@aifabrix/builder 2.57.0 → 2.59.0

package/lib/commands/dev-show-display.js

@@ -336,6 +336,8 @@ function logConfigurationSection(p) {
   logRow('Environment', p.environment);
   logRow('Controller', p.controller);
   logRow('Format', p.formatVal);
+  logRow('Registry', p.registry);
+  if (p.registry) logRow('Registry login', p.registryCredentials);
   logRow('Platform mode', p.setupPlatformMode);
   logRow('Traefik', p.traefikEnabled ? 'on' : 'off');
   logRow('Scoped resources', p.scopedResourcesLabel);
@@ -389,14 +391,16 @@ async function loadDevShowData(devIdStr) {
   const ports = devConfig.getDevPorts(Number.isNaN(devIdNum) ? 0 : devIdNum);
   const [
     environment, tlsEnabled, controller, formatRaw, useScoped, secretsRaw, setupPlatformMode, traefikEnabled,
-    remoteServer, dockerEndpoint, dockerTlsSkipVerify, mutagenFolder, syncSshUser, syncSshHost
+    remoteServer, dockerEndpoint, dockerTlsSkipVerify, mutagenFolder, syncSshUser, syncSshHost, registry
   ] = await Promise.all([
     config.getCurrentEnvironment(), config.getTlsEnabled(), config.getControllerUrl(),
     config.getFormat(), config.getUseEnvironmentScopedResources(), config.getAifabrixSecretsPath(),
     config.getSetupPlatformMode(), config.getTraefikEnabled(),
     config.getRemoteServer(), config.getDockerEndpoint(), config.getDockerTlsSkipVerify(),
-    config.getUserMutagenFolder(), config.getSyncSshUser(), config.getSyncSshHost()
+    config.getUserMutagenFolder(), config.getSyncSshUser(), config.getSyncSshHost(),
+    config.getRegistry ? config.getRegistry() : null
   ]);
+  const { registryCredentialLabel } = require('./dev-registry');
   const urlsLocalPath = getUrlsLocalYamlPath();
   const scopedResourcesLabel = useScoped ? 'on' : 'off (default)';
   const workResolved = paths.getAifabrixWork();
@@ -412,6 +416,8 @@ async function loadDevShowData(devIdStr) {
     tlsEnabled,
     controller,
     formatVal: formatRaw ?? null,
+    registry: registry || null,
+    registryCredentials: registryCredentialLabel(registry || null),
     scopedResourcesLabel,
     setupPlatformMode,
     traefikEnabled,
@@ -451,6 +457,8 @@ function renderDevShow(data) {
     tlsEnabled: data.tlsEnabled,
     controller: data.controller,
     formatVal: data.formatVal,
+    registry: data.registry,
+    registryCredentials: data.registryCredentials,
     setupPlatformMode: data.setupPlatformMode,
     traefikEnabled: data.traefikEnabled,
     scopedResourcesLabel: data.scopedResourcesLabel,

package/lib/commands/governance-verify-external.js

@@ -10,7 +10,7 @@ const {
   aggregateCoverage,
   buildPackOverrideResult
 } = require('./verify-governance-result-builders');
-const { VERDICT, verdictFromPassed } = require('../lifecycle/product-model');
+const { VERDICT } = require('../lifecycle/product-model');
 
 /**
  * @async
@@ -43,14 +43,21 @@ async function runGovernanceVerifyForExternalSystem(systemKey, options = {}) {
     };
   }
 
