@aifabrix/builder 2.62.0 → 2.63.1

package/lib/deployment/installation/local-environment-stage.js

@@ -19,6 +19,10 @@ const logger = require('../../utils/logger');
 const { resolveDatabaseNamesWithAdoption } = require('../../parameters/database-adoption');
 const { parseDatabaseSecretKey } = require('../../parameters/database-secret-values');
 const { resolveLocalInstallationName } = require('./local-installation');
+const {
+  authorizeEnvironmentWithController
+} = require('./local-environment-authorize');
+const { loadEnvironmentBootstrapSnapshot } = require('./local-environment-snapshot');
 
 /**
  * Applications that exist **once per environment**.
@@ -127,65 +131,6 @@ async function ensureEnvironmentDatabases(envKey, deps) {
   return ensured;
 }
 
-/**
- * Ask Miso whether this environment may exist, before anything is created.
- *
- * **Editions are Miso's, not Builder's.** Whether a licence permits `tst` or `pro` is not a
- * question this repository answers or caches: it asks, and Miso accepts or declines. Builder
- * holding its own copy of the entitlement rules would be a second answer to drift from the
- * licence, and a local one at that — the easiest possible thing to edit.
- *
- * This runs **first**. A decline after the databases exist would leave an environment's
- * objects behind for an environment that is not licensed, and nothing would later remove
- * them.
- *
- * @async
- * @param {string} envKey - Environment key
- * @param {Object} deps - Injected collaborators
- * @returns {Promise<void>}
- * @throws {Error} When Miso declines, or cannot be reached to ask
- */
-async function authorizeEnvironmentWithController(envKey, deps) {
-  if (typeof deps.authorizeEnvironment === 'function') {
-    await deps.authorizeEnvironment(envKey);
-    return;
-  }
-  const { resolveControllerUrl } = require('../../utils/controller-url');
-  const { getOrRefreshDeviceToken } = require('../../utils/token-manager');
-  const { createEnvironment } = require('../../api/environments.api');
-
-  const controllerUrl = await resolveControllerUrl();
-  if (!controllerUrl) {
-    throw new Error(
-      `Cannot create ${envKey}: no controller is configured, so whether your licence ` +
-        'permits this environment cannot be checked. Run "aifabrix login" first.'
-    );
-  }
-  const deviceToken = await getOrRefreshDeviceToken(controllerUrl);
-  if (!deviceToken || !deviceToken.token) {
-    throw new Error(
-      `Cannot create ${envKey}: not signed in, so whether your licence permits this ` +
-        'environment cannot be checked. Run "aifabrix login" first.'
-    );
-  }
-  const authConfig = {
-    type: 'device',
-    token: deviceToken.token,
-    controller: deviceToken.controller || controllerUrl
-  };
-  try {
-    await createEnvironment(controllerUrl, authConfig, { key: envKey, environment: envKey });
-  } catch (error) {
-    // Miso owns the edition rules, so its refusal is reported as given rather than
-    // reinterpreted here. Guessing at the reason would put a second, stale explanation of
-    // the licence in front of the operator.
-    throw new Error(
-      `Miso declined environment ${envKey}: ${error.message}\n` +
-        'Editions are licensed in Miso. Nothing was created locally.'
-    );
-  }
-}
-
 /**
  * Workloads `env deploy` promotes into a promotion-only environment.
  *
@@ -241,24 +186,32 @@ async function promoteWorkloadsForEnvironment(envKey, deps) {
  * @param {string} installationKey - Positional installation key (`local` or `local-…`)
  * @param {string} envKey - Validated stage, one of dev|tst|pro
  * @param {Object} [deps] - Injected collaborators
- * @returns {Promise<{ stage: string, vendor: string, installation: string, databases: string[], promoted: string[] }>}
+ * @returns {Promise<{ stage: string, vendor: string, installation: string, databases: string[], promoted: string[], snapshot: { environmentId?: string, applicationId?: string }|null }>}
  */
 async function runLocalEnvironmentStage(installationKey, envKey, deps = {}) {
   const config = deps.config || require('../../core/config');
   const policy = deps.policy || require('../../core/environment-mode-policy');
+  const authorize = deps.authorizeEnvironmentWithController || authorizeEnvironmentWithController;
+  const loadSnapshot = deps.loadEnvironmentBootstrapSnapshot || loadEnvironmentBootstrapSnapshot;
+
+  const developerId = await config.getDeveloperId();
+  const installation = resolveLocalInstallationName(installationKey, developerId);
 
