@aifabrix/builder 2.61.2 → 2.63.0

package/lib/api/applications.api.js

@@ -202,6 +202,26 @@ async function getApplicationStatus(controllerUrl, envKey, appKey, authConfig) {
   );
 }
 
+/**
+ * Update the authenticated application's own runtime status and URLs.
+ * POST /api/v1/environments/{envKey}/applications/self/status
+ * @requiresPermission {Controller} Application client token
+ * @async
+ * @function updateApplicationSelfStatus
+ * @param {string} controllerUrl - Controller base URL
+ * @param {string} envKey - Environment key
+ * @param {Object} authConfig - Client-token authentication configuration
+ * @param {Object} statusData - Runtime status payload
+ * @returns {Promise<Object>} Updated application response
+ * @throws {Error} If request fails
+ */
+async function updateApplicationSelfStatus(controllerUrl, envKey, authConfig, statusData) {
+  const client = new ApiClient(controllerUrl, authConfig);
+  return await client.post(`/api/v1/environments/${envKey}/applications/self/status`, {
+    body: statusData
+  });
+}
+
 module.exports = {
   listApplications,
   createApplication,
@@ -211,6 +231,6 @@ module.exports = {
   registerApplication,
   bootstrapApplication,
   rotateApplicationSecret,
-  getApplicationStatus
+  getApplicationStatus,
+  updateApplicationSelfStatus
 };
-

package/lib/api/bootstrap-snapshot.api.js

@@ -0,0 +1,115 @@
+/**
+ * `POST /api/v1/auth/bootstrap` — an application's resolved configuration (Miso 257.0).
+ *
+ * This is what removes the drift. Miso generates an environment's variables through the same
+ * catalog and reconciliation it uses for Azure, holds them in whichever store the deployment
+ * calls for — Key Vault, or encrypted in `Environment.configuration` for a local install —
+ * and hands back the resolved set. Builder stops generating values and stops deriving secret
+ * names, so there is one generator, one naming rule and one record.
+ *
+ * **The caller is the application, not the operator.** A client id and secret are provisioned
+ * with the application itself, so there is no chicken-and-egg: they exchange for a client
+ * token at `/api/v1/auth/token`, which needs no prior authentication. The token carries the
+ * application and environment, which means the snapshot is server-assigned — an application
+ * cannot ask for another application's configuration, because it cannot mint a token naming
+ * one. Builder passes credentials it already holds and is told what that application gets.
+ *
+ * **`success === true` is load-bearing.** Miso writes this envelope out explicitly rather than
+ * through the helper every neighbouring route uses, because that helper omits `success` and a
+ * consumer treats its absence as a protocol error. Checking it here keeps Builder honest with
+ * the same contract the SDK enforces.
+ *
+ * @fileoverview Fetch an application's bootstrap configuration snapshot from Miso
+ */
+
+'use strict';
+
+/** The only protocol version the endpoint accepts. */
+const BOOTSTRAP_PROTOCOL_VERSION = 1;
+
+/**
+ * @param {string} controllerUrl - Controller base URL
+ * @returns {string} Without a trailing slash
+ */
+function normalizeControllerUrl(controllerUrl) {
+  return String(controllerUrl || '').trim().replace(/\/+$/, '');
+}
+
+/**
+ * Exchange an application's client credentials for a client token.
+ *
+ * @async
+ * @param {string} controllerUrl - Controller base URL
+ * @param {{ clientId: string, clientSecret: string }} credentials - Application credentials
+ * @param {Function} [makeApiCall] - Injected transport
+ * @returns {Promise<string>} The client token
+ * @throws {Error} When the exchange fails or returns no token
+ */
+async function exchangeClientToken(controllerUrl, credentials, makeApiCall) {
+  const call = makeApiCall || require('../utils/api').makeApiCall;
+  const response = await call(`${normalizeControllerUrl(controllerUrl)}/api/v1/auth/token`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'x-client-id': credentials.clientId,
+      'x-client-secret': credentials.clientSecret
+    }
+  });
+  if (!response || response.success !== true) {
+    throw new Error(
+      `Could not authenticate as ${credentials.clientId}: ${(response && response.error) || 'request failed'}`
+    );
+  }
+  const data = response.data || {};
+  const token = data.token || data.data?.token || data.accessToken;
+  if (!token) {
+    // Names the client, never the secret, because this message reaches the terminal.
+    throw new Error(`Authentication for ${credentials.clientId} returned no token`);
+  }
+  return token;
+}
+
+/**
+ * Fetch an application's resolved configuration for its environment.
+ *
+ * @async
+ * @param {string} controllerUrl - Controller base URL
+ * @param {{ clientId: string, clientSecret: string }} credentials - Application credentials
+ * @param {Object} [deps] - Injected collaborators
+ * @returns {Promise<{ configuration: Object, context: Object, issuedAt: string }>} The snapshot
+ * @throws {Error} When authentication fails, or the snapshot is refused or malformed
+ */
+async function fetchBootstrapSnapshot(controllerUrl, credentials, deps = {}) {
+  if (!credentials || !credentials.clientId || !credentials.clientSecret) {
+    throw new Error('Client id and secret are required to fetch a bootstrap snapshot');
+  }
+  const call = deps.makeApiCall || require('../utils/api').makeApiCall;
+  const token = await exchangeClientToken(controllerUrl, credentials, call);
+  const response = await call(`${normalizeControllerUrl(controllerUrl)}/api/v1/auth/bootstrap`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify({ protocolVersion: BOOTSTRAP_PROTOCOL_VERSION })
+  });
+  if (!response || response.success !== true) {
+    throw new Error(
+      `Miso refused a configuration snapshot for ${credentials.clientId}: ` +
+        `${(response && response.error) || 'request failed'}`
+    );
+  }
+  const snapshot = response.data && response.data.data ? response.data.data : response.data;
+  if (!snapshot || typeof snapshot.configuration !== 'object' || snapshot.configuration === null) {
+    throw new Error(
+      `Miso returned a snapshot with no configuration for ${credentials.clientId}`
+    );
+  }
+  return snapshot;
+}
+
+module.exports = {
+  BOOTSTRAP_PROTOCOL_VERSION,
+  exchangeClientToken,
+  fetchBootstrapSnapshot
+};

