@aifabrix/builder 2.58.0 → 2.59.0

package/lib/commands/repair.js

@@ -1,11 +1,11 @@
 /**
- * Repair external integration config: fix drift between config and files on disk.
+ * Repair application documentation and external integration configuration drift.
  *
  * Aligns application.yaml with actual system/datasource files, fixes system key mismatch,
  * creates missing externalIntegration block, extracts rbac.yaml from system when needed,
  * and regenerates the deployment manifest.
  *
- * @fileoverview Repair external integration drift
+ * @fileoverview Repair application README or external integration drift
  * @author AI Fabrix Team
  * @version 2.0.0
  */
@@ -13,6 +13,10 @@
 'use strict';
 
 const fs = require('fs');
+const path = require('path');
+const { generateReadmeMd } = require('../app/readme');
+const { backupIntegrationFile } = require('../utils/integration-file-backup');
+const { trackRepairWrite } = require('./repair-changed-files');
 const { detectAppType } = require('../utils/paths');
 const { resolveApplicationConfigPath } = require('../utils/app-config-resolver');
 const { loadConfigFile, isYamlPath } = require('../utils/config-format');
@@ -43,7 +47,7 @@ function loadConfigAndDiscover(appPath, configPath) {
  * Validates repair inputs and resolves app path and config path.
  * @param {string} appName - Application name
  * @param {Object} options - Command options (auth)
- * @returns {Promise<{ appPath: string, configPath: string, dryRun: boolean, authOption: string|undefined }>}
+ * @returns {Promise<{ appPath: string, configPath: string, dryRun: boolean, authOption: string|undefined, isExternal: boolean }>}
  */
 async function validateAndResolveRepairPaths(appName, options) {
   if (!appName || typeof appName !== 'string') throw new Error('App name is required');
@@ -52,10 +56,42 @@ async function validateAndResolveRepairPaths(appName, options) {
     throw new Error('Option --auth must be a string');
   }
   const { appPath, isExternal } = await detectAppType(appName, options);
-  if (!isExternal) throw new Error(`App '${appName}' is not an external integration`);
+  if (!isExternal) validateApplicationRepairOptions(appName, options);
   const configPath = resolveApplicationConfigPath(appPath);
   if (!fs.existsSync(configPath)) throw new Error(`Application config not found: ${configPath}`);
-  return { appPath, configPath, dryRun, authOption };
+  return { appPath, configPath, dryRun, authOption, isExternal };
+}
+
+/** Validate the documentation-only repair supported for normal applications. */
+function validateApplicationRepairOptions(appName, options) {
+  const integrationOptions = ['all', 'api', 'auth', 'rbac', 'expose', 'sync', 'test',
+    'splitDatasources', 'rbacPreset', 'authWebhook', 'authSync'];
+  if (!options.doc || integrationOptions.some(key => options[key] !== undefined && options[key] !== false && options[key] !== null)) {
+    throw new Error(`App '${appName}' is not an external integration. Normal applications support repair --doc only (with --dry-run or --no-backup).`);
+  }
+}
+
+/** Regenerate a normal application's README using its current local configuration. */
+function repairApplicationReadme(appName, appPath, configPath, backupCtx) {
+  const variables = loadConfigFile(configPath);
+  const content = generateReadmeMd(appName, { ...variables, ...variables.app });
+  const readmePath = path.join(appPath, 'README.md');
+  trackRepairWrite(readmePath, backupCtx);
+  if (!backupCtx.dryRun) {
+    backupIntegrationFile(readmePath, backupCtx);
+    fs.writeFileSync(readmePath, content, { mode: 0o644, encoding: 'utf8' });
+  }
+  return {
+    updated: true,
+    applicationReadme: true,
+    actionsPerformed: true,
+    readmeRegenerated: true,
+    manifestRegenerated: false,
+    changes: ['Regenerated README.md from application configuration'],
+    changedFiles: backupCtx.dryRun ? backupCtx.wouldChangeFiles : backupCtx.changedFiles,
+    backupPaths: backupCtx.backupPaths,
+    warnings: []
+  };
 }
 
 /**
@@ -79,17 +115,18 @@ function createRepairBackupContext(options, dryRun) {
 }
 
