@aifabrix/builder 2.55.2 → 2.57.0

package/lib/utils/qualification-poll-ui.js

@@ -0,0 +1,136 @@
+/**
+ * @fileoverview TTY ora spinner + throttled non-TTY lines for qualification job polling.
+ * Mirrors host-ops-poll-ui.js's presentation pattern (plan 191.0 task 1).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('./logger');
+
+const SILENT_POLL_HANDLERS = {
+  onPollProgress: () => {},
+  onTransientError: () => {},
+  finish: () => {}
+};
+
+const NON_TTY_THROTTLE_MS = 5000;
+
+const HUMAN_STEP_LABELS = Object.freeze({
+  stageCandidate: 'Uploading configuration',
+  gateOperations: 'Checking operations',
+  gateTrust: 'Checking trust',
+  gateGovernance: 'Checking governance',
+  sealCertificate: 'Finalizing upload'
+});
+
+function shouldUseQualificationPollSpinner() {
+  return Boolean(process && process.stdout && process.stdout.isTTY);
+}
+
+/**
+ * @param {Object} job - PublishJobStatusResponse-shaped data ({ state, steps })
+ * @returns {string}
+ */
+function currentQualificationStepLabel(job, options = {}) {
+  if (!job || !Array.isArray(job.steps) || job.steps.length === 0) {
+    return 'Preparing upload';
+  }
+  const running = job.steps.find((step) => step.status === 'running');
+  if (running) return qualificationStepLabel(running, 'running', options);
+  const failed = job.steps.find((step) => step.status === 'failed');
+  if (failed) return qualificationStepLabel(failed, 'failed', options);
+  const pending = job.steps.find((step) => step.status === 'pending');
+  if (pending) return qualificationStepLabel(pending, 'pending', options);
+  return 'Upload complete';
+}
+
+function qualificationStepLabel(step, _status, _options) {
+  return HUMAN_STEP_LABELS[step.key] || 'Processing upload';
+}
+
+/**
+ * @param {string} jobId
+ * @param {Object|null} job
+ * @param {number} elapsedMs
+ * @param {string} [transientNote]
+ * @returns {string}
+ */
+function buildQualificationPollLine(jobId, job, elapsedMs, transientNote, options = {}) {
+  const seconds = Math.max(0, Math.round(elapsedMs / 1000));
+  const note = transientNote ? ` — ${transientNote}` : '';
+  if (options.verbose === true) {
+    return `Upload (job ${jobId}): ${currentQualificationStepLabel(job, options)} — ${seconds}s elapsed${note}`;
+  }
+  return `${currentQualificationStepLabel(job, options)} — ${seconds}s elapsed${note}`;
+}
+
+function createSpinnerQualificationPollHandlers(jobId, startedAt, options) {
+  const ora = require('ora');
+  const spinner = ora({
+    text: buildQualificationPollLine(jobId, null, 0, undefined, options),
+    spinner: 'dots'
+  }).start();
+  return {
+    onPollProgress: (job) => {
+      spinner.text = buildQualificationPollLine(jobId, job, Date.now() - startedAt, undefined, options);
+    },
+    onTransientError: (status, elapsedMs) => {
+      spinner.text = buildQualificationPollLine(
+        jobId,
+        null,
+        elapsedMs,
+        'service temporarily unavailable, retrying',
+        options
+      );
+    },
+    finish: () => spinner.stop()
+  };
+}
+
+function createNonTtyQualificationPollHandlers(jobId, startedAt, options) {
+  let lastLogAt = 0;
+  return {
+    onPollProgress: (job) => {
+      const now = Date.now();
+      if (now - lastLogAt < NON_TTY_THROTTLE_MS) {
+        return;
+      }
+      lastLogAt = now;
+      logger.log(chalk.gray(`  ${buildQualificationPollLine(jobId, job, now - startedAt, undefined, options)}`));
+    },
+    onTransientError: (status, elapsedMs) => {
+      logger.log(
+        chalk.gray(
+          `  ${buildQualificationPollLine(jobId, null, elapsedMs, 'service temporarily unavailable, retrying', options)}`
+        )
+      );
+    },
+    finish: () => {}
+  };
+}
+
+/**
+ * @param {string} jobId
+ * @param {{ startedAt?: number, silent?: boolean, verbose?: boolean }} [options]
+ * @returns {{ onPollProgress: Function, onTransientError: Function, finish: () => void }}
+ */
+function createQualificationPollHandlers(jobId, options = {}) {
+  if (options.silent === true) {
+    return SILENT_POLL_HANDLERS;
+  }
+  const startedAt = options.startedAt || Date.now();
+  if (shouldUseQualificationPollSpinner()) {
+    return createSpinnerQualificationPollHandlers(jobId, startedAt, options);
+  }
+  return createNonTtyQualificationPollHandlers(jobId, startedAt, options);
+}
+
+module.exports = {
+  currentQualificationStepLabel,
+  buildQualificationPollLine,
+  createQualificationPollHandlers,
+  shouldUseQualificationPollSpinner
+};

