@aifabrix/builder 2.62.0 → 2.63.1

package/lib/api/onboarding-status.api.js

@@ -0,0 +1,117 @@
+/**
+ * Read the public Miso required-baseline onboarding projection.
+ *
+ * @fileoverview Public Miso onboarding readiness client
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { ApiClient } = require('./index');
+
+const ENDPOINT = '/api/v1/health/onboarding-status';
+const PROJECTION_KEYS = ['code', 'retryable', 'state'];
+const VALID_PROJECTIONS = new Set([
+  'pending|null|true',
+  'complete|null|false',
+  'incomplete|baseline-dimensions-incomplete|true',
+  'incomplete|baseline-roles-incomplete|true'
+]);
+const VALID_PAIRS = new Set([
+  'pending|null|true::pending|null|true',
+  'incomplete|baseline-dimensions-incomplete|true::pending|null|true',
+  'complete|null|false::pending|null|true',
+  'complete|null|false::incomplete|baseline-roles-incomplete|true',
+  'complete|null|false::complete|null|false'
+]);
+
+function onboardingStatusError(message, code = 'MISO_ONBOARDING_STATUS_INVALID') {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function projectionSignature(projection) {
+  return `${projection.state}|${projection.code === null ? 'null' : projection.code}|${projection.retryable}`;
+}
+
+function hasValidProjectionTypes(projection) {
+  return typeof projection.state === 'string' &&
+    (projection.code === null || typeof projection.code === 'string') &&
+    typeof projection.retryable === 'boolean';
+}
+
+function parseProjection(value, name) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw onboardingStatusError(`Miso ${name} readiness projection is missing or malformed.`);
+  }
+  const keys = Object.keys(value).sort();
+  if (keys.length !== PROJECTION_KEYS.length || keys.some((key, index) => key !== PROJECTION_KEYS[index])) {
+    throw onboardingStatusError(`Miso ${name} readiness projection has unsupported fields.`);
+  }
+  const projection = { state: value.state, code: value.code, retryable: value.retryable };
+  if (!hasValidProjectionTypes(projection)) {
+    throw onboardingStatusError(`Miso ${name} readiness projection has invalid field types.`);
+  }
+  if (!VALID_PROJECTIONS.has(projectionSignature(projection))) {
+    throw onboardingStatusError(`Miso ${name} readiness projection has an unsupported state.`);
+  }
+  return Object.freeze(projection);
+}
+
+function parseOnboardingStatusResponse(response) {
+  if (!response || response.success !== true || response.status !== 200) {
+    throw onboardingStatusError(
+      'Miso onboarding readiness is unavailable.',
+      'MISO_ONBOARDING_STATUS_UNAVAILABLE'
+    );
+  }
+  const wireBody = response.data;
+  if (!wireBody || typeof wireBody !== 'object' || Array.isArray(wireBody) ||
+      Object.prototype.hasOwnProperty.call(wireBody, 'success')) {
+    throw onboardingStatusError('Miso onboarding readiness response envelope is malformed.');
+  }
+  const data = wireBody.data;
+  if (!data || typeof data !== 'object' || Array.isArray(data) ||
+      Object.prototype.hasOwnProperty.call(data, 'success')) {
+    throw onboardingStatusError('Miso onboarding readiness data envelope is malformed.');
+  }
+  const baselineDimensions = parseProjection(data.baselineDimensions, 'Dimension');
+  const baselineRoles = parseProjection(data.baselineRoles, 'Business Role');
+  const pair = `${projectionSignature(baselineDimensions)}::${projectionSignature(baselineRoles)}`;
+  if (!VALID_PAIRS.has(pair)) {
+    throw onboardingStatusError('Miso onboarding readiness contains an unsupported step ordering.');
+  }
+  return Object.freeze({ baselineDimensions, baselineRoles });
+}
+
+/**
+ * Fetch required-baseline readiness from Miso Controller.
+ * GET /api/v1/health/onboarding-status
+ * @requiresPermission {Controller} Public
+ * @param {string} controllerUrl
+ * @param {{timeoutMs?: number, client?: ApiClient}} [options]
+ * @returns {Promise<{baselineDimensions: Object, baselineRoles: Object}>}
+ */
+async function fetchOnboardingStatus(controllerUrl, options = {}) {
+  const client = options.client || new ApiClient(controllerUrl);
+  const requestOptions = {};
+  if (options.timeoutMs !== undefined) requestOptions.timeoutMs = options.timeoutMs;
+  let response;
+  try {
+    response = await client.get(ENDPOINT, requestOptions);
+  } catch {
+    throw onboardingStatusError(
+      'Miso onboarding readiness request failed.',
+      'MISO_ONBOARDING_STATUS_UNAVAILABLE'
+    );
+  }
+  return parseOnboardingStatusResponse(response);
+}
+
+module.exports = {
+  ENDPOINT,
+  fetchOnboardingStatus,
+  parseOnboardingStatusResponse
+};

