@aifabrix/builder 2.59.0 → 2.60.0

package/lib/schema/application-schema.json

@@ -7,12 +7,12 @@
     "key": "application-schema",
     "name": "Application Configuration Schema",
     "description": "JSON schema for validating AI Fabrix application configuration files",
-    "version": "1.7.0",
+    "version": "1.9.0",
     "type": "schema",
     "category": "infrastructure",
     "author": "AI Fabrix Team",
     "createdAt": "2024-01-01T00:00:00Z",
-    "updatedAt": "2026-09-16T00:00:00Z",
+    "updatedAt": "2026-09-23T00:00:00Z",
     "compatibility": {
       "minVersion": "1.0.0",
       "maxVersion": "2.0.0",
@@ -30,6 +30,27 @@
       "external-datasource.schema.json"
     ],
     "changelog": [
+      {
+        "version": "1.9.0",
+        "date": "2026-09-23T00:00:00Z",
+        "breaking": false,
+        "changes": [
+          "Added optional platforms: the target Azure resource group is matched against resource patterns to yield {platform} and {platform.name}, and that entry's configuration resolves from them.",
+          "Added optional environments: per-environment configuration layered over the platform match, overriding by name.",
+          "Added optional portalInput.visible (default true) so a resolved or derived value stays out of the portal form.",
+          "Both sections are optional and independent; manifests without them are unchanged."
+        ]
+      },
+      {
+        "version": "1.8.0",
+        "date": "2026-09-21T00:00:00Z",
+        "changes": [
+          "Added optional build.target: the multi-stage Dockerfile stage to build (docker build --target). Omitted, Docker builds the final stage as before, so existing manifests are unaffected. Lets one Dockerfile and one source tree produce more than one image.",
+          "Added optional top-level runAsRoot: run the container as the image user (root) rather than the invoking host user. Absent or false keeps the existing behavior. Only for an application that administers its own operating system, such as creating Linux accounts or running sshd.",
+          "Added optional top-level additionalPorts: extra container ports to publish beside the main port, for an application serving a second protocol such as SSH from the same container. Each host port is derived as hostPort + developerId * 100, the same formula as the main port. A base below 1024 is permitted so a well-known port keeps its number. Absent keeps the existing single-port behavior."
+        ],
+        "breaking": false
+      },
       {
         "version": "1.7.0",
         "date": "2026-09-16T00:00:00Z",
@@ -210,6 +231,124 @@
       "type": "boolean",
       "description": "Whether application requires storage.Physical storage is mapped to /mnt/data/. Blob storage is mapped to SMB File share /data/{app-key}/."
     },
+    "platforms": {
+      "type": "array",
+      "description": "Platform resolution: the target Azure resource group is matched against these entries, yielding {platform} and {platform.name}. Optional and independent of environments.",
+      "items": {
+        "type": "object",
+        "required": ["resource", "name", "configuration"],
+        "additionalProperties": false,
+        "properties": {
+          "resource": {
+            "type": "string",
+            "description": "Resource-group pattern; {platform} marks the platform segment and * captures a name segment",
+            "minLength": 1
+          },
+          "name": {
+            "type": "string",
+            "description": "Platform name: a literal, or * to take the captured segment",
+            "minLength": 1
+          },
+          "options": {
+            "type": "array",
+            "description": "Allowed platform values; required when resource contains {platform}",
+            "minItems": 1,
+            "items": { "type": "string", "minLength": 1 }
+          },
+          "platform": {
+            "type": "string",
+            "description": "Declared platform for a resource pattern with no {platform} token; mutually exclusive with options",
+            "minLength": 1
+          },
+          "configuration": {
+            "type": "array",
+            "description": "Values resolved when this platform matches",
+            "items": {
+        "type": "object",
+            "required": ["name", "value"],
+            "additionalProperties": false,
+            "properties": {
+              "name": {
+                "type": "string",
+                "description": "Configuration variable name",
+                "pattern": "^[A-Z_][A-Z0-9_]*$"
+              },
+              "value": {
+                "type": "string",
+                "description": "Literal, or a value containing {platform}, {platform.name} or {resourceGroup} tokens"
+              },
+              "location": {
+                "type": "string",
+                "description": "Where the value is stored",
+                "enum": ["variable", "keyvault"]
+              },
+              "required": {
+                "type": "boolean",
+                "description": "Whether this configuration is required"
+              },
+              "category": {
+                "type": "string",
+                "description": "Optional UI grouping label for portal/deployment wizard Configuration tab",
+                "minLength": 1,
+                "maxLength": 100
+              }
+            }
+            }
+          }
+        }
+      }
+    },
+    "environments": {
+      "type": "array",
+      "description": "Per-environment values layered over the platform match, overriding by name. Optional and independent of platforms.",
+      "items": {
