@aifabrix/builder 2.52.0 → 2.53.0

package/lib/utils/authentication-shape.js

@@ -110,6 +110,9 @@ function buildAuthenticationFromMethod(systemKey, authType) {
   if (method === 'none') {
     return { authType: 'none' };
   }
+  if (method === 'system') {
+    return { authType: 'system' };
+  }
   const flat = buildFlatCredentialTemplate(systemKey, method);
   return {
     authType: 'credential',
@@ -174,6 +177,9 @@ function migrateAuthenticationToNestedSchema(authentication, systemKey) {
   if (authentication.authType === 'none') {
     return { authentication: { authType: 'none' }, changed: false };
   }
+  if (authentication.authType === 'system') {
+    return { authentication: { authType: 'system' }, changed: false };
+  }
   if (authentication.authType === 'apiProvider' && authentication.apiProvider) {
     return { authentication, changed: false };
   }

package/lib/utils/compose-generator.js

@@ -31,6 +31,7 @@ const {
   buildTraefikIngressBase,
   computeTraefikStripPathPrefix
 } = require('./compose-traefik-ingress-base');
+const { buildTraefikExtraRouters } = require('./compose-traefik-extra-routes');
 const { parseDeveloperIdNum } = require('./declarative-url-ports');
 
 registerComposeHelpers();
@@ -250,13 +251,20 @@ function buildTraefikConfig(config, devId, scopeOpts = null, remoteServer = null
   // Traefik must only attach routers to `web` for developer-id > 0; `websecure`+tls labels without
   // matching certs break routing on Traefik 3.6+ for HTTP traffic (404 on PathPrefix).
   const terminateTlsAtTraefik = base.tls === true && devNum === 0;
+  const stripPathPrefix = computeTraefikStripPathPrefix(base.path, resolvedHealth);
+  const extra = buildTraefikExtraRouters(config.frontDoorRouting, base.path);
   return {
     enabled: true,
     host: base.host,
     path: base.path,
     tls: terminateTlsAtTraefik,
     certStore: terminateTlsAtTraefik ? base.certStore || null : null,
-    stripPathPrefix: computeTraefikStripPathPrefix(base.path, resolvedHealth)
+    stripPathPrefix,
+    passThroughRouters: extra.passThroughRouters,
+    aliasRouters: extra.aliasRouters.map((r) => ({
+      ...r,
+      stripPrimary: stripPathPrefix === true && base.path !== '/'
+    }))
   };
 }
 
@@ -424,6 +432,7 @@ module.exports = {
   getImageName,
   derivePathFromPattern,
   buildTraefikConfig,
+  buildTraefikExtraRouters,
   computeAlignedHealthCheckPath,
   resolveHealthCheckPathWithFrontDoorVdir,
   buildDevUsername,

