@aifabrix/builder 2.61.2 → 2.63.0

package/lib/utils/secrets-kv-scope.js

@@ -1,6 +1,21 @@
 /**
  * Env-scoped kv:// resolution helpers (prefixed keys + in-memory aliases).
  *
+ * Two regimes share this module:
+ *
+ * - `dev` and `miso` are **lenient** (plan 117). A `<env>-<key>` secret wins when present,
+ *   and an absent one falls back to the unprefixed key. Existing installations are written
+ *   that way, so removing the fallback would break every one of them.
+ * - `tst` and `pro` are **strict** (plan 210.0). Only `<env>-<key>` is read. An absent key
+ *   is absent — it never falls back to the unprefixed value and it is never generated.
+ *
+ * The strict rule is the whole point: these environments share one Postgres, one Redis and
+ * one secrets file with `dev`. A fallback there would hand production whatever `dev` happens
+ * to hold, which is worse than failing, because it looks like it worked. Strictness is
+ * therefore deliberately independent of `useEnvironmentScopedResources` and of the
+ * per-application `environmentScopedResources` flag: an installation that forgot to set
+ * either must not silently resolve `pro` against `dev`'s secrets.
+ *
  * @fileoverview Split from secrets-helpers for file size limits
  * @author AI Fabrix Team
  * @version 1.0.0
@@ -8,6 +23,25 @@
 
 'use strict';
 
+/**
+ * Environments where the `<env>-` prefix is mandatory rather than preferred.
+ *
+ * Not the same list as `physical-database-naming.PHYSICAL_NAME_ENVIRONMENTS`: that one is the
+ * Postgres naming vocabulary and includes `miso` and `dev`, which resolve leniently here.
+ */
+const STRICT_SCOPED_ENVIRONMENTS = Object.freeze(['tst', 'pro']);
+
+/**
+ * @param {string} envKey - Run environment key
+ * @returns {boolean} True when the prefix is mandatory for this environment
+ */
+function isStrictScopedEnvironment(envKey) {
+  if (!envKey || typeof envKey !== 'string') {
+    return false;
+  }
+  return STRICT_SCOPED_ENVIRONMENTS.includes(envKey.trim().toLowerCase());
+}
+
 /**
  * Treat undefined/null and whitespace-only strings as no value so prefixed slots
  * cannot shadow unprefixed secrets with empty placeholders (plan 117 scoped KV).
@@ -25,9 +59,80 @@ function isKvSlotEmpty(v) {
   return false;
 }
 
