@aifabrix/builder 2.44.6 → 2.45.5

package/lib/utils/urls-local-registry.js

@@ -1,8 +1,14 @@
 /**
- * Primary `urls.local.yaml` under {@link module:lib/utils/paths.getAifabrixHome} (same as
- * `secrets.local.yaml`). When that file is missing, falls back to the config directory for migration.
+ * Primary `urls.local.yaml` beside `config.yaml` (same directory as {@link module:lib/utils/paths.getConfigDirForPaths}),
+ * aligned with `secrets.local.yaml`. When missing, {@link readUrlsLocalRegistrySync} may read a legacy
+ * file under {@link module:lib/utils/paths.getAifabrixHome} (older releases when `aifabrix-home` was `$HOME`).
  *
- * @fileoverview Read/write registry; scan each builder app folder for application.yaml
+ * Per-app keys (see {@link mergeDocIntoRegistry}): `appKey-port`, `appKey-pattern`, `appKey-containerPort`,
+ * optional `appKey-internalDockerUseOriginOnly` (boolean) — overrides `frontDoorRouting.internalDockerUseOriginOnly`
+ * for declarative `url://` resolution when set (e.g. Keycloak internal URL without `/auth` when true).
+ *
+ * @fileoverview Read/write registry; scan builder/package dirs in canonical order (plan 141 P3).
+ *   Duplicate `app.key`: last scan directory wins — no cross-root mtime merge or `AIFABRIX_BUILDER_DIR` ordering.
  * @author AI Fabrix Team
  * @version 1.0.0
  */
@@ -14,17 +20,18 @@ const path = require('path');
 const yaml = require('js-yaml');
 const { DECLARATIVE_URL_INFRA_DEFAULTS } = require('./infra-env-defaults');
 const pathsUtil = require('./paths');
+const { collectLatestApplicationYamlEntriesPerApp } = require('./urls-local-registry-scan');
 
 /**
- * @returns {string} Absolute path to urls.local.yaml (primary; under resolved AI Fabrix home)
+ * @returns {string} Absolute path to urls.local.yaml (beside config.yaml)
  */
 function getUrlsLocalYamlPath() {
-  return path.join(pathsUtil.getAifabrixHome(), 'urls.local.yaml');
+  return path.join(pathsUtil.getConfigDirForPaths(), 'urls.local.yaml');
 }
 
-/** @returns {string} Path beside config.yaml (migration / older layouts) */
-function getConfigDirUrlsLocalYamlPath() {
-  return path.join(pathsUtil.getConfigDirForPaths(), 'urls.local.yaml');
+/** @returns {string} Legacy primary path from older CLI (under resolved AI Fabrix home) */
+function getLegacyUrlsLocalYamlPathAtAifabrixHome() {
+  return path.join(pathsUtil.getAifabrixHome(), 'urls.local.yaml');
 }
 
 function loadRegistryYamlFile(filePath) {
@@ -44,9 +51,9 @@ function readUrlsLocalRegistrySync() {
   if (fsRealSync.existsSync(primary)) {
     return loadRegistryYamlFile(primary);
   }
-  const atConfig = getConfigDirUrlsLocalYamlPath();
-  if (path.resolve(atConfig) !== path.resolve(primary) && fsRealSync.existsSync(atConfig)) {
-    return loadRegistryYamlFile(atConfig);
+  const legacy = getLegacyUrlsLocalYamlPathAtAifabrixHome();
+  if (path.resolve(legacy) !== path.resolve(primary) && fsRealSync.existsSync(legacy)) {
+    return loadRegistryYamlFile(legacy);
   }
   return {};
 }
@@ -90,22 +97,6 @@ function writeMergedRegistry(merged) {
   return merged;
 }
 