package/lib/utils/compose-traefik-extra-routes.js

@@ -0,0 +1,107 @@
+/**
+ * Extra Traefik routers from frontDoorRouting.requiresRuleSet + ruleSetConditions.
+ *
+ * @fileoverview Schema-legal pass-through routes (plan 171.0). No invented keys.
+ * @author AI Fabrix Team
+ * @version 1.1.0
+ */
+
+/**
+ * Normalize a route pattern to a PathPrefix value (no trailing slash / wildcards).
+ * @param {unknown} pattern
+ * @returns {string|null}
+ */
+function normalizeRoutePrefix(pattern) {
+  if (!pattern || typeof pattern !== 'string') {
+    return null;
+  }
+  const trimmed = pattern.trim();
+  if (!trimmed.startsWith('/')) {
+    return null;
+  }
+  if (trimmed === '/' || trimmed === '/*') {
+    return '/';
+  }
+  const withoutWildcards = trimmed.replace(/\/\*+$/g, '').replace(/\*+$/g, '');
+  const withoutTrailing = withoutWildcards.replace(/\/+$/g, '');
+  return withoutTrailing || '/';
+}
+
+/**
+ * Safe Traefik label id fragment from a path prefix.
+ * @param {string} prefix
+ * @param {number} index
+ * @returns {string}
+ */
+function routeIdFromPrefix(prefix, index) {
+  const slug = String(prefix || 'x')
+    .replace(/^\//, '')
+    .replace(/[^a-zA-Z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 40);
+  return `${slug || 'route'}-${index}`;
+}
+
+/**
+ * Collect PathPrefix values from ruleSetConditions matchValues.
+ * @param {Object} frontDoor
+ * @returns {string[]}
+ */
+function matchValuesFromRuleSetConditions(frontDoor) {
+  if (frontDoor.requiresRuleSet !== true) {
+    return [];
+  }
+  const conditions = Array.isArray(frontDoor.ruleSetConditions)
+    ? frontDoor.ruleSetConditions
+    : [];
+  const prefixes = [];
+  conditions.forEach((condition) => {
+    if (!condition || typeof condition !== 'object') {
+      return;
+    }
+    const values = Array.isArray(condition.matchValues) ? condition.matchValues : [];
+    values.forEach((raw) => {
+      const pathPrefix = normalizeRoutePrefix(raw);
+      if (pathPrefix && pathPrefix !== '/') {
+        prefixes.push(pathPrefix);
+      }
+    });
+  });
+  return prefixes;
+}
+
+/**
+ * Build Traefik extra-route descriptors from frontDoorRouting (schema fields only).
+ * @param {Object|null|undefined} frontDoor
+ * @param {string} _primaryPath - Resolved primary PathPrefix (unused; reserved for callers)
+ * @returns {{ passThroughRouters: object[], aliasRouters: object[] }}
+ */
+function buildTraefikExtraRouters(frontDoor, _primaryPath) {
+  const passThroughRouters = [];
+  const aliasRouters = [];
+  if (!frontDoor || typeof frontDoor !== 'object') {
+    return { passThroughRouters, aliasRouters };
+  }
+
+  const prefixes = matchValuesFromRuleSetConditions(frontDoor);
+  const seen = new Set();
+  prefixes.forEach((pathPrefix, index) => {
+    if (seen.has(pathPrefix)) {
+      return;
+    }
+    seen.add(pathPrefix);
+    passThroughRouters.push({
+      id: routeIdFromPrefix(pathPrefix, index),
+      pathPrefix
+    });
+  });
+
+  return { passThroughRouters, aliasRouters };
+}
+
+module.exports = {
+  normalizeRoutePrefix,
+  routeIdFromPrefix,
+  matchValuesFromRuleSetConditions,
+  buildTraefikExtraRouters
+};

package/lib/utils/docker-build.js

@@ -253,8 +253,8 @@ async function executeBuild(imageName, dockerfilePath, contextPath, tag, options
   );
   await executeDockerBuild(imageName, dockerfilePath, contextPath, tag, buildArgs, noCache);
 
-  // Tag image if additional tag provided
-  if (options && options.tag && options.tag !== 'latest') {
+  // Also apply floating `latest` when building a version tag (matches dev-promote dual tags).
+  if (options && options.tag && options.tag !== 'latest' && options.tag !== 'main') {
     const { execFileWithDockerEnv } = require('./docker-exec');
     const { getDockerExecEnv } = require('./remote-docker-env');
     const env = await getDockerExecEnv();

package/lib/utils/help-builder.js

@@ -98,7 +98,8 @@ const CATEGORIES = [
       { name: 'validate', term: 'validate [appKey|systemKey|file]' },
       { name: 'validate-json', term: 'validate-json [appKey|systemKey]' },
       { name: 'parameters', term: 'parameters validate' },
-      { name: 'diff', term: 'diff <file1> <file2>' }
+      { name: 'diff', term: 'diff <file1> <file2>' },
+      { name: 'package-score', term: 'package-score --reference <dir> --candidate <dir>' }
     ]
   },
   {
@@ -111,6 +112,7 @@ const CATEGORIES = [
       { name: 'delete', term: 'delete <systemKey>' },
       { name: 'repair', term: 'repair <systemKey>' },
       { name: 'manifest', term: 'manifest get-section <systemKey> <sectionKey>' },
+      { name: 'integration-definition', term: 'integration-definition apply <file>' },
       { name: 'channel', term: 'channel scaffold <channelTarget>' },
       { name: 'datasource' },
       { name: 'datasource load', term: 'datasource load <datasourceKey>' },

