@aifabrix/builder 2.56.0 → 2.58.0

package/lib/deployment/marketplace-environment.js

@@ -0,0 +1,305 @@
+'use strict';
+
+// Marketplace journals are durable runtime state. Use the repository's real-sync
+// adapter so a caller (or another Jest suite) mocking `fs` cannot make an
+// existing completed journal disappear and trigger a duplicate ARM deployment.
+const fs = require('../internal/fs-real-sync');
+const path = require('path');
+const crypto = require('crypto');
+const { spawnSync } = require('child_process');
+const config = require('../core/config');
+const { getRuntimeConfigDir } = require('../core/config-runtime-paths');
+
+const SHIPPED_TEMPLATE = path.resolve(__dirname, '../../templates/marketplace/main.json');
+// Resolved per call (not a module-load constant) so it honors AIFABRIX_HOME/AIFABRIX_CONFIG
+// the same way the rest of the CLI's config does -- including the Jest sandbox tests use.
+function journalDir() {
+  return path.join(getRuntimeConfigDir(), 'installations');
+}
+const SAFE_NAME = /^[a-z][a-z0-9-]{2,39}$/;
+const SUBSCRIPTION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+function readJson(file, label) {
+  const resolved = path.resolve(file);
+  let document;
+  try {
+    document = JSON.parse(fs.readFileSync(resolved, 'utf8'));
+  } catch (_) {
+    throw new Error(`${label} is missing or invalid JSON: ${resolved}`);
+  }
+  return { document, resolved };
+}
+
+function parameterValue(parameters, name) {
+  return parameters?.parameters?.[name]?.value;
+}
+
+function validateStageTarget(envKey, options) {
+  if (!['dev', 'tst', 'pro'].includes(envKey)) {
+    throw new Error('Marketplace platform stage requires an entitled workload environment: dev, tst or pro');
+  }
+  const installId = String(options.installId || '');
+  const resourceGroup = String(options.resourceGroup || '');
+  if (!SAFE_NAME.test(installId) || (resourceGroup && !SAFE_NAME.test(resourceGroup))) {
+    throw new Error('Install ID and resource group must be lowercase Azure-safe names (3-40 characters)');
+  }
+  const stage = options.stage || 'infra';
+  if (!['infra', 'platform', 'all'].includes(stage)) {
+    throw new Error('Stage must be infra, platform or all');
+  }
+  if (stage === 'all' && !options.controllerUrl) {
+    throw new Error('--stage all requires --controller-url from a completed wizard; use --stage infra for a new installation');
+  }
+  if (stage === 'platform') {
+    return { envKey, installId, stage, controllerUrl: options.controllerUrl };
+  }
+  return { envKey, installId, resourceGroup, stage };
+}
+
+function validateInfraFiles(target, options) {
+  const { resourceGroup } = target;
+  if (!resourceGroup || !SUBSCRIPTION_ID.test(String(options.subscription || ''))) {
+    throw new Error('Infrastructure stage requires --subscription and --resource-group');
+  }
+  if (!options.parameters) {
+    throw new Error('Infrastructure stage requires a secure --parameters file');
+  }
+  const template = readJson(options.marketplaceJson || SHIPPED_TEMPLATE, 'Marketplace template');
+  const params = readJson(options.parameters, 'ARM parameter file');
+  if (fs.statSync(params.resolved).mode & 0o077) {
+    throw new Error('ARM parameter file may contain secrets and must be owner-only (chmod 600)');
+  }
+  if (!template.document.resources || !template.document.parameters || !params.document.parameters) {
+    throw new Error('Expected an ARM deployment template and deploymentParameters JSON');
+  }
+  return { template, params };
+}
+
+function validateInfraParameters(target, options, files) {
+  const { installId, resourceGroup } = target;
+  const { params } = files;
+  if (typeof parameterValue(params.document, 'adminPassword') !== 'string' ||
+      !parameterValue(params.document, 'adminPassword')) {