-/**
- * @param {string} cfgPath
- * @returns {object|null}
- */
-function tryLoadApplicationYaml(cfgPath) {
-  if (!fsRealSync.existsSync(cfgPath)) {
-    return null;
-  }
-  try {
-    const doc = yaml.load(fsRealSync.readFileSync(cfgPath, 'utf8'));
-    return doc && typeof doc === 'object' ? doc : null;
-  } catch {
-    return null;
-  }
-}
-
 /**
  * @param {object} doc
  * @returns {number|null}
@@ -152,114 +143,193 @@ function mergeDocIntoRegistry(merged, doc, folderName) {
   } else {
     delete merged[ckey];
   }
+
+  mergeInternalDockerOriginOnlyRegistryKeyFromDoc(merged, appKey, doc);
 }
 
 /**
+ * When `application.yaml` explicitly sets `frontDoorRouting.internalDockerUseOriginOnly`, mirror it into
+ * `urls.local.yaml` on refresh. If the property is absent, leave any existing registry value unchanged
+ * (supports hand-edited `appKey-internalDockerUseOriginOnly` without a YAML field).
+ *
  * @param {Object} merged
- * @param {string} builderDir
+ * @param {string} appKey
+ * @param {object} doc
  */
-function mergeBuilderDirIntoRegistry(merged, builderDir) {
-  if (!builderDir || !fsRealSync.existsSync(builderDir) || !fsRealSync.statSync(builderDir).isDirectory()) {
+function mergeInternalDockerOriginOnlyRegistryKeyFromDoc(merged, appKey, doc) {
+  const key = `${appKey}-internalDockerUseOriginOnly`;
+  const fd = doc && doc.frontDoorRouting;
+  if (!fd || typeof fd !== 'object') {
     return;
   }
-  for (const ent of fsRealSync.readdirSync(builderDir, { withFileTypes: true })) {
-    if (!ent.isDirectory()) {
-      continue;
-    }
-    const doc = tryLoadApplicationYaml(path.join(builderDir, ent.name, 'application.yaml'));
-    if (!doc) {
-      continue;
-    }
-    mergeDocIntoRegistry(merged, doc, ent.name);
+  if (!Object.prototype.hasOwnProperty.call(fd, 'internalDockerUseOriginOnly')) {
+    return;
+  }
+  const v = fd.internalDockerUseOriginOnly;
+  if (v === true) {
+    merged[key] = true;
+  } else if (v === false) {
+    merged[key] = false;
+  } else {
+    delete merged[key];
   }
 }
 
 /**
- * True when getBuilderRoot() resolves to the same path as AIFABRIX_BUILDER_DIR (authoritative override).
- * @param {string|null} resolvedEffective
- * @param {string|null} envResolved
- * @returns {boolean}
+ * Append a directory to the scan list when it exists, is a directory, and is not already included (resolved).
+ * Later entries win duplicate `app.key` merges (see {@link collectLatestApplicationYamlEntriesPerApp}).
+ *
+ * @param {string[]} scanDirs
+ * @param {string|null|undefined} dirPath
+ * @returns {void}
  */
-function effectiveBuilderMatchesEnvVar(resolvedEffective, envResolved) {
-  return Boolean(envResolved && resolvedEffective && resolvedEffective === envResolved);
+function pushUniqueScanDir(scanDirs, dirPath) {
+  if (!dirPath || typeof dirPath !== 'string') {
+    return;
+  }
+  let resolved;
+  try {
+    resolved = path.resolve(dirPath);
+  } catch {
+    return;
+  }
+  try {
+    if (!fsRealSync.existsSync(resolved) || !fsRealSync.statSync(resolved).isDirectory()) {
+      return;
+    }
+  } catch {
+    return;
+  }
+  for (const existing of scanDirs) {
+    try {
+      if (path.resolve(existing) === resolved) {
+        return;
+      }
+    } catch {
+      // ignore
+    }
+  }
+  scanDirs.push(resolved);
 }
 
