@aifabrix/builder 2.56.0 → 2.58.0

package/lib/commands/agent-kit.js

@@ -1,15 +1,18 @@
-/**
- * `aifabrix agent-kit` command group.
- * @fileoverview Install, init, status, update, validate, remote create, start
- */
+/** `aifabrix agent-kit` command group. */
 
 'use strict';
 
 const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
-const { formatSuccessLine, formatBlockingError, formatWarningLine } = require('../utils/cli-layout-chalk');
+const {
+  formatSuccessLine,
+  formatBlockingError,
+  formatWarningLine
+} = require('../utils/cli-layout-chalk');
 const { runInstall, runUpdate } = require('../agent-kit/run');
 const { runStart } = require('../agent-kit/start');
+const { runList, runKill } = require('../agent-kit/tmux-sessions');
+const { formatSessionList, formatMissingKillName } = require('../agent-kit/session-report');
 const path = require('path');
 const { runInit, runRemoteCreate } = require('../agent-kit/init');
 const { enrichInitHostOptions, enrichInitRemoteOptions, enrichRemoteOptions, enrichApproveAllOptions } = require('../agent-kit/remote-prompts');
@@ -30,6 +33,8 @@ const {
   REMOTE_GROUP_HELP,
   REMOTE_HELP,
   START_HELP,
+  LIST_HELP,
+  KILL_HELP,
   HOST_OPTION_HELP,
   APPROVE_ALL_OPTION_HELP
 } = require('./agent-kit-help');
@@ -110,6 +115,8 @@ function emitStartReport(json, asJson) {
   logger.log(`Session    ${json.session}`);
   if (json.remoteControlName) {
     logger.log(`Remote     ${json.remoteControlName}`);
+  } else if (json.remoteControl) {
+    logger.log('Remote     Codex Remote Control');
   }
   logger.log(`Path       ${json.path}`);
   logger.log(`Launch     ${json.launch.join(' ')}`);
@@ -124,6 +131,32 @@ function emitStartReport(json, asJson) {
   logger.log(formatSuccessLine(json.dryRun ? 'Dry-run complete' : 'Ready'));
 }
 
+/**
+ * @param {object} json
+ * @param {boolean} asJson
+ * @returns {void}
+ */
+function emitListReport(json, asJson) {
+  if (asJson) {
+    logger.log(JSON.stringify(json, null, 2));
+    return;
+  }
+  logger.log(formatSessionList(json));
+}
+
+/**
+ * @param {object} json
+ * @param {boolean} asJson
+ * @returns {void}
+ */
+function emitKillReport(json, asJson) {
+  if (asJson) {
+    logger.log(JSON.stringify(json, null, 2));
+    return;
+  }
+  logger.log(formatSuccessLine(`Stopped tmux session ${json.session}`));
+}
+
 /**
  * @param {Function} runner
  * @param {object} options
@@ -159,6 +192,8 @@ function setupAgentKitCommands(program) {
   addValidateCommand(group);
   addRemoteCommand(group);
   addStartCommand(group);
+  addListCommand(group);
+  addKillCommand(group);
 }
 
 /**
@@ -387,8 +422,8 @@ async function runValidateLeaf(options) {
 function addStartCommand(group) {
   group
     .command('start <app>')
-    .description('Start Claude Code or Codex in tmux (does not install skills)')
-    .option('--approve-all', 'Write auto-approve config for this app only')
+    .description('Start Claude Code or Codex with Remote Control in named tmux')
+    .option('--approve-all', 'Write auto-approve config (default for start)')
     .option('--skip-approve-all', 'Do not write auto-approve configs')
     .option('--yes', 'Same as --approve-all')
     .option('--detach', 'Create the tmux session in the background (no attach)')
@@ -398,8 +433,10 @@ function addStartCommand(group) {
     )
     .option(
       '--remote-control',
-      'Claude Code only: same session on this PC, claude.ai/code, and the Claude mobile app'
+      'Enable native Remote Control for Claude or Codex (default)',
+      true
     )
+    .option('--no-remote-control', 'Start a local tmux-only session')
     .option('--dry-run', 'Print the launch command without starting it')
     .option('--json', 'Machine-readable output')
     .addHelpText('after', START_HELP)
@@ -414,4 +451,49 @@ function addStartCommand(group) {
     });
 }
 