package/lib/utils/variable-transformer.js

@@ -301,6 +301,9 @@ function transformSimpleOptionalFields(variables, transformed) {
   if (variables.externalIntegration) {
     transformed.externalIntegration = variables.externalIntegration;
   }
+  if (variables.required !== undefined) {
+    transformed.required = variables.required;
+  }
 }
 
 /**

package/lib/validation/required-variables.js

@@ -0,0 +1,41 @@
+/**
+ * @fileoverview Semantic checks for the application top-level `required` variable list:
+ * every name must be declared by the manifest configuration and have a resolvable source.
+ * Shape (array, unique, name pattern) is enforced by application-schema.json.
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+function hasResolvableValue(item) {
+  if (item.location === 'keyvault') return typeof item.value === 'string' && item.value !== '';
+  return (typeof item.value === 'string' && item.value !== '') || Boolean(item.portalInput);
+}
+
+/**
+ * Validates top-level `required` names against the deployment manifest configuration.
+ * @param {Object} manifest - Deployment manifest (application schema shape)
+ * @returns {string[]} Error messages (empty when valid or when `required` is absent)
+ */
+function validateRequiredVariables(manifest) {
+  const required = manifest && manifest.required;
+  if (!Array.isArray(required) || required.length === 0) return [];
+  const byName = new Map();
+  for (const item of Array.isArray(manifest.configuration) ? manifest.configuration : []) {
+    if (item && typeof item.name === 'string') byName.set(item.name, item);
+  }
+  const errors = [];
+  for (const name of required) {
+    if (typeof name !== 'string') continue;
+    const item = byName.get(name);
+    if (!item) {
+      errors.push(`required: ${name} is not declared in the application configuration (env.template)`);
+    } else if (!hasResolvableValue(item)) {
+      errors.push(`required: ${name} has no value or portal input, so it cannot resolve for the target`);
+    }
+  }
+  return errors;
+}
+
+module.exports = { validateRequiredVariables };

package/lib/validation/validator.js

@@ -24,6 +24,7 @@ const { loadConfigFile } = require('../utils/config-format');
 const { validateAuthKvCoverage, validateAuthSecurityPathConsistency } = require('./env-template-auth');
 const { validateKvReferencesInLines } = require('./env-template-kv');
 
+const { validateRequiredVariables } = require('./required-variables');
 /**
  * Validates application config file against application schema
  * Provides detailed error messages for configuration issues
@@ -366,13 +367,15 @@ function validateDeploymentJson(deployment) {
   ajv.addSchema(externalDataSourceSchemaCopy, externalDataSourceSchema.$id);
   const validate = ajv.compile(applicationSchema);
   const valid = validate(deployment);
+  const schemaErrors = valid ? [] : formatValidationErrors(validate.errors, {
+    deploymentManifest: deployment,
+    rootData: deployment
+  });
+  const requiredErrors = validateRequiredVariables(deployment);
 
