@aifabrix/builder 2.44.6 → 2.45.5

package/lib/commands/auth-config.js

@@ -8,53 +8,144 @@
  * @version 2.0.0
  */
 
+const chalk = require('chalk');
 const { formatBlockingError, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 const {
   setControllerUrl,
   setCurrentEnvironment,
-  getControllerUrl
+  getControllerUrl,
+  getRegisteredControllerUrls,
+  getConfig
 } = require('../core/config');
 const {
   validateControllerUrl,
   validateEnvironment,
   checkUserLoggedIn
 } = require('../utils/auth-config-validator');
-const { getControllerUrlFromLoggedInUser } = require('../utils/controller-url');
+const { hasStoredDeviceTokenForController } = require('../utils/controller-url');
 const logger = require('../utils/logger');
 
+/**
+ * True when user ran --set-controller with no URL (pick from config.yaml).
+ * @param {unknown} setController - Commander option value
+ * @returns {boolean}
+ */
+function isInteractiveControllerPick(setController) {
+  return (
+    setController === true ||
+    (typeof setController === 'string' && setController.trim() === '')
+  );
+}
+
+/**
+ * True when a non-empty controller URL string was passed.
+ * @param {unknown} setController - Commander option value
+ * @returns {boolean}
+ */
+function hasExplicitControllerUrl(setController) {
+  return typeof setController === 'string' && setController.trim() !== '';
+}
+
+/**
+ * Normalize controller URL for equality checks (trailing slashes).
+ * @param {string|null|undefined} url - URL or empty
+ * @returns {string}
+ */
+function normalizeForCompare(url) {
+  if (!url || typeof url !== 'string') return '';
+  return url.trim().replace(/\/+$/, '');
+}
+
+function throwNoRegisteredControllers() {
+  const msg =
+    'No controllers are registered in config. Run "aifabrix login" first, or set a controller with "aifabrix auth --set-controller <url>".';
+  logger.error(formatBlockingError(msg));
+  throw new Error(msg);
+}
+
+function throwNonInteractiveControllerPick() {
+  const msg =
+    'Cannot choose a controller without a URL in non-interactive mode. Run: aifabrix auth --set-controller <url>';
+  logger.error(formatBlockingError(msg));
+  throw new Error(msg);
+}
+
+/**
+ * Pick default controller from URLs in config (`controller` + `device` keys), or set the only one.
+ * @async
+ * @returns {Promise<void>}
+ */
+async function handleSelectRegisteredController() {
+  const urls = await getRegisteredControllerUrls();
+
+  if (urls.length === 0) {
+    throwNoRegisteredControllers();
+  }
+
+  if (!process.stdin.isTTY) {
+    throwNonInteractiveControllerPick();
+  }
+
+  if (urls.length === 1) {
+    const sole = urls[0];
+    const current = await getControllerUrl();
+    if (normalizeForCompare(current) === normalizeForCompare(sole)) {
+      logger.log(formatSuccessLine(`Default controller is already set to ${sole}.`));
+      logger.log(
+        chalk.white('To add another controller, run: aifabrix auth --set-controller <url>')
+      );
+      return;
+    }
+    await handleSetController(sole);
+    return;
+  }
+
+  const inquirer = require('inquirer');
+  const { controllerUrl } = await inquirer.prompt([
+    {
+      type: 'list',
+      name: 'controllerUrl',
+      message: 'Select default controller:',
+      choices: urls
+    }
+  ]);
+  await handleSetController(controllerUrl);
+}
+
 /**
  * Handle set-controller command
- * Allows setting the default controller when no credentials are stored, or when already logged in to that controller.
- * If credentials exist for a different controller, throws with a clear message.
+ * Allows setting the default controller when there are no device tokens, or when a token exists
+ * for the target URL (including switching among multiple logged-in controllers). If device tokens
+ * exist only for other controller URLs, throws with a clear message.
  *
  * @async
  * @function handleSetController
  * @param {string} url - Controller URL to set
  * @returns {Promise<void>}
- * @throws {Error} If validation fails or credentials exist for another controller
+ * @throws {Error} If validation fails or credentials exist only for other controllers
  */
 async function handleSetController(url) {
   try {
     validateControllerUrl(url);
     const normalizedUrl = url.trim().replace(/\/+$/, '');
 