 /**
- * Repairs external integration config: syncs files, aligns keys, creates rbac, regenerates manifest
+ * Repairs external integration config or regenerates a normal application's README.
  * @async
  * @param {string} appName - Application/integration name
  * @param {Object} [options] - Options
  * @param {boolean} [options.dryRun] - If true, only report changes; do not write
- * @param {boolean} [options.doc] - If true, regenerate README.md from deployment manifest
+ * @param {boolean} [options.doc] - Regenerate README.md from application config or integration deployment manifest
  * @returns {Promise<Object>}
  */
 async function repairExternalIntegration(appName, options = {}) {
-  const { appPath, configPath, dryRun, authOption } = await validateAndResolveRepairPaths(appName, options);
+  const { appPath, configPath, dryRun, authOption, isExternal } = await validateAndResolveRepairPaths(appName, options);
   const { backupPaths, backupCtx } = createRepairBackupContext(options, dryRun);
+  if (!isExternal) return repairApplicationReadme(appName, appPath, configPath, backupCtx);
   const loaded = loadConfigAndDiscover(appPath, configPath);
   return runRepairExternalIntegration({
     appName,

package/lib/commands/upload-qualification-client.js

@@ -1,6 +1,6 @@
 /**
  * @fileoverview Resumable Dataplane qualification upload: accept, --wait/--no-wait, poll, resume.
- * Mirrors dev-host-ops.js's job id + wait/no-wait contract (plan 191.0 task 1). Never invents
+ * Mirrors dev-host-ops.js's job id + wait/no-wait contract. Never invents
  * qualification truth — accept/poll surface exactly what Dataplane returns.
  * @author AI Fabrix Team
  * @version 1.0.0
@@ -12,13 +12,38 @@ const logger = require('../utils/logger');
 const { formatSuccessLine, formatWarningLine } = require('../utils/cli-test-layout-chalk');
 const { formatApiError } = require('../utils/api-error-handler');
 const { uploadApplicationViaPipelineWithAuthRetry } = require('../utils/pipeline-upload-auth-retry');
-const { pollQualificationJobUntilTerminal } = require('./upload-qualification-poll');
+const { pollQualificationJobUntilTerminal, requireQualificationSuccess,
+  isTransientQualificationPollError } = require('./upload-qualification-poll');
 const { createQualificationPollHandlers } = require('../utils/qualification-poll-ui');
 
+function isAmbiguousAcceptance(error) {
+  const status = error?.response?.status || error?.statusCode || error?.status;
+  const code = error?.cause?.code || error?.code;
+  return isTransientQualificationPollError(status) || (!status && (
+    error instanceof TypeError || ['AbortError', 'TimeoutError'].includes(error?.name) ||
+    ['ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT', 'EAI_AGAIN', 'ENOTFOUND',
+      'ECONNABORTED', 'UND_ERR_CONNECT_TIMEOUT'].includes(code)
+  ));
+}
+
+async function submitQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options) {
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      const res = await uploadApplicationViaPipelineWithAuthRetry(
+        dataplaneUrl, authConfig, payload, systemKey, options
+      );
+      if (res?.success !== false || !isTransientQualificationPollError(res.status) || attempt === 1) {
+        return res;
+      }
+    } catch (error) {
+      if (!isAmbiguousAcceptance(error) || attempt === 1) throw error;
+    }
+  }
+}
+
 /**
- * Ctrl-C / disconnect during polling must detach without corrupting truth (plan 191.0 task 4):
- * the qualification job keeps running on Dataplane regardless of whether this CLI process exits.
- * This only makes that safe fact visible, printing the resume command before exiting 130.
+ * Ctrl-C detaches from status following without asserting an unobserved job outcome.
+ * Prints the resume command before exiting 130.
  * @param {string} jobId
  * @param {string} systemKey
  * @returns {() => void} Call to remove the listeners once polling finishes normally.
@@ -27,7 +52,7 @@ function registerUploadInterruptHint(jobId, systemKey) {
   const onSignal = () => {
     logger.log(
       formatWarningLine(
-        `Interrupted — upload job ${jobId} is still running, unaffected. Resume with: aifabrix upload ${systemKey} --resume ${jobId}`
+        `Stopped following upload job ${jobId}; its current outcome is unknown. Resume with: aifabrix upload ${systemKey} --resume ${jobId}`
       )
     );
     process.exit(130);
@@ -52,12 +77,24 @@ function registerUploadInterruptHint(jobId, systemKey) {
  * @returns {Promise<{jobId: string, state: string, resumed: boolean, candidateFingerprint: string}>}
  */
 async function acceptQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options = {}) {
-  const res = await uploadApplicationViaPipelineWithAuthRetry(dataplaneUrl, authConfig, payload, systemKey, {
-    ...options,
-    async: true
-  });
+  let res;
+  try {
+    res = await submitQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, {
+      ...options,
+      async: true
+    });
+  } catch (error) {
+    if (!isAmbiguousAcceptance(error)) throw error;
+    const unknown = new Error('Upload acceptance outcome is unknown. Rerun the same upload command to recover the job.');
+    unknown.cause = error;
+    unknown.statusCode = error?.response?.status || error?.statusCode || error?.status;
+    throw unknown;
+  }
   if (res?.success === false) {
-    const err = new Error(formatApiError(res, dataplaneUrl));
+    const ambiguous = isTransientQualificationPollError(res.status);
+    const err = new Error(ambiguous
+      ? 'Upload acceptance outcome is unknown. Rerun the same upload command to recover the job.'
+      : formatApiError(res, dataplaneUrl));
     const status = Number(res.status || res.statusCode);
     err.statusCode = status >= 400 && status < 600 ? status : 400;
     throw err;
@@ -107,6 +144,14 @@ async function resumeQualificationUpload(dataplaneUrl, authConfig, jobId, system
  */
 async function runQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options = {}) {
   const accepted = await acceptQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options);
+  if (accepted.state === 'completed' || accepted.state === 'failed') {
+    requireQualificationSuccess(accepted);
+    return {
+      ...accepted,
+      candidateFingerprint: accepted.result?.candidateFingerprint,
+      terminal: accepted
+    };
+  }
   const wait = options.wait !== false;
   if (!wait) {
     if (options.json) {

