@aifabrix/builder 2.53.0 → 2.54.1

package/lib/utils/env-copy.js

@@ -20,7 +20,7 @@ const devConfig = require('../utils/dev-config');
 const { rewriteInfraEndpoints } = require('./env-endpoints');
 const { buildEnvVarMap } = require('./env-map');
 const { interpolateEnvVars } = require('./secrets-helpers');
-const { getLocalPort } = require('./port-resolver');
+const { getLocalPort, isExternalAppDoc } = require('./port-resolver');
 const { applyHostLocalKeycloakInternalUrl } = require('./env-copy-keycloak');
 
 /**
@@ -263,6 +263,21 @@ function extractEnvVarsFromContent(envContent, envVars) {
   return envVars;
 }
 
+/**
+ * Patch Connected System env for local resolve (infra hosts only; no listen PORT).
+ * @async
+ * @param {string} envContent - Original env content
+ * @returns {Promise<string>} Patched env content
+ */
+async function patchExternalEnvContentForLocal(envContent) {
+  const devIdNum = readDeveloperIdFromConfig(config) || 0;
+  const infraPorts = devConfig.getDevPorts(devIdNum);
+  const updated = await rewriteInfraEndpoints(envContent, 'local', infraPorts);
+  const envVars = await buildEnvVarMap('local', null, devIdNum);
+  const updatedEnvVars = extractEnvVarsFromContent(updated, envVars);
+  return interpolateEnvVars(updated, updatedEnvVars);
+}
+
 /**
  * Patch env content for local development
  * @async
@@ -271,21 +286,18 @@ function extractEnvVarsFromContent(envContent, envVars) {
  * @returns {Promise<string>} Patched env content
  */
 async function patchEnvContentForLocal(envContent, variables) {
+  if (isExternalAppDoc(variables)) {
+    return patchExternalEnvContentForLocal(envContent);
+  }
   const baseAppPort = getLocalPort(variables, 3000);
   const appPort = calculateDevAppPort(baseAppPort);
   const devIdNum = readDeveloperIdFromConfig(config) || 0;
   const infraPorts = devConfig.getDevPorts(devIdNum);
 
-  // Update PORT
   envContent = updatePortInEnv(envContent, appPort);
-
-  // Update localhost URLs
   envContent = updateLocalhostUrls(envContent, baseAppPort, appPort);
-
-  // Rewrite infra endpoints
   envContent = await rewriteInfraEndpoints(envContent, 'local', infraPorts);
 
-  // Interpolate ${VAR} references
   const envVars = await buildEnvVarMap('local', null, devIdNum);
   const updatedEnvVars = extractEnvVarsFromContent(envContent, envVars);
   envContent = interpolateEnvVars(envContent, updatedEnvVars);

package/lib/utils/external-env-template.js

@@ -52,9 +52,17 @@ const FALLBACK_SECURITY_BY_AUTH = {
   hmac: ['signingSecret'],
   bearer: ['bearerToken'],
   token: ['bearerToken'],
-  none: []
+  none: [],
+  system: []
 };
 
