@aifabrix/builder 2.44.5 → 2.45.0

package/lib/core/config-registered-controller-urls.js

@@ -0,0 +1,54 @@
+/**
+ * Derive controller URLs stored in config (default + device token keys).
+ *
+ * @fileoverview Registered controller URL list for auth --set-controller pick mode
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+/**
+ * Build sorted unique controller URLs from a config object.
+ * @param {Object} cfg - Parsed config.yaml object
+ * @param {(url: string) => string} normalizeControllerUrl - normalizer from config module
+ * @returns {string[]}
+ */
+function buildRegisteredControllerUrlList(cfg, normalizeControllerUrl) {
+  const seen = new Set();
+  const add = (raw) => {
+    if (!raw || typeof raw !== 'string') return;
+    const trimmed = raw.trim();
+    if (!/^https?:\/\//i.test(trimmed)) return;
+    let parsed;
+    try {
+      parsed = new URL(trimmed);
+    } catch {
+      return;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return;
+    seen.add(normalizeControllerUrl(trimmed));
+  };
+  if (cfg.controller) {
+    add(cfg.controller);
+  }
+  for (const key of Object.keys(cfg.device || {})) {
+    add(key);
+  }
+  return [...seen].sort((a, b) => a.localeCompare(b));
+}
+
+/**
+ * @param {() => Promise<Object>} getConfig - async config loader
+ * @param {(url: string) => string} normalizeControllerUrl
+ * @returns {Promise<string[]>}
+ */
+async function getRegisteredControllerUrlsWithLoader(getConfig, normalizeControllerUrl) {
+  const cfg = await getConfig();
+  return buildRegisteredControllerUrlList(cfg, normalizeControllerUrl);
+}
+
+module.exports = {
+  buildRegisteredControllerUrlList,
+  getRegisteredControllerUrlsWithLoader
+};

package/lib/core/config.js

@@ -15,62 +15,15 @@ const os = require('os');
 const { encryptToken, decryptToken, isTokenEncrypted } = require('../utils/token-encryption');
 const { ensureSecureFilePermissions, ensureSecureDirPermissions } = require('../utils/secure-file-permissions');
 const { getRuntimeConfigDir, getRuntimeConfigFile } = require('./config-runtime-paths');
+const { getAdminEmailFromConfig, setAdminEmailInConfig } = require('./config-admin-email');
+const { getRegisteredControllerUrlsWithLoader } = require('./config-registered-controller-urls');
+const { normalizeControllerUrl, validateAndNormalizeDeveloperId } = require('./config-normalize');
 // Avoid importing paths.js here to prevent circular dependency; use shared runtime config dir helper.
 // Config location: AIFABRIX_CONFIG dirname → AIFABRIX_HOME (with ~/.aifabrix fallback when config lives there) → ~/.aifabrix
 
 // Cache for developer ID - loaded when getConfig() is first called
 let cachedDeveloperId = null;
 
-/**
- * Normalize controller URL for consistent storage and lookup
- * Removes trailing slashes and normalizes the URL format
- * @param {string} url - Controller URL to normalize
- * @returns {string} Normalized controller URL
- */
-function normalizeControllerUrl(url) {
-  if (!url || typeof url !== 'string') {
-    return url;
-  }
-  // Remove trailing slashes
-  let normalized = url.trim().replace(/\/+$/, '');
-  // Ensure it starts with http:// or https://
-  if (!normalized.match(/^https?:\/\//)) {
-    // If it doesn't start with protocol, assume http://
-    normalized = `http://${normalized}`;
-  }
-  return normalized;
-}
-
-/**
- * Validate and normalize developer ID
- * @param {*} developerId - Developer ID value (can be string, number, undefined, or null)
- * @returns {string} Normalized developer ID as string
- * @throws {Error} If developer ID is invalid
- */
-function validateAndNormalizeDeveloperId(developerId) {
-  const DEV_ID_DIGITS_REGEX = /^[0-9]+$/;
-
-  if (typeof developerId === 'undefined' || developerId === null) {
-    return '0';
-  }
-
-  if (typeof developerId === 'number') {
-    if (developerId < 0 || !Number.isFinite(developerId)) {
-      throw new Error('Developer ID must be a non-negative digit string or number');
-    }
-    return String(developerId);
-  }
-
-  if (typeof developerId === 'string') {
-    if (!DEV_ID_DIGITS_REGEX.test(developerId)) {
-      throw new Error('Developer ID must be a non-negative digit string or number');
-    }
-    return developerId;
-  }
-
-  throw new Error('Developer ID must be a non-negative digit string or number');
-}
-
 /**
  * Ensure default config values exist
  * @param {Object} config - Configuration object
@@ -258,6 +211,25 @@ async function getTlsEnabled() {
   return cfg.tlsEnabled === true;
 }
 
