@aifabrix/builder 2.58.0 → 2.60.0

package/lib/schema/application-schema.json

@@ -7,12 +7,12 @@
     "key": "application-schema",
     "name": "Application Configuration Schema",
     "description": "JSON schema for validating AI Fabrix application configuration files",
-    "version": "1.7.0",
+    "version": "1.9.0",
     "type": "schema",
     "category": "infrastructure",
     "author": "AI Fabrix Team",
     "createdAt": "2024-01-01T00:00:00Z",
-    "updatedAt": "2026-09-16T00:00:00Z",
+    "updatedAt": "2026-09-23T00:00:00Z",
     "compatibility": {
       "minVersion": "1.0.0",
       "maxVersion": "2.0.0",
@@ -30,6 +30,27 @@
       "external-datasource.schema.json"
     ],
     "changelog": [
+      {
+        "version": "1.9.0",
+        "date": "2026-09-23T00:00:00Z",
+        "breaking": false,
+        "changes": [
+          "Added optional platforms: the target Azure resource group is matched against resource patterns to yield {platform} and {platform.name}, and that entry's configuration resolves from them.",
+          "Added optional environments: per-environment configuration layered over the platform match, overriding by name.",
+          "Added optional portalInput.visible (default true) so a resolved or derived value stays out of the portal form.",
+          "Both sections are optional and independent; manifests without them are unchanged."
+        ]
+      },
+      {
+        "version": "1.8.0",
+        "date": "2026-09-21T00:00:00Z",
+        "changes": [
+          "Added optional build.target: the multi-stage Dockerfile stage to build (docker build --target). Omitted, Docker builds the final stage as before, so existing manifests are unaffected. Lets one Dockerfile and one source tree produce more than one image.",
+          "Added optional top-level runAsRoot: run the container as the image user (root) rather than the invoking host user. Absent or false keeps the existing behavior. Only for an application that administers its own operating system, such as creating Linux accounts or running sshd.",
+          "Added optional top-level additionalPorts: extra container ports to publish beside the main port, for an application serving a second protocol such as SSH from the same container. Each host port is derived as hostPort + developerId * 100, the same formula as the main port. A base below 1024 is permitted so a well-known port keeps its number. Absent keeps the existing single-port behavior."
+        ],
+        "breaking": false
+      },
       {
         "version": "1.7.0",
         "date": "2026-09-16T00:00:00Z",
@@ -210,6 +231,124 @@
       "type": "boolean",
       "description": "Whether application requires storage.Physical storage is mapped to /mnt/data/. Blob storage is mapped to SMB File share /data/{app-key}/."
     },
+    "platforms": {
+      "type": "array",
+      "description": "Platform resolution: the target Azure resource group is matched against these entries, yielding {platform} and {platform.name}. Optional and independent of environments.",
+      "items": {
+        "type": "object",
+        "required": ["resource", "name", "configuration"],
+        "additionalProperties": false,
+        "properties": {
+          "resource": {
+            "type": "string",
+            "description": "Resource-group pattern; {platform} marks the platform segment and * captures a name segment",
+            "minLength": 1
+          },
+          "name": {
+            "type": "string",
+            "description": "Platform name: a literal, or * to take the captured segment",
+            "minLength": 1
+          },
+          "options": {
+            "type": "array",
+            "description": "Allowed platform values; required when resource contains {platform}",
+            "minItems": 1,
+            "items": { "type": "string", "minLength": 1 }
+          },
+          "platform": {
+            "type": "string",
+            "description": "Declared platform for a resource pattern with no {platform} token; mutually exclusive with options",
+            "minLength": 1
+          },
+          "configuration": {
+            "type": "array",
+            "description": "Values resolved when this platform matches",
+            "items": {
+        "type": "object",
+            "required": ["name", "value"],
+            "additionalProperties": false,
+            "properties": {
+              "name": {
+                "type": "string",
+                "description": "Configuration variable name",
+                "pattern": "^[A-Z_][A-Z0-9_]*$"
+              },
+              "value": {
+                "type": "string",
+                "description": "Literal, or a value containing {platform}, {platform.name} or {resourceGroup} tokens"
+              },
+              "location": {
+                "type": "string",
+                "description": "Where the value is stored",
+                "enum": ["variable", "keyvault"]
+              },
