@aifabrix/builder 2.44.5 → 2.44.6

package/lib/commands/datasource-capability.js

@@ -0,0 +1,411 @@
+/**
+ * Datasource capability subcommands (copy, remove, create, diff, edit, validate).
+ *
+ * @fileoverview Nested `aifabrix datasource capability` CLI (copy, relate, …)
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+const fs = require('fs');
+const logger = require('../utils/logger');
+const {
+  formatBlockingError,
+  formatSuccessLine,
+  headerKeyValue,
+  infoLine,
+  metadata
+} = require('../utils/cli-test-layout-chalk');
+const { validateDatasourceFile, resolveValidateInputPath } = require('../datasource/validate');
+const { runCapabilityCopy } = require('../datasource/capability/run-capability-copy');
+const { runCapabilityRemove } = require('../datasource/capability/run-capability-remove');
+const { runCapabilityDiff } = require('../datasource/capability/run-capability-diff');
+const { runCapabilityEdit } = require('../datasource/capability/run-capability-edit');
+const { checkCapabilitySlices } = require('../datasource/capability/validate-capability-slice');
+const { logDatasourceValidateOutcome } = require('../datasource/datasource-validate-display');
+const pathMod = require('path');
+const { printCapabilitySuccessFooter } = require('./datasource-capability-output');
+const { setupCapabilityRelateCommand } = require('./datasource-capability-relate-cli');
+const { setupCapabilityDimensionCommand } = require('./datasource-capability-dimension-cli');
+
+const CAP_COPY_HELP = `
+Examples:
+  $ aifabrix datasource capability copy test-e2e-hubspot-companies --from create --as createBasicTrial --dry-run
+  $ af datasource cap copy integration/myapp/x-datasource-y.json --from list --as listVerbose --dry-run
+
+When exposed.profiles.<from> exists it is copied to exposed.profiles.<as>.
+With --test, matching testPayload.scenarios rows (same operation as the source capability / openapi / CIP keys) are cloned with operation set to --as.
+
+Next step after mutating:  aifabrix datasource validate <file-or-key>
+`;
+
+const CAP_CREATE_HELP = `
+Requires exactly one source: **--from**, **--template**, or **--openapi-operation**.
+
+**--from** clones openapi/CIP/profile like **capability copy**. **--openapi-operation** finds an existing **openapi.operations** entry by **operationId** and clones it with a minimal CIP fetch step. **--template** loads **lib/datasource/capability/templates/[name].json** (built-in **minimal-fetch**).
+
+  $ aifabrix datasource capability create my-datasource-key --from list --as listAlt
+  $ af datasource cap create ./x.json --openapi-operation get-crm-v3-objects-contacts --as listContacts
+  $ af datasource cap create ./x.json --template minimal-fetch --as probeRead
+`;
+
+const CAP_VALIDATE_HELP = `
+  $ aifabrix datasource capability validate test-e2e-hubspot-companies
+  $ af datasource cap validate ./integration/x/y-datasource-z.json --capability create
+`;
+
+const CAP_REMOVE_HELP = `
+Examples:
+  $ aifabrix datasource capability remove test-e2e-hubspot-companies --capability createCliGolden --dry-run
+  $ af datasource cap remove ./integration/x/datasource.json --capability list
+
+Next:  aifabrix datasource validate <file-or-key>
+`;
+
+const CAP_DIFF_HELP = `
+Compare OpenAPI + CIP slices (and optional exposed.profiles) for one capability between two files.
+
+  $ aifabrix datasource capability diff ./before.json ./after.json --capability create
+  $ af datasource cap diff a.json b.json --capability-a list --capability-b listVerbose --profile list
+`;
+
+const CAP_EDIT_HELP = `
+Uses $VISUAL or $EDITOR for the JSON editor; if both are unset and **nano** is on PATH, nano is used.
+
+When **--section profile**, if **exposed.profiles** has a row for the capability you picked (interactive or **-c**), that row opens directly—no “which profile?” list. Use **--profile <key>** to edit a different row. Override the editor for one run: **--editor nano**.
+
