@aifabrix/builder 2.55.2 → 2.56.0

package/lib/generator/helpers.js

@@ -11,7 +11,6 @@
 const fs = require('fs');
 const path = require('path');
 const { loadConfigFile } = require('../utils/config-format');
-const { urlTokenToKeyVaultSecretName } = require('./deploy-manifest-azure-kv');
 
 /**
  * Loads application config file (application.yaml, application.json, or legacy path) via converter.
@@ -223,9 +222,6 @@ function determineVariableLocation(value, key) {
   if (value.startsWith('kv://')) {
     location = 'keyvault';
     required = true;
-  } else if (value.startsWith('url://')) {
-    location = 'keyvault';
-    required = true;
   }
 
   // Check if it's a sensitive variable
@@ -237,8 +233,8 @@ function determineVariableLocation(value, key) {
   if (location === 'keyvault' && value.startsWith('kv://')) {
     try {
       const { getInfraParameterCatalog } = require('../parameters/infra-parameter-catalog');
-      const entry = getInfraParameterCatalog().findEntryForKey(value.slice('kv://'.length));
-      if (entry?.scope === 'infra' && entry.generator?.type === 'emptyAllowed') {
+      const catalog = getInfraParameterCatalog();
+      if (catalog.isKeyAllowedEmpty(value.slice('kv://'.length))) {
         required = false;
       }
     } catch {
@@ -249,31 +245,6 @@ function determineVariableLocation(value, key) {
   return { location, required };
 }
 
-/**
- * Maps env.template url:// value(s) to Key Vault secret name(s) for deploy JSON.
- * Comma-separated lists are supported (e.g. CORS ALLOWED_ORIGINS): each segment
- * starting with url:// is mapped; other segments are left unchanged (e.g. http://localhost:*).
- *
- * @param {string} appKey - application.yaml app.key
- * @param {string} value - Full value after KEY= (must start with url:// for caller)
- * @returns {string} Comma-joined secret names / literals
- */
-function mapUrlTemplateValueToKeyVaultNames(appKey, value) {
-  const segments = value
-    .split(',')
-    .map((s) => s.trim())
-    .filter((s) => s.length > 0);
-  return segments
-    .map((seg) => {
-      if (seg.startsWith('url://')) {
-        const token = seg.slice('url://'.length).trim();
-        return urlTokenToKeyVaultSecretName(appKey, token);
-      }
-      return seg;
-    })
-    .join(',');
-}
-
 /**
  * Creates a configuration item from parsed variable
  * @function createConfigItem
@@ -282,21 +253,13 @@ function mapUrlTemplateValueToKeyVaultNames(appKey, value) {
  * @param {string} location - Variable location
  * @param {boolean} required - Whether variable is required
  * @param {Map} portalInputMap - Map of portalInput configurations
- * @param {string|null} appKey - application.yaml app.key (required when value uses url://)
  * @returns {Object} Configuration item
  */
-function createConfigItem(key, value, location, required, portalInputMap, appKey) {
+function createConfigItem(key, value, location, required, portalInputMap) {
   let storedValue = value;
   if (location === 'keyvault') {
     if (value.startsWith('kv://')) {
       storedValue = value.replace('kv://', '');
-    } else if (value.startsWith('url://')) {
-      if (!appKey) {
-        throw new Error(
-          `Cannot resolve ${key}=${value}: application app.key is required to map url:// to a Key Vault secret name`
-        );
-      }
-      storedValue = mapUrlTemplateValueToKeyVaultNames(appKey, value);
     }
   }
 
@@ -323,11 +286,6 @@ function parseEnvironmentVariables(envTemplate, variablesConfig = null) {
   const configuration = [];
   const lines = envTemplate.split('\n');
   const portalInputMap = createPortalInputMap(variablesConfig);
-  const appKey =
-    variablesConfig && variablesConfig.app && variablesConfig.app.key
-      ? String(variablesConfig.app.key).trim()
-      : null;
-
   for (const line of lines) {
     const parsed = parseEnvironmentVariableLine(line);
     if (!parsed) {
@@ -340,8 +298,7 @@ function parseEnvironmentVariables(envTemplate, variablesConfig = null) {
       parsed.value,
       location,
       required,
-      portalInputMap,
-      appKey
+      portalInputMap
     );
     configuration.push(configItem);
   }

package/lib/generator/index.js

@@ -22,7 +22,6 @@ const { generateControllerManifest } = require('./external-controller-manifest')
 const { resolveVersionForApp } = require('../utils/image-version');
 const { getContainerPort } = require('../utils/port-resolver');
 const { buildEnvVarMap } = require('../utils/env-map');
-const { rewriteFrontDoorHostForAzureDeploy } = require('./deploy-manifest-azure-kv');
 
