@aifabrix/builder 2.47.4 → 2.49.0

package/lib/utils/url-declarative-resolve-build-urls.js

@@ -12,6 +12,7 @@ const {
   computePublicUrlBaseString,
   resolveHostPortForDeclarativePublic
 } = require('./url-declarative-public-base');
+const { hasFrontDoorRemoteHostContext } = require('./remote-host-for-front-door');
 
 /**
  * Join base URL origin with path segments (no duplicate slashes).
@@ -38,6 +39,7 @@ function buildPublicUrlString(opts) {
     listenPort,
     developerIdNum,
     remoteServer,
+    developerRootDomain,
     pathPrefix,
     patternPath,
     traefik,
@@ -57,6 +59,7 @@ function buildPublicUrlString(opts) {
     tls: tls !== false,
     developerIdRaw,
     remoteServer,
+    developerRootDomain,
     profile,
     listenPort,
     developerIdNum,
@@ -90,6 +93,7 @@ function buildPublicHostOriginString(opts) {
     listenPort,
     developerIdNum,
     remoteServer,
+    developerRootDomain,
     traefik,
     hostTemplate,
     tls,
@@ -107,6 +111,7 @@ function buildPublicHostOriginString(opts) {
     tls: tls !== false,
     developerIdRaw,
     remoteServer,
+    developerRootDomain,
     profile,
     listenPort,
     developerIdNum,
@@ -140,6 +145,7 @@ function buildInternalHostOriginString(opts) {
     listenPort,
     targetAppKey,
     remoteServer,
+    developerRootDomain,
     pathPrefix,
     patternPath,
     developerIdNum,
@@ -156,12 +162,13 @@ function buildInternalHostOriginString(opts) {
   if (profile === 'docker') {
     return `http://${targetAppKey}:${listenPort}`;
   }
-  if (remoteServer && String(remoteServer).trim()) {
+  if (hasFrontDoorRemoteHostContext({ remoteServer, developerRootDomain })) {
     const pub = buildPublicUrlString({
       profile: 'local',
       listenPort,
       developerIdNum,
       remoteServer,
+      developerRootDomain,
       pathPrefix,
       patternPath,
       traefik,
@@ -190,6 +197,7 @@ function buildInternalUrlString(opts) {
     targetAppKey,
     runtimeBasePath,
     remoteServer,
+    developerRootDomain,
     pathPrefix,
     patternPath,
     developerIdNum,
@@ -207,12 +215,13 @@ function buildInternalUrlString(opts) {
     const origin = `http://${targetAppKey}:${listenPort}`;
     return runtimeBasePath ? joinUrlPath(origin, runtimeBasePath) : origin;
   }
-  if (remoteServer && String(remoteServer).trim()) {
+  if (hasFrontDoorRemoteHostContext({ remoteServer, developerRootDomain })) {
     return buildPublicUrlString({
       profile: 'local',
       listenPort,
       developerIdNum,
       remoteServer,
+      developerRootDomain,
       pathPrefix,
       patternPath,
       traefik,

package/lib/utils/url-declarative-resolve-expand-token.js

@@ -15,6 +15,7 @@ const {
   buildInternalUrlString
 } = require('./url-declarative-resolve-build-urls');
 const { normalizeRuntimeBasePath } = require('./url-declarative-runtime-base-path');
+const { hasFrontDoorRemoteHostContext } = require('./remote-host-for-front-door');
 
 /**
  * Published/browser origin port basis for url:// public surfaces (manifest `port`), not container listen.
@@ -39,6 +40,7 @@ function expandHostSurfacePublic(r) {
     listenPort: publishedOriginPortBasis(r),
     developerIdNum: r.devNum,
     remoteServer: r.remoteServer,
+    developerRootDomain: r.developerRootDomain,
     traefik: r.traefik,
     hostTemplate: r.hostTemplate,
     tls: r.tls,
@@ -59,7 +61,13 @@ function expandHostSurfacePublic(r) {
  * @returns {boolean}
  */
 function isLocalProfileWithoutRemoteServer(r) {
-  return r.profile === 'local' && !String(r.remoteServer || '').trim();
+  if (r.profile !== 'local') {
+    return false;
+  }
+  return !hasFrontDoorRemoteHostContext({
+    remoteServer: r.remoteServer,
+    developerRootDomain: r.developerRootDomain
+  });
 }
 
