@aifabrix/builder 2.55.0 → 2.56.0

package/lib/schema/infra.parameter.yaml

@@ -43,12 +43,48 @@ parameters:
     azure:
       vaultSecretName: postgres-passwordKeyVault
       notes: >-
-        Shared Docker Postgres admin password for local up-infra. This is separate from Keycloak’s
-        Azure Postgres admin secret `{appKey}-postgres-admin-password` in aifabrix-miso
-        infrastructure/bicep/modules/07_keycloak-webapp.bicep.
+        Local Docker Postgres admin password for up-infra. Azure application deployment does not
+        consume this name; use the system-scoped postgres-adminPassword entry for Azure.
+
+  - key: postgres-adminPassword
+    category: PostgreSQL
+    sensitive: true
+    valueSource: onboardingInput
+    requiredOnSystemOnboarding: true
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: postgres-adminPassword
+      legacyVaultSecretNames:
+        - '{serviceName}-postgres-admin-password'
+      notes: >-
+        Canonical Azure SDK PostgreSQL administrator password. The Marketplace alias
+        `{serviceName}-postgres-admin-password` is also accepted by the SDK, but Settings writes
+        this canonical name. Updating this stored value does not rotate the live PostgreSQL server.
+
+  - key: postgres-connectionString
+    category: PostgreSQL
+    sensitive: true
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: false
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: postgres-connectionString
+      notes: >-
+        Azure SDK administrator connection string for the default postgres database. This contains
+        the administrator username and password; application runtime databases use separate users.
 
   - key: redis-passwordKeyVault
-    scope: infra
+    category: Redis
+    sensitive: true
+    valueSource: optionalInput
+    requiredOnSystemOnboarding: false
+    scope: system
     generator:
       type: emptyAllowed
     ensureOn: [upInfra, resolveApp]
@@ -59,29 +95,151 @@ parameters:
         Set a value in secrets when using authenticated Redis or Azure.
 
   - key: redis-url
-    scope: infra
+    category: Redis
+    sensitive: true
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: true
+    scope: system
     generator:
       type: literal
       value: 'redis://${REDIS_HOST}:${REDIS_PORT}'
     ensureOn: [upInfra, resolveApp]
     azure:
-      notes: Not a Key Vault secret in local dev; URL built from infra endpoints in Azure.
+      notes: >-
+        Local up-infra resolves the REDIS_HOST/REDIS_PORT placeholders. Azure application deploy
+        must leave this key absent so the Azure SDK derives the rediss URL and credential.
+
+  - key: storage-keyKeyVault
+    category: Storage
+    sensitive: true
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: false
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: storage-keyKeyVault
+      notes: Azure SDK-derived primary storage account key.
+
+  - key: storage-connectionStringKeyVault
+    category: Storage
+    sensitive: true
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: false
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: storage-connectionStringKeyVault
+      notes: Azure SDK-derived storage account connection string.
+
+  - key: storage-account-key
+    category: Storage
+    sensitive: true
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: false
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: storage-account-key
+      notes: Marketplace Bicep storage-account key name retained for installed-stack diagnostics.
+
+  - key: acr-server
+    category: Container Registry
+    sensitive: false
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: false
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: acr-server
+      notes: Azure SDK-derived container registry login server.
+
+  - key: acr-username
+    category: Container Registry
+    sensitive: false
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: false
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: acr-username
+      notes: Azure SDK-derived container registry username when password authentication is enabled.
+
+  - key: acr-passwordKeyVault
+    category: Container Registry
+    sensitive: true
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: false
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: acr-passwordKeyVault
+      legacyVaultSecretNames:
+        - '{serviceName}-acr-registry-password'
+      notes: Azure SDK-derived container registry password when password authentication is enabled.
+
+  - key: frontdoor-url
+    category: Front Door
+    sensitive: false
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: false
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: frontdoor-url
+      notes: Azure Front Door public URL when materialized by the environment deployment.
+
+  - key: frontdoor-host
+    category: Front Door
+    sensitive: false
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: false
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: frontdoor-host
+      notes: Azure Front Door hostname when materialized by the environment deployment.
 