+const NO_SECRET_AUTH_TYPES = new Set(['none', 'apiProvider', 'system']);
+
+function isNoSecretAuthType(authBlock) {
+  const authType = authBlock && typeof authBlock.authType === 'string' ? authBlock.authType.trim() : '';
+  return NO_SECRET_AUTH_TYPES.has(authType);
+}
+
 /**
  * @param {Array<{name: string, value: string}>} authSecureVars
  * @param {Record<string, unknown>} security
@@ -96,7 +104,7 @@ function buildAuthSecureVarsFromSystem(system) {
   const prefix = systemKeyToKvPrefix(systemKey);
   if (!prefix) return authSecureVars;
   const authBlock = system?.authentication || system?.auth;
-  if (authBlock?.authType === 'apiProvider' || authBlock?.authType === 'none') {
+  if (isNoSecretAuthType(authBlock)) {
     return authSecureVars;
   }
   const credential = getAuthCredentialTemplate(authBlock);
@@ -147,6 +155,8 @@ function buildExternalEnvTemplateContext(system) {
     authMethod = 'apiprovider';
   } else if (authBlock?.authType === 'none') {
     authMethod = 'none';
+  } else if (authBlock?.authType === 'system') {
+    authMethod = 'system';
   } else {
     authMethod = (
       credential?.method ||
@@ -155,6 +165,14 @@ function buildExternalEnvTemplateContext(system) {
       'apikey'
     ).toLowerCase();
   }
+  if (isNoSecretAuthType(authBlock)) {
+    return {
+      authMethod,
+      authSecureVars: [],
+      authNonSecureVarNames: [],
+      configuration: buildConfigurationEntries(system)
+    };
+  }
   const slotSecureVars = buildAuthSecureVarsFromAllSlots(system);
   const authSecureVars =
     slotSecureVars.length > 0 ? slotSecureVars : buildAuthSecureVarsFromSystem(system);

package/lib/utils/paths.js

@@ -842,12 +842,25 @@ function resolveExistingWorkspacePath(appName, options) {
   return null;
 }
 
+function platformShellWorkspaceWithoutConfig(appPath, baseDir) {
+  if (!isExistingAppDirectory(appPath)) {
+    return null;
+  }
+  if (baseDir === 'role-assistant' || baseDir === 'enterprise-knowledge') {
+    return externalIntegrationFolderResult(appPath, baseDir);
+  }
+  return null;
+}
+
 function externalWorkspaceFolderFromConfig(appPath, baseDir, scopedWorkspace) {
   try {
     const configPath = resolveApplicationConfigPath(appPath);
     const variables = loadConfigFile(configPath);
     if (!variables) {
-      return null;
+      return platformShellWorkspaceWithoutConfig(appPath, baseDir);
+    }
+    if (baseDir === 'role-assistant' || baseDir === 'enterprise-knowledge') {
+      return externalIntegrationFolderResult(appPath, baseDir);
     }
     const isExternal = isExternalAppType(variables);
     return {
@@ -857,6 +870,10 @@ function externalWorkspaceFolderFromConfig(appPath, baseDir, scopedWorkspace) {
       baseDir
     };
   } catch {
+    const platformShell = platformShellWorkspaceWithoutConfig(appPath, baseDir);
+    if (platformShell) {
+      return platformShell;
+    }
     if (scopedWorkspace && isExistingAppDirectory(appPath)) {
       return externalIntegrationFolderResult(appPath, baseDir);
     }

package/lib/utils/platform-shell-package.js

@@ -0,0 +1,69 @@
+/**
+ * digitalWorker / enterpriseKnowledge packages are platform shells, not Connected Systems.
+ *
+ * @fileoverview Kind and workspace helpers for Role Assistant and Enterprise Knowledge
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { SYSTEM_KIND_DIGITAL_WORKER, WORKSPACE_ROLE_ASSISTANT } = require('./role-assistant-paths');
+const {
+  SYSTEM_KIND_ENTERPRISE_KNOWLEDGE,
+  WORKSPACE_ENTERPRISE_KNOWLEDGE
+} = require('./enterprise-knowledge-paths');
+
+function readSystemKind(application) {
+  if (!application || typeof application !== 'object') {
+    return '';
+  }
+  const kind = application.systemKind || application.systemKindKey;
+  return typeof kind === 'string' ? kind.trim() : '';
+}
+
+function isDigitalWorkerKind(application) {
+  return readSystemKind(application) === SYSTEM_KIND_DIGITAL_WORKER;
+}
+
+function isEnterpriseKnowledgeKind(application) {
+  return readSystemKind(application) === SYSTEM_KIND_ENTERPRISE_KNOWLEDGE;
+}
+
+function isPlatformShellKind(application) {
+  return isDigitalWorkerKind(application) || isEnterpriseKnowledgeKind(application);
+}
+
+function isRoleAssistantWorkspace(baseDir) {
+  return String(baseDir || '').trim() === WORKSPACE_ROLE_ASSISTANT;
+}
+
+function isEnterpriseKnowledgeWorkspace(baseDir) {
+  return String(baseDir || '').trim() === WORKSPACE_ENTERPRISE_KNOWLEDGE;
+}
+
+function isPlatformShellWorkspace(baseDir) {
+  return isRoleAssistantWorkspace(baseDir) || isEnterpriseKnowledgeWorkspace(baseDir);
+}
+
+function throwIfPlatformShellHasNoDeployJson(appName, baseDir) {
+  if (!isPlatformShellWorkspace(baseDir)) {
+    return;
+  }
+  throw new Error(
+    `'${appName}' is a Role Assistant or Enterprise Knowledge package and does not use ` +
+      'application.yaml or deployment JSON. Publish settings and Evidence with: ' +
+      `aifabrix upload ${appName} --env <dev|tst|pro>`
+  );
+}
+
+module.exports = {
+  readSystemKind,
+  isDigitalWorkerKind,
+  isEnterpriseKnowledgeKind,
+  isPlatformShellKind,
+  isRoleAssistantWorkspace,
+  isEnterpriseKnowledgeWorkspace,
+  isPlatformShellWorkspace,
+  throwIfPlatformShellHasNoDeployJson
+};

