@aifabrix/builder 2.63.0 → 2.63.1

package/lib/core/local-env-overrides.js

@@ -12,6 +12,8 @@
 
 'use strict';
 
+const { buildDevUsernameForFrontDoorHost } = require('../utils/compose-traefik-ingress-base');
+
 /** Applications the CLI registers itself through `.../applications/bootstrap`. */
 const CLI_BOOTSTRAPPED_APP_KEYS = Object.freeze(['dataplane']);
 
@@ -43,12 +45,30 @@ const ONBOARDING_APPS_CONFIG_KEY = 'onboardingApps';
  * to everybody, which is what happened the last time it carried a value.
  */
 const MISO_CONTROLLER_LOCAL_ONLY_ENV = Object.freeze({
-  INFRASTRUCTURE_NAME: '${DEV_USERNAME}.${DEV_ROOT_DOMAIN}',
   KEYCLOAK_PUBLIC_KEY: '',
   OTEL_SERVICE_VERSION: '',
   ACR_LOGIN_SERVER: ''
 });
 
+/**
+ * Miso's infrastructure name on a local install: `local-devNN`, the installation name the licence
+ * binds to (Miso plan 266.0). Miso names the customer's Entra SSO and SCIM applications from it
+ * (`AIF-local-dev03-SSO`) and also looks them up by that name.
+ *
+ * A concrete value, not a placeholder. These overrides are merged after the template is
+ * resolved, so the previous `${DEV_USERNAME}.${DEV_ROOT_DOMAIN}` was never interpolated by
+ * Builder; Docker substituted the unset variables with empty strings and Miso received `.`,
+ * creating `AIF-.-SSO` / `AIF-.-SCIM` in the customer's directory (2026-10-06). Developer id 0
+ * has no `devNN`, so nothing is injected there rather than an invalid `local-`.
+ *
+ * @param {Object} [cfg] - Parsed `~/.aifabrix/config.yaml`
+ * @returns {Object.<string, string>} `{ INFRASTRUCTURE_NAME }` or empty
+ */
+function localInfrastructureNameEnv(cfg) {
+  const devUsername = buildDevUsernameForFrontDoorHost(cfg ? cfg['developer-id'] : undefined);
+  return devUsername ? { INFRASTRUCTURE_NAME: `local-${devUsername}` } : {};
+}
+
 function normalizeAppKeyList(value) {
   const raw = Array.isArray(value) ? value : String(value ?? '').split(',');
   const seen = new Set();
@@ -91,7 +111,8 @@ function localEnvOverridesForApp(appName, cfg) {
   if (key === 'miso-controller') {
     return {
       ONBOARDING_APPS: resolveLocalOnboardingApps(cfg).join(','),
-      ...MISO_CONTROLLER_LOCAL_ONLY_ENV
+      ...MISO_CONTROLLER_LOCAL_ONLY_ENV,
+      ...localInfrastructureNameEnv(cfg)
     };
   }
   if (key === 'builder-api' || key === 'integration-server') {

package/lib/deployment/installation/index.js

@@ -29,7 +29,10 @@ async function deployInstallationStage(resourceGroupKey, options, deps = {}) {
   // install registers with Mori exactly as any other does.
   if (isLocalInstallationKey(resourceGroup) && ENVIRONMENT_STAGES.includes(validateStage(options.stage))) {
     const { runLocalEnvironmentStage } = require('./local-environment-stage');
-    return runLocalEnvironmentStage(resourceGroup, validateStage(options.stage), deps);
+    return runLocalEnvironmentStage(resourceGroup, validateStage(options.stage), {
+      ...deps,
+      preset: options.preset
+    });
   }
   const workspace = openWorkspace(resourceGroup, { root: deps.root });
   const input = resolveStageInput(resourceGroup, options, workspace.infra?.vendor?.value);

package/lib/deployment/installation/infra-catalog.js

@@ -102,8 +102,6 @@ const PARAMETER_CATALOG = Object.freeze({
   moriLicensePublicKey: { kind: 'file', source: 'registration', required: false, description: 'Mori licence issuer public key (SPKI PEM); empty leaves the installation unpinned and it then refuses every licence.' },
   moriPolicyPublicKey: { kind: 'file', source: 'registration', required: false, description: 'Mori policy signing anchor (SPKI PEM), a different pair from the licence key; empty leaves the policy bundle checkable only against the key it carries, which proves nothing.' },
   moriLicenseIssuer: { kind: 'file', source: 'registration', required: false, description: 'Expected iss claim on a Mori licence.' },
-  entraIdClientId: { kind: 'deferred', description: 'Not collected or sent by infra; issued/configured during later Entra provider onboarding.' },
-  entraIdClientSecret: { kind: 'deferred', description: 'Not collected or sent by infra; issued/configured during later Entra provider onboarding.' },
   entraIdTenantId: { kind: 'deferred', description: 'Customer Entra provider tenant; distinct from the Azure subscription directory tenant and configured later.' },
   licenseEdition: { kind: 'license', source: 'cliOrFile', description: 'License requested from Mori during tenant activation: COMMUNITY, STANDARD or ENTERPRISE, or an Azure Marketplace subscription ID. Standard/Enterprise by name is a 30-day evaluation.' },
   installationResourceModel: { kind: 'file', source: 'templateDefault', description: 'Initial installation topology: shared for Community and Standard, dedicated for Enterprise DEV. Defaults to shared and is protected by Azure application configuration. It records the topology the installation starts in and grants no later licence entitlement, so it is not a licence input.' },

package/lib/deployment/installation/local-environment-authorize.js

@@ -0,0 +1,221 @@
+/**
+ * Ask Miso whether a local environment may exist, with honest failure labels.
+ *
+ * Local create uses the same request shape as Azure: key, environment, and
+ * configuration.preset / serviceName / location. Docker values are real
+ * placement for that system (location local, serviceName local-devNN), not a
+ * stripped body. Schema rejection is not a licence decline.
+ *
+ * @fileoverview Local env deploy — Miso authorize with contract vs licence split
+ */
+
+'use strict';
+
+const { resolveLocalInstallationName } = require('./local-installation');
+const { normalizePreset } = require('../environment-config');
+
+/** Placement location stored for Docker / local / database installs. */
+const LOCAL_LOCATION = 'local';
+
+/**
+ * @param {Object|Error|null|undefined} errorOrResponse
+ * @returns {number}
+ */
+function statusOf(errorOrResponse) {
+  if (!errorOrResponse || typeof errorOrResponse !== 'object') {
+    return 0;
+  }
+  const raw =
+    errorOrResponse.status ??
+    errorOrResponse.statusCode ??
+    (errorOrResponse.errorData && errorOrResponse.errorData.statusCode);
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? n : 0;
+}
+
+/**
+ * @param {Object|Error|null|undefined} errorOrResponse
+ * @returns {string}
+ */
+function detailOf(errorOrResponse) {
+  if (!errorOrResponse) {
+    return 'request failed';
+  }
+  if (typeof errorOrResponse === 'string') {
+    return errorOrResponse;
+  }
+  return (
+    errorOrResponse.formattedError ||
+    errorOrResponse.detail ||
+    (typeof errorOrResponse.error === 'string' ? errorOrResponse.error : null) ||
+    errorOrResponse.message ||
+    'request failed'
+  );
+}
+
+/**
+ * True when the controller refused the body as invalid, before any licence decision.
+ *
+ * @param {Object|Error|null|undefined} errorOrResponse
+ * @returns {boolean}
+ */
+function isContractValidationFailure(errorOrResponse) {
+  const status = statusOf(errorOrResponse);
+  if (status === 400 || status === 422) {
+    return true;
+  }
+  const text = [
+    detailOf(errorOrResponse),
+    errorOrResponse && errorOrResponse.title,
+    errorOrResponse && errorOrResponse.type,
+    JSON.stringify((errorOrResponse && errorOrResponse.errorData) || {})
+  ]
+    .filter(Boolean)
+    .join(' ')
+    .toLowerCase();
+  return /configuration\.|["']?preset["']?|servicename|service.?name|["']?location["']?/.test(
+    text
+  );
+}
+
+/**
+ * @param {string} envKey
+ * @param {Object|Error} errorOrResponse
+ * @returns {Error}
+ */
+function formatAuthorizeFailure(envKey, errorOrResponse) {
+  const detail = detailOf(errorOrResponse);
+  if (isContractValidationFailure(errorOrResponse)) {
+    return new Error(
+      `Cannot create environment ${envKey}: the controller rejected the request as invalid ` +
+        `(not a licence decision).\n${detail}\n` +
+        'Local create uses the same configuration fields as Azure (preset, serviceName, ' +
+        'location). Nothing was created locally.'
+    );
+  }
+  return new Error(
+    `Miso declined environment ${envKey}: ${detail}\n` +
+      'Editions are licensed in Miso. Nothing was created locally.'
+  );
+}
+
+/**
+ * Same create body shape as Azure environment create.
+ *
+ * Docker still sends a licensed size preset (default `s`). `location` is `local`
+ * and `serviceName` is the installation name. Optional `--preset` overrides size.
+ *
+ * @param {string} envKey
+ * @param {{ serviceName: string, preset?: string, location?: string }} placement
+ * @returns {{ key: string, environment: string, configuration: Object }}
+ */
+function buildLocalEnvironmentCreateBody(envKey, placement) {
+  const key = String(envKey || '').trim();
+  return {
+    key,
+    environment: key,
+    configuration: {
+      preset: normalizePreset(placement.preset),
+      serviceName: String(placement.serviceName || '').trim(),
+      location: String(placement.location || LOCAL_LOCATION).trim() || LOCAL_LOCATION
+    }
+  };
+}
+
+/**
+ * @async
+ * @param {Object} deps
+ * @param {string} installationKey
+ * @returns {Promise<string>}
+ */
+async function resolveAuthorizeServiceName(deps, installationKey) {
+  if (deps.serviceName) {
+    return String(deps.serviceName).trim();
+  }
+  const config = deps.config || require('../../core/config');
+  const developerId = await config.getDeveloperId();
+  return resolveLocalInstallationName(installationKey || 'local', developerId);
+}
+
+/**
+ * @async
+ * @param {string} envKey
+ * @param {Object} deps
+ * @returns {Promise<{ controllerUrl: string, authConfig: Object }>}
+ */
+async function resolveAuthorizeSession(envKey, deps) {
+  const resolveControllerUrl =
+    deps.resolveControllerUrl || require('../../utils/controller-url').resolveControllerUrl;
+  const getOrRefreshDeviceToken =
+    deps.getOrRefreshDeviceToken ||
+    require('../../utils/token-manager').getOrRefreshDeviceToken;
+  const controllerUrl = await resolveControllerUrl();
+  if (!controllerUrl) {
+    throw new Error(
+      `Cannot create ${envKey}: no controller is configured, so whether your licence ` +
+        'permits this environment cannot be checked. Run "aifabrix login" first.'
+    );
+  }
+  const deviceToken = await getOrRefreshDeviceToken(controllerUrl);
+  if (!deviceToken || !deviceToken.token) {
+    throw new Error(
+      `Cannot create ${envKey}: not signed in, so whether your licence permits this ` +
+        'environment cannot be checked. Run "aifabrix login" first.'
+    );
+  }
+  return {
+    controllerUrl,
+    authConfig: {
+      type: 'device',
+      token: deviceToken.token,
+      controller: deviceToken.controller || controllerUrl
+    }
+  };
+}
+
+/**
+ * @async
+ * @param {string} envKey
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+async function authorizeEnvironmentWithController(envKey, deps = {}) {
+  if (typeof deps.authorizeEnvironment === 'function') {
+    await deps.authorizeEnvironment(envKey);
+    return;
+  }
+  const createEnvironment =
+    deps.createEnvironment || require('../../api/environments.api').createEnvironment;
+  const { controllerUrl, authConfig } = await resolveAuthorizeSession(envKey, deps);
+  const serviceName = await resolveAuthorizeServiceName(deps, deps.installationKey);
+  if (!serviceName) {
+    throw new Error(
+      `Cannot create ${envKey}: local serviceName is empty. Name the installation ` +
+        '(for example local-dev03) or set a developer id with "aifabrix setup".'
+    );
+  }
+  const body = buildLocalEnvironmentCreateBody(envKey, {
+    serviceName,
+    preset: deps.preset,
+    location: deps.location
+  });
+  let response;
+  try {
+    response = await createEnvironment(controllerUrl, authConfig, body);
+  } catch (error) {
+    throw formatAuthorizeFailure(envKey, error);
+  }
+  if (response && response.success === false) {
+    throw formatAuthorizeFailure(envKey, response);
+  }
+}
+
+module.exports = {
+  LOCAL_LOCATION,
+  statusOf,
+  detailOf,
+  isContractValidationFailure,
+  formatAuthorizeFailure,
+  buildLocalEnvironmentCreateBody,
+  authorizeEnvironmentWithController
+};

package/lib/deployment/installation/local-environment-snapshot.js

@@ -0,0 +1,124 @@
+/**
+ * Load an environment's bootstrap snapshot after its dataplane credential exists.
+ *
+ * Each environment holds its own application credential. `pro` must never authenticate
+ * with `dev`'s client secret. The snapshot is the settings source; this module does not
+ * write a parallel env file.
+ *
+ * @fileoverview Local env deploy — per-environment bootstrap snapshot
+ */
+
+'use strict';
+
+const { resolveStrictSecretName } = require('../../parameters/physical-secret-name');
+
+const DATAPLANE_CLIENT_ID_KEY = 'dataplane-client-idKeyVault';
+const DATAPLANE_CLIENT_SECRET_KEY = 'dataplane-client-secretKeyVault';
+
+/**
+ * @param {Object} secrets
+ * @param {string} key
+ * @returns {string|null}
+ */
+function nonEmptySecret(secrets, key) {
+  if (!secrets || typeof secrets !== 'object') {
+    return null;
+  }
+  const value = secrets[key];
+  if (value === null || value === undefined) {
+    return null;
+  }
+  const text = String(value).trim();
+  return text ? text : null;
+}
+
+/**
+ * Resolve this environment's dataplane client credentials.
+ *
+ * Uses `resolveStrictSecretName` so an application-scoped secret is never shared between
+ * environments, even when the catalog still pins an unprefixed literal.
+ *
+ * @param {string} envKey
+ * @param {Object} secrets
+ * @returns {{ clientId: string, clientSecret: string, clientIdKey: string, clientSecretKey: string }}
+ * @throws {Error} When either credential is missing for this environment
+ */
+function resolveEnvironmentDataplaneCredentials(envKey, secrets) {
+  const env = String(envKey || '').trim().toLowerCase();
+  const clientIdKey = resolveStrictSecretName(DATAPLANE_CLIENT_ID_KEY, env);
+  const clientSecretKey = resolveStrictSecretName(DATAPLANE_CLIENT_SECRET_KEY, env);
+  let clientId = nonEmptySecret(secrets, clientIdKey);
+  let clientSecret = nonEmptySecret(secrets, clientSecretKey);
+  let resolvedIdKey = clientIdKey;
+  let resolvedSecretKey = clientSecretKey;
+  // Same adoption rule as databases: a pre-environment install's unprefixed credential
+  // belongs to `dev`. tst and pro never adopt — that would share isolation away.
+  if (env === 'dev' && (!clientId || !clientSecret)) {
+    const adoptedId = nonEmptySecret(secrets, DATAPLANE_CLIENT_ID_KEY);
+    const adoptedSecret = nonEmptySecret(secrets, DATAPLANE_CLIENT_SECRET_KEY);
+    if (adoptedId && adoptedSecret) {
+      clientId = adoptedId;
+      clientSecret = adoptedSecret;
+      resolvedIdKey = DATAPLANE_CLIENT_ID_KEY;
+      resolvedSecretKey = DATAPLANE_CLIENT_SECRET_KEY;
+    }
+  }
+  if (!clientId || !clientSecret) {
+    const missing = [
+      !clientId ? clientIdKey : null,
+      !clientSecret ? clientSecretKey : null
+    ].filter(Boolean);
+    throw new Error(
+      `Cannot load a configuration snapshot for ${env}: missing ${missing.join(' and ')}. ` +
+        'Each environment uses its own dataplane credential. Add ' +
+        `aifabrix secret set ${missing[0]} <value>` +
+        (missing[1] ? ` (and ${missing[1]})` : '') +
+        '.'
+    );
+  }
+  return {
+    clientId,
+    clientSecret,
+    clientIdKey: resolvedIdKey,
+    clientSecretKey: resolvedSecretKey
+  };
+}
+
+/**
+ * Fetch the registered dataplane's bootstrap snapshot for this environment.
+ *
+ * @async
+ * @param {string} envKey
+ * @param {Object} [deps]
+ * @returns {Promise<{ configuration: Object, context: Object, issuedAt?: string }>}
+ */
+async function loadEnvironmentBootstrapSnapshot(envKey, deps = {}) {
+  const resolveControllerUrl =
+    deps.resolveControllerUrl || require('../../utils/controller-url').resolveControllerUrl;
+  const loadSecrets = deps.loadSecrets || require('../../core/secrets').loadSecrets;
+  const fetchBootstrapSnapshot =
+    deps.fetchBootstrapSnapshot ||
+    require('../../api/bootstrap-snapshot.api').fetchBootstrapSnapshot;
+
+  const controllerUrl = await resolveControllerUrl();
+  if (!controllerUrl) {
+    throw new Error(
+      `Cannot load a configuration snapshot for ${envKey}: no controller is configured. ` +
+        'Run "aifabrix login" first.'
+    );
+  }
+  const secrets = deps.secrets || (await loadSecrets(undefined));
+  const credentials = resolveEnvironmentDataplaneCredentials(envKey, secrets);
+  return fetchBootstrapSnapshot(
+    controllerUrl,
+    { clientId: credentials.clientId, clientSecret: credentials.clientSecret },
+    deps
+  );
+}
+
+module.exports = {
+  DATAPLANE_CLIENT_ID_KEY,
+  DATAPLANE_CLIENT_SECRET_KEY,
+  resolveEnvironmentDataplaneCredentials,
+  loadEnvironmentBootstrapSnapshot
+};

package/lib/deployment/installation/local-environment-stage.js

@@ -19,6 +19,10 @@ const logger = require('../../utils/logger');
 const { resolveDatabaseNamesWithAdoption } = require('../../parameters/database-adoption');
 const { parseDatabaseSecretKey } = require('../../parameters/database-secret-values');
 const { resolveLocalInstallationName } = require('./local-installation');
+const {
+  authorizeEnvironmentWithController
+} = require('./local-environment-authorize');
+const { loadEnvironmentBootstrapSnapshot } = require('./local-environment-snapshot');
 
 /**
  * Applications that exist **once per environment**.
@@ -127,65 +131,6 @@ async function ensureEnvironmentDatabases(envKey, deps) {
   return ensured;
 }
 
-/**
- * Ask Miso whether this environment may exist, before anything is created.
- *
- * **Editions are Miso's, not Builder's.** Whether a licence permits `tst` or `pro` is not a
- * question this repository answers or caches: it asks, and Miso accepts or declines. Builder
- * holding its own copy of the entitlement rules would be a second answer to drift from the
- * licence, and a local one at that — the easiest possible thing to edit.
- *
- * This runs **first**. A decline after the databases exist would leave an environment's
- * objects behind for an environment that is not licensed, and nothing would later remove
- * them.
- *
- * @async
- * @param {string} envKey - Environment key
- * @param {Object} deps - Injected collaborators
- * @returns {Promise<void>}
- * @throws {Error} When Miso declines, or cannot be reached to ask
- */
-async function authorizeEnvironmentWithController(envKey, deps) {
-  if (typeof deps.authorizeEnvironment === 'function') {
-    await deps.authorizeEnvironment(envKey);
-    return;
-  }
-  const { resolveControllerUrl } = require('../../utils/controller-url');
-  const { getOrRefreshDeviceToken } = require('../../utils/token-manager');
-  const { createEnvironment } = require('../../api/environments.api');
-
-  const controllerUrl = await resolveControllerUrl();
-  if (!controllerUrl) {
-    throw new Error(
-      `Cannot create ${envKey}: no controller is configured, so whether your licence ` +
-        'permits this environment cannot be checked. Run "aifabrix login" first.'
-    );
-  }
-  const deviceToken = await getOrRefreshDeviceToken(controllerUrl);
-  if (!deviceToken || !deviceToken.token) {
-    throw new Error(
-      `Cannot create ${envKey}: not signed in, so whether your licence permits this ` +
-        'environment cannot be checked. Run "aifabrix login" first.'
-    );
-  }
-  const authConfig = {
-    type: 'device',
-    token: deviceToken.token,
-    controller: deviceToken.controller || controllerUrl
-  };
-  try {
-    await createEnvironment(controllerUrl, authConfig, { key: envKey, environment: envKey });
-  } catch (error) {
-    // Miso owns the edition rules, so its refusal is reported as given rather than
-    // reinterpreted here. Guessing at the reason would put a second, stale explanation of
-    // the licence in front of the operator.
-    throw new Error(
-      `Miso declined environment ${envKey}: ${error.message}\n` +
-        'Editions are licensed in Miso. Nothing was created locally.'
-    );
-  }
-}
-
 /**
  * Workloads `env deploy` promotes into a promotion-only environment.
  *
@@ -241,24 +186,32 @@ async function promoteWorkloadsForEnvironment(envKey, deps) {
  * @param {string} installationKey - Positional installation key (`local` or `local-…`)
  * @param {string} envKey - Validated stage, one of dev|tst|pro
  * @param {Object} [deps] - Injected collaborators
- * @returns {Promise<{ stage: string, vendor: string, installation: string, databases: string[], promoted: string[] }>}
+ * @returns {Promise<{ stage: string, vendor: string, installation: string, databases: string[], promoted: string[], snapshot: { environmentId?: string, applicationId?: string }|null }>}
  */
 async function runLocalEnvironmentStage(installationKey, envKey, deps = {}) {
   const config = deps.config || require('../../core/config');
   const policy = deps.policy || require('../../core/environment-mode-policy');
+  const authorize = deps.authorizeEnvironmentWithController || authorizeEnvironmentWithController;
+  const loadSnapshot = deps.loadEnvironmentBootstrapSnapshot || loadEnvironmentBootstrapSnapshot;
+
+  const developerId = await config.getDeveloperId();
+  const installation = resolveLocalInstallationName(installationKey, developerId);
 
   // Miso first: it owns editions, and it accepts or declines this environment. Everything
-  // below creates something, so the licence answer has to come before any of it.
-  await authorizeEnvironmentWithController(envKey, deps);
+  // below creates something, so the licence answer has to come before any of it. Local
+  // create uses the same configuration fields as Azure (preset, serviceName, location).
+  await authorize(envKey, {
+    ...deps,
+    installationKey,
+    serviceName: installation,
+    preset: deps.preset
+  });
 
   // Then the local precondition. tst and pro are unreachable outside the front-door mode,
   // so creating their databases would leave resources behind for an environment that cannot
   // serve a request.
   await policy.assertEnvironmentAllowedForCurrentMode(envKey);
 
-  const developerId = await config.getDeveloperId();
-  const installation = resolveLocalInstallationName(installationKey, developerId);
-
   logger.log(`Deploying environment ${envKey} into local installation ${installation}`);
 
   // Databases before containers: a workload that starts without its database fails on its
@@ -271,7 +224,30 @@ async function runLocalEnvironmentStage(installationKey, envKey, deps = {}) {
     logger.log(`Promoted into ${envKey}: ${promoted.join(', ')}`);
   }
 
-  return { stage: envKey, vendor: 'DOCKER', installation, databases, promoted };
+  const snapshot = await summarizeEnvironmentSnapshot(envKey, loadSnapshot, deps);
+  return { stage: envKey, vendor: 'DOCKER', installation, databases, promoted, snapshot };
+}
+
+/**
+ * Load this environment's own bootstrap snapshot after the dataplane can register.
+ *
+ * @async
+ * @param {string} envKey
+ * @param {Function} loadSnapshot
+ * @param {Object} deps
+ * @returns {Promise<{ environmentId?: string, applicationId?: string }>}
+ */
+async function summarizeEnvironmentSnapshot(envKey, loadSnapshot, deps) {
+  const snapshotPayload = await loadSnapshot(envKey, deps);
+  const context = (snapshotPayload && snapshotPayload.context) || {};
+  logger.log(
+    `Loaded configuration snapshot for ${envKey}` +
+      (context.environmentId ? ` (environment ${context.environmentId})` : '')
+  );
+  return {
+    environmentId: context.environmentId,
+    applicationId: context.applicationId
+  };
 }
 
 module.exports = {
@@ -281,5 +257,6 @@ module.exports = {
   resolveEnvironmentDatabasePlan,
   ensureEnvironmentDatabases,
   promoteWorkloadsForEnvironment,
+  loadEnvironmentBootstrapSnapshot,
   runLocalEnvironmentStage
 };

package/lib/parameters/rsa-secret-values.js

@@ -30,30 +30,14 @@ function readPrivateKey(value, encryptionKey, pairId) {
 /**
  * Pairs whose private half belongs to Mori, not to an installation.
  *
- * Builder must never mint these. Licence trust is a two-signature chain, and both links
- * exist so that substituting a key fails rather than silently succeeding:
+ * Builder must never mint these. Generating either half would hand an installation the
+ * private key of material it only verifies against, so it could sign a licence it then
+ * accepts. 227.1 pinned the verifying key "precisely because a key travelling inside the
+ * token it verifies proves nothing"; a self-generated key proves exactly as little.
  *
- * 1. Mori signs the licence. The installation verifies it against the public key held on
- *    disk, so a licence from anywhere else does not verify.
- * 2. That on-disk material is itself validated against a key in Key Vault. The Key Vault is
- *    provisioned by the Marketplace deployment and readable only by Miso's managed
- *    identity — nobody can change it, including us — so swapping the on-disk public key for
- *    one whose private half an attacker holds fails at the second check.
- *
- * The second link is an **Azure** guarantee. A Docker installation has no Key Vault and no
- * managed identity, so locally the chain is the pinned public key alone. Closing that is
- * online validation against Mori, which is a known gap deferred on purpose: the delivery
- * target is Azure, and Docker exists to validate the shape of that stack.
- *
- * It does not soften this rule. The one environment lacking the second check is the last
- * one that should mint its own keys, and a locally generated pair would make local
- * behaviour diverge from the Azure stack it exists to mirror.
- *
- * Generating the pair locally breaks both links at once: the installation would hold the
- * private half of the key it verifies against, so it could sign a licence it then accepts,
- * and the material would no longer correspond to what Key Vault validates. 227.1 pinned
- * this key "precisely because a key travelling inside the token it verifies proves
- * nothing"; a self-generated key proves exactly as little.
+ * How Miso pins, stores, or cross-checks that public key (Key Vault, Docker secrets file,
+ * online Mori check) is Miso's contract — Builder has no code path that inspects a vault
+ * or deployment mode. Builder's job stops at: refuse to mint, resolve what was supplied.
  *
  * The public half reaches an installation through the `moriLicensePublicKey` deployment
  * parameter, which the installation contract already classifies as registration-supplied.
@@ -120,8 +104,8 @@ function generateRsaSecretValues(keys, existing = {}, encryptionKey) {
     if (populated(existing[key]) || populated(values[key])) continue;
     const entry = catalog.findEntryForKey(key);
     if (entry?.generator?.type !== 'rsaKeyPair') continue;
-    // Supplied by Mori at deployment and validated against Key Vault. Generating it here
-    // would hand the installation the private half of the key it verifies licences against.
+    // Supplied by Mori; never generated here. Minting it would hand the installation the
+    // private half of the key it verifies licences against.
     if (isIssuerSuppliedPair(entry)) continue;
     const entries = catalog.data.parameters.filter(e => e.key &&
       e.generator?.type === 'rsaKeyPair' && e.generator.pairId === entry.generator.pairId);
@@ -146,12 +130,11 @@ function generateRsaSecretValues(keys, existing = {}, encryptionKey) {
 function generateRsaValueFromCatalog(key, catalogEntry) {
   if (isIssuerSuppliedPair(catalogEntry)) {
     throw new Error(
-      `Secret "${key}" is supplied by Mori and is never generated here. Licence trust is a ` +
-      'two-signature chain: Mori signs the licence, which is verified against the on-disk ' +
-      'public key, and that material is validated against a Key Vault key readable only by ' +
-      'Miso\'s managed identity. The public half reaches an installation through the ' +
-      'moriLicensePublicKey deployment parameter. An installation with neither stays ' +
-      'unpinned and refuses every licence, which is the intended failure.'
+      `Secret "${key}" is supplied by Mori and is never generated here. An installation that ` +
+      'minted it would hold the private half of the key it verifies licences against. The ' +
+      'public half reaches an installation through the moriLicensePublicKey deployment ' +
+      'parameter. An installation with neither stays unpinned and refuses every licence, ' +
+      'which is the intended failure.'
     );
   }
   return generateRsaSecretValues([key])[key];

package/lib/schema/infra.parameter.yaml

@@ -28,10 +28,6 @@ standardUpInfraEnsureKeys:
   - databases-dataplane-2-passwordKeyVault
   - databases-dataplane-3-urlKeyVault
   - databases-dataplane-3-passwordKeyVault
-  # Miso-controller Entra onboarding (vendor app); required for aifabrix resolve miso-controller
-  - entra-callback-uri
-  - entra-client-idKeyVault
-  - entra-client-secretKeyVault
 parameters:
   - key: postgres-passwordKeyVault
     scope: infra
@@ -351,47 +347,8 @@ parameters:
 
   # Miso-controller Entra ID onboarding (vendor multi-tenant app). Empty client/callback values
   # allow local resolve and start-dev; set real values before Entra admin-consent flows.
-  - key: entra-callback-uri
-    category: Microsoft Entra ID
-    sensitive: false
-    valueSource: optionalInput
-    requiredOnSystemOnboarding: false
-    scope: system
-    generator:
-      type: emptyString
-    ensureOn: [upInfra, resolveApp]
-    azure:
-      notes: >-
-        ENTRA_ID_CENTRAL_CALLBACK_URI — Mori web redirect (e.g. …/entra-id-concent/callback);
-        empty locally until Mori URL is configured.
-
-  - key: entra-client-idKeyVault
-    category: Microsoft Entra ID
-    sensitive: false
-    valueSource: optionalInput
-    requiredOnSystemOnboarding: false
-    scope: system
-    generator:
-      type: emptyString
-    ensureOn: [upInfra, resolveApp]
-    azure:
-      notes: >-
-        Vendor Entra app client id (ENTRA_ID_CLIENT_ID); empty for local dev without Entra flows.
-
-  - key: entra-client-secretKeyVault
-    category: Microsoft Entra ID
-    sensitive: true
-    valueSource: optionalInput
-    requiredOnSystemOnboarding: false
-    scope: system
-    generator:
-      type: emptyString
-    ensureOn: [upInfra, resolveApp]
-    azure:
-      legacyVaultSecretNames:
-        - entra-vendor-client-secret
-      notes: >-
-        Vendor Entra app client secret (ENTRA_ID_CLIENT_SECRET); empty for local dev without Entra flows.
+  # No entra-callback-uri, entra-client-idKeyVault or entra-client-secretKeyVault: Miso holds no
+  # Entra client credentials; Mori owns the registration and every sign-in (plan 248.0).
 
   # Keycloak events: webhook signature secret used by miso-controller (KEYCLOAK_EVENTS_SECRET).
   # This must exist on first boot because up-platform runs containers from templates (no prior resolve).

package/lib/schema/infrastructure-schema.json

@@ -509,8 +509,6 @@
         "acrResourceId",
         "deployRoleAssignments",
         "moriBaseUrl",
-        "entraIdClientId",
-        "entraIdClientSecret",
         "entraIdTenantId",
         "licenseEdition",
         "capacityProfile",
@@ -970,62 +968,6 @@
         "encryptionKey": {
           "$ref": "#/definitions/envReference"
         },
-        "entraIdClientId": {
-          "type": "object",
-          "required": [
-            "value",
-            "source",
-            "description"
-          ],
-          "additionalProperties": false,
-          "properties": {
-            "value": {
-              "type": "null"
-            },
-            "source": {
-              "type": "string",
-              "minLength": 1
-            },
-            "description": {
-              "type": "string",
-              "minLength": 1
-            },
-            "required": {
-              "type": "boolean"
-            },
-            "requiredAt": {
-              "const": "tenantActivation"
-            }
-          }
-        },
-        "entraIdClientSecret": {
-          "type": "object",
-          "required": [
-            "value",
-            "source",
-            "description"
-          ],
-          "additionalProperties": false,
-          "properties": {
-            "value": {
-              "type": "null"
-            },
-            "source": {
-              "type": "string",
-              "minLength": 1
-            },
-            "description": {
-              "type": "string",
-              "minLength": 1
-            },
-            "required": {
-              "type": "boolean"
-            },
-            "requiredAt": {
-              "const": "tenantActivation"
-            }
-          }
-        },
         "entraIdTenantId": {
           "type": "object",
           "required": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.63.0",
+  "version": "2.63.1",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {

package/templates/applications/builder-api/application.yaml

@@ -5,7 +5,7 @@ app:
   description: 'Business Transformation services — HTTP orchestration for connected-system workspace lifecycle via Dataplane Enterprise MCP and governance APIs.'
   type: webapp
   language: typescript
-  version: 2.63.0
+  version: 2.63.1
 
 # Image Configuration
 image:

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.82
+  version: 2.0.84
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).

package/templates/applications/dataplane/env.template

@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.82
+VERSION=2.0.84
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5

package/templates/applications/mirrored-templates.json

@@ -6,7 +6,7 @@
         "repo": "aifabrix-miso",
         "path": "builder/miso-controller/env.template"
       },
-      "sha256": "9b74b94d5d6e7457d22cfe213f2ec9c3dceb75c540df3953aba3b51c35df05c7"
+      "sha256": "c14aba1bd4588e334b89f3714714521e659d29f96bb76fc28ef17cacec47c80f"
     },
     {
       "path": "templates/applications/builder-api/env.template",
@@ -30,7 +30,7 @@
         "repo": "aifabrix-dataplane",
         "path": "builder/dataplane/env.template"
       },
-      "sha256": "d35eda839464a65ebd018064ea7c2d292654891b41d1f56862b052720a78a3cc"
+      "sha256": "3f4abcd6e3b7a8cb8a6029c8841b63c2384b863ef168a2ed0128bd5856119e3f"
     },
     {
       "path": "templates/applications/integration-server/env.template",

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.91'
+  version: '2.0.95'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
@@ -96,6 +96,11 @@ platforms:
         value: 'azure'
       - name: MORI_BASE_URL
         value: 'https://platform.aifabrix.dev/mori'
+      # Names the Mori policy-signing pair the licence bundle is checked against. Must match
+      # Mori's own POLICY_KEY_ID (aifabrix-mori builder/mori-controller/application.yaml).
+      # Names the Mori policy-signing pair (MORI_POLICY_KEY_ID); must match Mori's manifest.
+      - name: POLICY_KEY_ID
+        value: 'mori-policy-key-1'
 
   # Local Docker runs. No resource group is supplied, so `matchLocalPlatform` takes the FIRST entry
   # declaring the local platform (`dev`) -- this one -- and the literal `aifabrix-local` can never
@@ -135,6 +140,10 @@ platforms:
         value: 'swedencentral'
       - name: MORI_BASE_URL
         value: 'url://mori-controller-internal'
+      # Names the Mori policy-signing pair the licence bundle is checked against. Must match
+      # Mori's own POLICY_KEY_ID (aifabrix-mori builder/mori-controller/application.yaml).
+      - name: POLICY_KEY_ID
+        value: 'mori-policy-key-1'
       # Declared, because the fallback infers it and infers it wrongly here:
       # `resolveCloudVendor` returns 'azure' whenever AZURE_SUBSCRIPTION_ID is set, and every
       # developer box has it from the shared development service principal. A local stack was
@@ -186,6 +195,10 @@ platforms:
       # consumer of it was pointed at a loopback address that does not exist in the cluster.
       - name: MORI_BASE_URL
         value: 'https://platform-{platform}.aifabrix.dev/mori'
+      # Names the Mori policy-signing pair the licence bundle is checked against. Must match
+      # Mori's own POLICY_KEY_ID (aifabrix-mori builder/mori-controller/application.yaml).
+      - name: POLICY_KEY_ID
+        value: 'mori-policy-key-1'
 
   - resource: aifabrix-ce-*
     name: '*'
@@ -212,6 +225,10 @@ platforms:
       # (`platform-dev.aifabrix.dev/mori`) this entry can follow the pattern used above.
       - name: MORI_BASE_URL
         value: 'https://{resourceGroup}-miso-mori-controller.azurewebsites.net/mori'
+      # Names the Mori policy-signing pair the licence bundle is checked against. Must match
+      # Mori's own POLICY_KEY_ID (aifabrix-mori builder/mori-controller/application.yaml).
+      - name: POLICY_KEY_ID
+        value: 'mori-policy-key-1'
 
 configuration:
   # -------------------------------------------------------------------------

package/templates/applications/miso-controller/env.template

@@ -148,8 +148,7 @@ REDIS_PERMISSIONS_TTL=900
 # sync-application-urls-from-env.service.
 #
 # After POST /api/ide/onboarding/entra-id/configure succeeds, controller adds Microsoft Entra IdP to stock Keycloak
-# using the customer enterprise app (AI Fabrix Miso), not the vendor ENTRA_ID_CLIENT_ID app.
-# After configure: Keycloak broker redirect is on the customer enterprise app (AI Fabrix Miso), not ENTRA_ID_CLIENT_ID.
+# using the customer enterprise app (AI Fabrix Miso); its broker redirect is on that app.
 
 KEYCLOAK_REALM=aifabrix
 # Public issuer / browser URL (includes /auth when Keycloak uses KC_HTTP_RELATIVE_PATH=/auth).
@@ -231,16 +230,8 @@ MISO_CLIENTSECRET=kv://miso-controller-client-secretKeyVault
 # Kept in the shared block because EITHER mode may install Entra later from the plan 219
 # provider catalogue: Azure hosting does not force Entra, and SaaS may choose it.
 #
-# AI Fabrix vendor app for TA-1 admin consent and Entra ID configure flows.
-# Same ENTRA_ID_CLIENT_ID / ENTRA_ID_CLIENT_SECRET on every deployment.
-# Customer SSO after configure uses a separate enterprise app (AI Fabrix Miso);
-# Keycloak broker redirect is on that customer app, not ENTRA_ID_CLIENT_ID.
-#
-# ENTRA_ID_CENTRAL_CALLBACK_URI — Web redirect on the vendor app; must point at
-# Mori (e.g. …/entra-id-concent/callback), not the SPA or controller.
-ENTRA_ID_CENTRAL_CALLBACK_URI=url://mori-controller-public/entra-id-concent/callback
-ENTRA_ID_CLIENT_ID=kv://entra-client-idKeyVault
-ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
+# No Entra client id, secret or callback here. Mori owns the app registration and every
+# sign-in; Miso only says which scopes it needs (plan 248.0, remove-vendor-app-secret-from-miso).
 
 # =============================================================================
 # TENANT ACTIVATION (TA-3) — EXISTING LLM CATALOG — [customerOwned]
@@ -378,15 +369,6 @@ MORI_LICENSE_PUBLIC_KEY=kv://mori-license-public-keyKeyVault
 # MORI_LICENSE_PUBLIC_KEY_FILE=/run/secrets/mori-license-public-key.pem
 MORI_LICENSE_ISSUER=mori-controller
 
-# =============================================================================
-# ENTRA ID ONBOARDING (delegated Graph via Mori)
-# =============================================================================
-# Must match a Web redirect URI on the vendor multi-tenant app and Mori’s route
-# …/entra-graph-delegated/callback. Shared pro Mori addon (CICD *-miso-rg):
-ENTRA_GRAPH_DELEGATED_REDIRECT_URI=url://mori-controller-public/entra-graph-delegated/callback
-
-# Optional delegated Graph scopes for GET …/graph-auth-url (space- or comma-separated).
-# ENTRA_GRAPH_DELEGATED_SCOPES=https://graph.microsoft.com/Application.ReadWrite.All,https://graph.microsoft.com/Group.ReadWrite.All,https://graph.microsoft.com/Synchronization.ReadWrite.All,openid,profile,offline_access
 
 # Dev only: log full delegated Graph JWT in general_log_* as delegatedGraphJwt (default off).
 # LOG_GRAPH_TOKEN=true

package/templates/applications/miso-controller/rbac.yaml

@@ -91,6 +91,10 @@ permissions:
     roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
     description: 'Delete groups'
 
+  - name: 'user-groups:update'
+    roles: ['aifabrix-security-admin']
+    description: 'Manage user-group memberships'
+
   # Administrative Permissions
   - name: 'admin:read'
     roles: ['aifabrix-platform-admin']
@@ -315,15 +319,15 @@ permissions:
     description: 'View dimensions and dimension values'
 
   - name: 'dimensions:create'
-    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    roles: ['aifabrix-security-admin']
     description: 'Create dimensions and dimension values'
 
   - name: 'dimensions:update'
-    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    roles: ['aifabrix-security-admin']
     description: 'Update dimensions and dimension values'
 
   - name: 'dimensions:delete'
-    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    roles: ['aifabrix-security-admin']
     description: 'Delete dimensions and dimension values'
 
   # Resource Type Management
@@ -363,15 +367,15 @@ permissions:
     description: 'View business roles'
 
   - name: 'roles:create'
-    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    roles: ['aifabrix-security-admin']
     description: 'Create business roles'
 
   - name: 'roles:update'
-    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    roles: ['aifabrix-security-admin']
     description: 'Update business roles'
 
   - name: 'roles:delete'
-    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    roles: ['aifabrix-security-admin']
     description: 'Delete business roles'
 
   # Evidence Kind Management

package/templates/marketplace/main.json

@@ -5,7 +5,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.47.16.16243",
-      "templateHash": "703508813427294425"
+      "templateHash": "17889093247943830402"
     }
   },
   "parameters": {
@@ -179,20 +179,6 @@
         "description": "Expected `iss` claim on a Mori licence."
       }
     },
-    "entraIdClientId": {
-      "type": "string",
-      "defaultValue": "481251f2-a318-47ba-9ad8-40c36f790df1",
-      "metadata": {
-        "description": "Vendor Entra multi-tenant app client ID. Default matches vendor miso-controller .env (not in createUiDefinition)."
-      }
-    },
-    "entraIdClientSecret": {
-      "type": "securestring",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Optional vendor Entra app client secret. Configure through the Miso installation contract."
-      }
-    },
     "entraIdTenantId": {
       "type": "string",
       "defaultValue": "09aff594-ba37-4af2-bf40-b773b654c563",
@@ -2540,9 +2526,6 @@
           "encryptionKey": {
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets'), '2025-04-01').outputs.encryptionKey.value]"
           },
-          "entraIdClientSecret": {
-            "value": "[parameters('entraIdClientSecret')]"
-          },
           "moriLicensePublicKey": {
             "value": "[parameters('moriLicensePublicKey')]"
           },
@@ -2560,7 +2543,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "4650500285752133401"
+              "templateHash": "6681447246114830480"
             }
           },
           "parameters": {
@@ -2629,13 +2612,6 @@
                 "description": "MISO Client Secret (auto-generated if not provided)"
               }
             },
-            "entraIdClientSecret": {
-              "type": "securestring",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Vendor Entra app client secret (ENTRA_ID_CLIENT_SECRET). Placeholder when empty — replace for live Entra flows."
-              }
-            },
             "moriLicensePublicKey": {
               "type": "string",
               "defaultValue": "",
@@ -2659,7 +2635,6 @@
             }
           },
           "variables": {
-            "resolvedEntraIdClientSecret": "[if(not(empty(parameters('entraIdClientSecret'))), parameters('entraIdClientSecret'), format('PLACEHOLDER_ENTRA_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]",
             "misoWebAppOrigin": "[if(endsWith(parameters('misoWebAppUrl'), '/'), substring(parameters('misoWebAppUrl'), 0, max(0, sub(length(parameters('misoWebAppUrl')), 1))), parameters('misoWebAppUrl'))]",
             "misoVdirSegment": "[if(or(equals(parameters('misoVdirPublic'), ''), equals(parameters('misoVdirPublic'), '/')), '', if(startsWith(parameters('misoVdirPublic'), '/'), parameters('misoVdirPublic'), format('/{0}', parameters('misoVdirPublic'))))]",
             "misoWebServerPublicUrl": "[if(empty(variables('misoVdirSegment')), variables('misoWebAppOrigin'), format('{0}{1}', variables('misoWebAppOrigin'), variables('misoVdirSegment')))]",
@@ -2750,14 +2725,6 @@
                 "value": "[if(not(empty(parameters('misoClientSecret'))), parameters('misoClientSecret'), format('PLACEHOLDER_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]"
               }
             },
-            {
-              "type": "Microsoft.KeyVault/vaults/secrets",
-              "apiVersion": "2023-07-01",
-              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'entra-client-secretKeyVault')]",
-              "properties": {
-                "value": "[variables('resolvedEntraIdClientSecret')]"
-              }
-            },
             {
               "condition": "[not(empty(parameters('moriLicensePublicKey')))]",
               "type": "Microsoft.KeyVault/vaults/secrets",
@@ -2891,9 +2858,6 @@
           "moriLicenseIssuer": {
             "value": "[parameters('moriLicenseIssuer')]"
           },
-          "entraIdClientId": {
-            "value": "[parameters('entraIdClientId')]"
-          },
           "entraIdTenantId": {
             "value": "[variables('effectiveEntraIdTenantId')]"
           },
@@ -2926,7 +2890,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "9991546815810387946"
+              "templateHash": "16391707537665698614"
             }
           },
           "parameters": {
@@ -3136,13 +3100,6 @@
                 "description": "Expected `iss` claim on a Mori licence."
               }
             },
-            "entraIdClientId": {
-              "type": "string",
-              "defaultValue": "481251f2-a318-47ba-9ad8-40c36f790df1",
-              "metadata": {
-                "description": "Vendor multi-tenant Entra app client ID. No longer emitted as an app setting — Miso does not hold provider credentials; Mori does. Retained so the marketplace parameter surface is unchanged."
-              }
-            },
             "entraIdTenantId": {
               "type": "string",
               "defaultValue": "09aff594-ba37-4af2-bf40-b773b654c563",
@@ -3224,8 +3181,6 @@
             "databaseUrlAppSettingValue": "[if(not(empty(parameters('databaseUrlSecretUriWithVersion'))), format('@Microsoft.KeyVault(SecretUri={0})', parameters('databaseUrlSecretUriWithVersion')), format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-databases-0-urlKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix')))]",
             "databaseLogUrlAppSettingValue": "[if(not(empty(parameters('databaseLogUrlSecretUriWithVersion'))), format('@Microsoft.KeyVault(SecretUri={0})', parameters('databaseLogUrlSecretUriWithVersion')), format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-databases-1-urlKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix')))]",
             "moriBaseNormalized": "[if(and(greater(length(parameters('moriBaseUrl')), 1), endsWith(parameters('moriBaseUrl'), '/')), substring(parameters('moriBaseUrl'), 0, max(0, sub(length(parameters('moriBaseUrl')), 1))), parameters('moriBaseUrl'))]",
-            "moriEntraGraphDelegatedRedirectUri": "[format('{0}/entra-graph-delegated/callback', variables('moriBaseNormalized'))]",
-            "moriEntraCentralCallbackUri": "[format('{0}/entra-id-concent/callback', variables('moriBaseNormalized'))]",
             "registryCredentialAppSettings": "[if(and(parameters('registryPasswordConfigured'), not(empty(parameters('acrLoginServer')))), createArray(createObject('name', 'DOCKER_REGISTRY_SERVER_USERNAME', 'value', parameters('acrAdminUsername')), createObject('name', 'DOCKER_REGISTRY_SERVER_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-acr-registry-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix')))), createArray())]"
           },
           "resources": [
@@ -3268,7 +3223,7 @@
                   "acrUseManagedIdentityCreds": "[not(parameters('registryPasswordConfigured'))]",
                   "healthCheckPath": "/health",
                   "alwaysOn": true,
-                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'DATABASE_URL', 'value', variables('databaseUrlAppSettingValue')), createObject('name', 'JWT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-secrets-jwtKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'NODE_ENV', 'value', 'production'), createObject('name', 'LOCATION', 'value', parameters('location')), createObject('name', 'PORT', 'value', '3000'), createObject('name', 'ALLOWED_ORIGINS', 'value', format('http://localhost:*,http://127.0.0.1:*,https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'DATABASELOG_URL', 'value', variables('databaseLogUrlAppSettingValue')), createObject('name', 'KEY_VAULT_ENABLED', 'value', 'true'), createObject('name', 'SECURITY_STORAGE_MODE', 'value', 'keyvault'), createObject('name', 'KEY_VAULT_URL', 'value', format('https://{0}.vault.azure.net/', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENCRYPTION_KEY', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-encryption-keyKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'AUTO_CREATE_TABLES', 'value', if(parameters('autoCreateTables'), 'true', 'false')), createObject('name', 'KEYCLOAK_REALM', 'value', parameters('keycloakRealm')), createObject('name', 'KEYCLOAK_CLIENT_ID', 'value', parameters('keycloakClientId')), createObject('name', 'KEYCLOAK_ADMIN_USERNAME', 'value', parameters('keycloakAdminUsername')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-keycloak-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-onboarding-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_EMAIL', 'value', parameters('adminEmail')), createObject('name', 'KEYCLOAK_SERVER_URL', 'value', variables('keycloakPublicUrl')), createObject('name', 'KEYCLOAK_INTERNAL_SERVER_URL', 'value', variables('keycloakInternalUrl')), createObject('name', 'KEYCLOAK_TOKEN_TIMEOUT', 'value', '5000'), createObject('name', 'KEYCLOAK_VERIFY_AUDIENCE', 'value', if(parameters('keycloakVerifyAudience'), 'true', 'false')), createObject('name', 'DISABLE_RATE_LIMIT', 'value', variables('shouldDisableRateLimit')), createObject('name', 'SKIP_DB_REDEPLOY', 'value', 'true'), createObject('name', 'MISO_WEB_SERVER_URL', 'value', variables('misoPublicUrl')), createObject('name', 'MISO_CONTROLLER_URL', 'value', variables('misoInternalUrl')), createObject('name', 'MISO_RELATIVE_PATH', 'value', variables('misoVdirValue')), createObject('name', 'CONTROLLER_BASE_URL', 'value', if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))), createObject('name', 'AZURE_SUBSCRIPTION_ID', 'value', subscription().subscriptionId), createObject('name', 'TENANT_ID', 'value', subscription().tenantId), createObject('name', 'DEPLOYMENT', 'value', 'azure'), createObject('name', 'AZURE_RESOURCE_GROUP_NAME', 'value', parameters('resourceGroupName')), createObject('name', 'INFRASTRUCTURE_NAME', 'value', parameters('prefix')), createObject('name', 'ENTRA_ID_TENANT_ID', 'value', parameters('entraIdTenantId')), createObject('name', 'MISO_CLIENTID', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-miso-clientIdKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'MISO_CLIENTSECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_BASE_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-base-urlKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_LICENSE_PUBLIC_KEY', 'value', if(empty(parameters('moriLicensePublicKey')), '', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-license-public-keyKeyVault)', last(split(parameters('keyVaultId'), '/'))))), createObject('name', 'MORI_LICENSE_ISSUER', 'value', parameters('moriLicenseIssuer')), createObject('name', 'ENTRA_GRAPH_DELEGATED_REDIRECT_URI', 'value', variables('moriEntraGraphDelegatedRedirectUri')), createObject('name', 'ENTRA_ID_CENTRAL_CALLBACK_URI', 'value', variables('moriEntraCentralCallbackUri')), createObject('name', 'DOCKER_ENABLE_CI', 'value', 'true'), createObject('name', 'DOCKER_REGISTRY_SERVER_URL', 'value', if(not(empty(parameters('acrLoginServer'))), format('https://{0}', parameters('acrLoginServer')), '')), createObject('name', 'ONBOARDING_CREATE_PIPELINE_CREDENTIALS', 'value', 'true'), createObject('name', 'BOOTSTRAP_APPKEYS', 'value', parameters('bootstrapAppKeys')), createObject('name', 'LICENSE_JWT', 'value', parameters('licenseJwt')), createObject('name', 'INSTALLATION_RESOURCE_MODEL', 'value', parameters('installationResourceModel')), createObject('name', 'LICENSE_EDITION', 'value', parameters('licenseEdition')), createObject('name', 'ONBOARDING_MODE', 'value', parameters('onboardingMode')), createObject('name', 'INSTALLATION_CAPACITY_PROFILE', 'value', parameters('capacityProfile'))), variables('registryCredentialAppSettings'))]",
+                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'DATABASE_URL', 'value', variables('databaseUrlAppSettingValue')), createObject('name', 'JWT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-secrets-jwtKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'NODE_ENV', 'value', 'production'), createObject('name', 'LOCATION', 'value', parameters('location')), createObject('name', 'PORT', 'value', '3000'), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'DATABASELOG_URL', 'value', variables('databaseLogUrlAppSettingValue')), createObject('name', 'KEY_VAULT_ENABLED', 'value', 'true'), createObject('name', 'SECURITY_STORAGE_MODE', 'value', 'keyvault'), createObject('name', 'KEY_VAULT_URL', 'value', format('https://{0}.vault.azure.net/', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENCRYPTION_KEY', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-encryption-keyKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'AUTO_CREATE_TABLES', 'value', if(parameters('autoCreateTables'), 'true', 'false')), createObject('name', 'KEYCLOAK_REALM', 'value', parameters('keycloakRealm')), createObject('name', 'KEYCLOAK_CLIENT_ID', 'value', parameters('keycloakClientId')), createObject('name', 'KEYCLOAK_ADMIN_USERNAME', 'value', parameters('keycloakAdminUsername')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-keycloak-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-onboarding-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_EMAIL', 'value', parameters('adminEmail')), createObject('name', 'KEYCLOAK_SERVER_URL', 'value', variables('keycloakPublicUrl')), createObject('name', 'KEYCLOAK_INTERNAL_SERVER_URL', 'value', variables('keycloakInternalUrl')), createObject('name', 'KEYCLOAK_TOKEN_TIMEOUT', 'value', '5000'), createObject('name', 'KEYCLOAK_VERIFY_AUDIENCE', 'value', if(parameters('keycloakVerifyAudience'), 'true', 'false')), createObject('name', 'DISABLE_RATE_LIMIT', 'value', variables('shouldDisableRateLimit')), createObject('name', 'SKIP_DB_REDEPLOY', 'value', 'true'), createObject('name', 'MISO_WEB_SERVER_URL', 'value', variables('misoPublicUrl')), createObject('name', 'MISO_CONTROLLER_URL', 'value', variables('misoInternalUrl')), createObject('name', 'MISO_RELATIVE_PATH', 'value', variables('misoVdirValue')), createObject('name', 'CONTROLLER_BASE_URL', 'value', if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))), createObject('name', 'AZURE_SUBSCRIPTION_ID', 'value', subscription().subscriptionId), createObject('name', 'TENANT_ID', 'value', subscription().tenantId), createObject('name', 'DEPLOYMENT', 'value', 'azure'), createObject('name', 'AZURE_RESOURCE_GROUP_NAME', 'value', parameters('resourceGroupName')), createObject('name', 'INFRASTRUCTURE_NAME', 'value', parameters('prefix')), createObject('name', 'ENTRA_ID_TENANT_ID', 'value', parameters('entraIdTenantId')), createObject('name', 'MISO_CLIENTID', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-miso-clientIdKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'MISO_CLIENTSECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_BASE_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-base-urlKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_LICENSE_PUBLIC_KEY', 'value', if(empty(parameters('moriLicensePublicKey')), '', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-license-public-keyKeyVault)', last(split(parameters('keyVaultId'), '/'))))), createObject('name', 'MORI_LICENSE_ISSUER', 'value', parameters('moriLicenseIssuer')), createObject('name', 'DOCKER_ENABLE_CI', 'value', 'true'), createObject('name', 'DOCKER_REGISTRY_SERVER_URL', 'value', if(not(empty(parameters('acrLoginServer'))), format('https://{0}', parameters('acrLoginServer')), '')), createObject('name', 'ONBOARDING_CREATE_PIPELINE_CREDENTIALS', 'value', 'true'), createObject('name', 'BOOTSTRAP_APPKEYS', 'value', parameters('bootstrapAppKeys')), createObject('name', 'LICENSE_JWT', 'value', parameters('licenseJwt')), createObject('name', 'INSTALLATION_RESOURCE_MODEL', 'value', parameters('installationResourceModel')), createObject('name', 'LICENSE_EDITION', 'value', parameters('licenseEdition')), createObject('name', 'ONBOARDING_MODE', 'value', parameters('onboardingMode')), createObject('name', 'INSTALLATION_CAPACITY_PROFILE', 'value', parameters('capacityProfile'))), variables('registryCredentialAppSettings'))]",
                   "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
                 },
                 "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
@@ -3663,9 +3618,6 @@
           },
           "encryptionKey": {
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets'), '2025-04-01').outputs.encryptionKey.value]"
-          },
-          "entraIdClientSecret": {
-            "value": "[parameters('entraIdClientSecret')]"
           }
         },
         "template": {
@@ -3675,7 +3627,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "4650500285752133401"
+              "templateHash": "6681447246114830480"
             }
           },
           "parameters": {
@@ -3744,13 +3696,6 @@
                 "description": "MISO Client Secret (auto-generated if not provided)"
               }
             },
-            "entraIdClientSecret": {
-              "type": "securestring",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Vendor Entra app client secret (ENTRA_ID_CLIENT_SECRET). Placeholder when empty — replace for live Entra flows."
-              }
-            },
             "moriLicensePublicKey": {
               "type": "string",
               "defaultValue": "",
@@ -3774,7 +3719,6 @@
             }
           },
           "variables": {
-            "resolvedEntraIdClientSecret": "[if(not(empty(parameters('entraIdClientSecret'))), parameters('entraIdClientSecret'), format('PLACEHOLDER_ENTRA_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]",
             "misoWebAppOrigin": "[if(endsWith(parameters('misoWebAppUrl'), '/'), substring(parameters('misoWebAppUrl'), 0, max(0, sub(length(parameters('misoWebAppUrl')), 1))), parameters('misoWebAppUrl'))]",
             "misoVdirSegment": "[if(or(equals(parameters('misoVdirPublic'), ''), equals(parameters('misoVdirPublic'), '/')), '', if(startsWith(parameters('misoVdirPublic'), '/'), parameters('misoVdirPublic'), format('/{0}', parameters('misoVdirPublic'))))]",
             "misoWebServerPublicUrl": "[if(empty(variables('misoVdirSegment')), variables('misoWebAppOrigin'), format('{0}{1}', variables('misoWebAppOrigin'), variables('misoVdirSegment')))]",
@@ -3865,14 +3809,6 @@
                 "value": "[if(not(empty(parameters('misoClientSecret'))), parameters('misoClientSecret'), format('PLACEHOLDER_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]"
               }
             },
-            {
-              "type": "Microsoft.KeyVault/vaults/secrets",
-              "apiVersion": "2023-07-01",
-              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'entra-client-secretKeyVault')]",
-              "properties": {
-                "value": "[variables('resolvedEntraIdClientSecret')]"
-              }
-            },
             {
               "condition": "[not(empty(parameters('moriLicensePublicKey')))]",
               "type": "Microsoft.KeyVault/vaults/secrets",