   - key: keycloak-admin-passwordKeyVault
-    scope: shared-service
+    category: Keycloak
+    sensitive: true
+    valueSource: legacyMigration
+    requiredOnSystemOnboarding: true
+    scope: system
     generator:
       type: literal
       value: '{{adminPassword}}'
     ensureOn: [upInfra, resolveApp]
     azure:
-      vaultSecretNamePattern: '{appKey}-keycloak-admin-password'
+      vaultSecretName: keycloak-admin-passwordKeyVault
+      legacyVaultSecretNames:
+        - '{serviceName}-keycloak-admin-password'
       notes: >-
         Local kv:// and secrets.local.yaml use the *KeyVault suffix. Miso install Bicep references
         SecretName `${prefix}-keycloak-admin-password` (no KeyVault suffix) in
         infrastructure/bicep/modules/05_miso-webapp.bicep and 07_keycloak-webapp.bicep.
 
   - key: keycloak-web-server-url
-    scope: shared-service
+    category: Keycloak
+    sensitive: false
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: true
+    scope: system
     generator:
       type: emptyString
     ensureOn: [upInfra, resolveApp]
@@ -92,7 +250,11 @@ parameters:
         Shipped miso-controller/dataplane env templates use url://keycloak-public instead of this kv:// for local resolve.
 
   - key: keycloak-internal-server-url
-    scope: shared-service
+    category: Keycloak
+    sensitive: false
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: true
+    scope: system
     generator:
       type: emptyString
     ensureOn: [upInfra, resolveApp]
@@ -102,9 +264,67 @@ parameters:
         Bicep (05_miso-webapp.bicep) uses unprefixed SecretName `keycloak-internal-server-url`.
         Shipped templates use url://keycloak-internal for local resolve.
 
+  - key: keycloak-vdir-public
+    category: Keycloak
+    sensitive: false
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: false
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: keycloak-vdir-public
+      notes: Public Keycloak virtual-directory path produced by the platform Bicep deployment.
+
+  - key: miso-controller-web-server-url
+    category: Platform URLs
+    sensitive: false
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: true
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: miso-controller-web-server-url
+      notes: Public Miso Controller URL produced by the platform Bicep deployment.
+
+  - key: miso-controller-internal-server-url
+    category: Platform URLs
+    sensitive: false
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: true
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: miso-controller-internal-server-url
+      legacyVaultSecretNames:
+        - miso-controller-internal-server-urlKeyVault
+      notes: Internal Miso Controller URL under the direct manifest name.
+
+  - key: miso-controller-vdir-public
+    category: Platform URLs
+    sensitive: false
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: true
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: miso-controller-vdir-public
+      notes: Public Miso Controller virtual-directory path produced by the platform Bicep deployment.
+
   # When env.template uses kv://keycloak-client-idKeyVault (multi-realm / dev naming).
   - key: keycloak-client-idKeyVault
-    scope: shared-service
+    category: Keycloak
+    sensitive: false
+    valueSource: generated
+    requiredOnSystemOnboarding: true
+    scope: system
     generator:
       type: literal
       value: 'miso-controller-miso-keycloak'
@@ -114,7 +334,11 @@ parameters:
         Default OAuth client id for controller ↔ Keycloak when resolved from secrets; override per environment.
 
   - key: keycloak-client-secretKeyVault
-    scope: shared-service
+    category: Keycloak
+    sensitive: true
+    valueSource: generated
+    requiredOnSystemOnboarding: true
+    scope: system
     generator:
       type: randomBytes32
     ensureOn: [upInfra, resolveApp]
@@ -125,7 +349,11 @@ parameters:
   # Miso-controller Entra ID onboarding (vendor multi-tenant app). Empty client/callback values
   # allow local resolve and start-dev; set real values before Entra admin-consent flows.
   - key: entra-callback-state-secret
-    scope: shared-service
+    category: Microsoft Entra ID
+    sensitive: true
+    valueSource: generated
+    requiredOnSystemOnboarding: true
+    scope: system
     generator:
       type: randomBytes32
     ensureOn: [upInfra, resolveApp]
@@ -135,7 +363,11 @@ parameters:
         maps to ENTRA_CALLBACK_STATE_SECRET in miso-controller env.template.
 
   - key: entra-callback-uri
-    scope: shared-service
+    category: Microsoft Entra ID
+    sensitive: false
+    valueSource: optionalInput
+    requiredOnSystemOnboarding: false
+    scope: system
     generator:
       type: emptyString
     ensureOn: [upInfra, resolveApp]
@@ -145,7 +377,11 @@ parameters:
         empty locally until Mori URL is configured.
 
