@aifabrix/builder 2.52.0 → 2.53.0

package/lib/cli/infra-guided.js

@@ -331,23 +331,30 @@ async function runGuidedDownInfra(appName, options, infraMod, appLib) {
   logger.log(SEPARATOR);
   logger.log('');
 
+  const targetDeveloperId = options && options.developerId;
   const spin = startSpinner('Stopping infrastructure...');
   await withMutedLogger(async() => {
     if (typeof appName === 'string' && appName.trim().length > 0) {
-      await appLib.downApp(appName, { volumes: !!options.volumes });
+      await appLib.downApp(appName, {
+        volumes: !!options.volumes,
+        developerId: targetDeveloperId
+      });
       return;
     }
-    if (options.volumes) await infraMod.stopInfraWithVolumes();
-    else await infraMod.stopInfra();
+    if (options.volumes) await infraMod.stopInfraWithVolumes(targetDeveloperId);
+    else await infraMod.stopInfra(targetDeveloperId);
   });
   stopSpinnerSuccess(spin, 'Infrastructure stopped');
 
-  const developerId = await config.getDeveloperId();
-  const idNum = typeof developerId === 'string' ? parseInt(developerId, 10) : developerId;
+  const developerId = String(
+    targetDeveloperId !== undefined && targetDeveloperId !== null && targetDeveloperId !== ''
+      ? targetDeveloperId
+      : await config.getDeveloperId()
+  );
   const cfg = await config.getConfig();
 
   logFooterStart('Stopped');
-  logSection('Developer', `dev${String(idNum).padStart(2, '0')} (id: ${idNum})`);
+  logSection('Developer', `dev${developerId.padStart(2, '0')} (id: ${developerId})`);
   logStoppedServices(cfg);
   if (options.volumes) {
     logger.log(chalk.yellow('⚠ Volumes removed: all local data deleted'));

package/lib/cli/setup-credential-deployment.js

@@ -18,8 +18,10 @@ const { runDeploymentList } = require('../commands/deployment-list');
 const CREDENTIAL_HELP_AFTER = `
 Subcommands:
   env <systemKey>   Prompt for KV_* values → integration/<key>/.env
-  push <systemKey>  Upload secrets from .env to Dataplane
+  push <systemKey>  Upload secrets from an env file to Dataplane (--file recommended)
   list               List credentials (pagination: --page-size)
+
+Secrets: pass paths only (e.g. --file ./path/to/.env). Never put secret values on the command line.
 `;
 
 const DEPLOYMENT_HELP_AFTER = `
@@ -42,10 +44,11 @@ function setupCredentialEnvAndPush(credential) {
     });
   credential
     .command('push <systemKey>')
-    .description('Push KV_* secrets from .env to Dataplane')
-    .action(async(systemKey, _options) => {
+    .description('Push KV_* secrets from an env file to Dataplane (file path only — no secret values on argv)')
+    .option('--file <path>', 'Env file with KV_* values (must exist; never put secret values on argv)')
+    .action(async(systemKey, options) => {
       try {
-        await runCredentialPush(systemKey);
+        await runCredentialPush(systemKey, { file: options.file });
       } catch (error) {
         logger.error(chalk.red(`Error: ${error.message}`));
         handleCommandError(error, 'credential push');
@@ -53,7 +56,6 @@ function setupCredentialEnvAndPush(credential) {
       }
     });
 }
-
 /**
  * Sets up credential and deployment list commands
  * @param {Command} program - Commander program instance

package/lib/cli/setup-infra.js

@@ -31,6 +31,9 @@ const {
   getRestartableInfraServiceNames,
   buildRestartInfraHelpLines
 } = require('../constants/infra-compose-service-names');
+const {
+  resolveTransientDeveloperIdFromOptions
+} = require('../utils/transient-developer-id');
 
 const {
   computeEffectiveInfraOptionalFlags,
@@ -97,6 +100,18 @@ async function applyDeveloperIdFromUpInfra(options) {
   return id;
 }
 
