providers query options
+ * @typedef {Object} ListAdminTokenProvidersOptions
+ * @property {TokenProviderDirection} direction - Required by OpenAPI
+ * @property {string} [search] - Search across key, displayName, issuer
+ * @property {number} [page] - Page number
+ * @property {number} [pageSize] - Page size
+ * @property {string} [sort] - Sort expression
+ * @property {string} [filter] - Filter expression
+ * @property {string} [enabled] - 'true' | 'false'
+ * @property {TokenProviderSubjectType} [subjectType] - Subject type filter
+ */
+
+/**
+ * Paginated list response for admin token providers
+ * @typedef {Object} ListAdminTokenProvidersResponse
+ * @property {TokenProvider[]} data - Provider rows
+ * @property {Object} meta - Pagination meta
+ * @property {Object} [links] - Pagination links
+ */
+
+module.exports = {};

package/lib/app/down.js

@@ -111,6 +111,20 @@ async function stopAppContainers(appName, companionKeys, developerId) {
   }
 }
 
+/**
+ * Resolve developer id for downApp (optional override does not change config).
+ * @param {Object} options
+ * @returns {Promise<string>}
+ */
+async function resolveDownAppDeveloperId(options) {
+  const override = options && options.developerId;
+  if (override === undefined || override === null || override === '') {
+    return config.getDeveloperId();
+  }
+  const { validateAndNormalizeDeveloperId } = require('../core/config-normalize');
+  return validateAndNormalizeDeveloperId(override);
+}
+
 /**
  * Stops and removes a specific application's container.
  * If --volumes is passed, attempts to remove the app's named Docker volume.
@@ -122,6 +136,7 @@ async function stopAppContainers(appName, companionKeys, developerId) {
  * @param {string} appName - Application name
  * @param {Object} options - Options
  * @param {boolean} [options.volumes=false] - Remove Docker volume data
+ * @param {string|number} [options.developerId] - Target developer for this stop only
  * @returns {Promise<void>} Resolves when operation completes
  * @throws {Error} If validation fails or Docker operations error (other than missing volume)
  *
@@ -136,7 +151,7 @@ async function downApp(appName, options = {}) {
     validateAppName(appName);
 
     const volumes = !!options.volumes;
-    const developerId = await config.getDeveloperId();
+    const developerId = await resolveDownAppDeveloperId(options);
     const appConfig = loadBuilderApplicationConfig(appName);
     const companionKeys = getCeleryCompanionAppKeys(appName, appConfig);
 

package/lib/app/run-container-start.js

@@ -141,6 +141,7 @@ async function startContainer(appName, composePath, port, appConfig = null, opts
     debug = false,
     runEnvPath = null,
     runEnvAdminPath = null,
+    ensureRunEnvFiles = null,
     runOptions = {},
     devMountPath = null,
     misoEnvironment = 'dev'
@@ -166,6 +167,9 @@ async function startContainer(appName, composePath, port, appConfig = null, opts
   }
 
   if (!usedDockerRunFallback) {
+    if (typeof ensureRunEnvFiles === 'function') {
+      await ensureRunEnvFiles();
+    }
     const env = await prepareContainerEnv(debug);
     await executeComposeUp(composeCmdBase, composePath, env, debug);
   }

package/lib/app/run-deploy-job.js

@@ -11,11 +11,16 @@ const logger = require('../utils/logger');
 const {
   infoLine,
   formatSuccessLine,
-  formatBlockingError
+  formatBlockingError,
+  metadata
 } = require('../utils/cli-test-layout-chalk');
 const { runDockerRunEphemeral } = require('../utils/docker-run-ephemeral');
 const { getInfraBridgeNetworkName } = require('../infrastructure/orphan-infra-docker-teardown');
 
+/** Migrate status lines: `[system] head=… applied=3 pending=[]` */
+const DEPLOY_JOB_STATUS_RE =
+  /^\[([^\]]+)\]\s+head=\S+\s+applied=(\d+)\s+pending=(\[[^\]]*\])/i;
+
 /**
  * Resolve trimmed deployJob from app config, or null if unset.
  * @param {Object} appConfig - Application configuration
@@ -39,6 +44,115 @@ async function resolveDeployJobNetwork() {
   return getInfraBridgeNetworkName(developerId);
 }
 