package/lib/utils/port-resolver.js

@@ -101,10 +101,59 @@ function getLocalPortFromPath(variablesPath) {
   return (p !== undefined && p !== null) ? p : null;
 }
 
+/**
+ * Connected Systems (`app.type: external`) have no HTTP listen port.
+ * @param {Object|null|undefined} variables - Parsed application config
+ * @returns {boolean}
+ */
+function isExternalAppDoc(variables) {
+  return Boolean(variables && variables.app && variables.app.type === 'external');
+}
+
+/**
+ * @param {string|null|undefined} variablesPath - Path to application config
+ * @returns {boolean}
+ */
+function isExternalAppPath(variablesPath) {
+  return isExternalAppDoc(loadVariablesFromPath(variablesPath));
+}
+
+/**
+ * Drop PORT assignments from resolved .env content (Connected Systems).
+ * @param {string} envContent
+ * @returns {string}
+ */
+function stripListenPortEnvLines(envContent) {
+  if (!envContent || typeof envContent !== 'string') {
+    return envContent;
+  }
+  return envContent
+    .split(/\r?\n/)
+    .filter((line) => !/^\s*PORT\s*=/.test(line))
+    .join('\n');
+}
+
+/**
+ * Set or append PORT for builder apps that listen on HTTP.
+ * @param {string} envContent
+ * @param {number} appPort
+ * @returns {string}
+ */
+function assignListenPortEnvLine(envContent, appPort) {
+  if (/^PORT\s*=.*$/m.test(envContent)) {
+    return envContent.replace(/^PORT\s*=\s*.*$/m, `PORT=${appPort}`);
+  }
+  return `${envContent}\nPORT=${appPort}\n`;
+}
+
 module.exports = {
   getContainerPort,
   getLocalPort,
   getContainerPortFromPath,
   getLocalPortFromPath,
-  loadVariablesFromPath
+  loadVariablesFromPath,
+  isExternalAppDoc,
+  isExternalAppPath,
+  stripListenPortEnvLines,
+  assignListenPortEnvLine
 };

package/lib/utils/rewrite-name-flag.js

@@ -0,0 +1,20 @@
+/**
+ * Treat clustered -name as the long --name option so quoted names with spaces work.
+ *
+ * @fileoverview Commander parses -name as -n plus leftover letters
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {string[]} argv
+ * @returns {string[]}
+ */
+function rewriteClusteredNameFlag(argv) {
+  const args = Array.isArray(argv) ? argv : [];
+  return args.map((arg) => (arg === '-name' ? '--name' : arg));
+}
+
+module.exports = { rewriteClusteredNameFlag };

package/lib/utils/role-assistant-paths.js

@@ -121,30 +121,33 @@ function firstExistingUnderRoot(disk, root, folderNames) {
 }
 
