@aifabrix/builder 2.61.2 → 2.63.0

package/lib/cli/infra-guided.js

@@ -14,6 +14,10 @@ const { execWithDockerEnv } = require('../utils/docker-exec');
 const { getLogLevel, passesLevelFilter } = require('../commands/app-logs');
 const { handleLogin } = require('../commands/login');
 const { handleUpBuilderApi } = require('../commands/up-builder-api');
+const {
+  handleUpIntegrationServer,
+  isIntegrationServerSelected
+} = require('../commands/up-integration-server');
 const {
   resolveGuidedAuthControllerUrl,
   runGuidedAuthStep,
@@ -45,6 +49,34 @@ const {
   emitSystemBuilderAppManifestLineIfTTY
 } = require('../utils/manifest-source-emit');
 const { flushDeferredPublicUrlWarnings } = require('./infra-guided-public-url-warn');
+const { fetchOnboardingStatus } = require('../api/onboarding-status.api');
+const {
+  waitForRequiredBaselineReadiness
+} = require('../commands/setup-onboarding-readiness');
+
+async function runRequiredBaselineReadinessIfNeeded(options, authOpts) {
+  if (!options || options.requireBaselineReadiness !== true) return;
+  const controllerUrl = await resolveGuidedAuthControllerUrl(authOpts);
+  const spin = startSpinner('Waiting for required Miso baseline onboarding...');
+  const onProgress = createSpinnerTextUpdater(spin);
+  try {
+    await waitForRequiredBaselineReadiness({
+      request: requestOptions => fetchOnboardingStatus(controllerUrl, requestOptions),
+      onProgress
+    });
+  } catch (error) {
+    if (spin && typeof spin.fail === 'function') spin.fail('Miso baseline onboarding not ready');
+    throw error;
+  }
+  stopSpinnerSuccess(spin, 'Miso baseline onboarding ready');
+  logger.log('');
+}
+
+async function runGuidedMisoAndReadinessPhase(options, handleUpMiso, authOpts) {
+  await withMutedLogger(() => prepareUrlsLocalRegistryForUpPlatform());
+  await runGuidedKeycloakAndMisoControllerPhase(options, handleUpMiso);
+  await runRequiredBaselineReadinessIfNeeded(options, authOpts);
+}
 
 /**
  * Guided Keycloak → Miso Controller start with one spinner per app (no second health wait).
@@ -295,8 +327,25 @@ async function runGuidedDataplaneInstallPhase(options, handleUpDataplane, handle
   await refreshDataplaneVersionAfterPlatformInstall();
 }
 
+async function runGuidedIntegrationServerPhase(options, selected) {
+  if (!selected) return;
+  const spin = startSpinner('Starting Integration Server...');
+  await withMutedLogger(() => handleUpIntegrationServer({ ...options, platformInstall: true }));
+  stopSpinnerSuccess(spin, 'Integration Server ready');
+}
+
+async function runGuidedKeycloakRealmPhase(options) {
+  if (!options || options.requireKeycloakRealm !== true) return;
+  const { waitForKeycloakRealmReady } = require('../utils/keycloak-realm-ready');
+  const spin = startSpinner('Waiting for Keycloak realm (aifabrix)...');
+  await waitForKeycloakRealmReady({ timeoutSeconds: 180 });
+  stopSpinnerSuccess(spin, 'Keycloak realm ready');
+  logger.log('');
+}
+
 async function runGuidedUpPlatform(options, handleUpMiso, handleUpDataplane, handleLogin, forceCleanSummary = null) {
-  logGuidedPlatformSetupHeader();
+  const integrationServerSelected = await isIntegrationServerSelected();
+  logGuidedPlatformSetupHeader({ integrationServer: integrationServerSelected });
   if (forceCleanSummary && forceCleanSummary.forceSummary) {
     logUpPlatformForceCleanSummary(forceCleanSummary.forceSummary, forceCleanSummary.cleanedApps);
   }
@@ -306,23 +355,21 @@ async function runGuidedUpPlatform(options, handleUpMiso, handleUpDataplane, han
     skipLoginIfAuthenticated: options && options.skipLoginIfAuthenticated === true
   };
 
