@aifabrix/builder 2.56.0 → 2.58.0

package/lib/utils/resolve-docker-image-ref.js

@@ -1,6 +1,7 @@
 /**
  * Resolve Docker repository path and tag from application config and optional CLI overrides.
- * Precedence: --image (full ref), --registry CLI, image.registry in manifest, else unqualified name.
+ * Precedence: --image (full ref), --registry CLI, installation `registry` in config.yaml,
+ * image.registry in manifest, else unqualified name.
  *
  * For refs like localhost:5000/repo without an explicit tag, prefer --image with :tag (parse ambiguity).
  *
@@ -12,6 +13,7 @@
 'use strict';
 
 const { parseImageOverride } = require('./parse-image-ref');
+const { readInstallationRegistrySync } = require('./config-registry-preference');
 const DOCKER_REPOSITORY_RE = /^[a-z0-9][a-z0-9._/-]*$/i;
 const DOCKER_TAG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 
@@ -92,6 +94,73 @@ function normalizeDockerRegistryPrefix(registry) {
   return t.slice(0, end);
 }
 
+/**
+ * Remove a registry host prefix from a Docker repository path.
+ * The first segment is a host when it contains `.` or `:` or equals `localhost`.
+ * @param {string} repository
+ * @returns {string}
+ */
+function stripRegistryHostFromRepository(repository) {
+  if (!repository || typeof repository !== 'string') {
+    return repository;
+  }
+  const parts = repository.split('/');
+  if (parts.length <= 1) {
+    return repository;
+  }
+  const host = parts[0];
+  if (host.includes('.') || host.includes(':') || host === 'localhost') {
+    return parts.slice(1).join('/');
+  }
+  return repository;
+}
+
+/**
+ * Effective registry for an application image.
+ * Precedence: `options.registry` (CLI) > installation `registry` > manifest `image.registry`.
+ * @param {Object} [appConfig] - Application manifest
+ * @param {Object} [options] - `registry` (CLI) and optional `installationRegistry` (preloaded; '' = none)
+ * @returns {{ registry: string, source: 'cli'|'installation'|'manifest'|'none' }}
+ */
+function resolveEffectiveRegistry(appConfig, options = {}) {
+  const opts = options || {};
+  const cli = normalizeDockerRegistryPrefix(opts.registry);
+  if (cli) return { registry: cli, source: 'cli' };
+  const installation = opts.installationRegistry !== undefined
+    ? normalizeDockerRegistryPrefix(opts.installationRegistry)
+    : readInstallationRegistrySync();
+  if (installation) return { registry: installation, source: 'installation' };
+  const manifest = normalizeDockerRegistryPrefix(appConfig?.image?.registry ?? '');
+  if (manifest) return { registry: manifest, source: 'manifest' };
+  return { registry: '', source: 'none' };
+}
+
+/**
+ * Prefix a repository with a registry exactly once (replacing any existing host).
+ * @param {string} registry - Registry prefix ('' keeps the repository unchanged)
+ * @param {string} repository - Repository path, possibly already qualified
+ * @returns {string}
+ */
+function qualifyRepository(registry, repository) {
+  const prefix = normalizeDockerRegistryPrefix(registry);
+  if (!prefix) return repository;
+  return `${prefix}/${stripRegistryHostFromRepository(repository)}`;
+}
+
+/**
+ * Deployment/registration image reference (`registry/name:tag`) using the shared precedence.
+ * @param {Object} variables - Application manifest
+ * @param {string} fallbackName - Name when the manifest has no image name or app key
+ * @param {Object} [options] - Same options as {@link resolveEffectiveRegistry}
+ * @returns {string}
+ */
+function buildManifestImageReference(variables, fallbackName, options = {}) {
+  const imageName = variables?.image?.name || variables?.app?.key || fallbackName;
+  const tag = variables?.image?.tag || 'latest';
+  const { registry } = resolveEffectiveRegistry(variables, options);
+  return `${qualifyRepository(registry, imageName)}:${tag}`;
+}
+
 /**
  * Effective image repository (may include registry prefix) and tag for Docker.
  * @param {string} appName - Application name
@@ -118,13 +187,8 @@ function resolveDockerImageRef(appName, appConfig, runOptions = {}) {
 
