@aifabrix/builder 2.62.0 → 2.63.0

package/lib/api/onboarding-status.api.js

@@ -0,0 +1,117 @@
+/**
+ * Read the public Miso required-baseline onboarding projection.
+ *
+ * @fileoverview Public Miso onboarding readiness client
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { ApiClient } = require('./index');
+
+const ENDPOINT = '/api/v1/health/onboarding-status';
+const PROJECTION_KEYS = ['code', 'retryable', 'state'];
+const VALID_PROJECTIONS = new Set([
+  'pending|null|true',
+  'complete|null|false',
+  'incomplete|baseline-dimensions-incomplete|true',
+  'incomplete|baseline-roles-incomplete|true'
+]);
+const VALID_PAIRS = new Set([
+  'pending|null|true::pending|null|true',
+  'incomplete|baseline-dimensions-incomplete|true::pending|null|true',
+  'complete|null|false::pending|null|true',
+  'complete|null|false::incomplete|baseline-roles-incomplete|true',
+  'complete|null|false::complete|null|false'
+]);
+
+function onboardingStatusError(message, code = 'MISO_ONBOARDING_STATUS_INVALID') {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function projectionSignature(projection) {
+  return `${projection.state}|${projection.code === null ? 'null' : projection.code}|${projection.retryable}`;
+}
+
+function hasValidProjectionTypes(projection) {
+  return typeof projection.state === 'string' &&
+    (projection.code === null || typeof projection.code === 'string') &&
+    typeof projection.retryable === 'boolean';
+}
+
+function parseProjection(value, name) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw onboardingStatusError(`Miso ${name} readiness projection is missing or malformed.`);
+  }
+  const keys = Object.keys(value).sort();
+  if (keys.length !== PROJECTION_KEYS.length || keys.some((key, index) => key !== PROJECTION_KEYS[index])) {
+    throw onboardingStatusError(`Miso ${name} readiness projection has unsupported fields.`);
+  }
+  const projection = { state: value.state, code: value.code, retryable: value.retryable };
+  if (!hasValidProjectionTypes(projection)) {
+    throw onboardingStatusError(`Miso ${name} readiness projection has invalid field types.`);
+  }
+  if (!VALID_PROJECTIONS.has(projectionSignature(projection))) {
+    throw onboardingStatusError(`Miso ${name} readiness projection has an unsupported state.`);
+  }
+  return Object.freeze(projection);
+}
+
+function parseOnboardingStatusResponse(response) {
+  if (!response || response.success !== true || response.status !== 200) {
+    throw onboardingStatusError(
+      'Miso onboarding readiness is unavailable.',
+      'MISO_ONBOARDING_STATUS_UNAVAILABLE'
+    );
+  }
+  const wireBody = response.data;
+  if (!wireBody || typeof wireBody !== 'object' || Array.isArray(wireBody) ||
+      Object.prototype.hasOwnProperty.call(wireBody, 'success')) {
+    throw onboardingStatusError('Miso onboarding readiness response envelope is malformed.');
+  }
+  const data = wireBody.data;
+  if (!data || typeof data !== 'object' || Array.isArray(data) ||
+      Object.prototype.hasOwnProperty.call(data, 'success')) {
+    throw onboardingStatusError('Miso onboarding readiness data envelope is malformed.');
+  }
+  const baselineDimensions = parseProjection(data.baselineDimensions, 'Dimension');
+  const baselineRoles = parseProjection(data.baselineRoles, 'Business Role');
+  const pair = `${projectionSignature(baselineDimensions)}::${projectionSignature(baselineRoles)}`;
+  if (!VALID_PAIRS.has(pair)) {
+    throw onboardingStatusError('Miso onboarding readiness contains an unsupported step ordering.');
+  }
+  return Object.freeze({ baselineDimensions, baselineRoles });
+}
+
+/**
+ * Fetch required-baseline readiness from Miso Controller.
+ * GET /api/v1/health/onboarding-status
+ * @requiresPermission {Controller} Public
+ * @param {string} controllerUrl
+ * @param {{timeoutMs?: number, client?: ApiClient}} [options]
+ * @returns {Promise<{baselineDimensions: Object, baselineRoles: Object}>}
+ */
+async function fetchOnboardingStatus(controllerUrl, options = {}) {
+  const client = options.client || new ApiClient(controllerUrl);
+  const requestOptions = {};
+  if (options.timeoutMs !== undefined) requestOptions.timeoutMs = options.timeoutMs;
+  let response;
+  try {
+    response = await client.get(ENDPOINT, requestOptions);
+  } catch {
+    throw onboardingStatusError(
+      'Miso onboarding readiness request failed.',
+      'MISO_ONBOARDING_STATUS_UNAVAILABLE'
+    );
+  }
+  return parseOnboardingStatusResponse(response);
+}
+
+module.exports = {
+  ENDPOINT,
+  fetchOnboardingStatus,
+  parseOnboardingStatusResponse
+};

package/lib/app/register.js

@@ -28,6 +28,24 @@ const { refreshUrlsLocalRegistryFromBuilder } = require('../utils/urls-local-reg
 const { resolveControllerUrl } = require('../utils/controller-url');
 const config = require('../core/config');
 
+/**
+ * Handle local credential persistence failure without exposing details in strict mode.
+ * @param {Error} error
+ * @param {boolean} required
+ * @returns {false}
+ */
+function handleCredentialPersistenceFailure(error, required) {
+  if (required) {
+    const persistenceError = new Error(
+      'Application credentials could not be saved to the supported local secret store.'
+    );
+    persistenceError.code = 'LOCAL_CREDENTIAL_PERSISTENCE_FAILED';
+    throw persistenceError;
+  }
+  logger.warn(chalk.yellow(`⚠  Could not save credentials locally: ${error.message}`));
+  return false;
+}
+
 /**
  * Build registration data payload from app configuration
  * @param {Object} appConfig - Application configuration
@@ -83,8 +101,11 @@ function buildRegistrationData(appConfig, options) {
  * @async
  * @param {Object} responseData - Registration response data
  * @param {string} apiUrl - API URL
+ * @param {Object} [options] - Persistence behavior
+ * @param {boolean} [options.required=false] - Throw a safe typed error when persistence fails
+ * @returns {Promise<boolean>} True when credentials were persisted
  */
-async function saveLocalCredentials(responseData, apiUrl) {
+async function saveLocalCredentials(responseData, apiUrl, options = {}) {
   const registeredAppKey = responseData.application.key;
   const clientIdKey = `${registeredAppKey}-client-idKeyVault`;
   const clientSecretKey = `${registeredAppKey}-client-secretKeyVault`;
@@ -113,8 +134,9 @@ async function saveLocalCredentials(responseData, apiUrl) {
       logger.log(formatSuccessParagraph('Credentials saved to ~/.aifabrix/secrets.local.yaml\n'));
     }
   } catch (error) {
-    logger.warn(chalk.yellow(`⚠  Could not save credentials locally: ${error.message}`));
+    return handleCredentialPersistenceFailure(error, options.required === true);
   }
+  return true;
 }
 
