@aifabrix/builder 2.58.0 → 2.60.0

package/templates/applications/dataplane/env.template

@@ -8,8 +8,8 @@
 
 # HTTP port for the app
 PORT=${PORT}
-# dev | tst | pro
-ENVIRONMENT=dev
+# dev | tst | pro. Resolved from the deployment environment; local Docker is dev.
+ENVIRONMENT={ENVIRONMENT}
 # Enable debug mode
 DEBUG=false
 # Logging level: DEBUG, INFO, WARNING, ERROR, CRITICAL
@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.70
+VERSION=2.0.74
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5
@@ -98,6 +98,15 @@ DB_3_PASSWORD=kv://databases-dataplane-3-passwordKeyVault
 # so Docker dataplane + miso-controller do not exhaust max_connections alongside make dev.
 # SAME_SERVER_POOL_BUDGET=24
 
+# Transaction lifetime guardrails (587.0). Loaders run remote/AI/file work outside
+# transactions; these are leak guards and telemetry, not the normal control path.
+# idle_in_transaction_session_timeout applied to every Dataplane engine (seconds, 0 = off).
+DB_IDLE_IN_TRANSACTION_TIMEOUT_SECONDS=60
+# Warn (sanitized: loader/phase/duration/counts/correlation only) when one transaction exceeds this.
+DB_SLOW_TRANSACTION_WARN_SECONDS=5
+# Upper bound of rows per Evidence bulk load request (atomic below the bound; larger fails before mutation).
+EVIDENCE_LOAD_MAX_ITEMS=500
+
 # =============================================================================
 # REDIS CONFIGURATION
 # =============================================================================
@@ -128,6 +137,21 @@ ABAC_POLICY_PARSE_CACHE_MAX_ENTRIES=2048
 # AUTHENTICATION CONFIGURATION
 # =============================================================================
 
+# MISO secret runtime (583.0): every process calls miso-client init_secrets() once.
+# Unset/local: MISO_AUTH_MODE=local — the SDK keeps this .env/dotenv credential flow.
+# Azure: deployment supplies MISO_AUTH_MODE=azure-managed-identity, MISO_CONTROLLER_URL,
+# MISO_BOOTSTRAP_AUDIENCE (and optional AZURE_CLIENT_ID); Miso-managed secrets
+# (DATABASE_URL, REDIS_URL, ENCRYPTION_KEY, ...) come from the Controller broker,
+# never from this file, and no MISO_CLIENTSECRET is required or returned.
+# Rotation: changed names are reread from the SDK; DB/Redis pools are disposed and
+# the process reports secretRotationRestartRequired until restarted. Invalidation
+# (denial/expiry) stops new secret-dependent work and makes health unhealthy.
+# Health: /health, /api/v1/health and /api/v1/health/platform return HTTP 503 with
+# reasonCode misoTokenUnavailable | misoTokenRejected | misoControllerUnreachable |
+# misoValidationTimeout whenever the Controller does not accept the live client
+# token — in LOCAL_MODE too. These endpoints measure usable application health,
+# not process liveness.
+MISO_AUTH_MODE=local
 # MISO Application Client Credentials (per application)
 # Backend-only: never expose MISO_CLIENTSECRET to the Vite frontend (use VITE_* in app-ui).
 MISO_CLIENTID=kv://dataplane-client-idKeyVault
@@ -151,7 +175,7 @@ MISO_LOGOUT_URL=/logout
 # Environment key sent to miso-controller (e.g. environmentKey on RBAC/register) when not supplied in the payload.
 # Set MISO_PIPELINE_ENV_KEY=dev when the controller installation uses dev (e.g. MISO_CLIENTID=miso-controller-dev-dataplane).
 # If unset, derived from MISO_CLIENTID (e.g. dev from miso-controller-dev-dataplane).
-MISO_PIPELINE_ENV_KEY=
+MISO_PIPELINE_ENV_KEY={PIPELINE_ENV_KEY}
 
 # LLM: chat/embed route through governed enterprise-llm only. Provider credentials
 # live on LLM provider external systems + dataplane secret store (not product .env).
@@ -334,3 +358,12 @@ TRUST_AI_EXPOSURE_GATE_ENABLED=false
 # when 346.rules / §17 revisions must invalidate existing certificates without matching rulesVersion.
 CERTIFICATION_DATASOURCE_SCHEMA_VERSION=
 CERTIFICATION_RULES_VERSION=
+
+# =============================================================================
+# DIMENSION ABAC ENFORCEMENT (589.0)
+# =============================================================================
+# false (default): Stage 1 dimension ABAC scope services do not enforce
+# external-system/source assignment scope, client-principal system binding or
+# subscription owner scope (RBAC permissions still apply).
+# true: enforce the Dimension ABAC certification rules (2026-09-21).
+DIMENSION_ABAC_ENFORCEMENT_ENABLED=false