 /**
- * Resolves role-assistant/ra-{roleKey} (preferred) or legacy bare folder.
- * @param {string} roleKey
+ * Resolves role-assistant/<systemKey> by exact folder name.
+ * Does not map a connected-system key onto an ra- package.
+ * @param {string} systemKey
  * @returns {string}
  */
-function getRoleAssistantPath(roleKey) {
-  if (!roleKey || typeof roleKey !== 'string') {
+function getRoleAssistantPath(systemKey) {
+  if (!systemKey || typeof systemKey !== 'string') {
+    throw new Error('Role key is required and must be a string');
+  }
+  const folderName = systemKey.trim();
+  if (!folderName) {
     throw new Error('Role key is required and must be a string');
   }
   const disk = nodeFs();
-  const folders = roleAssistantFolderCandidates(roleKey);
-  const preferred = roleAssistantSystemKey(roleKey);
   const cwdRoot = getCwdRoleAssistantRoot();
   const matRoot = path.join(getMaterializationParent(), WORKSPACE_ROLE_ASSISTANT);
 
   const existing =
-    firstExistingUnderRoot(disk, cwdRoot, folders) ||
-    firstExistingUnderRoot(disk, matRoot, folders);
+    firstExistingUnderRoot(disk, cwdRoot, [folderName]) ||
+    firstExistingUnderRoot(disk, matRoot, [folderName]);
   if (existing) {
     return existing;
   }
   if (cwdRoot) {
-    return path.join(cwdRoot, preferred);
+    return path.join(cwdRoot, folderName);
   }
-  return path.join(matRoot, preferred);
+  return path.join(matRoot, folderName);
 }
 
 module.exports = {

package/lib/utils/schema-resolver.js

@@ -14,6 +14,10 @@ const path = require('path');
 const { detectAppType } = require('./paths');
 const { resolveApplicationConfigPath } = require('./app-config-resolver');
 const { loadConfigFile } = require('./config-format');
+const {
+  isRoleAssistantWorkspace,
+  isEnterpriseKnowledgeWorkspace
+} = require('./platform-shell-package');
 
 /**
  * Resolves schemaBasePath from application config
@@ -314,7 +318,13 @@ async function resolveExternalFiles(appName, options = {}) {
     throw new Error('App name is required and must be a string');
   }
 
-  const { appPath } = await detectAppType(appName, options);
+  const { appPath, baseDir } = await detectAppType(appName, options);
+  if (isEnterpriseKnowledgeWorkspace(baseDir)) {
+    return [];
+  }
+  if (isRoleAssistantWorkspace(baseDir)) {
+    return [resolveRoleAssistantSettingsFile(appPath)];
+  }
   const variables = await loadAndValidateVariables(appPath);
 
   if (!variables.externalIntegration) {

package/lib/utils/secrets-helpers.js

@@ -17,7 +17,7 @@ const { rewriteInfraEndpoints, getEnvHosts, getServicePort, getServiceHost, getL
 const { loadEnvConfig } = require('./env-config-loader');
 const { updateContainerPortInEnvFile } = require('./env-ports');
 const { buildEnvVarMap } = require('./env-map');
-const { getLocalPortFromPath } = require('./port-resolver');
+const { getLocalPortFromPath, isExternalAppPath, assignListenPortEnvLine } = require('./port-resolver');
 const { readYamlAtPath, applyCanonicalSecretsOverride } = require('./secrets-canonical');
 const { collectUniqueKvPathStrings, isCommentOrEmptyLine, activeEnvLineForKvScan, envLineWithoutInlineComment } = require('./secrets-kv-refs');
 
@@ -407,20 +407,6 @@ async function getLocalEnvWithOverrides() {
   return localEnv;
 }
 
