@aifabrix/builder 2.58.0 → 2.60.0

package/templates/marketplace/main.json

@@ -5,7 +5,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.47.16.16243",
-      "templateHash": "12207364571048202485"
+      "templateHash": "6752412774681258733"
     }
   },
   "parameters": {
@@ -23,6 +23,14 @@
         "description": "Azure region for deployment. Default is the managed resource group location; portal may override via createUiDefinition."
       }
     },
+    "capacityProfile": {
+      "type": "string",
+      "defaultValue": "s",
+      "allowedValues": ["s", "m", "l", "xl"],
+      "metadata": {
+        "description": "Baseline capacity of the Miso/Keycloak foundation: s (B3), m (P2v3), l (P3v3), xl (P3mv3). One compute instance for every profile. Select the purchased capacity independently of licenseEdition; this does not provision workload environment topology."
+      }
+    },
     "tags": {
       "type": "object",
       "defaultValue": {
@@ -133,7 +141,14 @@
       "type": "bool",
       "defaultValue": true,
       "metadata": {
-        "description": "When false, skip ARM role assignments (CI/CD redeploy without roleAssignments/write). RBAC must already exist."
+        "description": "When false, skip ARM role assignments in THIS resource group (CI/CD redeploy without roleAssignments/write). RBAC must already exist."
+      }
+    },
+    "deployRegistryRoleAssignment": {
+      "type": "bool",
+      "defaultValue": "[parameters('deployRoleAssignments')]",
+      "metadata": {
+        "description": "When false, skip the AcrPull grant on the container registry. That grant lives in the registry's own resource group, which for a customer installation is in the vendor's tenant, where Azure RBAC cannot reach. An installation deployed with registry credentials sets this false and keeps the grants in its own resource group, which it does own."
       }
     },
     "moriBaseUrl": {
@@ -143,18 +158,18 @@
         "description": "Mori base URL for controller tenant activation and Entra handoff (no trailing slash)"
       }
     },
-    "moriCallbackApiKey": {
-      "type": "securestring",
+    "moriLicensePublicKey": {
+      "type": "string",
       "defaultValue": "",
       "metadata": {
-        "description": "Optional shared secret for Mori → controller callback. Configure through the Miso installation/application contract."
+        "description": "Mori licence issuer public key in SPKI PEM form. Empty leaves the installation unpinned, and Miso then refuses a licence rather than trusting a key carried inside it."
       }
     },
-    "entraCallbackStateSecret": {
-      "type": "securestring",
-      "defaultValue": "",
+    "moriLicenseIssuer": {
+      "type": "string",
+      "defaultValue": "mori-controller",
       "metadata": {
-        "description": "Optional shared HMAC secret for Entra consent OAuth state. Configure through the Miso installation contract."
+        "description": "Expected `iss` claim on a Mori licence."
       }
     },
     "entraIdClientId": {
@@ -210,15 +225,44 @@
   },
   "variables": {
     "infrastructureName": "[if(not(empty(parameters('infrastructureNameOverride'))), parameters('infrastructureNameOverride'), resourceGroup().name)]",
+    "capacityProfiles": {
+      "s": {
+        "computeSku": "B3",
+        "postgresSku": "Standard_B2ms",
+        "postgresTier": "Burstable",
+        "postgresStorageGB": 64
+      },
+      "m": {
+        "computeSku": "P2v3",
+        "postgresSku": "Standard_D2ds_v5",
+        "postgresTier": "GeneralPurpose",
+        "postgresStorageGB": 128
+      },
+      "l": {
+        "computeSku": "P3v3",
+        "postgresSku": "Standard_D4ds_v5",
+        "postgresTier": "GeneralPurpose",
+        "postgresStorageGB": 256
+      },
+      "xl": {
+        "computeSku": "P3mv3",
+        "postgresSku": "Standard_D8ds_v5",
+        "postgresTier": "GeneralPurpose",
+        "postgresStorageGB": 512
+      }
+    },
+    "selectedCapacity": "[variables('capacityProfiles')[parameters('capacityProfile')]]",
     "deploymentLocation": "[parameters('location')]",
     "appInsightsLocation": "[if(equals(variables('deploymentLocation'), 'norwaywest'), 'norwayeast', variables('deploymentLocation'))]",
     "openAiLocationKnown": "[contains(createArray('australiaeast', 'brazilsouth', 'canadaeast', 'eastus', 'eastus2', 'francecentral', 'japaneast', 'koreacentral', 'northcentralus', 'norwayeast', 'polandcentral', 'southafricanorth', 'southcentralus', 'southindia', 'swedencentral', 'switzerlandnorth', 'uksouth', 'westeurope', 'westus', 'westus3'), variables('deploymentLocation'))]",
-    "openAiLocation": "[if(variables('openAiLocationKnown'), variables('deploymentLocation'), 'swedencentral')]",
+    "createAzureOpenAI": "[and(and(parameters('enableAzureOpenAI'), variables('openAiLocationKnown')), not(variables('hostedInstallation')))]",
     "subnetBase": "[add(20, mod(length(variables('infrastructureName')), 230))]",
     "registryPasswordConfigured": "[not(empty(parameters('acrAdminPassword')))]",
     "acrRegistryName": "[toLower(last(split(parameters('acrResourceId'), '/')))]",