   const baseRepo = assertSafeRepository(getRepositoryPathFromConfig(appConfig, appName));
   const imageTag = assertSafeTag(tagFromOpts || imageTagFromConfig(appConfig));
-  const prefix =
-    normalizeDockerRegistryPrefix(opts.registry) ||
-    normalizeDockerRegistryPrefix(appConfig?.image?.registry ?? '');
-  if (prefix) {
-    return { imageName: assertSafeRepository(`${prefix}/${baseRepo}`), imageTag };
-  }
-  return { imageName: baseRepo, imageTag };
+  const { registry } = resolveEffectiveRegistry(appConfig, opts);
+  return { imageName: assertSafeRepository(qualifyRepository(registry, baseRepo)), imageTag };
 }
 
 /**
@@ -137,7 +201,7 @@ function resolveDockerImageRef(appName, appConfig, runOptions = {}) {
 function resolveComposeImageOverrideString(appName, appConfig, options = {}) {
   if (options.image) return options.image;
   if (options.imageOverride) return options.imageOverride;
-  const runOpts = { registry: options.registry, image: undefined };
+  const runOpts = { registry: options.registry, installationRegistry: options.installationRegistry, image: undefined };
   if (options.tag) {
     const { imageName } = resolveDockerImageRef(appName, appConfig, runOpts);
     return `${imageName}:${options.tag}`;
@@ -154,6 +218,11 @@ function resolveComposeImageOverrideString(appName, appConfig, options = {}) {
 module.exports = {
   resolveDockerImageRef,
   resolveComposeImageOverrideString,
+  resolveEffectiveRegistry,
+  qualifyRepository,
+  buildManifestImageReference,
+  stripRegistryHostFromRepository,
+  assertSafeTag,
   normalizeDockerRegistryPrefix,
   getRepositoryPathFromConfig,
   imageTagFromConfig

package/lib/utils/secrets-helpers.js

@@ -29,7 +29,15 @@ const { collectUniqueKvPathStrings, isCommentOrEmptyLine, activeEnvLineForKvScan
  * @returns {string} Interpolated content
  */
 function interpolateEnvVars(content, envVars) {
-  return content.replace(/\$\{([A-Z_]+)\}/g, (match, envVar) => {
+  const hasOwn = (key) => Object.prototype.hasOwnProperty.call(envVars, key);
+  const interpolated = content.replace(
+    /\$\{DEV_USERNAME\}\.\$\{REMOTE_HOST\}/g,
+    (match) => {
+      if (!hasOwn('DEV_USERNAME') || !hasOwn('REMOTE_HOST')) return match;
+      return [envVars.DEV_USERNAME, envVars.REMOTE_HOST].filter(Boolean).join('.');
+    }
+  );
+  return interpolated.replace(/\$\{([A-Z_]+)\}/g, (match, envVar) => {
     return envVars[envVar] || match;
   });
 }

package/lib/utils/variable-transformer.js

@@ -126,10 +126,8 @@ function transformFlatStructure(variables, appName) {
  * @returns {string} Image reference string
  */
 function buildImageReference(variables, appName) {
-  const imageName = variables.image?.name || variables.app?.key || appName;
-  const registry = variables.image?.registry;
-  const tag = variables.image?.tag || 'latest';
-  return registry ? `${registry}/${imageName}:${tag}` : `${imageName}:${tag}`;
+  const { buildManifestImageReference } = require('./resolve-docker-image-ref');
+  return buildManifestImageReference(variables, appName);
 }
 
 /**
@@ -301,6 +299,9 @@ function transformSimpleOptionalFields(variables, transformed) {
   if (variables.externalIntegration) {
     transformed.externalIntegration = variables.externalIntegration;
   }
+  if (variables.required !== undefined) {
+    transformed.required = variables.required;
+  }
 }
 