+    throw new Error('Secure ARM parameter file must supply adminPassword');
+  }
+  // Bicep module 14_marketplace-mori-bootstrap.bicep's own contract: empty/absent
+  // marketplaceSubscriptionId is a valid, intentional direct deploy -- Mori falls back
+  // to Community. Only reject a wrong *type*; do not require a non-empty value here,
+  // that would force a fabricated id past Mori's real Marketplace Fulfillment check.
+  const marketplaceSubscriptionId = parameterValue(params.document, 'marketplaceSubscriptionId');
+  if (marketplaceSubscriptionId !== undefined && typeof marketplaceSubscriptionId !== 'string') {
+    throw new Error('marketplaceSubscriptionId must be a string when present (empty string means a direct deploy, Community fallback)');
+  }
+  const nameOverride = parameterValue(params.document, 'infrastructureNameOverride');
+  if ((nameOverride && nameOverride !== installId) || (!nameOverride && resourceGroup !== installId)) {
+    throw new Error('Installation naming mismatch: infrastructureNameOverride must equal --install-id, or install ID must equal resource group');
+  }
+  const location = parameterValue(params.document, 'location') || options.location;
+  if (typeof location !== 'string' || !/^[a-z0-9]+$/i.test(location)) {
+    throw new Error('Infrastructure stage requires a valid Azure location in the parameter file or --location');
+  }
+  return location;
+}
+
+function preflight(envKey, options) {
+  const target = validateStageTarget(envKey, options);
+  if (target.stage === 'platform') return target;
+  const files = validateInfraFiles(target, options);
+  const location = validateInfraParameters(target, options, files);
+  return {
+    ...target, location,
+    subscription: options.subscription,
+    template: files.template.resolved,
+    parameters: files.params.resolved,
+    templateHash: crypto.createHash('sha256').update(fs.readFileSync(files.template.resolved)).digest('hex')
+  };
+}
+
+function journalPath(installId) {
+  return path.join(journalDir(), `${installId}.json`);
+}
+
+function readJournal(installId) {
+  const file = journalPath(installId);
+  if (!fs.existsSync(file)) throw new Error(`No infrastructure journal for ${installId}. Run --stage infra first.`);
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+
+function writeJournal(record) {
+  fs.mkdirSync(journalDir(), { recursive: true, mode: 0o700 });
+  fs.writeFileSync(journalPath(record.installId), `${JSON.stringify(record, null, 2)}\n`, { mode: 0o600 });
+}
+
+function runAz(args) {
+  const result = spawnSync('az', args, { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+  if (result.error || result.status !== 0) {
+    throw new Error(`Azure CLI ${args.slice(0, 3).join(' ')} failed (exit ${result.status ?? 'unavailable'}). Check Azure deployment diagnostics; secret-bearing output was withheld.`);
+  }
+  return result.stdout.trim();
+}
+
+function azureArgs(base, subscription) {
+  return [...base, '--subscription', subscription];
+}
+
+function checkExistingJournal(input) {
+  const old = fs.existsSync(journalPath(input.installId)) ? readJournal(input.installId) : null;
+  if (old) {
+    // Workspace mode (inputHash present) owns template/parameter updates through the input hash;
+    // the legacy explicit mode still rejects any template change for an existing install ID.
+    if (old.subscription !== input.subscription || old.resourceGroup !== input.resourceGroup ||
+        (!input.inputHash && old.templateHash !== input.templateHash)) {
+      throw new Error('Existing install journal has a different subscription, group or template; use a new install ID');
+    }
+    if (old.infraComplete && old.inputHash === input.inputHash) return old;
+  }
+  return null;
+}
+
+function isOwnResumableDeployment(input, az) {
