@aifabrix/builder 2.49.2 → 2.51.0

package/lib/utils/integration-path-resolve.js

@@ -0,0 +1,112 @@
+/**
+ * Find integration/<systemKey> under aifabrix-work (sibling repos).
+ *
+ * @fileoverview Worktree integration discovery for dev layouts (sibling repos under aifabrix-work)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { getAifabrixWork } = require('./paths');
+const { resolveApplicationConfigPath } = require('./app-config-resolver');
+const { discoverIntegrationFiles } = require('../commands/repair-internal');
+
+/**
+ * @param {string} appPath
+ * @returns {boolean}
+ */
+function integrationFolderHasContent(appPath) {
+  if (!fs.existsSync(appPath)) {
+    return false;
+  }
+  try {
+    const st = fs.statSync(appPath);
+    if (!st.isDirectory()) {
+      return false;
+    }
+  } catch {
+    return false;
+  }
+  const { systemFiles, datasourceFiles } = discoverIntegrationFiles(appPath);
+  if (systemFiles.length > 0 || datasourceFiles.length > 0) {
+    return true;
+  }
+  try {
+    resolveApplicationConfigPath(appPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {string} work
+ * @param {string} systemKey
+ * @returns {{ integrationPath: string, tier: string }[]}
+ */
+function collectWorkRepoIntegrationHits(work, systemKey) {
+  /** @type {{ integrationPath: string, tier: string }[]} */
+  const hits = [];
+  let entries;
+  try {
+    entries = fs.readdirSync(work, { withFileTypes: true });
+  } catch {
+    return hits;
+  }
+  for (const ent of entries) {
+    if (!ent.isDirectory() || ent.name.startsWith('.')) {
+      continue;
+    }
+    const candidate = path.join(work, ent.name, 'integration', systemKey);
+    if (integrationFolderHasContent(candidate)) {
+      hits.push({ integrationPath: path.resolve(candidate), tier: 'work-repo-integration' });
+    }
+  }
+  return hits;
+}
+
+/**
+ * @param {{ integrationPath: string, tier: string }[]} hits
+ * @param {string} systemKey
+ * @returns {{ integrationPath: string, tier: string }|null}
+ */
+function resolveUniqueIntegrationHit(hits, systemKey) {
+  if (hits.length === 1) {
+    return hits[0];
+  }
+  if (hits.length > 1) {
+    const err = new Error(
+      `Integration "${systemKey}" found in multiple repos under aifabrix-work: ${hits.map((h) => h.integrationPath).join(', ')}. ` +
+        'Run from the target repo or narrow with cwd.'
+    );
+    err.statusCode = 409;
+    throw err;
+  }
+  return null;
+}
+
+/**
+ * @param {string} systemKey
+ * @returns {{ integrationPath: string, tier: string }|null}
+ */
+function findIntegrationPathAcrossWorkTree(systemKey) {
+  const work = getAifabrixWork();
+  if (!work) {
+    return null;
+  }
+
+  const direct = path.join(work, 'integration', systemKey);
+  if (integrationFolderHasContent(direct)) {
+    return { integrationPath: path.resolve(direct), tier: 'work-integration' };
+  }
+
+  return resolveUniqueIntegrationHit(collectWorkRepoIntegrationHits(work, systemKey), systemKey);
+}
+
+module.exports = {
+  findIntegrationPathAcrossWorkTree,
+  integrationFolderHasContent
+};

package/lib/utils/logger.js

@@ -11,6 +11,39 @@
 
 /* eslint-disable no-console */
 
+const SENSITIVE_KEY_RE = /(password|secret|token|apikey|apiKey|authorization|clientSecret|x-client-token)/i;
+const BEARER_TOKEN_RE = /(Bearer\s+)[A-Za-z0-9._~-]+/gi;
+
+function maskString(value) {
+  const asString = String(value);
+  return asString.replace(BEARER_TOKEN_RE, '$1[REDACTED]');
+}
+
+function sanitizeValue(value) {
+  if (value instanceof Error) {
+    return value;
+  }
+  if (typeof value === 'string') {
+    return maskString(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => sanitizeValue(item));
+  }
+  if (value && typeof value === 'object') {
+    /** @type {Record<string, any>} */
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+      if (SENSITIVE_KEY_RE.test(key)) {
+        out[key] = '[REDACTED]';
+      } else {
+        out[key] = sanitizeValue(entry);
+      }
+    }
+    return out;
+  }
+  return value;
+}
+
 /**
  * Logger utility that wraps console methods
  * All console statements should use this logger to avoid eslint warnings
@@ -21,7 +54,7 @@ const logger = {
    * @param {...any} args - Arguments to log
    */
   log: (...args) => {
-    console.log(...args);
+    console.log(...args.map((arg) => sanitizeValue(arg)));
   },
 