     "effectiveAcrLoginServer": "[if(empty(parameters('acrLoginServer')), format('{0}{1}', variables('acrRegistryName'), environment().suffixes.acrLoginServer), parameters('acrLoginServer'))]",
     "registryUsername": "[if(variables('registryPasswordConfigured'), if(empty(parameters('acrAdminUsername')), variables('acrRegistryName'), parameters('acrAdminUsername')), '')]",
+    "hostedInstallation": "[equals(parameters('onboardingMode'), 'saasDirect')]",
+    "effectiveEntraIdTenantId": "[if(variables('hostedInstallation'), '', parameters('entraIdTenantId'))]",
     "keycloakContainerImage": "[format('{0}/aifabrix/keycloak:{1}', variables('effectiveAcrLoginServer'), parameters('keycloakImageTag'))]",
     "misoControllerContainerImage": "[format('{0}/aifabrix/miso-controller:{1}', variables('effectiveAcrLoginServer'), parameters('misoImageTag'))]",
     "keycloakVdirPublic": "/auth",
@@ -973,7 +1017,7 @@
       ]
     },
     {
-      "condition": "[parameters('enableAzureOpenAI')]",
+      "condition": "[variables('createAzureOpenAI')]",
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2025-04-01",
       "name": "azureOpenAI",
@@ -987,7 +1031,7 @@
             "value": "[variables('infrastructureName')]"
           },
           "location": {
-            "value": "[variables('openAiLocation')]"
+            "value": "[variables('deploymentLocation')]"
           },
           "tags": {
             "value": "[parameters('tags')]"
@@ -1432,10 +1476,10 @@
             "value": "[format('{0}-miso-asp', variables('infrastructureName'))]"
           },
           "skuDisplay": {
-            "value": "B2"
+            "value": "[variables('selectedCapacity').computeSku]"
           },
           "capacity": {
-            "value": 2
+            "value": 1
           },
           "tags": {
             "value": "[parameters('tags')]"
@@ -1448,7 +1492,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "4988795866576200937"
+              "templateHash": "11613691335280989070"
             }
           },
           "parameters": {
@@ -1467,20 +1511,7 @@
             },
             "skuDisplay": {
               "type": "string",
-              "allowedValues": [
-                "B1",
-                "B2",
-                "B3",
-                "S1",
-                "S2",
-                "S3",
-                "P1v3",
-                "P2v3",
-                "P3v3",
-                "EP1",
-                "EP2",
-                "EP3"
-              ],
+              "allowedValues": ["B1", "B2", "B3", "P1v3", "P2v3", "P3v3", "P3mv3"],
               "metadata": {
                 "description": "Select a Linux-compatible App Service Plan SKU with details"
               }
@@ -1507,15 +1538,10 @@
               "B1": "Basic",
               "B2": "Basic",
               "B3": "Basic",
-              "S1": "Standard",
-              "S2": "Standard",
-              "S3": "Standard",
               "P1v3": "PremiumV3",
               "P2v3": "PremiumV3",
               "P3v3": "PremiumV3",
-              "EP1": "ElasticPremium",
-              "EP2": "ElasticPremium",
-              "EP3": "ElasticPremium"
+              "P3mv3": "PremiumV3"
             }
           },
           "resources": [
@@ -1755,13 +1781,13 @@
             "value": "15"
           },
           "skuName": {
-            "value": "Standard_B2ms"
+            "value": "[variables('selectedCapacity').postgresSku]"
           },
           "skuTier": {
-            "value": "Burstable"
+            "value": "[variables('selectedCapacity').postgresTier]"
           },
           "storageSizeGB": {
-            "value": 64
+            "value": "[variables('selectedCapacity').postgresStorageGB]"
           },
           "subnetId": {
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'network'), '2025-04-01').outputs.postgresSubnetId.value]"
@@ -2190,7 +2216,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "6101318472045983896"
+              "templateHash": "10929433789276981779"
             }
           },
           "parameters": {
@@ -2491,6 +2517,15 @@
           },
           "encryptionKey": {
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets'), '2025-04-01').outputs.encryptionKey.value]"
+          },
+          "entraIdClientSecret": {
+            "value": "[parameters('entraIdClientSecret')]"
+          },
+          "moriLicensePublicKey": {
+            "value": "[parameters('moriLicensePublicKey')]"
+          },
+          "moriBaseUrl": {
+            "value": "[parameters('moriBaseUrl')]"
           }
         },
         "template": {
@@ -2500,7 +2535,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "9394845529752045254"
+              "templateHash": "445562478593270876"
             }
           },
           "parameters": {
@@ -2568,9 +2603,31 @@
               "metadata": {
                 "description": "MISO Client Secret (auto-generated if not provided)"
               }
+            },
+            "entraIdClientSecret": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Vendor Entra app client secret (ENTRA_ID_CLIENT_SECRET). Placeholder when empty — replace for live Entra flows."
