@aifabrix/builder 2.50.0 → 2.51.0

package/lib/utils/remote-dev-auth.js

@@ -24,6 +24,17 @@ function expandConfiguredSecretsTilde(filePath) {
   return filePath;
 }
 
+/** One auto-renew attempt per CLI process (shared by concurrent getRemoteDevAuth callers). */
+let autoRenewPromise = null;
+
+/**
+ * Reset process-level auto-renew gate (tests only).
+ * @returns {void}
+ */
+function resetDevCertAutoRenewGateForTests() {
+  autoRenewPromise = null;
+}
+
 /**
  * Single API object so resolveSharedSecretsEndpoint and callers share one getRemoteDevAuth
  * (Jest spies and partial mocks work reliably).
@@ -39,12 +50,11 @@ const remoteDevAuth = {
   },
 
   /**
-   * Get Builder Server URL, client cert PEM, and optional dev root CA when remote is configured; otherwise null.
-   * serverCaPem comes from ca.pem (saved at dev init); required for Node TLS to private-CA servers.
-   * Use for cert-authenticated dev API calls (settings, users, ssh-keys, secrets).
+   * Read remote server URL + client cert from disk without auto-renew.
+   * Use when renewing (avoids recursion) or when only a local presence check is needed.
    * @returns {Promise<{ serverUrl: string, clientCertPem: string, serverCaPem: string|null }|null>}
    */
-  async getRemoteDevAuth() {
+  async readRemoteDevAuth() {
     const serverUrl = await config.getRemoteServer();
     if (!serverUrl) return null;
     const devId = await config.getDeveloperId();
@@ -55,6 +65,30 @@ const remoteDevAuth = {
     return { serverUrl, clientCertPem, serverCaPem };
   },
 
+  /**
+   * Get Builder Server URL, client cert PEM, and optional dev root CA when remote is configured; otherwise null.
+   * When the client cert is still valid but expires within 14 days, renews it once per process before returning.
+   * serverCaPem comes from ca.pem (saved at dev init); required for Node TLS to private-CA servers.
+   * Use for cert-authenticated dev API calls (settings, users, ssh-keys, secrets).
+   * @returns {Promise<{ serverUrl: string, clientCertPem: string, serverCaPem: string|null }|null>}
+   */
+  async getRemoteDevAuth() {
+    const existing = await remoteDevAuth.readRemoteDevAuth();
+    if (!existing) return null;
+    if (!autoRenewPromise) {
+      autoRenewPromise = (async() => {
+        const { ensureDevCertFreshIfDue } = require('../commands/dev-refresh');
+        return ensureDevCertFreshIfDue({ quiet: false });
+      })();
+    }
+    try {
+      await autoRenewPromise;
+    } catch {
+      // ensureDevCertFreshIfDue already handles failures; keep using current cert
+    }
+    return remoteDevAuth.readRemoteDevAuth();
+  },
+
   /**
    * Resolve where shared secrets read/write should go. After dev init, config may still hold a
    * server-side filesystem path from GET /api/dev/settings (not an http URL) if merge did not rewrite it.
@@ -148,3 +182,4 @@ function normalizeSharedSecretsFilePath(configured) {
 }
 
 module.exports = remoteDevAuth;
+module.exports.resetDevCertAutoRenewGateForTests = resetDevCertAutoRenewGateForTests;

package/lib/utils/resolve-docker-image-ref.js

@@ -12,6 +12,32 @@
 'use strict';
 
 const { parseImageOverride } = require('./parse-image-ref');
+const DOCKER_REPOSITORY_RE = /^[a-z0-9][a-z0-9._/-]*$/i;
+const DOCKER_TAG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+
+/**
+ * @param {string} repository
+ * @returns {string}
+ */
+function assertSafeRepository(repository) {
+  const trimmed = String(repository || '').trim();
+  if (!trimmed || !DOCKER_REPOSITORY_RE.test(trimmed)) {
+    throw new Error(`Invalid Docker repository path: ${repository}`);
+  }
+  return trimmed;
+}
+
+/**
+ * @param {string} tag
+ * @returns {string}
+ */
+function assertSafeTag(tag) {
+  const trimmed = String(tag || '').trim();
+  if (!trimmed || !DOCKER_TAG_RE.test(trimmed)) {
+    throw new Error(`Invalid Docker image tag: ${tag}`);
+  }
+  return trimmed;
+}
 
