@aifabrix/builder 2.61.2 → 2.63.0

package/templates/applications/integration-server/env.template

@@ -0,0 +1,215 @@
+# Integration Server — INTEGRATOR installation
+# =============================================================================
+# A single managed container giving developers SSH-only access, with no Docker
+# execution inside it. Identity and configuration are pushed in by Miso; secrets
+# come from the secret store, not from this container's filesystem.
+#
+# The enterprise installation is a different manifest with its own template —
+# builder/builder-server/env.template. Same code, different deployment; each
+# template lists only the variables its own installation reads.
+#
+# Conventions (as used across AI Fabrix apps):
+#   kv://name    secret resolved from the secret store — never a literal here
+#   url://name   URL derived by Builder from the manifest
+#   ${VAR}       value supplied per environment
+
+# =============================================================================
+# CORE
+# =============================================================================
+
+# HTTP listen port (main.ts). Default: 3006
+PORT=3006
+
+# SQLite DB, audit log and managed state.
+#
+# A subdirectory of the mount, not its root: this is a separate installation with its
+# own database, users and identity model. On a dev host running both side by side the
+# bind mount is shared, and pointing both at the root would have each read the other's
+# database — which fails closed, because the recorded server type would not match.
+DATA_DIR=/mnt/data/integrator
+
+# Installation type (config/server-type.ts), resolved once at startup and then
+# persisted in builder.db. This installation IS an integrator, so it is set
+# explicitly: unset would mean enterprise. A populated installation cannot switch
+# type on a restart — that needs a migration.
+BUILDER_SERVER_TYPE=integrator
+
+# Set false or 0 to disable DATA_DIR/audit.log (audit.service.ts). Default: true
+# AUDIT_LOG_ENABLED=true
+
+# =============================================================================
+# SECRETS
+# =============================================================================
+
+# AES-GCM key for the secrets API, as a value from the secret store — this
+# installation has no host filesystem to mount a key file from.
+# 64 hex characters or 32 bytes.
+#
+# Generate a NEW key when installing this server. Never point this at the platform's
+# own key — Miso's, or the enterprise Builder Server's ENCRYPTION_KEY_PATH file.
+# Installing a customer's integrator with the platform key would let every developer
+# with a shell in that container decrypt every other installation's secrets, because
+# the same key is handed to each of them in their config.yaml. One installation, one
+# key: the blast radius of a leaked key is then that installation and nothing else.
+#
+#   openssl rand -hex 32
+#
+# The name follows the catalog's own `{appKey}-secrets-encryptionKeyVault` convention,
+# so it is this application's app-scoped secret and nothing else's. The earlier name said
+# `builder-server`: that is another application's key, and reading it from here would be
+# a cross-application read that only works by being deliberately shared — which is the
+# hole this avoids. Register it at install:
+#
+#   aifabrix secret set integration-server-secrets-encryptionKeyVault "$(openssl rand -hex 32)"
+#
+# The same key is written into every managed developer's config.yaml as
+# `secrets-encryption`, so the CLI can decrypt what this server encrypted. Those two
+# are one value from one source by construction — see account-ops-worker.ts, which
+# resolves it from this variable at the moment it writes the file. Rotating it means
+# re-running configuration sync so the homes are rewritten; values already stored in
+# the secrets table are encrypted with the old key and do not survive a rotation.
+ENCRYPTION_KEY=kv://integration-server-secrets-encryptionKeyVault
+
+# =============================================================================
+# MISO
+# =============================================================================
+# Where identity and configuration come from. Builder Server knows Miso only: it
+# never configures or verifies the identity provider — miso-client owns that.
+# /health carries a `miso` check on this installation, and fails without these.
+
+# Server-to-controller API calls on the environment network.
+MISO_CONTROLLER_URL=url://miso-controller-internal
+
+# Application client credentials, used to obtain an application token and to verify
+# the client tokens on POST /api/integrations/miso/*.
+MISO_CLIENTID=kv://integration-server-client-idKeyVault
+MISO_CLIENTSECRET=kv://integration-server-client-secretKeyVault
+
+# Reachable addresses reported to Miso after the HTTP listener starts. Miso uses the
+# internal address for user/configuration delivery and exposes the public address in
+# application status. Keep these derived from the manifest, like Dataplane's status
+# registration; a typed hostname or port drifts in local developer environments.
+INTEGRATION_SERVER_WEB_SERVER_URL=url://public
+INTEGRATION_SERVER_INTERNAL_URL=url://internal
+
+# The `environment` value written into each developer's ~/.aifabrix/config.yaml.
+# `controller` and `codingPlatform` are pushed by Miso; this one is the
+# installation's own deployment configuration and is never taken from the request.
+MANAGED_CONFIG_ENVIRONMENT=dev
+MISO_ENVIRONMENT=dev
+
+# =============================================================================
+# DEVELOPER ACCESS — SSH
+# =============================================================================
+
+# SSH endpoint returned to enrolling developers by POST /api/bootstrap/ssh.
+#
+# This is what the client is told to connect to, so it must be the address that is
