@aifabrix/builder 2.55.2 → 2.57.0

package/lib/generator/helpers.js

@@ -11,7 +11,24 @@
 const fs = require('fs');
 const path = require('path');
 const { loadConfigFile } = require('../utils/config-format');
-const { urlTokenToKeyVaultSecretName } = require('./deploy-manifest-azure-kv');
+const { getInfraParameterCatalog } = require('../parameters/infra-parameter-catalog');
+
+/**
+ * Baseline `required` for a keyvault-located key, from infra.parameter.yaml's
+ * `requiredOnSystemOnboarding` (matched by exact key or keyPattern). Returns false when the
+ * catalog can't be loaded or has no matching entry, so generation never hard-fails on this.
+ * @param {string} vaultKey - Key with any `kv://` prefix already stripped
+ * @returns {boolean}
+ */
+function baselineRequiredForVaultKey(vaultKey) {
+  try {
+    const catalog = getInfraParameterCatalog();
+    const entry = catalog.findEntryForKey(vaultKey);
+    return entry?.requiredOnSystemOnboarding === true;
+  } catch {
+    return false;
+  }
+}
 
 /**
  * Loads application config file (application.yaml, application.json, or legacy path) via converter.
@@ -149,34 +166,41 @@ function validatePortalInput(portalInput, variableName) {
 }
 
 /**
- * Parses environment variables from env.template and merges portalInput from application config
+ * Parses environment variables from env.template and merges explicit application config
  * @param {string} envTemplate - Content of env.template file
  * @param {Object|null} [variablesConfig=null] - Optional configuration from application.yaml
  * @returns {Array<Object>} Configuration array with merged portalInput
  * @throws {Error} If portalInput structure is invalid
  */
 /**
- * Creates a map of portal overlay metadata from variables config
- * @function createPortalInputMap
+ * Creates a map of configuration metadata from application.yaml.
+ * `required` is declarative: env names and kv:// values never imply it.
+ * @function createApplicationConfigMap
  * @param {Object|null} variablesConfig - Configuration from application.yaml
- * @returns {Map} Map of variable names to { portalInput, category? }
+ * @returns {Map} Map of variable names to { portalInput?, category?, required? }
  */
-function createPortalInputMap(variablesConfig) {
-  const portalInputMap = new Map();
+function createApplicationConfigMap(variablesConfig) {
+  const applicationConfigMap = new Map();
   if (variablesConfig && variablesConfig.configuration && Array.isArray(variablesConfig.configuration)) {
     for (const configItem of variablesConfig.configuration) {
-      if (configItem.name && configItem.portalInput) {
-        // Validate portalInput before adding to map
+      if (!configItem.name) continue;
+      const overlay = {};
+      if (configItem.portalInput) {
         validatePortalInput(configItem.portalInput, configItem.name);
-        const overlay = { portalInput: configItem.portalInput };
-        if (typeof configItem.category === 'string' && configItem.category.trim().length > 0) {
-          overlay.category = configItem.category.trim();
-        }
-        portalInputMap.set(configItem.name, overlay);
+        overlay.portalInput = configItem.portalInput;
+      }
+      if (typeof configItem.category === 'string' && configItem.category.trim().length > 0) {
+        overlay.category = configItem.category.trim();
+      }
+      if (typeof configItem.required === 'boolean') {
+        overlay.required = configItem.required;
+      }
+      if (Object.keys(overlay).length > 0) {
+        applicationConfigMap.set(configItem.name, overlay);
       }
     }
   }
-  return portalInputMap;
+  return applicationConfigMap;
 }
 