+  // ARM deployments are declarative/idempotent by name: re-running `deployment group
+  // create` with the same name only touches resources that still need work (e.g. a
+  // nested deployment script that failed) and leaves already-succeeded ones alone. A
+  // resource group that already has resources from *our own* prior attempt at this
+  // install ID is therefore safe to resume into, not "not empty" in the rejecting sense.
+  const deploymentName = `${input.installId}-marketplace-infra`;
+  const deployments = JSON.parse(az(azureArgs([
+    'deployment', 'group', 'list', '--resource-group', input.resourceGroup, '--output', 'json'
+  ], input.subscription)));
+  return deployments.some(deployment => deployment.name === deploymentName);
+}
+
+function ensureEmptyGroup(input, az) {
+  const account = JSON.parse(az(['account', 'show', '--output', 'json']));
+  if (account.id !== input.subscription) {
+    throw new Error('Selected az account subscription differs from --subscription; run az account set before deployment');
+  }
+  const exists = az(azureArgs(['group', 'exists', '--name', input.resourceGroup, '--output', 'tsv'], input.subscription)) === 'true';
+  if (exists) {
+    const resources = JSON.parse(az(azureArgs([
+      'resource', 'list', '--resource-group', input.resourceGroup, '--output', 'json'
+    ], input.subscription)));
+    if (resources.length && !isOwnResumableDeployment(input, az)) {
+      throw new Error('Target resource group is not empty; choose a new isolated group');
+    }
+  } else {
+    az(azureArgs(['group', 'create', '--name', input.resourceGroup, '--location', input.location, '--output', 'none'], input.subscription));
+  }
+}
+
+function runArmDeployment(input, az) {
+  const deploymentName = `${input.installId}-marketplace-infra`;
+  const common = [
+    '--resource-group', input.resourceGroup, '--name', deploymentName,
+    '--template-file', input.template, '--parameters', `@${input.parameters}`,
+    '--no-prompt', 'true'
+  ];
+  az(azureArgs(['deployment', 'group', 'validate', ...common, '--output', 'none'], input.subscription));
+  az(azureArgs(['deployment', 'group', 'what-if', ...common,
+    '--result-format', 'ResourceIdOnly', '--output', 'none'], input.subscription));
+  return { deploymentName, deployment: JSON.parse(az(azureArgs([
+    'deployment', 'group', 'create', ...common, '--output', 'json'
+  ], input.subscription))) };
+}
+
+function deployInfra(input, az = runAz) {
+  const old = checkExistingJournal(input);
+  if (old) return old;
+  ensureEmptyGroup(input, az);
+  const { deploymentName, deployment } = runArmDeployment(input, az);
+  const outputMap = deployment.properties?.outputs || {};
+  const outputs = Object.fromEntries(Object.entries(outputMap).map(([key, item]) => [key, item.value]));
+  if (!outputs.webAppUrl || !outputs.keyVaultName || !outputs.resourceGroupName) {
+    throw new Error('ARM deployment succeeded without required controller/vault/group outputs; inspect deployment before resume');
+  }
+  const record = {
+    installId: input.installId, envKey: input.envKey, subscription: input.subscription,
+    resourceGroup: input.resourceGroup, templateHash: input.templateHash, inputHash: input.inputHash,
+    deploymentName, deploymentId: deployment.id, correlationId: deployment.properties?.correlationId || null,
+    outputs, infraComplete: true,
+    platformComplete: false, recordedAt: new Date().toISOString()
+  };
+  writeJournal(record);
+  return record;
+}
+
+function assertAppDeploymentComplete(appName, deployment) {
+  if (deployment?.usedExternalDeploy || deployment?.result?.status?.status !== 'completed') {
+    throw new Error(`${appName} deployment did not reach completed status; resume platform stage after inspecting controller deployment`);
+  }
+}
+
