@aifabrix/builder 2.57.0 → 2.59.0

package/lib/deployment/installation/infra-catalog.js

@@ -20,6 +20,9 @@ const LICENSE_EDITIONS = Object.freeze(['COMMUNITY', 'STANDARD', 'ENTERPRISE']);
 const DEFAULT_LICENSE_EDITION = 'COMMUNITY';
 const ONBOARDING_MODES = Object.freeze(['saasDirect', 'customerOwned']);
 const DEFAULT_ONBOARDING_MODE = 'saasDirect';
+const ACR_AUTH_MODES = Object.freeze(['auto', 'mi', 'credentials']);
+const DEFAULT_ACR_AUTH = 'auto';
+const AZURE_LOCATION = /^[a-z0-9]{2,40}$/;
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
 /**
@@ -36,6 +39,45 @@ function normalizeLicenseEdition(value) {
   throw new Error(`License edition must be one of ${LICENSE_EDITIONS.join(', ')} or an Azure Marketplace subscription ID`);
 }
 
+/**
+ * Normalizes requested ACR image-pull auth: auto (default), mi, or credentials.
+ * `admin` (and its spellings) is a deprecated alias for `credentials`.
+ * @param {string} value - Raw value
+ * @returns {string} Canonical mode
+ */
+function normalizeAcrAuth(value) {
+  const raw = String(value ?? '').trim();
+  const aliases = {
+    auto: 'auto',
+    mi: 'mi',
+    'managed-identity': 'mi',
+    managedidentity: 'mi',
+    credentials: 'credentials',
+    admin: 'credentials',
+    adminuser: 'credentials',
+    'admin-user': 'credentials',
+    password: 'credentials'
+  };
+  const mode = aliases[raw.toLowerCase()];
+  if (!mode) {
+    throw new Error(`ACR auth must be one of ${ACR_AUTH_MODES.join(', ')} (deprecated alias: admin = credentials)`);
+  }
+  return mode;
+}
+
+/**
+ * Validates an Azure region name (for example swedencentral).
+ * @param {string} value - Raw value
+ * @returns {string} Lower-case region
+ */
+function normalizeAzureLocation(value) {
+  const location = String(value ?? '').trim().toLowerCase();
+  if (!AZURE_LOCATION.test(location)) {
+    throw new Error(`--location must be an Azure region name such as swedencentral (letters and digits only); got "${value}"`);
+  }
+  return location;
+}
+
 const PARAMETER_CATALOG = Object.freeze({
   infrastructureNameOverride: { kind: 'file', source: 'user', description: 'Optional infrastructure-name override; empty uses generated naming.' },
   location: { kind: 'file', source: 'user', required: true, description: 'Azure region for shared infrastructure.' },
@@ -50,11 +92,14 @@ const PARAMETER_CATALOG = Object.freeze({
   keycloakVerifyAudience: { kind: 'file', source: 'templateDefault', description: 'Enable Keycloak audience verification.' },
   encryptionKey: { kind: 'secretEnv', env: 'ENCRYPTION_KEY', required: true, description: 'Application/data encryption key.' },
   acrLoginServer: { kind: 'acrLookup', field: 'loginServer', description: 'Resolved from acrName; not entered separately.' },
-  acrAdminUsername: { kind: 'fixed', value: '', source: 'managedIdentityMode', description: 'Unused: Azure web apps pull images with their managed identities.' },
-  acrAdminPassword: { kind: 'fixed', value: '', source: 'managedIdentityMode', description: 'Unused: Azure image pull never uses a registry password.' },
-  acrResourceId: { kind: 'acrLookup', field: 'id', description: 'Resolved from acrName; both web app identities receive AcrPull on it and the deployment fails if the grant fails.' },
-  deployRoleAssignments: { kind: 'file', source: 'templateDefault', description: 'Deploy required Azure role assignments.' },
+  acrAdminUsername: { kind: 'fixed', value: '', source: 'managedIdentityMode', description: 'Empty in the workspace; credential mode fills it only in the temporary ARM parameters file (never committed).' },
+  acrAdminPassword: { kind: 'fixed', value: '', source: 'managedIdentityMode', description: 'Empty in the workspace; credential mode fills it only in the temporary ARM parameters file (never committed).' },
+  acrResourceId: { kind: 'acrLookup', field: 'id', description: 'Resolved from acrName; mi mode grants AcrPull to both web app identities.' },
+  deployRoleAssignments: { kind: 'file', source: 'templateDefault', description: 'Deploy Contributor role assignments in the installation resource group. Needed in every mode: without it the controller cannot create the environment resources its second stage deploys.' },
+  deployRegistryRoleAssignment: { kind: 'parameterDefault', defaultFrom: 'deployRoleAssignments', source: 'templateDefault', description: 'Deploy the AcrPull grant on the container registry. False while credential image pull is in effect, because that grant lives in the registry resource group, which a customer installation cannot reach; restored for managed identity.' },
   moriBaseUrl: { kind: 'file', source: 'registration', required: true, description: 'Mori service base URL.' },
+  moriLicensePublicKey: { kind: 'file', source: 'registration', required: false, description: 'Mori licence issuer public key (SPKI PEM); empty leaves the installation unpinned and it then refuses every licence.' },
+  moriLicenseIssuer: { kind: 'file', source: 'registration', required: false, description: 'Expected iss claim on a Mori licence.' },
   moriCallbackApiKey: { kind: 'secretEnv', env: 'MORI_CALLBACK_API_KEY', required: true, description: 'Mori callback authentication key.' },
   entraCallbackStateSecret: { kind: 'deferred', description: 'Not collected or sent by infra; issued/configured during later Entra provider onboarding.' },
   entraIdClientId: { kind: 'deferred', description: 'Not collected or sent by infra; issued/configured during later Entra provider onboarding.' },
@@ -62,6 +107,7 @@ const PARAMETER_CATALOG = Object.freeze({
   entraIdTenantId: { kind: 'deferred', description: 'Customer Entra provider tenant; distinct from the Azure subscription directory tenant and configured later.' },
   licenseEdition: { kind: 'license', source: 'cliOrFile', description: 'License requested from Mori during tenant activation: COMMUNITY, STANDARD or ENTERPRISE, or an Azure Marketplace subscription ID. Standard/Enterprise by name is a 30-day evaluation.' },
   onboardingMode: { kind: 'onboarding', source: 'workspacePolicy', description: 'Miso onboarding mode (ONBOARDING_MODE); Builder installations use saasDirect, Marketplace customer installations use customerOwned.' },
+  capacityProfile: { kind: 'capacity', source: 'workspacePreset', description: 'Infrastructure sizing profile (s, m, l, xl) selecting compute and PostgreSQL SKUs. Derived from the workspace preset so the two cannot drift; set it with --preset.' },
   misoImageTag: { kind: 'file', source: 'templateDefault', description: 'Miso container image tag.' },
   keycloakImageTag: { kind: 'file', source: 'templateDefault', description: 'Keycloak container image tag.' }
 });
@@ -85,7 +131,9 @@ const OUTPUT_CATALOG = Object.freeze({
   keycloakWebAppUrl: 'Keycloak web application URL.',
   keycloakRealmUrl: 'Keycloak realm URL.',
   keycloakAdminUser: 'Keycloak administrator user name.',
-  portalUrl: 'Azure portal link for the installation resource group.'
+  portalUrl: 'Azure portal link for the installation resource group.',
+  azureOpenAiCreated: 'Whether Phase-1 created the Azure OpenAI account in the installation region.',
+  azureOpenAiSkipReason: 'Why Azure OpenAI was not created; empty when it was. An unsupported region skips the optional account instead of relocating it.'
 });
 