 /**
@@ -210,68 +234,13 @@ function parseEnvironmentVariableLine(line) {
 }
 
 /**
- * Determines location and required status for a variable
+ * Determines storage location for a variable.
  * @function determineVariableLocation
  * @param {string} value - Variable value
- * @param {string} key - Variable key
- * @returns {Object} Object with location and required properties
+ * @returns {string} Deployment configuration location
  */
-function determineVariableLocation(value, key) {
-  let location = 'variable';
-  let required = false;
-
-  if (value.startsWith('kv://')) {
-    location = 'keyvault';
-    required = true;
-  } else if (value.startsWith('url://')) {
-    location = 'keyvault';
-    required = true;
-  }
-
-  // Check if it's a sensitive variable
-  const sensitiveKeys = ['password', 'secret', 'key', 'token', 'auth'];
-  if (sensitiveKeys.some(sensitive => key.toLowerCase().includes(sensitive))) {
-    required = true;
-  }
-
-  if (location === 'keyvault' && value.startsWith('kv://')) {
-    try {
-      const { getInfraParameterCatalog } = require('../parameters/infra-parameter-catalog');
-      const entry = getInfraParameterCatalog().findEntryForKey(value.slice('kv://'.length));
-      if (entry?.scope === 'infra' && entry.generator?.type === 'emptyAllowed') {
-        required = false;
-      }
-    } catch {
-      // Keep the conservative required=true default when the catalog is unavailable.
-    }
-  }
-
-  return { location, required };
-}
-
-/**
- * Maps env.template url:// value(s) to Key Vault secret name(s) for deploy JSON.
- * Comma-separated lists are supported (e.g. CORS ALLOWED_ORIGINS): each segment
- * starting with url:// is mapped; other segments are left unchanged (e.g. http://localhost:*).
- *
- * @param {string} appKey - application.yaml app.key
- * @param {string} value - Full value after KEY= (must start with url:// for caller)
- * @returns {string} Comma-joined secret names / literals
- */
-function mapUrlTemplateValueToKeyVaultNames(appKey, value) {
-  const segments = value
-    .split(',')
-    .map((s) => s.trim())
-    .filter((s) => s.length > 0);
-  return segments
-    .map((seg) => {
-      if (seg.startsWith('url://')) {
-        const token = seg.slice('url://'.length).trim();
-        return urlTokenToKeyVaultSecretName(appKey, token);
-      }
-      return seg;
-    })
-    .join(',');
+function determineVariableLocation(value) {
+  return value.startsWith('kv://') ? 'keyvault' : 'variable';
 }
 
 /**
@@ -280,26 +249,22 @@ function mapUrlTemplateValueToKeyVaultNames(appKey, value) {
  * @param {string} key - Variable key
  * @param {string} value - Variable value
  * @param {string} location - Variable location
- * @param {boolean} required - Whether variable is required
- * @param {Map} portalInputMap - Map of portalInput configurations
- * @param {string|null} appKey - application.yaml app.key (required when value uses url://)
+ * @param {Map} applicationConfigMap - Explicit application.yaml configuration
  * @returns {Object} Configuration item
  */
-function createConfigItem(key, value, location, required, portalInputMap, appKey) {
+function createConfigItem(key, value, location, applicationConfigMap) {
   let storedValue = value;
   if (location === 'keyvault') {
     if (value.startsWith('kv://')) {
       storedValue = value.replace('kv://', '');
-    } else if (value.startsWith('url://')) {
-      if (!appKey) {
-        throw new Error(
-          `Cannot resolve ${key}=${value}: application app.key is required to map url:// to a Key Vault secret name`
-        );
-      }
-      storedValue = mapUrlTemplateValueToKeyVaultNames(appKey, value);
     }
   }
 
+  const overlay = applicationConfigMap.get(key);
+  const required =
+    typeof overlay?.required === 'boolean'
+      ? overlay.required
+      : location === 'keyvault' && baselineRequiredForVaultKey(storedValue);
   const configItem = {
     name: key,
     value: storedValue,
@@ -307,10 +272,8 @@ function createConfigItem(key, value, location, required, portalInputMap, appKey
     required
   };
 
-  // Merge portalInput / category if present in application config
-  if (portalInputMap.has(key)) {
-    const overlay = portalInputMap.get(key);
-    configItem.portalInput = overlay.portalInput;
+  if (overlay) {
+    if (overlay.portalInput) configItem.portalInput = overlay.portalInput;
     if (typeof overlay.category === 'string' && overlay.category.length > 0) {
       configItem.category = overlay.category;
     }
@@ -322,26 +285,19 @@ function createConfigItem(key, value, location, required, portalInputMap, appKey
 function parseEnvironmentVariables(envTemplate, variablesConfig = null) {
   const configuration = [];
   const lines = envTemplate.split('\n');
-  const portalInputMap = createPortalInputMap(variablesConfig);
-  const appKey =
-    variablesConfig && variablesConfig.app && variablesConfig.app.key
-      ? String(variablesConfig.app.key).trim()
-      : null;
-
+  const applicationConfigMap = createApplicationConfigMap(variablesConfig);
   for (const line of lines) {
     const parsed = parseEnvironmentVariableLine(line);
     if (!parsed) {
       continue;
     }
 
