@aifabrix/builder 2.61.2 → 2.63.0

package/lib/core/environment-access-policy.js

@@ -0,0 +1,121 @@
+/**
+ * Who may act on which environment (plan 210.0).
+ *
+ * Cross-environment management is gated by the **signed-in user's** access, never by a
+ * standing service identity. The distinction matters because the bootstrap credential that
+ * makes a silent `dev` install possible would otherwise also reach `pro`: one shared secret
+ * on a developer host would become a route into production, and nothing in the audit trail
+ * would name a person.
+ *
+ * The entitled set therefore has to come from the user's own token. That is a property of
+ * the caller rather than of this module, so the rule is made mechanical: a caller states
+ * where the list came from, and anything other than a signed-in user is refused here rather
+ * than trusted to have checked.
+ *
+ * **A request touching several environments is all-or-nothing, decided before anything
+ * runs.** A partly applied cross-environment operation leaves the installation in a state
+ * nobody asked for, and the exit code does not say which half happened; refusing the whole
+ * request is recoverable, half-doing it is not.
+ *
+ * Pure: no I/O, no token parsing. The caller supplies what it learned.
+ *
+ * @fileoverview Environment entitlement checks for cross-environment commands
+ */
+
+'use strict';
+
+/** The only acceptable provenance for an entitled-environment list. */
+const USER_ACCESS_SOURCE = 'user';
+
+/**
+ * @param {unknown} value - Environment key
+ * @returns {string}
+ */
+function normalizeEnvKey(value) {
+  return String(value ?? '').trim().toLowerCase();
+}
+
+/**
+ * Normalise an entitled-environment list to comparable keys.
+ *
+ * @param {Array<unknown>|null|undefined} entitled - Environments the user may act on
+ * @returns {string[]} Unique, normalised, in the order given
+ */
+function normalizeEntitledEnvironments(entitled) {
+  if (!Array.isArray(entitled)) {
+    return [];
+  }
+  const seen = new Set();
+  const out = [];
+  for (const item of entitled) {
+    const key = normalizeEnvKey(typeof item === 'object' && item ? item.key ?? item.name : item);
+    if (!key || seen.has(key)) continue;
+    seen.add(key);
+    out.push(key);
+  }
+  return out;
+}
+
+/**
+ * Split a request into what this user may and may not act on.
+ *
+ * @param {Array<unknown>} requested - Environments the command would touch
+ * @param {Array<unknown>} entitled - Environments the user may act on
+ * @returns {{ allowed: string[], refused: string[] }}
+ */
+function partitionByEntitlement(requested, entitled) {
+  const permitted = new Set(normalizeEntitledEnvironments(entitled));
+  const allowed = [];
+  const refused = [];
+  for (const item of Array.isArray(requested) ? requested : [requested]) {
+    const key = normalizeEnvKey(item);
+    if (!key) continue;
+    (permitted.has(key) ? allowed : refused).push(key);
+  }
+  return { allowed, refused };
+}
+
+/**
+ * Refuse a request that reaches an environment this user is not entitled to.
+ *
+ * @param {Array<unknown>|string} requested - Environments the command would touch
+ * @param {Object} access - What the caller learned about the signed-in user
+ * @param {Array<unknown>} access.entitled - Environments the user may act on
+ * @param {string} access.source - Provenance; must be `user`
+ * @returns {string[]} The requested environments, normalised, when every one is permitted
+ * @throws {Error} When the list is not user-scoped, or any environment is not permitted
+ */
+function assertEnvironmentsEntitled(requested, access = {}) {
+  if (normalizeEnvKey(access.source) !== USER_ACCESS_SOURCE) {
+    throw new Error(
+      'Environment access must come from the signed-in user, not a service identity. ' +
+        'Run "aifabrix login" and retry.'
+    );
+  }
+  const entitled = normalizeEntitledEnvironments(access.entitled);
+  const { allowed, refused } = partitionByEntitlement(requested, access.entitled);
+
+  if (entitled.length === 0) {
+    throw new Error(
+      'You are signed in but entitled to no environment. Ask an administrator for access, ' +
+        'or check the controller with: aifabrix env secret list'
+    );
+  }
+  if (refused.length > 0) {
+    // Named in full, and nothing is run. Reporting only the first would hide the rest
+    // behind a retry loop, and running the entitled ones first would half-apply the request.
+    throw new Error(
+      `Not entitled to ${refused.join(', ')}. You may act on ${entitled.join(', ')}.\n` +
+        'Nothing was changed: a request spanning environments is refused as a whole so it ' +
+        'cannot be left half applied.'
+    );
+  }
+  return allowed;
+}
+
+module.exports = {
+  USER_ACCESS_SOURCE,
+  normalizeEntitledEnvironments,
+  partitionByEntitlement,
+  assertEnvironmentsEntitled
+};

