@aifabrix/builder 2.48.0 → 2.49.1

package/lib/utils/docker-daemon-tls-ca.js

@@ -51,6 +51,68 @@ function collectIssuerChainPems(peerCert) {
   return pems;
 }
 
+/**
+ * @param {string} rest - Host[:port] after tcp://
+ * @returns {{ host: string, port: number }|null}
+ */
+function parseBracketedTcpHostPort(rest) {
+  if (!rest.startsWith('[')) return null;
+  const end = rest.indexOf(']');
+  if (end === -1) return null;
+  const host = rest.slice(1, end);
+  let port = DEFAULT_DOCKER_TLS_PORT;
+  const after = rest.slice(end + 1);
+  if (after.startsWith(':')) {
+    const p = parseInt(after.slice(1), 10);
+    if (!Number.isNaN(p)) port = p;
+  }
+  return { host, port };
+}
+
+/**
+ * @param {string} rest - Host[:port] after tcp://
+ * @returns {{ host: string, port: number }}
+ */
+function parsePlainTcpHostPort(rest) {
+  const colonIdx = rest.lastIndexOf(':');
+  if (colonIdx > 0 && /^\d+$/.test(rest.slice(colonIdx + 1))) {
+    return {
+      host: rest.slice(0, colonIdx),
+      port: parseInt(rest.slice(colonIdx + 1), 10)
+    };
+  }
+  return { host: rest, port: DEFAULT_DOCKER_TLS_PORT };
+}
+
+/**
+ * @param {string} trimmed
+ * @returns {{ host: string, port: number }|null}
+ */
+function parseTcpSchemeEndpoint(trimmed) {
+  const rest = trimmed.slice(6).split('/')[0];
+  return parseBracketedTcpHostPort(rest) || parsePlainTcpHostPort(rest);
+}
+
+/**
+ * @param {string} trimmed
+ * @returns {{ host: string, port: number }|null}
+ */
+function parseDockerEndpointViaUrl(trimmed) {
+  try {
+    const u = new URL(trimmed.includes('://') ? trimmed : `tcp://${trimmed}`);
+    const host = String(u.hostname || '').trim();
+    if (!host) return null;
+    let port = DEFAULT_DOCKER_TLS_PORT;
+    if (u.port) {
+      const p = parseInt(u.port, 10);
+      if (!Number.isNaN(p)) port = p;
+    }
+    return { host, port };
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Parse docker-endpoint (tcp://host:port) into TLS connect parameters.
  * @param {string} endpoint
@@ -62,45 +124,11 @@ function parseDockerTlsEndpoint(endpoint) {
   const lower = trimmed.toLowerCase();
   if (lower.startsWith('unix:')) return null;
 
-  let host = '';
-  let port = DEFAULT_DOCKER_TLS_PORT;
-
-  if (lower.startsWith('tcp://')) {
-    const rest = trimmed.slice(6).split('/')[0];
-    if (rest.startsWith('[')) {
-      const end = rest.indexOf(']');
-      if (end === -1) return null;
-      host = rest.slice(1, end);
-      const after = rest.slice(end + 1);
-      if (after.startsWith(':')) {
-        const p = parseInt(after.slice(1), 10);
-        if (!Number.isNaN(p)) port = p;
-      }
-    } else {
-      const colonIdx = rest.lastIndexOf(':');
-      if (colonIdx > 0 && /^\d+$/.test(rest.slice(colonIdx + 1))) {
-        port = parseInt(rest.slice(colonIdx + 1), 10);
-        host = rest.slice(0, colonIdx);
-      } else {
-        host = rest;
-      }
-    }
-  } else {
-    try {
-      const u = new URL(trimmed.includes('://') ? trimmed : `tcp://${trimmed}`);
-      host = u.hostname;
-      if (u.port) {
-        const p = parseInt(u.port, 10);
-        if (!Number.isNaN(p)) port = p;
-      }
-    } catch {
-      return null;
-    }
-  }
-
-  host = String(host || '').trim();
-  if (!host) return null;
-  return { host, port, servername: host };
+  const parsed = lower.startsWith('tcp://')
+    ? parseTcpSchemeEndpoint(trimmed)
+    : parseDockerEndpointViaUrl(trimmed);
+  if (!parsed || !parsed.host) return null;
+  return { host: parsed.host, port: parsed.port, servername: parsed.host };
 }
 