 /**
  * Repository path without host (same rules as compose-generator getImageName).
@@ -59,7 +85,11 @@ function normalizeDockerRegistryPrefix(registry) {
   if (!t) {
     return '';
   }
-  return t.replace(/\/+$/, '');
+  let end = t.length;
+  while (end > 0 && t[end - 1] === '/') {
+    end -= 1;
+  }
+  return t.slice(0, end);
 }
 
 /**
@@ -81,18 +111,18 @@ function resolveDockerImageRef(appName, appConfig, runOptions = {}) {
   if (opts.image) {
     const parsed = parseImageOverride(opts.image);
     return {
-      imageName: parsed ? parsed.name : getRepositoryPathFromConfig(appConfig, appName),
-      imageTag: parsed ? parsed.tag : tagFromOpts || imageTagFromConfig(appConfig)
+      imageName: assertSafeRepository(parsed ? parsed.name : getRepositoryPathFromConfig(appConfig, appName)),
+      imageTag: assertSafeTag(parsed ? parsed.tag : tagFromOpts || imageTagFromConfig(appConfig))
     };
   }
 
-  const baseRepo = getRepositoryPathFromConfig(appConfig, appName);
-  const imageTag = tagFromOpts || imageTagFromConfig(appConfig);
+  const baseRepo = assertSafeRepository(getRepositoryPathFromConfig(appConfig, appName));
+  const imageTag = assertSafeTag(tagFromOpts || imageTagFromConfig(appConfig));
   const prefix =
     normalizeDockerRegistryPrefix(opts.registry) ||
     normalizeDockerRegistryPrefix(appConfig?.image?.registry ?? '');
   if (prefix) {
-    return { imageName: `${prefix}/${baseRepo}`, imageTag };
+    return { imageName: assertSafeRepository(`${prefix}/${baseRepo}`), imageTag };
   }
   return { imageName: baseRepo, imageTag };
 }

package/lib/utils/token-manager.js

@@ -409,13 +409,29 @@ function applyLabDataplaneApiKeyBearer(authConfig) {
 }
 
 function requireBearerForDataplanePipeline(authConfig) {
+  if (!authConfig || typeof authConfig !== 'object') {
+    return;
+  }
+
   if (authConfig.type === 'client-token' && authConfig.token) {
     return;
   }
 
+  // Token-forward (builder-api / bearerForward): never substitute lab API_KEY for the caller JWT.
+  if (authConfig.preserveBearer && authConfig.token) {
+    return;
+  }
+
   const preferAppClientToken =
     String(process.env.AIFABRIX_DEPLOYMENT_AUTH || '').toLowerCase() === 'client-credentials';
 
+  const existing = authConfig.token ? String(authConfig.token) : '';
+  const looksLikeJwt = existing.split('.').length === 3 && existing.length > 80;
+  // Enterprise path: keep a real OAuth JWT; do not overwrite with process.env.API_KEY.
+  if (looksLikeJwt) {
+    return;
+  }
+
   if (!preferAppClientToken && process.env.API_KEY) {
     const apiKey = String(process.env.API_KEY);
     if (authConfig.type === 'bearer' && authConfig.token !== apiKey) {

package/lib/utils/upload-sync-options.js

@@ -10,9 +10,10 @@
 
 /**
  * @param {Object} [options] - CLI options from test / sync callers
- * @returns {{ minimal: true, verbose: boolean, silentResolve: true, syncMode: true, force?: true }}
+ * @returns {{ minimal: true, verbose: boolean, silentResolve: true, syncMode: true, force?: true, authConfig?: Object, dataplaneUrl?: string, environment?: string }}
  */
 function buildMinimalUploadSyncOptions(options = {}) {
+  const deployPreflight = options.uploadContext === 'deploy-preflight';
   const out = {
     minimal: true,
     // CLI -v on verify-* / test-* is for run output, not preflight upload banners.
@@ -20,14 +21,27 @@ function buildMinimalUploadSyncOptions(options = {}) {
     silentResolve: true,
     syncMode: true,
     skipDataSync: true,
-    suppressPipelineSpinner: options.suppressPipelineSpinner === true
+    suppressPipelineSpinner:
+      options.suppressPipelineSpinner === true || deployPreflight === true
   };
   if (options.force === true) {
     out.force = true;
   }
-  if (options.suppressSummary === true) {
+  if (options.suppressSummary === true || deployPreflight === true) {
     out.suppressSummary = true;
   }
+  if (deployPreflight) {
+    out.uploadContext = 'deploy-preflight';
+  }
+  // Builder-api / programmatic callers: keep request Bearer — do not fall back to
+  // getDeploymentAuth against a stale mount AIFABRIX_CONFIG device token.
+  if (options.authConfig && options.dataplaneUrl) {
+    out.authConfig = options.authConfig;
+    out.dataplaneUrl = options.dataplaneUrl;
+    if (options.environment) {
+      out.environment = options.environment;
+    }
+  }
   return out;
 }
 

