@aifabrix/builder 2.59.0 → 2.61.2

package/lib/role-assistant/test-runner-search.js

@@ -17,7 +17,7 @@ const {
   wantsSkillsOnlyPath
 } = require('./test-runner-workhub-helpers');
 
-function operationKeys(spec) {
+function directOperationKeys(spec) {
   const raw = Array.isArray(spec && spec.operations) ? spec.operations : [];
   const keys = [];
   for (const item of raw) {
@@ -33,6 +33,42 @@ function operationKeys(spec) {
   return keys;
 }
 
+function operationClassKeys(spec) {
+  const classes = spec && typeof spec.operationClasses === 'object'
+    ? spec.operationClasses
+    : {};
+  const keys = [];
+  for (const rows of Object.values(classes)) {
+    if (!Array.isArray(rows)) {
+      continue;
+    }
+    for (const row of rows) {
+      const key = String(row || '').trim();
+      if (key && !keys.includes(key)) {
+        keys.push(key);
+      }
+    }
+  }
+  return keys;
+}
+
+function operationKeys(spec) {
+  return [...new Set([...directOperationKeys(spec), ...operationClassKeys(spec)])];
+}
+
+function skillsRequestOptions(testCase) {
+  if (!wantsSkillsOnlyPath(testCase)) {
+    return undefined;
+  }
+  const input = resolveInput(testCase);
+  const resourceType = String(input.resourceType || '').trim();
+  const operation = String(input.operation || '').trim();
+  if (operation) {
+    return { detail: 'operation', resourceType, operation };
+  }
+  return resourceType ? { detail: 'resource', resourceType } : undefined;
+}
+
 function pickResourceType(skillsPayload, operation) {
   const rts = resourceTypesMap(skillsPayload);
   const keys = Object.keys(rts);
@@ -139,7 +175,12 @@ async function runSearchCaseLifecycle(roleKey, testCase, runtimeContext) {
     throw new Error('Role assistant search case requires dataplane auth context.');
   }
   const roleRef = resolveRoleRef(roleKey, testCase);
-  const skillsRes = await getWorkSkills(dataplaneUrl, authConfig, roleRef);
+  const skillsRes = await getWorkSkills(
+    dataplaneUrl,
+    authConfig,
+    roleRef,
+    skillsRequestOptions(testCase)
+  );
   if (wantsSkillsOnlyPath(testCase)) {
     return searchLifecycleResult(roleKey, testCase, roleRef, skillsRes, null, null);
   }
@@ -157,6 +198,7 @@ module.exports = {
   wantsSearchPath,
   wantsSkillsOnlyPath,
   operationKeys,
+  skillsRequestOptions,
   pickResourceType,
   resolveRoleRef,
   buildSearchArguments,

package/lib/role-assistant/test-runner-workhub-answers.js

@@ -5,6 +5,8 @@
 
 'use strict';
 
+const { coversMissingFields } = require('./test-runner-workhub-missing-fields');
+
 const {
   resolveTargetSystemKey,
   shouldStampSuiteBid,
@@ -409,7 +411,8 @@ function resolveRespondValue(testCase, wait, statusRow, objective) {
   if (fromCase !== undefined) {
     return fromCase;
   }
-  return synthesizeWaitAnswer(wait, statusRow, objective, testCase);
+  const synthesized = synthesizeWaitAnswer(wait, statusRow, objective, testCase);
+  return coversMissingFields(wait, synthesized) ? synthesized : undefined;
 }
 
 function waitRespondFingerprint(wait) {

package/lib/role-assistant/test-runner-workhub-missing-fields.js

@@ -0,0 +1,42 @@
+/**
+ * @fileoverview Missing-field coverage for synthesized Work Hub answers.
+ */
+
+'use strict';
+
+function asPlainObject(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return {};
+  }
+  return value;
+}
+
+/**
+ * Fields the runtime named as missing (missingRequestBody waits). A synthesized
+ * answer that lacks any of them only makes the runtime ask the same question
+ * again, so it must not be sent.
+ * @param {Object} wait
+ * @returns {string[]}
+ */
+function waitMissingFields(wait) {
+  const raw = wait?.objectRef && typeof wait.objectRef === 'object' ? wait.objectRef.missingFields : null;
+  const list = Array.isArray(raw) ? raw : String(raw || '').split(',');
+  return list.map((row) => String(row || '').trim()).filter(Boolean);
+}
+
+function coversMissingFields(wait, value) {
+  if (value === undefined) {
+    return false;
+  }
+  const missing = waitMissingFields(wait);
+  if (missing.length === 0) {
+    return true;
+  }
+  const obj = asPlainObject(value);
+  if (!obj) {
+    return false;
+  }
+  return missing.every((field) => obj[field] !== undefined && obj[field] !== null && obj[field] !== '');
+}
+
+module.exports = { coversMissingFields, waitMissingFields };

