@aifabrix/builder 2.58.0 → 2.60.0

package/lib/schema/infra.parameter.yaml

@@ -29,7 +29,6 @@ standardUpInfraEnsureKeys:
   - databases-dataplane-3-urlKeyVault
   - databases-dataplane-3-passwordKeyVault
   # Miso-controller Entra onboarding (vendor app); required for aifabrix resolve miso-controller
-  - entra-callback-state-secret
   - entra-callback-uri
   - entra-client-idKeyVault
   - entra-client-secretKeyVault
@@ -98,7 +97,8 @@ parameters:
     category: Redis
     sensitive: true
     valueSource: providerOutput
-    requiredOnSystemOnboarding: true
+    # Not needed at first-time install: Redis is provisioned later (env deploy / TA), not at marketplace bootstrap.
+    requiredOnSystemOnboarding: false
     scope: system
     generator:
       type: literal
@@ -348,20 +348,6 @@ parameters:
 
   # Miso-controller Entra ID onboarding (vendor multi-tenant app). Empty client/callback values
   # allow local resolve and start-dev; set real values before Entra admin-consent flows.
-  - key: entra-callback-state-secret
-    category: Microsoft Entra ID
-    sensitive: true
-    valueSource: generated
-    requiredOnSystemOnboarding: true
-    scope: system
-    generator:
-      type: randomBytes32
-    ensureOn: [upInfra, resolveApp]
-    azure:
-      notes: >-
-        Shared HMAC secret (min 16 chars) for OAuth state between controller and Mori callback;
-        maps to ENTRA_CALLBACK_STATE_SECRET in miso-controller env.template.
-
   - key: entra-callback-uri
     category: Microsoft Entra ID
     sensitive: false
@@ -440,8 +426,9 @@ parameters:
     # side is decrypted by the other. The read was already happening in the shipped template
     # and the policy denied it. Declared rather than silently permitted, and kept to the one
     # application that needs it instead of moving the key to a scope that grants everyone.
-    sharedWithAppKeys:
+    visibility:
       - dataplane
+      - mori-controller
     scope: app
     generator:
       type: randomBytes32
@@ -453,6 +440,32 @@ parameters:
       notes: >-
         32-byte secret as base64; generated on first ensure. Rotate in production.
 
+  - key: integration-server-secrets-encryptionKeyVault
+    ownerAppKey: integration-server
+    # Deliberately NOT shared with any other app, which is the point of the row.
+    # An integrator installation hands this key to every developer it provisions: it is
+    # written into each managed ~/.aifabrix/config.yaml as `secrets-encryption`, so the
+    # CLI can decrypt what that installation's own secrets API encrypted. A key shared
+    # with another application would therefore be readable by everyone holding a shell
+    # in that container, and one leak would reach every installation using it.
+    # One installation, one key, so the blast radius stays inside it.
+    #
+    # Before this row existed, integration-server's env.template read
+    # `kv://builder-server-secrets-encryptionKeyVault` — another application's key.
+    # That resolves only by being granted, and granting it grants exactly the access
+    # above; without a grant it silently generated an unrelated value instead, so the
+    # two server types drifted apart with nothing reporting it.
+    scope: app
+    generator:
+      type: randomBytes32
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      vaultSecretName: integration-server-secrets-encryptionKeyVault
+      notes: >-
+        32-byte secret as base64; generated on first ensure, per installation. Rotating it
+        requires re-running configuration sync so every managed config.yaml is rewritten;
+        secrets already stored by that installation do not survive the rotation.
+
   # Local kv:// name matches miso-controller env.template (JWT_SECRET); not the generic {appKey}-secrets-jwtKeyVault Azure name.
   - key: miso-controller-jwt-secretKeyVault
     ownerAppKey: miso-controller
@@ -793,18 +806,6 @@ parameters:
         Optional local testing/development bearer bypass. A supplied local value is resolved; when absent,
         local and Azure application deployment resolve it as empty and do not fail.
 
