@aifabrix/builder 2.32.3 → 2.33.1

package/lib/app/rotate-secret.js

@@ -9,7 +9,8 @@
  */
 
 const chalk = require('chalk');
-const { getConfig, normalizeControllerUrl } = require('../core/config');
+const { getConfig, normalizeControllerUrl, resolveEnvironment } = require('../core/config');
+const { resolveControllerUrl } = require('../utils/controller-url');
 const { getOrRefreshDeviceToken } = require('../utils/token-manager');
 const { rotateApplicationSecret } = require('../api/applications.api');
 const { formatApiError } = require('../utils/api-error-handler');
@@ -61,6 +62,22 @@ function validateEnvironment(environment) {
   }
 }
 
+/**
+ * Resolve controller URL and environment from config; exit if controller is missing.
+ * @async
+ * @returns {Promise<{controllerUrl: string, environment: string}>}
+ */
+async function resolveControllerAndEnvironment() {
+  const controllerUrl = await resolveControllerUrl();
+  if (!controllerUrl) {
+    logger.error(chalk.red('❌ Controller URL is required. Run "aifabrix login" to set the controller URL in config.yaml'));
+    process.exit(1);
+  }
+  const environment = await resolveEnvironment();
+  validateEnvironment(environment);
+  return { controllerUrl, environment };
+}
+
 /**
  * Validate credentials object structure
  * @param {Object} credentials - Credentials object to validate
@@ -286,46 +303,46 @@ async function saveCredentialsLocally(appKey, credentials, actualControllerUrl)
 }
 
 /**
- * Rotate secret for an application
+ * Call rotate API, validate response, save locally, and display results.
+ * @async
+ * @param {string} appKey - Application key
+ * @param {string} actualControllerUrl - Resolved controller URL
+ * @param {string} environment - Environment ID or key
+ * @param {string} token - Bearer token
+ */
+async function executeRotation(appKey, actualControllerUrl, environment, token) {
+  const authConfig = { type: 'bearer', token };
+  const response = await rotateApplicationSecret(actualControllerUrl, environment, appKey, authConfig);
+
+  if (!response.success) {
+    const formattedError = response.formattedError || formatApiError(response, actualControllerUrl);
+    logger.error(formattedError);
+    logger.error(chalk.gray(`\nController URL: ${actualControllerUrl}`));
+    process.exit(1);
+  }
+
+  const { credentials, message } = validateResponse(response);
+  await saveCredentialsLocally(appKey, credentials, actualControllerUrl);
+  displayRotationResults(appKey, environment, credentials, actualControllerUrl, message);
+}
+
+/**
+ * Rotate secret for an application.
+ * Controller and environment come from config.yaml (set via aifabrix login or aifabrix auth config).
  * @async
  * @param {string} appKey - Application key
- * @param {Object} options - Command options
- * @param {string} options.environment - Environment ID or key
- * @param {string} [options.controller] - Controller URL (optional, uses configured controller if not provided)
+ * @param {Object} [_options] - Command options (reserved)
  * @throws {Error} If rotation fails
  */
-async function rotateSecret(appKey, options) {
+async function rotateSecret(appKey, _options = {}) {
   logger.log(chalk.yellow('⚠️  This will invalidate the old ClientSecret!\n'));
 
+  const { controllerUrl, environment } = await resolveControllerAndEnvironment();
   const config = await getConfig();
-
-  // Get authentication token
-  const controllerUrl = options.controller || null;
   const { token, actualControllerUrl } = await getRotationAuthToken(controllerUrl, config);
 
-  // Validate environment
-  validateEnvironment(options.environment);
-
-  // Use centralized API client
-  const authConfig = { type: 'bearer', token: token };
   try {
-    const response = await rotateApplicationSecret(actualControllerUrl, options.environment, appKey, authConfig);
-
-    if (!response.success) {
-      const formattedError = response.formattedError || formatApiError(response, actualControllerUrl);
-      logger.error(formattedError);
-      logger.error(chalk.gray(`\nController URL: ${actualControllerUrl}`));
-      process.exit(1);
-    }
-
-    // Validate response structure and extract credentials
-    const { credentials, message } = validateResponse(response);
-
-    // Save credentials locally
-    await saveCredentialsLocally(appKey, credentials, actualControllerUrl);
-
-    // Display results
-    displayRotationResults(appKey, options.environment, credentials, actualControllerUrl, message);
+    await executeRotation(appKey, actualControllerUrl, environment, token);
   } catch (error) {
     logger.error(chalk.red(`❌ Failed to rotate secret via controller: ${actualControllerUrl}`));
     logger.error(chalk.gray(`Error: ${error.message}`));