-    const { location, required } = determineVariableLocation(parsed.value, parsed.key);
+    const location = determineVariableLocation(parsed.value);
     const configItem = createConfigItem(
       parsed.key,
       parsed.value,
       location,
-      required,
-      portalInputMap,
-      appKey
+      applicationConfigMap
     );
     configuration.push(configItem);
   }

package/lib/generator/index.js

@@ -22,7 +22,6 @@ const { generateControllerManifest } = require('./external-controller-manifest')
 const { resolveVersionForApp } = require('../utils/image-version');
 const { getContainerPort } = require('../utils/port-resolver');
 const { buildEnvVarMap } = require('../utils/env-map');
-const { rewriteFrontDoorHostForAzureDeploy } = require('./deploy-manifest-azure-kv');
 
 /**
  * Generates deployment JSON from application configuration files
@@ -192,8 +191,6 @@ function buildAndValidateDeployment(appName, variables, envTemplate, rbac, optio
     substituteEnvVarsInDeployment(deployment, envVarMap);
   }
 
-  rewriteFrontDoorHostForAzureDeploy(deployment);
-
   // Ensure no other ${...} placeholders remain in manifest
   _validator.validateNoUnresolvedVariablesInDeployment(deployment);
 
@@ -239,7 +236,6 @@ async function buildDeploymentManifestInMemory(appName, options = {}) {
   }
   const envVarMap = await buildEnvVarMap('docker', null, null, { appPort: effectivePort });
   substituteEnvVarsInDeployment(deployment, envVarMap);
-  rewriteFrontDoorHostForAzureDeploy(deployment);
   _validator.validateNoUnresolvedVariablesInDeployment(deployment);
   return { deployment, appPath };
 }

package/lib/generator/split-variables.js

@@ -57,7 +57,7 @@ function extractOptionalSections(deployment) {
   const names = [
     'healthCheck', 'authentication', 'build', 'repository', 'deployment',
     'startupCommand', 'runtimeVersion', 'scaling', 'frontDoorRouting',
-    'environmentScopedResources'
+    'environmentScopedResources', 'required'
   ];
   for (const sectionName of names) {
     extractOptionalSection(deployment, sectionName, optional);
@@ -66,19 +66,25 @@ function extractOptionalSections(deployment) {
 }
 
 /**
- * Portal-only configuration for application.yaml (name + optional category + portalInput).
+ * Explicit application configuration metadata for application.yaml.
+ * required=false remains the default and is omitted.
  * @param {Array} configuration - Configuration array from deployment JSON
- * @returns {Array<{ name: string, category?: string, portalInput: Object }>}
+ * @returns {Array<{ name: string, category?: string, required?: boolean, portalInput?: Object }>}
  */
 function extractPortalInputConfiguration(configuration) {
   if (!Array.isArray(configuration) || configuration.length === 0) return [];
   return configuration
-    .filter(item => item && item.portalInput && typeof item.name === 'string')
+    .filter(item => item && typeof item.name === 'string' && (
+      item.portalInput || item.required === true ||
+      (typeof item.category === 'string' && item.category.trim().length > 0)
+    ))
     .map(item => {
-      const entry = { name: item.name, portalInput: item.portalInput };
+      const entry = { name: item.name };
+      if (item.portalInput) entry.portalInput = item.portalInput;
       if (typeof item.category === 'string' && item.category.trim().length > 0) {
         entry.category = item.category.trim();
       }
+      if (item.required === true) entry.required = true;
       return entry;
     });
 }

package/lib/internal/fs-real-sync.js

@@ -137,8 +137,37 @@ function appendFileSync(p, data, opts) {
   return delegate('appendFileSync', opts !== undefined ? [p, data, opts] : [p, data]);
 }
 