+              }
+            },
+            "moriLicensePublicKey": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Mori licence issuer public key (SPKI PEM). Empty leaves the installation unpinned."
+              }
+            },
+            "moriBaseUrl": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Mori base URL, stored so App Service can reference it instead of holding a literal."
+              }
             }
           },
           "variables": {
+            "resolvedEntraIdClientSecret": "[if(not(empty(parameters('entraIdClientSecret'))), parameters('entraIdClientSecret'), format('PLACEHOLDER_ENTRA_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]",
             "misoWebAppOrigin": "[if(endsWith(parameters('misoWebAppUrl'), '/'), substring(parameters('misoWebAppUrl'), 0, max(0, sub(length(parameters('misoWebAppUrl')), 1))), parameters('misoWebAppUrl'))]",
             "misoVdirSegment": "[if(or(equals(parameters('misoVdirPublic'), ''), equals(parameters('misoVdirPublic'), '/')), '', if(startsWith(parameters('misoVdirPublic'), '/'), parameters('misoVdirPublic'), format('/{0}', parameters('misoVdirPublic'))))]",
             "misoWebServerPublicUrl": "[if(empty(variables('misoVdirSegment')), variables('misoWebAppOrigin'), format('{0}{1}', variables('misoWebAppOrigin'), variables('misoVdirSegment')))]",
@@ -2660,6 +2717,32 @@
               "properties": {
                 "value": "[if(not(empty(parameters('misoClientSecret'))), parameters('misoClientSecret'), format('PLACEHOLDER_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]"
               }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'entra-client-secretKeyVault')]",
+              "properties": {
+                "value": "[variables('resolvedEntraIdClientSecret')]"
+              }
+            },
+            {
+              "condition": "[not(empty(parameters('moriLicensePublicKey')))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'mori-license-public-keyKeyVault')]",
+              "properties": {
+                "value": "[parameters('moriLicensePublicKey')]"
+              }
+            },
+            {
+              "condition": "[not(empty(parameters('moriBaseUrl')))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'mori-base-urlKeyVault')]",
+              "properties": {
+                "value": "[parameters('moriBaseUrl')]"
+              }
             }
           ]
         }
@@ -2710,6 +2793,12 @@
           "keycloakWebAppUrl": {
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keycloakWebApp'), '2025-04-01').outputs.webAppUrl.value]"
           },
+          "keycloakVdirPublic": {
+            "value": "[variables('keycloakVdirPublic')]"
+          },
+          "misoVdirPublic": {
+            "value": "/miso"
+          },
           "keycloakRealm": {
             "value": "aifabrix"
           },
@@ -2755,20 +2844,17 @@
           "moriBaseUrl": {
             "value": "[parameters('moriBaseUrl')]"
           },
-          "moriCallbackApiKey": {
-            "value": "[parameters('moriCallbackApiKey')]"
+          "moriLicensePublicKey": {
+            "value": "[parameters('moriLicensePublicKey')]"
           },
-          "entraCallbackStateSecret": {
-            "value": "[parameters('entraCallbackStateSecret')]"
+          "moriLicenseIssuer": {
+            "value": "[parameters('moriLicenseIssuer')]"
           },
           "entraIdClientId": {
             "value": "[parameters('entraIdClientId')]"
           },
-          "entraIdClientSecret": {
-            "value": "[parameters('entraIdClientSecret')]"
-          },
           "entraIdTenantId": {
-            "value": "[parameters('entraIdTenantId')]"
+            "value": "[variables('effectiveEntraIdTenantId')]"
           },
           "licenseEdition": {
             "value": "[parameters('licenseEdition')]"
@@ -2776,6 +2862,9 @@
           "onboardingMode": {
             "value": "[parameters('onboardingMode')]"
           },
+          "capacityProfile": {
+            "value": "[parameters('capacityProfile')]"
+          },
           "resourceGroupName": {
             "value": "[resourceGroup().name]"
           },
@@ -2790,7 +2879,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "3326510661393380434"
+              "templateHash": "13342696621269025420"
             }
           },
           "parameters": {
@@ -2943,6 +3032,20 @@
                 "description": "MISO controller web app URL (for MISO_WEB_SERVER_URL)"
               }
             },
+            "keycloakVdirPublic": {
+              "type": "string",
+              "defaultValue": "/auth",
+              "metadata": {
+                "description": "Public virtual-directory path for Keycloak (Front Door /auth/*). Builds KEYCLOAK_SERVER_URL."
