@aifabrix/builder 2.60.0 → 2.61.2

package/lib/datasource/capability/upsert-test-scaffold.js

@@ -0,0 +1,189 @@
+/**
+ * Build a no-duplicate upsert proof from author-owned scenario facts.
+ *
+ * @fileoverview Safe testPayload scaffolding for datasource capability upsert
+ */
+
+'use strict';
+
+const { deepClone } = require('./copy-operations');
+
+const RUN_TOKEN = /\{\{\s*testRunId\s*\}\}/i;
+
+function scenarioInput(scenario) {
+  const input = scenario?.input;
+  if (!input || typeof input !== 'object' || Array.isArray(input)) return null;
+  const properties = input.properties;
+  return properties && typeof properties === 'object' && !Array.isArray(properties)
+    ? properties
+    : input;
+}
+
+function scalar(value) {
+  return value !== null && ['string', 'number', 'boolean'].includes(typeof value);
+}
+
+function identityFromInput(input, identityFields) {
+  if (!input) return null;
+  const entries = identityFields.map((field) => [field, input[field]]);
+  if (entries.some(([, value]) => !scalar(value) || value === '')) return null;
+  return Object.fromEntries(entries);
+}
+
+function sameIdentity(first, second, identityFields) {
+  return identityFields.every((field) => first[field] === second[field]);
+}
+
+function isCollisionSafe(identity) {
+  return Object.values(identity).some((value) =>
+    typeof value === 'string' && RUN_TOKEN.test(value)
+  );
+}
+
+function profileFields(doc, targetKey) {
+  const profile = doc.exposed?.profiles?.[targetKey];
+  if (Array.isArray(profile)) return profile;
+  return Array.isArray(profile?.attributes) ? profile.attributes : [];
+}
+
+function changedPublishedField(doc, targetKey, first, second, identityFields) {
+  const identity = new Set(identityFields);
+  const published = new Set(profileFields(doc, targetKey));
+  return Object.keys(first).find((field) =>
+    !identity.has(field) && published.has(field) && scalar(first[field]) &&
+    scalar(second[field]) && first[field] !== second[field]
+  ) || null;
+}
+
+function analyzeWritePair(doc, targetKey, identityFields, firstRow, secondRow) {
+  const first = scenarioInput(firstRow);
+  const second = scenarioInput(secondRow);
+  const firstIdentity = identityFromInput(first, identityFields);
+  const secondIdentity = identityFromInput(second, identityFields);
+  if (!firstIdentity || !secondIdentity) return { reason: 'both writes must contain every business identity field' };
+  if (!sameIdentity(firstIdentity, secondIdentity, identityFields)) {
+    return { reason: 'the two writes must use the same business identity values' };
+  }
+  if (!isCollisionSafe(firstIdentity)) {
+    return { reason: 'the business identity must include {{testRunId}} to isolate each live run' };
+  }
+  const changedField = changedPublishedField(
+    doc, targetKey, first, second, identityFields
+  );
+  if (!changedField) {
+    return { reason: 'the second write must change one published non-identity scalar field' };
+  }
+  return { first, second, identity: firstIdentity, changedField };
+}
+
+function exactLookup(operation, input, expectedRows, identityKey) {
+  return {
+    operation,
+    input: deepClone(input),
+    identityKey,
+    matchMode: 'exactIdentities',
+    expectedRows: deepClone(expectedRows)
+  };
+}
+
+function expectedRow(identity, changedField, value) {
+  return { ...deepClone(identity), [changedField]: value };
+}
+
+function hasExactProof(scenarios, index, targetKey, lookupKey, facts) {
+  const rows = scenarios.slice(index, index + 5);
+  if (rows.length !== 5) return false;
+  const operations = rows.map((row) => row?.operation);
+  if (operations.join('|') !== [lookupKey, targetKey, lookupKey, targetKey, lookupKey].join('|')) {
+    return false;
+  }
+  const [before, , afterFirst, , afterSecond] = rows;
+  return [before, afterFirst, afterSecond].every((row) =>
+    row?.matchMode === 'exactIdentities' && row?.identityKey === facts.changedField
+  ) && Array.isArray(before.expectedRows) && before.expectedRows.length === 0 &&
+    afterFirst.expectedRows?.length === 1 && afterSecond.expectedRows?.length === 1 &&