package/lib/role-assistant/test-runner-workhub-wait-stop.js

@@ -0,0 +1,94 @@
+/**
+ * @fileoverview Work Hub poll stop rules for waits the runner cannot resolve.
+ *
+ * A wait with no matching case answer, a question the runtime re-issues
+ * unchanged after our answer, or a failed respond call never resolves by
+ * polling. Stopping at once keeps a stalled case at seconds, not the 180 s
+ * poll timeout (dev01 sales ladder, 2026-09-26: six cases, 18 min waiting).
+ */
+
+'use strict';
+
+const UNANSWERED_WAIT_TYPES = new Set(['respond-skipped', 'respond-repeated', 'respond-error']);
+
+/**
+ * The runtime asked the same question again after our answer: the answer did
+ * not resolve it, and repeating it cannot. Record once so the poll can stop.
+ */
+function recordRepeatedResponse(interactions, peId, fingerprint, wait) {
+  const already = interactions.some(
+    (row) => row && row.type === 'respond-repeated' && row.fingerprint === fingerprint
+  );
+  if (already) {
+    return;
+  }
+  interactions.push({
+    type: 'respond-repeated',
+    processExecutionId: peId,
+    fingerprint,
+    questionKey: wait.questionKey || wait.requestKey || null,
+    objectRefKind: wait.objectRef?.kind || null,
+    reason: 'same-question-after-answer'
+  });
+}
+
+function recordRespondError(interactions, peId, error) {
+  interactions.push({
+    type: 'respond-error',
+    processExecutionId: peId,
+    error: (error && error.message) || String(error)
+  });
+}
+
+/**
+ * A wait we could not answer (no matching case answer, the runtime re-asked
+ * after our answer, or respond failed) will not change by polling: stop now
+ * instead of waiting for the poll timeout.
+ * @param {Array<Object>} interactions
+ * @returns {string|null} stop reason or null to keep polling
+ */
+function unansweredWaitStopReason(interactions) {
+  const last = interactions.length > 0 ? interactions[interactions.length - 1] : null;
+  if (!last || !UNANSWERED_WAIT_TYPES.has(last.type)) {
+    return null;
+  }
+  return last.type === 'respond-error' ? 'respondFailed' : 'unansweredQuestion';
+}
+
+function recordSkippedResponse(interactions, peId, fingerprint, wait) {
+  interactions.push({
+    type: 'respond-skipped',
+    processExecutionId: peId,
+    fingerprint,
+    questionKey: wait.questionKey || wait.requestKey || null,
+    objectRefKind: wait.objectRef?.kind || null,
+    reason: 'no-matching-answer-or-synthesis'
+  });
+}
+
+const ALREADY_TERMINAL_RE = /already terminal/i;
+
+/**
+ * work.respond resumes the Decision Engine inline; by the time work.continue
+ * lands the execution may already be terminal. That is a finished run, not a
+ * failed answer.
+ */
+async function continueAfterRespond(dataplaneUrl, authConfig, peId) {
+  const { continueWorkExecution } = require('../api/work.api');
+  try {
+    await continueWorkExecution(dataplaneUrl, authConfig, peId, {});
+  } catch (err) {
+    if (!ALREADY_TERMINAL_RE.test((err && err.message) || String(err))) {
+      throw err;
+    }
+  }
+}
+
+module.exports = {
+  continueAfterRespond,
+  UNANSWERED_WAIT_TYPES,
+  recordSkippedResponse,
+  recordRepeatedResponse,
+  recordRespondError,
+  unansweredWaitStopReason
+};