+/**
+ * Admin email stored in `config.yaml` by `aifabrix setup` (Keycloak / pgAdmin). Empty when unset.
+ *
+ * @returns {Promise<string>}
+ */
+async function getAdminEmail() {
+  return getAdminEmailFromConfig(getConfig);
+}
+
+/**
+ * Persist admin email to `config.yaml` (used on subsequent setup runs as the prompt default).
+ *
+ * @param {string} email
+ * @returns {Promise<void>}
+ */
+async function setAdminEmail(email) {
+  return setAdminEmailInConfig(getConfig, saveConfig, email);
+}
+
 /**
  * Whether Traefik is enabled (`traefik: true` in config; infra compose includes the proxy).
  * @returns {Promise<boolean>}
@@ -316,6 +288,14 @@ async function getControllerUrl() {
   return config.controller || null;
 }
 
+/**
+ * Controller URLs from config: `controller` plus `device` token keys.
+ * @returns {Promise<string[]>}
+ */
+async function getRegisteredControllerUrls() {
+  return getRegisteredControllerUrlsWithLoader(getConfig, normalizeControllerUrl);
+}
+
 function isTokenExpired(expiresAt) {
   if (!expiresAt) return true;
   const expirationTime = new Date(expiresAt).getTime();
@@ -454,6 +434,8 @@ const exportsObj = {
   loadDeveloperId,
   getCurrentEnvironment,
   getTlsEnabled,
+  getAdminEmail,
+  setAdminEmail,
   getTraefikEnabled,
   setCurrentEnvironment,
   resolveEnvironment,
@@ -469,6 +451,7 @@ const exportsObj = {
   normalizeControllerUrl,
   setControllerUrl,
   getControllerUrl,
+  getRegisteredControllerUrls,
   get CONFIG_DIR() {
     return getRuntimeConfigDir();
   },

package/lib/core/env-reader.js

@@ -115,6 +115,19 @@ function detectSensitiveValue(key, value) {
   return false;
 }
 
+/**
+ * Path segment after `kv://` for sensitive env vars; must match infra.parameter.yaml keys.
+ * API_KEY uses the shared miso-controller/dataplane catalog entry (not a flat `api-key` slug).
+ * @param {string} key - Environment variable name
+ * @returns {string}
+ */
+function sensitiveKvPathSegmentFromEnvKey(key) {
+  if (key === 'API_KEY') {
+    return 'miso-controller-secrets-apiKeyVault';
+  }
+  return key.toLowerCase().replace(/[^a-z0-9]/g, '-');
+}
+
 /**
  * Convert existing .env variables to env.template format
  * @param {Object} existingEnv - Existing environment variables
@@ -128,7 +141,7 @@ function convertToEnvTemplate(existingEnv, requiredVars) {
   Object.entries(existingEnv).forEach(([key, value]) => {
     if (detectSensitiveValue(key, value)) {
       // Convert sensitive values to kv:// references
-      convertedEnv[key] = `kv://${key.toLowerCase().replace(/[^a-z0-9]/g, '-')}`;
+      convertedEnv[key] = `kv://${sensitiveKvPathSegmentFromEnvKey(key)}`;
     } else {
       // Keep non-sensitive values as-is
       convertedEnv[key] = value;
@@ -148,8 +161,8 @@ function generateSecretsFromEnv(envVars) {
 