-/**
- * Updates PORT variable in content
- * @function updatePortVariable
- * @param {string} envContent - Environment content
- * @param {number} appPort - Application port
- * @returns {string} Updated content
- */
-function updatePortVariable(envContent, appPort) {
-  if (/^PORT\s*=.*$/m.test(envContent)) {
-    return envContent.replace(/^PORT\s*=\s*.*$/m, `PORT=${appPort}`);
-  }
-  return `${envContent}\nPORT=${appPort}\n`;
-}
-
 /**
  * Builds environment variables for interpolation
  * @async
@@ -446,6 +432,7 @@ async function buildEnvVarsForInterpolation(devIdNum) {
 }
 
 async function adjustLocalEnvPortsInContent(envContent, variablesPath) {
+  const skipListenPort = isExternalAppPath(variablesPath);
   const devIdNum = await getDeveloperIdNumber();
   const localEnv = await getLocalEnvWithOverrides();
   const { localHostPort } = require('./declarative-url-ports');
@@ -453,15 +440,19 @@ async function adjustLocalEnvPortsInContent(envContent, variablesPath) {
   const baseListen = await resolveManifestListenPort(variablesPath, localEnv, envContent);
   const appPort = localHostPort(baseListen, devIdNum);
 
-  let updated = updatePortVariable(envContent, appPort);
-  updated = updateLocalhostUrls(updated, baseListen, appPort);
+  let updated = skipListenPort ? envContent : assignListenPortEnvLine(envContent, appPort);
+  if (!skipListenPort) {
+    updated = updateLocalhostUrls(updated, baseListen, appPort);
+  }
   updated = await rewriteInfraEndpoints(updated, 'local');
 
   const envVars = await buildEnvVarsForInterpolation(devIdNum);
-  envVars.PORT = String(appPort);
-  const portVar = getPortVarFromEnvTemplatePath(variablesPath);
-  if (portVar) {
-    envVars[portVar] = String(appPort);
+  if (!skipListenPort) {
+    envVars.PORT = String(appPort);
+    const portVar = getPortVarFromEnvTemplatePath(variablesPath);
+    if (portVar) {
+      envVars[portVar] = String(appPort);
+    }
   }
   updated = interpolateEnvVars(updated, envVars);
 

package/lib/utils/token-manager.js

@@ -212,6 +212,15 @@ async function tryClientTokenAuth(environment, appName, controllerUrl) {
   return null;
 }
 
+function throwNoDeploymentAuth(credentialApp) {
+  const err = new Error(
+    `No authentication method available. For CI: set AIFABRIX_DEPLOYMENT_AUTH=client-credentials and MISO_CLIENTID/MISO_CLIENTSECRET in .env or '${credentialApp}-client-idKeyVault' in secrets.local.yaml. For interactive use: aifabrix login`
+  );
+  err.statusCode = 401;
+  err.authFailure = true;
+  throw err;
+}
+
 /**
  * Get deployment authentication configuration with priority:
  * 1. Device token → type 'bearer' (user token) → send as Authorization: Bearer
@@ -265,11 +274,7 @@ async function getDeploymentAuth(controllerUrl, environment, appName, options =
     }
   }
 
-  throw new Error(
-    'No authentication method available. For CI: set AIFABRIX_DEPLOYMENT_AUTH=client-credentials and ' +
-      `MISO_CLIENTID/MISO_CLIENTSECRET in .env or '${credentialApp}-client-idKeyVault' in secrets.local.yaml. ` +
-      'For interactive use: aifabrix login'
-  );
+  throwNoDeploymentAuth(credentialApp);
 }
 
 /**

package/lib/validation/validate.js

@@ -23,6 +23,10 @@ const { validateControllerManifest } = require('./external-manifest-validator');
 const { runExternalValidateWithOptionalCertSync } = require('./validate-external-cert-sync');
 const { validateExternalFile } = require('./validate-external-file');
 const { reservedSystemKeyError } = require('./reserved-system-key-prefixes');
+const {
+  isRoleAssistantWorkspace,
+  isEnterpriseKnowledgeWorkspace
+} = require('../utils/platform-shell-package');
 