 /**
@@ -75,6 +83,7 @@ function expandHostSurfaceInternal(r) {
     listenPort: r.listenPort,
     targetAppKey: r.appKey,
     remoteServer: r.remoteServer,
+    developerRootDomain: r.developerRootDomain,
     pathPrefix: r.pathPrefix,
     patternPath: r.patternPath,
     developerIdNum: r.devNum,
@@ -101,6 +110,7 @@ function expandFullSurfacePublic(r) {
     listenPort: publishedOriginPortBasis(r),
     developerIdNum: r.devNum,
     remoteServer: r.remoteServer,
+    developerRootDomain: r.developerRootDomain,
     pathPrefix: r.pathPrefix,
     patternPath: r.patternPath,
     traefik: r.traefik,
@@ -134,6 +144,7 @@ function expandFullSurfaceInternal(r) {
     targetAppKey: r.appKey,
     runtimeBasePath: runtimePath,
     remoteServer: r.remoteServer,
+    developerRootDomain: r.developerRootDomain,
     pathPrefix: r.pathPrefix,
     patternPath: r.patternPath,
     developerIdNum: r.devNum,

package/lib/utils/url-declarative-resolve-load-doc.js

@@ -26,29 +26,47 @@ function tryReadApplicationYamlAt(cfgPath) {
 }
 
 /**
- * Prefer projectRoot/builder (fixtures, tests); then {@link pathsUtil.getBuilderPath} (global npm).
+ * Candidate paths for cross-app url:// resolution (low → high priority).
+ * Platform system apps prefer materialized `~/.aifabrix-work|home/builder` over CLI package `builder/` stubs.
+ *
  * @param {string} appKey
  * @param {object} pathsUtil
- * @param {string|null|undefined} [projectRootOverride] - When set (e.g. `ctx.projectRoot`), used instead of {@link pathsUtil.getProjectRoot} for the first candidate path (avoids flaky cross-test `paths` mocks).
+ * @param {string|null|undefined} [projectRootOverride] - When set (e.g. `ctx.projectRoot`), used instead of {@link pathsUtil.getProjectRoot} for the project-root candidate.
  * @returns {string[]}
  */
 function collectApplicationYamlPathsForUrlResolve(appKey, pathsUtil, projectRootOverride) {
   const list = [];
+  const seen = new Set();
+  const push = (cfgPath) => {
+    const resolved = path.resolve(cfgPath);
+    if (seen.has(resolved)) {
+      return;
+    }
+    seen.add(resolved);
+    list.push(resolved);
+  };
+
+  if (pathsUtil.isSystemBuilderAppName && pathsUtil.isSystemBuilderAppName(appKey)) {
+    try {
+      push(path.join(pathsUtil.getSystemBuilderRoot(), appKey, 'application.yaml'));
+    } catch {
+      /* ignore */
+    }
+  }
+
+  try {
+    push(path.join(pathsUtil.getBuilderPath(appKey), 'application.yaml'));
+  } catch {
+    /* ignore getBuilderPath errors */
+  }
+
   const trimmed =
     projectRootOverride !== undefined && projectRootOverride !== null
       ? String(projectRootOverride).trim()
       : '';
   const root = trimmed || pathsUtil.getProjectRoot();
   if (root) {
-    list.push(path.resolve(path.join(root, 'builder', appKey, 'application.yaml')));
-  }
-  try {
-    const viaBuilder = path.resolve(path.join(pathsUtil.getBuilderPath(appKey), 'application.yaml'));
-    if (!list.length || path.resolve(list[0]) !== viaBuilder) {
-      list.push(viaBuilder);
-    }
-  } catch {
-    /* ignore getBuilderPath errors */
+    push(path.join(root, 'builder', appKey, 'application.yaml'));
   }
   return list;
 }
@@ -86,5 +104,6 @@ function loadApplicationYamlDocForUrlResolve(appKey, ctx, pathsUtil) {
 }
 