+              "required": {
+                "type": "boolean",
+                "description": "Whether this configuration is required"
+              },
+              "category": {
+                "type": "string",
+                "description": "Optional UI grouping label for portal/deployment wizard Configuration tab",
+                "minLength": 1,
+                "maxLength": 100
+              }
+            }
+            }
+          }
+        }
+      }
+    },
+    "environments": {
+      "type": "array",
+      "description": "Per-environment values layered over the platform match, overriding by name. Optional and independent of platforms.",
+      "items": {
+        "type": "object",
+        "required": ["environment", "configuration"],
+        "additionalProperties": false,
+        "properties": {
+          "environment": {
+            "type": "string",
+            "description": "Deployment environment key (for example miso, dev, tst, pro)",
+            "minLength": 1
+          },
+          "configuration": {
+            "type": "array",
+            "description": "Values resolved for this environment",
+            "items": {
+        "type": "object",
+            "required": ["name", "value"],
+            "additionalProperties": false,
+            "properties": {
+              "name": {
+                "type": "string",
+                "description": "Configuration variable name",
+                "pattern": "^[A-Z_][A-Z0-9_]*$"
+              },
+              "value": {
+                "type": "string",
+                "description": "Literal, or a value containing {platform}, {platform.name} or {resourceGroup} tokens"
+              },
+              "location": {
+                "type": "string",
+                "description": "Where the value is stored",
+                "enum": ["variable", "keyvault"]
+              },
+              "required": {
+                "type": "boolean",
+                "description": "Whether this configuration is required"
+              },
+              "category": {
+                "type": "string",
+                "description": "Optional UI grouping label for portal/deployment wizard Configuration tab",
+                "minLength": 1,
+                "maxLength": 100
+              }
+            }
+            }
+          }
+        }
+      }
+    },
     "configuration": {
       "type": "array",
       "description": "Core application configuration",
@@ -274,6 +413,10 @@
                 "type": "boolean",
                 "description": "Whether to mask the input (for passwords)"
               },
+              "visible": {
+                "type": "boolean",
+                "description": "Whether the portal shows this input. Default true; false keeps a resolved or derived value out of the form."
+              },
               "validation": {
                 "type": "object",
                 "properties": {
@@ -413,6 +556,10 @@
                       "type": "boolean",
                       "description": "Whether to mask the input (for passwords)"
                     },
+                    "visible": {
+                      "type": "boolean",
+                      "description": "Whether the portal shows this input. Default true; false keeps a resolved or derived value out of the form."
+                    },
                     "validation": {
                       "type": "object",
                       "properties": {
@@ -806,6 +953,43 @@
       "minLength": 1,
       "maxLength": 200
     },
+    "additionalPorts": {
+      "type": "array",
+      "description": "Extra container ports to publish beside the main port. For an application that serves a second protocol from the same container, such as SSH alongside HTTP. Each host port is derived the same way as the main one: hostPort + developerId * 100 (developer id 0 keeps hostPort).",
+      "maxItems": 5,
+      "items": {
+        "type": "object",
+        "required": ["name", "containerPort", "hostPort"],
+        "additionalProperties": false,
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "What the port is for, e.g. 'ssh'. Used in generated compose comments and diagnostics.",
+            "pattern": "^[a-z][a-z0-9-]*$",
+            "minLength": 1,
+            "maxLength": 30
+          },
+          "containerPort": {
+            "type": "integer",
+            "description": "Port the process listens on inside the container.",
+            "minimum": 1,
+            "maximum": 65535
+          },
+          "hostPort": {
+            "type": "integer",
+            "description": "Base host port. The published port is hostPort + developerId * 100, so developers on one host do not collide. A base below 1024 is allowed so a well-known port can keep its number (SSH as 22, giving 122 for developer 1); the container engine binds it, not the application.",
+            "minimum": 1,
+            "maximum": 65535
+          }