+# actually reachable, not the container's own view. Both are derived rather than typed:
+# the host from the front door, and the port from the `ssh` entry in the manifest's
+# `additionalPorts` (Builder publishes it as SSH_PUBLIC_PORT = hostPort + developerId *
+# 100). Typing either by hand drifts from the manifest and advertises an endpoint
+# nothing is listening on.
+INTEGRATOR_SSH_HOST=url://public
+INTEGRATOR_SSH_PORT=${SSH_PUBLIC_PORT}
+
+# Where sshd reads each developer's authorized keys from.
+#
+# State, not configuration: it records which key each developer enrolled. Kept in the
+# image it was destroyed by every redeploy, and although reconciliation rebuilds it from
+# the database at startup, a developer reconnecting before that finishes is refused.
+# On the volume the file is already correct when sshd starts.
+#
+# Root-owned, inside a directory developers cannot write to.
+# Default: ${DATA_DIR}/authorized_keys.d
+# AUTHORIZED_KEYS_DIR=/mnt/data/integrator/authorized_keys.d
+
+# Root of the managed developer home directories.
+#
+# Must be on the persistent volume. A managed home is not scratch space: it holds the
+# developer's cloned repositories and build trees, the credentials their agent uses, the
+# managed config.yaml and the client certificate this server issued. An agent run takes
+# hours and outlives any single connection, so the work has to survive a redeploy.
+#
+# Inside the image it did not. Every redeploy destroyed the homes, which silently revoked
+# access as well as losing the work: the Linux accounts and their authorized_keys went
+# with them, while the projection in builder.db still said the developer was entitled.
+#
+# The entrypoint creates this root 755 and grants traverse on the path leading to it;
+# each developer's own home inside is 700 and owned by them.
+# Default: ${DATA_DIR}/home
+# DEVELOPER_HOME_ROOT=/mnt/data/integrator/home
+
+# Restores keys even though the projection has gone backwards.
+#
+# This installation records the highest Miso revision it has ever seen, outside the
+# database, so restoring builder.db from before a revocation is detectable: the mark is
+# higher than anything the projection now holds. When that happens the installation fails
+# closed — every developer is reconciled to no keys until Miso re-synchronises a revision
+# at least as high as the one already seen. Homes are retained and the server still boots,
+# so it can be repaired.
+#
+# A database rebuilt deliberately looks identical to one restored from before a
+# revocation, so this is the way past it. Set it only when you know the rebuild was
+# intended; it is logged when used. Only the exact value `true` is accepted.
+# ONBOARDING_ALLOW_BACKWARDS_PROJECTION=true
+
+# =============================================================================
+# CLIENT DOWNLOAD
+# =============================================================================
+# What GET /client/<target>.zip writes into the aifabrix.json beside the executable.
+#
+# The executable itself is identical for every installation — SmartScreen builds
+# reputation against a file hash, so a per-customer binary would never accumulate any.
+# The customer scope travels in this small file instead.
+
+# Platform origin the client posts its SSH key to. Only the origin is used; the client
+# appends its own path, so a value carrying /server would double it.
+CLIENT_PLATFORM_URL=url://public
+
+# Controller the client signs in against, as a browser reaches it.
+CLIENT_CONTROLLER_URL=url://miso-controller-public
+
+# Shown while onboarding, e.g. "Acme Corp". Optional.
+# CLIENT_DISPLAY_NAME=
+
+# How this installation is reached: `ssh` or `wss`. Exactly one is served.
+#
+#   ssh  Developers reach sshd over a private network overlay, which is the only route to
+#        the port — this installation must not publish 22 publicly. Deactivating a person
+#        in the overlay removes their route, and that is what ends access, including for
+#        sessions already open. The tunnel endpoint does not exist.
+#
+#   wss  There is no overlay: the session travels inside a WebSocket on the published
+#        HTTPS port, and sshd listens on loopback only, so the tunnel is the only way in.
+#        This server does the authorizing — a short-lived token at the open, refreshed
+#        over the tunnel while the developer works, and dropped on idle or revocation.
+#
+# Not both. Publishing 22 alongside the tunnel would make the overlay stop being a
+# control, and running both against one sshd means "does this person still have access?"
+# depends on which door they used — with the door that fails open deciding.
+#
+# Stated by the server because the server knows how it is published; the client reads it
+# from aifabrix.json and never has to guess. Guessing wrong fails as a timeout, which is
+# the least diagnosable failure there is.
+CLIENT_TRANSPORT=wss
+
+# =============================================================================
+# FRONT DOOR
+# =============================================================================
+# The application is published whole at its virtual directory, the same way
+# miso-controller serves /miso and dataplane serves /data. What is reachable from
+# outside is decided by `frontDoorRouting` in application.yaml and by the ingress.
+
+# Injected by Builder from `frontDoorRouting.pattern` in application.yaml; listed
+# because the app reads it. Routes are served unprefixed — the ingress strips the
+# prefix before the request arrives — so this only builds URLs handed to clients.
+# BASE_PATH=/integrator
+# X_FORWARDED_PREFIX=/integrator
+
+# =============================================================================
+# TESTING
+# =============================================================================
+
+# Enables POST /api/dev/e2e-reset. Never set in production.
+# E2E_RESET_SECRET=