 /**
  * Validates a file path (detects type and validates)
@@ -323,6 +327,32 @@ function aggregateExternalValidationSteps(steps, appPath) {
   };
 }
 
+function skippedValidationStep() {
+  return { valid: true, errors: [], warnings: [], skipped: true };
+}
+
+function skippedComponentsStep() {
+  return { valid: true, errors: [], warnings: [], files: [], skipped: true };
+}
+
+async function validatePlatformShellPackage(appName, baseDir, appPath, options) {
+  if (isEnterpriseKnowledgeWorkspace(baseDir)) {
+    return aggregateExternalValidationSteps({
+      application: skippedValidationStep(),
+      components: skippedComponentsStep(),
+      manifest: skippedValidationStep()
+    }, appPath);
+  }
+  if (!isRoleAssistantWorkspace(baseDir)) {
+    return null;
+  }
+  return aggregateExternalValidationSteps({
+    application: skippedValidationStep(),
+    components: await validateComponentsStep(appName, options),
+    manifest: skippedValidationStep()
+  }, appPath);
+}
+
 /**
  * Validates external system completely (components + full manifest)
  * Performs step-by-step validation: application config → components → full manifest
@@ -355,6 +385,16 @@ async function validateExternalSystemComplete(appName, options = {}) {
   };
 
   const externalOptions = { ...options };
+  const platformResult = await validatePlatformShellPackage(
+    appName,
+    baseDir,
+    appPath,
+    externalOptions
+  );
+  if (platformResult) {
+    return platformResult;
+  }
+
   steps.application = await validateApplicationStep(appName, externalOptions);
   steps.components = await validateComponentsStep(appName, externalOptions);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.53.0",
+  "version": "2.54.1",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {

package/templates/README.md

@@ -21,7 +21,7 @@ Application templates are folder-based and located under `templates/applications
 | --- | --- |
 | `aifabrix-builder/builder/builder-api/` | `templates/applications/builder-api/` |
 | `aifabrix-miso/builder/miso-controller/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/miso-controller/` |
-| `aifabrix-miso/builder/keycloak/` (`env.template`, `application.yaml`) | `templates/applications/keycloak/` |
+| `aifabrix-miso/builder/keycloak/` (`env.template`, `application.yaml`, `Dockerfile`, `cimd-lenient-parse/`) | `templates/applications/keycloak/` |
 | `aifabrix-dataplane/builder/dataplane/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/dataplane/` |
 
 **Schema master (dataplane):** Also copies dataplane `app/schemas/json/` core integration schemas + `type/*` and `configs/deployment-rules.yaml` into `lib/schema/` (same contract as dataplane `make sync-json`). Do not hand-edit those mirrors — edit dataplane SSOT, then sync. Builder-owned schemas in `lib/schema/` (wizard, infra, etc.) are left alone.

package/templates/applications/builder-api/Dockerfile

@@ -13,7 +13,7 @@ ENV NODE_ENV=production \
 WORKDIR /app
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends dumb-init \
+    && apt-get install -y --no-install-recommends dumb-init ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
 COPY package.json package-lock.json ./

package/templates/applications/builder-api/env.template

@@ -29,12 +29,19 @@ MISO_CLIENTSECRET=kv://builder-api-client-secretKeyVault
 
 # Internal: controller API for token validation (supports all miso-controller auth modes)
 MISO_CONTROLLER_URL=url://miso-controller-internal
+# Public: OAuth profile and remaining-step links shown to vendors (not Docker DNS)
+MISO_CONTROLLER_PUBLIC_URL=url://miso-controller-public
 
 # Internal: server-to-dataplane API (MCP execute, upload, governance)
 DATAPLANE_URL=url://dataplane-internal
+# Public: Slack/Teams/ChatGPT callbacks, packages, and portal remaining-step URLs
+DATAPLANE_PUBLIC_URL=url://dataplane-public
 