   Object.entries(envVars).forEach(([key, value]) => {
     if (detectSensitiveValue(key, value)) {
-      // Use centralized resolver for canonical secret names
-      const secretName = getCanonicalSecretName(key);
+      const secretName =
+        key === 'API_KEY' ? sensitiveKvPathSegmentFromEnvKey(key) : getCanonicalSecretName(key);
       secrets[secretName] = value;
     }
   });

package/lib/core/secrets-admin-env.js

@@ -0,0 +1,101 @@
+/**
+ * Infrastructure admin-secrets.env generation (PG/Redis Commander defaults).
+ *
+ * @fileoverview Split from secrets.js for module size limits
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const logger = require('../utils/logger');
+const config = require('./config');
+const {
+  mergeInfraParameterDefaultsForCli,
+  getInfraParameterCatalog,
+  readRelaxedCatalogDefaults
+} = require('../parameters/infra-parameter-catalog');
+const { createDefaultSecrets } = require('../utils/secrets-generator');
+const pathsUtil = require('../utils/paths');
+const { loadSecrets } = require('./secrets-load');
+
+/**
+ * Writes admin env key-value pairs to content; encrypts values when encryption key is set.
+ * @async
+ * @param {Object.<string, string>} adminObj - Key-value object (e.g. POSTGRES_PASSWORD, ...)
+ * @returns {Promise<string>} .env-style content (plaintext or secure:// for secrets)
+ */
+async function formatAdminSecretsContent(adminObj) {
+  const encryptionKey = await config.getSecretsEncryptionKey();
+  const { encryptSecret } = require('../utils/secrets-encryption');
+  const lines = ['# Infrastructure Admin Credentials'];
+  for (const [k, v] of Object.entries(adminObj)) {
+    const value = (v === null || v === undefined) ? '' : String(v).replace(/\n/g, ' ').trim();
+    const valueToWrite = encryptionKey ? encryptSecret(value, encryptionKey) : value;
+    lines.push(`${k}=${valueToWrite}`);
+  }
+  return lines.join('\n');
+}
+
+async function loadSecretsOrBootstrapForAdmin(secretsPath) {
+  try {
+    return await loadSecrets(secretsPath);
+  } catch (error) {
+    const defaultSecretsPath = secretsPath || path.join(pathsUtil.getAifabrixHome(), 'secrets.yaml');
+    if (!fs.existsSync(defaultSecretsPath)) {
+      logger.log('Creating default secrets file...');
+      await createDefaultSecrets(defaultSecretsPath);
+      return await loadSecrets(secretsPath);
+    }
+    throw error;
+  }
+}
+
+function getInfraDefaultsMergedForAdmin() {
+  try {
+    return mergeInfraParameterDefaultsForCli(getInfraParameterCatalog().data, {});
+  } catch {
+    return {};
+  }
+}
+
+function buildLocalAdminSecretsObject(secrets, infraDefaults) {
+  const raw = secrets['postgres-passwordKeyVault'];
+  const relaxed = readRelaxedCatalogDefaults();
+  const postgresPassword =
+    (raw && String(raw).trim()) ||
+    infraDefaults.adminPassword ||
+    relaxed.adminPassword ||
+    '';
+  const pgAdminEmail = infraDefaults.adminEmail || relaxed.adminEmail || '';
+  return {
+    POSTGRES_PASSWORD: postgresPassword,
+    PGADMIN_DEFAULT_EMAIL: pgAdminEmail,
+    PGADMIN_DEFAULT_PASSWORD: postgresPassword,
+    REDIS_HOST: 'local:redis:6379:0:',
+    REDIS_COMMANDER_USER: 'admin',
+    REDIS_COMMANDER_PASSWORD: postgresPassword
+  };
+}
+
+/** Generates admin secrets for infrastructure (beside config.yaml, typically ~/.aifabrix/admin-secrets.env). Defaults from infra.parameter.yaml `defaults`. */
+async function generateAdminSecretsEnv(secretsPath) {
+  const secrets = await loadSecretsOrBootstrapForAdmin(secretsPath);
+  const infraDefaults = getInfraDefaultsMergedForAdmin();
+  const adminObj = buildLocalAdminSecretsObject(secrets, infraDefaults);
+  const aifabrixDir = pathsUtil.getAifabrixSystemDir();
+  const adminEnvPath = path.join(aifabrixDir, 'admin-secrets.env');
+  if (!fs.existsSync(aifabrixDir)) {
+    fs.mkdirSync(aifabrixDir, { recursive: true, mode: 0o700 });
+  }
+  const adminSecrets = await formatAdminSecretsContent(adminObj);
+  fs.writeFileSync(adminEnvPath, adminSecrets, { mode: 0o600 });
+  return adminEnvPath;
+}
+
+module.exports = {
+  formatAdminSecretsContent,
+  generateAdminSecretsEnv
+};