 /**
@@ -262,6 +290,32 @@ async function writeDockerDaemonCaMarker(certDir) {
   await fs.writeFile(markerPath, `augmentedAt=${new Date().toISOString()}\n`, { mode: 0o600 });
 }
 
+/**
+ * @param {string} certDir
+ * @param {string} existingCaPem
+ * @param {string} dockerEndpoint
+ * @param {{ timeoutMs?: number }} fetchOpts
+ * @returns {Promise<boolean>}
+ */
+async function augmentCaPemForDockerVerify(certDir, existingCaPem, dockerEndpoint, fetchOpts) {
+  const fs = require('fs');
+  const path = require('path');
+  if (await caPemTrustsDockerDaemon(existingCaPem, dockerEndpoint, fetchOpts)) {
+    await writeDockerDaemonCaMarker(certDir);
+    return true;
+  }
+  const augmented = await augmentCaPemWithDockerDaemonChain(existingCaPem, dockerEndpoint, fetchOpts);
+  if (!augmented || augmented === existingCaPem) return false;
+  const { normalizePemNewlines } = require('./dev-cert-helper');
+  await fs.promises.writeFile(
+    path.join(certDir, 'ca.pem'),
+    normalizePemNewlines(augmented),
+    { mode: 0o600 }
+  );
+  await writeDockerDaemonCaMarker(certDir);
+  return true;
+}
+
 /**
  * Decide whether Docker CLI should verify the daemon certificate (DOCKER_TLS_VERIFY=1).
  * When ca.pem holds only the internal issue-cert CA but the daemon uses a public/wildcard cert,
@@ -288,24 +342,7 @@ async function resolveRemoteDockerDaemonVerify(ctx) {
   if (!dockerEndpoint) return true;
 
   const fetchOpts = { timeoutMs: DEFAULT_FETCH_TIMEOUT_MS };
-  if (await caPemTrustsDockerDaemon(existingCaPem, dockerEndpoint, fetchOpts)) {
-    await writeDockerDaemonCaMarker(certDir);
-    return true;
-  }
-
-  const augmented = await augmentCaPemWithDockerDaemonChain(existingCaPem, dockerEndpoint, fetchOpts);
-  if (augmented && augmented !== existingCaPem) {
-    const { normalizePemNewlines } = require('./dev-cert-helper');
-    await fs.promises.writeFile(
-      path.join(certDir, 'ca.pem'),
-      normalizePemNewlines(augmented),
-      { mode: 0o600 }
-    );
-    await writeDockerDaemonCaMarker(certDir);
-    return true;
-  }
-
-  return false;
+  return augmentCaPemForDockerVerify(certDir, existingCaPem, dockerEndpoint, fetchOpts);
 }
 
 module.exports = {

package/lib/utils/docker-reload-mount.js

@@ -101,6 +101,7 @@ function hostnameMatchesDockerHost(dockerHost) {
   const hnShort = hn.split('.')[0];
   const hShort = h.split('.')[0];
   if (h === hnShort || hn === hShort) return true;
+  if (hShort && hnShort && hShort === hnShort) return true;
   return false;
 }
 
@@ -120,8 +121,18 @@ function isReloadBindMountOnEngineHost(dockerEndpoint) {
   return hostnameMatchesDockerHost(host);
 }
 
+/**
+ * True when host refers to this machine (loopback, FQDN, or short hostname match).
+ * @param {string} host
+ * @returns {boolean}
+ */
+function isHostOnThisMachine(host) {
+  return hostnameMatchesDockerHost(host);
+}
+
 module.exports = {
   extractHostFromDockerEndpoint,
   isReloadBindMountOnEngineHost,
-  isLocalhostSyncSshHost
+  isLocalhostSyncSshHost,
+  isHostOnThisMachine
 };

package/lib/utils/external-env-template.js

@@ -54,6 +54,36 @@ const FALLBACK_SECURITY_BY_AUTH = {
   none: []
 };
 