package/lib/api/onboarding-status.api.js

@@ -0,0 +1,117 @@
+/**
+ * Read the public Miso required-baseline onboarding projection.
+ *
+ * @fileoverview Public Miso onboarding readiness client
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { ApiClient } = require('./index');
+
+const ENDPOINT = '/api/v1/health/onboarding-status';
+const PROJECTION_KEYS = ['code', 'retryable', 'state'];
+const VALID_PROJECTIONS = new Set([
+  'pending|null|true',
+  'complete|null|false',
+  'incomplete|baseline-dimensions-incomplete|true',
+  'incomplete|baseline-roles-incomplete|true'
+]);
+const VALID_PAIRS = new Set([
+  'pending|null|true::pending|null|true',
+  'incomplete|baseline-dimensions-incomplete|true::pending|null|true',
+  'complete|null|false::pending|null|true',
+  'complete|null|false::incomplete|baseline-roles-incomplete|true',
+  'complete|null|false::complete|null|false'
+]);
+
+function onboardingStatusError(message, code = 'MISO_ONBOARDING_STATUS_INVALID') {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function projectionSignature(projection) {
+  return `${projection.state}|${projection.code === null ? 'null' : projection.code}|${projection.retryable}`;
+}
+
+function hasValidProjectionTypes(projection) {
+  return typeof projection.state === 'string' &&
+    (projection.code === null || typeof projection.code === 'string') &&
+    typeof projection.retryable === 'boolean';
+}
+
+function parseProjection(value, name) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw onboardingStatusError(`Miso ${name} readiness projection is missing or malformed.`);
+  }
+  const keys = Object.keys(value).sort();
+  if (keys.length !== PROJECTION_KEYS.length || keys.some((key, index) => key !== PROJECTION_KEYS[index])) {
+    throw onboardingStatusError(`Miso ${name} readiness projection has unsupported fields.`);
+  }
+  const projection = { state: value.state, code: value.code, retryable: value.retryable };
+  if (!hasValidProjectionTypes(projection)) {
+    throw onboardingStatusError(`Miso ${name} readiness projection has invalid field types.`);
+  }
+  if (!VALID_PROJECTIONS.has(projectionSignature(projection))) {
+    throw onboardingStatusError(`Miso ${name} readiness projection has an unsupported state.`);
+  }
+  return Object.freeze(projection);
+}
+
+function parseOnboardingStatusResponse(response) {
+  if (!response || response.success !== true || response.status !== 200) {
+    throw onboardingStatusError(
+      'Miso onboarding readiness is unavailable.',
+      'MISO_ONBOARDING_STATUS_UNAVAILABLE'
+    );
+  }
+  const wireBody = response.data;
+  if (!wireBody || typeof wireBody !== 'object' || Array.isArray(wireBody) ||
+      Object.prototype.hasOwnProperty.call(wireBody, 'success')) {
+    throw onboardingStatusError('Miso onboarding readiness response envelope is malformed.');
+  }
+  const data = wireBody.data;
+  if (!data || typeof data !== 'object' || Array.isArray(data) ||
+      Object.prototype.hasOwnProperty.call(data, 'success')) {