+/**
+ * The secret key a strict environment actually requires.
+ *
+ * **Not simply `<env>-<key>`.** Miso's naming rule has three cases, and only the middle one
+ * is a bare environment prefix:
+ *
+ * ```text
+ * system              <key>            unprefixed, deliberately
+ * environment-scoped  pro-<key>
+ * application-scoped  pro-<app>-<key>
+ * ```
+ *
+ * They are not distinguishable from the key alone, so the name comes from the catalog entry's
+ * own vault-name pattern rather than being built here. A database password is therefore
+ * `pro-dataplane-databases-0-passwordKeyVault` — the application segment before the key — and
+ * `keycloak-*` and `acr-*` keep the names the Marketplace template writes.
+ *
+ * @param {string} envKey - Run environment key
+ * @param {string} pathStr - Unprefixed kv path
+ * @returns {string}
+ */
+function strictScopedKeyName(envKey, pathStr) {
+  const { resolveStrictSecretName } = require('../parameters/physical-secret-name');
+  return resolveStrictSecretName(pathStr, String(envKey).toLowerCase());
+}
+
+/**
+ * Alias every unprefixed key to its `<env>-` name so a lenient lookup finds it.
+ *
+ * Never called for a strict environment: aliasing there would reintroduce the fallback
+ * this module exists to remove.
+ *
+ * @param {Object} secrets
+ * @param {string} envKey
+ * @returns {Object}
+ */
+function mergeSecretsWithPrefixedCopies(secrets, envKey) {
+  if (!secrets || typeof secrets !== 'object' || !envKey) {
+    return secrets;
+  }
+  const prefix = `${String(envKey).toLowerCase()}-`;
+  const merged = { ...secrets };
+  for (const [k, v] of Object.entries(secrets)) {
+    if (typeof k !== 'string' || !k || k.startsWith(prefix)) continue;
+    const pk = prefix + k;
+    if (isKvSlotEmpty(merged[pk]) && !isKvSlotEmpty(v)) {
+      merged[pk] = v;
+    }
+  }
+  return merged;
+}
+
+/**
+ * Resolve the scoped-kv regime and the secrets map to read through.
+ *
+ * One helper so every caller applies the same rule; a caller that recomputed `effective`
+ * itself could leave a strict environment resolving leniently.
+ *
+ * @param {Object} secrets - Merged secrets map
+ * @param {{ effective?: boolean, envKey?: string }|null} scopedKv
+ * @returns {{ secretsMap: Object, envKey: string|undefined, effective: boolean, strict: boolean }}
+ */
+function prepareScopedKv(secrets, scopedKv) {
+  const envKey = scopedKv && scopedKv.envKey ? scopedKv.envKey : undefined;
+  const strict = isStrictScopedEnvironment(envKey);
+  const effective = strict || Boolean(scopedKv && scopedKv.effective && envKey);
+  const secretsMap =
+    effective && !strict ? mergeSecretsWithPrefixedCopies(secrets, envKey) : secrets;
+  return { secretsMap, envKey, effective, strict };
+}
+
 /**
  * @param {Function} getValueByPath - From secrets-helpers
- * @returns {{ getValueByPathWithEnvScope: Function, mergeSecretsWithPrefixedCopies: Function }}
+ * @returns {Object} Scoped kv helpers bound to that lookup
  */
 function createScopedKvHelpers(getValueByPath) {
   /**
@@ -38,40 +143,34 @@ function createScopedKvHelpers(getValueByPath) {
    * @returns {*}
    */
   function getValueByPathWithEnvScope(secrets, pathStr, envKey, effective) {
-    if (!effective || !envKey) {
+    const strict = isStrictScopedEnvironment(envKey);
+    if (!strict && (!effective || !envKey)) {
       return getValueByPath(secrets, pathStr);
     }
-    const prefix = `${String(envKey).toLowerCase()}-`;
-    const prefixedPath = prefix + pathStr;
-    const fromPrefixed = getValueByPath(secrets, prefixedPath);
+    const fromPrefixed = getValueByPath(secrets, strictScopedKeyName(envKey, pathStr));
+    if (strict) {
+      // No fallback. Undefined rather than the empty value so the caller's
+      // allowed-empty rule still decides whether absence is an error.
+      return isKvSlotEmpty(fromPrefixed) ? undefined : fromPrefixed;
+    }
     if (!isKvSlotEmpty(fromPrefixed)) {
       return fromPrefixed;
     }
     return getValueByPath(secrets, pathStr);
   }
 
-  /**
-   * @param {Object} secrets
-   * @param {string} envKey
-   * @returns {Object}
-   */
-  function mergeSecretsWithPrefixedCopies(secrets, envKey) {
-    if (!secrets || typeof secrets !== 'object' || !envKey) {
-      return secrets;
-    }
-    const prefix = `${String(envKey).toLowerCase()}-`;
-    const merged = { ...secrets };
-    for (const [k, v] of Object.entries(secrets)) {
-      if (typeof k !== 'string' || !k || k.startsWith(prefix)) continue;
-      const pk = prefix + k;
-      if (isKvSlotEmpty(merged[pk]) && !isKvSlotEmpty(v)) {
-        merged[pk] = v;
-      }
-    }
-    return merged;
-  }
-
-  return { getValueByPathWithEnvScope, mergeSecretsWithPrefixedCopies };
+  return {
+    getValueByPathWithEnvScope,
+    mergeSecretsWithPrefixedCopies,
+    prepareScopedKv
+  };
 }
 
-module.exports = { createScopedKvHelpers };
+module.exports = {
+  STRICT_SCOPED_ENVIRONMENTS,
+  isStrictScopedEnvironment,
+  strictScopedKeyName,
+  mergeSecretsWithPrefixedCopies,
+  prepareScopedKv,
+  createScopedKvHelpers
+};

package/lib/utils/secrets-materialize-local.js

@@ -17,6 +17,7 @@ const secretsUtils = require('./secrets-utils');
 const { loadConfiguredSharedSecretsStore } = require('./remote-secrets-loader');
 const { decryptSecretsObject } = require('../core/secrets-load');
 const { collectUniqueKvPathStrings } = require('./secrets-kv-refs');
+const { isStrictScopedEnvironment } = require('./secrets-kv-scope');
 const {
   resolveKvRefValue,
   mergeSecretsWithPrefixedCopies,
@@ -98,6 +99,14 @@ async function materializeResolvedKvSecretsToUserLocal(templateContent, mergedSe
     return [];
   }
 