+/**
+ * @param {Array<{name: string, value: string}>} authSecureVars
+ * @param {Record<string, unknown>} security
+ * @param {string} prefix
+ * @param {string} systemKey
+ */
+function pushSecureVarsFromSecurityMap(authSecureVars, security, prefix, systemKey) {
+  for (const key of Object.keys(security)) {
+    const envName = `KV_${prefix}_${securityKeyToVar(key)}`;
+    const pathVal = kvEnvKeyToPath(envName, systemKey);
+    authSecureVars.push({ name: envName, value: pathVal || `kv://${systemKey}/${key}` });
+  }
+}
+
+/**
+ * @param {Array<{name: string, value: string}>} authSecureVars
+ * @param {string} authMethod
+ * @param {string} prefix
+ * @param {string} systemKey
+ */
+function pushFallbackSecureVars(authSecureVars, authMethod, prefix, systemKey) {
+  const keys = FALLBACK_SECURITY_BY_AUTH[authMethod] || FALLBACK_SECURITY_BY_AUTH.apikey;
+  for (const key of keys) {
+    authSecureVars.push({
+      name: `KV_${prefix}_${securityKeyToVar(key)}`,
+      value: `kv://${systemKey}/${key}`
+    });
+  }
+}
+
 /**
  * Builds authSecureVars array from system authentication.security (or fallback by auth type).
  * @param {Object} system - System object with key and authentication
@@ -65,6 +95,9 @@ function buildAuthSecureVarsFromSystem(system) {
   const prefix = systemKeyToKvPrefix(systemKey);
   if (!prefix) return authSecureVars;
   const authBlock = system?.authentication || system?.auth;
+  if (authBlock?.authType === 'apiProvider' || authBlock?.authType === 'none') {
+    return authSecureVars;
+  }
   const credential = getAuthCredentialTemplate(authBlock);
   const security = credential?.security || authBlock?.security;
   const authMethod = (
@@ -74,19 +107,9 @@ function buildAuthSecureVarsFromSystem(system) {
     'apikey'
   ).toLowerCase();
   if (security && typeof security === 'object' && Object.keys(security).length > 0) {
-    for (const key of Object.keys(security)) {
-      const envName = `KV_${prefix}_${securityKeyToVar(key)}`;
-      const pathVal = kvEnvKeyToPath(envName, systemKey);
-      authSecureVars.push({ name: envName, value: pathVal || `kv://${systemKey}/${key}` });
-    }
+    pushSecureVarsFromSecurityMap(authSecureVars, security, prefix, systemKey);
   } else {
-    const keys = FALLBACK_SECURITY_BY_AUTH[authMethod] || FALLBACK_SECURITY_BY_AUTH.apikey;
-    for (const key of keys) {
-      authSecureVars.push({
-        name: `KV_${prefix}_${securityKeyToVar(key)}`,
-        value: `kv://${systemKey}/${key}`
-      });
-    }
+    pushFallbackSecureVars(authSecureVars, authMethod, prefix, systemKey);
   }
   return authSecureVars;
 }
@@ -116,13 +139,25 @@ function buildConfigurationEntries(system) {
  * @returns {{ authMethod: string, authSecureVars: Array<{name: string, value: string}>, authNonSecureVarNames: string[], configuration: Array<{name: string, value: string, comment: string}> }}
  */
 function buildExternalEnvTemplateContext(system) {
-  const authMethod = (system?.authentication?.method ||
-    system?.authentication?.type ||
-    system?.auth?.method ||
-    system?.auth?.type ||
-    'apikey').toLowerCase();
+  const authBlock = system?.authentication || system?.auth;
+  const credential = getAuthCredentialTemplate(authBlock);
+  let authMethod = 'apikey';
+  if (authBlock?.authType === 'apiProvider') {
+    authMethod = 'apiprovider';
+  } else if (authBlock?.authType === 'none') {
+    authMethod = 'none';
+  } else {
+    authMethod = (
+      credential?.method ||
+      authBlock?.method ||
+      authBlock?.type ||
+      'apikey'
+    ).toLowerCase();
+  }
   const authSecureVars = buildAuthSecureVarsFromSystem(system);
-  const authVars = system?.authentication?.variables || system?.auth?.variables || {};
+  const authVars =
+    (credential?.variables && typeof credential.variables === 'object' ? credential.variables : null) ||
+    (authBlock?.variables && typeof authBlock.variables === 'object' ? authBlock.variables : {});
   const authNonSecureVarNames = Object.keys(authVars);
   const configuration = buildConfigurationEntries(system);
   return {