+    throw onboardingStatusError('Miso onboarding readiness data envelope is malformed.');
+  }
+  const baselineDimensions = parseProjection(data.baselineDimensions, 'Dimension');
+  const baselineRoles = parseProjection(data.baselineRoles, 'Business Role');
+  const pair = `${projectionSignature(baselineDimensions)}::${projectionSignature(baselineRoles)}`;
+  if (!VALID_PAIRS.has(pair)) {
+    throw onboardingStatusError('Miso onboarding readiness contains an unsupported step ordering.');
+  }
+  return Object.freeze({ baselineDimensions, baselineRoles });
+}
+
+/**
+ * Fetch required-baseline readiness from Miso Controller.
+ * GET /api/v1/health/onboarding-status
+ * @requiresPermission {Controller} Public
+ * @param {string} controllerUrl
+ * @param {{timeoutMs?: number, client?: ApiClient}} [options]
+ * @returns {Promise<{baselineDimensions: Object, baselineRoles: Object}>}
+ */
+async function fetchOnboardingStatus(controllerUrl, options = {}) {
+  const client = options.client || new ApiClient(controllerUrl);
+  const requestOptions = {};
+  if (options.timeoutMs !== undefined) requestOptions.timeoutMs = options.timeoutMs;
+  let response;
+  try {
+    response = await client.get(ENDPOINT, requestOptions);
+  } catch {
+    throw onboardingStatusError(
+      'Miso onboarding readiness request failed.',
+      'MISO_ONBOARDING_STATUS_UNAVAILABLE'
+    );
+  }
+  return parseOnboardingStatusResponse(response);
+}
+
+module.exports = {
+  ENDPOINT,
+  fetchOnboardingStatus,
+  parseOnboardingStatusResponse
+};

package/lib/app/deploy.js

@@ -191,12 +191,21 @@ async function handleDeploymentError(error, appName, controllerUrl, usedExternal
  * @throws {Error} If image is missing or has no registry
  */
 function validateImageIsPullable(imageRef, appName) {
-  if (!imageRef || !imageRef.includes('/')) {
-    const hint = `Set image.registry and image.tag in builder/${appName}/application.yaml, or pass a full image ref (e.g. --image <registry>/${appName}:<tag>) when deploying`;
-    throw new Error(
-      `Deployed image must be pullable (include a registry). Current image: "${imageRef || 'none'}". ${hint}`
-    );
+  if (imageRef && imageRef.includes('/')) {
+    return;
+  }
+  // No registry configured means the installation deploys the application.yaml image as it
+  // stands, from the local Docker daemon. Demanding a registry component here would make a
+  // local install impossible for the one case it is meant to serve. A configured registry
+  // still has to appear in the reference, because then the image is expected to be pullable.
+  const { readInstallationRegistrySync } = require('../utils/config-registry-preference');
+  if (!readInstallationRegistrySync()) {
+    return;
   }
+  const hint = `Set image.registry and image.tag in builder/${appName}/application.yaml, or pass a full image ref (e.g. --image <registry>/${appName}:<tag>) when deploying`;
+  throw new Error(
+    `Deployed image must be pullable (include a registry). Current image: "${imageRef || 'none'}". ${hint}`
+  );
 }
 
