@aifabrix/builder 2.55.2 → 2.56.0

package/lib/utils/qualification-poll-ui.js

@@ -0,0 +1,136 @@
+/**
+ * @fileoverview TTY ora spinner + throttled non-TTY lines for qualification job polling.
+ * Mirrors host-ops-poll-ui.js's presentation pattern (plan 191.0 task 1).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('./logger');
+
+const SILENT_POLL_HANDLERS = {
+  onPollProgress: () => {},
+  onTransientError: () => {},
+  finish: () => {}
+};
+
+const NON_TTY_THROTTLE_MS = 5000;
+
+const HUMAN_STEP_LABELS = Object.freeze({
+  stageCandidate: 'Uploading configuration',
+  gateOperations: 'Checking operations',
+  gateTrust: 'Checking trust',
+  gateGovernance: 'Checking governance',
+  sealCertificate: 'Finalizing upload'
+});
+
+function shouldUseQualificationPollSpinner() {
+  return Boolean(process && process.stdout && process.stdout.isTTY);
+}
+
+/**
+ * @param {Object} job - PublishJobStatusResponse-shaped data ({ state, steps })
+ * @returns {string}
+ */
+function currentQualificationStepLabel(job, options = {}) {
+  if (!job || !Array.isArray(job.steps) || job.steps.length === 0) {
+    return 'Preparing upload';
+  }
+  const running = job.steps.find((step) => step.status === 'running');
+  if (running) return qualificationStepLabel(running, 'running', options);
+  const failed = job.steps.find((step) => step.status === 'failed');
+  if (failed) return qualificationStepLabel(failed, 'failed', options);
+  const pending = job.steps.find((step) => step.status === 'pending');
+  if (pending) return qualificationStepLabel(pending, 'pending', options);
+  return 'Upload complete';
+}
+
+function qualificationStepLabel(step, _status, _options) {
+  return HUMAN_STEP_LABELS[step.key] || 'Processing upload';
+}
+
+/**
+ * @param {string} jobId
+ * @param {Object|null} job
+ * @param {number} elapsedMs
+ * @param {string} [transientNote]
+ * @returns {string}
+ */
+function buildQualificationPollLine(jobId, job, elapsedMs, transientNote, options = {}) {
+  const seconds = Math.max(0, Math.round(elapsedMs / 1000));
+  const note = transientNote ? ` — ${transientNote}` : '';
+  if (options.verbose === true) {
+    return `Upload (job ${jobId}): ${currentQualificationStepLabel(job, options)} — ${seconds}s elapsed${note}`;
+  }
+  return `${currentQualificationStepLabel(job, options)} — ${seconds}s elapsed${note}`;
+}
+
+function createSpinnerQualificationPollHandlers(jobId, startedAt, options) {
+  const ora = require('ora');
+  const spinner = ora({
+    text: buildQualificationPollLine(jobId, null, 0, undefined, options),
+    spinner: 'dots'
+  }).start();
+  return {
+    onPollProgress: (job) => {
+      spinner.text = buildQualificationPollLine(jobId, job, Date.now() - startedAt, undefined, options);
+    },
+    onTransientError: (status, elapsedMs) => {
+      spinner.text = buildQualificationPollLine(
+        jobId,
+        null,
+        elapsedMs,
+        'service temporarily unavailable, retrying',
+        options
+      );
+    },
+    finish: () => spinner.stop()
+  };
+}
+
+function createNonTtyQualificationPollHandlers(jobId, startedAt, options) {
+  let lastLogAt = 0;
+  return {
+    onPollProgress: (job) => {
+      const now = Date.now();
+      if (now - lastLogAt < NON_TTY_THROTTLE_MS) {
+        return;
+      }
+      lastLogAt = now;
+      logger.log(chalk.gray(`  ${buildQualificationPollLine(jobId, job, now - startedAt, undefined, options)}`));
+    },
+    onTransientError: (status, elapsedMs) => {
+      logger.log(
+        chalk.gray(
+          `  ${buildQualificationPollLine(jobId, null, elapsedMs, 'service temporarily unavailable, retrying', options)}`
+        )
+      );
+    },
+    finish: () => {}
+  };
+}
+
+/**
+ * @param {string} jobId
+ * @param {{ startedAt?: number, silent?: boolean, verbose?: boolean }} [options]
+ * @returns {{ onPollProgress: Function, onTransientError: Function, finish: () => void }}
+ */
+function createQualificationPollHandlers(jobId, options = {}) {
+  if (options.silent === true) {
+    return SILENT_POLL_HANDLERS;
+  }
+  const startedAt = options.startedAt || Date.now();
+  if (shouldUseQualificationPollSpinner()) {
+    return createSpinnerQualificationPollHandlers(jobId, startedAt, options);
+  }
+  return createNonTtyQualificationPollHandlers(jobId, startedAt, options);
+}
+
+module.exports = {
+  currentQualificationStepLabel,
+  buildQualificationPollLine,
+  createQualificationPollHandlers,
+  shouldUseQualificationPollSpinner
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.55.2",
+  "version": "2.56.0",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {
@@ -21,6 +21,7 @@
     "dev-reload": "node scripts/pnpm/dev-reload.mjs",
     "dev-build": "node scripts/pnpm/af.mjs dev-build",
     "dev-promote": "node scripts/pnpm/af.mjs dev-promote",
+    "dev-deploy": "node scripts/pnpm/dev-deploy.mjs",
     "af": "node scripts/pnpm/af.mjs",
     "check-quiet": "node scripts/pnpm/check-quiet.mjs",
     "check": "npm run lint && npm run test",
@@ -125,7 +126,7 @@
     }
   },
   "dependencies": {
-    "@aifabrix/miso-client": "^4.19.0",
+    "@aifabrix/miso-client": "4.22.4",
     "adm-zip": "^0.6.0",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/templates/applications/builder-api/env.template