+/**
+ * @param {string} p
+ * @param {number|string} mode
+ * @returns {void}
+ */
+function chmodSync(p, mode) {
+  return delegate('chmodSync', [p, mode]);
+}
+
+/**
+ * @param {string} p
+ * @returns {import('node:fs').Stats}
+ */
+function lstatSync(p) {
+  return delegate('lstatSync', [p]);
+}
+
+/**
+ * @param {string} from
+ * @param {string} to
+ * @returns {void}
+ */
+function renameSync(from, to) {
+  return delegate('renameSync', [from, to]);
+}
+
 module.exports = {
   existsSync,
+  chmodSync,
+  lstatSync,
+  renameSync,
   readFileSync,
   readFileSyncDirect,
   writeFileSync,

package/lib/programmatic/builder-api-request.js

@@ -14,6 +14,7 @@ const { withWorkspaceLock } = require('./workspace-lock');
 const { getIdempotentResult, setIdempotentResult } = require('./idempotency-cache');
 const { withRequestTimeout } = require('./request-timeout');
 const { isHttpRawResult } = require('./http-raw-response');
+const { isHttpAcceptedResult } = require('./http-accepted-response');
 const { publicOriginFromRequest } = require('../channels/vendor-dataplane-url');
 
 /**
@@ -103,10 +104,11 @@ async function runHandler(auth, capability, params, body, query) {
  * @param {Object} options.body
  * @param {string} options.requestId
  * @param {Object} options.result
+ * @param {number} [options.httpStatus=200] - 202 for accepted-async operations (upload/deploy); idempotency replay preserves it.
  * @returns {{ httpStatus: number, body: Object, requestId: string, userId: string }}
  */
 function buildSuccessResponse(options) {
-  const { auth, idempotencyKey, capability, routeKey, params, body, requestId, result } = options;
+  const { auth, idempotencyKey, capability, routeKey, params, body, requestId, result, httpStatus = 200 } = options;
   const responseBody = { success: true, data: result, correlationId: requestId };
   if (idempotencyKey && isMutating(capability)) {
     setIdempotentResult(
@@ -116,10 +118,10 @@ function buildSuccessResponse(options) {
         route: routeKey,
         systemKey: resolveIdempotencySystemKey(params, body)
       },
-      { httpStatus: 200, body: responseBody, correlationId: requestId }
+      { httpStatus, body: responseBody, correlationId: requestId }
     );
   }
-  return { httpStatus: 200, body: responseBody, requestId, userId: auth.userId };
+  return { httpStatus, body: responseBody, requestId, userId: auth.userId };
 }
 
 /**
@@ -163,6 +165,7 @@ async function executeCapabilityRequest(options) {
   if (isHttpRawResult(result)) {
     return { httpStatus: 200, raw: result, requestId, userId: auth.userId };
   }
+  const accepted = isHttpAcceptedResult(result);
   return buildSuccessResponse({
     auth,
     idempotencyKey: req.headers['idempotency-key'],
@@ -171,7 +174,8 @@ async function executeCapabilityRequest(options) {
     params,
     body,
     requestId,
-    result
+    result: accepted ? result.data : result,
+    httpStatus: accepted ? 202 : 200
   });
 }
 

package/lib/programmatic/capability-registry.js

@@ -48,7 +48,9 @@ const CAPABILITIES = Object.freeze([
   { method: 'POST', route: '/systems/:systemKey/certify/:pillar', handlerId: 'runCertifyPillar', operationType: 'certify', mutating: true },
   { method: 'GET', route: '/systems/:systemKey/lifecycle', handlerId: 'getLifecycleReport', operationType: 'certify.read', mutating: false },
   { method: 'POST', route: '/systems/:systemKey/upload', handlerId: 'runUpload', operationType: 'apply.dev', mutating: true },
+  { method: 'GET', route: '/systems/:systemKey/upload/:jobId/status', handlerId: 'getUploadStatus', operationType: 'apply.dev.read', mutating: false },
   { method: 'POST', route: '/systems/:systemKey/deploy', handlerId: 'runDeploySystem', operationType: 'apply.prod', mutating: true },
+  { method: 'GET', route: '/systems/:systemKey/deploy/:deploymentId/status', handlerId: 'getDeployStatus', operationType: 'apply.prod.read', mutating: false },
   { method: 'POST', route: '/systems/:systemKey/download', handlerId: 'runDownload', operationType: 'workspace.write', mutating: true },
   {
     method: 'POST',