+/**
+ * @param {import('commander').Command} group
+ */
+function addListCommand(group) {
+  group
+    .command('list')
+    .description('List active tmux sessions for the current user')
+    .option('--json', 'Machine-readable output')
+    .addHelpText('after', LIST_HELP)
+    .action(async(options) => {
+      try {
+        emitListReport(runList(options), Boolean(options.json));
+      } catch (error) {
+        handleCommandError(error, 'agent-kit list');
+        process.exitCode = 1;
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} group
+ */
+function addKillCommand(group) {
+  group
+    .command('kill [name]')
+    .description('Stop one tmux session by exact name')
+    .option('--json', 'Machine-readable output')
+    .addHelpText('after', KILL_HELP)
+    .action(async(name, options) => {
+      if (!name) {
+        const report = formatMissingKillName(Boolean(options.json));
+        logger.error(report.stderr);
+        if (report.stdout) logger.log(report.stdout);
+        process.exitCode = 1;
+        return;
+      }
+      try {
+        emitKillReport(runKill({ ...options, name }), Boolean(options.json));
+      } catch (error) {
+        handleCommandError(error, 'agent-kit kill');
+        process.exitCode = 1;
+      }
+    });
+}
+
 module.exports = { setupAgentKitCommands };

package/lib/commands/dev-registry.js

@@ -0,0 +1,155 @@
+/**
+ * `aifabrix dev set-registry` / `dev print-registry` logic.
+ *
+ * @fileoverview Installation registry preference and host-scoped credential management
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const config = require('../core/config');
+const logger = require('../utils/logger');
+const { formatSuccessLine, formatWarningLine } = require('../utils/cli-test-layout-chalk');
+const { normalizeRegistryHost } = require('../utils/config-registry-preference');
+const registryCredentials = require('../utils/registry-credentials');
+
+/**
+ * Reads the whole of stdin (for --password-stdin).
+ * @param {NodeJS.ReadableStream} [stream] - Input stream
+ * @returns {Promise<string>}
+ */
+function readAllStdin(stream = process.stdin) {
+  return new Promise((resolve, reject) => {
+    let data = '';
+    stream.setEncoding('utf8');
+    stream.on('data', (chunk) => {
+      data += chunk;
+    });
+    stream.on('end', () => resolve(data));
+    stream.on('error', reject);
+  });
+}
+
+function hasOption(value) {
+  return value !== undefined && value !== null;
+}
+
+function assertModeOptions(registry, opts) {
+  const credentialOption = hasOption(opts.username) || hasOption(opts.password) || opts.passwordStdin === true;
+  if (opts.clear && opts.clearCredentials) {
+    throw new Error('Use either --clear or --clear-credentials, not both');
+  }
+  if ((opts.clear || opts.clearCredentials) && credentialOption) {
+    throw new Error('--clear and --clear-credentials cannot be combined with --username or a password option');
+  }
+  if (opts.clear && hasOption(registry)) {
+    throw new Error('--clear removes the saved registry and takes no registry argument');
+  }
+  if (!opts.clear && !(typeof registry === 'string' && registry.trim())) {
+    throw new Error('Registry is required (for example: aifabrix dev set-registry myregistry.azurecr.io)');
+  }
+}
+
+function assertCredentialOptions(opts) {
+  if (hasOption(opts.password) && opts.passwordStdin === true) {
+    throw new Error('Use either --password or --password-stdin, not both');
+  }
+  const passwordGiven = hasOption(opts.password) || opts.passwordStdin === true;
+  if (hasOption(opts.username) !== passwordGiven) {
+    throw new Error('--username and a password (--password or --password-stdin) must be supplied together');
+  }
+  if (hasOption(opts.username) && !String(opts.username).trim()) {