+        "type": "object",
+        "required": ["environment", "configuration"],
+        "additionalProperties": false,
+        "properties": {
+          "environment": {
+            "type": "string",
+            "description": "Deployment environment key (for example miso, dev, tst, pro)",
+            "minLength": 1
+          },
+          "configuration": {
+            "type": "array",
+            "description": "Values resolved for this environment",
+            "items": {
+        "type": "object",
+            "required": ["name", "value"],
+            "additionalProperties": false,
+            "properties": {
+              "name": {
+                "type": "string",
+                "description": "Configuration variable name",
+                "pattern": "^[A-Z_][A-Z0-9_]*$"
+              },
+              "value": {
+                "type": "string",
+                "description": "Literal, or a value containing {platform}, {platform.name} or {resourceGroup} tokens"
+              },
+              "location": {
+                "type": "string",
+                "description": "Where the value is stored",
+                "enum": ["variable", "keyvault"]
+              },
+              "required": {
+                "type": "boolean",
+                "description": "Whether this configuration is required"
+              },
+              "category": {
+                "type": "string",
+                "description": "Optional UI grouping label for portal/deployment wizard Configuration tab",
+                "minLength": 1,
+                "maxLength": 100
+              }
+            }
+            }
+          }
+        }
+      }
+    },
     "configuration": {
       "type": "array",
       "description": "Core application configuration",
@@ -274,6 +413,10 @@
                 "type": "boolean",
                 "description": "Whether to mask the input (for passwords)"
               },
+              "visible": {
+                "type": "boolean",
+                "description": "Whether the portal shows this input. Default true; false keeps a resolved or derived value out of the form."
+              },
               "validation": {
                 "type": "object",
                 "properties": {
@@ -413,6 +556,10 @@
                       "type": "boolean",
                       "description": "Whether to mask the input (for passwords)"
                     },
+                    "visible": {
+                      "type": "boolean",
+                      "description": "Whether the portal shows this input. Default true; false keeps a resolved or derived value out of the form."
+                    },
                     "validation": {
                       "type": "object",
                       "properties": {
@@ -806,6 +953,43 @@
       "minLength": 1,
       "maxLength": 200
     },
+    "additionalPorts": {
+      "type": "array",
+      "description": "Extra container ports to publish beside the main port. For an application that serves a second protocol from the same container, such as SSH alongside HTTP. Each host port is derived the same way as the main one: hostPort + developerId * 100 (developer id 0 keeps hostPort).",
+      "maxItems": 5,
+      "items": {
+        "type": "object",
+        "required": ["name", "containerPort", "hostPort"],
+        "additionalProperties": false,
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "What the port is for, e.g. 'ssh'. Used in generated compose comments and diagnostics.",
+            "pattern": "^[a-z][a-z0-9-]*$",
+            "minLength": 1,
+            "maxLength": 30
+          },
+          "containerPort": {
+            "type": "integer",
+            "description": "Port the process listens on inside the container.",
+            "minimum": 1,
+            "maximum": 65535
+          },
+          "hostPort": {
+            "type": "integer",
+            "description": "Base host port. The published port is hostPort + developerId * 100, so developers on one host do not collide. A base below 1024 is allowed so a well-known port can keep its number (SSH as 22, giving 122 for developer 1); the container engine binds it, not the application.",
+            "minimum": 1,
+            "maximum": 65535
+          }
+        }
+      }
+    },
+    "runAsRoot": {
+      "type": "boolean",
+      "default": false,
+      "description": "Run the container as the image user (root) instead of the invoking host user. Only for an application that administers its own operating system, such as creating Linux accounts or running sshd; files it writes to a bind mount will be root-owned. Absent or false keeps the existing behavior.",
+      "examples": [false]
+    },
     "runtimeVersion": {
       "type": "object",
       "description": "Runtime version configuration",
@@ -886,6 +1070,13 @@
           "description": "Dockerfile name (empty or missing = use auto-generated template)",
           "pattern": "^[^/].*"
         },
+        "target": {
+          "type": "string",
+          "description": "Multi-stage Dockerfile stage to build (docker build --target). Omit to build the final stage, which is the default. Lets one Dockerfile and one source tree produce more than one image, e.g. an application shipped in two installation variants.",
+          "minLength": 1,
+          "maxLength": 100,
+          "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*$"
+        },
         "remoteSyncPath": {
           "type": "string",
           "description": "Relative path under user-mutagen-folder for remote sync and Docker -v; when unset, defaults to dev/<appKey>. No leading slash.",

