@aifabrix/builder 2.51.0 → 2.52.0

package/lib/utils/env-copy-keycloak.js

@@ -0,0 +1,196 @@
+/**
+ * Host .env.local Keycloak loopback URL helpers for env-copy.
+ *
+ * @fileoverview Resolve developer-scoped Keycloak ports for host-side .env.local
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const yaml = require('js-yaml');
+const config = require('../core/config');
+
+/**
+ * Read unquoted env value from content.
+ * @param {string} content
+ * @param {string} key
+ * @returns {string}
+ */
+function readEnvLineValue(content, key) {
+  const re = new RegExp(`^${key}\\s*=\\s*(.*)$`, 'm');
+  const m = content.match(re);
+  if (!m) return '';
+  return m[1].trim().replace(/^["']|["']$/g, '');
+}
+
+/**
+ * @param {Object} cfgModule - Config module with CONFIG_FILE
+ * @returns {number|null}
+ */
+function readDeveloperIdFromConfig(cfgModule) {
+  const configPath = cfgModule && cfgModule.CONFIG_FILE ? cfgModule.CONFIG_FILE : null;
+  if (!configPath || !fs.existsSync(configPath)) {
+    return null;
+  }
+  try {
+    const cfgContent = fs.readFileSync(configPath, 'utf8');
+    const cfg = yaml.load(cfgContent) || {};
+    const raw = cfg['developer-id'];
+    if (typeof raw === 'number') {
+      return raw;
+    }
+    if (typeof raw === 'string' && /^[0-9]+$/.test(raw)) {
+      return parseInt(raw, 10);
+    }
+  } catch {
+    // ignore
+  }
+  return null;
+}
+
+/**
+ * Base Keycloak published port from urls.local.yaml (before developer offset).
+ * @returns {number|null}
+ */
+function readKeycloakBasePortFromUrlsLocal() {
+  try {
+    const urlsPath = path.join(path.dirname(config.CONFIG_FILE || ''), 'urls.local.yaml');
+    if (!fs.existsSync(urlsPath)) return null;
+    const doc = yaml.load(fs.readFileSync(urlsPath, 'utf8')) || {};
+    const raw = doc['keycloak-port'];
+    const n = typeof raw === 'number' ? raw : parseInt(String(raw || ''), 10);
+    return Number.isFinite(n) && n > 0 ? n : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {string} host
+ * @returns {string|null} Normalized loopback host or null when not loopback
+ */
+function normalizeKeycloakLoopbackHost(host) {
+  let next = host;
+  if (next === 'keycloak') {
+    next = 'localhost';
+  }
+  const isLoopback =
+    next === 'localhost' || next === '127.0.0.1' || next === '::1' || next === '[::1]';
+  if (!isLoopback) {
+    return null;
+  }
+  return next === '::1' ? '[::1]' : next;
+}
+
+/**
+ * @param {string} content
+ * @returns {number|null}
+ */
+function resolveExplicitKeycloakPort(content) {
+  const publicPortRaw = readEnvLineValue(content, 'KEYCLOAK_PUBLIC_PORT');
+  if (/^\d+$/.test(publicPortRaw)) {
+    return parseInt(publicPortRaw, 10);
+  }
+  const portRaw = readEnvLineValue(content, 'KEYCLOAK_PORT');
+  if (!/^\d+$/.test(portRaw)) {
+    return null;
+  }
+  const portNum = parseInt(portRaw, 10);
+  // 8080 is the in-container listen port — not the host publish port
+  return portNum !== 8080 ? portNum : null;
+}
+
+/**