package/lib/cli.js

@@ -18,6 +18,7 @@ const validator = require('./validation/validator');
 const config = require('./core/config');
 const devConfig = require('./utils/dev-config');
 const chalk = require('chalk');
+const path = require('path');
 const logger = require('./utils/logger');
 const { validateCommand, handleCommandError } = require('./utils/cli-utils');
 const { handleLogin } = require('./commands/login');
@@ -25,6 +26,9 @@ const { handleLogout } = require('./commands/logout');
 const { handleAuthStatus } = require('./commands/auth-status');
 const { handleSecure } = require('./commands/secure');
 const { handleSecretsSet } = require('./commands/secrets-set');
+const { handleAuthConfig } = require('./commands/auth-config');
+const { setupAppCommands: setupAppManagementCommands } = require('./commands/app');
+const { setupDatasourceCommands } = require('./commands/datasource');
 
 /**
  * Sets up authentication commands
@@ -33,7 +37,7 @@ const { handleSecretsSet } = require('./commands/secrets-set');
 function setupAuthCommands(program) {
   program.command('login')
     .description('Authenticate with Miso Controller')
-    .option('-c, --controller <url>', 'Controller URL (default: calculated based on developer ID: http://localhost:${3000 + (developerId * 100)})')
+    .option('-c, --controller <url>', 'Controller URL (default: from config or developer ID, e.g. http://localhost:3000)')
     .option('-m, --method <method>', 'Authentication method (device|credentials)', 'device')
     .option('-a, --app <app>', 'Application name (required for credentials method, reads from secrets.local.yaml)')
     .option('--client-id <id>', 'Client ID (for credentials method, overrides secrets.local.yaml)')
@@ -81,16 +85,52 @@ function setupAuthCommands(program) {
   auth
     .command('status')
     .description('Display authentication status for current controller and environment')
-    .option('-c, --controller <url>', 'Check status for specific controller (uses developer ID-based default if not provided)')
-    .option('-e, --environment <env>', 'Check status for specific environment')
     .action(authStatusHandler);
 
-  // Alias: status (register as separate command since Commander.js doesn't support multi-word aliases)
-  program.command('status')
-    .description('Display authentication status (alias for auth status)')
-    .option('-c, --controller <url>', 'Check status for specific controller (uses developer ID-based default if not provided)')
-    .option('-e, --environment <env>', 'Check status for specific environment')
-    .action(authStatusHandler);
+  auth
+    .command('config')
+    .description('Configure authentication settings (controller, environment)')
+    .option('--set-controller <url>', 'Set default controller URL')
+    .option('--set-environment <env>', 'Set default environment')
+    .action(async(options) => {
+      try {
+        await handleAuthConfig(options);
+      } catch (error) {
+        handleCommandError(error, 'auth config');
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * Runs the up command: resolves developer ID, traefik, and starts infra.
+ * @param {Object} options - Commander options (developer, traefik)
+ * @returns {Promise<void>}
+ */
+async function runUpCommand(options) {
+  let developerId = null;
+  if (options.developer) {
+    const id = parseInt(options.developer, 10);
+    if (isNaN(id) || id < 0) {
+      throw new Error('Developer ID must be a non-negative number (0 = default infra, > 0 = developer-specific)');
+    }
+    await config.setDeveloperId(id);
+    process.env.AIFABRIX_DEVELOPERID = id.toString();
+    developerId = id;
+    logger.log(chalk.green(`✓ Developer ID set to ${id}`));
+  }
+  const cfg = await config.getConfig();
+  if (options.traefik === true) {
+    cfg.traefik = true;
+    await config.saveConfig(cfg);
+    logger.log(chalk.green('✓ Traefik enabled and saved to config'));
+  } else if (options.traefik === false) {
+    cfg.traefik = false;
+    await config.saveConfig(cfg);
+    logger.log(chalk.green('✓ Traefik disabled and saved to config'));
+  }
+  const useTraefik = options.traefik === true ? true : (options.traefik === false ? false : !!(cfg.traefik));
+  await infra.startInfra(developerId, { traefik: useTraefik });
 }
 