 /**

package/lib/app/run-env-compose.js

@@ -20,6 +20,11 @@ const secretsEnsure = require('../core/secrets-ensure');
 const secretsEnvWrite = require('../core/secrets-env-write');
 const { getContainerPort } = require('../utils/port-resolver');
 const { applyAdminSecretsPlatformOverlay } = require('../core/admin-secrets-env-overlay');
+const {
+  resolveDimensionAbacSetting,
+  applyDimensionAbacToEnvMap
+} = require('../utils/dataplane-dimension-abac-setting');
+const { resolveEffectiveRegistry } = require('../utils/resolve-docker-image-ref');
 
 /**
  * Merge app env with admin-secrets; overlay ensures platform keys come from admin file.
@@ -38,6 +43,13 @@ async function applyOnboardingPlatformModeIfNeeded(appName, merged) {
   merged.ONBOARDING_FULL_PLATFORM = mode === 'full' ? 'true' : 'false';
 }
 
+async function applyDimensionAbacSettingIfNeeded(appName, merged) {
+  if (appName !== 'dataplane') return;
+  const userConfig = await config.getConfig();
+  const resolved = resolveDimensionAbacSetting(userConfig);
+  applyDimensionAbacToEnvMap(appName, merged, resolved.value);
+}
+
 /**
  * Backfill only secrets needed for `aifabrix run <app>`: kv:// keys from that app's env.template
  * (catalog defaults via placeholderContext). Does not run full `ensureInfraSecrets`.
@@ -260,6 +272,29 @@ async function applyPostgresPasswordFromPgpass(merged, developerId) {
   if (pgpassPwd !== undefined) merged.POSTGRES_PASSWORD = pgpassPwd;
 }
 
+/**
+ * Deliver existing local installation inputs to privileged Miso bootstrap only.
+ * @param {string} appName
+ * @param {Object} merged
+ * @param {Object} appConfig
+ * @param {Object|null} scopeOpts
+ */
+function applyMisoBootstrapInputsIfNeeded(appName, merged, appConfig, scopeOpts) {
+  if (appName !== 'miso-controller') return;
+  const postgresPassword = merged.POSTGRES_PASSWORD;
+  if (typeof postgresPassword !== 'string' || postgresPassword.trim().length === 0) {
+    throw new Error(
+      'Local PostgreSQL administrator password is unavailable. Re-run "aifabrix up-infra" before starting Miso Controller.'
+    );
+  }
+  merged.POSTGRES_ADMIN_PASSWORD = postgresPassword;
+  const { registry } = resolveEffectiveRegistry(appConfig, {
+    registry: scopeOpts?.registry
+  });
+  if (registry) merged.ACR_LOGIN_SERVER = registry;
+  else delete merged.ACR_LOGIN_SERVER;
+}
+
 /**
  * @param {string} runEnvPath
  * @param {string} runEnvAdminPath
@@ -300,8 +335,10 @@ async function buildMergedRunEnvAndWrite(appName, appConfig, devDir, developerId
   mergeRunEnvWithAdminOverlay(merged, adminObj, appName);
   await applyOnboardingPlatformModeIfNeeded(appName, merged);
   await applyPostgresPasswordFromPgpass(merged, developerId);
+  applyMisoBootstrapInputsIfNeeded(appName, merged, appConfig, scopeOpts);
   injectDatabaseNamesAndUsers(merged, appConfig, scopeOpts);
   injectContainerPortForRun(merged, appConfig, appName);
+  await applyDimensionAbacSettingIfNeeded(appName, merged);
 
   const runEnvPath = path.join(devDir, '.env.run');
   const runEnvAdminPath = path.join(devDir, '.env.run.admin');
@@ -351,9 +388,9 @@ async function ensureRunEnvFilesPresent(
  * @throws {Error} If password keys appear in environment-like assignment
  */
 function assertNoPasswordLiteralsInCompose(composeContent) {
-  const badPattern = /\n\s+(-?\s*)(POSTGRES_PASSWORD|DB_\d+_PASSWORD)\s*[:=]/;
+  const badPattern = /\n\s+(-?\s*)(POSTGRES_PASSWORD|POSTGRES_ADMIN_PASSWORD|DB_\d+_PASSWORD)\s*[:=]/;
   if (badPattern.test(composeContent)) {
-    throw new Error('Generated compose must not contain password literals (POSTGRES_PASSWORD, DB_*_PASSWORD). Use env_file only.');
+    throw new Error('Generated compose must not contain password literals (PostgreSQL or application database passwords). Use env_file only.');
   }
 }
 

package/lib/app/run-env-recovery.js

@@ -26,6 +26,7 @@ function buildRunEnvRecovery(appName, prepared) {
       prepared.appConfig.developerId,
       {
         runEnvKey: prepared.mergedRunOptions.env,
+        registry: prepared.mergedRunOptions.registry,
         effectiveEnvironmentScopedResources:
           prepared.mergedRunOptions.effectiveEnvironmentScopedResources
       }

package/lib/app/run-helpers.js

@@ -366,7 +366,7 @@ async function prepareEnvironment(appName, appConfig, options) {
     appConfig,
     devDir,
     developerId,
-    { runEnvKey, effectiveEnvironmentScopedResources }
+    { runEnvKey, effectiveEnvironmentScopedResources, registry: options.registry }
   );
   const { hydrateMissingLocalParameters } = require('./run-parameter-sync');
   await hydrateMissingLocalParameters(appName, runEnvPath);