 module.exports = {
+  collectApplicationYamlPathsForUrlResolve,
   loadApplicationYamlDocForUrlResolve
 };

package/lib/utils/url-declarative-resolve.js

@@ -172,6 +172,7 @@ function replaceUrlRefToken(token, ctx, profile, devNum, derivedEnvKey, registry
     patternPath,
     pathPrefix,
     remoteServer: ctx.remoteServer,
+    developerRootDomain: ctx.developerRootDomain,
     devNum,
     derivedEnvKey,
     traefik: traefikForToken,
@@ -197,6 +198,7 @@ function replaceUrlRefToken(token, ctx, profile, devNum, derivedEnvKey, registry
  * @param {boolean} ctx.useEnvironmentScopedResources
  * @param {boolean} ctx.appEnvironmentScopedResources
  * @param {string|null|undefined} ctx.remoteServer
+ * @param {string|null|undefined} [ctx.developerRootDomain]
  * @param {string|number|null|undefined} ctx.developerIdRaw
  * @param {boolean} [ctx.traefik] - When `ctx.userCfg` is absent: global Traefik-style URL flag. When `ctx.userCfg` is set: `ctx.traefik` is ignored for per-token Traefik; see {@link resolveDeclarativeUrlSurfaceState}.
  * @param {boolean|undefined} [ctx.declarativePublicUrlsUseLocalhost] - When `ctx.userCfg` is absent: **`undefined`** (default) skips `remote-server` when Traefik is off; **`true`** forces localhost; **`false`** allows remote authority without Traefik. When `ctx.userCfg` is set and root **`traefik` is not** `false`: ignored for public bases; derived per target app from `applications.<target>.proxy`. When **`ctx.userCfg.traefik === false`**, public bases always use localhost (per-app `proxy` does not opt into `remote-server` without infra Traefik).

package/lib/utils/urls-local-registry-scan.js

@@ -13,6 +13,7 @@ const path = require('path');
 const fsRealSync = require('../internal/fs-real-sync');
 const { resolveApplicationConfigPath } = require('./app-config-resolver');
 const { loadConfigFile } = require('./config-format');
+const pathsUtil = require('./paths');
 