package/lib/schema/infra-parameter.schema.json

@@ -3,7 +3,10 @@
   "$id": "aifabrix://schema/infra-parameter.schema.json",
   "title": "Infra parameter catalog",
   "type": "object",
-  "required": ["version", "parameters"],
+  "required": [
+    "version",
+    "parameters"
+  ],
   "additionalProperties": false,
   "properties": {
     "version": {
@@ -12,7 +15,10 @@
     },
     "standardUpInfraEnsureKeys": {
       "type": "array",
-      "items": { "type": "string", "minLength": 1 },
+      "items": {
+        "type": "string",
+        "minLength": 1
+      },
       "description": "Extra keys always merged on up-infra (e.g. default miso-controller DB pair when no workspace template lists them)."
     },
     "defaults": {
@@ -20,28 +26,47 @@
       "additionalProperties": false,
       "description": "Default values for {{adminPassword}}, {{adminEmail}}, {{userPassword}} in literal generator values; overridden by aifabrix up-infra flags.",
       "properties": {
-        "adminEmail": { "type": "string" },
-        "adminPassword": { "type": "string" },
-        "userPassword": { "type": "string" }
+        "adminEmail": {
+          "type": "string"
+        },
+        "adminPassword": {
+          "type": "string"
+        },
+        "userPassword": {
+          "type": "string"
+        }
       }
     },
     "parameters": {
       "type": "array",
-      "items": { "$ref": "#/definitions/parameterEntry" }
+      "items": {
+        "$ref": "#/definitions/parameterEntry"
+      }
     }
   },
   "definitions": {
     "ensureOnEnum": {
       "type": "string",
-      "enum": ["upInfra", "resolveApp", "appRegister"]
+      "enum": [
+        "upInfra",
+        "resolveApp",
+        "appRegister"
+      ]
     },
     "scopeEnum": {
       "type": "string",
-      "enum": ["infra", "app", "shared-service", "system"]
+      "enum": [
+        "infra",
+        "app",
+        "shared-service",
+        "system"
+      ]
     },
     "generator": {
       "type": "object",
-      "required": ["type"],
+      "required": [
+        "type"
+      ],
       "additionalProperties": false,
       "properties": {
         "type": {
@@ -67,17 +92,47 @@
           "maximum": 512,
           "description": "For randomAlphanumeric: character count (default 32). For password: default 8. Charset [a-zA-Z0-9]."
         },
-        "pairId": { "type": "string", "minLength": 1 },
-        "part": { "type": "string", "enum": ["private", "public"] }
+        "pairId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "part": {
+          "type": "string",
+          "enum": [
+            "private",
+            "public"
+          ]
+        }
       },
       "allOf": [
         {
-          "if": { "properties": { "type": { "const": "literal" } } },
-          "then": { "required": ["value"] }
+          "if": {
+            "properties": {
+              "type": {
+                "const": "literal"
+              }
+            }
+          },
+          "then": {
+            "required": [
+              "value"
+            ]
+          }
         },
         {
-          "if": { "properties": { "type": { "const": "rsaKeyPair" } } },
-          "then": { "required": ["pairId", "part"] }
+          "if": {
+            "properties": {
+              "type": {
+                "const": "rsaKeyPair"
+              }
+            }
+          },
+          "then": {
+            "required": [
+              "pairId",
+              "part"
+            ]
+          }
         }
       ]
     },
@@ -85,19 +140,32 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "vaultSecretName": { "type": "string" },
-        "vaultSecretNamePattern": { "type": "string" },
+        "vaultSecretName": {
+          "type": "string"
+        },
+        "vaultSecretNamePattern": {
+          "type": "string"
+        },
         "legacyVaultSecretNames": {
           "type": "array",
-          "items": { "type": "string", "minLength": 1 },
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
           "uniqueItems": true
         },
-        "notes": { "type": "string" }
+        "notes": {
+          "type": "string"
+        }
       }
     },
     "parameterEntry": {
       "type": "object",
-      "required": ["scope", "generator", "ensureOn"],
+      "required": [
+        "scope",
+        "generator",
+        "ensureOn"
+      ],
       "additionalProperties": false,
       "properties": {
         "key": {
@@ -108,8 +176,13 @@
           "type": "string",
           "minLength": 1
         },
-        "category": { "type": "string", "minLength": 1 },
-        "sensitive": { "type": "boolean" },
+        "category": {
+          "type": "string",
+          "minLength": 1
+        },
+        "sensitive": {
+          "type": "boolean"
+        },
         "valueSource": {
           "type": "string",
           "enum": [
@@ -120,31 +193,64 @@
             "optionalInput"
           ]
         },
-        "requiredOnSystemOnboarding": { "type": "boolean" },
-        "ownerAppKey": { "type": "string", "minLength": 1 },
+        "requiredOnSystemOnboarding": {
+          "type": "boolean"
+        },
+        "ownerAppKey": {
+          "type": "string",
+          "minLength": 1
+        },
         "sharedWithAppKeys": {
           "type": "array",
-          "items": { "type": "string", "minLength": 1 },
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
           "minItems": 1,
           "uniqueItems": true,
           "description": "Named applications, other than ownerAppKey, that may read this value."
         },
-        "scope": { "$ref": "#/definitions/scopeEnum" },
-        "generator": { "$ref": "#/definitions/generator" },
+        "visibility": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "App keys allowed to read this parameter. Canonical field in the Miso catalog that lib/schema/infra.parameter.yaml mirrors; sharedWithAppKeys is the older Builder spelling."
+        },
+        "scope": {
+          "$ref": "#/definitions/scopeEnum"
+        },
+        "generator": {
+          "$ref": "#/definitions/generator"
+        },
         "ensureOn": {
           "type": "array",
           "minItems": 1,
-          "items": { "$ref": "#/definitions/ensureOnEnum" }
+          "items": {
+            "$ref": "#/definitions/ensureOnEnum"
+          }
+        },
+        "requiredForLocal": {
+          "type": "boolean"
+        },
+        "azure": {
+          "$ref": "#/definitions/azureBlock"
         },
-        "requiredForLocal": { "type": "boolean" },
-        "azure": { "$ref": "#/definitions/azureBlock" },
-        "notes": { "type": "string" }
+        "notes": {
+          "type": "string"
+        }
       },
       "allOf": [
         {
           "if": {
-            "required": ["scope"],
-            "properties": { "scope": { "const": "system" } }
+            "required": [
+              "scope"
+            ],
+            "properties": {
+              "scope": {
+                "const": "system"
+              }
+            }
           },
           "then": {
             "required": [