+const DOWN_INFRA_HELP_AFTER = `
+Examples:
+  $ aifabrix down-infra
+  $ aifabrix down-infra --volumes
+  $ aifabrix down-infra --developer-id 02
+  $ aifabrix down-infra -d 02 --volumes
+  $ aifabrix down-infra myapp --developer-id 02
+
+--developer-id / -d target another developer's stack for this command only.
+They do not change developer-id in config.
+`;
+
 /**
  * @param {Object} options
  * @param {Object} cfg - Mutable config from getConfig()
@@ -302,20 +317,32 @@ function setupUpBuilderApiCommand(program) {
 function setupDownInfraCommand(program) {
   program.command('down-infra [service|app]')
     .description('Stop all infra, or stop one app; use -v to remove volumes')
+    .addHelpText('after', DOWN_INFRA_HELP_AFTER)
     .option('-v, --volumes', 'Remove volumes (deletes all data)')
     .option('--verbose', 'Show full orchestration output (default is guided summary)')
+    .option(
+      '-d, --developer <id>',
+      'Target developer ID for this stop only (does not change config)'
+    )
+    .option(
+      '--developer-id <id>',
+      'Same as --developer; target another developer without changing config'
+    )
     .action(async(appName, options) => {
       try {
+        const developerId = resolveTransientDeveloperIdFromOptions(options);
+        const opts = { ...options, developerId };
         if (!options.verbose) {
-          await runGuidedDownInfra(appName, options, infra, appLib);
+          await runGuidedDownInfra(appName, opts, infra, appLib);
           return;
         }
 
         if (typeof appName === 'string' && appName.trim().length > 0) {
-          await appLib.downApp(appName, { volumes: !!options.volumes });
+          await appLib.downApp(appName, { volumes: !!options.volumes, developerId });
+        } else if (options.volumes) {
+          await infra.stopInfraWithVolumes(developerId);
         } else {
-          if (options.volumes) await infra.stopInfraWithVolumes();
-          else await infra.stopInfra();
+          await infra.stopInfra(developerId);
         }
       } catch (error) {
         handleCommandError(error, 'down-infra');

package/lib/cli/setup-utility-validate.js

@@ -228,6 +228,7 @@ function setupValidateDiffCommands(program) {
   setupValidateCommand(program);
   setupValidateJsonCommand(program);
   setupDiffCommand(program);
+  require('../commands/package-score').setupPackageScoreCommand(program);
 }
 
 module.exports = {

package/lib/commands/channel-add-setup.js

@@ -18,26 +18,36 @@ const { addChannelCommand } = require('../channels/add-channel');
 const CHANNEL_ADD_HELP_AFTER = `
 ${formatSupportedChannelTargetsHelp()}
 
+One command covers scaffold → upload → install:
+  $ aifabrix channel add slack --name "Elsa" --probe
+
 Examples:
-  # After upload/deploy of the communication external system
   $ aifabrix channel add slack --name "Elsa"
   $ aifabrix channel add teams-bot --name "Elsa" --description "Enterprise AI assistant for employees"
   $ aifabrix channel add chatgpt --name "Your Assistant"
-  $ aifabrix channel add microsoft-copilot --name "Your Assistant"
+  $ aifabrix channel add microsoft-copilot --name "Your Assistant" \\
+      --oauth-plugin-vault-reference-id "<Teams-Entra-SSO-auth-config-id>"
 
   # Slack slash-command prefix (registers /{prefix}-help in manifest)
   $ aifabrix channel add slack --name "Elsa" --command-prefix af
 
-  # Generate artifacts only; no dataplane patch
+  # Generate artifacts only; no dataplane patch / upload
   $ aifabrix channel add slack --name "Elsa" --dry-run
 
-  # Regenerate artifacts and patch config (does not rotate secrets)
+  # Re-upload communication system + regenerate channel config (does not rotate secrets)
   $ aifabrix channel add slack --name "Elsa" --force
 