+              }
+            },
+            "misoVdirPublic": {
+              "type": "string",
+              "defaultValue": "/miso",
+              "metadata": {
+                "description": "Public virtual-directory path for the controller. Emitted as MISO_RELATIVE_PATH."
+              }
+            },
             "enablePostgresPublicAccess": {
               "type": "bool",
               "defaultValue": false,
@@ -2972,32 +3075,25 @@
                 "description": "Mori base URL (no trailing slash); used for tenant activation / handoff"
               }
             },
-            "moriCallbackApiKey": {
-              "type": "securestring",
+            "moriLicensePublicKey": {
+              "type": "string",
               "defaultValue": "",
               "metadata": {
-                "description": "Optional shared secret for Mori → controller callback, supplied through the Miso installation/application contract."
+                "description": "Mori licence issuer public key (SPKI PEM). Empty leaves this installation unpinned."
               }
             },
-            "entraCallbackStateSecret": {
-              "type": "securestring",
-              "defaultValue": "",
+            "moriLicenseIssuer": {
+              "type": "string",
+              "defaultValue": "mori-controller",
               "metadata": {
-                "description": "Optional shared HMAC secret for Entra consent OAuth state, supplied through the Miso installation contract."
+                "description": "Expected `iss` claim on a Mori licence."
               }
             },
             "entraIdClientId": {
               "type": "string",
               "defaultValue": "481251f2-a318-47ba-9ad8-40c36f790df1",
               "metadata": {
-                "description": "Vendor multi-tenant Entra app client ID."
-              }
-            },
-            "entraIdClientSecret": {
-              "type": "securestring",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional vendor Entra app client secret, supplied through the Miso installation contract."
+                "description": "Vendor multi-tenant Entra app client ID. No longer emitted as an app setting — Miso does not hold provider credentials; Mori does. Retained so the marketplace parameter surface is unchanged."
               }
             },
             "entraIdTenantId": {
@@ -3022,6 +3118,13 @@
                 "description": "Tenant onboarding mode (ONBOARDING_MODE)."
               }
             },
+            "capacityProfile": {
+              "type": "string",
+              "defaultValue": "s",
+              "metadata": {
+                "description": "Capacity the installation was provisioned at (s/m/l/xl). Emitted as INSTALLATION_CAPACITY_PROFILE so the controller sizes the platform environment from the installation rather than guessing; without it the controller assumed m and rewrote an S App Service Plan to P2v3."
+              }
+            },
             "resourceGroupName": {
               "type": "string",
               "defaultValue": "[resourceGroup().name]",
@@ -3035,10 +3138,27 @@
               "metadata": {
                 "description": "Mori license JWT for controller. Empty uses Mori subscription validation. DEVELOPMENT is ignored when DEPLOYMENT=azure."
               }
+            },
+            "bootstrapAppKeys": {
+              "type": "string",
+              "defaultValue": "dataplane,builder-api,mori-controller",
+              "metadata": {
+                "description": "Workload applications an installer may provision at install time (BOOTSTRAP_APPKEYS)."