 /**
  * @param {string} appDir - Absolute path to a builder app folder (directory containing application config)
@@ -44,9 +45,10 @@ function tryGetApplicationDirConfigForRegistry(appDir) {
  * @param {string} builderDir
  * @param {import('fs').Dirent} ent
  * @param {number} dirIndex
- * @param {Map<string, { folderName: string, doc: object, dirIndex: number }>} best
+ * @param {Map<string, { folderName: string, doc: object, dirIndex: number, tier: number }>} best
+ * @param {{ cwdBuilderDir?: string|null, systemMaterializedDir?: string|null }} scanCtx
  */
-function maybeUpdateBestFromAppFolder(builderDir, ent, dirIndex, best) {
+function maybeUpdateBestFromAppFolder(builderDir, ent, dirIndex, best, scanCtx) {
   const appDir = path.join(builderDir, ent.name);
   const entry = tryGetApplicationDirConfigForRegistry(appDir);
   if (!entry) {
@@ -54,18 +56,82 @@ function maybeUpdateBestFromAppFolder(builderDir, ent, dirIndex, best) {
   }
   const { doc } = entry;
   const appKey = (doc.app && doc.app.key) || ent.name;
+  const tier = resolveRegistryScanTierForDir(builderDir, scanCtx);
   const cur = best.get(appKey);
+  const next = { folderName: ent.name, doc, dirIndex, tier };
+
+  if (pathsUtil.isSystemBuilderAppName(appKey)) {
+    if (!cur || tier > cur.tier || (tier === cur.tier && dirIndex > cur.dirIndex)) {
+      best.set(appKey, next);
+    }
+    return;
+  }
+
   if (!cur || dirIndex > cur.dirIndex) {
-    best.set(appKey, { folderName: ent.name, doc, dirIndex });
+    best.set(appKey, next);
+  }
+}
+
+/**
+ * @param {string} resolved
+ * @param {{ cwdBuilderDir?: string|null, projectRoot?: string|null }} scanCtx
+ * @returns {number|null}
+ */
+function resolveCwdCheckoutRegistryTier(resolved, scanCtx) {
+  const cwdDir =
+    scanCtx && scanCtx.cwdBuilderDir ? path.resolve(String(scanCtx.cwdBuilderDir)) : null;
+  if (!cwdDir || resolved !== cwdDir) {
+    return null;
+  }
+  const projectRoot =
+    scanCtx && scanCtx.projectRoot ? path.resolve(String(scanCtx.projectRoot)) : null;
+  const projectBuilder = projectRoot ? path.resolve(projectRoot, 'builder') : null;
+  if (projectBuilder && resolved === projectBuilder) {
+    return 0;
   }
+  return 2;
+}
+
+/**
+ * @param {string} resolved
+ * @param {{ systemMaterializedDir?: string|null, effectiveBuilderDir?: string|null }} scanCtx
+ * @returns {boolean}
+ */
+function isMaterializedRegistryBuilderDir(resolved, scanCtx) {
+  const tierOneDirs = [];
+  if (scanCtx && scanCtx.systemMaterializedDir) {
+    tierOneDirs.push(path.resolve(String(scanCtx.systemMaterializedDir)));
+  }
+  if (scanCtx && scanCtx.effectiveBuilderDir) {
+    const eff = path.resolve(String(scanCtx.effectiveBuilderDir));
+    if (!tierOneDirs.includes(eff)) {
+      tierOneDirs.push(eff);
+    }
+  }
+  return tierOneDirs.includes(resolved);
+}
+
+/**
+ * @param {string} builderDir
+ * @param {{ cwdBuilderDir?: string|null, systemMaterializedDir?: string|null, effectiveBuilderDir?: string|null, projectRoot?: string|null }} scanCtx
+ * @returns {number}
+ */
+function resolveRegistryScanTierForDir(builderDir, scanCtx) {
+  const resolved = path.resolve(builderDir);
+  const cwdTier = resolveCwdCheckoutRegistryTier(resolved, scanCtx);
+  if (cwdTier !== null) {
+    return cwdTier;
+  }
+  return isMaterializedRegistryBuilderDir(resolved, scanCtx) ? 1 : 0;
 }
 
 /**
  * @param {string} builderDir
  * @param {number} dirIndex
- * @param {Map<string, { folderName: string, doc: object, dirIndex: number }>} best
+ * @param {Map<string, { folderName: string, doc: object, dirIndex: number, tier: number }>} best
+ * @param {{ cwdBuilderDir?: string|null, systemMaterializedDir?: string|null }} scanCtx
  */
-function mergeBuilderDirScanIntoBestMap(builderDir, dirIndex, best) {
+function mergeBuilderDirScanIntoBestMap(builderDir, dirIndex, best, scanCtx) {
   if (!builderDir || typeof builderDir !== 'string') {
     return;
   }
@@ -76,22 +142,41 @@ function mergeBuilderDirScanIntoBestMap(builderDir, dirIndex, best) {
     if (!ent.isDirectory()) {
       continue;
     }
-    maybeUpdateBestFromAppFolder(builderDir, ent, dirIndex, best);
+    maybeUpdateBestFromAppFolder(builderDir, ent, dirIndex, best, scanCtx);
+  }
+}
+
+/**
+ * @param {{ cwdBuilderDir?: string|null, systemMaterializedDir?: string|null, effectiveBuilderDir?: string|null }} [scanCtx]
+ * @returns {{ cwdBuilderDir?: string|null, systemMaterializedDir?: string|null, effectiveBuilderDir?: string|null }}
+ */
+function buildRegistryScanContext(scanCtx) {
+  const ctx = scanCtx && typeof scanCtx === 'object' ? { ...scanCtx } : {};
+  if (!ctx.systemMaterializedDir) {
+    try {
+      ctx.systemMaterializedDir = pathsUtil.getSystemBuilderRoot();
+    } catch {
+      ctx.systemMaterializedDir = null;
+    }
   }
+  return ctx;
 }
 