+    throw new Error('--username must not be empty');
+  }
+  if (hasOption(opts.password) && String(opts.password) === '') {
+    throw new Error('--password must not be empty');
+  }
+  return passwordGiven;
+}
+
+async function resolvePassword(opts, readStdin) {
+  if (opts.passwordStdin !== true) return String(opts.password);
+  const password = (await readStdin()).replace(/\r?\n$/, '');
+  if (!password) {
+    throw new Error('--password-stdin received an empty password');
+  }
+  return password;
+}
+
+async function saveWithCredentials(host, username, password) {
+  const saved = await registryCredentials.saveRegistryCredentials(host, username, password);
+  try {
+    await config.setRegistry(host);
+  } catch (error) {
+    saved.rollback();
+    throw new Error(`Could not save the registry preference; credentials for ${host} were restored (${error.message})`);
+  }
+}
+
+async function runClearMode(registry, opts) {
+  if (opts.clear) {
+    await config.clearRegistry();
+    logger.log(formatSuccessLine('Registry cleared (application image.registry applies again)'));
+    return { action: 'clear', registry: null, credentials: false };
+  }
+  const host = normalizeRegistryHost(registry);
+  const removed = registryCredentials.removeRegistryCredentials(host);
+  logger.log(formatSuccessLine(removed ? `Credentials removed for ${host}` : `No stored credentials for ${host}`));
+  return { action: 'clear-credentials', registry: host, credentials: false };
+}
+
+/**
+ * Runs `dev set-registry`.
+ * @param {string|undefined} registry - Positional registry
+ * @param {Object} opts - Commander options
+ * @param {Object} [deps] - `readStdin` override (tests)
+ * @returns {Promise<{ action: string, registry: string|null, credentials: boolean }>}
+ */
+async function runSetRegistry(registry, opts = {}, deps = {}) {
+  assertModeOptions(registry, opts);
+  if (opts.clear || opts.clearCredentials) return runClearMode(registry, opts);
+  const host = normalizeRegistryHost(registry);
+  const withCredentials = assertCredentialOptions(opts);
+  if (!withCredentials) {
+    await config.setRegistry(host);
+    logger.log(formatSuccessLine(`Registry set to ${host}`));
+    return { action: 'set', registry: host, credentials: false };
+  }
+  const password = await resolvePassword(opts, deps.readStdin || readAllStdin);
+  await saveWithCredentials(host, String(opts.username).trim(), password);
+  logger.log(formatSuccessLine(`Registry set to ${host}`));
+  logger.log(formatSuccessLine(`Credentials saved for ${host} in your local secrets file (encrypted)`));
+  if (opts.passwordStdin !== true) {
+    logger.log(formatWarningLine('--password can appear in shell history and process listings; prefer --password-stdin'));
+  }
+  return { action: 'set', registry: host, credentials: true };
+}
+
+/**
+ * `dev print-registry`: the saved value plus a newline, or an empty line. Stdout only.
+ * @returns {Promise<void>}
+ */
+async function runPrintRegistry() {
+  const registry = await config.getRegistry();
+  process.stdout.write(`${registry || ''}\n`);
+}
+
+/**
+ * Safe credential status label for `dev show` (never decrypts).
+ * @param {string|null} registry - Saved registry
+ * @returns {string|null}
+ */
+function registryCredentialLabel(registry) {
+  if (!registry) return null;
+  try {
+    const status = registryCredentials.getRegistryCredentialStatus(registry);
+    if (status === 'complete') return 'configured';
+    if (status === 'absent') return 'not configured';
+    return `incomplete (run: aifabrix dev set-registry ${registry} --clear-credentials)`;
+  } catch {
+    return 'unknown';
+  }
+}
+
+module.exports = { runSetRegistry, runPrintRegistry, registryCredentialLabel, readAllStdin };