+              }
             }
           },
           "variables": {
             "shouldDisableRateLimit": "[if(equals(parameters('deploymentEnvironment'), 'prod'), 'false', 'true')]",
+            "misoOriginUrl": "[if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))]",
+            "misoWebAppOrigin": "[if(endsWith(variables('misoOriginUrl'), '/'), substring(variables('misoOriginUrl'), 0, max(0, sub(length(variables('misoOriginUrl')), 1))), variables('misoOriginUrl'))]",
+            "misoVdirSegment": "[if(or(equals(parameters('misoVdirPublic'), ''), equals(parameters('misoVdirPublic'), '/')), '', if(startsWith(parameters('misoVdirPublic'), '/'), parameters('misoVdirPublic'), format('/{0}', parameters('misoVdirPublic'))))]",
+            "misoPublicUrl": "[if(empty(variables('misoVdirSegment')), variables('misoWebAppOrigin'), format('{0}{1}', variables('misoWebAppOrigin'), variables('misoVdirSegment')))]",
+            "misoInternalUrl": "[if(empty(variables('misoVdirSegment')), variables('misoWebAppOrigin'), format('{0}{1}', variables('misoWebAppOrigin'), variables('misoVdirSegment')))]",
+            "misoVdirValue": "[if(empty(variables('misoVdirSegment')), '/', variables('misoVdirSegment'))]",
+            "keycloakWebAppOrigin": "[if(endsWith(parameters('keycloakWebAppUrl'), '/'), substring(parameters('keycloakWebAppUrl'), 0, max(0, sub(length(parameters('keycloakWebAppUrl')), 1))), parameters('keycloakWebAppUrl'))]",
+            "keycloakVdirSegment": "[if(or(equals(parameters('keycloakVdirPublic'), ''), equals(parameters('keycloakVdirPublic'), '/')), '', if(startsWith(parameters('keycloakVdirPublic'), '/'), parameters('keycloakVdirPublic'), format('/{0}', parameters('keycloakVdirPublic'))))]",
+            "keycloakPublicUrl": "[if(empty(variables('keycloakVdirSegment')), variables('keycloakWebAppOrigin'), format('{0}{1}', variables('keycloakWebAppOrigin'), variables('keycloakVdirSegment')))]",
+            "keycloakInternalUrl": "[variables('keycloakPublicUrl')]",
             "databaseUrlAppSettingValue": "[if(not(empty(parameters('databaseUrlSecretUriWithVersion'))), format('@Microsoft.KeyVault(SecretUri={0})', parameters('databaseUrlSecretUriWithVersion')), format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-databases-0-urlKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix')))]",
             "databaseLogUrlAppSettingValue": "[if(not(empty(parameters('databaseLogUrlSecretUriWithVersion'))), format('@Microsoft.KeyVault(SecretUri={0})', parameters('databaseLogUrlSecretUriWithVersion')), format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-databases-1-urlKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix')))]",
             "moriBaseNormalized": "[if(and(greater(length(parameters('moriBaseUrl')), 1), endsWith(parameters('moriBaseUrl'), '/')), substring(parameters('moriBaseUrl'), 0, max(0, sub(length(parameters('moriBaseUrl')), 1))), parameters('moriBaseUrl'))]",
@@ -3086,7 +3206,7 @@
                   "acrUseManagedIdentityCreds": "[not(parameters('registryPasswordConfigured'))]",
                   "healthCheckPath": "/health",
                   "alwaysOn": true,
-                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'DATABASE_URL', 'value', variables('databaseUrlAppSettingValue')), createObject('name', 'JWT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-secrets-jwtKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'NODE_ENV', 'value', 'production'), createObject('name', 'LOCATION', 'value', parameters('location')), createObject('name', 'PORT', 'value', '3000'), createObject('name', 'CORS_ORIGINS', 'value', format('https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'ALLOWED_ORIGINS', 'value', format('http://localhost:*,http://127.0.0.1:*,https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'DATABASELOG_URL', 'value', variables('databaseLogUrlAppSettingValue')), createObject('name', 'KEY_VAULT_ENABLED', 'value', 'true'), createObject('name', 'SECURITY_STORAGE_MODE', 'value', 'keyvault'), createObject('name', 'KEY_VAULT_URL', 'value', format('https://{0}.vault.azure.net/', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENCRYPTION_KEY', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-encryption-keyKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'AUTO_CREATE_TABLES', 'value', if(parameters('autoCreateTables'), 'true', 'false')), createObject('name', 'KEYCLOAK_REALM', 'value', parameters('keycloakRealm')), createObject('name', 'KEYCLOAK_CLIENT_ID', 'value', parameters('keycloakClientId')), createObject('name', 'KEYCLOAK_ADMIN_USERNAME', 'value', parameters('keycloakAdminUsername')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-keycloak-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-onboarding-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'KEYCLOAK_SERVER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=keycloak-web-server-url)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'KEYCLOAK_INTERNAL_SERVER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=keycloak-internal-server-url)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'KEYCLOAK_TOKEN_TIMEOUT', 'value', '5000'), createObject('name', 'KEYCLOAK_VERIFY_AUDIENCE', 'value', if(parameters('keycloakVerifyAudience'), 'true', 'false')), createObject('name', 'DISABLE_RATE_LIMIT', 'value', variables('shouldDisableRateLimit')), createObject('name', 'SKIP_DB_REDEPLOY', 'value', 'true'), createObject('name', 