+async function deployWorkloadApps(input, dependencies) {
+  const deployApp = dependencies.deployApp || require('../app').deployApp;
+  const deployEnvironment = dependencies.deployEnvironment || require('./environment').deployEnvironment;
+  const environment = await deployEnvironment(input.envKey, { poll: true });
+  if (environment?.status !== 'ready') {
+    throw new Error(`Environment ${input.envKey} did not reach ready status; resume platform stage after controller deployment completes`);
+  }
+  await (dependencies.setEnvironment || config.setCurrentEnvironment)(input.envKey);
+  assertAppDeploymentComplete('dataplane', await deployApp('dataplane', { yes: true, poll: true }));
+  assertAppDeploymentComplete('builder-api', await deployApp('builder-api', { yes: true, poll: true }));
+}
+
+async function deployPlatform(input, dependencies = {}) {
+  const record = (dependencies.readJournal || readJournal)(input.installId);
+  if (record.envKey !== input.envKey) throw new Error('Journal workload environment differs from requested environment');
+  if (record.platformComplete) return record;
+  const controller = input.controllerUrl || record.publicControllerUrl;
+  if (typeof controller !== 'string' || !/^https:\/\/[^/]+\/miso\/?$/.test(controller)) {
+    throw new Error('Platform stage requires --controller-url https://<ready-public-host>/miso from the completed wizard');
+  }
+  if (!record.runtimeReady) {
+    throw new Error('Controller runtime is not ready; rerun infrastructure readiness before the platform stage');
+  }
+  await (dependencies.setControllerUrl || config.setControllerUrl)(controller);
+  await deployWorkloadApps(input, dependencies);
+  record.publicControllerUrl = controller.replace(/\/$/, '');
+  record.platformComplete = true;
+  record.platformRecordedAt = new Date().toISOString();
+  (dependencies.writeJournal || writeJournal)(record);
+  return record;
+}
+
+async function deployMarketplaceEnvironment(envKey, options, dependencies = {}) {
+  const input = preflight(envKey, options);
+  if (input.stage === 'platform') return deployPlatform(input, dependencies);
+  const record = deployInfra(input, dependencies.az);
+  const probe = dependencies.probe || probeController;
+  await probe(record.outputs.webAppUrl);
+  record.runtimeReady = true;
+  writeJournal(record);
+  if (input.stage === 'infra') return record;
+  return deployPlatform({ ...input, controllerUrl: options.controllerUrl }, dependencies);
+}
+
+async function probeController(controllerUrl) {
+  return probeHttps(controllerUrl, '/api/v1/health/readiness', 'Controller');
+}
+
+/**
+ * Waits until an HTTPS endpoint answers successfully (App Service startup lags ARM success).
+ * @param {string} baseUrl - HTTPS base URL from ARM outputs
+ * @param {string} pathname - Probe path
+ * @param {string} label - Service label for errors
+ * @param {number} [attempts=30] - Attempts at 10-second intervals
+ * @returns {Promise<void>}
+ */
+async function probeHttps(baseUrl, pathname, label, attempts = 30) {
+  if (typeof baseUrl !== 'string' || !baseUrl.startsWith('https://')) {
+    throw new Error(`ARM output does not contain a valid HTTPS ${label} URL`);
+  }
+  const url = new URL(pathname, baseUrl);
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    try {
+      const response = await fetch(url, { signal: AbortSignal.timeout(5000) });
+      if (response.ok) return;
+    } catch (_) {
+      // App Service startup can lag successful ARM provisioning.
+    }
+    await new Promise(resolve => setTimeout(resolve, 10000));
+  }
+  throw new Error(`${label} readiness did not pass at ${url.origin}; inspect App Service before resuming`);
+}
+
+module.exports = { preflight, deployInfra, deployPlatform, deployMarketplaceEnvironment, runAz, probeHttps, SAFE_NAME };

