@aifabrix/builder 2.60.0 → 2.62.0

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.83'
+  version: '2.0.91'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
@@ -84,12 +84,108 @@ repository:
 # are stack-level, not per environment: there is no `environments:` section.
 # env.template consumes these names as {NAME}.
 platforms:
+  # Production is matched first and by its literal name, because its host is not the suffixed
+  # pattern the other platforms follow: `platform.aifabrix.dev`, not `platform-pro.aifabrix.dev`.
+  - resource: aifabrix-int-pro
+    name: aifabrix
+    platform: pro
+    configuration:
+      - name: LOCATION
+        value: 'swedencentral'
+      - name: CLOUD_VENDOR
+        value: 'azure'
+      - name: MORI_BASE_URL
+        value: 'https://platform.aifabrix.dev/mori'
+
+  # Local Docker runs. No resource group is supplied, so `matchLocalPlatform` takes the FIRST entry
+  # declaring the local platform (`dev`) -- this one -- and the literal `aifabrix-local` can never
+  # match a real group, so Azure deployments fall through to the entries below.
+  #
+  # It MUST sit above `aifabrix-int-{platform}`: that entry also resolves to `dev`, so without this
+  # one a local stack took `https://platform-dev.aifabrix.dev/mori` -- a host that does not exist on
+  # a developer machine. Measured on dev01 2026-09-28: every Mori call failed with `socket hang up`,
+  # and `LicenseValidationService.pickupLicenseFromMori` maps that transport failure to
+  # `LicenseInvalidError`, which surfaces as **HTTP 403** on
+  # `POST /api/ide/onboarding/license/pickup`. A connection failure reported as Forbidden sent the
+  # investigation after api-key permissions for days (mori 48.0 `reproduce-license-pickup-403`).
+  #
+  # Service-to-service traffic has no reason to leave the cluster through the public edge, and the
+  # public host is not even resolvable from inside the container. Verified from the miso-controller
+  # container: `http://mori-controller:3004/api/v1/health` answers 200 while both
+  # `platform-dev.aifabrix.dev` and `dev01.aifabrix.dev` fail to connect.
+  #
+  # The value is the declarative `url://` form rather than a literal host, so the Builder resolves
+  # it from the platform topology the same way Mori's own env.template resolves
+  # `url://miso-controller-internal`. A literal would be a second place to edit whenever the local
+  # service address changes, and the whole point of `url://` is that there is one.
+  #
+  # Verified on dev01 that this is the reachable address and that the `/mori` prefix it carries is
+  # served: from the miso-controller container both `http://mori-controller:3004/api/v1/health` and
+  # `http://mori-controller:3004/mori/api/v1/health` answer 200. `moriApiBase()` appends `/api/v1`.
+  #
+  # NOT `kv://mori-controller-web-server-url`, which is what the entries below deliberately moved
+  # away from: that reads the application RECORD, and on aifabrix-ce-16 the record still held
+  # `http://localhost:3004`. `url://` is resolved from the topology at resolve time, not from a
+  # record an Azure deployment never overwrites.
+  - resource: aifabrix-local
+    name: aifabrix
+    platform: dev
+    configuration:
+      - name: LOCATION
+        value: 'swedencentral'
+      - name: MORI_BASE_URL
+        value: 'url://mori-controller-internal'
+      # Declared, because the fallback infers it and infers it wrongly here:
+      # `resolveCloudVendor` returns 'azure' whenever AZURE_SUBSCRIPTION_ID is set, and every
+      # developer box has it from the shared development service principal. A local stack was
+      # therefore treated as an Azure installation, `verifyInstallationBinding` took
+      # `verifyAzureBinding`, and that demands a directory tenant AND a resource group. A
+      # developer box has no resource group, so the binding refused with
+      # "Azure licence binding requires the tenant ID and resource group." The licence guard
+      # turns that into HTTP 403 on every guarded operation — including
+      # `app rotate-secret`, which is the one command that recovers a re-minted credential.
+      #
+      # Measured on dev01 2026-10-04: the dataplane could not start (its client secret had been
+      # re-minted, plan 264.0) and the recovery command was itself refused. The two defects
+      # compose into a dead end that no developer can get out of.
+      - name: CLOUD_VENDOR
+        value: 'docker'
+      # The one installation name the licence binds to (plan 266.0). Sent to Mori as
+      # `resourceGroupName`; docker requires exactly `local-dev{NN}` or registration refuses.
+      # Only on this entry — the Azure platforms below must not be `local-*` and keep SERVICE_NAME.
+      - name: MISO_INSTALLATION_NAME
+        value: 'local-${DEV_USERNAME}'
+      # Plan 262.0: a local stack onboards as SaaS, so the full activation cycle is reachable here.
+      #
+      # `requiresTenantActivationWizard()` is `isAzureDeployment() || isAzureMockDeployment() ||
+      # isSaasDirectOnboarding()`. With `customerOwned` all three are false on a dev box, so the
+      # wizard never ran — and the wizard is what collects the customer directory tenant and
+      # records consent. Without it the tenant is only ever read from the environment, which is the
+      # in-tenant assumption and wrong for SaaS.
+      #
+      # This is the ONBOARDING axis, deliberately not the DEPLOYMENT axis. `DEPLOYMENT` stays
+      # `database` (DB-only; no Docker, no Azure), which `isLocalOnboardingDeployment()` already
+      # treats as local. `DEPLOYMENT=local` means Miso orchestrating Docker itself, which is not
+      # ready and is not what a dev box runs — keying this on it would never fire.
+      #
+      # Only on this entry: the Azure platforms below stay `customerOwned`.
+      - name: ONBOARDING_MODE
+        value: 'saasDirect'
+
   - resource: aifabrix-int-{platform}
     name: aifabrix
-    options: [dev, tst, pro]
+    options: [dev, tst]
     configuration:
       - name: LOCATION
         value: 'swedencentral'
+      - name: CLOUD_VENDOR
+        value: 'azure'
+      # Mori the installation talks to. Previously `kv://mori-controller-web-server-url`, which
+      # resolved to whatever the *application record* held — on aifabrix-ce-16 that was
+      # `http://localhost:3004`, because an Azure deployment never overwrites a stale URL, so every
+      # consumer of it was pointed at a loopback address that does not exist in the cluster.
+      - name: MORI_BASE_URL
+        value: 'https://platform-{platform}.aifabrix.dev/mori'
 