   // Miso first: it owns editions, and it accepts or declines this environment. Everything
-  // below creates something, so the licence answer has to come before any of it.
-  await authorizeEnvironmentWithController(envKey, deps);
+  // below creates something, so the licence answer has to come before any of it. Local
+  // create uses the same configuration fields as Azure (preset, serviceName, location).
+  await authorize(envKey, {
+    ...deps,
+    installationKey,
+    serviceName: installation,
+    preset: deps.preset
+  });
 
   // Then the local precondition. tst and pro are unreachable outside the front-door mode,
   // so creating their databases would leave resources behind for an environment that cannot
   // serve a request.
   await policy.assertEnvironmentAllowedForCurrentMode(envKey);
 
-  const developerId = await config.getDeveloperId();
-  const installation = resolveLocalInstallationName(installationKey, developerId);
-
   logger.log(`Deploying environment ${envKey} into local installation ${installation}`);
 
   // Databases before containers: a workload that starts without its database fails on its
@@ -271,7 +224,30 @@ async function runLocalEnvironmentStage(installationKey, envKey, deps = {}) {
     logger.log(`Promoted into ${envKey}: ${promoted.join(', ')}`);
   }
 
-  return { stage: envKey, vendor: 'DOCKER', installation, databases, promoted };
+  const snapshot = await summarizeEnvironmentSnapshot(envKey, loadSnapshot, deps);
+  return { stage: envKey, vendor: 'DOCKER', installation, databases, promoted, snapshot };
+}
+
+/**
+ * Load this environment's own bootstrap snapshot after the dataplane can register.
+ *
+ * @async
+ * @param {string} envKey
+ * @param {Function} loadSnapshot
+ * @param {Object} deps
+ * @returns {Promise<{ environmentId?: string, applicationId?: string }>}
+ */
+async function summarizeEnvironmentSnapshot(envKey, loadSnapshot, deps) {
+  const snapshotPayload = await loadSnapshot(envKey, deps);
+  const context = (snapshotPayload && snapshotPayload.context) || {};
+  logger.log(
+    `Loaded configuration snapshot for ${envKey}` +
+      (context.environmentId ? ` (environment ${context.environmentId})` : '')
+  );
+  return {
+    environmentId: context.environmentId,
+    applicationId: context.applicationId
+  };
 }
 
 module.exports = {
@@ -281,5 +257,6 @@ module.exports = {
   resolveEnvironmentDatabasePlan,
   ensureEnvironmentDatabases,
   promoteWorkloadsForEnvironment,
+  loadEnvironmentBootstrapSnapshot,
   runLocalEnvironmentStage
 };

package/lib/generator/index.js

@@ -22,6 +22,22 @@ const { generateControllerManifest } = require('./external-controller-manifest')
 const { resolveVersionForApp } = require('../utils/image-version');
 const { getContainerPort } = require('../utils/port-resolver');
 const { buildEnvVarMap } = require('../utils/env-map');
+const config = require('../core/config');
+const {
+  resolveDimensionAbacSetting,
+  applyDimensionAbacToConfiguration
+} = require('../utils/dataplane-dimension-abac-setting');
+
+async function resolveDimensionAbacValue(appName) {
+  if (appName !== 'dataplane') return undefined;
+  const userConfig = await config.getConfig();
+  return resolveDimensionAbacSetting(userConfig).value;
+}
+
+async function applyResolvedDimensionAbacToConfiguration(appName, configuration) {
+  const value = await resolveDimensionAbacValue(appName);
+  if (value !== undefined) applyDimensionAbacToConfiguration(appName, configuration, value);
+}
 const { mergeAdditionalPublishedPorts } = require('../utils/docker-manifest-public-port');
 
 /**
@@ -115,6 +131,13 @@ function substitutePortInDeployment(obj, portNumber) {
   }
 }
 