-  await withMutedLogger(() => prepareUrlsLocalRegistryForUpPlatform());
-  await runGuidedKeycloakAndMisoControllerPhase(options, handleUpMiso);
-  if (options && options.requireKeycloakRealm === true) {
-    const { waitForKeycloakRealmReady } = require('../utils/keycloak-realm-ready');
-    const realmSpin = startSpinner('Waiting for Keycloak realm (aifabrix)...');
-    await waitForKeycloakRealmReady({ timeoutSeconds: 180 });
-    stopSpinnerSuccess(realmSpin, 'Keycloak realm ready');
-    logger.log('');
-  }
+  await runGuidedMisoAndReadinessPhase(options, handleUpMiso, authOpts);
+  await runGuidedKeycloakRealmPhase(options);
   await runGuidedAuthStep(handleLogin, authOpts, { startSpinner, stopSpinnerSuccess });
   const controllerUrl = await resolveGuidedAuthControllerUrl(authOpts);
   await runGuidedDataplaneInstallPhase(options, handleUpDataplane, handleLogin, controllerUrl);
   const baSpin = startSpinner('Starting Builder API...');
   await withMutedLogger(() => handleUpBuilderApi({ ...options, platformInstall: true }));
   stopSpinnerSuccess(baSpin, 'Builder API ready');
-  await validateAppErrorLogs(['miso-controller', 'dataplane', 'builder-api']);
-  await logPlatformReadyFooter();
+  await runGuidedIntegrationServerPhase(options, integrationServerSelected);
+  const appNames = [
+    'miso-controller', 'dataplane', 'builder-api',
+    ...(integrationServerSelected ? ['integration-server'] : [])
+  ];
+  await validateAppErrorLogs(appNames);
+  await logPlatformReadyFooter({ integrationServer: integrationServerSelected });
 }
 
 async function runGuidedDownInfra(appName, options, infraMod, appLib) {
@@ -368,6 +415,7 @@ module.exports = {
   runGuidedUpMiso,
   runGuidedUpDataplane,
   runGuidedUpPlatform,
+  runRequiredBaselineReadinessIfNeeded,
   runGuidedDownInfra,
   stripHealthPrefix
 };

package/lib/cli/setup-infra-up-platform-action.js

@@ -17,6 +17,10 @@ const { handleLogin } = require('../commands/login');
 const { handleUpMiso } = require('../commands/up-miso');
 const { handleUpDataplane } = require('../commands/up-dataplane');
 const { handleUpBuilderApi } = require('../commands/up-builder-api');
+const {
+  handleUpIntegrationServer,
+  isIntegrationServerSelected
+} = require('../commands/up-integration-server');
 const {
   applyUpPlatformForceConfig,
   cleanBuilderAppDirs,
@@ -26,7 +30,13 @@ const {
 const { runGuidedUpPlatform } = require('./infra-guided');
 const { recordInfraInstallationCommand } = require('./installation-log-command');
 
-const PLATFORM_APPS = ['keycloak', 'miso-controller', 'dataplane', 'builder-api'];
+const PLATFORM_APPS = [
+  'keycloak',
+  'miso-controller',
+  'dataplane',
+  'builder-api',
+  'integration-server'
+];
 