+ * @returns {number|null}
+ */
+function resolveDeveloperIdForKeycloakPort() {
+  try {
+    const raw = process.env.AIFABRIX_DEVELOPERID;
+    if (raw && /^[0-9]+$/.test(String(raw).trim())) {
+      return parseInt(String(raw).trim(), 10);
+    }
+    return readDeveloperIdFromConfig(config);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Published Keycloak host port for this developer (never a fixed 8182).
+ * Prefer KEYCLOAK_PUBLIC_PORT, then loopback KEYCLOAK_PORT (if not container 8080),
+ * else base from urls.local.yaml / 8082 + developer-id × 100.
+ *
+ * @param {string} content - Env file content
+ * @returns {{ host: string, port: number }|null}
+ */
+function resolveHostKeycloakLoopbackEndpoint(content) {
+  const { publishedHostPort, parseDeveloperIdNum } = require('./declarative-url-ports');
+  const host = normalizeKeycloakLoopbackHost(
+    readEnvLineValue(content, 'KEYCLOAK_HOST') || 'localhost'
+  );
+  if (!host) {
+    return null;
+  }
+  const explicit = resolveExplicitKeycloakPort(content);
+  if (explicit !== null) {
+    return { host, port: explicit };
+  }
+  const base = readKeycloakBasePortFromUrlsLocal() || 8082;
+  const port = publishedHostPort(base, parseDeveloperIdNum(resolveDeveloperIdForKeycloakPort()));
+  return { host, port };
+}
+
+/**
+ * Upsert KEYCLOAK_PORT and KEYCLOAK_INTERNAL_SERVER_URL for host .env.local.
+ * @param {string} content
+ * @param {string} host
+ * @param {number} port
+ * @returns {string}
+ */
+function patchKeycloakHostInternalLines(content, host, port) {
+  const internalUrl = `http://${host}:${port}/auth`;
+  let next = content;
+  if (readEnvLineValue(content, 'KEYCLOAK_HOST') === 'keycloak') {
+    next = next.replace(/^KEYCLOAK_HOST\s*=.*$/m, 'KEYCLOAK_HOST=localhost');
+  }
+  if (/^KEYCLOAK_PORT\s*=/m.test(next)) {
+    next = next.replace(/^KEYCLOAK_PORT\s*=.*$/m, `KEYCLOAK_PORT=${port}`);
+  } else {
+    next = `${next.trimEnd()}\nKEYCLOAK_PORT=${port}\n`;
+  }
+  if (/^KEYCLOAK_INTERNAL_SERVER_URL\s*=/m.test(next)) {
+    return next.replace(
+      /^KEYCLOAK_INTERNAL_SERVER_URL\s*=.*$/m,
+      `KEYCLOAK_INTERNAL_SERVER_URL=${internalUrl}`
+    );
+  }
+  return `${next.trimEnd()}\nKEYCLOAK_INTERNAL_SERVER_URL=${internalUrl}\n`;
+}
+
+/**
+ * For host `.env.local`, force Keycloak admin/internal base to this developer's
+ * published loopback port (`base + developerId × 100`). Never hardcodes a single
+ * developer’s port (e.g. 8182).
+ *
+ * @param {string} content - Env file content
+ * @returns {string}
+ */
+function applyHostLocalKeycloakInternalUrl(content) {
+  if (typeof content !== 'string' || content.length === 0) {
+    return content;
+  }
+  const endpoint = resolveHostKeycloakLoopbackEndpoint(content);
+  if (!endpoint) {
+    return content;
+  }
+  return patchKeycloakHostInternalLines(content, endpoint.host, endpoint.port);
+}
+
+module.exports = {
+  applyHostLocalKeycloakInternalUrl,
+  readEnvLineValue,
+  resolveHostKeycloakLoopbackEndpoint
+};