   /**
@@ -29,7 +62,7 @@ const logger = {
    * @param {...any} args - Arguments to log
    */
   error: (...args) => {
-    console.error(...args);
+    console.error(...args.map((arg) => sanitizeValue(arg)));
   },
 
   /**
@@ -37,7 +70,7 @@ const logger = {
    * @param {...any} args - Arguments to log
    */
   warn: (...args) => {
-    console.warn(...args);
+    console.warn(...args.map((arg) => sanitizeValue(arg)));
   },
 
   /**
@@ -45,7 +78,7 @@ const logger = {
    * @param {...any} args - Arguments to log
    */
   info: (...args) => {
-    console.log(...args);
+    console.log(...args.map((arg) => sanitizeValue(arg)));
   }
 };
 

package/lib/utils/manifest-source-emit.js

@@ -74,7 +74,7 @@ function getManifestSourcePayload(appKey, appPath, opts = {}) {
   } catch {
     configPath = '';
   }
-  let tier = 'resolved';
+  let tier;
   try {
     tier = computeTierForAppPath(key, dir, opts.cwd);
   } catch {

package/lib/utils/paths-reload-source.js

@@ -0,0 +1,148 @@
+/**
+ * Resolve product-repo source roots for platform app --reload bind mounts.
+ *
+ * @fileoverview When builder manifests live under aifabrix-work/builder/<app>, build.context
+ *   ../.. may point at the work root instead of the product repo; reload mounts must target
+ *   the repo that contains app/ or packages/.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const { isSystemBuilderAppName } = require('./paths-system-builder-keys');
+
+const nodeFs = () => require('../internal/fs-real-sync');
+
+/** @type {Readonly<Record<string, string[]>>} */
+const SYSTEM_APP_SOURCE_REPO_DIR_NAMES = Object.freeze({
+  dataplane: ['aifabrix-dataplane'],
+  'miso-controller': ['aifabrix-miso'],
+  'builder-api': ['aifabrix-builder']
+});
+
+/** @type {Readonly<Record<string, string[]>>} */
+const SYSTEM_APP_RELOAD_MARKERS = Object.freeze({
+  dataplane: ['app/main.py'],
+  'miso-controller': ['packages/miso-controller/package.json'],
+  'builder-api': ['lib/cli.js', 'bin/aifabrix.js']
+});
+
+/**
+ * @param {string} appName
+ * @param {string} rootPath
+ * @returns {boolean}
+ */
+function isValidReloadSourceRoot(appName, rootPath) {
+  if (!rootPath || typeof rootPath !== 'string') {
+    return false;
+  }
+  const markers = SYSTEM_APP_RELOAD_MARKERS[appName];
+  if (!markers || markers.length === 0) {
+    return nodeFs().existsSync(rootPath);
+  }
+  return markers.some((rel) => nodeFs().existsSync(path.join(rootPath, rel)));
+}
+
+/**
+ * @param {string} builderPath
+ * @param {string} [buildContext]
+ * @returns {string}
+ */
+function resolveBuildContextFromBuilder(builderPath, buildContext = '../..') {
+  const ctx = buildContext && typeof buildContext === 'string' ? buildContext : '.';
+  return path.resolve(builderPath, ctx);
+}
+
+/**
+ * @param {{ getAifabrixWork?: () => (string|null), getCwdBuilderAppPath?: (string) => (string|null) }} deps
+ * @returns {{ getWork: () => (string|null), getCwdBuilder: (string) => (string|null) }}
+ */
+function resolveReloadDeps(deps) {
+  return {
+    getWork: deps.getAifabrixWork || (() => require('./paths').getAifabrixWork()),
+    getCwdBuilder: deps.getCwdBuilderAppPath || ((name) => require('./paths').getCwdBuilderAppPath(name))
+  };
+}
+
+/**
+ * @param {string} appName
+ * @param {string} builderPath
+ * @param {string} buildContext
+ * @param {{ getAifabrixWork?: () => (string|null), getCwdBuilderAppPath?: (string) => (string|null) }} deps
+ * @returns {string[]}
+ */