+  $ aifabrix datasource capability edit my-datasource-key --capability create --section openapi
+  $ af datasource cap edit my-datasource-key -c updateAddress --section profile
+`;
+
+/**
+ * Copy/create from CLI: always calls copy with basicExposure false (not exposed on CLI).
+ *
+ * @param {string} fileOrKey
+ * @param {object} options - Commander options
+ * @returns {Promise<void>}
+ */
+async function runCopyLikeAction(fileOrKey, options) {
+  const result = await runCapabilityCopy({
+    fileOrKey,
+    from: options.from,
+    as: options.as,
+    dryRun: Boolean(options.dryRun),
+    overwrite: Boolean(options.overwrite),
+    noBackup: Boolean(options.noBackup),
+    basicExposure: false,
+    includeTestPayload: Boolean(options.test),
+    openApiOperationId: options.openapiOperation,
+    template: options.template
+  });
+
+  if (result.dryRun) {
+    logger.log(infoLine('Dry run — planned JSON Patch operations:'));
+    logger.log('');
+    logger.log(JSON.stringify(result.patchOperations, null, 2));
+    return;
+  }
+
+  if (result.backupPath) {
+    logger.log(headerKeyValue('Backup:', result.backupPath));
+  }
+  printCapabilitySuccessFooter(result.resolvedPath, result.updatedSections);
+}
+
+/**
+ * @param {string} fileOrKey
+ * @param {object} options - Commander options
+ * @returns {Promise<void>}
+ */
+async function runRemoveAction(fileOrKey, options) {
+  const result = await runCapabilityRemove({
+    fileOrKey,
+    capability: options.capability,
+    dryRun: Boolean(options.dryRun),
+    noBackup: Boolean(options.noBackup),
+    force: Boolean(options.force)
+  });
+
+  if (result.dryRun) {
+    logger.log(infoLine('Dry run — planned JSON Patch operations:'));
+    logger.log('');
+    logger.log(JSON.stringify(result.patchOperations, null, 2));
+    if (!result.removed) {
+      logger.log(metadata('(no changes; capability already absent)'));
+    }
+    return;
+  }
+
+  if (result.backupPath) {
+    logger.log(headerKeyValue('Backup:', result.backupPath));
+  }
+  const heading = result.removed ? 'Removed' : 'Unchanged';
+  printCapabilitySuccessFooter(result.resolvedPath, result.updatedSections, heading);
+}
+
+/**
+ * @param {import('commander').Command} cap - capability command group
+ * @returns {void}
+ */
+function setupCapabilityCopyCommand(cap) {
+  cap.command('copy <file-or-key>')
+    .description(
+      'Clone openapi + CIP operations (lowercase keys), profiles (--as casing); optional --test for scenarios'
+    )
+    .requiredOption('--from <key>', 'Source capability key (must exist)')
+    .requiredOption('--as <key>', 'Target capability key (must be unique unless --overwrite)')
+    .option('--dry-run', 'Print JSON Patch operations; do not write')
+    .option('--overwrite', 'Replace target capability and matching exposed.profiles.<as> if present')
+    .option('--no-backup', 'Skip backup copy under integration/<app>/backup/')
+    .option(
+      '--test',
+      'Also clone testPayload.scenarios rows whose operation matches the source capability'
+    )
+    .addHelpText('after', CAP_COPY_HELP)
+    .action(async(fileOrKey, options) => {
+      try {
+        await runCopyLikeAction(fileOrKey, options);
+      } catch (error) {
+        logger.error(formatBlockingError(`capability copy failed: ${error.message}`));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} cap
+ * @returns {void}
+ */
+function setupCapabilityRemoveCommand(cap) {
+  cap.command('remove <file-or-key>')
+    .description(
+      'Remove one capability (capabilities[], openapi.operations, execution.cip.operations), exposed.profiles.<key>, and matching testPayload.scenarios rows'
+    )
+    .requiredOption('-c, --capability <key>', 'Capability key to delete')
+    .option('--dry-run', 'Print JSON Patch operations; do not write')
+    .option('--no-backup', 'Skip backup copy under integration/<app>/backup/')
+    .option('--force', 'Succeed if capability is already absent (no file change)')
+    .addHelpText('after', CAP_REMOVE_HELP)