   return {
-    valid,
-    errors: valid ? [] : formatValidationErrors(validate.errors, {
-      deploymentManifest: deployment,
-      rootData: deployment
-    })
+    valid: valid && requiredErrors.length === 0,
+    errors: [...schemaErrors, ...requiredErrors]
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.55.2",
+  "version": "2.57.0",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {
@@ -21,8 +21,13 @@
     "dev-reload": "node scripts/pnpm/dev-reload.mjs",
     "dev-build": "node scripts/pnpm/af.mjs dev-build",
     "dev-promote": "node scripts/pnpm/af.mjs dev-promote",
+    "dev-deploy": "node scripts/pnpm/dev-deploy.mjs",
     "af": "node scripts/pnpm/af.mjs",
     "check-quiet": "node scripts/pnpm/check-quiet.mjs",
+    "agent-skills:sync": "node scripts/pnpm/agent-skills-sync.mjs",
+    "agent-skills:check": "node scripts/pnpm/agent-skills-sync.mjs --check",
+    "agent-skills:sync:codex": "node scripts/pnpm/agent-skills-sync.mjs --codex-home",
+    "agent-skills:test": "node --test scripts/pnpm/agent-skills-sync.test.mjs",
     "check": "npm run lint && npm run test",
     "lint": "eslint . --ext .js",
     "lint:fix": "eslint . --ext .js --fix",
@@ -125,7 +130,7 @@
     }
   },
   "dependencies": {
-    "@aifabrix/miso-client": "^4.19.0",
+    "@aifabrix/miso-client": "4.22.4",
     "adm-zip": "^0.6.0",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/templates/README.md

@@ -22,12 +22,16 @@ Application templates are folder-based and located under `templates/applications
 | `aifabrix-builder/builder/builder-api/` | `templates/applications/builder-api/` |
 | `aifabrix-miso/builder/miso-controller/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/miso-controller/` |
 | `aifabrix-miso/builder/keycloak/` (`env.template`, `application.yaml`, `Dockerfile`, `cimd-lenient-parse/`) | `templates/applications/keycloak/` |
+| `aifabrix-miso/infrastructure/marketplace/` (`main.json`, `createUiDefinition.json`) | `templates/marketplace/` |
 | `aifabrix-dataplane/builder/dataplane/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/dataplane/` |
 
 **Schema master (dataplane):** Also copies dataplane `app/schemas/json/` core integration schemas + `type/*` and `configs/deployment-rules.yaml` into `lib/schema/` (same contract as dataplane `make sync-json`). Do not hand-edit those mirrors — edit dataplane SSOT, then sync. Builder-owned schemas in `lib/schema/` (wizard, infra, etc.) are left alone.
 
 Overrides: `AIFABRIX_MISO_SRC`, `AIFABRIX_DATAPLANE_SRC` / `AIFABRIX_DATAPLANE_ROOT` (repo roots). Install with `aifabrix up-platform` / `up-builder-api` — do not hand-edit the template copies as primary.
 
+The Marketplace copies are compiled/source artifacts for a future Azure install command. `main.parameters.json` is intentionally excluded because installation secrets and customer-specific values must come from the installer's secure parameter file.
+The two-stage CLI procedure and a blank parameter-file example are in [docs/marketplace-env-deploy.md](../docs/marketplace-env-deploy.md).
+
 **Template Validation:**
 - Template folder must exist in `templates/applications/<name>/`
 - Template folder must contain at least one file

package/templates/agent-kit/instructions/AGENTKIT.md

@@ -57,13 +57,13 @@ curl -fsSL https://claude.ai/install.sh | bash
 claude auth login
 ```
 
-**Run in tmux** from this workspace so closing the terminal does not kill Claude. `--remote-control` is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (Code). That is not `claude --cloud` (a separate cloud VM). Claude `--tmux` is for worktrees only.
+**Run in tmux** from this workspace so closing the terminal does not kill Claude. The command enables Remote Control and this workspace's Claude auto-approval by default. Remote Control is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (Code). That is not `claude --cloud` (a separate cloud VM). Claude `--tmux` is for worktrees only.
 
