@aifabrix/builder 2.61.2 → 2.63.0

package/lib/commands/up-builder-api.js

@@ -23,10 +23,28 @@ const {
   resolveUpBuilderApiControllerContext,
   provisionAndDeployBuilderApi,
   refreshBuilderApiEnvAfterProvision,
-  computeBuilderApiRunOverrides,
-  resolveEnvironment
+  computeBuilderApiRunOverrides
 } = require('./up-builder-api-provision');
 
+const BUILDER_API_ENVIRONMENT_KEY = 'miso';
+
+/**
+ * Builder API is a platform application and is installed once in miso.
+ * The selected workload environment only controls which workloads it manages.
+ *
+ * @param {Object} options
+ * @returns {string}
+ */
+function resolveBuilderApiEnvironmentKey(options) {
+  const requested = options && options.envKey
+    ? String(options.envKey).trim().toLowerCase()
+    : BUILDER_API_ENVIRONMENT_KEY;
+  if (requested !== BUILDER_API_ENVIRONMENT_KEY) {
+    throw new Error('Builder-api can only be installed in environment \'miso\'.');
+  }
+  return BUILDER_API_ENVIRONMENT_KEY;
+}
+
 /**
  * @async
  * @param {Object} [options]
@@ -39,10 +57,7 @@ async function handleUpBuilderApi(options = {}) {
     );
   }
 
-  const environmentKey =
-    options && options.envKey
-      ? String(options.envKey).trim().toLowerCase()
-      : await resolveEnvironment();
+  const environmentKey = resolveBuilderApiEnvironmentKey(options);
 
   const { controllerUrl, authConfig, useBootstrap } = await resolveUpBuilderApiControllerContext(
     options,
@@ -63,6 +78,7 @@ async function handleUpBuilderApi(options = {}) {
   const { portOverride } = await computeBuilderApiRunOverrides(options);
 
   const runOpts = {
+    env: environmentKey,
     registry: options.registry,
     registryMode: options.registryMode,
     skipEnvOutputPath: true,
@@ -79,10 +95,10 @@ async function handleUpBuilderApi(options = {}) {
   if (options.platformInstall !== true) {
     logger.log(
       formatSuccessParagraph(
-        'up-builder-api complete. Builder-api is registered, deployed in dev, and running locally.'
+        'up-builder-api complete. Builder-api is registered in miso and running locally.'
       )
     );
   }
 }
 
-module.exports = { handleUpBuilderApi };
+module.exports = { handleUpBuilderApi, resolveBuilderApiEnvironmentKey };

package/lib/commands/up-common.js

@@ -331,12 +331,16 @@ const DATAPLANE_BUILDER_APP_KEYS = Object.freeze(['dataplane']);
 /** Builder API platform app key (154.2). */
 const BUILDER_API_APP_KEYS = Object.freeze(['builder-api']);
 
+/** Optional integration server platform app key. */
+const INTEGRATION_SERVER_APP_KEYS = Object.freeze(['integration-server']);
+
 /** Builder dirs removed on up-platform / setup force (includes Celery companions). */
 const PLATFORM_BUILDER_CLEAN_APP_KEYS = Object.freeze([
   'keycloak',
   'miso-controller',
   ...DATAPLANE_BUILDER_APP_KEYS,
-  ...BUILDER_API_APP_KEYS
+  ...BUILDER_API_APP_KEYS,
+  ...INTEGRATION_SERVER_APP_KEYS
 ]);
 
 /**
@@ -375,6 +379,15 @@ async function ensureBuilderApiAppsFromTemplate(opts = {}) {
   return anyCopied;
 }
 
