@aifabrix/builder 2.43.0 → 2.44.0

package/lib/utils/health-check.js

@@ -1,3 +1,4 @@
+const { formatSuccessLine } = require('./cli-test-layout-chalk');
 /**
  * Health Check Utilities
  *
@@ -9,13 +10,41 @@
  */
 
 const http = require('http');
+const https = require('https');
 const net = require('net');
 const chalk = require('chalk');
-const { exec } = require('child_process');
-const { promisify } = require('util');
 const logger = require('./logger');
+const { execWithDockerEnv } = require('./docker-exec');
+const { computeTraefikHealthCheckUrl } = require('./health-check-url');
 
-const execAsync = promisify(exec);
+/**
+ * Compute the health check URL for an app.
+ *
+ * - Default (no Traefik front-door): http://localhost:<port><healthPath>
+ * - With Traefik + app frontDoorRouting.enabled: <publicBase><frontDoorRouting.pattern><healthPath>
+ *
+ * @async
+ * @param {string} appName
+ * @param {number} healthCheckPort
+ * @param {Object|null} appConfig
+ * @param {Object} opts
+ * @param {Object} [opts.runOptions] - runApp options (may include env + effectiveEnvironmentScopedResources)
+ * @returns {Promise<string>}
+ */
+async function computeHealthCheckUrl(appName, healthCheckPort, appConfig, _opts = {}) {
+  const healthCheckPath = appConfig?.healthCheck?.path || '/health';
+
+  // Traefik front-door branch: probe via resolved public host + path (e.g. https://dev02.builder02.local/auth/health/ready)
+  try {
+    const traefikUrl = await computeTraefikHealthCheckUrl(appName, healthCheckPort, appConfig);
+    if (traefikUrl) return traefikUrl;
+  } catch {
+    // If any resolver step fails, fall back to localhost probing.
+  }
+
+  // Default: probe local published port.
+  return `http://localhost:${healthCheckPort}${healthCheckPath}`;
+}
 
 /**
  * Checks if db-init container exists and waits for it to complete
@@ -33,7 +62,7 @@ const execAsync = promisify(exec);
  */
 async function checkDbInitContainerExists(dbInitContainer) {
   try {
-    const { stdout } = await execAsync(`docker ps -a --filter "name=${dbInitContainer}" --format "{{.Names}}"`);
+    const { stdout } = await execWithDockerEnv(`docker ps -a --filter "name=${dbInitContainer}" --format "{{.Names}}"`);
     return stdout.trim() === dbInitContainer;
   } catch {
     return false;
@@ -48,7 +77,7 @@ async function checkDbInitContainerExists(dbInitContainer) {
  * @returns {Promise<string>} Exit code
  */
 async function getContainerExitCode(dbInitContainer) {
-  const { stdout: exitCode } = await execAsync(`docker inspect --format='{{.State.ExitCode}}' ${dbInitContainer}`);
+  const { stdout: exitCode } = await execWithDockerEnv(`docker inspect --format='{{.State.ExitCode}}' ${dbInitContainer}`);
   return exitCode.trim();
 }
 