-  const allVerified = datasourceRows.every(r => r.verdict === VERDICT.VERIFIED);
+  const allNotApplicable = datasourceRows.every(
+    r => r.verdict === VERDICT.NOT_APPLICABLE
+  );
+  const allClosed = datasourceRows.every(
+    r => r.verdict === VERDICT.VERIFIED || r.verdict === VERDICT.NOT_APPLICABLE
+  );
   const coverage = aggregateCoverage(datasourceRows);
   return {
     systemKey: resolvedKey,
     command: 'governance verify',
-    verdict: verdictFromPassed(allVerified),
-    policyCoveragePercent: coverage.policy ?? (allVerified ? 100 : 0),
-    dimensionCoveragePercent: coverage.dimension ?? (allVerified ? 100 : 0),
+    verdict: allNotApplicable
+      ? VERDICT.NOT_APPLICABLE
+      : (allClosed ? VERDICT.VERIFIED : VERDICT.FAILED),
+    policyCoveragePercent: coverage.policy ?? (allClosed ? 100 : 0),
+    dimensionCoveragePercent: coverage.dimension ?? (allClosed ? 100 : 0),
     enforcementScenarios: sumEnforcementScenarios(datasourceRows),
     datasourceRows
   };

package/lib/commands/repair-datasource.js

@@ -16,11 +16,12 @@ const {
   repairNoneLlmToServiceContract,
   stripDeprecatedServiceCategory
 } = require('./repair-datasource-service-contract');
+const {
+  DEFAULT_DATASOURCE_SYNC,
+  createDefaultDatasourceSync
+} = require('../datasource/sync-defaults');
 
-const DEFAULT_SYNC = {
-  mode: 'pull',
-  batchSize: 500
-};
+const DEFAULT_SYNC = DEFAULT_DATASOURCE_SYNC;
 
 const MINIMAL_METADATA_SCHEMA = {
   type: 'object',
@@ -348,7 +349,7 @@ function repairExposeFromAttributes(parsed, changes) {
 }
 
 /**
- * Adds default sync section if missing or empty. Not applied for entityType 'none'.
+ * Adds a default sync section only when absent. Not applied for entityType 'none'.
  *
  * @param {Object} parsed - Parsed datasource (mutated)
  * @param {string[]} changes - Change log
@@ -356,10 +357,9 @@ function repairExposeFromAttributes(parsed, changes) {
  */
 function repairSyncSection(parsed, changes) {
   if (isNoneEntityType(parsed?.entityType)) return false;
-  const sync = parsed.sync;
-  if (sync && typeof sync === 'object' && Object.keys(sync).length > 0) return false;
-  parsed.sync = { ...DEFAULT_SYNC };
-  changes.push('Added default sync section (mode: pull, batchSize: 500)');
+  if (Object.prototype.hasOwnProperty.call(parsed, 'sync')) return false;
+  parsed.sync = createDefaultDatasourceSync();
+  changes.push('Added default sync section (enabled: true, mode: pull, schedule: @monthly UTC, batchSize: 500)');
   return true;
 }
 

package/lib/commands/repair.js

@@ -1,11 +1,11 @@
 /**
- * Repair external integration config: fix drift between config and files on disk.
+ * Repair application documentation and external integration configuration drift.
  *
  * Aligns application.yaml with actual system/datasource files, fixes system key mismatch,
  * creates missing externalIntegration block, extracts rbac.yaml from system when needed,
  * and regenerates the deployment manifest.
  *
- * @fileoverview Repair external integration drift
+ * @fileoverview Repair application README or external integration drift
  * @author AI Fabrix Team
  * @version 2.0.0
  */
@@ -13,6 +13,10 @@
 'use strict';
 