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.81'
+  version: '2.0.83'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
@@ -75,6 +75,29 @@ repository:
 # - DATABASE_URL, REDIS_URL, KEYCLOAK_* → auto-generated during Azure install
 # - Other MISO_*, AZURE_*, kv:// → credentials and system parameters
 # - PORT, NODE_ENV, MISO_ENVIRONMENT → set by deployment target
+# - LOCATION → resolved from the platform match below
+
+# =============================================================================
+# Platform Resolution (target Azure resource group decides)
+# =============================================================================
+# One controller per installation (MISO_ENVIRONMENT=miso), so the values that vary
+# are stack-level, not per environment: there is no `environments:` section.
+# env.template consumes these names as {NAME}.
+platforms:
+  - resource: aifabrix-int-{platform}
+    name: aifabrix
+    options: [dev, tst, pro]
+    configuration:
+      - name: LOCATION
+        value: 'swedencentral'
+
+  - resource: aifabrix-ce-*
+    name: '*'
+    # The group carries no dev|tst|pro token, so the platform is declared.
+    platform: dev
+    configuration:
+      - name: LOCATION
+        value: 'swedencentral'
 
 configuration:
   # -------------------------------------------------------------------------

package/templates/applications/miso-controller/env.template

@@ -29,11 +29,6 @@
 #
 # =============================================================================
 
-# Skip automatic first-time bootstrap on controller startup (default: false).
-# Bootstrap = DB controller row, Keycloak realm/client, admin user, roles (empty DB only).
-# Keep false for normal dev — this is NOT the Azure tenant-activation UI wizard.
-# Set true only for tests that must not mutate Keycloak/DB on startup.
-SKIP_FIRST_TIME_SETUP=false
 
 # Force onboarding to run even when a controller row already exists (default: unset/false).
 # Prefer SQL/API one-shot: POST /api/v1/controller/force-onboarding (controller:admin) or set
@@ -46,11 +41,12 @@ SKIP_FIRST_TIME_SETUP=false
 ONBOARDING_CONTROLLER_KEY=miso-controller
 
 # Infrastructure/service name used by controller/onboarding flows
-INFRASTRUCTURE_NAME=aifabrix
+INFRASTRUCTURE_NAME=${DEV_USERNAME}.${DEV_ROOT_DOMAIN}
 
 # Azure region (required for first-time onboarding: controller record / provisioning metadata).
 # Use the region you deploy to (e.g. westeurope, eastus, northeurope). Single env name: LOCATION.
-LOCATION=westeurope
+# Resolved from the platform match; see `platforms` in application.yaml.
+LOCATION={LOCATION}
 
 # Required for admin user creation during onboarding
 # Password for the initial administrator user (username: admin)
@@ -59,23 +55,20 @@ ONBOARDING_ADMIN_PASSWORD=kv://miso-controller-admin-passwordKeyVault
 # Optional admin email for onboarding (default: admin@aifabrix.ai)
 ONBOARDING_ADMIN_EMAIL=kv://miso-controller-admin-emailKeyVault
 
-# [customerOwned] Create development environment during onboarding (default: false)
-# Full platform: create miso, dev, tst, and pro during onboarding (default: false)
-# When true, supersedes ONBOARDING_CREATE_DEV_ENV for which extra environments are created
-# [saasDirect] Keep false in the customer container — extra environments belong to the
-# eSystems deploy path, not the customer wizard.
+# Which environments onboarding creates (plan 240.0). This is the only onboarding environment
+# variable: false or unset creates `dev`, true creates `dev`, `tst` and `pro`.
+#
+# `dev` is always created — every edition is entitled to it, and the installation registers its
+# own applications into it. What `dev` *is* follows the licence rather than this flag: in the
+# shared model it runs on the installation stack and needs no infrastructure of its own; in the
+# dedicated model it waits at lifecycle `created` for an administrator.
+#
+# Replaces ONBOARDING_CREATE_DEV_ENV, ONBOARDING_CREATE_MISO_ENV and SKIP_FIRST_TIME_SETUP,
+# which expressed one decision in four places and disagreed about its default. Whether the
+# installation environment is deployed during onboarding now follows ONBOARDING_MODE: a hosted
+# (saasDirect) installation deploys it, a customer-owned one leaves it to the activation wizard.
 ONBOARDING_FULL_PLATFORM=false
 
-# [customerOwned] When true, run Azure env deploy for onboarding envs (SDK modules). Default false —
-# Marketplace already provisions infra; TA owns customer env deploy.
-# [saasDirect] Keep false: eSystems already deployed the required runtime services.
-ONBOARDING_CREATE_MISO_ENV=false
-
-# [customerOwned] Set to true to create both miso and dev environments during onboarding
-# When false (default), only the miso environment is created (ignored when ONBOARDING_FULL_PLATFORM=true)
-# [saasDirect] Keep false in the customer container.
-ONBOARDING_CREATE_DEV_ENV=true
-
 # =============================================================================
 # APPLICATION ENVIRONMENT
 # =============================================================================
@@ -226,12 +219,7 @@ MISO_CLIENTSECRET=kv://miso-controller-client-secretKeyVault
 #
 # ENTRA_ID_CENTRAL_CALLBACK_URI — Web redirect on the vendor app; must point at
 # Mori (e.g. …/entra-id-concent/callback), not the SPA or controller.
-# ENTRA_CALLBACK_STATE_SECRET — Shared HMAC secret (min 16 chars) for OAuth state
-# between controller and Mori callback service; same value on Mori and controller.
-#
-# Delegated Graph (second redirect URI on the same vendor app): see section below.
-ENTRA_CALLBACK_STATE_SECRET=kv://entra-callback-state-secret
-ENTRA_ID_CENTRAL_CALLBACK_URI=https://dev01.aifabrix.dev/mori/entra-id-concent/callback
+ENTRA_ID_CENTRAL_CALLBACK_URI=url://mori-controller-public/entra-id-concent/callback
 ENTRA_ID_CLIENT_ID=kv://entra-client-idKeyVault
 ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
 