@@ -37,6 +37,10 @@ DATAPLANE_URL=url://dataplane-internal
 # Public: Slack/Teams/ChatGPT callbacks, packages, and portal remaining-step URLs
 DATAPLANE_PUBLIC_URL=url://dataplane-public
 
+# Self URLs: internal service calls and public links generated by Builder API
+BUILDER_API_URL=url://internal
+BUILDER_API_PUBLIC_URL=url://public
+
 DEFAULT_ENVIRONMENT=dev
 
 # Browser Origin allowlist for portal calls (CORS). url:// expands at resolve.

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.65
+  version: 2.0.68
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).

package/templates/applications/dataplane/env.template

@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.65
+VERSION=2.0.68
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5

package/templates/applications/keycloak/Dockerfile

@@ -1,29 +1,34 @@
 # Keycloak Identity and Access Management with Custom Themes
-# Official 26.7.2 distro + experimental CIMD. Does not compile Keycloak from source.
+# Official 26.7.3 distro + experimental CIMD. Does not compile Keycloak from source.
 # One class is recompiled against this image's jars:
 # - PR 51235: CIMD parse ignores unknown JSON fields (ChatGPT client.json)
 # - #50362: strip jwt-bearer (and other confidential-only grants) on public CIMD
 # 26.7 advertises token_endpoint_auth_methods_supported "none" for Claude CIMD.
 