-  - key: mori-callback-api-keyKeyVault
-    ownerAppKey: miso-controller
-    scope: app
-    generator:
-      type: randomBytes32
-    ensureOn: [resolveApp]
-    azure:
-      vaultSecretName: mori-callback-api-keyKeyVault
-      legacyVaultSecretNames:
-        - marketplace-mori-callback-api-key
-      notes: Miso Controller callback credential; generated only when its resolved manifest requires it.
-
   # App semver when env.template / conversion yields kv://version (local secrets backfill).
   - key: version
     scope: app

package/lib/schema/infrastructure-schema.json

@@ -1,18 +1,18 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://raw.githubusercontent.com/esystemsdev/aifabrix-builder/refs/heads/main/lib/schema/infrastructure-schema.json",
+  "$id": "aifabrix://schema/infrastructure-schema.json",
   "title": "AI Fabrix Installation Infrastructure Manifest",
   "description": "Committed, non-secret environment-infra.json for an installation workspace under infrastructure/<resource-group>/. Secrets appear only as valueFromEnv references.",
   "metadata": {
     "key": "infrastructure-schema",
     "name": "Installation Infrastructure Manifest Schema",
     "description": "JSON schema for infrastructure/<resource-group>/environment-infra.json",
-    "version": "2.0.0",
+    "version": "2.1.0",
     "type": "schema",
     "category": "infrastructure",
     "author": "AI Fabrix Team",
     "createdAt": "2024-01-01T00:00:00Z",
-    "updatedAt": "2026-09-17T00:00:00Z",
+    "updatedAt": "2026-09-24T00:00:00Z",
     "compatibility": {
       "minVersion": "2.0.0",
       "maxVersion": "2.0.0",
@@ -26,6 +26,14 @@
     ],
     "dependencies": [],
     "changelog": [
+      {
+        "version": "2.1.0",
+        "date": "2026-09-24T00:00:00Z",
+        "breaking": false,
+        "changes": [
+          "Removed moriCallbackApiKey and entraCallbackStateSecret: the shipped Marketplace template no longer declares them. The installation receives its Mori key at licence registration, and Entra consent state is issued server-side (Mori 227.5)."
+        ]
+      },
       {
         "version": "2.0.0",
         "date": "2026-09-16T00:00:00Z",
@@ -501,12 +509,11 @@
         "acrResourceId",
         "deployRoleAssignments",
         "moriBaseUrl",
-        "moriCallbackApiKey",
-        "entraCallbackStateSecret",
         "entraIdClientId",
         "entraIdClientSecret",
         "entraIdTenantId",
         "licenseEdition",
+        "capacityProfile",
         "onboardingMode",
         "misoImageTag",
         "keycloakImageTag"
@@ -981,7 +988,7 @@
             }
           }
         },
-        "moriBaseUrl": {
+        "deployRegistryRoleAssignment": {
           "type": "object",
           "required": [
             "value",
@@ -1009,13 +1016,24 @@
             },
             "required": {
               "type": "boolean"
+            },
+            "restoreValue": {
+              "type": [
+                "string",
+                "boolean",
+                "number",
+                "object",
+                "array"
+              ],
+              "description": "Value to restore when credential mode no longer applies."
+            },
+            "restoreSource": {
+              "type": "string",
+              "minLength": 1
             }
           }
         },
-        "moriCallbackApiKey": {
-          "$ref": "#/definitions/envReference"
-        },
-        "entraCallbackStateSecret": {
+        "moriBaseUrl": {
           "type": "object",
           "required": [
             "value",
@@ -1025,7 +1043,13 @@
           "additionalProperties": false,
           "properties": {
             "value": {
-              "type": "null"
+              "type": [
+                "string",
+                "boolean",
+                "number",
+                "object",
+                "array"
+              ]
             },
             "source": {
               "type": "string",
@@ -1037,9 +1061,6 @@
             },
             "required": {
               "type": "boolean"
-            },
-            "requiredAt": {
-              "const": "tenantActivation"
             }
           }
         },
@@ -1242,6 +1263,98 @@
               "type": "boolean"
             }
           }
+        },
+        "moriLicensePublicKey": {
+          "type": "object",
+          "required": [
+            "value",
+            "source",
+            "description"
+          ],
+          "additionalProperties": false,
+          "properties": {
+            "value": {
+              "type": [
+                "string",
+                "boolean",
+                "number",
+                "object",
+                "array"
+              ]
+            },
+            "source": {
+              "type": "string",
+              "minLength": 1
+            },
+            "description": {
+              "type": "string",
+              "minLength": 1
+            },
+            "required": {
+              "type": "boolean"
+            }
+          }
+        },
+        "moriLicenseIssuer": {
+          "type": "object",
+          "required": [
+            "value",
+            "source",
+            "description"
+          ],
+          "additionalProperties": false,
+          "properties": {
+            "value": {
+              "type": [
+                "string",
+                "boolean",
+                "number",
+                "object",
+                "array"
+              ]
+            },
+            "source": {
+              "type": "string",
+              "minLength": 1
+            },
+            "description": {
+              "type": "string",
+              "minLength": 1
+            },
+            "required": {
+              "type": "boolean"
+            }
+          }
+        },
+        "capacityProfile": {
+          "type": "object",
+          "required": [
+            "value",
+            "source",
+            "description"
+          ],
+          "additionalProperties": false,
+          "properties": {
+            "value": {
+              "enum": [
+                "s",
+                "m",
+                "l",
+                "xl"
+              ]
+            },
+            "source": {
+              "type": "string",
+              "minLength": 1
+            },
+            "description": {
+              "type": "string",
+              "minLength": 1
+            },
+            "required": {
+              "type": "boolean"
+            }
+          }
         }
       }
     },
@@ -1326,6 +1439,12 @@
         },
         "portalUrl": {
           "$ref": "#/definitions/output"
+        },
+        "azureOpenAiCreated": {
+          "$ref": "#/definitions/output"
+        },
+        "azureOpenAiSkipReason": {
+          "$ref": "#/definitions/output"
         }
       }
     },