   - resource: aifabrix-ce-*
     name: '*'
@@ -98,6 +194,24 @@ platforms:
     configuration:
       - name: LOCATION
         value: 'swedencentral'
+      - name: CLOUD_VENDOR
+        value: 'azure'
+      # The App Service hostname, not the Front Door one, because only this is derivable.
+      #
+      # The Front Door endpoint carries an Azure-generated suffix (`fzahchbachcfbgaj`) that no
+      # template can spell: `{platform}`, `{platform.name}` and `{resourceGroup}` are the only
+      # tokens, and none of them yields it. The previous literal was aifabrix-ce-16's endpoint and
+      # was therefore wrong for every other `aifabrix-ce-*` installation -- the next one built would
+      # have pointed its Miso at ce-16's Mori.
+      #
+      # The web app is named `{resourceGroup}-miso-mori-controller` by the installer, so its default
+      # hostname IS derivable and is correct for every installation in the group. Verified on
+      # aifabrix-ce-16 2026-09-27: that host answers /mori/health with 200. This is also the better
+      # address for Miso->Mori traffic, which is service-to-service and has no reason to leave the
+      # cluster through the public edge. When the named platform hosts exist
+      # (`platform-dev.aifabrix.dev/mori`) this entry can follow the pattern used above.
+      - name: MORI_BASE_URL
+        value: 'https://{resourceGroup}-miso-mori-controller.azurewebsites.net/mori'
 
 configuration:
   # -------------------------------------------------------------------------

