@aifabrix/builder 2.3.0 → 2.3.2

package/lib/app-run.js

@@ -9,390 +9,13 @@
  * @version 2.0.0
  */
 
-const fs = require('fs').promises;
-const fsSync = require('fs');
-const path = require('path');
 const chalk = require('chalk');
-const yaml = require('js-yaml');
-const { exec } = require('child_process');
-const { promisify } = require('util');
-const validator = require('./validator');
-const infra = require('./infra');
-const secrets = require('./secrets');
 const config = require('./config');
-const buildCopy = require('./utils/build-copy');
 const logger = require('./utils/logger');
-const { waitForHealthCheck, checkPortAvailable } = require('./utils/health-check');
+const { checkPortAvailable, waitForHealthCheck } = require('./utils/health-check');
 const composeGenerator = require('./utils/compose-generator');
-
-const execAsync = promisify(exec);
-
-/**
- * Checks if Docker image exists for the application
- * @param {string} imageName - Image name (can include repository prefix)
- * @param {string} tag - Image tag (default: latest)
- * @param {boolean} [debug=false] - Enable debug logging
- * @returns {Promise<boolean>} True if image exists
- */
-async function checkImageExists(imageName, tag = 'latest', debug = false) {
-  try {
-    const fullImageName = `${imageName}:${tag}`;
-    const cmd = `docker images --format "{{.Repository}}:{{.Tag}}" --filter "reference=${fullImageName}"`;
-    if (debug) {
-      logger.log(chalk.gray(`[DEBUG] Executing: ${cmd}`));
-    }
-    // Use Docker's native filtering for cross-platform compatibility (Windows-safe)
-    const { stdout } = await execAsync(cmd);
-    const lines = stdout.trim().split('\n').filter(line => line.trim() !== '');
-    const exists = lines.some(line => line.trim() === fullImageName);
-    if (debug) {
-      logger.log(chalk.gray(`[DEBUG] Image ${fullImageName} exists: ${exists}`));
-    }
-    return exists;
-  } catch (error) {
-    if (debug) {
-      logger.log(chalk.gray(`[DEBUG] Image check failed: ${error.message}`));
-    }
-    return false;
-  }
-}
-
-/**
- * Checks if container is already running
- * @param {string} appName - Application name
- * @param {number} developerId - Developer ID (0 = default infra, > 0 = developer-specific)
- * @param {boolean} [debug=false] - Enable debug logging
- * @returns {Promise<boolean>} True if container is running
- */
-async function checkContainerRunning(appName, developerId, debug = false) {
-  try {
-    // Dev 0: aifabrix-{appName} (no dev-0 suffix), Dev > 0: aifabrix-dev{id}-{appName}
-    const containerName = developerId === 0 ? `aifabrix-${appName}` : `aifabrix-dev${developerId}-${appName}`;
-    const cmd = `docker ps --filter "name=${containerName}" --format "{{.Names}}"`;
-    if (debug) {
-      logger.log(chalk.gray(`[DEBUG] Executing: ${cmd}`));
-    }
-    const { stdout } = await execAsync(cmd);
-    const isRunning = stdout.trim() === containerName;
-    if (debug) {
-      logger.log(chalk.gray(`[DEBUG] Container ${containerName} running: ${isRunning}`));
-      if (isRunning) {
-        // Get container status details
-        const statusCmd = `docker ps --filter "name=${containerName}" --format "{{.Status}}"`;
-        const { stdout: status } = await execAsync(statusCmd);
-        const portsCmd = `docker ps --filter "name=${containerName}" --format "{{.Ports}}"`;
-        const { stdout: ports } = await execAsync(portsCmd);
-        logger.log(chalk.gray(`[DEBUG] Container status: ${status.trim()}`));
-        logger.log(chalk.gray(`[DEBUG] Container ports: ${ports.trim()}`));
-      }
-    }
-    return isRunning;
-  } catch (error) {
-    if (debug) {
-      logger.log(chalk.gray(`[DEBUG] Container check failed: ${error.message}`));
-    }
-    return false;
-  }
-}
-
-/**
- * Stops and removes existing container
- * @param {string} appName - Application name
- * @param {number} developerId - Developer ID (0 = default infra, > 0 = developer-specific)
- * @param {boolean} [debug=false] - Enable debug logging
- */
-async function stopAndRemoveContainer(appName, developerId, debug = false) {
-  try {
-    // Dev 0: aifabrix-{appName} (no dev-0 suffix), Dev > 0: aifabrix-dev{id}-{appName}