+/**
+ * Ensure the optional integration server manifest exists under the system builder root.
+ * @param {object} [opts]
+ * @returns {Promise<boolean>}
+ */
+async function ensureIntegrationServerAppsFromTemplate(opts = {}) {
+  return ensureAppFromTemplate(INTEGRATION_SERVER_APP_KEYS[0], opts);
+}
+
 /**
  * Merge builder/packages `application.yaml` into `~/.aifabrix/urls.local.yaml`.
  * Same scan as the end of {@link prepareUrlsLocalRegistryForUpPlatform}; call after platform app
@@ -410,10 +423,12 @@ module.exports = {
   applyUpPlatformForceConfig,
   cleanBuilderAppDirs,
   BUILDER_API_APP_KEYS,
+  INTEGRATION_SERVER_APP_KEYS,
   DATAPLANE_BUILDER_APP_KEYS,
   PLATFORM_BUILDER_CLEAN_APP_KEYS,
   ensureAppFromTemplate,
   ensureBuilderApiAppsFromTemplate,
+  ensureIntegrationServerAppsFromTemplate,
   ensureDataplaneAppsFromTemplate,
   patchEnvOutputPathForDeployOnly,
   validateEnvOutputPathFolderOrNull,

package/lib/commands/up-dataplane-bootstrap.js

@@ -19,14 +19,128 @@ const {
   extractAppConfiguration
 } = require('../utils/app-register-config');
 const { buildRegistrationData, saveLocalCredentials, applyLocalhostPortAdjustment } = require('../app/register');
-const { loadDataplanePipelineCredentialsFromSecretsFile } = require('./up-dataplane-credentials');
+const {
+  loadDataplanePipelineCredentialsFromSecretsFile,
+  credentialsAcceptToken,
+  waitForDataplaneCredentials
+} = require('./up-dataplane-credentials');
 const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+const { getToken } = require('../api/auth.api');
+const { updateApplicationSelfStatus } = require('../api/applications.api');
+const { tokenFrom } = require('../app/run-parameter-sync');
+const { resolveDeclarativeShowUrlsForApp } = require('../core/secrets-env-declarative-expand');
+const pathsUtil = require('../utils/paths');
 
 const ENCRYPTION_VAULT_KEYS = [
   'miso-controller-secrets-encryptionKeyVault',
   'secrets-encryptionKeyVault'
 ];
 