@@ -60,11 +89,11 @@ async function getContainerExitCode(dbInitContainer) {
  * @returns {Promise<boolean>} True if handled (container already exited)
  */
 async function handleExitedContainer(dbInitContainer) {
-  const { stdout: status } = await execAsync(`docker inspect --format='{{.State.Status}}' ${dbInitContainer}`);
+  const { stdout: status } = await execWithDockerEnv(`docker inspect --format='{{.State.Status}}' ${dbInitContainer}`);
   if (status.trim() === 'exited') {
     const exitCode = await getContainerExitCode(dbInitContainer);
     if (exitCode === '0') {
-      logger.log(chalk.green('✓ Database initialization already completed'));
+      logger.log(formatSuccessLine('Database initialization already completed'));
     } else {
       logger.log(chalk.yellow(`⚠ Database initialization exited with code ${exitCode}`));
     }
@@ -82,11 +111,11 @@ async function handleExitedContainer(dbInitContainer) {
  */
 async function waitForContainerExit(dbInitContainer, maxAttempts) {
   for (let attempts = 0; attempts < maxAttempts; attempts++) {
-    const { stdout: currentStatus } = await execAsync(`docker inspect --format='{{.State.Status}}' ${dbInitContainer}`);
+    const { stdout: currentStatus } = await execWithDockerEnv(`docker inspect --format='{{.State.Status}}' ${dbInitContainer}`);
     if (currentStatus.trim() === 'exited') {
       const exitCode = await getContainerExitCode(dbInitContainer);
       if (exitCode === '0') {
-        logger.log(chalk.green('✓ Database initialization completed'));
+        logger.log(formatSuccessLine('Database initialization completed'));
       } else {
         logger.log(chalk.yellow(`⚠ Database initialization exited with code ${exitCode}`));
       }
@@ -135,7 +164,7 @@ async function getPortFromDockerInspect(appName, debug) {
   if (debug) {
     logger.log(chalk.gray(`[DEBUG] Executing: ${inspectCmd}`));
   }
-  const { stdout: portMapping } = await execAsync(inspectCmd);
+  const { stdout: portMapping } = await execWithDockerEnv(inspectCmd);
   const ports = portMapping.trim().split('\n').filter(p => p && p !== '');
   if (ports.length > 0) {
     const port = parseInt(ports[0], 10);
@@ -162,7 +191,7 @@ async function getPortFromDockerPs(appName, debug) {
   if (debug) {
     logger.log(chalk.gray(`[DEBUG] Fallback: Executing: ${psCmd}`));
   }
-  const { stdout: psOutput } = await execAsync(psCmd);
+  const { stdout: psOutput } = await execWithDockerEnv(psCmd);
   const portMatch = psOutput.match(/:(\d+)->/);
   if (!portMatch) {
     return null;
@@ -244,6 +273,7 @@ function handleHealthResponse(res, data, debug, resolve) {
 function doHealthCheckRequest(healthCheckUrl, debug, resolve, reject) {
   try {
     const urlObj = new URL(healthCheckUrl);
+    const transport = urlObj.protocol === 'https:' ? https : http;
     const options = {
       hostname: urlObj.hostname,
       port: urlObj.port || (urlObj.protocol === 'https:' ? 443 : 80),
@@ -254,10 +284,9 @@ function doHealthCheckRequest(healthCheckUrl, debug, resolve, reject) {
       logger.log(chalk.gray(`[DEBUG] Health check request: ${healthCheckUrl}`));
       logger.log(chalk.gray(`[DEBUG] Request options: ${JSON.stringify(options, null, 2)}`));
     }
-    // eslint-disable-next-line prefer-const
-    let timeoutId;
-    const req = http.request(options, (res) => {
-      clearTimeout(timeoutId);
+    const timer = { id: null };
+    const req = transport.request(options, (res) => {
+      clearTimeout(timer.id);
       let data = '';
       if (debug) {
         logger.log(chalk.gray(`[DEBUG] Response status code: ${res.statusCode}`));
@@ -268,13 +297,13 @@ function doHealthCheckRequest(healthCheckUrl, debug, resolve, reject) {
       });
       res.on('end', () => handleHealthResponse(res, data, debug, resolve));
     });
-    timeoutId = setTimeout(() => {
+    timer.id = setTimeout(() => {
       if (debug) logger.log(chalk.gray('[DEBUG] Health check request timeout after 5 seconds'));
       req.destroy();
       resolve(false);
     }, 5000);
     req.on('error', (error) => {
-      clearTimeout(timeoutId);
+      clearTimeout(timer.id);
       if (debug) logger.log(chalk.gray(`[DEBUG] Health check request error: ${error.message}`));
       resolve(false);
     });
@@ -341,16 +370,14 @@ async function determineHealthCheckPort(port, appName, debug) {
  * @returns {Object} Health check configuration
  */
 function buildHealthCheckConfig(healthCheckPort, config, timeout, debug) {
-  const healthCheckPath = config?.healthCheck?.path || '/health';
-  const healthCheckUrl = `http://localhost:${healthCheckPort}${healthCheckPath}`;
   const maxAttempts = timeout / 2;
 
+  // URL is computed later (may use Traefik public base).
   if (debug) {
-    logger.log(chalk.gray(`[DEBUG] Health check URL: ${healthCheckUrl}`));
     logger.log(chalk.gray(`[DEBUG] Timeout: ${timeout} seconds, Max attempts: ${maxAttempts}`));
   }
 
-  return { healthCheckUrl, maxAttempts };
+  return { maxAttempts };
 }
 
 /**
@@ -370,7 +397,7 @@ async function performHealthCheckAttempt(healthCheckUrl, attempt, maxAttempts, d
     }
     const healthCheckPassed = await checkHealthEndpoint(healthCheckUrl, debug);
     if (healthCheckPassed) {
-      logger.log(chalk.green('✓ Application is healthy'));
+      logger.log(formatSuccessLine('Application is healthy'));
       if (debug) {
         logger.log(chalk.gray(`[DEBUG] Health check passed after ${attempt + 1} attempt(s)`));
       }
@@ -384,11 +411,15 @@ async function performHealthCheckAttempt(healthCheckUrl, attempt, maxAttempts, d
   return false;
 }
 
-async function waitForHealthCheck(appName, timeout = 90, port = null, config = null, debug = false) {
+async function waitForHealthCheck(appName, timeout = 90, port = null, config = null, debug = false, runOptions = {}) {
   await waitForDbInit(appName);
 
   const healthCheckPort = await determineHealthCheckPort(port, appName, debug);
-  const { healthCheckUrl, maxAttempts } = buildHealthCheckConfig(healthCheckPort, config, timeout, debug);
+  const { maxAttempts } = buildHealthCheckConfig(healthCheckPort, config, timeout, debug);
+  const healthCheckUrl = await computeHealthCheckUrl(appName, healthCheckPort, config, { runOptions });
+  if (debug) {
+    logger.log(chalk.gray(`[DEBUG] Health check URL: ${healthCheckUrl}`));
+  }
 
   for (let attempts = 0; attempts < maxAttempts; attempts++) {
     const passed = await performHealthCheckAttempt(healthCheckUrl, attempts, maxAttempts, debug);
@@ -426,6 +457,9 @@ async function checkPortAvailable(port) {
 module.exports = {
   waitForHealthCheck,
   checkHealthEndpoint,
-  checkPortAvailable
+  checkPortAvailable,
+  computeHealthCheckUrl,
+  // Re-exported for tests and shared usage.
+  normalizeFrontDoorPatternForHealth: require('./health-check-url').normalizeFrontDoorPatternForHealth
 };
 

package/lib/utils/help-builder.js

@@ -12,7 +12,7 @@ const { Help } = require('commander');
 
 /**
  * Command categories and order. Each command can have an optional `term` override
- * for the help line (e.g. "down [app]"); otherwise the command name is used.
+ * for the help line (e.g. "down [service|app]"); otherwise the command name is used.
  *
  * @type {Array<{ name: string, commands: Array<{ name: string, term?: string }> }>}
  */
@@ -24,10 +24,10 @@ const CATEGORIES = [
       { name: 'up-platform' },
       { name: 'up-miso' },
       { name: 'up-dataplane' },
-      { name: 'down-infra', term: 'down-infra [app]' },
+      { name: 'down-infra', term: 'down-infra [service|app]' },
       { name: 'doctor' },
       { name: 'status' },
-      { name: 'restart', term: 'restart <service>' }
+      { name: 'restart', term: 'restart <service|app>' }
     ]
   },
   {
@@ -82,18 +82,19 @@ const CATEGORIES = [
       { name: 'json', term: 'json <app>' },
       { name: 'split-json', term: 'split-json <app>' },
       { name: 'convert', term: 'convert <app>' },
-      { name: 'show', term: 'show <appKey>' },
+      { name: 'show', term: 'show <app>' },
       { name: 'validate', term: 'validate <appOrFile>' },
+      { name: 'parameters', term: 'parameters validate' },
       { name: 'diff', term: 'diff <file1> <file2>' }
     ]
   },
   {
     name: 'External Systems',
     commands: [
-      { name: 'download', term: 'download <system-key>' },
-      { name: 'upload', term: 'upload <system-key>' },
-      { name: 'delete', term: 'delete <system-key>' },
-      { name: 'repair', term: 'repair <app>' },
+      { name: 'download', term: 'download <systemKey>' },
+      { name: 'upload', term: 'upload <systemKey>' },
+      { name: 'delete', term: 'delete <systemKey>' },
+      { name: 'repair', term: 'repair <systemKey>' },
       { name: 'datasource' },
       { name: 'test', term: 'test <app>' },
       { name: 'test-e2e', term: 'test-e2e <app>' },
@@ -182,6 +183,8 @@ function formatCommandCategories(helper, program) {
   out.push('Help:');
   out.push(`  ${'help [command]'.padEnd(pad)}display help for command`);
   out.push('');
+  out.push(`  ${''.padEnd(pad)}Tip: aifabrix <command> --help for flags and examples`);
+  out.push('');
   return out;
 }
 

package/lib/utils/image-version.js

@@ -9,15 +9,12 @@
  * @version 2.0.0
  */
 
-const { exec } = require('child_process');
-const { promisify } = require('util');
 const { getBuilderPath } = require('./paths');
 const { resolveApplicationConfigPath } = require('./app-config-resolver');
 const { loadConfigFile, writeConfigFile } = require('./config-format');
-const composeGenerator = require('./compose-generator');
 const containerHelpers = require('./app-run-containers');
-
-const execAsync = promisify(exec);
+const { resolveDockerImageRef } = require('./resolve-docker-image-ref');
+const { execWithDockerEnv } = require('./docker-exec');
 
 const OCI_VERSION_LABEL = 'org.opencontainers.image.version';
 const SEMVER_REGEX = /^v?(\d+\.\d+\.\d+)(?:-[-.\w]+)?(?:\+[-.\w]+)?$/i;
@@ -38,7 +35,7 @@ async function getVersionFromImage(imageName, imageTag) {
 
   try {
     const labelFormat = `{{index .Config.Labels "${OCI_VERSION_LABEL}"}}`;
-    const { stdout } = await execAsync(
+    const { stdout } = await execWithDockerEnv(
       `docker inspect --format '${labelFormat}' "${fullImage}" 2>/dev/null || true`,
       { timeout: 10000 }
     );
@@ -139,8 +136,7 @@ async function resolveVersionForApp(appName, variables, options = {}) {
     return { version, fromImage: false, updated: false };
   }
 
-  const imageName = composeGenerator.getImageName(variables, appName);
-  const imageTag = variables?.image?.tag || 'latest';
+  const { imageName, imageTag } = resolveDockerImageRef(appName, variables, {});
   const imageExists = await containerHelpers.checkImageExists(imageName, imageTag);
 
   if (!imageExists) {

package/lib/utils/infra-containers.js

@@ -9,11 +9,8 @@
  * @version 2.0.0
  */
 
-const { exec } = require('child_process');
-const { promisify } = require('util');
 const config = require('../core/config');
-
-const execAsync = promisify(exec);
+const { execWithDockerEnv } = require('./docker-exec');
 
 /**
  * Finds container by name pattern
@@ -42,7 +39,7 @@ async function findContainer(serviceName, devId = null, options = {}) {
       ];
 
     for (const pattern of patternsToTry) {
-      const { stdout } = await execAsync(`docker ps --filter "name=${pattern}" --format "{{.Names}}"`);
+      const { stdout } = await execWithDockerEnv(`docker ps --filter "name=${pattern}" --format "{{.Names}}"`);
       const names = stdout
         .split('\n')
         .map(s => s.trim())
@@ -75,7 +72,7 @@ async function checkServiceWithHealthCheck(serviceName, devId = null, options =
     if (!containerName) {
       return 'unknown';
     }
-    const { stdout } = await execAsync(`docker inspect --format='{{.State.Health.Status}}' ${containerName}`);
+    const { stdout } = await execWithDockerEnv(`docker inspect --format='{{.State.Health.Status}}' ${containerName}`);
     const status = stdout.trim().replace(/['"]/g, '');
     // Accept both 'healthy' and 'starting' as healthy (starting means it's initializing)
     return (status === 'healthy' || status === 'starting') ? 'healthy' : status;
@@ -99,7 +96,7 @@ async function checkServiceWithoutHealthCheck(serviceName, devId = null, options
     if (!containerName) {
       return 'unknown';
     }
-    const { stdout } = await execAsync(`docker inspect --format='{{.State.Status}}' ${containerName}`);
+    const { stdout } = await execWithDockerEnv(`docker inspect --format='{{.State.Status}}' ${containerName}`);
     const status = stdout.trim().replace(/['"]/g, '');
     // Treat 'running' or 'healthy' as 'healthy' for services without health checks
     return (status === 'running' || status === 'healthy') ? 'healthy' : 'unhealthy';

package/lib/utils/infra-env-defaults.js

@@ -0,0 +1,162 @@
+/**
+ * Canonical env defaults for docker/local interpolation (formerly lib/schema/env-config.yaml).
+ *
+ * @fileoverview Infra-only vs app-service layers merged for backward compatibility.
+ *   True infra: DB, Redis, runtime. App rows (MISO_*, DATAPLANE_*, …) are a separate object
+ *   so policy and future YAML-only sourcing stay clear — see APP_SERVICE_ENV_DEFAULTS.
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const { buildAppServiceEnvOverlay } = require('./app-service-env-from-builder');
+
+/**
+ * @param {string|null|undefined} projectRoot
+ * @returns {string}
+ */
+function resolveProjectRootForEnvDefaults(projectRoot) {
+  if (projectRoot !== undefined && projectRoot !== null) {
+    return projectRoot;
+  }
+  try {
+    const { getProjectRoot } = require('./paths');
+    if (typeof getProjectRoot === 'function') {
+      return getProjectRoot();
+    }
+  } catch {
+    // ignore
+  }
+  return process.cwd();
+}
+
+/** Docker profile: databases, cache, process env only (no application services). */
+const INFRA_ENV_DEFAULTS_DOCKER = Object.freeze({
+  DB_HOST: 'postgres',
+  DB_PORT: 5432,
+  REDIS_HOST: 'redis',
+  REDIS_PORT: 6379,
+  NODE_ENV: 'production',
+  PYTHONUNBUFFERED: 1,
+  PYTHONDONTWRITEBYTECODE: 1,
+  PYTHONIOENCODING: 'utf-8'
+});
+
+/** Local profile: same infra shape as docker with localhost hosts. */
+const INFRA_ENV_DEFAULTS_LOCAL = Object.freeze({
+  DB_HOST: 'localhost',
+  DB_PORT: 5432,
+  REDIS_HOST: 'localhost',
+  REDIS_PORT: 6379,
+  NODE_ENV: 'development',
+  PYTHONUNBUFFERED: 1,
+  PYTHONDONTWRITEBYTECODE: 1,
+  PYTHONIOENCODING: 'utf-8'
+});
+
+/**
+ * Default *_HOST / *_PORT / *_PUBLIC_PORT for known stack apps.
+ * Prefer application.yaml + url:// for URLs; these support ${VAR} interpolation until templates migrate.
+ */
+const APP_SERVICE_ENV_DEFAULTS_DOCKER = Object.freeze({
+  MISO_HOST: 'miso-controller',
+  MISO_PORT: 3000,
+  MISO_PUBLIC_PORT: 3000,
+  KEYCLOAK_HOST: 'keycloak',
+  KEYCLOAK_PORT: 8080,
+  KEYCLOAK_PUBLIC_PORT: 8082,
+  MORI_HOST: 'mori-controller',
+  MORI_PORT: 3004,
+  OPENWEBUI_HOST: 'openwebui',
+  OPENWEBUI_PORT: 3003,
+  FLOWISE_HOST: 'flowise',
+  FLOWISE_PORT: 3002,
+  DATAPLANE_HOST: 'dataplane',
+  DATAPLANE_PORT: 3001,
+  DATAPLANE_PUBLIC_PORT: 3001
+});
+
+const APP_SERVICE_ENV_DEFAULTS_LOCAL = Object.freeze({
+  MISO_HOST: 'localhost',
+  MISO_PORT: 3010,
+  MISO_PUBLIC_PORT: 3010,
+  KEYCLOAK_HOST: 'localhost',
+  KEYCLOAK_PORT: 8082,
+  KEYCLOAK_PUBLIC_PORT: 8082,
+  MORI_HOST: 'localhost',
+  MORI_PORT: 3014,
+  OPENWEBUI_HOST: 'localhost',
+  OPENWEBUI_PORT: 3013,
+  FLOWISE_HOST: 'localhost',
+  FLOWISE_PORT: 3012,
+  DATAPLANE_HOST: 'localhost',
+  DATAPLANE_PORT: 3011,
+  DATAPLANE_PUBLIC_PORT: 3011
+});
+
+/**
+ * @param {Record<string, unknown>} a
+ * @param {Record<string, unknown>} b
+ * @returns {Record<string, unknown>}
+ */
+function shallowMergeEnv(a, b) {
+  return { ...a, ...b };
+}
+
+/**
+ * Merged env-config shape (infra + static app fallbacks + per-app builder manifest overlay).
+ * @param {string|null|undefined} [projectRoot] - When omitted, uses paths getProjectRoot or process.cwd().
+ * @returns {Object}
+ */
+function buildMergedDefaultEnvConfig(projectRoot) {
+  const root = resolveProjectRootForEnvDefaults(projectRoot);
+  const overlay = buildAppServiceEnvOverlay(root);
+  return {
+    environments: {
+      docker: shallowMergeEnv(
+        shallowMergeEnv(
+          { ...INFRA_ENV_DEFAULTS_DOCKER },
+          { ...APP_SERVICE_ENV_DEFAULTS_DOCKER }
+        ),
+        overlay.docker
+      ),
+      local: shallowMergeEnv(
+        shallowMergeEnv(
+          { ...INFRA_ENV_DEFAULTS_LOCAL },
+          { ...APP_SERVICE_ENV_DEFAULTS_LOCAL }
+        ),
+        overlay.local
+      )
+    }
+  };
+}
+
+/**
+ * Deep clone of default env-config (docker/local hosts and ports).
+ * @param {string|null|undefined} [projectRoot] - Optional workspace root for builder/ scan.
+ * @returns {Object}
+ */
+function getDefaultEnvConfig(projectRoot) {
+  return JSON.parse(JSON.stringify(buildMergedDefaultEnvConfig(projectRoot)));
+}
+
+/**
+ * Infra-only defaults for declarative url:// resolution and registry fallbacks.
+ * Application manifests should set `port` / `frontDoorRouting`; these apply when omitted.
+ */
+const DECLARATIVE_URL_INFRA_DEFAULTS = Object.freeze({
+  manifestPortFallback: 3000,
+  frontDoorPatternWhenUnspecified: '/',
+  inactiveVdirPublicEnvReplacement: '/'
+});
+
+module.exports = {
+  getDefaultEnvConfig,
+  buildMergedDefaultEnvConfig,
+  INFRA_ENV_DEFAULTS_DOCKER,
+  INFRA_ENV_DEFAULTS_LOCAL,
+  APP_SERVICE_ENV_DEFAULTS_DOCKER,
+  APP_SERVICE_ENV_DEFAULTS_LOCAL,
+  DECLARATIVE_URL_INFRA_DEFAULTS
+};

package/lib/utils/infra-status-display.js

@@ -0,0 +1,167 @@
+/**
+ * Shared output for `aifabrix status`: title + configuration block.
+ * TLS/SSL (`infraTlsSslCell`) and `devNN` title match `dev-show-display.js`; environment, Traefik,
+ * and scoped-resources lines use uppercase ON/OFF-style labels for status output.
+ *
+ * @fileoverview Infra status CLI display helpers
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const config = require('../core/config');
+const logger = require('./logger');
+
+/** En dash for unset / empty values (same as dev-show-display). */
+const EM = '\u2013';
+const LABEL_W = 18;
+
+/**
+ * @param {unknown} v
+ * @returns {boolean}
+ */
+function isUnset(v) {
+  return v === null || v === undefined || v === '';
+}
+
+/**
+ * @param {unknown} v
+ * @returns {string}
+ */
+function cell(v) {
+  return isUnset(v) ? EM : String(v);
+}
+
+/**
+ * @param {string} label
+ * @param {unknown} value
+ */
+function logPaddedFieldRow(label, value) {
+  logger.log(`  ${label.padEnd(LABEL_W)} ${cell(value)}`);
+}
+
+/**
+ * @param {string|null|undefined} remoteUrl
+ * @returns {string}
+ */
+function hostFromRemoteUrl(remoteUrl) {
+  if (!remoteUrl || typeof remoteUrl !== 'string') {
+    return '';
+  }
+  try {
+    const u = new URL(remoteUrl.trim());
+    return u.hostname || '';
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * @param {string} devIdStr
+ * @returns {string} e.g. dev02
+ */
+function devProfileHandle(devIdStr) {
+  const s = String(devIdStr);
+  if (/^[0-9]+$/.test(s)) {
+    return `dev${s.padStart(2, '0')}`;
+  }
+  return `dev${s}`;
+}
+
+/**
+ * Infra / compose TLS mode from ~/.aifabrix `tlsEnabled` (not Docker TLS verify).
+ * @param {boolean} tlsEnabled
+ * @returns {string}
+ */
+function infraTlsSslCell(tlsEnabled) {
+  return tlsEnabled ? 'ON 🔒' : 'OFF 🕐';
+}
+
+/**
+ * Traefik proxy row (`traefik: true` in config). Icons only (no ANSI color).
+ * @param {boolean} traefikEnabled
+ * @returns {string}
+ */
+function statusTraefikProxyCell(traefikEnabled) {
+  return traefikEnabled ? 'ON 🟢' : 'OFF 🟡';
+}
+
+/**
+ * Environment for status (uppercase).
+ * @param {unknown} environment
+ * @returns {string}
+ */
+function formatStatusEnvironment(environment) {
+  if (isUnset(environment)) {
+    return EM;
+  }
+  return String(environment).trim().toUpperCase();
+}
+
+/**
+ * Scoped resources for status: ON vs OFF (DEFAULT).
+ * @param {boolean} useScoped
+ * @returns {string}
+ */
+function statusScopedResourcesCell(useScoped) {
+  return useScoped ? 'ON' : 'OFF (DEFAULT)';
+}
+
+/**
+ * Single-line title for `aifabrix status` (same dev profile + remote host pattern as dev show).
+ * @param {string} devIdStr
+ * @param {string|null|undefined} remoteServer
+ * @returns {string}
+ */
+function formatInfraStatusTitleLine(devIdStr, remoteServer) {
+  const who = devProfileHandle(devIdStr);
+  const host = hostFromRemoteUrl(remoteServer);
+  if (host) {
+    return `📊 Infrastructure Status (${who} @ ${host})`;
+  }
+  return `📊 Infrastructure Status (${who})`;
+}
+
+/**
+ * @param {{ remoteServer: string|null|undefined, tlsEnabled: boolean, environment: unknown, useScoped: boolean, traefikEnabled: boolean }} p
+ */
+function logInfraStatusConfigurationSummary(p) {
+  logger.log('⚙️ Configuration');
+  logPaddedFieldRow('Server', p.remoteServer);
+  logPaddedFieldRow('TLS/SSL', infraTlsSslCell(p.tlsEnabled));
+  logPaddedFieldRow('Traefik proxy', statusTraefikProxyCell(p.traefikEnabled));
+  logPaddedFieldRow('Environment', formatStatusEnvironment(p.environment));
+  logPaddedFieldRow('Scoped resources', statusScopedResourcesCell(p.useScoped));
+  logger.log('');
+}
+
+/**
+ * @returns {Promise<{ devIdStr: string, remoteServer: string|null|undefined, tlsEnabled: boolean, environment: unknown, useScoped: boolean, traefikEnabled: boolean }>}
+ */
+async function loadInfraStatusSummary() {
+  const [rawDevId, environment, tlsEnabled, remoteServer, useScoped, traefikEnabled] = await Promise.all([
+    config.getDeveloperId(),
+    config.getCurrentEnvironment(),
+    config.getTlsEnabled(),
+    config.getRemoteServer(),
+    config.getUseEnvironmentScopedResources(),
+    config.getTraefikEnabled()
+  ]);
+  const devIdStr = rawDevId === null || rawDevId === undefined ? '0' : String(rawDevId);
+  return {
+    devIdStr,
+    environment,
+    tlsEnabled,
+    remoteServer,
+    useScoped,
+    traefikEnabled
+  };
+}
+
+module.exports = {
+  loadInfraStatusSummary,
+  formatInfraStatusTitleLine,
+  logInfraStatusConfigurationSummary,
+  logPaddedFieldRow
+};