+  // This writes back under the UNPREFIXED key. In a strict environment that would mint an
+  // unprefixed copy of a tst or pro secret which dev would then resolve, quietly undoing the
+  // isolation. Nothing is lost by skipping: a strict environment resolves only `<env>-<key>`,
+  // so every value it resolved was already stored under the name it will be read by.
+  if (isStrictScopedEnvironment(scopedKv && scopedKv.envKey)) {
+    return [];
+  }
+
   try {
     const { effective, secretsMap, localMap } = buildScopedMaps(mergedSecrets, scopedKv);
     const sharedScoped = await resolveSharedScopedMapForMaterialize(scopedKv, effective);

package/lib/utils/secrets-missing-error.js

@@ -10,6 +10,7 @@
 
 const { formatMissingSecretsFileInfo } = require('./secrets-helpers');
 const { isCommentOrEmptyLine } = require('./secrets-kv-refs');
+const { isStrictScopedEnvironment, strictScopedKeyName } = require('./secrets-kv-scope');
 
 /**
  * @param {string} kvRef - e.g. kv://hubspot-demo/clientSecret
@@ -117,6 +118,35 @@ function buildKvNamespaceAlternateHints(missing, secrets, appName) {
   return lines;
 }
 
+/**
+ * Name the key a strict environment actually needs.
+ *
+ * The template references `kv://<key>`, but `tst` and `pro` only read `<env>-<key>`, so an
+ * error quoting the template reference alone would send someone to create the one name that
+ * will not be used. Both are printed: the reference so the template line is findable, and
+ * the required key so `aifabrix secret set` gets the right argument.
+ *
+ * @param {string[]} missing - kv:// refs
+ * @param {{ envKey?: string }|null} [scopedKv]
+ * @returns {string[]}
+ */
+function buildStrictScopedKeyHints(missing, scopedKv) {
+  const envKey = scopedKv && scopedKv.envKey ? scopedKv.envKey : null;
+  if (!envKey || !isStrictScopedEnvironment(envKey)) {
+    return [];
+  }
+  const env = String(envKey).toLowerCase();
+  const lines = missing.map(
+    (ref) => `Required-key: ${strictScopedKeyName(env, kvRefToSecretSetKey(ref))}`
+  );
+  lines.push(
+    `Scoped-env-hint: ${env} reads only ${env}-prefixed secrets. The unprefixed key is ` +
+      `not a fallback and is never generated for ${env}, so another environment's value ` +
+      'cannot be used by accident.'
+  );
+  return lines;
+}
+
 /**
  * @param {Object} opts
  * @param {string[]} opts.missing
@@ -125,10 +155,11 @@ function buildKvNamespaceAlternateHints(missing, secrets, appName) {
  * @param {string} [opts.envTemplatePath]
  * @param {string} [opts.envTemplate]
  * @param {Object} [opts.secrets]
+ * @param {{ envKey?: string }|null} [opts.scopedKv]
  * @returns {string}
  */
 function buildMissingSecretsErrorMessage(opts) {
-  const { missing, secretsFilePaths, appName, envTemplatePath, envTemplate, secrets } = opts;
+  const { missing, secretsFilePaths, appName, envTemplatePath, envTemplate, secrets, scopedKv } = opts;
   const fileInfo = formatMissingSecretsFileInfo(secretsFilePaths);
   const lines = [`Missing secrets: ${missing.join(', ')}`];
   if (fileInfo) lines.push(fileInfo.trim());
@@ -138,6 +169,9 @@ function buildMissingSecretsErrorMessage(opts) {
     if (templateLine) lines.push(`Env-template-line: ${ref}|${templateLine}`);
   }
   if (appName) lines.push(`App-name: ${appName}`);
+  for (const hint of buildStrictScopedKeyHints(missing, scopedKv)) {
+    lines.push(hint);
+  }
   if (hasStaleOAuthTemplatePaths(missing) && appName) {
     lines.push(`Stale-template-hint: oauth-leftover | repair ${appName}`);
   }

package/lib/utils/token-manager.js

@@ -10,7 +10,6 @@
  */
 
 const config = require('../core/config');
-const logger = require('./logger');
 const { maskSensitiveData } = require('./log-redaction');
 const {
   refreshClientToken,
@@ -205,12 +204,17 @@ async function tryClientTokenAuth(environment, appName, controllerUrl) {
   return null;
 }
 