 /**

package/lib/app/register.js

@@ -28,6 +28,24 @@ const { refreshUrlsLocalRegistryFromBuilder } = require('../utils/urls-local-reg
 const { resolveControllerUrl } = require('../utils/controller-url');
 const config = require('../core/config');
 
+/**
+ * Handle local credential persistence failure without exposing details in strict mode.
+ * @param {Error} error
+ * @param {boolean} required
+ * @returns {false}
+ */
+function handleCredentialPersistenceFailure(error, required) {
+  if (required) {
+    const persistenceError = new Error(
+      'Application credentials could not be saved to the supported local secret store.'
+    );
+    persistenceError.code = 'LOCAL_CREDENTIAL_PERSISTENCE_FAILED';
+    throw persistenceError;
+  }
+  logger.warn(chalk.yellow(`⚠  Could not save credentials locally: ${error.message}`));
+  return false;
+}
+
 /**
  * Build registration data payload from app configuration
  * @param {Object} appConfig - Application configuration
@@ -83,8 +101,11 @@ function buildRegistrationData(appConfig, options) {
  * @async
  * @param {Object} responseData - Registration response data
  * @param {string} apiUrl - API URL
+ * @param {Object} [options] - Persistence behavior
+ * @param {boolean} [options.required=false] - Throw a safe typed error when persistence fails
+ * @returns {Promise<boolean>} True when credentials were persisted
  */
-async function saveLocalCredentials(responseData, apiUrl) {
+async function saveLocalCredentials(responseData, apiUrl, options = {}) {
   const registeredAppKey = responseData.application.key;
   const clientIdKey = `${registeredAppKey}-client-idKeyVault`;
   const clientSecretKey = `${registeredAppKey}-client-secretKeyVault`;
@@ -113,8 +134,9 @@ async function saveLocalCredentials(responseData, apiUrl) {
       logger.log(formatSuccessParagraph('Credentials saved to ~/.aifabrix/secrets.local.yaml\n'));
     }
   } catch (error) {
-    logger.warn(chalk.yellow(`⚠  Could not save credentials locally: ${error.message}`));
+    return handleCredentialPersistenceFailure(error, options.required === true);
   }
+  return true;
 }
 
 /**

package/lib/app/run-env-compose.js

@@ -13,20 +13,26 @@ const path = require('path');
 const fs = require('fs').promises;
 const fsSync = require('fs');
 const pathsUtil = require('../utils/paths');
+const { isScopeActiveForOptions } = require('../utils/environment-scoped-resources');
 const adminSecrets = require('../core/admin-secrets');
 const config = require('../core/config');
 const secretsEnsure = require('../core/secrets-ensure');
 const secretsEnvWrite = require('../core/secrets-env-write');
 const { getContainerPort } = require('../utils/port-resolver');
 const { applyAdminSecretsPlatformOverlay } = require('../core/admin-secrets-env-overlay');
+const {
+  resolveDimensionAbacSetting,
+  applyDimensionAbacToEnvMap
+} = require('../utils/dataplane-dimension-abac-setting');
+const { resolveEffectiveRegistry } = require('../utils/resolve-docker-image-ref');
 
 /**
  * Merge app env with admin-secrets; overlay ensures platform keys come from admin file.
  * @param {Object.<string, string>} merged
  * @param {Object.<string, string>} adminObj
  */
-function mergeRunEnvWithAdminOverlay(merged, adminObj) {
-  applyAdminSecretsPlatformOverlay(merged, adminObj);
+function mergeRunEnvWithAdminOverlay(merged, adminObj, appName) {
+  applyAdminSecretsPlatformOverlay(merged, adminObj, appName);
 }
 
 async function applyOnboardingPlatformModeIfNeeded(appName, merged) {
@@ -37,6 +43,13 @@ async function applyOnboardingPlatformModeIfNeeded(appName, merged) {
   merged.ONBOARDING_FULL_PLATFORM = mode === 'full' ? 'true' : 'false';
 }
 