package/lib/validation/openapi-contract-surface-validator.js

@@ -307,6 +307,10 @@ function resolveCachedVendorSpec(documentKey, prefix, appPath, systemKey, vendor
 function validateServiceContractVendorOpenApi(ds, prefix, appPath, systemKey, vendorCache) {
   const errors = [];
   const warnings = [];
+  // Python/CIP handlers without a vendor OpenAPI binding are valid serviceContracts.
+  if (!hasVendorOpenapiOnManifest(ds)) {
+    return { errors, warnings };
+  }
   const documentKey =
     typeof ds.openapi?.documentKey === 'string' ? ds.openapi.documentKey.trim() : '';
   if (!documentKey) {

package/lib/validation/validator.js

@@ -223,10 +223,11 @@ async function validateRbac(appName, options = {}) {
     throw new Error(`Invalid syntax in ${basename}: ${error.message}`);
   }
 
-  const errors = [
-    ...validateRoles(rbac.roles),
-    ...validatePermissions(rbac.permissions)
-  ];
+  const [roleErrors, permissionErrors] = await Promise.all([
+    Promise.resolve(validateRoles(rbac.roles)),
+    Promise.resolve(validatePermissions(rbac.permissions))
+  ]);
+  const errors = [...roleErrors, ...permissionErrors];
 
   return {
     valid: errors.length === 0,
@@ -275,7 +276,7 @@ async function validateEnvTemplate(appName, options = {}) {
       if (!trimmed.includes('=')) {
         errors.push(`Line ${index + 1}: Invalid environment variable format (missing =)`);
       } else {
-        const [key, _value] = trimmed.split('=', 2);
+        const [key] = trimmed.split('=', 2);
         // Trim key to handle whitespace issues
         // Empty values are allowed (_value can be empty string or undefined)
         const trimmedKey = key ? key.trim() : '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.50.0",
+  "version": "2.51.0",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {
@@ -85,36 +85,58 @@
     "cache": true,
     "temp-dir": ".nyc_output"
   },
+  "overrides": {
+    "@babel/core": "^7.29.7",
+    "@babel/plugin-transform-modules-systemjs": "^7.29.7",
+    "fast-uri": "^4.1.0",
+    "flatted": "^3.4.2",
+    "follow-redirects": "^1.16.0",
+    "form-data": "^4.0.6",
+    "lodash": "^4.18.1",
+    "minimatch": "^10.2.5",
+    "picomatch": "^4.0.5",
+    "qs": "^6.15.3"
+  },
   "pnpm": {
     "overrides": {
-      "@bcoe/v8-coverage": "^1.0.2"
+      "@bcoe/v8-coverage": "^1.0.2",
+      "@babel/core": "^7.29.7",
+      "@babel/plugin-transform-modules-systemjs": "^7.29.7",
+      "fast-uri": "^4.1.0",
+      "flatted": "^3.4.2",
+      "follow-redirects": "^1.16.0",
+      "form-data": "^4.0.6",
+      "lodash": "^4.18.1",
+      "minimatch": "^10.2.5",
+      "picomatch": "^4.0.5",
+      "qs": "^6.15.3"
     }
   },
   "dependencies": {
     "@aifabrix/miso-client": "^4.19.0",
-    "ajv": "^8.12.0",
+    "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
-    "axios": "^1.6.0",
+    "axios": "^1.18.1",
     "chalk": "^4.1.2",
     "commander": "^11.1.0",
-    "handlebars": "^4.7.8",
+    "handlebars": "^4.7.9",
     "inquirer": "^8.2.5",
     "inquirer-autocomplete-prompt": "^2.0.0",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.3.0",
     "ora": "^5.4.1",
-    "yaml": "^2.4.0"
+    "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@babel/plugin-syntax-optional-chaining": "^7.8.3",
-    "@babel/preset-env": "^7.29.0",
+    "@babel/preset-env": "^7.29.7",
     "@bcoe/v8-coverage": "^1.0.2",
-    "@nestjs/common": "^10.4.15",
-    "@nestjs/core": "^10.4.15",
-    "@nestjs/platform-express": "^10.4.15",
+    "@nestjs/common": "^11.1.28",
+    "@nestjs/core": "^11.1.28",
+    "@nestjs/platform-express": "^11.1.28",
     "@types/node": "^20.10.0",
     "cross-env": "^10.1.0",
     "eslint": "^8.55.0",
-    "jest": "^30.2.0",
+    "jest": "^30.4.2",
     "markdownlint-cli": "^0.49.0",
     "nyc": "^18.0.0",
     "reflect-metadata": "^0.2.2",

