@aifabrix/builder 2.55.0 → 2.55.2

package/lib/commands/auth-status.js

@@ -34,6 +34,7 @@ const {
   displayStoredClientTokensSection,
   tryResolveClientTokenAuth
 } = require('./auth-status-client-tokens');
+const { parseAuthUserResponse } = require('./auth-status-user');
 
 /**
  * Format expiration date for display
@@ -71,11 +72,13 @@ async function checkDeviceToken(controllerUrl) {
     const response = await getAuthUser(controllerUrl, authConfig);
 
     if (response.success && response.data) {
+      const parsed = parseAuthUserResponse(response, deviceToken.token);
       return {
         type: 'Device Token',
         token: deviceToken.token,
-        authenticated: response.data.authenticated !== false,
-        user: response.data.user,
+        authenticated: parsed.authenticated,
+        user: parsed.user,
+        username: parsed.username,
         expiresAt: deviceToken.expiresAt
       };
     }
@@ -113,11 +116,13 @@ async function validateClientToken(token, controllerUrl, environment, appName, e
     const response = await getAuthUser(controllerUrl, authConfig);
 
     if (response.success && response.data) {
+      const parsed = parseAuthUserResponse(response, token);
       return {
         type: 'Client Token',
         token: token,
-        authenticated: response.data.authenticated !== false,
-        user: response.data.user,
+        authenticated: parsed.authenticated,
+        user: parsed.user,
+        username: parsed.username,
         expiresAt: expiresAt,
         appName: appName
       };
@@ -185,6 +190,11 @@ function displayTokenInfo(tokenInfo) {
   logger.log(`  Status: ${statusIcon} ${statusText}`);
   logger.log(`  Token Type: ${chalk.cyan(tokenInfo.type)}`);
 
+  if (tokenInfo.authenticated) {
+    const username = tokenInfo.username || (tokenInfo.user && tokenInfo.user.username);
+    logger.log(`  User: ${username ? chalk.cyan(username) : chalk.gray('—')}`);
+  }
+
   if (tokenInfo.appName) {
     logger.log(`  Application: ${chalk.cyan(tokenInfo.appName)}`);
   }

package/lib/commands/datasource-load-export-cli.js

@@ -7,6 +7,7 @@
 'use strict';
 
 const logger = require('../utils/logger');
+const { writeJsonEnvelopeAndExit } = require('../utils/cli-json-exit');
 const { formatBlockingError } = require('../utils/cli-test-layout-chalk');
 const { runDatasourceLoad } = require('../datasource/bulk-loader-service');
 const { runDatasourceExport } = require('../datasource/datasource-exporter-service');
@@ -82,7 +83,9 @@ async function datasourceLoadAction(datasourceKey, options) {
 
     if (options.json) {
       const { context: _ctx, ...payload } = result;
-      logger.log(JSON.stringify(payload, null, 2));
+      // exitCode 0 — write and resolve, never exit here; this action always
+      // exits unconditionally below with the real computed code.
+      await writeJsonEnvelopeAndExit(payload, 0);
     } else {
       displayDatasourceLoadTTY(result, { environment: options.env, verbose: options.verbose });
     }
@@ -112,7 +115,9 @@ async function datasourceExportAction(datasourceKey, options) {
 
     if (options.json) {
       const { context: _ctx, ...payload } = result;
-      logger.log(JSON.stringify(payload, null, 2));
+      // exitCode 0 — write and resolve, never exit here; this action always
+      // exits unconditionally below with the real computed code.
+      await writeJsonEnvelopeAndExit(payload, 0);
     } else {
       displayDatasourceExportTTY(result, { environment: options.env, verbose: options.verbose });
     }

package/lib/commands/datasource-test-trust-cli.js

@@ -7,6 +7,7 @@
 'use strict';
 
