@aifabrix/builder 2.58.0 → 2.60.0

package/lib/commands/upload-qualification-client.js

@@ -1,6 +1,6 @@
 /**
  * @fileoverview Resumable Dataplane qualification upload: accept, --wait/--no-wait, poll, resume.
- * Mirrors dev-host-ops.js's job id + wait/no-wait contract (plan 191.0 task 1). Never invents
+ * Mirrors dev-host-ops.js's job id + wait/no-wait contract. Never invents
  * qualification truth — accept/poll surface exactly what Dataplane returns.
  * @author AI Fabrix Team
  * @version 1.0.0
@@ -12,13 +12,38 @@ const logger = require('../utils/logger');
 const { formatSuccessLine, formatWarningLine } = require('../utils/cli-test-layout-chalk');
 const { formatApiError } = require('../utils/api-error-handler');
 const { uploadApplicationViaPipelineWithAuthRetry } = require('../utils/pipeline-upload-auth-retry');
-const { pollQualificationJobUntilTerminal } = require('./upload-qualification-poll');
+const { pollQualificationJobUntilTerminal, requireQualificationSuccess,
+  isTransientQualificationPollError } = require('./upload-qualification-poll');
 const { createQualificationPollHandlers } = require('../utils/qualification-poll-ui');
 
+function isAmbiguousAcceptance(error) {
+  const status = error?.response?.status || error?.statusCode || error?.status;
+  const code = error?.cause?.code || error?.code;
+  return isTransientQualificationPollError(status) || (!status && (
+    error instanceof TypeError || ['AbortError', 'TimeoutError'].includes(error?.name) ||
+    ['ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT', 'EAI_AGAIN', 'ENOTFOUND',
+      'ECONNABORTED', 'UND_ERR_CONNECT_TIMEOUT'].includes(code)
+  ));
+}
+
+async function submitQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options) {
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      const res = await uploadApplicationViaPipelineWithAuthRetry(
+        dataplaneUrl, authConfig, payload, systemKey, options
+      );
+      if (res?.success !== false || !isTransientQualificationPollError(res.status) || attempt === 1) {
+        return res;
+      }
+    } catch (error) {
+      if (!isAmbiguousAcceptance(error) || attempt === 1) throw error;
+    }
+  }
+}
+
 /**
- * Ctrl-C / disconnect during polling must detach without corrupting truth (plan 191.0 task 4):
- * the qualification job keeps running on Dataplane regardless of whether this CLI process exits.
- * This only makes that safe fact visible, printing the resume command before exiting 130.
+ * Ctrl-C detaches from status following without asserting an unobserved job outcome.
+ * Prints the resume command before exiting 130.
  * @param {string} jobId
  * @param {string} systemKey
  * @returns {() => void} Call to remove the listeners once polling finishes normally.
@@ -27,7 +52,7 @@ function registerUploadInterruptHint(jobId, systemKey) {
   const onSignal = () => {
     logger.log(
       formatWarningLine(
-        `Interrupted — upload job ${jobId} is still running, unaffected. Resume with: aifabrix upload ${systemKey} --resume ${jobId}`
+        `Stopped following upload job ${jobId}; its current outcome is unknown. Resume with: aifabrix upload ${systemKey} --resume ${jobId}`
       )
     );
     process.exit(130);
@@ -52,12 +77,24 @@ function registerUploadInterruptHint(jobId, systemKey) {
  * @returns {Promise<{jobId: string, state: string, resumed: boolean, candidateFingerprint: string}>}
  */
 async function acceptQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options = {}) {
-  const res = await uploadApplicationViaPipelineWithAuthRetry(dataplaneUrl, authConfig, payload, systemKey, {
-    ...options,
-    async: true
-  });
+  let res;
+  try {
+    res = await submitQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, {
+      ...options,
+      async: true
+    });
+  } catch (error) {
+    if (!isAmbiguousAcceptance(error)) throw error;
+    const unknown = new Error('Upload acceptance outcome is unknown. Rerun the same upload command to recover the job.');
+    unknown.cause = error;
+    unknown.statusCode = error?.response?.status || error?.statusCode || error?.status;
+    throw unknown;
+  }
   if (res?.success === false) {
-    const err = new Error(formatApiError(res, dataplaneUrl));
+    const ambiguous = isTransientQualificationPollError(res.status);
+    const err = new Error(ambiguous
+      ? 'Upload acceptance outcome is unknown. Rerun the same upload command to recover the job.'
+      : formatApiError(res, dataplaneUrl));
     const status = Number(res.status || res.statusCode);
     err.statusCode = status >= 400 && status < 600 ? status : 400;
     throw err;
@@ -107,6 +144,14 @@ async function resumeQualificationUpload(dataplaneUrl, authConfig, jobId, system
  */
 async function runQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options = {}) {
   const accepted = await acceptQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options);
+  if (accepted.state === 'completed' || accepted.state === 'failed') {
+    requireQualificationSuccess(accepted);
+    return {
+      ...accepted,
+      candidateFingerprint: accepted.result?.candidateFingerprint,
+      terminal: accepted
+    };
+  }
   const wait = options.wait !== false;
   if (!wait) {
     if (options.json) {