package/lib/role-assistant/test-runner-workhub.js

@@ -13,8 +13,7 @@ const {
   getWorkTask,
   approveWorkTask,
   getWorkExecutionStatus,
-  respondWorkExecution,
-  continueWorkExecution
+  respondWorkExecution
 } = require('../api/work.api');
 const {
   synthesizeWaitAnswer,
@@ -29,6 +28,13 @@ const {
   persistCaseOpenApiViaBuilderApi
 } = require('./test-runner-bid-apply');
 const { resolveTargetSystemKey } = require('./test-runner-bid-document');
+const {
+  recordSkippedResponse,
+  recordRepeatedResponse,
+  recordRespondError,
+  unansweredWaitStopReason,
+  continueAfterRespond
+} = require('./test-runner-workhub-wait-stop');
 const {
   TERMINAL_TASK,
   delayMs,
@@ -178,17 +184,6 @@ async function maybeApproveTask(dataplaneUrl, authConfig, taskId, ctx) {
   await _attemptApproveTask(dataplaneUrl, authConfig, taskId, ctx);
 }
 
-function recordSkippedResponse(interactions, peId, fingerprint, wait) {
-  interactions.push({
-    type: 'respond-skipped',
-    processExecutionId: peId,
-    fingerprint,
-    questionKey: wait.questionKey || wait.requestKey || null,
-    objectRefKind: wait.objectRef?.kind || null,
-    reason: 'no-matching-answer-or-synthesis'
-  });
-}
-
 function recordBidEmit(testCase, interactions, peId) {
   const { loadCaseBidDocument } = require('./test-runner-workhub-answers');
   const emittedBid = loadCaseBidDocument(testCase);
@@ -237,6 +232,7 @@ async function respondToWaitingExecution(
   const wait = statusRow.wait && typeof statusRow.wait === 'object' ? statusRow.wait : {};
   const fingerprint = waitRespondFingerprint(wait);
   if (alreadyResponded(interactions, fingerprint)) {
+    recordRepeatedResponse(interactions, peId, fingerprint, wait);
     return;
   }
   const payload = buildRespondPayload(
@@ -260,7 +256,7 @@ async function respondToWaitingExecution(
     }
   }
   await respondWorkExecution(dataplaneUrl, authConfig, peId, payload);
-  await continueWorkExecution(dataplaneUrl, authConfig, peId, {});
+  await continueAfterRespond(dataplaneUrl, authConfig, peId);
   interactions.push({ type: 'respond', processExecutionId: peId, fingerprint });
   if (shouldApplyBidAfterWait(testCase, wait)) {
     recordBidEmit(testCase, interactions, peId);
@@ -291,8 +287,9 @@ async function maybeRespondWaiting(dataplaneUrl, authConfig, taskRow, testCase,
       interactions,
       statusRow
     );
-  } catch (_err) {
-    // Soft: continue polling task.
+  } catch (err) {
+    // A failed respond/continue never resolves itself; record it so the poll stops.
+    recordRespondError(interactions, peId, err);
   }
 }
 
@@ -301,7 +298,13 @@ function assertTerminalWorkHubTask(last, taskId, timeoutMs, options = {}) {
     throw new Error(`Work Hub task ${taskId} produced no status rows.`);
   }
   const finalStatusToken = String(last?.status || last?.taskStatus || '').trim().toLowerCase();
-  if (!TERMINAL_TASK.has(finalStatusToken) && options.recordTimeout === true) {
+  if (TERMINAL_TASK.has(finalStatusToken)) {
+    return last;
+  }
+  if (options.stoppedReason) {
+    return { ...last, pollStopped: options.stoppedReason, lastStatus: finalStatusToken || 'unknown' };
+  }
+  if (options.recordTimeout === true) {
     last = {
       ...last,
       pollTimedOut: true,
@@ -353,14 +356,18 @@ async function pollWorkHubTask(dataplaneUrl, authConfig, taskId, testCase, optio
     applyWorkHubPollStatus(ctx, last, status);
     await maybeApproveTask(dataplaneUrl, authConfig, taskId, ctx);
     await maybeRespondWaiting(dataplaneUrl, authConfig, last, testCase, ctx.interactions);
-    if (shouldStopPendingApprovalPoll(status, ctx)) {
+    ctx.stoppedReason = unansweredWaitStopReason(ctx.interactions);
+    if (ctx.stoppedReason || shouldStopPendingApprovalPoll(status, ctx)) {
       break;
     }
     await delayMs(intervalMs);
   }
 