package/lib/commands/upload-qualification-poll.js

@@ -1,5 +1,5 @@
 /**
- * @fileoverview Poll a Dataplane qualification (publish) job until terminal (plan 191.0 task 1).
+ * @fileoverview Poll a Dataplane qualification job while retaining resumable identity.
  * Never invents success and never marks the candidate failed just because the CLI stopped polling —
  * timing out returns a resumable jobId instead.
  * @author AI Fabrix Team
@@ -13,7 +13,7 @@ const { formatApiError } = require('../utils/api-error-handler');
 
 const POLL_INTERVAL_MS = 3000;
 const POLL_TIMEOUT_MS = 30 * 60 * 1000;
-const TRANSIENT_HTTP_STATUSES = new Set([502, 503, 504]);
+const TRANSIENT_HTTP_STATUSES = new Set([429, 502, 503, 504]);
 const MAX_TRANSIENT_POLL_ERRORS = 20;
 
 const GOVERNANCE_SCENARIOS_MISSING = 'GOVERNANCE_SCENARIOS_MISSING';
@@ -46,6 +46,17 @@ function formatQualificationJobFailure(job) {
   };
 }
 
+/** Throw only for an authoritative stored failure, retaining the original job. */
+function requireQualificationSuccess(job) {
+  if (job.state !== 'failed') return;
+  const failure = formatQualificationJobFailure(job);
+  const err = new Error(failure.message);
+  err.jobId = job.jobId;
+  err.job = job;
+  err.skipDoctor = failure.userFacing;
+  throw err;
+}
+
 /**
  * @param {number|string} status
  * @returns {boolean}
@@ -54,6 +65,35 @@ function isTransientQualificationPollError(status) {
   return TRANSIENT_HTTP_STATUSES.has(Number(status));
 }
 