   - key: entra-client-idKeyVault
-    scope: shared-service
+    category: Microsoft Entra ID
+    sensitive: false
+    valueSource: optionalInput
+    requiredOnSystemOnboarding: false
+    scope: system
     generator:
       type: emptyString
     ensureOn: [upInfra, resolveApp]
@@ -154,18 +390,28 @@ parameters:
         Vendor Entra app client id (ENTRA_ID_CLIENT_ID); empty for local dev without Entra flows.
 
   - key: entra-client-secretKeyVault
-    scope: shared-service
+    category: Microsoft Entra ID
+    sensitive: true
+    valueSource: optionalInput
+    requiredOnSystemOnboarding: false
+    scope: system
     generator:
       type: emptyString
     ensureOn: [upInfra, resolveApp]
     azure:
+      legacyVaultSecretNames:
+        - entra-vendor-client-secret
       notes: >-
         Vendor Entra app client secret (ENTRA_ID_CLIENT_SECRET); empty for local dev without Entra flows.
 
   # Keycloak events: webhook signature secret used by miso-controller (KEYCLOAK_EVENTS_SECRET).
   # This must exist on first boot because up-platform runs containers from templates (no prior resolve).
   - key: keycloak-events-secretKeyVault
-    scope: shared-service
+    category: Keycloak
+    sensitive: true
+    valueSource: generated
+    requiredOnSystemOnboarding: true
+    scope: system
     generator:
       type: randomBytes32
     ensureOn: [upInfra, resolveApp]
@@ -174,7 +420,11 @@ parameters:
         Shared secret for Keycloak event signature verification. Generated on first ensure for local bootstrap.
 
   - key: keycloak-default-passwordKeyVault
-    scope: shared-service
+    category: Keycloak
+    sensitive: true
+    valueSource: generated
+    requiredOnSystemOnboarding: true
+    scope: system
     generator:
       type: literal
       value: '{{userPassword}}'
@@ -184,41 +434,48 @@ parameters:
         Keycloak default-user password for local/bootstrap; explicit literal so it is not randomBytes32.
 
   - key: miso-controller-secrets-encryptionKeyVault
+    ownerAppKey: miso-controller
     scope: app
     generator:
       type: randomBytes32
     ensureOn: [upInfra, resolveApp]
     azure:
-      vaultSecretNamePattern: '{appKey}-secrets-encryptionKeyVault'
+      vaultSecretName: miso-controller-secrets-encryptionKeyVault
+      legacyVaultSecretNames:
+        - '{serviceName}-encryption-keyKeyVault'
       notes: >-
         32-byte secret as base64; generated on first ensure. Rotate in production.
 
   # Local kv:// name matches miso-controller env.template (JWT_SECRET); not the generic {appKey}-secrets-jwtKeyVault Azure name.
   - key: miso-controller-jwt-secretKeyVault
+    ownerAppKey: miso-controller
     scope: app
     generator:
       type: randomBytes32
     ensureOn: [upInfra, resolveApp]
     azure:
-      vaultSecretNamePattern: '{appKey}-secrets-jwtKeyVault'
+      vaultSecretName: miso-controller-jwt-secretKeyVault
+      legacyVaultSecretNames:
+        - '{serviceName}-secrets-jwtKeyVault'
       notes: >-
         JWT signing secret; generated on first ensure. Azure Bicep typically uses `${prefix}-secrets-jwtKeyVault`.
 
-  # LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault — local default skips Mori/JWT license checks.
-  # Controller ignores DEVELOPMENT when DEPLOYMENT=azure.
+  # LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault — empty means Community edition.
+  # Set only to a real signed offline licence JWT.
   - key: miso-controller-jwt-licenseKeyVault
+    ownerAppKey: miso-controller
     scope: app
     generator:
-      type: literal
-      value: 'DEVELOPMENT'
+      type: emptyString
     ensureOn: [upInfra, resolveApp]
     azure:
       notes: >-
-        Local/dev default DEVELOPMENT disables license validation (no Mori/JWT required).
-        Ignored when DEPLOYMENT=azure. Override with a real offline license JWT (or empty for Mori) in non-dev.
+        Empty means the unlicensed Community edition (DEV, size S, shared resources).
+        Override only with a real signed offline license JWT.
 