package/lib/cli/infra-guided.js

@@ -49,6 +49,34 @@ const {
   emitSystemBuilderAppManifestLineIfTTY
 } = require('../utils/manifest-source-emit');
 const { flushDeferredPublicUrlWarnings } = require('./infra-guided-public-url-warn');
+const { fetchOnboardingStatus } = require('../api/onboarding-status.api');
+const {
+  waitForRequiredBaselineReadiness
+} = require('../commands/setup-onboarding-readiness');
+
+async function runRequiredBaselineReadinessIfNeeded(options, authOpts) {
+  if (!options || options.requireBaselineReadiness !== true) return;
+  const controllerUrl = await resolveGuidedAuthControllerUrl(authOpts);
+  const spin = startSpinner('Waiting for required Miso baseline onboarding...');
+  const onProgress = createSpinnerTextUpdater(spin);
+  try {
+    await waitForRequiredBaselineReadiness({
+      request: requestOptions => fetchOnboardingStatus(controllerUrl, requestOptions),
+      onProgress
+    });
+  } catch (error) {
+    if (spin && typeof spin.fail === 'function') spin.fail('Miso baseline onboarding not ready');
+    throw error;
+  }
+  stopSpinnerSuccess(spin, 'Miso baseline onboarding ready');
+  logger.log('');
+}
+
+async function runGuidedMisoAndReadinessPhase(options, handleUpMiso, authOpts) {
+  await withMutedLogger(() => prepareUrlsLocalRegistryForUpPlatform());
+  await runGuidedKeycloakAndMisoControllerPhase(options, handleUpMiso);
+  await runRequiredBaselineReadinessIfNeeded(options, authOpts);
+}
 
 /**
  * Guided Keycloak → Miso Controller start with one spinner per app (no second health wait).
@@ -327,8 +355,7 @@ async function runGuidedUpPlatform(options, handleUpMiso, handleUpDataplane, han
     skipLoginIfAuthenticated: options && options.skipLoginIfAuthenticated === true
   };
 
-  await withMutedLogger(() => prepareUrlsLocalRegistryForUpPlatform());
-  await runGuidedKeycloakAndMisoControllerPhase(options, handleUpMiso);
+  await runGuidedMisoAndReadinessPhase(options, handleUpMiso, authOpts);
   await runGuidedKeycloakRealmPhase(options);
   await runGuidedAuthStep(handleLogin, authOpts, { startSpinner, stopSpinnerSuccess });
   const controllerUrl = await resolveGuidedAuthControllerUrl(authOpts);
@@ -388,6 +415,7 @@ module.exports = {
   runGuidedUpMiso,
   runGuidedUpDataplane,
   runGuidedUpPlatform,
+  runRequiredBaselineReadinessIfNeeded,
   runGuidedDownInfra,
   stripHealthPrefix
 };

package/lib/cli/setup-platform.js

@@ -4,7 +4,7 @@
  * `setup` is the one-shot platform installer. When no infrastructure is
  * detected it runs a small wizard (admin email/password, AI tool keys) and
  * then `up-infra` + `up-platform`. When infra is already up, it offers a
- * mode menu (re-install, wipe data, clean install files, update images).
+ * mode menu (re-install, wipe data, update images).
  *
  * `teardown` is the symmetrical inverse of `setup`: `down-infra -v` plus a
  * full clean of the AI Fabrix system directory (everything except
@@ -20,6 +20,7 @@
 const { handleCommandError } = require('../utils/cli-utils');
 const { handleSetup } = require('../commands/setup');
 const { handleTeardown } = require('../commands/teardown');
+const { parseDimensionAbacOption } = require('../utils/dataplane-dimension-abac-setting');
 
 const SETUP_HELP_AFTER = `
 What this command does:
@@ -27,16 +28,25 @@ What this command does:
   - With infra running: shows a mode menu:
       1) Re-install — stop infra and remove all volumes, then up-infra + up-platform --force.
       2) Wipe data — drop every database and DB user, then up-infra + up-platform --force.
-      3) Clean installation files — remove user-local secrets, then up-infra + up-platform --force.
-      4) Update images — pull the latest infra and platform images, then up-infra + up-platform.
+      3) Update images — pull the latest infra and platform images, then up-infra + up-platform.
   - With --mode fresh: first-time install when no infra is running (non-interactive; use with --admin-email and --admin-password).
   - With --mode update-images: refresh images when infra is already running (non-interactive).
 
 AI tool keys are read from the user-local file (~/.aifabrix/secrets.local.yaml) merged with the shared aifabrix-secrets file. If either source already provides keys, the AI tool prompt is skipped.
 
+Dimension ABAC defaults to off. Use --dimension-abac on|off to persist an explicit Dataplane selection. The saved selection is reused by later setup and redeploy flows; changing it takes effect after the normal Dataplane restart/redeploy boundary.
+
 Use 'aifabrix teardown' to fully remove the local installation.
 `;
 
+function parseRepeatedDimensionAbacOption(raw, previous) {
+  const value = parseDimensionAbacOption(raw);
+  if (previous !== undefined && previous !== value) {
+    throw new Error('Conflicting --dimension-abac values. Supply only on or only off.');
+  }
+  return value;
+}
+
 const TEARDOWN_HELP_AFTER = `
 What this command does:
   - Runs down-infra -v (stops all infra + apps, removes every Docker volume).
@@ -64,6 +74,11 @@ function registerSetup(program) {
     .option('--integration-server', 'Install the integration server (runs once in the miso environment)')
     .option('--no-integration-server', 'Do not install the integration server (default)')
     .option('--mode <mode>', 'Non-interactive mode: fresh (no infra) or update-images (infra running)')
+    .option(
+      '--dimension-abac <off|on>',
+      'Persist Dataplane Dimension ABAC selection (default: off)',
+      parseRepeatedDimensionAbacOption
+    )
     .option('-y, --yes', 'Skip destructive confirmation prompts (re-install, wipe data, teardown)')
     .addHelpText('after', SETUP_HELP_AFTER)
     .action(async(options) => {

package/lib/commands/setup-modes.js

@@ -296,7 +296,8 @@ async function runUpPlatform(opts = {}) {
         base: true,
         platformControllerUrl: authCtx.platformControllerUrl,
         skipLoginIfAuthenticated: authCtx.skipLoginIfAuthenticated,
-        requireKeycloakRealm: opts.requireKeycloakRealm === true
+        requireKeycloakRealm: opts.requireKeycloakRealm === true,
+        requireBaselineReadiness: true
       },
       upMiso.handleUpMiso,
       upDataplane.handleUpDataplane,