package/lib/app/register.js

@@ -28,6 +28,24 @@ const { refreshUrlsLocalRegistryFromBuilder } = require('../utils/urls-local-reg
 const { resolveControllerUrl } = require('../utils/controller-url');
 const config = require('../core/config');
 
+/**
+ * Handle local credential persistence failure without exposing details in strict mode.
+ * @param {Error} error
+ * @param {boolean} required
+ * @returns {false}
+ */
+function handleCredentialPersistenceFailure(error, required) {
+  if (required) {
+    const persistenceError = new Error(
+      'Application credentials could not be saved to the supported local secret store.'
+    );
+    persistenceError.code = 'LOCAL_CREDENTIAL_PERSISTENCE_FAILED';
+    throw persistenceError;
+  }
+  logger.warn(chalk.yellow(`⚠  Could not save credentials locally: ${error.message}`));
+  return false;
+}
+
 /**
  * Build registration data payload from app configuration
  * @param {Object} appConfig - Application configuration
@@ -83,8 +101,11 @@ function buildRegistrationData(appConfig, options) {
  * @async
  * @param {Object} responseData - Registration response data
  * @param {string} apiUrl - API URL
+ * @param {Object} [options] - Persistence behavior
+ * @param {boolean} [options.required=false] - Throw a safe typed error when persistence fails
+ * @returns {Promise<boolean>} True when credentials were persisted
  */
-async function saveLocalCredentials(responseData, apiUrl) {
+async function saveLocalCredentials(responseData, apiUrl, options = {}) {
   const registeredAppKey = responseData.application.key;
   const clientIdKey = `${registeredAppKey}-client-idKeyVault`;
   const clientSecretKey = `${registeredAppKey}-client-secretKeyVault`;
@@ -113,8 +134,9 @@ async function saveLocalCredentials(responseData, apiUrl) {
       logger.log(formatSuccessParagraph('Credentials saved to ~/.aifabrix/secrets.local.yaml\n'));
     }
   } catch (error) {
-    logger.warn(chalk.yellow(`⚠  Could not save credentials locally: ${error.message}`));
+    return handleCredentialPersistenceFailure(error, options.required === true);
   }
+  return true;
 }
 
 /**

package/lib/app/run-env-compose.js

@@ -20,6 +20,11 @@ const secretsEnsure = require('../core/secrets-ensure');
 const secretsEnvWrite = require('../core/secrets-env-write');
 const { getContainerPort } = require('../utils/port-resolver');
 const { applyAdminSecretsPlatformOverlay } = require('../core/admin-secrets-env-overlay');
+const {
+  resolveDimensionAbacSetting,
+  applyDimensionAbacToEnvMap
+} = require('../utils/dataplane-dimension-abac-setting');
+const { resolveEffectiveRegistry } = require('../utils/resolve-docker-image-ref');
 
 /**
  * Merge app env with admin-secrets; overlay ensures platform keys come from admin file.
@@ -38,6 +43,13 @@ async function applyOnboardingPlatformModeIfNeeded(appName, merged) {
   merged.ONBOARDING_FULL_PLATFORM = mode === 'full' ? 'true' : 'false';
 }
 