   # Validate callbacks and assistant catalog after install
   $ aifabrix channel add slack --name "Elsa" --probe
 
-Prerequisites: aifabrix upload <target> (or deploy) and aifabrix login
+Behavior:
+  - Scaffolds integration/<target>/ when missing (does not overwrite existing files)
+  - Uploads when the system is not on the dataplane; with --force uploads every time
+  - Then configures the channel install (artifacts, credentials, admin guide)
+  - microsoft-copilot uses Entra SSO (trustedIssuer); pass --oauth-plugin-vault-reference-id
+    from Teams Developer Portal. Does not create Fabrix oauth2 channel credentials.
+
+Requires: aifabrix login
 `;
 
 /**
@@ -64,6 +74,7 @@ async function runChannelAddAction(channelTarget, options, meta = {}) {
     icon: options.icon,
     template: options.template,
     commandPrefix: options.commandPrefix,
+    oauthPluginVaultReferenceId: options.oauthPluginVaultReferenceId,
     dryRun: options.dryRun === true,
     force: options.force === true,
     probe: options.probe === true
@@ -77,7 +88,7 @@ async function runChannelAddAction(channelTarget, options, meta = {}) {
  */
 function registerChannelAddCommand(parent, meta = {}) {
   const description =
-    'Configure channel install (manifest, credentials, admin guide) after upload/deploy';
+    'Scaffold (if needed), upload (if needed/--force), then configure channel install';
   const commandName = meta.commandName || 'add <channelTarget>';
   const cmd = meta.hidden
     ? parent.command(commandName, { hidden: true })
@@ -88,12 +99,19 @@ function registerChannelAddCommand(parent, meta = {}) {
     .option('-d, --description <text>', 'Channel description (default generated)')
     .option('--icon <path>', 'Path to channel icon asset')
     .option('--template <name>', 'Template override (default from channel target)')
-    .option('--dry-run', 'Generate artifacts only; do not patch external system or credentials')
-    .option('--force', 'Regenerate artifacts and patch config (does not rotate secrets)')
+    .option('--dry-run', 'Generate artifacts only; do not upload, patch, or set credentials')
+    .option(
+      '--force',
+      'Re-upload communication system and regenerate channel config (does not rotate secrets)'
+    )
     .option(
       '--command-prefix <key>',
       'Slack slash alias prefix (default af) — registers /{prefix}-help etc. in manifest'
     )
+    .option(
+      '--oauth-plugin-vault-reference-id <id>',
+      'Teams Developer Portal Entra SSO OAuth auth-config id (microsoft-copilot)'
+    )
     .option('--probe', 'After install, validate callbacks and assistant catalog')
     .addHelpText('after', CHANNEL_ADD_HELP_AFTER)
     .action(async(channelTarget, options) => {
@@ -101,7 +119,8 @@ function registerChannelAddCommand(parent, meta = {}) {
         await runChannelAddAction(channelTarget, options, meta);
       } catch (error) {
         if (!error.message?.includes('Authentication required')) {
-          logger.error(formatBlockingError('Channel install failed:'), error.message);
+          const detail = error.message || String(error);
+          logger.error(formatBlockingError(`Channel install failed:\n${detail}`));
         }
         process.exit(1);
       }

package/lib/commands/channel.js

@@ -25,15 +25,20 @@ const { registerChannelAddCommand } = require('./channel-add-setup');
 
 const CHANNEL_HELP_AFTER = `
 Subcommands:
-  scaffold <target>   Create integration/<target>/ files locally (step 1)
-  add <target>        Channel install guide + manifest/credential patch (step 3)
+  add <target>        One command: scaffold (if needed) → upload (if needed/--force) → install
+  scaffold <target>   Optional: create integration/<target>/ files only (local)
 