   # Exact entry so this is not caught by *KeyVault → randomBytes32 (invalid email).
   - key: miso-controller-admin-emailKeyVault
+    ownerAppKey: miso-controller
     scope: app
     generator:
       type: literal
@@ -229,19 +486,26 @@ parameters:
 
   # Local first-time install / onboarding default (change in production).
   - key: miso-controller-admin-passwordKeyVault
+    ownerAppKey: miso-controller
     scope: app
     generator:
       type: literal
       value: '{{adminPassword}}'
     ensureOn: [upInfra, resolveApp]
     azure:
+      legacyVaultSecretNames:
+        - '{serviceName}-onboarding-admin-password'
       notes: >-
         Matches controller onboarding default; override in secrets for non-dev.
         Same secret backs ONBOARDING_ADMIN_PASSWORD and MISO_ADMIN_PASSWORD in env.template.
 
   # DEPLOYMENT=azure only; local/docker leave empty (do not generate random placeholders).
   - key: azure-subscription-idKeyVault
-    scope: infra
+    category: Azure
+    sensitive: false
+    valueSource: onboardingInput
+    requiredOnSystemOnboarding: false
+    scope: system
     generator:
       type: emptyString
     ensureOn: [upInfra, resolveApp]
@@ -249,7 +513,11 @@ parameters:
       notes: Production Key Vault / app settings; empty locally.
 
   - key: azure-tenant-idKeyVault
-    scope: infra
+    category: Azure
+    sensitive: false
+    valueSource: onboardingInput
+    requiredOnSystemOnboarding: false
+    scope: system
     generator:
       type: emptyString
     ensureOn: [upInfra, resolveApp]
@@ -257,7 +525,11 @@ parameters:
       notes: Production only; empty locally.
 
   - key: azure-service-nameKeyVault
-    scope: infra
+    category: Azure
+    sensitive: false
+    valueSource: onboardingInput
+    requiredOnSystemOnboarding: false
+    scope: system
     generator:
       type: emptyString
     ensureOn: [upInfra, resolveApp]
@@ -270,7 +542,7 @@ parameters:
       type: emptyString
     ensureOn: [upInfra, resolveApp]
     azure:
-      notes: Production only; empty locally.
+      notes: Optional service-principal override for local/tooling use; Azure App Service uses managed identity.
 
   - key: azure-client-secretKeyVault
     scope: infra
@@ -278,7 +550,7 @@ parameters:
       type: emptyString
     ensureOn: [upInfra, resolveApp]
     azure:
-      notes: Production only; empty locally.
+      notes: Optional service-principal override for local/tooling use; Azure App Service uses managed identity.
 
   # Optional private npm; local scaffold leaves empty.
   - key: BASH_NPM_TOKEN
@@ -300,16 +572,20 @@ parameters:
 
   # Default client id for controller app in local multi-service layout; override after register if needed.
   - key: miso-controller-client-idKeyVault
+    ownerAppKey: miso-controller
     scope: app
     generator:
       type: literal
       value: 'miso-controller-miso-miso-controller'
     ensureOn: [upInfra, resolveApp]
     azure:
+      legacyVaultSecretNames:
+        - '{serviceName}-miso-clientIdKeyVault'
       notes: >-
         Per-app OAuth client id from controller registration; literal default matches local Keycloak client naming.
 
   - key: miso-controller-client-secretKeyVault
+    ownerAppKey: miso-controller
     scope: app
     generator:
       type: randomBytes32
@@ -321,6 +597,7 @@ parameters:
 
   # Dataplane ↔ controller OAuth (builder/dataplane env.template MISO_CLIENTID / MISO_CLIENTSECRET).
   - key: dataplane-client-idKeyVault
+    ownerAppKey: dataplane
     scope: app
     generator:
       type: literal
@@ -332,6 +609,7 @@ parameters:
         (override for environments such as miso-controller-dev-dataplane).
 
   - key: dataplane-client-secretKeyVault
+    ownerAppKey: dataplane
     scope: app
     generator:
       type: randomBytes32
@@ -340,10 +618,14 @@ parameters:
       vaultSecretName: dataplane-client-secretKeyVault
       notes: Per-app OAuth client secret for dataplane; generated on first ensure.
 
-  # Mori / telemetry: optional locally (LICENSE_JWT via miso-controller-jwt-licenseKeyVault=DEVELOPMENT skips Mori).
+  # Mori / telemetry is optional for an unlicensed Community installation.
   # MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault — local default apiKey.
   - key: mori-controller-auth-methodKeyVault
-    scope: infra
+    category: Mori
+    sensitive: false
+    valueSource: optionalInput
+    requiredOnSystemOnboarding: false
+    scope: system
     generator:
       type: literal
       value: 'apiKey'
@@ -353,7 +635,11 @@ parameters:
         Local/dev default apiKey. Override when using Mori basic auth or other methods.
 