+async function applyDimensionAbacSettingIfNeeded(appName, merged) {
+  if (appName !== 'dataplane') return;
+  const userConfig = await config.getConfig();
+  const resolved = resolveDimensionAbacSetting(userConfig);
+  applyDimensionAbacToEnvMap(appName, merged, resolved.value);
+}
+
 /**
  * Backfill only secrets needed for `aifabrix run <app>`: kv:// keys from that app's env.template
  * (catalog defaults via placeholderContext). Does not run full `ensureInfraSecrets`.
@@ -260,6 +272,29 @@ async function applyPostgresPasswordFromPgpass(merged, developerId) {
   if (pgpassPwd !== undefined) merged.POSTGRES_PASSWORD = pgpassPwd;
 }
 
+/**
+ * Deliver existing local installation inputs to privileged Miso bootstrap only.
+ * @param {string} appName
+ * @param {Object} merged
+ * @param {Object} appConfig
+ * @param {Object|null} scopeOpts
+ */
+function applyMisoBootstrapInputsIfNeeded(appName, merged, appConfig, scopeOpts) {
+  if (appName !== 'miso-controller') return;
+  const postgresPassword = merged.POSTGRES_PASSWORD;
+  if (typeof postgresPassword !== 'string' || postgresPassword.trim().length === 0) {
+    throw new Error(
+      'Local PostgreSQL administrator password is unavailable. Re-run "aifabrix up-infra" before starting Miso Controller.'
+    );
+  }
+  merged.POSTGRES_ADMIN_PASSWORD = postgresPassword;
+  const { registry } = resolveEffectiveRegistry(appConfig, {
+    registry: scopeOpts?.registry
+  });
+  if (registry) merged.ACR_LOGIN_SERVER = registry;
+  else delete merged.ACR_LOGIN_SERVER;
+}
+
 /**
  * @param {string} runEnvPath
  * @param {string} runEnvAdminPath
@@ -300,8 +335,10 @@ async function buildMergedRunEnvAndWrite(appName, appConfig, devDir, developerId
   mergeRunEnvWithAdminOverlay(merged, adminObj, appName);
   await applyOnboardingPlatformModeIfNeeded(appName, merged);
   await applyPostgresPasswordFromPgpass(merged, developerId);
+  applyMisoBootstrapInputsIfNeeded(appName, merged, appConfig, scopeOpts);
   injectDatabaseNamesAndUsers(merged, appConfig, scopeOpts);
   injectContainerPortForRun(merged, appConfig, appName);
+  await applyDimensionAbacSettingIfNeeded(appName, merged);
 
   const runEnvPath = path.join(devDir, '.env.run');
   const runEnvAdminPath = path.join(devDir, '.env.run.admin');
@@ -351,9 +388,9 @@ async function ensureRunEnvFilesPresent(
  * @throws {Error} If password keys appear in environment-like assignment
  */
 function assertNoPasswordLiteralsInCompose(composeContent) {
-  const badPattern = /\n\s+(-?\s*)(POSTGRES_PASSWORD|DB_\d+_PASSWORD)\s*[:=]/;
+  const badPattern = /\n\s+(-?\s*)(POSTGRES_PASSWORD|POSTGRES_ADMIN_PASSWORD|DB_\d+_PASSWORD)\s*[:=]/;
   if (badPattern.test(composeContent)) {
-    throw new Error('Generated compose must not contain password literals (POSTGRES_PASSWORD, DB_*_PASSWORD). Use env_file only.');
+    throw new Error('Generated compose must not contain password literals (PostgreSQL or application database passwords). Use env_file only.');
   }
 }
 

package/lib/app/run-env-recovery.js

@@ -26,6 +26,7 @@ function buildRunEnvRecovery(appName, prepared) {
       prepared.appConfig.developerId,
       {
         runEnvKey: prepared.mergedRunOptions.env,
+        registry: prepared.mergedRunOptions.registry,
         effectiveEnvironmentScopedResources:
           prepared.mergedRunOptions.effectiveEnvironmentScopedResources
       }