+        }
+      }
+    },
+    "runAsRoot": {
+      "type": "boolean",
+      "default": false,
+      "description": "Run the container as the image user (root) instead of the invoking host user. Only for an application that administers its own operating system, such as creating Linux accounts or running sshd; files it writes to a bind mount will be root-owned. Absent or false keeps the existing behavior.",
+      "examples": [false]
+    },
     "runtimeVersion": {
       "type": "object",
       "description": "Runtime version configuration",
@@ -886,6 +1070,13 @@
           "description": "Dockerfile name (empty or missing = use auto-generated template)",
           "pattern": "^[^/].*"
         },
+        "target": {
+          "type": "string",
+          "description": "Multi-stage Dockerfile stage to build (docker build --target). Omit to build the final stage, which is the default. Lets one Dockerfile and one source tree produce more than one image, e.g. an application shipped in two installation variants.",
+          "minLength": 1,
+          "maxLength": 100,
+          "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*$"
+        },
         "remoteSyncPath": {
           "type": "string",
           "description": "Relative path under user-mutagen-folder for remote sync and Docker -v; when unset, defaults to dev/<appKey>. No leading slash.",

package/lib/schema/environment-deploy-request.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://raw.githubusercontent.com/esystemsdev/aifabrix-builder/refs/heads/main/lib/schema/environment-deploy-request.schema.json",
+  "$id": "aifabrix://schema/environment-deploy-request.schema.json",
   "title": "Environment Deploy Request",
   "description": "Request body for POST /api/v1/environments/{envKey}/deploy",
   "type": "object",

package/lib/schema/external-datasource.schema.json

@@ -7,12 +7,12 @@
          "key":"external-datasource-schema",
          "name":"External Data Source Configuration Schema",
          "description":"JSON schema for validating ExternalDataSource configuration files",
-     "version":"2.9.11",
+     "version":"2.9.12",
          "type":"schema",
          "category":"integration",
          "author":"AI Fabrix Team",
          "createdAt":"2024-01-01T00:00:00Z",
-         "updatedAt":"2026-08-30T00:00:00Z",
+         "updatedAt":"2026-09-17T00:00:00Z",
          "compatibility":{
             "minVersion":"1.0.0",
             "maxVersion":"3.0.0",
@@ -31,6 +31,15 @@
          "external-system.schema.json"
       ],
       "changelog":[
+         {
+            "version":"2.9.12",
+            "date":"2026-09-17T00:00:00Z",
+            "changes":[
+               "Added cipOperation.shape enum value 'upsert' (manifest-declared only; composes the datasource's standard create + update via fetch.source datasource; existence-resolved branch with fail-closed per-action permissions). COM writeShape and published x-ai-intent gain the same value. 543 O-SHAPE updated.",
+               "Added optional sync.enabled (default true) to disable scheduled, manual, webhook, and syncBridge synchronization without disabling datasource reads. Added @monthly as the authoring default for new full-set schedules; existing schedule-less manifests remain valid and are not migrated. CIP $defs unchanged (543 visual N/A)."
+            ],
+            "breaking":false
+         },
          {
             "version":"2.9.11",
             "date":"2026-08-30T00:00:00Z",
@@ -862,6 +871,11 @@
          "type":"object",
          "description":"Record synchronization rules.",
          "properties":{
+            "enabled":{
+               "type":"boolean",
+               "description":"Whether synchronization is enabled for this datasource. False blocks scheduled, manual, webhook, and syncBridge synchronization while preserving normal datasource access.",
+               "default":true
+            },
             "mode":{
                "type":"string",
                "enum":[
@@ -874,6 +888,7 @@
             "schedule":{
                "type":"string",
                "description":"Cron for full-set (sync all) jobs. Supports 5-field cron syntax or @hourly/@daily/@weekly/@monthly.",
+               "default":"@monthly",
                "pattern":"^(@hourly|@daily|@weekly|@monthly|([0-9*/,-]+\\s+){4}[0-9*/,-]+)$"
             },
             "batchSize":{
@@ -2547,9 +2562,10 @@
                "enum":[
                   "create",
                   "update",
-                  "delete"
+                  "delete",
+                  "upsert"
                ],
-               "description":"Manifest classification for custom operations when fetch step inference is insufficient. Resolved by resolve_cip_write_shape (precedence over fetch inference) and drives x-ai-intent, x-ai-sideEffects, and x-ai-contract.riskLevel on published OpenAPI. shape delete marks the operation as dangerous for agent policy (with core capability delete)."