 /**
  * Generates deployment JSON from application configuration files
@@ -192,8 +191,6 @@ function buildAndValidateDeployment(appName, variables, envTemplate, rbac, optio
     substituteEnvVarsInDeployment(deployment, envVarMap);
   }
 
-  rewriteFrontDoorHostForAzureDeploy(deployment);
-
   // Ensure no other ${...} placeholders remain in manifest
   _validator.validateNoUnresolvedVariablesInDeployment(deployment);
 
@@ -239,7 +236,6 @@ async function buildDeploymentManifestInMemory(appName, options = {}) {
   }
   const envVarMap = await buildEnvVarMap('docker', null, null, { appPort: effectivePort });
   substituteEnvVarsInDeployment(deployment, envVarMap);
-  rewriteFrontDoorHostForAzureDeploy(deployment);
   _validator.validateNoUnresolvedVariablesInDeployment(deployment);
   return { deployment, appPath };
 }

package/lib/programmatic/builder-api-request.js

@@ -14,6 +14,7 @@ const { withWorkspaceLock } = require('./workspace-lock');
 const { getIdempotentResult, setIdempotentResult } = require('./idempotency-cache');
 const { withRequestTimeout } = require('./request-timeout');
 const { isHttpRawResult } = require('./http-raw-response');
+const { isHttpAcceptedResult } = require('./http-accepted-response');
 const { publicOriginFromRequest } = require('../channels/vendor-dataplane-url');
 
 /**
@@ -103,10 +104,11 @@ async function runHandler(auth, capability, params, body, query) {
  * @param {Object} options.body
  * @param {string} options.requestId
  * @param {Object} options.result
+ * @param {number} [options.httpStatus=200] - 202 for accepted-async operations (upload/deploy); idempotency replay preserves it.
  * @returns {{ httpStatus: number, body: Object, requestId: string, userId: string }}
  */
 function buildSuccessResponse(options) {
-  const { auth, idempotencyKey, capability, routeKey, params, body, requestId, result } = options;
+  const { auth, idempotencyKey, capability, routeKey, params, body, requestId, result, httpStatus = 200 } = options;
   const responseBody = { success: true, data: result, correlationId: requestId };
   if (idempotencyKey && isMutating(capability)) {
     setIdempotentResult(
@@ -116,10 +118,10 @@ function buildSuccessResponse(options) {
         route: routeKey,
         systemKey: resolveIdempotencySystemKey(params, body)
       },
-      { httpStatus: 200, body: responseBody, correlationId: requestId }
+      { httpStatus, body: responseBody, correlationId: requestId }
     );
   }
-  return { httpStatus: 200, body: responseBody, requestId, userId: auth.userId };
+  return { httpStatus, body: responseBody, requestId, userId: auth.userId };
 }
 
 /**
@@ -163,6 +165,7 @@ async function executeCapabilityRequest(options) {
   if (isHttpRawResult(result)) {
     return { httpStatus: 200, raw: result, requestId, userId: auth.userId };
   }
+  const accepted = isHttpAcceptedResult(result);
   return buildSuccessResponse({
     auth,
     idempotencyKey: req.headers['idempotency-key'],
@@ -171,7 +174,8 @@ async function executeCapabilityRequest(options) {
     params,
     body,
     requestId,
-    result
+    result: accepted ? result.data : result,
+    httpStatus: accepted ? 202 : 200
   });
 }
 

package/lib/programmatic/capability-registry.js

@@ -48,7 +48,9 @@ const CAPABILITIES = Object.freeze([
   { method: 'POST', route: '/systems/:systemKey/certify/:pillar', handlerId: 'runCertifyPillar', operationType: 'certify', mutating: true },
   { method: 'GET', route: '/systems/:systemKey/lifecycle', handlerId: 'getLifecycleReport', operationType: 'certify.read', mutating: false },
   { method: 'POST', route: '/systems/:systemKey/upload', handlerId: 'runUpload', operationType: 'apply.dev', mutating: true },
+  { method: 'GET', route: '/systems/:systemKey/upload/:jobId/status', handlerId: 'getUploadStatus', operationType: 'apply.dev.read', mutating: false },
   { method: 'POST', route: '/systems/:systemKey/deploy', handlerId: 'runDeploySystem', operationType: 'apply.prod', mutating: true },
+  { method: 'GET', route: '/systems/:systemKey/deploy/:deploymentId/status', handlerId: 'getDeployStatus', operationType: 'apply.prod.read', mutating: false },
   { method: 'POST', route: '/systems/:systemKey/download', handlerId: 'runDownload', operationType: 'workspace.write', mutating: true },
   {
     method: 'POST',