 /** Mori service key name written by DOCKER registration. */
@@ -159,7 +207,11 @@ module.exports = {
   DEFAULT_LICENSE_EDITION,
   ONBOARDING_MODES,
   DEFAULT_ONBOARDING_MODE,
+  ACR_AUTH_MODES,
+  DEFAULT_ACR_AUTH,
   normalizeLicenseEdition,
+  normalizeAcrAuth,
+  normalizeAzureLocation,
   buildEnvTemplate,
   assertTemplateCoverage
 };

package/lib/deployment/installation/infra-manifest.js

@@ -8,9 +8,10 @@
 
 const crypto = require('crypto');
 const {
-  PARAMETER_CATALOG, OUTPUT_CATALOG, DEFAULT_LICENSE_EDITION, DEFAULT_ONBOARDING_MODE
+  PARAMETER_CATALOG, OUTPUT_CATALOG, DEFAULT_LICENSE_EDITION, DEFAULT_ONBOARDING_MODE, DEFAULT_ACR_AUTH
 } = require('./infra-catalog');
 
+const ACR_AUTH_DESCRIPTION = 'Image pull auth: auto (default; local dev set-registry pair for the ACR login server, else managed identity), mi (AcrPull), or credentials (local pair, then authorized ACR admin lookup). Credentials are never committed.';
 const INFRA_SCHEMA_VERSION = '2.0.0';
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
@@ -41,17 +42,34 @@ function parameterEntry(name, template) {
     return entry(DEFAULT_LICENSE_EDITION, spec.source, spec.description);
   case 'onboarding':
     return entry(DEFAULT_ONBOARDING_MODE, spec.source, spec.description);
+  case 'capacity':
+    // Mirrors the workspace preset; azure-infra-stage keeps them in step on every run.
+    return entry('s', spec.source, spec.description);
+  case 'parameterDefault':
+    return entry(templateDefault(template, spec.defaultFrom), spec.source, spec.description);
   default:
     return entry(templateDefault(template, name), spec.source, spec.description, spec.required ? { required: true } : {});
   }
 }
 
+/** Sources written by Builder workflows that must survive regeneration. */
+const STICKY_SOURCES = Object.freeze(['cli', 'acrAuthCredentials', 'acrAuthAdmin']);
+
+function preservedState(previous) {
+  const kept = { value: previous.value };
+  if (STICKY_SOURCES.includes(previous.source)) kept.source = previous.source;
+  for (const key of ['restoreValue', 'restoreSource']) {
+    if (previous[key] !== undefined) kept[key] = previous[key];
+  }
+  return kept;
+}
+
 function buildParameters(template, existing = {}) {
   const parameters = {};
   for (const name of Object.keys(PARAMETER_CATALOG)) {
     const fresh = parameterEntry(name, template);
     const workflowOwned = ['fixed', 'deferred', 'secretEnv'].includes(PARAMETER_CATALOG[name].kind);
-    parameters[name] = existing[name] && !workflowOwned ? { ...fresh, value: existing[name].value } : fresh;
+    parameters[name] = existing[name] && !workflowOwned ? { ...fresh, ...preservedState(existing[name]) } : fresh;
   }
   return parameters;
 }
@@ -64,6 +82,7 @@ function buildOutputs(existing = {}) {
 function azureSections(template, existing) {
   return {
     acrName: existing.acrName || entry('', 'user', 'Required private ACR name. Builder resolves and persists its login server and resource ID using the authenticated Azure account.', { required: true }),
+    acrAuth: existing.acrAuth || entry(DEFAULT_ACR_AUTH, 'cliOrFile', ACR_AUTH_DESCRIPTION),
     allowMyIp: existing.allowMyIp || entry(false, 'cliOrFile', 'Default-off internal test access. When enabled, Builder resolves and audits one public IPv4 /32.', { resolvedCidr: null, resolvedAt: null, resolver: null }),
     preset: existing.preset || entry('s', 'cliOrFile', 'Shared infrastructure sizing preset.'),
     parameters: buildParameters(template, existing.parameters),
@@ -156,6 +175,7 @@ function missingRequiredFields(doc) {
 
 module.exports = {
   INFRA_SCHEMA_VERSION,
+  ACR_AUTH_DESCRIPTION,
   buildInfraDocument,
   missingRequiredFields
 };

package/lib/deployment/installation/infra-projection.js

@@ -3,12 +3,15 @@
 /**
  * @fileoverview Projects `environment-infra.json` plus resolved workspace secrets into standard
  * ARM deploymentParameters, and applies the default-off current-IP access option.
- * Deferred tenant-activation parameters are never projected.
+ * Deferred tenant-activation parameters are never projected. ACR admin credentials (password mode)
+ * are injected only into the temporary parameters file and never enter the input hash.
  */
 
 const { PARAMETER_CATALOG } = require('./infra-catalog');
 const { sha256 } = require('./workspace-files');
 