-FROM quay.io/keycloak/keycloak:26.7.2 AS keycloak-base
+FROM quay.io/keycloak/keycloak:26.7.3 AS keycloak-base
 
 FROM eclipse-temurin:21-jdk-jammy AS cimd-patch
 COPY --from=keycloak-base /opt/keycloak/lib/lib/main /opt/kc-jars/main
 COPY --from=keycloak-base /opt/keycloak/lib/lib/boot /opt/kc-jars/boot
 COPY cimd-lenient-parse/AbstractClientIdMetadataDocumentExecutor.java \
      /tmp/src/org/keycloak/protocol/oauth2/cimd/clientpolicy/executor/AbstractClientIdMetadataDocumentExecutor.java
+COPY mori-email-sender/com /tmp/src/com
+COPY mori-email-sender/META-INF /tmp/mori-provider/META-INF
 RUN mkdir -p /tmp/classes \
  && find /opt/kc-jars -name '*.jar' | paste -sd: - > /tmp/cp.txt \
  && { \
       echo --release; echo 21; echo -cp; cat /tmp/cp.txt; echo -d; echo /tmp/classes; \
       echo /tmp/src/org/keycloak/protocol/oauth2/cimd/clientpolicy/executor/AbstractClientIdMetadataDocumentExecutor.java; \
+      find /tmp/src/com -name '*.java'; \
     } > /tmp/javac.args \
  && javac @/tmp/javac.args \
  && SERVICES_JAR=$(ls /opt/kc-jars/main/org.keycloak.keycloak-services-*.jar) \
  && cp "$SERVICES_JAR" /tmp/keycloak-services-patched.jar \
- && jar uf /tmp/keycloak-services-patched.jar -C /tmp/classes .
+ && jar uf /tmp/keycloak-services-patched.jar -C /tmp/classes org/keycloak \
+ && cp -r /tmp/classes/com /tmp/mori-provider/ \
+ && jar cf /tmp/mori-email-sender.jar -C /tmp/mori-provider .
 
-FROM quay.io/keycloak/keycloak:26.7.2
+FROM quay.io/keycloak/keycloak:26.7.3
 
 # Set working directory
 WORKDIR /opt/keycloak
@@ -31,6 +36,7 @@ WORKDIR /opt/keycloak
 # Copy custom themes from share directory (only if themes/ folder exists)
 USER root
 COPY --from=cimd-patch /tmp/keycloak-services-patched.jar /tmp/keycloak-services-patched.jar
+COPY --from=cimd-patch /tmp/mori-email-sender.jar /opt/keycloak/providers/mori-email-sender.jar
 RUN SERVICES_JAR=$(ls /opt/keycloak/lib/lib/main/org.keycloak.keycloak-services-*.jar) \
  && cp /tmp/keycloak-services-patched.jar "$SERVICES_JAR" \
  && rm /tmp/keycloak-services-patched.jar
@@ -50,7 +56,8 @@ RUN if [ -d "/tmp/build-context/themes" ] && [ "$(ls -A /tmp/build-context/theme
 # Build Keycloak with health checks enabled (similar to Keycloak 24.0)
 # This enables the /health, /health/live, /health/ready, and /health/started endpoints
 # Expose health endpoints on main HTTP port (like 24.0) instead of management port
-RUN /opt/keycloak/bin/kc.sh build --health-enabled=true --http-management-health-enabled=false --features=cimd
+RUN /opt/keycloak/bin/kc.sh build --health-enabled=true --http-management-health-enabled=false \
+    --features=cimd --spi-email-sender--provider=mori
 
 # Switch back to keycloak user
 USER keycloak

package/templates/applications/keycloak/application.yaml

@@ -4,12 +4,12 @@ app:
   displayName: 'AI Fabrix Keycloak'
   description: 'Identity and Access Management'
   type: webapp
-  version: '26.7.2'
+  version: '26.7.3-aifabrix.1'
 
 # Image Configuration
 image:
   name: aifabrix/keycloak
-  tag: 'latest'
+  tag: '26.7.3-aifabrix.1'
   registry: aifabrixacr.azurecr.io
   registryMode: external
 

package/templates/applications/keycloak/cimd-lenient-parse/AbstractClientIdMetadataDocumentExecutor.java

@@ -1,6 +1,6 @@
 package org.keycloak.protocol.oauth2.cimd.clientpolicy.executor;
 