+function collectReloadSourceCandidates(appName, builderPath, buildContext, deps) {
+  const { getWork, getCwdBuilder } = resolveReloadDeps(deps);
+  const candidates = [];
+  const cwdHit = getCwdBuilder(appName);
+  if (cwdHit) {
+    candidates.push(resolveBuildContextFromBuilder(cwdHit, buildContext));
+  }
+
+  const work = getWork();
+  if (!work) {
+    return candidates;
+  }
+
+  const repoNames = SYSTEM_APP_SOURCE_REPO_DIR_NAMES[appName] || [];
+  for (const repoName of repoNames) {
+    candidates.push(path.join(work, repoName));
+  }
+  try {
+    for (const entry of nodeFs().readdirSync(work)) {
+      if (!entry || entry.startsWith('.')) continue;
+      const builderSub = path.join(work, entry, 'builder', appName);
+      if (nodeFs().existsSync(builderSub)) {
+        candidates.push(resolveBuildContextFromBuilder(builderSub, buildContext));
+      }
+    }
+  } catch {
+    // ignore unreadable work root
+  }
+  return candidates;
+}
+
+/**
+ * @param {string} appName
+ * @param {string[]} candidates
+ * @param {string} fallback
+ * @returns {string}
+ */
+function pickFirstValidReloadRoot(appName, candidates, fallback) {
+  for (const candidate of candidates) {
+    if (isValidReloadSourceRoot(appName, candidate)) {
+      return candidate;
+    }
+  }
+  return fallback;
+}
+
+/**
+ * Resolve bind-mount source for `--reload` on platform system apps.
+ *
+ * @param {string} appName
+ * @param {string} builderPath - builder/<app> directory used for run
+ * @param {string} [buildContext='../..'] - build.context from application.yaml
+ * @param {{ getAifabrixWork?: () => (string|null), getCwdBuilderAppPath?: (string) => (string|null) }} [deps]
+ * @returns {string}
+ */
+function resolveSystemAppReloadSourceRoot(appName, builderPath, buildContext = '../..', deps = {}) {
+  const direct = resolveBuildContextFromBuilder(builderPath, buildContext);
+  if (!isSystemBuilderAppName(appName)) {
+    return direct;
+  }
+  if (isValidReloadSourceRoot(appName, direct)) {
+    return direct;
+  }
+  const candidates = collectReloadSourceCandidates(appName, builderPath, buildContext, deps);
+  return pickFirstValidReloadRoot(appName, candidates, direct);
+}
+
+module.exports = {
+  SYSTEM_APP_SOURCE_REPO_DIR_NAMES,
+  SYSTEM_APP_RELOAD_MARKERS,
+  isValidReloadSourceRoot,
+  resolveSystemAppReloadSourceRoot
+};

package/lib/utils/paths-system-builder-keys.js

@@ -0,0 +1,25 @@
+/**
+ * Platform system builder app keys (shared to avoid circular requires in paths.js).
+ *
+ * @fileoverview SYSTEM_BUILDER_APP_KEYS for dataplane, miso-controller, etc.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const SYSTEM_BUILDER_APP_KEYS = Object.freeze(['keycloak', 'miso-controller', 'dataplane', 'builder-api']);
+
+/**
+ * @param {string} appName
+ * @returns {boolean}
+ */
+function isSystemBuilderAppName(appName) {
+  if (!appName || typeof appName !== 'string') return false;
+  return SYSTEM_BUILDER_APP_KEYS.includes(appName);
+}
+
+module.exports = {
+  SYSTEM_BUILDER_APP_KEYS,
+  isSystemBuilderAppName
+};

package/lib/utils/paths.js

@@ -447,7 +447,7 @@ function getBuilderRoot() {
  * {@link getSystemBuilderRoot} (= {@link getAppsMaterializationParent}`/builder`), never the global CLI package tree.
  * @readonly
  */
-const SYSTEM_BUILDER_APP_KEYS = Object.freeze(['keycloak', 'miso-controller', 'dataplane']);
+const SYSTEM_BUILDER_APP_KEYS = Object.freeze(['keycloak', 'miso-controller', 'dataplane', 'builder-api']);
 