package/lib/commands/upload-qualification-poll.js

@@ -1,5 +1,5 @@
 /**
- * @fileoverview Poll a Dataplane qualification (publish) job until terminal (plan 191.0 task 1).
+ * @fileoverview Poll a Dataplane qualification job while retaining resumable identity.
  * Never invents success and never marks the candidate failed just because the CLI stopped polling —
  * timing out returns a resumable jobId instead.
  * @author AI Fabrix Team
@@ -13,7 +13,7 @@ const { formatApiError } = require('../utils/api-error-handler');
 
 const POLL_INTERVAL_MS = 3000;
 const POLL_TIMEOUT_MS = 30 * 60 * 1000;
-const TRANSIENT_HTTP_STATUSES = new Set([502, 503, 504]);
+const TRANSIENT_HTTP_STATUSES = new Set([429, 502, 503, 504]);
 const MAX_TRANSIENT_POLL_ERRORS = 20;
 
 const GOVERNANCE_SCENARIOS_MISSING = 'GOVERNANCE_SCENARIOS_MISSING';
@@ -46,6 +46,17 @@ function formatQualificationJobFailure(job) {
   };
 }
 
+/** Throw only for an authoritative stored failure, retaining the original job. */
+function requireQualificationSuccess(job) {
+  if (job.state !== 'failed') return;
+  const failure = formatQualificationJobFailure(job);
+  const err = new Error(failure.message);
+  err.jobId = job.jobId;
+  err.job = job;
+  err.skipDoctor = failure.userFacing;
+  throw err;
+}
+
 /**
  * @param {number|string} status
  * @returns {boolean}
@@ -54,6 +65,35 @@ function isTransientQualificationPollError(status) {
   return TRANSIENT_HTTP_STATUSES.has(Number(status));
 }
 