+function normalizeDeploymentPort(deployment, effectivePort) {
+  if (deployment.port === undefined) return;
+  deployment.port = typeof deployment.port === 'string' && /^\d+$/.test(deployment.port)
+    ? parseInt(deployment.port, 10)
+    : (typeof deployment.port === 'number' ? deployment.port : effectivePort);
+}
+
 /** Regex to find ${VAR} placeholders for env substitution */
 const ENV_VAR_PLACEHOLDER_REGEX = /\$\{([^}]+)\}/g;
 
@@ -179,6 +202,9 @@ function buildAndValidateDeployment(appName, variables, envTemplate, rbac, optio
   // Parse environment variables from template and merge portalInput from application config.
   // A known deployment target resolves manifest {NAME} values; otherwise they stay for the Controller.
   const configuration = parseEnvironmentVariables(envTemplate, variables, options && options.target);
+  if (options && options.dimensionAbacValue !== undefined) {
+    applyDimensionAbacToConfiguration(appName, configuration, options.dimensionAbacValue);
+  }
 
   // Build deployment manifest (Controller computes deploymentKey from schema)
   const deployment = builders.buildManifestStructure(appName, variables, configuration, rbac);
@@ -193,10 +219,7 @@ function buildAndValidateDeployment(appName, variables, envTemplate, rbac, optio
   // Replace ${PORT} with port from application.yaml so manifest deploys correctly
   const effectivePort = getEffectivePortForSubstitution(variables, 3000);
   substitutePortInDeployment(deployment, effectivePort);
-  if (deployment.port !== undefined) {
-    deployment.port = typeof deployment.port === 'string' && /^\d+$/.test(deployment.port)
-      ? parseInt(deployment.port, 10) : (typeof deployment.port === 'number' ? deployment.port : effectivePort);
-  }
+  normalizeDeploymentPort(deployment, effectivePort);
 
   // Resolve ${REDIS_HOST}, ${DB_HOST}, etc. from env-config.yaml so manifest has no unresolved vars
   const envVarMap = options && options.envVarMap;
@@ -239,14 +262,12 @@ async function buildDeploymentManifestInMemory(appName, options = {}) {
     app: { ...variables.app, version: resolved.version }
   };
   const configuration = parseEnvironmentVariables(envTemplate, variables, options && options.target);
+  await applyResolvedDimensionAbacToConfiguration(appName, configuration);
   const deployment = builders.buildManifestStructure(appName, variablesWithVersion, configuration, rbac);
 
   const effectivePort = getEffectivePortForSubstitution(variablesWithVersion, 3000);
   substitutePortInDeployment(deployment, effectivePort);
-  if (deployment.port !== undefined) {
-    deployment.port = typeof deployment.port === 'string' && /^\d+$/.test(deployment.port)
-      ? parseInt(deployment.port, 10) : (typeof deployment.port === 'number' ? deployment.port : effectivePort);
-  }
+  normalizeDeploymentPort(deployment, effectivePort);
   const envVarMap = await buildEnvVarMap('docker', null, null, { appPort: effectivePort });
   await mergeAdditionalPublishedPorts(envVarMap, variablesWithVersion);
   substituteEnvVarsInDeployment(deployment, envVarMap);
@@ -302,10 +323,12 @@ async function writeRegularDeployJson(appName, appPath, appType, options = {}) {
   };
   const effectivePort = getEffectivePortForSubstitution(variablesWithVersion, 3000);
   const envVarMap = await buildEnvVarMap('docker', null, null, { appPort: effectivePort });
+  const dimensionAbacValue = await resolveDimensionAbacValue(appName);
   await mergeAdditionalPublishedPorts(envVarMap, variablesWithVersion);
   const deployment = buildAndValidateDeployment(appName, variablesWithVersion, envTemplate, rbac, {
     envVarMap,
-    target: options.target
+    target: options.target,
+    dimensionAbacValue
   });
   const jsonContent = JSON.stringify(deployment, null, 2);
   fs.writeFileSync(jsonPath, jsonContent, { mode: 0o644 });