 const fs = require('fs');
+const path = require('path');
+const { generateReadmeMd } = require('../app/readme');
+const { backupIntegrationFile } = require('../utils/integration-file-backup');
+const { trackRepairWrite } = require('./repair-changed-files');
 const { detectAppType } = require('../utils/paths');
 const { resolveApplicationConfigPath } = require('../utils/app-config-resolver');
 const { loadConfigFile, isYamlPath } = require('../utils/config-format');
@@ -43,7 +47,7 @@ function loadConfigAndDiscover(appPath, configPath) {
  * Validates repair inputs and resolves app path and config path.
  * @param {string} appName - Application name
  * @param {Object} options - Command options (auth)
- * @returns {Promise<{ appPath: string, configPath: string, dryRun: boolean, authOption: string|undefined }>}
+ * @returns {Promise<{ appPath: string, configPath: string, dryRun: boolean, authOption: string|undefined, isExternal: boolean }>}
  */
 async function validateAndResolveRepairPaths(appName, options) {
   if (!appName || typeof appName !== 'string') throw new Error('App name is required');
@@ -52,10 +56,42 @@ async function validateAndResolveRepairPaths(appName, options) {
     throw new Error('Option --auth must be a string');
   }
   const { appPath, isExternal } = await detectAppType(appName, options);
-  if (!isExternal) throw new Error(`App '${appName}' is not an external integration`);
+  if (!isExternal) validateApplicationRepairOptions(appName, options);
   const configPath = resolveApplicationConfigPath(appPath);
   if (!fs.existsSync(configPath)) throw new Error(`Application config not found: ${configPath}`);
-  return { appPath, configPath, dryRun, authOption };
+  return { appPath, configPath, dryRun, authOption, isExternal };
+}
+
+/** Validate the documentation-only repair supported for normal applications. */
+function validateApplicationRepairOptions(appName, options) {
+  const integrationOptions = ['all', 'api', 'auth', 'rbac', 'expose', 'sync', 'test',
+    'splitDatasources', 'rbacPreset', 'authWebhook', 'authSync'];
+  if (!options.doc || integrationOptions.some(key => options[key] !== undefined && options[key] !== false && options[key] !== null)) {
+    throw new Error(`App '${appName}' is not an external integration. Normal applications support repair --doc only (with --dry-run or --no-backup).`);
+  }
+}
+
+/** Regenerate a normal application's README using its current local configuration. */
+function repairApplicationReadme(appName, appPath, configPath, backupCtx) {
+  const variables = loadConfigFile(configPath);
+  const content = generateReadmeMd(appName, { ...variables, ...variables.app });
+  const readmePath = path.join(appPath, 'README.md');
+  trackRepairWrite(readmePath, backupCtx);
+  if (!backupCtx.dryRun) {
+    backupIntegrationFile(readmePath, backupCtx);
+    fs.writeFileSync(readmePath, content, { mode: 0o644, encoding: 'utf8' });
+  }
+  return {
+    updated: true,
+    applicationReadme: true,
+    actionsPerformed: true,
+    readmeRegenerated: true,
+    manifestRegenerated: false,
+    changes: ['Regenerated README.md from application configuration'],
+    changedFiles: backupCtx.dryRun ? backupCtx.wouldChangeFiles : backupCtx.changedFiles,
+    backupPaths: backupCtx.backupPaths,
+    warnings: []
+  };
 }
 
 /**
@@ -79,17 +115,18 @@ function createRepairBackupContext(options, dryRun) {
 }
 
 /**
- * Repairs external integration config: syncs files, aligns keys, creates rbac, regenerates manifest
+ * Repairs external integration config or regenerates a normal application's README.
  * @async
  * @param {string} appName - Application/integration name
  * @param {Object} [options] - Options
  * @param {boolean} [options.dryRun] - If true, only report changes; do not write
- * @param {boolean} [options.doc] - If true, regenerate README.md from deployment manifest
+ * @param {boolean} [options.doc] - Regenerate README.md from application config or integration deployment manifest
  * @returns {Promise<Object>}
  */
 async function repairExternalIntegration(appName, options = {}) {
-  const { appPath, configPath, dryRun, authOption } = await validateAndResolveRepairPaths(appName, options);
+  const { appPath, configPath, dryRun, authOption, isExternal } = await validateAndResolveRepairPaths(appName, options);
   const { backupPaths, backupCtx } = createRepairBackupContext(options, dryRun);
+  if (!isExternal) return repairApplicationReadme(appName, appPath, configPath, backupCtx);
   const loaded = loadConfigAndDiscover(appPath, configPath);
   return runRepairExternalIntegration({
     appName,

package/lib/commands/setup-image-refresh.js

@@ -21,9 +21,30 @@ const infraHelpers = require('../infrastructure/helpers');
 const upCommon = require('./up-common');
 const { sectionTitle, formatDatasourceListRow } = require('../utils/cli-test-layout-chalk');
 const { startSpinner, stopSpinnerSuccess } = require('./setup-spinners');
+const { ensureLoginForImageRefs } = require('../utils/registry-credentials');
 
 const PLATFORM_APPS = ['keycloak', 'miso-controller', 'dataplane'];
 