package/lib/utils/health-check-poll-ui.js

@@ -0,0 +1,119 @@
+/**
+ * In-place health-check wait line (TTY ora or carriage-return refresh).
+ *
+ * @fileoverview Health check poll presentation helpers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('./logger');
+
+function shouldUseHealthCheckPollSpinner() {
+  return Boolean(process && process.stdout && process.stdout.isTTY);
+}
+
+/**
+ * @param {number} attemptIndex - Zero-based attempt index after a failed probe
+ * @param {number} maxAttempts
+ * @returns {string}
+ */
+function buildHealthCheckPollText(attemptIndex, maxAttempts) {
+  return chalk.yellow(
+    `Waiting for health check… (${attemptIndex + 1}/${maxAttempts})`
+  );
+}
+
+function createSilentHealthCheckPollHandlers() {
+  return {
+    usesSpinner: false,
+    onWaiting: () => {},
+    finish: () => {}
+  };
+}
+
+function createDelegatedHealthCheckPollHandlers(maxAttempts, onPollText) {
+  return {
+    usesSpinner: false,
+    onWaiting: (attemptIndex) => {
+      onPollText(buildHealthCheckPollText(attemptIndex, maxAttempts));
+    },
+    finish: () => {}
+  };
+}
+
+function createOraHealthCheckPollHandlers(maxAttempts) {
+  const ora = require('ora');
+  const spinner = ora({
+    text: buildHealthCheckPollText(0, maxAttempts),
+    spinner: 'dots'
+  });
+  let started = false;
+  return {
+    usesSpinner: true,
+    onWaiting: (attemptIndex) => {
+      if (!started) {
+        spinner.start();
+        started = true;
+      }
+      spinner.text = buildHealthCheckPollText(attemptIndex, maxAttempts);
+    },
+    finish: () => {
+      if (started) {
+        spinner.stop();
+        process.stdout.write('\n');
+      }
+    }
+  };
+}
+
+function createCarriageReturnHealthCheckPollHandlers(maxAttempts) {
+  let lastLine = '';
+  return {
+    usesSpinner: false,
+    onWaiting: (attemptIndex) => {
+      const line = buildHealthCheckPollText(attemptIndex, maxAttempts);
+      if (process.stdout && process.stdout.isTTY) {
+        process.stdout.write(`\r${line}`);
+        lastLine = line;
+        return;
+      }
+      logger.log(line);
+    },
+    finish: () => {
+      if (lastLine && process.stdout && process.stdout.isTTY) {
+        process.stdout.write('\n');
+        lastLine = '';
+      }
+    }
+  };
+}
+
+/**
+ * @param {number} maxAttempts
+ * @param {{ silent?: boolean, onPollText?: (text: string) => void }} [options]
+ * @returns {{ usesSpinner: boolean, onWaiting: (attemptIndex: number) => void, finish: () => void }}
+ */
+function createHealthCheckPollHandlers(maxAttempts, options = {}) {
+  const silent = options && options.silent === true;
+  const onPollText = options && typeof options.onPollText === 'function' ? options.onPollText : null;
+
+  if (silent) {
+    return createSilentHealthCheckPollHandlers();
+  }
+  if (onPollText) {
+    return createDelegatedHealthCheckPollHandlers(maxAttempts, onPollText);
+  }
+  if (shouldUseHealthCheckPollSpinner()) {
+    return createOraHealthCheckPollHandlers(maxAttempts);
+  }
+  return createCarriageReturnHealthCheckPollHandlers(maxAttempts);
+}
+
+module.exports = {
+  buildHealthCheckPollText,
+  createHealthCheckPollHandlers,
+  shouldUseHealthCheckPollSpinner
+};