 /**
  * When the same app exists under multiple builder roots, the **last** directory in `scanDirs`
- * wins (highest `dirIndex`). Matches plan 141 canonical precedence (checkout / cwd after system materialization).
+ * wins (highest `dirIndex`) for user apps. Platform system apps use tiered precedence:
+ * cwd checkout builder (tier 2) > materialized system builder (tier 1) > CLI/package stubs (tier 0).
  *
  * @param {string[]} scanDirs - Builder or `packages` directories, low → high priority
+ * @param {{ cwdBuilderDir?: string|null, systemMaterializedDir?: string|null }} [scanCtx]
  * @returns {Array<{ folderName: string, doc: object }>}
  */
-function collectLatestApplicationYamlEntriesPerApp(scanDirs) {
-  /** @type {Map<string, { folderName: string, doc: object, dirIndex: number }>} */
+function collectLatestApplicationYamlEntriesPerApp(scanDirs, scanCtx) {
+  const ctx = buildRegistryScanContext(scanCtx);
+  /** @type {Map<string, { folderName: string, doc: object, dirIndex: number, tier: number }>} */
   const best = new Map();
   scanDirs.forEach((builderDir, dirIndex) => {
-    mergeBuilderDirScanIntoBestMap(builderDir, dirIndex, best);
+    mergeBuilderDirScanIntoBestMap(builderDir, dirIndex, best, ctx);
   });
   return [...best.entries()]
     .sort((a, b) => a[0].localeCompare(b[0]))

package/lib/utils/urls-local-registry.js

@@ -266,6 +266,25 @@ function buildCanonicalRegistryScanDirs(root, effectiveBuilderDir, opts = {}) {
   return scanDirs;
 }
 
+/**
+ * @param {{ excludeCwdBuilderScan?: boolean }} opts
+ * @returns {string|null}
+ */
+function resolveCwdBuilderDirForRegistryScan(opts) {
+  if (opts.excludeCwdBuilderScan) {
+    return null;
+  }
+  try {
+    const cwdRoot = pathsUtil.findProjectRootFromCwd();
+    if (cwdRoot && typeof cwdRoot === 'string') {
+      return path.join(cwdRoot, 'builder');
+    }
+  } catch {
+    // ignore
+  }
+  return null;
+}
+
 /**
  * Merge scan results into registry (does not remove stale keys).
  * @param {string|null} projectRoot - getProjectRoot() or null (same semantics as projectRoot || getProjectRoot())
@@ -289,7 +308,11 @@ function refreshUrlsLocalRegistryFromBuilder(projectRoot, opts) {
     effectiveBuilderDir = null;
   }
   const scanDirs = buildCanonicalRegistryScanDirs(root, effectiveBuilderDir, o);
-  const entries = collectLatestApplicationYamlEntriesPerApp(scanDirs);
+  const entries = collectLatestApplicationYamlEntriesPerApp(scanDirs, {
+    cwdBuilderDir: resolveCwdBuilderDirForRegistryScan(o),
+    effectiveBuilderDir,
+    projectRoot: root
+  });
   for (const { folderName, doc } of entries) {
     mergeDocIntoRegistry(merged, doc, folderName);
   }

package/lib/utils/worker-sidecars.js

@@ -6,6 +6,8 @@
 
 'use strict';
 