 const logger = require('../utils/logger');
+const { writeJsonEnvelopeAndExit } = require('../utils/cli-json-exit');
 const { formatBlockingError } = require('../utils/cli-test-layout-chalk');
 const { runDatasourceAgentTrust } = require('../datasource/agent-trust-run');
 const { writeTrustDebugLogAndPrint } = require('../datasource/agent-trust-debug-log');
@@ -52,7 +53,10 @@ async function finalizeDatasourceVerifyTrust(datasourceKey, options, result) {
     strict: options.strict === true
   };
   if (options.json) {
-    logger.log(JSON.stringify(result.trustRun, null, 2));
+    // exitCode 0 here means "write and resolve, never exit" — the real exit
+    // code is decided below and the caller exits unconditionally, even on
+    // success, so process.exit() must stay solely the caller's job.
+    await writeJsonEnvelopeAndExit(result.trustRun, 0);
   } else if (options.summary) {
     const tr = result.trustRun;
     logger.log(

package/lib/commands/governance-command-action.js

@@ -6,6 +6,7 @@
 
 const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
+const { writeJsonEnvelopeAndExit } = require('../utils/cli-json-exit');
 const { runGovernanceGenerateForExternalSystem } = require('./governance-generate-external');
 const { runGovernanceVerifyForExternalSystem } = require('./governance-verify-external');
 const { runGovernanceUploadForExternalSystem } = require('./governance-upload-external');
@@ -75,12 +76,12 @@ async function governanceVerifyHandler(systemKey, options, cmd) {
   try {
     const opts = normalizeGovernanceOptions(options, cmd);
     const result = await runGovernanceVerifyForExternalSystem(systemKey, opts);
+    const exitCode = exitCodeFromVerdict(result.verdict);
     if (opts.json) {
-      logger.log(JSON.stringify(buildJsonEnvelope(result, opts.verbose), null, 2));
-    } else {
-      displayVerifyGovernanceTTY(result.systemKey, result, { details: opts.verbose });
+      await writeJsonEnvelopeAndExit(buildJsonEnvelope(result, opts.verbose), exitCode);
+      return;
     }
-    const exitCode = exitCodeFromVerdict(result.verdict);
+    displayVerifyGovernanceTTY(result.systemKey, result, { details: opts.verbose });
     if (exitCode !== 0) {
       process.exit(exitCode);
     }

package/lib/commands/identity-membership-role-cache.js

@@ -35,7 +35,12 @@ const ROLE_LIST_COLUMNS = [
     label: 'Groups',
     width: 44,
     value: (r) => {
-      const groups = Array.isArray(r.groups) ? r.groups.filter(Boolean) : [];
+      const groups = Array.isArray(r.groups)
+        ? r.groups.filter(Boolean)
+        : (r.mappings || [])
+          .filter((mapping) => mapping?.isActive !== false)
+          .map((mapping) => mapping?.groupName)
+          .filter(Boolean);
       return groups.length > 0 ? groups.join(', ') : '—';
     }
   }

package/lib/commands/lifecycle-command-action.js

@@ -6,8 +6,8 @@
 
 'use strict';
 
-const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
+const { writeJsonEnvelopeAndExit } = require('../utils/cli-json-exit');
 const { cliOptsSkipPublish } = require('../utils/cli-sync-options');
 const { runLifecycleForExternalSystem } = require('./lifecycle-external');
 const { displayLifecycleReportTTY } = require('../lifecycle/report-display');
@@ -65,6 +65,12 @@ async function runLifecycleCommandAction(appName, options, cmd) {
   const result = await runLifecycleForExternalSystem(appName, opts);
   const report = result.report;
 
+  const pillarVerdict = lifecycleVerdictFromReport(report);
+  const exitCode =
+    pillarVerdict === VERDICT.VERIFIED
+      ? 0
+      : exitCodeFromVerdict(pillarVerdict, { partial: pillarVerdict === VERDICT.NOT_VERIFIED });
+
   if (opts.json) {
     const envelope = {
       systemKey: result.systemKey,
@@ -82,22 +88,17 @@ async function runLifecycleCommandAction(appName, options, cmd) {
     if (opts.verbose) {
       envelope.datasources = report.datasources;
     }
-    logger.log(JSON.stringify(envelope, null, 2));
-  } else {
-    displayLifecycleReportTTY(result.systemKey, report, {
-      details: opts.verbose,
-      openApiPublished: result.openApiPublished === true,
-      certificationProgress: result.certificationProgress ?? null,
-      dataplaneUrl: result.dataplaneUrl ?? null,
-      dataplaneUiBaseUrl: result.dataplaneUiBaseUrl ?? null
-    });
+    await writeJsonEnvelopeAndExit(envelope, exitCode);
+    return;
   }
 