package/lib/parameters/rsa-secret-values.js

@@ -30,30 +30,14 @@ function readPrivateKey(value, encryptionKey, pairId) {
 /**
  * Pairs whose private half belongs to Mori, not to an installation.
  *
- * Builder must never mint these. Licence trust is a two-signature chain, and both links
- * exist so that substituting a key fails rather than silently succeeding:
+ * Builder must never mint these. Generating either half would hand an installation the
+ * private key of material it only verifies against, so it could sign a licence it then
+ * accepts. 227.1 pinned the verifying key "precisely because a key travelling inside the
+ * token it verifies proves nothing"; a self-generated key proves exactly as little.
  *
- * 1. Mori signs the licence. The installation verifies it against the public key held on
- *    disk, so a licence from anywhere else does not verify.
- * 2. That on-disk material is itself validated against a key in Key Vault. The Key Vault is
- *    provisioned by the Marketplace deployment and readable only by Miso's managed
- *    identity — nobody can change it, including us — so swapping the on-disk public key for
- *    one whose private half an attacker holds fails at the second check.
- *
- * The second link is an **Azure** guarantee. A Docker installation has no Key Vault and no
- * managed identity, so locally the chain is the pinned public key alone. Closing that is
- * online validation against Mori, which is a known gap deferred on purpose: the delivery
- * target is Azure, and Docker exists to validate the shape of that stack.
- *
- * It does not soften this rule. The one environment lacking the second check is the last
- * one that should mint its own keys, and a locally generated pair would make local
- * behaviour diverge from the Azure stack it exists to mirror.
- *
- * Generating the pair locally breaks both links at once: the installation would hold the
- * private half of the key it verifies against, so it could sign a licence it then accepts,
- * and the material would no longer correspond to what Key Vault validates. 227.1 pinned
- * this key "precisely because a key travelling inside the token it verifies proves
- * nothing"; a self-generated key proves exactly as little.
+ * How Miso pins, stores, or cross-checks that public key (Key Vault, Docker secrets file,
+ * online Mori check) is Miso's contract — Builder has no code path that inspects a vault
+ * or deployment mode. Builder's job stops at: refuse to mint, resolve what was supplied.
  *
  * The public half reaches an installation through the `moriLicensePublicKey` deployment
  * parameter, which the installation contract already classifies as registration-supplied.
@@ -120,8 +104,8 @@ function generateRsaSecretValues(keys, existing = {}, encryptionKey) {
     if (populated(existing[key]) || populated(values[key])) continue;
     const entry = catalog.findEntryForKey(key);
     if (entry?.generator?.type !== 'rsaKeyPair') continue;
-    // Supplied by Mori at deployment and validated against Key Vault. Generating it here
-    // would hand the installation the private half of the key it verifies licences against.
+    // Supplied by Mori; never generated here. Minting it would hand the installation the
+    // private half of the key it verifies licences against.
     if (isIssuerSuppliedPair(entry)) continue;
     const entries = catalog.data.parameters.filter(e => e.key &&
       e.generator?.type === 'rsaKeyPair' && e.generator.pairId === entry.generator.pairId);
@@ -146,12 +130,11 @@ function generateRsaSecretValues(keys, existing = {}, encryptionKey) {
 function generateRsaValueFromCatalog(key, catalogEntry) {
   if (isIssuerSuppliedPair(catalogEntry)) {
     throw new Error(
-      `Secret "${key}" is supplied by Mori and is never generated here. Licence trust is a ` +
-      'two-signature chain: Mori signs the licence, which is verified against the on-disk ' +
-      'public key, and that material is validated against a Key Vault key readable only by ' +
-      'Miso\'s managed identity. The public half reaches an installation through the ' +
-      'moriLicensePublicKey deployment parameter. An installation with neither stays ' +
-      'unpinned and refuses every licence, which is the intended failure.'
+      `Secret "${key}" is supplied by Mori and is never generated here. An installation that ` +
+      'minted it would hold the private half of the key it verifies licences against. The ' +
+      'public half reaches an installation through the moriLicensePublicKey deployment ' +
+      'parameter. An installation with neither stays unpinned and refuses every licence, ' +
+      'which is the intended failure.'
     );
   }
   return generateRsaSecretValues([key])[key];

package/lib/schema/infra.parameter.yaml

@@ -28,10 +28,6 @@ standardUpInfraEnsureKeys:
   - databases-dataplane-2-passwordKeyVault
   - databases-dataplane-3-urlKeyVault
   - databases-dataplane-3-passwordKeyVault
-  # Miso-controller Entra onboarding (vendor app); required for aifabrix resolve miso-controller
-  - entra-callback-uri
-  - entra-client-idKeyVault
-  - entra-client-secretKeyVault
 parameters:
   - key: postgres-passwordKeyVault
     scope: infra
@@ -351,47 +347,8 @@ parameters:
 