-    const containerName = developerId === 0 ? `aifabrix-${appName}` : `aifabrix-dev${developerId}-${appName}`;
-    logger.log(chalk.yellow(`Stopping existing container ${containerName}...`));
-    const stopCmd = `docker stop ${containerName}`;
-    if (debug) {
-      logger.log(chalk.gray(`[DEBUG] Executing: ${stopCmd}`));
-    }
-    await execAsync(stopCmd);
-    const rmCmd = `docker rm ${containerName}`;
-    if (debug) {
-      logger.log(chalk.gray(`[DEBUG] Executing: ${rmCmd}`));
-    }
-    await execAsync(rmCmd);
-    logger.log(chalk.green(`✓ Container ${containerName} stopped and removed`));
-  } catch (error) {
-    if (debug) {
-      logger.log(chalk.gray(`[DEBUG] Stop/remove container error: ${error.message}`));
-    }
-    // Container might not exist, which is fine
-    // Dev 0: aifabrix-{appName} (no dev-0 suffix), Dev > 0: aifabrix-dev{id}-{appName}
-    const containerName = developerId === 0 ? `aifabrix-${appName}` : `aifabrix-dev${developerId}-${appName}`;
-    logger.log(chalk.gray(`Container ${containerName} was not running`));
-  }
-}
-
-/**
- * Validates app name and loads configuration
- * @async
- * @param {string} appName - Application name
- * @returns {Promise<Object>} Application configuration
- * @throws {Error} If validation fails
- */
-async function validateAppConfiguration(appName) {
-  // Validate app name
-  if (!appName || typeof appName !== 'string') {
-    throw new Error('Application name is required');
-  }
-
-  // Check if we're running from inside the builder directory
-  const currentDir = process.cwd();
-  const normalizedPath = currentDir.replace(/\\/g, '/');
-  const expectedBuilderPath = `builder/${appName}`;
-
-  // If inside builder/{appName}, suggest moving to project root
-  if (normalizedPath.endsWith(expectedBuilderPath)) {
-    const projectRoot = path.resolve(currentDir, '../..');
-    throw new Error(
-      'You\'re running from inside the builder directory.\n' +
-      `Current directory: ${currentDir}\n` +
-      'Please change to the project root and try again:\n' +
-      `  cd ${projectRoot}\n` +
-      `  aifabrix run ${appName}`
-    );
-  }
-
-  // Load and validate app configuration
-  const configPath = path.join(process.cwd(), 'builder', appName, 'variables.yaml');
-  if (!fsSync.existsSync(configPath)) {
-    const expectedDir = path.join(currentDir, 'builder', appName);
-    throw new Error(
-      `Application configuration not found: ${configPath}\n` +
-      `Current directory: ${currentDir}\n` +
-      `Expected location: ${expectedDir}\n` +
-      'Make sure you\'re running from the project root (where \'builder\' directory exists)\n' +
-      `Run 'aifabrix create ${appName}' first if configuration doesn't exist`
-    );
-  }
-
-  const configContent = fsSync.readFileSync(configPath, 'utf8');
-  const config = yaml.load(configContent);
-
-  // Validate configuration
-  const validation = await validator.validateApplication(appName);
-  if (!validation.valid) {
-    const allErrors = [];
-
-    if (validation.variables && validation.variables.errors && validation.variables.errors.length > 0) {
-      allErrors.push('variables.yaml:');
-      allErrors.push(...validation.variables.errors.map(err => `  ${err}`));
-    }
-
-    if (validation.rbac && validation.rbac.errors && validation.rbac.errors.length > 0) {
-      allErrors.push('rbac.yaml:');
-      allErrors.push(...validation.rbac.errors.map(err => `  ${err}`));
-    }
-
-    if (validation.env && validation.env.errors && validation.env.errors.length > 0) {
-      allErrors.push('env.template:');
-      allErrors.push(...validation.env.errors.map(err => `  ${err}`));
-    }
-
-    if (allErrors.length === 0) {
-      throw new Error('Configuration validation failed');
-    }
-
-    throw new Error(`Configuration validation failed:\n${allErrors.join('\n')}`);
-  }
-
-  return config;
-}
-
-/**
- * Checks prerequisites: Docker image and infrastructure
- * @async
- * @param {string} appName - Application name
- * @param {Object} config - Application configuration
- * @param {boolean} [debug=false] - Enable debug logging
- * @throws {Error} If prerequisites are not met
- */
-async function checkPrerequisites(appName, config, debug = false) {
