@aifabrix/builder 2.61.2 → 2.62.0

package/lib/utils/token-manager.js

@@ -10,7 +10,6 @@
  */
 
 const config = require('../core/config');
-const logger = require('./logger');
 const { maskSensitiveData } = require('./log-redaction');
 const {
   refreshClientToken,
@@ -205,12 +204,17 @@ async function tryClientTokenAuth(environment, appName, controllerUrl) {
   return null;
 }
 
-function throwNoDeploymentAuth(credentialApp) {
-  const err = new Error(
-    `No authentication method available. For CI: set AIFABRIX_DEPLOYMENT_AUTH=client-credentials and MISO_CLIENTID/MISO_CLIENTSECRET in .env or '${credentialApp}-client-idKeyVault' in secrets.local.yaml. For interactive use: aifabrix login`
-  );
+// Two causes reach here: no credentials at all, or credentials the controller rejected.
+// Saying "put it in secrets.local.yaml" for the second sends the reader after a key that is
+// already present and simply not valid, so name the rejection instead.
+function throwNoDeploymentAuth(credentialApp, exchangeError) {
+  const err = new Error(exchangeError
+    ? `Client credentials for '${credentialApp}' were rejected by the controller: ${exchangeError.message}. ` +
+      `Re-issue them with: aifabrix login && aifabrix app rotate-secret ${credentialApp}`
+    : `No authentication method available. For CI: set AIFABRIX_DEPLOYMENT_AUTH=client-credentials and MISO_CLIENTID/MISO_CLIENTSECRET in .env or '${credentialApp}-client-idKeyVault' in secrets.local.yaml. For interactive use: aifabrix login`);
   err.statusCode = 401;
   err.authFailure = true;
+  if (exchangeError) err.cause = exchangeError;
   throw err;
 }
 
@@ -262,8 +266,10 @@ async function getDeploymentAuth(controllerUrl, environment, appName, options =
           controller: controllerUrl
         };
       }
-    } catch {
-      // Refresh failed; fall through to throw below
+    } catch (err) {
+      // Keep it: credentials existed and the controller turned them down, which is a
+      // different problem from having none, and the only place that fact is observable.
+      throwNoDeploymentAuth(credentialApp, err);
     }
   }
 
@@ -341,7 +347,7 @@ async function forceRefreshDeviceToken(controllerUrl) {
 
   // Must have refresh token to force refresh
   if (!tokenInfo.refreshToken) {
-    logger.warn('Cannot refresh: no refresh token available. Please login again using: aifabrix login');
+    warnRefreshFailureOnce(controllerUrl, 'Cannot refresh: no refresh token available. Please login again using: aifabrix login');
     return null;
   }
 

package/lib/utils/url-public-path-prefix.js

@@ -1,18 +1,20 @@
 /**
- * Plan 117 URL path prefix for url://public (dev/tst only when gated).
+ * Plan 117 URL path prefix for url://public (scoped environments only when gated).
  *
- * @fileoverview baseEffective ∧ derived envKey ∈ {dev,tst}. Caller must pass prefix only when `traefik` is on (see url-declarative-resolve).
+ * @fileoverview baseEffective ∧ derived envKey ∈ SCOPED_RUN_ENVIRONMENTS. Caller must pass prefix only when `traefik` is on (see url-declarative-resolve).
  * @author AI Fabrix Team
  * @version 1.0.0
  */
 
 'use strict';
 