 DEFAULT_ENVIRONMENT=dev
 
+# Browser Origin allowlist for portal calls (CORS). url:// expands at resolve.
+ALLOWED_ORIGINS=http://localhost:*,url://host-public,url://host-private,url://dataplane-host-public,url://dataplane-host-private
+
 # COM-generated Enterprise MCP owner system (normal MCP execute — no dataplane adapter)
 ENTERPRISE_MCP_SYSTEM_KEY=enterprise-integration-lifecycle
 

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.31
+  version: 2.0.47
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).
@@ -71,14 +71,15 @@ build:
   envOutputPath: ../../.env # Copy to repo root for local dev
   language: python # Runtime language for template selection (typescript or python)
   # Dev reload: polling + watch /app/app only (avoids EMFILE on full repo bind-mount). See run_local.py, make af-reload.
-  reloadStart: WATCHFILES_FORCE_POLLING=1 uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001} --reload --reload-dir /app/app
+  reloadStart: WATCHFILES_FORCE_POLLING=1 uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001} --reload --reload-dir /app/app --timeout-graceful-shutdown 15
   # Pulled-image local compose (no bind-mount): drives `command` in generated docker-compose. Override for non-standard images (e.g. stub ACR tags).
-  imageRun: exec python -m uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001}
+  # Early ASGI (boot.api) binds PORT before heavy app.main import — Azure App Service warmup.
+  imageRun: exec python -m uvicorn boot.api:app --host 0.0.0.0 --port ${PORT:-3001}
   # Image policy (442.0): explicit Dockerfile COPY; worker/beat via python -m app.core.*
   # integration/ in image: only onboarding-catalog.json keys (+ deploy/application per key).
   worker: true
-  imageRunWorker: exec python -m app.core.celery_worker_main
-  imageRunBeat: exec python -m app.core.celery_beat_main
+  imageRunWorker: exec python -m boot.celery_worker
+  imageRunBeat: exec python -m boot.celery_beat
   # Optional one-shot before ANY long-running role (api/worker/beat). Run exactly once per
   # aifabrix run / Deployment — never once-per-container. Schema: application-schema build.deployJob.
   # Local: aifabrix run; remote: miso Deployment via miso-azure (not Docker on controller).

package/templates/applications/dataplane/env.template

@@ -21,7 +21,7 @@ AIFABRIX_PLATFORM_LANGUAGE=en
 # Docker default (no volume): use LOG_FILE_PATH=/app/logs/app.log (directory created in image).
 # Production with persistent logs: use /mnt/data/logs/app.log and mount a volume at /mnt/data.
 LOG_FILE_PATH=/mnt/data/logs/app.log
-# If true, run without Redis/Celery (single process). Set false on API/worker/beat in production.
+# If true, run without Celery (single process). Pair with build.worker: false so worker/beat are not started.
 LOCAL_MODE=false
 
 # Celery worker process tuning (dataplane-worker container; optional overrides)
@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.31
+VERSION=2.0.47
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5

package/templates/applications/dataplane/rbac.yaml

@@ -50,6 +50,11 @@ roles:
     description: "Discover business context for external systems via REST and MCP"
     groups: ["AI-Fabrix-External-System-Discoverers"]
 
+  - name: "Everyone"
+    value: "aifabrix-everyone"
+    description: "Authenticated-user consume access for Enterprise LLM and platform search (not a Role Assistant)"
+    groups: ["AI-Fabrix-Everyone"]
+
 permissions:
   # Credential management
   - name: "credential:create"
@@ -314,11 +319,11 @@ permissions:
   
   # Search operations
   - name: "document:search"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-deployment-admin", "aifabrix-compliance-admin", "aifabrix-developer", "aifabrix-observer"]
+    roles: ["aifabrix-everyone"]
     description: "Search documents"
   
   - name: "record:search"
-    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-deployment-admin", "aifabrix-compliance-admin", "aifabrix-developer", "aifabrix-observer"]
+    roles: ["aifabrix-everyone"]
     description: "Search records"
 
   - name: "external-system:discover"