package/lib/schema/installation-environment.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://raw.githubusercontent.com/esystemsdev/aifabrix-builder/refs/heads/main/lib/schema/installation-environment.schema.json",
+  "$id": "aifabrix://schema/installation-environment.schema.json",
   "title": "AI Fabrix Installation Environment File",
   "description": "Committed, non-secret infrastructure/<resource-group>/environment-dev|tst|pro.json. Inherited shared values name environment-infra.json as their source; request is the exact non-secret Miso deploy projection.",
   "metadata": {

package/lib/schema/wizard-config.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://raw.githubusercontent.com/esystemsdev/aifabrix-builder/refs/heads/main/lib/schema/wizard-config.schema.json",
+  "$id": "aifabrix://schema/wizard-config.schema.json",
   "title": "AI Fabrix Wizard Configuration Schema",
   "description": "Schema for validating wizard.yaml configuration files for headless external system creation",
   "type": "object",

package/lib/utils/compose-generate-docker-compose.js

@@ -249,6 +249,18 @@ function buildComposeTemplateContext(ctx) {
     networkName: ctx.networkName,
     containerName: ctx.containerName,
     misoEnvironment: resolveMisoEnvironment(ctx.options),
+    // Containers are run as the invoking host user so bind-mounted files stay writable.
+    // An app that administers its own operating system — creating accounts, managing
+    // sshd — cannot work that way and declares `runAsRoot: true` to opt out.
+    runAsRoot: ctx.appConfig?.runAsRoot === true,
+    // Extra ports for an application serving a second protocol from the same container,
+    // such as SSH beside HTTP. Each host port uses the main port's formula so developers
+    // on one host do not collide.
+    additionalPorts: (ctx.appConfig?.additionalPorts ?? []).map((entry) => ({
+      name: entry.name,
+      containerPort: entry.containerPort,
+      hostPort: ctx.idNum === 0 ? entry.hostPort : entry.hostPort + ctx.idNum * 100
+    })),
     devMountPath: ctx.devMountPath,
     localDataMountPath,
     reloadStartCommand: ctx.reloadStartCommand,

package/lib/utils/config-paths.js

@@ -101,13 +101,8 @@ function createHomeAndSecretsPathFunctions(getConfigFn, saveConfigFn) {
         return;
       }
       const resolved = path.resolve(trimmed);
-      await setPathConfig(
-        getConfigFn,
-        saveConfigFn,
-        'aifabrix-work',
-        resolved,
-        'Work path must be a non-empty string'
-      );
+      await setPathConfig(getConfigFn, saveConfigFn, 'aifabrix-work', resolved,
+        'Work path must be a non-empty string');
     },
     async getAifabrixSecretsPath() {
       return getPathConfig(getConfigFn, 'aifabrix-secrets');
@@ -168,6 +163,17 @@ async function resolveEnvConfigPathToAbsolute(raw, getConfigFn) {
   return path.normalize(path.resolve(base, trimmed));
 }
 