+async function applyDimensionAbacSettingIfNeeded(appName, merged) {
+  if (appName !== 'dataplane') return;
+  const userConfig = await config.getConfig();
+  const resolved = resolveDimensionAbacSetting(userConfig);
+  applyDimensionAbacToEnvMap(appName, merged, resolved.value);
+}
+
 /**
  * Backfill only secrets needed for `aifabrix run <app>`: kv:// keys from that app's env.template
  * (catalog defaults via placeholderContext). Does not run full `ensureInfraSecrets`.
@@ -108,9 +121,7 @@ function injectDatabaseNamesAndUsers(env, appConfig, scopeOpts = null) {
   if (!Array.isArray(databases) || databases.length === 0) return;
   const prefix =
     scopeOpts &&
-    scopeOpts.effectiveEnvironmentScopedResources &&
-    scopeOpts.runEnvKey &&
-    (scopeOpts.runEnvKey === 'dev' || scopeOpts.runEnvKey === 'tst')
+    isScopeActiveForOptions(scopeOpts)
       ? `${String(scopeOpts.runEnvKey).toLowerCase()}-`
       : '';
   for (let i = 0; i < databases.length; i++) {
@@ -261,6 +272,29 @@ async function applyPostgresPasswordFromPgpass(merged, developerId) {
   if (pgpassPwd !== undefined) merged.POSTGRES_PASSWORD = pgpassPwd;
 }
 
+/**
+ * Deliver existing local installation inputs to privileged Miso bootstrap only.
+ * @param {string} appName
+ * @param {Object} merged
+ * @param {Object} appConfig
+ * @param {Object|null} scopeOpts
+ */
+function applyMisoBootstrapInputsIfNeeded(appName, merged, appConfig, scopeOpts) {
+  if (appName !== 'miso-controller') return;
+  const postgresPassword = merged.POSTGRES_PASSWORD;
+  if (typeof postgresPassword !== 'string' || postgresPassword.trim().length === 0) {
+    throw new Error(
+      'Local PostgreSQL administrator password is unavailable. Re-run "aifabrix up-infra" before starting Miso Controller.'
+    );
+  }
+  merged.POSTGRES_ADMIN_PASSWORD = postgresPassword;
+  const { registry } = resolveEffectiveRegistry(appConfig, {
+    registry: scopeOpts?.registry
+  });
+  if (registry) merged.ACR_LOGIN_SERVER = registry;
+  else delete merged.ACR_LOGIN_SERVER;
+}
+
 /**
  * @param {string} runEnvPath
  * @param {string} runEnvAdminPath
@@ -298,11 +332,13 @@ async function buildMergedRunEnvAndWrite(appName, appConfig, devDir, developerId
     runEnvKey
   });
   const merged = { ...adminObj, ...appObj };
-  mergeRunEnvWithAdminOverlay(merged, adminObj);
+  mergeRunEnvWithAdminOverlay(merged, adminObj, appName);
   await applyOnboardingPlatformModeIfNeeded(appName, merged);
   await applyPostgresPasswordFromPgpass(merged, developerId);
+  applyMisoBootstrapInputsIfNeeded(appName, merged, appConfig, scopeOpts);
   injectDatabaseNamesAndUsers(merged, appConfig, scopeOpts);
   injectContainerPortForRun(merged, appConfig, appName);
+  await applyDimensionAbacSettingIfNeeded(appName, merged);
 
   const runEnvPath = path.join(devDir, '.env.run');
   const runEnvAdminPath = path.join(devDir, '.env.run.admin');
@@ -352,9 +388,9 @@ async function ensureRunEnvFilesPresent(
  * @throws {Error} If password keys appear in environment-like assignment
  */
 function assertNoPasswordLiteralsInCompose(composeContent) {
-  const badPattern = /\n\s+(-?\s*)(POSTGRES_PASSWORD|DB_\d+_PASSWORD)\s*[:=]/;
+  const badPattern = /\n\s+(-?\s*)(POSTGRES_PASSWORD|POSTGRES_ADMIN_PASSWORD|DB_\d+_PASSWORD)\s*[:=]/;
   if (badPattern.test(composeContent)) {
-    throw new Error('Generated compose must not contain password literals (POSTGRES_PASSWORD, DB_*_PASSWORD). Use env_file only.');
+    throw new Error('Generated compose must not contain password literals (PostgreSQL or application database passwords). Use env_file only.');
   }
 }
 