+    afterFirst.expectedRows?.[0]?.[facts.changedField] === facts.first[facts.changedField] &&
+    afterSecond.expectedRows?.[0]?.[facts.changedField] === facts.second[facts.changedField];
+}
+
+function findExistingProof(doc, scenarios, targetKey, lookupKey, identityFields) {
+  for (let index = 0; index <= scenarios.length - 5; index += 1) {
+    const facts = analyzeWritePair(
+      doc, targetKey, identityFields, scenarios[index + 1], scenarios[index + 3]
+    );
+    if (!facts.reason && hasExactProof(scenarios, index, targetKey, lookupKey, facts)) return true;
+  }
+  return false;
+}
+
+function findAdjacentWrites(doc, scenarios, targetKey, identityFields) {
+  let lastReason = 'two adjacent enabled upsert scenarios are required';
+  for (let index = 0; index < scenarios.length - 1; index += 1) {
+    const first = scenarios[index];
+    const second = scenarios[index + 1];
+    if (first?.operation !== targetKey || second?.operation !== targetKey) continue;
+    if (first.enabled === false || second.enabled === false) continue;
+    const facts = analyzeWritePair(doc, targetKey, identityFields, first, second);
+    if (!facts.reason) return { index, facts };
+    lastReason = facts.reason;
+  }
+  return { reason: lastReason };
+}
+
+function insufficientIssue(reason) {
+  return {
+    code: 'UPSERT-TEST-DATA-INSUFFICIENT',
+    severity: 'blocking',
+    ownership: 'test-payload',
+    aiFixable: false,
+    message: `Safe --test scaffolding was not generated: ${reason}; no values were fabricated`,
+    consequence: 'A weaker generated case could provide false no-duplicate confidence.',
+    remediation: ['Author two adjacent upsert inputs with the same isolated identity and one changed published field, then rerun --test.'],
+    prevention: 'Keep collision-safe two-write facts with the datasource test payload.',
+    residualRisk: 'Upsert remains unproven until the exact live chain passes.'
+  };
+}
+
+function buildProofRows(lookupKey, facts) {
+  const firstExpected = expectedRow(
+    facts.identity, facts.changedField, facts.first[facts.changedField]
+  );
+  const secondExpected = expectedRow(
+    facts.identity, facts.changedField, facts.second[facts.changedField]
+  );
+  return [
+    exactLookup(lookupKey, facts.identity, [], facts.changedField),
+    exactLookup(lookupKey, facts.identity, [firstExpected], facts.changedField),
+    exactLookup(lookupKey, facts.identity, [secondExpected], facts.changedField)
+  ];
+}
+
+function scaffoldUpsertTests(originalDoc, analysis, targetKey = 'upsert') {
+  const scenarios = originalDoc.testPayload?.scenarios;
+  const lookupKey = analysis?.selectedLookup?.operationKey;
+  const identities = Array.isArray(analysis?.identityFields) ? analysis.identityFields : [];
+  if (!Array.isArray(scenarios) || !lookupKey || identities.length === 0) {
+    return { changed: false, issue: insufficientIssue('required scenarios or exact lookup facts are missing') };
+  }
+  if (findExistingProof(originalDoc, scenarios, targetKey, lookupKey, identities)) {
+    return { changed: false, doc: originalDoc, patchOperations: [], updatedSections: [] };
+  }
+  const pair = findAdjacentWrites(originalDoc, scenarios, targetKey, identities);
+  if (pair.reason) return { changed: false, issue: insufficientIssue(pair.reason) };
+  const [before, afterFirst, afterSecond] = buildProofRows(lookupKey, pair.facts);
+  const doc = deepClone(originalDoc);
+  doc.testPayload.scenarios.splice(pair.index, 2,
+    before, scenarios[pair.index], afterFirst, scenarios[pair.index + 1], afterSecond);
+  return {
+    changed: true,
+    doc,
+    patchOperations: [{ op: 'replace', path: '/testPayload/scenarios', value: doc.testPayload.scenarios }],
+    updatedSections: ['testPayload.scenarios: upsert no-duplicate proof']
+  };
+}
+
+module.exports = {
+  scaffoldUpsertTests,
+  analyzeWritePair,
+  insufficientIssue
+};

package/lib/datasource/validate.js

@@ -23,6 +23,8 @@ const { validateFieldReferences } = require('./field-reference-validator');
 const { validateAbac } = require('./abac-validator');
 const { buildDatasourceValidateSummary } = require('./datasource-validate-summary');
 