+/**
+ * Quiet docker stdio by default (hide app bootstrap warnings). Full inherit only with --debug.
+ * @param {{ quiet?: boolean, debug?: boolean }} params
+ * @returns {boolean}
+ */
+function shouldQuietDeployJob(params = {}) {
+  if (params.debug === true) {
+    return false;
+  }
+  return true;
+}
+
+/**
+ * Parse migrate CLI status lines into totals (no per-chain head/pending dump).
+ * @param {string} output
+ * @returns {{ chains: number, applied: number, pending: number }|null}
+ */
+function summarizeDeployJobMigrateOutput(output) {
+  if (typeof output !== 'string' || !output.trim()) {
+    return null;
+  }
+  let chains = 0;
+  let applied = 0;
+  let pending = 0;
+  for (const line of output.split(/\r?\n/)) {
+    const match = DEPLOY_JOB_STATUS_RE.exec(line.trim());
+    if (!match) {
+      continue;
+    }
+    chains += 1;
+    applied += Number.parseInt(match[2], 10) || 0;
+    const inner = match[3].slice(1, -1).trim();
+    if (inner) {
+      pending += inner.split(',').filter((part) => part.trim()).length;
+    }
+  }
+  if (chains === 0) {
+    return null;
+  }
+  return { chains, applied, pending };
+}
+
+/**
+ * One-line migrate totals from quiet deployJob output (replaces per-chain dump).
+ * @param {string} output
+ * @returns {string|null} Summary text for the completed line, or null
+ */
+function formatDeployJobMigrateSummary(output) {
+  const summary = summarizeDeployJobMigrateOutput(output);
+  if (!summary) {
+    return null;
+  }
+  return `${summary.applied} applied, ${summary.pending} pending (${summary.chains} chains)`;
+}
+
+/**
+ * @deprecated Prefer formatDeployJobMigrateSummary — kept for tests.
+ * @param {string} output
+ */
+function emitDeployJobSummaryLines(output) {
+  const text = formatDeployJobMigrateSummary(output);
+  if (text) {
+    logger.log(metadata(`DB migrate: ${text}`));
+  }
+}
+
+/**
+ * @param {string|null|undefined} devMountPath
+ * @returns {Array<{ host: string, container: string }>}
+ */
+function _deployJobVolumeMounts(devMountPath) {
+  if (typeof devMountPath !== 'string' || !devMountPath.trim()) {
+    return [];
+  }
+  return [{ host: devMountPath.trim(), container: '/app' }];
+}
+
+/**
+ * Always announce the job; debug adds command/network/mount detail.
+ * @param {{ fullImage: string, cmd: string, network: string, volumeMounts: Array, debug: boolean }} params
+ */
+function _logDeployJobStart(params) {
+  logger.log(infoLine(`Running build.deployJob once before start (${params.fullImage})…`));
+  if (!params.debug) {
+    return;
+  }
+  logger.log(infoLine(`deployJob: ${params.cmd}`));
+  logger.log(infoLine(`deployJob network: ${params.network}`));
+  if (params.volumeMounts.length) {
+    logger.log(infoLine(`deployJob mount: ${params.volumeMounts[0].host} -> /app`));
+  }
+}
+
+/**
+ * @param {{ result: any, quietJob: boolean }} params
+ * @throws {Error}
+ */
+function _assertDeployJobExit(params) {
+  const code = params.quietJob ? params.result.code : params.result;
+  if (code === 0) {
+    return;
+  }
+  if (params.quietJob && params.result.output) {
+    logger.log(params.result.output.trimEnd());
+  }
+  logger.log(formatBlockingError(`build.deployJob failed with exit code ${code}`));
+  throw new Error(`build.deployJob failed with exit code ${code}`);
+}
+
 /**
  * If build.deployJob is set, run it once in an ephemeral container (same image + env).
  * Fail-closed on non-zero exit. No-op when unset.
@@ -53,6 +167,7 @@ async function resolveDeployJobNetwork() {
  * @param {string|null} [params.runEnvPath] - Ephemeral .env.run path for --env-file
  * @param {string|null} [params.devMountPath] - Host path mounted at /app for --reload
  * @param {boolean} [params.debug]
+ * @param {boolean} [params.quiet] - Unused legacy flag; quiet is default unless debug
  * @returns {Promise<void>}
  * @throws {Error} If deployJob exits non-zero
  */
@@ -61,7 +176,8 @@ async function runDeployJobIfConfigured({
   fullImage,
   runEnvPath = null,
   devMountPath = null,
-  debug = false
+  debug = false,
+  quiet = false
 }) {
   const cmd = resolveDeployJobCommand(appConfig);
   if (!cmd) {
@@ -72,37 +188,29 @@ async function runDeployJobIfConfigured({
   }
   const network = await resolveDeployJobNetwork();
   const volumeMounts = _deployJobVolumeMounts(devMountPath);
-  logger.log(infoLine(`Running build.deployJob once before start (${fullImage})…`));
-  if (debug) {
-    logger.log(infoLine(`deployJob: ${cmd}`));
-    logger.log(infoLine(`deployJob network: ${network}`));
-    if (volumeMounts.length) {
-      logger.log(infoLine(`deployJob mount: ${volumeMounts[0].host} -> /app`));
-    }
-  }
-  const code = await runDockerRunEphemeral(fullImage, cmd, runEnvPath, {
+  const quietJob = shouldQuietDeployJob({ quiet, debug });
+  _logDeployJobStart({ fullImage, cmd, network, volumeMounts, debug });
+  const result = await runDockerRunEphemeral(fullImage, cmd, runEnvPath, {
     network,
-    volumeMounts
+    volumeMounts,
+    quiet: quietJob
   });
-  if (code !== 0) {
-    logger.log(formatBlockingError(`build.deployJob failed with exit code ${code}`));
-    throw new Error(`build.deployJob failed with exit code ${code}`);
+  _assertDeployJobExit({ result, quietJob });
+  if (quietJob && result.output) {
+    const migrateSummary = formatDeployJobMigrateSummary(result.output);
+    if (migrateSummary) {
+      logger.log(formatSuccessLine(`build.deployJob completed — ${migrateSummary}`));
+      return;
+    }
   }
   logger.log(formatSuccessLine('build.deployJob completed'));
 }
 