package/templates/applications/miso-controller/env.template

@@ -11,7 +11,8 @@
 #   [saasDirect]    eSystems-hosted SaaS activation (four-step wizard)
 #   [customerOwned] Azure-in-tenant activation (existing TA wizard)
 #
-# ONBOARDING_MODE selects the onboarding step list. It is orthogonal to DEPLOYMENT,
+# ONBOARDING_MODE selects the onboarding step list. saasDirect also enables the local wizard.
+# It is orthogonal to DEPLOYMENT,
 # which selects Azure SDK vs local execution. There is NO fifth DEPLOYMENT value:
 # eSystems-hosted SaaS still runs DEPLOYMENT=azure. See the DEPLOYMENT TYPE and
 # ONBOARDING MODE sections below.
@@ -40,14 +41,28 @@
 # Optional custom controller key for onboarding (default: miso-controller)
 ONBOARDING_CONTROLLER_KEY=miso-controller
 
-# Infrastructure/service name used by controller/onboarding flows
-INFRASTRUCTURE_NAME=${DEV_USERNAME}.${DEV_ROOT_DOMAIN}
-
 # Azure region (required for first-time onboarding: controller record / provisioning metadata).
 # Use the region you deploy to (e.g. westeurope, eastus, northeurope). Single env name: LOCATION.
 # Resolved from the platform match; see `platforms` in application.yaml.
 LOCATION={LOCATION}
 
+# Which kind of installation this is, for licence binding. Declared, never inferred.
+#
+# `resolveCloudVendor` falls back to "AZURE_SUBSCRIPTION_ID is set, therefore Azure", and every
+# developer box has that variable from the shared development service principal. A local stack was
+# then bound as an Azure installation, which requires a directory tenant AND a resource group; a
+# developer box has no resource group, so licence binding refused and the licence guard returned
+# HTTP 403 for every guarded operation — `app rotate-secret` included, which is precisely the
+# command needed to recover a credential the controller had re-minted.
+#
+# Resolved from the platform match: `docker` locally, `azure` for every real resource group.
+CLOUD_VENDOR={CLOUD_VENDOR}
+
+# The one installation name the licence binds to (plan 266.0). Not a label: Miso sends it to Mori
+# as `resourceGroupName`, and docker requires exactly `local-dev{NN}` or registration refuses.
+# `${DEV_USERNAME}` yields `local-dev03`. It is the only name a local install declares.
+MISO_INSTALLATION_NAME=local-${DEV_USERNAME}
+
 # Required for admin user creation during onboarding
 # Password for the initial administrator user (username: admin)
 ONBOARDING_ADMIN_PASSWORD=kv://miso-controller-admin-passwordKeyVault
@@ -151,7 +166,6 @@ KEYCLOAK_CLIENT_ID=kv://keycloak-client-idKeyVault
 KEYCLOAK_CLIENT_SECRET=kv://keycloak-client-secretKeyVault
 KEYCLOAK_ADMIN_USERNAME=admin
 KEYCLOAK_ADMIN_PASSWORD=kv://keycloak-admin-passwordKeyVault
-KEYCLOAK_PUBLIC_KEY=
 KEYCLOAK_VERIFY_AUDIENCE=false
 KEYCLOAK_TOKEN_TIMEOUT=5000
 KEYCLOAK_DEFAULT_PASSWORD=kv://keycloak-default-passwordKeyVault
@@ -193,16 +207,21 @@ WAIT_FOR_KEYCLOAK=true
 # For production: use public domain (e.g., https://miso.example.com)
 # url://public includes front-door path from application.yaml (e.g. /controller).
 MISO_WEB_SERVER_URL=url://public
+# Private service-to-service controller origin; public/browser traffic uses MISO_WEB_SERVER_URL.
 MISO_CONTROLLER_URL=url://internal
 MISO_RELATIVE_PATH=url://vdir-public
-ALLOWED_ORIGINS=http://localhost:*,url://host-public,url://host-private,url://dataplane-host-public,url://dataplane-host-private
+ALLOWED_ORIGINS=http://localhost:*,url://host-public,url://host-private,url://dataplane-host-public,url://dataplane-host-private,url://mori-controller-host-public
 # Opt-in: broker/entry/referer under /data keep …/data/auth/callback (do not append /miso). Default off.
 # AUTH_PRESERVE_DATAPLANE_VDIR=true
 