+const ARM_CREDENTIAL_PARAMS = Object.freeze(new Set(['acrAdminUsername', 'acrAdminPassword']));
+
 function projectParameter(name, doc, context) {
   const spec = PARAMETER_CATALOG[name];
   switch (spec.kind) {
@@ -27,6 +30,12 @@ function projectParameter(name, doc, context) {
     }
     return context.acr[spec.field];
   case 'fixed':
+    if (name === 'acrAdminUsername' && context.registryCredentials) {
+      return context.registryCredentials.username;
+    }
+    if (name === 'acrAdminPassword' && context.registryCredentials) {
+      return context.registryCredentials.password;
+    }
     return spec.value;
   default:
     return doc.parameters[name].value;
@@ -39,6 +48,7 @@ function projectParameter(name, doc, context) {
  * @param {Object} context - Resolution context
  * @param {Object.<string,string>} context.env - Resolved workspace .env values
  * @param {{ id: string, loginServer: string }} context.acr - Resolved registry
+ * @param {{ username: string, password: string }|null|undefined} context.registryCredentials - Credential-mode pull creds (never hashed)
  * @param {string} context.templateHash - SHA-256 of the deployed template
  * @returns {{ document: Object, inputHash: string }}
  */
@@ -49,9 +59,10 @@ function buildArmParameters(doc, context) {
     const value = projectParameter(name, doc, context);
     if (value === undefined) continue;
     parameters[name] = { value };
-    // Secrets never enter the hash.
-    if (PARAMETER_CATALOG[name].kind !== 'secretEnv') nonSecret[name] = value;
+    const catalog = PARAMETER_CATALOG[name];
+    if (catalog.kind !== 'secretEnv' && !ARM_CREDENTIAL_PARAMS.has(name)) nonSecret[name] = value;
   }
+  nonSecret.acrAuth = doc.acrAuth?.effective || doc.acrAuth?.value || 'auto';
   return {
     document: {
       $schema: 'https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#',

package/lib/deployment/installation/registry-auth-mode.js

@@ -0,0 +1,121 @@
+'use strict';
+
+/**
+ * @fileoverview Image-pull authentication for CLI-managed AZURE infra. The requested mode
+ * (`auto|mi|credentials`, deprecated `admin` = credentials) resolves to an effective `mi` or
+ * `credentials` mode. Credential values come from the primary user's `dev set-registry` pair for the
+ * resolved ACR login server, or (explicit credentials only) from an authorized ACR admin lookup.
+ * They live only in memory and in the temporary ARM parameters file.
+ */
+
+const { normalizeAcrAuth } = require('./infra-catalog');
+const { ACR_AUTH_DESCRIPTION } = require('./infra-manifest');
+
+const FORCED_ROLE_SOURCES = Object.freeze(['acrAuthCredentials', 'acrAuthAdmin']);
+
+function restoreForcedRole(roles) {
+  const { restoreValue, restoreSource, ...rest } = roles;
+  return {
+    ...rest,
+    value: restoreValue === undefined ? true : restoreValue,
+    source: restoreSource || 'templateDefault'
+  };
+}
+
+function restoreLegacyContributorRole(doc) {
+  const roles = doc.parameters.deployRoleAssignments;
+  if (roles && FORCED_ROLE_SOURCES.includes(roles.source)) {
+    doc.parameters.deployRoleAssignments = restoreForcedRole(roles);
+  }
+}
+
+/**
+ * Normalizes and records the requested mode (CLI wins over the workspace value).
+ * @param {Object} doc - Infra manifest (mutated)
+ * @param {Object} input - Stage input (`acrAuth` from CLI)
+ * @returns {string} Requested mode
+ */
+function applyRequestedAcrAuth(doc, input) {
+  const fromCli = input.acrAuth !== undefined;
+  const mode = normalizeAcrAuth(fromCli ? input.acrAuth : (doc.acrAuth?.value || 'auto'));
+  doc.acrAuth = {
+    ...(doc.acrAuth || {}),
+    value: mode,
+    source: fromCli ? 'cli' : (doc.acrAuth?.source || 'cliOrFile'),