+const fsRealSync = require('../internal/fs-real-sync');
+
 const { buildDefaultLocalContainerName } = require('./environment-scoped-resources');
 
 /**
@@ -88,10 +90,31 @@ function getWorkerCompanionAppKeys(appKey, appConfig) {
   return resolveWorkerSidecars(appKey, appConfig).companions.map((entry) => entry.key);
 }
 
+/**
+ * @param {string|undefined|null} envFilePath
+ * @returns {boolean}
+ */
+function isLocalModeFromEnvFile(envFilePath) {
+  if (!envFilePath || typeof envFilePath !== 'string') {
+    return false;
+  }
+  try {
+    const content = fsRealSync.readFileSync(envFilePath, 'utf8');
+    const match = content.match(/^LOCAL_MODE=(.+)$/m);
+    if (!match) {
+      return false;
+    }
+    const value = match[1].trim().replace(/^["']|["']$/g, '').toLowerCase();
+    return value === 'true' || value === '1' || value === 'yes';
+  } catch {
+    return false;
+  }
+}
+
 /**
  * @param {string} appKey
  * @param {object} appConfig
- * @param {{ devId: string|number, idNum: number }} ids
+ * @param {{ devId: string|number, idNum: number, envFilePath?: string }} ids
  * @returns {{
  *   enabled: boolean,
  *   worker?: { key: string, containerName: string, command: string },
@@ -99,6 +122,9 @@ function getWorkerCompanionAppKeys(appKey, appConfig) {
  * }}
  */
 function buildWorkerSidecarComposeContext(appKey, appConfig, ids) {
+  if (isLocalModeFromEnvFile(ids.envFilePath)) {
+    return { enabled: false };
+  }
   const sidecars = resolveWorkerSidecars(appKey, appConfig);
   if (!sidecars.enabled) {
     return { enabled: false };
@@ -133,6 +159,7 @@ function imageRunToStartupCommand(imageRun) {
 }
 
 module.exports = {
+  isLocalModeFromEnvFile,
   readImageRunCommand,
   isWorkerStackEnabled,
   resolveWorkerSidecars,

package/lib/validation/external-system-auth-rules.js

@@ -14,6 +14,8 @@ const STANDARD_AUTH_VAR_NAMES = new Set([
   'baseurl', 'clientid', 'clientsecret', 'tokenurl', 'apikey', 'username', 'password'
 ]);
 
+const { getAuthCredentialTemplate } = require('../utils/authentication-shape');
+
 function trimVar(value) {
   return (value !== undefined && value !== null ? String(value).trim() : '');
 }
@@ -23,6 +25,39 @@ function isOAuth2OrAad(method) {
   return m === 'oauth2' || m === 'aad';
 }
 
+/**
+ * Resolves credential method from nested or legacy flat authentication.
+ * @param {Object|null|undefined} auth
+ * @returns {string}
+ */
+function resolveAuthMethod(auth) {
+  if (!auth || typeof auth !== 'object') {
+    return '';
+  }
+  if (auth.authType === 'none') {
+    return 'none';
+  }
+  if (auth.authType === 'apiProvider') {
+    return 'apiprovider';
+  }
+  const credential = getAuthCredentialTemplate(auth);
+  return String(credential?.method || auth.method || '').toLowerCase();
+}
+
+/**
+ * Resolves non-secret auth variables from nested or legacy flat authentication.
+ * @param {Object|null|undefined} auth
+ * @returns {Object|null}
+ */
+function resolveAuthVariables(auth) {
+  if (!auth || typeof auth !== 'object') {
+    return null;
+  }
+  const credential = getAuthCredentialTemplate(auth);
+  const variables = credential?.variables || auth.variables;
+  return variables && typeof variables === 'object' ? variables : null;
+}
+
 /**
  * Validates OAuth2/AAD grantType and conditional authorizationUrl for external system files.
  * When method is oauth2 or aad: grantType (if present) must be client_credentials or authorization_code;
@@ -34,20 +69,23 @@ function isOAuth2OrAad(method) {
  */
 function validateOAuth2GrantTypeAndAuthorizationUrl(parsed, errors) {
   const auth = parsed?.authentication;
-  const variables = auth?.variables;
-  if (!variables || typeof variables !== 'object' || !isOAuth2OrAad(auth.method)) {
+  const variables = resolveAuthVariables(auth);
+  const method = resolveAuthMethod(auth);
+  if (!variables || !isOAuth2OrAad(method)) {
     return;
   }
 