package/lib/programmatic/get-deploy-status.js

@@ -0,0 +1,45 @@
+/**
+ * Builder-api status read for an async external system deploy (plan 191.0 task 3).
+ * Thin proxy over Miso's own pipeline deployment status — Builder never invents deployment state.
+ *
+ * @fileoverview GET /systems/:systemKey/deploy/:deploymentId/status
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { runWithWorkspaceContext } = require('./workspace-context');
+const { buildBearerAuthConfig } = require('./auth-config');
+const { getPipelineDeployment } = require('../api/pipeline.api');
+const { formatApiError } = require('../utils/api-error-handler');
+
+/**
+ * @param {Object} res
+ * @param {string} controllerUrl
+ * @returns {Error & { statusCode: number }}
+ */
+function toDeployStatusError(res, controllerUrl) {
+  const err = new Error(formatApiError(res, controllerUrl));
+  const status = Number(res.status || res.statusCode);
+  err.statusCode = status >= 400 && status < 600 ? status : 502;
+  return err;
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @param {string} deploymentId
+ * @returns {Promise<Object>} Miso deployment status (id, status, progress, updatedAt, qualification, ...)
+ */
+async function getDeployStatus(ctx, deploymentId) {
+  return runWithWorkspaceContext(ctx, async() => {
+    const authConfig = buildBearerAuthConfig(ctx.bearerToken);
+    const res = await getPipelineDeployment(ctx.controllerUrl, ctx.environment, deploymentId, authConfig);
+    if (res?.success === false) {
+      throw toDeployStatusError(res, ctx.controllerUrl);
+    }
+    return res.data ?? res;
+  });
+}
+
+module.exports = { getDeployStatus };

package/lib/programmatic/get-upload-status.js

@@ -0,0 +1,45 @@
+/**
+ * Builder-api status read for an async qualification upload job (plan 191.0 task 3).
+ * Thin proxy over Dataplane's own publish-job status — Builder never invents job state.
+ *
+ * @fileoverview GET /systems/:systemKey/upload/:jobId/status
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { runWithWorkspaceContext } = require('./workspace-context');
+const { buildProgrammaticAuthContext } = require('./auth-config');
+const { getPublishJobStatus } = require('../api/pipeline.api');
+const { formatApiError } = require('../utils/api-error-handler');
+
+/**
+ * @param {Object} res
+ * @param {string} dataplaneUrl
+ * @returns {Error & { statusCode: number }}
+ */
+function toJobStatusError(res, dataplaneUrl) {
+  const err = new Error(formatApiError(res, dataplaneUrl));
+  const status = Number(res.status || res.statusCode);
+  err.statusCode = status >= 400 && status < 600 ? status : 502;
+  return err;
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @param {string} jobId
+ * @returns {Promise<Object>} Dataplane PublishJobStatusResponse (jobId, state, steps, error, result)
+ */
+async function getUploadStatus(ctx, jobId) {
+  return runWithWorkspaceContext(ctx, async() => {
+    const { authConfig, dataplaneUrl } = buildProgrammaticAuthContext(ctx);
+    const res = await getPublishJobStatus(dataplaneUrl, authConfig, jobId);
+    if (res?.success === false) {
+      throw toJobStatusError(res, dataplaneUrl);
+    }
+    return res.data;
+  });
+}
+
+module.exports = { getUploadStatus };