-  const pillarVerdict = lifecycleVerdictFromReport(report);
-  const exitCode =
-    pillarVerdict === VERDICT.VERIFIED
-      ? 0
-      : exitCodeFromVerdict(pillarVerdict, { partial: pillarVerdict === VERDICT.NOT_VERIFIED });
+  displayLifecycleReportTTY(result.systemKey, report, {
+    details: opts.verbose,
+    openApiPublished: result.openApiPublished === true,
+    certificationProgress: result.certificationProgress ?? null,
+    dataplaneUrl: result.dataplaneUrl ?? null,
+    dataplaneUiBaseUrl: result.dataplaneUiBaseUrl ?? null
+  });
   if (exitCode !== 0) {
     process.exit(exitCode);
   }

package/lib/commands/login-credentials.js

@@ -15,6 +15,7 @@ const { getToken } = require('../api/auth.api');
 const { formatApiError } = require('../utils/api-error-handler');
 const { loadClientCredentials } = require('../utils/token-manager');
 const logger = require('../utils/logger');
+const { writeStreamAndWait } = require('../utils/write-stream-and-wait');
 
 /**
  * Tries to load credentials from secrets file
@@ -136,7 +137,7 @@ function handleLoginError(response, appName) {
  * @param {Object} response - API response
  * @returns {Object} Token data object
  */
-function extractTokenData(response) {
+async function extractTokenData(response) {
   // OpenAPI spec response: { success: boolean, token: string, expiresIn: number, expiresAt: string, ... }
   // Handle both flat and nested response structures (some APIs wrap in data field)
   // If response.data exists, use it; otherwise use response directly
@@ -146,7 +147,10 @@ function extractTokenData(response) {
   if (!responseData || !responseData.token) {
     logger.error(formatBlockingError('Invalid response: missing token'));
     if (responseData) {
-      logger.error(chalk.gray(`Response structure: ${JSON.stringify(responseData, null, 2)}`));
+      await writeStreamAndWait(
+        process.stderr,
+        `${chalk.gray(`Response structure: ${JSON.stringify(responseData, null, 2)}`)}\n`
+      );
     }
     process.exit(1);
   }
@@ -190,9 +194,10 @@ async function handleCredentialsLogin(controllerUrl, appName, clientId, clientSe
 
   if (!response.success) {
     handleLoginError(response, appName);
+    return;
   }
 
-  const responseData = extractTokenData(response);
+  const responseData = await extractTokenData(response);
   const expiresAt = calculateTokenExpiration(responseData);
 
   return {

package/lib/commands/login-device.js

@@ -15,6 +15,7 @@ const ora = require('ora');
 const { setCurrentEnvironment, saveDeviceToken, setControllerUrl } = require('../core/config');
 const { initiateDeviceCodeFlow } = require('../api/auth.api');
 const { pollDeviceCodeToken, displayDeviceCodeInfo } = require('../utils/api');
+const { resolveDeviceVisitUrl } = require('../utils/device-code');
 const logger = require('../utils/logger');
 const { formatSuccessLine } = require('../utils/cli-layout-chalk');
 
@@ -42,6 +43,10 @@ async function getEnvironmentKey(environment) {
     return envKey;
   }
 
+  if (!process.stdin || process.stdin.isTTY === false) {
+    return 'dev';
+  }
+
   const envPrompt = await inquirer.prompt([{
     type: 'input',
     name: 'environment',
@@ -255,10 +260,8 @@ function logDeviceFlowError(deviceError, opts) {
 }
 
 function printCompactDeviceUrl(deviceCodeResponse) {
-  const visitUrl =
-    deviceCodeResponse.verification_uri_complete ||
-    `${deviceCodeResponse.verification_uri}?user_code=${deviceCodeResponse.user_code}`;
-  logger.log('\nOpen browser to authenticate:');
+  const visitUrl = resolveDeviceVisitUrl(deviceCodeResponse);
+  logger.log('\nOpen this URL to authenticate:');
   logger.log(chalk.yellow(`${visitUrl}\n`));
 }
 