   return {
-    finalTask: assertTerminalWorkHubTask(last, taskId, timeoutMs, { recordTimeout: true }),
+    finalTask: assertTerminalWorkHubTask(last, taskId, timeoutMs, {
+      recordTimeout: !ctx.stoppedReason,
+      stoppedReason: ctx.stoppedReason || null
+    }),
     timeline,
     interactions: ctx.interactions
   };
@@ -478,6 +485,8 @@ async function runWorkHubCaseLifecycle(roleKey, testCase, runtimeContext, option
 module.exports = {
   wantsWorkHubPath,
   runWorkHubCaseLifecycle,
+  pollWorkHubTask,
+  unansweredWaitStopReason,
   planAlreadyActivated,
   isPlanLostError,
   extractPeFromTask,

package/lib/schema/application-schema.json

@@ -7,12 +7,12 @@
     "key": "application-schema",
     "name": "Application Configuration Schema",
     "description": "JSON schema for validating AI Fabrix application configuration files",
-    "version": "1.7.0",
+    "version": "1.10.0",
     "type": "schema",
     "category": "infrastructure",
     "author": "AI Fabrix Team",
     "createdAt": "2024-01-01T00:00:00Z",
-    "updatedAt": "2026-09-16T00:00:00Z",
+    "updatedAt": "2026-09-25T00:00:00Z",
     "compatibility": {
       "minVersion": "1.0.0",
       "maxVersion": "2.0.0",
@@ -30,6 +30,35 @@
       "external-datasource.schema.json"
     ],
     "changelog": [
+      {
+        "version": "1.10.0",
+        "date": "2026-09-25T00:00:00Z",
+        "changes": [
+          "Added optional top-level webSocketsEnabled: request Azure App Service WebSocket support for applications whose manifest opts in. Absent or false preserves existing deployment behavior."
+        ],
+        "breaking": false
+      },
+      {
+        "version": "1.9.0",
+        "date": "2026-09-23T00:00:00Z",
+        "breaking": false,
+        "changes": [
+          "Added optional platforms: the target Azure resource group is matched against resource patterns to yield {platform} and {platform.name}, and that entry's configuration resolves from them.",
+          "Added optional environments: per-environment configuration layered over the platform match, overriding by name.",
+          "Added optional portalInput.visible (default true) so a resolved or derived value stays out of the portal form.",
+          "Both sections are optional and independent; manifests without them are unchanged."
+        ]
+      },
+      {
+        "version": "1.8.0",
+        "date": "2026-09-21T00:00:00Z",
+        "changes": [
+          "Added optional build.target: the multi-stage Dockerfile stage to build (docker build --target). Omitted, Docker builds the final stage as before, so existing manifests are unaffected. Lets one Dockerfile and one source tree produce more than one image.",
+          "Added optional top-level runAsRoot: run the container as the image user (root) rather than the invoking host user. Absent or false keeps the existing behavior. Only for an application that administers its own operating system, such as creating Linux accounts or running sshd.",
+          "Added optional top-level additionalPorts: extra container ports to publish beside the main port, for an application serving a second protocol such as SSH from the same container. Each host port is derived as hostPort + developerId * 100, the same formula as the main port. A base below 1024 is permitted so a well-known port keeps its number. Absent keeps the existing single-port behavior."
+        ],
+        "breaking": false
+      },
       {
         "version": "1.7.0",
         "date": "2026-09-16T00:00:00Z",
@@ -210,6 +239,128 @@
       "type": "boolean",
       "description": "Whether application requires storage.Physical storage is mapped to /mnt/data/. Blob storage is mapped to SMB File share /data/{app-key}/."
     },
+    "webSocketsEnabled": {
+      "type": "boolean",
+      "description": "Whether the hosting provider must enable WebSocket upgrades for this application. Optional and false by default."
+    },
+    "platforms": {
+      "type": "array",
+      "description": "Platform resolution: the target Azure resource group is matched against these entries, yielding {platform} and {platform.name}. Optional and independent of environments.",
+      "items": {
+        "type": "object",
+        "required": ["resource", "name", "configuration"],
+        "additionalProperties": false,
+        "properties": {
+          "resource": {
+            "type": "string",
+            "description": "Resource-group pattern; {platform} marks the platform segment and * captures a name segment",
+            "minLength": 1
+          },
+          "name": {
+            "type": "string",
+            "description": "Platform name: a literal, or * to take the captured segment",
+            "minLength": 1
+          },
+          "options": {
+            "type": "array",
+            "description": "Allowed platform values; required when resource contains {platform}",
+            "minItems": 1,
+            "items": { "type": "string", "minLength": 1 }
+          },
+          "platform": {
+            "type": "string",
+            "description": "Declared platform for a resource pattern with no {platform} token; mutually exclusive with options",
+            "minLength": 1
+          },
+          "configuration": {
+            "type": "array",
+            "description": "Values resolved when this platform matches",
+            "items": {
+        "type": "object",
+            "required": ["name", "value"],
+            "additionalProperties": false,
+            "properties": {
+              "name": {
+                "type": "string",
+                "description": "Configuration variable name",
+                "pattern": "^[A-Z_][A-Z0-9_]*$"
+              },
+              "value": {
+                "type": "string",
+                "description": "Literal, or a value containing {platform}, {platform.name} or {resourceGroup} tokens"
+              },
+              "location": {
+                "type": "string",
+                "description": "Where the value is stored",
+                "enum": ["variable", "keyvault"]
+              },
+              "required": {
+                "type": "boolean",
+                "description": "Whether this configuration is required"