 /**
- * Builder dirs to scan in order; later merges overwrite registry keys from earlier dirs.
- * When `AIFABRIX_BUILDER_DIR` is set and differs from projectRoot/builder, env builder root is merged last.
- * Otherwise projectRoot/builder is merged last so explicit refresh roots override getBuilderRoot().
- *
- * @param {string} root - Resolved project root passed to refresh
- * @param {string|null} effectiveBuilderDir - pathsUtil.getBuilderRoot()
  * @returns {string[]}
  */
-function getOrderedBuilderDirsForRegistryScan(root, effectiveBuilderDir) {
-  const legacyBuilderDir = path.join(root, 'builder');
-  let resolvedLegacy;
-  let resolvedEffective;
+function getPackageBuilderLikeDirsForRegistryScan() {
+  const out = [];
   try {
-    resolvedLegacy = path.resolve(legacyBuilderDir);
-    resolvedEffective = effectiveBuilderDir ? path.resolve(effectiveBuilderDir) : null;
+    out.push(path.join(pathsUtil.getIntegrationBuilderBaseDir(), 'packages'));
   } catch {
-    return [legacyBuilderDir];
+    // ignore
+  }
+  try {
+    const pr = pathsUtil.getProjectRoot();
+    if (pr) {
+      out.push(path.join(pr, 'packages'));
+    }
+  } catch {
+    // ignore
   }
-  const envRaw = process.env.AIFABRIX_BUILDER_DIR && String(process.env.AIFABRIX_BUILDER_DIR).trim();
-  const envResolved = envRaw ? path.resolve(envRaw) : null;
-  // Only treat env as authoritative when getBuilderRoot() is actually that path. Otherwise a stray
-  // AIFABRIX_BUILDER_DIR on CI (or Jest mocking getBuilderRoot to a temp dir) must not force
-  // [legacy, effective] — that order lets the real checkout builder overwrite the mocked root last.
-  const effectiveMatchesEnvVar = effectiveBuilderMatchesEnvVar(resolvedEffective, envResolved);
+  return out;
+}
 
-  if (effectiveBuilderDir && resolvedEffective && resolvedEffective === resolvedLegacy) {
-    return [legacyBuilderDir];
+/**
+ * Canonical builder/package scan roots (low → high priority). Plan 141 P3: fixed order replaces
+ * mtime merge and `AIFABRIX_BUILDER_DIR` scan ordering; `findProjectRootFromCwd` builder is last when enabled.
+ *
+ * @param {string|null} root
+ * @param {string|null} effectiveBuilderDir
+ * @param {{ excludeCwdBuilderScan?: boolean }} opts
+ * @returns {string[]}
+ */
+function buildCanonicalRegistryScanDirs(root, effectiveBuilderDir, opts = {}) {
+  const scanDirs = [];
+  pushUniqueScanDir(scanDirs, pathsUtil.getSystemBuilderRoot());
+  pushUniqueScanDir(scanDirs, effectiveBuilderDir);
+  if (root) {
+    pushUniqueScanDir(scanDirs, path.join(root, 'builder'));
   }
-  if (effectiveMatchesEnvVar && effectiveBuilderDir && resolvedEffective && resolvedEffective !== resolvedLegacy) {
-    return [legacyBuilderDir, effectiveBuilderDir];
+  for (const pkg of getPackageBuilderLikeDirsForRegistryScan()) {
+    pushUniqueScanDir(scanDirs, pkg);
   }
-  if (effectiveBuilderDir && resolvedEffective && resolvedEffective !== resolvedLegacy) {
-    return [effectiveBuilderDir, legacyBuilderDir];
+  if (!opts.excludeCwdBuilderScan) {
+    let cwdRoot = null;
+    try {
+      cwdRoot = pathsUtil.findProjectRootFromCwd();
+    } catch {
+      cwdRoot = null;
+    }
+    if (cwdRoot && typeof cwdRoot === 'string') {
+      pushUniqueScanDir(scanDirs, path.join(cwdRoot, 'builder'));
+    }
   }
-  return [legacyBuilderDir];
+  return scanDirs;
 }
 