package/lib/utils/promote-dev-docker-image.js

@@ -1,9 +1,10 @@
 /**
  * Promote a developer-scoped local Docker image to the manifest base repository (tag only).
  *
- * @fileoverview Used by `aifabrix build --base --from-dev` and dev-promote workflows
+ * @fileoverview Used by `aifabrix build --base --from-dev` and dev-promote workflows.
+ * Promote always applies two base tags: `latest` (floating) and the version tag (TAG / package version).
  * @author AI Fabrix Team
- * @version 1.0.0
+ * @version 1.2.0
  */
 
 'use strict';
@@ -15,6 +16,12 @@ const { execWithDockerEnv } = require('./docker-exec');
 const logger = require('./logger');
 const { formatSuccessLine } = require('./cli-test-layout-chalk');
 
+/** Floating base tag applied on every promote alongside the version tag (matches setup manifests). */
+const PROMOTE_FLOATING_TAG = 'latest';
+
+/** @deprecated Use {@link PROMOTE_FLOATING_TAG}. Kept for callers that imported the old name. */
+const PROMOTE_MAIN_TAG = PROMOTE_FLOATING_TAG;
+
 /**
  * @param {string} value
  * @returns {string}
@@ -61,6 +68,34 @@ async function dockerTagImageRef(sourceRef, targetRef) {
   await execWithDockerEnv(`docker tag ${shellQuote(sourceRef)} ${shellQuote(targetRef)}`);
 }
 
+/**
+ * Version tag for promote (not floating aliases).
+ * @param {Object} options
+ * @returns {string}
+ */
+function resolvePromoteVersionTag(options = {}) {
+  const raw = String(options.tag || '').trim();
+  // `main` accepted as legacy alias for the floating tag.
+  if (!raw || raw === PROMOTE_FLOATING_TAG || raw === 'main') {
+    return PROMOTE_FLOATING_TAG;
+  }
+  return raw;
+}
+
+/**
+ * Base tags to apply on promote: version first, then `latest` when distinct.
+ * @param {Object} options
+ * @returns {string[]}
+ */
+function resolvePromoteBaseTags(options = {}) {
+  const versionTag = resolvePromoteVersionTag(options);
+  const tags = [versionTag];
+  if (versionTag !== PROMOTE_FLOATING_TAG) {
+    tags.push(PROMOTE_FLOATING_TAG);
+  }
+  return tags;
+}
+
 /**
  * @param {string} appName
  * @param {Object} variables
@@ -69,7 +104,7 @@ async function dockerTagImageRef(sourceRef, targetRef) {
  * @returns {Promise<{ devRef: string, baseRef: string, devTag: string, baseTag: string }>}
  */
 async function resolveDevAndBaseImageRefs(appName, variables, developerId, options) {
-  const baseTag = options.tag || 'latest';
+  const baseTag = resolvePromoteVersionTag(options);
   const devTag = options.fromDevTag || 'latest';
   const { buildImageName: baseName } = await resolveBuildDockerTagNames(appName, variables, developerId, {
     ...options,
@@ -93,31 +128,68 @@ async function resolveDevAndBaseImageRefs(appName, variables, developerId, optio
  * @param {Object} appConfig
  * @param {string|number} developerId
  * @param {Object} options
- * @returns {Promise<{ devRef: string, baseRef: string }|null>}
+ * @returns {Promise<{
+ *   devRef: string,
+ *   baseRef: string,
+ *   baseName: string,
+ *   baseTags: string[]
+ * }|null>}
  */
 async function resolvePromoteSourceAndTargetRefs(appName, appConfig, developerId, options) {
-  const baseTag = options.tag || 'latest';
+  const baseTags = resolvePromoteBaseTags(options);
+  const versionTag = baseTags[0];
   const devTagCandidates = ['latest'];
-  if (baseTag !== 'latest' && !devTagCandidates.includes(baseTag)) {
-    devTagCandidates.push(baseTag);
+  if (versionTag !== 'latest' && !devTagCandidates.includes(versionTag)) {
+    devTagCandidates.push(versionTag);
   }
   for (const fromDevTag of devTagCandidates) {
     const refs = await resolveDevAndBaseImageRefs(appName, appConfig, developerId, {
       ...options,
+      tag: versionTag,
       fromDevTag
     });
     if (await dockerImageRefExists(refs.devRef)) {
-      return { devRef: refs.devRef, baseRef: refs.baseRef };
+      const baseName = refs.baseRef.slice(0, refs.baseRef.lastIndexOf(':'));
+      return {
+        devRef: refs.devRef,
+        baseRef: refs.baseRef,
+        baseName,
+        baseTags
+      };
     }
   }
   return null;
 }
 
