@aifabrix/builder 2.48.0 → 2.49.0

package/lib/utils/compose-generator.js

@@ -116,7 +116,7 @@ function buildImageConfig(config, appName, imageOverride) {
  * @param {string|null|undefined} [readinessSuffix] - Path after vdir (default /health/ready or healthCheck.readinessPathSuffix)
  * @returns {string} Absolute path starting with /
  */
-function computeAlignedHealthCheckPath(config, devId, scopeOpts, remoteServer, readinessSuffix) {
+function computeAlignedHealthCheckPath(config, devId, scopeOpts, remoteServer, readinessSuffix, developerRootDomain) {
   const hc = config.healthCheck || {};
   let suffix = '/health/ready';
   if (
@@ -128,7 +128,7 @@ function computeAlignedHealthCheckPath(config, devId, scopeOpts, remoteServer, r
   } else if (typeof hc.readinessPathSuffix === 'string' && hc.readinessPathSuffix.startsWith('/')) {
     suffix = hc.readinessPathSuffix;
   }
-  const traefik = buildTraefikIngressBase(config, devId, scopeOpts, remoteServer);
+  const traefik = buildTraefikIngressBase(config, devId, scopeOpts, remoteServer, developerRootDomain);
   if (traefik.enabled === true) {
     const p = traefik.path;
     if (!p || p === '/') {
@@ -158,7 +158,7 @@ function computeAlignedHealthCheckPath(config, devId, scopeOpts, remoteServer, r
  * @param {{ skipVdirMergeWhenPathIsBareHealth?: boolean }} [opts] - When `skipVdirMergeWhenPathIsBareHealth`, path `/health` is left as-is (in-container probe; ingress strips vdir for miso/dataplane). Deployment JSON health paths do **not** use this helper — see `buildHealthCheck` in `builders.js` (YAML paths only).
  * @returns {string} Absolute path starting with /
  */
-function resolveHealthCheckPathWithFrontDoorVdir(config, devId, scopeOpts, remoteServer, opts) {
+function resolveHealthCheckPathWithFrontDoorVdir(config, devId, scopeOpts, remoteServer, opts, developerRootDomain) {
   const hc = config.healthCheck || {};
   const raw = typeof hc.path === 'string' && hc.path.startsWith('/') ? hc.path : '/health';
   const fd = config.frontDoorRouting;
@@ -168,7 +168,7 @@ function resolveHealthCheckPathWithFrontDoorVdir(config, devId, scopeOpts, remot
   if (opts && opts.skipVdirMergeWhenPathIsBareHealth === true && raw === '/health') {
     return raw;
   }
-  const traefik = buildTraefikIngressBase(config, devId, scopeOpts, remoteServer);
+  const traefik = buildTraefikIngressBase(config, devId, scopeOpts, remoteServer, developerRootDomain);
   if (traefik.enabled !== true) {
     return raw;
   }
@@ -178,7 +178,7 @@ function resolveHealthCheckPathWithFrontDoorVdir(config, devId, scopeOpts, remot
       ? ''
       : String(vdirRaw).replace(/\/+$/, '');
   if (!vdir) {
-    return computeAlignedHealthCheckPath(config, devId, scopeOpts, remoteServer, raw);
+    return computeAlignedHealthCheckPath(config, devId, scopeOpts, remoteServer, raw, developerRootDomain);
   }
   if (raw === vdir || raw.startsWith(`${vdir}/`)) {
     return raw;
@@ -192,13 +192,14 @@ function resolveHealthCheckPathWithFrontDoorVdir(config, devId, scopeOpts, remot
  * @param {string|number} devId - Developer id
  * @param {Object|null} scopeOpts - Env-scoped compose options
  * @param {string|null|undefined} remoteServer - Remote server URL
+ * @param {string|null|undefined} [developerRootDomain] - App hostname root
  * @returns {Object} Health check configuration
  */
-function buildHealthCheckConfig(config, devId, scopeOpts, remoteServer) {
+function buildHealthCheckConfig(config, devId, scopeOpts, remoteServer, developerRootDomain) {
   const hc = config.healthCheck || {};
   const path = resolveHealthCheckPathWithFrontDoorVdir(config, devId, scopeOpts, remoteServer, {
     skipVdirMergeWhenPathIsBareHealth: true
-  });