+    description: ACR_AUTH_DESCRIPTION
+  };
+  return mode;
+}
+
+function localSetupHint(host) {
+  return `Run "aifabrix dev set-registry ${host} --username <username> --password-stdin", or use --acr-auth mi`;
+}
+
+async function resolveAzureFallback(doc, acr, az, fetchAdmin) {
+  try {
+    return fetchAdmin(doc, acr, az);
+  } catch (error) {
+    throw new Error(`No registry credentials are available for ${acr.loginServer}: ${error.message}. ${localSetupHint(acr.loginServer)}`);
+  }
+}
+
+/**
+ * Resolves the effective pull mode and ephemeral credentials. A partial local pair always fails.
+ * @param {Object} doc - Infra manifest with a normalized `acrAuth`
+ * @param {{ loginServer: string, adminUserEnabled?: boolean }} acr - Resolved registry
+ * @param {Function} az - Azure CLI runner
+ * @param {Object} deps - `loadRegistryCredentials(host)` and `resolveAcrAdminCredentials(doc, acr, az)`
+ * @returns {Promise<{ mode: 'mi'|'credentials', credentials: ({username: string, password: string}|null), source: string }>}
+ */
+async function resolveRegistryAuth(doc, acr, az, deps) {
+  const requested = normalizeAcrAuth(doc.acrAuth?.value || 'auto');
+  if (requested === 'mi') return { mode: 'mi', credentials: null, source: 'managedIdentity' };
+  const local = await deps.loadRegistryCredentials(acr.loginServer);
+  if (local) return { mode: 'credentials', credentials: local, source: 'localRegistryCredentials' };
+  if (requested === 'auto') return { mode: 'mi', credentials: null, source: 'managedIdentity' };
+  const azure = await resolveAzureFallback(doc, acr, az, deps.resolveAcrAdminCredentials);
+  return { mode: 'credentials', credentials: azure, source: 'acrAdminLookup' };
+}
+
+/**
+ * Records the effective mode and keeps the registry role assignment consistent with it.
+ *
+ * Credential mode turns off only `deployRegistryRoleAssignment` -- the AcrPull grant, which lives
+ * in the registry's own resource group and, for a customer installation, in the vendor's tenant
+ * where Azure RBAC cannot reach. It deliberately leaves `deployRoleAssignments` alone: those are
+ * Contributor grants in the resource group the installation is creating, which the deployer owns.
+ *
+ * Turning both off is what ce-12 and ce-13 did, and it broke the installation in a way that took
+ * two attempts to see. Without Contributor on its own resource group the controller cannot create
+ * anything, so its second stage failed every module, no resource bindings were recorded, and both
+ * application deployments refused with "Environment 'dev' has no recorded placement".
+ *
+ * @param {Object} doc - Infra manifest (mutated)
+ * @param {'mi'|'credentials'} mode - Effective mode
+ */
+function applyEffectiveAcrAuth(doc, mode) {
+  doc.acrAuth = { ...doc.acrAuth, effective: mode };
+  restoreLegacyContributorRole(doc);
+  const roles = doc.parameters.deployRegistryRoleAssignment
+    || doc.parameters.deployRoleAssignments;
+  const forced = FORCED_ROLE_SOURCES.includes(roles.source);
+  if (mode === 'credentials') {
+    if (forced) return;
+    doc.parameters.deployRegistryRoleAssignment = {
+      ...roles, value: false, source: 'acrAuthCredentials', restoreValue: roles.value, restoreSource: roles.source
+    };
+    return;
+  }
+  if (!forced) return;
+  doc.parameters.deployRegistryRoleAssignment = restoreForcedRole(roles);
+}
+
+/**
+ * @param {Object} doc - Infra manifest
+ * @returns {boolean} True when the last resolved pull mode uses registry credentials
+ */
+function usesRegistryCredentials(doc) {
+  return doc.acrAuth?.effective === 'credentials';
+}
+
+module.exports = { applyRequestedAcrAuth, resolveRegistryAuth, applyEffectiveAcrAuth, usesRegistryCredentials };