+/** Preserve the accepted identity without asserting a business outcome. */
+function unavailableJob(jobId, message) {
+  const error = new Error(
+    `${message} Job ${jobId}: status unavailable. Resume with: aifabrix upload <systemKey> --resume ${jobId}`
+  );
+  error.jobId = jobId;
+  error.resumable = true;
+  return error;
+}
+
+/** Normalize transport exceptions so returned HTTP errors and throws share retries. */
+async function readQualificationJob(dataplaneUrl, authConfig, jobId) {
+  try {
+    return await getPublishJobStatus(dataplaneUrl, authConfig, jobId);
+  } catch (error) {
+    const status = error?.response?.status || error?.statusCode || error?.status;
+    const code = error?.cause?.code || error?.code;
+    const network = ['ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT', 'EAI_AGAIN',
+      'ENOTFOUND', 'ECONNABORTED', 'UND_ERR_CONNECT_TIMEOUT'].includes(code) ||
+      error instanceof TypeError || ['AbortError', 'TimeoutError'].includes(error?.name);
+    if (isTransientQualificationPollError(status) || (!status && network)) {
+      return { success: false, status: status || 503 };
+    }
+    const failure = unavailableJob(jobId, 'Unable to check upload progress.');
+    failure.statusCode = status;
+    throw failure;
+  }
+}
+
 /**
  * @param {string} dataplaneUrl
  * @param {Object} authConfig
@@ -64,19 +104,19 @@ function isTransientQualificationPollError(status) {
 async function fetchQualificationJobWithRetry(dataplaneUrl, authConfig, jobId, pollUi = {}) {
   const started = Date.now();
   for (let attempt = 0; attempt <= MAX_TRANSIENT_POLL_ERRORS; attempt += 1) {
-    const res = await getPublishJobStatus(dataplaneUrl, authConfig, jobId);
+    const res = await readQualificationJob(dataplaneUrl, authConfig, jobId);
     if (res?.success !== false) {
       return res.data;
     }
     if (!isTransientQualificationPollError(res.status)) {
-      const err = new Error(formatApiError(res, dataplaneUrl));
+      const err = unavailableJob(jobId, formatApiError(res, dataplaneUrl));
       const status = Number(res.status);
       err.statusCode = status >= 400 && status < 600 ? status : 400;
       throw err;
     }
     if (attempt >= MAX_TRANSIENT_POLL_ERRORS) {
-      throw new Error(
-        `The upload service returned HTTP ${res.status} repeatedly while waiting for job ${jobId}.`
+      throw unavailableJob(
+        jobId, `The upload service returned HTTP ${res.status} repeatedly.`
       );
     }
     if (typeof pollUi.onTransientError === 'function') {
@@ -84,13 +124,13 @@ async function fetchQualificationJobWithRetry(dataplaneUrl, authConfig, jobId, p
     }
     await sleep(POLL_INTERVAL_MS);
   }
-  throw new Error(`Failed to check upload job ${jobId} after transient retries`);
+  throw unavailableJob(jobId, 'Status retries exhausted.');
 }
 
 /**
  * Poll a Dataplane qualification job to terminal state (completed|failed). The timeout only
  * bounds how long *this CLI process* waits — Dataplane keeps running the job regardless; timing
- * out returns a resumable jobId, never a fabricated failure (plan 191.0 task 4).
+ * out returns a resumable jobId, never a fabricated failure.
  * @param {string} dataplaneUrl
  * @param {Object} authConfig
  * @param {string} jobId
@@ -112,25 +152,13 @@ async function pollQualificationJobUntilTerminal(
     if (typeof pollUi.onPollProgress === 'function') {
       pollUi.onPollProgress(job);
     }
-    if (job.state === 'failed') {
-      const failure = formatQualificationJobFailure(job);
-      const err = new Error(failure.message);
-      err.jobId = jobId;
-      err.job = job;
-      err.skipDoctor = failure.userFacing;
-      throw err;
-    }
+    requireQualificationSuccess(job);
     if (job.state === 'completed') {
       return job;
     }
     await sleep(POLL_INTERVAL_MS);
   }
-  const timeoutErr = new Error(
-    `Timed out waiting for upload job ${jobId}. It is still running — resume with: aifabrix upload <systemKey> --resume ${jobId}`
-  );
-  timeoutErr.jobId = jobId;
-  timeoutErr.resumable = true;
-  throw timeoutErr;
+  throw unavailableJob(jobId, 'Timed out waiting for upload progress.');
 }
 
 module.exports = {
@@ -139,5 +167,6 @@ module.exports = {
   isTransientQualificationPollError,
   fetchQualificationJobWithRetry,
   formatQualificationJobFailure,
+  requireQualificationSuccess,
   pollQualificationJobUntilTerminal
 };

package/lib/commands/wizard-dataplane.js

@@ -4,43 +4,11 @@
  * @version 2.0.0
  */
 
-const chalk = require('chalk');
 const logger = require('../utils/logger');
 const { formatProgress, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 const { getDataplaneUrl } = require('../datasource/deploy');
-const { listEnvironmentApplications } = require('../api/environments.api');
 