package/lib/utils/health-check-url.js

@@ -63,56 +63,76 @@ function frontDoorPattern(appConfig) {
 }
 
 /**
- * Public app URL (Traefik + frontDoor mount path), without the health path — for CLI summaries.
- * Requires infra Traefik on, `frontDoorRouting.enabled`, host, and pattern.
- *
- * @async
- * @param {string} appName
- * @param {number} healthCheckPort
  * @param {Object|null} appConfig
- * @returns {Promise<string|null>}
+ * @returns {{ fd: Object, mountPath: string }|null}
  */
-async function computeTraefikPublicAppUrl(_appName, _healthCheckPort, appConfig) {
+function readTraefikFrontDoorMount(appConfig) {
   if (!appConfig || !frontDoorEnabled(appConfig)) return null;
   const pattern = frontDoorPattern(appConfig);
   if (!pattern) return null;
-
-  const coreConfig = require('../core/config');
-  const userCfg = await coreConfig.getConfig();
-  if (!(userCfg && userCfg.traefik)) return null;
-
   const fd = appConfig.frontDoorRouting;
-  if (!fd || typeof fd !== 'object') return null;
   const hostTemplate = typeof fd.host === 'string' ? fd.host.trim() : '';
   if (!hostTemplate) return null;
+  return { fd, mountPath: normalizeFrontDoorPatternForHealth(pattern) };
+}
 
-  const mountPath = normalizeFrontDoorPatternForHealth(pattern);
-
-  const infraTlsEnabled = Boolean(userCfg && userCfg.tlsEnabled);
-  const remoteServer = await coreConfig.getRemoteServer();
-  const developerIdRaw = await coreConfig.getDeveloperId();
-  const developerIdNum = parseDeveloperIdNum(developerIdRaw);
-  const setupPlatformMode = await coreConfig.getSetupPlatformMode();
+/**
+ * @param {Object} appConfig
+ * @returns {Promise<Object|null>}
+ */
+async function loadTraefikPublicUrlContext(appConfig) {
+  const coreConfig = require('../core/config');
+  const userCfg = await coreConfig.getConfig();
+  if (!(userCfg && userCfg.traefik)) return null;
+  const [remoteServer, developerRootDomain, developerIdRaw, setupPlatformMode] = await Promise.all([
+    coreConfig.getRemoteServer(),
+    coreConfig.getDeveloperRootDomain(),
+    coreConfig.getDeveloperId(),
+    coreConfig.getSetupPlatformMode()
+  ]);
+  return {
+    infraTlsEnabled: Boolean(userCfg && userCfg.tlsEnabled),
+    remoteServer,
+    developerRootDomain,
+    developerIdRaw,
+    developerIdNum: parseDeveloperIdNum(developerIdRaw),
+    setupPlatformMode,
+    listenPort: Number(appConfig?.port || 3000)
+  };
+}
 
-  // URLs are resolved for the CLI on the host, not from inside a container.
-  const profile = 'local';
-  const listenPort = Number(appConfig?.port || 3000);
+/**
+ * Public app URL (Traefik + frontDoor mount path), without the health path — for CLI summaries.
+ * Requires infra Traefik on, `frontDoorRouting.enabled`, host, and pattern.
+ *
+ * @async
+ * @param {string} appName
+ * @param {number} healthCheckPort
+ * @param {Object|null} appConfig
+ * @returns {Promise<string|null>}
+ */
+async function computeTraefikPublicAppUrl(_appName, _healthCheckPort, appConfig) {
+  const frontDoor = readTraefikFrontDoorMount(appConfig);
+  if (!frontDoor) return null;
+  const ctx = await loadTraefikPublicUrlContext(appConfig);
+  if (!ctx) return null;
 
   const publicBase = computePublicUrlBaseString({
     traefik: true,
     pathActive: true,
-    hostTemplate: fd.host,
-    tls: fd.tls,
-    developerIdRaw,
-    remoteServer,
-    profile,
-    listenPort,
-    developerIdNum,
-    infraTlsEnabled,
-    setupPlatformMode
+    hostTemplate: frontDoor.fd.host,
+    tls: frontDoor.fd.tls,
+    developerIdRaw: ctx.developerIdRaw,
+    remoteServer: ctx.remoteServer,
+    developerRootDomain: ctx.developerRootDomain,
+    profile: 'local',
+    listenPort: ctx.listenPort,
+    developerIdNum: ctx.developerIdNum,
+    infraTlsEnabled: ctx.infraTlsEnabled,
+    setupPlatformMode: ctx.setupPlatformMode
   });
 
-  return joinUrlPath(publicBase, mountPath);
+  return joinUrlPath(publicBase, frontDoor.mountPath);
 }
 
 /**