package/templates/applications/mirrored-templates.json

@@ -0,0 +1,52 @@
+{
+  "mirrors": [
+    {
+      "path": "templates/applications/miso-controller/env.template",
+      "master": {
+        "repo": "aifabrix-miso",
+        "path": "builder/miso-controller/env.template"
+      },
+      "sha256": "9b74b94d5d6e7457d22cfe213f2ec9c3dceb75c540df3953aba3b51c35df05c7"
+    },
+    {
+      "path": "templates/applications/builder-api/env.template",
+      "master": {
+        "repo": "aifabrix-miso",
+        "path": "builder/builder-api/env.template"
+      },
+      "sha256": "1a6b013aa0a34b72c5a0be3dd714bd718a8adb981bcbb9de3d5370e2dd33786c"
+    },
+    {
+      "path": "templates/applications/keycloak/env.template",
+      "master": {
+        "repo": "aifabrix-miso",
+        "path": "builder/keycloak/env.template"
+      },
+      "sha256": "72de7dc5345b842bc20566f8d5105b6541e8185dff157e9af2d37db9590b01fb"
+    },
+    {
+      "path": "templates/applications/dataplane/env.template",
+      "master": {
+        "repo": "aifabrix-dataplane",
+        "path": "builder/dataplane/env.template"
+      },
+      "sha256": "d35eda839464a65ebd018064ea7c2d292654891b41d1f56862b052720a78a3cc"
+    },
+    {
+      "path": "templates/applications/integration-server/env.template",
+      "master": {
+        "repo": "aifabrix-setup",
+        "path": "builder/integration-server/env.template"
+      },
+      "sha256": "a80584bcf6880937c43557a71ca1c423104ab4e15badf4bb14a0a9a9dcaa01d6"
+    },
+    {
+      "path": "templates/applications/integration-server/application.yaml",
+      "master": {
+        "repo": "aifabrix-setup",
+        "path": "builder/integration-server/application.yaml"
+      },
+      "sha256": "04cbfdb9a012393a5e97a1dda1b8f304e97c9532339f045e5912cd250a26a179"
+    }
+  ]
+}

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.89'
+  version: '2.0.91'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
@@ -92,6 +92,8 @@ platforms:
     configuration:
       - name: LOCATION
         value: 'swedencentral'
+      - name: CLOUD_VENDOR
+        value: 'azure'
       - name: MORI_BASE_URL
         value: 'https://platform.aifabrix.dev/mori'
 