package/lib/generator/builders.js

@@ -41,16 +41,15 @@ function filterConfigurationByRegistryMode(configuration, _registryMode) {
   return Array.isArray(configuration) ? configuration : [];
 }
 
+/**
+ * Deployment image reference using the shared registry precedence
+ * (installation `registry` in config.yaml, then manifest `image.registry`).
+ * @param {Object} variables - Application variables
+ * @returns {string}
+ */
 function buildImageReference(variables) {
-  const imageName = variables.image?.name || variables.app?.key || 'app';
-  const registry = variables.image?.registry;
-  const tag = variables.image?.tag || 'latest';
-
-  if (registry) {
-    return `${registry}/${imageName}:${tag}`;
-  }
-
-  return `${imageName}:${tag}`;
+  const { buildManifestImageReference } = require('../utils/resolve-docker-image-ref');
+  return buildManifestImageReference(variables, 'app');
 }
 
 /**
@@ -359,6 +358,10 @@ function addSimpleOptionalFields(deployment, variables) {
   if (variables.environmentScopedResources === true) {
     deployment.environmentScopedResources = true;
   }
+  // Non-arrays pass through so schema validation reports them; an empty list stays omitted.
+  if (variables.required !== undefined && !(Array.isArray(variables.required) && variables.required.length === 0)) {
+    deployment.required = variables.required;
+  }
 }
 
 function buildOptionalFields(deployment, variables, rbac) {

package/lib/generator/helpers.js

@@ -11,6 +11,24 @@
 const fs = require('fs');
 const path = require('path');
 const { loadConfigFile } = require('../utils/config-format');
+const { getInfraParameterCatalog } = require('../parameters/infra-parameter-catalog');
+
+/**
+ * Baseline `required` for a keyvault-located key, from infra.parameter.yaml's
+ * `requiredOnSystemOnboarding` (matched by exact key or keyPattern). Returns false when the
+ * catalog can't be loaded or has no matching entry, so generation never hard-fails on this.
+ * @param {string} vaultKey - Key with any `kv://` prefix already stripped
+ * @returns {boolean}
+ */
+function baselineRequiredForVaultKey(vaultKey) {
+  try {
+    const catalog = getInfraParameterCatalog();
+    const entry = catalog.findEntryForKey(vaultKey);
+    return entry?.requiredOnSystemOnboarding === true;
+  } catch {
+    return false;
+  }
+}
 
 /**
  * Loads application config file (application.yaml, application.json, or legacy path) via converter.
@@ -148,34 +166,41 @@ function validatePortalInput(portalInput, variableName) {
 }
 
 /**
- * Parses environment variables from env.template and merges portalInput from application config
+ * Parses environment variables from env.template and merges explicit application config
  * @param {string} envTemplate - Content of env.template file
  * @param {Object|null} [variablesConfig=null] - Optional configuration from application.yaml
  * @returns {Array<Object>} Configuration array with merged portalInput
  * @throws {Error} If portalInput structure is invalid
  */
 /**
- * Creates a map of portal overlay metadata from variables config
- * @function createPortalInputMap
+ * Creates a map of configuration metadata from application.yaml.
+ * `required` is declarative: env names and kv:// values never imply it.
+ * @function createApplicationConfigMap
  * @param {Object|null} variablesConfig - Configuration from application.yaml
- * @returns {Map} Map of variable names to { portalInput, category? }
+ * @returns {Map} Map of variable names to { portalInput?, category?, required? }
  */
-function createPortalInputMap(variablesConfig) {
-  const portalInputMap = new Map();
+function createApplicationConfigMap(variablesConfig) {
+  const applicationConfigMap = new Map();
   if (variablesConfig && variablesConfig.configuration && Array.isArray(variablesConfig.configuration)) {
     for (const configItem of variablesConfig.configuration) {
-      if (configItem.name && configItem.portalInput) {
-        // Validate portalInput before adding to map
+      if (!configItem.name) continue;
+      const overlay = {};
+      if (configItem.portalInput) {
         validatePortalInput(configItem.portalInput, configItem.name);
-        const overlay = { portalInput: configItem.portalInput };
-        if (typeof configItem.category === 'string' && configItem.category.trim().length > 0) {
-          overlay.category = configItem.category.trim();
-        }
-        portalInputMap.set(configItem.name, overlay);
+        overlay.portalInput = configItem.portalInput;
+      }
+      if (typeof configItem.category === 'string' && configItem.category.trim().length > 0) {
+        overlay.category = configItem.category.trim();
+      }
+      if (typeof configItem.required === 'boolean') {
+        overlay.required = configItem.required;
+      }
+      if (Object.keys(overlay).length > 0) {
+        applicationConfigMap.set(configItem.name, overlay);
       }
     }
   }
-  return portalInputMap;
+  return applicationConfigMap;
 }
 
