@aifabrix/builder 2.43.0 → 2.44.0

package/lib/commands/secrets-remove-all.js

@@ -0,0 +1,220 @@
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+/**
+ * @fileoverview aifabrix secret remove-all – remove every secret (user file, shared file, or remote API)
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+const path = require('path');
+const fs = require('fs');
+const readline = require('readline');
+const yaml = require('js-yaml');
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { getAifabrixSecretsPath } = require('../core/config');
+const pathsUtil = require('../utils/paths');
+const remoteDevAuth = require('../utils/remote-dev-auth');
+const devApi = require('../api/dev.api');
+
+/**
+ * @param {string} question
+ * @returns {Promise<string>}
+ */
+function promptLine(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise(resolve => {
+    rl.question(question, answer => {
+      rl.close();
+      resolve((answer || '').trim());
+    });
+  });
+}
+
+/**
+ * Read secret keys from a YAML secrets file.
+ * @param {string} filePath - Absolute path
+ * @returns {string[]} Sorted unique keys
+ */
+function listKeysFromYamlFile(filePath) {
+  if (!fs.existsSync(filePath)) {
+    return [];
+  }
+  try {
+    const content = fs.readFileSync(filePath, 'utf8');
+    const data = yaml.load(content) || {};
+    if (typeof data !== 'object' || Array.isArray(data)) {
+      return [];
+    }
+    return Object.keys(data).sort((a, b) => a.localeCompare(b, undefined, { sensitivity: 'base' }));
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Write an empty secrets map to file (same options as single-key remove).
+ * @param {string} filePath - Absolute path
+ */
+function writeEmptySecretsFile(filePath) {
+  const yamlContent = yaml.dump({}, { indent: 2, lineWidth: -1, noRefs: true, sortKeys: false });
+  fs.writeFileSync(filePath, yamlContent, { mode: 0o600 });
+}
+
+/**
+ * @param {boolean} skipPrompt - When true (--yes), skip confirmation
+ * @param {string} whereLabel - Human-readable target
+ * @param {number} count - Number of keys
+ * @returns {Promise<boolean>}
+ */
+async function confirmRemoveAll(skipPrompt, whereLabel, count) {
+  if (skipPrompt) {
+    return true;
+  }
+  logger.log(chalk.yellow(`\nThis will permanently remove all ${count} secret key(s) from ${whereLabel}.`));
+  logger.log(chalk.gray('This cannot be undone.\n'));
+  const answer = (await promptLine(chalk.bold('Type "yes" to confirm (anything else cancels): '))).toLowerCase();
+  return answer === 'yes';
+}
+
+/**
+ * @param {Object} auth - Remote dev auth (serverUrl, clientCertPem, serverCaPem)
+ * @param {string} target - Secrets endpoint URL
+ * @returns {Promise<string[]>}
+ */
+async function listRemoteSecretKeys(auth, target) {
+  const items = await devApi.listSecrets(
+    auth.serverUrl,
+    auth.clientCertPem,
+    auth.serverCaPem || undefined,
+    target
+  );
+  return (Array.isArray(items) ? items : [])
+    .map(i => i.name || i.key || '')
+    .filter(k => typeof k === 'string' && k.length > 0)
+    .sort((a, b) => a.localeCompare(b, undefined, { sensitivity: 'base' }));
+}
+
+/**
+ * @param {string} target - Secrets endpoint URL
+ * @returns {string}
+ */
+function labelForRemoteSharedSecrets(target) {
+  const host = remoteDevAuth.getSharedSecretsRemoteHostname(target);
+  return host ? `shared secrets (remote - ${host})` : 'shared secrets (remote)';
+}
+
+/**
+ * @param {Object} auth
+ * @param {string[]} keys
+ * @param {string} target
+ * @returns {Promise<void>}
+ */
+async function deleteRemoteSecretKeys(auth, keys, target) {
+  const ca = auth.serverCaPem || undefined;
+  for (const key of keys) {
+    await devApi.deleteSecret(auth.serverUrl, auth.clientCertPem, key, ca, target);
+  }
+}