-/**
- * Find dataplane service application key from environment applications list
- * @async
- * @function findDataplaneServiceAppKey
- * @param {string} controllerUrl - Controller URL
- * @param {string} environment - Environment key
- * @param {Object} authConfig - Authentication configuration
- * @returns {Promise<string|null>} Dataplane service appKey or null if not found
- */
-// eslint-disable-next-line complexity
-async function findDataplaneServiceAppKey(controllerUrl, environment, authConfig) {
-  try {
-    const response = await listEnvironmentApplications(controllerUrl, environment, authConfig, { pageSize: 100 });
-    if (!response.success || !response.data) return null;
-    const applications = response.data.data || response.data || [];
-    for (const app of applications) {
-      const appKey = app.key || app.id;
-      if (!appKey) continue;
-      const keyLower = appKey.toLowerCase();
-      const appType = app.configuration?.type || app.type;
-      const nameLower = (app.displayName || app.name || '').toLowerCase();
-      if (keyLower === 'dataplane' || keyLower.includes('dataplane') || (appType === 'service' && nameLower.includes('dataplane'))) {
-        return appKey;
-      }
-    }
-    return null;
-  } catch (error) {
-    logger.log(chalk.gray(`  Could not list applications: ${error.message}`));
-    return null;
-  }
-}
+const DATAPLANE_APPLICATION_KEY = 'dataplane';
 
 /**
  * Check if error is a "Not Found" error
@@ -65,7 +33,7 @@ function createDataplaneNotFoundError() {
 }
 
 /**
- * Try to get dataplane URL using fallback app key
+ * Get dataplane URL from the canonical controller application key.
  * @async
  * @param {string} controllerUrl - Controller URL
  * @param {string} environment - Environment key
@@ -73,18 +41,23 @@ function createDataplaneNotFoundError() {
  * @returns {Promise<string>} Dataplane URL
  * @throws {Error} If dataplane URL cannot be retrieved
  */
-async function tryFallbackDataplaneUrl(controllerUrl, environment, authConfig, silent) {
+async function getExactDataplaneUrl(controllerUrl, environment, authConfig, silent) {
   try {
-    const fallbackUrl = await getDataplaneUrl(controllerUrl, 'dataplane', environment, authConfig);
+    const dataplaneUrl = await getDataplaneUrl(
+      controllerUrl,
+      DATAPLANE_APPLICATION_KEY,
+      environment,
+      authConfig
+    );
     if (!silent) {
-      logger.log(formatSuccessLine(`Dataplane URL: ${fallbackUrl}`));
+      logger.log(formatSuccessLine(`Dataplane URL: ${dataplaneUrl}`));
     }
-    return fallbackUrl;
-  } catch (fallbackError) {
-    if (isNotFoundError(fallbackError)) {
+    return dataplaneUrl;
+  } catch (error) {
+    if (isNotFoundError(error)) {
       throw createDataplaneNotFoundError();
     }
-    throw fallbackError;
+    throw error;
   }
 }
 
@@ -105,15 +78,7 @@ async function discoverDataplaneUrl(controllerUrl, environment, authConfig, opts
     logger.log(formatProgress('Getting dataplane URL from controller...'));
   }
   try {
-    const dataplaneAppKey = await findDataplaneServiceAppKey(controllerUrl, environment, authConfig);
-    if (dataplaneAppKey) {
-      const dataplaneUrl = await getDataplaneUrl(controllerUrl, dataplaneAppKey, environment, authConfig);
-      if (!silent) {
-        logger.log(formatSuccessLine(`Dataplane URL: ${dataplaneUrl}`));
-      }
-      return dataplaneUrl;
-    }
-    return await tryFallbackDataplaneUrl(controllerUrl, environment, authConfig, silent);
+    return await getExactDataplaneUrl(controllerUrl, environment, authConfig, silent);
   } catch (error) {
     if (error.message.includes('Could not discover dataplane URL')) {
       throw error;
@@ -126,6 +91,5 @@ async function discoverDataplaneUrl(controllerUrl, environment, authConfig, opts
 }
 