 /**
  * @param {Object} options
@@ -59,6 +69,9 @@ async function runUpPlatformWork(options) {
     await handleUpMiso(options);
     await handleUpDataplane(options);
     await handleUpBuilderApi({ ...options, platformInstall: true });
+    if (await isIntegrationServerSelected()) {
+      await handleUpIntegrationServer({ ...options, platformInstall: true });
+    }
   }
   return cleanedAppKeys;
 }

package/lib/cli/setup-platform.js

@@ -4,7 +4,7 @@
  * `setup` is the one-shot platform installer. When no infrastructure is
  * detected it runs a small wizard (admin email/password, AI tool keys) and
  * then `up-infra` + `up-platform`. When infra is already up, it offers a
- * mode menu (re-install, wipe data, clean install files, update images).
+ * mode menu (re-install, wipe data, update images).
  *
  * `teardown` is the symmetrical inverse of `setup`: `down-infra -v` plus a
  * full clean of the AI Fabrix system directory (everything except
@@ -20,6 +20,7 @@
 const { handleCommandError } = require('../utils/cli-utils');
 const { handleSetup } = require('../commands/setup');
 const { handleTeardown } = require('../commands/teardown');
+const { parseDimensionAbacOption } = require('../utils/dataplane-dimension-abac-setting');
 
 const SETUP_HELP_AFTER = `
 What this command does:
@@ -27,16 +28,25 @@ What this command does:
   - With infra running: shows a mode menu:
       1) Re-install — stop infra and remove all volumes, then up-infra + up-platform --force.
       2) Wipe data — drop every database and DB user, then up-infra + up-platform --force.
-      3) Clean installation files — remove user-local secrets, then up-infra + up-platform --force.
-      4) Update images — pull the latest infra and platform images, then up-infra + up-platform.
+      3) Update images — pull the latest infra and platform images, then up-infra + up-platform.
   - With --mode fresh: first-time install when no infra is running (non-interactive; use with --admin-email and --admin-password).
   - With --mode update-images: refresh images when infra is already running (non-interactive).
 
 AI tool keys are read from the user-local file (~/.aifabrix/secrets.local.yaml) merged with the shared aifabrix-secrets file. If either source already provides keys, the AI tool prompt is skipped.
 
+Dimension ABAC defaults to off. Use --dimension-abac on|off to persist an explicit Dataplane selection. The saved selection is reused by later setup and redeploy flows; changing it takes effect after the normal Dataplane restart/redeploy boundary.
+
 Use 'aifabrix teardown' to fully remove the local installation.
 `;
 
+function parseRepeatedDimensionAbacOption(raw, previous) {
+  const value = parseDimensionAbacOption(raw);
+  if (previous !== undefined && previous !== value) {
+    throw new Error('Conflicting --dimension-abac values. Supply only on or only off.');
+  }
+  return value;
+}
+
 const TEARDOWN_HELP_AFTER = `
 What this command does:
   - Runs down-infra -v (stops all infra + apps, removes every Docker volume).
@@ -61,7 +71,14 @@ function registerSetup(program) {
     .option('--pro-password-mode <mode>', 'Pro profile only: autogen or manual')
     .option('--admin-email <email>', 'Admin email (non-interactive fresh install)')
     .option('--admin-password <password>', 'Admin password for dev or pro manual-single (non-interactive)')
+    .option('--integration-server', 'Install the integration server (runs once in the miso environment)')
+    .option('--no-integration-server', 'Do not install the integration server (default)')
     .option('--mode <mode>', 'Non-interactive mode: fresh (no infra) or update-images (infra running)')
+    .option(
+      '--dimension-abac <off|on>',
+      'Persist Dataplane Dimension ABAC selection (default: off)',
+      parseRepeatedDimensionAbacOption
+    )
     .option('-y, --yes', 'Skip destructive confirmation prompts (re-install, wipe data, teardown)')
     .addHelpText('after', SETUP_HELP_AFTER)
     .action(async(options) => {

package/lib/commands/auth-config.js

@@ -23,6 +23,7 @@ const {
   checkUserLoggedIn
 } = require('../utils/auth-config-validator');
 const { hasStoredDeviceTokenForController } = require('../utils/controller-url');
+const { assertEnvironmentAllowedForCurrentMode } = require('../core/environment-mode-policy');
 const logger = require('../utils/logger');
 