package/lib/commands/setup-onboarding-readiness.js

@@ -0,0 +1,83 @@
+/**
+ * Bounded observer for required Miso baseline onboarding.
+ *
+ * @fileoverview Setup-only Miso baseline readiness observer
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { performance } = require('node:perf_hooks');
+
+const DEFAULT_INTERVAL_MS = 2000;
+const DEFAULT_REQUEST_TIMEOUT_MS = 5000;
+const DEFAULT_DEADLINE_MS = 90000;
+
+function monotonicNow() {
+  return performance.now();
+}
+
+function readinessError(message, code) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function classifyReadiness(snapshot) {
+  const dimensions = snapshot.baselineDimensions;
+  const roles = snapshot.baselineRoles;
+  if (dimensions.state === 'incomplete') {
+    throw readinessError(
+      `Required baseline Dimensions are incomplete (${dimensions.code}). Retry setup after reconciliation completes.`,
+      dimensions.code
+    );
+  }
+  if (roles.state === 'incomplete') {
+    throw readinessError(
+      `Required baseline Business Roles are incomplete (${roles.code}). Retry setup after reconciliation completes.`,
+      roles.code
+    );
+  }
+  if (dimensions.state === 'complete' && roles.state === 'complete') return 'complete';
+  return dimensions.state === 'pending' ? 'dimensions' : 'roles';
+}
+
+function timeoutError() {
+  return readinessError(
+    'Timed out waiting for required Miso baseline onboarding. Retry setup after reconciliation completes.',
+    'MISO_BASELINE_READINESS_TIMEOUT'
+  );
+}
+
+async function waitForRequiredBaselineReadiness(options) {
+  const request = options.request;
+  const now = options.now || monotonicNow;
+  const sleep = options.sleep || (ms => new Promise(resolve => setTimeout(resolve, ms)));
+  const onProgress = options.onProgress || (() => {});
+  const intervalMs = options.intervalMs ?? DEFAULT_INTERVAL_MS;
+  const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  const deadlineMs = options.deadlineMs ?? DEFAULT_DEADLINE_MS;
+  const startedAt = now();
+  while (now() - startedAt < deadlineMs) {
+    const remaining = deadlineMs - (now() - startedAt);
+    if (remaining <= 0) throw timeoutError();
+    const snapshot = await request({ timeoutMs: Math.min(requestTimeoutMs, remaining) });
+    const state = classifyReadiness(snapshot);
+    if (state === 'complete') return snapshot;
+    onProgress(state === 'dimensions'
+      ? 'Waiting for required baseline Dimensions...'
+      : 'Waiting for required baseline Business Roles...');
+    const afterRequest = deadlineMs - (now() - startedAt);
+    if (afterRequest <= 0) throw timeoutError();
+    await sleep(Math.min(intervalMs, afterRequest));
+  }
+  throw timeoutError();
+}
+
+module.exports = {
+  DEFAULT_INTERVAL_MS,
+  DEFAULT_REQUEST_TIMEOUT_MS,
+  DEFAULT_DEADLINE_MS,
+  waitForRequiredBaselineReadiness
+};

package/lib/commands/setup.js

@@ -36,6 +36,11 @@ const setupModes = require('./setup-modes');
 const { syncPlatformControllerUrlsInConfig } = require('./setup-platform-auth');
 const installationLog = require('../utils/installation-log');
 const { beginSetupCommandFlow, endSetupCommandFlow } = require('./setup-run-context');
+const {
+  parseDimensionAbacOption,
+  resolveDimensionAbacSetting,
+  persistExplicitDimensionAbacSetting
+} = require('../utils/dataplane-dimension-abac-setting');
 
 const MODE = setupPrompts.MODE;
 
@@ -87,7 +92,20 @@ function normalizeCliMode(options) {
  * @param {'fresh'|'update-images'} cliMode
  * @returns {Promise<{ outcome: string, setupMode: string }>}
  */
-async function runSetupWithCliMode(options, cliMode) {
+async function persistDimensionAbacSelection(settingContext) {
+  await persistExplicitDimensionAbacSetting(config, settingContext.explicitValue);
+}
+
+async function prepareDimensionAbacSetting(options) {
+  const explicitValue = parseDimensionAbacOption(options.dimensionAbac);
+  const userConfig = await config.getConfig();
+  const resolved = resolveDimensionAbacSetting(userConfig, explicitValue);
+  const displayValue = resolved.value ? 'on' : 'off';
+  logger.log(infoLine(`Dimension ABAC: ${displayValue} (${resolved.source}).`));
+  return { explicitValue, ...resolved };
+}
+
+async function runSetupWithCliMode(options, cliMode, settingContext) {
   logSetupHeader();
   logger.log(formatProgress('Detecting current installation state...'));
   const running = await isInfraRunning();
@@ -97,12 +115,13 @@ async function runSetupWithCliMode(options, cliMode) {
         'Infrastructure is already running; use --mode update-images or run teardown first.'
       );
     }
-    await runFreshInstallFlow(options);
+    await runFreshInstallFlow(options, settingContext);
     return { outcome: 'success', setupMode: CLI_SETUP_MODES.FRESH };
   }
   if (!running) {
     throw new Error('No infrastructure running; use --mode fresh for first-time install.');
   }
+  await persistDimensionAbacSelection(settingContext);
   await dispatchMode(MODE.UPDATE_IMAGES);
   logger.log(formatSuccessParagraph(`aifabrix setup complete (mode: ${cliMode}).`));
   return { outcome: 'success', setupMode: cliMode };
@@ -120,12 +139,13 @@ async function applySetupPlatformMode(options) {
   return mode;
 }
 
-async function runFreshInstallFlow(options) {
+async function runFreshInstallFlow(options, settingContext) {
   await maybePinDeveloperIdForFreshInstall(options.developer);
   logger.log(infoLine('No infrastructure detected; starting fresh install.'));
   await applySetupPlatformMode(options);
   const adminCreds = await setupPrompts.promptAdminCredentials(options);
   await config.setAdminEmail(adminCreds.adminEmail);
+  await persistDimensionAbacSelection(settingContext);
   await setupModes.runFreshInstall(adminCreds);
   logger.log(formatSuccessParagraph('aifabrix setup complete (fresh install).'));
 }
@@ -134,7 +154,7 @@ async function runFreshInstallFlow(options) {
  * @param {boolean} assumeYes
  * @returns {Promise<{ aborted: boolean, mode: string|null }>}
  */
-async function runExistingInfraFlow(assumeYes) {
+async function runExistingInfraFlow(assumeYes, settingContext) {
   const mode = await setupPrompts.promptModeSelection();
   const proceed = await setupPrompts.confirmDestructiveMode(mode, assumeYes);
   if (!proceed) {
@@ -145,6 +165,7 @@ async function runExistingInfraFlow(assumeYes) {
   if (mode === MODE.REINSTALL || mode === MODE.WIPE_DATA) {
     await applySetupPlatformMode({});
   }
+  await persistDimensionAbacSelection(settingContext);
   await dispatchMode(mode);
   logger.log(formatSuccessParagraph(`aifabrix setup complete (mode: ${mode}).`));
   return { aborted: false, mode };
@@ -197,20 +218,19 @@ async function dispatchMode(mode) {
  * @param {boolean} assumeYes
  * @returns {Promise<{ outcome: string, setupMode: string|null }>}
  */
-async function runSetupMainPath(options, assumeYes) {
-  const cliMode = normalizeCliMode(options);
+async function runSetupMainPath(options, assumeYes, cliMode, settingContext) {
   if (cliMode) {
-    return runSetupWithCliMode(options, cliMode);
+    return runSetupWithCliMode(options, cliMode, settingContext);
   }
 