package/lib/deployment/installation/stage-input.js

@@ -7,7 +7,7 @@
  */
 
 const path = require('path');
-const { normalizeLicenseEdition } = require('./infra-catalog');
+const { normalizeLicenseEdition, normalizeAcrAuth, normalizeAzureLocation } = require('./infra-catalog');
 
 const WORKSPACE_STAGES = Object.freeze(['register', 'infra', 'dev', 'tst', 'pro']);
 const ENVIRONMENT_STAGES = Object.freeze(['dev', 'tst', 'pro']);
@@ -102,11 +102,24 @@ function assertInfraOnlyOptions(stage, options) {
   if (options.allowMyIp && stage !== 'infra') {
     throw new Error('--allow-my-ip is supported only with --stage infra for AZURE installations');
   }
-  if (options.licenseEdition === undefined) return;
-  if (stage !== 'infra') {
-    throw new Error('--license-edition is supported only with --stage infra for AZURE installations');
+  if (options.licenseEdition !== undefined) {
+    if (stage !== 'infra') {
+      throw new Error('--license-edition is supported only with --stage infra for AZURE installations');
+    }
+    normalizeLicenseEdition(options.licenseEdition);
+  }
+  if (options.acrAuth !== undefined) {
+    if (stage !== 'infra') {
+      throw new Error('--acr-auth is supported only with --stage infra for AZURE installations');
+    }
+    normalizeAcrAuth(options.acrAuth);
+  }
+  if (options.location !== undefined) {
+    if (stage !== 'infra') {
+      throw new Error('--location is supported only with --stage infra (later environments inherit the saved region)');
+    }
+    normalizeAzureLocation(options.location);
   }
-  normalizeLicenseEdition(options.licenseEdition);
 }
 