+const BOOTSTRAP_CREDENTIAL_ERROR_CODE = 'DATAPLANE_BOOTSTRAP_CREDENTIALS_UNAVAILABLE';
+
+/**
+ * Create a stable, secret-safe bootstrap credential error.
+ * @param {string} message
+ * @returns {Error}
+ */
+function createBootstrapCredentialError(message) {
+  const error = new Error(message);
+  error.code = BOOTSTRAP_CREDENTIAL_ERROR_CODE;
+  return error;
+}
+
+/**
+ * @param {Object|null|undefined} credentials
+ * @returns {boolean}
+ */
+function hasUsablePipelineCredentials(credentials) {
+  return Boolean(
+    credentials &&
+    typeof credentials.clientId === 'string' && credentials.clientId.trim() &&
+    typeof credentials.clientSecret === 'string' && credentials.clientSecret.trim()
+  );
+}
+
+/**
+ * Persist newly issued credentials and prove they can be loaded before deployment.
+ * @async
+ * @param {Object} responseData
+ * @param {string} controllerUrl
+ * @param {string} environmentKey
+ * @param {number} containerPort
+ * @returns {Promise<{status: string, credentialsAvailable: true}>}
+ */
+async function persistBootstrapCredentials(responseData, controllerUrl, environmentKey, containerPort) {
+  try {
+    await saveLocalCredentials(responseData, controllerUrl, { required: true });
+  } catch {
+    throw createBootstrapCredentialError(
+      'Dataplane bootstrap credentials could not be persisted locally; deployment was not started.'
+    );
+  }
+  const localCredentials = await loadDataplanePipelineCredentialsFromSecretsFile();
+  if (!hasUsablePipelineCredentials(localCredentials)) {
+    throw createBootstrapCredentialError(
+      'Dataplane bootstrap credentials are not available from the supported local secret store; ' +
+        'deployment was not started.'
+    );
+  }
+  await syncDataplaneApplicationUrls(
+    controllerUrl,
+    environmentKey,
+    responseData.credentials,
+    containerPort
+  );
+  if (!(await waitForDataplaneCredentials(controllerUrl))) {
+    throw createBootstrapCredentialError(
+      'Dataplane bootstrap credentials were issued but the controller did not accept them in time. ' +
+        'Deployment was not started; retry the command after checking the controller token endpoint.'
+    );
+  }
+  logger.log(formatSuccessLine('Dataplane bootstrap credentials saved locally'));
+  return { status: 'provisioned', credentialsAvailable: true };
+}
+
+/**
+ * Require existing supported local credentials for an idempotent response.
+ * @async
+ * @returns {Promise<{status: string, credentialsAvailable: true}>}
+ */
+async function acceptAlreadyProvisionedDataplane(controllerUrl) {
+  const localCredentials = await loadDataplanePipelineCredentialsFromSecretsFile();
+  const accepted = hasUsablePipelineCredentials(localCredentials) &&
+    await credentialsAcceptToken(controllerUrl);
+  if (!accepted) {
+    throw createBootstrapCredentialError(
+      'Dataplane is registered on the controller but pipeline credentials are missing locally. ' +
+        'Use an authorized session to run: aifabrix app rotate-secret dataplane, then retry setup.'
+    );
+  }
+  logger.log(formatSuccessLine('Dataplane already provisioned (bootstrap idempotent)'));
+  return { status: 'already_provisioned', credentialsAvailable: true };
+}
+
+/**
+ * @async
+ * @param {Object} responseData
+ * @param {string} controllerUrl
+ * @param {string} environmentKey
+ * @param {number} containerPort
+ * @returns {Promise<{status: string, credentialsAvailable: true}>}
+ */
+async function handleBootstrapResponse(responseData, controllerUrl, environmentKey, containerPort) {
+  if (hasUsablePipelineCredentials(responseData.credentials)) {
+    return persistBootstrapCredentials(responseData, controllerUrl, environmentKey, containerPort);
+  }
+  if (responseData.status === 'already_provisioned') {
+    return acceptAlreadyProvisionedDataplane(controllerUrl);
+  }
+  throw createBootstrapCredentialError(
+    'Dataplane bootstrap returned no usable credentials or supported already-provisioned status; ' +
+      'deployment was not started.'
+  );
+}
+
 /**
  * @param {Record<string, unknown>} secrets
  * @returns {string|null}
@@ -87,6 +201,33 @@ async function canUseBootstrapProvision(options = {}) {
   return Boolean(encryptionKey);
 }
 
+/**
+ * Persist canonical declarative URLs before Dataplane takes its bootstrap snapshot.
+ * @param {string} controllerUrl
+ * @param {string} environmentKey
+ * @param {{clientId: string, clientSecret: string}} credentials
+ * @param {number} containerPort
+ * @returns {Promise<void>}
+ */
+async function syncDataplaneApplicationUrls(controllerUrl, environmentKey, credentials, containerPort) {
+  const appPath = pathsUtil.getBuilderPath('dataplane');
+  const variablesPath = pathsUtil.resolveApplicationConfigPath(appPath);
+  const urls = await resolveDeclarativeShowUrlsForApp('dataplane', appPath, variablesPath, 'docker');
+  if (!urls) {
+    throw new Error('Could not resolve canonical Dataplane public and internal URLs');
+  }
+  const tokenResponse = await getToken(credentials.clientId, credentials.clientSecret, controllerUrl);
+  const response = await updateApplicationSelfStatus(
+    controllerUrl,
+    environmentKey,
+    { type: 'client-token', token: tokenFrom(tokenResponse) },
+    { status: 'deploying', url: urls.publicUrl, internalUrl: urls.internalUrl, port: containerPort }
+  );
+  if (!response?.success) {
+    throw new Error('Controller rejected canonical Dataplane public and internal URLs');
+  }
+}
+
 /**
  * Register dataplane via bootstrap endpoint (idempotent).
  * @async
@@ -94,7 +235,7 @@ async function canUseBootstrapProvision(options = {}) {
  * @param {string} controllerUrl
  * @param {string} environmentKey
  * @param {Function} buildDataplaneImageRefFn
- * @returns {Promise<void>}
+ * @returns {Promise<{status: string, credentialsAvailable: true}>}
  */
 async function bootstrapDataplaneApplication(options, controllerUrl, environmentKey, buildDataplaneImageRefFn) {
   const encryptionKey = await resolveBootstrapEncryptionKey();
@@ -107,6 +248,7 @@ async function bootstrapDataplaneApplication(options, controllerUrl, environment
 