'MISO_WEB_SERVER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-web-server-url)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MISO_CONTROLLER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-internal-server-urlKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MISO_RELATIVE_PATH', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-vdir-public)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'CONTROLLER_BASE_URL', 'value', if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))), createObject('name', 'AZURE_SUBSCRIPTION_ID', 'value', subscription().subscriptionId), createObject('name', 'TENANT_ID', 'value', subscription().tenantId), createObject('name', 'AZURE_RESOURCE_GROUP_NAME', 'value', parameters('resourceGroupName')), createObject('name', 'INFRASTRUCTURE_NAME', 'value', parameters('prefix')), createObject('name', 'ENTRA_ID_CLIENT_ID', 'value', parameters('entraIdClientId')), createObject('name', 'ENTRA_ID_CLIENT_SECRET', 'value', parameters('entraIdClientSecret')), createObject('name', 'ENTRA_ID_TENANT_ID', 'value', parameters('entraIdTenantId')), createObject('name', 'MISO_CLIENTID', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-miso-clientIdKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'MISO_CLIENTSECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_BASE_URL', 'value', variables('moriBaseNormalized')), createObject('name', 'MORI_CALLBACK_API_KEY', 'value', parameters('moriCallbackApiKey')), createObject('name', 'ENTRA_GRAPH_DELEGATED_REDIRECT_URI', 'value', variables('moriEntraGraphDelegatedRedirectUri')), createObject('name', 'ENTRA_ID_CENTRAL_CALLBACK_URI', 'value', variables('moriEntraCentralCallbackUri')), createObject('name', 'ENTRA_CALLBACK_STATE_SECRET', 'value', parameters('entraCallbackStateSecret')), createObject('name', 'DOCKER_ENABLE_CI', 'value', 'true'), createObject('name', 'DOCKER_REGISTRY_SERVER_URL', 'value', if(not(empty(parameters('acrLoginServer'))), format('https://{0}', parameters('acrLoginServer')), '')), createObject('name', 'ONBOARDING_CREATE_PIPELINE_CREDENTIALS', 'value', 'true'), createObject('name', 'LICENSE_JWT', 'value', parameters('licenseJwt')), createObject('name', 'LICENSE_EDITION', 'value', parameters('licenseEdition')), createObject('name', 'ONBOARDING_MODE', 'value', parameters('onboardingMode'))), variables('registryCredentialAppSettings'))]",
+                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'DATABASE_URL', 'value', variables('databaseUrlAppSettingValue')), createObject('name', 'JWT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-secrets-jwtKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'NODE_ENV', 'value', 'production'), createObject('name', 'LOCATION', 'value', parameters('location')), createObject('name', 'PORT', 'value', '3000'), createObject('name', 'ALLOWED_ORIGINS', 'value', format('http://localhost:*,http://127.0.0.1:*,https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'DATABASELOG_URL', 'value', variables('databaseLogUrlAppSettingValue')), createObject('name', 'KEY_VAULT_ENABLED', 'value', 'true'), createObject('name', 'SECURITY_STORAGE_MODE', 'value', 'keyvault'), createObject('name', 'KEY_VAULT_URL', 'value', format('https://{0}.vault.azure.net/', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENCRYPTION_KEY', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-encryption-keyKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'AUTO_CREATE_TABLES', 'value', if(parameters('autoCreateTables'), 'true', 'false')), createObject('name', 'KEYCLOAK_REALM', 'value', parameters('keycloakRealm')), createObject('name', 'KEYCLOAK_CLIENT_ID', 'value', parameters('keycloakClientId')), createObject('name', 'KEYCLOAK_ADMIN_USERNAME', 'value', parameters('keycloakAdminUsername')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-keycloak-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-onboarding-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'KEYCLOAK_SERVER_URL', 'value', variables('keycloakPublicUrl')), createObject('name', 'KEYCLOAK_INTERNAL_SERVER_URL', 'value', variables('keycloakInternalUrl')), createObject('name', 'KEYCLOAK_TOKEN_TIMEOUT', 'value', '5000'), createObject('name', 'KEYCLOAK_VERIFY_AUDIENCE', 'value', if(parameters('keycloakVerifyAudience'), 'true', 'false')), createObject('name', 'DISABLE_RATE_LIMIT', 'value', variables('shouldDisableRateLimit')), createObject('name', 'SKIP_DB_REDEPLOY', 'value', 'true'), createObject('name', 'MISO_WEB_SERVER_URL', 'value', variables('misoPublicUrl')), createObject('name', 'MISO_CONTROLLER_URL', 'value', variables('misoInternalUrl')), createObject('name', 'MISO_RELATIVE_PATH', 'value', variables('misoVdirValue')), createObject('name', 'CONTROLLER_BASE_URL', 'value', if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))), createObject('name', 'AZURE_SUBSCRIPTION_ID', 'value', subscription().subscriptionId), createObject('name', 'TENANT_ID', 'value', subscription().tenantId), createObject('name', 'DEPLOYMENT', 'value', 'azure'), createObject('name', 'AZURE_RESOURCE_GROUP_NAME', 'value', parameters('resourceGroupName')), createObject('name', 'INFRASTRUCTURE_NAME', 'value', parameters('prefix')), createObject('name', 'ENTRA_ID_TENANT_ID', 'value', parameters('entraIdTenantId')), createObject('name', 'MISO_CLIENTID', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-miso-clientIdKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'MISO_CLIENTSECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_BASE_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-base-urlKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_LICENSE_PUBLIC_KEY', 