+
+/**
+ * Remove every shared secret via remote API.
+ * @param {string} target - Resolved secrets endpoint URL
+ * @param {Object} options - { yes?: boolean }
+ * @returns {Promise<void>}
+ */
+async function removeAllRemoteSharedSecrets(target, options) {
+  const auth = await remoteDevAuth.getRemoteDevAuth();
+  if (!auth) {
+    throw new Error('Remote server not configured or certificate missing. Run "aifabrix dev init" first.');
+  }
+  const keys = await listRemoteSecretKeys(auth, target);
+  if (keys.length === 0) {
+    logger.log(chalk.gray('No shared secrets to remove.'));
+    return;
+  }
+  const where = labelForRemoteSharedSecrets(target);
+  const ok = await confirmRemoveAll(!!options.yes, where, keys.length);
+  if (!ok) {
+    logger.log(chalk.gray('Cancelled. No secrets were removed.'));
+    return;
+  }
+  await deleteRemoteSecretKeys(auth, keys, target);
+  logger.log(formatSuccessLine(`Removed ${keys.length} secret key(s) from ${where}.`));
+}
+
+/**
+ * Remove every key from a shared secrets YAML file.
+ * @param {string} resolvedPath - Absolute file path
+ * @param {Object} options - { yes?: boolean }
+ * @returns {Promise<void>}
+ */
+async function removeAllSharedFileSecrets(resolvedPath, options) {
+  const keys = listKeysFromYamlFile(resolvedPath);
+  if (keys.length === 0) {
+    logger.log(chalk.gray('No shared secrets to remove.'));
+    return;
+  }
+  const ok = await confirmRemoveAll(!!options.yes, `shared secrets file (${resolvedPath})`, keys.length);
+  if (!ok) {
+    logger.log(chalk.gray('Cancelled. No secrets were removed.'));
+    return;
+  }
+  writeEmptySecretsFile(resolvedPath);
+  logger.log(formatSuccessLine(`Removed ${keys.length} secret key(s) from shared secrets file.`));
+}
+
+/**
+ * Remove every key from shared store (remote API or file).
+ * @param {string} generalSecretsPath - Path or URL from config
+ * @param {Object} options - { yes?: boolean }
+ * @returns {Promise<void>}
+ */
+async function removeAllSharedSecrets(generalSecretsPath, options) {
+  const target = await remoteDevAuth.resolveSharedSecretsEndpoint(generalSecretsPath);
+  if (remoteDevAuth.isRemoteSecretsUrl(target)) {
+    await removeAllRemoteSharedSecrets(target, options);
+    return;
+  }
+  const resolvedPath = path.isAbsolute(target) ? target : path.resolve(process.cwd(), target);
+  await removeAllSharedFileSecrets(resolvedPath, options);
+}
+
+/**
+ * @param {Object} options - { yes?: boolean }
+ * @returns {Promise<void>}
+ */
+async function removeAllUserSecrets(options) {
+  const userSecretsPath = pathsUtil.getPrimaryUserSecretsLocalPath();
+  const keys = listKeysFromYamlFile(userSecretsPath);
+  if (keys.length === 0) {
+    logger.log(chalk.gray('No user secrets to remove.'));
+    return;
+  }
+  const ok = await confirmRemoveAll(!!options.yes, `user secrets (${userSecretsPath})`, keys.length);
+  if (!ok) {
+    logger.log(chalk.gray('Cancelled. No secrets were removed.'));
+    return;
+  }
+  writeEmptySecretsFile(userSecretsPath);
+  logger.log(formatSuccessLine(`Removed ${keys.length} secret key(s) from user secrets.`));
+}
+
+/**
+ * Handle secret remove-all command.
+ * @param {Object} options - { shared?: boolean, yes?: boolean }
+ * @returns {Promise<void>}
+ */
+async function handleSecretsRemoveAll(options) {
+  const isShared = options.shared || options['shared'] || false;
+  if (!isShared) {
+    await removeAllUserSecrets(options);
+    return;
+  }
+  const generalSecretsPath = await getAifabrixSecretsPath();
+  if (!generalSecretsPath) {
+    throw new Error('Shared secrets not configured. Set aifabrix-secrets in config.yaml.');
+  }
+  await removeAllSharedSecrets(generalSecretsPath, options);
+}
+
+module.exports = { handleSecretsRemoveAll };