package/lib/core/environment-mode-policy.js

@@ -0,0 +1,177 @@
+/**
+ * Which environments a local installation may build in and select (plan 210.0).
+ *
+ * Two rules, kept together because they describe one position: `tst` and `pro` are
+ * **promotion targets**, not working environments.
+ *
+ * **Build is a dev activity.** `tst` and `pro` receive a promoted image — the same image run
+ * as another container under an environment-suffixed name. Building into them would mean the
+ * artifact in production was never the artifact that was tested, which is the property
+ * promotion exists to guarantee. Miso does not police this; a build leaves no trace of where
+ * it happened, so the refusal has to be here.
+ *
+ * **`tst` and `pro` need the front door.** They exist only in `full` platform mode, where
+ * Traefik routes each environment under its own path. `single-traefik` is a front door for
+ * **one** environment, and `single` is direct ports: several environments on one host collide
+ * on ports there. Allowing the selection in either would produce an environment that is
+ * unreachable rather than one that failed to start, so it is refused up front.
+ *
+ * Pure except for `resolveEffectiveBuildEnvironment`, which reads the configured environment.
+ *
+ * @fileoverview Build and platform-mode environment policy for local installations
+ */
+
+'use strict';
+
+const {
+  SETUP_PLATFORM_MODE,
+  normalizeSetupPlatformMode
+} = require('./setup-platform-mode');
+
+/** Environments that receive a promoted artifact and are never built into. */
+const PROMOTION_ONLY_ENVIRONMENTS = Object.freeze(['tst', 'pro']);
+
+/**
+ * @param {unknown} envKey - Environment key
+ * @returns {string} Lowercase trimmed key
+ */
+function normalizeEnvKey(envKey) {
+  return String(envKey ?? '').trim().toLowerCase();
+}
+
+/**
+ * @param {unknown} envKey - Environment key
+ * @returns {boolean} True when the environment only ever receives a promoted artifact
+ */
+function isPromotionOnlyEnvironment(envKey) {
+  return PROMOTION_ONLY_ENVIRONMENTS.includes(normalizeEnvKey(envKey));
+}
+
+/**
+ * Refuse a build that would target a promotion-only environment.
+ *
+ * `--env` has no default, so an omitted flag silently takes the configured environment. The
+ * message distinguishes the two cases: being told "build cannot target pro" after typing no
+ * environment at all is not actionable on its own.
+ *
+ * @param {unknown} envKey - Resolved environment key
+ * @param {Object} [opts] - Context
+ * @param {boolean} [opts.explicit] - Whether the caller passed --env
+ * @throws {Error} When the environment is tst or pro
+ */
+function assertBuildEnvironmentAllowed(envKey, opts = {}) {
+  const key = normalizeEnvKey(envKey);
+  if (!isPromotionOnlyEnvironment(key)) {
+    return;
+  }
+  const cause = opts.explicit
+    ? `--env ${key}`
+    : `the current environment is ${key}`;
+  throw new Error(
+    `Cannot build into ${key} (${cause}). ${key} receives a promoted image, never a locally ` +
+      'built one, so that what runs there is what was tested in dev.\n' +
+      'Build in dev with: aifabrix build <appKey> --env dev\n' +
+      `Then promote into ${key} with: aifabrix env`
+  );
+}
+
+/**
+ * Refuse selecting a promotion-only environment outside the front-door platform mode.
+ *
+ * @param {unknown} envKey - Environment key being selected
+ * @param {unknown} mode - setupPlatformMode value
+ * @throws {Error} When the environment needs full mode and the install is not in it
+ */
+function assertEnvironmentAllowedForPlatformMode(envKey, mode) {