 /**
  * Merge scan results into registry (does not remove stale keys).
  * @param {string|null} projectRoot - getProjectRoot() or null (same semantics as projectRoot || getProjectRoot())
+ * @param {{ excludeCwdBuilderScan?: boolean }} [opts] - When `excludeCwdBuilderScan` is true, omit cwd
+ *   checkout `builder/` (tests / `ctx.projectRoot` isolation — avoids merging ambient repo `builder/`).
  * @returns {Object} Updated registry
  */
-function refreshUrlsLocalRegistryFromBuilder(projectRoot) {
+function refreshUrlsLocalRegistryFromBuilder(projectRoot, opts) {
+  const o = opts && typeof opts === 'object' ? opts : {};
   const root = projectRoot || pathsUtil.getProjectRoot();
   const merged = { ...readUrlsLocalRegistrySync() };
   if (!root) {
     return writeMergedRegistry(merged);
   }
-  // Published npm tarball omits builder/ under the package root (.npmignore). Global installs must
-  // still refresh from the real builder tree (AIFABRIX_BUILDER_DIR or integration base + builder).
+  // Published npm tarball omits builder/ under the package root (.npmignore). Global installs still
+  // resolve materialized apps via getBuilderRoot() (same parent as getSystemBuilderRoot when aligned).
   let effectiveBuilderDir = null;
   try {
     effectiveBuilderDir = pathsUtil.getBuilderRoot();
   } catch {
     effectiveBuilderDir = null;
   }
-  let builderDirs = getOrderedBuilderDirsForRegistryScan(root, effectiveBuilderDir);
-  try {
-    const sysRoot = pathsUtil.getSystemBuilderRoot();
-    const resolvedSys = path.resolve(sysRoot);
-    if (fsRealSync.existsSync(sysRoot)) {
-      const resolvedList = builderDirs.map((d) => path.resolve(d));
-      if (!resolvedList.includes(resolvedSys)) {
-        builderDirs = [sysRoot, ...builderDirs];
-      }
-    }
-  } catch {
-    // ignore
-  }
-  for (const builderDir of builderDirs) {
-    mergeBuilderDirIntoRegistry(merged, builderDir);
+  const scanDirs = buildCanonicalRegistryScanDirs(root, effectiveBuilderDir, o);
+  const entries = collectLatestApplicationYamlEntriesPerApp(scanDirs);
+  for (const { folderName, doc } of entries) {
+    mergeDocIntoRegistry(merged, doc, folderName);
   }
   return writeMergedRegistry(merged);
 }
 
+const REGISTRY_BOOL_TRUE = new Set([true, 'true', 'yes', 'on', 1, '1']);
+const REGISTRY_BOOL_FALSE = new Set([false, 'false', 'no', 'off', 0, '0']);
+
+/**
+ * @param {unknown} raw
+ * @returns {boolean|undefined}
+ */
+function coerceRegistryBool(raw) {
+  if (REGISTRY_BOOL_TRUE.has(raw)) {
+    return true;
+  }
+  if (REGISTRY_BOOL_FALSE.has(raw)) {
+    return false;
+  }
+  return undefined;
+}
+
+/**
+ * Optional `appKey-internalDockerUseOriginOnly` in `urls.local.yaml` (boolean or common string coercions).
+ * When set, declarative URL resolution uses this value instead of (or in addition to) `application.yaml`.
+ *
+ * @param {string} appKey
+ * @param {Object|null|undefined} registry
+ * @returns {boolean|undefined} undefined when the key is absent or not coercible to boolean
+ */
+function readRegistryInternalDockerUseOriginOnly(appKey, registry) {
+  const r = registry && typeof registry === 'object' ? registry : {};
+  const key = `${appKey}-internalDockerUseOriginOnly`;
+  if (!Object.prototype.hasOwnProperty.call(r, key)) {
+    return undefined;
+  }
+  return coerceRegistryBool(r[key]);
+}
+
 /**
  * @param {string} appKey
  * @param {Object} registry
@@ -293,5 +363,6 @@ module.exports = {
   writeUrlsLocalRegistrySync,
   refreshUrlsLocalRegistryFromBuilder,
   normalizePatternForUrl,
-  getRegistryEntryForApp
+  getRegistryEntryForApp,
+  readRegistryInternalDockerUseOriginOnly
 };