 ```bash
-aifabrix agent-kit start claude --remote-control --approve-all --yes
+aifabrix agent-kit start claude
 ```
 
-tmux session name defaults to this folder. Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). Override the folder with `--name`. Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t <folder>`. Several workspaces can run at once. Same account on phone and PC (`claude auth login`, Pro/Max/Team — not an API key). On the phone: Claude app → **Code**. Skills: `/aifabrix-plan` (and the other `/aifabrix-*` names). First `claude` must run inside this workspace, not your home directory. Full notes: `.agents/skills/shared/hosts.md`.
+tmux session name defaults to this folder. Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). Override with `--name`; opt out with `--no-remote-control` and/or `--skip-approve-all`. Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t <folder>`. Use `aifabrix agent-kit list` and `agent-kit kill <folder>` to manage sessions. Same account on phone and PC (`claude auth login`, Pro/Max/Team — not an API key). On the phone: Claude app → **Code**. Skills: `/aifabrix-plan` (and the other `/aifabrix-*` names). First `claude` must run inside this workspace, not your home directory. Full notes: `.agents/skills/shared/hosts.md`.
 {{/if}}
 {{#if codex}}
 
@@ -76,13 +76,13 @@ npm install -g @openai/codex
 codex login
 ```
 
-**Run in tmux** from this workspace so the session stays if you close the terminal:
+**Run in tmux** from this workspace so the session stays if you close the terminal. The command starts native Codex Remote Control and writes this workspace's Codex auto-approval by default:
 
 ```bash
-aifabrix agent-kit start codex --approve-all --yes
+aifabrix agent-kit start codex
 ```
 
-Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t <folder>`, or `aifabrix agent-kit start codex` from this workspace. Default session name is this folder. Skills: `$aifabrix-plan` (and the other `$aifabrix-*` names). Codex reads `AGENTS.md`. Full notes: `.agents/skills/shared/hosts.md`.
+Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t <folder>`. A duplicate `start` fails instead of attaching. Default session name is this folder. Use `--no-remote-control` and/or `--skip-approve-all` to opt out. Skills: `$aifabrix-plan` (and the other `$aifabrix-*` names). Codex reads `AGENTS.md`. Full notes: `.agents/skills/shared/hosts.md`.
 {{/if}}
 
 ## Auth for delivery CLI

package/templates/agent-kit/skills/shared/hosts.md

@@ -6,14 +6,14 @@ Install and sign-in steps are in `AGENTKIT.md`. This file is how to **run** each
 
 Do not start Claude or Codex in your home directory. `cd` into this git workspace first.
 
-## Auto-approve (optional)
+## Auto-approve
 
 `aifabrix agent-kit install` can write gitignored host configs so Claude Code and Codex do not prompt for every tool:
 
 - Claude Code: `.claude/settings.local.json` (`permissions.defaultMode` = `bypassPermissions`, `allow` = `Bash(aifabrix *)` and `Read(~/**)`)
 - Codex: `.codex/config.toml` (`approval_policy = "never"`, `sandbox_mode = "workspace-write"`)
 
-Those files stay in **this workspace**. Claude may **read** files under the developer home (`Read(~/**)`) and run the delivery CLI (`Bash(aifabrix *)`). They do not add sibling folders as extra workspaces, do not grant Write outside this repo, and do not allow every shell command. TTY asks which host to auto-approve when both are selected. `--approve-all claude` or `--approve-all codex` writes only that host. `--yes` or a non-TTY / `--json` run writes them. `--skip-approve-all` skips. `--force` overwrites existing local files. Builder never writes `~/.claude` or `~/.codex`.
+Those files stay in **this workspace**. Claude may **read** files under the developer home (`Read(~/**)`) and run the delivery CLI (`Bash(aifabrix *)`). They do not add sibling folders as extra workspaces, do not grant Write outside this repo, and do not allow every shell command. `agent-kit start claude|codex` writes only the selected host's file by default; `--skip-approve-all` opts out. Install/update retain their explicit approval prompts and flags. `--force` overwrites existing local files. Builder never writes `~/.claude` or `~/.codex`.
 
 ## Cursor
 
@@ -23,13 +23,13 @@ Those files stay in **this workspace**. Claude may **read** files under the deve
 
 ## Claude Code
 
-**Local or SSH — tmux.** Closing the terminal must not kill Claude. Agent Kit starts Claude **inside tmux**. `--remote-control` is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (**Code**). Do not use `claude --cloud` for this — that starts a different machine that clones GitHub. Claude `--tmux` is only for `--worktree` sessions, not this wrapper.
+**Local or SSH — tmux.** Closing the terminal must not kill Claude. Agent Kit starts Claude **inside tmux**, with Remote Control and workspace auto-approval enabled by default. Remote Control is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (**Code**). Do not use `claude --cloud` for this — that starts a different machine that clones GitHub. Claude `--tmux` is only for `--worktree` sessions, not this wrapper.
 
 ```bash
-aifabrix agent-kit start claude --remote-control --approve-all --yes
+aifabrix agent-kit start claude
 ```
 