package/lib/app/run-helpers.js

@@ -366,7 +366,7 @@ async function prepareEnvironment(appName, appConfig, options) {
     appConfig,
     devDir,
     developerId,
-    { runEnvKey, effectiveEnvironmentScopedResources }
+    { runEnvKey, effectiveEnvironmentScopedResources, registry: options.registry }
   );
   const { hydrateMissingLocalParameters } = require('./run-parameter-sync');
   await hydrateMissingLocalParameters(appName, runEnvPath);

package/lib/cli/infra-guided.js

@@ -49,6 +49,34 @@ const {
   emitSystemBuilderAppManifestLineIfTTY
 } = require('../utils/manifest-source-emit');
 const { flushDeferredPublicUrlWarnings } = require('./infra-guided-public-url-warn');
+const { fetchOnboardingStatus } = require('../api/onboarding-status.api');
+const {
+  waitForRequiredBaselineReadiness
+} = require('../commands/setup-onboarding-readiness');
+
+async function runRequiredBaselineReadinessIfNeeded(options, authOpts) {
+  if (!options || options.requireBaselineReadiness !== true) return;
+  const controllerUrl = await resolveGuidedAuthControllerUrl(authOpts);
+  const spin = startSpinner('Waiting for required Miso baseline onboarding...');
+  const onProgress = createSpinnerTextUpdater(spin);
+  try {
+    await waitForRequiredBaselineReadiness({
+      request: requestOptions => fetchOnboardingStatus(controllerUrl, requestOptions),
+      onProgress
+    });
+  } catch (error) {
+    if (spin && typeof spin.fail === 'function') spin.fail('Miso baseline onboarding not ready');
+    throw error;
+  }
+  stopSpinnerSuccess(spin, 'Miso baseline onboarding ready');
+  logger.log('');
+}
+
+async function runGuidedMisoAndReadinessPhase(options, handleUpMiso, authOpts) {
+  await withMutedLogger(() => prepareUrlsLocalRegistryForUpPlatform());
+  await runGuidedKeycloakAndMisoControllerPhase(options, handleUpMiso);
+  await runRequiredBaselineReadinessIfNeeded(options, authOpts);
+}
 
 /**
  * Guided Keycloak → Miso Controller start with one spinner per app (no second health wait).
@@ -327,8 +355,7 @@ async function runGuidedUpPlatform(options, handleUpMiso, handleUpDataplane, han
     skipLoginIfAuthenticated: options && options.skipLoginIfAuthenticated === true
   };
 
-  await withMutedLogger(() => prepareUrlsLocalRegistryForUpPlatform());
-  await runGuidedKeycloakAndMisoControllerPhase(options, handleUpMiso);
+  await runGuidedMisoAndReadinessPhase(options, handleUpMiso, authOpts);
   await runGuidedKeycloakRealmPhase(options);
   await runGuidedAuthStep(handleLogin, authOpts, { startSpinner, stopSpinnerSuccess });
   const controllerUrl = await resolveGuidedAuthControllerUrl(authOpts);
@@ -388,6 +415,7 @@ module.exports = {
   runGuidedUpMiso,
   runGuidedUpDataplane,
   runGuidedUpPlatform,
+  runRequiredBaselineReadinessIfNeeded,
   runGuidedDownInfra,
   stripHealthPrefix
 };

package/lib/cli/setup-platform.js

@@ -4,7 +4,7 @@
  * `setup` is the one-shot platform installer. When no infrastructure is
  * detected it runs a small wizard (admin email/password, AI tool keys) and
  * then `up-infra` + `up-platform`. When infra is already up, it offers a
- * mode menu (re-install, wipe data, clean install files, update images).
+ * mode menu (re-install, wipe data, update images).
  *
  * `teardown` is the symmetrical inverse of `setup`: `down-infra -v` plus a
  * full clean of the AI Fabrix system directory (everything except
@@ -20,6 +20,7 @@
 const { handleCommandError } = require('../utils/cli-utils');
 const { handleSetup } = require('../commands/setup');
 const { handleTeardown } = require('../commands/teardown');
+const { parseDimensionAbacOption } = require('../utils/dataplane-dimension-abac-setting');
 