+/** Preserve the accepted identity without asserting a business outcome. */
+function unavailableJob(jobId, message) {
+  const error = new Error(
+    `${message} Job ${jobId}: status unavailable. Resume with: aifabrix upload <systemKey> --resume ${jobId}`
+  );
+  error.jobId = jobId;
+  error.resumable = true;
+  return error;
+}
+
+/** Normalize transport exceptions so returned HTTP errors and throws share retries. */
+async function readQualificationJob(dataplaneUrl, authConfig, jobId) {
+  try {
+    return await getPublishJobStatus(dataplaneUrl, authConfig, jobId);
+  } catch (error) {
+    const status = error?.response?.status || error?.statusCode || error?.status;
+    const code = error?.cause?.code || error?.code;
+    const network = ['ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT', 'EAI_AGAIN',
+      'ENOTFOUND', 'ECONNABORTED', 'UND_ERR_CONNECT_TIMEOUT'].includes(code) ||
+      error instanceof TypeError || ['AbortError', 'TimeoutError'].includes(error?.name);
+    if (isTransientQualificationPollError(status) || (!status && network)) {
+      return { success: false, status: status || 503 };
+    }
+    const failure = unavailableJob(jobId, 'Unable to check upload progress.');
+    failure.statusCode = status;
+    throw failure;
+  }
+}
+
 /**
  * @param {string} dataplaneUrl
  * @param {Object} authConfig
@@ -64,19 +104,19 @@ function isTransientQualificationPollError(status) {
 async function fetchQualificationJobWithRetry(dataplaneUrl, authConfig, jobId, pollUi = {}) {
   const started = Date.now();
   for (let attempt = 0; attempt <= MAX_TRANSIENT_POLL_ERRORS; attempt += 1) {
-    const res = await getPublishJobStatus(dataplaneUrl, authConfig, jobId);
+    const res = await readQualificationJob(dataplaneUrl, authConfig, jobId);
     if (res?.success !== false) {
       return res.data;
     }
     if (!isTransientQualificationPollError(res.status)) {
-      const err = new Error(formatApiError(res, dataplaneUrl));
+      const err = unavailableJob(jobId, formatApiError(res, dataplaneUrl));
       const status = Number(res.status);
       err.statusCode = status >= 400 && status < 600 ? status : 400;
       throw err;
     }
     if (attempt >= MAX_TRANSIENT_POLL_ERRORS) {
-      throw new Error(
-        `The upload service returned HTTP ${res.status} repeatedly while waiting for job ${jobId}.`
+      throw unavailableJob(
+        jobId, `The upload service returned HTTP ${res.status} repeatedly.`
       );
     }
     if (typeof pollUi.onTransientError === 'function') {
@@ -84,13 +124,13 @@ async function fetchQualificationJobWithRetry(dataplaneUrl, authConfig, jobId, p
     }
     await sleep(POLL_INTERVAL_MS);
   }
-  throw new Error(`Failed to check upload job ${jobId} after transient retries`);
+  throw unavailableJob(jobId, 'Status retries exhausted.');
 }
 
 /**
  * Poll a Dataplane qualification job to terminal state (completed|failed). The timeout only
  * bounds how long *this CLI process* waits — Dataplane keeps running the job regardless; timing
- * out returns a resumable jobId, never a fabricated failure (plan 191.0 task 4).
+ * out returns a resumable jobId, never a fabricated failure.
  * @param {string} dataplaneUrl
  * @param {Object} authConfig
  * @param {string} jobId
@@ -112,25 +152,13 @@ async function pollQualificationJobUntilTerminal(
     if (typeof pollUi.onPollProgress === 'function') {
       pollUi.onPollProgress(job);
     }
-    if (job.state === 'failed') {
-      const failure = formatQualificationJobFailure(job);
-      const err = new Error(failure.message);
-      err.jobId = jobId;
-      err.job = job;
-      err.skipDoctor = failure.userFacing;
-      throw err;
-    }
+    requireQualificationSuccess(job);
     if (job.state === 'completed') {
       return job;
     }
     await sleep(POLL_INTERVAL_MS);
   }
-  const timeoutErr = new Error(
-    `Timed out waiting for upload job ${jobId}. It is still running — resume with: aifabrix upload <systemKey> --resume ${jobId}`
-  );
-  timeoutErr.jobId = jobId;
-  timeoutErr.resumable = true;
-  throw timeoutErr;
+  throw unavailableJob(jobId, 'Timed out waiting for upload progress.');
 }
 
 module.exports = {
@@ -139,5 +167,6 @@ module.exports = {
   isTransientQualificationPollError,
   fetchQualificationJobWithRetry,
   formatQualificationJobFailure,
+  requireQualificationSuccess,
   pollQualificationJobUntilTerminal
 };

package/lib/commands/wizard-dataplane.js

@@ -4,43 +4,11 @@
  * @version 2.0.0
  */
 
-const chalk = require('chalk');
 const logger = require('../utils/logger');
 const { formatProgress, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 const { getDataplaneUrl } = require('../datasource/deploy');
-const { listEnvironmentApplications } = require('../api/environments.api');
 