package/lib/app/run-env-recovery.js

@@ -26,6 +26,7 @@ function buildRunEnvRecovery(appName, prepared) {
       prepared.appConfig.developerId,
       {
         runEnvKey: prepared.mergedRunOptions.env,
+        registry: prepared.mergedRunOptions.registry,
         effectiveEnvironmentScopedResources:
           prepared.mergedRunOptions.effectiveEnvironmentScopedResources
       }

package/lib/app/run-helpers.js

@@ -366,7 +366,7 @@ async function prepareEnvironment(appName, appConfig, options) {
     appConfig,
     devDir,
     developerId,
-    { runEnvKey, effectiveEnvironmentScopedResources }
+    { runEnvKey, effectiveEnvironmentScopedResources, registry: options.registry }
   );
   const { hydrateMissingLocalParameters } = require('./run-parameter-sync');
   await hydrateMissingLocalParameters(appName, runEnvPath);

package/lib/app/run.js

@@ -258,10 +258,12 @@ function applyTraefikFlagToRunOptions(runOptions, userCfg) {
 
 /**
  * @param {string} envKey
- * @throws {Error} If env is not dev, tst, or pro
+ * @param {string} appName
+ * @throws {Error} If env is not a supported workload environment or a miso-only platform app
  */
-function assertValidRunEnvKey(envKey) {
-  if (envKey !== 'dev' && envKey !== 'tst' && envKey !== 'pro') {
+function assertValidRunEnvKey(envKey, appName) {
+  const misoOnlyPlatformApp = appName === 'builder-api' || appName === 'integration-server';
+  if (envKey !== 'dev' && envKey !== 'tst' && envKey !== 'pro' && !(envKey === 'miso' && misoOnlyPlatformApp)) {
     throw new Error('--env must be dev, tst, or pro');
   }
 }
@@ -345,7 +347,7 @@ function emitRunManifestMetadataIfRequested(appName, options) {
  */
 async function prepareAppRun(appName, options, debug) {
   const envKey = (options.env || 'dev').toLowerCase();
-  assertValidRunEnvKey(envKey);
+  assertValidRunEnvKey(envKey, appName);
   const shouldContinue = await validateAppForRun(appName, debug);
   if (!shouldContinue) {
     return null;

package/lib/build/standard-docker-build.js

@@ -104,6 +104,10 @@ async function executeDockerImageBuild(appName, options, buildConfig) {
  * @returns {Promise<string>} Built image ref e.g. name:tag
  */
 async function runStandardDockerBuild(appName, options) {
+  // Before the tag plan, the promote shortcut and any Docker call: every build path reaches
+  // here, and a build into tst or pro must not get as far as producing an artifact.
+  const { assertBuildEnvironmentForOptions } = require('../core/environment-mode-policy');
+  await assertBuildEnvironmentForOptions(options);
   const { resolveBuildTagPlan, readAppVersion } = require('../utils/image-tags');
   const { buildConfig, config: appConfig } = await buildHelpers.loadAndValidateConfig(appName);
   // Resolve and validate every tag before any Docker build, tag, login or promote.

package/lib/channels/channel-artifact-generator.js

@@ -92,7 +92,7 @@ function renderTemplateFile(templatePath, context) {
  * @param {boolean} dryRun
  * @returns {{ installPath: string, content: string }|null}
  */
-function renderInstallGuideIfPresent(templatesDir, runtimeValues, outputDir, dryRun) {
+function renderInstallGuideIfPresent(templatesDir, runtimeValues, outputDir, dryRun, durableDir) {
   const installTemplate = path.join(templatesDir, 'install.template.md.hbs');
   if (!fs.existsSync(installTemplate)) {
     return null;
@@ -100,11 +100,19 @@ function renderInstallGuideIfPresent(templatesDir, runtimeValues, outputDir, dry
   const content = renderTemplateFile(installTemplate, runtimeValues);
   assertNoSecretsInArtifact(content);
   const installPath = path.join(outputDir, 'INSTALL.md');
+  // `outputDir` is under gitignored dist/, so a copy there alone is lost on any clean and the
+  // API that serves this document 404s afterwards. Write the durable copy too when the caller
+  // knows where the channel's committed files live.
+  const durablePath = durableDir ? path.join(durableDir, 'INSTALL.md') : '';
   if (!dryRun) {
     fs.mkdirSync(outputDir, { recursive: true });
     fs.writeFileSync(installPath, content, 'utf8');
+    if (durablePath) {
+      fs.mkdirSync(durableDir, { recursive: true });
+      fs.writeFileSync(durablePath, content, 'utf8');
+    }
   }
-  return { installPath, content };
+  return { installPath, content, durablePath: durablePath || undefined };
 }
 