+const { validateBinaryDocumentsContract } = require('./binary-documents-validator');
+
 const DATASOURCE_CONFIG_EXTENSIONS = new Set(['.json', '.yaml', '.yml']);
 const EXCLUDE_CONFIG_NAMES = new Set([
   'application.json',
@@ -242,12 +244,14 @@ async function validateDatasourceFile(filePathOrKey) {
     };
   }
 
+  const binary = validateBinaryDocumentsContract(parsed);
+  const warnings = binary.warnings.map(issue => `${issue.code}: ${issue.message}`);
   const postSchemaErrors = collectPostSchemaErrors(parsed);
   if (postSchemaErrors.length > 0) {
     return {
       valid: false,
       errors: postSchemaErrors,
-      warnings: [],
+      warnings,
       resolvedPath: filePath,
       summary
     };
@@ -256,7 +260,7 @@ async function validateDatasourceFile(filePathOrKey) {
   return {
     valid: true,
     errors: [],
-    warnings: [],
+    warnings,
     resolvedPath: filePath,
     summary
   };
@@ -269,7 +273,8 @@ async function validateDatasourceFile(filePathOrKey) {
 function collectPostSchemaErrors(parsed) {
   return [
     ...validateFieldReferences(parsed),
-    ...validateAbac(parsed)
+    ...validateAbac(parsed),
+    ...validateBinaryDocumentsContract(parsed).errors.map(issue => `${issue.code}: ${issue.message}`)
   ];
 }
 
@@ -303,12 +308,14 @@ function validateDatasourceParsed(parsed) {
     };
   }
 
+  const binary = validateBinaryDocumentsContract(parsed);
+  const warnings = binary.warnings.map(issue => `${issue.code}: ${issue.message}`);
   const postSchemaErrors = collectPostSchemaErrors(parsed);
   if (postSchemaErrors.length > 0) {
     return {
       valid: false,
       errors: postSchemaErrors,
-      warnings: [],
+      warnings,
       summary
     };
   }
@@ -316,7 +323,7 @@ function validateDatasourceParsed(parsed) {
   return {
     valid: true,
     errors: [],
-    warnings: [],
+    warnings,
     summary
   };
 }

package/lib/generator/index.js

@@ -22,6 +22,7 @@ const { generateControllerManifest } = require('./external-controller-manifest')
 const { resolveVersionForApp } = require('../utils/image-version');
 const { getContainerPort } = require('../utils/port-resolver');
 const { buildEnvVarMap } = require('../utils/env-map');
+const { mergeAdditionalPublishedPorts } = require('../utils/docker-manifest-public-port');
 
 /**
  * Generates deployment JSON from application configuration files
@@ -247,6 +248,7 @@ async function buildDeploymentManifestInMemory(appName, options = {}) {
       ? parseInt(deployment.port, 10) : (typeof deployment.port === 'number' ? deployment.port : effectivePort);
   }
   const envVarMap = await buildEnvVarMap('docker', null, null, { appPort: effectivePort });
+  await mergeAdditionalPublishedPorts(envVarMap, variablesWithVersion);
   substituteEnvVarsInDeployment(deployment, envVarMap);
   _validator.validateNoUnresolvedVariablesInDeployment(deployment);
   return { deployment, appPath };
@@ -300,6 +302,7 @@ async function writeRegularDeployJson(appName, appPath, appType, options = {}) {
   };
   const effectivePort = getEffectivePortForSubstitution(variablesWithVersion, 3000);
   const envVarMap = await buildEnvVarMap('docker', null, null, { appPort: effectivePort });
+  await mergeAdditionalPublishedPorts(envVarMap, variablesWithVersion);
   const deployment = buildAndValidateDeployment(appName, variablesWithVersion, envTemplate, rbac, {
     envVarMap,
     target: options.target