+const { isScopedRunEnvironmentKey } = require('./environment-scoped-resources');
+
 /**
  * @param {boolean} useEnvironmentScopedResources - config gate
  * @param {boolean} appEnvironmentScopedResources - application.yaml
  * @param {string} derivedEnvKey - from client id (dev|tst|pro|miso)
- * @returns {string} '' | '/dev' | '/tst'
+ * @returns {string} '' | '/dev' | '/tst' | '/pro'
  */
 function computePublicUrlPathPrefix(useEnvironmentScopedResources, appEnvironmentScopedResources, derivedEnvKey) {
   const baseEffective = Boolean(useEnvironmentScopedResources) && Boolean(appEnvironmentScopedResources);
@@ -20,13 +22,7 @@ function computePublicUrlPathPrefix(useEnvironmentScopedResources, appEnvironmen
     return '';
   }
   const k = String(derivedEnvKey || '').toLowerCase();
-  if (k === 'dev') {
-    return '/dev';
-  }
-  if (k === 'tst') {
-    return '/tst';
-  }
-  return '';
+  return isScopedRunEnvironmentKey(k) ? `/${k}` : '';
 }
 
 module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.61.2",
+  "version": "2.62.0",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {
@@ -35,11 +35,12 @@
     "lint:fix": "eslint . --ext .js --fix",
     "test": "node tests/scripts/test-wrapper.js",
     "build": "npm run lint && npm run test",
-    "build:ci": "npm run lint && npm run check:schema-sync && npm run check:flags && npm run check:cli-help && npm run test:ci",
+    "build:ci": "npm run lint && npm run check:schema-sync && npm run check:flags && npm run check:cli-help && npm run check:mirrored-templates && npm run test:ci",
     "test:ci": "bash tests/scripts/ci-simulate.sh",
     "check:schema-sync": "node scripts/check-datasource-test-run-schema-sync.js",
     "check:flags": "jest tests/lib/schema/flag-map-validation-run.test.js --runInBand --config jest.config.default.js",
     "check:cli-help": "node scripts/check-cli-help-examples.js",
+    "check:mirrored-templates": "node scripts/check-mirrored-templates.js",
     "test:manual": "jest --config jest.config.manual.js --runInBand",
     "test:integration": "jest --config jest.config.integration.js --runInBand",
     "test:integration:fixtures": "jest --config jest.config.integration.fixtures.js --runInBand",

package/templates/applications/builder-api/application.yaml

@@ -5,7 +5,7 @@ app:
   description: 'Business Transformation services — HTTP orchestration for connected-system workspace lifecycle via Dataplane Enterprise MCP and governance APIs.'
   type: webapp
   language: typescript
-  version: 2.61.2
+  version: 2.62.0
 
 # Image Configuration
 image:

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.79
+  version: 2.0.82
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).
@@ -26,7 +26,7 @@ frontDoorRouting:
   pattern: /data/*
   enabled: true
   # Docker url://internal full URLs: http://dataplane:PORT only (ingress /data is not on in-container routes).
-  internalDockerUseOriginOnly: false
+  internalDockerUseOriginOnly: true
   host: ${DEV_USERNAME}.${REMOTE_HOST}
   tls: ${TLS_ENABLED}
   # Origin RFC 9728 PRM (outside /data PathPrefix) — Builder Traefik pass-through (plan 171.0).

package/templates/applications/dataplane/env.template

@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.79
+VERSION=2.0.82
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5