 /**
@@ -166,6 +167,7 @@ async function handleSetEnvironment(environment) {
   try {
     // Validate environment format
     validateEnvironment(environment);
+    await assertEnvironmentAllowedForCurrentMode(environment);
 
     // Get current controller from config
     const controllerUrl = await getControllerUrl();

package/lib/commands/login.js

@@ -121,6 +121,10 @@ async function normalizeControllerUrl(options) {
 async function handleEnvironmentConfig(options) {
   if (options.environment) {
     const environment = options.environment.trim();
+    // `login -e tst` sets the environment without going through `auth set-environment`,
+    // so the mode rule has to be applied here too or it is trivially bypassed.
+    const { assertEnvironmentAllowedForCurrentMode } = require('../core/environment-mode-policy');
+    await assertEnvironmentAllowedForCurrentMode(environment);
     await setCurrentEnvironment(environment);
     if (!options.compact) {
       logger.log(chalk.gray(`Environment: ${environment}`));

package/lib/commands/repair-datasource-apply.js

@@ -8,6 +8,7 @@
 
 'use strict';
 
+const { repairLegacyDatasource } = require('./repair-datasource-legacy');
 const { repairKeyedDocument } = require('./repair-datasource-keyed-document');
 const { repairOpenapiSection } = require('./repair-datasource-openapi');
 const { repairSyncOperationsFromCapabilities } = require('./repair-datasource-sync-operations');
@@ -122,7 +123,8 @@ function applyOpenapiDatasourceRepairs(parsed, changes) {
  */
 function runRepairDatasourceFile(parsed, options, changes, helpers) {
   const out = Array.isArray(changes) ? changes : [];
-  let updated = helpers.stripDeprecatedServiceCategory(parsed, out);
+  let updated = repairLegacyDatasource(parsed, out);
+  updated = helpers.stripDeprecatedServiceCategory(parsed, out) || updated;
 
   if (shouldApplyServiceContractRepair(parsed, options)) {
     updated = repairNoneLlmToServiceContract(parsed, out) || updated;