+/**
+ * @param {string} baseName
+ * @param {string[]} baseTags
+ * @param {string|null} devId
+ * @returns {Promise<boolean>} true when every target already matches dev image id
+ */
+async function allBaseTagsMatchDev(baseName, baseTags, devId) {
+  if (!devId) {
+    return false;
+  }
+  for (const tag of baseTags) {
+    const ref = `${baseName}:${tag}`;
+    if (!(await dockerImageRefExists(ref))) {
+      return false;
+    }
+    const baseId = await readDockerImageId(ref);
+    if (!baseId || baseId !== devId) {
+      return false;
+    }
+  }
+  return true;
+}
+
 /**
  * Tag developer-scoped image as manifest base when present locally.
+ * Always applies the version tag and `latest`.
  * @param {string} appName
  * @param {Object} options - build options (`base`, `tag`, `registry`, `fromDev`)
- * @returns {Promise<string|null>} base image ref when promoted/skipped; null when dev image missing
+ * @returns {Promise<string|null>} primary base image ref (version) when promoted; null when missing
  */
 async function tryPromoteDevImageToBase(appName, options = {}) {
   if (options.base !== true) {
@@ -135,19 +207,27 @@ async function tryPromoteDevImageToBase(appName, options = {}) {
   if (!resolved) {
     return null;
   }
-  const { devRef, baseRef } = resolved;
+  const { devRef, baseRef, baseName, baseTags } = resolved;
 
   const devId = await readDockerImageId(devRef);
-  if (await dockerImageRefExists(baseRef)) {
-    const baseId = await readDockerImageId(baseRef);
-    if (devId && baseId && devId === baseId) {
-      logger.log(formatSuccessLine(`Base image already matches dev build: ${baseRef}`));
-      return baseRef;
-    }
+  if (await allBaseTagsMatchDev(baseName, baseTags, devId)) {
+    logger.log(
+      formatSuccessLine(
+        `Base image already matches dev build: ${baseTags.map((t) => `${baseName}:${t}`).join(', ')}`
+      )
+    );
+    return baseRef;
   }
 
-  await dockerTagImageRef(devRef, baseRef);
-  logger.log(formatSuccessLine(`Promoted dev image to base (tag only): ${baseRef}`));
+  for (const tag of baseTags) {
+    const targetRef = `${baseName}:${tag}`;
+    await dockerTagImageRef(devRef, targetRef);
+  }
+  logger.log(
+    formatSuccessLine(
+      `Promoted dev image to base (tag only): ${baseTags.map((t) => `${baseName}:${t}`).join(', ')}`
+    )
+  );
   return baseRef;
 }
 
@@ -160,10 +240,14 @@ function shouldAttemptDevPromote(options) {
 }
 
 module.exports = {
+  PROMOTE_FLOATING_TAG,
+  PROMOTE_MAIN_TAG,
   tryPromoteDevImageToBase,
   shouldAttemptDevPromote,
   resolveDevAndBaseImageRefs,
   resolvePromoteSourceAndTargetRefs,
+  resolvePromoteBaseTags,
+  resolvePromoteVersionTag,
   dockerImageRefExists,
   readDockerImageId,
   dockerTagImageRef