package/templates/applications/integration-server/application.yaml

@@ -0,0 +1,91 @@
+# AI Fabrix Builder app config — INTEGRATOR server type.
+#
+# Same code as builder/builder-server/, different installation. One source tree, two
+# manifests: the Dockerfile's `integrator` target and this folder's env.template are the
+# only things that differ, so there is no forked codebase to keep in step.
+#
+# Enterprise is the existing full development box with Docker. Integrator is a single
+# container giving developers SSH-only access, with no Docker execution inside it.
+
+app:
+  key: integration-server
+  displayName: AI Fabrix Integration Server
+  description: AI Fabrix Integration Server onboards developers over SSH into one container. It creates their Linux accounts and authorized keys, and gives them SSH-only access without Docker inside that container.
+  type: webapp
+  version: 2.0.10
+image:
+  name: aifabrix/integration-server
+  tag: latest
+  registry: aifabrixacr.azurecr.io
+  registryMode: external
+# Base 3006 keeps it clear of builder-server (3002), dataplane (3001), mori-controller
+# (3004) and builder-api (3005), so both server types can run on one dev host.
+# Builder derives the host port as `port` + developerId * 100 (dev01 -> 3106).
+port: 3006
+webSocketsEnabled: true
+# This container administers its own operating system: it creates the developers'
+# Linux accounts, writes /etc/ssh/authorized_keys.d and runs sshd. Builder otherwise
+# runs containers as the invoking host user, which cannot do any of that.
+runAsRoot: true
+# Developers reach this installation over SSH, so that port has to be published as well
+# as the HTTP one. The base keeps SSH's well-known number and the published port follows
+# the same formula as the main port — 22 + developerId * 100 — so dev01 gets 122 and two
+# developers on one host cannot collide. Bootstrap advertises it via SSH_PUBLIC_PORT.
+additionalPorts:
+  - name: ssh
+    containerPort: 22
+    hostPort: 22
+requires:
+  database: false
+  redis: false
+  storage: true
+build:
+  language: typescript
+  context: ../..
+  dockerfile: builder/builder-server/Dockerfile
+  # Selects the Dockerfile's integrator stage. Without it Docker builds the last stage,
+  # which is enterprise — the same image under a different name. This is the one build
+  # difference between the two installations.
+  target: integrator
+  # No envOutputPath: this installation only runs in Docker, and Builder treats the
+  # value as a directory — pointing it at a file name creates a folder of that name.
+  #
+  # Reload runs the real entrypoint, not a bare watcher. The generated compose bind-mounts
+  # the repository over /app and clears the image ENTRYPOINT, which for this installation
+  # meant no sshd, no account-ops worker, and the API running as root — so nothing about
+  # SSH, provisioning or privilege separation worked in the mode developers actually use,
+  # and a queued account was never created. The entrypoint finds the build itself —
+  # /app/dist in the image, /app/builder-server/dist under the bind mount — because the
+  # compose template HTML-escapes `=`, so a VAR=value prefix never survives as an
+  # assignment.
+  #
+  # The API therefore starts from the host's build, so a code change is
+  # `npm run build --prefix builder-server` and a restart, not an in-container watch. That
+  # is deliberate: the watcher ran as root and left root-owned dist/ behind, which then
+  # broke the next `pnpm check` on the host.
+  reloadStart: exec /docker-entrypoint-integrator.sh
+# Ingress. A distinct prefix from builder-server's /server/*, which is not cosmetic: the
+# two installation types are alternatives in production, but a development host runs both,
+# and two applications declaring the same host and prefix collide. Traefik then routes the
+# prefix to whichever container was created last, so integrator-only routes answer 404
+# from the enterprise container — a failure that looks like a bug in the route rather than
+# a collision in the manifests.
+#
+# The pattern is a PathPrefix, not an allowlist: it forwards every path beneath it, so the
+# application refuses anything else that arrives through the front door. Filtering at the
+# ingress is still required and is tracked as open in 029 V4.
+frontDoorRouting:
+  pattern: /integrator/*
+  enabled: true
+  host: ${DEV_USERNAME}.${REMOTE_HOST}
+  tls: ${TLS_ENABLED}
+  internalDockerUseOriginOnly: true
+repository:
+  enabled: false
+  repositoryUrl: ''
+deployment:
+  controllerUrl: ''
+  environment: dev
+healthCheck:
+  path: /health
+  interval: 30