package/lib/core/secrets-ensure-infra.js

@@ -70,8 +70,41 @@ function getInfraSecretKeysForUpInfra() {
   }
 }
 
+/**
+ * Same merge as runtime `loadSecrets()` (primary `~/.aifabrix/secrets.local.yaml` plus `aifabrix-secrets` file or remote API).
+ * Ensures missing-key checks treat remote `--shared` keys as already satisfied.
+ *
+ * @returns {Promise<Object.<string, string>>}
+ */
+async function loadMergedSecretsForEnsureMissingCheck() {
+  const { loadSecrets } = require('./secrets-load');
+  return loadSecrets(undefined);
+}
+
+/**
+ * Default on for writes to the primary user secrets file: consult full {@link loadSecrets} merge so remote
+ * `--shared` keys are not duplicated locally. Opt out with `useMergedSecretsForMissingKeys: false`.
+ *
+ * @param {{ useMergedSecretsForMissingKeys?: boolean }} options
+ * @param {{ type?: string, filePath?: string }} target
+ * @returns {boolean}
+ */
+function shouldUseMergedSecretsForMissingKeys(options, target) {
+  if (options.useMergedSecretsForMissingKeys === false) return false;
+  if (options.useMergedSecretsForMissingKeys === true) return true;
+  if (!target || target.type !== 'file' || !target.filePath) return false;
+  try {
+    const primary = pathsUtil.getPrimaryUserSecretsLocalPath();
+    return path.resolve(target.filePath) === path.resolve(primary);
+  } catch {
+    return false;
+  }
+}
+
 module.exports = {
   buildInfraPlaceholderContext,
   isSecretKeyAllowedEmpty,
-  getInfraSecretKeysForUpInfra
+  getInfraSecretKeysForUpInfra,
+  loadMergedSecretsForEnsureMissingCheck,
+  shouldUseMergedSecretsForMissingKeys
 };