+    .action(async(fileOrKey, options) => {
+      try {
+        await runRemoveAction(fileOrKey, options);
+      } catch (error) {
+        logger.error(formatBlockingError(`capability remove failed: ${error.message}`));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} cap
+ * @returns {void}
+ */
+function setupCapabilityCreateCommand(cap) {
+  const createCmd = cap
+    .command('create <file-or-key>')
+    .description(
+      'Create capability: exactly one of --from, --template, or --openapi-operation (alias: add)'
+    );
+  if (typeof createCmd.alias === 'function') {
+    createCmd.alias('add');
+  }
+  createCmd
+    .requiredOption('--as <key>', 'New capability key (must be unique unless --overwrite)')
+    .option('--from <key>', 'Clone from an existing capability (same as capability copy)')
+    .option(
+      '--openapi-operation <operationId>',
+      'Match openapi.operations[].operationId in this file; minimal CIP fetch step'
+    )
+    .option('--template <name>', 'Built-in templates under capability/templates (e.g. minimal-fetch)')
+    .option('--dry-run', 'Print JSON Patch operations; do not write')
+    .option('--overwrite', 'Replace target capability and matching exposed.profiles.<as> if present')
+    .option('--no-backup', 'Skip backup')
+    .option(
+      '--test',
+      'With --from: clone testPayload.scenarios rows whose operation matches the source capability'
+    )
+    .addHelpText('after', CAP_CREATE_HELP)
+    .action(async(fileOrKey, options) => {
+      try {
+        await runCopyLikeAction(fileOrKey, options);
+      } catch (error) {
+        logger.error(formatBlockingError(`capability create failed: ${error.message}`));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} cap
+ * @returns {void}
+ */
+function setupCapabilityDiffCommand(cap) {
+  cap
+    .command('diff <file-a> <file-b>')
+    .description(
+      'Compare capability slices between two datasource JSON files (optional exposed.profiles profile)'
+    )
+    .option(
+      '-c, --capability <key>',
+      'Capability key on both sides (use --capability-a/b to compare different keys)'
+    )
+    .option('--capability-a <key>', 'Capability key in first file')
+    .option('--capability-b <key>', 'Capability key in second file')
+    .option('--profile <name>', 'Include exposed.profiles.<name> on both sides')
+    .option('--profile-a <name>', 'Profile key for first file')
+    .option('--profile-b <name>', 'Profile key for second file')
+    .addHelpText('after', CAP_DIFF_HELP)
+    .action(async(fileA, fileB, options) => {
+      try {
+        const { identical } = runCapabilityDiff({
+          fileA,
+          fileB,
+          capability: options.capability,
+          capabilityA: options.capabilityA,
+          capabilityB: options.capabilityB,
+          profile: options.profile,
+          profileA: options.profileA,
+          profileB: options.profileB
+        });
+        if (!identical) {
+          process.exit(1);
+        }
+      } catch (error) {
+        logger.error(formatBlockingError(`capability diff failed: ${error.message}`));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} cap
+ * @returns {void}
+ */
+function setupCapabilityEditCommand(cap) {
+  cap
+    .command('edit <file-or-key>')
+    .description(
+      'Interactively edit openapi/cip/exposed profile JSON for one capability (TTY + $EDITOR / nano)'
+    )
+    .option('-c, --capability <key>', 'Capability key (skip prompt)')
+    .option('--section <name>', 'openapi | cip | profile (skip prompt)')
+    .option('--profile <name>', 'When section=profile, exposed.profiles key (skip prompt)')
+    .option('--editor <cmd>', 'Editor command for this run (sets VISUAL and EDITOR)')
+    .option('--no-backup', 'Skip backup copy under integration/<app>/backup/')
+    .addHelpText('after', CAP_EDIT_HELP)
+    .action(async(fileOrKey, options) => {
+      try {
+        const editorArg = options.editor !== undefined && options.editor !== null ? String(options.editor).trim() : '';