@@ -133,6 +135,42 @@ platforms:
         value: 'swedencentral'
       - name: MORI_BASE_URL
         value: 'url://mori-controller-internal'
+      # Declared, because the fallback infers it and infers it wrongly here:
+      # `resolveCloudVendor` returns 'azure' whenever AZURE_SUBSCRIPTION_ID is set, and every
+      # developer box has it from the shared development service principal. A local stack was
+      # therefore treated as an Azure installation, `verifyInstallationBinding` took
+      # `verifyAzureBinding`, and that demands a directory tenant AND a resource group. A
+      # developer box has no resource group, so the binding refused with
+      # "Azure licence binding requires the tenant ID and resource group." The licence guard
+      # turns that into HTTP 403 on every guarded operation — including
+      # `app rotate-secret`, which is the one command that recovers a re-minted credential.
+      #
+      # Measured on dev01 2026-10-04: the dataplane could not start (its client secret had been
+      # re-minted, plan 264.0) and the recovery command was itself refused. The two defects
+      # compose into a dead end that no developer can get out of.
+      - name: CLOUD_VENDOR
+        value: 'docker'
+      # The one installation name the licence binds to (plan 266.0). Sent to Mori as
+      # `resourceGroupName`; docker requires exactly `local-dev{NN}` or registration refuses.
+      # Only on this entry — the Azure platforms below must not be `local-*` and keep SERVICE_NAME.
+      - name: MISO_INSTALLATION_NAME
+        value: 'local-${DEV_USERNAME}'
+      # Plan 262.0: a local stack onboards as SaaS, so the full activation cycle is reachable here.
+      #
+      # `requiresTenantActivationWizard()` is `isAzureDeployment() || isAzureMockDeployment() ||
+      # isSaasDirectOnboarding()`. With `customerOwned` all three are false on a dev box, so the
+      # wizard never ran — and the wizard is what collects the customer directory tenant and
+      # records consent. Without it the tenant is only ever read from the environment, which is the
+      # in-tenant assumption and wrong for SaaS.
+      #
+      # This is the ONBOARDING axis, deliberately not the DEPLOYMENT axis. `DEPLOYMENT` stays
+      # `database` (DB-only; no Docker, no Azure), which `isLocalOnboardingDeployment()` already
+      # treats as local. `DEPLOYMENT=local` means Miso orchestrating Docker itself, which is not
+      # ready and is not what a dev box runs — keying this on it would never fire.
+      #
+      # Only on this entry: the Azure platforms below stay `customerOwned`.
+      - name: ONBOARDING_MODE
+        value: 'saasDirect'
 
   - resource: aifabrix-int-{platform}
     name: aifabrix
@@ -140,6 +178,8 @@ platforms:
     configuration:
       - name: LOCATION
         value: 'swedencentral'
+      - name: CLOUD_VENDOR
+        value: 'azure'
       # Mori the installation talks to. Previously `kv://mori-controller-web-server-url`, which
       # resolved to whatever the *application record* held — on aifabrix-ce-16 that was
       # `http://localhost:3004`, because an Azure deployment never overwrites a stale URL, so every
@@ -154,6 +194,8 @@ platforms:
     configuration:
       - name: LOCATION
         value: 'swedencentral'
+      - name: CLOUD_VENDOR
+        value: 'azure'
       # The App Service hostname, not the Front Door one, because only this is derivable.
       #
       # The Front Door endpoint carries an Azure-generated suffix (`fzahchbachcfbgaj`) that no

package/templates/applications/miso-controller/env.template

@@ -11,7 +11,8 @@
 #   [saasDirect]    eSystems-hosted SaaS activation (four-step wizard)
 #   [customerOwned] Azure-in-tenant activation (existing TA wizard)
 #
-# ONBOARDING_MODE selects the onboarding step list. It is orthogonal to DEPLOYMENT,
+# ONBOARDING_MODE selects the onboarding step list. saasDirect also enables the local wizard.
+# It is orthogonal to DEPLOYMENT,
 # which selects Azure SDK vs local execution. There is NO fifth DEPLOYMENT value:
 # eSystems-hosted SaaS still runs DEPLOYMENT=azure. See the DEPLOYMENT TYPE and
 # ONBOARDING MODE sections below.
@@ -40,14 +41,28 @@
 # Optional custom controller key for onboarding (default: miso-controller)
 ONBOARDING_CONTROLLER_KEY=miso-controller
 