+  }, developerRootDomain);
   return {
     path,
     interval: hc.interval || 30,
@@ -230,10 +231,11 @@ function buildDevUsername(devId) {
  * @param {Object|null} scopeOpts - Env-scoped Traefik path
  * @param {string|null|undefined} remoteServer - From config (for ${REMOTE_HOST})
  * @param {string|undefined} [resolvedHealthPathForStrip] - Compose health path; when omitted, derived via resolveHealthCheckPathWithFrontDoorVdir (same as probe)
+ * @param {string|null|undefined} [developerRootDomain] - App hostname root from settings
  * @returns {Object} Traefik configuration object
  */
-function buildTraefikConfig(config, devId, scopeOpts = null, remoteServer = null, resolvedHealthPathForStrip) {
-  const base = buildTraefikIngressBase(config, devId, scopeOpts, remoteServer);
+function buildTraefikConfig(config, devId, scopeOpts = null, remoteServer = null, resolvedHealthPathForStrip, developerRootDomain) {
+  const base = buildTraefikIngressBase(config, devId, scopeOpts, remoteServer, developerRootDomain);
   if (!base.enabled) {
     return { enabled: false };
   }
@@ -242,7 +244,7 @@ function buildTraefikConfig(config, devId, scopeOpts = null, remoteServer = null
       ? String(resolvedHealthPathForStrip)
       : resolveHealthCheckPathWithFrontDoorVdir(config, devId, scopeOpts, remoteServer, {
         skipVdirMergeWhenPathIsBareHealth: true
-      });
+      }, developerRootDomain);
   const devNum = parseDeveloperIdNum(devId);
   // Shared builder host: nginx terminates TLS on :443 and proxies HTTP to per-dev Traefik :80 (e.g. 280).
   // Traefik must only attach routers to `web` for developer-id > 0; `websecure`+tls labels without
@@ -282,6 +284,7 @@ function buildRequiresConfig(config) {
  * @param {string} [runExtras.imageOverride] - Full image reference for run (e.g. from --image)
  * @param {Object|null} [runExtras.scopeOpts] - Traefik / scoped compose options
  * @param {string|null|undefined} [runExtras.remoteServer] - For ${REMOTE_HOST} in frontDoorRouting.host
+ * @param {string|null|undefined} [runExtras.developerRootDomain] - App hostname root (overrides remote-server host)
  * @param {boolean} [runExtras.omitAppTraefikLabels] - When true (user config `traefik: false`), omit Traefik labels and BASE_PATH env from compose even if application.yaml enables frontDoorRouting
  * @returns {Object} Service configuration
  */
@@ -290,6 +293,7 @@ function buildServiceConfig(appName, config, port, devId, runExtras = {}) {
     imageOverride = null,
     scopeOpts = null,
     remoteServer = null,
+    developerRootDomain = null,
     omitAppTraefikLabels = false
   } = runExtras;
   const containerPortValue = getContainerPort(config, 3000);
@@ -303,7 +307,7 @@ function buildServiceConfig(appName, config, port, devId, runExtras = {}) {
     ? composeTraefikServiceKey(appName, scopeOpts.runEnvKey)
     : null;
   const scopeForHealthAndTraefik = useTraefikScope ? scopeOpts : null;
-  const healthCheck = buildHealthCheckConfig(config, devId, scopeForHealthAndTraefik, remoteServer);
+  const healthCheck = buildHealthCheckConfig(config, devId, scopeForHealthAndTraefik, remoteServer, developerRootDomain);
   return {
     app: buildAppConfig(appName, config, composeAppKey),
     image: buildImageConfig(config, appName, imageOverride),
@@ -319,7 +323,8 @@ function buildServiceConfig(appName, config, port, devId, runExtras = {}) {
           devId,
           scopeForHealthAndTraefik,
           remoteServer,
-          healthCheck.path
+          healthCheck.path,
+          developerRootDomain
         ),
     ...buildRequiresConfig(config)
   };
@@ -379,20 +384,34 @@ function buildNetworkAndContainerNames(appName, devId, idNum, scopeOpts = null)
 }
 