package/lib/lifecycle/product-model.js

@@ -134,6 +134,7 @@ function computeOperationalReadinessPercent(checks) {
   let earned = 0;
   let total = 0;
   for (const [key, weight] of Object.entries(OPERATIONS_WEIGHTS)) {
+    if (checks[key] === null) continue;
     total += weight;
     if (checks[key] === true) {
       earned += weight;
@@ -159,9 +160,9 @@ function buildOperationsChecksFromSteps(steps) {
     authorization: integration || e2e,
     openApi: validation,
     mappings: validation,
-    sync: e2e,
-    crud: e2e,
-    execution: e2e,
+    sync: steps.keyedDocumentGet === true ? null : e2e,
+    crud: steps.keyedDocumentGet === true ? steps.documentPersistence === true : e2e,
+    execution: steps.keyedDocumentGet === true ? steps.documentPersistence === true : e2e,
     validation,
     unitTests: unit,
     integrationTests: integration,

package/lib/lifecycle/report-display.js

@@ -132,8 +132,9 @@ function displayOperationsVerificationSteps(detailsGrouped) {
   for (const [groupName, keys] of groups) {
     logger.log(chalk.white(groupName));
     for (const key of keys) {
-      const passed = detailsGrouped[groupName.toLowerCase()]?.[key] ?? detailsGrouped[key];
-      const glyph = passed ? successGlyph() : failureGlyph();
+      const group = detailsGrouped[groupName.toLowerCase()];
+      const passed = group && Object.hasOwn(group, key) ? group[key] : detailsGrouped[key];
+      const glyph = passed === null ? chalk.gray('⏭ Not applicable') : passed ? successGlyph() : failureGlyph();
       logger.log(`  ${labels[key] || key}`.padEnd(24) + glyph);
     }
   }

package/lib/parameters/infra-parameter-catalog.js

@@ -135,7 +135,7 @@ function createCatalogApi(doc, exact, patterns) {
     const entry = findEntryForKey(key);
     const gen = entry && entry.generator;
     // emptyAllowed: e.g. Redis password when no requirepass.
-    // emptyString: optional user-supplied keys (OpenAI / Azure OpenAI) — absent resolves like ''.
+    // emptyString: optional user-supplied catalog keys — absent resolves like ''.
     return Boolean(gen && (gen.type === 'emptyAllowed' || gen.type === 'emptyString'));
   }
 

package/lib/programmatic/builder-help-enterprise-sync-fabrix.js

@@ -10,7 +10,7 @@ const fs = require('fs');
 const path = require('path');
 const { buildHelpEnvelope } = require('./builder-help-envelope');
 
-const HELP_MD_DIR = path.join(__dirname, 'help-content');
+const HELP_MD_DIR = path.join(__dirname, '..', '..', 'docs', 'builder-help', 'content');
 
 /** @type {ReadonlyArray<string>} */
 const REPAIR_COMMANDS = Object.freeze([

package/lib/programmatic/builder-help-governance.js

@@ -15,7 +15,7 @@ const { listPlatformRoles } = require('./platform-rbac-catalog');
 const { CHANNEL_TARGET_KEYS, CHANNEL_TARGETS } = require('../channels/channel-targets');
 
 const BUILDER_HELP_DIR = path.join(__dirname, '..', '..', 'docs', 'builder-help');
-const HELP_MD_DIR = path.join(__dirname, 'help-content');
+const HELP_MD_DIR = path.join(BUILDER_HELP_DIR, 'content');
 
 /**
  * @param {string} fileName

package/lib/programmatic/builder-help.js

@@ -65,7 +65,7 @@ const PROSE_TOPIC_FILES = Object.freeze({
   enterpriseSyncFabrix: 'enterprise-sync-fabrix.md'
 });
 
-const HELP_MD_DIR = path.join(__dirname, 'help-content');
+const HELP_MD_DIR = path.join(__dirname, '..', '..', 'docs', 'builder-help', 'content');
 
 /**
  * @param {string} message

package/lib/role-assistant/test-runner-workhub-answers.js

@@ -5,6 +5,8 @@
 
 'use strict';
 