   const grantType = trimVar(variables.grantType);
   if (grantType !== '' && !VALID_GRANT_TYPES.includes(grantType)) {
-    errors.push('authentication.variables.grantType must be one of: client_credentials, authorization_code');
+    errors.push('authentication.credential.variables.grantType must be one of: client_credentials, authorization_code');
     return;
   }
 
   const effectiveGrant = grantType || 'authorization_code';
   if (effectiveGrant === 'authorization_code' && trimVar(variables.authorizationUrl) === '') {
-    errors.push('authentication.variables.authorizationUrl is required when grantType is authorization_code or omitted');
+    errors.push(
+      'authentication.credential.variables.authorizationUrl is required when grantType is authorization_code or omitted'
+    );
   }
 }
 
@@ -55,7 +93,7 @@ function validateOAuth2GrantTypeAndAuthorizationUrl(parsed, errors) {
  * Validates that the external system configuration array does not contain standard auth variable names.
  * BASEURL, CLIENTID, CLIENTSECRET, TOKENURL, APIKEY, USERNAME, PASSWORD are credential parameters
  * supplied from the selected credential at runtime and must not be in configuration. Exception:
- * BASEURL is only allowed in configuration when authentication.method is 'none'.
+ * BASEURL is only allowed in configuration when authentication auth method is 'none'.
  *
  * @param {Object} parsed - Parsed external system object
  * @param {string[]} errors - Array to push validation error messages into
@@ -63,7 +101,7 @@ function validateOAuth2GrantTypeAndAuthorizationUrl(parsed, errors) {
 function validateConfigurationNoStandardAuthVariables(parsed, errors) {
   const config = parsed?.configuration;
   if (!Array.isArray(config) || config.length === 0) return;
-  const method = (parsed?.authentication?.method && String(parsed.authentication.method).toLowerCase()) || '';
+  const method = resolveAuthMethod(parsed?.authentication);
   const authNone = method === 'none';
   const allowedWhenNone = new Set(['baseurl']);
   for (const item of config) {
@@ -75,7 +113,7 @@ function validateConfigurationNoStandardAuthVariables(parsed, errors) {
     errors.push(
       `configuration must not contain standard auth variable '${name}'. ` +
       'Standard auth variables (BASEURL, CLIENTID, CLIENTSECRET, TOKENURL, APIKEY, USERNAME, PASSWORD) are supplied from the selected credential at runtime. ' +
-      'BASEURL is only allowed in configuration when authentication.method is \'none\'.'
+      'BASEURL is only allowed in configuration when authentication authType is none.'
     );
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.47.4",
+  "version": "2.49.0",
   "description": "AI Fabrix Local Fabric & Deployment SDK",
   "main": "lib/index.js",
   "bin": {
@@ -95,6 +95,7 @@
     "yaml": "^2.4.0"
   },
   "devDependencies": {
+    "@babel/plugin-syntax-optional-chaining": "^7.8.3",
     "@babel/preset-env": "^7.29.0",
     "@bcoe/v8-coverage": "^1.0.2",
     "@types/node": "^20.10.0",