-# Infrastructure/service name used by controller/onboarding flows
-INFRASTRUCTURE_NAME=${DEV_USERNAME}.${DEV_ROOT_DOMAIN}
-
 # Azure region (required for first-time onboarding: controller record / provisioning metadata).
 # Use the region you deploy to (e.g. westeurope, eastus, northeurope). Single env name: LOCATION.
 # Resolved from the platform match; see `platforms` in application.yaml.
 LOCATION={LOCATION}
 
+# Which kind of installation this is, for licence binding. Declared, never inferred.
+#
+# `resolveCloudVendor` falls back to "AZURE_SUBSCRIPTION_ID is set, therefore Azure", and every
+# developer box has that variable from the shared development service principal. A local stack was
+# then bound as an Azure installation, which requires a directory tenant AND a resource group; a
+# developer box has no resource group, so licence binding refused and the licence guard returned
+# HTTP 403 for every guarded operation — `app rotate-secret` included, which is precisely the
+# command needed to recover a credential the controller had re-minted.
+#
+# Resolved from the platform match: `docker` locally, `azure` for every real resource group.
+CLOUD_VENDOR={CLOUD_VENDOR}
+
+# The one installation name the licence binds to (plan 266.0). Not a label: Miso sends it to Mori
+# as `resourceGroupName`, and docker requires exactly `local-dev{NN}` or registration refuses.
+# `${DEV_USERNAME}` yields `local-dev03`. It is the only name a local install declares.
+MISO_INSTALLATION_NAME=local-${DEV_USERNAME}
+
 # Required for admin user creation during onboarding
 # Password for the initial administrator user (username: admin)
 ONBOARDING_ADMIN_PASSWORD=kv://miso-controller-admin-passwordKeyVault
@@ -151,7 +166,6 @@ KEYCLOAK_CLIENT_ID=kv://keycloak-client-idKeyVault
 KEYCLOAK_CLIENT_SECRET=kv://keycloak-client-secretKeyVault
 KEYCLOAK_ADMIN_USERNAME=admin
 KEYCLOAK_ADMIN_PASSWORD=kv://keycloak-admin-passwordKeyVault
-KEYCLOAK_PUBLIC_KEY=
 KEYCLOAK_VERIFY_AUDIENCE=false
 KEYCLOAK_TOKEN_TIMEOUT=5000
 KEYCLOAK_DEFAULT_PASSWORD=kv://keycloak-default-passwordKeyVault
@@ -291,12 +305,12 @@ DEPLOYMENT=database
 #
 # customerOwned = Azure-in-tenant wizard
 #                 consent → identity → size → access-model → endpoint → validation
-# saasDirect    = eSystems-hosted activation
-#                 consent → identity → endpoint (domain only) → review
+# saasDirect    = hosted or local Docker guided activation
+#                 consent → endpoint (local browser URL or optional domain) → identity → review
 #                 Omits size, access-model, customer deploy and platform-apps.
 #
 # Unset defaults to customerOwned. An unknown value fails closed with HTTP 400.
-ONBOARDING_MODE=customerOwned
+ONBOARDING_MODE=saasDirect
 
 # Dev/test: show TA Entra "Completing setup" countdown (120s cap). Default false.
 # Exposed to UI via GET /api/v1/tenant/status → showTaCountdown (restart controller after change).
@@ -311,9 +325,10 @@ SHOW_TA_COUNT_DOWN=false
 ENCRYPTION_KEY=kv://miso-controller-secrets-encryptionKeyVault
 
 # Comma-separated application keys allowed for POST .../applications/bootstrap (install-time only).
-# Environment placement is a separate controller rule: workloads (dataplane, builder-api) install into
-# dev/tst/pro but never `miso`; miso-controller and keycloak only into `miso`; mori-controller anywhere.
-BOOTSTRAP_APPKEYS=dataplane,builder-api,mori-controller
+# Environment placement is a separate controller rule: workloads (dataplane, customer apps) install
+# into dev/tst/pro but never `miso`; miso-controller, keycloak, builder-api, and integration-server
+# only into `miso`; mori-controller anywhere.
+BOOTSTRAP_APPKEYS=dataplane,builder-api,integration-server,mori-controller
 