 const SETUP_HELP_AFTER = `
 What this command does:
@@ -27,16 +28,25 @@ What this command does:
   - With infra running: shows a mode menu:
       1) Re-install — stop infra and remove all volumes, then up-infra + up-platform --force.
       2) Wipe data — drop every database and DB user, then up-infra + up-platform --force.
-      3) Clean installation files — remove user-local secrets, then up-infra + up-platform --force.
-      4) Update images — pull the latest infra and platform images, then up-infra + up-platform.
+      3) Update images — pull the latest infra and platform images, then up-infra + up-platform.
   - With --mode fresh: first-time install when no infra is running (non-interactive; use with --admin-email and --admin-password).
   - With --mode update-images: refresh images when infra is already running (non-interactive).
 
 AI tool keys are read from the user-local file (~/.aifabrix/secrets.local.yaml) merged with the shared aifabrix-secrets file. If either source already provides keys, the AI tool prompt is skipped.
 
+Dimension ABAC defaults to off. Use --dimension-abac on|off to persist an explicit Dataplane selection. The saved selection is reused by later setup and redeploy flows; changing it takes effect after the normal Dataplane restart/redeploy boundary.
+
 Use 'aifabrix teardown' to fully remove the local installation.
 `;
 
+function parseRepeatedDimensionAbacOption(raw, previous) {
+  const value = parseDimensionAbacOption(raw);
+  if (previous !== undefined && previous !== value) {
+    throw new Error('Conflicting --dimension-abac values. Supply only on or only off.');
+  }
+  return value;
+}
+
 const TEARDOWN_HELP_AFTER = `
 What this command does:
   - Runs down-infra -v (stops all infra + apps, removes every Docker volume).
@@ -64,6 +74,11 @@ function registerSetup(program) {
     .option('--integration-server', 'Install the integration server (runs once in the miso environment)')
     .option('--no-integration-server', 'Do not install the integration server (default)')
     .option('--mode <mode>', 'Non-interactive mode: fresh (no infra) or update-images (infra running)')
+    .option(
+      '--dimension-abac <off|on>',
+      'Persist Dataplane Dimension ABAC selection (default: off)',
+      parseRepeatedDimensionAbacOption
+    )
     .option('-y, --yes', 'Skip destructive confirmation prompts (re-install, wipe data, teardown)')
     .addHelpText('after', SETUP_HELP_AFTER)
     .action(async(options) => {

package/lib/commands/setup-modes.js

@@ -296,7 +296,8 @@ async function runUpPlatform(opts = {}) {
         base: true,
         platformControllerUrl: authCtx.platformControllerUrl,
         skipLoginIfAuthenticated: authCtx.skipLoginIfAuthenticated,
-        requireKeycloakRealm: opts.requireKeycloakRealm === true
+        requireKeycloakRealm: opts.requireKeycloakRealm === true,
+        requireBaselineReadiness: true
       },
       upMiso.handleUpMiso,
       upDataplane.handleUpDataplane,