+  const key = normalizeEnvKey(envKey);
+  if (!isPromotionOnlyEnvironment(key)) {
+    return;
+  }
+  const normalized = normalizeSetupPlatformMode(mode);
+  if (normalized === SETUP_PLATFORM_MODE.FULL) {
+    return;
+  }
+  const reason =
+    normalized === SETUP_PLATFORM_MODE.SINGLE_TRAEFIK
+      ? 'single-traefik is a front door for one environment only'
+      : 'single mode publishes direct ports, and several environments on one host collide on ports';
+  throw new Error(
+    `Environment ${key} requires platform mode "full" (HTTPS front door with per-environment ` +
+      `paths). This installation is "${normalized}": ${reason}.\n` +
+      'Switch with: aifabrix setup --platform full'
+  );
+}
+
+/**
+ * Refuse a promotion-only environment against the installation's configured mode.
+ *
+ * @param {unknown} envKey - Environment key being selected
+ * @returns {Promise<void>}
+ * @throws {Error} When the environment needs full mode and the install is not in it
+ */
+async function assertEnvironmentAllowedForCurrentMode(envKey) {
+  if (!isPromotionOnlyEnvironment(envKey)) {
+    return;
+  }
+  const config = require('./config');
+  const mode =
+    typeof config.getSetupPlatformMode === 'function'
+      ? await config.getSetupPlatformMode()
+      : SETUP_PLATFORM_MODE.SINGLE;
+  assertEnvironmentAllowedForPlatformMode(envKey, mode);
+}
+
+/**
+ * The environment a build will actually target.
+ *
+ * Mirrors how the secret path resolves it (`buildScopedKvContext`): an omitted `--env` falls
+ * through to the configured environment, so a guard that only inspected the flag would let
+ * `aifabrix build` run against `pro` on a machine configured for it.
+ *
+ * @param {Object} [options] - Build options carrying `env`
+ * @returns {Promise<{ envKey: string, explicit: boolean }>}
+ */
+async function resolveEffectiveBuildEnvironment(options = {}) {
+  if (options && options.env) {
+    return { envKey: normalizeEnvKey(options.env), explicit: true };
+  }
+  const config = require('./config');
+  if (typeof config.getCurrentEnvironment !== 'function') {
+    return { envKey: 'dev', explicit: false };
+  }
+  let current;
+  try {
+    current = await config.getCurrentEnvironment();
+  } catch {
+    // An unreadable config is a different failure, reported properly by whatever next needs
+    // it — secrets resolution cannot proceed without it either. Turning it into "cannot
+    // build" would stop every build on a machine whose config has an unrelated problem, and
+    // it protects nothing: reaching tst or pro requires either an explicit --env, which
+    // never reads config, or a readable config naming one.
+    return { envKey: 'dev', explicit: false };
+  }
+  return { envKey: normalizeEnvKey(current) || 'dev', explicit: false };
+}
+
+/**
+ * Resolve the build environment and refuse it when it is promotion-only.
+ *
+ * @param {Object} [options] - Build options carrying `env`
+ * @returns {Promise<string>} The allowed environment key
+ * @throws {Error} When the environment is tst or pro
+ */
+async function assertBuildEnvironmentForOptions(options = {}) {
+  const { envKey, explicit } = await resolveEffectiveBuildEnvironment(options);
+  assertBuildEnvironmentAllowed(envKey, { explicit });
+  return envKey;
+}
+
+module.exports = {
+  PROMOTION_ONLY_ENVIRONMENTS,
+  isPromotionOnlyEnvironment,
+  assertBuildEnvironmentAllowed,
+  assertEnvironmentAllowedForPlatformMode,
+  assertEnvironmentAllowedForCurrentMode,
+  resolveEffectiveBuildEnvironment,
+  assertBuildEnvironmentForOptions
+};