 function assertStageScopedOptions(stage, options) {
@@ -137,7 +150,7 @@ function assertStageScopedOptions(stage, options) {
  * @param {Object} options - Commander options
  * @param {string|undefined} persistedVendor - Vendor recorded in an existing workspace
  * @returns {{ resourceGroup: string, stage: string, vendor: string, allowMyIp: boolean, licenseEdition: string|undefined,
- *   preset: string|undefined, controllerUrl: string|undefined, misoApiKeyEnv: string|undefined }}
+ *   acrAuth: string|undefined, location: string|undefined, preset: string|undefined, controllerUrl: string|undefined, misoApiKeyEnv: string|undefined }}
  */
 function resolveStageInput(resourceGroupKey, options, persistedVendor) {
   const resourceGroup = validateResourceGroupKey(resourceGroupKey);
@@ -150,6 +163,8 @@ function resolveStageInput(resourceGroupKey, options, persistedVendor) {
     vendor,
     allowMyIp: options.allowMyIp === true,
     licenseEdition: options.licenseEdition,
+    acrAuth: options.acrAuth,
+    location: options.location,
     preset: options.preset,
     controllerUrl: options.controllerUrl,
     misoApiKeyEnv: options.misoApiKeyEnv

package/lib/deployment/marketplace-environment.js

@@ -9,6 +9,7 @@ const crypto = require('crypto');
 const { spawnSync } = require('child_process');
 const config = require('../core/config');
 const { getRuntimeConfigDir } = require('../core/config-runtime-paths');
+const logger = require('../utils/logger');
 
 const SHIPPED_TEMPLATE = path.resolve(__dirname, '../../templates/marketplace/main.json');
 // Resolved per call (not a module-load constant) so it honors AIFABRIX_HOME/AIFABRIX_CONFIG
@@ -273,8 +274,28 @@ async function deployMarketplaceEnvironment(envKey, options, dependencies = {})
   return deployPlatform({ ...input, controllerUrl: options.controllerUrl }, dependencies);
 }
 
+/**
+ * Attempts allowed for the controller, at 10-second intervals.
+ *
+ * The controller runs first-time onboarding inside startup, and on Azure that onboarding is
+ * normally interrupted once — the template applies post-Key-Vault app settings and restarts the
+ * site — so the retry runs too. A clean installation was measured taking 720 seconds to pass its
+ * warm-up probe. The old 30 attempts gave 5 minutes and reported `readiness did not pass` for
+ * installations that were healthy, which is worse than a slow wait: it leaves `controllerUrl`
+ * unrecorded, so `--stage dev` then refuses with "Shared infrastructure is not deployed".
+ *
+ * 180 attempts is 30 minutes, matching WEBSITES_CONTAINER_START_TIME_LIMIT. Waiting longer than
+ * App Service itself would is pointless; waiting less than it declares is what caused this.
+ */
+const CONTROLLER_READINESS_ATTEMPTS = 180;
+
 async function probeController(controllerUrl) {
-  return probeHttps(controllerUrl, '/api/v1/health/readiness', 'Controller');
+  return probeHttps(
+    controllerUrl,
+    '/api/v1/health/readiness',
+    'Controller',
+    CONTROLLER_READINESS_ATTEMPTS
+  );
 }
 
 /**
@@ -297,6 +318,10 @@ async function probeHttps(baseUrl, pathname, label, attempts = 30) {
     } catch (_) {
       // App Service startup can lag successful ARM provisioning.
     }
+    // A wait measured in minutes should say so, or it is indistinguishable from a hang.
+    if (attempt > 0 && attempt % 6 === 0) {
+      logger.log(`  waiting for ${label} readiness… ${attempt * 10}s elapsed`);
+    }
     await new Promise(resolve => setTimeout(resolve, 10000));
   }
   throw new Error(`${label} readiness did not pass at ${url.origin}; inspect App Service before resuming`);

package/lib/generator/builders.js

@@ -41,16 +41,15 @@ function filterConfigurationByRegistryMode(configuration, _registryMode) {
   return Array.isArray(configuration) ? configuration : [];
 }
 