 # MISO Environment Configuration (miso, dev, tst, pro)
 MISO_ENVIRONMENT=miso
 
-# MISO Application Client Credentials (per application)
+# Governed configuration uses per-application client credentials by default. The SDK loads
+# its bootstrap snapshot and refreshes it automatically within two minutes; consumers decide
+# whether a changed key also requires an internal client or resource to be recreated.
+MISO_AUTH_MODE=client-credentials
+# MISO Application Client Credentials (per application; never expose the secret to the browser)
 MISO_CLIENTID=kv://miso-controller-client-idKeyVault
 MISO_CLIENTSECRET=kv://miso-controller-client-secretKeyVault
 
@@ -286,12 +305,12 @@ DEPLOYMENT=database
 #
 # customerOwned = Azure-in-tenant wizard
 #                 consent → identity → size → access-model → endpoint → validation
-# saasDirect    = eSystems-hosted activation
-#                 consent → identity → endpoint (domain only) → review
+# saasDirect    = hosted or local Docker guided activation
+#                 consent → endpoint (local browser URL or optional domain) → identity → review
 #                 Omits size, access-model, customer deploy and platform-apps.
 #
 # Unset defaults to customerOwned. An unknown value fails closed with HTTP 400.
-ONBOARDING_MODE=customerOwned
+ONBOARDING_MODE=saasDirect
 
 # Dev/test: show TA Entra "Completing setup" countdown (120s cap). Default false.
 # Exposed to UI via GET /api/v1/tenant/status → showTaCountdown (restart controller after change).
@@ -306,9 +325,10 @@ SHOW_TA_COUNT_DOWN=false
 ENCRYPTION_KEY=kv://miso-controller-secrets-encryptionKeyVault
 
 # Comma-separated application keys allowed for POST .../applications/bootstrap (install-time only).
-# Environment placement is a separate controller rule: workloads (dataplane, builder-api) install into
-# dev/tst/pro but never `miso`; miso-controller and keycloak only into `miso`; mori-controller anywhere.
-BOOTSTRAP_APPKEYS=dataplane,builder-api,mori-controller
+# Environment placement is a separate controller rule: workloads (dataplane, customer apps) install
+# into dev/tst/pro but never `miso`; miso-controller, keycloak, builder-api, and integration-server
+# only into `miso`; mori-controller anywhere.
+BOOTSTRAP_APPKEYS=dataplane,builder-api,integration-server,mori-controller
 
 # Key Vault Integration (for security parameter encryption)
 # Set to true to enable Azure Key Vault for storing security parameters
@@ -378,8 +398,36 @@ ENTRA_GRAPH_DELEGATED_REDIRECT_URI=url://mori-controller-public/entra-graph-dele
 # registered and running for this developer.
 # MORI_API_KEY is per-installation and is minted by POST /marketplace/bootstrap; it is written
 # here by the controller after registration, not provisioned ahead of it.
-MORI_BASE_URL=kv://mori-controller-web-server-url
+MORI_BASE_URL={MORI_BASE_URL}
+
+# Mori's policy signing ANCHOR, public half. Verifies the signed enforcement bundle.
+#
+# Mori holds the private half and signs with it; this is the key the bundle is checked against, so
+# an installation that could write it could trust a bundle it signed itself. It is supplied, never
+# generated: on Azure the deployment template writes `mori-policy-public-keyKeyVault` into the
+# installation vault. Locally it is per developer, because each box's Mori holds its own pair.
+#
+# `pnpm license:sign:local` reads it from here so the command needs no arguments. Export the public
+# half from the local Mori once:
+#
+#   docker exec aifabrix-dev${NN}-mori-controller node -e "const {createPublicKey}=require('crypto');\
+#     process.stdout.write(createPublicKey(process.env.MORI_POLICY_PRIVATE_KEY.replace(/\\n/g,'\n'))\
+#     .export({type:'spki',format:'pem'}).toString())"
+#
+# Empty is valid: an installation with no anchor cannot verify a bundle and says so, rather than
+# accepting one signed by any key.
+MORI_POLICY_PUBLIC_KEY=
+MORI_POLICY_KEY_ID={POLICY_KEY_ID}
 MORI_API_KEY=kv://mori-controller-api-keyKeyVault
+# Ask Mori for a container-registry credential when the installation was given none.
+# Off by default: the call has a 30s timeout inside credential resolution, so enabling it on an
+# installation whose Mori cannot issue would stall every deployment that reaches that point.
+# Declared here because it was previously read from process.env and set nowhere, so there was no
+# supported way to turn the path on — an installation that pulls vendor images through a
+# Mori-issued token had to have an app setting added by hand. Cross-tenant managed identity
+# cannot grant registry access, so this is the only mechanism that works for a customer
+# installation pulling from the vendor registry.
+MORI_REGISTRY_CREDENTIALS=false
 