package/lib/commands/setup-onboarding-readiness.js

@@ -0,0 +1,83 @@
+/**
+ * Bounded observer for required Miso baseline onboarding.
+ *
+ * @fileoverview Setup-only Miso baseline readiness observer
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { performance } = require('node:perf_hooks');
+
+const DEFAULT_INTERVAL_MS = 2000;
+const DEFAULT_REQUEST_TIMEOUT_MS = 5000;
+const DEFAULT_DEADLINE_MS = 90000;
+
+function monotonicNow() {
+  return performance.now();
+}
+
+function readinessError(message, code) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function classifyReadiness(snapshot) {
+  const dimensions = snapshot.baselineDimensions;
+  const roles = snapshot.baselineRoles;
+  if (dimensions.state === 'incomplete') {
+    throw readinessError(
+      `Required baseline Dimensions are incomplete (${dimensions.code}). Retry setup after reconciliation completes.`,
+      dimensions.code
+    );
+  }
+  if (roles.state === 'incomplete') {
+    throw readinessError(
+      `Required baseline Business Roles are incomplete (${roles.code}). Retry setup after reconciliation completes.`,
+      roles.code
+    );
+  }
+  if (dimensions.state === 'complete' && roles.state === 'complete') return 'complete';
+  return dimensions.state === 'pending' ? 'dimensions' : 'roles';
+}
+
+function timeoutError() {
+  return readinessError(
+    'Timed out waiting for required Miso baseline onboarding. Retry setup after reconciliation completes.',
+    'MISO_BASELINE_READINESS_TIMEOUT'
+  );
+}
+
+async function waitForRequiredBaselineReadiness(options) {
+  const request = options.request;
+  const now = options.now || monotonicNow;
+  const sleep = options.sleep || (ms => new Promise(resolve => setTimeout(resolve, ms)));
+  const onProgress = options.onProgress || (() => {});
+  const intervalMs = options.intervalMs ?? DEFAULT_INTERVAL_MS;
+  const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  const deadlineMs = options.deadlineMs ?? DEFAULT_DEADLINE_MS;
+  const startedAt = now();
+  while (now() - startedAt < deadlineMs) {
+    const remaining = deadlineMs - (now() - startedAt);
+    if (remaining <= 0) throw timeoutError();
+    const snapshot = await request({ timeoutMs: Math.min(requestTimeoutMs, remaining) });
+    const state = classifyReadiness(snapshot);
+    if (state === 'complete') return snapshot;
+    onProgress(state === 'dimensions'
+      ? 'Waiting for required baseline Dimensions...'
+      : 'Waiting for required baseline Business Roles...');
+    const afterRequest = deadlineMs - (now() - startedAt);
+    if (afterRequest <= 0) throw timeoutError();
+    await sleep(Math.min(intervalMs, afterRequest));
+  }
+  throw timeoutError();
+}
+
+module.exports = {
+  DEFAULT_INTERVAL_MS,
+  DEFAULT_REQUEST_TIMEOUT_MS,
+  DEFAULT_DEADLINE_MS,
+  waitForRequiredBaselineReadiness
+};

package/lib/commands/setup.js

@@ -36,6 +36,11 @@ const setupModes = require('./setup-modes');
 const { syncPlatformControllerUrlsInConfig } = require('./setup-platform-auth');
 const installationLog = require('../utils/installation-log');
 const { beginSetupCommandFlow, endSetupCommandFlow } = require('./setup-run-context');
+const {
+  parseDimensionAbacOption,
+  resolveDimensionAbacSetting,
+  persistExplicitDimensionAbacSetting
+} = require('../utils/dataplane-dimension-abac-setting');
 
 const MODE = setupPrompts.MODE;
 
@@ -87,7 +92,20 @@ function normalizeCliMode(options) {
  * @param {'fresh'|'update-images'} cliMode
  * @returns {Promise<{ outcome: string, setupMode: string }>}
  */
-async function runSetupWithCliMode(options, cliMode) {
+async function persistDimensionAbacSelection(settingContext) {
+  await persistExplicitDimensionAbacSetting(config, settingContext.explicitValue);
+}
+
+async function prepareDimensionAbacSetting(options) {
+  const explicitValue = parseDimensionAbacOption(options.dimensionAbac);
+  const userConfig = await config.getConfig();
+  const resolved = resolveDimensionAbacSetting(userConfig, explicitValue);
+  const displayValue = resolved.value ? 'on' : 'off';
+  logger.log(infoLine(`Dimension ABAC: ${displayValue} (${resolved.source}).`));
+  return { explicitValue, ...resolved };
+}
+
+async function runSetupWithCliMode(options, cliMode, settingContext) {
   logSetupHeader();
   logger.log(formatProgress('Detecting current installation state...'));
   const running = await isInfraRunning();
@@ -97,12 +115,13 @@ async function runSetupWithCliMode(options, cliMode) {
         'Infrastructure is already running; use --mode update-images or run teardown first.'
       );
     }
-    await runFreshInstallFlow(options);
+    await runFreshInstallFlow(options, settingContext);
     return { outcome: 'success', setupMode: CLI_SETUP_MODES.FRESH };
   }
   if (!running) {
     throw new Error('No infrastructure running; use --mode fresh for first-time install.');
   }
+  await persistDimensionAbacSelection(settingContext);
   await dispatchMode(MODE.UPDATE_IMAGES);
   logger.log(formatSuccessParagraph(`aifabrix setup complete (mode: ${cliMode}).`));
   return { outcome: 'success', setupMode: cliMode };
@@ -120,12 +139,13 @@ async function applySetupPlatformMode(options) {
   return mode;
 }
 