package/lib/utils/env-copy.js

@@ -21,6 +21,7 @@ const { rewriteInfraEndpoints } = require('./env-endpoints');
 const { buildEnvVarMap } = require('./env-map');
 const { interpolateEnvVars } = require('./secrets-helpers');
 const { getLocalPort } = require('./port-resolver');
+const { applyHostLocalKeycloakInternalUrl } = require('./env-copy-keycloak');
 
 /**
  * Read developer ID from config file synchronously
@@ -98,6 +99,26 @@ function resolveEnvOutputPath(rawOutputPath, variablesPath) {
   return outputPath;
 }
 
+/**
+ * Sibling host-only env path next to `build.envOutputPath` (`.env` → `.env.local`).
+ * Used for host CLI / manual tests; must not be mounted into the container.
+ *
+ * @param {string} envOutputPath - Resolved path ending in `.env`
+ * @returns {string} Path ending in `.env.local`
+ */
+function resolveEnvLocalOutputPath(envOutputPath) {
+  if (typeof envOutputPath !== 'string' || envOutputPath.trim() === '') {
+    throw new Error('envOutputPath is required to resolve .env.local');
+  }
+  if (envOutputPath.endsWith('.env.local')) {
+    return envOutputPath;
+  }
+  if (envOutputPath.endsWith('.env')) {
+    return `${envOutputPath}.local`;
+  }
+  return path.join(path.dirname(envOutputPath), '.env.local');
+}
+
 /**
  * Writes .env to envOutputPath for `--reload`: merge container `.env.run` into the host file.
  * Preserves comments when a file already exists (e.g. after `aifabrix resolve`). Keys present only
@@ -149,8 +170,18 @@ async function writeEnvOutputForLocal(appName, outputPath) {
     const localMap = parseEnvContentToMap(localContent);
     toWrite = mergeEnvMapIntoContent(existingContent, localMap);
   }
+  const isLocalSibling = path.basename(outputPath) === '.env.local';
+  if (isLocalSibling) {
+    toWrite = applyHostLocalKeycloakInternalUrl(toWrite);
+  }
   await fsp.writeFile(outputPath, toWrite, { mode: 0o600 });
-  logger.log(formatSuccessLine(`Wrote .env to envOutputPath (localPort): ${outputPath}`));
+  logger.log(
+    formatSuccessLine(
+      isLocalSibling
+        ? `Wrote host .env.local (localhost ports for CLI/tests): ${outputPath}`
+        : `Wrote .env to envOutputPath (localPort): ${outputPath}`
+    )
+  );
 }
 
 /**
@@ -408,6 +439,8 @@ async function processEnvVariables(envPath, variablesPath, appName, secretsPath,
 module.exports = {
   processEnvVariables,
   resolveEnvOutputPath,
+  resolveEnvLocalOutputPath,
+  applyHostLocalKeycloakInternalUrl,
   substituteMntDataForLocal,
   syncWrittenBuilderEnvToOutputPath,
   writeEnvOutputForReload,

package/lib/utils/external-system-readiness-compact-display.js

@@ -248,6 +248,9 @@ function formatGatePillarLine(opts = {}) {
   if (verdict === VERDICT.FAILED) {
     return formatBlockingError(`${label} · FAILED${suffix}`);
   }
+  if (verdict === VERDICT.NOT_APPLICABLE) {
+    return formatSuccessLine(`${label} · NOT APPLICABLE${suffix}`);
+  }
   return formatWarningLine(`${label} · NOT VERIFIED${suffix}`);
 }
 

package/lib/utils/health-check-public-warn.js

@@ -38,32 +38,50 @@ async function filterTraefikUrlByDns(traefikUrl, debug, isHostnameResolvableFn)
  * @param {string} [p.skippedPublicHealthUrl]
  * @param {string[]} [p.urlsToTry]
  * @param {number} p.resolvedIndex
+ * @returns {string|null} Warning message without leading glyph, or null
  */
-function logPublicHealthUrlWarningIfNeeded(p) {
+function buildPublicHealthUrlWarningMessage(p) {
   const { skippedPublicHealthUrl, urlsToTry, resolvedIndex } = p;
-  if (typeof resolvedIndex !== 'number' || resolvedIndex < 0) return;
+  if (typeof resolvedIndex !== 'number' || resolvedIndex < 0) return null;
 
   if (skippedPublicHealthUrl) {
-    logger.log(
-      chalk.yellow(
-        `⚠ Public URL was not verified (DNS): ${skippedPublicHealthUrl}. ` +
-          'The application reported healthy via localhost only. Validate DNS names and Traefik routing for this host.'
-      )
+    return (
+      `Public URL was not verified (DNS): ${skippedPublicHealthUrl}. ` +
+      'The application reported healthy via localhost only. Validate DNS names and Traefik routing for this host.'
     );
-    return;
   }
   if (Array.isArray(urlsToTry) && urlsToTry.length > 1 && resolvedIndex > 0) {
     const pub = urlsToTry[0];
-    logger.log(
-      chalk.yellow(
-        `⚠ Public URL was not verified: ${pub}. ` +
-          'Health checks succeeded via localhost only. Validate Traefik routing, TLS, and DNS.'
-      )
+    return (
+      `Public URL was not verified: ${pub}. ` +
+      'Health checks succeeded via localhost only. Validate Traefik routing, TLS, and DNS.'
     );
   }
+  return null;
+}
+
+/**
+ * @param {Object} p
+ * @param {string} [p.skippedPublicHealthUrl]
+ * @param {string[]} [p.urlsToTry]
+ * @param {number} p.resolvedIndex
+ * @param {boolean} [p.defer]
+ * @param {(message: string) => void} [p.onDeferred]
+ */
+function logPublicHealthUrlWarningIfNeeded(p) {
+  const message = buildPublicHealthUrlWarningMessage(p);
+  if (!message) return;
+  if (p && p.defer === true) {
+    if (typeof p.onDeferred === 'function') {
+      p.onDeferred(message);
+    }
+    return;
+  }
+  logger.log(chalk.yellow(`⚠ ${message}`));
 }
 