package/lib/schema/infra.parameter.yaml

@@ -29,7 +29,6 @@ standardUpInfraEnsureKeys:
   - databases-dataplane-3-urlKeyVault
   - databases-dataplane-3-passwordKeyVault
   # Miso-controller Entra onboarding (vendor app); required for aifabrix resolve miso-controller
-  - entra-callback-state-secret
   - entra-callback-uri
   - entra-client-idKeyVault
   - entra-client-secretKeyVault
@@ -349,20 +348,6 @@ parameters:
 
   # Miso-controller Entra ID onboarding (vendor multi-tenant app). Empty client/callback values
   # allow local resolve and start-dev; set real values before Entra admin-consent flows.
-  - key: entra-callback-state-secret
-    category: Microsoft Entra ID
-    sensitive: true
-    valueSource: generated
-    requiredOnSystemOnboarding: true
-    scope: system
-    generator:
-      type: randomBytes32
-    ensureOn: [upInfra, resolveApp]
-    azure:
-      notes: >-
-        Shared HMAC secret (min 16 chars) for OAuth state between controller and Mori callback;
-        maps to ENTRA_CALLBACK_STATE_SECRET in miso-controller env.template.
-
   - key: entra-callback-uri
     category: Microsoft Entra ID
     sensitive: false
@@ -441,8 +426,9 @@ parameters:
     # side is decrypted by the other. The read was already happening in the shipped template
     # and the policy denied it. Declared rather than silently permitted, and kept to the one
     # application that needs it instead of moving the key to a scope that grants everyone.
-    sharedWithAppKeys:
+    visibility:
       - dataplane
+      - mori-controller
     scope: app
     generator:
       type: randomBytes32
@@ -454,6 +440,32 @@ parameters:
       notes: >-
         32-byte secret as base64; generated on first ensure. Rotate in production.
 