package/lib/commands/secrets-remove.js

@@ -4,14 +4,14 @@
  * @version 2.0.0
  */
 
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 const path = require('path');
 const fs = require('fs');
 const yaml = require('js-yaml');
-const chalk = require('chalk');
 const logger = require('../utils/logger');
 const { getAifabrixSecretsPath } = require('../core/config');
 const pathsUtil = require('../utils/paths');
-const { isRemoteSecretsUrl, getRemoteDevAuth } = require('../utils/remote-dev-auth');
+const remoteDevAuth = require('../utils/remote-dev-auth');
 const devApi = require('../api/dev.api');
 
 /**
@@ -44,27 +44,36 @@ function removeKeyFromFile(key, filePath) {
  * @returns {Promise<void>}
  */
 async function removeSharedSecret(key, generalSecretsPath) {
-  if (isRemoteSecretsUrl(generalSecretsPath)) {
-    const auth = await getRemoteDevAuth();
+  const target = await remoteDevAuth.resolveSharedSecretsEndpoint(generalSecretsPath);
+  if (remoteDevAuth.isRemoteSecretsUrl(target)) {
+    const auth = await remoteDevAuth.getRemoteDevAuth();
     if (!auth) {
       throw new Error('Remote server not configured or certificate missing. Run "aifabrix dev init" first.');
     }
     try {
-      await devApi.deleteSecret(auth.serverUrl, auth.clientCertPem, key);
+      await devApi.deleteSecret(
+        auth.serverUrl,
+        auth.clientCertPem,
+        key,
+        auth.serverCaPem || undefined,
+        target
+      );
     } catch (err) {
       if (err.status === 404) {
         throw new Error(`Secret '${key}' not found.`);
       }
       throw err;
     }
-    logger.log(chalk.green(`✓ Secret '${key}' removed from remote shared secrets.`));
+    const host = remoteDevAuth.getSharedSecretsRemoteHostname(target);
+    const where = host ? `shared secrets (remote - ${host})` : 'shared secrets (remote)';
+    logger.log(formatSuccessLine(`Secret '${key}' removed from ${where}.`));
     return;
   }
-  const resolvedPath = path.isAbsolute(generalSecretsPath)
-    ? generalSecretsPath
-    : path.resolve(process.cwd(), generalSecretsPath);
+  const resolvedPath = path.isAbsolute(target)
+    ? target
+    : path.resolve(process.cwd(), target);
   removeKeyFromFile(key, resolvedPath);
-  logger.log(chalk.green(`✓ Secret '${key}' removed from shared secrets file.`));
+  logger.log(formatSuccessLine(`Secret '${key}' removed from shared secrets file.`));
 }
 
 /**
@@ -88,9 +97,9 @@ async function handleSecretsRemove(key, options) {
     }
     await removeSharedSecret(key, generalSecretsPath);
   } else {
-    const userSecretsPath = path.join(pathsUtil.getAifabrixHome(), 'secrets.local.yaml');
+    const userSecretsPath = pathsUtil.getPrimaryUserSecretsLocalPath();
     removeKeyFromFile(key, userSecretsPath);
-    logger.log(chalk.green(`✓ Secret '${key}' removed from user secrets.`));
+    logger.log(formatSuccessLine(`Secret '${key}' removed from user secrets.`));
   }
 }
 

package/lib/commands/secrets-set.js

@@ -9,13 +9,13 @@
  * @version 2.0.0
  */
 
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 const path = require('path');
-const chalk = require('chalk');
 const logger = require('../utils/logger');
 const { getAifabrixSecretsPath } = require('../core/config');
 const { saveLocalSecret, saveSecret } = require('../utils/local-secrets');
 const pathsUtil = require('../utils/paths');
-const { isRemoteSecretsUrl, getRemoteDevAuth } = require('../utils/remote-dev-auth');
+const remoteDevAuth = require('../utils/remote-dev-auth');
 const devApi = require('../api/dev.api');
 