-/**
- * Find dataplane service application key from environment applications list
- * @async
- * @function findDataplaneServiceAppKey
- * @param {string} controllerUrl - Controller URL
- * @param {string} environment - Environment key
- * @param {Object} authConfig - Authentication configuration
- * @returns {Promise<string|null>} Dataplane service appKey or null if not found
- */
-// eslint-disable-next-line complexity
-async function findDataplaneServiceAppKey(controllerUrl, environment, authConfig) {
-  try {
-    const response = await listEnvironmentApplications(controllerUrl, environment, authConfig, { pageSize: 100 });
-    if (!response.success || !response.data) return null;
-    const applications = response.data.data || response.data || [];
-    for (const app of applications) {
-      const appKey = app.key || app.id;
-      if (!appKey) continue;
-      const keyLower = appKey.toLowerCase();
-      const appType = app.configuration?.type || app.type;
-      const nameLower = (app.displayName || app.name || '').toLowerCase();
-      if (keyLower === 'dataplane' || keyLower.includes('dataplane') || (appType === 'service' && nameLower.includes('dataplane'))) {
-        return appKey;
-      }
-    }
-    return null;
-  } catch (error) {
-    logger.log(chalk.gray(`  Could not list applications: ${error.message}`));
-    return null;
-  }
-}
+const DATAPLANE_APPLICATION_KEY = 'dataplane';
 
 /**
  * Check if error is a "Not Found" error
@@ -65,7 +33,7 @@ function createDataplaneNotFoundError() {
 }
 
 /**
- * Try to get dataplane URL using fallback app key
+ * Get dataplane URL from the canonical controller application key.
  * @async
  * @param {string} controllerUrl - Controller URL
  * @param {string} environment - Environment key
@@ -73,18 +41,23 @@ function createDataplaneNotFoundError() {
  * @returns {Promise<string>} Dataplane URL
  * @throws {Error} If dataplane URL cannot be retrieved
  */
-async function tryFallbackDataplaneUrl(controllerUrl, environment, authConfig, silent) {
+async function getExactDataplaneUrl(controllerUrl, environment, authConfig, silent) {
   try {
-    const fallbackUrl = await getDataplaneUrl(controllerUrl, 'dataplane', environment, authConfig);
+    const dataplaneUrl = await getDataplaneUrl(
+      controllerUrl,
+      DATAPLANE_APPLICATION_KEY,
+      environment,
+      authConfig
+    );
     if (!silent) {
-      logger.log(formatSuccessLine(`Dataplane URL: ${fallbackUrl}`));
+      logger.log(formatSuccessLine(`Dataplane URL: ${dataplaneUrl}`));
     }
-    return fallbackUrl;
-  } catch (fallbackError) {
-    if (isNotFoundError(fallbackError)) {
+    return dataplaneUrl;
+  } catch (error) {
+    if (isNotFoundError(error)) {
       throw createDataplaneNotFoundError();
     }
-    throw fallbackError;
+    throw error;
   }
 }
 
@@ -105,15 +78,7 @@ async function discoverDataplaneUrl(controllerUrl, environment, authConfig, opts
     logger.log(formatProgress('Getting dataplane URL from controller...'));
   }
   try {
-    const dataplaneAppKey = await findDataplaneServiceAppKey(controllerUrl, environment, authConfig);
-    if (dataplaneAppKey) {
-      const dataplaneUrl = await getDataplaneUrl(controllerUrl, dataplaneAppKey, environment, authConfig);
-      if (!silent) {
-        logger.log(formatSuccessLine(`Dataplane URL: ${dataplaneUrl}`));
-      }
-      return dataplaneUrl;
-    }
-    return await tryFallbackDataplaneUrl(controllerUrl, environment, authConfig, silent);
+    return await getExactDataplaneUrl(controllerUrl, environment, authConfig, silent);
   } catch (error) {
     if (error.message.includes('Could not discover dataplane URL')) {
       throw error;
@@ -126,6 +91,5 @@ async function discoverDataplaneUrl(controllerUrl, environment, authConfig, opts
 }
 
 module.exports = {
-  discoverDataplaneUrl,
-  findDataplaneServiceAppKey
+  discoverDataplaneUrl
 };

package/lib/core/env-platform-expand.js

@@ -0,0 +1,93 @@
+/**
+ * `{NAME}` expansion in env content (plan 200.0).
+ *
+ * Values resolved from the manifest `platforms` / `environments` sections are substituted into
+ * `env.template` values. Runs after `kv://` and before `url://`, so a resolved value may itself
+ * carry a declarative URL.
+ *
+ * Only the value side of `KEY=value` is touched, and only `{UPPER_SNAKE}` tokens that are not
+ * preceded by `$`. That leaves Builder's existing `${VAR}` expansion and `{lowercase}` text in
+ * comments alone — both appear in shipped templates.
+ *
+ * @fileoverview Platform/environment name expansion for env.template
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { resolveConfiguration } = require('../utils/platform-resolution');
+
+/** `{NAME}` not preceded by `$`; uppercase only, matching the configuration name pattern. */
+const NAME_TOKEN = /(?<!\$)\{([A-Z_][A-Z0-9_]*)\}/g;
+
+/**
+ * @param {Object} [manifest] - Application manifest
+ * @returns {boolean} True when the manifest declares either section
+ */
+function declaresPlatformSections(manifest) {
+  if (!manifest || typeof manifest !== 'object') return false;
+  return Array.isArray(manifest.platforms) || Array.isArray(manifest.environments);
+}
+
+function expandValue(value, values, key, strict, context = {}) {
+  return value.replace(NAME_TOKEN, (match, name) => {
+    if (Object.prototype.hasOwnProperty.call(values, name)) return values[name];
+    if (!strict) return match;
+    // Without a resource group no platform matched, so only environments and built-ins resolved.
+    // Saying so turns "why is this missing" into "declare it here".
+    const where = context.resourceGroup
+      ? `resource group "${context.resourceGroup}" and environment "${context.environment || ''}"`
+      : `environment "${context.environment || ''}" (no resource group, so platform values are unavailable)`;
+    throw new Error(
+      `${key} references {${name}}, which no platform or environment configuration resolves for ` +
+      `${where}. Declare it under environments, or run against a resource group that supplies it.`
+    );
+  });
+}
+
+/**
+ * Expands `{NAME}` on the value side of every assignment line.
+ * @param {string} content - Env content
+ * @param {Object} values - Resolved names
+ * @param {Object} [opts] - `strict` (default true) errors on an unresolved name; false leaves the
+ *   token in place for a later resolver (the deploy manifest, resolved by Miso per installation)
+ * @returns {string}
+ * @throws {Error} When strict and a referenced name is not resolved
+ */
+function expandNamesInEnvContent(content, values, opts = {}) {
+  const strict = opts.strict !== false;
+  const context = { environment: opts.environment, resourceGroup: opts.resourceGroup };
+  const lines = String(content || '').split('\n');
+  const out = lines.map(line => {
+    const trimmed = line.trimStart();
+    if (!trimmed || trimmed.startsWith('#')) return line;
+    const separator = line.indexOf('=');
+    if (separator < 0) return line;
+    const key = line.slice(0, separator);
+    const value = line.slice(separator + 1);
+    return `${key}=${expandValue(value, values, key.trim(), strict, context)}`;
+  });
+  return out.join('\n');
+}
+
+/**
+ * Resolves the manifest sections and expands `{NAME}` when either section is declared.
+ * A manifest without them is returned untouched, so existing applications are unaffected.
+ * @param {string} content - Env content after kv:// resolution
+ * @param {Object} params - `manifest`, `environment` (deployment env key), `resourceGroup`, `strict`
+ * @returns {string}
+ */
+function expandPlatformNamesIfPresent(content, params = {}) {
+  const { manifest, environment, resourceGroup, strict } = params;
+  if (!declaresPlatformSections(manifest)) return content;
+  const { values } = resolveConfiguration(manifest, { environment, resourceGroup });
+  return expandNamesInEnvContent(content, values, { strict, environment, resourceGroup });
+}
+
+module.exports = {
+  NAME_TOKEN,
+  declaresPlatformSections,
+  expandNamesInEnvContent,
+  expandPlatformNamesIfPresent
+};

