@aifabrix/builder 2.51.1 → 2.52.1

package/lib/schema/external-system.schema.json

@@ -7,12 +7,12 @@
       "key": "external-system-schema",
       "name": "External System Configuration Schema",
       "description": "JSON schema for validating ExternalSystem configuration files",
-      "version": "1.13.1",
+      "version": "1.14.0",
       "type": "schema",
       "category": "integration",
       "author": "AI Fabrix Team",
       "createdAt": "2024-01-01T00:00:00Z",
-      "updatedAt": "2026-07-22T00:00:00Z",
+      "updatedAt": "2026-08-07T00:00:00Z",
       "compatibility": {
          "minVersion": "1.4.0",
          "maxVersion": "2.0.0",
@@ -27,6 +27,14 @@
       ],
       "dependencies": [],
       "changelog": [
+         {
+            "version": "1.14.0",
+            "date": "2026-08-07T00:00:00Z",
+            "changes": [
+               "Added authentication.authType system for platform-managed downstream auth (no credential/apiProvider; ownership only — not autonomous system actor)."
+            ],
+            "breaking": false
+         },
          {
             "version": "1.13.1",
             "date": "2026-07-22T00:00:00Z",
@@ -806,6 +814,7 @@
                "enum": [
                   "credential",
                   "apiProvider",
+                  "system",
                   "none"
                ]
             },
@@ -845,6 +854,36 @@
                      "apiProvider"
                   ]
                }
+            },
+            {
+               "if": {
+                  "properties": {
+                     "authType": {
+                        "const": "system"
+                     }
+                  }
+               },
+               "then": {
+                  "properties": {
+                     "credential": false,
+                     "apiProvider": false
+                  }
+               }
+            },
+            {
+               "if": {
+                  "properties": {
+                     "authType": {
+                        "const": "none"
+                     }
+                  }
+               },
+               "then": {
+                  "properties": {
+                     "credential": false,
+                     "apiProvider": false
+                  }
+               }
             }
          ]
       }
@@ -1039,7 +1078,7 @@
          "default": false
       },
       "authentication": {
-         "description": "Nested authentication: authType credential (local template), apiProvider (Miso delegated), or none. Deprecated — prefer authentications[] with usage.",
+         "description": "Nested authentication: authType credential (local template), apiProvider (Miso delegated), system (platform-managed downstream auth ownership), or none (downstream anonymous). Deprecated — prefer authentications[] with usage.",
          "oneOf": [
             {
                "type": "object",
@@ -1073,6 +1112,18 @@
                },
                "additionalProperties": false
             },
+            {
+               "type": "object",
+               "required": [
+                  "authType"
+               ],
+               "properties": {
+                  "authType": {
+                     "const": "system"
+                  }
+               },
+               "additionalProperties": false
+            },
             {
                "type": "object",
                "required": [

package/lib/schema/infra.parameter.yaml

@@ -340,26 +340,6 @@ parameters:
       vaultSecretName: dataplane-client-secretKeyVault
       notes: Per-app OAuth client secret for dataplane; generated on first ensure.
 
-  - key: mori-controller-client-idKeyVault
-    scope: app
-    generator:
-      type: literal
-      value: 'miso-controller-dev-mori-controller'
-    ensureOn: [upInfra, resolveApp]
-    azure:
-      notes: >-
-        Per-app OAuth client id from controller registration; literal default matches
-        {controllerId}-{environmentKey}-{applicationKey} (override per environment).
-
-  - key: mori-controller-client-secretKeyVault
-    scope: app
-    generator:
-      type: randomBytes32
-    ensureOn: [upInfra, resolveApp]
-    azure:
-      vaultSecretName: mori-controller-client-secretKeyVault
-      notes: Per-app OAuth client secret for mori-controller; generated on first ensure.
-
   # Mori / telemetry: optional locally (LICENSE_JWT via miso-controller-jwt-licenseKeyVault=DEVELOPMENT skips Mori).
   # MORI_AUTH_METHOD=kv://mori-controller-auth-methodKeyVault — local default apiKey.
   - key: mori-controller-auth-methodKeyVault