+/**
+ * Deployment image reference using the shared registry precedence
+ * (installation `registry` in config.yaml, then manifest `image.registry`).
+ * @param {Object} variables - Application variables
+ * @returns {string}
+ */
 function buildImageReference(variables) {
-  const imageName = variables.image?.name || variables.app?.key || 'app';
-  const registry = variables.image?.registry;
-  const tag = variables.image?.tag || 'latest';
-
-  if (registry) {
-    return `${registry}/${imageName}:${tag}`;
-  }
-
-  return `${imageName}:${tag}`;
+  const { buildManifestImageReference } = require('../utils/resolve-docker-image-ref');
+  return buildManifestImageReference(variables, 'app');
 }
 
 /**

package/lib/generator/index.js

@@ -117,35 +117,46 @@ function substitutePortInDeployment(obj, portNumber) {
 /** Regex to find ${VAR} placeholders for env substitution */
 const ENV_VAR_PLACEHOLDER_REGEX = /\$\{([^}]+)\}/g;
 
+function replaceDeploymentEnvString(value, envVarMap, fieldPath) {
+  if (fieldPath === 'frontDoorRouting.host') return value;
+  return value.replace(ENV_VAR_PLACEHOLDER_REGEX, (match, varName) =>
+    Object.prototype.hasOwnProperty.call(envVarMap, varName) ? String(envVarMap[varName]) : match);
+}
+
+function substituteEnvVarsInArray(items, envVarMap, fieldPath) {
+  for (let i = 0; i < items.length; i++) {
+    const itemPath = `${fieldPath}[${i}]`;
+    if (typeof items[i] === 'string') {
+      items[i] = replaceDeploymentEnvString(items[i], envVarMap, itemPath);
+    } else if (typeof items[i] === 'object' && items[i] !== null) {
+      substituteEnvVarsInDeployment(items[i], envVarMap, itemPath);
+    }
+  }
+}
+
 /**
  * Recursively replaces ${VAR} with envVarMap[VAR] in all string values of obj (in-place).
  * Only substitutes when VAR is a key in envVarMap (from env-config.yaml / config).
  *
  * @param {Object} obj - Deployment manifest or any nested object
  * @param {Object} envVarMap - Flat map of variable names to values (e.g. from buildEnvVarMap('docker'))
+ * @param {string} [fieldPath=''] - Internal traversal path used to preserve the portable front door host template
  */
-function substituteEnvVarsInDeployment(obj, envVarMap) {
+function substituteEnvVarsInDeployment(obj, envVarMap, fieldPath = '') {
   if (!envVarMap || typeof envVarMap !== 'object') return;
   if (obj === null || obj === undefined) return;
   if (Array.isArray(obj)) {
-    for (let i = 0; i < obj.length; i++) {
-      if (typeof obj[i] === 'string') {
-        obj[i] = obj[i].replace(ENV_VAR_PLACEHOLDER_REGEX, (match, varName) =>
-          Object.prototype.hasOwnProperty.call(envVarMap, varName) ? String(envVarMap[varName]) : match);
-      } else if (typeof obj[i] === 'object' && obj[i] !== null) {
-        substituteEnvVarsInDeployment(obj[i], envVarMap);
-      }
-    }
+    substituteEnvVarsInArray(obj, envVarMap, fieldPath);
     return;
   }
   if (typeof obj === 'object') {
     for (const key of Object.keys(obj)) {
       const value = obj[key];
+      const childPath = fieldPath ? `${fieldPath}.${key}` : key;
       if (typeof value === 'string') {
-        obj[key] = value.replace(ENV_VAR_PLACEHOLDER_REGEX, (match, varName) =>
-          Object.prototype.hasOwnProperty.call(envVarMap, varName) ? String(envVarMap[varName]) : match);
+        obj[key] = replaceDeploymentEnvString(value, envVarMap, childPath);
       } else if (typeof value === 'object' && value !== null) {
-        substituteEnvVarsInDeployment(value, envVarMap);
+        substituteEnvVarsInDeployment(value, envVarMap, childPath);
       }
     }
   }

package/lib/integration-definition/apply.js

@@ -18,6 +18,7 @@ const { applyStaticAndEnterprise } = require('./apply-static-enterprise');
 const { applyViewpointDefaults } = require('./apply-viewpoint-defaults');
 const { stampCredentialTestEndpoint } = require('./apply-test-endpoint');
 const { buildSystemFile } = require('./apply-system-file');
+const { resolveAuthoredDatasourceSync } = require('../datasource/sync-defaults');
 
 const STAMP_FILE = '.aifabrix-integration-definition.json';
 