package/templates/applications/integration-server/env.template

@@ -0,0 +1,215 @@
+# Integration Server — INTEGRATOR installation
+# =============================================================================
+# A single managed container giving developers SSH-only access, with no Docker
+# execution inside it. Identity and configuration are pushed in by Miso; secrets
+# come from the secret store, not from this container's filesystem.
+#
+# The enterprise installation is a different manifest with its own template —
+# builder/builder-server/env.template. Same code, different deployment; each
+# template lists only the variables its own installation reads.
+#
+# Conventions (as used across AI Fabrix apps):
+#   kv://name    secret resolved from the secret store — never a literal here
+#   url://name   URL derived by Builder from the manifest
+#   ${VAR}       value supplied per environment
+
+# =============================================================================
+# CORE
+# =============================================================================
+
+# HTTP listen port (main.ts). Default: 3006
+PORT=3006
+
+# SQLite DB, audit log and managed state.
+#
+# A subdirectory of the mount, not its root: this is a separate installation with its
+# own database, users and identity model. On a dev host running both side by side the
+# bind mount is shared, and pointing both at the root would have each read the other's
+# database — which fails closed, because the recorded server type would not match.
+DATA_DIR=/mnt/data/integrator
+
+# Installation type (config/server-type.ts), resolved once at startup and then
+# persisted in builder.db. This installation IS an integrator, so it is set
+# explicitly: unset would mean enterprise. A populated installation cannot switch
+# type on a restart — that needs a migration.
+BUILDER_SERVER_TYPE=integrator
+
+# Set false or 0 to disable DATA_DIR/audit.log (audit.service.ts). Default: true
+# AUDIT_LOG_ENABLED=true
+
+# =============================================================================
+# SECRETS
+# =============================================================================
+
+# AES-GCM key for the secrets API, as a value from the secret store — this
+# installation has no host filesystem to mount a key file from.
+# 64 hex characters or 32 bytes.
+#
+# Generate a NEW key when installing this server. Never point this at the platform's
+# own key — Miso's, or the enterprise Builder Server's ENCRYPTION_KEY_PATH file.
+# Installing a customer's integrator with the platform key would let every developer
+# with a shell in that container decrypt every other installation's secrets, because
+# the same key is handed to each of them in their config.yaml. One installation, one
+# key: the blast radius of a leaked key is then that installation and nothing else.
+#
+#   openssl rand -hex 32
+#
+# The name follows the catalog's own `{appKey}-secrets-encryptionKeyVault` convention,
+# so it is this application's app-scoped secret and nothing else's. The earlier name said
+# `builder-server`: that is another application's key, and reading it from here would be
+# a cross-application read that only works by being deliberately shared — which is the
+# hole this avoids. Register it at install:
+#
+#   aifabrix secret set integration-server-secrets-encryptionKeyVault "$(openssl rand -hex 32)"
+#
+# The same key is written into every managed developer's config.yaml as
+# `secrets-encryption`, so the CLI can decrypt what this server encrypted. Those two
+# are one value from one source by construction — see account-ops-worker.ts, which
+# resolves it from this variable at the moment it writes the file. Rotating it means
+# re-running configuration sync so the homes are rewritten; values already stored in
+# the secrets table are encrypted with the old key and do not survive a rotation.
+ENCRYPTION_KEY=kv://integration-server-secrets-encryptionKeyVault
+
+# =============================================================================
+# MISO
+# =============================================================================
+# Where identity and configuration come from. Builder Server knows Miso only: it
+# never configures or verifies the identity provider — miso-client owns that.
+# /health carries a `miso` check on this installation, and fails without these.
+
+# Server-to-controller API calls on the environment network.
+MISO_CONTROLLER_URL=url://miso-controller-internal
+
+# Application client credentials, used to obtain an application token and to verify
+# the client tokens on POST /api/integrations/miso/*.
+MISO_CLIENTID=kv://integration-server-client-idKeyVault
+MISO_CLIENTSECRET=kv://integration-server-client-secretKeyVault
+
+# Reachable addresses reported to Miso after the HTTP listener starts. Miso uses the
+# internal address for user/configuration delivery and exposes the public address in
+# application status. Keep these derived from the manifest, like Dataplane's status
+# registration; a typed hostname or port drifts in local developer environments.
+INTEGRATION_SERVER_WEB_SERVER_URL=url://public
+INTEGRATION_SERVER_INTERNAL_URL=url://internal
+
+# The `environment` value written into each developer's ~/.aifabrix/config.yaml.
+# `controller` and `codingPlatform` are pushed by Miso; this one is the
+# installation's own deployment configuration and is never taken from the request.
+MANAGED_CONFIG_ENVIRONMENT=dev
+MISO_ENVIRONMENT=dev
+
+# =============================================================================
+# DEVELOPER ACCESS — SSH
+# =============================================================================
+
+# SSH endpoint returned to enrolling developers by POST /api/bootstrap/ssh.
+#
+# This is what the client is told to connect to, so it must be the address that is