   - key: mori-controller-api-keyKeyVault
-    scope: infra
+    category: Mori
+    sensitive: true
+    valueSource: optionalInput
+    requiredOnSystemOnboarding: false
+    scope: system
     generator:
       type: emptyString
     ensureOn: [upInfra, resolveApp]
@@ -361,7 +647,11 @@ parameters:
       notes: Empty locally; set when calling Mori with API key auth.
 
   - key: mori-controller-basic-usernameKeyVault
-    scope: infra
+    category: Mori
+    sensitive: false
+    valueSource: optionalInput
+    requiredOnSystemOnboarding: false
+    scope: system
     generator:
       type: emptyString
     ensureOn: [upInfra, resolveApp]
@@ -369,7 +659,11 @@ parameters:
       notes: Empty locally; Mori basic auth optional.
 
   - key: mori-controller-basic-passwordKeyVault
-    scope: infra
+    category: Mori
+    sensitive: true
+    valueSource: optionalInput
+    requiredOnSystemOnboarding: false
+    scope: system
     generator:
       type: emptyString
     ensureOn: [upInfra, resolveApp]
@@ -377,7 +671,11 @@ parameters:
       notes: Empty locally; Mori basic auth optional.
 
   - key: appinsights-connectionStringKeyVault
-    scope: infra
+    category: Observability
+    sensitive: true
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: false
+    scope: system
     generator:
       type: emptyString
     ensureOn: [upInfra, resolveApp]
@@ -386,14 +684,70 @@ parameters:
       notes: >-
         Aligns with keyvault.md / Azure naming (appinsights.connectionStringKeyVault). Empty locally until set from Azure Portal.
 
+  - key: appinsights-keyKeyVault
+    category: Observability
+    sensitive: true
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: false
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: appinsights-keyKeyVault
+      notes: Azure SDK-derived Application Insights instrumentation key.
+
+  - key: loganalytics-workspace-id
+    category: Observability
+    sensitive: false
+    valueSource: providerOutput
+    requiredOnSystemOnboarding: false
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: loganalytics-workspace-id
+      notes: Azure SDK-derived Log Analytics workspace customer identifier.
+
+  - key: azureopenai-endpoint
+    category: Azure OpenAI
+    sensitive: false
+    valueSource: optionalInput
+    requiredOnSystemOnboarding: false
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: azureopenai-endpoint
+      notes: Azure OpenAI endpoint produced by the environment infrastructure deployment.
+
+  - key: azureopenai-apikey
+    category: Azure OpenAI
+    sensitive: true
+    valueSource: optionalInput
+    requiredOnSystemOnboarding: false
+    scope: system
+    generator:
+      type: emptyString
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: azureopenai-apikey
+      notes: Azure OpenAI API key produced by the environment infrastructure deployment.
+
   # Dataplane builder/dataplane env.template (AI/LLM); optional until OpenAI or Azure OpenAI is configured.
   - key: secrets-openaiApiKeyVault
-    scope: app
+    category: OpenAI
+    sensitive: true
+    valueSource: optionalInput
+    requiredOnSystemOnboarding: false
+    scope: system
     generator:
       type: emptyString
-    ensureOn: [upInfra, resolveApp]
+    ensureOn: [resolveApp]
     azure:
-      notes: Empty until set; user-supplied OpenAI API key (not auto-generated).
+      notes: Optional shared OpenAI API key; empty until supplied and never auto-generated.
 
   - key: azure-openaiapi-urlKeyVault
     scope: app
@@ -411,6 +765,31 @@ parameters:
     azure:
       notes: Empty until set; user-supplied Azure OpenAI API key (not auto-generated).
 