package/lib/commands/dev-show-display.js

@@ -336,6 +336,8 @@ function logConfigurationSection(p) {
   logRow('Environment', p.environment);
   logRow('Controller', p.controller);
   logRow('Format', p.formatVal);
+  logRow('Registry', p.registry);
+  if (p.registry) logRow('Registry login', p.registryCredentials);
   logRow('Platform mode', p.setupPlatformMode);
   logRow('Traefik', p.traefikEnabled ? 'on' : 'off');
   logRow('Scoped resources', p.scopedResourcesLabel);
@@ -389,14 +391,16 @@ async function loadDevShowData(devIdStr) {
   const ports = devConfig.getDevPorts(Number.isNaN(devIdNum) ? 0 : devIdNum);
   const [
     environment, tlsEnabled, controller, formatRaw, useScoped, secretsRaw, setupPlatformMode, traefikEnabled,
-    remoteServer, dockerEndpoint, dockerTlsSkipVerify, mutagenFolder, syncSshUser, syncSshHost
+    remoteServer, dockerEndpoint, dockerTlsSkipVerify, mutagenFolder, syncSshUser, syncSshHost, registry
   ] = await Promise.all([
     config.getCurrentEnvironment(), config.getTlsEnabled(), config.getControllerUrl(),
     config.getFormat(), config.getUseEnvironmentScopedResources(), config.getAifabrixSecretsPath(),
     config.getSetupPlatformMode(), config.getTraefikEnabled(),
     config.getRemoteServer(), config.getDockerEndpoint(), config.getDockerTlsSkipVerify(),
-    config.getUserMutagenFolder(), config.getSyncSshUser(), config.getSyncSshHost()
+    config.getUserMutagenFolder(), config.getSyncSshUser(), config.getSyncSshHost(),
+    config.getRegistry ? config.getRegistry() : null
   ]);
+  const { registryCredentialLabel } = require('./dev-registry');
   const urlsLocalPath = getUrlsLocalYamlPath();
   const scopedResourcesLabel = useScoped ? 'on' : 'off (default)';
   const workResolved = paths.getAifabrixWork();
@@ -412,6 +416,8 @@ async function loadDevShowData(devIdStr) {
     tlsEnabled,
     controller,
     formatVal: formatRaw ?? null,
+    registry: registry || null,
+    registryCredentials: registryCredentialLabel(registry || null),
     scopedResourcesLabel,
     setupPlatformMode,
     traefikEnabled,
@@ -451,6 +457,8 @@ function renderDevShow(data) {
     tlsEnabled: data.tlsEnabled,
     controller: data.controller,
     formatVal: data.formatVal,
+    registry: data.registry,
+    registryCredentials: data.registryCredentials,
     setupPlatformMode: data.setupPlatformMode,
     traefikEnabled: data.traefikEnabled,
     scopedResourcesLabel: data.scopedResourcesLabel,

package/lib/commands/setup-image-refresh.js

@@ -21,9 +21,30 @@ const infraHelpers = require('../infrastructure/helpers');
 const upCommon = require('./up-common');
 const { sectionTitle, formatDatasourceListRow } = require('../utils/cli-test-layout-chalk');
 const { startSpinner, stopSpinnerSuccess } = require('./setup-spinners');
+const { ensureLoginForImageRefs } = require('../utils/registry-credentials');
 
 const PLATFORM_APPS = ['keycloak', 'miso-controller', 'dataplane'];
 