+# actually reachable, not the container's own view. Both are derived rather than typed:
+# the host from the front door, and the port from the `ssh` entry in the manifest's
+# `additionalPorts` (Builder publishes it as SSH_PUBLIC_PORT = hostPort + developerId *
+# 100). Typing either by hand drifts from the manifest and advertises an endpoint
+# nothing is listening on.
+INTEGRATOR_SSH_HOST=url://public
+INTEGRATOR_SSH_PORT=${SSH_PUBLIC_PORT}
+
+# Where sshd reads each developer's authorized keys from.
+#
+# State, not configuration: it records which key each developer enrolled. Kept in the
+# image it was destroyed by every redeploy, and although reconciliation rebuilds it from
+# the database at startup, a developer reconnecting before that finishes is refused.
+# On the volume the file is already correct when sshd starts.
+#
+# Root-owned, inside a directory developers cannot write to.
+# Default: ${DATA_DIR}/authorized_keys.d
+# AUTHORIZED_KEYS_DIR=/mnt/data/integrator/authorized_keys.d
+
+# Root of the managed developer home directories.
+#
+# Must be on the persistent volume. A managed home is not scratch space: it holds the
+# developer's cloned repositories and build trees, the credentials their agent uses, the
+# managed config.yaml and the client certificate this server issued. An agent run takes
+# hours and outlives any single connection, so the work has to survive a redeploy.
+#
+# Inside the image it did not. Every redeploy destroyed the homes, which silently revoked
+# access as well as losing the work: the Linux accounts and their authorized_keys went
+# with them, while the projection in builder.db still said the developer was entitled.
+#
+# The entrypoint creates this root 755 and grants traverse on the path leading to it;
+# each developer's own home inside is 700 and owned by them.
+# Default: ${DATA_DIR}/home
+# DEVELOPER_HOME_ROOT=/mnt/data/integrator/home
+
+# Restores keys even though the projection has gone backwards.
+#
+# This installation records the highest Miso revision it has ever seen, outside the
+# database, so restoring builder.db from before a revocation is detectable: the mark is
+# higher than anything the projection now holds. When that happens the installation fails
+# closed — every developer is reconciled to no keys until Miso re-synchronises a revision
+# at least as high as the one already seen. Homes are retained and the server still boots,
+# so it can be repaired.
+#
+# A database rebuilt deliberately looks identical to one restored from before a
+# revocation, so this is the way past it. Set it only when you know the rebuild was
+# intended; it is logged when used. Only the exact value `true` is accepted.
+# ONBOARDING_ALLOW_BACKWARDS_PROJECTION=true
+
+# =============================================================================
+# CLIENT DOWNLOAD
+# =============================================================================
+# What GET /client/<target>.zip writes into the aifabrix.json beside the executable.
+#
+# The executable itself is identical for every installation — SmartScreen builds
+# reputation against a file hash, so a per-customer binary would never accumulate any.
+# The customer scope travels in this small file instead.
+
+# Platform origin the client posts its SSH key to. Only the origin is used; the client
+# appends its own path, so a value carrying /server would double it.
+CLIENT_PLATFORM_URL=url://public
+
+# Controller the client signs in against, as a browser reaches it.
+CLIENT_CONTROLLER_URL=url://miso-controller-public
+
+# Shown while onboarding, e.g. "Acme Corp". Optional.
+# CLIENT_DISPLAY_NAME=
+
+# How this installation is reached: `ssh` or `wss`. Exactly one is served.
+#
+#   ssh  Developers reach sshd over a private network overlay, which is the only route to
+#        the port — this installation must not publish 22 publicly. Deactivating a person
+#        in the overlay removes their route, and that is what ends access, including for
+#        sessions already open. The tunnel endpoint does not exist.
+#
+#   wss  There is no overlay: the session travels inside a WebSocket on the published
+#        HTTPS port, and sshd listens on loopback only, so the tunnel is the only way in.
+#        This server does the authorizing — a short-lived token at the open, refreshed
+#        over the tunnel while the developer works, and dropped on idle or revocation.
+#
+# Not both. Publishing 22 alongside the tunnel would make the overlay stop being a
+# control, and running both against one sshd means "does this person still have access?"
+# depends on which door they used — with the door that fails open deciding.
+#
+# Stated by the server because the server knows how it is published; the client reads it
+# from aifabrix.json and never has to guess. Guessing wrong fails as a timeout, which is
+# the least diagnosable failure there is.
+CLIENT_TRANSPORT=wss
+
+# =============================================================================
+# FRONT DOOR
+# =============================================================================
+# The application is published whole at its virtual directory, the same way
+# miso-controller serves /miso and dataplane serves /data. What is reachable from
+# outside is decided by `frontDoorRouting` in application.yaml and by the ingress.
+
+# Injected by Builder from `frontDoorRouting.pattern` in application.yaml; listed
+# because the app reads it. Routes are served unprefixed — the ingress strips the
+# prefix before the request arrives — so this only builds URLs handed to clients.
+# BASE_PATH=/integrator
+# X_FORWARDED_PREFIX=/integrator
+
+# =============================================================================
+# TESTING
+# =============================================================================
+
+# Enables POST /api/dev/e2e-reset. Never set in production.
+# E2E_RESET_SECRET=