 # Key Vault Integration (for security parameter encryption)
 # Set to true to enable Azure Key Vault for storing security parameters
@@ -384,6 +399,25 @@ ENTRA_GRAPH_DELEGATED_REDIRECT_URI=url://mori-controller-public/entra-graph-dele
 # MORI_API_KEY is per-installation and is minted by POST /marketplace/bootstrap; it is written
 # here by the controller after registration, not provisioned ahead of it.
 MORI_BASE_URL={MORI_BASE_URL}
+
+# Mori's policy signing ANCHOR, public half. Verifies the signed enforcement bundle.
+#
+# Mori holds the private half and signs with it; this is the key the bundle is checked against, so
+# an installation that could write it could trust a bundle it signed itself. It is supplied, never
+# generated: on Azure the deployment template writes `mori-policy-public-keyKeyVault` into the
+# installation vault. Locally it is per developer, because each box's Mori holds its own pair.
+#
+# `pnpm license:sign:local` reads it from here so the command needs no arguments. Export the public
+# half from the local Mori once:
+#
+#   docker exec aifabrix-dev${NN}-mori-controller node -e "const {createPublicKey}=require('crypto');\
+#     process.stdout.write(createPublicKey(process.env.MORI_POLICY_PRIVATE_KEY.replace(/\\n/g,'\n'))\
+#     .export({type:'spki',format:'pem'}).toString())"
+#
+# Empty is valid: an installation with no anchor cannot verify a bundle and says so, rather than
+# accepting one signed by any key.
+MORI_POLICY_PUBLIC_KEY=
+MORI_POLICY_KEY_ID={POLICY_KEY_ID}
 MORI_API_KEY=kv://mori-controller-api-keyKeyVault
 # Ask Mori for a container-registry credential when the installation was given none.
 # Off by default: the call has a 30s timeout inside credential resolution, so enabling it on an
@@ -417,37 +451,9 @@ APPLICATIONINSIGHTS_CONNECTION_STRING=kv://appinsights-connectionStringKeyVault
 # OpenTelemetry service name (optional, defaults to miso-controller)
 OTEL_SERVICE_NAME=miso-controller
 
-# OpenTelemetry service version (optional, defaults to npm_package_version or 1.0.0)
-OTEL_SERVICE_VERSION=
-
 # =============================================================================
 # STORAGE CONFIGURATION
 # =============================================================================
 
 # Mount Volume Configuration
 MOUNT_VOLUME=/mnt/data/
-
-# Image registry this installation deploys from.
-#
-# `pipeline-validation-flow.helper.ts` resolves the deploy registry as ACR_LOGIN_SERVER first, then
-# the controller record's `configuration.imageRegistry`. Azure installations get the record from the
-# installer, so this stays EMPTY there and behaviour is unchanged. A local installation matches no
-# platform (`allowLocalPlatform` is false for the controller) and has no record, so without this key
-# every `aifabrix deploy` fails with "Image registry is not configured on the controller
-# installation".
-#
-# EMPTY on purpose. The controller record is read AFTER this and overwrites it, so an Azure
-# installation ignores whatever stands here; only a local installation consumes it.
-#
-# This briefly shipped as `aifabrixce16.azurecr.io` — one test installation's registry, committed
-# into the product, so every developer who did not override it would have pushed and pulled
-# against ce-16 without being told. A `{ACR_LOGIN_SERVER}` token was tried instead and is worse
-# still: nothing resolves it without a resource group, so it breaks `aifabrix build` outright
-# ("no platform or environment configuration resolves it for environment dev").
-#
-# Empty is the honest third answer. An Azure installation is unaffected, and a local
-# `aifabrix deploy` fails with "Image registry is not configured on the controller installation",
-# which names the missing thing. Its proper home is the Builder run tooling, which already knows
-# the answer (`aifabrix dev print-registry`) and should inject it per developer rather than have
-# Miso ship one installation's registry to everybody.
-ACR_LOGIN_SERVER=