package/lib/core/secrets-ensure.js

@@ -1,10 +1,11 @@
 /**
- * AI Fabrix Builder – Ensure secrets in configured store
+ * AI Fabrix Builder – Ensure secrets in the primary user store
  *
- * Ensures missing secret keys exist in the correct store (file path, remote API, or
- * user secrets file). New values are encrypted when writing to file and
- * secrets-encryption is set. Remote write tries API first; on failure falls back
- * to user file with a warning.
+ * Automated flows (resolve, run, wizard, up-infra backfill) **only** write to
+ * `~/.aifabrix/secrets.local.yaml` (or the path from `getPrimaryUserSecretsLocalPath`).
+ * The shared store (`aifabrix-secrets` file or remote API) is **read** via `loadSecrets()`;
+ * writing there is **human-only** through `aifabrix secret set --shared` (see `commands/secrets-set.js`).
+ * New values are encrypted when secrets-encryption is set.
  *
  * @fileoverview Central ensure-secrets service for zero-touch install
  * @author AI Fabrix Team
@@ -17,6 +18,7 @@ const os = require('os');
 const config = require('./config');
 const pathsUtil = require('../utils/paths');
 const logger = require('../utils/logger');
+const { formatSuccessLine, metadata } = require('../utils/cli-test-layout-chalk');
 const remoteDevAuth = require('../utils/remote-dev-auth');
 const devApi = require('../api/dev.api');
 const {
@@ -31,7 +33,9 @@ const { loadEnvTemplate } = require('../utils/secrets-helpers');
 const {
   buildInfraPlaceholderContext,
   isSecretKeyAllowedEmpty,
-  getInfraSecretKeysForUpInfra
+  getInfraSecretKeysForUpInfra,
+  loadMergedSecretsForEnsureMissingCheck,
+  shouldUseMergedSecretsForMissingKeys
 } = require('./secrets-ensure-infra');
 const { syncLiteralKvSecretsFromCliOverrides } = require('./secrets-infra-placeholder-sync');
 
@@ -59,10 +63,12 @@ function expandTilde(filePath) {
 }
 
 /**
- * Resolve write target from config.
+ * Resolve the **configured** shared store for inspection/validation (e.g. `secret validate` without a path).
+ * This is the `aifabrix-secrets` target (file or remote API), not the default for automated writes.
+ *
  * - File path → that path (expand ~)
- * - http(s) URL → remote (fallback: user file)
- * - No config → user file
+ * - http(s) URL → remote
+ * - No config → primary user secrets file
  *
  * @returns {Promise<{ type: 'file'|'remote', filePath?: string, serverUrl?: string|null, secretsEndpointUrl?: string, clientCertPem?: string|null, serverCaPem?: string|null }>}
  */
@@ -91,6 +97,16 @@ async function resolveWriteTarget() {
   return { type: 'file', filePath };
 }
 
+/**
+ * Default write target for **automated** ensure / `setSecretInStore` (resolve, run, wizard, infra).
+ * Never the shared store; use `aifabrix secret set --shared` to write shared.
+ *
+ * @returns {Promise<{ type: 'file', filePath: string }>}
+ */
+async function resolvePrimaryUserWriteTarget() {
+  return { type: 'file', filePath: pathsUtil.getPrimaryUserSecretsLocalPath() };
+}
+
 /**
  * Load existing secrets from the resolved target (file or remote).
  *
@@ -166,34 +182,36 @@ function valueForKey(key, suggested, emptyForCredentials, placeholderContext) {
 }
 
 /**
- * Add secrets via remote API; on failure write to local file (with encryption if configured).
- * @param {Object} target - Resolved target (remote)
- * @param {string[]} toAdd - Keys to add
- * @param {Object} suggested - Suggested values
- * @param {string[]} added - Array to push added keys to
- * @param {string|null} encryptionKey - Encryption key for file fallback or null
- * @returns {Promise<string[]>}
+ * Short label for logs (file path or remote secrets URL).
+ * @param {{ type?: string, filePath?: string, secretsEndpointUrl?: string }|null} target
+ * @returns {string}
  */
-async function addSecretsRemote(target, toAdd, suggested, added, encryptionKey, placeholderContext) {
-  const emptyForCredentials = false;
-  for (const key of toAdd) {
-    const value = valueForKey(key, suggested, emptyForCredentials, placeholderContext);
-    try {
-      await devApi.addSecret(
-        target.serverUrl,
-        target.clientCertPem,
-        { key, value },
-        target.serverCaPem || undefined,
-        target.secretsEndpointUrl
-      );
-      added.push(key);
-    } catch (err) {
-      logger.warn(`Remote secret "${key}" failed (${err.message}); writing to local file.`);
-      await writeSecretToFile(target.filePath, key, value, encryptionKey);
-      added.push(key);
-    }
+function summarizeSecretsStoreForLog(target) {
+  if (!target || typeof target !== 'object') return 'secrets store';
+  if (target.type === 'remote' && typeof target.secretsEndpointUrl === 'string' && target.secretsEndpointUrl.trim()) {
+    return target.secretsEndpointUrl.trim();
   }
-  return added;
+  if (typeof target.filePath === 'string' && target.filePath.trim()) {
+    return target.filePath.trim();
+  }
+  return 'secrets store';
+}
+
+/**
+ * Log that new values were written for keys that were missing or empty.
+ * @param {string[]} added
+ * @param {{ type?: string, filePath?: string, secretsEndpointUrl?: string }|null} target
+ */
+function logNewSecretValuesWritten(added, target) {
+  if (!Array.isArray(added) || added.length === 0) return;
+  const where = summarizeSecretsStoreForLog(target);
+  logger.log(
+    formatSuccessLine(
+      `Wrote ${added.length} new secret value(s) to ${where}. ` +
+        'These keys were missing or empty; values are now stored.'
+    )
+  );
+  logger.log(metadata(`  Keys: ${added.join(', ')}`));
 }
 
 /**
@@ -223,9 +241,7 @@ async function addSecretsToFile(batch) {
     await writeSecretToFile(filePath, key, value, encryptionKey);
     added.push(key);
   }
-  if (added.length > 0) {
-    logger.log(`✔ Ensured ${added.length} secret key(s): ${added.join(', ')}`);
-  }
+  logNewSecretValuesWritten(added, { type: 'file', filePath });
   return added;
 }
 
@@ -240,6 +256,9 @@ async function addSecretsToFile(batch) {
  * @param {Object} [options] - Options
  * @param {boolean} [options.emptyValuesForCredentials=false] - Use empty string for new values
  * @param {Object} [options.suggestedValues] - Optional map key -> value for specific keys
+ * @param {boolean} [options.useMergedSecretsForMissingKeys] - When true, treat keys present in the full
+ *   `loadSecrets()` merge (including remote `--shared`) as satisfied. When false, only the target store file
+ *   is consulted. When omitted and the target file is the primary user secrets path, merged secrets are used (default).
  * @returns {Promise<string[]>} Keys that were added (new or backfilled)
  * @throws {Error} If config or file write fails
  */
@@ -253,8 +272,11 @@ async function ensureSecretsForKeys(keys, options = {}) {
     : {};
   const placeholderContext = options.placeholderContext;
 
-  const target = options._targetOverride || await resolveWriteTarget();
-  const existing = await loadExistingFromTarget(target);
+  const target = options._targetOverride || (await resolvePrimaryUserWriteTarget());
+  let existing = await loadExistingFromTarget(target);
+  if (shouldUseMergedSecretsForMissingKeys(options, target)) {
+    existing = await loadMergedSecretsForEnsureMissingCheck();
+  }
   const toAdd = keys.filter((k) => {
     const v = existing[k];
     const missingOrEmpty = v === undefined || v === null || (typeof v === 'string' && v.trim() === '');
@@ -265,9 +287,6 @@ async function ensureSecretsForKeys(keys, options = {}) {
   const encryptionKey = await config.getSecretsEncryptionKey();
   const added = [];
 
-  if (target.type === 'remote' && target.serverUrl && target.clientCertPem) {
-    return addSecretsRemote(target, toAdd, suggested, added, encryptionKey, placeholderContext);
-  }
   return addSecretsToFile({
     filePath: target.filePath,
     toAdd,
@@ -288,6 +307,8 @@ async function ensureSecretsForKeys(keys, options = {}) {
  * @param {string} envTemplatePathOrContent - Path to env.template or template content
  * @param {Object} [options] - Options
  * @param {boolean} [options.emptyValuesForCredentials=false] - Use empty string for new values
+ * @param {boolean} [options.useMergedSecretsForMissingKeys] - Same semantics as {@link ensureSecretsForKeys};
+ *   defaults to merged lookup when the write target is the primary user secrets file
  * @returns {Promise<string[]>} Keys that were added
  * @throws {Error} If template cannot be read or ensure fails
  */
@@ -313,9 +334,12 @@ async function ensureSecretsFromEnvTemplate(envTemplatePathOrContent, options =
       : path.resolve(process.cwd(), options.preferredFilePath);
     target = { type: 'file', filePath };
   } else {
-    target = await resolveWriteTarget();
+    target = await resolvePrimaryUserWriteTarget();
+  }
+  let existing = await loadExistingFromTarget(target);
+  if (shouldUseMergedSecretsForMissingKeys(options, target)) {
+    existing = await loadMergedSecretsForEnsureMissingCheck();
   }
-  const existing = await loadExistingFromTarget(target);
   const missingKeys = findMissingSecretKeys(template, existing);
   return ensureSecretsForKeys(missingKeys, { ...options, _targetOverride: target });
 }
@@ -358,29 +382,16 @@ async function writeSecretToStoreFile(filePath, key, strValue) {
  */
 async function setSecretInStore(key, value) {
   if (!key || typeof key !== 'string' || value === undefined) return;
-  const target = await resolveWriteTarget();
   const strValue = typeof value === 'string' ? value : String(value);
-  if (target.type === 'remote' && target.serverUrl && target.clientCertPem) {
-    try {
-      await devApi.addSecret(
-        target.serverUrl,
-        target.clientCertPem,
-        { key, value: strValue },
-        target.serverCaPem || undefined,
-        target.secretsEndpointUrl
-      );
-    } catch (err) {
-      logger.warn(`Could not sync secret "${key}" to remote store: ${err.message}`);
-      const encryptionKey = await config.getSecretsEncryptionKey();
-      await writeSecretToFile(target.filePath, key, strValue, encryptionKey);
-    }
-    return;
-  }
-  await writeSecretToStoreFile(target.filePath, key, strValue);
+  const userPath = pathsUtil.getPrimaryUserSecretsLocalPath();
+  await writeSecretToStoreFile(userPath, key, strValue);
 }
 
 /**
- * Ensure infra secrets exist in the configured store. Call before ensureAdminSecrets or startInfra.
+ * Ensure infra secrets exist before ensureAdminSecrets or startInfra.
+ * Writes go to the primary user secrets file only (same as all **`ensureSecretsForKeys`** / **`setSecretInStore`** paths).
+ * **`kv://` resolution** merges the shared store via **`loadSecrets()`**. To publish a key to shared, use
+ * **`aifabrix secret set --shared`**.
  *
  * @async
  * @function ensureInfraSecrets
@@ -398,11 +409,21 @@ async function setSecretInStore(key, value) {
 async function ensureInfraSecrets(options = {}) {
   const keys = getInfraSecretKeysForUpInfra();
   const placeholderContext = buildInfraPlaceholderContext(options);
-  const added = await ensureSecretsForKeys(keys, { placeholderContext });
+  const userSecretsPath = pathsUtil.getPrimaryUserSecretsLocalPath();
+  const added = await ensureSecretsForKeys(keys, {
+    placeholderContext,
+    _targetOverride: { type: 'file', filePath: userSecretsPath }
+  });
+
+  async function writeInfraPlaceholderLiteralToUserLocal(key, value) {
+    const strValue = typeof value === 'string' ? value : String(value);
+    await writeSecretToStoreFile(userSecretsPath, key, strValue);
+  }
+
   await syncLiteralKvSecretsFromCliOverrides(
     options,
     placeholderContext,
-    setSecretInStore,
+    writeInfraPlaceholderLiteralToUserLocal,
     infraParameterCatalogModule
   );
   return added;
@@ -414,6 +435,7 @@ module.exports = {
   ensureInfraSecrets,
   setSecretInStore,
   resolveWriteTarget,
+  resolvePrimaryUserWriteTarget,
   loadExistingFromTarget,
   getInfraSecretKeysForUpInfra,
   isSecretKeyAllowedEmpty,