+const { coversMissingFields } = require('./test-runner-workhub-missing-fields');
+
 const {
   resolveTargetSystemKey,
   shouldStampSuiteBid,
@@ -409,7 +411,8 @@ function resolveRespondValue(testCase, wait, statusRow, objective) {
   if (fromCase !== undefined) {
     return fromCase;
   }
-  return synthesizeWaitAnswer(wait, statusRow, objective, testCase);
+  const synthesized = synthesizeWaitAnswer(wait, statusRow, objective, testCase);
+  return coversMissingFields(wait, synthesized) ? synthesized : undefined;
 }
 
 function waitRespondFingerprint(wait) {

package/lib/role-assistant/test-runner-workhub-missing-fields.js

@@ -0,0 +1,42 @@
+/**
+ * @fileoverview Missing-field coverage for synthesized Work Hub answers.
+ */
+
+'use strict';
+
+function asPlainObject(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return {};
+  }
+  return value;
+}
+
+/**
+ * Fields the runtime named as missing (missingRequestBody waits). A synthesized
+ * answer that lacks any of them only makes the runtime ask the same question
+ * again, so it must not be sent.
+ * @param {Object} wait
+ * @returns {string[]}
+ */
+function waitMissingFields(wait) {
+  const raw = wait?.objectRef && typeof wait.objectRef === 'object' ? wait.objectRef.missingFields : null;
+  const list = Array.isArray(raw) ? raw : String(raw || '').split(',');
+  return list.map((row) => String(row || '').trim()).filter(Boolean);
+}
+
+function coversMissingFields(wait, value) {
+  if (value === undefined) {
+    return false;
+  }
+  const missing = waitMissingFields(wait);
+  if (missing.length === 0) {
+    return true;
+  }
+  const obj = asPlainObject(value);
+  if (!obj) {
+    return false;
+  }
+  return missing.every((field) => obj[field] !== undefined && obj[field] !== null && obj[field] !== '');
+}
+
+module.exports = { coversMissingFields, waitMissingFields };

package/lib/role-assistant/test-runner-workhub-wait-stop.js

@@ -0,0 +1,94 @@
+/**
+ * @fileoverview Work Hub poll stop rules for waits the runner cannot resolve.
+ *
+ * A wait with no matching case answer, a question the runtime re-issues
+ * unchanged after our answer, or a failed respond call never resolves by
+ * polling. Stopping at once keeps a stalled case at seconds, not the 180 s
+ * poll timeout (dev01 sales ladder, 2026-09-26: six cases, 18 min waiting).
+ */
+
+'use strict';
+
+const UNANSWERED_WAIT_TYPES = new Set(['respond-skipped', 'respond-repeated', 'respond-error']);
+
+/**
+ * The runtime asked the same question again after our answer: the answer did
+ * not resolve it, and repeating it cannot. Record once so the poll can stop.
+ */
+function recordRepeatedResponse(interactions, peId, fingerprint, wait) {
+  const already = interactions.some(
+    (row) => row && row.type === 'respond-repeated' && row.fingerprint === fingerprint
+  );
+  if (already) {
+    return;
+  }
+  interactions.push({
+    type: 'respond-repeated',
+    processExecutionId: peId,
+    fingerprint,
+    questionKey: wait.questionKey || wait.requestKey || null,
+    objectRefKind: wait.objectRef?.kind || null,
+    reason: 'same-question-after-answer'
+  });
+}
+
+function recordRespondError(interactions, peId, error) {
+  interactions.push({
+    type: 'respond-error',
+    processExecutionId: peId,
+    error: (error && error.message) || String(error)
+  });
+}
+
+/**
+ * A wait we could not answer (no matching case answer, the runtime re-asked
+ * after our answer, or respond failed) will not change by polling: stop now
+ * instead of waiting for the poll timeout.
+ * @param {Array<Object>} interactions
+ * @returns {string|null} stop reason or null to keep polling
+ */
+function unansweredWaitStopReason(interactions) {
+  const last = interactions.length > 0 ? interactions[interactions.length - 1] : null;
+  if (!last || !UNANSWERED_WAIT_TYPES.has(last.type)) {
+    return null;
+  }
+  return last.type === 'respond-error' ? 'respondFailed' : 'unansweredQuestion';
+}
+
+function recordSkippedResponse(interactions, peId, fingerprint, wait) {
+  interactions.push({
+    type: 'respond-skipped',
+    processExecutionId: peId,
+    fingerprint,
+    questionKey: wait.questionKey || wait.requestKey || null,
+    objectRefKind: wait.objectRef?.kind || null,
+    reason: 'no-matching-answer-or-synthesis'
+  });
+}
+
+const ALREADY_TERMINAL_RE = /already terminal/i;
+
+/**
+ * work.respond resumes the Decision Engine inline; by the time work.continue
+ * lands the execution may already be terminal. That is a finished run, not a
+ * failed answer.
+ */
+async function continueAfterRespond(dataplaneUrl, authConfig, peId) {
+  const { continueWorkExecution } = require('../api/work.api');
+  try {
+    await continueWorkExecution(dataplaneUrl, authConfig, peId, {});
+  } catch (err) {
+    if (!ALREADY_TERMINAL_RE.test((err && err.message) || String(err))) {
+      throw err;
+    }
+  }
+}
+
+module.exports = {
+  continueAfterRespond,
+  UNANSWERED_WAIT_TYPES,
+  recordSkippedResponse,
+  recordRepeatedResponse,
+  recordRespondError,
+  unansweredWaitStopReason
+};