@@ -160,8 +161,7 @@ function buildDatasourceFile(ds, systemKey, capabilities, sync, enrichOptions =
     ...(ds.storageType ? { storageType: ds.storageType } : {}),
     ...(ds.dimensions && typeof ds.dimensions === 'object' ? { dimensions: ds.dimensions } : {}),
     capabilities: buildDatasourceCapabilities(caps, key),
-    // Schema sync is mode/schedule/batchSize only; BID sync.mode=incremental is operational intent.
-    sync: { mode: 'pull', schedule: /** @type {any} */ (sync).schedule || '0 */6 * * *', batchSize: 100 },
+    sync: resolveAuthoredDatasourceSync(ds, sync),
     primaryKey: ['id'],
     labelKey: [labelField],
     ...buildDatasourceSchema(labelField)

package/lib/internal/fs-real-sync.js

@@ -178,5 +178,8 @@ module.exports = {
   rmSync,
   unlinkSync,
   copyFileSync,
-  appendFileSync
+  appendFileSync,
+  openSync: (...args) => delegate('openSync', args),
+  closeSync: (...args) => delegate('closeSync', args),
+  realpathSync: (...args) => delegate('realpathSync', args)
 };

package/lib/programmatic/bearer-auth.js

@@ -8,8 +8,7 @@
 
 'use strict';
 
-/** @type {import('@aifabrix/miso-client').MisoClient | null} */
-let misoClientSingleton = null;
+const { getBuilderMisoRuntime } = require('./builder-miso-runtime');
 
 /**
  * @param {import('http').IncomingMessage} req
@@ -36,65 +35,10 @@ function assertNoForbiddenAuthHeaders(req) {
 }
 
 /**
- * @returns {string}
- */
-function resolveControllerUrlFromEnv() {
-  const raw =
-    process.env.MISO_CONTROLLER_URL ||
-    process.env.CONTROLLER_URL ||
-    process.env.MISO_WEB_SERVER_URL ||
-    '';
-  const url = String(raw).trim().replace(/\/$/, '');
-  if (!url) {
-    throw new Error('MISO_CONTROLLER_URL (or CONTROLLER_URL) is required for token validation');
-  }
-  return url;
-}
-
-/**
- * @returns {import('@aifabrix/miso-client/dist/types/config.types').MisoClientConfig}
- */
-function buildMisoClientConfigFromEnv() {
-  const clientId = (process.env.MISO_CLIENTID || '').trim();
-  const clientSecret = (process.env.MISO_CLIENTSECRET || '').trim();
-  if (!clientId || !clientSecret) {
-    throw new Error('MISO_CLIENTID and MISO_CLIENTSECRET are required for builder-api auth');
-  }
-  return {
-    clientId,
-    clientSecret,
-    controllerUrl: resolveControllerUrlFromEnv(),
-    logLevel: (process.env.LOG_LEVEL || 'info').toLowerCase()
-  };
-}
-
-/**
- * Test hook — reset cached MisoClient between Jest cases.
- */
-function resetMisoClientForTests() {
-  misoClientSingleton = null;
-}
-
-/**
- * @returns {Promise<import('@aifabrix/miso-client').MisoClient>}
+ * @returns {Promise<import('@aifabrix/miso-client').MisoClient>} Initialized shared client
  */
 async function getMisoClientForAuth() {
-  let MisoClient;
-  try {
-    ({ MisoClient } = require('@aifabrix/miso-client'));
-  } catch {
-    const err = new Error('@aifabrix/miso-client is required for builder-api auth');
-    err.statusCode = 503;
-    throw err;
-  }
-
-  if (!misoClientSingleton) {
-    misoClientSingleton = new MisoClient(buildMisoClientConfigFromEnv());
-  }
-  if (!misoClientSingleton.isInitialized()) {
-    await misoClientSingleton.initialize();
-  }
-  return misoClientSingleton;
+  return getBuilderMisoRuntime().getClient();
 }
 
 /**
@@ -167,9 +111,6 @@ async function authenticateRequest(req, opts = {}) {
 module.exports = {
   extractBearerToken,
   assertNoForbiddenAuthHeaders,
-  resolveControllerUrlFromEnv,
-  buildMisoClientConfigFromEnv,
-  resetMisoClientForTests,
   getMisoClientForAuth,
   validateBearerToken,
   authenticateRequest