package/templates/marketplace/createUiDefinition.json

@@ -5,19 +5,44 @@
   "parameters": {
     "config": {
       "basics": {
-        "description": "Choose subscription, resource group, and region above. Under **Application resources Resource group name**, enter your install id (for example `aifabrixpoc02`). That managed resource group name is the naming prefix: resources become `{rg}-miso-asp`, `{rg}-miso-miso`, and so on. Set the Azure **Application name** to the same id when the portal asks. Enter the initial platform administrator password and choose the license below. Container images are pulled with the web apps' managed identities; no registry credential is needed."
+        "description": "Choose subscription, resource group, and region above. Under **Application resources Resource group name**, enter your install id (for example `aifabrixpoc02`), using at most 16 lowercase characters. That managed resource group name is the naming prefix: resources become `{rg}-miso-asp`, `{rg}-miso-miso`, and so on. Set the Azure **Application name** to the same id when the portal asks. Enter the initial platform administrator password and choose the license below. Container images are pulled with the web apps' managed identities; no registry credential is needed.",
+        "resourceGroup": {
+          "constraints": {
+            "validations": [
+              {
+                "regex": "^[a-z][a-z0-9]*(-[a-z0-9]+)*$",
+                "message": "Use lowercase letters, digits and single hyphens, starting with a letter. The name becomes the prefix for every resource, and the Key Vault created as {name}-miso-kv must start with a letter and cannot contain consecutive or trailing hyphens."
+              },
+              {
+                "regex": "^.{1,16}$",
+                "message": "Use at most 16 characters. The name becomes the prefix for every resource: the Key Vault is created as {name}-miso-kv, and Azure limits a Key Vault name to 24 characters."
+              }
+            ]
+          }
+        }
       }
     },
     "basics": [
+      {
+        "name": "adminEmail",
+        "type": "Microsoft.Common.TextBox",
+        "label": "Administrator email",
+        "toolTip": "Email for the initial platform administrator and installation welcome.",
+        "constraints": {
+          "required": true,
+          "regex": "^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$",
+          "validationMessage": "Enter a valid email address."
+        }
+      },
       {
         "name": "adminPassword",
         "type": "Microsoft.Common.PasswordBox",
         "label": "Administrator password",
-        "toolTip": "Password for the initial AI Fabrix platform administrator (user admin). PostgreSQL, Keycloak, and encryption secrets are generated automatically and stored in Key Vault — do not reuse this password for infrastructure.",
+        "toolTip": "Password for the initial AI Fabrix platform administrator (user admin). PostgreSQL, Keycloak, and encryption secrets are generated automatically and stored in Key Vault \u2014 do not reuse this password for infrastructure.",
         "constraints": {
           "required": true,
           "regex": "^.{8,128}$",
-          "validationMessage": "Password must be 8–128 characters."
+          "validationMessage": "Password must be 8\u2013128 characters."
         },
         "options": {
           "hideConfirmation": false
@@ -63,6 +88,27 @@
           "regex": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
           "validationMessage": "Enter the Marketplace subscription ID as a GUID (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)."
         }
+      },
+      {
+        "name": "installationResourceModel",
+        "type": "Microsoft.Common.DropDown",
+        "label": "Initial infrastructure",
+        "toolTip": "Choose Shared for Community or Standard. Choose Dedicated DEV for Enterprise. This provisions infrastructure before licence issuance; it does not grant licence entitlements.",
+        "defaultValue": "Shared (Community / Standard)",
+        "constraints": {
+          "required": "[equals(basics('licenseChoice'), 'SUBSCRIPTION_ID')]",
+          "allowedValues": [
+            {
+              "label": "Shared (Community / Standard)",
+              "value": "shared"
+            },
+            {
+              "label": "Dedicated DEV (Enterprise)",
+              "value": "dedicated"
+            }
+          ]
+        },
+        "visible": "[equals(basics('licenseChoice'), 'SUBSCRIPTION_ID')]"
       }
     ],
     "steps": [],
@@ -71,7 +117,9 @@
       "deploymentEnvironment": "evaluation",
       "adminPassword": "[basics('adminPassword')]",
       "licenseEdition": "[if(equals(basics('licenseChoice'), 'SUBSCRIPTION_ID'), basics('licenseSubscriptionKey'), basics('licenseChoice'))]",
-      "acrResourceId": "__MARKETPLACE_ACR_RESOURCE_ID__"
+      "acrResourceId": "__MARKETPLACE_ACR_RESOURCE_ID__",
+      "installationResourceModel": "[if(equals(basics('licenseChoice'), 'SUBSCRIPTION_ID'), basics('installationResourceModel'), if(equals(basics('licenseChoice'), 'ENTERPRISE'), 'dedicated', 'shared'))]",
+      "adminEmail": "[basics('adminEmail')]"
     }
   }
 }