 /**
@@ -209,40 +234,13 @@ function parseEnvironmentVariableLine(line) {
 }
 
 /**
- * Determines location and required status for a variable
+ * Determines storage location for a variable.
  * @function determineVariableLocation
  * @param {string} value - Variable value
- * @param {string} key - Variable key
- * @returns {Object} Object with location and required properties
+ * @returns {string} Deployment configuration location
  */
-function determineVariableLocation(value, key) {
-  let location = 'variable';
-  let required = false;
-
-  if (value.startsWith('kv://')) {
-    location = 'keyvault';
-    required = true;
-  }
-
-  // Check if it's a sensitive variable
-  const sensitiveKeys = ['password', 'secret', 'key', 'token', 'auth'];
-  if (sensitiveKeys.some(sensitive => key.toLowerCase().includes(sensitive))) {
-    required = true;
-  }
-
-  if (location === 'keyvault' && value.startsWith('kv://')) {
-    try {
-      const { getInfraParameterCatalog } = require('../parameters/infra-parameter-catalog');
-      const catalog = getInfraParameterCatalog();
-      if (catalog.isKeyAllowedEmpty(value.slice('kv://'.length))) {
-        required = false;
-      }
-    } catch {
-      // Keep the conservative required=true default when the catalog is unavailable.
-    }
-  }
-
-  return { location, required };
+function determineVariableLocation(value) {
+  return value.startsWith('kv://') ? 'keyvault' : 'variable';
 }
 
 /**
@@ -251,11 +249,10 @@ function determineVariableLocation(value, key) {
  * @param {string} key - Variable key
  * @param {string} value - Variable value
  * @param {string} location - Variable location
- * @param {boolean} required - Whether variable is required
- * @param {Map} portalInputMap - Map of portalInput configurations
+ * @param {Map} applicationConfigMap - Explicit application.yaml configuration
  * @returns {Object} Configuration item
  */
-function createConfigItem(key, value, location, required, portalInputMap) {
+function createConfigItem(key, value, location, applicationConfigMap) {
   let storedValue = value;
   if (location === 'keyvault') {
     if (value.startsWith('kv://')) {
@@ -263,6 +260,11 @@ function createConfigItem(key, value, location, required, portalInputMap) {
     }
   }
 
+  const overlay = applicationConfigMap.get(key);
+  const required =
+    typeof overlay?.required === 'boolean'
+      ? overlay.required
+      : location === 'keyvault' && baselineRequiredForVaultKey(storedValue);
   const configItem = {
     name: key,
     value: storedValue,
@@ -270,10 +272,8 @@ function createConfigItem(key, value, location, required, portalInputMap) {
     required
   };
 
-  // Merge portalInput / category if present in application config
-  if (portalInputMap.has(key)) {
-    const overlay = portalInputMap.get(key);
-    configItem.portalInput = overlay.portalInput;
+  if (overlay) {
+    if (overlay.portalInput) configItem.portalInput = overlay.portalInput;
     if (typeof overlay.category === 'string' && overlay.category.length > 0) {
       configItem.category = overlay.category;
     }
@@ -285,20 +285,19 @@ function createConfigItem(key, value, location, required, portalInputMap) {
 function parseEnvironmentVariables(envTemplate, variablesConfig = null) {
   const configuration = [];
   const lines = envTemplate.split('\n');
-  const portalInputMap = createPortalInputMap(variablesConfig);
+  const applicationConfigMap = createApplicationConfigMap(variablesConfig);
   for (const line of lines) {
     const parsed = parseEnvironmentVariableLine(line);
     if (!parsed) {
       continue;
     }
 
-    const { location, required } = determineVariableLocation(parsed.value, parsed.key);
+    const location = determineVariableLocation(parsed.value);
     const configItem = createConfigItem(
       parsed.key,
       parsed.value,
       location,
-      required,
-      portalInputMap
+      applicationConfigMap
     );
     configuration.push(configItem);
   }

package/lib/generator/split-variables.js

@@ -57,7 +57,7 @@ function extractOptionalSections(deployment) {
   const names = [
     'healthCheck', 'authentication', 'build', 'repository', 'deployment',
     'startupCommand', 'runtimeVersion', 'scaling', 'frontDoorRouting',
-    'environmentScopedResources'
+    'environmentScopedResources', 'required'
   ];
   for (const sectionName of names) {
     extractOptionalSection(deployment, sectionName, optional);
@@ -66,19 +66,25 @@ function extractOptionalSections(deployment) {
 }
 
 /**
- * Portal-only configuration for application.yaml (name + optional category + portalInput).
+ * Explicit application configuration metadata for application.yaml.
+ * required=false remains the default and is omitted.
  * @param {Array} configuration - Configuration array from deployment JSON
- * @returns {Array<{ name: string, category?: string, portalInput: Object }>}
+ * @returns {Array<{ name: string, category?: string, required?: boolean, portalInput?: Object }>}
  */
 function extractPortalInputConfiguration(configuration) {
   if (!Array.isArray(configuration) || configuration.length === 0) return [];
   return configuration
-    .filter(item => item && item.portalInput && typeof item.name === 'string')
+    .filter(item => item && typeof item.name === 'string' && (
+      item.portalInput || item.required === true ||
+      (typeof item.category === 'string' && item.category.trim().length > 0)
+    ))
     .map(item => {
-      const entry = { name: item.name, portalInput: item.portalInput };
+      const entry = { name: item.name };
+      if (item.portalInput) entry.portalInput = item.portalInput;
       if (typeof item.category === 'string' && item.category.trim().length > 0) {
         entry.category = item.category.trim();
       }
+      if (item.required === true) entry.required = true;
       return entry;
     });
 }

package/lib/internal/fs-real-sync.js

@@ -137,8 +137,37 @@ function appendFileSync(p, data, opts) {
   return delegate('appendFileSync', opts !== undefined ? [p, data, opts] : [p, data]);
 }
 
+/**
+ * @param {string} p
+ * @param {number|string} mode
+ * @returns {void}
+ */
+function chmodSync(p, mode) {
+  return delegate('chmodSync', [p, mode]);
+}
+
+/**
+ * @param {string} p
+ * @returns {import('node:fs').Stats}
+ */
+function lstatSync(p) {
+  return delegate('lstatSync', [p]);
+}
+
+/**
+ * @param {string} from
+ * @param {string} to
+ * @returns {void}
+ */
+function renameSync(from, to) {
+  return delegate('renameSync', [from, to]);
+}
+
 module.exports = {
   existsSync,
+  chmodSync,
+  lstatSync,
+  renameSync,
   readFileSync,
   readFileSyncDirect,
   writeFileSync,

package/lib/role-assistant/package-validate.js

@@ -10,6 +10,7 @@ const fs = require('../internal/fs-real-sync');
 const { validateExternalFile, parseJsonFileContent } = require('../validation/validate-external-file');
 const { listTestCaseFiles } = require('./test-cases');
 const { validateTestCaseFile } = require('./test-case-validate');
+const { shouldSkipEvidencePayload } = require('./evidence-sync');
 
 const SETTINGS_TYPE = 'role-assistant-settings';
 const EMPTY_TESTS_SKIP = 'tests/: skipped (no test cases)';
@@ -59,6 +60,9 @@ function validateEvidenceJsonFile(filePath) {
   if (parseResult.error) {
     return { ...parseResult.error, file: filePath, type: 'evidence' };
   }
+  if (shouldSkipEvidencePayload(filePath, parseResult.parsed)) {
+    return { valid: true, errors: [], warnings: [], file: filePath, type: 'evidence' };
+  }
   const rows = evidenceRows(parseResult.parsed);
   const errors = [];
   if (!rows) {