package/scripts/export-builder-api-evidence.js

@@ -18,8 +18,8 @@ const DEFAULT_OUT = path.join(
   '..',
   'aifabrix-dataplane',
   'integration',
-  'aifabrix-builder-api',
-  'aifabrix-builder-api-evidence.json'
+  'builder-api',
+  'builder-api-evidence.json'
 );
 
 const EVIDENCE_PATTERNS = path.join(REPO_ROOT, 'docs', 'builder-help', 'evidence-patterns.json');

package/scripts/lib/plan-actor.js

@@ -80,9 +80,9 @@ function loadActor() {
 function saveActor(displayName, email) {
   const actorPath = resolveActorPath();
   fs.mkdirSync(path.dirname(actorPath), { recursive: true });
-  const lines = [`displayName: "${displayName.replace(/"/g, '\\"')}"`];
+  const lines = [`displayName: ${JSON.stringify(displayName)}`];
   if (email) {
-    lines.push(`email: "${email.replace(/"/g, '\\"')}"`);
+    lines.push(`email: ${JSON.stringify(email)}`);
   }
   fs.writeFileSync(actorPath, `${lines.join('\n')}\n`, 'utf8');
   return actorPath;

package/scripts/lib/plan-meta.js

@@ -87,7 +87,7 @@ function patchPlanMeta(planPath, key, value) {
     die('Plan has no frontmatter to patch');
   }
   let yaml = match[1];
-  const quoted = `"${String(value).replace(/"/g, '\\"')}"`;
+  const quoted = JSON.stringify(String(value));
   const re = new RegExp(`^${key}:.*$`, 'm');
   if (re.test(yaml)) {
     yaml = yaml.replace(re, `${key}: ${quoted}`);

package/scripts/lib/plan-parse.js

@@ -111,7 +111,7 @@ function loadPlanFile(planPath) {
   if (!match) {
     return null;
   }
-  const meta = parseSimpleYaml(match[1]) || {};
+  const meta = parseSimpleYaml(match[1]);
   if (Array.isArray(meta.todos)) {
     meta.todos = normalizeTodos(meta.todos);
   }

package/scripts/lib/plan-prevalidate-gates.js

@@ -17,6 +17,17 @@ const { loadPlanFile, hasSurface } = require('./plan-parse');
 const REPO_ROOT = path.resolve(__dirname, '../..');
 const PREVALIDATE_REPORT_DIR = path.join(REPO_ROOT, 'temp/plan-prevalidation');
 
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function escapeMarkdownCell(value) {
+  return String(value ?? '')
+    .replace(/\r?\n+/g, ' ')
+    .replace(/\|/g, '\\|')
+    .trim();
+}
+
 /**
  * @typedef {{ label: string, status: 'pass' | 'fail' | 'warn' | 'skip', detail?: string }} GateResult
  */
@@ -299,7 +310,7 @@ function buildPrevalidateReport(params) {
     '| --- | --- | --- |'
   ];
   for (const g of gates) {
-    lines.push(`| ${g.label} | ${g.status} | ${(g.detail || '').replace(/\|/g, '\\|')} |`);
+    lines.push(`| ${escapeMarkdownCell(g.label)} | ${escapeMarkdownCell(g.status)} | ${escapeMarkdownCell(g.detail || '')} |`);
   }
   return `${lines.join('\n')}\n`;
 }

package/scripts/lib/plan-run-report.js

@@ -8,6 +8,17 @@ const fs = require('fs');
 const path = require('path');
 const { REPORT_DIR } = require('./plan-config');
 