   const { variables } = await loadVariablesYaml('dataplane');
   const appConfig = await extractAppConfiguration(variables, 'dataplane', options);
+  const containerPort = appConfig.port;
   await applyLocalhostPortAdjustment(appConfig, controllerUrl, options);
 
   const imageOverride = options.image || buildDataplaneImageRefFn(options);
@@ -126,24 +268,15 @@ async function bootstrapDataplaneApplication(options, controllerUrl, environment
     registrationData
   );
 
-  if (responseData.credentials && responseData.credentials.clientSecret) {
-    await saveLocalCredentials(responseData, controllerUrl);
-    logger.log(formatSuccessLine('Dataplane bootstrap credentials saved locally'));
-  } else if (responseData.status === 'already_provisioned') {
-    logger.log(formatSuccessLine('Dataplane already provisioned (bootstrap idempotent)'));
-    const localCredentials = await loadDataplanePipelineCredentialsFromSecretsFile();
-    if (!localCredentials) {
-      throw new Error(
-        'Dataplane is registered on the controller but pipeline credentials are missing locally. ' +
-          'Run fresh setup with volume wipe, or: aifabrix login && aifabrix app rotate-secret dataplane'
-      );
-    }
-  }
+  return handleBootstrapResponse(responseData, controllerUrl, environmentKey, containerPort);
 }
 
 module.exports = {
   canUseBootstrapProvision,
   resolveBootstrapEncryptionKey,
   bootstrapDataplaneApplication,
-  pickBootstrapEncryptionKeyFromSecrets
+  syncDataplaneApplicationUrls,
+  pickBootstrapEncryptionKeyFromSecrets,
+  hasUsablePipelineCredentials,
+  BOOTSTRAP_CREDENTIAL_ERROR_CODE
 };

package/lib/commands/up-dataplane-credentials.js

@@ -193,8 +193,29 @@ async function alignDataplaneCredentialsAfterDeploy(options, controllerUrl) {
   }
 }
 
+/**
+ * Wait until a freshly bootstrapped pair is accepted, before anything depends on it.
+ *
+ * The Controller can answer the bootstrap call before the pipeline client is usable, and
+ * the deploy that follows gets one attempt against one URL: validateDeployment retries only
+ * on a 5xx, so a 401 from a client that is not published yet ends the install. The align
+ * step already tolerates this, with 15 attempts across three bases, but it runs after the
+ * deploy — the forgiving check after the unforgiving one.
+ *
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} [retry] - Overrides for the bootstrap probe budget
+ * @returns {Promise<boolean>} True once the pair is accepted
+ */
+async function waitForDataplaneCredentials(controllerUrl, retry = {}) {
+  const { maxAttempts, delayMs } = resolveCredentialProbeRetry({ useBootstrap: true, credentialProbeRetry: retry });
+  return credentialsAcceptTokenWithRetry(controllerUrl, maxAttempts, delayMs);
+}
+
 module.exports = {
   alignDataplaneCredentialsAfterDeploy,
+  waitForDataplaneCredentials,
+  credentialsAcceptTokenWithRetry,
   probeDataplaneClientToken,
   credentialsAcceptToken,
   loadDataplanePipelineCredentialsFromSecretsFile,

