---
summary: "Built-in alias registry — `cassava`, `sweetpotato`, `wheat`, and `breedbase` resolve out-of-the-box without env vars; orientation envelope now carries CC-BY attribution metadata."
breaking: false
---

# 0.4.12 — 2026-05-04

`brapi_connect` now ships with a curated registry of public BrAPI v2 endpoints, so agents can call `brapi_connect({ alias: 'cassava' })` (or `sweetpotato`, `wheat`, `breedbase`) on a fresh deployment without any env-var setup. Each builtin was probed against the live upstream surface — anonymous reads return real data and the standard `/studies`, `/germplasm`, `/variables` endpoints respond with non-trivial totals. Two servers that brapi.org/servers still lists as no-auth (`musabase.org`, `solgenomics.net`) actually require login on every endpoint and are intentionally absent.

## Added

- **Built-in known-server registry** at `src/config/builtin-aliases.ts`. Frozen list with attribution metadata (license, citation, homepage, demo flag). Resolves between per-alias env vars and `BRAPI_DEFAULT_*` so operator overrides still win and credentialed connections still work as before.
- **`attribution` block in the orientation envelope** — when a connection comes from a builtin, the envelope returned by `brapi_connect` and `brapi_server_info` includes `{ license, citation, homepage, isDemo? }`. CC-BY attribution propagates to the agent automatically; the formatted text output now renders an `## Attribution` section. Absent for custom env-only or agent-passed connections.
- **`BRAPI_BUILTIN_ALIASES_DISABLED`** opt-out env var. Comma-separated alias names (case-insensitive, whitespace-tolerant) remove specific builtins from resolution and discovery for deployments that prefer a stripped surface.
- **`origin: 'env' | 'builtin'`** field on `DiscoveredAlias`. The connect tool description now splits the two sources into separate sentences so agents can tell which aliases ship out-of-the-box vs which the operator pre-wired.

## Changed

- **`resolveConnectInput` precedence is four layers** (was three): agent input → per-alias env → builtin registry → default env. When the baseUrl comes from a builtin, `BRAPI_DEFAULT_*` credentials are no longer layered on top — those belong to the default server, not whatever upstream the builtin happens to point at. Per-alias credentials still apply.
- **README** documents the new precedence, the four shipped aliases, override behavior (`BRAPI_<ALIAS>_BASE_URL` repoints, `BRAPI_<ALIAS>_USERNAME`+`_PASSWORD` attaches auth), and the opt-out env var.

## Fixed

- **`brapi_find_studies` and `brapi_get_study` tolerate `seasons: [null]`** — the breedbase.org demo deployment serves studies with a literal null inside the seasons array, which previously caused Zod to reject the entire response. Inner element type is now `string \| null`; the format renderers and distribution computation skip null entries. New sparse-payload test case covers the breedbase shape.

## Notes

- Hosted-deployment migration: operators currently setting `BRAPI_CASSAVA_BASE_URL=https://cassavabase.org/brapi/v2` can drop that env var — the builtin covers it. `BRAPI_CASSAVA_USERNAME` / `_PASSWORD` (if set for write access) continue to work unchanged.
- Each Breedbase instance has its own user table — no SSO across `cassavabase.org`, `sweetpotatobase.org`, `wheat.triticeaetoolbox.org`. Write access still requires separate registration on each upstream.