 module.exports = {
   filterTraefikUrlByDns,
+  buildPublicHealthUrlWarningMessage,
   logPublicHealthUrlWarningIfNeeded
 };

package/lib/utils/health-check.js

@@ -339,6 +339,14 @@ function resolveHealthCheckPollOptions(runOptions = {}) {
   if (typeof runOptions.onPollText === 'function') {
     pollOptions.onPollText = runOptions.onPollText;
   }
+  const defer =
+    runOptions.deferPublicUrlWarning === true || typeof runOptions.onPollText === 'function';
+  if (defer) {
+    pollOptions.deferPublicUrlWarning = true;
+    if (typeof runOptions.onDeferredPublicUrlWarning === 'function') {
+      pollOptions.onDeferredPublicUrlWarning = runOptions.onDeferredPublicUrlWarning;
+    }
+  }
   return pollOptions;
 }
 
@@ -367,7 +375,9 @@ async function pollUntilHealthCheckPasses({
       logPublicHealthUrlWarningIfNeeded({
         skippedPublicHealthUrl,
         urlsToTry,
-        resolvedIndex: attemptResult.resolvedIndex
+        resolvedIndex: attemptResult.resolvedIndex,
+        defer: pollOptions.deferPublicUrlWarning === true,
+        onDeferred: pollOptions.onDeferredPublicUrlWarning
       });
       return;
     }

package/lib/utils/help-builder.js

@@ -79,6 +79,7 @@ const CATEGORIES = [
       { name: 'dimension value', term: 'dimension value <command>' },
       { name: 'resource-type' },
       { name: 'role' },
+      { name: 'role-assistant' },
       { name: 'evidence-kind' },
       { name: 'enterprise-knowledge' },
       { name: 'identity' },

package/lib/utils/paths.js

@@ -382,15 +382,41 @@ function getIntegrationBuilderBaseDir() {
 }
 
 /**
- * Returns the default integration root under {@link getAppsMaterializationParent} (listing may also
- * scan {@link getCwdIntegrationRoot}; see {@link listIntegrationAppNames}).
+ * Returns the default integration root: {@link getCwdIntegrationRoot} when present, else
+ * under {@link getAppsMaterializationParent}. Listing may still scan both trees
+ * (see {@link listIntegrationAppNames}).
  *
  * @returns {string} Absolute path to integration/ directory
  */
 function getIntegrationRoot() {
+  const cwdRoot = getCwdIntegrationRoot();
+  if (cwdRoot) {
+    return cwdRoot;
+  }
   return path.join(getAppsMaterializationParent(), 'integration');
 }
 
+/**
+ * True when path exists and is a directory (best-effort; false on error).
+ * @param {string} dirPath
+ * @returns {boolean}
+ */
+function isExistingDirectoryPath(dirPath) {
+  if (!dirPath || typeof dirPath !== 'string') {
+    return false;
+  }
+  try {
+    const disk = nodeFs();
+    if (!disk.existsSync(dirPath)) {
+      return false;
+    }
+    const st = disk.statSync(dirPath);
+    return Boolean(st && typeof st.isDirectory === 'function' && st.isDirectory());
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Absolute `integration/` next to {@link process.cwd} when that directory exists.
  *
@@ -574,8 +600,10 @@ function listIntegrationAppNames() {
   if (cwdRoot) {
     addBuilderSubdirNamesToSet(disk, cwdRoot, names, withAppConfig(cwdRoot));
   }
-  const matInt = getIntegrationRoot();
-  addBuilderSubdirNamesToSet(disk, matInt, names, withAppConfig(matInt));
+  const matInt = path.join(getAppsMaterializationParent(), 'integration');
+  if (!cwdRoot || path.resolve(matInt) !== path.resolve(cwdRoot)) {
+    addBuilderSubdirNamesToSet(disk, matInt, names, withAppConfig(matInt));
+  }
   return [...names].sort();
 }
 
@@ -629,8 +657,11 @@ function listBuilderAppNames() {
 }
 
 /**
- * Gets the integration folder path: **`cwd/integration/<appName>`** when that directory exists, else
- * **`aifabrix-work` or `aifabrix-home` + `/integration/<appName>`**.
+ * Gets the integration folder path.
+ * Resolution: existing `cwd/integration/<app>` → existing materialization copy →
+ * `cwd/integration/<app>` when `cwd/integration/` exists (new download/create) →
+ * materialization parent. Download should use {@link getAppCreatePath} when it must
+ * always land under cwd even if a materialization orphan exists.
  *
  * @param {string} appName - Application name
  * @returns {string} Absolute path to integration directory
@@ -648,18 +679,21 @@ function getIntegrationPath(appName) {
   } catch {
     // programmatic module optional for CLI-only usage
   }
-  const cwdInt = path.join(path.resolve(process.cwd()), 'integration', appName);
-  try {
-    if (nodeFs().existsSync(cwdInt)) {
-      const st = nodeFs().statSync(cwdInt);
-      if (st && typeof st.isDirectory === 'function' && st.isDirectory()) {
-        return cwdInt;
-      }
+  const cwdRoot = getCwdIntegrationRoot();
+  const matApp = path.join(getAppsMaterializationParent(), 'integration', appName);
+  if (cwdRoot) {
+    const cwdApp = path.join(cwdRoot, appName);
+    if (isExistingDirectoryPath(cwdApp)) {
+      return cwdApp;
     }
-  } catch {
-    // ignore
   }
-  return path.join(getAppsMaterializationParent(), 'integration', appName);
+  if (isExistingDirectoryPath(matApp)) {
+    return matApp;
+  }
+  if (cwdRoot) {
+    return path.join(cwdRoot, appName);
+  }
+  return matApp;
 }
 
 /**
@@ -797,13 +831,15 @@ function resolveExistingWorkspacePath(appName, options) {
   if (isExistingAppDirectory(appPath)) {
     return { appPath, baseDir };
   }
-  const altWorkspace =
-    baseDir === 'enterprise-knowledge' ? 'integration' : 'enterprise-knowledge';
-  const alt = resolveAppWorkspace(appName, { ...options, workspace: altWorkspace });
-  if (!isExistingAppDirectory(alt.appPath)) {
-    return null;
+  const alternates = ['integration', 'enterprise-knowledge', 'role-assistant']
+    .filter((workspaceName) => workspaceName !== baseDir);
+  for (const workspaceName of alternates) {
+    const alt = resolveAppWorkspace(appName, { ...options, workspace: workspaceName });
+    if (isExistingAppDirectory(alt.appPath)) {
+      return { appPath: alt.appPath, baseDir: alt.baseDir };
+    }
   }
-  return { appPath: alt.appPath, baseDir: alt.baseDir };
+  return null;
 }
 
 function externalWorkspaceFolderFromConfig(appPath, baseDir, scopedWorkspace) {
@@ -926,7 +962,7 @@ async function detectAppType(appName, options = {}) {
   const builderAfterTemplate = checkBuilderFolder(appName);
   if (builderAfterTemplate) return builderAfterTemplate;
   throw new Error(
-    `App '${appName}' not found in integration/${appName}, enterprise-knowledge/${appName}, or builder/${appName}`
+    `App '${appName}' not found in integration/${appName}, enterprise-knowledge/${appName}, role-assistant/${appName}, or builder/${appName}`
   );
 }
 
@@ -964,6 +1000,11 @@ async function getResolveAppPath(appName, options = {}) {
   if (workspaceHit) {
     return workspaceHit;
   }
+  const { getRoleAssistantPath } = require('./role-assistant-paths');
+  const roleAssistantHit = tryResolveEnvOnlyPath(getRoleAssistantPath(appName));
+  if (roleAssistantHit) {
+    return roleAssistantHit;
+  }
   const integrationHit = tryResolveEnvOnlyPath(getIntegrationPath(appName));
   if (integrationHit) {
     return integrationHit;
@@ -981,23 +1022,17 @@ async function getResolveAppPath(appName, options = {}) {
   return { appPath: result.appPath, envOnly: false };
 }
 
-/**
- * @param {string} walkDir - Candidate workspace root (walk upward from cwd)
- * @param {string} cwd - Resolved process.cwd()
- * @param {ReturnType<typeof nodeFs>} disk
- * @returns {string|null}
- */
-function tryIntegrationAppKeyAtWalkStep(walkDir, cwd, disk) {
-  const integrationDir = path.join(walkDir, 'integration');
+function tryAuthoringAppKeyAtWalkStep(walkDir, cwd, disk, folderName) {
+  const authoringDir = path.join(walkDir, folderName);
   try {
-    if (!disk.existsSync(integrationDir)) {
+    if (!disk.existsSync(authoringDir)) {
       return null;
     }
-    const intNorm = path.resolve(integrationDir);
-    if (cwd !== intNorm && !cwd.startsWith(intNorm + path.sep)) {
+    const rootNorm = path.resolve(authoringDir);
+    if (cwd !== rootNorm && !cwd.startsWith(rootNorm + path.sep)) {
       return null;
     }
-    const rel = path.relative(intNorm, cwd);
+    const rel = path.relative(rootNorm, cwd);
     if (!rel || rel.startsWith('..') || path.isAbsolute(rel)) {
       return null;
     }
@@ -1008,16 +1043,20 @@ function tryIntegrationAppKeyAtWalkStep(walkDir, cwd, disk) {
 }
 
 /**
- * Resolve app folder name when cwd is under some ancestor's `integration/<systemKey>/`.
+ * Resolve app folder name when cwd is under integration/, role-assistant/, or
+ * enterprise-knowledge/<systemKey>/.
  * Walks up from cwd (does not use {@link getIntegrationBuilderBaseDir}) so detection still works
- * when the canonical base is config/home but the shell is inside a checkout's integration tree.
+ * when the canonical base is config/home but the shell is inside a checkout's tree.
  */
 function resolveIntegrationAppKeyFromCwd() {
   const cwd = path.resolve(process.cwd());
   const disk = nodeFs();
   let p = cwd;
   for (let i = 0; i < 64; i += 1) {
-    const key = tryIntegrationAppKeyAtWalkStep(p, cwd, disk);
+    const key =
+      tryAuthoringAppKeyAtWalkStep(p, cwd, disk, 'integration') ||
+      tryAuthoringAppKeyAtWalkStep(p, cwd, disk, 'role-assistant') ||
+      tryAuthoringAppKeyAtWalkStep(p, cwd, disk, 'enterprise-knowledge');
     if (key) {
       return key;
     }
@@ -1073,6 +1112,9 @@ module.exports = {
   getEnterpriseKnowledgePath: require('./enterprise-knowledge-paths').getEnterpriseKnowledgePath,
   getEnterpriseKnowledgeRoot: require('./enterprise-knowledge-paths').getEnterpriseKnowledgeRoot,
   listEnterpriseKnowledgeAnchors: require('./enterprise-knowledge-paths').listEnterpriseKnowledgeAnchors,
+  getRoleAssistantPath: require('./role-assistant-paths').getRoleAssistantPath,
+  getRoleAssistantRoot: require('./role-assistant-paths').getRoleAssistantRoot,
+  getCwdRoleAssistantRoot: require('./role-assistant-paths').getCwdRoleAssistantRoot,
   resolveAppWorkspace: require('./app-path-resolve').resolveAppWorkspace,
   resolveExternalSystemPath: require('./app-path-resolve').resolveExternalSystemPath
 };

package/lib/utils/pipeline-upload-auth-retry.js

@@ -57,10 +57,22 @@ async function resolveClientTokenAuthForPipelineRetry(systemKey) {
  * @param {Object} authConfig
  * @param {Object} payload
  * @param {string} systemKey - External system key for credential lookup on retry
+ * @param {Object} [options] - Forwarded to uploadApplicationViaPipeline (e.g. timeoutMs)
  * @returns {Promise<Object>}
  */
-async function uploadApplicationViaPipelineWithAuthRetry(dataplaneUrl, authConfig, payload, systemKey) {
-  const first = await uploadApplicationViaPipeline(dataplaneUrl, authConfig, payload);
+async function uploadApplicationViaPipelineWithAuthRetry(
+  dataplaneUrl,
+  authConfig,
+  payload,
+  systemKey,
+  options = {}
+) {
+  const first = await uploadApplicationViaPipeline(
+    dataplaneUrl,
+    authConfig,
+    payload,
+    options
+  );
   if (!isPipelineAuthFailure(first) || authConfig.type !== 'bearer') {
     return first;
   }
@@ -77,7 +89,7 @@ async function uploadApplicationViaPipelineWithAuthRetry(dataplaneUrl, authConfi
       'Device login token was rejected for pipeline publish; retrying with application client token…'
     )
   );
-  return uploadApplicationViaPipeline(dataplaneUrl, clientAuth, payload);
+  return uploadApplicationViaPipeline(dataplaneUrl, clientAuth, payload, options);
 }
 
 module.exports = {