+/**
+ * `image:` values of a compose file (plain scan; variables are left unresolved and skipped).
+ * @param {string} composePath - Compose file path
+ * @returns {string[]}
+ */
+function readComposeImageRefs(composePath) {
+  let text = '';
+  try {
+    text = String(fs.readFileSync(composePath, 'utf8') || '');
+  } catch {
+    return [];
+  }
+  const refs = [];
+  for (const line of text.split(/\r?\n/)) {
+    const match = line.match(/^\s*image:\s*["']?([^"'\s#]+)["']?/);
+    if (match && !match[1].includes('$')) refs.push(match[1]);
+  }
+  return refs;
+}
+
 /**
  * Pull infra-compose images (postgres, redis, optional pgadmin/redis-commander/traefik).
  *
@@ -42,6 +63,8 @@ async function pullInfraImages(opts = {}) {
     }
     return;
   }
+  // Authenticate once per private registry host before compose pulls (stored pairs only).
+  await ensureLoginForImageRefs(readComposeImageRefs(composePath));
   const project = infraHelpers.getInfraProjectName(devId);
   const composeCmd = await dockerUtils.getComposeCommand();
   if (!quiet) {
@@ -91,6 +114,8 @@ async function pullPlatformAppImage(appName, opts = {}) {
     }
     return false;
   }
+  // A partial stored credential pair fails closed here instead of degrading to a warning.
+  await ensureLoginForImageRefs([imageRef]);
   try {
     if (!quiet) {
       const spin = startSpinner(`Pulling ${appName} image...`);
@@ -142,5 +167,6 @@ module.exports = {
   PLATFORM_APPS,
   pullInfraImages,
   pullPlatformImages,
+  readComposeImageRefs,
   runSetupImageRefresh
 };

package/lib/commands/upload-qualification-client.js

@@ -1,6 +1,6 @@
 /**
  * @fileoverview Resumable Dataplane qualification upload: accept, --wait/--no-wait, poll, resume.
- * Mirrors dev-host-ops.js's job id + wait/no-wait contract (plan 191.0 task 1). Never invents
+ * Mirrors dev-host-ops.js's job id + wait/no-wait contract. Never invents
  * qualification truth — accept/poll surface exactly what Dataplane returns.
  * @author AI Fabrix Team
  * @version 1.0.0
@@ -12,13 +12,38 @@ const logger = require('../utils/logger');
 const { formatSuccessLine, formatWarningLine } = require('../utils/cli-test-layout-chalk');
 const { formatApiError } = require('../utils/api-error-handler');
 const { uploadApplicationViaPipelineWithAuthRetry } = require('../utils/pipeline-upload-auth-retry');
-const { pollQualificationJobUntilTerminal } = require('./upload-qualification-poll');
+const { pollQualificationJobUntilTerminal, requireQualificationSuccess,
+  isTransientQualificationPollError } = require('./upload-qualification-poll');
 const { createQualificationPollHandlers } = require('../utils/qualification-poll-ui');
 