package/lib/programmatic/get-deploy-status.js

@@ -0,0 +1,45 @@
+/**
+ * Builder-api status read for an async external system deploy (plan 191.0 task 3).
+ * Thin proxy over Miso's own pipeline deployment status — Builder never invents deployment state.
+ *
+ * @fileoverview GET /systems/:systemKey/deploy/:deploymentId/status
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { runWithWorkspaceContext } = require('./workspace-context');
+const { buildBearerAuthConfig } = require('./auth-config');
+const { getPipelineDeployment } = require('../api/pipeline.api');
+const { formatApiError } = require('../utils/api-error-handler');
+
+/**
+ * @param {Object} res
+ * @param {string} controllerUrl
+ * @returns {Error & { statusCode: number }}
+ */
+function toDeployStatusError(res, controllerUrl) {
+  const err = new Error(formatApiError(res, controllerUrl));
+  const status = Number(res.status || res.statusCode);
+  err.statusCode = status >= 400 && status < 600 ? status : 502;
+  return err;
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @param {string} deploymentId
+ * @returns {Promise<Object>} Miso deployment status (id, status, progress, updatedAt, qualification, ...)
+ */
+async function getDeployStatus(ctx, deploymentId) {
+  return runWithWorkspaceContext(ctx, async() => {
+    const authConfig = buildBearerAuthConfig(ctx.bearerToken);
+    const res = await getPipelineDeployment(ctx.controllerUrl, ctx.environment, deploymentId, authConfig);
+    if (res?.success === false) {
+      throw toDeployStatusError(res, ctx.controllerUrl);
+    }
+    return res.data ?? res;
+  });
+}
+
+module.exports = { getDeployStatus };

package/lib/programmatic/get-upload-status.js

@@ -0,0 +1,45 @@
+/**
+ * Builder-api status read for an async qualification upload job (plan 191.0 task 3).
+ * Thin proxy over Dataplane's own publish-job status — Builder never invents job state.
+ *
+ * @fileoverview GET /systems/:systemKey/upload/:jobId/status
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { runWithWorkspaceContext } = require('./workspace-context');
+const { buildProgrammaticAuthContext } = require('./auth-config');
+const { getPublishJobStatus } = require('../api/pipeline.api');
+const { formatApiError } = require('../utils/api-error-handler');
+
+/**
+ * @param {Object} res
+ * @param {string} dataplaneUrl
+ * @returns {Error & { statusCode: number }}
+ */
+function toJobStatusError(res, dataplaneUrl) {
+  const err = new Error(formatApiError(res, dataplaneUrl));
+  const status = Number(res.status || res.statusCode);
+  err.statusCode = status >= 400 && status < 600 ? status : 502;
+  return err;
+}
+
+/**
+ * @param {import('./workspace-context').WorkspaceContext} ctx
+ * @param {string} jobId
+ * @returns {Promise<Object>} Dataplane PublishJobStatusResponse (jobId, state, steps, error, result)
+ */
+async function getUploadStatus(ctx, jobId) {
+  return runWithWorkspaceContext(ctx, async() => {
+    const { authConfig, dataplaneUrl } = buildProgrammaticAuthContext(ctx);
+    const res = await getPublishJobStatus(dataplaneUrl, authConfig, jobId);
+    if (res?.success === false) {
+      throw toJobStatusError(res, dataplaneUrl);
+    }
+    return res.data;
+  });
+}
+
+module.exports = { getUploadStatus };

package/lib/programmatic/http-accepted-response.js

@@ -0,0 +1,31 @@
+/**
+ * Marker for builder-api handlers that accepted a durable async operation (202), instead of
+ * completing synchronously (200). Mirrors http-raw-response.js's escape-hatch pattern so
+ * executeCapabilityRequest can special-case the response status without every other handler
+ * needing to know about it (plan 191.0 task 3: replace 5-minute sync upload/deploy web requests
+ * with accepted operation responses).
+ *
+ * @fileoverview 202-accepted result marker for upload/deploy web handlers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {Object} data - Operation identity/state to return in the response body (e.g. {jobId, candidateFingerprint} or {deploymentId, status}).
+ * @returns {{ __httpAccepted: true, data: Object }}
+ */
+function createHttpAcceptedResult(data) {
+  return { __httpAccepted: true, data };
+}
+
+/**
+ * @param {unknown} result
+ * @returns {boolean}
+ */
+function isHttpAcceptedResult(result) {
+  return Boolean(result && typeof result === 'object' && result.__httpAccepted === true);
+}
+
+module.exports = { createHttpAcceptedResult, isHttpAcceptedResult };