package/lib/schema/integration-definition.schema.json

@@ -0,0 +1,195 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "aifabrix://schema/integration-definition.schema.json",
+  "title": "AI Fabrix Builder Integration Definition (BID)",
+  "description": "Canonical BT → Builder integration definition. Schema name aifabrix.builder.integrationDefinition v1.0.0.",
+  "metadata": {
+    "key": "integration-definition-schema",
+    "name": "Builder Integration Definition",
+    "version": "1.0.0",
+    "schemaName": "aifabrix.builder.integrationDefinition",
+    "type": "schema",
+    "category": "integration",
+    "author": "AI Fabrix Team",
+    "createdAt": "2026-08-04T00:00:00Z",
+    "updatedAt": "2026-08-04T00:00:00Z"
+  },
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaName",
+    "schemaVersion",
+    "definitionId",
+    "definitionHash",
+    "meta",
+    "packageIdentity",
+    "system",
+    "datasources",
+    "relationships",
+    "sync",
+    "capabilities",
+    "authority",
+    "acceptance"
+  ],
+  "properties": {
+    "schemaName": {
+      "type": "string",
+      "const": "aifabrix.builder.integrationDefinition"
+    },
+    "schemaVersion": {
+      "type": "string",
+      "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$",
+      "description": "BID schema semver; implementers must accept 1.0.0."
+    },
+    "definitionId": {
+      "type": "string",
+      "format": "uuid"
+    },
+    "definitionHash": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$",
+      "description": "SHA-256 of canonicalized BID body excluding this field."
+    },
+    "meta": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["suiteRunId", "producedAt", "btAssistantKey"],
+      "properties": {
+        "suiteRunId": { "type": "string", "minLength": 1 },
+        "producedAt": { "type": "string", "format": "date-time" },
+        "btAssistantKey": { "type": "string", "minLength": 1 },
+        "answerFingerprint": { "type": "string" },
+        "knowledgePackRefs": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "humanAnswerRefs": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "replaceSystemKey": { "type": "boolean", "default": false }
+      }
+    },
+    "packageIdentity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["systemKey", "packageVersion", "displayName"],
+      "properties": {
+        "systemKey": { "type": "string", "pattern": "^[a-z0-9-]+$", "minLength": 3 },
+        "packageVersion": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
+        "displayName": { "type": "string", "minLength": 1 }
+      }
+    },
+    "system": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": ["key", "systemKind", "connectionRefs"],
+      "properties": {
+        "key": { "type": "string", "pattern": "^[a-z0-9-]+$" },
+        "displayName": { "type": "string" },
+        "description": { "type": "string" },
+        "systemKind": { "type": "string", "minLength": 1 },
+        "type": { "type": "string", "enum": ["openapi", "mcp", "custom"] },
+        "connectionRefs": {
+          "type": "object",
+          "description": "kv:// or credential key refs only — no plaintext secrets.",
+          "additionalProperties": { "type": "string", "minLength": 1 }
+        },
+        "openapiSourceRef": { "type": "string" }
+      }
+    },
+    "datasources": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": true,
+        "required": ["key", "displayName", "entityType", "resourceType"],
+        "properties": {
+          "key": { "type": "string", "pattern": "^[a-z0-9-]+$", "minLength": 3 },
+          "displayName": { "type": "string", "minLength": 1 },
+          "entityType": {
+            "type": "string",
+            "enum": [
+              "documentStorage",
+              "vectorStore",
+              "recordStorage",
+              "messageService",
+              "serviceContract",
+              "none"
+            ]
+          },
+          "resourceType": { "type": "string", "pattern": "^[a-z0-9-]+$" },
+          "capabilityKeys": {
+            "type": "array",
+            "items": { "type": "string", "pattern": "^[a-z][a-zA-Z0-9]*$" }
+          },
+          "propertyKeys": {
+            "type": "array",
+            "description": "Vendor property names to sync/index (CRM objects → CIP query.properties + fieldMappings).",
+            "items": { "type": "string", "pattern": "^[a-zA-Z][a-zA-Z0-9_]*$", "minLength": 1 }
+          },
+          "openapiSourceRef": { "type": "string" }
+        }
+      }
+    },
+    "relationships": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": true,
+        "required": ["from", "to", "kind"],
+        "properties": {
+          "from": { "type": "string", "minLength": 1 },
+          "to": { "type": "string", "minLength": 1 },
+          "kind": { "type": "string", "minLength": 1 }
+        }
+      }
+    },
+    "sync": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": ["mode"],
+      "properties": {
+        "mode": {
+          "type": "string",
+          "enum": ["incremental"],
+          "description": "Incremental sync is mandatory for CRM profile datasources."
+        },
+        "datasources": {
+          "type": "array",
+          "items": { "type": "string", "pattern": "^[a-z0-9-]+$" }
+        }
+      }
+    },
+    "capabilities": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "array",
+        "items": { "type": "string", "pattern": "^[a-z][a-zA-Z0-9]*$" }
+      },
+      "description": "Map of datasource key → capability keys (must include named write for company DS)."
+    },
+    "authority": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": ["writeRequiresUserAuthority"],
+      "properties": {
+        "writeRequiresUserAuthority": { "type": "boolean" },
+        "notes": { "type": "string" }
+      }
+    },
+    "acceptance": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": ["gates"],
+      "properties": {
+        "gates": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "type": "string", "minLength": 1 }
+        }
+      }
+    }
+  }
+}

package/lib/utils/authentication-shape.js

@@ -110,6 +110,9 @@ function buildAuthenticationFromMethod(systemKey, authType) {
   if (method === 'none') {
     return { authType: 'none' };
   }
+  if (method === 'system') {
+    return { authType: 'system' };
+  }
   const flat = buildFlatCredentialTemplate(systemKey, method);
   return {
     authType: 'credential',
@@ -174,6 +177,9 @@ function migrateAuthenticationToNestedSchema(authentication, systemKey) {
   if (authentication.authType === 'none') {
     return { authentication: { authType: 'none' }, changed: false };
   }
+  if (authentication.authType === 'system') {
+    return { authentication: { authType: 'system' }, changed: false };
+  }
   if (authentication.authType === 'apiProvider' && authentication.apiProvider) {
     return { authentication, changed: false };
   }

package/lib/utils/certify-external-workspace.js

@@ -0,0 +1,40 @@
+/**
+ * @fileoverview Workspace roots allowed for external certify / verify CLI commands.
+ */
+
+'use strict';
+
+const CERTIFY_EXTERNAL_BASE_DIRS = new Set([
+  'integration',
+  'role-assistant',
+  'enterprise-knowledge'
+]);
+
+/**
+ * @param {string|null|undefined} baseDir
+ * @returns {boolean}
+ */
+function isCertifyExternalWorkspace(baseDir) {
+  return CERTIFY_EXTERNAL_BASE_DIRS.has(baseDir);
+}
+
+/**
+ * @param {string|null|undefined} baseDir
+ * @param {string} commandLabel - e.g. verify-operations
+ * @returns {void}
+ * @throws {Error}
+ */
+function assertCertifyExternalWorkspace(baseDir, commandLabel) {
+  if (!isCertifyExternalWorkspace(baseDir)) {
+    throw new Error(
+      `${commandLabel} applies to external authoring folders only ` +
+        '(integration/<systemKey>/, role-assistant/<roleKey>/, or enterprise-knowledge/<key>/).'
+    );
+  }
+}
+
+module.exports = {
+  CERTIFY_EXTERNAL_BASE_DIRS,
+  isCertifyExternalWorkspace,
+  assertCertifyExternalWorkspace
+};

package/lib/utils/docker-build.js

@@ -253,12 +253,12 @@ async function executeBuild(imageName, dockerfilePath, contextPath, tag, options
   );
   await executeDockerBuild(imageName, dockerfilePath, contextPath, tag, buildArgs, noCache);
 
-  // Tag image if additional tag provided
-  if (options && options.tag && options.tag !== 'latest') {
+  // Also apply floating `main` when building a version tag (matches dev-promote dual tags).
+  if (options && options.tag && options.tag !== 'latest' && options.tag !== 'main') {
     const { execFileWithDockerEnv } = require('./docker-exec');
     const { getDockerExecEnv } = require('./remote-docker-env');
     const env = await getDockerExecEnv();
-    await execFileWithDockerEnv('docker', ['tag', `${imageName}:${tag}`, `${imageName}:latest`], { env });
+    await execFileWithDockerEnv('docker', ['tag', `${imageName}:${tag}`, `${imageName}:main`], { env });
   }
 }
 

package/lib/utils/docker-run-ephemeral.js

@@ -16,8 +16,12 @@ const { getDockerExecEnv } = require('./remote-docker-env');
  * @param {string} fullImage - Image:tag
  * @param {string} cmd - Shell command (passed to sh -c)
  * @param {string|null} [envFilePath] - Path for docker run --env-file
- * @param {{ network?: string|null, volumeMounts?: Array<{ host: string, container: string }> }} [options]
- * @returns {Promise<number>} Exit code
+ * @param {{
+ *   network?: string|null,
+ *   volumeMounts?: Array<{ host: string, container: string }>,
+ *   quiet?: boolean
+ * }} [options] - quiet=true pipes stdio (installer-friendly; dump on failure)
+ * @returns {Promise<number|{ code: number, output: string }>} Exit code, or code+output when quiet
  */
 async function runDockerRunEphemeral(fullImage, cmd, envFilePath = null, options = {}) {
   const dockerEnv = await getDockerExecEnv();
@@ -26,22 +30,48 @@ async function runDockerRunEphemeral(fullImage, cmd, envFilePath = null, options
       ? options.network.trim()
       : null;
   const volumeMounts = Array.isArray(options?.volumeMounts) ? options.volumeMounts : [];
-  return new Promise((resolve) => {
-    const args = ['run', '--rm'];
-    if (network) {
-      args.push('--network', network);
-    }
-    if (envFilePath) {
-      args.push('--env-file', envFilePath);
-    }
-    for (const mount of volumeMounts) {
-      const host = typeof mount?.host === 'string' ? mount.host.trim() : '';
-      const container = typeof mount?.container === 'string' ? mount.container.trim() : '';
-      if (host && container) {
-        args.push('-v', `${host}:${container}`);
-      }
+  const quiet = options?.quiet === true;
+  const args = _buildDockerRunArgs(fullImage, cmd, envFilePath, network, volumeMounts);
+  if (quiet) {
+    return _spawnDockerQuiet(args, dockerEnv);
+  }
+  return _spawnDockerInherit(args, dockerEnv);
+}
+
+/**
+ * @param {string} fullImage
+ * @param {string} cmd
+ * @param {string|null} envFilePath
+ * @param {string|null} network
+ * @param {Array<{ host: string, container: string }>} volumeMounts
+ * @returns {string[]}
+ */
+function _buildDockerRunArgs(fullImage, cmd, envFilePath, network, volumeMounts) {
+  const args = ['run', '--rm'];
+  if (network) {
+    args.push('--network', network);
+  }
+  if (envFilePath) {
+    args.push('--env-file', envFilePath);
+  }
+  for (const mount of volumeMounts) {
+    const host = typeof mount?.host === 'string' ? mount.host.trim() : '';
+    const container = typeof mount?.container === 'string' ? mount.container.trim() : '';
+    if (host && container) {
+      args.push('-v', `${host}:${container}`);
     }
-    args.push(fullImage, 'sh', '-c', cmd);
+  }
+  args.push(fullImage, 'sh', '-c', cmd);
+  return args;
+}
+
+/**
+ * @param {string[]} args
+ * @param {NodeJS.ProcessEnv} dockerEnv
+ * @returns {Promise<number>}
+ */
+function _spawnDockerInherit(args, dockerEnv) {
+  return new Promise((resolve) => {
     const proc = spawn('docker', args, {
       stdio: 'inherit',
       shell: false,
@@ -52,4 +82,34 @@ async function runDockerRunEphemeral(fullImage, cmd, envFilePath = null, options
   });
 }
 
+/**
+ * @param {string[]} args
+ * @param {NodeJS.ProcessEnv} dockerEnv
+ * @returns {Promise<{ code: number, output: string }>}
+ */
+function _spawnDockerQuiet(args, dockerEnv) {
+  return new Promise((resolve) => {
+    const proc = spawn('docker', args, {
+      stdio: ['ignore', 'pipe', 'pipe'],
+      shell: false,
+      env: dockerEnv
+    });
+    const chunks = [];
+    const push = (buf) => {
+      if (buf && buf.length) {
+        chunks.push(buf);
+      }
+    };
+    proc.stdout.on('data', push);
+    proc.stderr.on('data', push);
+    proc.on('close', (code) => {
+      resolve({
+        code: code !== null ? code : 1,
+        output: Buffer.concat(chunks).toString('utf8')
+      });
+    });
+    proc.on('error', () => resolve({ code: 1, output: '' }));
+  });
+}
+
 module.exports = { runDockerRunEphemeral };

package/lib/utils/health-check-public-warn.js

@@ -38,32 +38,50 @@ async function filterTraefikUrlByDns(traefikUrl, debug, isHostnameResolvableFn)
  * @param {string} [p.skippedPublicHealthUrl]
  * @param {string[]} [p.urlsToTry]
  * @param {number} p.resolvedIndex
+ * @returns {string|null} Warning message without leading glyph, or null
  */
-function logPublicHealthUrlWarningIfNeeded(p) {
+function buildPublicHealthUrlWarningMessage(p) {
   const { skippedPublicHealthUrl, urlsToTry, resolvedIndex } = p;
-  if (typeof resolvedIndex !== 'number' || resolvedIndex < 0) return;
+  if (typeof resolvedIndex !== 'number' || resolvedIndex < 0) return null;
 
   if (skippedPublicHealthUrl) {
-    logger.log(
-      chalk.yellow(
-        `⚠ Public URL was not verified (DNS): ${skippedPublicHealthUrl}. ` +
-          'The application reported healthy via localhost only. Validate DNS names and Traefik routing for this host.'
-      )
+    return (
+      `Public URL was not verified (DNS): ${skippedPublicHealthUrl}. ` +
+      'The application reported healthy via localhost only. Validate DNS names and Traefik routing for this host.'
     );
-    return;
   }
   if (Array.isArray(urlsToTry) && urlsToTry.length > 1 && resolvedIndex > 0) {
     const pub = urlsToTry[0];
-    logger.log(
-      chalk.yellow(
-        `⚠ Public URL was not verified: ${pub}. ` +
-          'Health checks succeeded via localhost only. Validate Traefik routing, TLS, and DNS.'
-      )
+    return (
+      `Public URL was not verified: ${pub}. ` +
+      'Health checks succeeded via localhost only. Validate Traefik routing, TLS, and DNS.'
     );
   }
+  return null;
+}
+
+/**
+ * @param {Object} p
+ * @param {string} [p.skippedPublicHealthUrl]
+ * @param {string[]} [p.urlsToTry]
+ * @param {number} p.resolvedIndex
+ * @param {boolean} [p.defer]
+ * @param {(message: string) => void} [p.onDeferred]
+ */
+function logPublicHealthUrlWarningIfNeeded(p) {
+  const message = buildPublicHealthUrlWarningMessage(p);
+  if (!message) return;
+  if (p && p.defer === true) {
+    if (typeof p.onDeferred === 'function') {
+      p.onDeferred(message);
+    }
+    return;
+  }
+  logger.log(chalk.yellow(`⚠ ${message}`));
 }
 
 module.exports = {
   filterTraefikUrlByDns,
+  buildPublicHealthUrlWarningMessage,
   logPublicHealthUrlWarningIfNeeded
 };

package/lib/utils/health-check.js

@@ -339,6 +339,14 @@ function resolveHealthCheckPollOptions(runOptions = {}) {
   if (typeof runOptions.onPollText === 'function') {
     pollOptions.onPollText = runOptions.onPollText;
   }
+  const defer =
+    runOptions.deferPublicUrlWarning === true || typeof runOptions.onPollText === 'function';
+  if (defer) {
+    pollOptions.deferPublicUrlWarning = true;
+    if (typeof runOptions.onDeferredPublicUrlWarning === 'function') {
+      pollOptions.onDeferredPublicUrlWarning = runOptions.onDeferredPublicUrlWarning;
+    }
+  }
   return pollOptions;
 }
 
@@ -367,7 +375,9 @@ async function pollUntilHealthCheckPasses({
       logPublicHealthUrlWarningIfNeeded({
         skippedPublicHealthUrl,
         urlsToTry,
-        resolvedIndex: attemptResult.resolvedIndex
+        resolvedIndex: attemptResult.resolvedIndex,
+        defer: pollOptions.deferPublicUrlWarning === true,
+        onDeferred: pollOptions.onDeferredPublicUrlWarning
       });
       return;
     }

package/lib/utils/help-builder.js

@@ -111,6 +111,7 @@ const CATEGORIES = [
       { name: 'delete', term: 'delete <systemKey>' },
       { name: 'repair', term: 'repair <systemKey>' },
       { name: 'manifest', term: 'manifest get-section <systemKey> <sectionKey>' },
+      { name: 'integration-definition', term: 'integration-definition apply <file>' },
       { name: 'channel', term: 'channel scaffold <channelTarget>' },
       { name: 'datasource' },
       { name: 'datasource load', term: 'datasource load <datasourceKey>' },

package/lib/utils/paths.js

@@ -1022,23 +1022,17 @@ async function getResolveAppPath(appName, options = {}) {
   return { appPath: result.appPath, envOnly: false };
 }
 
-/**
- * @param {string} walkDir - Candidate workspace root (walk upward from cwd)
- * @param {string} cwd - Resolved process.cwd()
- * @param {ReturnType<typeof nodeFs>} disk
- * @returns {string|null}
- */
-function tryIntegrationAppKeyAtWalkStep(walkDir, cwd, disk) {
-  const integrationDir = path.join(walkDir, 'integration');
+function tryAuthoringAppKeyAtWalkStep(walkDir, cwd, disk, folderName) {
+  const authoringDir = path.join(walkDir, folderName);
   try {
-    if (!disk.existsSync(integrationDir)) {
+    if (!disk.existsSync(authoringDir)) {
       return null;
     }
-    const intNorm = path.resolve(integrationDir);
-    if (cwd !== intNorm && !cwd.startsWith(intNorm + path.sep)) {
+    const rootNorm = path.resolve(authoringDir);
+    if (cwd !== rootNorm && !cwd.startsWith(rootNorm + path.sep)) {
       return null;
     }
-    const rel = path.relative(intNorm, cwd);
+    const rel = path.relative(rootNorm, cwd);
     if (!rel || rel.startsWith('..') || path.isAbsolute(rel)) {
       return null;
     }
@@ -1049,16 +1043,20 @@ function tryIntegrationAppKeyAtWalkStep(walkDir, cwd, disk) {
 }
 
 /**
- * Resolve app folder name when cwd is under some ancestor's `integration/<systemKey>/`.
+ * Resolve app folder name when cwd is under integration/, role-assistant/, or
+ * enterprise-knowledge/<systemKey>/.
  * Walks up from cwd (does not use {@link getIntegrationBuilderBaseDir}) so detection still works
- * when the canonical base is config/home but the shell is inside a checkout's integration tree.
+ * when the canonical base is config/home but the shell is inside a checkout's tree.
  */
 function resolveIntegrationAppKeyFromCwd() {
   const cwd = path.resolve(process.cwd());
   const disk = nodeFs();
   let p = cwd;
   for (let i = 0; i < 64; i += 1) {
-    const key = tryIntegrationAppKeyAtWalkStep(p, cwd, disk);
+    const key =
+      tryAuthoringAppKeyAtWalkStep(p, cwd, disk, 'integration') ||
+      tryAuthoringAppKeyAtWalkStep(p, cwd, disk, 'role-assistant') ||
+      tryAuthoringAppKeyAtWalkStep(p, cwd, disk, 'enterprise-knowledge');
     if (key) {
       return key;
     }