-tmux session name is this folder (for example `aifabrix-docs`). Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). `--name` overrides the folder. Several workspaces can run at once. Detach without killing Claude: `Ctrl-b` then `d`. Reattach: `tmux attach -t aifabrix-docs`, or run `start` again from the same folder. Then `/aifabrix-plan` (or another `/aifabrix-*` skill). First run in a project asks you to trust the folder; accept only this workspace.
+tmux session name is this folder (for example `aifabrix-docs`). Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). `--name` overrides the folder; `--no-remote-control` and `--skip-approve-all` opt out. Several workspaces can run at once. Detach without killing Claude: `Ctrl-b` then `d`. Reattach: `tmux attach -t aifabrix-docs`. A duplicate `start` fails instead of attaching. Then `/aifabrix-plan` (or another `/aifabrix-*` skill). First run in a project asks you to trust the folder; accept only this workspace.
 
 **Phone and PC.** Sign in with the same Claude Pro/Max/Team account (`claude auth login` — not an API key). After Remote Control starts, open **Code** in the Claude mobile app and/or [claude.ai/code](https://claude.ai/code) on the PC. In an already-running session, `/remote-control` or `/mobile`.
 
@@ -37,13 +37,13 @@ Closing the terminal (or SSH) does not stop a tmux session. Stopping tmux or the
 
 ## Codex
 
-**Local or SSH — tmux (recommended).** Same recipe on your PC and on a remote host. tmux keeps Codex running if you close the terminal or disconnect SSH. Codex has no Claude-style phone/web Remote Control.
+**Local or SSH — tmux and Remote Control.** tmux keeps Codex running if you close the terminal or disconnect SSH. Agent Kit also starts Codex's native remote-control daemon and workspace auto-approval by default.
 
 ```bash
-aifabrix agent-kit start codex --approve-all --yes
+aifabrix agent-kit start codex
 ```
 
-Equivalent: `tmux new -s aifabrix-docs -c /path/to/this-workspace` then `codex`. Default `--name` is the last folder. If that session already exists, `start` attaches. Detach: `Ctrl-b` then `d`. Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`.
+Default `--name` is the last folder. `--no-remote-control` keeps the launch local; `--skip-approve-all` leaves Codex permissions unchanged. If that session already exists, `start` fails with list/kill guidance. Detach: `Ctrl-b` then `d`. Reattach with `tmux attach -t aifabrix-docs`. Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`. Killing tmux does not stop the shared daemon; use `codex remote-control stop` when required.
 
 **Foreground only (no tmux).**
 
@@ -58,8 +58,8 @@ codex
 | --- | --- |
 | New named session | `tmux new -s <name> -c /path/to/this-workspace` |
 | Detach (leave it running) | `Ctrl-b`, then `d` |
-| List sessions | `tmux ls` |
+| List sessions | `aifabrix agent-kit list` |
 | Attach | `tmux attach -t <name>` |
-| Kill session | `tmux kill-session -t <name>` |
+| Kill session | `aifabrix agent-kit kill <name>` |
 
 Use a different `--name` per workspace so several Claude or Codex sessions can run on the same host. Claude and Codex in the **same** folder also need two names.

package/templates/applications/builder-api/env.template

@@ -37,6 +37,10 @@ DATAPLANE_URL=url://dataplane-internal
 # Public: Slack/Teams/ChatGPT callbacks, packages, and portal remaining-step URLs
 DATAPLANE_PUBLIC_URL=url://dataplane-public
 
+# Self URLs: internal service calls and public links generated by Builder API
+BUILDER_API_URL=url://internal
+BUILDER_API_PUBLIC_URL=url://public
+
 DEFAULT_ENVIRONMENT=dev
 
 # Browser Origin allowlist for portal calls (CORS). url:// expands at resolve.

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.65
+  version: 2.0.70
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).

package/templates/applications/dataplane/env.template

@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.65
+VERSION=2.0.70
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5

package/templates/applications/keycloak/Dockerfile

@@ -1,29 +1,34 @@
 # Keycloak Identity and Access Management with Custom Themes
-# Official 26.7.2 distro + experimental CIMD. Does not compile Keycloak from source.
+# Official 26.7.3 distro + experimental CIMD. Does not compile Keycloak from source.
 # One class is recompiled against this image's jars:
 # - PR 51235: CIMD parse ignores unknown JSON fields (ChatGPT client.json)
 # - #50362: strip jwt-bearer (and other confidential-only grants) on public CIMD
 # 26.7 advertises token_endpoint_auth_methods_supported "none" for Claude CIMD.
 