+        if (editorArg) {
+          process.env.VISUAL = editorArg;
+          process.env.EDITOR = editorArg;
+        }
+        const section = normalizeCapabilityEditSection(options.section);
+        const result = await runCapabilityEdit({
+          fileOrKey,
+          capability: options.capability,
+          section,
+          profile: options.profile,
+          noBackup: Boolean(options.noBackup)
+        });
+        if (result.backupPath) {
+          logger.log(headerKeyValue('Backup:', result.backupPath));
+        }
+        printCapabilitySuccessFooter(result.resolvedPath, ['Saved capability slice JSON'], 'Updated');
+      } catch (error) {
+        logger.error(formatBlockingError(`capability edit failed: ${error.message}`));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} cap
+ * @returns {void}
+ */
+function setupCapabilityValidateCommand(cap) {
+  cap.command('validate <file-or-key>')
+    .description('Validate datasource JSON; optional --capability slice presence check')
+    .option('-c, --capability <key>', 'Ensure capability exists in openapi + cip + capabilities[]')
+    .addHelpText('after', CAP_VALIDATE_HELP)
+    .action(async(fileOrKey, options) => {
+      try {
+        const trimmed = fileOrKey.trim();
+        const result = await validateDatasourceFile(trimmed);
+        const resolvedPath = result.resolvedPath;
+        const argResolved = pathMod.resolve(trimmed);
+        const showMapping = resolvedPath && argResolved !== resolvedPath && trimmed !== resolvedPath;
+        logDatasourceValidateOutcome(result, trimmed, showMapping);
+
+        if (!result.valid) {
+          process.exit(1);
+        }
+
+        if (options.capability) {
+          const readPath = resolveValidateInputPath(trimmed);
+          const parsed = JSON.parse(fs.readFileSync(readPath, 'utf8'));
+          const slice = checkCapabilitySlices(parsed, options.capability);
+          if (slice.missing.length > 0) {
+            logger.error(
+              formatBlockingError(
+                `Capability "${slice.key}" incomplete: ${slice.missing.join('; ')}`
+              )
+            );
+            process.exit(1);
+          }
+          logger.log(formatSuccessLine(`Capability slice OK: ${slice.key}`));
+        }
+      } catch (error) {
+        logger.error(formatBlockingError(`capability validate failed: ${error.message}`));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * Normalize `--section` for capability edit (openapi | cip | profile).
+ *
+ * @param {unknown} raw - Commander option value
+ * @returns {'openapi'|'cip'|'profile'|undefined}
+ * @throws {Error} When value is non-empty but not allowed
+ */
+function normalizeCapabilityEditSection(raw) {
+  const sec = raw !== undefined && raw !== null ? String(raw).trim().toLowerCase() : '';
+  if (sec && !['openapi', 'cip', 'profile'].includes(sec)) {
+    throw new Error('--section must be openapi, cip, or profile');
+  }
+  return sec || undefined;
+}
+
+/**
+ * Register nested datasource capability commands.
+ *
+ * @param {import('commander').Command} datasource - datasource command group
+ * @returns {void}
+ */
+function setupDatasourceCapabilityCommands(datasource) {
+  const cap = datasource
+    .command('capability')
+    .description(
+      'Copy, remove, relate (FK metadata), diff, edit, or validate per-capability slices in datasource JSON'
+    );
+  if (typeof cap.alias === 'function') {
+    cap.alias('cap');
+  }
+
+  setupCapabilityCopyCommand(cap);
+  setupCapabilityRemoveCommand(cap);
+  setupCapabilityCreateCommand(cap);
+  setupCapabilityRelateCommand(cap);
+  setupCapabilityDimensionCommand(cap);
+  setupCapabilityDiffCommand(cap);
+  setupCapabilityEditCommand(cap);
+  setupCapabilityValidateCommand(cap);
+}
+
+module.exports = {
+  setupDatasourceCapabilityCommands,
+  printCapabilitySuccessFooter,
+  runCopyLikeAction,
+  runRemoveAction,
+  normalizeCapabilityEditSection
+};