 /**
@@ -101,20 +141,11 @@ function setupInfraCommands(program) {
   program.command('up')
     .description('Start local infrastructure services (Postgres, Redis, pgAdmin, Redis Commander)')
     .option('-d, --developer <id>', 'Set developer ID and start infrastructure')
+    .option('--traefik', 'Include Traefik reverse proxy and save to config')
+    .option('--no-traefik', 'Exclude Traefik and save to config')
     .action(async(options) => {
       try {
-        let developerId = null;
-        if (options.developer) {
-          const id = parseInt(options.developer, 10);
-          if (isNaN(id) || id < 0) {
-            throw new Error('Developer ID must be a non-negative number (0 = default infra, > 0 = developer-specific)');
-          }
-          await config.setDeveloperId(id);
-          process.env.AIFABRIX_DEVELOPERID = id.toString();
-          developerId = id;
-          logger.log(chalk.green(`✓ Developer ID set to ${id}`));
-        }
-        await infra.startInfra(developerId);
+        await runUpCommand(options);
       } catch (error) {
         handleCommandError(error, 'up');
         process.exit(1);
@@ -232,6 +263,88 @@ function setupInfraCommands(program) {
     });
 }
 
+/**
+ * Normalize options for external system creation
+ * @function normalizeExternalOptions
+ * @param {Object} options - Raw CLI options
+ * @returns {Object} Normalized options
+ */
+function normalizeExternalOptions(options) {
+  const normalized = { ...options };
+  if (options.displayName) normalized.systemDisplayName = options.displayName;
+  if (options.description) normalized.systemDescription = options.description;
+  if (options.systemType) normalized.systemType = options.systemType;
+  if (options.authType) normalized.authType = options.authType;
+  if (options.datasources !== undefined) {
+    const parsedCount = parseInt(options.datasources, 10);
+    if (Number.isNaN(parsedCount) || parsedCount < 1 || parsedCount > 10) {
+      throw new Error('Datasources count must be a number between 1 and 10');
+    }
+    normalized.datasourceCount = parsedCount;
+  }
+  if (options.controller) {
+    normalized.controller = true;
+    normalized.controllerUrl = options.controller;
+  }
+  return normalized;
+}
+
+/**
+ * Validate required options for non-interactive external creation
+ * @function validateNonInteractiveExternalOptions
+ * @param {Object} normalizedOptions - Normalized options
+ * @throws {Error} If required options are missing
+ */
+function validateNonInteractiveExternalOptions(normalizedOptions) {
+  const missing = [];
+  if (!normalizedOptions.systemDisplayName) missing.push('--display-name');
+  if (!normalizedOptions.systemDescription) missing.push('--description');
+  if (!normalizedOptions.systemType) missing.push('--system-type');
+  if (!normalizedOptions.authType) missing.push('--auth-type');
+  if (!normalizedOptions.datasourceCount) missing.push('--datasources');
+  if (missing.length > 0) {
+    throw new Error(`Missing required options for non-interactive external create: ${missing.join(', ')}`);
+  }
+  if (!Object.prototype.hasOwnProperty.call(normalizedOptions, 'github')) {
+    normalizedOptions.github = false;
+  }
+  if (!Object.prototype.hasOwnProperty.call(normalizedOptions, 'controller')) {
+    normalizedOptions.controller = false;
+  }
+}
+
+/**
+ * Handle create command execution
+ * @async
+ * @function handleCreateCommand
+ * @param {string} appName - Application name
+ * @param {Object} options - CLI options
+ */
+async function handleCreateCommand(appName, options) {
+  const validTypes = ['webapp', 'api', 'service', 'functionapp', 'external'];
+  if (options.type && !validTypes.includes(options.type)) {
+    throw new Error(`Invalid type: ${options.type}. Must be one of: ${validTypes.join(', ')}`);
+  }
+
+  const wizardOptions = { app: appName, ...options };
+  const normalizedOptions = normalizeExternalOptions(options);
+
+  const isExternalType = options.type === 'external';
+  const isNonInteractive = process.stdin && process.stdin.isTTY === false;
+
+  if (isExternalType && !options.wizard && isNonInteractive) {
+    validateNonInteractiveExternalOptions(normalizedOptions);
+  }
+
+  const shouldUseWizard = options.wizard && (options.type === 'external' || (!options.type && validTypes.includes('external')));
+  if (shouldUseWizard) {
+    const { handleWizard } = require('./commands/wizard');
+    await handleWizard(wizardOptions);
+  } else {
+    await app.createApp(appName, normalizedOptions);
+  }
+}
+
 /**
  * Sets up application lifecycle commands
  * @param {Command} program - Commander program instance
@@ -252,20 +365,14 @@ function setupAppCommands(program) {
     .option('--github-steps <steps>', 'Extra GitHub workflow steps (comma-separated, e.g., npm,test)')
     .option('--main-branch <branch>', 'Main branch name for workflows', 'main')
     .option('--wizard', 'Use interactive wizard for external system creation')
+    .option('--display-name <name>', 'External system display name')
+    .option('--description <desc>', 'External system description')
+    .option('--system-type <type>', 'External system type (openapi, mcp, custom)')
+    .option('--auth-type <type>', 'External system auth type (oauth2, apikey, basic)')
+    .option('--datasources <count>', 'Number of datasources to create')
     .action(async(appName, options) => {
       try {
-        // Validate type if provided
-        const validTypes = ['webapp', 'api', 'service', 'functionapp', 'external'];
-        if (options.type && !validTypes.includes(options.type)) {
-          throw new Error(`Invalid type: ${options.type}. Must be one of: ${validTypes.join(', ')}`);
-        }
-        // If wizard flag is set and type is external, use wizard instead
-        if (options.wizard && (options.type === 'external' || (!options.type && validTypes.includes('external')))) {
-          const { handleWizard } = require('./commands/wizard');
-          await handleWizard({ app: appName, ...options });
-        } else {
-          await app.createApp(appName, options);
-        }
+        await handleCreateCommand(appName, options);
       } catch (error) {
         handleCommandError(error, 'create');
         process.exit(1);
@@ -273,11 +380,9 @@ function setupAppCommands(program) {
     });
 
   program.command('wizard')
-    .description('Interactive wizard for creating external systems')
+    .description('Interactive wizard for creating external systems (or headless with --config)')
     .option('-a, --app <app>', 'Application name (if not provided, will prompt)')
-    .option('-c, --controller <url>', 'Controller URL')
-    .option('-e, --environment <env>', 'Environment (dev, tst, pro)', 'dev')
-    .option('--dataplane <url>', 'Dataplane URL (overrides controller lookup)')
+    .option('--config <file>', 'Path to wizard.yaml config file for headless mode')
     .action(async(options) => {
       try {
         const { handleWizard } = require('./commands/wizard');
@@ -331,8 +436,6 @@ function setupAppCommands(program) {
 
   program.command('deploy <app>')
     .description('Deploy to Azure via Miso Controller')
-    .option('-c, --controller <url>', 'Controller URL')
-    .option('-e, --environment <env>', 'Environment (miso, dev, tst, pro)', 'dev')
     .option('--client-id <id>', 'Client ID (overrides config)')
     .option('--client-secret <secret>', 'Client Secret (overrides config)')
     .option('--poll', 'Poll for deployment status', true)
@@ -384,7 +487,6 @@ function setupEnvironmentCommands(program) {
   environment
     .command('deploy <env>')
     .description('Deploy/setup environment in Miso Controller')
-    .option('-c, --controller <url>', 'Controller URL (required)')
     .option('--config <file>', 'Environment configuration file')
     .option('--skip-validation', 'Skip environment validation')
     .option('--poll', 'Poll for deployment status', true)
@@ -399,7 +501,6 @@ function setupEnvironmentCommands(program) {
   env
     .command('deploy <env>')
     .description('Deploy/setup environment in Miso Controller')
-    .option('-c, --controller <url>', 'Controller URL (required)')
     .option('--config <file>', 'Environment configuration file')
     .option('--skip-validation', 'Skip environment validation')
     .option('--poll', 'Poll for deployment status', true)
@@ -407,6 +508,52 @@ function setupEnvironmentCommands(program) {
     .action(deployEnvHandler);
 }
 
+/**
+ * Handles split-json command logic
+ * @async
+ * @function handleSplitJsonCommand
+ * @param {string} appName - Application name
+ * @param {Object} options - Command options
+ * @returns {Promise<Object>} Paths to generated files
+ */
+async function handleSplitJsonCommand(appName, options) {
+  const fs = require('fs');
+  const { detectAppType, getDeployJsonPath } = require('./utils/paths');
+  const { appPath, appType } = await detectAppType(appName, options);
+
+  const outputDir = options.output || appPath;
+  if (appType === 'external') {
+    const schemaPath = path.join(appPath, 'application-schema.json');
+    if (!fs.existsSync(schemaPath)) {
+      throw new Error(`application-schema.json not found: ${schemaPath}`);
+    }
+    return generator.splitExternalApplicationSchema(schemaPath, outputDir);
+  }
+
+  const deployJsonPath = getDeployJsonPath(appName, appType, true);
+  if (!fs.existsSync(deployJsonPath)) {
+    throw new Error(`Deployment JSON file not found: ${deployJsonPath}`);
+  }
+
+  return generator.splitDeployJson(deployJsonPath, outputDir);
+}
+
+/**
+ * Logs split-json results
+ * @function logSplitJsonResult
+ * @param {Object} result - Generated file paths
+ * @returns {void}
+ */
+function logSplitJsonResult(result) {
+  logger.log(chalk.green('\n✓ Successfully split deployment JSON into component files:'));
+  logger.log(`  • env.template: ${result.envTemplate}`);
+  logger.log(`  • variables.yaml: ${result.variables}`);
+  if (result.rbac) {
+    logger.log(`  • rbac.yml: ${result.rbac}`);
+  }
+  logger.log(`  • README.md: ${result.readme}`);
+}
+
 /**
  * Sets up utility commands
  * @param {Command} program - Commander program instance
@@ -441,9 +588,10 @@ function setupUtilityCommands(program) {
 
   program.command('json <app>')
     .description('Generate deployment JSON (aifabrix-deploy.json for normal apps, application-schema.json for external systems)')
-    .action(async(appName) => {
+    .option('--type <type>', 'Application type (external) - if set, only checks integration folder')
+    .action(async(appName, options) => {
       try {
-        const result = await generator.generateDeployJsonWithValidation(appName);
+        const result = await generator.generateDeployJsonWithValidation(appName, options);
         if (result.success) {
           const fileName = result.path.includes('application-schema.json') ? 'application-schema.json' : 'deployment JSON';
           logger.log(`✓ Generated ${fileName}: ${result.path}`);
@@ -468,27 +616,11 @@ function setupUtilityCommands(program) {
   program.command('split-json <app>')
     .description('Split deployment JSON into component files (env.template, variables.yaml, rbac.yml, README.md)')
     .option('-o, --output <dir>', 'Output directory for component files (defaults to same directory as JSON)')
+    .option('--type <type>', 'Application type (external) - if set, only checks integration folder')
     .action(async(appName, options) => {
       try {
-        const fs = require('fs');
-        const { detectAppType, getDeployJsonPath } = require('./utils/paths');
-        const { appPath, appType } = await detectAppType(appName);
-        const deployJsonPath = getDeployJsonPath(appName, appType, true);
-
-        if (!fs.existsSync(deployJsonPath)) {
-          throw new Error(`Deployment JSON file not found: ${deployJsonPath}`);
-        }
-
-        const outputDir = options.output || appPath;
-        const result = await generator.splitDeployJson(deployJsonPath, outputDir);
-
-        logger.log(chalk.green('\n✓ Successfully split deployment JSON into component files:'));
-        logger.log(`  • env.template: ${result.envTemplate}`);
-        logger.log(`  • variables.yaml: ${result.variables}`);
-        if (result.rbac) {
-          logger.log(`  • rbac.yml: ${result.rbac}`);
-        }
-        logger.log(`  • README.md: ${result.readme}`);
+        const result = await handleSplitJsonCommand(appName, options);
+        logSplitJsonResult(result);
       } catch (error) {
         handleCommandError(error, 'split-json');
         process.exit(1);
@@ -525,10 +657,11 @@ function setupUtilityCommands(program) {
 
   program.command('validate <appOrFile>')
     .description('Validate application or external integration file')
-    .action(async(appOrFile) => {
+    .option('--type <type>', 'Application type (external) - if set, only checks integration folder')
+    .action(async(appOrFile, options) => {
       try {
         const validate = require('./validation/validate');
-        const result = await validate.validateAppOrFile(appOrFile);
+        const result = await validate.validateAppOrFile(appOrFile, options);
         validate.displayValidationResults(result);
         if (!result.valid) {
           process.exit(1);
@@ -688,8 +821,6 @@ function setupSecretsCommands(program) {
 function setupExternalSystemCommands(program) {
   program.command('download <system-key>')
     .description('Download external system from dataplane to local development structure')
-    .option('-e, --environment <env>', 'Environment (dev, tst, pro)', 'dev')
-    .option('-c, --controller <url>', 'Controller URL')
     .option('--dry-run', 'Show what would be downloaded without actually downloading')
     .action(async(systemKey, options) => {
       try {
@@ -701,6 +832,24 @@ function setupExternalSystemCommands(program) {
       }
     });
 
+  program.command('delete <system-key>')
+    .description('Delete external system from dataplane (also deletes all associated datasources)')
+    .option('--type <type>', 'Application type (external) - required for external systems')
+    .option('--yes', 'Skip confirmation prompt')
+    .option('--force', 'Skip confirmation prompt (alias for --yes)')
+    .action(async(systemKey, options) => {
+      try {
+        if (options.type !== 'external') {
+          throw new Error('Delete command for external systems requires --type external');
+        }
+        const externalDelete = require('./external-system/delete');
+        await externalDelete.deleteExternalSystem(systemKey, options);
+      } catch (error) {
+        handleCommandError(error, 'delete');
+        process.exit(1);
+      }
+    });
+
   program.command('test <app>')
     .description('Run unit tests for external system (local validation, no API calls)')
     .option('-d, --datasource <key>', 'Test specific datasource only')
@@ -723,8 +872,6 @@ function setupExternalSystemCommands(program) {
     .description('Run integration tests via dataplane pipeline API')
     .option('-d, --datasource <key>', 'Test specific datasource only')
     .option('-p, --payload <file>', 'Path to custom test payload file')
-    .option('-e, --environment <env>', 'Environment (dev, tst, pro)', 'dev')
-    .option('-c, --controller <url>', 'Controller URL')
     .option('-v, --verbose', 'Show detailed test output')
     .option('--timeout <ms>', 'Request timeout in milliseconds', '30000')
     .action(async(appName, options) => {
@@ -747,14 +894,16 @@ function setupExternalSystemCommands(program) {
  * @param {Command} program - Commander program instance
  */
 function setupCommands(program) {
-  setupAuthCommands(program);
   setupInfraCommands(program);
+  setupAuthCommands(program);
   setupAppCommands(program);
   setupEnvironmentCommands(program);
+  setupAppManagementCommands(program);
+  setupDatasourceCommands(program);
   setupUtilityCommands(program);
+  setupExternalSystemCommands(program);
   setupDevCommands(program);
   setupSecretsCommands(program);
-  setupExternalSystemCommands(program);
 }
 
 module.exports = {

package/lib/commands/app.js

@@ -24,13 +24,12 @@ function setupAppCommands(program) {
     .command('app')
     .description('Manage applications');
 
-  // Register command
+  // Register command (controller and environment from config.yaml)
   app
     .command('register <appKey>')
     .description('Register application and get pipeline credentials')
-    .requiredOption('-e, --environment <env>', 'Environment ID or key')
-    .option('-c, --controller <url>', 'Controller URL (overrides variables.yaml)')
     .option('-p, --port <port>', 'Application port (default: from variables.yaml)')
+    .option('-u, --url <url>', 'Application URL. If omitted: app.url, deployment.dataplaneUrl or deployment.appUrl in variables.yaml; else http://localhost:{build.localPort or port}')
     .option('-n, --name <name>', 'Override display name')
     .option('-d, --description <desc>', 'Override description')
     .action(async(appKey, options) => {
@@ -42,12 +41,10 @@ function setupAppCommands(program) {
       }
     });
 
-  // List command
+  // List command (controller and environment from config.yaml)
   app
     .command('list')
     .description('List applications')
-    .requiredOption('-e, --environment <env>', 'Environment ID or key')
-    .option('-c, --controller <url>', 'Controller URL (optional, uses configured controller if not provided)')
     .action(async(options) => {
       try {
         await listApplications(options);
@@ -57,12 +54,10 @@ function setupAppCommands(program) {
       }
     });
 
-  // Rotate secret command
+  // Rotate secret command (controller and environment from config.yaml)
   app
     .command('rotate-secret <appKey>')
     .description('Rotate pipeline ClientSecret for an application')
-    .requiredOption('-e, --environment <env>', 'Environment ID or key')
-    .option('-c, --controller <url>', 'Controller URL (optional, uses configured controller if not provided)')
     .action(async(appKey, options) => {
       try {
         await rotateSecret(appKey, options);