 /**

package/lib/validation/required-variables.js

@@ -0,0 +1,41 @@
+/**
+ * @fileoverview Semantic checks for the application top-level `required` variable list:
+ * every name must be declared by the manifest configuration and have a resolvable source.
+ * Shape (array, unique, name pattern) is enforced by application-schema.json.
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+function hasResolvableValue(item) {
+  if (item.location === 'keyvault') return typeof item.value === 'string' && item.value !== '';
+  return (typeof item.value === 'string' && item.value !== '') || Boolean(item.portalInput);
+}
+
+/**
+ * Validates top-level `required` names against the deployment manifest configuration.
+ * @param {Object} manifest - Deployment manifest (application schema shape)
+ * @returns {string[]} Error messages (empty when valid or when `required` is absent)
+ */
+function validateRequiredVariables(manifest) {
+  const required = manifest && manifest.required;
+  if (!Array.isArray(required) || required.length === 0) return [];
+  const byName = new Map();
+  for (const item of Array.isArray(manifest.configuration) ? manifest.configuration : []) {
+    if (item && typeof item.name === 'string') byName.set(item.name, item);
+  }
+  const errors = [];
+  for (const name of required) {
+    if (typeof name !== 'string') continue;
+    const item = byName.get(name);
+    if (!item) {
+      errors.push(`required: ${name} is not declared in the application configuration (env.template)`);
+    } else if (!hasResolvableValue(item)) {
+      errors.push(`required: ${name} has no value or portal input, so it cannot resolve for the target`);
+    }
+  }
+  return errors;
+}
+
+module.exports = { validateRequiredVariables };

package/lib/validation/validator.js

@@ -24,6 +24,7 @@ const { loadConfigFile } = require('../utils/config-format');
 const { validateAuthKvCoverage, validateAuthSecurityPathConsistency } = require('./env-template-auth');
 const { validateKvReferencesInLines } = require('./env-template-kv');
 
+const { validateRequiredVariables } = require('./required-variables');
 /**
  * Validates application config file against application schema
  * Provides detailed error messages for configuration issues
@@ -366,13 +367,15 @@ function validateDeploymentJson(deployment) {
   ajv.addSchema(externalDataSourceSchemaCopy, externalDataSourceSchema.$id);
   const validate = ajv.compile(applicationSchema);
   const valid = validate(deployment);
+  const schemaErrors = valid ? [] : formatValidationErrors(validate.errors, {
+    deploymentManifest: deployment,
+    rootData: deployment
+  });
+  const requiredErrors = validateRequiredVariables(deployment);
 
   return {
-    valid,
-    errors: valid ? [] : formatValidationErrors(validate.errors, {
-      deploymentManifest: deployment,
-      rootData: deployment
-    })
+    valid: valid && requiredErrors.length === 0,
+    errors: [...schemaErrors, ...requiredErrors]
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.56.0",
+  "version": "2.58.0",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {
@@ -24,6 +24,11 @@
     "dev-deploy": "node scripts/pnpm/dev-deploy.mjs",
     "af": "node scripts/pnpm/af.mjs",
     "check-quiet": "node scripts/pnpm/check-quiet.mjs",
+    "agent-skills:sync": "node scripts/pnpm/agent-skills-sync.mjs",
+    "agent-skills:check": "node scripts/pnpm/agent-skills-sync.mjs --check",
+    "agent-skills:sync:codex": "node scripts/pnpm/agent-skills-sync.mjs --codex-home",
+    "agent-skills:test": "node --test scripts/pnpm/agent-skills-sync.test.mjs",
+    "dev-deploy:test": "node --test scripts/pnpm/dev-deploy.test.mjs",
     "check": "npm run lint && npm run test",
     "lint": "eslint . --ext .js",
     "lint:fix": "eslint . --ext .js --fix",

package/templates/README.md

@@ -22,12 +22,16 @@ Application templates are folder-based and located under `templates/applications
 | `aifabrix-builder/builder/builder-api/` | `templates/applications/builder-api/` |
 | `aifabrix-miso/builder/miso-controller/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/miso-controller/` |
 | `aifabrix-miso/builder/keycloak/` (`env.template`, `application.yaml`, `Dockerfile`, `cimd-lenient-parse/`) | `templates/applications/keycloak/` |
+| `aifabrix-miso/infrastructure/marketplace/` (`main.json`, `createUiDefinition.json`) | `templates/marketplace/` |
 | `aifabrix-dataplane/builder/dataplane/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/dataplane/` |
 
 **Schema master (dataplane):** Also copies dataplane `app/schemas/json/` core integration schemas + `type/*` and `configs/deployment-rules.yaml` into `lib/schema/` (same contract as dataplane `make sync-json`). Do not hand-edit those mirrors — edit dataplane SSOT, then sync. Builder-owned schemas in `lib/schema/` (wizard, infra, etc.) are left alone.
 