+/**
+ * `image:` values of a compose file (plain scan; variables are left unresolved and skipped).
+ * @param {string} composePath - Compose file path
+ * @returns {string[]}
+ */
+function readComposeImageRefs(composePath) {
+  let text = '';
+  try {
+    text = String(fs.readFileSync(composePath, 'utf8') || '');
+  } catch {
+    return [];
+  }
+  const refs = [];
+  for (const line of text.split(/\r?\n/)) {
+    const match = line.match(/^\s*image:\s*["']?([^"'\s#]+)["']?/);
+    if (match && !match[1].includes('$')) refs.push(match[1]);
+  }
+  return refs;
+}
+
 /**
  * Pull infra-compose images (postgres, redis, optional pgadmin/redis-commander/traefik).
  *
@@ -42,6 +63,8 @@ async function pullInfraImages(opts = {}) {
     }
     return;
   }
+  // Authenticate once per private registry host before compose pulls (stored pairs only).
+  await ensureLoginForImageRefs(readComposeImageRefs(composePath));
   const project = infraHelpers.getInfraProjectName(devId);
   const composeCmd = await dockerUtils.getComposeCommand();
   if (!quiet) {
@@ -91,6 +114,8 @@ async function pullPlatformAppImage(appName, opts = {}) {
     }
     return false;
   }
+  // A partial stored credential pair fails closed here instead of degrading to a warning.
+  await ensureLoginForImageRefs([imageRef]);
   try {
     if (!quiet) {
       const spin = startSpinner(`Pulling ${appName} image...`);
@@ -142,5 +167,6 @@ module.exports = {
   PLATFORM_APPS,
   pullInfraImages,
   pullPlatformImages,
+  readComposeImageRefs,
   runSetupImageRefresh
 };

package/lib/core/config-attach-extensions.js

@@ -1,5 +1,5 @@
 /**
- * Attach token, path, format, and scoped-resources helpers to config exports.
+ * Attach token, path, format, scoped-resources, and registry helpers to config exports.
  *
  * @fileoverview Keeps lib/core/config.js under max-lines
  * @author AI Fabrix Team
@@ -42,6 +42,9 @@ function attachConfigExtensions(exportsObj, deps) {
   const { createScopedResourcesPreferenceFunctions } = require('../utils/config-scoped-resources-preference');
   Object.assign(exportsObj, createScopedResourcesPreferenceFunctions(getConfig, saveConfig));
 
+  const { createRegistryPreferenceFunctions } = require('../utils/config-registry-preference');
+  Object.assign(exportsObj, createRegistryPreferenceFunctions(getConfig, saveConfig));
+
   const { createSecretsPathFunctions } = require('../utils/config-secrets-path');
   Object.assign(exportsObj, createSecretsPathFunctions(getConfig, saveConfig));
 }