+function isAmbiguousAcceptance(error) {
+  const status = error?.response?.status || error?.statusCode || error?.status;
+  const code = error?.cause?.code || error?.code;
+  return isTransientQualificationPollError(status) || (!status && (
+    error instanceof TypeError || ['AbortError', 'TimeoutError'].includes(error?.name) ||
+    ['ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT', 'EAI_AGAIN', 'ENOTFOUND',
+      'ECONNABORTED', 'UND_ERR_CONNECT_TIMEOUT'].includes(code)
+  ));
+}
+
+async function submitQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options) {
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      const res = await uploadApplicationViaPipelineWithAuthRetry(
+        dataplaneUrl, authConfig, payload, systemKey, options
+      );
+      if (res?.success !== false || !isTransientQualificationPollError(res.status) || attempt === 1) {
+        return res;
+      }
+    } catch (error) {
+      if (!isAmbiguousAcceptance(error) || attempt === 1) throw error;
+    }
+  }
+}
+
 /**
- * Ctrl-C / disconnect during polling must detach without corrupting truth (plan 191.0 task 4):
- * the qualification job keeps running on Dataplane regardless of whether this CLI process exits.
- * This only makes that safe fact visible, printing the resume command before exiting 130.
+ * Ctrl-C detaches from status following without asserting an unobserved job outcome.
+ * Prints the resume command before exiting 130.
  * @param {string} jobId
  * @param {string} systemKey
  * @returns {() => void} Call to remove the listeners once polling finishes normally.
@@ -27,7 +52,7 @@ function registerUploadInterruptHint(jobId, systemKey) {
   const onSignal = () => {
     logger.log(
       formatWarningLine(
-        `Interrupted — upload job ${jobId} is still running, unaffected. Resume with: aifabrix upload ${systemKey} --resume ${jobId}`
+        `Stopped following upload job ${jobId}; its current outcome is unknown. Resume with: aifabrix upload ${systemKey} --resume ${jobId}`
       )
     );
     process.exit(130);
@@ -52,12 +77,24 @@ function registerUploadInterruptHint(jobId, systemKey) {
  * @returns {Promise<{jobId: string, state: string, resumed: boolean, candidateFingerprint: string}>}
  */
 async function acceptQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options = {}) {
-  const res = await uploadApplicationViaPipelineWithAuthRetry(dataplaneUrl, authConfig, payload, systemKey, {
-    ...options,
-    async: true
-  });
+  let res;
+  try {
+    res = await submitQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, {
+      ...options,
+      async: true
+    });
+  } catch (error) {
+    if (!isAmbiguousAcceptance(error)) throw error;
+    const unknown = new Error('Upload acceptance outcome is unknown. Rerun the same upload command to recover the job.');
+    unknown.cause = error;
+    unknown.statusCode = error?.response?.status || error?.statusCode || error?.status;
+    throw unknown;
+  }
   if (res?.success === false) {
-    const err = new Error(formatApiError(res, dataplaneUrl));
+    const ambiguous = isTransientQualificationPollError(res.status);
+    const err = new Error(ambiguous
+      ? 'Upload acceptance outcome is unknown. Rerun the same upload command to recover the job.'
+      : formatApiError(res, dataplaneUrl));
     const status = Number(res.status || res.statusCode);
     err.statusCode = status >= 400 && status < 600 ? status : 400;
     throw err;
@@ -107,6 +144,14 @@ async function resumeQualificationUpload(dataplaneUrl, authConfig, jobId, system
  */
 async function runQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options = {}) {
   const accepted = await acceptQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options);
+  if (accepted.state === 'completed' || accepted.state === 'failed') {
+    requireQualificationSuccess(accepted);
+    return {
+      ...accepted,
+      candidateFingerprint: accepted.result?.candidateFingerprint,
+      terminal: accepted
+    };
+  }
   const wait = options.wait !== false;
   if (!wait) {
     if (options.json) {

package/lib/commands/upload-qualification-poll.js

@@ -1,5 +1,5 @@
 /**
- * @fileoverview Poll a Dataplane qualification (publish) job until terminal (plan 191.0 task 1).
+ * @fileoverview Poll a Dataplane qualification job while retaining resumable identity.
  * Never invents success and never marks the candidate failed just because the CLI stopped polling —
  * timing out returns a resumable jobId instead.
  * @author AI Fabrix Team
@@ -13,7 +13,7 @@ const { formatApiError } = require('../utils/api-error-handler');
 