 Overrides: `AIFABRIX_MISO_SRC`, `AIFABRIX_DATAPLANE_SRC` / `AIFABRIX_DATAPLANE_ROOT` (repo roots). Install with `aifabrix up-platform` / `up-builder-api` — do not hand-edit the template copies as primary.
 
+The Marketplace copies are compiled/source artifacts for a future Azure install command. `main.parameters.json` is intentionally excluded because installation secrets and customer-specific values must come from the installer's secure parameter file.
+The two-stage CLI procedure and a blank parameter-file example are in [docs/marketplace-env-deploy.md](../docs/marketplace-env-deploy.md).
+
 **Template Validation:**
 - Template folder must exist in `templates/applications/<name>/`
 - Template folder must contain at least one file

package/templates/agent-kit/instructions/AGENTKIT.md

@@ -57,13 +57,13 @@ curl -fsSL https://claude.ai/install.sh | bash
 claude auth login
 ```
 
-**Run in tmux** from this workspace so closing the terminal does not kill Claude. `--remote-control` is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (Code). That is not `claude --cloud` (a separate cloud VM). Claude `--tmux` is for worktrees only.
+**Run in tmux** from this workspace so closing the terminal does not kill Claude. The command enables Remote Control and this workspace's Claude auto-approval by default. Remote Control is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (Code). That is not `claude --cloud` (a separate cloud VM). Claude `--tmux` is for worktrees only.
 
 ```bash
-aifabrix agent-kit start claude --remote-control --approve-all --yes
+aifabrix agent-kit start claude
 ```
 
-tmux session name defaults to this folder. Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). Override the folder with `--name`. Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t <folder>`. Several workspaces can run at once. Same account on phone and PC (`claude auth login`, Pro/Max/Team — not an API key). On the phone: Claude app → **Code**. Skills: `/aifabrix-plan` (and the other `/aifabrix-*` names). First `claude` must run inside this workspace, not your home directory. Full notes: `.agents/skills/shared/hosts.md`.
+tmux session name defaults to this folder. Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). Override with `--name`; opt out with `--no-remote-control` and/or `--skip-approve-all`. Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t <folder>`. Use `aifabrix agent-kit list` and `agent-kit kill <folder>` to manage sessions. Same account on phone and PC (`claude auth login`, Pro/Max/Team — not an API key). On the phone: Claude app → **Code**. Skills: `/aifabrix-plan` (and the other `/aifabrix-*` names). First `claude` must run inside this workspace, not your home directory. Full notes: `.agents/skills/shared/hosts.md`.
 {{/if}}
 {{#if codex}}
 
@@ -76,13 +76,13 @@ npm install -g @openai/codex
 codex login
 ```
 
-**Run in tmux** from this workspace so the session stays if you close the terminal:
+**Run in tmux** from this workspace so the session stays if you close the terminal. The command starts native Codex Remote Control and writes this workspace's Codex auto-approval by default:
 
 ```bash
-aifabrix agent-kit start codex --approve-all --yes
+aifabrix agent-kit start codex
 ```
 
-Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t <folder>`, or `aifabrix agent-kit start codex` from this workspace. Default session name is this folder. Skills: `$aifabrix-plan` (and the other `$aifabrix-*` names). Codex reads `AGENTS.md`. Full notes: `.agents/skills/shared/hosts.md`.
+Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t <folder>`. A duplicate `start` fails instead of attaching. Default session name is this folder. Use `--no-remote-control` and/or `--skip-approve-all` to opt out. Skills: `$aifabrix-plan` (and the other `$aifabrix-*` names). Codex reads `AGENTS.md`. Full notes: `.agents/skills/shared/hosts.md`.
 {{/if}}
 
 ## Auth for delivery CLI

package/templates/agent-kit/skills/shared/hosts.md

@@ -6,14 +6,14 @@ Install and sign-in steps are in `AGENTKIT.md`. This file is how to **run** each
 
 Do not start Claude or Codex in your home directory. `cd` into this git workspace first.
 