package/lib/programmatic/http-accepted-response.js

@@ -0,0 +1,31 @@
+/**
+ * Marker for builder-api handlers that accepted a durable async operation (202), instead of
+ * completing synchronously (200). Mirrors http-raw-response.js's escape-hatch pattern so
+ * executeCapabilityRequest can special-case the response status without every other handler
+ * needing to know about it (plan 191.0 task 3: replace 5-minute sync upload/deploy web requests
+ * with accepted operation responses).
+ *
+ * @fileoverview 202-accepted result marker for upload/deploy web handlers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {Object} data - Operation identity/state to return in the response body (e.g. {jobId, candidateFingerprint} or {deploymentId, status}).
+ * @returns {{ __httpAccepted: true, data: Object }}
+ */
+function createHttpAcceptedResult(data) {
+  return { __httpAccepted: true, data };
+}
+
+/**
+ * @param {unknown} result
+ * @returns {boolean}
+ */
+function isHttpAcceptedResult(result) {
+  return Boolean(result && typeof result === 'object' && result.__httpAccepted === true);
+}
+
+module.exports = { createHttpAcceptedResult, isHttpAcceptedResult };

package/lib/programmatic/openapi-descriptions.js

@@ -129,15 +129,25 @@ const OPERATION_DESCRIPTIONS = Object.freeze({
     tags: ['certify']
   },
   runUpload: {
-    summary: 'Upload integration to dev Dataplane',
+    summary: 'Submit integration for durable Dataplane qualification (async)',
     description:
-      'Full dev publish: validate, sync deploy JSON, push credentials, pipeline upload. Requires external-system:publish in dev. Mutating; use Idempotency-Key; may take up to MAX_UPLOAD_TIMEOUT_MS.',
+      'Validates, syncs deploy JSON, pushes credentials, then durably submits the candidate for Dataplane qualification (plan 191.0). Returns 202 immediately with {jobId, candidateFingerprint} — never blocks on the qualification ladder. Poll GET .../upload/{jobId}/status for terminal state. Requires external-system:publish in dev. Mutating; use Idempotency-Key.',
+    tags: ['apply']
+  },
+  getUploadStatus: {
+    summary: 'Read qualification job status',
+    description: 'Poll the durable Dataplane qualification job accepted by runUpload. Read-only proxy; terminal states are completed/failed.',
     tags: ['apply']
   },
   runDeploySystem: {
-    summary: 'Deploy integration via controller (promote)',
+    summary: 'Deploy integration via controller (promote, async)',
     description:
-      'Controller deploy for external systems (CLI aifabrix deploy parity). Optional body.gate matches CLI --gate (operations,trust,governance,full). Certificate seal is a platform side-effect of published Deploy — not a separate certificates issue call. Mutating; use Idempotency-Key.',
+      'Controller deploy for external systems (CLI aifabrix deploy parity). Optional body.gate is a no-op notice — qualification gates now run once during upload, not at deploy time. Returns 202 immediately with {deploymentId} — never blocks on the outer Miso deployment (fast when the candidate is already qualified, slower on the legacy ladder otherwise). Poll GET .../deploy/{deploymentId}/status for terminal state. Mutating; use Idempotency-Key.',
+    tags: ['apply']
+  },
+  getDeployStatus: {
+    summary: 'Read deployment status',
+    description: 'Poll the durable Miso deployment accepted by runDeploySystem. Read-only proxy; includes heartbeat (updatedAt) and, for qualified Connected Systems, a nested qualification/promotion summary.',
     tags: ['apply']
   },
   runDownload: {

package/lib/programmatic/request-timeout.js

@@ -8,27 +8,33 @@
 
 'use strict';
 