 const POLL_INTERVAL_MS = 3000;
 const POLL_TIMEOUT_MS = 30 * 60 * 1000;
-const TRANSIENT_HTTP_STATUSES = new Set([502, 503, 504]);
+const TRANSIENT_HTTP_STATUSES = new Set([429, 502, 503, 504]);
 const MAX_TRANSIENT_POLL_ERRORS = 20;
 
 const GOVERNANCE_SCENARIOS_MISSING = 'GOVERNANCE_SCENARIOS_MISSING';
@@ -46,6 +46,17 @@ function formatQualificationJobFailure(job) {
   };
 }
 
+/** Throw only for an authoritative stored failure, retaining the original job. */
+function requireQualificationSuccess(job) {
+  if (job.state !== 'failed') return;
+  const failure = formatQualificationJobFailure(job);
+  const err = new Error(failure.message);
+  err.jobId = job.jobId;
+  err.job = job;
+  err.skipDoctor = failure.userFacing;
+  throw err;
+}
+
 /**
  * @param {number|string} status
  * @returns {boolean}
@@ -54,6 +65,35 @@ function isTransientQualificationPollError(status) {
   return TRANSIENT_HTTP_STATUSES.has(Number(status));
 }
 
+/** Preserve the accepted identity without asserting a business outcome. */
+function unavailableJob(jobId, message) {
+  const error = new Error(
+    `${message} Job ${jobId}: status unavailable. Resume with: aifabrix upload <systemKey> --resume ${jobId}`
+  );
+  error.jobId = jobId;
+  error.resumable = true;
+  return error;
+}
+
+/** Normalize transport exceptions so returned HTTP errors and throws share retries. */
+async function readQualificationJob(dataplaneUrl, authConfig, jobId) {
+  try {
+    return await getPublishJobStatus(dataplaneUrl, authConfig, jobId);
+  } catch (error) {
+    const status = error?.response?.status || error?.statusCode || error?.status;
+    const code = error?.cause?.code || error?.code;
+    const network = ['ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT', 'EAI_AGAIN',
+      'ENOTFOUND', 'ECONNABORTED', 'UND_ERR_CONNECT_TIMEOUT'].includes(code) ||
+      error instanceof TypeError || ['AbortError', 'TimeoutError'].includes(error?.name);
+    if (isTransientQualificationPollError(status) || (!status && network)) {
+      return { success: false, status: status || 503 };
+    }
+    const failure = unavailableJob(jobId, 'Unable to check upload progress.');
+    failure.statusCode = status;
+    throw failure;
+  }
+}
+
 /**
  * @param {string} dataplaneUrl
  * @param {Object} authConfig
@@ -64,19 +104,19 @@ function isTransientQualificationPollError(status) {
 async function fetchQualificationJobWithRetry(dataplaneUrl, authConfig, jobId, pollUi = {}) {
   const started = Date.now();
   for (let attempt = 0; attempt <= MAX_TRANSIENT_POLL_ERRORS; attempt += 1) {
-    const res = await getPublishJobStatus(dataplaneUrl, authConfig, jobId);
+    const res = await readQualificationJob(dataplaneUrl, authConfig, jobId);
     if (res?.success !== false) {
       return res.data;
     }
     if (!isTransientQualificationPollError(res.status)) {
-      const err = new Error(formatApiError(res, dataplaneUrl));
+      const err = unavailableJob(jobId, formatApiError(res, dataplaneUrl));
       const status = Number(res.status);
       err.statusCode = status >= 400 && status < 600 ? status : 400;
       throw err;
     }
     if (attempt >= MAX_TRANSIENT_POLL_ERRORS) {
-      throw new Error(
-        `The upload service returned HTTP ${res.status} repeatedly while waiting for job ${jobId}.`
+      throw unavailableJob(
+        jobId, `The upload service returned HTTP ${res.status} repeatedly.`
       );
     }
     if (typeof pollUi.onTransientError === 'function') {
@@ -84,13 +124,13 @@ async function fetchQualificationJobWithRetry(dataplaneUrl, authConfig, jobId, p
     }
     await sleep(POLL_INTERVAL_MS);
   }
-  throw new Error(`Failed to check upload job ${jobId} after transient retries`);
+  throw unavailableJob(jobId, 'Status retries exhausted.');
 }
 