-## Auto-approve (optional)
+## Auto-approve
 
 `aifabrix agent-kit install` can write gitignored host configs so Claude Code and Codex do not prompt for every tool:
 
 - Claude Code: `.claude/settings.local.json` (`permissions.defaultMode` = `bypassPermissions`, `allow` = `Bash(aifabrix *)` and `Read(~/**)`)
 - Codex: `.codex/config.toml` (`approval_policy = "never"`, `sandbox_mode = "workspace-write"`)
 
-Those files stay in **this workspace**. Claude may **read** files under the developer home (`Read(~/**)`) and run the delivery CLI (`Bash(aifabrix *)`). They do not add sibling folders as extra workspaces, do not grant Write outside this repo, and do not allow every shell command. TTY asks which host to auto-approve when both are selected. `--approve-all claude` or `--approve-all codex` writes only that host. `--yes` or a non-TTY / `--json` run writes them. `--skip-approve-all` skips. `--force` overwrites existing local files. Builder never writes `~/.claude` or `~/.codex`.
+Those files stay in **this workspace**. Claude may **read** files under the developer home (`Read(~/**)`) and run the delivery CLI (`Bash(aifabrix *)`). They do not add sibling folders as extra workspaces, do not grant Write outside this repo, and do not allow every shell command. `agent-kit start claude|codex` writes only the selected host's file by default; `--skip-approve-all` opts out. Install/update retain their explicit approval prompts and flags. `--force` overwrites existing local files. Builder never writes `~/.claude` or `~/.codex`.
 
 ## Cursor
 
@@ -23,13 +23,13 @@ Those files stay in **this workspace**. Claude may **read** files under the deve
 
 ## Claude Code
 
-**Local or SSH — tmux.** Closing the terminal must not kill Claude. Agent Kit starts Claude **inside tmux**. `--remote-control` is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (**Code**). Do not use `claude --cloud` for this — that starts a different machine that clones GitHub. Claude `--tmux` is only for `--worktree` sessions, not this wrapper.
+**Local or SSH — tmux.** Closing the terminal must not kill Claude. Agent Kit starts Claude **inside tmux**, with Remote Control and workspace auto-approval enabled by default. Remote Control is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (**Code**). Do not use `claude --cloud` for this — that starts a different machine that clones GitHub. Claude `--tmux` is only for `--worktree` sessions, not this wrapper.
 
 ```bash
-aifabrix agent-kit start claude --remote-control --approve-all --yes
+aifabrix agent-kit start claude
 ```
 
-tmux session name is this folder (for example `aifabrix-docs`). Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). `--name` overrides the folder. Several workspaces can run at once. Detach without killing Claude: `Ctrl-b` then `d`. Reattach: `tmux attach -t aifabrix-docs`, or run `start` again from the same folder. Then `/aifabrix-plan` (or another `/aifabrix-*` skill). First run in a project asks you to trust the folder; accept only this workspace.
+tmux session name is this folder (for example `aifabrix-docs`). Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). `--name` overrides the folder; `--no-remote-control` and `--skip-approve-all` opt out. Several workspaces can run at once. Detach without killing Claude: `Ctrl-b` then `d`. Reattach: `tmux attach -t aifabrix-docs`. A duplicate `start` fails instead of attaching. Then `/aifabrix-plan` (or another `/aifabrix-*` skill). First run in a project asks you to trust the folder; accept only this workspace.
 
 **Phone and PC.** Sign in with the same Claude Pro/Max/Team account (`claude auth login` — not an API key). After Remote Control starts, open **Code** in the Claude mobile app and/or [claude.ai/code](https://claude.ai/code) on the PC. In an already-running session, `/remote-control` or `/mobile`.
 