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function escapeMarkdownCell(value) {
+  return String(value ?? '')
+    .replace(/\r?\n+/g, ' ')
+    .replace(/\|/g, '\\|')
+    .trim();
+}
+
 /**
  * @param {object} params
  * @returns {string}
@@ -44,13 +55,13 @@ function buildSummaryMarkdown(params) {
 
   for (const g of gates) {
     const icon = g.status === 'pass' ? 'pass' : g.status === 'warn' ? 'warn' : 'FAIL';
-    lines.push(`| ${g.label} | ${icon} | ${(g.detail || '').replace(/\|/g, '\\|')} |`);
+    lines.push(`| ${escapeMarkdownCell(g.label)} | ${icon} | ${escapeMarkdownCell(g.detail || '')} |`);
   }
 
   lines.push('', '## Todos', '', '| ID | Status | Content |', '| --- | --- | --- |');
   for (const t of todos) {
     lines.push(
-      `| ${t.id} | ${t.status} | ${String(t.content).replace(/\|/g, '\\|').slice(0, 100)} |`
+      `| ${escapeMarkdownCell(t.id)} | ${escapeMarkdownCell(t.status)} | ${escapeMarkdownCell(t.content).slice(0, 100)} |`
     );
   }
 

package/scripts/pnpm/lib/resolve-aifabrix-bin.mjs

@@ -10,8 +10,8 @@ const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../
 const MIN_AIFABRIX_VERSION = '2.45.0';
 
 /**
- * @param {string} version
- * @returns {number[]}
+ * @param {string} version - Semver string.
+ * @returns {number[]} Parsed numeric semver segments.
  */
 function parseSemver(version) {
   return String(version)
@@ -21,9 +21,9 @@ function parseSemver(version) {
 }
 
 /**
- * @param {string} left
- * @param {string} right
- * @returns {number}
+ * @param {string} left - Left semver.
+ * @param {string} right - Right semver.
+ * @returns {number} Compare result (1, 0, -1).
  */
 function compareSemver(left, right) {
   const a = parseSemver(left);
@@ -38,8 +38,8 @@ function compareSemver(left, right) {
 }
 
 /**
- * @param {string} bin
- * @returns {string|null}
+ * @param {string} bin - Candidate executable path.
+ * @returns {string|null} CLI version output or null.
  */
 function readAifabrixVersion(bin) {
   try {
@@ -50,7 +50,7 @@ function readAifabrixVersion(bin) {
 }
 
 /**
- * @returns {string[]}
+ * @returns {string[]} Candidate aifabrix binary paths.
  */
 function collectAifabrixCandidates() {
   const candidates = [];
@@ -85,14 +85,14 @@ function collectAifabrixCandidates() {
 /**
  * Prefer this repo's bin/aifabrix.js when developing the builder package locally.
  *
- * @returns {string}
+ * @returns {string} Resolved aifabrix executable path.
  */
 export function resolveAifabrixBin() {
   let bestBin = null;
   let bestVersion = null;
 
   for (const candidate of collectAifabrixCandidates()) {
-    let resolved = candidate;
+    let resolved;
     try {
       if (fs.existsSync(candidate)) {
         resolved = fs.realpathSync(candidate);

package/templates/applications/dataplane/application.yaml

@@ -5,8 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python  # Explicitly specify Python language
-  version: 2.0.0
-
+  version: 2.0.10
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build dataplane -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
@@ -69,7 +68,7 @@ build:
   # Pulled-image local compose (no bind-mount): drives `command` in generated docker-compose. Override for non-standard images (e.g. stub ACR tags).
   imageRun: exec python -m uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001}
   # Image policy (442.0): explicit Dockerfile COPY; worker/beat via python -m app.core.*
-  # integration/ in image: <systemKey>-deploy.json + application.json|yaml only (no test-*, wizard-configs).
+  # integration/ in image: only onboarding-catalog.json keys (+ deploy/application per key).
   worker: true
   imageRunWorker: exec python -m app.core.celery_worker_main
   imageRunBeat: exec python -m app.core.celery_beat_main
@@ -83,7 +82,9 @@ build:
 # NOT included (auto-configured):
 # - Database URLs, Redis → auto-generated during Azure install
 # - MISO_*, KEYCLOAK_* → auto-generated during Azure install  
-# - AI params (OPENAI_*, AZURE_OPENAI_*) → from controller config
+# - AI params / provider secrets → LLM external systems + secret store
+#   (never product OPENAI_* / AZURE_OPENAI_*). ≥2 providers →
+#   ENTERPRISE_LLM_DEFAULT_SELECTOR (portal LLM category).
 # - ENVIRONMENT → set by deployment target
 