package/lib/commands/up-dataplane.js

@@ -227,6 +227,9 @@ async function deployDataplaneToController(options) {
     image: imageOverride,
     registryMode: options.registryMode,
     envKey: options.envKey ? String(options.envKey).trim().toLowerCase() : undefined,
+    // The bootstrap path has no device login, so it sets client-credentials explicitly.
+    // Dropping it here left the deploy in 'auto' mode.
+    deploymentAuth: options.deploymentAuth,
     // Guided up-platform already shows a top-level spinner for the dataplane step.
     // Avoid nested deploy polling spinners/logs.
     silentPoll: options.platformInstall === true
@@ -266,7 +269,8 @@ function emitDataplaneManifestLineFromBuilder() {
 }
 
 function computeDataplanePortOverride(runEnvKey, developerIdNum) {
-  if (runEnvKey !== 'dev' && runEnvKey !== 'tst') {
+  const { isScopedRunEnvironmentKey } = require('../utils/environment-scoped-resources');
+  if (!isScopedRunEnvironmentKey(runEnvKey)) {
     return undefined;
   }
   return dataplaneDockerHostPort(3001, developerIdNum, runEnvKey);
@@ -340,21 +344,26 @@ async function provisionAndDeployDataplane(options, environmentKey, controllerUr
   logger.log('');
 }
 
-/**
- * Handle up-dataplane command: ensure logged in, environment dev, ensure dataplane,
- * register or rotate (if already registered), deploy (send manifest to controller),
- * then run dataplane app locally (always local deployment).
- *
- * @async
- * @function handleUpDataplane
- * @param {Object} options - Commander options
- * @param {string} [options.registry] - Override registry for dataplane
- * @param {string} [options.registryMode] - Override registry mode (acr|external)
- * @param {string} [options.image] - Override image reference for dataplane
- * @param {boolean} [options.skipInfraCheck] - When true, skip Postgres/Redis gate (caller already verified, e.g. guided up-dataplane).
- * @returns {Promise<void>}
- * @throws {Error} If infra not up, controller unavailable, not logged in, environment not dev, or any step fails
- */
+async function runDataplaneLocally(options) {
+  const { runEnvKey, portOverride } = await computeDataplaneRunOverrides(options);
+  const runAppOpts = {
+    skipEnvOutputPath: true,
+    env: runEnvKey,
+    port: portOverride,
+    registry: options.registry || undefined,
+    base: options.base !== false,
+    skipManifestMetadataLine: true
+  };
+  if (options.platformInstall === true) {
+    if (typeof options.onPollText === 'function') {
+      runAppOpts.onPollText = options.onPollText;
+    } else {
+      runAppOpts.silentPoll = true;
+    }
+  }
+  await app.runApp('dataplane', runAppOpts);
+}
+
 async function handleUpDataplane(options = {}) {
   if (options.platformInstall !== true) {
     logger.log(chalk.blue('Starting up-dataplane (register/rotate, deploy, then run dataplane locally)...\n'));
@@ -385,24 +394,7 @@ async function handleUpDataplane(options = {}) {
     controllerUrl
   );
 
-  const { runEnvKey, portOverride } = await computeDataplaneRunOverrides(options);
-
-  const runAppOpts = {
-    skipEnvOutputPath: true,
-    env: runEnvKey,
-    port: portOverride,
-    registry: options.registry || undefined,
-    base: options.base !== false,
-    skipManifestMetadataLine: true
-  };
-  if (options.platformInstall === true) {
-    if (typeof options.onPollText === 'function') {
-      runAppOpts.onPollText = options.onPollText;
-    } else {
-      runAppOpts.silentPoll = true;
-    }
-  }
-  await app.runApp('dataplane', runAppOpts);
+  await runDataplaneLocally(options);
 
   if (options.platformInstall !== true) {
     logger.log(formatSuccessParagraph('up-dataplane complete. Dataplane is registered, deployed in dev, and running locally.'));