   # Miso-controller Entra ID onboarding (vendor multi-tenant app). Empty client/callback values
   # allow local resolve and start-dev; set real values before Entra admin-consent flows.
-  - key: entra-callback-uri
-    category: Microsoft Entra ID
-    sensitive: false
-    valueSource: optionalInput
-    requiredOnSystemOnboarding: false
-    scope: system
-    generator:
-      type: emptyString
-    ensureOn: [upInfra, resolveApp]
-    azure:
-      notes: >-
-        ENTRA_ID_CENTRAL_CALLBACK_URI — Mori web redirect (e.g. …/entra-id-concent/callback);
-        empty locally until Mori URL is configured.
-
-  - key: entra-client-idKeyVault
-    category: Microsoft Entra ID
-    sensitive: false
-    valueSource: optionalInput
-    requiredOnSystemOnboarding: false
-    scope: system
-    generator:
-      type: emptyString
-    ensureOn: [upInfra, resolveApp]
-    azure:
-      notes: >-
-        Vendor Entra app client id (ENTRA_ID_CLIENT_ID); empty for local dev without Entra flows.
-
-  - key: entra-client-secretKeyVault
-    category: Microsoft Entra ID
-    sensitive: true
-    valueSource: optionalInput
-    requiredOnSystemOnboarding: false
-    scope: system
-    generator:
-      type: emptyString
-    ensureOn: [upInfra, resolveApp]
-    azure:
-      legacyVaultSecretNames:
-        - entra-vendor-client-secret
-      notes: >-
-        Vendor Entra app client secret (ENTRA_ID_CLIENT_SECRET); empty for local dev without Entra flows.
+  # No entra-callback-uri, entra-client-idKeyVault or entra-client-secretKeyVault: Miso holds no
+  # Entra client credentials; Mori owns the registration and every sign-in (plan 248.0).
 
   # Keycloak events: webhook signature secret used by miso-controller (KEYCLOAK_EVENTS_SECRET).
   # This must exist on first boot because up-platform runs containers from templates (no prior resolve).

package/lib/schema/infrastructure-schema.json

@@ -509,8 +509,6 @@
         "acrResourceId",
         "deployRoleAssignments",
         "moriBaseUrl",
-        "entraIdClientId",
-        "entraIdClientSecret",
         "entraIdTenantId",
         "licenseEdition",
         "capacityProfile",
@@ -970,62 +968,6 @@
         "encryptionKey": {
           "$ref": "#/definitions/envReference"
         },
-        "entraIdClientId": {
-          "type": "object",
-          "required": [
-            "value",
-            "source",
-            "description"
-          ],
-          "additionalProperties": false,
-          "properties": {
-            "value": {
-              "type": "null"
-            },
-            "source": {
-              "type": "string",
-              "minLength": 1
-            },
-            "description": {
-              "type": "string",
-              "minLength": 1
-            },
-            "required": {
-              "type": "boolean"
-            },
-            "requiredAt": {
-              "const": "tenantActivation"
-            }
-          }
-        },
-        "entraIdClientSecret": {
-          "type": "object",
-          "required": [
-            "value",
-            "source",
-            "description"
-          ],
-          "additionalProperties": false,
-          "properties": {
-            "value": {
-              "type": "null"
-            },
-            "source": {
-              "type": "string",
-              "minLength": 1
-            },
-            "description": {
-              "type": "string",
-              "minLength": 1
-            },
-            "required": {
-              "type": "boolean"
-            },
-            "requiredAt": {
-              "const": "tenantActivation"
-            }
-          }
-        },
         "entraIdTenantId": {
           "type": "object",
           "required": [