 # =============================================================================
 # LOGGING CONFIGURATION
@@ -403,9 +451,6 @@ APPLICATIONINSIGHTS_CONNECTION_STRING=kv://appinsights-connectionStringKeyVault
 # OpenTelemetry service name (optional, defaults to miso-controller)
 OTEL_SERVICE_NAME=miso-controller
 
-# OpenTelemetry service version (optional, defaults to npm_package_version or 1.0.0)
-OTEL_SERVICE_VERSION=
-
 # =============================================================================
 # STORAGE CONFIGURATION
 # =============================================================================

package/templates/applications/miso-controller/rbac.yaml

@@ -176,6 +176,23 @@ permissions:
     roles: ['aifabrix-platform-admin', 'aifabrix-deployment-admin']
     description: 'Remove applications from environments'
 
+  # External-system catalog (aligned with src/examples/permissions.csv)
+  - name: 'external-system:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-security-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-compliance-admin',
+        'aifabrix-developer',
+        'aifabrix-observer'
+      ]
+    description: 'Read external systems'
+
+  - name: 'external-systems:domain-manager'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Manage external-system catalog promotion and role-derived dimension governance'
+
   # Pipeline & Deployment
   - name: 'applications:deploy'
     roles: ['aifabrix-platform-admin', 'aifabrix-deployment-admin', 'aifabrix-developer']

package/templates/external-system/external-datasource.yaml.hbs

@@ -122,7 +122,13 @@ openapi:
 # documentStorage:
 #   enabled: true
 #   binaryOperationRef: get
-#   embeddingField: content
+#   responseType: binary
+#   ingestAfterSync: true
+# Keyed retrieval (no list): for a vendor PDF, image or octet-stream response,
+# keep only get in capabilities and end its CIP steps with output.mode: documents.
+# Fetch: { source: openapi, openapiRef: get, responseType: binary }
+# Map response metadata from raw.headers.FileName and raw.params.DocumentId.
+# The wizard and repair infer this shape from the vendor OpenAPI response media type.
 {{/if}}
 {{#if (eq schemaEntityType "vectorStore")}}
 # vectorStore: vector index settings (model id, dimensions, etc. per schema). Uncomment and set to match your embedding deployment.