package/lib/deployment/installation/azure-infra-stage.js

@@ -0,0 +1,191 @@
+'use strict';
+
+/**
+ * @fileoverview AZURE `--stage infra`: validates the workspace, resolves ACR and secrets, deploys
+ * the workspace Marketplace template snapshot, verifies image pull (managed identity or registry
+ * credentials) and that both applications started, and records outputs. Mori registration and
+ * tenant activation stay with Miso. Registry credentials are never written to the workspace.
+ */
+
+// Real-sync adapter: installation workspace state must not disappear under Jest fs mocks.
+const fs = require('../../internal/fs-real-sync');
+const os = require('os');
+const path = require('path');
+const marketplace = require('../marketplace-environment');
+const { normalizePreset } = require('../environment-config');
+const { normalizeLicenseEdition, normalizeAzureLocation, ONBOARDING_MODES } = require('./infra-catalog');
+const { materializeWorkspace, saveInfra } = require('./workspace');
+const { missingRequiredFields } = require('./infra-manifest');
+const { buildArmParameters, applyAllowMyIp } = require('./infra-projection');
+const { materializeWorkspaceSecrets } = require('./workspace-secrets');
+const { mergeWorkspaceEnv } = require('./workspace-env');
+const { resolvePublicIpv4 } = require('./public-ip');
+const preflight = require('./azure-preflight');
+const readiness = require('./azure-readiness');
+const registryAuth = require('./registry-auth-mode');
+
+const INFRA_SECRETS = Object.freeze(['ADMIN_PASSWORD', 'ENCRYPTION_KEY', 'MORI_CALLBACK_API_KEY']);
+
+function missingInputError(file, fields) {
+  const error = new Error(
+    `Installation workspace needs input before infra can run. Set these fields in ${file}, then rerun:\n  - ${fields.join('\n  - ')}`
+  );
+  error.code = 'WORKSPACE_INPUT_REQUIRED';
+  return error;
+}
+
+function applyLicenseOptions(doc, input) {
+  const license = doc.parameters.licenseEdition;
+  if (input.licenseEdition !== undefined) {
+    doc.parameters.licenseEdition = { ...license, value: normalizeLicenseEdition(input.licenseEdition), source: 'cli' };
+  } else {
+    doc.parameters.licenseEdition = { ...license, value: normalizeLicenseEdition(license.value) };
+  }
+  if (!ONBOARDING_MODES.includes(doc.parameters.onboardingMode.value)) {
+    throw new Error(`parameters.onboardingMode.value must be one of ${ONBOARDING_MODES.join(', ')}`);
+  }
+}
+
+async function applyAccessOptions(doc, input, deps) {
+  if (input.preset !== undefined) {
+    doc.preset = { ...doc.preset, value: normalizePreset(input.preset), source: 'cli' };
+  }
+  applyLicenseOptions(doc, input);
+  const enabled = input.allowMyIp || doc.allowMyIp.value === true;
+  if (!enabled) {
+    applyAllowMyIp(doc, { enabled: false });
+    return;
+  }
+  const access = await (deps.resolvePublicIpv4 || resolvePublicIpv4)();
+  applyAllowMyIp(doc, { enabled: true, ...access });
+}
+
+function withTemporaryParameters(document, action) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'aifabrix-arm-'));
+  const file = path.join(dir, 'parameters.json');
+  try {
+    fs.chmodSync(dir, 0o700);
+    fs.writeFileSync(file, JSON.stringify(document), { mode: 0o600 });
+    return action(file);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+function recordDeployment(doc, record, now) {
+  doc.deployment = {
+    ...doc.deployment,
+    status: { ...doc.deployment.status, value: 'succeeded' },
+    name: record.deploymentName,
+    id: record.deploymentId,
+    correlationId: record.correlationId || null,
+    inputHash: record.inputHash,
+    completedAt: record.recordedAt || now().toISOString()
+  };
+  for (const name of Object.keys(doc.outputs)) {
+    doc.outputs[name].value = record.outputs[name] ?? null;
+  }
+}
+
+function deployTemplate(workspace, doc, context) {
+  const { document, inputHash } = buildArmParameters(doc, context);
+  return withTemporaryParameters(document, parametersFile => marketplace.deployInfra({
+    installId: doc.installId.value,
+    envKey: null,
+    subscription: doc.subscriptionId.value,
+    resourceGroup: doc.resourceGroup.value,
+    location: doc.parameters.location.value,
+    template: workspace.paths.template,
+    parameters: parametersFile,
+    templateHash: context.templateHash,
+    inputHash