package/templates/applications/mirrored-templates.json

@@ -0,0 +1,52 @@
+{
+  "mirrors": [
+    {
+      "path": "templates/applications/miso-controller/env.template",
+      "master": {
+        "repo": "aifabrix-miso",
+        "path": "builder/miso-controller/env.template"
+      },
+      "sha256": "9b74b94d5d6e7457d22cfe213f2ec9c3dceb75c540df3953aba3b51c35df05c7"
+    },
+    {
+      "path": "templates/applications/builder-api/env.template",
+      "master": {
+        "repo": "aifabrix-miso",
+        "path": "builder/builder-api/env.template"
+      },
+      "sha256": "1a6b013aa0a34b72c5a0be3dd714bd718a8adb981bcbb9de3d5370e2dd33786c"
+    },
+    {
+      "path": "templates/applications/keycloak/env.template",
+      "master": {
+        "repo": "aifabrix-miso",
+        "path": "builder/keycloak/env.template"
+      },
+      "sha256": "72de7dc5345b842bc20566f8d5105b6541e8185dff157e9af2d37db9590b01fb"
+    },
+    {
+      "path": "templates/applications/dataplane/env.template",
+      "master": {
+        "repo": "aifabrix-dataplane",
+        "path": "builder/dataplane/env.template"
+      },
+      "sha256": "d35eda839464a65ebd018064ea7c2d292654891b41d1f56862b052720a78a3cc"
+    },
+    {
+      "path": "templates/applications/integration-server/env.template",
+      "master": {
+        "repo": "aifabrix-setup",
+        "path": "builder/integration-server/env.template"
+      },
+      "sha256": "a80584bcf6880937c43557a71ca1c423104ab4e15badf4bb14a0a9a9dcaa01d6"
+    },
+    {
+      "path": "templates/applications/integration-server/application.yaml",
+      "master": {
+        "repo": "aifabrix-setup",
+        "path": "builder/integration-server/application.yaml"
+      },
+      "sha256": "04cbfdb9a012393a5e97a1dda1b8f304e97c9532339f045e5912cd250a26a179"
+    }
+  ]
+}