+function findBuilderDirectory(base) {
+  if (!base) return null;
+  const candidate = path.join(base, 'builder');
+  try {
+    if (fs.existsSync(candidate) && fs.statSync(candidate).isDirectory()) return candidate;
+  } catch {
+    /* Missing or inaccessible builder directory. */
+  }
+  return null;
+}
+
 function createEnvConfigPathFunctions(getConfigFn, saveConfigFn) {
   return {
     /**
@@ -199,30 +205,16 @@ function createEnvConfigPathFunctions(getConfigFn, saveConfigFn) {
         return path.dirname(absolute);
       }
       const pathsMod = require('./paths');
-      const tryDir = (base) => {
-        if (!base) {
-          return null;
-        }
-        const b = path.join(base, 'builder');
-        try {
-          if (fs.existsSync(b) && fs.statSync(b).isDirectory()) {
-            return b;
-          }
-        } catch {
-          /* ignore */
-        }
-        return null;
-      };
-      const fromProject = tryDir(pathsMod.getProjectRoot());
+      const fromProject = findBuilderDirectory(pathsMod.getProjectRoot());
       if (fromProject) {
         return fromProject;
       }
-      const fromEffective = tryDir(pathsMod.getBuilderRoot());
+      const fromEffective = findBuilderDirectory(pathsMod.getBuilderRoot());
       if (fromEffective) {
         return fromEffective;
       }
       const work = pathsMod.getAifabrixWork();
-      return tryDir(work);
+      return findBuilderDirectory(work);
     }
   };
 }
@@ -368,11 +360,10 @@ function applySecretsUrlFromRemote(config) {
   config['aifabrix-secrets'] = `${base}/api/dev/secrets`;
 }
 
-function applySyncAndDockerFromHost(config) {
+function applySyncHost(config) {
   const host = hostnameFromUrl(config['remote-server']);
   if (!host) return;
   if (!config['sync-ssh-host']) config['sync-ssh-host'] = host;
-  if (!config['docker-endpoint']) config['docker-endpoint'] = `tcp://${host}:2376`;
 }
 
 async function mergeRemoteSettingsImpl(getConfigFn, saveConfigFn, settings) {
@@ -386,8 +377,13 @@ async function mergeRemoteSettingsImpl(getConfigFn, saveConfigFn, settings) {
     if (value === '') continue;
     config[key] = value;
   }
+  // Current settings are authoritative: never inherit Docker access from another identity.
+  if (typeof settings['docker-endpoint'] !== 'string' || !settings['docker-endpoint'].trim()) {
+    delete config['docker-endpoint'];
+    delete config['docker-tls-skip-verify'];
+  }
   applySecretsUrlFromRemote(config);
-  applySyncAndDockerFromHost(config);
+  applySyncHost(config);
   await saveConfigFn(config);
 }
 
@@ -428,7 +424,6 @@ module.exports = {
   resolveEnvConfigPathToAbsolute,
   SETTINGS_RESPONSE_KEYS,
   applySecretsUrlFromRemote,
-  applySyncAndDockerFromHost,
+  applySyncAndDockerFromHost: applySyncHost,
   hostnameFromUrl
 };
-

package/lib/utils/config-registry-preference.js

@@ -14,13 +14,15 @@ const { getRuntimeConfigFile } = require('../core/config-runtime-paths');
 
 const REGISTRY_CONFIG_KEY = 'registry';
 const HOST_LABEL = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
-const REGISTRY_HOST_RE = new RegExp(`^${HOST_LABEL}(?:\\.${HOST_LABEL})*(?::\\d{1,5})?$`);
+const REGISTRY_HOST_RE = new RegExp(`^${HOST_LABEL}(?:\\.${HOST_LABEL})*$`);
 