package/lib/commands/repair-datasource-legacy.js

@@ -0,0 +1,94 @@
+/**
+ * @fileoverview Migrate legacy datasource storage and mapping shapes.
+ * @author AI Fabrix Team
+ */
+'use strict';
+
+const ENTITY_TYPES = {
+  'record-storage': 'recordStorage',
+  'document-storage': 'documentStorage',
+  'vector-store': 'vectorStore',
+  'message-service': 'messageService'
+};
+
+/**
+ * Preserve legacy attribute types in metadataSchema and qualify raw input paths.
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function repairLegacyAttributes(parsed, changes) {
+  let updated = false;
+  for (const [key, attr] of Object.entries(parsed.fieldMappings?.attributes || {})) {
+    if (!attr || typeof attr !== 'object') continue;
+    if (typeof attr.expression === 'string' && /^\{\{\s*metadata\.[\w.[\]]+\s*\}\}$/.test(attr.expression)) {
+      attr.expression = attr.expression.replace(/\{\{\s*(metadata\.[\w.[\]]+)\s*\}\}/, '{{raw.$1}}');
+      changes.push(`Qualified legacy attribute '${key}' with raw input root`);
+      updated = true;
+    }
+    if (['string', 'number', 'integer', 'boolean', 'object', 'array', 'null'].includes(attr.type)) {
+      parsed.metadataSchema ||= { type: 'object', additionalProperties: true };
+      parsed.metadataSchema.properties ||= {};
+      parsed.metadataSchema.properties[key] ||= { type: attr.type };
+      delete attr.type;
+      changes.push(`Moved legacy attribute '${key}' type to metadataSchema`);
+      updated = true;
+    }
+  }
+  return updated;
+}
+
+/**
+ * Move only unambiguous local bindings; preserve unsupported/conflicting input.
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function repairLegacyDimensions(parsed, changes) {
+  const legacy = parsed.fieldMappings?.dimensions;
+  if (!legacy || typeof legacy !== 'object' || Array.isArray(legacy)) return false;
+  let updated = false;
+  for (const [key, value] of Object.entries(legacy)) {
+    const match = typeof value === 'string' && /^metadata\.([a-z][a-zA-Z0-9]*)$/.exec(value);
+    if (!match || !Object.hasOwn(parsed.fieldMappings.attributes || {}, match[1])) continue;
+    const binding = { type: 'local', field: match[1] };
+    const existing = parsed.dimensions?.[key];
+    if (existing && (existing.type !== 'local' || existing.field !== match[1])) continue;
+    parsed.dimensions ||= {};
+    parsed.dimensions[key] ||= binding;
+    delete legacy[key];
+    changes.push(`Moved legacy dimension '${key}' to root dimensions`);
+    updated = true;
+  }
+  if (Object.keys(legacy).length === 0) {
+    delete parsed.fieldMappings.dimensions;
+    updated = true;
+  }
+  return updated;
+}
+
+/**
+ * @param {Object} parsed
+ * @param {string[]} changes
+ * @returns {boolean}
+ */
+function repairLegacyDatasource(parsed, changes = []) {
+  if (!parsed || typeof parsed !== 'object') return false;
+  let updated = false;
+  if (Object.hasOwn(ENTITY_TYPES, parsed.entityType)) {
+    parsed.entityType = ENTITY_TYPES[parsed.entityType];
+    changes.push(`Normalized legacy entityType to ${parsed.entityType}`);
+    updated = true;
+  }
+  if (['recordStorage', 'documentStorage'].includes(parsed.entityType) && !parsed.labelKey
+      && parsed.primaryKey?.length === 1
+      && Object.hasOwn(parsed.fieldMappings?.attributes || {}, parsed.primaryKey[0])) {
+    parsed.labelKey = [...parsed.primaryKey];
+    changes.push('Defaulted missing labelKey to the sole primary key attribute');
+    updated = true;
+  }
+  updated = repairLegacyAttributes(parsed, changes) || updated;
+  return repairLegacyDimensions(parsed, changes) || updated;
+}
+
+module.exports = { repairLegacyDatasource };

package/lib/commands/setup-image-refresh.js

@@ -105,6 +105,26 @@ function readPlatformDeployImageRef(appName) {
  * @param {{ quiet?: boolean }} [opts]
  * @returns {Promise<boolean>} True when a pull was attempted
  */
+/**
+ * True when Docker already holds the image.
+ *
+ * An installation with no registry configured deploys the `application.yaml` image as it
+ * stands, which is built locally and never pushed. Authenticating first would prompt for
+ * credentials the install does not need, and pulling would fail against a registry that
+ * has never seen the tag, so the local image is the answer when it is already there.
+ *
+ * @param {string} imageRef - Image reference
+ * @returns {Promise<boolean>}
+ */
+async function imageExistsLocally(imageRef) {
+  try {
+    await dockerExec.execWithDockerEnv(`docker image inspect ${imageRef}`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 async function pullPlatformAppImage(appName, opts = {}) {
   const quiet = Boolean(opts.quiet);
   const imageRef = readPlatformDeployImageRef(appName);
@@ -114,6 +134,12 @@ async function pullPlatformAppImage(appName, opts = {}) {
     }
     return false;
   }
+  if (await imageExistsLocally(imageRef)) {
+    if (!quiet) {
+      logger.log(formatDatasourceListRow('ok', appName, 'image already local'));
+    }
+    return true;
+  }
   // A partial stored credential pair fails closed here instead of degrading to a warning.
   await ensureLoginForImageRefs([imageRef]);
   try {

package/lib/commands/setup-modes.js

@@ -58,7 +58,13 @@ const {
 } = require('../utils/infra-optional-service-flags');
 