 module.exports = {
-  discoverDataplaneUrl,
-  findDataplaneServiceAppKey
+  discoverDataplaneUrl
 };

package/lib/datasource/datasource-validate-summary.js

@@ -74,17 +74,20 @@ function summarizeSyncLine(sync) {
   if (!sync || typeof sync !== 'object') {
     return 'Not configured';
   }
-  const parts = [];
+  const disabled = sync.enabled === false;
+  const parts = [disabled ? 'disabled' : sync.enabled === true ? 'enabled' : 'enabled (legacy default)'];
+  if (sync.schedule) {
+    parts.push(`${disabled ? 'retained schedule' : 'scheduled'} ${JSON.stringify(sync.schedule)}`);
+  } else {
+    parts.push('manual-only');
+  }
   if (sync.mode) {
     parts.push(String(sync.mode));
   }
   if (sync.batchSize !== undefined && sync.batchSize !== null) {
     parts.push(`batch size ${sync.batchSize}`);
   }
-  if (sync.schedule) {
-    parts.push(`schedule ${JSON.stringify(sync.schedule)}`);
-  }
-  return parts.length ? parts.join(', ') : 'Present';
+  return parts.join(', ');
 }
 
 /**

package/lib/datasource/sync-defaults.js

@@ -0,0 +1,53 @@
+/**
+ * Datasource synchronization defaults for newly authored sync blocks.
+ * @fileoverview Keeps default creation separate from preservation decisions.
+ */
+
+'use strict';
+
+const DEFAULT_DATASOURCE_SYNC = Object.freeze({
+  enabled: true,
+  mode: 'pull',
+  schedule: '@monthly',
+  batchSize: 500
+});
+
+const DATASOURCE_SYNC_MODES = new Set(['pull', 'push', 'bidirectional']);
+
+/**
+ * @param {Record<string, unknown>} [overrides]
+ * @returns {Record<string, unknown>}
+ */
+function createDefaultDatasourceSync(overrides = {}) {
+  return { ...DEFAULT_DATASOURCE_SYNC, ...overrides };
+}
+
+/**
+ * Resolve sync for a newly materialized BID datasource.
+ * An explicit datasource block is preserved exactly, including no schedule.
+ * @param {Record<string, unknown>} datasource
+ * @param {Record<string, unknown>} bidSync
+ * @returns {unknown}
+ */
+function resolveAuthoredDatasourceSync(datasource, bidSync) {
+  if (Object.prototype.hasOwnProperty.call(datasource, 'sync')) {
+    const explicit = datasource.sync;
+    return explicit && typeof explicit === 'object' ? { ...explicit } : explicit;
+  }
+  const overrides = {};
+  for (const key of ['enabled', 'schedule', 'batchSize']) {
+    if (Object.prototype.hasOwnProperty.call(bidSync, key)) {
+      overrides[key] = bidSync[key];
+    }
+  }
+  if (DATASOURCE_SYNC_MODES.has(String(bidSync.mode))) {
+    overrides.mode = bidSync.mode;
+  }
+  return createDefaultDatasourceSync(overrides);
+}
+
+module.exports = {
+  DEFAULT_DATASOURCE_SYNC,
+  createDefaultDatasourceSync,
+  resolveAuthoredDatasourceSync
+};

package/lib/deployment/installation/azure-infra-stage.js

@@ -50,6 +50,16 @@ async function applyAccessOptions(doc, input, deps) {
   if (input.preset !== undefined) {
     doc.preset = { ...doc.preset, value: normalizePreset(input.preset), source: 'cli' };
   }
+  // The template sizes compute and PostgreSQL from capacityProfile, and the workspace already
+  // records a preset with the same values. Deriving one from the other keeps a single source:
+  // an installation cannot end up recording preset 'm' while deploying 's'.
+  if (doc.parameters.capacityProfile) {
+    doc.parameters.capacityProfile = {
+      ...doc.parameters.capacityProfile,
+      value: normalizePreset(doc.preset.value),
+      source: 'workspacePreset'
+    };
+  }
   applyLicenseOptions(doc, input);
   const enabled = input.allowMyIp || doc.allowMyIp.value === true;
   if (!enabled) {