-// AI Fabrix Keycloak image patch on 26.7.2 (not a Keycloak source build):
+// AI Fabrix Keycloak image patch on 26.7.3 (not a Keycloak source build):
 // 1) PR 51235 — ignore unknown CIMD JSON fields (ChatGPT client.json).
 // 2) keycloak#50362 / PR 50411 idea — drop confidential-only grants (jwt-bearer)
 //    from public CIMD metadata so Claude hosted Connect can register.
@@ -848,7 +848,7 @@ public abstract class AbstractClientIdMetadataDocumentExecutor<CONFIG extends Ab
 
     /**
      * Grant types Keycloak's DescriptionConverter refuses on a public client.
-     * Same set as Keycloak PR 50411 (not in 26.7.2).
+     * Same set as Keycloak PR 50411 (not in 26.7.3).
      */
     protected static final Set<String> CONFIDENTIAL_ONLY_GRANT_TYPES = new LinkedHashSet<>(Arrays.asList(
             OAuth2Constants.CLIENT_CREDENTIALS,
@@ -873,7 +873,7 @@ public abstract class AbstractClientIdMetadataDocumentExecutor<CONFIG extends Ab
 
     /**
      * RFC 7591 §3.2.1 lets the AS replace requested grant_types. Claude CIMD is public
-     * (`none`) plus jwt-bearer; Keycloak 26.7.2 rejects that combination (#50362).
+     * (`none`) plus jwt-bearer; Keycloak 26.7.3 rejects that combination (#50362).
      */
     protected void stripConfidentialOnlyGrantsForPublicClient(OIDCClientRepresentation oidcClient) {
         if (!"none".equals(oidcClient.getTokenEndpointAuthMethod())) {

package/templates/applications/keycloak/cimd-lenient-parse/SOURCE.md

@@ -1,19 +1,19 @@
-# CIMD image patch (Keycloak 26.7.2)
+# CIMD image patch (Keycloak 26.7.3)
 
-This directory is **not** a Keycloak source build. `aifabrix build keycloak` still starts from `quay.io/keycloak/keycloak:26.7.2`. A Docker stage recompiles this one class against that image’s jars and injects it into `org.keycloak.keycloak-services-*.jar` before `kc.sh build`.
+This directory is **not** a Keycloak source build. `aifabrix build keycloak` still starts from `quay.io/keycloak/keycloak:26.7.3`. A Docker stage recompiles this one class against that image’s jars and injects it into `org.keycloak.keycloak-services-*.jar` before `kc.sh build`.
 
-Upstream file: `services/.../AbstractClientIdMetadataDocumentExecutor.java` @ tag `26.7.2` (Apache 2.0).
+Upstream file: `services/.../AbstractClientIdMetadataDocumentExecutor.java` @ tag `26.7.3` (Apache 2.0).
 
 ## Lenient parse (ChatGPT)
 
 ChatGPT’s CIMD `client.json` includes extra fields (for example `token_endpoint_auth_methods_supported`) that Keycloak 26.7.x rejects because CIMD parse uses Jackson `FAIL_ON_UNKNOWN_PROPERTIES`.
 
-- [keycloak/keycloak#51235](https://github.com/keycloak/keycloak/pull/51235) (open; not in 26.7.2)
+- [keycloak/keycloak#51235](https://github.com/keycloak/keycloak/pull/51235) (open; not in 26.7.3)
 