+              },
+              "category": {
+                "type": "string",
+                "description": "Optional UI grouping label for portal/deployment wizard Configuration tab",
+                "minLength": 1,
+                "maxLength": 100
+              }
+            }
+            }
+          }
+        }
+      }
+    },
+    "environments": {
+      "type": "array",
+      "description": "Per-environment values layered over the platform match, overriding by name. Optional and independent of platforms.",
+      "items": {
+        "type": "object",
+        "required": ["environment", "configuration"],
+        "additionalProperties": false,
+        "properties": {
+          "environment": {
+            "type": "string",
+            "description": "Deployment environment key (for example miso, dev, tst, pro)",
+            "minLength": 1
+          },
+          "configuration": {
+            "type": "array",
+            "description": "Values resolved for this environment",
+            "items": {
+        "type": "object",
+            "required": ["name", "value"],
+            "additionalProperties": false,
+            "properties": {
+              "name": {
+                "type": "string",
+                "description": "Configuration variable name",
+                "pattern": "^[A-Z_][A-Z0-9_]*$"
+              },
+              "value": {
+                "type": "string",
+                "description": "Literal, or a value containing {platform}, {platform.name} or {resourceGroup} tokens"
+              },
+              "location": {
+                "type": "string",
+                "description": "Where the value is stored",
+                "enum": ["variable", "keyvault"]
+              },
+              "required": {
+                "type": "boolean",
+                "description": "Whether this configuration is required"
+              },
+              "category": {
+                "type": "string",
+                "description": "Optional UI grouping label for portal/deployment wizard Configuration tab",
+                "minLength": 1,
+                "maxLength": 100
+              }
+            }
+            }
+          }
+        }
+      }
+    },
     "configuration": {
       "type": "array",
       "description": "Core application configuration",
@@ -274,6 +425,10 @@
                 "type": "boolean",
                 "description": "Whether to mask the input (for passwords)"
               },
+              "visible": {
+                "type": "boolean",
+                "description": "Whether the portal shows this input. Default true; false keeps a resolved or derived value out of the form."
+              },
               "validation": {
                 "type": "object",
                 "properties": {
@@ -413,6 +568,10 @@
                       "type": "boolean",
                       "description": "Whether to mask the input (for passwords)"
                     },
+                    "visible": {
+                      "type": "boolean",
+                      "description": "Whether the portal shows this input. Default true; false keeps a resolved or derived value out of the form."
+                    },
                     "validation": {
                       "type": "object",
                       "properties": {
@@ -806,6 +965,43 @@
       "minLength": 1,
       "maxLength": 200
     },
+    "additionalPorts": {
+      "type": "array",
+      "description": "Extra container ports to publish beside the main port. For an application that serves a second protocol from the same container, such as SSH alongside HTTP. Each host port is derived the same way as the main one: hostPort + developerId * 100 (developer id 0 keeps hostPort).",
+      "maxItems": 5,
+      "items": {
+        "type": "object",
+        "required": ["name", "containerPort", "hostPort"],
+        "additionalProperties": false,
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "What the port is for, e.g. 'ssh'. Used in generated compose comments and diagnostics.",
+            "pattern": "^[a-z][a-z0-9-]*$",
+            "minLength": 1,
+            "maxLength": 30
+          },
+          "containerPort": {
+            "type": "integer",
+            "description": "Port the process listens on inside the container.",
+            "minimum": 1,
+            "maximum": 65535
+          },
+          "hostPort": {
+            "type": "integer",
+            "description": "Base host port. The published port is hostPort + developerId * 100, so developers on one host do not collide. A base below 1024 is allowed so a well-known port can keep its number (SSH as 22, giving 122 for developer 1); the container engine binds it, not the application.",
+            "minimum": 1,
+            "maximum": 65535
+          }
+        }
+      }
+    },
+    "runAsRoot": {
+      "type": "boolean",
+      "default": false,
+      "description": "Run the container as the image user (root) instead of the invoking host user. Only for an application that administers its own operating system, such as creating Linux accounts or running sshd; files it writes to a bind mount will be root-owned. Absent or false keeps the existing behavior.",
+      "examples": [false]
+    },
     "runtimeVersion": {
       "type": "object",
       "description": "Runtime version configuration",
@@ -886,6 +1082,13 @@
           "description": "Dockerfile name (empty or missing = use auto-generated template)",
           "pattern": "^[^/].*"
         },
+        "target": {
+          "type": "string",
+          "description": "Multi-stage Dockerfile stage to build (docker build --target). Omit to build the final stage, which is the default. Lets one Dockerfile and one source tree produce more than one image, e.g. an application shipped in two installation variants.",
+          "minLength": 1,
+          "maxLength": 100,
+          "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*$"
+        },
         "remoteSyncPath": {
           "type": "string",
           "description": "Relative path under user-mutagen-folder for remote sync and Docker -v; when unset, defaults to dev/<appKey>. No leading slash.",