package/lib/utils/transient-developer-id.js

@@ -0,0 +1,28 @@
+/**
+ * Transient developer-id override for CLI commands (does not persist config).
+ *
+ * @fileoverview Resolve optional --developer-id / --developer without setDeveloperId
+ */
+
+'use strict';
+
+const { validateAndNormalizeDeveloperId } = require('../core/config-normalize');
+
+/**
+ * Resolve optional CLI developer override (transient — does not persist).
+ * Prefers developerId (--developer-id) over developer (-d/--developer).
+ *
+ * @param {Object} [options] - Commander options
+ * @returns {string|undefined} Normalized digit string, or undefined to use config
+ */
+function resolveTransientDeveloperIdFromOptions(options) {
+  const raw = options && (options.developerId ?? options.developer);
+  if (raw === undefined || raw === null || raw === '') {
+    return undefined;
+  }
+  return validateAndNormalizeDeveloperId(raw);
+}
+
+module.exports = {
+  resolveTransientDeveloperIdFromOptions
+};

package/package.json

@@ -1,12 +1,19 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.52.0",
+  "version": "2.53.0",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {
     "aifabrix": "bin/aifabrix.js",
     "af": "bin/aifabrix.js"
   },
+  "files": [
+    "bin/aifabrix.js",
+    "lib/",
+    "templates/",
+    "README.md",
+    "LICENSE"
+  ],
   "scripts": {
     "help": "node scripts/pnpm/help.mjs",
     "dev-install": "node scripts/pnpm/dev-install.mjs",
@@ -21,32 +28,23 @@
     "lint:fix": "eslint . --ext .js --fix",
     "test": "node tests/scripts/test-wrapper.js",
     "build": "npm run lint && npm run test",
-    "build:ci": "npm run lint && npm run check:schema-sync && npm run check:flags && npm run test:ci",
+    "build:ci": "npm run lint && npm run check:schema-sync && npm run check:flags && npm run check:cli-help && npm run test:ci",
     "test:ci": "bash tests/scripts/ci-simulate.sh",
-    "install:local": "node scripts/install-local.js && which aifabrix && which af",
-    "uninstall:local": "node scripts/install-local.js uninstall && which aifabrix && which af",
-    "sync-json": "node scripts/sync-builder-api-template.js",
-    "builder-api:build": "tsc -p packages/builder-api/tsconfig.json",
-    "builder-api:nest": "node bin/builder-api-nest.js",
-    "builder-api:cleanup": "node bin/builder-api-cleanup.js",
-    "check:builder-api-arch": "node scripts/check-builder-api-architecture-grep.js",
     "check:schema-sync": "node scripts/check-datasource-test-run-schema-sync.js",
     "check:flags": "jest tests/lib/schema/flag-map-validation-run.test.js --runInBand --config jest.config.default.js",
-    "test:154": "npm run check:builder-api-arch && jest --runInBand tests/lib/programmatic/ tests/packages/builder-api/ tests/lib/commands/up-builder-api.test.js tests/lib/commands/up-common.test.js tests/lib/commands/repair-deploy-script.test.js tests/lib/generator/deploy-script.test.js tests/lib/generator/wizard-generator.test.js tests/lib/scripts/sync-builder-api-template.test.js tests/lib/platform-integrations-manifest.test.js",
-    "test:154-docker-ip": "jest --runInBand tests/scripts/stage_builder_api_for_docker.test.js tests/scripts/docker_image_content_gate.test.js",
-    "stage-builder-api-docker": "node scripts/stage_builder_api_for_docker.js",
-    "docker-image-build-builder-api": "npm run stage-builder-api-docker && docker build -f builder/builder-api/Dockerfile -t builder-api:gate .",
-    "docker-image-gate-builder-api": "npm run docker-image-build-builder-api && node scripts/docker_image_content_gate.js builder-api:gate builder-api",
+    "check:cli-help": "node scripts/check-cli-help-examples.js",
     "test:manual": "jest --config jest.config.manual.js --runInBand",
     "test:integration": "jest --config jest.config.integration.js --runInBand",
     "test:integration:fixtures": "jest --config jest.config.integration.fixtures.js --runInBand",
     "test:hubspot-wizard": "node integration/hubspot-test/test.js",
     "test:hubspot-dataplane-down": "node integration/hubspot-test/test-dataplane-down.js",
     "test:coverage": "cross-env RUN_COVERAGE=1 node tests/scripts/test-wrapper.js",
-    "test:watch": "jest --watch",
-    "diagnose:cli": "node scripts/diagnose-cli.js",
+    "docker-image-gate-builder-api": "node scripts/stage_builder_api_for_docker.js && docker build -f builder/builder-api/Dockerfile -t builder-api:gate . && node scripts/docker_image_content_gate.js builder-api:gate builder-api",
+    "install:local": "node scripts/install-local.js && which aifabrix && which af",
+    "uninstall:local": "node scripts/install-local.js uninstall && which aifabrix && which af",
     "install:global": "npm install -g . --force && which aifabrix && which af && aifabrix --version",
     "uninstall:global": "npm uninstall -g @aifabrix/builder",
+    "sync-json": "node scripts/sync-builder-api-template.js",
     "pack": "npm run build && npm pack",
     "validate": "npm run build",
     "prepublishOnly": "npm run validate"