 ## Public client + jwt-bearer (Claude hosted)
 
-Claude’s CIMD is a public client (`token_endpoint_auth_method: none`) that also lists `urn:ietf:params:oauth:grant-type:jwt-bearer`. Keycloak 26.7.2 then fails authorize with `JWT authorization grant cannot be enabled in a public client` ([#50362](https://github.com/keycloak/keycloak/issues/50362)). Official [PR 50411](https://github.com/keycloak/keycloak/pull/50411) is still a draft and defaults the filter **off**. This image always drops confidential-only grants on public CIMD metadata (RFC 7591 §3.2.1), which is enough for hosted Claude Connect (authorization_code). It does **not** implement public-client JWT Authorization Grant / EMA.
+Claude’s CIMD is a public client (`token_endpoint_auth_method: none`) that also lists `urn:ietf:params:oauth:grant-type:jwt-bearer`. Keycloak 26.7.3 then fails authorize with `JWT authorization grant cannot be enabled in a public client` ([#50362](https://github.com/keycloak/keycloak/issues/50362)). Official [PR 50411](https://github.com/keycloak/keycloak/pull/50411) is still a draft and defaults the filter **off**. This image always drops confidential-only grants on public CIMD metadata (RFC 7591 §3.2.1), which is enough for hosted Claude Connect (authorization_code). It does **not** implement public-client JWT Authorization Grant / EMA.
 
-26.7.2 already advertises `token_endpoint_auth_methods_supported` `"none"` when `--features=cimd`.
+26.7.3 already advertises `token_endpoint_auth_methods_supported` `"none"` when `--features=cimd`.
 
 Drop this patched class when the consumed `quay.io` tag includes both behaviors.

package/templates/applications/keycloak/env.template

@@ -55,7 +55,7 @@ KC_HEALTH_ENABLED=true
 KC_HTTP_MANAGEMENT_HEALTH_ENABLED=false
 # Single-instance: use local cache so /health/ready passes (avoids Infinispan cluster check)
 KC_CACHE=local
-# Runtime features. Include cimd so Keycloak 26.7.2 advertises Client ID Metadata
+# Runtime features. Include cimd so Keycloak 26.7.3 advertises Client ID Metadata
 # Documents. preview alone triggers a start-time rebuild that drops cimd.
 KC_FEATURES=preview,cimd
 
@@ -67,6 +67,18 @@ KC_FEATURES=preview,cimd
 MISO_CLIENTID=kv://keycloak-client-idKeyVault
 MISO_CLIENTSECRET=kv://keycloak-client-secretKeyVault
 
+# =============================================================================
+# MANAGED ACTION EMAIL (Keycloak -> Mori REST)
+# =============================================================================
+# The custom EmailSenderProvider relays Keycloak-rendered signed action emails to
+# Mori. It never receives ACS credentials and never sends the action URL to Miso.
+# Installation must supply the Mori environment returned during registration.
+MORI_BASE_URL=kv://mori-controller-web-server-url
+MORI_ENVIRONMENT_ID=kv://mori-controller-environment-idKeyVault
+MORI_API_KEY=kv://mori-controller-api-keyKeyVault
+MORI_NOTIFICATION_TIMEOUT_MS=10000
+MORI_NOTIFICATION_MAX_ATTEMPTS=2
+
 # Connects to postgres service in Docker network (postgres) or localhost (local)
 
 KC_DB=postgres

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.66'
+  version: '2.0.78'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).

package/templates/applications/miso-controller/env.template

@@ -177,7 +177,7 @@ IDENTITY_LOCAL_PASSWORD_MODE=admin-reveal
 # Both onboarding modes use Mori's AI Fabrix-owned sender. MORI_API_KEY below is the
 # existing installation service key; no notification-specific secret is created.
 NOTIFICATION_BINDING=aifabrixManaged
-MORI_ENVIRONMENT_ID=
+MORI_ENVIRONMENT_ID=kv://mori-controller-environment-idKeyVault
 
 # Keycloak Events Configuration
 KEYCLOAK_EVENTS_ENABLED=true
@@ -237,7 +237,7 @@ CONTROLLER_EVALUATION=
 #
 # Delegated Graph (second redirect URI on the same vendor app): see section below.
 ENTRA_CALLBACK_STATE_SECRET=kv://entra-callback-state-secret
-ENTRA_ID_CENTRAL_CALLBACK_URI=https://aifabrix-pro-miso-mori.azurewebsites.net/entra-id-concent/callback
+ENTRA_ID_CENTRAL_CALLBACK_URI=https://dev01.aifabrix.dev/mori/entra-id-concent/callback
 ENTRA_ID_CLIENT_ID=kv://entra-client-idKeyVault
 ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
 