package/lib/deployment/installation/azure-preflight.js

@@ -127,10 +127,21 @@ function assertDeploymentAuthority(doc, acr, az) {
   if (!hasPermission(az, subscriptionScope, DEPLOYMENT_WRITE)) {
     throw new Error(`The signed-in Azure account cannot create deployments in subscription ${doc.subscriptionId.value}`);
   }
-  if (isAdminAcrAuth(doc)) return;
+  // Checked separately, because they are different permissions on different resources.
+  //
+  // Credential mode used to return here and skip both. That was wrong for the first one: the
+  // installation still needs Contributor granted in the resource group it is creating, and
+  // skipping the check hid the fact that the grant was being skipped too. The controller then
+  // could not create anything, and the failure surfaced three layers away as "Environment 'dev'
+  // has no recorded placement".
   if (doc.parameters.deployRoleAssignments.value !== false && !hasPermission(az, subscriptionScope, ROLE_ASSIGNMENT_WRITE)) {
-    throw new Error(`The signed-in Azure account cannot create role assignments in subscription ${doc.subscriptionId.value}; ask for Owner or User Access Administrator, or set parameters.deployRoleAssignments.value to false when roles already exist, or use --acr-auth credentials with a pair saved by "aifabrix dev set-registry"`);
+    throw new Error(`The signed-in Azure account cannot create role assignments in subscription ${doc.subscriptionId.value}; ask for Owner or User Access Administrator, or set parameters.deployRoleAssignments.value to false when roles already exist`);
   }
+  // The AcrPull grant reaches into the registry's own resource group, which a customer
+  // installation cannot touch at all. Credential mode does not request it, so do not require
+  // permission for it.
+  if (isAdminAcrAuth(doc)) return;
+  if (doc.parameters.deployRegistryRoleAssignment?.value === false) return;
   if (!hasPermission(az, acr.id, ROLE_ASSIGNMENT_WRITE)) {
     throw new Error(`The signed-in Azure account cannot assign AcrPull on registry ${doc.acrName.value}; ask for Owner or User Access Administrator on that registry, or use --acr-auth credentials with a pair saved by "aifabrix dev set-registry"`);
   }

package/lib/deployment/installation/azure-readiness.js

@@ -82,14 +82,36 @@ function verifyRuntimeImagePull(doc, az) {
   }
 }
 
+/**
+ * Attempts allowed for Miso readiness, at 10-second intervals.
+ *
+ * Miso runs first-time onboarding inside startup, and on Azure that onboarding is normally
+ * interrupted once — the template applies post-Key-Vault app settings and restarts the site — so
+ * the retry runs too. A clean installation was measured taking 720 seconds to pass its warm-up
+ * probe, and ce-10 was failed at 300 by the old default of 30 attempts.
+ *
+ * Reporting `readiness did not pass` for a healthy installation is worse than waiting: it leaves
+ * `controllerUrl` unrecorded, and `--stage dev` then refuses with "Shared infrastructure is not
+ * deployed for this workspace" on infrastructure that is deployed and serving.
+ *
+ * 180 attempts is 30 minutes, matching WEBSITES_CONTAINER_START_TIME_LIMIT. Keycloak keeps the
+ * shorter default: it does not run onboarding, and it is already up by the time Miso answers.
+ */
+const MISO_READINESS_ATTEMPTS = 180;
+
 /**
  * Waits for Miso and Keycloak to start after pulling their images.
  * @param {Object} doc - Infra manifest with outputs
- * @param {Function} probe - probeHttps(baseUrl, path, label)
+ * @param {Function} probe - probeHttps(baseUrl, path, label, attempts)
  * @returns {Promise<void>}
  */
 async function waitForApplications(doc, probe) {
-  await probe(doc.outputs.webAppUrl.value, '/api/v1/health/readiness', 'Miso');
+  await probe(
+    doc.outputs.webAppUrl.value,
+    '/api/v1/health/readiness',
+    'Miso',
+    MISO_READINESS_ATTEMPTS
+  );
   const realmUrl = doc.outputs.keycloakRealmUrl.value;
   if (typeof realmUrl !== 'string' || !realmUrl.startsWith('https://')) {
     throw new Error('ARM output keycloakRealmUrl is not a valid HTTPS URL');