@@ -289,7 +292,13 @@ async function handleDeviceCodeLogin(controllerUrl, environment, online, scope,
     const deviceCodeResponse = convertDeviceCodeResponse(apiResponse);
 
     if (!opts.compact) {
-      displayDeviceCodeInfo(deviceCodeResponse.user_code, deviceCodeResponse.verification_uri, logger, chalk);
+      displayDeviceCodeInfo(
+        deviceCodeResponse.user_code,
+        deviceCodeResponse.verification_uri,
+        logger,
+        chalk,
+        deviceCodeResponse.verification_uri_complete
+      );
     } else {
       printCompactDeviceUrl(deviceCodeResponse);
     }

package/lib/commands/login.js

@@ -16,9 +16,13 @@ const { setCurrentEnvironment, saveClientToken, setControllerUrl } = require('..
 const logger = require('../utils/logger');
 const { handleCredentialsLogin } = require('./login-credentials');
 const { handleDeviceCodeLogin } = require('./login-device');
-const { resolveControllerUrl } = require('../utils/controller-url');
+const { resolveControllerUrl, discoverControllerBaseUrl } = require('../utils/controller-url');
 const { tryRefreshDataplaneVersionAfterLogin } = require('./auth-status-dataplane-version');
 
+function isInteractiveStdin() {
+  return Boolean(process.stdin && process.stdin.isTTY);
+}
+
 /**
  * Determine and validate authentication method
  * @async
@@ -34,6 +38,10 @@ async function determineAuthMethod(method) {
     return method;
   }
 
+  if (!isInteractiveStdin()) {
+    return 'device';
+  }
+
   const authMethod = await inquirer.prompt([{
     type: 'list',
     name: 'method',
@@ -86,6 +94,8 @@ async function normalizeControllerUrl(options) {
     controllerUrl = await resolveControllerUrl();
   }
   controllerUrl = String(controllerUrl).trim().replace(/\/+$/, '');
+  const inputUrl = controllerUrl;
+  controllerUrl = await discoverControllerBaseUrl(controllerUrl);
   if (!options.skipControllerUrlPersist) {
     const persistUrl = options.tokenControllerUrl
       ? String(options.tokenControllerUrl).trim().replace(/\/+$/, '')
@@ -93,6 +103,9 @@ async function normalizeControllerUrl(options) {
     await setControllerUrl(persistUrl);
   }
   if (!options.compact) {
+    if (controllerUrl !== inputUrl) {
+      logger.log(chalk.gray(`Using controller ${controllerUrl}`));
+    }
     logger.log(chalk.gray(`Controller URL: ${controllerUrl}`));
   }
   return controllerUrl;

package/lib/commands/logout.js

@@ -132,11 +132,54 @@ async function clearClientTokens(options) {
   return 0;
 }
 
+function normalizeTokenType(value) {
+  const type = value && String(value).toLowerCase();
+  if (type && type !== 'device' && type !== 'client') {
+    throw new Error('--type must be either "device" or "client"');
+  }
+  return type;
+}
+
+function validateLogoutOptionCombination(options, type) {
+  if (options.app && !options.environment) {
+    throw new Error('--app requires --environment option');
+  }
+  if (type === 'client' && options.controller) {
+    throw new Error('--controller can only be used with --type device');
+  }
+  if (type === 'device' && (options.environment || options.app)) {
+    throw new Error('--environment and --app can only be used with --type client');
+  }
+}
+
+function validateLogoutSelectors(options) {
+  if ('controller' in options && options.controller !== undefined && options.controller !== null) {
+    validateControllerUrl(options.controller);
+  }
+  if ('environment' in options && options.environment !== undefined && options.environment !== null) {
+    validateEnvironmentKey(options.environment);
+  }
+}
+
+/**
+ * Validate logout option combinations and normalize the token type.
+ * @param {Object} options - Raw logout options
+ * @returns {Object} Validated options with a normalized type
+ * @throws {Error} If an option or option combination is invalid
+ */
+function normalizeLogoutOptions(options) {
+  const type = normalizeTokenType(options.type);
+  validateLogoutOptionCombination(options, type);
+  validateLogoutSelectors(options);
+  return { ...options, type };
+}
+
 /**
  * Handle logout command action
  * @async
  * @function handleLogout
  * @param {Object} options - Logout options
+ * @param {string} [options.type] - Token type to clear (device or client)
  * @param {string} [options.controller] - Clear device tokens for specific controller
  * @param {string} [options.environment] - Clear client tokens for specific environment
  * @param {string} [options.app] - Clear client tokens for specific app (requires --environment)
@@ -147,24 +190,17 @@ async function handleLogout(options) {
   const configPath = CONFIG_FILE;
   logger.log(chalk.blue('\n🔓 Clearing authentication tokens...\n'));
 