@@ -323,8 +323,10 @@ SHOW_TA_COUNT_DOWN=false
 # Encryption Key for Database Secrets
 ENCRYPTION_KEY=kv://miso-controller-secrets-encryptionKeyVault
 
-# Comma-separated application keys allowed for POST .../applications/bootstrap (install-time only)
-BOOTSTRAP_APPKEYS=dataplane,builder-api
+# Comma-separated application keys allowed for POST .../applications/bootstrap (install-time only).
+# Environment placement is a separate controller rule: workloads (dataplane, builder-api) install into
+# dev/tst/pro but never `miso`; miso-controller and keycloak only into `miso`; mori-controller anywhere.
+BOOTSTRAP_APPKEYS=dataplane,builder-api,mori-controller
 
 # Key Vault Integration (for security parameter encryption)
 # Set to true to enable Azure Key Vault for storing security parameters
@@ -347,18 +349,16 @@ API_KEY=kv://miso-controller-secrets-apiKeyVault
 # =============================================================================
 # LICENSE CONFIGURATION — [always]
 # =============================================================================
-# [saasDirect] Must use the Mori flow (never DEVELOPMENT): Mori issues and owns the
+# [saasDirect] Must use the Mori flow: Mori issues and owns the
 # 30-day STANDARD / M trial, and sales later updates the same subscription.
 #
 # Offline JWT license (optional):
 # - If set, controller validates license offline (RS256) without Mori subscription status call.
 # - Value can be literal JWT or kv:// reference.
-# - If not set, controller falls back to existing Mori subscription validation flow.
-#
-# Development: set to DEVELOPMENT to disable license validation (no Mori/JWT required):
-#   LICENSE_JWT=DEVELOPMENT
-# - Use only for local development (DEPLOYMENT=local|database|azure-mock).
-# - Ignored when DEPLOYMENT=azure (Azure marketplace / App Service installs).
+# - If empty and no stored licence exists, controller runs as Community edition
+#   (DEV environment, size S, shared resources).
+# - Set only to a real signed offline licence JWT. Controlled tests may use the separate
+#   LICENSE_VALIDATION_DISABLED=true switch; do not use it in deployed installations.
 LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault
 
 # =============================================================================
@@ -366,7 +366,7 @@ LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault
 # =============================================================================
 # Must match a Web redirect URI on the vendor multi-tenant app and Mori’s route
 # …/entra-graph-delegated/callback. Shared pro Mori addon (CICD *-miso-rg):
-ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-miso-mori.azurewebsites.net/entra-graph-delegated/callback
+ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://dev01.aifabrix.dev/mori/entra-graph-delegated/callback
 
 # Optional delegated Graph scopes for GET …/graph-auth-url (space- or comma-separated).
 # ENTRA_GRAPH_DELEGATED_SCOPES=https://graph.microsoft.com/Application.ReadWrite.All,https://graph.microsoft.com/Group.ReadWrite.All,https://graph.microsoft.com/Synchronization.ReadWrite.All,openid,profile,offline_access
@@ -381,12 +381,9 @@ ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix-pro-miso-mori.azurewebsites.
 # only works when a local Mori app is registered and running for this developer.
 # MORI_CALLBACK_API_KEY must be the same secret as Mori MORI_CONTROLLER_CALLBACK_API_KEY
 # (both resolve from kv://mori-callback-api-keyKeyVault — do not generate separate values).
-MORI_BASE_URL=https://aifabrix-pro-miso-mori.azurewebsites.net
-MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault
+MORI_BASE_URL=kv://mori-controller-web-server-url
 MORI_CALLBACK_API_KEY=kv://mori-callback-api-keyKeyVault
 MORI_API_KEY=kv://mori-controller-api-keyKeyVault
-MORI_USERNAME=kv://mori-controller-basic-usernameKeyVault
-MORI_PASSWORD=kv://mori-controller-basic-passwordKeyVault
 