 /**
  * @param {string} appName
@@ -537,19 +537,45 @@ function isAppSubdirSync(root, name) {
 }
 
 /**
- * Lists app names (directories) under integration root. Excludes dot-prefixed entries.
+ * True when an integration/builder app directory has application config (yaml/json or legacy variables.yaml).
+ * Skips helper folders such as fixtures/ and wizard-configs/.
+ * @param {string} appDir - Absolute path to candidate app directory
+ * @returns {boolean}
+ */
+function hasApplicationConfigSync(appDir) {
+  if (!appDir || typeof appDir !== 'string') return false;
+  const disk = nodeFs();
+  const names = [
+    'application.yaml',
+    'application.yml',
+    'application.json',
+    'variables.yaml'
+  ];
+  return names.some((name) => {
+    try {
+      return disk.existsSync(path.join(appDir, name));
+    } catch {
+      return false;
+    }
+  });
+}
+
+/**
+ * Lists app names (directories) under integration root. Excludes dot-prefixed entries
+ * and directories without application config (e.g. fixtures/, wizard-configs/).
  * Returns [] if root does not exist.
  * @returns {string[]} Sorted list of app directory names
  */
 function listIntegrationAppNames() {
   const disk = nodeFs();
   const names = new Set();
+  const withAppConfig = (root) => (name) => hasApplicationConfigSync(path.join(root, name));
   const cwdRoot = getCwdIntegrationRoot();
   if (cwdRoot) {
-    addBuilderSubdirNamesToSet(disk, cwdRoot, names, null);
+    addBuilderSubdirNamesToSet(disk, cwdRoot, names, withAppConfig(cwdRoot));
   }
   const matInt = getIntegrationRoot();
-  addBuilderSubdirNamesToSet(disk, matInt, names, null);
+  addBuilderSubdirNamesToSet(disk, matInt, names, withAppConfig(matInt));
   return [...names].sort();
 }
 
@@ -595,7 +621,9 @@ function listBuilderAppNames() {
   }
   roots.add(path.resolve(getSystemBuilderRoot()));
   for (const r of roots) {
-    addBuilderSubdirNamesToSet(disk, r, names, null);
+    addBuilderSubdirNamesToSet(disk, r, names, (name) =>
+      hasApplicationConfigSync(path.join(r, name))
+    );
   }
   return [...names].sort();
 }
@@ -611,6 +639,15 @@ function getIntegrationPath(appName) {
   if (!appName || typeof appName !== 'string') {
     throw new Error('App name is required and must be a string');
   }
+  try {
+    const { getIntegrationPathScope } = require('../programmatic/integration-path-scope');
+    const scope = getIntegrationPathScope();
+    if (scope && typeof scope.resolveIntegrationPath === 'function') {
+      return scope.resolveIntegrationPath(appName);
+    }
+  } catch {
+    // programmatic module optional for CLI-only usage
+  }
   const cwdInt = path.join(path.resolve(process.cwd()), 'integration', appName);
   try {
     if (nodeFs().existsSync(cwdInt)) {
@@ -727,25 +764,81 @@ function isExternalAppType(variables) {
  * @param {string} appName - Application name
  * @returns {Object|null} App type info or null if no config found
  */
-function checkIntegrationFolder(appName) {
-  const integrationPath = getIntegrationPath(appName);
-  let variables;
+function isScopedIntegrationPathActive() {
   try {
-    const configPath = resolveApplicationConfigPath(integrationPath);
-    variables = loadConfigFile(configPath);
+    const { getIntegrationPathScope } = require('../programmatic/integration-path-scope');
+    const scope = getIntegrationPathScope();
+    return Boolean(scope && typeof scope.resolveIntegrationPath === 'function');
+  } catch {
+    return false;
+  }
+}
+
+function externalIntegrationFolderResult(appPath, baseDir = 'integration') {
+  return {
+    isExternal: true,
+    appPath,
+    appType: 'external',
+    baseDir
+  };
+}
+
+function isExistingAppDirectory(dirPath) {
+  try {
+    return fs.existsSync(dirPath) && fs.statSync(dirPath).isDirectory();
   } catch {
+    return false;
+  }
+}
+
+function resolveExistingWorkspacePath(appName, options) {
+  const { resolveAppWorkspace } = require('./app-path-resolve');
+  const { appPath, baseDir } = resolveAppWorkspace(appName, options);
+  if (isExistingAppDirectory(appPath)) {
+    return { appPath, baseDir };
+  }
+  const altWorkspace =
+    baseDir === 'enterprise-knowledge' ? 'integration' : 'enterprise-knowledge';
+  const alt = resolveAppWorkspace(appName, { ...options, workspace: altWorkspace });
+  if (!isExistingAppDirectory(alt.appPath)) {
     return null;
   }
-  if (variables) {
+  return { appPath: alt.appPath, baseDir: alt.baseDir };
+}
+
+function externalWorkspaceFolderFromConfig(appPath, baseDir, scopedWorkspace) {
+  try {
+    const configPath = resolveApplicationConfigPath(appPath);
+    const variables = loadConfigFile(configPath);
+    if (!variables) {
+      return null;
+    }
     const isExternal = isExternalAppType(variables);
     return {
       isExternal,
-      appPath: integrationPath,
+      appPath,
       appType: isExternal ? 'external' : 'regular',
-      baseDir: 'integration'
+      baseDir
     };
+  } catch {
+    if (scopedWorkspace && isExistingAppDirectory(appPath)) {
+      return externalIntegrationFolderResult(appPath, baseDir);
+    }
+    return null;
   }
-  return null;
+}
+
+function checkExternalWorkspaceFolder(appName, options = {}) {
+  const located = resolveExistingWorkspacePath(appName, options);
+  if (!located) {
+    return null;
+  }
+  const { appPath, baseDir } = located;
+  const scopedWorkspace = isScopedIntegrationPathActive();
+  if (scopedWorkspace && !isExistingAppDirectory(appPath)) {
+    return null;
+  }
+  return externalWorkspaceFolderFromConfig(appPath, baseDir, scopedWorkspace);
 }
 