 ${formatSupportedChannelTargetsHelp()}
 
-Typical flow (channels are connected systems, not controller apps):
+Typical flow:
+  aifabrix channel add slack --name "Elsa" --probe
+
+  # Force re-upload of the communication system, then reinstall channel
+  aifabrix channel add slack --name "Elsa" --force --probe
+
+Optional low-level steps (usually unnecessary):
   aifabrix channel scaffold slack
   aifabrix upload slack --force
-  aifabrix channel add slack --name "Elsa" --probe
 
 Controller pipeline apps only: aifabrix app register · aifabrix app list
 
@@ -43,10 +48,10 @@ Requires: aifabrix login (for add)
 const CHANNEL_SCAFFOLD_HELP_AFTER = `
 ${formatSupportedChannelTargetsHelp()}
 
-Typical flow:
-  aifabrix channel scaffold slack
-  aifabrix upload slack --force
+Prefer one command (scaffold + upload + install):
   aifabrix channel add slack --name "Your Assistant" --probe
+
+scaffold alone only writes local files under integration/<target>/.
 `;
 
 /**
@@ -56,7 +61,7 @@ function setupChannelCommands(program) {
   const channel = program
     .command('channel')
     .description(
-      'Assistant channels (Slack, Teams, Copilot, ChatGPT) — scaffold integration and install'
+      'Assistant channels — one-command add (scaffold → upload → install), plus optional scaffold'
     )
     .addHelpText('after', CHANNEL_HELP_AFTER);
 
@@ -86,8 +91,7 @@ function setupChannelCommands(program) {
           logger.log(metadata(file));
         }
         logger.log('');
-        logger.log(chalk.white('Next steps:'));
-        logger.log(chalk.gray(`  aifabrix upload ${channelTarget} --force`));
+        logger.log(chalk.white('Next step (recommended):'));
         logger.log(
           chalk.gray(`  aifabrix channel add ${channelTarget} --name "Your Assistant" --probe`)
         );

package/lib/commands/credential-push.js

@@ -51,8 +51,10 @@ async function buildPayload(systemKey) {
  * Runs credential push: push KV_* from .env to dataplane.
  * @async
  * @param {string} systemKey - External system key
+ * @param {Object} [options]
+ * @param {string} [options.file] - Explicit env file path (required to exist when set)
  * @returns {Promise<{ pushed: number }>} Count of secrets pushed
- * @throws {Error} If auth or push fails
+ * @throws {Error} If auth or push fails, or --file path is missing
  */
 function logPushResult(pushResult) {
   if (pushResult.pushed > 0) {
@@ -66,10 +68,35 @@ function logPushResult(pushResult) {
   if (pushResult.warning) logger.log(chalk.yellow(`Warning: ${pushResult.warning}`));
 }
 
-async function runCredentialPush(systemKey) {
+/**
+ * Resolve env file path for credential push.
+ * @param {string} systemKey
+ * @param {Object} [options]
+ * @returns {string}
+ */
+function resolveCredentialEnvFilePath(systemKey, options = {}) {
+  const fileOpt =
+    options.file !== undefined && options.file !== null ? String(options.file).trim() : '';
+  if (fileOpt) {
+    const resolved = path.resolve(fileOpt);
+    const fsReal = require('../internal/fs-real-sync');
+    let isFile = false;
+    try {
+      isFile = fsReal.existsSync(resolved) && fsReal.statSync(resolved).isFile();
+    } catch (_err) {
+      isFile = false;
+    }
+    if (!isFile) {
+      throw new Error(`Credential env file not found: ${resolved}`);
+    }
+    return resolved;
+  }
+  return path.join(getIntegrationPath(systemKey), '.env');
+}
+
+async function runCredentialPush(systemKey, options = {}) {
   validateSystemKeyFormat(systemKey);
-  const appPath = getIntegrationPath(systemKey);
-  const envFilePath = path.join(appPath, '.env');
+  const envFilePath = resolveCredentialEnvFilePath(systemKey, options);
 
   const { resolveEnvironment } = require('../core/config');
   const environment = await resolveEnvironment();
@@ -99,4 +126,9 @@ async function runCredentialPush(systemKey) {
   return { pushed: pushResult.pushed || 0 };
 }
 
-module.exports = { runCredentialPush, validateSystemKeyFormat, buildPayload };
+module.exports = {
+  runCredentialPush,
+  validateSystemKeyFormat,
+  buildPayload,
+  resolveCredentialEnvFilePath
+};

package/lib/commands/integration-definition.js

@@ -0,0 +1,158 @@
+/**
+ * CLI: integration-definition validate | apply
+ * @fileoverview BT → Builder BID commands (no section PATCH orchestration)
+ */
+
+'use strict';
+
+/* eslint-disable no-console */
+
+const chalk = require('chalk');
+const fs = require('fs');
+const path = require('path');
+const {
+  applyIntegrationDefinition,
+  validateIntegrationDefinition,
+  withDefinitionHash
+} = require('../integration-definition');
+const { handleCommandError } = require('../utils/cli-utils');
+const {
+  formatSuccessLine,
+  formatBlockingError,
+  failureGlyph
+} = require('../utils/cli-layout-chalk');
+
+const PARENT_HELP_AFTER = `
+
+Examples:
+  $ aifabrix integration-definition validate ./bid.json
+  $ aifabrix integration-definition apply ./bid.json --dry-run
+
+BID is the minimal business create language (systemKind, resourceType, propertyKeys).
+Apply materializes integration/<systemKey>/ package files (EDS/system).
+AI catalog: GET /help?topic=resourceTypeCatalog on builder-api.
+`;
+
+const VALIDATE_HELP_AFTER = `
+
+Examples:
+  $ aifabrix integration-definition validate ./bid.json
+  $ aifabrix integration-definition validate ./bid.json --fix-hash
+
+Checks JSON Schema, definitionHash, product rules, and active resourceType catalog keys.
+`;
+
+const APPLY_HELP_AFTER = `
+
+Examples:
+  $ aifabrix integration-definition apply ./bid.json
+  $ aifabrix integration-definition apply ./bid.json --dry-run
+  $ aifabrix integration-definition apply ./bid.json --force
+  $ aifabrix integration-definition apply ./bid.json --output-dir /tmp/out
+`;
+
+/**
+ * @param {string} filePath
+ * @returns {Record<string, unknown>}
+ */
+function loadBidFile(filePath) {
+  const abs = path.resolve(filePath);
+  if (!fs.existsSync(abs)) {
+    throw new Error(`BID file not found: ${abs}`);
+  }
+  return JSON.parse(fs.readFileSync(abs, 'utf8'));
+}
+
+/**
+ * @param {string} file
+ * @param {{ fixHash?: boolean }} options
+ * @returns {Promise<void>}
+ */
+async function runValidateCommand(file, options) {
+  let bid = loadBidFile(file);
+  if (options.fixHash) {
+    bid = withDefinitionHash(bid);
+    fs.writeFileSync(path.resolve(file), `${JSON.stringify(bid, null, 2)}\n`, 'utf8');
+    console.log(formatSuccessLine(`Wrote definitionHash to ${file}`));
+  }
+  const result = validateIntegrationDefinition(bid);
+  if (!result.valid) {
+    console.error(formatBlockingError('BID invalid'));
+    for (const err of result.errors) {
+      console.error(chalk.red(`  ${failureGlyph()} ${err}`));
+    }
+    process.exit(1);
+  }
+  console.log(formatSuccessLine('BID valid'));
+  console.log(`  definitionId: ${result.bid.definitionId}`);
+  console.log(`  definitionHash: ${result.bid.definitionHash}`);
+}
+
+/**
+ * @param {string} file
+ * @param {{ outputDir?: string, dryRun?: boolean, force?: boolean }} options
+ * @returns {Promise<void>}
+ */
+async function runApplyCommand(file, options) {
+  const bid = loadBidFile(file);
+  const out = await applyIntegrationDefinition(bid, {
+    outputDir: options.outputDir,
+    dryRun: Boolean(options.dryRun),
+    force: Boolean(options.force)
+  });
+  console.log(formatSuccessLine(`BID apply ${out.status}`));
+  console.log(`  systemKey: ${out.systemKey}`);
+  console.log(`  outputDir: ${out.outputDir}`);
+  console.log(`  definitionHash: ${out.definitionHash}`);
+  if (out.files) {
+    console.log(`  files: ${out.files.join(', ')}`);
+  }
+}
+
+/**
+ * @param {import('commander').Command} program
+ */
+function setupIntegrationDefinitionCommands(program) {
+  const cmd = program
+    .command('integration-definition')
+    .description(
+      'Validate or apply a Builder Integration Definition (BID) — minimal business create language for integration packages'
+    )
+    .addHelpText('after', PARENT_HELP_AFTER);
+
+  cmd
+    .command('validate <file>')
+    .description(
+      'Validate BID JSON (schema, definitionHash, product rules, resourceType catalog)'
+    )
+    .option('--fix-hash', 'Rewrite file with computed definitionHash')
+    .addHelpText('after', VALIDATE_HELP_AFTER)
+    .action(async(file, options) => {
+      try {
+        await runValidateCommand(file, options);
+      } catch (error) {
+        handleCommandError(error, 'integration-definition validate');
+      }
+    });
+
+  cmd
+    .command('apply <file>')
+    .description(
+      'Idempotently apply BID to integration/<systemKey>/ (Builder-owned EDS/system writes)'
+    )
+    .option('--output-dir <dir>', 'Override output directory')
+    .option('--force', 'Rewrite package even when definitionHash matches stamp')
+    .option('--dry-run', 'Show planned files without writing')
+    .addHelpText('after', APPLY_HELP_AFTER)
+    .action(async(file, options) => {
+      try {
+        await runApplyCommand(file, options);
+      } catch (error) {
+        handleCommandError(error, 'integration-definition apply');
+      }
+    });
+}
+
+module.exports = {
+  setupIntegrationDefinitionCommands
+};

package/lib/commands/package-score.js

@@ -0,0 +1,72 @@
+/**
+ * CLI: score candidate integration package vs a reference package directory.
+ *
+ * @fileoverview package-score command — score-only parity; reference is never generation input
+ */
+
+'use strict';
+
+const path = require('path');
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { scorePackageParity } = require('../lab/package-parity-score');
+
+/**
+ * @param {Object} options
+ * @param {string} options.reference
+ * @param {string} options.candidate
+ * @param {boolean} [options.json]
+ * @returns {Promise<number>} process exit code
+ */
+async function runPackageScoreCommand(options = {}) {
+  const reference = String(options.reference || '').trim();
+  const candidate = String(options.candidate || '').trim();
+  if (!reference || !candidate) {
+    throw new Error('Both --reference <dir> and --candidate <dir> are required.');
+  }
+  const report = scorePackageParity(path.resolve(reference), path.resolve(candidate));
+  if (options.json === true) {
+    logger.log(JSON.stringify(report, null, 2));
+  } else {
+    logger.log(chalk.bold(`Package parity score: ${report.score}/${report.maxScore}`));
+    logger.log(chalk.gray(report.summary));
+    logger.log(chalk.gray(`Reference (score-only): ${report.referenceDir}`));
+    logger.log(chalk.gray(`Candidate: ${report.candidateDir}`));
+    for (const row of report.facets) {
+      const mark = row.ok ? chalk.green('✔') : chalk.red('✖');
+      logger.log(`  ${mark} ${row.id}: ${row.detail}`);
+    }
+    if (report.goldIsScoreOnly) {
+      logger.log(chalk.yellow('Note: reference package is for scoring only — never use it as generation input.'));
+    }
+  }
+  return report.identical ? 0 : 1;
+}
+
+/**
+ * @param {import('commander').Command} program
+ */
+function setupPackageScoreCommand(program) {
+  program
+    .command('package-score')
+    .description(
+      'Score a candidate integration package directory against a reference package (score-only; not generation)'
+    )
+    .option('--reference <dir>', 'Reference integration package directory (score baseline only)')
+    .option('--candidate <dir>', 'Candidate integration package directory')
+    .option('--json', 'Emit structured JSON report', false)
+    .action(async(options) => {
+      try {
+        const code = await runPackageScoreCommand(options);
+        process.exitCode = code;
+      } catch (error) {
+        logger.error(chalk.red(`Error: ${error.message}`));
+        process.exitCode = 1;
+      }
+    });
+}
+
+module.exports = {
+  setupPackageScoreCommand,
+  runPackageScoreCommand
+};

package/lib/commands/repair-auth-apply.js

@@ -28,6 +28,7 @@ const ALLOWED_REPAIR_AUTH = [
   'oidc',
   'hmac',
   'none',
+  'system',
   'bearerforward'
 ];
 
@@ -57,8 +58,12 @@ function isAllowedRepairAuth(authOption) {
  */
 function buildAuthenticationForRepair(systemKey, authOption) {
   const normalized = normalizeRepairAuthOption(authOption);
+  if (normalized === 'system') {
+    return buildSystemAuthentication();
+  }
   if (normalized === 'bearerforward') {
-    return buildBearerForwardAuthentication();
+    // Legacy alias: prefer authType system for platform facades.
+    return buildSystemAuthentication();
   }
   const schemaMethod =
     normalized === 'queryparam'
@@ -70,11 +75,19 @@ function buildAuthenticationForRepair(systemKey, authOption) {
 }
 
 /**
- * Facade APIs that forward the caller Bearer token — no workspace kv secret.
- * @returns {{ authType: 'none' }}
+ * Platform-managed downstream authentication (no workspace kv secret).
+ * @returns {{ authType: 'system' }}
+ */
+function buildSystemAuthentication() {
+  return { authType: 'system' };
+}
+
+/**
+ * @deprecated Use buildSystemAuthentication — bearerForward is not a public authType.
+ * @returns {{ authType: 'system' }}
  */
 function buildBearerForwardAuthentication() {
-  return { authType: 'none' };
+  return buildSystemAuthentication();
 }
 
 /**
@@ -99,7 +112,7 @@ function mergePreservedAuthVariables(mergedVariables, existingVars) {
 function repairAuthChangeLabel(authOption) {
   const normalized = normalizeRepairAuthOption(authOption);
   if (normalized === 'bearertoken' || normalized === 'bearerkey') return 'bearerToken';
-  if (normalized === 'bearerforward') return 'bearerForward';
+  if (normalized === 'bearerforward') return 'system';
   return normalized;
 }
 
@@ -157,6 +170,7 @@ module.exports = {
   normalizeRepairAuthOption,
   isAllowedRepairAuth,
   buildAuthenticationForRepair,
+  buildSystemAuthentication,
   buildBearerForwardAuthentication,
   mergePreservedAuthVariables,
   repairAuthChangeLabel,

package/lib/commands/repair-datasource-sync-operations.js

@@ -108,7 +108,10 @@ function ensureSyncOperationScaffold(parsed) {
     parsed.execution = { engine: 'cip' };
   }
   if (!parsed.execution.cip || typeof parsed.execution.cip !== 'object') {
-    parsed.execution.cip = { operations: {} };
+    parsed.execution.cip = { version: '1.0', operations: {} };
+  }
+  if (!parsed.execution.cip.version) {
+    parsed.execution.cip.version = '1.0';
   }
   if (!parsed.execution.cip.operations || typeof parsed.execution.cip.operations !== 'object') {
     parsed.execution.cip.operations = {};