 /**
@@ -39,20 +39,29 @@ const devApi = require('../api/dev.api');
  * @returns {Promise<void>}
  */
 async function setSharedSecret(key, value, generalSecretsPath) {
-  if (isRemoteSecretsUrl(generalSecretsPath)) {
-    const auth = await getRemoteDevAuth();
+  const target = await remoteDevAuth.resolveSharedSecretsEndpoint(generalSecretsPath);
+  if (remoteDevAuth.isRemoteSecretsUrl(target)) {
+    const auth = await remoteDevAuth.getRemoteDevAuth();
     if (!auth) {
       throw new Error('Remote server not configured or certificate missing. Run "aifabrix dev init" first.');
     }
-    await devApi.addSecret(auth.serverUrl, auth.clientCertPem, { key, value });
-    logger.log(chalk.green(`✓ Secret '${key}' saved to remote secrets (shared).`));
+    await devApi.addSecret(
+      auth.serverUrl,
+      auth.clientCertPem,
+      { key, value },
+      auth.serverCaPem || undefined,
+      target
+    );
+    const host = remoteDevAuth.getSharedSecretsRemoteHostname(target);
+    const where = host ? `shared secrets (remote - ${host})` : 'shared secrets (remote)';
+    logger.log(formatSuccessLine(`Secret '${key}' saved to ${where}.`));
     return;
   }
-  const resolvedPath = path.isAbsolute(generalSecretsPath)
-    ? generalSecretsPath
-    : path.resolve(process.cwd(), generalSecretsPath);
+  const resolvedPath = path.isAbsolute(target)
+    ? target
+    : path.resolve(process.cwd(), target);
   await saveSecret(key, value, resolvedPath);
-  logger.log(chalk.green(`✓ Secret '${key}' saved to general secrets file: ${resolvedPath}`));
+  logger.log(formatSuccessLine(`Secret '${key}' saved to general secrets file: ${resolvedPath}`));
 }
 
 async function handleSecretsSet(key, value, options) {
@@ -80,8 +89,8 @@ async function handleSecretsSet(key, value, options) {
     await setSharedSecret(key, value, generalSecretsPath);
   } else {
     await saveLocalSecret(key, value);
-    const userSecretsPath = path.join(pathsUtil.getAifabrixHome(), 'secrets.local.yaml');
-    logger.log(chalk.green(`✓ Secret '${key}' saved to user secrets file: ${userSecretsPath}`));
+    const userSecretsPath = pathsUtil.getPrimaryUserSecretsLocalPath();
+    logger.log(formatSuccessLine(`Secret '${key}' saved to user secrets file: ${userSecretsPath}`));
   }
 }
 

package/lib/commands/secrets-validate.js

@@ -1,3 +1,4 @@
+const { formatBlockingError, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 /**
  * AI Fabrix Builder – Secrets validate command
  *
@@ -9,7 +10,6 @@
  */
 
 const chalk = require('chalk');
-const path = require('path');
 const logger = require('../utils/logger');
 const { validateSecretsFile } = require('../utils/secrets-validation');
 const { validateDataplaneSecrets } = require('../utils/token-manager');
@@ -34,7 +34,7 @@ async function handleSecretsValidate(pathArg, options = {}) {
     if (target.type === 'file' && target.filePath) {
       filePath = target.filePath;
     } else {
-      filePath = path.join(pathsUtil.getAifabrixHome(), 'secrets.local.yaml');
+      filePath = pathsUtil.getPrimaryUserSecretsLocalPath();
     }
   }
 
@@ -42,9 +42,9 @@ async function handleSecretsValidate(pathArg, options = {}) {
   const dataplaneResult = validateDataplaneSecrets(filePath);
   const allValid = result.valid && dataplaneResult.valid;
   if (result.valid) {
-    logger.log(chalk.green(`✓ Secrets file is valid: ${result.path}`));
+    logger.log(formatSuccessLine(`Secrets file is valid: ${result.path}`));
   } else {
-    logger.log(chalk.red(`✗ Validation failed: ${result.path}`));
+    logger.log(formatBlockingError(`Validation failed: ${result.path}`));
     result.errors.forEach((err) => logger.log(chalk.yellow(`  • ${err}`)));
   }
   if (!dataplaneResult.valid) {

package/lib/commands/secure.js

@@ -1,3 +1,4 @@
+const { formatSuccessLine, formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
 /**
  * AI Fabrix Builder - Secure Command
  *
@@ -32,7 +33,7 @@ async function findSecretsFiles() {
   const files = [];
 