 /**
@@ -130,6 +138,7 @@ function generateCopilotChannelArtifact(params, templatesDir, outputPath) {
  * @param {string} params.channelTarget
  * @param {Object} params.runtimeValues
  * @param {boolean} [params.dryRun]
+ * @param {string} [params.durableDir] - Committed channel directory for the persisted INSTALL.md
  * @returns {{ outputPath: string, artifactHash: string, content: string, installPath?: string }}
  */
 function generateChannelArtifact(params) {
@@ -158,7 +167,8 @@ function generateChannelArtifact(params) {
     templatesDir,
     runtimeValues,
     outputDir,
-    params.dryRun === true
+    params.dryRun === true,
+    params.durableDir
   );
 
   const installReady = runtimeValues?.installReady === true;

package/lib/cli/infra-guided-footers.js

@@ -46,11 +46,12 @@ async function resolvePlatformControllerUrlForDisplay() {
   return resolvePlatformControllerUrl();
 }
 
-async function logPlatformReadyFooter() {
-  const [controllerUrl, dataplaneUrl, keycloakUrl] = await Promise.all([
+async function logPlatformReadyFooter(options = {}) {
+  const [controllerUrl, dataplaneUrl, keycloakUrl, integrationServerUrl] = await Promise.all([
     resolvePlatformControllerUrlForDisplay(),
     computeAppBaseUrl('dataplane'),
-    computeAppBaseUrl('keycloak')
+    computeAppBaseUrl('keycloak'),
+    options.integrationServer === true ? computeAppBaseUrl('integration-server') : null
   ]);
   const cfg = await config.getConfig();
   const env = cfg && cfg.environment ? cfg.environment : 'dev';
@@ -60,7 +61,7 @@ async function logPlatformReadyFooter() {
   logSection('Miso Controller', controllerUrl);
   logSection('Dataplane (DEV)', dataplaneUrl);
   logSection('Keycloak', keycloakUrl);
-  logSection('API Documentation', `${dataplaneUrl}/api/docs`);
+  if (integrationServerUrl) logSection('Integration Server', `${integrationServerUrl}/download`);
   logSection('Knowledge Base', 'https://docs.aifabrix.ai');
   logSection('Getting Started', 'https://docs.aifabrix.ai/get-started');
   logFooterEnd();
@@ -91,20 +92,21 @@ async function logDataplaneReadyFooter() {
 /**
  * @param {'platform'|'dataplane'} [scope]
  */
-function logPlatformSetupDurationHint(scope = 'platform') {
+function logPlatformSetupDurationHint(scope = 'platform', options = {}) {
+  const optionalApp = options.integrationServer === true ? ', Builder API, and Integration Server' : ', and Builder API';
   const line =
     scope === 'dataplane'
       ? 'Installation may take a few minutes. Authenticating and starting Dataplane — please wait.'
-      : 'Installation may take a few minutes. Keycloak, Miso Controller, Dataplane, and Builder API are starting — please wait.';
+      : `Installation may take a few minutes. Keycloak, Miso Controller, Dataplane${optionalApp} are starting — please wait.`;
   logger.log(chalk.yellow(`⚠ ${line}`));
 }
 
-function logGuidedPlatformSetupHeader() {
+function logGuidedPlatformSetupHeader(options = {}) {
   logger.log('');
   logger.log(title('AI Fabrix Platform Setup'));
   logger.log(SEPARATOR);
   logger.log('');
-  logPlatformSetupDurationHint('platform');
+  logPlatformSetupDurationHint('platform', options);
   logger.log('');
 }