 /** Builder app keys touched by `up-platform --force`. */
-const PLATFORM_APPS = ['keycloak', 'miso-controller', 'dataplane', 'builder-api'];
+const PLATFORM_APPS = [
+  'keycloak',
+  'miso-controller',
+  'dataplane',
+  'builder-api',
+  'integration-server'
+];
 
 function formatBackupSuffix() {
   const d = new Date();
@@ -290,7 +296,8 @@ async function runUpPlatform(opts = {}) {
         base: true,
         platformControllerUrl: authCtx.platformControllerUrl,
         skipLoginIfAuthenticated: authCtx.skipLoginIfAuthenticated,
-        requireKeycloakRealm: opts.requireKeycloakRealm === true
+        requireKeycloakRealm: opts.requireKeycloakRealm === true,
+        requireBaselineReadiness: true
       },
       upMiso.handleUpMiso,
       upDataplane.handleUpDataplane,

package/lib/commands/setup-onboarding-readiness.js

@@ -0,0 +1,83 @@
+/**
+ * Bounded observer for required Miso baseline onboarding.
+ *
+ * @fileoverview Setup-only Miso baseline readiness observer
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { performance } = require('node:perf_hooks');
+
+const DEFAULT_INTERVAL_MS = 2000;
+const DEFAULT_REQUEST_TIMEOUT_MS = 5000;
+const DEFAULT_DEADLINE_MS = 90000;
+
+function monotonicNow() {
+  return performance.now();
+}
+
+function readinessError(message, code) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function classifyReadiness(snapshot) {
+  const dimensions = snapshot.baselineDimensions;
+  const roles = snapshot.baselineRoles;
+  if (dimensions.state === 'incomplete') {
+    throw readinessError(
+      `Required baseline Dimensions are incomplete (${dimensions.code}). Retry setup after reconciliation completes.`,
+      dimensions.code
+    );
+  }
+  if (roles.state === 'incomplete') {
+    throw readinessError(
+      `Required baseline Business Roles are incomplete (${roles.code}). Retry setup after reconciliation completes.`,
+      roles.code
+    );
+  }
+  if (dimensions.state === 'complete' && roles.state === 'complete') return 'complete';
+  return dimensions.state === 'pending' ? 'dimensions' : 'roles';
+}
+
+function timeoutError() {
+  return readinessError(
+    'Timed out waiting for required Miso baseline onboarding. Retry setup after reconciliation completes.',
+    'MISO_BASELINE_READINESS_TIMEOUT'
+  );
+}
+
+async function waitForRequiredBaselineReadiness(options) {
+  const request = options.request;
+  const now = options.now || monotonicNow;
+  const sleep = options.sleep || (ms => new Promise(resolve => setTimeout(resolve, ms)));
+  const onProgress = options.onProgress || (() => {});
+  const intervalMs = options.intervalMs ?? DEFAULT_INTERVAL_MS;
+  const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  const deadlineMs = options.deadlineMs ?? DEFAULT_DEADLINE_MS;
+  const startedAt = now();
+  while (now() - startedAt < deadlineMs) {
+    const remaining = deadlineMs - (now() - startedAt);
+    if (remaining <= 0) throw timeoutError();
+    const snapshot = await request({ timeoutMs: Math.min(requestTimeoutMs, remaining) });
+    const state = classifyReadiness(snapshot);
+    if (state === 'complete') return snapshot;
+    onProgress(state === 'dimensions'
+      ? 'Waiting for required baseline Dimensions...'
+      : 'Waiting for required baseline Business Roles...');
+    const afterRequest = deadlineMs - (now() - startedAt);
+    if (afterRequest <= 0) throw timeoutError();
+    await sleep(Math.min(intervalMs, afterRequest));
+  }
+  throw timeoutError();
+}
+
+module.exports = {
+  DEFAULT_INTERVAL_MS,
+  DEFAULT_REQUEST_TIMEOUT_MS,
+  DEFAULT_DEADLINE_MS,
+  waitForRequiredBaselineReadiness
+};

package/lib/commands/setup-prompts-platform-mode.js

@@ -73,8 +73,42 @@ async function promptSetupPlatformMode(options = {}) {
   return normalizeSetupPlatformMode(mode);
 }
 