@@ -285,7 +273,7 @@ SKIP_DB_REDEPLOY=true
 # database    — DB/RBAC only, no Docker from controller; dashboard (default dev)
 #
 # Missing or invalid value defaults to azure (wizard + Azure credentials).
-# Bootstrap (SKIP_FIRST_TIME_SETUP=false) is separate from the activation wizard.
+# First-time bootstrap is separate from the activation wizard.
 # NOTE: there is no `saas` value. eSystems-hosted SaaS runs DEPLOYMENT=azure with
 # ONBOARDING_MODE=saasDirect (see next section).
 DEPLOYMENT=database
@@ -375,7 +363,7 @@ MORI_LICENSE_ISSUER=mori-controller
 # =============================================================================
 # Must match a Web redirect URI on the vendor multi-tenant app and Mori’s route
 # …/entra-graph-delegated/callback. Shared pro Mori addon (CICD *-miso-rg):
-ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://dev01.aifabrix.dev/mori/entra-graph-delegated/callback
+ENTRA_GRAPH_DELEGATED_REDIRECT_URI=url://mori-controller-public/entra-graph-delegated/callback
 
 # Optional delegated Graph scopes for GET …/graph-auth-url (space- or comma-separated).
 # ENTRA_GRAPH_DELEGATED_SCOPES=https://graph.microsoft.com/Application.ReadWrite.All,https://graph.microsoft.com/Group.ReadWrite.All,https://graph.microsoft.com/Synchronization.ReadWrite.All,openid,profile,offline_access
@@ -386,12 +374,11 @@ ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://dev01.aifabrix.dev/mori/entra-graph-d
 # =============================================================================
 # MORI SERVICE CONFIGURATION
 # =============================================================================
-# Shared Mori (handoff poll + Entra callback). Local `url://mori-controller-public`
-# only works when a local Mori app is registered and running for this developer.
-# MORI_CALLBACK_API_KEY must be the same secret as Mori MORI_CONTROLLER_CALLBACK_API_KEY
-# (both resolve from kv://mori-callback-api-keyKeyVault — do not generate separate values).
+# Shared Mori. Local `url://mori-controller-public` only works when a local Mori app is
+# registered and running for this developer.
+# MORI_API_KEY is per-installation and is minted by POST /marketplace/bootstrap; it is written
+# here by the controller after registration, not provisioned ahead of it.
 MORI_BASE_URL=kv://mori-controller-web-server-url
-MORI_CALLBACK_API_KEY=kv://mori-callback-api-keyKeyVault
 MORI_API_KEY=kv://mori-controller-api-keyKeyVault
 
 # =============================================================================

package/templates/external-system/external-datasource.yaml.hbs

@@ -98,7 +98,7 @@ openapi:
 
 # --- Optional sections: uncomment or delete as needed ---
 #
-# Query-time (v2.4): public list/get/filter are served from persisted Dataplane DB — not live external HTTP on every read (Plan 346 section 11).
+# Query-time: public list/get/filter are served from persisted Dataplane DB — not live external HTTP on every read.
 # External APIs: sync jobs and create/update/delete execution paths. CIP fetch→map is for ingestion, writes, or orchestration — populate storage before expecting query APIs.
 #
 # CIP (Composable Integration Pipeline): fetch → [paginate] → [map] → [filter] → output
@@ -106,12 +106,13 @@ openapi:
 # execution.cip requires version "1.0" and operations.<name>.steps ($defs.cipDefinition). Custom operation keys must match the same pattern as capabilities[].
 #
 {{#if (eq schemaEntityType "recordStorage")}}
-# sync: external APIs run during sync (Plan 346 section 11). Minimal contract: mode/schedule/batchSize per schema. FK fields on a record should update atomically in one logical write.
+# sync: external APIs run during synchronization. New automatic schedules default to calendar-month cadence in UTC.
+# Omit schedule to retain manual-only synchronization. Set enabled: false for total synchronization disable; retained schedule and incremental settings are preserved.
 # sync:
-#   pull:
-#     enabled: true
-#     schedule: "0 * * * *"
-#     batchSize: 500
+#   enabled: true
+#   mode: pull
+#   schedule: "@monthly"
+#   batchSize: 500
 # validation: structural / pre-persistence checks; quality: post-mapping acceptance (e.g. rejectIf) — see schema when you enable them.
 # capabilities: standard names list, get, create, update, delete + custom names matching ^[a-z][a-zA-Z0-9]*$; must match execution.cip.operations / openapi.operations you implement.
 # capabilities: [list, get]