package/lib/utils/validation-poll-ui.js

@@ -23,10 +23,12 @@ function shouldUseValidationPollSpinner() {
  * @param {number} deadlineMs - Wall-clock deadline (Date.now() + remaining budget)
  * @returns {string}
  */
-function buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs) {
+function buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs, subject) {
   const remainingSec = Math.max(0, Math.ceil((deadlineMs - Date.now()) / 1000));
+  const label =
+    subject && String(subject).trim() ? String(subject).trim() : 'validation run';
   if (!envelope || typeof envelope !== 'object') {
-    return `Waiting for validation run… starting (budget ~${remainingSec}s)`;
+    return `Waiting for ${label}… starting (budget ~${remainingSec}s)`;
   }
   const c =
     envelope.reportCompleteness !== undefined && envelope.reportCompleteness !== null
@@ -34,26 +36,29 @@ function buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs) {
       : '?';
   const st =
     envelope.status !== undefined && envelope.status !== null ? String(envelope.status) : '?';
-  return `Waiting for validation run… completeness=${c} status=${st} (poll ${attemptIndex + 1} · ~${remainingSec}s left)`;
+  return `Waiting for ${label}… completeness=${c} status=${st} (poll ${attemptIndex + 1} · ~${remainingSec}s left)`;
 }
 
 const NON_TTY_THROTTLE_MS = 5000;
 
 /**
  * @param {number} deadlineMs - Absolute deadline for poll budget display
+ * @param {Object} [opts]
+ * @param {string} [opts.subject] - Datasource key or label shown in poll text
  * @returns {{ usesSpinner: boolean, onPollProgress: Function, finish: () => void }}
  */
-function createValidationPollHandlers(deadlineMs) {
+function createValidationPollHandlers(deadlineMs, opts = {}) {
+  const subject = opts.subject;
   if (shouldUseValidationPollSpinner()) {
     const ora = require('ora');
     const spinner = ora({
-      text: buildValidationPollSpinnerText(null, 0, deadlineMs),
+      text: buildValidationPollSpinnerText(null, 0, deadlineMs, subject),
       spinner: 'dots'
     }).start();
     return {
       usesSpinner: true,
       onPollProgress: (envelope, attemptIndex, _meta) => {
-        spinner.text = buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs);
+        spinner.text = buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs, subject);
       },
       finish: () => {
         spinner.stop();
@@ -68,7 +73,9 @@ function createValidationPollHandlers(deadlineMs) {
       const now = Date.now();
       if (now - lastNonTtyLogAt < NON_TTY_THROTTLE_MS) return;
       lastNonTtyLogAt = now;
-      logger.log(chalk.gray(buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs)));
+      logger.log(
+        chalk.gray(buildValidationPollSpinnerText(envelope, attemptIndex, deadlineMs, subject))
+      );
     },
     finish: () => {}
   };