 const { createGenerateDockerCompose } = require('./compose-generate-docker-compose');
-async function getRemoteServerForCompose() {
+async function getFrontDoorHostContextForCompose() {
   try {
     const rs = await config.getRemoteServer();
-    return rs && String(rs).trim() ? String(rs).trim() : null;
+    const remoteServer = rs && String(rs).trim() ? String(rs).trim() : null;
+    let developerRootDomain = null;
+    try {
+      const root = await config.getDeveloperRootDomain();
+      developerRootDomain = root && String(root).trim() ? String(root).trim() : null;
+    } catch {
+      developerRootDomain = null;
+    }
+    return { remoteServer, developerRootDomain };
   } catch {
-    return null;
+    return { remoteServer: null, developerRootDomain: null };
   }
 }
 
+async function getRemoteServerForCompose() {
+  const ctx = await getFrontDoorHostContextForCompose();
+  return ctx.remoteServer;
+}
+
 const generateDockerCompose = createGenerateDockerCompose({
   loadDockerComposeTemplate,
   resolveComposeImageOverrideString,
   getDeveloperIdAndNumeric,
   getRemoteServerForCompose,
+  getFrontDoorHostContextForCompose,
   buildNetworkAndContainerNames,
   buildServiceConfig,
   buildVolumesConfig,

package/lib/utils/compose-traefik-ingress-base.js

@@ -10,6 +10,10 @@ const {
   buildEnvScopedTraefikPath
 } = require('./environment-scoped-resources');
 const { parseDeveloperIdNum } = require('./declarative-url-ports');
+const {
+  resolveRemoteHostForFrontDoor,
+  hasFrontDoorRemoteHostContext
+} = require('./remote-host-for-front-door');
 
 /**
  * Derives base path from routing pattern by removing trailing wildcards
@@ -66,21 +70,15 @@ function buildDevUsernameForFrontDoorHost(devId) {
  * @param {string} template
  * @param {string|number|null|undefined} developerIdRaw
  * @param {string|null|undefined} remoteServer
+ * @param {string|null|undefined} [developerRootDomain] - App hostname root (overrides remote-server hostname for ${REMOTE_HOST})
  * @returns {string}
  */
-function expandFrontDoorHostPlaceholders(template, developerIdRaw, remoteServer) {
+function expandFrontDoorHostPlaceholders(template, developerIdRaw, remoteServer, developerRootDomain) {
   let t = String(template || '');
   t = t.replace(/\$\{DEV_USERNAME\}\$\{REMOTE_HOST\}/g, '${DEV_USERNAME}.${REMOTE_HOST}');
   const devU = buildDevUsernameForFrontDoorHost(developerIdRaw);
   t = t.replace(/\$\{DEV_USERNAME\}/g, devU);
-  let remoteHost = '';
-  try {
-    if (remoteServer && String(remoteServer).trim()) {
-      remoteHost = new URL(String(remoteServer).trim()).hostname;
-    }
-  } catch {
-    remoteHost = '';
-  }
+  const remoteHost = resolveRemoteHostForFrontDoor({ remoteServer, developerRootDomain });
   t = t.replace(/\$\{REMOTE_HOST\}/g, remoteHost);
   t = t.replace(/^\.+/g, '').replace(/\.{2,}/g, '.').replace(/\.+$/g, '').trim();
   return t;
@@ -90,13 +88,13 @@ function templateUsesRemoteHostPlaceholder(hostTemplate) {
   return /\$\{REMOTE_HOST\}/.test(String(hostTemplate || ''));
 }
 
-function resolveTraefikRouterHost(hostTemplate, developerIdRaw, remoteServer) {
+function resolveTraefikRouterHost(hostTemplate, developerIdRaw, remoteServer, developerRootDomain) {
   const usesRemote = templateUsesRemoteHostPlaceholder(hostTemplate);
-  const hasRemote = Boolean(remoteServer && String(remoteServer).trim());
+  const hasRemote = hasFrontDoorRemoteHostContext({ remoteServer, developerRootDomain });
   if (usesRemote && !hasRemote) {
     return 'localhost';
   }
-  return expandFrontDoorHostPlaceholders(hostTemplate, developerIdRaw, remoteServer);
+  return expandFrontDoorHostPlaceholders(hostTemplate, developerIdRaw, remoteServer, developerRootDomain);
 }
 