 /**
- * Normalizes and validates a registry host (optionally with a port).
- * Rejects schemes, paths, embedded credentials, query/fragment text and whitespace.
+ * Normalizes and validates a registry host.
+ * Rejects schemes, paths, embedded credentials, query/fragment text and whitespace. A port is
+ * rejected because the deployment `image` contract (application-schema.json, shared with the
+ * Controller) accepts only one colon, which separates the tag.
  * @param {string} value - Raw registry value
- * @returns {string} Lower-case host[:port]
+ * @returns {string} Lower-case host
  * @throws {Error} When the value is empty or not a plain host
  */
 function normalizeRegistryHost(value) {
@@ -33,8 +35,13 @@ function normalizeRegistryHost(value) {
     throw new Error(`Invalid registry "${raw}": use a host name such as myregistry.azurecr.io (no scheme, path or credentials)`);
   }
   const host = withoutSlash.toLowerCase();
-  const port = host.includes(':') ? Number(host.split(':')[1]) : null;
-  if (!REGISTRY_HOST_RE.test(host) || (port !== null && (port < 1 || port > 65535))) {
+  if (host.includes(':')) {
+    throw new Error(
+      `Invalid registry "${raw}": a port is not supported because the deployed image reference keeps one colon for the tag. ` +
+      'Use a host name such as myregistry.azurecr.io.'
+    );
+  }
+  if (!REGISTRY_HOST_RE.test(host)) {
     throw new Error(`Invalid registry "${raw}": use a host name such as myregistry.azurecr.io`);
   }
   return host;

package/lib/utils/dev-init-ssh-merge.js

@@ -163,16 +163,17 @@ async function mergeDevSshConfigBlock(p) {
  * Update ~/.ssh/config with Host <user>.<host> for interactive SSH; log result.
  * @param {string} baseUrl - Builder Server base URL
  * @param {string} devId - Developer ID (digits)
+ * @param {Object} [freshSettings] - Current authenticated server settings; never mix with saved identity
  * @returns {Promise<{ hostAlias: string|null, syncUser: string, syncHost: string|null }>}
  */
-async function mergeDevSshConfigAfterInit(baseUrl, devId) {
-  const syncHost = (await config.getSyncSshHost()) || hostnameFromBaseUrl(baseUrl);
-  const syncUser = (await config.getSyncSshUser()) || `dev${devId}`;
+async function mergeDevSshConfigAfterInit(baseUrl, devId, freshSettings) {
+  const syncHost = (freshSettings ? freshSettings['sync-ssh-host'] : await config.getSyncSshHost()) || hostnameFromBaseUrl(baseUrl);
+  const syncUser = (freshSettings ? freshSettings['sync-ssh-user'] : await config.getSyncSshUser()) || `dev${devId}`;
   if (!syncHost) {
     return { hostAlias: null, syncUser, syncHost: null };
   }
   try {
-    const rootTrimmed = trimDeveloperRootDomain(await config.getDeveloperRootDomain());
+    const rootTrimmed = trimDeveloperRootDomain(freshSettings ? freshSettings['developer-root-domain'] : await config.getDeveloperRootDomain());
     return await mergeDevSshConfigBlock({
       baseUrl,
       devId,

package/lib/utils/dev-user-groups.js

@@ -10,7 +10,8 @@ const ALLOWED_DEV_GROUPS = Object.freeze([
   'secret-manager',
   'secret-reader',
   'developer',
-  'docker'
+  'docker',
+  'integrator'
 ]);
 
 /**

package/lib/utils/docker-build.js

@@ -96,8 +96,15 @@ function handleDockerClose(code, ctx) {
   }
 }
 
-function buildDockerCliArgs(imageName, tag, dockerfilePath, contextPath, buildArgs, noCache) {
+function buildDockerCliArgs(imageName, tag, dockerfilePath, contextPath, buildArgs, options = {}) {
+  const { noCache = false, target } = options;
   const args = ['build', '-t', `${imageName}:${tag}`, '-f', dockerfilePath];
+  // A multi-stage Dockerfile builds its last stage unless told otherwise. `build.target`
+  // lets one Dockerfile serve several images from the same source, which is the only way
+  // an app can ship two variants without duplicating its build.
+  if (target) {
+    args.push('--target', String(target));
+  }
   for (const [key, value] of Object.entries(buildArgs)) {
     if (value !== null && value !== undefined && String(value).length > 0) {
       args.push('--build-arg', `${key}=${String(value)}`);
@@ -111,9 +118,12 @@ function buildDockerCliArgs(imageName, tag, dockerfilePath, contextPath, buildAr
 }
 