-  // Validate options
-  if (options.app && !options.environment) {
-    throw new Error('--app requires --environment option');
-  }
-
-  if ('controller' in options && options.controller !== undefined && options.controller !== null) {
-    validateControllerUrl(options.controller);
-  }
-
-  if ('environment' in options && options.environment !== undefined && options.environment !== null) {
-    validateEnvironmentKey(options.environment);
-  }
+  const normalizedOptions = normalizeLogoutOptions(options);
 
   // Clear device tokens
-  const deviceTokensCleared = await clearDeviceTokens(options);
+  const deviceTokensCleared = normalizedOptions.type === 'client'
+    ? 0
+    : await clearDeviceTokens(normalizedOptions);
 
   // Clear client tokens
-  const clientTokensCleared = await clearClientTokens(options);
+  const clientTokensCleared = normalizedOptions.type === 'device'
+    ? 0
+    : await clearClientTokens(normalizedOptions);
 
   // Summary
   const totalCleared = deviceTokensCleared + clientTokensCleared;
@@ -178,4 +214,3 @@ async function handleLogout(options) {
 }
 
 module.exports = { handleLogout };
-

package/lib/commands/role-assistant.js

@@ -64,7 +64,8 @@ Subcommands:
   copy <roleKey>   Capture one Work Hub execution as a local YAML test case
 
 Package workspace (top-level commands — same digital-worker package):
-  download / validate / upload / deploy <roleKey>   Manage role-assistant/ra-<roleKey>/
+  download / validate / upload ra-<roleKey>   Manage role-assistant/ra-<roleKey>/
+  upload publishes settings and sidecars; operator Make available is a separate action
 
 Examples:
   $ aifabrix role-assistant test customer-support-bot
@@ -72,11 +73,11 @@ Examples:
   $ aifabrix role-assistant test customer-support-bot --list-cases
   $ aifabrix role-assistant test customer-support-bot --env tst --json
   $ aifabrix role-assistant copy customer-support-bot --suite 001 --reference a9f09fb8-d9eb-477f-8bb4-59e670fc82a4
-  $ aifabrix upload customer-support-bot --env dev
+  $ aifabrix upload ra-customer-support-bot --env dev
   $ aifabrix test ra-customer-support-bot
 
 Notes:
-  - Local packages live under role-assistant/ra-<roleKey>/ (bare <roleKey> in CLI args).
+  - role-assistant test/copy use bare <roleKey>; top-level package commands use ra-<roleKey>.
   - test uses the public/running worker by default; pass --publish (or upload) to refresh from local files.
   - copy writes tests/<suite>/<caseId>.yaml from a Work Hub execution id; it does not publish.
   - See: aifabrix role-assistant test -h
@@ -267,19 +268,30 @@ async function runRoleAssistantTestAction(roleKey, options, cmd) {
   const portalUrl = buildExternalSystemUiUrl(result.dataplaneUiBaseUrl, systemKey);
   const caseResult = await resolveSelectedCaseResults(systemKey, opts, result, verdict, portalUrl);
 