 /**
@@ -108,9 +106,10 @@ function resolveTraefikRouterHost(hostTemplate, developerIdRaw, remoteServer) {
  * @param {string|number} devId - Developer id for host expansion
  * @param {Object|null} scopeOpts - Env-scoped Traefik path (effectiveEnvironmentScopedResources, runEnvKey)
  * @param {string|null|undefined} remoteServer - For ${REMOTE_HOST}
+ * @param {string|null|undefined} [developerRootDomain] - App hostname root from settings
  * @returns {{ enabled: false } | { enabled: true, host: string, path: string, tls: boolean, certStore: string|null }}
  */
-function buildTraefikIngressBase(config, devId, scopeOpts, remoteServer) {
+function buildTraefikIngressBase(config, devId, scopeOpts, remoteServer, developerRootDomain) {
   const frontDoor = config.frontDoorRouting;
   if (!frontDoor || frontDoor.enabled !== true) {
     return { enabled: false };
@@ -118,7 +117,7 @@ function buildTraefikIngressBase(config, devId, scopeOpts, remoteServer) {
   if (!frontDoor.host || typeof frontDoor.host !== 'string') {
     throw new Error('frontDoorRouting.host is required when frontDoorRouting.enabled is true');
   }
-  const host = resolveTraefikRouterHost(frontDoor.host, devId, remoteServer);
+  const host = resolveTraefikRouterHost(frontDoor.host, devId, remoteServer, developerRootDomain);
   const basePath = derivePathFromPattern(frontDoor.pattern);
   let pathOut = basePath;
   if (

package/lib/utils/config-paths.js

@@ -22,6 +22,7 @@ const SETTINGS_RESPONSE_KEYS = [
   'aifabrix-env-config',
   'remote-server',
   'docker-endpoint',
+  'developer-root-domain',
   'docker-tls-skip-verify',
   'sync-ssh-user',
   'sync-ssh-host'
@@ -290,6 +291,9 @@ function createRemoteConfigGetters(getConfigFn) {
     },
     async getSyncSshHost() {
       return getPathConfig(getConfigFn, 'sync-ssh-host');
+    },
+    async getDeveloperRootDomain() {
+      return getPathConfig(getConfigFn, 'developer-root-domain');
     }
   };
 }
@@ -424,6 +428,7 @@ module.exports = {
   resolveEnvConfigPathToAbsolute,
   SETTINGS_RESPONSE_KEYS,
   applySecretsUrlFromRemote,
-  applySyncAndDockerFromHost
+  applySyncAndDockerFromHost,
+  hostnameFromUrl
 };
 

package/lib/utils/dev-user-groups.js

@@ -8,6 +8,7 @@
 const ALLOWED_DEV_GROUPS = Object.freeze([
   'admin',
   'secret-manager',
+  'secret-reader',
   'developer',
   'docker'
 ]);

package/lib/utils/docker-daemon-tls-ca.js

@@ -51,6 +51,68 @@ function collectIssuerChainPems(peerCert) {
   return pems;
 }
 
+/**
+ * @param {string} rest - Host[:port] after tcp://
+ * @returns {{ host: string, port: number }|null}
+ */
+function parseBracketedTcpHostPort(rest) {
+  if (!rest.startsWith('[')) return null;
+  const end = rest.indexOf(']');
+  if (end === -1) return null;
+  const host = rest.slice(1, end);
+  let port = DEFAULT_DOCKER_TLS_PORT;
+  const after = rest.slice(end + 1);
+  if (after.startsWith(':')) {
+    const p = parseInt(after.slice(1), 10);
+    if (!Number.isNaN(p)) port = p;
+  }
+  return { host, port };
+}
+
+/**
+ * @param {string} rest - Host[:port] after tcp://
+ * @returns {{ host: string, port: number }}
+ */
+function parsePlainTcpHostPort(rest) {
+  const colonIdx = rest.lastIndexOf(':');
+  if (colonIdx > 0 && /^\d+$/.test(rest.slice(colonIdx + 1))) {
+    return {
+      host: rest.slice(0, colonIdx),
+      port: parseInt(rest.slice(colonIdx + 1), 10)
+    };
+  }
+  return { host: rest, port: DEFAULT_DOCKER_TLS_PORT };
+}
+
+/**
+ * @param {string} trimmed
+ * @returns {{ host: string, port: number }|null}
+ */
+function parseTcpSchemeEndpoint(trimmed) {
+  const rest = trimmed.slice(6).split('/')[0];
+  return parseBracketedTcpHostPort(rest) || parsePlainTcpHostPort(rest);
+}
+
+/**
+ * @param {string} trimmed
+ * @returns {{ host: string, port: number }|null}
+ */
+function parseDockerEndpointViaUrl(trimmed) {
+  try {
+    const u = new URL(trimmed.includes('://') ? trimmed : `tcp://${trimmed}`);
+    const host = String(u.hostname || '').trim();
+    if (!host) return null;
+    let port = DEFAULT_DOCKER_TLS_PORT;
+    if (u.port) {
+      const p = parseInt(u.port, 10);
+      if (!Number.isNaN(p)) port = p;
+    }
+    return { host, port };
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Parse docker-endpoint (tcp://host:port) into TLS connect parameters.
  * @param {string} endpoint
@@ -62,45 +124,11 @@ function parseDockerTlsEndpoint(endpoint) {
   const lower = trimmed.toLowerCase();
   if (lower.startsWith('unix:')) return null;
 