   // User's secrets file
-  const userSecretsPath = path.join(pathsUtil.getAifabrixHome(), 'secrets.local.yaml');
+  const userSecretsPath = pathsUtil.getPrimaryUserSecretsLocalPath();
   if (fs.existsSync(userSecretsPath)) {
     files.push({ path: userSecretsPath, type: 'user' });
   }
@@ -131,7 +132,7 @@ async function getEncryptionKey(options) {
     // Check if key already exists in config
     const existingKey = await getSecretsEncryptionKey();
     if (existingKey) {
-      logger.log(chalk.yellow('⚠️  Encryption key already configured in config.yaml'));
+      logger.log(chalk.yellow('⚠  Encryption key already configured in config.yaml'));
       const useExisting = await inquirer.prompt([{
         type: 'confirm',
         name: 'use',
@@ -143,18 +144,18 @@ async function getEncryptionKey(options) {
       } else {
         encryptionKey = await promptForEncryptionKey();
         await setSecretsEncryptionKey(encryptionKey);
-        logger.log(chalk.green('✓ Encryption key saved to config.yaml'));
+        logger.log(formatSuccessLine('Encryption key saved to config.yaml'));
       }
     } else {
       encryptionKey = await promptForEncryptionKey();
       await setSecretsEncryptionKey(encryptionKey);
-      logger.log(chalk.green('✓ Encryption key saved to config.yaml'));
+      logger.log(formatSuccessLine('Encryption key saved to config.yaml'));
     }
   } else {
     // Validate and save the provided key
     validateEncryptionKey(encryptionKey);
     await setSecretsEncryptionKey(encryptionKey);
-    logger.log(chalk.green('✓ Encryption key saved to config.yaml'));
+    logger.log(formatSuccessLine('Encryption key saved to config.yaml'));
   }
   return encryptionKey;
 }
@@ -178,12 +179,12 @@ async function processSecretsFiles(secretsFiles, encryptionKey) {
       totalValues += result.total;
 
       if (result.encrypted > 0) {
-        logger.log(chalk.green(`  ✓ Encrypted ${result.encrypted} of ${result.total} values`));
+        logger.log(chalk.green(`  ✔ Encrypted ${result.encrypted} of ${result.total} values`));
       } else {
         logger.log(chalk.gray(`  - All values already encrypted (${result.total} total)`));
       }
     } catch (error) {
-      logger.log(chalk.red(`  ✗ Error: ${error.message}`));
+      logger.log(chalk.red(`  ✖ Error: ${error.message}`));
     }
   }
 
@@ -197,7 +198,7 @@ async function processSecretsFiles(secretsFiles, encryptionKey) {
  * @param {number} totalValues - Total number of values
  */
 function displayEncryptionSummary(filesCount, totalEncrypted, totalValues) {
-  logger.log(chalk.green('\n✅ Encryption complete!'));
+  logger.log(formatSuccessParagraph('Encryption complete!'));
   logger.log(chalk.gray(`   Files processed: ${filesCount}`));
   logger.log(chalk.gray(`   Values encrypted: ${totalEncrypted} of ${totalValues} total`));
   logger.log(chalk.gray('   Encryption key stored in: ~/.aifabrix/config.yaml\n'));
@@ -224,7 +225,7 @@ async function handleSecure(options) {
   const secretsFiles = await findSecretsFiles();
 
   if (secretsFiles.length === 0) {
-    logger.log(chalk.yellow('⚠️  No secrets files found to encrypt'));
+    logger.log(chalk.yellow('⚠  No secrets files found to encrypt'));
     logger.log(chalk.gray('   Create ~/.aifabrix/secrets.local.yaml or configure aifabrix-secrets in config.yaml'));
     return;
   }