+/**
+ * Per-handler {envVar, defaultMs}. Plan 191.0 task 3: runUpload/runDeploySystem are accept-only
+ * (202) — local validation + manifest build + one accept HTTP call, never the qualification
+ * ladder or outer deployment — so their budget shrunk from 300000 (the old
+ * blocking-on-the-full-ladder value). Their status-read siblings are short, single-proxy reads.
+ * @type {Readonly<Record<string, { envVar: string, defaultMs: number }>>}
+ */
+const HANDLER_TIMEOUT_CONFIG = Object.freeze({
+  runUpload: { envVar: 'MAX_UPLOAD_TIMEOUT_MS', defaultMs: 45000 },
+  getUploadStatus: { envVar: 'MAX_UPLOAD_STATUS_TIMEOUT_MS', defaultMs: 15000 },
+  runDeploySystem: { envVar: 'MAX_DEPLOY_TIMEOUT_MS', defaultMs: 45000 },
+  getDeployStatus: { envVar: 'MAX_DEPLOY_STATUS_TIMEOUT_MS', defaultMs: 15000 },
+  runDownload: { envVar: 'MAX_DOWNLOAD_TIMEOUT_MS', defaultMs: 300000 },
+  runTest: { envVar: 'MAX_TEST_E2E_TIMEOUT_MS', defaultMs: 120000 },
+  runCertifyPillar: { envVar: 'MAX_CERTIFY_TIMEOUT_MS', defaultMs: 120000 }
+});
+
 /**
  * @param {string} handlerId
  * @returns {number}
  */
 function getTimeoutMsForHandler(handlerId) {
-  if (handlerId === 'runUpload') {
-    return Number(process.env.MAX_UPLOAD_TIMEOUT_MS || 300000);
-  }
-  if (handlerId === 'runDeploySystem') {
-    return Number(process.env.MAX_DEPLOY_TIMEOUT_MS || 300000);
-  }
-  if (handlerId === 'runDownload') {
-    return Number(process.env.MAX_DOWNLOAD_TIMEOUT_MS || 300000);
-  }
-  if (handlerId === 'runTest') {
-    return Number(process.env.MAX_TEST_E2E_TIMEOUT_MS || 120000);
-  }
-  if (handlerId === 'runCertifyPillar') {
-    return Number(process.env.MAX_CERTIFY_TIMEOUT_MS || 120000);
+  const config = HANDLER_TIMEOUT_CONFIG[handlerId];
+  if (!config) {
+    return Number(process.env.MAX_REQUEST_TIMEOUT_MS || 120000);
   }
-  return Number(process.env.MAX_REQUEST_TIMEOUT_MS || 120000);
+  return Number(process.env[config.envVar] || config.defaultMs);
 }
 
 /**

package/lib/programmatic/route-handler-map.js

@@ -19,6 +19,8 @@ const { runRepair } = require('./run-repair');
 const { runValidate } = require('./run-validate');
 const { runPreviewUpload, runUpload } = require('./run-upload');
 const { runDeploySystem } = require('./run-deploy');
+const { getUploadStatus } = require('./get-upload-status');
+const { getDeployStatus } = require('./get-deploy-status');
 const { runDownload } = require('./run-download');
 const { runProtectionUpload, runProtectionCreate } = require('./run-protection');
 const { runTest } = require('./run-test');
@@ -157,6 +159,8 @@ const HANDLER_MAP = {
       probe: body.probe === true,
       minimal: true
     }),
+  getUploadStatus: (params, auth) =>
+    getUploadStatus(buildContext(auth, params.systemKey), params.jobId),
   runDeploySystem: (params, auth, body) =>
     runDeploySystem(buildContext(auth, params.systemKey), {
       gate: body.gate,
@@ -165,6 +169,8 @@ const HANDLER_MAP = {
       sync: body.sync === true,
       verbose: body.verbose === true
     }),
+  getDeployStatus: (params, auth) =>
+    getDeployStatus(buildContext(auth, params.systemKey), params.deploymentId),
   runDownload: (params, auth, body = {}) =>
     runDownload(buildContext(auth, params.systemKey), {
       force: body.force === true,

package/lib/programmatic/run-deploy.js

@@ -12,6 +12,7 @@ const { deployExternalSystem } = require('../external-system/deploy');
 const { runWithWorkspaceContext } = require('./workspace-context');
 const { mergeProgrammaticOptions } = require('./command-options');
 const { touchWorkspaceMeta } = require('./workspace-meta');
+const { createHttpAcceptedResult } = require('./http-accepted-response');
 
 /**
  * @param {unknown} gate
@@ -39,9 +40,11 @@ function attachDeployStatus(err) {
 }
 
 /**
+ * Builder-api web callers never block on the outer Miso deployment (plan 191.0 task 3) — accept
+ * only, return 202 with the deployment id immediately; poll via getDeployStatus.
  * @param {import('./workspace-context').WorkspaceContext} ctx
  * @param {Object} [options]
- * @param {string} [options.gate] - Same as CLI --gate (operations,trust,governance,full)
+ * @param {string} [options.gate] - Same as CLI --gate (operations,trust,governance,full); now a no-op notice, kept for compatibility.
  * @param {string} [options.subjectEmail]
  * @param {boolean} [options.probe]
  * @param {boolean} [options.sync]
@@ -55,13 +58,14 @@ async function runDeploySystem(ctx, options = {}) {
     subjectEmail: options.subjectEmail,
     probe: options.probe === true,
     sync: options.sync === true,
-    verbose: options.verbose === true
+    verbose: options.verbose === true,
+    poll: false
   });
   return runWithWorkspaceContext(ctx, async() => {
     try {
       const result = await deployExternalSystem(ctx.systemKey, merged);
       touchWorkspaceMeta(ctx, { lastOperation: 'deploy' });
-      return result && typeof result === 'object' ? result : { deployed: true };
+      return createHttpAcceptedResult(result && typeof result === 'object' ? result : { deployed: true });
     } catch (err) {
       throw attachDeployStatus(err);
     }