-  let host = '';
-  let port = DEFAULT_DOCKER_TLS_PORT;
-
-  if (lower.startsWith('tcp://')) {
-    const rest = trimmed.slice(6).split('/')[0];
-    if (rest.startsWith('[')) {
-      const end = rest.indexOf(']');
-      if (end === -1) return null;
-      host = rest.slice(1, end);
-      const after = rest.slice(end + 1);
-      if (after.startsWith(':')) {
-        const p = parseInt(after.slice(1), 10);
-        if (!Number.isNaN(p)) port = p;
-      }
-    } else {
-      const colonIdx = rest.lastIndexOf(':');
-      if (colonIdx > 0 && /^\d+$/.test(rest.slice(colonIdx + 1))) {
-        port = parseInt(rest.slice(colonIdx + 1), 10);
-        host = rest.slice(0, colonIdx);
-      } else {
-        host = rest;
-      }
-    }
-  } else {
-    try {
-      const u = new URL(trimmed.includes('://') ? trimmed : `tcp://${trimmed}`);
-      host = u.hostname;
-      if (u.port) {
-        const p = parseInt(u.port, 10);
-        if (!Number.isNaN(p)) port = p;
-      }
-    } catch {
-      return null;
-    }
-  }
-
-  host = String(host || '').trim();
-  if (!host) return null;
-  return { host, port, servername: host };
+  const parsed = lower.startsWith('tcp://')
+    ? parseTcpSchemeEndpoint(trimmed)
+    : parseDockerEndpointViaUrl(trimmed);
+  if (!parsed || !parsed.host) return null;
+  return { host: parsed.host, port: parsed.port, servername: parsed.host };
 }
 
 /**
@@ -262,6 +290,32 @@ async function writeDockerDaemonCaMarker(certDir) {
   await fs.writeFile(markerPath, `augmentedAt=${new Date().toISOString()}\n`, { mode: 0o600 });
 }
 
+/**
+ * @param {string} certDir
+ * @param {string} existingCaPem
+ * @param {string} dockerEndpoint
+ * @param {{ timeoutMs?: number }} fetchOpts
+ * @returns {Promise<boolean>}
+ */
+async function augmentCaPemForDockerVerify(certDir, existingCaPem, dockerEndpoint, fetchOpts) {
+  const fs = require('fs');
+  const path = require('path');
+  if (await caPemTrustsDockerDaemon(existingCaPem, dockerEndpoint, fetchOpts)) {
+    await writeDockerDaemonCaMarker(certDir);
+    return true;
+  }
+  const augmented = await augmentCaPemWithDockerDaemonChain(existingCaPem, dockerEndpoint, fetchOpts);
+  if (!augmented || augmented === existingCaPem) return false;
+  const { normalizePemNewlines } = require('./dev-cert-helper');
+  await fs.promises.writeFile(
+    path.join(certDir, 'ca.pem'),
+    normalizePemNewlines(augmented),
+    { mode: 0o600 }
+  );
+  await writeDockerDaemonCaMarker(certDir);
+  return true;
+}
+
 /**
  * Decide whether Docker CLI should verify the daemon certificate (DOCKER_TLS_VERIFY=1).
  * When ca.pem holds only the internal issue-cert CA but the daemon uses a public/wildcard cert,
@@ -288,24 +342,7 @@ async function resolveRemoteDockerDaemonVerify(ctx) {
   if (!dockerEndpoint) return true;
 