+/**
+ * Whether this installation carries the integration server.
+ *
+ * It runs once per stack in the `miso` environment and most installations do not need it,
+ * so it is opt-in rather than something every install acquires by default. The answer is
+ * persisted, so it is asked once rather than on every run.
+ *
+ * `--integration-server` and `--no-integration-server` answer it non-interactively; a
+ * non-TTY run without either defaults to not installing it, because acquiring an extra
+ * application by silence is the wrong default.
+ *
+ * @async
+ * @param {Object} [options] - CLI options
+ * @returns {Promise<boolean>}
+ */
+async function promptIntegrationServer(options = {}) {
+  if (options.integrationServer === true || options.integrationServer === false) {
+    return options.integrationServer;
+  }
+  if (!process.stdin.isTTY || options.yes === true) {
+    return false;
+  }
+  const { integrationServer } = await inquirer.prompt([
+    {
+      type: 'confirm',
+      name: 'integrationServer',
+      message: 'Install the integration server (runs once in the miso environment)?',
+      default: false
+    }
+  ]);
+  return Boolean(integrationServer);
+}
+
 module.exports = {
   resolvePlatformModeFromOptions,
   promptSetupPlatformMode,
+  promptIntegrationServer,
   getSetupPlatformModePromptChoices
 };

package/lib/commands/setup.js

@@ -36,6 +36,11 @@ const setupModes = require('./setup-modes');
 const { syncPlatformControllerUrlsInConfig } = require('./setup-platform-auth');
 const installationLog = require('../utils/installation-log');
 const { beginSetupCommandFlow, endSetupCommandFlow } = require('./setup-run-context');
+const {
+  parseDimensionAbacOption,
+  resolveDimensionAbacSetting,
+  persistExplicitDimensionAbacSetting
+} = require('../utils/dataplane-dimension-abac-setting');
 
 const MODE = setupPrompts.MODE;
 
@@ -87,7 +92,20 @@ function normalizeCliMode(options) {
  * @param {'fresh'|'update-images'} cliMode
  * @returns {Promise<{ outcome: string, setupMode: string }>}
  */
-async function runSetupWithCliMode(options, cliMode) {
+async function persistDimensionAbacSelection(settingContext) {
+  await persistExplicitDimensionAbacSetting(config, settingContext.explicitValue);
+}
+
+async function prepareDimensionAbacSetting(options) {
+  const explicitValue = parseDimensionAbacOption(options.dimensionAbac);
+  const userConfig = await config.getConfig();
+  const resolved = resolveDimensionAbacSetting(userConfig, explicitValue);
+  const displayValue = resolved.value ? 'on' : 'off';
+  logger.log(infoLine(`Dimension ABAC: ${displayValue} (${resolved.source}).`));
+  return { explicitValue, ...resolved };
+}
+
+async function runSetupWithCliMode(options, cliMode, settingContext) {
   logSetupHeader();
   logger.log(formatProgress('Detecting current installation state...'));
   const running = await isInfraRunning();
@@ -97,12 +115,13 @@ async function runSetupWithCliMode(options, cliMode) {
         'Infrastructure is already running; use --mode update-images or run teardown first.'
       );
     }
-    await runFreshInstallFlow(options);
+    await runFreshInstallFlow(options, settingContext);
     return { outcome: 'success', setupMode: CLI_SETUP_MODES.FRESH };
   }
   if (!running) {
     throw new Error('No infrastructure running; use --mode fresh for first-time install.');
   }
+  await persistDimensionAbacSelection(settingContext);
   await dispatchMode(MODE.UPDATE_IMAGES);
   logger.log(formatSuccessParagraph(`aifabrix setup complete (mode: ${cliMode}).`));
   return { outcome: 'success', setupMode: cliMode };
@@ -110,19 +129,23 @@ async function runSetupWithCliMode(options, cliMode) {
 