+  const exitCode = computeRoleAssistantExitCode(verdict, caseResult);
+
   if (opts.json) {
-    logger.log(
-      JSON.stringify(
-        buildRoleAssistantTestEnvelope(displayKey, verdict, portalUrl, result, opts, caseResult),
-        null,
-        2
-      )
+    // Large piped stdout writes on Linux are non-blocking; exiting right
+    // after console.log() can truncate the JSON before the OS write
+    // completes. Wait for the write to flush before exiting non-zero.
+    const payload = JSON.stringify(
+      logger.sanitizeValue(
+        buildRoleAssistantTestEnvelope(displayKey, verdict, portalUrl, result, opts, caseResult)
+      ),
+      null,
+      2
     );
-  } else {
-    displayRoleAssistantTestSummary(displayKey, verdict, portalUrl, result, caseResult);
+    return new Promise((resolve) => {
+      process.stdout.write(`${payload}\n`, () => {
+        if (exitCode !== 0) {
+          process.exit(exitCode);
+        }
+        resolve(exitCode);
+      });
+    });
   }
 
-  const exitCode = computeRoleAssistantExitCode(verdict, caseResult);
+  displayRoleAssistantTestSummary(displayKey, verdict, portalUrl, result, caseResult);
   if (exitCode !== 0) {
     process.exit(exitCode);
   }

package/lib/commands/verify-governance-command-action.js

@@ -6,6 +6,7 @@
 
 const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
+const { writeJsonEnvelopeAndExit } = require('../utils/cli-json-exit');
 const { runVerifyGovernanceCombined } = require('./verify-governance-combined-external');
 const { normalizeTestGovernanceCliOptions } = require('./test-governance-cli-options');
 const { displayVerifyGovernanceTTY } = require('../lifecycle/report-display');
@@ -33,16 +34,17 @@ async function runVerifyGovernanceCommandAction(appName, options, cmd) {
   const opts = normalizeVerifyGovernanceCliOptions(options, cmd);
   const result = await runVerifyGovernanceCombined(appName, opts);
 
+  const exitCode = exitCodeFromVerdict(result.verdict);
+
   if (opts.json) {
-    logger.log(JSON.stringify(buildJsonEnvelope(result, opts.verbose), null, 2));
-  } else {
-    if (opts.verbose && !opts.pack && typeof result.generated === 'number' && result.generated > 0) {
-      logger.log(formatSuccessLine(`Generated packs for ${result.generated} datasource(s)`));
-    }
-    displayVerifyGovernanceTTY(result.systemKey, result, { details: opts.verbose });
+    await writeJsonEnvelopeAndExit(buildJsonEnvelope(result, opts.verbose), exitCode);
+    return;
   }
 
-  const exitCode = exitCodeFromVerdict(result.verdict);
+  if (opts.verbose && !opts.pack && typeof result.generated === 'number' && result.generated > 0) {
+    logger.log(formatSuccessLine(`Generated packs for ${result.generated} datasource(s)`));
+  }
+  displayVerifyGovernanceTTY(result.systemKey, result, { details: opts.verbose });
   if (exitCode !== 0) {
     process.exit(exitCode);
   }

package/lib/commands/verify-operations-command-action.js

@@ -6,8 +6,8 @@
 
 'use strict';
 
-const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
+const { writeJsonEnvelopeAndExit } = require('../utils/cli-json-exit');
 const { cliOptsSkipPublish } = require('../utils/cli-sync-options');
 const { runVerifyOperationsForExternalSystem } = require('./verify-operations-external');
 const { displayVerifyOperationsTTY } = require('../lifecycle/report-display');
@@ -37,16 +37,17 @@ async function runVerifyOperationsCommandAction(appName, options, cmd) {
   const opts = normalizeVerifyOperationsCliOptions(options, cmd);
   const result = await runVerifyOperationsForExternalSystem(appName, opts);
 
+  const exitCode = exitCodeFromVerdict(result.verdict);
+
   if (opts.json) {
-    logger.log(JSON.stringify(buildJsonEnvelope(result, opts.verbose), null, 2));
-  } else {
-    displayVerifyOperationsTTY(appName, result, {
-      details: opts.verbose,
-      warnings: result.warnings
-    });
+    await writeJsonEnvelopeAndExit(buildJsonEnvelope(result, opts.verbose), exitCode);
+    return;
   }
 