-FROM quay.io/keycloak/keycloak:26.7.2 AS keycloak-base
+FROM quay.io/keycloak/keycloak:26.7.3 AS keycloak-base
 
 FROM eclipse-temurin:21-jdk-jammy AS cimd-patch
 COPY --from=keycloak-base /opt/keycloak/lib/lib/main /opt/kc-jars/main
 COPY --from=keycloak-base /opt/keycloak/lib/lib/boot /opt/kc-jars/boot
 COPY cimd-lenient-parse/AbstractClientIdMetadataDocumentExecutor.java \
      /tmp/src/org/keycloak/protocol/oauth2/cimd/clientpolicy/executor/AbstractClientIdMetadataDocumentExecutor.java
+COPY mori-email-sender/com /tmp/src/com
+COPY mori-email-sender/META-INF /tmp/mori-provider/META-INF
 RUN mkdir -p /tmp/classes \
  && find /opt/kc-jars -name '*.jar' | paste -sd: - > /tmp/cp.txt \
  && { \
       echo --release; echo 21; echo -cp; cat /tmp/cp.txt; echo -d; echo /tmp/classes; \
       echo /tmp/src/org/keycloak/protocol/oauth2/cimd/clientpolicy/executor/AbstractClientIdMetadataDocumentExecutor.java; \
+      find /tmp/src/com -name '*.java'; \
     } > /tmp/javac.args \
  && javac @/tmp/javac.args \
  && SERVICES_JAR=$(ls /opt/kc-jars/main/org.keycloak.keycloak-services-*.jar) \
  && cp "$SERVICES_JAR" /tmp/keycloak-services-patched.jar \
- && jar uf /tmp/keycloak-services-patched.jar -C /tmp/classes .
+ && jar uf /tmp/keycloak-services-patched.jar -C /tmp/classes org/keycloak \
+ && cp -r /tmp/classes/com /tmp/mori-provider/ \
+ && jar cf /tmp/mori-email-sender.jar -C /tmp/mori-provider .
 
-FROM quay.io/keycloak/keycloak:26.7.2
+FROM quay.io/keycloak/keycloak:26.7.3
 
 # Set working directory
 WORKDIR /opt/keycloak
@@ -31,6 +36,7 @@ WORKDIR /opt/keycloak
 # Copy custom themes from share directory (only if themes/ folder exists)
 USER root
 COPY --from=cimd-patch /tmp/keycloak-services-patched.jar /tmp/keycloak-services-patched.jar
+COPY --from=cimd-patch /tmp/mori-email-sender.jar /opt/keycloak/providers/mori-email-sender.jar
 RUN SERVICES_JAR=$(ls /opt/keycloak/lib/lib/main/org.keycloak.keycloak-services-*.jar) \
  && cp /tmp/keycloak-services-patched.jar "$SERVICES_JAR" \
  && rm /tmp/keycloak-services-patched.jar
@@ -50,7 +56,8 @@ RUN if [ -d "/tmp/build-context/themes" ] && [ "$(ls -A /tmp/build-context/theme
 # Build Keycloak with health checks enabled (similar to Keycloak 24.0)
 # This enables the /health, /health/live, /health/ready, and /health/started endpoints
 # Expose health endpoints on main HTTP port (like 24.0) instead of management port
-RUN /opt/keycloak/bin/kc.sh build --health-enabled=true --http-management-health-enabled=false --features=cimd
+RUN /opt/keycloak/bin/kc.sh build --health-enabled=true --http-management-health-enabled=false \
+    --features=cimd --spi-email-sender--provider=mori
 