package/lib/programmatic/openapi-descriptions.js

@@ -129,15 +129,25 @@ const OPERATION_DESCRIPTIONS = Object.freeze({
     tags: ['certify']
   },
   runUpload: {
-    summary: 'Upload integration to dev Dataplane',
+    summary: 'Submit integration for durable Dataplane qualification (async)',
     description:
-      'Full dev publish: validate, sync deploy JSON, push credentials, pipeline upload. Requires external-system:publish in dev. Mutating; use Idempotency-Key; may take up to MAX_UPLOAD_TIMEOUT_MS.',
+      'Validates, syncs deploy JSON, pushes credentials, then durably submits the candidate for Dataplane qualification (plan 191.0). Returns 202 immediately with {jobId, candidateFingerprint} — never blocks on the qualification ladder. Poll GET .../upload/{jobId}/status for terminal state. Requires external-system:publish in dev. Mutating; use Idempotency-Key.',
+    tags: ['apply']
+  },
+  getUploadStatus: {
+    summary: 'Read qualification job status',
+    description: 'Poll the durable Dataplane qualification job accepted by runUpload. Read-only proxy; terminal states are completed/failed.',
     tags: ['apply']
   },
   runDeploySystem: {
-    summary: 'Deploy integration via controller (promote)',
+    summary: 'Deploy integration via controller (promote, async)',
     description:
-      'Controller deploy for external systems (CLI aifabrix deploy parity). Optional body.gate matches CLI --gate (operations,trust,governance,full). Certificate seal is a platform side-effect of published Deploy — not a separate certificates issue call. Mutating; use Idempotency-Key.',
+      'Controller deploy for external systems (CLI aifabrix deploy parity). Optional body.gate is a no-op notice — qualification gates now run once during upload, not at deploy time. Returns 202 immediately with {deploymentId} — never blocks on the outer Miso deployment (fast when the candidate is already qualified, slower on the legacy ladder otherwise). Poll GET .../deploy/{deploymentId}/status for terminal state. Mutating; use Idempotency-Key.',
+    tags: ['apply']
+  },
+  getDeployStatus: {
+    summary: 'Read deployment status',
+    description: 'Poll the durable Miso deployment accepted by runDeploySystem. Read-only proxy; includes heartbeat (updatedAt) and, for qualified Connected Systems, a nested qualification/promotion summary.',
     tags: ['apply']
   },
   runDownload: {

package/lib/programmatic/request-timeout.js

@@ -8,27 +8,33 @@
 
 'use strict';
 
+/**
+ * Per-handler {envVar, defaultMs}. Plan 191.0 task 3: runUpload/runDeploySystem are accept-only
+ * (202) — local validation + manifest build + one accept HTTP call, never the qualification
+ * ladder or outer deployment — so their budget shrunk from 300000 (the old
+ * blocking-on-the-full-ladder value). Their status-read siblings are short, single-proxy reads.
+ * @type {Readonly<Record<string, { envVar: string, defaultMs: number }>>}
+ */
+const HANDLER_TIMEOUT_CONFIG = Object.freeze({
+  runUpload: { envVar: 'MAX_UPLOAD_TIMEOUT_MS', defaultMs: 45000 },
+  getUploadStatus: { envVar: 'MAX_UPLOAD_STATUS_TIMEOUT_MS', defaultMs: 15000 },
+  runDeploySystem: { envVar: 'MAX_DEPLOY_TIMEOUT_MS', defaultMs: 45000 },
+  getDeployStatus: { envVar: 'MAX_DEPLOY_STATUS_TIMEOUT_MS', defaultMs: 15000 },
+  runDownload: { envVar: 'MAX_DOWNLOAD_TIMEOUT_MS', defaultMs: 300000 },
+  runTest: { envVar: 'MAX_TEST_E2E_TIMEOUT_MS', defaultMs: 120000 },
+  runCertifyPillar: { envVar: 'MAX_CERTIFY_TIMEOUT_MS', defaultMs: 120000 }
+});
+
 /**
  * @param {string} handlerId
  * @returns {number}
  */
 function getTimeoutMsForHandler(handlerId) {
-  if (handlerId === 'runUpload') {
-    return Number(process.env.MAX_UPLOAD_TIMEOUT_MS || 300000);
-  }
-  if (handlerId === 'runDeploySystem') {
-    return Number(process.env.MAX_DEPLOY_TIMEOUT_MS || 300000);
-  }
-  if (handlerId === 'runDownload') {
-    return Number(process.env.MAX_DOWNLOAD_TIMEOUT_MS || 300000);
-  }
-  if (handlerId === 'runTest') {
-    return Number(process.env.MAX_TEST_E2E_TIMEOUT_MS || 120000);
-  }
-  if (handlerId === 'runCertifyPillar') {
-    return Number(process.env.MAX_CERTIFY_TIMEOUT_MS || 120000);
+  const config = HANDLER_TIMEOUT_CONFIG[handlerId];
+  if (!config) {
+    return Number(process.env.MAX_REQUEST_TIMEOUT_MS || 120000);
   }
-  return Number(process.env.MAX_REQUEST_TIMEOUT_MS || 120000);
+  return Number(process.env[config.envVar] || config.defaultMs);
 }
 