package/templates/README.md

@@ -15,7 +15,18 @@ Application templates are folder-based and located under `templates/applications
 - `templates/applications/keycloak/` - Keycloak application template
 - `templates/applications/builder-api/` - Builder API platform webapp (published from `builder/builder-api/` via `npm run sync-json`)
 
-**Platform SSOT (builder-api, plan 154.2):** Edit `builder/builder-api/` in the aifabrix-builder repo, then run `npm run sync-json` to publish `application.yaml`, `Dockerfile`, and `env.template` into `templates/applications/builder-api/`. Install with `aifabrix up-platform` or `aifabrix up-builder-api` — not hand-editing the template copy.
+**Platform template sync (`pnpm run sync-json`):** Publishes local `builder/builder-api/` (`application.yaml`, `Dockerfile`, `env.template`) and, when sibling checkouts exist, pulls the same file sets as miso/dataplane sync-json:
+
+| SSOT | → template |
+| --- | --- |
+| `aifabrix-builder/builder/builder-api/` | `templates/applications/builder-api/` |
+| `aifabrix-miso/builder/miso-controller/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/miso-controller/` |
+| `aifabrix-miso/builder/keycloak/` (`env.template`, `application.yaml`) | `templates/applications/keycloak/` |
+| `aifabrix-dataplane/builder/dataplane/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/dataplane/` |
+
+**Schema master (dataplane):** Also copies dataplane `app/schemas/json/` core integration schemas + `type/*` and `configs/deployment-rules.yaml` into `lib/schema/` (same contract as dataplane `make sync-json`). Do not hand-edit those mirrors — edit dataplane SSOT, then sync. Builder-owned schemas in `lib/schema/` (wizard, infra, etc.) are left alone.
+
+Overrides: `AIFABRIX_MISO_SRC`, `AIFABRIX_DATAPLANE_SRC` / `AIFABRIX_DATAPLANE_ROOT` (repo roots). Install with `aifabrix up-platform` / `up-builder-api` — do not hand-edit the template copies as primary.
 
 **Template Validation:**
 - Template folder must exist in `templates/applications/<name>/`

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.20
+  version: 2.0.31
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).
@@ -29,6 +29,13 @@ frontDoorRouting:
   internalDockerUseOriginOnly: false
   host: ${DEV_USERNAME}.${REMOTE_HOST}
   tls: ${TLS_ENABLED}
+  # Origin RFC 9728 PRM (outside /data PathPrefix) — Builder Traefik pass-through (plan 171.0).
+  requiresRuleSet: true
+  ruleSetConditions:
+    - type: UrlPath
+      operator: BeginsWith
+      matchValues:
+        - /.well-known/oauth-protected-resource/data
 
 # Azure Requirements
 requires:
@@ -88,7 +95,8 @@ build:
 # - MISO_*, KEYCLOAK_* → auto-generated during Azure install
 # - AI params / provider secrets → LLM external systems + secret store
 #   (never product OPENAI_* / AZURE_OPENAI_*). ≥2 providers →
-#   ENTERPRISE_LLM_DEFAULT_SELECTOR (portal LLM category).
+#   ENTERPRISE_LLM_DEFAULT_SELECTOR (portal/env deploy default); Environment
+#   Settings ai.llmProvider overrides without redeploy.
 # - ENVIRONMENT → set by deployment target
 
 configuration:

package/templates/applications/dataplane/env.template

@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.20
+VERSION=2.0.31
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5
@@ -155,11 +155,10 @@ MISO_PIPELINE_ENV_KEY=
 