   logSetupHeader();
   logger.log(formatProgress('Detecting current installation state...'));
   const running = await isInfraRunning();
   if (!running) {
-    await runFreshInstallFlow(options);
+    await runFreshInstallFlow(options, settingContext);
     return { outcome: 'success', setupMode: 'fresh' };
   }
-  const r = await runExistingInfraFlow(assumeYes);
+  const r = await runExistingInfraFlow(assumeYes, settingContext);
   const outcome = r.aborted ? 'aborted' : 'success';
   return { outcome, setupMode: r.mode };
 }
@@ -300,7 +320,9 @@ async function handleSetup(options = {}) {
 
   beginSetupCommandFlow();
   try {
-    const main = await runSetupMainPath(options, assumeYes);
+    const cliMode = normalizeCliMode(options);
+    const settingContext = await prepareDimensionAbacSetting(options);
+    const main = await runSetupMainPath(options, assumeYes, cliMode, settingContext);
     outcome = main.outcome;
     setupMode = main.setupMode;
   } catch (e) {

package/lib/commands/up-dataplane-bootstrap.js

@@ -19,6 +19,11 @@ const {
   extractAppConfiguration
 } = require('../utils/app-register-config');
 const { buildRegistrationData, saveLocalCredentials, applyLocalhostPortAdjustment } = require('../app/register');
+const {
+  loadDataplanePipelineCredentialsFromSecretsFile,
+  credentialsAcceptToken,
+  waitForDataplaneCredentials
+} = require('./up-dataplane-credentials');
 const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 const { getToken } = require('../api/auth.api');
 const { updateApplicationSelfStatus } = require('../api/applications.api');
@@ -31,6 +36,111 @@ const ENCRYPTION_VAULT_KEYS = [
   'secrets-encryptionKeyVault'
 ];
 
+const BOOTSTRAP_CREDENTIAL_ERROR_CODE = 'DATAPLANE_BOOTSTRAP_CREDENTIALS_UNAVAILABLE';
+
+/**
+ * Create a stable, secret-safe bootstrap credential error.
+ * @param {string} message
+ * @returns {Error}
+ */
+function createBootstrapCredentialError(message) {
+  const error = new Error(message);
+  error.code = BOOTSTRAP_CREDENTIAL_ERROR_CODE;
+  return error;
+}
+
+/**
+ * @param {Object|null|undefined} credentials
+ * @returns {boolean}
+ */
+function hasUsablePipelineCredentials(credentials) {
+  return Boolean(
+    credentials &&
+    typeof credentials.clientId === 'string' && credentials.clientId.trim() &&
+    typeof credentials.clientSecret === 'string' && credentials.clientSecret.trim()
+  );
+}
+
+/**
+ * Persist newly issued credentials and prove they can be loaded before deployment.
+ * @async
+ * @param {Object} responseData
+ * @param {string} controllerUrl
+ * @param {string} environmentKey
+ * @param {number} containerPort
+ * @returns {Promise<{status: string, credentialsAvailable: true}>}
+ */
+async function persistBootstrapCredentials(responseData, controllerUrl, environmentKey, containerPort) {
+  try {
+    await saveLocalCredentials(responseData, controllerUrl, { required: true });
+  } catch {
+    throw createBootstrapCredentialError(
+      'Dataplane bootstrap credentials could not be persisted locally; deployment was not started.'
+    );
+  }
+  const localCredentials = await loadDataplanePipelineCredentialsFromSecretsFile();
+  if (!hasUsablePipelineCredentials(localCredentials)) {
+    throw createBootstrapCredentialError(
+      'Dataplane bootstrap credentials are not available from the supported local secret store; ' +
+        'deployment was not started.'
+    );
+  }
+  await syncDataplaneApplicationUrls(
+    controllerUrl,
+    environmentKey,
+    responseData.credentials,
+    containerPort
+  );
+  if (!(await waitForDataplaneCredentials(controllerUrl))) {
+    throw createBootstrapCredentialError(
+      'Dataplane bootstrap credentials were issued but the controller did not accept them in time. ' +
+        'Deployment was not started; retry the command after checking the controller token endpoint.'
+    );
+  }
+  logger.log(formatSuccessLine('Dataplane bootstrap credentials saved locally'));
+  return { status: 'provisioned', credentialsAvailable: true };
+}
+
+/**
+ * Require existing supported local credentials for an idempotent response.
+ * @async
+ * @returns {Promise<{status: string, credentialsAvailable: true}>}
+ */
+async function acceptAlreadyProvisionedDataplane(controllerUrl) {
+  const localCredentials = await loadDataplanePipelineCredentialsFromSecretsFile();
+  const accepted = hasUsablePipelineCredentials(localCredentials) &&
+    await credentialsAcceptToken(controllerUrl);
+  if (!accepted) {
+    throw createBootstrapCredentialError(
+      'Dataplane is registered on the controller but pipeline credentials are missing locally. ' +
+        'Use an authorized session to run: aifabrix app rotate-secret dataplane, then retry setup.'
+    );
+  }
+  logger.log(formatSuccessLine('Dataplane already provisioned (bootstrap idempotent)'));
+  return { status: 'already_provisioned', credentialsAvailable: true };
+}
+
+/**
+ * @async
+ * @param {Object} responseData
+ * @param {string} controllerUrl
+ * @param {string} environmentKey
+ * @param {number} containerPort
+ * @returns {Promise<{status: string, credentialsAvailable: true}>}
+ */
+async function handleBootstrapResponse(responseData, controllerUrl, environmentKey, containerPort) {
+  if (hasUsablePipelineCredentials(responseData.credentials)) {
+    return persistBootstrapCredentials(responseData, controllerUrl, environmentKey, containerPort);
+  }
+  if (responseData.status === 'already_provisioned') {
+    return acceptAlreadyProvisionedDataplane(controllerUrl);
+  }
+  throw createBootstrapCredentialError(
+    'Dataplane bootstrap returned no usable credentials or supported already-provisioned status; ' +
+      'deployment was not started.'
+  );
+}
+
 /**
  * @param {Record<string, unknown>} secrets
  * @returns {string|null}
@@ -118,41 +228,6 @@ async function syncDataplaneApplicationUrls(controllerUrl, environmentKey, crede
   }
 }
 