package/lib/core/local-env-overrides.js

@@ -0,0 +1,149 @@
+/**
+ * Builder-owned env values for locally installed platform applications.
+ *
+ * `templates/applications/{miso-controller,builder-api,keycloak}/env.template` are
+ * byte-identical mirrors of the Miso master, and `dataplane` mirrors the dataplane
+ * repository. An edit to a mirror survives until the next `chore(templates): sync`
+ * commit and then disappears without a diff anyone reads, so a value Builder decides
+ * cannot live there. It is applied here instead, after the template is resolved.
+ *
+ * @fileoverview Local-install env overrides owned by Builder, not by a mirrored template
+ */
+
+'use strict';
+
+/** Applications the CLI registers itself through `.../applications/bootstrap`. */
+const CLI_BOOTSTRAPPED_APP_KEYS = Object.freeze(['dataplane']);
+
+/**
+ * Controller onboarding owns the miso-only platform applications. Dataplane remains a
+ * CLI-owned workload and must never be inserted into this list.
+ */
+const DEFAULT_LOCAL_ONBOARDING_APPS = Object.freeze(['builder-api']);
+
+/** Config key an installation may set to choose its own onboarding list. */
+const ONBOARDING_APPS_CONFIG_KEY = 'onboardingApps';
+
+/**
+ * Keys Builder's mirror carried that the Miso master does not.
+ *
+ * They were edits to a mirrored file, which is the thing this module exists to prevent: the
+ * mirror has since fallen 57 lines behind its master, and re-syncing it would have dropped
+ * them silently. They are declared here instead, so the next sync cannot lose them.
+ *
+ * - `INFRASTRUCTURE_NAME` is the only one carrying a value, used by controller and onboarding
+ *   flows. Losing it would change behaviour, not merely remove a blank line.
+ * - The other three shipped empty. They are kept so a local install's env has exactly the keys
+ *   it had before this sync: an absent key and an empty one are usually the same thing, and
+ *   "usually" is not a basis for changing every installation at once.
+ *
+ * `ACR_LOGIN_SERVER` is deliberately empty. Miso removed it with the note that its proper home
+ * is Builder's run tooling, which knows the per-developer answer — so an installation that
+ * needs it should have it injected there rather than shipped one test installation's registry
+ * to everybody, which is what happened the last time it carried a value.
+ */
+const MISO_CONTROLLER_LOCAL_ONLY_ENV = Object.freeze({
+  INFRASTRUCTURE_NAME: '${DEV_USERNAME}.${DEV_ROOT_DOMAIN}',
+  KEYCLOAK_PUBLIC_KEY: '',
+  OTEL_SERVICE_VERSION: '',
+  ACR_LOGIN_SERVER: ''
+});
+
+function normalizeAppKeyList(value) {
+  const raw = Array.isArray(value) ? value : String(value ?? '').split(',');
+  const seen = new Set();
+  for (const entry of raw) {
+    const key = String(entry ?? '').trim().toLowerCase();
+    if (key) {
+      seen.add(key);
+    }
+  }
+  return [...seen];
+}
+
+/**
+ * Applications controller onboarding may register on this installation.
+ *
+ * Builder API is always retained because Controller onboarding owns that miso-only
+ * application. This also migrates older explicit-empty setup values safely.
+ *
+ * @param {Object} [cfg] - Parsed `~/.aifabrix/config.yaml`
+ * @returns {string[]} Application keys, never including one the CLI bootstraps
+ */
+function resolveLocalOnboardingApps(cfg) {
+  const configured = cfg ? cfg[ONBOARDING_APPS_CONFIG_KEY] : undefined;
+  const list = configured === undefined || configured === null
+    ? [...DEFAULT_LOCAL_ONBOARDING_APPS]
+    : normalizeAppKeyList(configured);
+  const allowed = list.filter((key) => !CLI_BOOTSTRAPPED_APP_KEYS.includes(key));
+  return ['builder-api', ...allowed.filter((key) => key !== 'builder-api')];
+}
+
+/**
+ * Env values Builder owns for a locally installed application.
+ *
+ * @param {string} appName - Application key
+ * @param {Object} [cfg] - Parsed `~/.aifabrix/config.yaml`
+ * @returns {Object.<string, string>} Map to merge into resolved env content; empty when none apply
+ */
+function localEnvOverridesForApp(appName, cfg) {
+  const key = String(appName ?? '').trim().toLowerCase();
+  if (key === 'miso-controller') {
+    return {
+      ONBOARDING_APPS: resolveLocalOnboardingApps(cfg).join(','),
+      ...MISO_CONTROLLER_LOCAL_ONLY_ENV
+    };
+  }
+  if (key === 'builder-api' || key === 'integration-server') {
+    return { MISO_ENVIRONMENT: 'miso' };
+  }
+  return {};
+}
+
+/**
+ * Merge Builder-owned values into resolved env content for a locally installed application.
+ *
+ * Applied after the template is resolved, so the installation's choice is the authority for
+ * these keys. The merge function is passed in rather than imported, because the only caller
+ * owns it and importing it here would close a require cycle.
+ *
+ * @param {string} content - Resolved env content
+ * @param {string} appName - Application key
+ * @param {(content: string, map: Object) => string} mergeEnvMapIntoContent - Merge helper
+ * @returns {Promise<string>} Content with overrides merged, unchanged when none apply
+ */
+async function applyLocalEnvOverrides(content, appName, mergeEnvMapIntoContent) {
+  let cfg = null;
+  try {
+    cfg = await require('./config').getConfig();
+  } catch {
+    // No readable config (fresh machine, or resolve outside an installation): use defaults.
+  }
+  const overrides = localEnvOverridesForApp(appName, cfg);
+  if (!overrides || Object.keys(overrides).length === 0) {
+    return content;
+  }
+  return mergeEnvMapIntoContent(content, overrides);
+}
+
+/**
+ * The onboarding list for an installation that does or does not carry the integration
+ * server. Written to config so the choice survives, rather than being asked on every run.
+ *
+ * @param {boolean} integrationServer - Whether the installation carries it
+ * @returns {string[]} Value for the `onboardingApps` config key
+ */
+function onboardingAppsForIntegrationServer(integrationServer) {
+  return integrationServer ? ['builder-api', 'integration-server'] : ['builder-api'];
+}
+
+module.exports = {
+  CLI_BOOTSTRAPPED_APP_KEYS,
+  DEFAULT_LOCAL_ONBOARDING_APPS,
+  ONBOARDING_APPS_CONFIG_KEY,
+  MISO_CONTROLLER_LOCAL_ONLY_ENV,
+  resolveLocalOnboardingApps,
+  localEnvOverridesForApp,
+  applyLocalEnvOverrides,
+  onboardingAppsForIntegrationServer
+};

package/lib/core/secrets-ensure.js

@@ -29,6 +29,7 @@ const {
   saveSecretsFile
 } = require('../utils/secrets-generator');
 const { encryptSecret } = require('../utils/secrets-encryption');
+const { generateRsaSecretValues } = require('../parameters/rsa-secret-values');
 const { loadEnvTemplate } = require('../utils/secrets-helpers');
 const {
   buildInfraPlaceholderContext,
@@ -287,12 +288,13 @@ async function ensureSecretsForKeys(keys, options = {}) {
   if (toAdd.length === 0) return [];
 
   const encryptionKey = await config.getSecretsEncryptionKey();
+  const rsaValues = emptyForCredentials ? {} : generateRsaSecretValues(toAdd, { ...existing, ...suggested }, encryptionKey);
   const added = [];
 
   return addSecretsToFile({
     filePath: target.filePath,
-    toAdd,
-    suggested,
+    toAdd: [...new Set([...toAdd, ...Object.keys(rsaValues)])],
+    suggested: { ...rsaValues, ...suggested },
     emptyForCredentials,
     encryptionKey,
     added,

package/lib/core/secrets-env-content.js

@@ -12,6 +12,7 @@ const fs = require('fs');
 const path = require('path');
 const { resolveApplicationConfigPath } = require('../utils/app-config-resolver');
 const config = require('./config');
+const { applyLocalEnvOverrides } = require('./local-env-overrides');
 const {
   interpolateEnvVars,
   collectMissingSecrets,
@@ -40,8 +41,9 @@ const secretsEnsure = require('./secrets-ensure');
 const { resolveSecretsPath, getActualSecretsPath } = require('../utils/secrets-path');
 const pathsUtil = require('../utils/paths');
 const { readAppEnvironmentScopedFlagForAppPath } = require('../utils/app-scoped-config');
-const { computeEffectiveEnvironmentScopedResources, redisDbIndexForScopedRunEnv } = require('../utils/environment-scoped-resources');
-const { applyRedisDbIndexToEnvContent } = require('../utils/redis-env-scope');
+const { computeEffectiveEnvironmentScopedResources } = require('../utils/environment-scoped-resources');
+const { isStrictScopedEnvironment } = require('../utils/secrets-kv-scope');
+const { applyScopedRedisDbIndex } = require('../utils/redis-env-scope');
 const { expandDeclarativeUrlsIfPresent } = require('./secrets-env-declarative-expand');
 const {
   mergeAdditionalPublishedPorts,
@@ -106,7 +108,8 @@ async function resolveKvReferences(
         secretsFilePaths,
         appName,
         envTemplatePath,
-        envTemplate
+        envTemplate,
+        scopedKv
       })
     );
   }
@@ -237,12 +240,14 @@ async function generateEnvContent(appName, secretsPath, environment = 'local', f
   const variablesPath = (options && options.envOnly) ? null : resolveApplicationConfigPath(appPath);
   const template = loadEnvTemplate(templatePath);
   const secretsPaths = await getActualSecretsPath(secretsPath, appName);
-  if (force) {
+  const { runEnvKey, effective } = await buildScopedKvContext(appPath, options);
+  // --force backfills a missing secret by generating one. A strict environment must not be
+  // handed a value the Controller has never seen, so it errors on the missing key instead.
+  if (force && !isStrictScopedEnvironment(runEnvKey)) {
     const preferredPath = secretsPath ? resolveSecretsPath(secretsPath) : secretsPaths.userPath;
     await secretsEnsure.ensureSecretsFromEnvTemplate(templatePath, { preferredFilePath: preferredPath });
   }
   const secrets = await loadSecrets(secretsPath, appName);
-  const { runEnvKey, effective } = await buildScopedKvContext(appPath, options);
   let resolved = await resolveKvReferences(template, secrets, environment, secretsPaths, appName, {
     envKey: runEnvKey,
     effective,
@@ -262,10 +267,8 @@ async function generateEnvContent(appName, secretsPath, environment = 'local', f
     Boolean(options.envOnly)
   );
   resolved = await applyEnvironmentTransformations(resolved, environment, variablesPath);
-  if (effective) {
-    const idx = redisDbIndexForScopedRunEnv(runEnvKey);
-    resolved = applyRedisDbIndexToEnvContent(resolved, idx);
-  }
+  resolved = applyScopedRedisDbIndex(resolved, runEnvKey, effective);
+  resolved = await applyLocalEnvOverrides(resolved, appName, mergeEnvMapIntoContent);
 
   return resolved;
 }

package/lib/core/secrets-env-write.js

@@ -208,7 +208,7 @@ async function resolveAndGetEnvMap(appName, options = {}) {
     const adminSecrets = require('./admin-secrets');
     const { applyAdminSecretsPlatformOverlay } = require('./admin-secrets-env-overlay');
     const adminObj = await adminSecrets.readAndDecryptAdminSecrets();
-    applyAdminSecretsPlatformOverlay(map, adminObj);
+    applyAdminSecretsPlatformOverlay(map, adminObj, appName);
   } catch {
     // admin-secrets.env optional until up-infra/setup
   }

package/lib/datasource/capability/capability-manifest.js

@@ -9,6 +9,7 @@
 'use strict';
 
 const FORBIDDEN_ROOT_KEYS = new Set([
+  '_comManifestRoleCatalog',
   'context',
   'origin',
   'generatedBy',

package/lib/deployment/installation/index.js

@@ -6,8 +6,14 @@
  * All input validation happens before any filesystem, network or cloud mutation.
  */
 
-const { resolveStageInput, validateResourceGroupKey, ENVIRONMENT_STAGES } = require('./stage-input');
+const {
+  resolveStageInput,
+  validateResourceGroupKey,
+  validateStage,
+  ENVIRONMENT_STAGES
+} = require('./stage-input');
 const { openWorkspace } = require('./workspace');
+const { isLocalInstallationKey } = require('./local-installation');
 
 /**
  * Runs one installation workspace stage.
@@ -18,6 +24,13 @@ const { openWorkspace } = require('./workspace');
  */
 async function deployInstallationStage(resourceGroupKey, options, deps = {}) {
   const resourceGroup = validateResourceGroupKey(resourceGroupKey);
+  // A local installation owns its environments itself: no workspace, no Azure template and
+  // no Controller round trip. `register` still goes the shared route, because a local
+  // install registers with Mori exactly as any other does.
+  if (isLocalInstallationKey(resourceGroup) && ENVIRONMENT_STAGES.includes(validateStage(options.stage))) {
+    const { runLocalEnvironmentStage } = require('./local-environment-stage');
+    return runLocalEnvironmentStage(resourceGroup, validateStage(options.stage), deps);
+  }
   const workspace = openWorkspace(resourceGroup, { root: deps.root });
   const input = resolveStageInput(resourceGroup, options, workspace.infra?.vendor?.value);
   const base = { stage: input.stage, vendor: input.vendor, workspaceDir: workspace.dir };