 /**
  * Poll a Dataplane qualification job to terminal state (completed|failed). The timeout only
  * bounds how long *this CLI process* waits — Dataplane keeps running the job regardless; timing
- * out returns a resumable jobId, never a fabricated failure (plan 191.0 task 4).
+ * out returns a resumable jobId, never a fabricated failure.
  * @param {string} dataplaneUrl
  * @param {Object} authConfig
  * @param {string} jobId
@@ -112,25 +152,13 @@ async function pollQualificationJobUntilTerminal(
     if (typeof pollUi.onPollProgress === 'function') {
       pollUi.onPollProgress(job);
     }
-    if (job.state === 'failed') {
-      const failure = formatQualificationJobFailure(job);
-      const err = new Error(failure.message);
-      err.jobId = jobId;
-      err.job = job;
-      err.skipDoctor = failure.userFacing;
-      throw err;
-    }
+    requireQualificationSuccess(job);
     if (job.state === 'completed') {
       return job;
     }
     await sleep(POLL_INTERVAL_MS);
   }
-  const timeoutErr = new Error(
-    `Timed out waiting for upload job ${jobId}. It is still running — resume with: aifabrix upload <systemKey> --resume ${jobId}`
-  );
-  timeoutErr.jobId = jobId;
-  timeoutErr.resumable = true;
-  throw timeoutErr;
+  throw unavailableJob(jobId, 'Timed out waiting for upload progress.');
 }
 
 module.exports = {
@@ -139,5 +167,6 @@ module.exports = {
   isTransientQualificationPollError,
   fetchQualificationJobWithRetry,
   formatQualificationJobFailure,
+  requireQualificationSuccess,
   pollQualificationJobUntilTerminal
 };

package/lib/commands/wizard-dataplane.js

@@ -4,43 +4,11 @@
  * @version 2.0.0
  */
 
-const chalk = require('chalk');
 const logger = require('../utils/logger');
 const { formatProgress, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 const { getDataplaneUrl } = require('../datasource/deploy');
-const { listEnvironmentApplications } = require('../api/environments.api');
 
-/**
- * Find dataplane service application key from environment applications list
- * @async
- * @function findDataplaneServiceAppKey
- * @param {string} controllerUrl - Controller URL
- * @param {string} environment - Environment key
- * @param {Object} authConfig - Authentication configuration
- * @returns {Promise<string|null>} Dataplane service appKey or null if not found
- */
-// eslint-disable-next-line complexity
-async function findDataplaneServiceAppKey(controllerUrl, environment, authConfig) {
-  try {
-    const response = await listEnvironmentApplications(controllerUrl, environment, authConfig, { pageSize: 100 });
-    if (!response.success || !response.data) return null;
-    const applications = response.data.data || response.data || [];
-    for (const app of applications) {
-      const appKey = app.key || app.id;
-      if (!appKey) continue;
-      const keyLower = appKey.toLowerCase();
-      const appType = app.configuration?.type || app.type;
-      const nameLower = (app.displayName || app.name || '').toLowerCase();
-      if (keyLower === 'dataplane' || keyLower.includes('dataplane') || (appType === 'service' && nameLower.includes('dataplane'))) {
-        return appKey;
-      }
-    }
-    return null;
-  } catch (error) {
-    logger.log(chalk.gray(`  Could not list applications: ${error.message}`));
-    return null;
-  }
-}
+const DATAPLANE_APPLICATION_KEY = 'dataplane';
 