   const fetchOpts = { timeoutMs: DEFAULT_FETCH_TIMEOUT_MS };
-  if (await caPemTrustsDockerDaemon(existingCaPem, dockerEndpoint, fetchOpts)) {
-    await writeDockerDaemonCaMarker(certDir);
-    return true;
-  }
-
-  const augmented = await augmentCaPemWithDockerDaemonChain(existingCaPem, dockerEndpoint, fetchOpts);
-  if (augmented && augmented !== existingCaPem) {
-    const { normalizePemNewlines } = require('./dev-cert-helper');
-    await fs.promises.writeFile(
-      path.join(certDir, 'ca.pem'),
-      normalizePemNewlines(augmented),
-      { mode: 0o600 }
-    );
-    await writeDockerDaemonCaMarker(certDir);
-    return true;
-  }
-
-  return false;
+  return augmentCaPemForDockerVerify(certDir, existingCaPem, dockerEndpoint, fetchOpts);
 }
 
 module.exports = {

package/lib/utils/docker-reload-mount.js

@@ -101,6 +101,7 @@ function hostnameMatchesDockerHost(dockerHost) {
   const hnShort = hn.split('.')[0];
   const hShort = h.split('.')[0];
   if (h === hnShort || hn === hShort) return true;
+  if (hShort && hnShort && hShort === hnShort) return true;
   return false;
 }
 
@@ -120,8 +121,18 @@ function isReloadBindMountOnEngineHost(dockerEndpoint) {
   return hostnameMatchesDockerHost(host);
 }
 
+/**
+ * True when host refers to this machine (loopback, FQDN, or short hostname match).
+ * @param {string} host
+ * @returns {boolean}
+ */
+function isHostOnThisMachine(host) {
+  return hostnameMatchesDockerHost(host);
+}
+
 module.exports = {
   extractHostFromDockerEndpoint,
   isReloadBindMountOnEngineHost,
-  isLocalhostSyncSshHost
+  isLocalhostSyncSshHost,
+  isHostOnThisMachine
 };

package/lib/utils/external-env-template.js

@@ -54,6 +54,36 @@ const FALLBACK_SECURITY_BY_AUTH = {
   none: []
 };
 
+/**
+ * @param {Array<{name: string, value: string}>} authSecureVars
+ * @param {Record<string, unknown>} security
+ * @param {string} prefix
+ * @param {string} systemKey
+ */
+function pushSecureVarsFromSecurityMap(authSecureVars, security, prefix, systemKey) {
+  for (const key of Object.keys(security)) {
+    const envName = `KV_${prefix}_${securityKeyToVar(key)}`;
+    const pathVal = kvEnvKeyToPath(envName, systemKey);
+    authSecureVars.push({ name: envName, value: pathVal || `kv://${systemKey}/${key}` });
+  }
+}
+
+/**
+ * @param {Array<{name: string, value: string}>} authSecureVars
+ * @param {string} authMethod
+ * @param {string} prefix
+ * @param {string} systemKey
+ */
+function pushFallbackSecureVars(authSecureVars, authMethod, prefix, systemKey) {
+  const keys = FALLBACK_SECURITY_BY_AUTH[authMethod] || FALLBACK_SECURITY_BY_AUTH.apikey;
+  for (const key of keys) {
+    authSecureVars.push({
+      name: `KV_${prefix}_${securityKeyToVar(key)}`,
+      value: `kv://${systemKey}/${key}`
+    });
+  }
+}
+
 /**
  * Builds authSecureVars array from system authentication.security (or fallback by auth type).
  * @param {Object} system - System object with key and authentication
@@ -65,6 +95,9 @@ function buildAuthSecureVarsFromSystem(system) {
   const prefix = systemKeyToKvPrefix(systemKey);
   if (!prefix) return authSecureVars;
   const authBlock = system?.authentication || system?.auth;
+  if (authBlock?.authType === 'apiProvider' || authBlock?.authType === 'none') {
+    return authSecureVars;
+  }
   const credential = getAuthCredentialTemplate(authBlock);
   const security = credential?.security || authBlock?.security;
   const authMethod = (
@@ -74,19 +107,9 @@ function buildAuthSecureVarsFromSystem(system) {
     'apikey'
   ).toLowerCase();
   if (security && typeof security === 'object' && Object.keys(security).length > 0) {
-    for (const key of Object.keys(security)) {
-      const envName = `KV_${prefix}_${securityKeyToVar(key)}`;
-      const pathVal = kvEnvKeyToPath(envName, systemKey);
-      authSecureVars.push({ name: envName, value: pathVal || `kv://${systemKey}/${key}` });
-    }
+    pushSecureVarsFromSecurityMap(authSecureVars, security, prefix, systemKey);
   } else {
-    const keys = FALLBACK_SECURITY_BY_AUTH[authMethod] || FALLBACK_SECURITY_BY_AUTH.apikey;
-    for (const key of keys) {
-      authSecureVars.push({
-        name: `KV_${prefix}_${securityKeyToVar(key)}`,
-        value: `kv://${systemKey}/${key}`
-      });
-    }
+    pushFallbackSecureVars(authSecureVars, authMethod, prefix, systemKey);
   }
   return authSecureVars;
 }
@@ -116,13 +139,25 @@ function buildConfigurationEntries(system) {
  * @returns {{ authMethod: string, authSecureVars: Array<{name: string, value: string}>, authNonSecureVarNames: string[], configuration: Array<{name: string, value: string, comment: string}> }}
  */
 function buildExternalEnvTemplateContext(system) {
-  const authMethod = (system?.authentication?.method ||
-    system?.authentication?.type ||
-    system?.auth?.method ||
-    system?.auth?.type ||
-    'apikey').toLowerCase();
+  const authBlock = system?.authentication || system?.auth;
+  const credential = getAuthCredentialTemplate(authBlock);
+  let authMethod = 'apikey';
+  if (authBlock?.authType === 'apiProvider') {
+    authMethod = 'apiprovider';
+  } else if (authBlock?.authType === 'none') {
+    authMethod = 'none';
+  } else {
+    authMethod = (
+      credential?.method ||
+      authBlock?.method ||
+      authBlock?.type ||
+      'apikey'
+    ).toLowerCase();
+  }
   const authSecureVars = buildAuthSecureVarsFromSystem(system);
-  const authVars = system?.authentication?.variables || system?.auth?.variables || {};
+  const authVars =
+    (credential?.variables && typeof credential.variables === 'object' ? credential.variables : null) ||
+    (authBlock?.variables && typeof authBlock.variables === 'object' ? authBlock.variables : {});
   const authNonSecureVarNames = Object.keys(authVars);
   const configuration = buildConfigurationEntries(system);
   return {