-function throwNoDeploymentAuth(credentialApp) {
-  const err = new Error(
-    `No authentication method available. For CI: set AIFABRIX_DEPLOYMENT_AUTH=client-credentials and MISO_CLIENTID/MISO_CLIENTSECRET in .env or '${credentialApp}-client-idKeyVault' in secrets.local.yaml. For interactive use: aifabrix login`
-  );
+// Two causes reach here: no credentials at all, or credentials the controller rejected.
+// Saying "put it in secrets.local.yaml" for the second sends the reader after a key that is
+// already present and simply not valid, so name the rejection instead.
+function throwNoDeploymentAuth(credentialApp, exchangeError) {
+  const err = new Error(exchangeError
+    ? `Client credentials for '${credentialApp}' were rejected by the controller: ${exchangeError.message}. ` +
+      `Re-issue them with: aifabrix login && aifabrix app rotate-secret ${credentialApp}`
+    : `No authentication method available. For CI: set AIFABRIX_DEPLOYMENT_AUTH=client-credentials and MISO_CLIENTID/MISO_CLIENTSECRET in .env or '${credentialApp}-client-idKeyVault' in secrets.local.yaml. For interactive use: aifabrix login`);
   err.statusCode = 401;
   err.authFailure = true;
+  if (exchangeError) err.cause = exchangeError;
   throw err;
 }
 
@@ -262,8 +266,10 @@ async function getDeploymentAuth(controllerUrl, environment, appName, options =
           controller: controllerUrl
         };
       }
-    } catch {
-      // Refresh failed; fall through to throw below
+    } catch (err) {
+      // Keep it: credentials existed and the controller turned them down, which is a
+      // different problem from having none, and the only place that fact is observable.
+      throwNoDeploymentAuth(credentialApp, err);
     }
   }
 
@@ -341,7 +347,7 @@ async function forceRefreshDeviceToken(controllerUrl) {
 
   // Must have refresh token to force refresh
   if (!tokenInfo.refreshToken) {
-    logger.warn('Cannot refresh: no refresh token available. Please login again using: aifabrix login');
+    warnRefreshFailureOnce(controllerUrl, 'Cannot refresh: no refresh token available. Please login again using: aifabrix login');
     return null;
   }
 

package/lib/utils/url-public-path-prefix.js

@@ -1,18 +1,20 @@
 /**
- * Plan 117 URL path prefix for url://public (dev/tst only when gated).
+ * Plan 117 URL path prefix for url://public (scoped environments only when gated).
  *
- * @fileoverview baseEffective ∧ derived envKey ∈ {dev,tst}. Caller must pass prefix only when `traefik` is on (see url-declarative-resolve).
+ * @fileoverview baseEffective ∧ derived envKey ∈ SCOPED_RUN_ENVIRONMENTS. Caller must pass prefix only when `traefik` is on (see url-declarative-resolve).
  * @author AI Fabrix Team
  * @version 1.0.0
  */
 
 'use strict';
 
+const { isScopedRunEnvironmentKey } = require('./environment-scoped-resources');
+
 /**
  * @param {boolean} useEnvironmentScopedResources - config gate
  * @param {boolean} appEnvironmentScopedResources - application.yaml
  * @param {string} derivedEnvKey - from client id (dev|tst|pro|miso)
- * @returns {string} '' | '/dev' | '/tst'
+ * @returns {string} '' | '/dev' | '/tst' | '/pro'
  */
 function computePublicUrlPathPrefix(useEnvironmentScopedResources, appEnvironmentScopedResources, derivedEnvKey) {
   const baseEffective = Boolean(useEnvironmentScopedResources) && Boolean(appEnvironmentScopedResources);
@@ -20,13 +22,7 @@ function computePublicUrlPathPrefix(useEnvironmentScopedResources, appEnvironmen
     return '';
   }
   const k = String(derivedEnvKey || '').toLowerCase();
-  if (k === 'dev') {
-    return '/dev';
-  }
-  if (k === 'tst') {
-    return '/tst';
-  }
-  return '';
+  return isScopedRunEnvironmentKey(k) ? `/${k}` : '';
 }
 