package/lib/utils/dataplane-dimension-abac-setting.js

@@ -0,0 +1,120 @@
+/**
+ * Resolve and materialize the Dataplane Dimension ABAC installer setting.
+ *
+ * @fileoverview Strict non-secret Dimension ABAC setting helpers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const SETTING_NAME = 'DIMENSION_ABAC_ENFORCEMENT_ENABLED';
+const CONFIG_KEY = 'dimensionAbacEnforcementEnabled';
+const DATAPLANE_APP = 'dataplane';
+
+function settingError(message) {
+  const error = new Error(message);
+  error.code = 'DIMENSION_ABAC_SETTING_INVALID';
+  return error;
+}
+
+function parseDimensionAbacOption(raw) {
+  if (raw === undefined || raw === null) return undefined;
+  if (raw === true || raw === false) return raw;
+  const value = String(raw).trim().toLowerCase();
+  if (value === 'on') return true;
+  if (value === 'off') return false;
+  throw settingError('Invalid --dimension-abac value. Use on or off.');
+}
+
+function readStoredValue(userConfig) {
+  const applications = userConfig && userConfig.applications;
+  if (applications === undefined || applications === null) return undefined;
+  if (typeof applications !== 'object' || Array.isArray(applications)) {
+    throw settingError('Invalid applications configuration; expected an object.');
+  }
+  const entry = applications[DATAPLANE_APP];
+  if (entry === undefined || entry === null) return undefined;
+  if (typeof entry !== 'object' || Array.isArray(entry)) {
+    throw settingError('Invalid applications.dataplane configuration; expected an object.');
+  }
+  if (!Object.prototype.hasOwnProperty.call(entry, CONFIG_KEY)) return undefined;
+  if (typeof entry[CONFIG_KEY] !== 'boolean') {
+    throw settingError(`Invalid applications.dataplane.${CONFIG_KEY}; expected a boolean.`);
+  }
+  return entry[CONFIG_KEY];
+}
+
+function resolveDimensionAbacSetting(userConfig, explicitValue) {
+  const stored = readStoredValue(userConfig);
+  if (explicitValue !== undefined && typeof explicitValue !== 'boolean') {
+    throw settingError('Explicit Dimension ABAC selection must be a boolean.');
+  }
+  if (explicitValue !== undefined) return { value: explicitValue, source: 'explicit' };
+  if (stored !== undefined) return { value: stored, source: 'stored' };
+  return { value: false, source: 'default' };
+}
+
+async function persistExplicitDimensionAbacSetting(configApi, value) {
+  if (value === undefined) return undefined;
+  if (!configApi || typeof configApi.getConfig !== 'function' || typeof configApi.saveConfig !== 'function') {
+    throw settingError('Configuration API is unavailable.');
+  }
+  if (typeof value !== 'boolean') {
+    throw settingError('Persisted Dimension ABAC selection must be a boolean.');
+  }
+  const userConfig = await configApi.getConfig();
+  readStoredValue(userConfig);
+  const applications = { ...(userConfig.applications || {}) };
+  const dataplane = { ...(applications[DATAPLANE_APP] || {}), [CONFIG_KEY]: value };
+  const nextConfig = { ...userConfig, applications: { ...applications, [DATAPLANE_APP]: dataplane } };
+  await configApi.saveConfig(nextConfig);
+  return nextConfig;
+}
+
+function toDimensionAbacEnvValue(value) {
+  if (typeof value !== 'boolean') {
+    throw settingError('Dimension ABAC value must be a boolean.');
+  }
+  return value ? 'true' : 'false';
+}
+
+function applyDimensionAbacToEnvMap(appName, envMap, value) {
+  if (appName !== DATAPLANE_APP) return envMap;
+  if (!envMap || typeof envMap !== 'object' || Array.isArray(envMap)) {
+    throw settingError('Dataplane environment map must be an object.');
+  }
+  envMap[SETTING_NAME] = toDimensionAbacEnvValue(value);
+  return envMap;
+}
+
+function applyDimensionAbacToConfiguration(appName, configuration, value) {
+  if (appName !== DATAPLANE_APP) return configuration;
+  if (!Array.isArray(configuration)) {
+    throw settingError('Dataplane deployment configuration must be an array.');
+  }
+  const matches = configuration.filter(item => item && item.name === SETTING_NAME);
+  if (matches.length > 1) {
+    throw settingError(`Dataplane deployment configuration contains duplicate ${SETTING_NAME} entries.`);
+  }
+  const entry = {
+    name: SETTING_NAME,
+    value: toDimensionAbacEnvValue(value),
+    location: 'variable',
+    required: false
+  };
+  if (matches.length === 0) configuration.push(entry);
+  else Object.assign(matches[0], entry);
+  return configuration;
+}
+
+module.exports = {
+  SETTING_NAME,
+  CONFIG_KEY,
+  parseDimensionAbacOption,
+  resolveDimensionAbacSetting,
+  persistExplicitDimensionAbacSetting,
+  toDimensionAbacEnvValue,
+  applyDimensionAbacToEnvMap,
+  applyDimensionAbacToConfiguration
+};

package/lib/utils/log-redaction.js

@@ -13,6 +13,9 @@
 /** Env key patterns that indicate a secret (mask value) — same rules as aifabrix logs <app>. */
 const SECRET_KEY_PATTERN = /password|secret|token|credential|api[_-]?key/i;
 