package/lib/validation/wizard-config-validator.js

@@ -164,36 +164,73 @@ function validateWizardConfigSchema(config) {
   };
 }
 
+/**
+ * Candidate bases for relative openapi-file paths (first existing wins).
+ * @param {string} configPath - Path to wizard.yaml
+ * @returns {string[]}
+ */
+function wizardOpenApiFilePathCandidates(filePath, configPath) {
+  const raw = String(filePath || '').trim();
+  if (!raw) {
+    return [];
+  }
+  if (path.isAbsolute(raw)) {
+    return [path.resolve(raw)];
+  }
+  const configDir = path.dirname(path.resolve(configPath));
+  return [...new Set([
+    path.resolve(process.cwd(), raw),
+    path.resolve(configDir, raw)
+  ])];
+}
+
+/**
+ * Resolve openapi-file path for wizard config (absolute path).
+ * Relative paths: process.cwd() first, then wizard.yaml directory.
+ * @param {string} filePath
+ * @param {string} configPath
+ * @returns {Promise<string>}
+ */
+async function resolveWizardOpenApiFilePath(filePath, configPath) {
+  const candidates = wizardOpenApiFilePathCandidates(filePath, configPath);
+  if (candidates.length === 0) {
+    return '';
+  }
+  for (const candidate of candidates) {
+    try {
+      await fs.access(candidate);
+      return candidate;
+    } catch (error) {
+      if (error.code !== 'ENOENT') {
+        throw error;
+      }
+    }
+  }
+  return candidates[0];
+}
+
 /**
  * Validate file path exists (for openapi-file source type)
  * @function validateFilePath
  * @param {string} filePath - Path to validate
- * @param {string} basePath - Base path for relative paths
- * @returns {Promise<Object>} Validation result with valid flag and errors
+ * @param {string} configPath - Path to wizard.yaml (relative paths resolve from cwd, then config dir)
+ * @returns {Promise<Object>} Validation result with valid flag, errors, and resolvedPath
  */
-async function validateFilePath(filePath, basePath) {
-  const baseDir = path.resolve(basePath);
-  const resolvedPath = path.isAbsolute(filePath)
-    ? path.resolve(filePath)
-    : path.resolve(baseDir, filePath);
-  if (!path.isAbsolute(filePath)) {
-    const baseWithSep = baseDir.endsWith(path.sep) ? baseDir : `${baseDir}${path.sep}`;
-    if (!resolvedPath.startsWith(baseWithSep)) {
-      return {
-        valid: false,
-        errors: [`OpenAPI file path must be within: ${baseDir}`]
-      };
-    }
+async function validateFilePath(filePath, configPath) {
+  const resolvedPath = await resolveWizardOpenApiFilePath(filePath, configPath);
+  if (!resolvedPath) {
+    return { valid: false, errors: ['OpenAPI file path is required'], resolvedPath: '' };
   }
   try {
     await fs.access(resolvedPath);
   } catch (error) {
     return {
       valid: false,
-      errors: [`OpenAPI file not found: ${resolvedPath}`]
+      errors: [`OpenAPI file not found: ${resolvedPath}`],
+      resolvedPath
     };
   }
-  return { valid: true, errors: [] };
+  return { valid: true, errors: [], resolvedPath };
 }
 
 /**
@@ -229,10 +266,11 @@ function validateSchemaAndResolveEnvVars(config, shouldResolveEnvVars) {
 async function performSemanticValidations(config, configPath, validateFilePaths) {
   const errors = [];
   if (validateFilePaths && config.source?.type === 'openapi-file' && config.source?.filePath) {
-    const basePath = path.dirname(path.resolve(configPath));
-    const fileResult = await validateFilePath(config.source.filePath, basePath);
+    const fileResult = await validateFilePath(config.source.filePath, configPath);
     if (!fileResult.valid) {
       errors.push(...fileResult.errors);
+    } else if (fileResult.resolvedPath) {
+      config.source.filePath = fileResult.resolvedPath;
     }
   }
   if (config.mode === 'add-datasource' && !config.systemIdOrKey) {
@@ -296,6 +334,7 @@ module.exports = {
   wizardConfigExists,
   validateWizardConfig,
   validateWizardConfigSchema,
+  resolveWizardOpenApiFilePath,
   resolveEnvVar,
   resolveEnvVarsInObject,
   formatValidationErrors,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.44.6",
+  "version": "2.45.5",
   "description": "AI Fabrix Local Fabric & Deployment SDK",
   "main": "lib/index.js",
   "bin": {
@@ -36,6 +36,8 @@
     "precommit": "npm run lint:fix && npm run test",
     "install:local": "node scripts/install-local.js && which aifabrix && which af",
     "uninstall:local": "node scripts/install-local.js uninstall && which aifabrix && which af",
+    "install:global": "npm install -g . --force && which aifabrix && which af && aifabrix --version",
+    "uninstall:global": "npm uninstall -g @aifabrix/builder",
     "diagnose:cli": "node scripts/diagnose-cli.js",
     "check:schema-sync": "node scripts/check-datasource-test-run-schema-sync.js",
     "check:flags": "jest tests/lib/schema/flag-map-validation-run.test.js --runInBand --config jest.config.default.js"

package/templates/applications/dataplane/application.yaml

@@ -26,6 +26,8 @@ environmentScopedResources: true
 frontDoorRouting:
   pattern: /data/*
   enabled: true
+  # Docker url://internal full URLs: http://dataplane:PORT only (ingress /data is not on in-container routes).
+  internalDockerUseOriginOnly: false
   host: ${DEV_USERNAME}.${REMOTE_HOST}
   tls: ${TLS_ENABLED}
 