package/lib/role-assistant/test-runner-workhub.js

@@ -13,8 +13,7 @@ const {
   getWorkTask,
   approveWorkTask,
   getWorkExecutionStatus,
-  respondWorkExecution,
-  continueWorkExecution
+  respondWorkExecution
 } = require('../api/work.api');
 const {
   synthesizeWaitAnswer,
@@ -29,6 +28,13 @@ const {
   persistCaseOpenApiViaBuilderApi
 } = require('./test-runner-bid-apply');
 const { resolveTargetSystemKey } = require('./test-runner-bid-document');
+const {
+  recordSkippedResponse,
+  recordRepeatedResponse,
+  recordRespondError,
+  unansweredWaitStopReason,
+  continueAfterRespond
+} = require('./test-runner-workhub-wait-stop');
 const {
   TERMINAL_TASK,
   delayMs,
@@ -178,17 +184,6 @@ async function maybeApproveTask(dataplaneUrl, authConfig, taskId, ctx) {
   await _attemptApproveTask(dataplaneUrl, authConfig, taskId, ctx);
 }
 
-function recordSkippedResponse(interactions, peId, fingerprint, wait) {
-  interactions.push({
-    type: 'respond-skipped',
-    processExecutionId: peId,
-    fingerprint,
-    questionKey: wait.questionKey || wait.requestKey || null,
-    objectRefKind: wait.objectRef?.kind || null,
-    reason: 'no-matching-answer-or-synthesis'
-  });
-}
-
 function recordBidEmit(testCase, interactions, peId) {
   const { loadCaseBidDocument } = require('./test-runner-workhub-answers');
   const emittedBid = loadCaseBidDocument(testCase);
@@ -237,6 +232,7 @@ async function respondToWaitingExecution(
   const wait = statusRow.wait && typeof statusRow.wait === 'object' ? statusRow.wait : {};
   const fingerprint = waitRespondFingerprint(wait);
   if (alreadyResponded(interactions, fingerprint)) {
+    recordRepeatedResponse(interactions, peId, fingerprint, wait);
     return;
   }
   const payload = buildRespondPayload(
@@ -260,7 +256,7 @@ async function respondToWaitingExecution(
     }
   }
   await respondWorkExecution(dataplaneUrl, authConfig, peId, payload);
-  await continueWorkExecution(dataplaneUrl, authConfig, peId, {});
+  await continueAfterRespond(dataplaneUrl, authConfig, peId);
   interactions.push({ type: 'respond', processExecutionId: peId, fingerprint });
   if (shouldApplyBidAfterWait(testCase, wait)) {
     recordBidEmit(testCase, interactions, peId);
@@ -291,8 +287,9 @@ async function maybeRespondWaiting(dataplaneUrl, authConfig, taskRow, testCase,
       interactions,
       statusRow
     );
-  } catch (_err) {
-    // Soft: continue polling task.
+  } catch (err) {
+    // A failed respond/continue never resolves itself; record it so the poll stops.
+    recordRespondError(interactions, peId, err);
   }
 }
 