 function createDockerSpawnParams(options) {
-  const { imageName, tag, dockerfilePath, contextPath, buildArgs, noCache, env } = options;
+  const { imageName, tag, dockerfilePath, contextPath, buildArgs, noCache, env, target } = options;
   const spawnEnv = { ...process.env, ...(env || {}) };
-  const args = buildDockerCliArgs(imageName, tag, dockerfilePath, contextPath, buildArgs || {}, noCache);
+  const args = buildDockerCliArgs(imageName, tag, dockerfilePath, contextPath, buildArgs || {}, {
+    noCache,
+    target
+  });
   return { spawnEnv, args };
 }
 
@@ -163,7 +173,8 @@ function runDockerBuildProcess(buildOpts) {
     reject,
     env = {},
     buildArgs = {},
-    noCache = false
+    noCache = false,
+    target
   } = buildOpts;
   const { spawnEnv, args } = createDockerSpawnParams({
     imageName,
@@ -172,7 +183,8 @@ function runDockerBuildProcess(buildOpts) {
     contextPath,
     buildArgs,
     noCache,
-    env
+    env,
+    target
   });
   const dockerProcess = spawn('docker', args, {
     shell: process.platform === 'win32',
@@ -192,7 +204,12 @@ function runDockerBuildProcess(buildOpts) {
  * @returns {Promise<void>} Resolves when build completes
  * @throws {Error} If build fails
  */
-async function executeDockerBuild(imageName, dockerfilePath, contextPath, tag, buildArgs = {}, noCache = false) {
+async function executeDockerBuild(imageName, dockerfilePath, contextPath, tag, buildArgs = {}, options = false) {
+  // Historically the sixth argument was the `noCache` boolean. It is now an options
+  // object so a build stage can be named too; the boolean form still works, because
+  // this function is exported and callers outside this module pass it that way.
+  const { noCache = false, target } =
+    typeof options === 'boolean' ? { noCache: options } : options || {};
   const spinner = ora({ text: 'Starting Docker build...', spinner: 'dots' }).start();
   const fsSync = require('fs');
   const path = require('path');
@@ -228,7 +245,8 @@ async function executeDockerBuild(imageName, dockerfilePath, contextPath, tag, b
       reject,
       env: dockerCliEnv,
       buildArgs: resolvedBuildArgs,
-      noCache
+      noCache,
+      target
     });
   });
 }
@@ -251,7 +269,10 @@ async function executeBuild(imageName, dockerfilePath, contextPath, tag, options
     options &&
       (options.cache === false || options.noCache === true || options['no-cache'] === true)
   );
-  await executeDockerBuild(imageName, dockerfilePath, contextPath, tag, buildArgs, noCache);
+  await executeDockerBuild(imageName, dockerfilePath, contextPath, tag, buildArgs, {
+    noCache,
+    target: options && options.target
+  });
   await applyTagAliases(imageName, tag, resolveTagAliases(tag, options));
 }
 

package/lib/utils/docker-daemon-tls-ca.js

@@ -146,7 +146,7 @@ function dockerEndpointFromRemoteServer(remoteServerUrl) {
 }
 
 /**
- * Resolve docker-endpoint for CA augmentation (settings override, else derive from remote-server).
+ * Resolve only an explicitly advertised docker-endpoint; a server hostname is not Docker access.
  * @param {{ settings?: Object|null, remoteServerUrl?: string|null }} ctx
  * @returns {string|null}
  */
@@ -156,7 +156,7 @@ function resolveDockerEndpointForCaAugment(ctx) {
   if (typeof fromSettings === 'string' && fromSettings.trim()) {
     return fromSettings.trim();
   }
-  return dockerEndpointFromRemoteServer(ctx && ctx.remoteServerUrl);
+  return null;
 }
 
 /**