-async function handleBootstrapResponse(responseData, controllerUrl, environmentKey, containerPort) {
-  if (responseData.credentials && responseData.credentials.clientSecret) {
-    await saveLocalCredentials(responseData, controllerUrl);
-    await syncDataplaneApplicationUrls(
-      controllerUrl,
-      environmentKey,
-      responseData.credentials,
-      containerPort
-    );
-    logger.log(formatSuccessLine('Dataplane bootstrap credentials saved locally'));
-    const { waitForDataplaneCredentials } = require('./up-dataplane-credentials');
-    if (!(await waitForDataplaneCredentials(controllerUrl))) {
-      throw new Error(
-        'Dataplane bootstrap credentials were issued but the controller did not accept them in time. ' +
-        'The deploy that follows gets one attempt, so it would fail with a less specific error. ' +
-        'Retry the command; if it persists, check the controller is serving /api/v1/auth/token.'
-      );
-    }
-    return;
-  }
-  if (responseData.status === 'already_provisioned') {
-    logger.log(formatSuccessLine('Dataplane already provisioned (bootstrap idempotent)'));
-    const { credentialsAcceptToken } = require('./up-dataplane-credentials');
-    if (await credentialsAcceptToken(controllerUrl)) return;
-    throw new Error(
-      'Dataplane is registered on the controller but local pipeline credentials are missing or ' +
-        'not accepted by it. Run: aifabrix login && aifabrix app rotate-secret dataplane'
-    );
-  }
-  throw new Error(
-    'Dataplane bootstrap returned no credentials and no "already_provisioned" status ' +
-      `(status: ${responseData.status || 'none'}). The controller may be a version this CLI does not support.`
-  );
-}
-
 /**
  * Register dataplane via bootstrap endpoint (idempotent).
  * @async
@@ -160,7 +235,7 @@ async function handleBootstrapResponse(responseData, controllerUrl, environmentK
  * @param {string} controllerUrl
  * @param {string} environmentKey
  * @param {Function} buildDataplaneImageRefFn
- * @returns {Promise<void>}
+ * @returns {Promise<{status: string, credentialsAvailable: true}>}
  */
 async function bootstrapDataplaneApplication(options, controllerUrl, environmentKey, buildDataplaneImageRefFn) {
   const encryptionKey = await resolveBootstrapEncryptionKey();
@@ -193,7 +268,7 @@ async function bootstrapDataplaneApplication(options, controllerUrl, environment
     registrationData
   );
 
-  await handleBootstrapResponse(responseData, controllerUrl, environmentKey, containerPort);
+  return handleBootstrapResponse(responseData, controllerUrl, environmentKey, containerPort);
 }
 
 module.exports = {
@@ -201,5 +276,7 @@ module.exports = {
   resolveBootstrapEncryptionKey,
   bootstrapDataplaneApplication,
   syncDataplaneApplicationUrls,
-  pickBootstrapEncryptionKeyFromSecrets
+  pickBootstrapEncryptionKeyFromSecrets,
+  hasUsablePipelineCredentials,
+  BOOTSTRAP_CREDENTIAL_ERROR_CODE
 };

package/lib/commands/up-dataplane.js

@@ -344,34 +344,8 @@ async function provisionAndDeployDataplane(options, environmentKey, controllerUr
   logger.log('');
 }
 
-/**
- * Handle up-dataplane command: ensure logged in, environment dev, ensure dataplane,
- * register or rotate (if already registered), deploy (send manifest to controller),
- * then run dataplane app locally (always local deployment).
- *
- * @async
- * @function handleUpDataplane
- * @param {Object} options - Commander options
- * @param {string} [options.registry] - Override registry for dataplane
- * @param {string} [options.registryMode] - Override registry mode (acr|external)
- * @param {string} [options.image] - Override image reference for dataplane
- * @param {boolean} [options.skipInfraCheck] - When true, skip Postgres/Redis gate (caller already verified, e.g. guided up-dataplane).
- * @returns {Promise<void>}
- * @throws {Error} If infra not up, controller unavailable, not logged in, environment not dev, or any step fails
- */
-/**
- * Run options for the local dataplane container.
- *
- * A guided platform install already shows one spinner for the whole dataplane step, so it
- * either forwards its own progress callback or asks for silence; a standalone run prints
- * normally.
- *
- * @param {Object} options - Command options
- * @param {string} runEnvKey - Resolved run environment
- * @param {number|undefined} portOverride - Resolved port override
- * @returns {Object} Options for app.runApp
- */
-function buildDataplaneRunOptions(options, runEnvKey, portOverride) {
+async function runDataplaneLocally(options) {
+  const { runEnvKey, portOverride } = await computeDataplaneRunOverrides(options);
   const runAppOpts = {
     skipEnvOutputPath: true,
     env: runEnvKey,
@@ -387,7 +361,7 @@ function buildDataplaneRunOptions(options, runEnvKey, portOverride) {
       runAppOpts.silentPoll = true;
     }
   }
-  return runAppOpts;
+  await app.runApp('dataplane', runAppOpts);
 }
 
 async function handleUpDataplane(options = {}) {
@@ -420,8 +394,7 @@ async function handleUpDataplane(options = {}) {
     controllerUrl
   );
 
-  const { runEnvKey, portOverride } = await computeDataplaneRunOverrides(options);
-  await app.runApp('dataplane', buildDataplaneRunOptions(options, runEnvKey, portOverride));
+  await runDataplaneLocally(options);
 
   if (options.platformInstall !== true) {
     logger.log(formatSuccessParagraph('up-dataplane complete. Dataplane is registered, deployed in dev, and running locally.'));

package/lib/generator/index.js

@@ -22,6 +22,22 @@ const { generateControllerManifest } = require('./external-controller-manifest')
 const { resolveVersionForApp } = require('../utils/image-version');
 const { getContainerPort } = require('../utils/port-resolver');
 const { buildEnvVarMap } = require('../utils/env-map');
+const config = require('../core/config');
+const {
+  resolveDimensionAbacSetting,
+  applyDimensionAbacToConfiguration
+} = require('../utils/dataplane-dimension-abac-setting');
+
+async function resolveDimensionAbacValue(appName) {
+  if (appName !== 'dataplane') return undefined;
+  const userConfig = await config.getConfig();
+  return resolveDimensionAbacSetting(userConfig).value;
+}
+
+async function applyResolvedDimensionAbacToConfiguration(appName, configuration) {
+  const value = await resolveDimensionAbacValue(appName);
+  if (value !== undefined) applyDimensionAbacToConfiguration(appName, configuration, value);
+}
 const { mergeAdditionalPublishedPorts } = require('../utils/docker-manifest-public-port');
 