 # =============================================================================
 # LOGGING CONFIGURATION

package/lib/generator/deploy-manifest-azure-kv.js

@@ -1,81 +0,0 @@
-/**
- * Map url:// placeholders and Traefik host templates to Azure Key Vault secret names
- * in deployment manifests (Miso Controller / App Service @Microsoft.KeyVault references).
- *
- * @fileoverview Plan 122 — deploy JSON must not ship url:// or ${DEV_USERNAME} for Azure
- * @author AI Fabrix Team
- * @version 1.0.0
- */
-
-'use strict';
-
-const { parseUrlToken } = require('../utils/url-declarative-token-parse');
-
-/**
- * @param {string|undefined} surface
- * @param {string} subject
- * @param {boolean} isPublic
- * @returns {string|undefined} Secret name when surface is vdir/host
- */
-function secretNameFromSurface(surface, subject, isPublic) {
-  if (surface === 'vdir') {
-    return `${subject}-vdir-${isPublic ? 'public' : 'internal'}`;
-  }
-  if (surface === 'host') {
-    return `${subject}-host-${isPublic ? 'public' : 'internal'}`;
-  }
-  return undefined;
-}
-
-/**
- * Key Vault secret name for a url:// token (path after url://).
- * Aligns with infrastructure/bicep (e.g. keycloak-web-server-url, miso-controller-web-server-url).
- *
- * @param {string} ownerAppKey - application.yaml app.key for the manifest being generated
- * @param {string} token - Token after url:// (no scheme)
- * @returns {string}
- */
-function urlTokenToKeyVaultSecretName(ownerAppKey, token) {
-  const selfKey = String(ownerAppKey || '').trim() || 'app';
-  const t = String(token || '').trim();
-  if (!t) {
-    throw new Error('Empty url:// reference (expected a token after url://)');
-  }
-  const { targetKey, kind, surface } = parseUrlToken(t);
-  const isPublic = kind === 'public';
-  const subject = targetKey ? String(targetKey).trim() : selfKey;
-
-  const fromSurface = secretNameFromSurface(surface, subject, isPublic);
-  if (fromSurface !== undefined) {
-    return fromSurface;
-  }
-  if (targetKey === 'keycloak' || (!targetKey && selfKey === 'keycloak')) {
-    return isPublic ? 'keycloak-web-server-url' : 'keycloak-internal-server-url';
-  }
-  if (!targetKey) {
-    return isPublic ? `${selfKey}-web-server-url` : `${selfKey}-internal-server-url`;
-  }
-  return isPublic ? `${subject}-web-server-url` : `${subject}-internal-server-url`;
-}
-
-/**
- * Replace Traefik-style host templates with a Key Vault secret name consumed by Azure provisioning.
- *
- * @param {Object} deployment - Deployment manifest (mutated in place)
- * @returns {void}
- */
-function rewriteFrontDoorHostForAzureDeploy(deployment) {
-  if (!deployment || !deployment.frontDoorRouting || typeof deployment.frontDoorRouting.host !== 'string') {
-    return;
-  }
-  const h = deployment.frontDoorRouting.host;
-  if (/\$\{(DEV_USERNAME|REMOTE_HOST)\}/.test(h)) {
-    const key = deployment.key || 'app';
-    deployment.frontDoorRouting.host = `${key}-frontdoor-routing-host`;
-  }
-}
-
-module.exports = {
-  urlTokenToKeyVaultSecretName,
-  rewriteFrontDoorHostForAzureDeploy
-};