 /**

package/lib/programmatic/route-handler-map.js

@@ -19,6 +19,8 @@ const { runRepair } = require('./run-repair');
 const { runValidate } = require('./run-validate');
 const { runPreviewUpload, runUpload } = require('./run-upload');
 const { runDeploySystem } = require('./run-deploy');
+const { getUploadStatus } = require('./get-upload-status');
+const { getDeployStatus } = require('./get-deploy-status');
 const { runDownload } = require('./run-download');
 const { runProtectionUpload, runProtectionCreate } = require('./run-protection');
 const { runTest } = require('./run-test');
@@ -157,6 +159,8 @@ const HANDLER_MAP = {
       probe: body.probe === true,
       minimal: true
     }),
+  getUploadStatus: (params, auth) =>
+    getUploadStatus(buildContext(auth, params.systemKey), params.jobId),
   runDeploySystem: (params, auth, body) =>
     runDeploySystem(buildContext(auth, params.systemKey), {
       gate: body.gate,
@@ -165,6 +169,8 @@ const HANDLER_MAP = {
       sync: body.sync === true,
       verbose: body.verbose === true
     }),
+  getDeployStatus: (params, auth) =>
+    getDeployStatus(buildContext(auth, params.systemKey), params.deploymentId),
   runDownload: (params, auth, body = {}) =>
     runDownload(buildContext(auth, params.systemKey), {
       force: body.force === true,

package/lib/programmatic/run-deploy.js

@@ -12,6 +12,7 @@ const { deployExternalSystem } = require('../external-system/deploy');
 const { runWithWorkspaceContext } = require('./workspace-context');
 const { mergeProgrammaticOptions } = require('./command-options');
 const { touchWorkspaceMeta } = require('./workspace-meta');
+const { createHttpAcceptedResult } = require('./http-accepted-response');
 
 /**
  * @param {unknown} gate
@@ -39,9 +40,11 @@ function attachDeployStatus(err) {
 }
 
 /**
+ * Builder-api web callers never block on the outer Miso deployment (plan 191.0 task 3) — accept
+ * only, return 202 with the deployment id immediately; poll via getDeployStatus.
  * @param {import('./workspace-context').WorkspaceContext} ctx
  * @param {Object} [options]
- * @param {string} [options.gate] - Same as CLI --gate (operations,trust,governance,full)
+ * @param {string} [options.gate] - Same as CLI --gate (operations,trust,governance,full); now a no-op notice, kept for compatibility.
  * @param {string} [options.subjectEmail]
  * @param {boolean} [options.probe]
  * @param {boolean} [options.sync]
@@ -55,13 +58,14 @@ async function runDeploySystem(ctx, options = {}) {
     subjectEmail: options.subjectEmail,
     probe: options.probe === true,
     sync: options.sync === true,
-    verbose: options.verbose === true
+    verbose: options.verbose === true,
+    poll: false
   });
   return runWithWorkspaceContext(ctx, async() => {
     try {
       const result = await deployExternalSystem(ctx.systemKey, merged);
       touchWorkspaceMeta(ctx, { lastOperation: 'deploy' });
-      return result && typeof result === 'object' ? result : { deployed: true };
+      return createHttpAcceptedResult(result && typeof result === 'object' ? result : { deployed: true });
     } catch (err) {
       throw attachDeployStatus(err);
     }