package/lib/commands/datasource-unified-test-cli.options.js

@@ -125,7 +125,7 @@ function attachDatasourceTestCommonOptions(cmd, opts) {
     )
     .option(
       '--sync',
-      'Publish this datasource JSON from disk to the dataplane before running the test (requires login / same auth as upload)'
+      'Publish local integration config to the dataplane before running the test (same as aifabrix upload <systemKey>; requires login)'
     )
     .option('--json', 'Print raw DatasourceTestRun JSON to stdout')
     .option('--summary', 'Print compact summary line')

package/lib/commands/datasource.js

@@ -23,16 +23,28 @@ const {
   setupDatasourceTestIntegrationCommand,
   setupDatasourceTestE2ECommand
 } = require('./datasource-unified-test-cli');
+const { setupDatasourceCapabilityCommands } = require('./datasource-capability');
 
+/**
+ * Parent help only. Commander already prints the full "Commands:" list; do not duplicate it here.
+ * Use examples + alias note so `af datasource -h` stays short and non-repetitive.
+ */
 const DATASOURCE_HELP_AFTER = `
-Subcommands:
-  validate <file-or-key>       Validate datasource JSON (path or datasource key under integration/<app>/)
-  list                         List datasources (env from config)
-  upload <file-or-key>         Deploy one datasource JSON to the dataplane (path or key; systemKey in file)
-  diff                         Compare two datasource JSON files
-  test <key>                   Structural/policy validation via unified dataplane API (DatasourceTestRun)
-  test-integration / test-e2e  Integration or E2E run via the same unified validation API
-  log-test / log-integration / log-e2e  Show saved debug logs (structural, integration, E2E)
+
+Examples:
+  $ aifabrix datasource validate integration/<app>/<app>-datasource-contacts.json
+  $ aifabrix datasource list
+  $ aifabrix datasource list test                   # only datasource keys starting with "test"
+  $ af ds upload <datasourceKey>                    # same as: aifabrix datasource upload …
+  $ af ds test <datasourceKey> --app <integrationFolder> --debug
+  $ af ds test-e2e <datasourceKey> --app <integrationFolder> -v
+  $ aifabrix datasource capability copy <file-or-key> --from create --as createBasicTrial --dry-run
+  $ aifabrix datasource capability remove <file-or-key> --capability createTrial --dry-run
+  $ aifabrix datasource capability diff ./a.json ./b.json --capability list
+  $ aifabrix datasource capability edit <file-or-key> --capability create --section openapi
+
+Per-command help:  aifabrix datasource <command> --help
+Shorthand:         af ds (alias for datasource)
 `;
 
 const DATASOURCE_VALIDATE_HELP_AFTER = `
@@ -53,6 +65,25 @@ Examples:
   $ af ds upload ../integration/hubspot/hubspot-datasource-deals.json
 `;
 
+const DATASOURCE_DIFF_HELP_AFTER = `
+Examples:
+  $ aifabrix datasource diff integration/myapp/old-datasource.json integration/myapp/new-datasource.json
+  $ af ds diff ./before.json ./after.json
+  $ af ds diff /abs/path/a.json /abs/path/b.json
+
+Note: Both arguments must be file paths. Use paths under integration/<app>/ or any two JSON files on disk.
+`;
+
+const DATASOURCE_LIST_HELP_AFTER = `
+Examples:
+  $ aifabrix datasource list
+  $ aifabrix datasource list test              # keys starting with "test" (e.g. test-e2e-hubspot-users)
+  $ af ds list hubspot                         # keys starting with "hubspot"
+
+Filter applies to the datasource key field returned by the dataplane (prefix match, case-sensitive).
+Omit [prefix] to list all datasources for the active environment.
+`;
+
 function setupDatasourceValidateCommand(datasource) {
   datasource.command('validate <file-or-key>')
     .description('Validate datasource JSON (file path or datasource key under integration/<app>/)')
@@ -76,11 +107,18 @@ function setupDatasourceValidateCommand(datasource) {
 }
 
 function setupDatasourceListCommand(datasource) {
-  datasource.command('list')
-    .description('List datasources for environment in config')
-    .action(async() => {
+  datasource.command('list [prefix]')
+    .description(
+      'List datasources for environment in config (optional prefix filters datasource keys)'
+    )
+    .addHelpText('after', DATASOURCE_LIST_HELP_AFTER)
+    .action(async(prefix) => {
       try {
-        await listDatasources({});
+        const opts = {};
+        if (typeof prefix === 'string' && prefix.trim()) {
+          opts.keyPrefix = prefix.trim();
+        }
+        await listDatasources(opts);
       } catch (error) {
         logger.error(formatBlockingError('Failed to list datasources:'), error.message);
         process.exit(1);
@@ -90,7 +128,8 @@ function setupDatasourceListCommand(datasource) {
 
 function setupDatasourceDiffCommand(datasource) {
   datasource.command('diff <file1> <file2>')
-    .description('Diff two datasource JSON files')
+    .description('Diff two datasource JSON files (two file paths; not datasource keys)')
+    .addHelpText('after', DATASOURCE_DIFF_HELP_AFTER)
     .action(async(file1, file2) => {
       try {
         await compareDatasources(file1, file2);
@@ -193,6 +232,7 @@ function setupDatasourceCommands(program) {
   if (typeof datasource.alias === 'function') {
     datasource.alias('ds');
   }
+  setupDatasourceCapabilityCommands(datasource);
   setupDatasourceValidateCommand(datasource);
   setupDatasourceListCommand(datasource);
   setupDatasourceDiffCommand(datasource);

package/lib/commands/dev-down.js

@@ -1,4 +1,4 @@
-const { formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
+const { formatSuccessLine, formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
 /**
  * dev down – stop Mutagen sync sessions and optionally app containers for this developer.
  *
@@ -39,7 +39,7 @@ async function stopMutagenSessions(developerId) {
     const toTerminate = sessions.filter(name => name.startsWith(prefix));
     for (const name of toTerminate) {
       await execAsync(`"${mutagenPath}" sync terminate "${name}"`, { timeout: 5000 });
-      logger.log(chalk.green(`  ✔ Stopped sync session: ${name}`));
+      logger.log(chalk.green('  ') + formatSuccessLine(`Stopped sync session: ${name}`));
     }
     if (toTerminate.length === 0 && sessions.length > 0) {
       logger.log(chalk.gray('No sync sessions for this developer.'));
@@ -99,7 +99,7 @@ async function handleDevDown(options = {}) {
       if (!appName) continue;
       try {
         await appLib.downApp(appName, {});
-        logger.log(chalk.green(`  ✔ Stopped app: ${appName}`));
+        logger.log(chalk.green('  ') + formatSuccessLine(`Stopped app: ${appName}`));
       } catch (err) {
         logger.log(chalk.yellow(`  ⚠ Could not stop ${appName}: ${err.message}`));
       }

package/lib/commands/dev-infra-gate.js

@@ -0,0 +1,32 @@
+/**
+ * @fileoverview Shared strict check that developer Postgres/Redis infra is running.
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const infra = require('../infrastructure');
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+
+const DEV_INFRA_DOWN_MESSAGE = 'Infrastructure is not up. Run \'aifabrix up-infra\' first.';
+
+/**
+ * Ensures this developer's Postgres/Redis (strict scope) are healthy.
+ *
+ * @param {{ quietSuccess?: boolean }} [opts] - When `quietSuccess`, omit the success log (e.g. guided spinner shows it).
+ * @returns {Promise<void>}
+ * @throws {Error} When infra is not healthy
+ */
+async function assertDevInfraUp(opts = {}) {
+  const quietSuccess = Boolean(opts.quietSuccess);
+  const health = await infra.checkInfraHealth(undefined, { strict: true });
+  const allHealthy = Object.values(health).every((status) => status === 'healthy');
+  if (!allHealthy) {
+    throw new Error(DEV_INFRA_DOWN_MESSAGE);
+  }
+  if (!quietSuccess) {
+    logger.log(formatSuccessLine('Infrastructure is up'));
+  }
+}
+
+module.exports = { assertDevInfraUp, DEV_INFRA_DOWN_MESSAGE };

package/lib/commands/dev-init.js

@@ -1,4 +1,4 @@
-const { formatSuccessLine, formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
+const { formatSuccessLine, formatSuccessParagraph, successGlyph } = require('../utils/cli-test-layout-chalk');
 /**
  * @fileoverview aifabrix dev init – onboard with Builder Server (issue-cert, save cert, get settings, add SSH key, SSH config alias).
  * Auth: first call (issue-cert) uses no client cert; other calls send the client cert (mTLS on https, X-Client-Cert header on http for getSettings/addSshKey).
@@ -195,12 +195,18 @@ async function saveCertAndConfig(configDir, devId, certificatePem, keyPem, caPem
   if (caPem && typeof caPem === 'string' && caPem.trim()) {
     const caNormalized = normalizePemNewlines(caPem.trim());
     await fs.writeFile(path.join(certDir, 'ca.pem'), caNormalized, { mode: 0o600 });
-    logger.log(chalk.green('  ✔ Certificate and CA saved to ') + chalk.cyan(path.join(certDir, 'cert.pem')));
+    logger.log(
+      `${chalk.green('  ')}${successGlyph()}${chalk.green(' Certificate and CA saved to ')}${chalk.cyan(path.join(certDir, 'cert.pem'))}`
+    );
   } else {
-    logger.log(chalk.green('  ✔ Certificate saved to ') + chalk.cyan(path.join(certDir, 'cert.pem')));
+    logger.log(
+      `${chalk.green('  ')}${successGlyph()}${chalk.green(' Certificate saved to ')}${chalk.cyan(path.join(certDir, 'cert.pem'))}`
+    );
   }
   await config.setDeveloperId(devId);
-  logger.log(chalk.green('  ✔ Developer ID set to ') + chalk.cyan(devId));
+  logger.log(
+    `${chalk.green('  ')}${successGlyph()}${chalk.green(' Developer ID set to ')}${chalk.cyan(devId)}`
+  );
 }
 
 /**
@@ -217,7 +223,7 @@ async function registerSshKey(baseUrl, clientCertPem, clientKeyPem, devId, serve
       publicKey,
       label: 'aifabrix-init'
     }, clientKeyPem, serverCaPem);
-    logger.log(chalk.green('  ✔ SSH key registered'));
+    logger.log(chalk.green('  ') + formatSuccessLine('SSH key registered'));
   } catch (err) {
     if (err.status === 409) {
       logger.log(chalk.yellow('  ⚠ SSH key already registered'));
@@ -262,7 +268,7 @@ async function applySettingsFromServer(baseUrl, devId, issueResponse, keyPem, se
   const configDir = getConfigDirForPaths();
   if (issueResponse.settings && typeof issueResponse.settings === 'object') {
     await config.mergeRemoteSettings(issueResponse.settings);
-    logger.log(chalk.green('  ✔ Config updated from server (issue-cert response)'));
+    logger.log(chalk.green('  ') + formatSuccessLine('Config updated from server (issue-cert response)'));
     return;
   }
   logger.log(chalk.gray('  Fetching settings...'));
@@ -272,7 +278,7 @@ async function applySettingsFromServer(baseUrl, devId, issueResponse, keyPem, se
     }
     const settings = await devApi.getSettings(baseUrl, issueResponse.certificate, keyPem, serverCaPem);
     await config.mergeRemoteSettings(settings);
-    logger.log(chalk.green('  ✔ Config updated from server'));
+    logger.log(chalk.green('  ') + formatSuccessLine('Config updated from server'));
   } catch (err) {
     const msg = err.status === 400 ? getBadRequestHint() : (err.message || String(err));
     logger.log(chalk.yellow('  ⚠ Could not fetch settings (server may not support cert yet): ' + msg));