package/lib/programmatic/run-upload.js

@@ -12,8 +12,11 @@ const { uploadExternalSystem } = require('../commands/upload');
 const { runWithWorkspaceContext } = require('./workspace-context');
 const { mergeProgrammaticOptions } = require('./command-options');
 const { touchWorkspaceMeta } = require('./workspace-meta');
+const { createHttpAcceptedResult } = require('./http-accepted-response');
 
 /**
+ * Builder-api web callers never block on the qualification ladder (plan 191.0 task 3) — always
+ * submit async and return 202 with the resumable job id immediately; poll via getUploadStatus.
  * @param {import('./workspace-context').WorkspaceContext} ctx
  * @param {Object} [options]
  * @param {boolean} [options.force]
@@ -24,16 +27,17 @@ const { touchWorkspaceMeta } = require('./workspace-meta');
  * @returns {Promise<Object|void>}
  */
 async function runUpload(ctx, options = {}) {
-  const merged = mergeProgrammaticOptions(ctx, options);
+  const merged = mergeProgrammaticOptions(ctx, { ...options, wait: false });
   return runWithWorkspaceContext(ctx, async() => {
     const result = await uploadExternalSystem(ctx.systemKey, merged);
-    if (!options.dryRun) {
-      touchWorkspaceMeta(ctx, {
-        lastOperation: 'upload',
-        lastUploadId: result?.uploadId || null
-      });
+    if (options.dryRun) {
+      return result;
     }
-    return result;
+    touchWorkspaceMeta(ctx, {
+      lastOperation: 'upload',
+      lastUploadId: result?.jobId || null
+    });
+    return createHttpAcceptedResult(result);
   });
 }
 

package/lib/schema/infra.parameter.yaml

@@ -460,19 +460,18 @@ parameters:
       notes: >-
         JWT signing secret; generated on first ensure. Azure Bicep typically uses `${prefix}-secrets-jwtKeyVault`.
 
-  # LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault — local default skips Mori/JWT license checks.
-  # Controller ignores DEVELOPMENT when DEPLOYMENT=azure.
+  # LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault — empty means Community edition.
+  # Set only to a real signed offline licence JWT.
   - key: miso-controller-jwt-licenseKeyVault
     ownerAppKey: miso-controller
     scope: app
     generator:
-      type: literal
-      value: 'DEVELOPMENT'
+      type: emptyString
     ensureOn: [upInfra, resolveApp]
     azure:
       notes: >-
-        Local/dev default DEVELOPMENT disables license validation (no Mori/JWT required).
-        Ignored when DEPLOYMENT=azure. Override with a real offline license JWT (or empty for Mori) in non-dev.
+        Empty means the unlicensed Community edition (DEV, size S, shared resources).
+        Override only with a real signed offline license JWT.
 
   # Exact entry so this is not caught by *KeyVault → randomBytes32 (invalid email).
   - key: miso-controller-admin-emailKeyVault
@@ -619,7 +618,7 @@ parameters:
       vaultSecretName: dataplane-client-secretKeyVault
       notes: Per-app OAuth client secret for dataplane; generated on first ensure.
 
-  # Mori / telemetry: optional locally (LICENSE_JWT via miso-controller-jwt-licenseKeyVault=DEVELOPMENT skips Mori).
+  # Mori / telemetry is optional for an unlicensed Community installation.
   # MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault — local default apiKey.
   - key: mori-controller-auth-methodKeyVault
     category: Mori

package/lib/utils/cli-utils.js

@@ -441,7 +441,9 @@ function handleCommandError(error, command) {
     return;
   }
   const errorMessages = appendCommandPermissionHint(formatError(error), command);
-  const skipDoctor = isMissingSecretsErrorMessage(error && error.message);
+  const skipDoctor = error && error.skipDoctor === true
+    ? true
+    : isMissingSecretsErrorMessage(error && error.message);
   logError(command, errorMessages, { skipDoctor });
   if (error.wizardResumeMessage) {
     logger.log(error.wizardResumeMessage);
@@ -489,4 +491,3 @@ module.exports = {
   appendWizardError,
   logOfflinePathWhenType
 };
-