package/lib/commands/service-user.js

@@ -1,3 +1,4 @@
+const { formatBlockingError, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 /**
  * Service user create command – create service user and get one-time secret
  * POST /api/v1/service-users. Used by `aifabrix service-user create`.
@@ -75,14 +76,14 @@ function handleCreateError(response) {
   const status = response.status;
   const msg = response.formattedError || response.error || 'Request failed';
   if (status === 400) {
-    logger.error(chalk.red(`❌ Validation error: ${msg}`));
+    logger.error(formatBlockingError(`Validation error: ${msg}`));
   } else if (status === 401) {
-    logger.error(chalk.red('❌ Unauthorized. Run "aifabrix login" and try again.'));
+    logger.error(formatBlockingError('Unauthorized. Run "aifabrix login" and try again.'));
   } else if (status === 403) {
-    logger.error(chalk.red('❌ Missing permission: service-user:create'));
+    logger.error(formatBlockingError('Missing permission: service-user:create'));
     logger.error(chalk.gray('Your account needs the service-user:create permission on the controller.'));
   } else {
-    logger.error(chalk.red(`❌ Failed to create service user: ${msg}`));
+    logger.error(formatBlockingError(`Failed to create service user: ${msg}`));
   }
   process.exit(1);
 }
@@ -96,20 +97,20 @@ function handleServiceUserApiError(response, permissionScope) {
   const status = response.status;
   const msg = response.formattedError || response.error || 'Request failed';
   if (status === 400) {
-    logger.error(chalk.red(`❌ Validation error: ${msg}`));
+    logger.error(formatBlockingError(`Validation error: ${msg}`));
   } else if (status === 401) {
-    logger.error(chalk.red('❌ Unauthorized. Run "aifabrix login" and try again.'));
+    logger.error(formatBlockingError('Unauthorized. Run "aifabrix login" and try again.'));
   } else if (status === 403) {
-    logger.error(chalk.red(`❌ Missing permission: service-user:${permissionScope}`));
+    logger.error(formatBlockingError(`Missing permission: service-user:${permissionScope}`));
     logger.error(chalk.gray(`Your account needs the service-user:${permissionScope} permission on the controller.`));
   } else if (status === 404) {
-    logger.error(chalk.red('❌ Service user not found.'));
+    logger.error(formatBlockingError('Service user not found.'));
     const detail = response.error || '';
     if (detail) {
       logger.error(chalk.gray(detail));
     }
   } else {
-    logger.error(chalk.red(`❌ Request failed: ${msg}`));
+    logger.error(formatBlockingError(`Request failed: ${msg}`));
   }
   process.exit(1);
 }
@@ -123,12 +124,12 @@ function handleServiceUserApiError(response, permissionScope) {
 async function resolveControllerAndAuth(options) {
   const controllerUrl = options.controller || (await resolveControllerUrl());
   if (!controllerUrl) {
-    logger.error(chalk.red('❌ Controller URL is required. Run "aifabrix login" first.'));
+    logger.error(formatBlockingError('Controller URL is required. Run "aifabrix login" first.'));
     process.exit(1);
   }
   const authResult = await getServiceUserAuth(controllerUrl);
   if (!authResult || !authResult.token) {
-    logger.error(chalk.red(`❌ No authentication token for controller: ${controllerUrl}`));
+    logger.error(formatBlockingError(`No authentication token for controller: ${controllerUrl}`));
     logger.error(chalk.gray('Run: aifabrix login'));
     process.exit(1);
   }
@@ -173,7 +174,7 @@ function displayServiceUserList(items) {
  * @param {string} clientSecret - One-time client secret
  */
 function displayCreateSuccess(clientId, clientSecret) {
-  logger.log(chalk.bold('\n✓ Service user created\n'));
+  logger.log(chalk.bold('\n✔ Service user created\n'));
   logger.log(chalk.cyan('  clientId:    ') + clientId);
   logger.log(chalk.cyan('  clientSecret: ') + clientSecret);
   logger.log('');
@@ -207,19 +208,19 @@ function validateServiceUserOptions(options) {
   const redirectUris = parseList(options.redirectUris);
   const groupNames = parseList(options.groupNames);
   if (!username) {
-    logger.error(chalk.red('❌ Username is required. Use --username <username>.'));
+    logger.error(formatBlockingError('Username is required. Use --username <username>.'));
     process.exit(1);
   }
   if (!email) {
-    logger.error(chalk.red('❌ Email is required. Use --email <email>.'));
+    logger.error(formatBlockingError('Email is required. Use --email <email>.'));
     process.exit(1);
   }
   if (redirectUris.length === 0) {
-    logger.error(chalk.red('❌ At least one redirect URI is required. Use --redirect-uris <uri1,uri2,...>.'));
+    logger.error(formatBlockingError('At least one redirect URI is required. Use --redirect-uris <uri1,uri2,...>.'));
     process.exit(1);
   }
   if (groupNames.length === 0) {
-    logger.error(chalk.red('❌ At least one group name is required. Use --group-names <name1,name2,...>.'));
+    logger.error(formatBlockingError('At least one group name is required. Use --group-names <name1,name2,...>.'));
     process.exit(1);
   }
   return {
@@ -241,12 +242,12 @@ async function resolveOptionsAndAuth(options) {
   const validated = validateServiceUserOptions(options);
   const controllerUrl = options.controller || (await resolveControllerUrl());
   if (!controllerUrl) {
-    logger.error(chalk.red('❌ Controller URL is required. Run "aifabrix login" first.'));
+    logger.error(formatBlockingError('Controller URL is required. Run "aifabrix login" first.'));
     process.exit(1);
   }
   const authResult = await getServiceUserAuth(controllerUrl);
   if (!authResult || !authResult.token) {
-    logger.error(chalk.red(`❌ No authentication token for controller: ${controllerUrl}`));
+    logger.error(formatBlockingError(`No authentication token for controller: ${controllerUrl}`));
     logger.error(chalk.gray('Run: aifabrix login'));
     process.exit(1);
   }
@@ -295,7 +296,7 @@ async function runServiceUserCreate(options = {}) {
 function requireServiceUserId(id) {
   const trimmed = (id && typeof id === 'string' ? id.trim() : '') || '';
   if (!trimmed) {
-    logger.error(chalk.red('❌ Service user ID is required. Use --id <uuid>.'));
+    logger.error(formatBlockingError('Service user ID is required. Use --id <uuid>.'));
     process.exit(1);
   }
   return trimmed;
@@ -343,7 +344,7 @@ async function runServiceUserRotateSecret(options = {}) {
   const payload = response?.data?.data ?? response?.data ?? response ?? {};
   const clientSecret = payload?.clientSecret ?? '';
   if (response && response.success === true) {
-    logger.log(chalk.bold('\n✓ Secret rotated\n'));
+    logger.log(chalk.bold('\n✔ Secret rotated\n'));
     logger.log(chalk.cyan('  clientSecret: ') + clientSecret);
     logger.log('');
     logger.log(chalk.yellow('⚠ ' + ONE_TIME_WARNING));
@@ -366,7 +367,7 @@ async function runServiceUserDelete(options = {}) {
     return;
   }
   if (response && response.success === true) {
-    logger.log(chalk.green('✓ Service user deactivated.\n'));
+    logger.log(formatSuccessLine('Service user deactivated.\n'));
   }
 }
 