 async function applySetupPlatformMode(options) {
   const mode = await setupPlatformModePrompts.promptSetupPlatformMode(options);
+  const integrationServer = await setupPlatformModePrompts.promptIntegrationServer(options);
   const cfg = await config.getConfig();
   applyPlatformTopologyFlagsToConfig(cfg, mode);
+  const { onboardingAppsForIntegrationServer } = require('../core/local-env-overrides');
+  cfg.onboardingApps = onboardingAppsForIntegrationServer(integrationServer);
   await config.saveConfig(cfg);
   await syncPlatformControllerUrlsInConfig();
   return mode;
 }
 
-async function runFreshInstallFlow(options) {
+async function runFreshInstallFlow(options, settingContext) {
   await maybePinDeveloperIdForFreshInstall(options.developer);
   logger.log(infoLine('No infrastructure detected; starting fresh install.'));
   await applySetupPlatformMode(options);
   const adminCreds = await setupPrompts.promptAdminCredentials(options);
   await config.setAdminEmail(adminCreds.adminEmail);
+  await persistDimensionAbacSelection(settingContext);
   await setupModes.runFreshInstall(adminCreds);
   logger.log(formatSuccessParagraph('aifabrix setup complete (fresh install).'));
 }
@@ -131,7 +154,7 @@ async function runFreshInstallFlow(options) {
  * @param {boolean} assumeYes
  * @returns {Promise<{ aborted: boolean, mode: string|null }>}
  */
-async function runExistingInfraFlow(assumeYes) {
+async function runExistingInfraFlow(assumeYes, settingContext) {
   const mode = await setupPrompts.promptModeSelection();
   const proceed = await setupPrompts.confirmDestructiveMode(mode, assumeYes);
   if (!proceed) {
@@ -142,6 +165,7 @@ async function runExistingInfraFlow(assumeYes) {
   if (mode === MODE.REINSTALL || mode === MODE.WIPE_DATA) {
     await applySetupPlatformMode({});
   }
+  await persistDimensionAbacSelection(settingContext);
   await dispatchMode(mode);
   logger.log(formatSuccessParagraph(`aifabrix setup complete (mode: ${mode}).`));
   return { aborted: false, mode };
@@ -194,20 +218,19 @@ async function dispatchMode(mode) {
  * @param {boolean} assumeYes
  * @returns {Promise<{ outcome: string, setupMode: string|null }>}
  */
-async function runSetupMainPath(options, assumeYes) {
-  const cliMode = normalizeCliMode(options);
+async function runSetupMainPath(options, assumeYes, cliMode, settingContext) {
   if (cliMode) {
-    return runSetupWithCliMode(options, cliMode);
+    return runSetupWithCliMode(options, cliMode, settingContext);
   }
 
   logSetupHeader();
   logger.log(formatProgress('Detecting current installation state...'));
   const running = await isInfraRunning();
   if (!running) {
-    await runFreshInstallFlow(options);
+    await runFreshInstallFlow(options, settingContext);
     return { outcome: 'success', setupMode: 'fresh' };
   }
-  const r = await runExistingInfraFlow(assumeYes);
+  const r = await runExistingInfraFlow(assumeYes, settingContext);
   const outcome = r.aborted ? 'aborted' : 'success';
   return { outcome, setupMode: r.mode };
 }
@@ -297,7 +320,9 @@ async function handleSetup(options = {}) {
 
   beginSetupCommandFlow();
   try {
-    const main = await runSetupMainPath(options, assumeYes);
+    const cliMode = normalizeCliMode(options);
+    const settingContext = await prepareDimensionAbacSetting(options);
+    const main = await runSetupMainPath(options, assumeYes, cliMode, settingContext);
     outcome = main.outcome;
     setupMode = main.setupMode;
   } catch (e) {