 module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.61.2",
+  "version": "2.63.0",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {
@@ -35,12 +35,14 @@
     "lint:fix": "eslint . --ext .js --fix",
     "test": "node tests/scripts/test-wrapper.js",
     "build": "npm run lint && npm run test",
-    "build:ci": "npm run lint && npm run check:schema-sync && npm run check:flags && npm run check:cli-help && npm run test:ci",
+    "build:ci": "npm run lint && npm run check:schema-sync && npm run check:flags && npm run check:cli-help && npm run check:mirrored-templates && npm run test:ci",
     "test:ci": "bash tests/scripts/ci-simulate.sh",
     "check:schema-sync": "node scripts/check-datasource-test-run-schema-sync.js",
     "check:flags": "jest tests/lib/schema/flag-map-validation-run.test.js --runInBand --config jest.config.default.js",
     "check:cli-help": "node scripts/check-cli-help-examples.js",
+    "check:mirrored-templates": "node scripts/check-mirrored-templates.js",
     "test:manual": "jest --config jest.config.manual.js --runInBand",
+    "test:manual:public": "jest --config jest.config.manual-public.js --runInBand",
     "test:integration": "jest --config jest.config.integration.js --runInBand",
     "test:integration:fixtures": "jest --config jest.config.integration.fixtures.js --runInBand",
     "test:hubspot-wizard": "node integration/hubspot-test/test.js",

package/templates/README.md

@@ -26,6 +26,12 @@ Application templates are folder-based and located under `templates/applications
 | `aifabrix-miso/packages/miso-controller/configs/infra.parameter.yaml` | `lib/schema/infra.parameter.yaml` |
 | `aifabrix-dataplane/builder/dataplane/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/dataplane/` |
 
+The Dataplane `env.template` is the source of truth for
+`DIMENSION_ABAC_ENFORCEMENT_ENABLED` and its default `false`. Do not hand-edit
+the bundled mirror. `aifabrix setup --dimension-abac on|off` stores an operator
+selection outside the template and overlays the resolved lowercase value during
+local runtime and deployment-manifest materialization.
+
 **Schema master (dataplane):** Also copies dataplane `app/schemas/json/` core integration schemas + `type/*` and `configs/deployment-rules.yaml` into `lib/schema/` (same contract as dataplane `make sync-json`). Do not hand-edit those mirrors — edit dataplane SSOT, then sync. `lib/schema/infra.parameter.yaml` is the Miso catalog mirror above; other Builder-owned schemas in `lib/schema/` (wizard and the rest) are left alone.
 
 Overrides: `AIFABRIX_MISO_SRC`, `AIFABRIX_DATAPLANE_SRC` / `AIFABRIX_DATAPLANE_ROOT` (repo roots). Install with `aifabrix up-platform` / `up-builder-api` — do not hand-edit the template copies as primary.

package/templates/applications/builder-api/application.yaml

@@ -5,7 +5,7 @@ app:
   description: 'Business Transformation services — HTTP orchestration for connected-system workspace lifecycle via Dataplane Enterprise MCP and governance APIs.'
   type: webapp
   language: typescript
-  version: 2.61.2
+  version: 2.63.0
 
 # Image Configuration
 image:

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.79
+  version: 2.0.82
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).
@@ -26,7 +26,7 @@ frontDoorRouting:
   pattern: /data/*
   enabled: true
   # Docker url://internal full URLs: http://dataplane:PORT only (ingress /data is not on in-container routes).
-  internalDockerUseOriginOnly: false
+  internalDockerUseOriginOnly: true
   host: ${DEV_USERNAME}.${REMOTE_HOST}
   tls: ${TLS_ENABLED}
   # Origin RFC 9728 PRM (outside /data PathPrefix) — Builder Traefik pass-through (plan 171.0).