@@ -380,7 +381,7 @@ async function runServiceUserUpdateGroups(options = {}) {
   const id = requireServiceUserId(options.id);
   const groupNames = parseList(options.groupNames);
   if (groupNames.length === 0) {
-    logger.error(chalk.red('❌ At least one group name is required. Use --group-names <name1,name2,...>.'));
+    logger.error(formatBlockingError('At least one group name is required. Use --group-names <name1,name2,...>.'));
     process.exit(1);
   }
   const { controllerUrl, authConfig } = await resolveControllerAndAuth(options);
@@ -390,7 +391,7 @@ async function runServiceUserUpdateGroups(options = {}) {
     return;
   }
   if (response && response.success === true) {
-    logger.log(chalk.green('✓ Service user groups updated.\n'));
+    logger.log(formatSuccessLine('Service user groups updated.\n'));
   }
 }
 
@@ -404,7 +405,7 @@ async function runServiceUserUpdateRedirectUris(options = {}) {
   const id = requireServiceUserId(options.id);
   const redirectUris = parseList(options.redirectUris);
   if (redirectUris.length === 0) {
-    logger.error(chalk.red('❌ At least one redirect URI is required. Use --redirect-uris <uri1,uri2,...>.'));
+    logger.error(formatBlockingError('At least one redirect URI is required. Use --redirect-uris <uri1,uri2,...>.'));
     process.exit(1);
   }
   const { controllerUrl, authConfig } = await resolveControllerAndAuth(options);
@@ -414,7 +415,7 @@ async function runServiceUserUpdateRedirectUris(options = {}) {
     return;
   }
   if (response && response.success === true) {
-    logger.log(chalk.green('✓ Service user redirect URIs updated.\n'));
+    logger.log(formatSuccessLine('Service user redirect URIs updated.\n'));
   }
 }