package/lib/utils/health-check-poll-ui.js

@@ -0,0 +1,84 @@
+/**
+ * In-place health-check wait line (TTY ora or carriage-return refresh).
+ *
+ * @fileoverview Health check poll presentation helpers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('./logger');
+
+function shouldUseHealthCheckPollSpinner() {
+  return Boolean(process && process.stdout && process.stdout.isTTY);
+}
+
+/**
+ * @param {number} attemptIndex - Zero-based attempt index after a failed probe
+ * @param {number} maxAttempts
+ * @returns {string}
+ */
+function buildHealthCheckPollText(attemptIndex, maxAttempts) {
+  return chalk.yellow(
+    `Waiting for health check… (${attemptIndex + 1}/${maxAttempts})`
+  );
+}
+
+/**
+ * @param {number} maxAttempts
+ * @returns {{ usesSpinner: boolean, onWaiting: (attemptIndex: number) => void, finish: () => void }}
+ */
+function createHealthCheckPollHandlers(maxAttempts) {
+  if (shouldUseHealthCheckPollSpinner()) {
+    const ora = require('ora');
+    const spinner = ora({
+      text: buildHealthCheckPollText(0, maxAttempts),
+      spinner: 'dots'
+    });
+    let started = false;
+    return {
+      usesSpinner: true,
+      onWaiting: (attemptIndex) => {
+        if (!started) {
+          spinner.start();
+          started = true;
+        }
+        spinner.text = buildHealthCheckPollText(attemptIndex, maxAttempts);
+      },
+      finish: () => {
+        if (started) {
+          spinner.stop();
+          process.stdout.write('\n');
+        }
+      }
+    };
+  }
+
+  let lastLine = '';
+  return {
+    usesSpinner: false,
+    onWaiting: (attemptIndex) => {
+      const line = buildHealthCheckPollText(attemptIndex, maxAttempts);
+      if (process.stdout && process.stdout.isTTY) {
+        process.stdout.write(`\r${line}`);
+        lastLine = line;
+        return;
+      }
+      logger.log(line);
+    },
+    finish: () => {
+      if (lastLine && process.stdout && process.stdout.isTTY) {
+        process.stdout.write('\n');
+        lastLine = '';
+      }
+    }
+  };
+}
+
+module.exports = {
+  buildHealthCheckPollText,
+  createHealthCheckPollHandlers,
+  shouldUseHealthCheckPollSpinner
+};