-  const exitCode = exitCodeFromVerdict(result.verdict);
+  displayVerifyOperationsTTY(appName, result, {
+    details: opts.verbose,
+    warnings: result.warnings
+  });
   if (exitCode !== 0) {
     process.exit(exitCode);
   }

package/lib/commands/verify-trust-command-action.js

@@ -6,8 +6,8 @@
 
 'use strict';
 
-const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
+const { writeJsonEnvelopeAndExit } = require('../utils/cli-json-exit');
 const { runVerifyTrustForExternalSystem } = require('./verify-trust-external');
 const { normalizeTestTrustCliOptions } = require('./test-trust-cli-options');
 const { displayVerifyTrustTTY } = require('../lifecycle/report-display');
@@ -30,6 +30,8 @@ async function runVerifyTrustCommandAction(appName, options, cmd) {
     timeout: opts.timeout
   });
 
+  const exitCode = exitCodeFromVerdict(result.verdict);
+
   if (opts.json) {
     const envelope = buildJsonEnvelope(
       {
@@ -44,12 +46,11 @@ async function runVerifyTrustCommandAction(appName, options, cmd) {
       },
       opts.details || opts.verbose
     );
-    logger.log(JSON.stringify(envelope, null, 2));
-  } else {
-    displayVerifyTrustTTY(result.systemKey, result, { details: opts.verbose || opts.details });
+    await writeJsonEnvelopeAndExit(envelope, exitCode);
+    return;
   }
 
-  const exitCode = exitCodeFromVerdict(result.verdict);
+  displayVerifyTrustTTY(result.systemKey, result, { details: opts.verbose || opts.details });
   if (exitCode !== 0) {
     process.exit(exitCode);
   }

package/lib/external-system/download.js

@@ -74,9 +74,8 @@ async function setupAuthenticationAndDataplane(systemKey, _options, _config) {
   }
 
   const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
-  logger.log(formatProgress('Resolving dataplane URL…'));
+  // discoverDataplaneUrl already logs progress and success
   const dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig);
-  logger.log(formatSuccessLine(`Dataplane URL: ${dataplaneUrl}`));
 
   return { authConfig, dataplaneUrl };
 }

package/lib/generator/helpers.js

@@ -234,6 +234,18 @@ function determineVariableLocation(value, key) {
     required = true;
   }
 
+  if (location === 'keyvault' && value.startsWith('kv://')) {
+    try {
+      const { getInfraParameterCatalog } = require('../parameters/infra-parameter-catalog');
+      const entry = getInfraParameterCatalog().findEntryForKey(value.slice('kv://'.length));
+      if (entry?.scope === 'infra' && entry.generator?.type === 'emptyAllowed') {
+        required = false;
+      }
+    } catch {
+      // Keep the conservative required=true default when the catalog is unavailable.
+    }
+  }
+
   return { location, required };
 }
 
@@ -344,4 +356,3 @@ module.exports = {
   validatePortalInput,
   parseEnvironmentVariables
 };
-

package/lib/integration-definition/apply-static-enterprise.js

@@ -52,12 +52,12 @@ function setRecordFetch(op) {
   let found = false;
   for (const step of steps) {
     if (step && step.fetch && typeof step.fetch === 'object') {
-      step.fetch.source = 'record';
+      step.fetch = { source: 'record' };
       found = true;
     }
   }
   if (!found) {
-    steps.unshift({ fetch: { source: 'record', query: {} } });
+    steps.unshift({ fetch: { source: 'record' } });
     if (!steps.some((row) => row && row.output)) {
       steps.push({ output: { mode: 'records' } });
     }
@@ -87,6 +87,9 @@ function ensureRecordCapability(body, capKey) {
   if (!ops[capKey] || typeof ops[capKey] !== 'object') {
     ops[capKey] = { enabled: true, description: `Local ${capKey}`, steps: [] };
   }
+  if (capKey === 'create' || capKey === 'update') {
+    ops[capKey].shape = capKey;
+  }
   setRecordFetch(/** @type {Record<string, unknown>} */ (ops[capKey]));
 }