 # LLM: chat/embed route through governed enterprise-llm only. Provider credentials
 # live on LLM provider external systems + dataplane secret store (not product .env).
-# When ≥2 LLM providers are published under enterprise-llm, set selectorKey
-# (system key), e.g. openai | azure-openai | ollama. Ignored when only one.
-# Prefer portal Configuration category LLM after deploy; this env is the resolve target.
-# Default LLM provider systemKey when ≥2 LLM providers are published under
-# enterprise-llm (fail-closed if empty). Portal category LLM can override.
+# Deploy-time default provider (systemKey) when Environment Settings ai.llmProvider
+# is empty. Operators can override in Environment Settings without redeploying.
+# When ≥2 LLM providers are published and both settings and this env are empty,
+# resolve fails closed. Ignored when only one provider is published.
 # Lab default: openai (catalog also ships azure-openai).
 ENTERPRISE_LLM_DEFAULT_SELECTOR=openai
 
@@ -180,6 +179,8 @@ ABAC_EXPLAIN_MODE_ENABLED=false
 ABAC_PERFORMANCE_THRESHOLD_MS=1000
 
 # RBAC Audit Configuration
+# When true, audit denials (rbac.permission.check.failure) and decision traces.
+# Successful allow checks are not audited (no forensic value; floods every request).
 RBAC_AUDIT_ENABLED=true
 # RBAC audit detail: summary | detailed | explain
 RBAC_AUDIT_DETAIL_LEVEL=summary

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.20'
+  version: '2.0.34'
 
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
@@ -81,7 +81,7 @@ configuration:
   # Operations & Debugging
   # -------------------------------------------------------------------------
   - name: LOG_LEVEL
-    category: General
+    category: Operations & Debugging
     portalInput:
       field: select
       label: 'Log Level'
@@ -92,7 +92,7 @@ configuration:
         - error
 
   - name: ENABLE_API_DOCS
-    category: General
+    category: Operations & Debugging
     portalInput:
       field: select
       label: 'Enable API Documentation (Swagger/ReDoc)'
@@ -101,7 +101,7 @@ configuration:
         - 'false'
 
   - name: FAST_STARTUP
-    category: General
+    category: Operations & Debugging
     portalInput:
       field: select
       label: 'Fast Startup (skip non-critical init)'
@@ -110,7 +110,7 @@ configuration:
         - 'false'
 
   - name: LOG_TO_FILE
-    category: General
+    category: Operations & Debugging
     portalInput:
       field: select
       label: 'Log to File'
@@ -122,7 +122,7 @@ configuration:
   # Keycloak Events (feature flag)
   # -------------------------------------------------------------------------
   - name: KEYCLOAK_EVENTS_ENABLED
-    category: General
+    category: Keycloak Events
     portalInput:
       field: select
       label: 'Keycloak Events (sync users/groups)'
@@ -130,18 +130,33 @@ configuration:
         - 'true'
         - 'false'
 
+  # -------------------------------------------------------------------------
+  # Identity — local user password / invitation
+  # -------------------------------------------------------------------------
+  - name: IDENTITY_LOCAL_PASSWORD_MODE
+    category: Identity
+    portalInput:
+      field: select
+      label: 'Password setup for new local users'
+      placeholder: 'Choose how new users set their password'
+      options:
+        - label: 'Send invitation email (user sets their own password)'
+          value: email
+        - label: 'Show a one-time temporary password to the admin'
+          value: admin-reveal
+
   # -------------------------------------------------------------------------
   # Rate Limiting (tune for environment)
   # -------------------------------------------------------------------------
   - name: RATE_LIMIT_WINDOW_MS
-    category: General
+    category: Rate Limiting
     portalInput:
       field: text
       label: 'Rate Limit Window (milliseconds)'
       placeholder: '900000'
 
   - name: RATE_LIMIT_MAX
-    category: General
+    category: Rate Limiting
     portalInput:
       field: text
       label: 'Rate Limit Max Requests per Window'