 /**
@@ -115,6 +131,13 @@ function substitutePortInDeployment(obj, portNumber) {
   }
 }
 
+function normalizeDeploymentPort(deployment, effectivePort) {
+  if (deployment.port === undefined) return;
+  deployment.port = typeof deployment.port === 'string' && /^\d+$/.test(deployment.port)
+    ? parseInt(deployment.port, 10)
+    : (typeof deployment.port === 'number' ? deployment.port : effectivePort);
+}
+
 /** Regex to find ${VAR} placeholders for env substitution */
 const ENV_VAR_PLACEHOLDER_REGEX = /\$\{([^}]+)\}/g;
 
@@ -179,6 +202,9 @@ function buildAndValidateDeployment(appName, variables, envTemplate, rbac, optio
   // Parse environment variables from template and merge portalInput from application config.
   // A known deployment target resolves manifest {NAME} values; otherwise they stay for the Controller.
   const configuration = parseEnvironmentVariables(envTemplate, variables, options && options.target);
+  if (options && options.dimensionAbacValue !== undefined) {
+    applyDimensionAbacToConfiguration(appName, configuration, options.dimensionAbacValue);
+  }
 
   // Build deployment manifest (Controller computes deploymentKey from schema)
   const deployment = builders.buildManifestStructure(appName, variables, configuration, rbac);
@@ -193,10 +219,7 @@ function buildAndValidateDeployment(appName, variables, envTemplate, rbac, optio
   // Replace ${PORT} with port from application.yaml so manifest deploys correctly
   const effectivePort = getEffectivePortForSubstitution(variables, 3000);
   substitutePortInDeployment(deployment, effectivePort);
-  if (deployment.port !== undefined) {
-    deployment.port = typeof deployment.port === 'string' && /^\d+$/.test(deployment.port)
-      ? parseInt(deployment.port, 10) : (typeof deployment.port === 'number' ? deployment.port : effectivePort);
-  }
+  normalizeDeploymentPort(deployment, effectivePort);
 
   // Resolve ${REDIS_HOST}, ${DB_HOST}, etc. from env-config.yaml so manifest has no unresolved vars
   const envVarMap = options && options.envVarMap;
@@ -239,14 +262,12 @@ async function buildDeploymentManifestInMemory(appName, options = {}) {
     app: { ...variables.app, version: resolved.version }
   };
   const configuration = parseEnvironmentVariables(envTemplate, variables, options && options.target);
+  await applyResolvedDimensionAbacToConfiguration(appName, configuration);
   const deployment = builders.buildManifestStructure(appName, variablesWithVersion, configuration, rbac);
 
   const effectivePort = getEffectivePortForSubstitution(variablesWithVersion, 3000);
   substitutePortInDeployment(deployment, effectivePort);
-  if (deployment.port !== undefined) {
-    deployment.port = typeof deployment.port === 'string' && /^\d+$/.test(deployment.port)
-      ? parseInt(deployment.port, 10) : (typeof deployment.port === 'number' ? deployment.port : effectivePort);
-  }
+  normalizeDeploymentPort(deployment, effectivePort);
   const envVarMap = await buildEnvVarMap('docker', null, null, { appPort: effectivePort });
   await mergeAdditionalPublishedPorts(envVarMap, variablesWithVersion);
   substituteEnvVarsInDeployment(deployment, envVarMap);
@@ -302,10 +323,12 @@ async function writeRegularDeployJson(appName, appPath, appType, options = {}) {
   };
   const effectivePort = getEffectivePortForSubstitution(variablesWithVersion, 3000);
   const envVarMap = await buildEnvVarMap('docker', null, null, { appPort: effectivePort });
+  const dimensionAbacValue = await resolveDimensionAbacValue(appName);
   await mergeAdditionalPublishedPorts(envVarMap, variablesWithVersion);
   const deployment = buildAndValidateDeployment(appName, variablesWithVersion, envTemplate, rbac, {
     envVarMap,
-    target: options.target
+    target: options.target,
+    dimensionAbacValue
   });
   const jsonContent = JSON.stringify(deployment, null, 2);
   fs.writeFileSync(jsonPath, jsonContent, { mode: 0o644 });