package/lib/schema/external-datasource.schema.json

@@ -7,7 +7,7 @@
          "key":"external-datasource-schema",
          "name":"External Data Source Configuration Schema",
          "description":"JSON schema for validating ExternalDataSource configuration files",
-     "version":"2.9.12",
+     "version":"2.9.13",
          "type":"schema",
          "category":"integration",
          "author":"AI Fabrix Team",
@@ -31,6 +31,15 @@
          "external-system.schema.json"
       ],
       "changelog":[
+         {
+            "version":"2.9.13",
+            "date":"2026-09-24T00:00:00Z",
+            "changes":[
+               "Added fetch.responseType ('json' | 'binary', default json): a file body becomes one binary record with headers and request arguments exposed to fieldMappings while bytes stay out of traces.",
+               "Added output.mode 'documents' for entityType documentStorage: binary records are persisted through the document pipeline and emitted as document references; documentStorage.binaryOperationRef may name the datasource's own get for keyed retrieval."
+            ],
+            "breaking":false
+         },
          {
             "version":"2.9.12",
             "date":"2026-09-17T00:00:00Z",
@@ -2739,6 +2748,15 @@
                   },
                   "httpResponseNormalization":{
                      "$ref":"#/$defs/httpResponseNormalization"
+                  },
+                  "responseType":{
+                     "type":"string",
+                     "enum":[
+                        "json",
+                        "binary"
+                     ],
+                     "default":"json",
+                     "description":"Body contract of the vendor response. 'binary' turns a file body (application/octet-stream, PDF, image ...) into one binary record whose bytes stay out of traces: {_binary:{contentType,size,filename,sha256}, headers:{...}, params:{...}} for map expressions such as raw.headers.AttachmentName or raw.params.PurchaseOrderNumber. A binary Content-Type is promoted automatically when responseType is omitted; declaring 'binary' fails closed when the body is JSON."
                   }
                },
                "allOf":[
@@ -3174,9 +3192,11 @@
                   "mode":{
                      "type":"string",
                      "enum":[
-                        "records"
+                        "records",
+                        "documents"
                      ],
-                     "default":"records"
+                     "default":"records",
+                     "description":"'records' emits normalized records. 'documents' (entityType documentStorage only) stores each binary record through the document pipeline (document store, DocumentRecord/registry rows, FK dimensions, ingestion per documentStorage.ingestAfterSync) and emits document references {key, filename, contentType, size, sha256, downloadRef}; IDE simulation never persists."
                   },
                   "limit":{
                      "type":"integer",