 # Switch back to keycloak user
 USER keycloak

package/templates/applications/keycloak/application.yaml

@@ -4,12 +4,12 @@ app:
   displayName: 'AI Fabrix Keycloak'
   description: 'Identity and Access Management'
   type: webapp
-  version: '26.7.2'
+  version: '26.7.3-aifabrix.1'
 
 # Image Configuration
 image:
   name: aifabrix/keycloak
-  tag: 'latest'
+  tag: '26.7.3-aifabrix.1'
   registry: aifabrixacr.azurecr.io
   registryMode: external
 

package/templates/applications/keycloak/cimd-lenient-parse/AbstractClientIdMetadataDocumentExecutor.java

@@ -1,6 +1,6 @@
 package org.keycloak.protocol.oauth2.cimd.clientpolicy.executor;
 
-// AI Fabrix Keycloak image patch on 26.7.2 (not a Keycloak source build):
+// AI Fabrix Keycloak image patch on 26.7.3 (not a Keycloak source build):
 // 1) PR 51235 — ignore unknown CIMD JSON fields (ChatGPT client.json).
 // 2) keycloak#50362 / PR 50411 idea — drop confidential-only grants (jwt-bearer)
 //    from public CIMD metadata so Claude hosted Connect can register.
@@ -848,7 +848,7 @@ public abstract class AbstractClientIdMetadataDocumentExecutor<CONFIG extends Ab
 
     /**
      * Grant types Keycloak's DescriptionConverter refuses on a public client.
-     * Same set as Keycloak PR 50411 (not in 26.7.2).
+     * Same set as Keycloak PR 50411 (not in 26.7.3).
      */
     protected static final Set<String> CONFIDENTIAL_ONLY_GRANT_TYPES = new LinkedHashSet<>(Arrays.asList(
             OAuth2Constants.CLIENT_CREDENTIALS,
@@ -873,7 +873,7 @@ public abstract class AbstractClientIdMetadataDocumentExecutor<CONFIG extends Ab
 
     /**
      * RFC 7591 §3.2.1 lets the AS replace requested grant_types. Claude CIMD is public
-     * (`none`) plus jwt-bearer; Keycloak 26.7.2 rejects that combination (#50362).
+     * (`none`) plus jwt-bearer; Keycloak 26.7.3 rejects that combination (#50362).
      */
     protected void stripConfidentialOnlyGrantsForPublicClient(OIDCClientRepresentation oidcClient) {
         if (!"none".equals(oidcClient.getTokenEndpointAuthMethod())) {

package/templates/applications/keycloak/cimd-lenient-parse/SOURCE.md

@@ -1,19 +1,19 @@
-# CIMD image patch (Keycloak 26.7.2)
+# CIMD image patch (Keycloak 26.7.3)
 
-This directory is **not** a Keycloak source build. `aifabrix build keycloak` still starts from `quay.io/keycloak/keycloak:26.7.2`. A Docker stage recompiles this one class against that image’s jars and injects it into `org.keycloak.keycloak-services-*.jar` before `kc.sh build`.
+This directory is **not** a Keycloak source build. `aifabrix build keycloak` still starts from `quay.io/keycloak/keycloak:26.7.3`. A Docker stage recompiles this one class against that image’s jars and injects it into `org.keycloak.keycloak-services-*.jar` before `kc.sh build`.
 
-Upstream file: `services/.../AbstractClientIdMetadataDocumentExecutor.java` @ tag `26.7.2` (Apache 2.0).
+Upstream file: `services/.../AbstractClientIdMetadataDocumentExecutor.java` @ tag `26.7.3` (Apache 2.0).
 
 ## Lenient parse (ChatGPT)
 
 ChatGPT’s CIMD `client.json` includes extra fields (for example `token_endpoint_auth_methods_supported`) that Keycloak 26.7.x rejects because CIMD parse uses Jackson `FAIL_ON_UNKNOWN_PROPERTIES`.
 