 /**
@@ -776,6 +869,41 @@ function checkBuilderFolder(appName) {
   }
   return null;
 }
+
+/**
+ * When {@link getBuilderPath} has no application config but the CLI ships
+ * `templates/applications/<appName>/`, materialize `builder/<appName>/` (same as
+ * `ensureAppFromTemplate` for platform apps on `up-miso` / `up-dataplane`).
+ *
+ * @param {string} appName
+ * @returns {Promise<boolean>} True when template was copied
+ */
+async function ensureShippedBuilderAppTemplate(appName) {
+  if (!appName || typeof appName !== 'string') {
+    return false;
+  }
+  if (isSystemBuilderAppName(appName)) {
+    return false;
+  }
+  const projectRoot = getProjectRoot();
+  const templateDir = path.join(projectRoot, 'templates', 'applications', appName);
+  if (!fs.existsSync(templateDir) || !fs.statSync(templateDir).isDirectory()) {
+    return false;
+  }
+  const builderPath = getBuilderPath(appName);
+  try {
+    resolveApplicationConfigPath(builderPath);
+    return false;
+  } catch {
+    // No application config under builder/<appName>; copy shipped template.
+  }
+  const { copyTemplateFiles } = require('../validation/template');
+  const { ensureReadmeForAppPath } = require('../app/readme');
+  await copyTemplateFiles(appName, builderPath);
+  await ensureReadmeForAppPath(builderPath, appName);
+  return true;
+}
+
 /**
  * Detects if an app is external type by checking application config.
  * Resolution order: integration/ first, then builder/; if neither exists, throws.
@@ -786,15 +914,20 @@ function checkBuilderFolder(appName) {
  * @returns {Promise<{isExternal: boolean, appPath: string, appType: string, baseDir?: string}>}
  * @throws {Error} When app not found in integration/ or builder/
  */
-async function detectAppType(appName, _options = {}) {
+async function detectAppType(appName, options = {}) {
   if (!appName || typeof appName !== 'string') {
     throw new Error('App name is required and must be a string');
   }
-  const integrationResult = checkIntegrationFolder(appName);
-  if (integrationResult) return integrationResult;
+  const externalResult = checkExternalWorkspaceFolder(appName, options);
+  if (externalResult) return externalResult;
   const builderResult = checkBuilderFolder(appName);
   if (builderResult) return builderResult;
-  throw new Error(`App '${appName}' not found in integration/${appName} or builder/${appName}`);
+  await ensureShippedBuilderAppTemplate(appName);
+  const builderAfterTemplate = checkBuilderFolder(appName);
+  if (builderAfterTemplate) return builderAfterTemplate;
+  throw new Error(
+    `App '${appName}' not found in integration/${appName}, enterprise-knowledge/${appName}, or builder/${appName}`
+  );
 }
 