'value', if(empty(parameters('moriLicensePublicKey')), '', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-license-public-keyKeyVault)', last(split(parameters('keyVaultId'), '/'))))), createObject('name', 'MORI_LICENSE_ISSUER', 'value', parameters('moriLicenseIssuer')), createObject('name', 'ENTRA_GRAPH_DELEGATED_REDIRECT_URI', 'value', variables('moriEntraGraphDelegatedRedirectUri')), createObject('name', 'ENTRA_ID_CENTRAL_CALLBACK_URI', 'value', variables('moriEntraCentralCallbackUri')), createObject('name', 'DOCKER_ENABLE_CI', 'value', 'true'), createObject('name', 'DOCKER_REGISTRY_SERVER_URL', 'value', if(not(empty(parameters('acrLoginServer'))), format('https://{0}', parameters('acrLoginServer')), '')), createObject('name', 'ONBOARDING_CREATE_PIPELINE_CREDENTIALS', 'value', 'true'), createObject('name', 'BOOTSTRAP_APPKEYS', 'value', parameters('bootstrapAppKeys')), createObject('name', 'LICENSE_JWT', 'value', parameters('licenseJwt')), createObject('name', 'LICENSE_EDITION', 'value', parameters('licenseEdition')), createObject('name', 'ONBOARDING_MODE', 'value', parameters('onboardingMode')), createObject('name', 'INSTALLATION_CAPACITY_PROFILE', 'value', parameters('capacityProfile'))), variables('registryCredentialAppSettings'))]",
                   "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
                 },
                 "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
@@ -3192,7 +3312,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "1560535279661158869"
+              "templateHash": "7505559434659026911"
             }
           },
           "parameters": {
@@ -3210,8 +3330,28 @@
               "metadata": {
                 "description": "Object IDs (principalId) of web apps that use Key Vault references"
               }
+            },
+            "grantWorkloadVaultAccess": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Grant workload web apps direct Key Vault access. Default false: workloads fetch parameters through Miso. Set true only to restore the pre-227.6 behaviour for an installation that needs it."
+              }
+            },
+            "platformPrincipalIds": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "defaultValue": [],
+              "metadata": {
+                "description": "Object IDs of platform principals (Miso, Keycloak) that always retain vault access"
+              }
             }
           },
+          "variables": {
+            "effectivePrincipalIds": "[if(parameters('grantWorkloadVaultAccess'), union(parameters('webAppPrincipalIds'), parameters('platformPrincipalIds')), parameters('platformPrincipalIds'))]"
+          },
           "resources": {
             "kv": {
               "existing": true,
@@ -3227,10 +3367,10 @@
                 "copy": [
                   {
                     "name": "accessPolicies",
-                    "count": "[length(parameters('webAppPrincipalIds'))]",
+                    "count": "[length(variables('effectivePrincipalIds'))]",
                     "input": {
                       "tenantId": "[subscription().tenantId]",
-                      "objectId": "[parameters('webAppPrincipalIds')[copyIndex('accessPolicies')]]",
+                      "objectId": "[variables('effectivePrincipalIds')[copyIndex('accessPolicies')]]",
                       "permissions": {
                         "secrets": ["get", "list", "set"],
                         "keys": [],
@@ -3278,7 +3418,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "16977137676176830260"
+              "templateHash": "8140687320474179352"
             }
           },
           "parameters": {
@@ -3304,7 +3444,8 @@
           "variables": {
             "readySetting": {
               "AIFABRIX_KV_ACCESS_READY": "[parameters('readyStamp')]"
-            }
+            },
+            "misoOnboardingSetting": "[variables('readySetting')]"
           },
           "resources": [
             {
@@ -3373,7 +3514,7 @@
                     "value": "[parameters('misoWebAppName')]"
                   },
                   "appSettings": {
-                    "value": "[union(list(resourceId('Microsoft.Web/sites/config', parameters('misoWebAppName'), 'appsettings'), '2022-03-01').properties, variables('readySetting'))]"
+                    "value": "[union(list(resourceId('Microsoft.Web/sites/config', parameters('misoWebAppName'), 'appsettings'), '2022-03-01').properties, variables('misoOnboardingSetting'))]"
                   }
                 },
                 "template": {
@@ -3460,6 +3601,9 @@
           },
           "encryptionKey": {
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets'), '2025-04-01').outputs.encryptionKey.value]"
+          },
+          "entraIdClientSecret": {
+            "value": "[parameters('entraIdClientSecret')]"
           }
         },
         "template": {
@@ -3469,7 +3613,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "9394845529752045254"
+              "templateHash": "445562478593270876"
             }
           },
           "parameters": {
@@ -3537,9 +3681,31 @@
               "metadata": {
                 "description": "MISO Client Secret (auto-generated if not provided)"
               }
+            },
+            "entraIdClientSecret": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Vendor Entra app client secret (ENTRA_ID_CLIENT_SECRET). Placeholder when empty — replace for live Entra flows."