+/** Bounded encryption/master-key names; avoids treating every `key` variable as secret. */
+const ENCRYPTION_KEY_PATTERN = /(?:^|[_-])(?:encryption|master)[_-]?key(?:$|[_-])/i;
+
 /** Prefixes to strip before checking key (avoids masking KEYCLOAK_SERVER_URL etc.) */
 const KEY_PREFIXES_TO_STRIP = /^KEYCLOAK_|^KEY_VAULT_/;
 
@@ -50,7 +53,7 @@ function maskEnvLine(line) {
   const value = line.slice(eq + 1);
 
   const keyForCheck = key.replace(KEY_PREFIXES_TO_STRIP, '');
-  const isSecretKey = SECRET_KEY_PATTERN.test(keyForCheck);
+  const isSecretKey = SECRET_KEY_PATTERN.test(keyForCheck) || ENCRYPTION_KEY_PATTERN.test(keyForCheck);
 
   const maskedValue = maskUrlEmbeddedCredentials(value);
   const hasUrlCredentials = maskedValue !== value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.62.0",
+  "version": "2.63.1",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {
@@ -42,6 +42,7 @@
     "check:cli-help": "node scripts/check-cli-help-examples.js",
     "check:mirrored-templates": "node scripts/check-mirrored-templates.js",
     "test:manual": "jest --config jest.config.manual.js --runInBand",
+    "test:manual:public": "jest --config jest.config.manual-public.js --runInBand",
     "test:integration": "jest --config jest.config.integration.js --runInBand",
     "test:integration:fixtures": "jest --config jest.config.integration.fixtures.js --runInBand",
     "test:hubspot-wizard": "node integration/hubspot-test/test.js",

package/templates/README.md

@@ -26,6 +26,12 @@ Application templates are folder-based and located under `templates/applications
 | `aifabrix-miso/packages/miso-controller/configs/infra.parameter.yaml` | `lib/schema/infra.parameter.yaml` |
 | `aifabrix-dataplane/builder/dataplane/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/dataplane/` |
 
+The Dataplane `env.template` is the source of truth for
+`DIMENSION_ABAC_ENFORCEMENT_ENABLED` and its default `false`. Do not hand-edit
+the bundled mirror. `aifabrix setup --dimension-abac on|off` stores an operator
+selection outside the template and overlays the resolved lowercase value during
+local runtime and deployment-manifest materialization.
+
 **Schema master (dataplane):** Also copies dataplane `app/schemas/json/` core integration schemas + `type/*` and `configs/deployment-rules.yaml` into `lib/schema/` (same contract as dataplane `make sync-json`). Do not hand-edit those mirrors — edit dataplane SSOT, then sync. `lib/schema/infra.parameter.yaml` is the Miso catalog mirror above; other Builder-owned schemas in `lib/schema/` (wizard and the rest) are left alone.
 
 Overrides: `AIFABRIX_MISO_SRC`, `AIFABRIX_DATAPLANE_SRC` / `AIFABRIX_DATAPLANE_ROOT` (repo roots). Install with `aifabrix up-platform` / `up-builder-api` — do not hand-edit the template copies as primary.

package/templates/applications/builder-api/application.yaml

@@ -5,7 +5,7 @@ app:
   description: 'Business Transformation services — HTTP orchestration for connected-system workspace lifecycle via Dataplane Enterprise MCP and governance APIs.'
   type: webapp
   language: typescript
-  version: 2.62.0
+  version: 2.63.1
 
 # Image Configuration
 image:

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.82
+  version: 2.0.84
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).

package/templates/applications/dataplane/env.template

@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.82
+VERSION=2.0.84
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5