+  - key: integration-server-secrets-encryptionKeyVault
+    ownerAppKey: integration-server
+    # Deliberately NOT shared with any other app, which is the point of the row.
+    # An integrator installation hands this key to every developer it provisions: it is
+    # written into each managed ~/.aifabrix/config.yaml as `secrets-encryption`, so the
+    # CLI can decrypt what that installation's own secrets API encrypted. A key shared
+    # with another application would therefore be readable by everyone holding a shell
+    # in that container, and one leak would reach every installation using it.
+    # One installation, one key, so the blast radius stays inside it.
+    #
+    # Before this row existed, integration-server's env.template read
+    # `kv://builder-server-secrets-encryptionKeyVault` — another application's key.
+    # That resolves only by being granted, and granting it grants exactly the access
+    # above; without a grant it silently generated an unrelated value instead, so the
+    # two server types drifted apart with nothing reporting it.
+    scope: app
+    generator:
+      type: randomBytes32
+    ensureOn: [upInfra, resolveApp]
+    azure:
+      vaultSecretName: integration-server-secrets-encryptionKeyVault
+      notes: >-
+        32-byte secret as base64; generated on first ensure, per installation. Rotating it
+        requires re-running configuration sync so every managed config.yaml is rewritten;
+        secrets already stored by that installation do not survive the rotation.
+
   # Local kv:// name matches miso-controller env.template (JWT_SECRET); not the generic {appKey}-secrets-jwtKeyVault Azure name.
   - key: miso-controller-jwt-secretKeyVault
     ownerAppKey: miso-controller
@@ -794,18 +806,6 @@ parameters:
         Optional local testing/development bearer bypass. A supplied local value is resolved; when absent,
         local and Azure application deployment resolve it as empty and do not fail.
 
-  - key: mori-callback-api-keyKeyVault
-    ownerAppKey: miso-controller
-    scope: app
-    generator:
-      type: randomBytes32
-    ensureOn: [resolveApp]
-    azure:
-      vaultSecretName: mori-callback-api-keyKeyVault
-      legacyVaultSecretNames:
-        - marketplace-mori-callback-api-key
-      notes: Miso Controller callback credential; generated only when its resolved manifest requires it.
-
   # App semver when env.template / conversion yields kv://version (local secrets backfill).
   - key: version
     scope: app

package/lib/schema/infrastructure-schema.json

@@ -7,12 +7,12 @@
     "key": "infrastructure-schema",
     "name": "Installation Infrastructure Manifest Schema",
     "description": "JSON schema for infrastructure/<resource-group>/environment-infra.json",
-    "version": "2.0.0",
+    "version": "2.1.0",
     "type": "schema",
     "category": "infrastructure",
     "author": "AI Fabrix Team",
     "createdAt": "2024-01-01T00:00:00Z",
-    "updatedAt": "2026-09-17T00:00:00Z",
+    "updatedAt": "2026-09-24T00:00:00Z",
     "compatibility": {
       "minVersion": "2.0.0",
       "maxVersion": "2.0.0",
@@ -26,6 +26,14 @@
     ],
     "dependencies": [],
     "changelog": [
+      {
+        "version": "2.1.0",
+        "date": "2026-09-24T00:00:00Z",
+        "breaking": false,
+        "changes": [
+          "Removed moriCallbackApiKey and entraCallbackStateSecret: the shipped Marketplace template no longer declares them. The installation receives its Mori key at licence registration, and Entra consent state is issued server-side (Mori 227.5)."
+        ]
+      },
       {
         "version": "2.0.0",
         "date": "2026-09-16T00:00:00Z",
@@ -501,8 +509,6 @@
         "acrResourceId",
         "deployRoleAssignments",
         "moriBaseUrl",
-        "moriCallbackApiKey",
-        "entraCallbackStateSecret",
         "entraIdClientId",
         "entraIdClientSecret",
         "entraIdTenantId",
@@ -1058,37 +1064,6 @@
             }
           }
         },
-        "moriCallbackApiKey": {
-          "$ref": "#/definitions/envReference"
-        },
-        "entraCallbackStateSecret": {
-          "type": "object",
-          "required": [
-            "value",
-            "source",
-            "description"
-          ],
-          "additionalProperties": false,
-          "properties": {
-            "value": {
-              "type": "null"
-            },
-            "source": {
-              "type": "string",
-              "minLength": 1
-            },
-            "description": {
-              "type": "string",
-              "minLength": 1
-            },
-            "required": {
-              "type": "boolean"
-            },
-            "requiredAt": {
-              "const": "tenantActivation"
-            }
-          }
-        },
         "entraIdClientId": {
           "type": "object",
           "required": [