package/lib/core/secrets-env-content.js

@@ -44,6 +44,7 @@ const { computeEffectiveEnvironmentScopedResources, redisDbIndexForScopedRunEnv
 const { applyRedisDbIndexToEnvContent } = require('../utils/redis-env-scope');
 const { expandDeclarativeUrlsIfPresent } = require('./secrets-env-declarative-expand');
 const {
+  mergeAdditionalPublishedPorts,
   mergeDockerManifestPublishedPort,
   rewriteDockerManifestPublicPortEnvLine
 } = require('../utils/docker-manifest-public-port');
@@ -154,6 +155,12 @@ async function getDockerRedisDbEndpoints() {
   return { redisHost, redisPort, dbHost, dbPort };
 }
 
+/** Host ports clients connect to: the manifest's own, plus any additionalPorts. */
+async function mergePublishedPorts(envVars, appDoc) {
+  await mergeDockerManifestPublishedPort(envVars, appDoc);
+  await mergeAdditionalPublishedPorts(envVars, appDoc);
+}
+
 /** Docker env transformations: ports, infra endpoints, PORT. */
 async function applyDockerTransformations(resolved, variablesPath) {
   resolved = await resolveServicePortsInEnvContent(resolved, 'docker');
@@ -164,7 +171,7 @@ async function applyDockerTransformations(resolved, variablesPath) {
   const containerPort = getContainerPortFromPath(variablesPath) ?? getContainerPortFromDockerEnv(dockerEnv) ?? 3000;
   const envVars = await buildEnvVarMap('docker', null, null, { appPort: containerPort });
   const appDoc = loadVariablesFromPath(variablesPath);
-  await mergeDockerManifestPublishedPort(envVars, appDoc);
+  await mergePublishedPorts(envVars, appDoc);
   envVars.REDIS_HOST = redisHost;
   envVars.REDIS_PORT = String(redisPort);
   envVars.DB_HOST = dbHost;
@@ -187,6 +194,32 @@ async function applyEnvironmentTransformations(resolved, environment, variablesP
   return resolved;
 }
 
+/**
+ * Expands manifest `{NAME}` values when the application declares platforms/environments.
+ * Local Builder runs pass no resource group, so they resolve as the local platform.
+ * @param {string} content - Env content after kv:// resolution
+ * @param {string|null} variablesPath - Application manifest path (null in env-only mode)
+ * @param {string} runEnvKey - Deployment environment key
+ * @param {Object} [options] - `resourceGroup` when a deployment target is known
+ * @returns {string}
+ */
+function expandPlatformNamesForApp(content, variablesPath, runEnvKey, options = {}) {
+  if (!variablesPath) return content;
+  const { expandPlatformNamesIfPresent } = require('./env-platform-expand');
+  const { loadConfigFile } = require('../utils/config-format');
+  let manifest = null;
+  try {
+    manifest = loadConfigFile(variablesPath);
+  } catch {
+    return content;
+  }
+  return expandPlatformNamesIfPresent(content, {
+    manifest,
+    environment: runEnvKey,
+    resourceGroup: options.resourceGroup
+  });
+}
+
 /**
  * Generate .env content from template and secrets (no disk write).
  * When options.envOnly is true, variablesPath is null (no application config).
@@ -210,15 +243,16 @@ async function generateEnvContent(appName, secretsPath, environment = 'local', f
   }
   const secrets = await loadSecrets(secretsPath, appName);
   const { runEnvKey, effective } = await buildScopedKvContext(appPath, options);
-  const scopedKv = { envKey: runEnvKey, effective };
   let resolved = await resolveKvReferences(template, secrets, environment, secretsPaths, appName, {
     envKey: runEnvKey,
     effective,
     envTemplatePath: templatePath
   });
   if (!secretsPath) {
-    await materializeResolvedKvSecretsToUserLocal(template, secrets, scopedKv, options);
+    await materializeResolvedKvSecretsToUserLocal(template, secrets, { envKey: runEnvKey, effective }, options);
   }
+  // Platform/environment {NAME} before url://, so a resolved value may carry a declarative URL.
+  resolved = expandPlatformNamesForApp(resolved, variablesPath, runEnvKey, options);
   resolved = await expandDeclarativeUrlsIfPresent(
     resolved,
     appName,