package/templates/marketplace/createUiDefinition.json

@@ -5,19 +5,44 @@
   "parameters": {
     "config": {
       "basics": {
-        "description": "Choose subscription, resource group, and region above. Under **Application resources Resource group name**, enter your install id (for example `aifabrixpoc02`). That managed resource group name is the naming prefix: resources become `{rg}-miso-asp`, `{rg}-miso-miso`, and so on. Set the Azure **Application name** to the same id when the portal asks. Enter the initial platform administrator password and choose the license below. Container images are pulled with the web apps' managed identities; no registry credential is needed."
+        "description": "Choose subscription, resource group, and region above. Under **Application resources Resource group name**, enter your install id (for example `aifabrixpoc02`), using at most 16 lowercase characters. That managed resource group name is the naming prefix: resources become `{rg}-miso-asp`, `{rg}-miso-miso`, and so on. Set the Azure **Application name** to the same id when the portal asks. Enter the initial platform administrator password and choose the license below. Container images are pulled with the web apps' managed identities; no registry credential is needed.",
+        "resourceGroup": {
+          "constraints": {
+            "validations": [
+              {
+                "regex": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$",
+                "message": "Use lowercase letters, digits and single hyphens, starting with a letter. The name becomes the prefix for every resource, and the Key Vault created as {name}-miso-kv must start with a letter and cannot contain consecutive or trailing hyphens."
+              },
+              {
+                "regex": "^.{1,16}$",
+                "message": "Use at most 16 characters. The name becomes the prefix for every resource: the Key Vault is created as {name}-miso-kv, and Azure limits a Key Vault name to 24 characters."
+              }
+            ]
+          }
+        }
       }
     },
     "basics": [
+      {
+        "name": "adminEmail",
+        "type": "Microsoft.Common.TextBox",
+        "label": "Administrator email",
+        "toolTip": "Email for the initial platform administrator and installation welcome.",
+        "constraints": {
+          "required": true,
+          "regex": "^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$",
+          "validationMessage": "Enter a valid email address."
+        }
+      },
       {
         "name": "adminPassword",
         "type": "Microsoft.Common.PasswordBox",
         "label": "Administrator password",
-        "toolTip": "Password for the initial AI Fabrix platform administrator (user admin). PostgreSQL, Keycloak, and encryption secrets are generated automatically and stored in Key Vault — do not reuse this password for infrastructure.",
+        "toolTip": "Password for the initial AI Fabrix platform administrator (user admin). PostgreSQL, Keycloak, and encryption secrets are generated automatically and stored in Key Vault \u2014 do not reuse this password for infrastructure.",
         "constraints": {
           "required": true,
           "regex": "^.{8,128}$",
-          "validationMessage": "Password must be 8–128 characters."
+          "validationMessage": "Password must be 8\u2013128 characters."
         },
         "options": {
           "hideConfirmation": false
@@ -63,6 +88,27 @@
           "regex": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
           "validationMessage": "Enter the Marketplace subscription ID as a GUID (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)."
         }
+      },
+      {
+        "name": "installationResourceModel",
+        "type": "Microsoft.Common.DropDown",
+        "label": "Initial infrastructure",
+        "toolTip": "Choose Shared for Community or Standard. Choose Dedicated DEV for Enterprise. This provisions infrastructure before licence issuance; it does not grant licence entitlements.",
+        "defaultValue": "Shared (Community / Standard)",
+        "constraints": {
+          "required": "[equals(basics('licenseChoice'), 'SUBSCRIPTION_ID')]",
+          "allowedValues": [
+            {
+              "label": "Shared (Community / Standard)",
+              "value": "shared"
+            },
+            {
+              "label": "Dedicated DEV (Enterprise)",
+              "value": "dedicated"
+            }
+          ]
+        },
+        "visible": "[equals(basics('licenseChoice'), 'SUBSCRIPTION_ID')]"
       }
     ],
     "steps": [],
@@ -71,7 +117,9 @@
       "deploymentEnvironment": "evaluation",
       "adminPassword": "[basics('adminPassword')]",
       "licenseEdition": "[if(equals(basics('licenseChoice'), 'SUBSCRIPTION_ID'), basics('licenseSubscriptionKey'), basics('licenseChoice'))]",
-      "acrResourceId": "__MARKETPLACE_ACR_RESOURCE_ID__"
+      "acrResourceId": "__MARKETPLACE_ACR_RESOURCE_ID__",
+      "installationResourceModel": "[if(equals(basics('licenseChoice'), 'SUBSCRIPTION_ID'), basics('installationResourceModel'), if(equals(basics('licenseChoice'), 'ENTERPRISE'), 'dedicated', 'shared'))]",
+      "adminEmail": "[basics('adminEmail')]"
     }
   }
 }