-- [keycloak/keycloak#51235](https://github.com/keycloak/keycloak/pull/51235) (open; not in 26.7.2)
+- [keycloak/keycloak#51235](https://github.com/keycloak/keycloak/pull/51235) (open; not in 26.7.3)
 
 ## Public client + jwt-bearer (Claude hosted)
 
-Claude’s CIMD is a public client (`token_endpoint_auth_method: none`) that also lists `urn:ietf:params:oauth:grant-type:jwt-bearer`. Keycloak 26.7.2 then fails authorize with `JWT authorization grant cannot be enabled in a public client` ([#50362](https://github.com/keycloak/keycloak/issues/50362)). Official [PR 50411](https://github.com/keycloak/keycloak/pull/50411) is still a draft and defaults the filter **off**. This image always drops confidential-only grants on public CIMD metadata (RFC 7591 §3.2.1), which is enough for hosted Claude Connect (authorization_code). It does **not** implement public-client JWT Authorization Grant / EMA.
+Claude’s CIMD is a public client (`token_endpoint_auth_method: none`) that also lists `urn:ietf:params:oauth:grant-type:jwt-bearer`. Keycloak 26.7.3 then fails authorize with `JWT authorization grant cannot be enabled in a public client` ([#50362](https://github.com/keycloak/keycloak/issues/50362)). Official [PR 50411](https://github.com/keycloak/keycloak/pull/50411) is still a draft and defaults the filter **off**. This image always drops confidential-only grants on public CIMD metadata (RFC 7591 §3.2.1), which is enough for hosted Claude Connect (authorization_code). It does **not** implement public-client JWT Authorization Grant / EMA.
 
-26.7.2 already advertises `token_endpoint_auth_methods_supported` `"none"` when `--features=cimd`.
+26.7.3 already advertises `token_endpoint_auth_methods_supported` `"none"` when `--features=cimd`.
 
 Drop this patched class when the consumed `quay.io` tag includes both behaviors.

package/templates/applications/keycloak/env.template

@@ -55,7 +55,7 @@ KC_HEALTH_ENABLED=true
 KC_HTTP_MANAGEMENT_HEALTH_ENABLED=false
 # Single-instance: use local cache so /health/ready passes (avoids Infinispan cluster check)
 KC_CACHE=local
-# Runtime features. Include cimd so Keycloak 26.7.2 advertises Client ID Metadata
+# Runtime features. Include cimd so Keycloak 26.7.3 advertises Client ID Metadata
 # Documents. preview alone triggers a start-time rebuild that drops cimd.
 KC_FEATURES=preview,cimd
 
@@ -67,6 +67,18 @@ KC_FEATURES=preview,cimd
 MISO_CLIENTID=kv://keycloak-client-idKeyVault
 MISO_CLIENTSECRET=kv://keycloak-client-secretKeyVault
 
+# =============================================================================
+# MANAGED ACTION EMAIL (Keycloak -> Mori REST)
+# =============================================================================
+# The custom EmailSenderProvider relays Keycloak-rendered signed action emails to
+# Mori. It never receives ACS credentials and never sends the action URL to Miso.
+# Installation must supply the Mori environment returned during registration.
+MORI_BASE_URL=kv://mori-controller-web-server-url
+MORI_ENVIRONMENT_ID=kv://mori-controller-environment-idKeyVault
+MORI_API_KEY=kv://mori-controller-api-keyKeyVault
+MORI_NOTIFICATION_TIMEOUT_MS=10000
+MORI_NOTIFICATION_MAX_ATTEMPTS=2
+
 # Connects to postgres service in Docker network (postgres) or localhost (local)
 
 KC_DB=postgres

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.66'
+  version: '2.0.81'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
@@ -58,7 +58,8 @@ build:
   dockerfile: builder/miso-controller/Dockerfile # Dockerfile name (relative to project root)
   envOutputPath: ../../packages/miso-controller/.env # Copy .env to repo root for local dev (relative to builder/) (if null, no .env file is copied) (if empty, .env file is copied to repo root)
   language: typescript # Runtime language for template selection (typescript or python)
-  reloadStart: pnpm --filter @aifabrix/miso-controller run dev:watch:public # Docker --reload: nodemon backend + pre-built UI (no Vite in container)
+  # Runtime image has npm/npx, not pnpm. Keep the existing dev:watch:public script.
+  reloadStart: npm --prefix packages/miso-controller run dev:watch:public
 
 # Repository Configuration (pipeline validate: REPOSITORY_URL_MISMATCH)
 repository: