@aifabrix/builder 2.47.0 → 2.47.2

package/lib/build/docker-build-args.js

@@ -0,0 +1,83 @@
+/**
+ * Docker build-arg resolution from resolved env and shell overlays.
+ *
+ * @fileoverview Build-time args for `aifabrix build` / docker build
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const secretsEnvWrite = require('../core/secrets-env-write');
+const { assertMisoControllerNpmSdkDeps } = require('./miso-controller-npm-sdk-guard');
+
+const MISO_CONTROLLER_UI_BUILD_ARG_KEYS = [
+  'MISO_RELATIVE_PATH',
+  'MISO_WEB_SERVER_URL',
+  'VITE_BASE_PATH',
+  'KEYCLOAK_SERVER_URL',
+  'KEYCLOAK_REALM',
+  'KEYCLOAK_CLIENT_ID'
+];
+
+/**
+ * @param {Object.<string, string>} buildArgs
+ * @param {Object.<string, string>} envMap
+ */
+function applyMisoControllerUiBuildArgs(buildArgs, envMap) {
+  for (const key of MISO_CONTROLLER_UI_BUILD_ARG_KEYS) {
+    const value = envMap[key];
+    if (typeof value === 'string' && value.trim() && !value.includes('://')) {
+      buildArgs[key] = value.trim();
+    }
+  }
+  if (!buildArgs.VITE_BASE_PATH && buildArgs.MISO_RELATIVE_PATH) {
+    buildArgs.VITE_BASE_PATH = buildArgs.MISO_RELATIVE_PATH;
+  }
+  if (!buildArgs.VITE_BASE_PATH && buildArgs.MISO_WEB_SERVER_URL) {
+    try {
+      const pathname = new URL(buildArgs.MISO_WEB_SERVER_URL).pathname.replace(/\/+$/, '');
+      if (pathname && pathname !== '/') {
+        buildArgs.VITE_BASE_PATH = pathname;
+      }
+    } catch {
+      // ignore invalid public URL
+    }
+  }
+}
+
+/**
+ * Resolve Docker build-args from resolved env map and merged BASH_* secrets.
+ *
+ * @param {string} appName
+ * @param {string} [contextPath] Docker build context (repo root for miso-controller)
+ * @returns {Promise<Object.<string, string>>}
+ */
+async function resolveDockerBuildArgsForApp(appName, contextPath) {
+  const envMap = await secretsEnvWrite.resolveAndGetEnvMap(appName, { environment: 'docker' });
+  const { getBashPrefixedProcessEnvOverlay } = require('../utils/bash-secret-env');
+  const bashOverlay = await getBashPrefixedProcessEnvOverlay(null, appName);
+  const buildArgs = {};
+  if (envMap.NPM_TOKEN) buildArgs.NPM_TOKEN = envMap.NPM_TOKEN;
+  if (envMap.PYPI_TOKEN) buildArgs.PYPI_TOKEN = envMap.PYPI_TOKEN;
+  for (const [k, v] of Object.entries(bashOverlay)) {
+    if (v && buildArgs[k] === undefined) buildArgs[k] = v;
+  }
+  const shellNpm = typeof process.env.NPM_TOKEN === 'string' ? process.env.NPM_TOKEN.trim() : '';
+  const shellPypi = typeof process.env.PYPI_TOKEN === 'string' ? process.env.PYPI_TOKEN.trim() : '';
+  if (shellNpm) buildArgs.NPM_TOKEN = shellNpm;
+  if (shellPypi) buildArgs.PYPI_TOKEN = shellPypi;
+  if (appName === 'miso-controller') {
+    applyMisoControllerUiBuildArgs(buildArgs, envMap);
+  }
+  if (appName === 'miso-controller' && contextPath) {
+    assertMisoControllerNpmSdkDeps(path.resolve(contextPath));
+  }
+  return buildArgs;
+}
+
+module.exports = {
+  resolveDockerBuildArgsForApp,
+  applyMisoControllerUiBuildArgs
+};

package/lib/build/index.js

@@ -35,9 +35,8 @@ const dockerBuild = require('../utils/docker-build');
 const buildCopy = require('../utils/build-copy');
 const { resolveBuildDockerTagNames } = require('../utils/build-resolve-image');
 const buildHelpers = require('../utils/build-helpers');
-const secretsEnvWrite = require('../core/secrets-env-write');
 const { ensureRunSecretsForApp } = require('../app/run-env-compose');
-const { assertMisoControllerNpmSdkDeps } = require('./miso-controller-npm-sdk-guard');
+const { resolveDockerBuildArgsForApp } = require('./docker-build-args');
 
 /**
  * Loads application config for an application
@@ -394,33 +393,6 @@ async function handleDockerfileGeneration(appName, params, options, buildHelpers
   }, generateDockerfile);
 }
 
-/**
- * Resolve Docker build-args from resolved env map and merged BASH_* secrets.
- * @param {string} appName
- * @param {string} [contextPath] Docker build context (repo root for miso-controller)
- * @returns {Promise<Object.<string, string>>}
- */
-async function resolveDockerBuildArgsForApp(appName, contextPath) {
-  const envMap = await secretsEnvWrite.resolveAndGetEnvMap(appName, { environment: 'docker' });
-  const { getBashPrefixedProcessEnvOverlay } = require('../utils/bash-secret-env');
-  const bashOverlay = await getBashPrefixedProcessEnvOverlay(null, appName);
-  const buildArgs = {};
-  if (envMap.NPM_TOKEN) buildArgs.NPM_TOKEN = envMap.NPM_TOKEN;
-  if (envMap.PYPI_TOKEN) buildArgs.PYPI_TOKEN = envMap.PYPI_TOKEN;
-  for (const [k, v] of Object.entries(bashOverlay)) {
-    if (v && buildArgs[k] === undefined) buildArgs[k] = v;
-  }
-  // Exported shell tokens win (local dev: export NPM_TOKEN=... before af build / docker build).
-  const shellNpm = typeof process.env.NPM_TOKEN === 'string' ? process.env.NPM_TOKEN.trim() : '';
-  const shellPypi = typeof process.env.PYPI_TOKEN === 'string' ? process.env.PYPI_TOKEN.trim() : '';
-  if (shellNpm) buildArgs.NPM_TOKEN = shellNpm;
-  if (shellPypi) buildArgs.PYPI_TOKEN = shellPypi;
-  if (appName === 'miso-controller' && contextPath) {
-    assertMisoControllerNpmSdkDeps(path.resolve(contextPath));
-  }
-  return buildArgs;
-}
-
 /**
  * Standard Docker build path after CLI header is printed (non-external apps).
  * @param {string} appName

package/lib/cli/index.js

@@ -31,6 +31,7 @@ const { setupPlatformCommands } = require('./setup-platform');
 const { setupCertificationCommands } = require('./setup-certification-commands');
 const { setupGovernanceCommands } = require('../commands/governance');
 const { setupChannelCommands } = require('../commands/channel');
+const { setupNpmCommands } = require('./setup-npm');
 
 /**
  * Dev, secrets, parameters, and platform commands (keeps setupCommands under statement limit).
@@ -39,6 +40,7 @@ const { setupChannelCommands } = require('../commands/channel');
 function setupDevAndPlatformCommands(program) {
   setupDevCommands(program);
   setupSecretsCommands(program);
+  setupNpmCommands(program);
   setupParametersCommands(program);
   setupPlatformCommands(program);
 }

package/lib/cli/infra-guided-auth.js

@@ -11,7 +11,7 @@
 const chalk = require('chalk');
 const logger = require('../utils/logger');
 const config = require('../core/config');
-const { resolvePlatformControllerUrl } = require('../utils/platform-controller-url');
+const { resolvePlatformControllerUrl, resolveCliPlatformControllerUrl } = require('../utils/platform-controller-url');
 const { withMutedLogger } = require('../utils/with-muted-logger');
 const { formatBlockingError } = require('../utils/cli-test-layout-chalk');
 const { isAuthenticationError } = require('../utils/cli-utils');
@@ -19,29 +19,45 @@ const { resolveControllerUrl, isPlatformAuthValidForController } = require('../u
 
 /**
  * @param {Object} authOpts
- * @returns {Promise<string>}
+ * @returns {Promise<{ apiUrl: string, tokenUrl: string }>}
  */
-async function resolveGuidedAuthControllerUrl(authOpts = {}) {
-  return (
+async function resolveGuidedAuthControllerUrls(authOpts = {}) {
+  const tokenUrl =
     authOpts.platformControllerUrl ||
     (await config.getPlatformControllerUrl()) ||
-    (await resolvePlatformControllerUrl())
-  );
+    (await resolvePlatformControllerUrl());
+  const remoteServer = await config.getRemoteServer();
+  let apiUrl = tokenUrl;
+  if (remoteServer && String(remoteServer).trim()) {
+    apiUrl = await resolveCliPlatformControllerUrl();
+  }
+  return { apiUrl, tokenUrl };
+}
+
+/**
+ * @param {Object} authOpts
+ * @returns {Promise<string>}
+ */
+async function resolveGuidedAuthControllerUrl(authOpts = {}) {
+  const { apiUrl } = await resolveGuidedAuthControllerUrls(authOpts);
+  return apiUrl;
 }
 
 /**
  * @async
  * @param {Function} handleLoginFn
- * @param {string} controllerUrl
- * @param {{ skipDataplaneVersionRefresh?: boolean }} [opts]
+ * @param {string} controllerUrl - Controller API base URL (may be localhost on builder host)
+ * @param {{ skipDataplaneVersionRefresh?: boolean, tokenControllerUrl?: string }} [opts]
  * @returns {Promise<void>}
  */
 async function runGuidedDeviceLogin(handleLoginFn, controllerUrl, opts = {}) {
   await handleLoginFn({
     method: 'device',
     controller: controllerUrl,
+    tokenControllerUrl: opts.tokenControllerUrl,
     environment: 'dev',
     compact: true,
+    skipControllerUrlPersist: Boolean(opts.tokenControllerUrl),
     skipDataplaneVersionRefresh: opts.skipDataplaneVersionRefresh === true,
     exitOnFailure: false
   });
@@ -56,20 +72,27 @@ async function runGuidedDeviceLogin(handleLoginFn, controllerUrl, opts = {}) {
  */
 async function runGuidedAuthStep(handleLoginFn, authOpts, spinners) {
   const spin = spinners.startSpinner('Authenticating...');
-  const controllerUrl = await resolveGuidedAuthControllerUrl(authOpts);
+  const { apiUrl, tokenUrl } = await resolveGuidedAuthControllerUrls(authOpts);
+  const loginOpts = { skipDataplaneVersionRefresh: true, tokenControllerUrl: tokenUrl };
   const skipLogin =
     authOpts.skipLoginIfAuthenticated === true ||
-    (await isPlatformAuthValidForController(controllerUrl));
+    (await isPlatformAuthValidForController(tokenUrl));
   try {
     if (skipLogin) {
       spinners.stopSpinnerSuccess(spin, 'Already authenticated');
       return;
     }
-    await runGuidedDeviceLogin(handleLoginFn, controllerUrl, { skipDataplaneVersionRefresh: true });
+    await runGuidedDeviceLogin(handleLoginFn, apiUrl, loginOpts);
   } catch (authErr) {
     if (spin) spin.fail('Authentication required');
+    const retriable =
+      isAuthenticationError(authErr) ||
+      /device code|authorization_pending|complete sign-in|browser/i.test(String(authErr.message || ''));
+    if (!retriable) {
+      throw authErr;
+    }
     logger.error(formatBlockingError('Authentication required. Complete sign-in in your browser.'));
-    await runGuidedDeviceLogin(handleLoginFn, controllerUrl, { skipDataplaneVersionRefresh: true });
+    await runGuidedDeviceLogin(handleLoginFn, apiUrl, loginOpts);
   }
   spinners.stopSpinnerSuccess(spin, 'Authenticated');
 }
@@ -102,6 +125,7 @@ async function runGuidedDataplaneWithAuthRecovery(options, handleUpDataplane, ha
 }
 
 module.exports = {
+  resolveGuidedAuthControllerUrls,
   resolveGuidedAuthControllerUrl,
   runGuidedDeviceLogin,
   runGuidedAuthStep,

package/lib/cli/setup-npm.js

@@ -0,0 +1,59 @@
+/**
+ * CLI npm command setup (user-global registry auth).
+ *
+ * @fileoverview aifabrix npm config command registration
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+const { handleCommandError } = require('../utils/cli-utils');
+const { handleNpmConfig } = require('../commands/npm-config');
+
+const NPM_CONFIG_HELP_AFTER = `
+Writes @aifabrix scope registry auth to your user npm config (~/.npmrc by default).
+Does not modify repo-level .npmrc files.
+
+Token source (default): merged secrets key BASH_NPM_TOKEN (user or --shared store).
+Docker/build: BASH_NPM_TOKEN is also mapped to NPM_TOKEN for aifabrix build.
+
+Examples:
+  $ aifabrix secret set BASH_NPM_TOKEN "<token>" --shared
+  $ aifabrix npm config
+  $ aifabrix npm config --check
+  $ aifabrix npm config --dry-run
+  $ NPM_TOKEN="<token>" aifabrix npm config --from-env
+
+Migration from repo .npmrc.token:
+  1. aifabrix secret remove npm-token-secretKeyVault --shared
+  2. aifabrix secret set BASH_NPM_TOKEN "<token>" --shared
+  3. aifabrix npm config
+  4. npm whoami --registry=https://registry.npmjs.org/
+`;
+
+/**
+ * @param {import('commander').Command} program
+ */
+function setupNpmCommands(program) {
+  const npm = program.command('npm').description('User-global npm registry configuration');
+
+  npm
+    .command('config')
+    .description('Apply @aifabrix npm auth from BASH_NPM_TOKEN to user ~/.npmrc')
+    .option('--dry-run', 'Show what would be written without changing files')
+    .option('--check', 'Exit 0 when BASH_NPM_TOKEN is set and npm whoami succeeds')
+    .option('--from-env', 'Use NPM_TOKEN from the environment once (not merged secrets)')
+    .addHelpText('after', NPM_CONFIG_HELP_AFTER)
+    .action(async(opts) => {
+      try {
+        await handleNpmConfig({
+          dryRun: Boolean(opts.dryRun),
+          check: Boolean(opts.check),
+          fromEnv: Boolean(opts.fromEnv)
+        });
+      } catch (error) {
+        handleCommandError(error, 'npm config');
+      }
+    });
+}
+
+module.exports = { setupNpmCommands };

package/lib/cli/setup-secrets.js

@@ -101,7 +101,7 @@ Examples:
 const SECRET_SET_SECRETS_FILE_HELP_AFTER = `
 Examples:
   $ aifabrix secret set-secrets-file ./shared-secrets.yaml
-  $ aifabrix secret set-secrets-file https://dev.example.com/api/secrets
+  $ aifabrix secret set-secrets-file https://builder01.local/api/dev/secrets
   $ aifabrix secret set-secrets-file ""
 `;
 

package/lib/commands/login-device.js

@@ -81,8 +81,11 @@ async function saveDeviceLoginConfig(controllerUrl, token, refreshToken, expires
  * @returns {Promise<void>}
  */
 async function saveTokenAndDisplaySuccess(controllerUrl, token, refreshToken, expiresAt, envKey, opts = {}) {
-  await saveDeviceLoginConfig(controllerUrl, token, refreshToken, expiresAt);
-  await setControllerUrl(controllerUrl);
+  const storageUrl = opts.tokenControllerUrl
+    ? String(opts.tokenControllerUrl).trim().replace(/\/+$/, '')
+    : controllerUrl;
+  await saveDeviceLoginConfig(storageUrl, token, refreshToken, expiresAt);
+  await setControllerUrl(storageUrl);
   if (envKey) {
     await setCurrentEnvironment(envKey);
   }
@@ -219,6 +222,8 @@ function convertDeviceCodeResponse(apiResponse) {
     device_code: deviceCodeData.deviceCode || deviceCodeData.device_code,
     user_code: deviceCodeData.userCode || deviceCodeData.user_code,
     verification_uri: deviceCodeData.verificationUri || deviceCodeData.verification_uri,
+    verification_uri_complete:
+      deviceCodeData.verificationUriComplete || deviceCodeData.verification_uri_complete,
     expires_in: deviceCodeData.expiresIn || deviceCodeData.expires_in || 600,
     interval: deviceCodeData.interval || 5
   };
@@ -246,8 +251,11 @@ function logDeviceFlowError(deviceError, opts) {
 }
 
 function printCompactDeviceUrl(deviceCodeResponse) {
+  const visitUrl =
+    deviceCodeResponse.verification_uri_complete ||
+    `${deviceCodeResponse.verification_uri}?user_code=${deviceCodeResponse.user_code}`;
   logger.log('\nOpen browser to authenticate:');
-  logger.log(chalk.yellow(`${deviceCodeResponse.verification_uri}?user_code=${deviceCodeResponse.user_code}\n`));
+  logger.log(chalk.yellow(`${visitUrl}\n`));
 }
 
 /**

package/lib/commands/login.js

@@ -86,8 +86,12 @@ async function normalizeControllerUrl(options) {
     controllerUrl = await resolveControllerUrl();
   }
   controllerUrl = String(controllerUrl).trim().replace(/\/+$/, '');
-  // Save controller URL to config
-  await setControllerUrl(controllerUrl);
+  if (!options.skipControllerUrlPersist) {
+    const persistUrl = options.tokenControllerUrl
+      ? String(options.tokenControllerUrl).trim().replace(/\/+$/, '')
+      : controllerUrl;
+    await setControllerUrl(persistUrl);
+  }
   if (!options.compact) {
     logger.log(chalk.gray(`Controller URL: ${controllerUrl}`));
   }
@@ -158,7 +162,8 @@ async function handleCredentialsLoginFlow(controllerUrl, environment, options) {
 async function handleDeviceCodeLoginFlow(controllerUrl, environment, options) {
   return await handleDeviceCodeLogin(controllerUrl, environment, options.online, options.scope, {
     compact: Boolean(options.compact),
-    exitOnFailure: options.exitOnFailure !== false
+    exitOnFailure: options.exitOnFailure !== false,
+    tokenControllerUrl: options.tokenControllerUrl
   });
 }
 

package/lib/commands/npm-config.js

@@ -0,0 +1,103 @@
+/**
+ * aifabrix npm config — apply user-global npm auth from BASH_NPM_TOKEN.
+ *
+ * @fileoverview npm config command handler
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { execFile } = require('child_process');
+const { promisify } = require('util');
+const chalk = require('chalk');
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+const logger = require('../utils/logger');
+const secretsLoad = require('../core/secrets-load');
+const { collectBashPrefixedEnv } = require('../utils/bash-secret-env');
+const {
+  REGISTRY_URL,
+  getUserNpmrcPath,
+  writeUserNpmrcFromToken
+} = require('../utils/npm-user-config');
+
+const execFileAsync = promisify(execFile);
+
+/**
+ * Resolve npm token from merged secrets or --from-env.
+ *
+ * @param {{ fromEnv?: boolean }} options
+ * @returns {Promise<string>}
+ */
+async function resolveNpmToken(options = {}) {
+  if (options.fromEnv) {
+    const fromProcess = (process.env.NPM_TOKEN || '').trim();
+    if (!fromProcess) {
+      throw new Error('NPM_TOKEN is not set in the environment (--from-env)');
+    }
+    return fromProcess;
+  }
+  const secrets = await secretsLoad.loadSecrets();
+  const bashEnv = collectBashPrefixedEnv(secrets);
+  const token = bashEnv.NPM_TOKEN;
+  if (!token) {
+    throw new Error(
+      'BASH_NPM_TOKEN is not set in merged secrets. Run: aifabrix secret set BASH_NPM_TOKEN "<token>" --shared'
+    );
+  }
+  return token;
+}
+
+/**
+ * Run npm whoami against registry.npmjs.org using the given token.
+ *
+ * @param {string} token
+ * @returns {Promise<string>} username
+ */
+async function npmWhoamiWithToken(token) {
+  const { stdout } = await execFileAsync(
+    'npm',
+    ['whoami', `--registry=${REGISTRY_URL}`, `--//registry.npmjs.org/:_authToken=${token}`],
+    { env: { ...process.env }, timeout: 30000 }
+  );
+  return String(stdout).trim();
+}
+
+/**
+ * @param {{ dryRun?: boolean, check?: boolean, fromEnv?: boolean }} options
+ * @returns {Promise<{ ok: boolean, npmrcPath?: string, username?: string, dryRun?: boolean }>}
+ */
+async function handleNpmConfig(options = {}) {
+  const dryRun = Boolean(options.dryRun);
+  const checkOnly = Boolean(options.check);
+  const token = await resolveNpmToken({ fromEnv: Boolean(options.fromEnv) });
+  const npmrcPath = getUserNpmrcPath();
+
+  if (checkOnly) {
+    const username = await npmWhoamiWithToken(token);
+    return { ok: true, npmrcPath, username };
+  }
+
+  const result = writeUserNpmrcFromToken(token, { dryRun, npmrcPath });
+
+  if (dryRun) {
+    logger.log(chalk.blue('Dry run — would update user npm config:'));
+    logger.log(`  path: ${npmrcPath}`);
+    for (const key of result.managedKeys) {
+      const suffix = key.includes('_authToken') ? '=<redacted>' : '';
+      logger.log(`  ${key}${suffix}`);
+    }
+    return { ok: true, npmrcPath, dryRun: true };
+  }
+
+  const username = await npmWhoamiWithToken(token);
+  logger.log(formatSuccessLine(`Updated user npm config: ${npmrcPath}`));
+  logger.log(chalk.gray(`npm whoami: ${username}`));
+  return { ok: true, npmrcPath, username };
+}
+
+module.exports = {
+  resolveNpmToken,
+  npmWhoamiWithToken,
+  handleNpmConfig
+};

package/lib/utils/api.js

@@ -12,6 +12,7 @@
 
 const { parseErrorResponse, formatNetworkError } = require('./api-error-handler');
 const { inferServiceLabelFromUrl } = require('./service-url-label');
+const { fetchWithOptionalDevPlatformTls } = require('./dev-platform-tls');
 const auditLogger = require('../core/audit-logger');
 
 /** Default timeout for HTTP requests (ms). Prevents hanging when the controller is unreachable. 30s allows Azure Web App cold start to complete. */
@@ -350,7 +351,7 @@ async function makeApiCall(url, options = {}) {
   const { fetchOptions, singleRequestTimeoutMs } = prepareFetchOptionsForRequest(options);
 
   try {
-    const response = await fetch(url, fetchOptions);
+    const response = await fetchWithOptionalDevPlatformTls(url, fetchOptions);
     const duration = Date.now() - startTime;
 
     if (!response.ok) {

package/lib/utils/controller-url.js

@@ -145,7 +145,10 @@ async function isControllerHealthReachable(controllerUrl) {
     return false;
   }
   try {
-    const res = await fetch(`${base}/health`, { signal: AbortSignal.timeout(2500) });
+    const { fetchWithOptionalDevPlatformTls } = require('./dev-platform-tls');
+    const res = await fetchWithOptionalDevPlatformTls(`${base}/health`, {
+      signal: AbortSignal.timeout(2500)
+    });
     return res.ok;
   } catch {
     return false;

package/lib/utils/dev-platform-tls.js

@@ -0,0 +1,148 @@
+/**
+ * Dev platform HTTPS: builder-server nginx front door uses TLS while infra `tlsEnabled` may be off.
+ *
+ * @fileoverview Self-signed TLS allowance for remote dev platform URLs
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const https = require('https');
+const config = require('../core/config');
+const { isLocalhostPublicSchemeHostname } = require('./localhost-public-host');
+
+/**
+ * @param {string} url
+ * @returns {boolean}
+ */
+function isHttpsNonLocalhostUrl(url) {
+  try {
+    const u = new URL(url);
+    return u.protocol === 'https:' && !isLocalhostPublicSchemeHostname(u.hostname);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {string} requestHostname
+ * @param {string} remoteServerUrl
+ * @returns {boolean}
+ */
+function hostnameMatchesRemoteDevPlatform(requestHostname, remoteServerUrl) {
+  let remoteHost = '';
+  try {
+    remoteHost = new URL(remoteServerUrl).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  const host = String(requestHostname || '').trim().toLowerCase();
+  if (!host || !remoteHost) {
+    return false;
+  }
+  return host === remoteHost || host.endsWith(`.${remoteHost}`);
+}
+
+/**
+ * True when URL is a remote dev platform HTTPS endpoint (builder-server nginx / Traefik front door).
+ *
+ * @async
+ * @param {string} url
+ * @returns {Promise<boolean>}
+ */
+async function shouldAllowInsecureDevPlatformTls(url) {
+  if (!isHttpsNonLocalhostUrl(url)) {
+    return false;
+  }
+  try {
+    const remote = await config.getRemoteServer();
+    const remoteTrimmed = remote && String(remote).trim();
+    if (!remoteTrimmed) {
+      return false;
+    }
+    const hostname = new URL(url).hostname;
+    return hostnameMatchesRemoteDevPlatform(hostname, remoteTrimmed);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Minimal fetch for self-signed dev platform HTTPS (Node global fetch cannot set rejectUnauthorized).
+ *
+ * @param {string} url
+ * @param {Object} options
+ * @returns {Promise<{ status: number, statusText: string, headers: { get: Function }, text: Function, json: Function }>}
+ */
+function nodeHttpsFetchInsecure(url, options = {}) {
+  return new Promise((resolve, reject) => {
+    const u = new URL(url);
+    const method = String(options.method || 'GET').toUpperCase();
+    const headers = { ...(options.headers || {}) };
+    const body = options.body;
+    const reqOpts = {
+      hostname: u.hostname,
+      port: u.port || 443,
+      path: `${u.pathname}${u.search}`,
+      method,
+      headers,
+      rejectUnauthorized: false
+    };
+
+    const req = https.request(reqOpts, (res) => {
+      const chunks = [];
+      res.on('data', (chunk) => chunks.push(chunk));
+      res.on('end', () => {
+        const raw = Buffer.concat(chunks).toString('utf8');
+        const status = res.statusCode || 0;
+        resolve({
+          ok: status >= 200 && status < 300,
+          status,
+          statusText: res.statusMessage || '',
+          headers: {
+            get: (name) => res.headers[String(name || '').toLowerCase()] || null
+          },
+          text: async() => raw,
+          json: async() => JSON.parse(raw)
+        });
+      });
+    });
+
+    req.on('error', reject);
+    if (options.signal) {
+      const onAbort = () => {
+        req.destroy(new Error('The operation was aborted'));
+      };
+      if (options.signal.aborted) {
+        onAbort();
+        return;
+      }
+      options.signal.addEventListener('abort', onAbort, { once: true });
+    }
+    if (body !== undefined && body !== null) {
+      req.write(typeof body === 'string' ? body : String(body));
+    }
+    req.end();
+  });
+}
+
+/**
+ * @async
+ * @param {string} url
+ * @param {Object} options
+ * @returns {Promise<Response>}
+ */
+async function fetchWithOptionalDevPlatformTls(url, options = {}) {
+  if (await shouldAllowInsecureDevPlatformTls(url)) {
+    return nodeHttpsFetchInsecure(url, options);
+  }
+  return fetch(url, options);
+}
+
+module.exports = {
+  isHttpsNonLocalhostUrl,
+  hostnameMatchesRemoteDevPlatform,
+  shouldAllowInsecureDevPlatformTls,
+  fetchWithOptionalDevPlatformTls
+};