@@ -37,13 +37,13 @@ Closing the terminal (or SSH) does not stop a tmux session. Stopping tmux or the
 
 ## Codex
 
-**Local or SSH — tmux (recommended).** Same recipe on your PC and on a remote host. tmux keeps Codex running if you close the terminal or disconnect SSH. Codex has no Claude-style phone/web Remote Control.
+**Local or SSH — tmux and Remote Control.** tmux keeps Codex running if you close the terminal or disconnect SSH. Agent Kit also starts Codex's native remote-control daemon and workspace auto-approval by default.
 
 ```bash
-aifabrix agent-kit start codex --approve-all --yes
+aifabrix agent-kit start codex
 ```
 
-Equivalent: `tmux new -s aifabrix-docs -c /path/to/this-workspace` then `codex`. Default `--name` is the last folder. If that session already exists, `start` attaches. Detach: `Ctrl-b` then `d`. Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`.
+Default `--name` is the last folder. `--no-remote-control` keeps the launch local; `--skip-approve-all` leaves Codex permissions unchanged. If that session already exists, `start` fails with list/kill guidance. Detach: `Ctrl-b` then `d`. Reattach with `tmux attach -t aifabrix-docs`. Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`. Killing tmux does not stop the shared daemon; use `codex remote-control stop` when required.
 
 **Foreground only (no tmux).**
 
@@ -58,8 +58,8 @@ codex
 | --- | --- |
 | New named session | `tmux new -s <name> -c /path/to/this-workspace` |
 | Detach (leave it running) | `Ctrl-b`, then `d` |
-| List sessions | `tmux ls` |
+| List sessions | `aifabrix agent-kit list` |
 | Attach | `tmux attach -t <name>` |
-| Kill session | `tmux kill-session -t <name>` |
+| Kill session | `aifabrix agent-kit kill <name>` |
 
 Use a different `--name` per workspace so several Claude or Codex sessions can run on the same host. Claude and Codex in the **same** folder also need two names.

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.68
+  version: 2.0.70
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).

package/templates/applications/dataplane/env.template

@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.68
+VERSION=2.0.70
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.78'
+  version: '2.0.81'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
@@ -58,7 +58,8 @@ build:
   dockerfile: builder/miso-controller/Dockerfile # Dockerfile name (relative to project root)
   envOutputPath: ../../packages/miso-controller/.env # Copy .env to repo root for local dev (relative to builder/) (if null, no .env file is copied) (if empty, .env file is copied to repo root)
   language: typescript # Runtime language for template selection (typescript or python)
-  reloadStart: pnpm --filter @aifabrix/miso-controller run dev:watch:public # Docker --reload: nodemon backend + pre-built UI (no Vite in container)
+  # Runtime image has npm/npx, not pnpm. Keep the existing dev:watch:public script.
+  reloadStart: npm --prefix packages/miso-controller run dev:watch:public
 
 # Repository Configuration (pipeline validate: REPOSITORY_URL_MISMATCH)
 repository:

package/templates/applications/miso-controller/env.template

@@ -213,12 +213,6 @@ MISO_ENVIRONMENT=miso
 MISO_CLIENTID=kv://miso-controller-client-idKeyVault
 MISO_CLIENTSECRET=kv://miso-controller-client-secretKeyVault
 
-# Evaluation mode (optional .env override of DB controller.configuration.evaluation):
-# When true (default if DB omits flag), infra deploy may coerce :envKey to `miso` — e2e poll on `dev` can 404.
-# Set false locally to force path envKey to match deploy + GET .../deployments/:id.
-# Unset = use DB only.
-CONTROLLER_EVALUATION=
-
 # =============================================================================
 # ENTRA ID ONBOARDING (vendor multi-tenant app — admin consent) — [always]
 # =============================================================================
@@ -361,6 +355,21 @@ API_KEY=kv://miso-controller-secrets-apiKeyVault
 #   LICENSE_VALIDATION_DISABLED=true switch; do not use it in deployed installations.
 LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault
 