package/lib/deployment/installation/infra-catalog.js

@@ -88,6 +88,7 @@ const PARAMETER_CATALOG = Object.freeze({
   enablePostgresPublicAccess: { kind: 'allowMyIp', source: 'allowMyIp', description: 'Default off; enabled only while allowMyIp grants the validated caller IPv4 /32 for testing.' },
   allowedIPs: { kind: 'allowMyIp', source: 'allowMyIpOrUser', description: 'Explicit CIDRs for PostgreSQL, Key Vault, and Storage; allowMyIp merges the resolved caller IPv4 /32.' },
   adminPassword: { kind: 'secretEnv', env: 'ADMIN_PASSWORD', required: true, description: 'Installation administrator password.' },
+  adminEmail: { kind: 'file', source: 'user', required: true, description: 'Email of the initial platform administrator, used for the installation welcome. Required: the template sets no default and enforces minLength.' },
   deploymentEnvironment: { kind: 'file', source: 'templateDefault', description: 'Vendor deployment profile.' },
   keycloakVerifyAudience: { kind: 'file', source: 'templateDefault', description: 'Enable Keycloak audience verification.' },
   encryptionKey: { kind: 'secretEnv', env: 'ENCRYPTION_KEY', required: true, description: 'Application/data encryption key.' },
@@ -99,11 +100,13 @@ const PARAMETER_CATALOG = Object.freeze({
   deployRegistryRoleAssignment: { kind: 'parameterDefault', defaultFrom: 'deployRoleAssignments', source: 'templateDefault', description: 'Deploy the AcrPull grant on the container registry. False while credential image pull is in effect, because that grant lives in the registry resource group, which a customer installation cannot reach; restored for managed identity.' },
   moriBaseUrl: { kind: 'file', source: 'registration', required: true, description: 'Mori service base URL.' },
   moriLicensePublicKey: { kind: 'file', source: 'registration', required: false, description: 'Mori licence issuer public key (SPKI PEM); empty leaves the installation unpinned and it then refuses every licence.' },
+  moriPolicyPublicKey: { kind: 'file', source: 'registration', required: false, description: 'Mori policy signing anchor (SPKI PEM), a different pair from the licence key; empty leaves the policy bundle checkable only against the key it carries, which proves nothing.' },
   moriLicenseIssuer: { kind: 'file', source: 'registration', required: false, description: 'Expected iss claim on a Mori licence.' },
   entraIdClientId: { kind: 'deferred', description: 'Not collected or sent by infra; issued/configured during later Entra provider onboarding.' },
   entraIdClientSecret: { kind: 'deferred', description: 'Not collected or sent by infra; issued/configured during later Entra provider onboarding.' },
   entraIdTenantId: { kind: 'deferred', description: 'Customer Entra provider tenant; distinct from the Azure subscription directory tenant and configured later.' },
   licenseEdition: { kind: 'license', source: 'cliOrFile', description: 'License requested from Mori during tenant activation: COMMUNITY, STANDARD or ENTERPRISE, or an Azure Marketplace subscription ID. Standard/Enterprise by name is a 30-day evaluation.' },
+  installationResourceModel: { kind: 'file', source: 'templateDefault', description: 'Initial installation topology: shared for Community and Standard, dedicated for Enterprise DEV. Defaults to shared and is protected by Azure application configuration. It records the topology the installation starts in and grants no later licence entitlement, so it is not a licence input.' },
   onboardingMode: { kind: 'onboarding', source: 'workspacePolicy', description: 'Miso onboarding mode (ONBOARDING_MODE); Builder installations use saasDirect, Marketplace customer installations use customerOwned.' },
   capacityProfile: { kind: 'capacity', source: 'workspacePreset', description: 'Infrastructure sizing profile (s, m, l, xl) selecting compute and PostgreSQL SKUs. Derived from the workspace preset so the two cannot drift; set it with --preset.' },
   misoImageTag: { kind: 'file', source: 'templateDefault', description: 'Miso container image tag.' },