-async function runFreshInstallFlow(options) {
+async function runFreshInstallFlow(options, settingContext) {
   await maybePinDeveloperIdForFreshInstall(options.developer);
   logger.log(infoLine('No infrastructure detected; starting fresh install.'));
   await applySetupPlatformMode(options);
   const adminCreds = await setupPrompts.promptAdminCredentials(options);
   await config.setAdminEmail(adminCreds.adminEmail);
+  await persistDimensionAbacSelection(settingContext);
   await setupModes.runFreshInstall(adminCreds);
   logger.log(formatSuccessParagraph('aifabrix setup complete (fresh install).'));
 }
@@ -134,7 +154,7 @@ async function runFreshInstallFlow(options) {
  * @param {boolean} assumeYes
  * @returns {Promise<{ aborted: boolean, mode: string|null }>}
  */
-async function runExistingInfraFlow(assumeYes) {
+async function runExistingInfraFlow(assumeYes, settingContext) {
   const mode = await setupPrompts.promptModeSelection();
   const proceed = await setupPrompts.confirmDestructiveMode(mode, assumeYes);
   if (!proceed) {
@@ -145,6 +165,7 @@ async function runExistingInfraFlow(assumeYes) {
   if (mode === MODE.REINSTALL || mode === MODE.WIPE_DATA) {
     await applySetupPlatformMode({});
   }
+  await persistDimensionAbacSelection(settingContext);
   await dispatchMode(mode);
   logger.log(formatSuccessParagraph(`aifabrix setup complete (mode: ${mode}).`));
   return { aborted: false, mode };
@@ -197,20 +218,19 @@ async function dispatchMode(mode) {
  * @param {boolean} assumeYes
  * @returns {Promise<{ outcome: string, setupMode: string|null }>}
  */
-async function runSetupMainPath(options, assumeYes) {
-  const cliMode = normalizeCliMode(options);
+async function runSetupMainPath(options, assumeYes, cliMode, settingContext) {
   if (cliMode) {
-    return runSetupWithCliMode(options, cliMode);
+    return runSetupWithCliMode(options, cliMode, settingContext);
   }
 
   logSetupHeader();
   logger.log(formatProgress('Detecting current installation state...'));
   const running = await isInfraRunning();
   if (!running) {
-    await runFreshInstallFlow(options);
+    await runFreshInstallFlow(options, settingContext);
     return { outcome: 'success', setupMode: 'fresh' };
   }
-  const r = await runExistingInfraFlow(assumeYes);
+  const r = await runExistingInfraFlow(assumeYes, settingContext);
   const outcome = r.aborted ? 'aborted' : 'success';
   return { outcome, setupMode: r.mode };
 }
@@ -300,7 +320,9 @@ async function handleSetup(options = {}) {
 
   beginSetupCommandFlow();
   try {
-    const main = await runSetupMainPath(options, assumeYes);
+    const cliMode = normalizeCliMode(options);
+    const settingContext = await prepareDimensionAbacSetting(options);
+    const main = await runSetupMainPath(options, assumeYes, cliMode, settingContext);
     outcome = main.outcome;
     setupMode = main.setupMode;
   } catch (e) {