 /**
  * Check if error is a "Not Found" error
@@ -65,7 +33,7 @@ function createDataplaneNotFoundError() {
 }
 
 /**
- * Try to get dataplane URL using fallback app key
+ * Get dataplane URL from the canonical controller application key.
  * @async
  * @param {string} controllerUrl - Controller URL
  * @param {string} environment - Environment key
@@ -73,18 +41,23 @@ function createDataplaneNotFoundError() {
  * @returns {Promise<string>} Dataplane URL
  * @throws {Error} If dataplane URL cannot be retrieved
  */
-async function tryFallbackDataplaneUrl(controllerUrl, environment, authConfig, silent) {
+async function getExactDataplaneUrl(controllerUrl, environment, authConfig, silent) {
   try {
-    const fallbackUrl = await getDataplaneUrl(controllerUrl, 'dataplane', environment, authConfig);
+    const dataplaneUrl = await getDataplaneUrl(
+      controllerUrl,
+      DATAPLANE_APPLICATION_KEY,
+      environment,
+      authConfig
+    );
     if (!silent) {
-      logger.log(formatSuccessLine(`Dataplane URL: ${fallbackUrl}`));
+      logger.log(formatSuccessLine(`Dataplane URL: ${dataplaneUrl}`));
     }
-    return fallbackUrl;
-  } catch (fallbackError) {
-    if (isNotFoundError(fallbackError)) {
+    return dataplaneUrl;
+  } catch (error) {
+    if (isNotFoundError(error)) {
       throw createDataplaneNotFoundError();
     }
-    throw fallbackError;
+    throw error;
   }
 }
 
@@ -105,15 +78,7 @@ async function discoverDataplaneUrl(controllerUrl, environment, authConfig, opts
     logger.log(formatProgress('Getting dataplane URL from controller...'));
   }
   try {
-    const dataplaneAppKey = await findDataplaneServiceAppKey(controllerUrl, environment, authConfig);
-    if (dataplaneAppKey) {
-      const dataplaneUrl = await getDataplaneUrl(controllerUrl, dataplaneAppKey, environment, authConfig);
-      if (!silent) {
-        logger.log(formatSuccessLine(`Dataplane URL: ${dataplaneUrl}`));
-      }
-      return dataplaneUrl;
-    }
-    return await tryFallbackDataplaneUrl(controllerUrl, environment, authConfig, silent);
+    return await getExactDataplaneUrl(controllerUrl, environment, authConfig, silent);
   } catch (error) {
     if (error.message.includes('Could not discover dataplane URL')) {
       throw error;
@@ -126,6 +91,5 @@ async function discoverDataplaneUrl(controllerUrl, environment, authConfig, opts
 }
 
 module.exports = {
-  discoverDataplaneUrl,
-  findDataplaneServiceAppKey
+  discoverDataplaneUrl
 };

package/lib/core/config-attach-extensions.js

@@ -1,5 +1,5 @@
 /**
- * Attach token, path, format, and scoped-resources helpers to config exports.
+ * Attach token, path, format, scoped-resources, and registry helpers to config exports.
  *
  * @fileoverview Keeps lib/core/config.js under max-lines
  * @author AI Fabrix Team
@@ -42,6 +42,9 @@ function attachConfigExtensions(exportsObj, deps) {
   const { createScopedResourcesPreferenceFunctions } = require('../utils/config-scoped-resources-preference');
   Object.assign(exportsObj, createScopedResourcesPreferenceFunctions(getConfig, saveConfig));
 
+  const { createRegistryPreferenceFunctions } = require('../utils/config-registry-preference');
+  Object.assign(exportsObj, createRegistryPreferenceFunctions(getConfig, saveConfig));
+
   const { createSecretsPathFunctions } = require('../utils/config-secrets-path');
   Object.assign(exportsObj, createSecretsPathFunctions(getConfig, saveConfig));
 }