+               "description":"Manifest classification for custom operations when fetch step inference is insufficient. Resolved by resolve_cip_write_shape (precedence over fetch inference) and drives x-ai-intent, x-ai-sideEffects, and x-ai-contract.riskLevel on published OpenAPI. shape delete marks the operation as dangerous for agent policy (with core capability delete). shape upsert is never inferred: the operation must compose exactly this datasource's standard create and update operations as two fetch.source 'datasource' steps; at execution the generic CIP branch resolves record existence from validation.repeatingValues reject fields and runs exactly one half, enforcing that half's permissions fail-closed (no cross-action fallback)."
             },
             "steps":{
                "type":"array",
@@ -3467,4 +3483,3 @@
    },
    "additionalProperties":false
  }
- 

package/lib/schema/infra-parameter.schema.json

@@ -1,9 +1,12 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://aifabrix.dev/schemas/infra-parameter.schema.json",
+  "$id": "aifabrix://schema/infra-parameter.schema.json",
   "title": "Infra parameter catalog",
   "type": "object",
-  "required": ["version", "parameters"],
+  "required": [
+    "version",
+    "parameters"
+  ],
   "additionalProperties": false,
   "properties": {
     "version": {
@@ -12,7 +15,10 @@
     },
     "standardUpInfraEnsureKeys": {
       "type": "array",
-      "items": { "type": "string", "minLength": 1 },
+      "items": {
+        "type": "string",
+        "minLength": 1
+      },
       "description": "Extra keys always merged on up-infra (e.g. default miso-controller DB pair when no workspace template lists them)."
     },
     "defaults": {
@@ -20,28 +26,47 @@
       "additionalProperties": false,
       "description": "Default values for {{adminPassword}}, {{adminEmail}}, {{userPassword}} in literal generator values; overridden by aifabrix up-infra flags.",
       "properties": {
-        "adminEmail": { "type": "string" },
-        "adminPassword": { "type": "string" },
-        "userPassword": { "type": "string" }
+        "adminEmail": {
+          "type": "string"
+        },
+        "adminPassword": {
+          "type": "string"
+        },
+        "userPassword": {
+          "type": "string"
+        }
       }
     },
     "parameters": {
       "type": "array",
-      "items": { "$ref": "#/definitions/parameterEntry" }
+      "items": {
+        "$ref": "#/definitions/parameterEntry"
+      }
     }
   },
   "definitions": {
     "ensureOnEnum": {
       "type": "string",
-      "enum": ["upInfra", "resolveApp", "appRegister"]
+      "enum": [
+        "upInfra",
+        "resolveApp",
+        "appRegister"
+      ]
     },
     "scopeEnum": {
       "type": "string",
-      "enum": ["infra", "app", "shared-service", "system"]
+      "enum": [
+        "infra",
+        "app",
+        "shared-service",
+        "system"
+      ]
     },
     "generator": {
       "type": "object",
-      "required": ["type"],
+      "required": [
+        "type"
+      ],
       "additionalProperties": false,
       "properties": {
         "type": {
@@ -67,17 +92,47 @@
           "maximum": 512,
           "description": "For randomAlphanumeric: character count (default 32). For password: default 8. Charset [a-zA-Z0-9]."