+  # Dataplane RS256 signing identity. The two rows are generated as one linked pair.
+  - key: secrets-certificatePrivateKeyVault
+    ownerAppKey: dataplane
+    scope: app
+    generator:
+      type: rsaKeyPair
+      pairId: dataplane-signing
+      part: private
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: secrets-certificatePrivateKeyVault
+      notes: PKCS#8 PEM private key generated with the matching public key.
+
+  - key: secrets-certificatePublicKeyVault
+    ownerAppKey: dataplane
+    scope: app
+    generator:
+      type: rsaKeyPair
+      pairId: dataplane-signing
+      part: public
+    ensureOn: [resolveApp]
+    azure:
+      vaultSecretName: secrets-certificatePublicKeyVault
+      notes: SPKI PEM public key derived from the linked private key.
+
   # Legacy unprefixed name (scaffold / old env.template); prefer *KeyVault suffix or {appKey}-secrets-apiKeyVault (keyvault.md).
   - key: api-key
     scope: app
@@ -423,13 +802,26 @@ parameters:
 
   # Legacy unprefixed name; prefer kv://{appKey}-secrets-apiKeyVault in env.template (keyvault.md secrets.apiKeyVault).
   - key: miso-controller-secrets-apiKeyVault
+    scope: infra
+    generator:
+      type: emptyAllowed
+    ensureOn: [upInfra]
+    azure:
+      notes: >-
+        Optional local testing/development bearer bypass. A supplied local value is resolved; when absent,
+        local and Azure application deployment resolve it as empty and do not fail.
+
+  - key: mori-callback-api-keyKeyVault
+    ownerAppKey: miso-controller
     scope: app
     generator:
       type: randomBytes32
-    ensureOn: [upInfra, resolveApp]
+    ensureOn: [resolveApp]
     azure:
-      notes: >-
-        Prefer {appKey}-secrets-apiKeyVault locally; dataplane shares miso-controller's entry for pipeline Bearer bypass.
+      vaultSecretName: mori-callback-api-keyKeyVault
+      legacyVaultSecretNames:
+        - marketplace-mori-callback-api-key
+      notes: Miso Controller callback credential; generated only when its resolved manifest requires it.
 
   # App semver when env.template / conversion yields kv://version (local secrets backfill).
   - key: version
@@ -442,15 +834,57 @@ parameters:
       notes: >-
         Default application version for kv://version; override in secrets when needed.
 
-  # Per-index database secrets (local names). Index must match requires.databases order in application.yaml.
+  # Exact Miso Controller rows retain Marketplace infrastructure-name aliases.
+  - key: databases-miso-controller-0-urlKeyVault
+    ownerAppKey: miso-controller
+    scope: app
+    generator:
+      type: databaseUrl
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      vaultSecretName: databases-miso-controller-0-urlKeyVault
+      legacyVaultSecretNames:
+        - '{serviceName}-databases-0-urlKeyVault'
+
+  - key: databases-miso-controller-0-passwordKeyVault
+    ownerAppKey: miso-controller
+    scope: app
+    generator:
+      type: databasePassword
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      vaultSecretName: databases-miso-controller-0-passwordKeyVault
+
+  - key: databases-miso-controller-1-urlKeyVault
+    ownerAppKey: miso-controller
+    scope: app
+    generator:
+      type: databaseUrl
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      vaultSecretName: databases-miso-controller-1-urlKeyVault
+      legacyVaultSecretNames:
+        - '{serviceName}-databases-1-urlKeyVault'
+
+  - key: databases-miso-controller-1-passwordKeyVault
+    ownerAppKey: miso-controller
+    scope: app
+    generator:
+      type: databasePassword
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      vaultSecretName: databases-miso-controller-1-passwordKeyVault
+
+  # Per-index database secrets. Index must match requires.databases order in application.yaml.
   - keyPattern: '^databases-[a-z0-9-]+-\d+-urlKeyVault$'
     scope: app
     generator:
       type: databaseUrl
     ensureOn: [upInfra, resolveApp]
     azure:
-      vaultSecretNamePattern: '{appKey}-databases-{index}-urlKeyVault'
-      notes: Azure vault secret name prefixes app key; local kv:// key has no app prefix.
+      legacyVaultSecretNames:
+        - '{appKey}-databases-{index}-urlKeyVault'
+      notes: The direct manifest key is canonical; the app-prefixed form is migration-only.
 
   - keyPattern: '^databases-[a-z0-9-]+-\d+-passwordKeyVault$'
     scope: app
@@ -458,7 +892,8 @@ parameters:
       type: databasePassword
     ensureOn: [upInfra, resolveApp]
     azure:
-      vaultSecretNamePattern: '{appKey}-databases-{index}-passwordKeyVault'
+      legacyVaultSecretNames:
+        - '{appKey}-databases-{index}-passwordKeyVault'
 
   # Keycloak and other *-url keys (non-database).
   - keyPattern: '^keycloak-.+-url$'