+# Signed licenses require a Mori issuer key trusted independently of the JWT.
+# Provision the SPKI PEM public key and exact issuer during installation, before
+# pasting LICENSE_JWT or using Update license. An embedded JWT publicKey/jwk or Mori URL
+# is not a trust source. For disconnected installs, deliver the key through the
+# authenticated installation package or another operator-verified channel.
+# Azure resolves this from Key Vault using the app's managed identity.
+# Builder Docker resolves the same kv:// catalog key from the installer's local
+# secrets store before starting the container. Provision a trusted Mori public key
+# there first; the empty catalog default is only for unlicensed Community mode.
+MORI_LICENSE_PUBLIC_KEY=kv://mori-license-public-keyKeyVault
+# Plain docker run can instead leave MORI_LICENSE_PUBLIC_KEY unset and use a
+# trusted, read-only PEM mount at this path.
+# MORI_LICENSE_PUBLIC_KEY_FILE=/run/secrets/mori-license-public-key.pem
+MORI_LICENSE_ISSUER=mori-controller
+
 # =============================================================================
 # ENTRA ID ONBOARDING (delegated Graph via Mori)
 # =============================================================================

package/templates/marketplace/createUiDefinition.json

@@ -0,0 +1,77 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
+  "handler": "Microsoft.Azure.CreateUIDef",
+  "version": "0.1.2-preview",
+  "parameters": {
+    "config": {
+      "basics": {
+        "description": "Choose subscription, resource group, and region above. Under **Application resources Resource group name**, enter your install id (for example `aifabrixpoc02`). That managed resource group name is the naming prefix: resources become `{rg}-miso-asp`, `{rg}-miso-miso`, and so on. Set the Azure **Application name** to the same id when the portal asks. Enter the initial platform administrator password and choose the license below. Container images are pulled with the web apps' managed identities; no registry credential is needed."
+      }
+    },
+    "basics": [
+      {
+        "name": "adminPassword",
+        "type": "Microsoft.Common.PasswordBox",
+        "label": "Administrator password",
+        "toolTip": "Password for the initial AI Fabrix platform administrator (user admin). PostgreSQL, Keycloak, and encryption secrets are generated automatically and stored in Key Vault — do not reuse this password for infrastructure.",
+        "constraints": {
+          "required": true,
+          "regex": "^.{8,128}$",
+          "validationMessage": "Password must be 8–128 characters."
+        },
+        "options": {
+          "hideConfirmation": false
+        }
+      },
+      {
+        "name": "licenseChoice",
+        "type": "Microsoft.Common.DropDown",
+        "label": "License",
+        "toolTip": "License AI Fabrix requests during tenant activation. Community is permanent. Standard or Enterprise requested by name is a 30-day evaluation. For a purchased plan, choose 'Purchased Marketplace subscription' and enter its subscription ID; the edition is then resolved from the purchased plan.",
+        "defaultValue": "Community",
+        "constraints": {
+          "required": true,
+          "allowedValues": [
+            {
+              "label": "Community",
+              "value": "COMMUNITY"
+            },
+            {
+              "label": "Standard (30-day evaluation)",
+              "value": "STANDARD"
+            },
+            {
+              "label": "Enterprise (30-day evaluation)",
+              "value": "ENTERPRISE"
+            },
+            {
+              "label": "Purchased Marketplace subscription",
+              "value": "SUBSCRIPTION_ID"
+            }
+          ]
+        }
+      },
+      {
+        "name": "licenseSubscriptionKey",
+        "type": "Microsoft.Common.TextBox",
+        "label": "Marketplace subscription ID",
+        "toolTip": "The ID (GUID) of the purchased AI Fabrix Azure Marketplace subscription.",
+        "defaultValue": "",
+        "visible": "[equals(basics('licenseChoice'), 'SUBSCRIPTION_ID')]",
+        "constraints": {
+          "required": "[equals(basics('licenseChoice'), 'SUBSCRIPTION_ID')]",
+          "regex": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+          "validationMessage": "Enter the Marketplace subscription ID as a GUID (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)."
+        }
+      }
+    ],
+    "steps": [],
+    "outputs": {
+      "location": "[location()]",
+      "deploymentEnvironment": "evaluation",
+      "adminPassword": "[basics('adminPassword')]",
+      "licenseEdition": "[if(equals(basics('licenseChoice'), 'SUBSCRIPTION_ID'), basics('licenseSubscriptionKey'), basics('licenseChoice'))]",
+      "acrResourceId": "__MARKETPLACE_ACR_RESOURCE_ID__"
+    }
+  }
+}

package/templates/marketplace/install.parameters.example.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "adminPassword": { "value": "" },
+    "marketplaceSubscriptionId": { "value": "" },
+    "location": { "value": "swedencentral" }
+  }
+}