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.89'
+  version: '2.0.91'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
@@ -92,6 +92,8 @@ platforms:
     configuration:
       - name: LOCATION
         value: 'swedencentral'
+      - name: CLOUD_VENDOR
+        value: 'azure'
       - name: MORI_BASE_URL
         value: 'https://platform.aifabrix.dev/mori'
 
@@ -133,6 +135,42 @@ platforms:
         value: 'swedencentral'
       - name: MORI_BASE_URL
         value: 'url://mori-controller-internal'
+      # Declared, because the fallback infers it and infers it wrongly here:
+      # `resolveCloudVendor` returns 'azure' whenever AZURE_SUBSCRIPTION_ID is set, and every
+      # developer box has it from the shared development service principal. A local stack was
+      # therefore treated as an Azure installation, `verifyInstallationBinding` took
+      # `verifyAzureBinding`, and that demands a directory tenant AND a resource group. A
+      # developer box has no resource group, so the binding refused with
+      # "Azure licence binding requires the tenant ID and resource group." The licence guard
+      # turns that into HTTP 403 on every guarded operation — including
+      # `app rotate-secret`, which is the one command that recovers a re-minted credential.
+      #
+      # Measured on dev01 2026-10-04: the dataplane could not start (its client secret had been
+      # re-minted, plan 264.0) and the recovery command was itself refused. The two defects
+      # compose into a dead end that no developer can get out of.
+      - name: CLOUD_VENDOR
+        value: 'docker'
+      # The one installation name the licence binds to (plan 266.0). Sent to Mori as
+      # `resourceGroupName`; docker requires exactly `local-dev{NN}` or registration refuses.
+      # Only on this entry — the Azure platforms below must not be `local-*` and keep SERVICE_NAME.
+      - name: MISO_INSTALLATION_NAME
+        value: 'local-${DEV_USERNAME}'
+      # Plan 262.0: a local stack onboards as SaaS, so the full activation cycle is reachable here.
+      #
+      # `requiresTenantActivationWizard()` is `isAzureDeployment() || isAzureMockDeployment() ||
+      # isSaasDirectOnboarding()`. With `customerOwned` all three are false on a dev box, so the
+      # wizard never ran — and the wizard is what collects the customer directory tenant and
+      # records consent. Without it the tenant is only ever read from the environment, which is the
+      # in-tenant assumption and wrong for SaaS.
+      #
+      # This is the ONBOARDING axis, deliberately not the DEPLOYMENT axis. `DEPLOYMENT` stays
+      # `database` (DB-only; no Docker, no Azure), which `isLocalOnboardingDeployment()` already
+      # treats as local. `DEPLOYMENT=local` means Miso orchestrating Docker itself, which is not
+      # ready and is not what a dev box runs — keying this on it would never fire.
+      #
+      # Only on this entry: the Azure platforms below stay `customerOwned`.
+      - name: ONBOARDING_MODE
+        value: 'saasDirect'
 
   - resource: aifabrix-int-{platform}
     name: aifabrix
@@ -140,6 +178,8 @@ platforms:
     configuration:
       - name: LOCATION
         value: 'swedencentral'
+      - name: CLOUD_VENDOR
+        value: 'azure'
       # Mori the installation talks to. Previously `kv://mori-controller-web-server-url`, which
       # resolved to whatever the *application record* held — on aifabrix-ce-16 that was
       # `http://localhost:3004`, because an Azure deployment never overwrites a stale URL, so every
@@ -154,6 +194,8 @@ platforms:
     configuration:
       - name: LOCATION
         value: 'swedencentral'
+      - name: CLOUD_VENDOR
+        value: 'azure'
       # The App Service hostname, not the Front Door one, because only this is derivable.
       #
       # The Front Door endpoint carries an Azure-generated suffix (`fzahchbachcfbgaj`) that no