package/lib/datasource/datasource-validate-summary.js

@@ -74,17 +74,20 @@ function summarizeSyncLine(sync) {
   if (!sync || typeof sync !== 'object') {
     return 'Not configured';
   }
-  const parts = [];
+  const disabled = sync.enabled === false;
+  const parts = [disabled ? 'disabled' : sync.enabled === true ? 'enabled' : 'enabled (legacy default)'];
+  if (sync.schedule) {
+    parts.push(`${disabled ? 'retained schedule' : 'scheduled'} ${JSON.stringify(sync.schedule)}`);
+  } else {
+    parts.push('manual-only');
+  }
   if (sync.mode) {
     parts.push(String(sync.mode));
   }
   if (sync.batchSize !== undefined && sync.batchSize !== null) {
     parts.push(`batch size ${sync.batchSize}`);
   }
-  if (sync.schedule) {
-    parts.push(`schedule ${JSON.stringify(sync.schedule)}`);
-  }
-  return parts.length ? parts.join(', ') : 'Present';
+  return parts.join(', ');
 }
 
 /**

package/lib/datasource/sync-defaults.js

@@ -0,0 +1,53 @@
+/**
+ * Datasource synchronization defaults for newly authored sync blocks.
+ * @fileoverview Keeps default creation separate from preservation decisions.
+ */
+
+'use strict';
+
+const DEFAULT_DATASOURCE_SYNC = Object.freeze({
+  enabled: true,
+  mode: 'pull',
+  schedule: '@monthly',
+  batchSize: 500
+});
+
+const DATASOURCE_SYNC_MODES = new Set(['pull', 'push', 'bidirectional']);
+
+/**
+ * @param {Record<string, unknown>} [overrides]
+ * @returns {Record<string, unknown>}
+ */
+function createDefaultDatasourceSync(overrides = {}) {
+  return { ...DEFAULT_DATASOURCE_SYNC, ...overrides };
+}
+
+/**
+ * Resolve sync for a newly materialized BID datasource.
+ * An explicit datasource block is preserved exactly, including no schedule.
+ * @param {Record<string, unknown>} datasource
+ * @param {Record<string, unknown>} bidSync
+ * @returns {unknown}
+ */
+function resolveAuthoredDatasourceSync(datasource, bidSync) {
+  if (Object.prototype.hasOwnProperty.call(datasource, 'sync')) {
+    const explicit = datasource.sync;
+    return explicit && typeof explicit === 'object' ? { ...explicit } : explicit;
+  }
+  const overrides = {};
+  for (const key of ['enabled', 'schedule', 'batchSize']) {
+    if (Object.prototype.hasOwnProperty.call(bidSync, key)) {
+      overrides[key] = bidSync[key];
+    }
+  }
+  if (DATASOURCE_SYNC_MODES.has(String(bidSync.mode))) {
+    overrides.mode = bidSync.mode;
+  }
+  return createDefaultDatasourceSync(overrides);
+}
+
+module.exports = {
+  DEFAULT_DATASOURCE_SYNC,
+  createDefaultDatasourceSync,
+  resolveAuthoredDatasourceSync
+};

package/lib/deployment/installation/azure-infra-stage.js

@@ -24,7 +24,9 @@ const preflight = require('./azure-preflight');
 const readiness = require('./azure-readiness');
 const registryAuth = require('./registry-auth-mode');
 