+  }, context.az));
+}
+
+async function verifyAndRecordReadiness(workspace, doc, deps) {
+  readiness.verifyRuntimeImagePull(doc, deps.az);
+  await readiness.waitForApplications(doc, deps.probe || marketplace.probeHttps);
+  const controllerUrl = `${String(doc.outputs.webAppUrl.value).replace(/\/+$/, '')}/miso`;
+  doc.controllerUrl = { ...doc.controllerUrl, value: controllerUrl };
+  doc.tenantActivation.url = { ...doc.tenantActivation.url, value: controllerUrl };
+  saveInfra(workspace, doc);
+  mergeWorkspaceEnv(workspace.paths.env, { CONTROLLER_URL: controllerUrl }, { root: workspace.root, replaceable: ['CONTROLLER_URL'] });
+  return controllerUrl;
+}
+
+function applyLocation(doc, input) {
+  if (input.location === undefined) return;
+  doc.parameters.location = { ...doc.parameters.location, value: normalizeAzureLocation(input.location), source: 'cli' };
+}
+
+async function resolvePullAuth(doc, acr, deps, az) {
+  const loadRegistryCredentials = deps.loadRegistryCredentials ||
+    require('../../utils/registry-credentials').loadRegistryCredentials;
+  const resolved = await registryAuth.resolveRegistryAuth(doc, acr, az, {
+    loadRegistryCredentials,
+    resolveAcrAdminCredentials: preflight.resolveAcrAdminCredentials
+  });
+  registryAuth.applyEffectiveAcrAuth(doc, resolved.mode);
+  return resolved.credentials;
+}
+
+async function prepareInfra(workspace, input, deps, az) {
+  const { doc, templateHash } = materializeWorkspace(workspace, input, deps);
+  applyLocation(doc, input);
+  const missing = missingRequiredFields(doc);
+  if (missing.length > 0) {
+    if (input.location !== undefined) saveInfra(workspace, doc);
+    throw missingInputError(workspace.paths.infra, missing);
+  }
+  registryAuth.applyRequestedAcrAuth(doc, input);
+  preflight.assertActiveAccount(doc, az);
+  const acr = preflight.resolveAcr(doc, az);
+  doc.parameters.acrLoginServer.value = acr.loginServer;
+  doc.parameters.acrResourceId.value = acr.id;
+  // Local pair first (a partial pair fails closed); Azure admin lookup only for explicit credentials.
+  const registryCredentials = await resolvePullAuth(doc, acr, deps, az);
+  preflight.assertDeploymentAuthority(doc, acr, az);
+  await applyAccessOptions(doc, input, deps);
+  saveInfra(workspace, doc);
+  return { doc, templateHash, acr, registryCredentials };
+}
+
+function deployWithStatus(workspace, doc, context) {
+  doc.deployment.status = { ...doc.deployment.status, value: 'running' };
+  saveInfra(workspace, doc);
+  try {
+    return deployTemplate(workspace, doc, context);
+  } catch (error) {
+    doc.deployment.status = { ...doc.deployment.status, value: 'failed' };
+    saveInfra(workspace, doc);
+    throw error;
+  }
+}
+
+/**
+ * Runs the AZURE infra stage.
+ * @param {Object} workspace - Opened workspace
+ * @param {Object} input - Validated stage input
+ * @param {Object} [deps] - Injected dependencies (az, probe, resolvePublicIpv4, secretsApi, now, templatePath,
+ *   loadRegistryCredentials)
+ * @returns {Promise<{ doc: Object, controllerUrl: string, activationUrl: string }>}
+ */
+async function runAzureInfraStage(workspace, input, deps = {}) {
+  const context = { az: deps.az || marketplace.runAz, now: deps.now || (() => new Date()), probe: deps.probe };
+  const { doc, templateHash, acr, registryCredentials } = await prepareInfra(workspace, input, deps, context.az);
+  const env = await materializeWorkspaceSecrets({
+    vendor: 'AZURE', envPath: workspace.paths.env, root: workspace.root, names: INFRA_SECRETS, secretsApi: deps.secretsApi
+  });
+  const record = deployWithStatus(workspace, doc, {
+    env, acr, templateHash, az: context.az, registryCredentials
+  });
+  recordDeployment(doc, record, context.now);
+  // Never persist registry credentials in the workspace manifest.
+  doc.parameters.acrAdminUsername = { ...doc.parameters.acrAdminUsername, value: '', source: 'managedIdentityMode' };
+  doc.parameters.acrAdminPassword = { ...doc.parameters.acrAdminPassword, value: '', source: 'managedIdentityMode' };
+  saveInfra(workspace, doc);
+  const controllerUrl = await verifyAndRecordReadiness(workspace, doc, context);
+  return { doc, controllerUrl, activationUrl: doc.tenantActivation.url.value };
+}
+
+module.exports = { runAzureInfraStage, INFRA_SECRETS };