-/**
- * @param {string|null|undefined} devMountPath
- * @returns {Array<{ host: string, container: string }>}
- */
-function _deployJobVolumeMounts(devMountPath) {
-  if (typeof devMountPath !== 'string' || !devMountPath.trim()) {
-    return [];
-  }
-  return [{ host: devMountPath.trim(), container: '/app' }];
-}
-
 module.exports = {
   resolveDeployJobCommand,
-  runDeployJobIfConfigured
+  runDeployJobIfConfigured,
+  shouldQuietDeployJob,
+  emitDeployJobSummaryLines,
+  formatDeployJobMigrateSummary,
+  summarizeDeployJobMigrateOutput
 };

package/lib/app/run-env-compose.js

@@ -315,6 +315,37 @@ async function buildMergedRunEnvAndWrite(appName, appConfig, devDir, developerId
   return { runEnvPath, runEnvAdminPath };
 }
 
+/**
+ * Rebuild run env files when another use of the shared applications directory removed them.
+ * @async
+ * @param {string} appName - Application name
+ * @param {Object} appConfig - Application configuration
+ * @param {string} runEnvPath - Expected .env.run path
+ * @param {string} runEnvAdminPath - Expected .env.run.admin path
+ * @param {number|string} developerId - Developer ID
+ * @param {Object|null} scopeOpts - Environment-scoped run options
+ * @returns {Promise<void>}
+ */
+async function ensureRunEnvFilesPresent(
+  appName,
+  appConfig,
+  runEnvPath,
+  runEnvAdminPath,
+  developerId,
+  scopeOpts = null
+) {
+  if (fsSync.existsSync(runEnvPath) && fsSync.existsSync(runEnvAdminPath)) {
+    return;
+  }
+  await buildMergedRunEnvAndWrite(
+    appName,
+    appConfig,
+    path.dirname(runEnvPath),
+    developerId,
+    scopeOpts
+  );
+}
+
 /**
  * Assert generated compose does not contain password literals in environment (ISO 27K).
  * @param {string} composeContent - Generated docker-compose content
@@ -330,6 +361,7 @@ function assertNoPasswordLiteralsInCompose(composeContent) {
 module.exports = {
   cleanApplicationsDir,
   buildMergedRunEnvAndWrite,
+  ensureRunEnvFilesPresent,
   assertNoPasswordLiteralsInCompose,
   ensureRunSecretsForApp
 };