-  // Extract image name from configuration (same logic as build process)
-  const imageName = composeGenerator.getImageName(config, appName);
-  const imageTag = config.image?.tag || 'latest';
-  const fullImageName = `${imageName}:${imageTag}`;
-
-  if (debug) {
-    logger.log(chalk.gray(`[DEBUG] Image name: ${imageName}, tag: ${imageTag}`));
-  }
-
-  // Check if Docker image exists
-  logger.log(chalk.blue(`Checking if image ${fullImageName} exists...`));
-  const imageExists = await checkImageExists(imageName, imageTag, debug);
-  if (!imageExists) {
-    throw new Error(`Docker image ${fullImageName} not found\nRun 'aifabrix build ${appName}' first`);
-  }
-  logger.log(chalk.green(`✓ Image ${fullImageName} found`));
-
-  // Check infrastructure health
-  logger.log(chalk.blue('Checking infrastructure health...'));
-  const infraHealth = await infra.checkInfraHealth();
-  if (debug) {
-    logger.log(chalk.gray(`[DEBUG] Infrastructure health: ${JSON.stringify(infraHealth, null, 2)}`));
-  }
-  const unhealthyServices = Object.entries(infraHealth)
-    .filter(([_, status]) => status !== 'healthy')
-    .map(([service, _]) => service);
-
-  if (unhealthyServices.length > 0) {
-    throw new Error(`Infrastructure services not healthy: ${unhealthyServices.join(', ')}\nRun 'aifabrix up' first`);
-  }
-  logger.log(chalk.green('✓ Infrastructure is running'));
-}
-/**
- * Prepares environment: ensures .env file and generates Docker Compose
- * @async
- * @param {string} appName - Application name
- * @param {Object} appConfig - Application configuration
- * @param {Object} options - Run options
- * @returns {Promise<string>} Path to generated compose file
- */
-async function prepareEnvironment(appName, appConfig, options) {
-  // Get developer ID and dev-specific directory
-  const developerId = await config.getDeveloperId();
-  const devDir = buildCopy.getDevDirectory(appName, developerId);
-
-  // Ensure dev directory exists (should exist from build, but check anyway)
-  if (!fsSync.existsSync(devDir)) {
-    await buildCopy.copyBuilderToDevDirectory(appName, developerId);
-  }
-
-  // Ensure .env file exists with 'docker' environment context (for running in Docker)
-  // Generate in builder directory first, then copy to dev directory
-  const builderEnvPath = path.join(process.cwd(), 'builder', appName, '.env');
-  if (!fsSync.existsSync(builderEnvPath)) {
-    logger.log(chalk.yellow('Generating .env file from template...'));
-    await secrets.generateEnvFile(appName, null, 'docker');
-  } else {
-    // Re-generate with 'docker' context to ensure correct hostnames for Docker
-    logger.log(chalk.blue('Updating .env file for Docker environment...'));
-    await secrets.generateEnvFile(appName, null, 'docker');
-  }
-
-  // Copy .env to dev directory
-  const devEnvPath = path.join(devDir, '.env');
-  if (fsSync.existsSync(builderEnvPath)) {
-    await fs.copyFile(builderEnvPath, devEnvPath);
-  }
-
-  // Also ensure .env file in apps/ directory is updated (for Docker build context)
-  const variablesPath = path.join(devDir, 'variables.yaml');
-  if (fsSync.existsSync(variablesPath)) {
-    const variablesContent = fsSync.readFileSync(variablesPath, 'utf8');
-    const variables = yaml.load(variablesContent);
-
-    if (variables?.build?.envOutputPath && variables.build.envOutputPath !== null) {
-      // The generateEnvFile already copies to apps/, but ensure it's using docker context
-      logger.log(chalk.blue('Ensuring .env file in apps/ directory is updated for Docker...'));
-      await secrets.generateEnvFile(appName, null, 'docker');
-      // Copy .env to dev directory again after regeneration
-      if (fsSync.existsSync(builderEnvPath)) {
-        await fs.copyFile(builderEnvPath, devEnvPath);
-      }
-    }
-  }
-
-  // Generate Docker Compose configuration
-  logger.log(chalk.blue('Generating Docker Compose configuration...'));
-  const composeOptions = { ...options };
-  if (!composeOptions.port) {
-    const basePort = appConfig.port || 3000;
-    composeOptions.port = developerId === 0 ? basePort : basePort + (developerId * 100);
-  }
-  const composeContent = await composeGenerator.generateDockerCompose(appName, appConfig, composeOptions);
-
-  // Write compose file to dev-specific directory (devDir already defined above)
-  // Ensure dev directory exists (should exist from build, but check anyway)
-  if (!fsSync.existsSync(devDir)) {
-    await buildCopy.copyBuilderToDevDirectory(appName, developerId);
-  }
-  const tempComposePath = path.join(devDir, 'docker-compose.yaml');
-  await fs.writeFile(tempComposePath, composeContent);
-
-  return tempComposePath;
-}
-
-/**
- * Starts the container and waits for health check
- * @async
- * @param {string} appName - Application name
- * @param {string} composePath - Path to Docker Compose file
- * @param {number} port - Application port
- * @param {Object} config - Application configuration
- * @param {boolean} [debug=false] - Enable debug logging
- * @throws {Error} If container fails to start or become healthy
- */
-async function startContainer(appName, composePath, port, config = null, debug = false) {
-  logger.log(chalk.blue(`Starting ${appName}...`));
-
-  // Ensure ADMIN_SECRETS_PATH is set for db-init service
-  const adminSecretsPath = await infra.ensureAdminSecrets();
-  if (debug) {
-    logger.log(chalk.gray(`[DEBUG] Admin secrets path: ${adminSecretsPath}`));
-  }
-
-  // Load POSTGRES_PASSWORD from admin-secrets.env
-  const adminSecretsContent = fsSync.readFileSync(adminSecretsPath, 'utf8');
-  const postgresPasswordMatch = adminSecretsContent.match(/^POSTGRES_PASSWORD=(.+)$/m);
-  const postgresPassword = postgresPasswordMatch ? postgresPasswordMatch[1] : '';
-
-  // Set environment variables for docker-compose
-  const env = {
-    ...process.env,
-    ADMIN_SECRETS_PATH: adminSecretsPath,
-    POSTGRES_PASSWORD: postgresPassword
-  };
-
-  if (debug) {
-    logger.log(chalk.gray(`[DEBUG] Environment variables: ADMIN_SECRETS_PATH=${adminSecretsPath}, POSTGRES_PASSWORD=${postgresPassword ? '***' : '(not set)'}`));
-  }
-
-  const composeCmd = `docker-compose -f "${composePath}" up -d`;
-  if (debug) {
-    logger.log(chalk.gray(`[DEBUG] Executing: ${composeCmd}`));
-    logger.log(chalk.gray(`[DEBUG] Compose file: ${composePath}`));
-  }
-  await execAsync(composeCmd, { env });
-  // Dev 0: aifabrix-{appName} (no dev-0 suffix), Dev > 0: aifabrix-dev{id}-{appName}
-  const containerName = config.developerId === 0 ? `aifabrix-${appName}` : `aifabrix-dev${config.developerId}-${appName}`;
-  logger.log(chalk.green(`✓ Container ${containerName} started`));
-  if (debug) {
-    // Get container status after start
-    const statusCmd = `docker ps --filter "name=${containerName}" --format "{{.Status}}"`;
-    const { stdout: status } = await execAsync(statusCmd);
-    const portsCmd = `docker ps --filter "name=${containerName}" --format "{{.Ports}}"`;
-    const { stdout: ports } = await execAsync(portsCmd);
-    logger.log(chalk.gray(`[DEBUG] Container status: ${status.trim()}`));
-    logger.log(chalk.gray(`[DEBUG] Container ports: ${ports.trim()}`));
-  }
-
-  // Wait for health check using host port (CLI --port or dev-specific port, NOT localPort)
-  const healthCheckPath = config?.healthCheck?.path || '/health';
-  logger.log(chalk.blue(`Waiting for application to be healthy at http://localhost:${port}${healthCheckPath}...`));
-  await waitForHealthCheck(appName, 90, port, config, debug);
-}
-/**
- * Displays run status after successful start
- * @param {string} appName - Application name
- * @param {number} port - Application port
- * @param {Object} config - Application configuration (with developerId property)
- */
-async function displayRunStatus(appName, port, config) {
-  // Dev 0: aifabrix-{appName} (no dev-0 suffix), Dev > 0: aifabrix-dev{id}-{appName}
-  const containerName = config.developerId === 0 ? `aifabrix-${appName}` : `aifabrix-dev${config.developerId}-${appName}`;
-  const healthCheckPath = config?.healthCheck?.path || '/health';
-  const healthCheckUrl = `http://localhost:${port}${healthCheckPath}`;
-
-  logger.log(chalk.green(`\n✓ App running at http://localhost:${port}`));
-  logger.log(chalk.blue(`Health check: ${healthCheckUrl}`));
-  logger.log(chalk.gray(`Container: ${containerName}`));
-}
+// Helper functions extracted to reduce file size and complexity
+const helpers = require('./app-run-helpers');
 
 /**
  * Runs the application locally using Docker
@@ -421,7 +44,7 @@ async function runApp(appName, options = {}) {
 
   try {
     // Validate app name and load configuration
-    const appConfig = await validateAppConfiguration(appName);
+    const appConfig = await helpers.validateAppConfiguration(appName);
 
     // Load developer ID once from config module - it's now cached and available as config.developerId
     // Developer ID: 0 = default infra, > 0 = developer-specific
@@ -433,21 +56,23 @@ async function runApp(appName, options = {}) {
     }
 
     // Check prerequisites: image and infrastructure
-    await checkPrerequisites(appName, appConfig, debug);
+    await helpers.checkPrerequisites(appName, appConfig, debug);
 
     // Check if container is already running
-    const containerRunning = await checkContainerRunning(appName, appConfig.developerId, debug);
+    const containerRunning = await helpers.checkContainerRunning(appName, appConfig.developerId, debug);
     if (containerRunning) {
       // Dev 0: aifabrix-{appName} (no dev-0 suffix), Dev > 0: aifabrix-dev{id}-{appName}
-      const containerName = appConfig.developerId === 0 ? `aifabrix-${appName}` : `aifabrix-dev${appConfig.developerId}-${appName}`;
+      const idNum2 = typeof appConfig.developerId === 'string' ? parseInt(appConfig.developerId, 10) : appConfig.developerId;
+      const containerName = idNum2 === 0 ? `aifabrix-${appName}` : `aifabrix-dev${appConfig.developerId}-${appName}`;
       logger.log(chalk.yellow(`Container ${containerName} is already running`));
-      await stopAndRemoveContainer(appName, appConfig.developerId, debug);
+      await helpers.stopAndRemoveContainer(appName, appConfig.developerId, debug);
     }
 
     // Calculate host port: use dev-specific port offset if not overridden
     // IMPORTANT: Container port (for Dockerfile) stays unchanged from appConfig.port
     const basePort = appConfig.port || 3000;
-    const hostPort = options.port || (appConfig.developerId === 0 ? basePort : basePort + (appConfig.developerId * 100));
+    const idNum3 = typeof appConfig.developerId === 'string' ? parseInt(appConfig.developerId, 10) : appConfig.developerId;
+    const hostPort = options.port || (idNum3 === 0 ? basePort : basePort + (idNum3 * 100));
     if (debug) {
       logger.log(chalk.gray(`[DEBUG] Host port: ${hostPort} (${options.port ? 'CLI override' : 'dev-specific'}), Container port: ${appConfig.build?.containerPort || appConfig.port || 3000} (unchanged)`));
     }
@@ -460,17 +85,17 @@ async function runApp(appName, options = {}) {
     }
 
     // Prepare environment: ensure .env file and generate Docker Compose
-    const tempComposePath = await prepareEnvironment(appName, appConfig, options);
+    const tempComposePath = await helpers.prepareEnvironment(appName, appConfig, options);
     if (debug) {
       logger.log(chalk.gray(`[DEBUG] Compose file generated: ${tempComposePath}`));
     }
 
     try {
       // Start container and wait for health check
-      await startContainer(appName, tempComposePath, hostPort, appConfig, debug);
+      await helpers.startContainer(appName, tempComposePath, hostPort, appConfig, debug);
 
       // Display success message
-      await displayRunStatus(appName, hostPort, appConfig);
+      await helpers.displayRunStatus(appName, hostPort, appConfig);
 
     } catch (error) {
       // Keep the compose file for debugging - don't delete on error
@@ -491,9 +116,9 @@ async function runApp(appName, options = {}) {
 }
 module.exports = {
   runApp,
-  checkImageExists,
-  checkContainerRunning,
-  stopAndRemoveContainer,
+  checkImageExists: helpers.checkImageExists,
+  checkContainerRunning: helpers.checkContainerRunning,
+  stopAndRemoveContainer: helpers.stopAndRemoveContainer,
   checkPortAvailable,
   generateDockerCompose: composeGenerator.generateDockerCompose,
   waitForHealthCheck

package/lib/build.js

@@ -350,7 +350,8 @@ async function buildApp(appName, options = {}) {
 
     // 2. Get developer ID and copy files to dev-specific directory
     const developerId = await config.getDeveloperId();
-    const directoryName = developerId === 0 ? 'applications' : `dev-${developerId}`;
+    const idNum = typeof developerId === 'string' ? parseInt(developerId, 10) : developerId;
+    const directoryName = idNum === 0 ? 'applications' : `dev-${developerId}`;
     logger.log(chalk.blue(`Copying files to developer-specific directory (${directoryName})...`));
     const devDir = await buildCopy.copyBuilderToDevDirectory(appName, developerId);
     logger.log(chalk.green(`✓ Files copied to: ${devDir}`));

package/lib/cli.js

@@ -336,18 +336,19 @@ function setupCommands(program) {
         // Commander.js converts --set-id to setId in options object
         const setIdValue = options.setId || options['set-id'];
         if (setIdValue) {
-          const id = parseInt(setIdValue, 10);
-          if (isNaN(id) || id < 0) {
-            throw new Error('Developer ID must be a non-negative number (0 = default infra, > 0 = developer-specific)');
+          const digitsOnly = /^[0-9]+$/.test(setIdValue);
+          if (!digitsOnly) {
+            throw new Error('Developer ID must be a non-negative digit string (0 = default infra, > 0 = developer-specific)');
           }
-          await config.setDeveloperId(id);
-          process.env.AIFABRIX_DEVELOPERID = id.toString();
-          logger.log(chalk.green(`✓ Developer ID set to ${id}`));
+          // Convert to number for setDeveloperId and getDevPorts (they expect numbers)
+          const devIdNum = parseInt(setIdValue, 10);
+          await config.setDeveloperId(devIdNum);
+          process.env.AIFABRIX_DEVELOPERID = setIdValue;
+          logger.log(chalk.green(`✓ Developer ID set to ${setIdValue}`));
           // Use the ID we just set instead of reading from file to avoid race conditions
-          const devId = id;
-          const ports = devConfig.getDevPorts(devId);
+          const ports = devConfig.getDevPorts(devIdNum);
           logger.log('\n🔧 Developer Configuration\n');
-          logger.log(`Developer ID: ${devId}`);
+          logger.log(`Developer ID: ${setIdValue}`);
           logger.log('\nPorts:');
           logger.log(`  App: ${ports.app}`);
           logger.log(`  Postgres: ${ports.postgres}`);
@@ -359,7 +360,9 @@ function setupCommands(program) {
         }
 
         const devId = await config.getDeveloperId();
-        const ports = devConfig.getDevPorts(devId);
+        // Convert string developer ID to number for getDevPorts
+        const devIdNum = parseInt(devId, 10);
+        const ports = devConfig.getDevPorts(devIdNum);
         logger.log('\n🔧 Developer Configuration\n');
         logger.log(`Developer ID: ${devId}`);
         logger.log('\nPorts:');

package/lib/commands/secure.js

@@ -17,7 +17,8 @@ const inquirer = require('inquirer');
 const chalk = require('chalk');
 const logger = require('../utils/logger');
 const { setSecretsEncryptionKey, getSecretsEncryptionKey } = require('../config');
-const { encryptSecret, isEncrypted, validateEncryptionKey } = require('../utils/secrets-encryption');
+const { validateEncryptionKey } = require('../utils/secrets-encryption');
+const { encryptYamlValues } = require('../utils/yaml-preserve');
 
 /**
  * Finds all secrets.local.yaml files to encrypt
@@ -92,7 +93,8 @@ async function findSecretsFiles() {
 
 /**
  * Encrypts all non-encrypted values in a secrets file
- * Preserves YAML structure and comments
+ * Preserves YAML structure, comments, and formatting
+ * Skips URLs (http:// and https://) as they are not secrets
  *
  * @async
  * @function encryptSecretsFile
@@ -102,45 +104,25 @@ async function findSecretsFiles() {
  */
 async function encryptSecretsFile(filePath, encryptionKey) {
   const content = fs.readFileSync(filePath, 'utf8');
-  const secrets = yaml.load(content);
 
-  if (!secrets || typeof secrets !== 'object') {
-    throw new Error(`Invalid secrets file format: ${filePath}`);
-  }
-
-  let encryptedCount = 0;
-  let totalCount = 0;
-  const updatedSecrets = {};
-
-  for (const [key, value] of Object.entries(secrets)) {
-    totalCount++;
-    if (typeof value === 'string' && value.trim() !== '') {
-      if (isEncrypted(value)) {
-        // Already encrypted, keep as-is
-        updatedSecrets[key] = value;
-      } else {
-        // Encrypt the value
-        updatedSecrets[key] = encryptSecret(value, encryptionKey);
-        encryptedCount++;
-      }
-    } else {
-      // Non-string or empty value, keep as-is
-      updatedSecrets[key] = value;
+  // Validate that file contains valid YAML structure (optional check)
+  try {
+    const secrets = yaml.load(content);
+    if (!secrets || typeof secrets !== 'object') {
+      throw new Error(`Invalid secrets file format: ${filePath}`);
     }
+  } catch (error) {
+    // If YAML parsing fails, still try to encrypt (might have syntax issues but could be fixable)
+    // The line-by-line parser will handle it gracefully
   }
 
-  // Write back to file with same formatting
-  // Use yaml.dump with appropriate options to preserve structure
-  const yamlContent = yaml.dump(updatedSecrets, {
-    indent: 2,
-    lineWidth: -1,
-    noRefs: true,
-    sortKeys: false
-  });
+  // Use line-by-line encryption to preserve comments and formatting
+  const result = encryptYamlValues(content, encryptionKey);
 
-  fs.writeFileSync(filePath, yamlContent, { mode: 0o600 });
+  // Write back to file preserving all formatting
+  fs.writeFileSync(filePath, result.content, { mode: 0o600 });
 
-  return { encrypted: encryptedCount, total: totalCount };
+  return { encrypted: result.encrypted, total: result.total };
 }
 
 /**