         },
-        "pairId": { "type": "string", "minLength": 1 },
-        "part": { "type": "string", "enum": ["private", "public"] }
+        "pairId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "part": {
+          "type": "string",
+          "enum": [
+            "private",
+            "public"
+          ]
+        }
       },
       "allOf": [
         {
-          "if": { "properties": { "type": { "const": "literal" } } },
-          "then": { "required": ["value"] }
+          "if": {
+            "properties": {
+              "type": {
+                "const": "literal"
+              }
+            }
+          },
+          "then": {
+            "required": [
+              "value"
+            ]
+          }
         },
         {
-          "if": { "properties": { "type": { "const": "rsaKeyPair" } } },
-          "then": { "required": ["pairId", "part"] }
+          "if": {
+            "properties": {
+              "type": {
+                "const": "rsaKeyPair"
+              }
+            }
+          },
+          "then": {
+            "required": [
+              "pairId",
+              "part"
+            ]
+          }
         }
       ]
     },
@@ -85,19 +140,32 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "vaultSecretName": { "type": "string" },
-        "vaultSecretNamePattern": { "type": "string" },
+        "vaultSecretName": {
+          "type": "string"
+        },
+        "vaultSecretNamePattern": {
+          "type": "string"
+        },
         "legacyVaultSecretNames": {
           "type": "array",
-          "items": { "type": "string", "minLength": 1 },
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
           "uniqueItems": true
         },
-        "notes": { "type": "string" }
+        "notes": {
+          "type": "string"
+        }
       }
     },
     "parameterEntry": {
       "type": "object",
-      "required": ["scope", "generator", "ensureOn"],
+      "required": [
+        "scope",
+        "generator",
+        "ensureOn"
+      ],
       "additionalProperties": false,
       "properties": {
         "key": {
@@ -108,8 +176,13 @@
           "type": "string",
           "minLength": 1
         },
-        "category": { "type": "string", "minLength": 1 },
-        "sensitive": { "type": "boolean" },
+        "category": {
+          "type": "string",
+          "minLength": 1
+        },
+        "sensitive": {
+          "type": "boolean"
+        },
         "valueSource": {
           "type": "string",
           "enum": [
@@ -120,31 +193,64 @@
             "optionalInput"
           ]
         },
-        "requiredOnSystemOnboarding": { "type": "boolean" },
-        "ownerAppKey": { "type": "string", "minLength": 1 },
+        "requiredOnSystemOnboarding": {
+          "type": "boolean"
+        },
+        "ownerAppKey": {
+          "type": "string",
+          "minLength": 1
+        },
         "sharedWithAppKeys": {
           "type": "array",
-          "items": { "type": "string", "minLength": 1 },
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
           "minItems": 1,
           "uniqueItems": true,
           "description": "Named applications, other than ownerAppKey, that may read this value."
         },
-        "scope": { "$ref": "#/definitions/scopeEnum" },
-        "generator": { "$ref": "#/definitions/generator" },
+        "visibility": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "App keys allowed to read this parameter. Canonical field in the Miso catalog that lib/schema/infra.parameter.yaml mirrors; sharedWithAppKeys is the older Builder spelling."
+        },
+        "scope": {
+          "$ref": "#/definitions/scopeEnum"
+        },
+        "generator": {
+          "$ref": "#/definitions/generator"
+        },
         "ensureOn": {
           "type": "array",
           "minItems": 1,
-          "items": { "$ref": "#/definitions/ensureOnEnum" }
+          "items": {
+            "$ref": "#/definitions/ensureOnEnum"
+          }
+        },
+        "requiredForLocal": {
+          "type": "boolean"
+        },
+        "azure": {
+          "$ref": "#/definitions/azureBlock"
         },
-        "requiredForLocal": { "type": "boolean" },
-        "azure": { "$ref": "#/definitions/azureBlock" },
-        "notes": { "type": "string" }
+        "notes": {
+          "type": "string"
+        }
       },
       "allOf": [
         {
           "if": {
-            "required": ["scope"],
-            "properties": { "scope": { "const": "system" } }
+            "required": [
+              "scope"
+            ],
+            "properties": {
+              "scope": {
+                "const": "system"
+              }
+            }
           },
           "then": {
             "required": [