+              }
+            },
+            "moriLicensePublicKey": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Mori licence issuer public key (SPKI PEM). Empty leaves the installation unpinned."
+              }
+            },
+            "moriBaseUrl": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Mori base URL, stored so App Service can reference it instead of holding a literal."
+              }
             }
           },
           "variables": {
+            "resolvedEntraIdClientSecret": "[if(not(empty(parameters('entraIdClientSecret'))), parameters('entraIdClientSecret'), format('PLACEHOLDER_ENTRA_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]",
             "misoWebAppOrigin": "[if(endsWith(parameters('misoWebAppUrl'), '/'), substring(parameters('misoWebAppUrl'), 0, max(0, sub(length(parameters('misoWebAppUrl')), 1))), parameters('misoWebAppUrl'))]",
             "misoVdirSegment": "[if(or(equals(parameters('misoVdirPublic'), ''), equals(parameters('misoVdirPublic'), '/')), '', if(startsWith(parameters('misoVdirPublic'), '/'), parameters('misoVdirPublic'), format('/{0}', parameters('misoVdirPublic'))))]",
             "misoWebServerPublicUrl": "[if(empty(variables('misoVdirSegment')), variables('misoWebAppOrigin'), format('{0}{1}', variables('misoWebAppOrigin'), variables('misoVdirSegment')))]",
@@ -3629,6 +3795,32 @@
               "properties": {
                 "value": "[if(not(empty(parameters('misoClientSecret'))), parameters('misoClientSecret'), format('PLACEHOLDER_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]"
               }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'entra-client-secretKeyVault')]",
+              "properties": {
+                "value": "[variables('resolvedEntraIdClientSecret')]"
+              }
+            },
+            {
+              "condition": "[not(empty(parameters('moriLicensePublicKey')))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'mori-license-public-keyKeyVault')]",
+              "properties": {
+                "value": "[parameters('moriLicensePublicKey')]"
+              }
+            },
+            {
+              "condition": "[not(empty(parameters('moriBaseUrl')))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'mori-base-urlKeyVault')]",
+              "properties": {
+                "value": "[parameters('moriBaseUrl')]"
+              }
             }
           ]
         }
@@ -3772,7 +3964,7 @@
       ]
     },
     {
-      "condition": "[parameters('deployRoleAssignments')]",
+      "condition": "[parameters('deployRegistryRoleAssignment')]",
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2025-04-01",
       "name": "acrPullRoleAssignment",
@@ -3801,7 +3993,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "1882530004456299732"
+              "templateHash": "14966069055732756709"
             }
           },
           "parameters": {
@@ -3821,7 +4013,7 @@
             }
           },
           "variables": {
-            "acrPullRoleDefinitionId": "7f951dda-4ed3-4680-a7ca-43b17298f9ac"
+            "acrPullRoleDefinitionId": "7f951dda-4ed3-4680-a7ca-43fe172d538d"
           },
           "resources": [
             {
@@ -4082,6 +4274,20 @@
     "portalUrl": {
       "type": "string",
       "value": "[format('https://portal.azure.com/#@{0}/resource/subscriptions/{1}/resourceGroups/{2}', subscription().tenantId, subscription().subscriptionId, resourceGroup().name)]"
+    },
+    "azureOpenAiCreated": {
+      "type": "string",
+      "metadata": {
+        "description": "`true` when Phase-1 created the Azure OpenAI account in the installation region."
+      },
+      "value": "[if(variables('createAzureOpenAI'), 'true', 'false')]"
+    },
+    "azureOpenAiSkipReason": {
+      "type": "string",
+      "metadata": {
+        "description": "Empty when the account was created; otherwise why it was not."
+      },
+      "value": "[if(variables('createAzureOpenAI'), '', if(parameters('enableAzureOpenAI'), format('Azure OpenAI is not offered in {0}, and it is not relocated to another region automatically. The installation is complete without it: create the account in a supported region yourself, or supply an existing endpoint as an external provider.', variables('deploymentLocation')), 'Azure OpenAI creation was disabled for this installation (enableAzureOpenAI=false).'))]"
     }
   }
 }