@@ -63,6 +65,8 @@ build:
   envOutputPath: ../../.env       # Copy to repo root for local dev
   language: python                # Runtime language for template selection (typescript or python)
   reloadStart: uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001} --reload  # PORT set from port above at run time; default 3001 must match port
+  # Pulled-image local compose (no bind-mount): drives `command` in generated docker-compose. Override for non-standard images (e.g. stub ACR tags).
+  imageRun: exec python -m uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001}
 
 # =============================================================================
 # Portal Input Configuration (Deployment Wizard)

package/templates/applications/dataplane/env.template

@@ -21,7 +21,7 @@ LOG_FORMAT=json
 # Production with persistent logs: use /mnt/data/logs/app.log and mount a volume at /mnt/data.
 LOG_FILE_PATH=/mnt/data/logs/app.log
 # If true, run without Redis/Celery (single process)
-LOCAL_MODE=false
+LOCAL_MODE=true
 
 # When API_KEY is set, a matching Bearer token bypasses OAuth2 validation
 # Same kv:// as miso-controller API_KEY so pipeline Bearer bypass uses one secrets.local entry
@@ -30,6 +30,9 @@ API_KEY=kv://miso-controller-secrets-apiKeyVault
 # API Configuration
 API_V1_STR=/api/v1
 VERSION=1.9.5
+# Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
+# MIN_BUILDER_CLI_VERSION=2.45.0
+MIN_BUILDER_CLI_VERSION=2.45.0
 # Base URL for the dataplane web server (used for default OAuth2 callback URL when redirectUri is omitted)
 # url:// resolves after kv://; includes front-door path from application.yaml (e.g. /data)
 DATAPLANE_WEB_SERVER_URL=url://public
@@ -165,6 +168,15 @@ RBAC_EXPLAIN_MODE_ENABLED=false
 # validates only (no second DB write). Default false.
 AUDIT_ASYNC_SHADOW_ENQUEUE=false
 
+# Policy Library management HTTP API gate. When false (default), management
+# routes are not registered (404): /api/v1/policies/*, /api/v1/external/{key}/policies,
+# /api/v1/users/{id}/policies, /api/v1/groups/{id}/policies, IDE /validate/policy and
+# /simulate/policy-impact/{datasourceKey}. ABAC runtime evaluation is unaffected.
+# Set to true for local dev when iterating on policy CRUD APIs.
+# Policy Library management HTTP APIs (default false → routes not registered, 404).
+# Set true for local dev policy CRUD; pair with VITE_POLICY_MANAGEMENT_ENABLED=true in app-ui.
+POLICY_MANAGEMENT_API_ENABLED=false
+
 # =============================================================================
 # OBSERVABILITY CONFIGURATION
 # =============================================================================

package/templates/applications/dataplane/rbac.yaml

@@ -280,6 +280,10 @@ permissions:
   - name: "record:search"
     roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-deployment-admin", "aifabrix-compliance-admin", "aifabrix-developer", "aifabrix-observer"]
     description: "Search records"
+
+  - name: "governance:evaluate"
+    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-developer"]
+    description: "Run governance scenario acceptance (subject impersonation for ABAC proof)"
   
   # IDE simulation operations
   - name: "dataplane:abac-simulate"

package/templates/applications/miso-controller/application.yaml

@@ -23,6 +23,8 @@ port: 3000
 frontDoorRouting:
   pattern: /miso/*
   enabled: true
+  # Docker url://internal full URLs: http://miso-controller:PORT only (ingress /miso is not on in-container routes).
+  internalDockerUseOriginOnly: false
   host: ${DEV_USERNAME}.${REMOTE_HOST}
   tls: ${TLS_ENABLED}