package/templates/applications/dataplane/env.template

@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.79
+VERSION=2.0.82
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5

package/templates/applications/integration-server/application.yaml

@@ -0,0 +1,91 @@
+# AI Fabrix Builder app config — INTEGRATOR server type.
+#
+# Same code as builder/builder-server/, different installation. One source tree, two
+# manifests: the Dockerfile's `integrator` target and this folder's env.template are the
+# only things that differ, so there is no forked codebase to keep in step.
+#
+# Enterprise is the existing full development box with Docker. Integrator is a single
+# container giving developers SSH-only access, with no Docker execution inside it.
+
+app:
+  key: integration-server
+  displayName: AI Fabrix Integration Server
+  description: AI Fabrix Integration Server onboards developers over SSH into one container. It creates their Linux accounts and authorized keys, and gives them SSH-only access without Docker inside that container.
+  type: webapp
+  version: 2.0.10
+image:
+  name: aifabrix/integration-server
+  tag: latest
+  registry: aifabrixacr.azurecr.io
+  registryMode: external
+# Base 3006 keeps it clear of builder-server (3002), dataplane (3001), mori-controller
+# (3004) and builder-api (3005), so both server types can run on one dev host.
+# Builder derives the host port as `port` + developerId * 100 (dev01 -> 3106).
+port: 3006
+webSocketsEnabled: true
+# This container administers its own operating system: it creates the developers'
+# Linux accounts, writes /etc/ssh/authorized_keys.d and runs sshd. Builder otherwise
+# runs containers as the invoking host user, which cannot do any of that.
+runAsRoot: true
+# Developers reach this installation over SSH, so that port has to be published as well
+# as the HTTP one. The base keeps SSH's well-known number and the published port follows
+# the same formula as the main port — 22 + developerId * 100 — so dev01 gets 122 and two
+# developers on one host cannot collide. Bootstrap advertises it via SSH_PUBLIC_PORT.
+additionalPorts:
+  - name: ssh
+    containerPort: 22
+    hostPort: 22
+requires:
+  database: false
+  redis: false
+  storage: true
+build:
+  language: typescript
+  context: ../..
+  dockerfile: builder/builder-server/Dockerfile
+  # Selects the Dockerfile's integrator stage. Without it Docker builds the last stage,
+  # which is enterprise — the same image under a different name. This is the one build
+  # difference between the two installations.
+  target: integrator
+  # No envOutputPath: this installation only runs in Docker, and Builder treats the
+  # value as a directory — pointing it at a file name creates a folder of that name.
+  #
+  # Reload runs the real entrypoint, not a bare watcher. The generated compose bind-mounts
+  # the repository over /app and clears the image ENTRYPOINT, which for this installation
+  # meant no sshd, no account-ops worker, and the API running as root — so nothing about
+  # SSH, provisioning or privilege separation worked in the mode developers actually use,
+  # and a queued account was never created. The entrypoint finds the build itself —
+  # /app/dist in the image, /app/builder-server/dist under the bind mount — because the
+  # compose template HTML-escapes `=`, so a VAR=value prefix never survives as an
+  # assignment.
+  #
+  # The API therefore starts from the host's build, so a code change is
+  # `npm run build --prefix builder-server` and a restart, not an in-container watch. That
+  # is deliberate: the watcher ran as root and left root-owned dist/ behind, which then
+  # broke the next `pnpm check` on the host.
+  reloadStart: exec /docker-entrypoint-integrator.sh
+# Ingress. A distinct prefix from builder-server's /server/*, which is not cosmetic: the
+# two installation types are alternatives in production, but a development host runs both,
+# and two applications declaring the same host and prefix collide. Traefik then routes the
+# prefix to whichever container was created last, so integrator-only routes answer 404
+# from the enterprise container — a failure that looks like a bug in the route rather than
+# a collision in the manifests.
+#
+# The pattern is a PathPrefix, not an allowlist: it forwards every path beneath it, so the
+# application refuses anything else that arrives through the front door. Filtering at the
+# ingress is still required and is tracked as open in 029 V4.
+frontDoorRouting:
+  pattern: /integrator/*
+  enabled: true
+  host: ${DEV_USERNAME}.${REMOTE_HOST}
+  tls: ${TLS_ENABLED}
+  internalDockerUseOriginOnly: true
+repository:
+  enabled: false
+  repositoryUrl: ''
+deployment:
+  controllerUrl: ''
+  environment: dev
+healthCheck:
+  path: /health
+  interval: 30