 configuration:
@@ -91,6 +92,7 @@ configuration:
   # Operations & Debugging
   # -------------------------------------------------------------------------
   - name: LOG_LEVEL
+    category: Operations & Debugging
     portalInput:
       field: select
       label: "Log Level"
@@ -101,6 +103,7 @@ configuration:
         - ERROR
 
   - name: ABAC_AUDIT_DETAIL_LEVEL
+    category: Operations & Debugging
     portalInput:
       field: select
       label: "ABAC Audit Detail Level"
@@ -109,6 +112,7 @@ configuration:
         - detailed
 
   - name: RBAC_AUDIT_DETAIL_LEVEL
+    category: Operations & Debugging
     portalInput:
       field: select
       label: "RBAC Audit Detail Level"
@@ -118,6 +122,7 @@ configuration:
         - explain
 
   - name: TRUST_CUSTOMER_POLICY_LEVEL
+    category: Trust
     portalInput:
       field: select
       label: "Trust policy level (no-policy defaults)"
@@ -127,6 +132,7 @@ configuration:
         - relaxed
 
   - name: TRUST_PUBLISH_GATE_ENABLED
+    category: Trust
     portalInput:
       field: select
       label: "Enforce trust gate on datasource publish"
@@ -135,6 +141,7 @@ configuration:
         - "true"
 
   - name: TRUST_PROMOTE_GATE_ENABLED
+    category: Trust
     portalInput:
       field: select
       label: "Enforce trust gate on external system publish (promote scope)"
@@ -143,6 +150,7 @@ configuration:
         - "true"
 
   - name: TRUST_RUNTIME_GATE_ENABLED
+    category: Trust
     portalInput:
       field: select
       label: "Enforce trust gate on CIP execution and workforce generation inputs (runtime scope)"
@@ -151,6 +159,7 @@ configuration:
         - "true"
 
   - name: TRUST_AI_EXPOSURE_GATE_ENABLED
+    category: Trust
     portalInput:
       field: select
       label: "Enforce trust gate on AI document-storage prompt generation"
@@ -164,24 +173,28 @@ configuration:
   # Tune based on customer data volumes and external API characteristics
 
   - name: CIP_EXECUTION_MAX_RECORDS
+    category: CIP Execution
     portalInput:
       field: text
       label: "Max Records per CIP Execution"
       placeholder: "100000"
 
   - name: CIP_EXECUTION_MAX_RESPONSE_SIZE_MB
+    category: CIP Execution
     portalInput:
       field: text
       label: "Max Response Size (MB)"
       placeholder: "100.0"
 
   - name: CIP_EXECUTION_OPERATION_TIMEOUT
+    category: CIP Execution
     portalInput:
       field: text
       label: "Operation Timeout (seconds)"
       placeholder: "300.0"
 
   - name: CIP_EXECUTION_HTTP_TIMEOUT
+    category: CIP Execution
     portalInput:
       field: text
       label: "HTTP Request Timeout (seconds)"
@@ -193,13 +206,22 @@ configuration:
   # Tune to match external API rate limits
 
   - name: CIP_EXECUTION_RATE_LIMIT_REQUESTS_PER_SECOND
+    category: CIP Rate Limiting
     portalInput:
       field: text
       label: "Rate Limit (requests/second)"
       placeholder: "10.0"
 
   - name: CIP_EXECUTION_RATE_LIMIT_BURST_SIZE
+    category: CIP Rate Limiting
     portalInput:
       field: text
       label: "Rate Limit Burst Size"
       placeholder: "20"
+
+  - name: ENTERPRISE_LLM_DEFAULT_SELECTOR
+    category: LLM
+    portalInput:
+      field: text
+      label: "Default LLM provider (system key when two or more providers)"
+      placeholder: "openai"