-const INFRA_SECRETS = Object.freeze(['ADMIN_PASSWORD', 'ENCRYPTION_KEY', 'MORI_CALLBACK_API_KEY']);
+// The Marketplace template stopped accepting moriCallbackApiKey: the installation receives its
+// Mori key at licence registration instead, so infra no longer provisions or projects one.
+const INFRA_SECRETS = Object.freeze(['ADMIN_PASSWORD', 'ENCRYPTION_KEY']);
 
 function missingInputError(file, fields) {
   const error = new Error(
@@ -50,6 +52,16 @@ async function applyAccessOptions(doc, input, deps) {
   if (input.preset !== undefined) {
     doc.preset = { ...doc.preset, value: normalizePreset(input.preset), source: 'cli' };
   }
+  // The template sizes compute and PostgreSQL from capacityProfile, and the workspace already
+  // records a preset with the same values. Deriving one from the other keeps a single source:
+  // an installation cannot end up recording preset 'm' while deploying 's'.
+  if (doc.parameters.capacityProfile) {
+    doc.parameters.capacityProfile = {
+      ...doc.parameters.capacityProfile,
+      value: normalizePreset(doc.preset.value),
+      source: 'workspacePreset'
+    };
+  }
   applyLicenseOptions(doc, input);
   const enabled = input.allowMyIp || doc.allowMyIp.value === true;
   if (!enabled) {

package/lib/deployment/installation/azure-preflight.js

@@ -127,10 +127,21 @@ function assertDeploymentAuthority(doc, acr, az) {
   if (!hasPermission(az, subscriptionScope, DEPLOYMENT_WRITE)) {
     throw new Error(`The signed-in Azure account cannot create deployments in subscription ${doc.subscriptionId.value}`);
   }
-  if (isAdminAcrAuth(doc)) return;
+  // Checked separately, because they are different permissions on different resources.
+  //
+  // Credential mode used to return here and skip both. That was wrong for the first one: the
+  // installation still needs Contributor granted in the resource group it is creating, and
+  // skipping the check hid the fact that the grant was being skipped too. The controller then
+  // could not create anything, and the failure surfaced three layers away as "Environment 'dev'
+  // has no recorded placement".
   if (doc.parameters.deployRoleAssignments.value !== false && !hasPermission(az, subscriptionScope, ROLE_ASSIGNMENT_WRITE)) {
-    throw new Error(`The signed-in Azure account cannot create role assignments in subscription ${doc.subscriptionId.value}; ask for Owner or User Access Administrator, or set parameters.deployRoleAssignments.value to false when roles already exist, or use --acr-auth credentials with a pair saved by "aifabrix dev set-registry"`);
+    throw new Error(`The signed-in Azure account cannot create role assignments in subscription ${doc.subscriptionId.value}; ask for Owner or User Access Administrator, or set parameters.deployRoleAssignments.value to false when roles already exist`);
   }
+  // The AcrPull grant reaches into the registry's own resource group, which a customer
+  // installation cannot touch at all. Credential mode does not request it, so do not require
+  // permission for it.
+  if (isAdminAcrAuth(doc)) return;
+  if (doc.parameters.deployRegistryRoleAssignment?.value === false) return;
   if (!hasPermission(az, acr.id, ROLE_ASSIGNMENT_WRITE)) {
     throw new Error(`The signed-in Azure account cannot assign AcrPull on registry ${doc.acrName.value}; ask for Owner or User Access Administrator on that registry, or use --acr-auth credentials with a pair saved by "aifabrix dev set-registry"`);
   }