package/lib/utils/dataplane-dimension-abac-setting.js

@@ -0,0 +1,120 @@
+/**
+ * Resolve and materialize the Dataplane Dimension ABAC installer setting.
+ *
+ * @fileoverview Strict non-secret Dimension ABAC setting helpers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const SETTING_NAME = 'DIMENSION_ABAC_ENFORCEMENT_ENABLED';
+const CONFIG_KEY = 'dimensionAbacEnforcementEnabled';
+const DATAPLANE_APP = 'dataplane';
+
+function settingError(message) {
+  const error = new Error(message);
+  error.code = 'DIMENSION_ABAC_SETTING_INVALID';
+  return error;
+}
+
+function parseDimensionAbacOption(raw) {
+  if (raw === undefined || raw === null) return undefined;
+  if (raw === true || raw === false) return raw;
+  const value = String(raw).trim().toLowerCase();
+  if (value === 'on') return true;
+  if (value === 'off') return false;
+  throw settingError('Invalid --dimension-abac value. Use on or off.');
+}
+
+function readStoredValue(userConfig) {
+  const applications = userConfig && userConfig.applications;
+  if (applications === undefined || applications === null) return undefined;
+  if (typeof applications !== 'object' || Array.isArray(applications)) {
+    throw settingError('Invalid applications configuration; expected an object.');
+  }
+  const entry = applications[DATAPLANE_APP];
+  if (entry === undefined || entry === null) return undefined;
+  if (typeof entry !== 'object' || Array.isArray(entry)) {
+    throw settingError('Invalid applications.dataplane configuration; expected an object.');
+  }
+  if (!Object.prototype.hasOwnProperty.call(entry, CONFIG_KEY)) return undefined;
+  if (typeof entry[CONFIG_KEY] !== 'boolean') {
+    throw settingError(`Invalid applications.dataplane.${CONFIG_KEY}; expected a boolean.`);
+  }
+  return entry[CONFIG_KEY];
+}
+
+function resolveDimensionAbacSetting(userConfig, explicitValue) {
+  const stored = readStoredValue(userConfig);
+  if (explicitValue !== undefined && typeof explicitValue !== 'boolean') {
+    throw settingError('Explicit Dimension ABAC selection must be a boolean.');
+  }
+  if (explicitValue !== undefined) return { value: explicitValue, source: 'explicit' };
+  if (stored !== undefined) return { value: stored, source: 'stored' };
+  return { value: false, source: 'default' };
+}
+
+async function persistExplicitDimensionAbacSetting(configApi, value) {
+  if (value === undefined) return undefined;
+  if (!configApi || typeof configApi.getConfig !== 'function' || typeof configApi.saveConfig !== 'function') {
+    throw settingError('Configuration API is unavailable.');
+  }
+  if (typeof value !== 'boolean') {
+    throw settingError('Persisted Dimension ABAC selection must be a boolean.');
+  }
+  const userConfig = await configApi.getConfig();
+  readStoredValue(userConfig);
+  const applications = { ...(userConfig.applications || {}) };
+  const dataplane = { ...(applications[DATAPLANE_APP] || {}), [CONFIG_KEY]: value };
+  const nextConfig = { ...userConfig, applications: { ...applications, [DATAPLANE_APP]: dataplane } };
+  await configApi.saveConfig(nextConfig);
+  return nextConfig;
+}
+
+function toDimensionAbacEnvValue(value) {
+  if (typeof value !== 'boolean') {
+    throw settingError('Dimension ABAC value must be a boolean.');
+  }
+  return value ? 'true' : 'false';
+}
+
+function applyDimensionAbacToEnvMap(appName, envMap, value) {
+  if (appName !== DATAPLANE_APP) return envMap;
+  if (!envMap || typeof envMap !== 'object' || Array.isArray(envMap)) {
+    throw settingError('Dataplane environment map must be an object.');
+  }
+  envMap[SETTING_NAME] = toDimensionAbacEnvValue(value);
+  return envMap;
+}
+
+function applyDimensionAbacToConfiguration(appName, configuration, value) {
+  if (appName !== DATAPLANE_APP) return configuration;
+  if (!Array.isArray(configuration)) {
+    throw settingError('Dataplane deployment configuration must be an array.');
+  }
+  const matches = configuration.filter(item => item && item.name === SETTING_NAME);
+  if (matches.length > 1) {
+    throw settingError(`Dataplane deployment configuration contains duplicate ${SETTING_NAME} entries.`);
+  }
+  const entry = {
+    name: SETTING_NAME,
+    value: toDimensionAbacEnvValue(value),
+    location: 'variable',
+    required: false
+  };
+  if (matches.length === 0) configuration.push(entry);
+  else Object.assign(matches[0], entry);
+  return configuration;
+}
+
+module.exports = {
+  SETTING_NAME,
+  CONFIG_KEY,
+  parseDimensionAbacOption,
+  resolveDimensionAbacSetting,
+  persistExplicitDimensionAbacSetting,
+  toDimensionAbacEnvValue,
+  applyDimensionAbacToEnvMap,
+  applyDimensionAbacToConfiguration
+};

package/lib/utils/log-redaction.js

@@ -13,6 +13,9 @@
 /** Env key patterns that indicate a secret (mask value) — same rules as aifabrix logs <app>. */
 const SECRET_KEY_PATTERN = /password|secret|token|credential|api[_-]?key/i;
 
+/** Bounded encryption/master-key names; avoids treating every `key` variable as secret. */
+const ENCRYPTION_KEY_PATTERN = /(?:^|[_-])(?:encryption|master)[_-]?key(?:$|[_-])/i;
+
 /** Prefixes to strip before checking key (avoids masking KEYCLOAK_SERVER_URL etc.) */
 const KEY_PREFIXES_TO_STRIP = /^KEYCLOAK_|^KEY_VAULT_/;
 
@@ -50,7 +53,7 @@ function maskEnvLine(line) {
   const value = line.slice(eq + 1);
 
   const keyForCheck = key.replace(KEY_PREFIXES_TO_STRIP, '');
-  const isSecretKey = SECRET_KEY_PATTERN.test(keyForCheck);
+  const isSecretKey = SECRET_KEY_PATTERN.test(keyForCheck) || ENCRYPTION_KEY_PATTERN.test(keyForCheck);
 
   const maskedValue = maskUrlEmbeddedCredentials(value);
   const hasUrlCredentials = maskedValue !== value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.62.0",
+  "version": "2.63.0",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {
@@ -42,6 +42,7 @@
     "check:cli-help": "node scripts/check-cli-help-examples.js",
     "check:mirrored-templates": "node scripts/check-mirrored-templates.js",
     "test:manual": "jest --config jest.config.manual.js --runInBand",
+    "test:manual:public": "jest --config jest.config.manual-public.js --runInBand",
     "test:integration": "jest --config jest.config.integration.js --runInBand",
     "test:integration:fixtures": "jest --config jest.config.integration.fixtures.js --runInBand",
     "test:hubspot-wizard": "node integration/hubspot-test/test.js",

package/templates/README.md

@@ -26,6 +26,12 @@ Application templates are folder-based and located under `templates/applications
 | `aifabrix-miso/packages/miso-controller/configs/infra.parameter.yaml` | `lib/schema/infra.parameter.yaml` |
 | `aifabrix-dataplane/builder/dataplane/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/dataplane/` |
 
+The Dataplane `env.template` is the source of truth for
+`DIMENSION_ABAC_ENFORCEMENT_ENABLED` and its default `false`. Do not hand-edit
+the bundled mirror. `aifabrix setup --dimension-abac on|off` stores an operator
+selection outside the template and overlays the resolved lowercase value during
+local runtime and deployment-manifest materialization.
+
 **Schema master (dataplane):** Also copies dataplane `app/schemas/json/` core integration schemas + `type/*` and `configs/deployment-rules.yaml` into `lib/schema/` (same contract as dataplane `make sync-json`). Do not hand-edit those mirrors — edit dataplane SSOT, then sync. `lib/schema/infra.parameter.yaml` is the Miso catalog mirror above; other Builder-owned schemas in `lib/schema/` (wizard and the rest) are left alone.
 
 Overrides: `AIFABRIX_MISO_SRC`, `AIFABRIX_DATAPLANE_SRC` / `AIFABRIX_DATAPLANE_ROOT` (repo roots). Install with `aifabrix up-platform` / `up-builder-api` — do not hand-edit the template copies as primary.

package/templates/applications/builder-api/application.yaml

@@ -5,7 +5,7 @@ app:
   description: 'Business Transformation services — HTTP orchestration for connected-system workspace lifecycle via Dataplane Enterprise MCP and governance APIs.'
   type: webapp
   language: typescript
-  version: 2.62.0
+  version: 2.63.0
 
 # Image Configuration
 image: