@aifabrix/builder 2.42.1 → 2.44.0

package/lib/commands/up-dataplane.js

@@ -1,3 +1,4 @@
+const { formatSuccessLine, formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
 /**
  * AI Fabrix Builder - Up Dataplane Command
  *
@@ -11,10 +12,12 @@
  * @version 2.0.0
  */
 
+const path = require('path');
 const readline = require('readline');
 const chalk = require('chalk');
 const pathsUtil = require('../utils/paths');
 const { loadConfigFile } = require('../utils/config-format');
+const { resolveDockerImageRef, normalizeDockerRegistryPrefix } = require('../utils/resolve-docker-image-ref');
 const logger = require('../utils/logger');
 const config = require('../core/config');
 const { checkAuthentication } = require('../utils/app-register-auth');
@@ -80,7 +83,7 @@ async function resolveControllerUrlWithHealthCheck() {
   logger.log(chalk.yellow(`\nController at ${controllerUrl} is not responding (health check failed).\n`));
   const newUrl = await promptForControllerUrl(controllerUrl);
   if (!newUrl) {
-    throw new Error('Controller URL is required. Run "aifabrix up-dataplane" again and enter a valid controller URL, or set it with: aifabrix auth config --set-controller <url>');
+    throw new Error('Controller URL is required. Run "aifabrix up-dataplane" again and enter a valid controller URL, or set it with: aifabrix auth --set-controller <url>');
   }
 
   try {
@@ -96,7 +99,7 @@ async function resolveControllerUrlWithHealthCheck() {
     throw new Error(`Controller at ${normalizedNew} is not responding. Ensure the controller is running and reachable, then run "aifabrix up-dataplane" again.`);
   }
 
-  logger.log(chalk.green(`✓ Using controller: ${normalizedNew}`));
+  logger.log(formatSuccessLine(`Using controller: ${normalizedNew}`));
   return normalizedNew;
 }
 
@@ -114,7 +117,7 @@ async function registerOrRotateDataplane(options, controllerUrl, environmentKey,
     logger.log(chalk.blue('Dataplane already registered; rotating secret...'));
     await rotateSecret('dataplane', options);
   } else {
-    const imageOverride = options.image || (options.registry ? buildDataplaneImageRef(options.registry) : undefined);
+    const imageOverride = options.image || buildDataplaneImageRef(options);
     const registerOpts = { imageOverride, image: imageOverride, registryMode: options.registryMode };
     await registerApplication('dataplane', registerOpts);
   }
@@ -126,25 +129,32 @@ async function registerOrRotateDataplane(options, controllerUrl, environmentKey,
  * @returns {Promise<void>}
  */
 async function deployDataplaneToController(options) {
-  const imageOverride = options.image || (options.registry ? buildDataplaneImageRef(options.registry) : undefined);
+  const imageOverride = options.image || buildDataplaneImageRef(options);
   const deployOpts = { imageOverride, image: imageOverride, registryMode: options.registryMode };
   await app.deployApp('dataplane', deployOpts);
 }
 
 /**
- * Build full image ref from registry and dataplane config (registry/name:tag)
- * @param {string} registry - Registry URL
- * @returns {string|undefined} Full image reference or undefined
+ * Full pullable image ref when CLI `--registry` and/or manifest `image.registry` is set.
+ * Returns undefined when neither is set (register/deploy use application config as before).
+ * @param {Object} [options] - Commander options
+ * @param {string} [options.registry] - CLI registry override (wins over manifest)
+ * @returns {string|undefined} Full reference or undefined
  */
-function buildDataplaneImageRef(registry) {
+function buildDataplaneImageRef(options = {}) {
   try {
     const builderPath = pathsUtil.getBuilderPath('dataplane');
     const configPath = pathsUtil.resolveApplicationConfigPath(builderPath);
-    const variables = loadConfigFile(configPath);
-    const name = variables?.image?.name || variables?.app?.key || 'dataplane';
-    const tag = variables?.image?.tag || 'latest';
-    const base = (registry || '').replace(/\/+$/, '');
-    return base ? `${base}/${name}:${tag}` : undefined;
+    const variables = loadConfigFile(configPath) || {};
+    const cli = normalizeDockerRegistryPrefix(options.registry);
+    const manifestReg = normalizeDockerRegistryPrefix(variables.image?.registry);
+    if (!cli && !manifestReg) {
+      return undefined;
+    }
+    const { imageName, imageTag } = resolveDockerImageRef('dataplane', variables, {
+      registry: options.registry || undefined
+    });
+    return `${imageName}:${imageTag}`;
   } catch {
     return undefined;
   }
@@ -167,7 +177,7 @@ function buildDataplaneImageRef(registry) {
 async function handleUpDataplane(options = {}) {
   const builderDir = await config.getAifabrixBuilderDir();
   if (builderDir) {
-    process.env.AIFABRIX_BUILDER_DIR = builderDir;
+    process.env.AIFABRIX_BUILDER_DIR = path.resolve(builderDir);
   }
   logger.log(chalk.blue('Starting up-dataplane (register/rotate, deploy, then run dataplane locally)...\n'));
 
@@ -179,10 +189,10 @@ async function handleUpDataplane(options = {}) {
   const environment = (cfg && cfg.environment) ? cfg.environment : 'dev';
   if (environment !== 'dev') {
     throw new Error(
-      'Dataplane is only supported in dev environment. Set with: aifabrix auth config --set-environment dev.'
+      'Dataplane is only supported in dev environment. Set with: aifabrix auth --set-environment dev.'
     );
   }
-  logger.log(chalk.green('✓ Logged in and environment is dev'));
+  logger.log(formatSuccessLine('Logged in and environment is dev'));
 
   await ensureAppFromTemplate('dataplane');
   // If envOutputPath target folder does not exist, set envOutputPath to null
@@ -192,9 +202,12 @@ async function handleUpDataplane(options = {}) {
 
   await deployDataplaneToController(options);
   logger.log('');
-  await app.runApp('dataplane', { skipEnvOutputPath: true });
+  await app.runApp('dataplane', {
+    skipEnvOutputPath: true,
+    registry: options.registry || undefined
+  });
 
-  logger.log(chalk.green('\n✓ up-dataplane complete. Dataplane is registered, deployed in dev, and running locally.'));
+  logger.log(formatSuccessParagraph('up-dataplane complete. Dataplane is registered, deployed in dev, and running locally.'));
 }
 
 module.exports = { handleUpDataplane, buildDataplaneImageRef };

package/lib/commands/up-miso.js

@@ -1,3 +1,4 @@
+const { formatSuccessLine, formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
 /**
  * AI Fabrix Builder - Up Miso Command
  *
@@ -9,9 +10,8 @@
  * @version 2.0.0
  */
 
+const path = require('path');
 const chalk = require('chalk');
-const pathsUtil = require('../utils/paths');
-const { loadConfigFile } = require('../utils/config-format');
 const logger = require('../utils/logger');
 const config = require('../core/config');
 const infra = require('../infrastructure');
@@ -38,26 +38,6 @@ function parseImageOptions(imageOpts) {
   return map;
 }
 
-/**
- * Build full image ref from registry and app config (registry/name:tag)
- * @param {string} appName - keycloak or miso-controller
- * @param {string} registry - Registry URL
- * @returns {string} Full image reference
- */
-function buildImageRefFromRegistry(appName, registry) {
-  try {
-    const builderPath = pathsUtil.getBuilderPath(appName);
-    const configPath = pathsUtil.resolveApplicationConfigPath(builderPath);
-    const variables = loadConfigFile(configPath);
-    const name = variables?.image?.name || variables?.app?.key || appName;
-    const tag = variables?.image?.tag || 'latest';
-    const base = (registry || '').replace(/\/+$/, '');
-    return base ? `${base}/${name}:${tag}` : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
 /**
  * Build run options and run keycloak, then miso-controller
  * @async
@@ -65,10 +45,20 @@ function buildImageRefFromRegistry(appName, registry) {
  */
 async function runMisoApps(options) {
   const imageMap = parseImageOptions(options.image);
-  const keycloakImage = imageMap.keycloak || (options.registry ? buildImageRefFromRegistry('keycloak', options.registry) : undefined);
-  const misoImage = imageMap['miso-controller'] || (options.registry ? buildImageRefFromRegistry('miso-controller', options.registry) : undefined);
-  const keycloakRunOpts = { image: keycloakImage, registry: options.registry, registryMode: options.registryMode, skipEnvOutputPath: true, skipInfraCheck: true };
-  const misoRunOpts = { image: misoImage, registry: options.registry, registryMode: options.registryMode, skipEnvOutputPath: true, skipInfraCheck: true };
+  const common = {
+    registry: options.registry,
+    registryMode: options.registryMode,
+    skipEnvOutputPath: true,
+    skipInfraCheck: true
+  };
+  const keycloakRunOpts = { ...common };
+  if (imageMap.keycloak) {
+    keycloakRunOpts.image = imageMap.keycloak;
+  }
+  const misoRunOpts = { ...common };
+  if (imageMap['miso-controller']) {
+    misoRunOpts.image = imageMap['miso-controller'];
+  }
   logger.log(chalk.blue('Starting keycloak...'));
   await app.runApp('keycloak', keycloakRunOpts);
   logger.log(chalk.blue('Starting miso-controller...'));
@@ -90,7 +80,7 @@ async function runMisoApps(options) {
 async function handleUpMiso(options = {}) {
   const builderDir = await config.getAifabrixBuilderDir();
   if (builderDir) {
-    process.env.AIFABRIX_BUILDER_DIR = builderDir;
+    process.env.AIFABRIX_BUILDER_DIR = path.resolve(builderDir);
   }
   logger.log(chalk.blue('Starting up-miso (keycloak + miso-controller from images)...\n'));
   // Strict: only this developer's infra (same as status), so up-miso and status agree
@@ -99,7 +89,7 @@ async function handleUpMiso(options = {}) {
   if (!allHealthy) {
     throw new Error('Infrastructure is not up. Run \'aifabrix up-infra\' first.');
   }
-  logger.log(chalk.green('✓ Infrastructure is up'));
+  logger.log(formatSuccessLine('Infrastructure is up'));
   await ensureAppFromTemplate('keycloak');
   await ensureAppFromTemplate('miso-controller');
   // If envOutputPath target folder does not exist, set envOutputPath to null
@@ -109,7 +99,7 @@ async function handleUpMiso(options = {}) {
   patchEnvOutputPathForDeployOnly('keycloak');
   patchEnvOutputPathForDeployOnly('miso-controller');
   await runMisoApps(options);
-  logger.log(chalk.green('\n✓ up-miso complete. Keycloak and miso-controller are running.') +
+  logger.log(formatSuccessParagraph('up-miso complete. Keycloak and miso-controller are running.') +
     chalk.gray('\n  Run onboarding and register Keycloak from the miso-controller repo if needed. Use \'aifabrix up-dataplane\' for dataplane.'));
 }
 

package/lib/commands/upload.js

@@ -1,7 +1,8 @@
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 /**
- * Upload external system to dataplane (single pipeline upload: upload → validate → publish).
+ * Upload external system to dataplane (single pipeline upload: validate → publish → controller register).
  *
- * @fileoverview Upload command handler for aifabrix upload <system-key>
+ * @fileoverview Upload command handler for aifabrix upload <systemKey>
  * @author AI Fabrix Team
  * @version 2.0.0
  */
@@ -21,9 +22,19 @@ const {
 const { validateExternalSystemComplete } = require('../validation/validate');
 const { displayValidationResults } = require('../validation/validate-display');
 const { generateControllerManifest } = require('../generator/external-controller-manifest');
-const { uploadApplicationViaPipeline } = require('../api/pipeline.api');
+const {
+  uploadApplicationViaPipeline,
+  validatePipelineConfig,
+  testSystemViaPipeline
+} = require('../api/pipeline.api');
 const { formatApiError } = require('../utils/api-error-handler');
 const { logDataplanePipelineWarning } = require('../utils/dataplane-pipeline-warning');
+const { unwrapPublicationResult, unwrapApiData } = require('../utils/external-system-readiness-core');
+const {
+  logUploadReadinessSummary,
+  logServerValidationWarnings,
+  logProbeRuntimeBlock
+} = require('../utils/external-system-readiness-display');
 
 /**
  * Validates system-key format (same as download).
@@ -66,10 +77,10 @@ async function resolveDataplaneAndAuth(systemKey) {
   const authConfig = await getDeploymentAuth(controllerUrl, environment, systemKey);
 
   if (!authConfig.token && !authConfig.clientId) {
-    throw new Error('Authentication required. Run "aifabrix login" or "aifabrix app register <system-key>" first.');
+    throw new Error('Authentication required. Run "aifabrix login" or "aifabrix app register <systemKey>" first.');
   }
 
-  logger.log(chalk.blue('Resolving dataplane URL...'));
+  logger.log(chalk.gray('Resolving dataplane URL...'));
   const dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig);
   return { dataplaneUrl, authConfig, environment };
 }
@@ -79,7 +90,7 @@ async function resolveDataplaneAndAuth(systemKey) {
  * @param {string} dataplaneUrl - Dataplane base URL
  * @param {Object} authConfig - Auth config
  * @param {Object} payload - { version, application, dataSources, status: "draft" }
- * @returns {Promise<Object>} Publication result from Dataplane
+ * @returns {Promise<Object>} Raw API response envelope
  */
 async function runUploadValidatePublish(dataplaneUrl, authConfig, payload) {
   const res = await uploadApplicationViaPipeline(dataplaneUrl, authConfig, payload);
@@ -91,9 +102,8 @@ async function runUploadValidatePublish(dataplaneUrl, authConfig, payload) {
 }
 
 /**
- * Builds a short summary of validation errors for the thrown message.
  * @param {Object} validationResult - Result from validateExternalSystemComplete
- * @returns {string} First few errors joined for the error message
+ * @returns {string}
  */
 function formatValidationErrorSummary(validationResult) {
   const errors = validationResult.errors || [];
@@ -108,7 +118,6 @@ function formatValidationErrorSummary(validationResult) {
 }
 
 /**
- * Throws if validation result is invalid (displays results first).
  * @param {Object} validationResult - Result from validateExternalSystemComplete
  * @throws {Error} If validationResult.valid is false
  */
@@ -162,52 +171,142 @@ async function pushAndLogCredentialSecrets(dataplaneUrl, authConfig, systemKey,
 }
 
 /**
- * Uploads external system to dataplane (single pipeline upload). No controller deploy.
- * @param {string} systemKey - External system key (integration/<system-key>/)
- * @param {Object} [options] - Options
- * @param {boolean} [options.dryRun] - Validate and build payload only; no API calls
- * @returns {Promise<void>}
- * @throws {Error} If validation or API calls fail
+ * Optional server-side pipeline validate when --verbose.
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {Object} payload
  */
-async function uploadExternalSystem(systemKey, options = {}) {
-  validateSystemKeyFormat(systemKey);
-  logger.log(chalk.blue(`\nUploading external system to dataplane: ${systemKey}`));
+async function maybeRunVerboseServerValidation(dataplaneUrl, authConfig, payload) {
+  const vr = await validatePipelineConfig(dataplaneUrl, authConfig, {
+    config: {
+      version: payload.version,
+      application: payload.application,
+      dataSources: payload.dataSources
+    }
+  });
+  if (vr?.success === false) {
+    throw new Error(formatApiError(vr, dataplaneUrl));
+  }
+  const body = unwrapApiData(vr);
+  logServerValidationWarnings(body);
+}
 
+/**
+ * Empty payload template for POST /validation/run: selects dataplane **payload test** path
+ * (per-datasource template / connectivity), not the full validation-engine run.
+ * Avoids false RBAC failures right after upload: engine security checks autoRbac vs
+ * `system.permissions[]` before the controller has synced permissions (deploy --probe
+ * still uses the engine path without payloadTemplate).
+ */
+const UPLOAD_PROBE_TEST_DATA = { payloadTemplate: {} };
+
+/**
+ * Optional POST validation/run after successful upload.
+ * @param {string} dataplaneUrl
+ * @param {string} systemKey
+ * @param {Object} authConfig
+ * @param {number|undefined} probeTimeoutMs
+ */
+async function maybeRunUploadProbe(dataplaneUrl, systemKey, authConfig, probeTimeoutMs) {
+  logger.log(chalk.blue('\nRunning runtime checks (--probe)...'));
+  const timeoutMs = probeTimeoutMs === undefined || probeTimeoutMs === null ? 120000 : probeTimeoutMs;
+  try {
+    const pr = await testSystemViaPipeline(
+      dataplaneUrl,
+      systemKey,
+      authConfig,
+      UPLOAD_PROBE_TEST_DATA,
+      { timeout: timeoutMs }
+    );
+    if (pr.success === false) {
+      logger.log(chalk.yellow(`⚠ Probe request failed: ${pr.formattedError || pr.error || 'unknown error'}`));
+      return;
+    }
+    const probeData = unwrapApiData(pr);
+    logProbeRuntimeBlock(probeData, systemKey);
+  } catch (e) {
+    logger.log(chalk.yellow(`⚠ Probe failed: ${e.message}`));
+  }
+}
+
+/**
+ * Local validation, manifest, payload, and configuration resolution.
+ * @param {string} systemKey
+ * @returns {Promise<{ manifest: Object, payload: Object }>}
+ */
+async function buildValidatedUploadManifestPayload(systemKey) {
   const validationResult = await validateExternalSystemComplete(systemKey, { type: 'external' });
   throwIfValidationFailed(validationResult);
-  logger.log(chalk.green('Validation passed.'));
-
+  logger.log(formatSuccessLine('Local validation passed'));
   const manifest = await generateControllerManifest(systemKey, { type: 'external' });
   const payload = buildUploadPayload(manifest);
   await resolvePayloadConfiguration(systemKey, payload);
+  return { manifest, payload };
+}
 
-  if (options.dryRun) {
-    logger.log(chalk.yellow('Dry run: would upload payload (no API calls).'));
-    logger.log(chalk.gray(`  System: ${manifest.key}, version: ${payload.version}, datasources: ${payload.dataSources.length}`));
-    return;
-  }
-
+/**
+ * Upload path after dry-run check.
+ * @param {string} systemKey
+ * @param {Object} options
+ * @param {Object} manifest
+ * @param {Object} payload
+ */
+async function runUploadPublishAndSummary(systemKey, options, manifest, payload) {
   const { dataplaneUrl, authConfig, environment } = await resolveDataplaneAndAuth(systemKey);
   requireBearerForDataplanePipeline(authConfig);
-  logger.log(chalk.blue(`Dataplane: ${dataplaneUrl}`));
+  logger.log(chalk.gray('Target:'));
+  logger.log(chalk.gray(`Environment: ${environment}`));
+  logger.log(chalk.gray(`Dataplane: ${dataplaneUrl}`));
   logDataplanePipelineWarning();
-
+  if (options.verbose) {
+    await maybeRunVerboseServerValidation(dataplaneUrl, authConfig, payload);
+  }
   await pushAndLogCredentialSecrets(dataplaneUrl, authConfig, systemKey, payload);
-  await runUploadValidatePublish(dataplaneUrl, authConfig, payload);
-  logUploadSuccess(environment, systemKey, dataplaneUrl);
+  const rawRes = await runUploadValidatePublish(dataplaneUrl, authConfig, payload);
+  const publication = unwrapPublicationResult(rawRes);
+  if (!publication) {
+    throw new Error(
+      'Unexpected response from dataplane upload: missing publication result (uploadId/system/datasources).'
+    );
+  }
+  logUploadReadinessSummary({
+    environment,
+    dataplaneUrl,
+    systemKey,
+    publication,
+    manifest,
+    minimal: !!options.minimal,
+    willProbe: !!options.probe
+  });
+  if (options.probe) {
+    await maybeRunUploadProbe(dataplaneUrl, systemKey, authConfig, options.probeTimeout);
+  }
 }
 
 /**
- * Logs upload success summary.
- * @param {string} environment - Environment key
- * @param {string} systemKey - System key
- * @param {string} dataplaneUrl - Dataplane URL
+ * Uploads external system: publishes to dataplane and registers with controller (draft).
+ * @param {string} systemKey - External system key (integration/<systemKey>/)
+ * @param {Object} [options] - Options
+ * @param {boolean} [options.dryRun] - Validate and build payload only; no API calls
+ * @param {boolean} [options.verbose] - POST pipeline/validate for server warnings
+ * @param {boolean} [options.probe] - POST validation/run after publish
+ * @param {number} [options.probeTimeout] - Probe timeout ms (default 120000)
+ * @param {boolean} [options.minimal] - Short summary only
+ * @returns {Promise<void>}
+ * @throws {Error} If validation or API calls fail
  */
-function logUploadSuccess(environment, systemKey, dataplaneUrl) {
-  logger.log(chalk.green('\nUpload validated and published to dataplane.'));
-  logger.log(chalk.blue(`Environment: ${environment}`));
-  logger.log(chalk.blue(`System: ${systemKey}`));
-  logger.log(chalk.blue(`Dataplane: ${dataplaneUrl}`));
+async function uploadExternalSystem(systemKey, options = {}) {
+  validateSystemKeyFormat(systemKey);
+  logger.log(chalk.blue(`\nUploading external system: ${chalk.bold(systemKey)}`));
+  const { manifest, payload } = await buildValidatedUploadManifestPayload(systemKey);
+  if (options.dryRun) {
+    logger.log(chalk.yellow('Dry run: would upload payload (no API calls).'));
+    logger.log(
+      chalk.gray(`  System: ${manifest.key}, version: ${payload.version}, datasources: ${payload.dataSources.length}`)
+    );
+    return;
+  }
+  await runUploadPublishAndSummary(systemKey, options, manifest, payload);
 }
 
 module.exports = {

package/lib/commands/wizard-core-helpers.js

@@ -308,7 +308,7 @@ function throwConfigGenerationError(generateResponse, options = {}) {
 }
 
 /**
- * Write debug log to integration/<appName>/debug.log
+ * Write debug log to integration/<systemKey>/debug.log
  * @async
  * @param {string} appName - Application name
  * @param {string} content - Debug log content

package/lib/commands/wizard-dataplane.js

@@ -6,6 +6,7 @@
 
 const chalk = require('chalk');
 const logger = require('../utils/logger');
+const { infoLine, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 const { getDataplaneUrl } = require('../datasource/deploy');
 const { listEnvironmentApplications } = require('../api/environments.api');
 
@@ -75,7 +76,7 @@ function createDataplaneNotFoundError() {
 async function tryFallbackDataplaneUrl(controllerUrl, environment, authConfig) {
   try {
     const fallbackUrl = await getDataplaneUrl(controllerUrl, 'dataplane', environment, authConfig);
-    logger.log(chalk.green(`\u2713 Dataplane URL: ${fallbackUrl}`));
+    logger.log(formatSuccessLine(`Dataplane URL: ${fallbackUrl}`));
     return fallbackUrl;
   } catch (fallbackError) {
     if (isNotFoundError(fallbackError)) {
@@ -96,12 +97,12 @@ async function tryFallbackDataplaneUrl(controllerUrl, environment, authConfig) {
  * @throws {Error} If dataplane URL cannot be discovered
  */
 async function discoverDataplaneUrl(controllerUrl, environment, authConfig) {
-  logger.log(chalk.blue('\uD83C\uDF10 Getting dataplane URL from controller...'));
+  logger.log(infoLine('🌐 Getting dataplane URL from controller...'));
   try {
     const dataplaneAppKey = await findDataplaneServiceAppKey(controllerUrl, environment, authConfig);
     if (dataplaneAppKey) {
       const dataplaneUrl = await getDataplaneUrl(controllerUrl, dataplaneAppKey, environment, authConfig);
-      logger.log(chalk.green(`\u2713 Dataplane URL: ${dataplaneUrl}`));
+      logger.log(formatSuccessLine(`Dataplane URL: ${dataplaneUrl}`));
       return dataplaneUrl;
     }
     return await tryFallbackDataplaneUrl(controllerUrl, environment, authConfig);

package/lib/commands/wizard-helpers.js

@@ -117,9 +117,9 @@ function showWizardConfigSummary(config, displayPath) {
 }
 
 /**
- * Ensure integration/<appKey> directory exists
- * @param {string} appKey - Application key
- * @returns {Promise<string>} Resolved config path (integration/<appKey>/wizard.yaml)
+ * Ensure integration/<systemKey> directory exists
+ * @param {string} appKey - Integration folder name (system key)
+ * @returns {Promise<string>} Resolved config path (integration/<systemKey>/wizard.yaml)
  */
 async function ensureIntegrationDir(appKey) {
   const dir = path.join(process.cwd(), 'integration', appKey);

package/lib/commands/wizard.js

@@ -344,7 +344,7 @@ async function executeWizardFlow(appKey, dataplaneUrl, authConfig, flowOpts = {}
 
 /**
  * Load wizard config from configPath if it exists (for prefill)
- * @param {string} [configPath] - Path to wizard.yaml (e.g. integration/<app>/wizard.yaml)
+ * @param {string} [configPath] - Path to wizard.yaml (e.g. integration/<systemKey>/wizard.yaml)
  * @param {string} [appName] - App name (for log message)
  * @returns {Promise<Object|null>} Loaded config or null
  */
@@ -441,7 +441,7 @@ async function handleWizardError(appKey, configPath, mode, systemIdOrKey, error)
  * @param {Object} options - Command options
  * @param {string} [options.app] - Application name (from positional or -a)
  * @param {string} [options.config] - Path to wizard.yaml (headless mode)
- * @param {string} [options.configPath] - Resolved path integration/<app>/wizard.yaml for load/save
+ * @param {string} [options.configPath] - Resolved path integration/<systemKey>/wizard.yaml for load/save
  * @returns {Promise<void>} Resolves when wizard completes
  * @throws {Error} If wizard fails (wizardResumeMessage set when appKey known)
  */

package/lib/core/admin-secrets.js

@@ -11,9 +11,10 @@
 'use strict';
 
 const path = require('path');
-const fs = require('fs');
+const fsRealSync = require('../internal/fs-real-sync');
 const config = require('./config');
 const { decryptSecret, isEncrypted } = require('../utils/secrets-encryption');
+const { ensureSecureFilePermissions } = require('../utils/secure-file-permissions');
 
 /**
  * Parse .env-style content into key-value map (excludes comments and empty lines).
@@ -47,17 +48,27 @@ function parseAdminEnvContent(content) {
  * Use the returned object only in memory (e.g. to build a temporary .env for docker compose).
  *
  * @async
- * @param {string} [adminSecretsPath] - Path to admin-secrets.env; default: ~/.aifabrix/admin-secrets.env
+ * @param {string} [adminSecretsPath] - Path to admin-secrets.env; default: beside config.yaml (typically ~/.aifabrix), with legacy fallback under aifabrix-home when only that file exists
  * @returns {Promise<Object.<string, string>>} Plain object e.g. { POSTGRES_PASSWORD, PGADMIN_DEFAULT_EMAIL, ... }
  * @throws {Error} If file missing, or encrypted value and decryption fails / no key configured
  */
 async function readAndDecryptAdminSecrets(adminSecretsPath) {
   const pathsUtil = require('../utils/paths');
-  const resolvedPath = adminSecretsPath || path.join(pathsUtil.getAifabrixHome(), 'admin-secrets.env');
-  if (!fs.existsSync(resolvedPath)) {
+  let resolvedPath = adminSecretsPath;
+  if (!resolvedPath) {
+    const systemPath = path.join(pathsUtil.getAifabrixSystemDir(), 'admin-secrets.env');
+    const legacyPath = path.join(pathsUtil.getAifabrixHome(), 'admin-secrets.env');
+    resolvedPath = fsRealSync.existsSync(systemPath)
+      ? systemPath
+      : fsRealSync.existsSync(legacyPath)
+        ? legacyPath
+        : systemPath;
+  }
+  if (!fsRealSync.existsSync(resolvedPath)) {
     throw new Error(`Admin secrets file not found: ${resolvedPath}. Run 'aifabrix up-infra' or ensure admin-secrets.env exists.`);
   }
-  const content = fs.readFileSync(resolvedPath, 'utf8');
+  ensureSecureFilePermissions(resolvedPath);
+  const content = fsRealSync.readFileSync(resolvedPath, 'utf8');
   const raw = parseAdminEnvContent(content);
   const encryptionKey = await config.getSecretsEncryptionKey();
   const out = {};

package/lib/core/audit-logger.js

@@ -16,12 +16,12 @@ const path = require('path');
 const os = require('os');
 const paths = require('../utils/paths');
 
-// Audit log file path (in user's home directory for compliance)
+// Audit log file path (beside config.yaml / CLI system dir for compliance)
 let auditLogPath = null;
 
 /**
  * Gets the audit log file path
- * Creates .aifabrix directory in user's home if it doesn't exist
+ * Creates config / system directory if it doesn't exist
  * @returns {Promise<string>} Path to audit log file
  */
 async function getAuditLogPath() {
@@ -29,7 +29,7 @@ async function getAuditLogPath() {
     return auditLogPath;
   }
 
-  const aifabrixDir = paths.getAifabrixHome();
+  const aifabrixDir = paths.getAifabrixSystemDir();
 
   try {
     await fs.mkdir(aifabrixDir, { recursive: true });
@@ -336,6 +336,13 @@ function extractPathFromUrl(url) {
   }
 }
 
+/**
+ * Clears cached audit log path (for tests that vary getAifabrixSystemDir between calls).
+ */
+function resetAuditLogPathCache() {
+  auditLogPath = null;
+}
+
 module.exports = {
   auditLog,
   logDeploymentAttempt,
@@ -345,6 +352,7 @@ module.exports = {
   logApplicationCreation,
   logApiCall,
   maskSensitiveData,
-  createAuditEntry
+  createAuditEntry,
+  resetAuditLogPathCache
 };