 /**
@@ -808,19 +941,32 @@ async function detectAppType(appName, _options = {}) {
  * @returns {Promise<{appPath: string, envOnly: boolean}>} appPath and envOnly (true when only env.template is used)
  * @throws {Error} When app not found in integration or builder
  */
-async function getResolveAppPath(appName) {
+function tryResolveEnvOnlyPath(dirPath) {
+  const envTemplatePath = path.join(dirPath, 'env.template');
+  if (!fs.existsSync(dirPath) || !fs.existsSync(envTemplatePath)) {
+    return null;
+  }
+  try {
+    resolveApplicationConfigPath(dirPath);
+    return { appPath: dirPath, envOnly: false };
+  } catch {
+    return { appPath: dirPath, envOnly: true };
+  }
+}
+
+async function getResolveAppPath(appName, options = {}) {
   if (!appName || typeof appName !== 'string') {
     throw new Error('App name is required and must be a string');
   }
-  const integrationPath = getIntegrationPath(appName);
-  const envTemplatePath = path.join(integrationPath, 'env.template');
-  if (fs.existsSync(integrationPath) && fs.existsSync(envTemplatePath)) {
-    try {
-      resolveApplicationConfigPath(integrationPath);
-      return { appPath: integrationPath, envOnly: false };
-    } catch {
-      return { appPath: integrationPath, envOnly: true };
-    }
+  const { resolveAppWorkspace } = require('./app-path-resolve');
+  const { appPath: workspacePath } = resolveAppWorkspace(appName, options);
+  const workspaceHit = tryResolveEnvOnlyPath(workspacePath);
+  if (workspaceHit) {
+    return workspaceHit;
+  }
+  const integrationHit = tryResolveEnvOnlyPath(getIntegrationPath(appName));
+  if (integrationHit) {
+    return integrationHit;
   }
   const { resolveApplicationManifestPathSync } = require('./manifest-location');
   const manifestHit = resolveApplicationManifestPathSync({
@@ -831,7 +977,7 @@ async function getResolveAppPath(appName) {
   if (manifestHit) {
     return { appPath: manifestHit.absolutePath, envOnly: false };
   }
-  const result = await detectAppType(appName);
+  const result = await detectAppType(appName, options);
   return { appPath: result.appPath, envOnly: false };
 }
 
@@ -918,9 +1064,16 @@ module.exports = {
   getDeployJsonPath,
   resolveApplicationConfigPath,
   resolveRbacPath,
+  ensureShippedBuilderAppTemplate,
   detectAppType,
   getResolveAppPath,
   resolveIntegrationAppKeyFromCwd,
-  clearProjectRootCache
+  clearProjectRootCache,
+  resolveSystemAppReloadSourceRoot: require('./paths-reload-source').resolveSystemAppReloadSourceRoot,
+  getEnterpriseKnowledgePath: require('./enterprise-knowledge-paths').getEnterpriseKnowledgePath,
+  getEnterpriseKnowledgeRoot: require('./enterprise-knowledge-paths').getEnterpriseKnowledgeRoot,
+  listEnterpriseKnowledgeAnchors: require('./enterprise-knowledge-paths').listEnterpriseKnowledgeAnchors,
+  resolveAppWorkspace: require('./app-path-resolve').resolveAppWorkspace,
+  resolveExternalSystemPath: require('./app-path-resolve').resolveExternalSystemPath
 };
 

package/lib/utils/pipeline-upload-auth-retry.js

@@ -64,6 +64,10 @@ async function uploadApplicationViaPipelineWithAuthRetry(dataplaneUrl, authConfi
   if (!isPipelineAuthFailure(first) || authConfig.type !== 'bearer') {
     return first;
   }
+  // Token-forward: do not swap the caller JWT for application client-token.
+  if (authConfig.preserveBearer) {
+    return first;
+  }
   const clientAuth = await resolveClientTokenAuthForPipelineRetry(systemKey);
   if (!clientAuth || clientAuth.type === 'bearer') {
     return first;