package/lib/commands/up-integration-server.js

@@ -0,0 +1,112 @@
+/**
+ * Install the optional Integration Server as a miso-only platform application.
+ *
+ * @fileoverview Integration Server setup phase
+ */
+
+'use strict';
+
+const app = require('../app');
+const config = require('../core/config');
+const { generateEnvFile } = require('../core/secrets');
+const pathsUtil = require('../utils/paths');
+const { loadConfigFile } = require('../utils/config-format');
+const { resolveDockerImageRef } = require('../utils/resolve-docker-image-ref');
+const { callBootstrapApi } = require('../utils/app-bootstrap-api');
+const { loadVariablesYaml, extractAppConfiguration } = require('../utils/app-register-config');
+const { buildRegistrationData, saveLocalCredentials, applyLocalhostPortAdjustment } = require('../app/register');
+const { publishedHostPort, parseDeveloperIdNum } = require('../utils/declarative-url-ports');
+const { resolveBootstrapEncryptionKey } = require('./up-dataplane-bootstrap');
+const { resolveUpBuilderApiControllerContext } = require('./up-builder-api-provision');
+const {
+  ensureIntegrationServerAppsFromTemplate,
+  refreshUrlsLocalRegistryForCurrentProject
+} = require('./up-common');
+const { resolveLocalOnboardingApps } = require('../core/local-env-overrides');
+
+const APP_KEY = 'integration-server';
+const ENVIRONMENT_KEY = 'miso';
+
+async function isIntegrationServerSelected() {
+  const cfg = await config.getConfig();
+  return resolveLocalOnboardingApps(cfg).includes(APP_KEY);
+}
+
+function resolveIntegrationServerImageRef(options = {}) {
+  const appPath = pathsUtil.getBuilderPath(APP_KEY);
+  const manifestPath = pathsUtil.resolveApplicationConfigPath(appPath);
+  const variables = loadConfigFile(manifestPath) || {};
+  const { imageName, imageTag } = resolveDockerImageRef(APP_KEY, variables, {
+    registry: options.registry
+  });
+  return `${imageName}:${imageTag}`;
+}
+
+async function bootstrapIntegrationServer(options, controllerUrl) {
+  const encryptionKey = await resolveBootstrapEncryptionKey();
+  if (!encryptionKey) {
+    throw new Error('Bootstrap encryption key is unavailable for Integration Server installation.');
+  }
+  const { variables } = await loadVariablesYaml(APP_KEY);
+  const appConfig = await extractAppConfiguration(variables, APP_KEY, options);
+  await applyLocalhostPortAdjustment(appConfig, controllerUrl, options);
+  const image = options.image || resolveIntegrationServerImageRef(options);
+  const registrationData = buildRegistrationData(appConfig, {
+    image,
+    imageOverride: image,
+    registryMode: options.registryMode,
+    envKey: ENVIRONMENT_KEY
+  });
+  const response = await callBootstrapApi(
+    controllerUrl,
+    encryptionKey,
+    ENVIRONMENT_KEY,
+    registrationData
+  );
+  if (!response.credentials || !response.credentials.clientSecret) {
+    throw new Error('Integration Server bootstrap did not return its existing credentials.');
+  }
+  await saveLocalCredentials(response, controllerUrl);
+}
+
+async function runIntegrationServer(options) {
+  await generateEnvFile(APP_KEY, null, 'local', true);
+  const developerId = parseDeveloperIdNum(await config.getDeveloperId());
+  await app.runApp(APP_KEY, {
+    env: ENVIRONMENT_KEY,
+    registry: options.registry,
+    registryMode: options.registryMode,
+    image: options.image,
+    port: publishedHostPort(3006, developerId),
+    skipEnvOutputPath: true,
+    skipInfraCheck: true,
+    skipManifestMetadataLine: true,
+    silentPoll: true
+  });
+}
+
+async function handleUpIntegrationServer(options = {}) {
+  await ensureIntegrationServerAppsFromTemplate({ silent: true });
+  refreshUrlsLocalRegistryForCurrentProject();
+  const context = await resolveUpBuilderApiControllerContext(options, ENVIRONMENT_KEY);
+  if (!context.useBootstrap) {
+    throw new Error('Integration Server installation requires local bootstrap provisioning.');
+  }
+  await bootstrapIntegrationServer(options, context.controllerUrl);
+  const image = options.image || resolveIntegrationServerImageRef(options);
+  await app.deployApp(APP_KEY, {
+    image,
+    imageOverride: image,
+    registryMode: options.registryMode,
+    envKey: ENVIRONMENT_KEY,
+    deploymentAuth: 'client-credentials',
+    silentPoll: true
+  });
+  await runIntegrationServer({ ...options, image });
+}
+
+module.exports = {
+  handleUpIntegrationServer,
+  isIntegrationServerSelected,
+  resolveIntegrationServerImageRef
+};