@@ -301,7 +298,13 @@ function assertTerminalWorkHubTask(last, taskId, timeoutMs, options = {}) {
     throw new Error(`Work Hub task ${taskId} produced no status rows.`);
   }
   const finalStatusToken = String(last?.status || last?.taskStatus || '').trim().toLowerCase();
-  if (!TERMINAL_TASK.has(finalStatusToken) && options.recordTimeout === true) {
+  if (TERMINAL_TASK.has(finalStatusToken)) {
+    return last;
+  }
+  if (options.stoppedReason) {
+    return { ...last, pollStopped: options.stoppedReason, lastStatus: finalStatusToken || 'unknown' };
+  }
+  if (options.recordTimeout === true) {
     last = {
       ...last,
       pollTimedOut: true,
@@ -353,14 +356,18 @@ async function pollWorkHubTask(dataplaneUrl, authConfig, taskId, testCase, optio
     applyWorkHubPollStatus(ctx, last, status);
     await maybeApproveTask(dataplaneUrl, authConfig, taskId, ctx);
     await maybeRespondWaiting(dataplaneUrl, authConfig, last, testCase, ctx.interactions);
-    if (shouldStopPendingApprovalPoll(status, ctx)) {
+    ctx.stoppedReason = unansweredWaitStopReason(ctx.interactions);
+    if (ctx.stoppedReason || shouldStopPendingApprovalPoll(status, ctx)) {
       break;
     }
     await delayMs(intervalMs);
   }
 
   return {
-    finalTask: assertTerminalWorkHubTask(last, taskId, timeoutMs, { recordTimeout: true }),
+    finalTask: assertTerminalWorkHubTask(last, taskId, timeoutMs, {
+      recordTimeout: !ctx.stoppedReason,
+      stoppedReason: ctx.stoppedReason || null
+    }),
     timeline,
     interactions: ctx.interactions
   };
@@ -478,6 +485,8 @@ async function runWorkHubCaseLifecycle(roleKey, testCase, runtimeContext, option
 module.exports = {
   wantsWorkHubPath,
   runWorkHubCaseLifecycle,
+  pollWorkHubTask,
+  unansweredWaitStopReason,
   planAlreadyActivated,
   isPlanLostError,
   extractPeFromTask,

package/lib/schema/application-schema.json

@@ -7,12 +7,12 @@
     "key": "application-schema",
     "name": "Application Configuration Schema",
     "description": "JSON schema for validating AI Fabrix application configuration files",
-    "version": "1.9.0",
+    "version": "1.10.0",
     "type": "schema",
     "category": "infrastructure",
     "author": "AI Fabrix Team",
     "createdAt": "2024-01-01T00:00:00Z",
-    "updatedAt": "2026-09-23T00:00:00Z",
+    "updatedAt": "2026-09-25T00:00:00Z",
     "compatibility": {
       "minVersion": "1.0.0",
       "maxVersion": "2.0.0",
@@ -30,6 +30,14 @@
       "external-datasource.schema.json"
     ],
     "changelog": [
+      {
+        "version": "1.10.0",
+        "date": "2026-09-25T00:00:00Z",
+        "changes": [
+          "Added optional top-level webSocketsEnabled: request Azure App Service WebSocket support for applications whose manifest opts in. Absent or false preserves existing deployment behavior."
+        ],
+        "breaking": false
+      },
       {
         "version": "1.9.0",
         "date": "2026-09-23T00:00:00Z",
@@ -231,6 +239,10 @@
       "type": "boolean",
       "description": "Whether application requires storage.Physical storage is mapped to /mnt/data/. Blob storage is mapped to SMB File share /data/{app-key}/."
     },
+    "webSocketsEnabled": {
+      "type": "boolean",
+      "description": "Whether the hosting provider must enable WebSocket upgrades for this application. Optional and false by default."
+    },
     "platforms": {
       "type": "array",
       "description": "Platform resolution: the target Azure resource group is matched against these entries, yielding {platform} and {platform.name}. Optional and independent of environments.",