package/lib/commands/wizard-config-normalizer.js

@@ -6,7 +6,9 @@
 
 const { repairKeyedDocument } = require('./repair-datasource-keyed-document');
 
-const ENTITY_TYPE_FALLBACK = 'record-storage';
+const { repairLegacyDatasource } = require('./repair-datasource-legacy');
+
+const ENTITY_TYPE_FALLBACK = 'recordStorage';
 const VALID_ENTITY_TYPES = new Set([
   'document-storage',
   'documentStorage',
@@ -16,6 +18,7 @@ const VALID_ENTITY_TYPES = new Set([
   'recordStorage',
   'message-service',
   'messageService',
+  'serviceContract',
   'none'
 ]);
 const VALID_PORTAL_FIELDS = new Set(['text', 'textarea', 'select', 'json', 'boolean', 'number']);
@@ -89,6 +92,7 @@ function normalizeDatasourceConfig(datasourceConfig, openapiSpec) {
   if (datasourceConfig.entityType && !VALID_ENTITY_TYPES.has(datasourceConfig.entityType)) {
     datasourceConfig.entityType = ENTITY_TYPE_FALLBACK;
   }
+  repairLegacyDatasource(datasourceConfig);
   normalizePortalInput(datasourceConfig);
   normalizeCipOutputModes(datasourceConfig);
   repairKeyedDocument(datasourceConfig, { openapiSpec });

package/lib/core/admin-secrets-env-overlay.js

@@ -10,9 +10,10 @@
 
 /**
  * @param {Object.<string, string>} adminObj
+ * @param {string} [appName]
  * @returns {Object.<string, string>}
  */
-function buildPlatformEnvOverlayFromAdminSecrets(adminObj) {
+function buildPlatformEnvOverlayFromAdminSecrets(adminObj, appName) {
   if (!adminObj || typeof adminObj !== 'object') return {};
   const platformPwd =
     adminObj.PLATFORM_ADMIN_PASSWORD ||
@@ -39,6 +40,9 @@ function buildPlatformEnvOverlayFromAdminSecrets(adminObj) {
   if (email) {
     overlay.ONBOARDING_ADMIN_EMAIL = email;
   }
+  if (appName === 'miso-controller' && adminObj.POSTGRES_PASSWORD) {
+    overlay.POSTGRES_ADMIN_PASSWORD = adminObj.POSTGRES_PASSWORD;
+  }
   return overlay;
 }
 
@@ -46,9 +50,10 @@ function buildPlatformEnvOverlayFromAdminSecrets(adminObj) {
  * Apply admin-secrets values over resolved app env (admin-secrets wins for platform keys).
  * @param {Object.<string, string>} envMap
  * @param {Object.<string, string>} adminObj
+ * @param {string} [appName]
  */
-function applyAdminSecretsPlatformOverlay(envMap, adminObj) {
-  const overlay = buildPlatformEnvOverlayFromAdminSecrets(adminObj);
+function applyAdminSecretsPlatformOverlay(envMap, adminObj, appName) {
+  const overlay = buildPlatformEnvOverlayFromAdminSecrets(adminObj, appName);
   for (const [key, value] of Object.entries(overlay)) {
     if (value !== undefined && value !== null && String(value).trim() !== '') {
       envMap[key] = String(value);