-    const loggedInControllerUrl = await getControllerUrlFromLoggedInUser();
-    if (!loggedInControllerUrl) {
-      // No stored credentials: allow setting controller so "aifabrix login" opens the right place
-      await setControllerUrl(url);
-      logger.log(formatSuccessLine(`Controller URL set to: ${url}`));
-      return;
-    }
+    const userConfig = await getConfig();
+    const device =
+      userConfig.device && typeof userConfig.device === 'object' ? userConfig.device : {};
+    const deviceKeys = Object.keys(device);
+    const hasTokenForTarget = await hasStoredDeviceTokenForController(normalizedUrl);
 
-    const normalizedLoggedIn = loggedInControllerUrl.trim().replace(/\/+$/, '');
-    if (normalizedLoggedIn === normalizedUrl) {
+    if (deviceKeys.length === 0 || hasTokenForTarget) {
       await setControllerUrl(url);
       logger.log(formatSuccessLine(`Controller URL set to: ${url}`));
       return;
     }
 
+    const otherKey =
+      deviceKeys.find((k) => normalizeForCompare(k) !== normalizeForCompare(normalizedUrl)) ||
+      deviceKeys[0];
     throw new Error(
-      `You have credentials for another controller (${loggedInControllerUrl}).\n` +
+      `You have credentials for another controller (${otherKey.trim().replace(/\/+$/, '')}).\n` +
       'To use a different controller either run "aifabrix login" with that controller, or run "aifabrix logout" first to clear credentials, then set the new controller with "aifabrix auth --set-controller <url>".'
     );
   } catch (error) {
@@ -107,20 +198,27 @@ async function handleSetEnvironment(environment) {
  * @async
  * @function handleAuthConfig
  * @param {Object} options - Command options
- * @param {string} [options.setController] - Controller URL to set
+ * @param {string|boolean} [options.setController] - Controller URL, or true when flag has no value
  * @param {string} [options.setEnvironment] - Environment to set
  * @returns {Promise<void>}
  * @throws {Error} If command fails
  */
 async function handleAuthConfig(options) {
-  if (!options.setController && !options.setEnvironment) {
+  const pick = isInteractiveControllerPick(options.setController);
+  const hasUrl = hasExplicitControllerUrl(options.setController);
+
+  if (!pick && !hasUrl && !options.setEnvironment) {
     throw new Error(
       'No action specified. Use "aifabrix auth --set-controller <url>" or "aifabrix auth --set-environment <env>".'
     );
   }
-  if (options.setController) {
+
+  if (pick) {
+    await handleSelectRegisteredController();
+  } else if (hasUrl) {
     await handleSetController(options.setController);
   }
+
   if (options.setEnvironment) {
     await handleSetEnvironment(options.setEnvironment);
   }

package/lib/commands/auth-status-dataplane-version.js

@@ -0,0 +1,231 @@
+/**
+ * Auth-status dataplane version refresh + compatibility resolution (plan 142.0).
+ *
+ * Extracted from `auth-status.js` to keep that file under the 500-line limit
+ * (`.cursor/rules/project-rules.mdc → File and Function Size Limits`). The
+ * helpers here are pure-ish (only depend on the dataplane health API and the
+ * `device.<controllerUrl>` cache module) so they are easy to mock in unit
+ * tests.
+ *
+ * @fileoverview Resolve dataplane version + Builder CLI compatibility for auth status
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const { fetchDataplaneGeneralHealth } = require('../api/dataplane-health.api');
+const {
+  updateDeviceDataplaneVersions,
+  getDeviceDataplaneVersions
+} = require('../core/config-device-dataplane');
+const {
+  getInstalledCliVersion
+} = require('../utils/dataplane-cli-version-gate');
+const { isAtLeast, isValidSemver } = require('../utils/semver-compare');
+
+/**
+ * Per plan 142.0: invalid semver from the dataplane is logged but does **not**
+ * block the CLI; missing min version means no enforcement.
+ *
+ * @param {string} cliVersion
+ * @param {string|undefined} minBuilderCliVersion
+ * @returns {boolean}
+ */
+function computeCompatibility(cliVersion, minBuilderCliVersion) {
+  if (!minBuilderCliVersion) return true;
+  if (!isValidSemver(minBuilderCliVersion) || !isValidSemver(cliVersion)) {
+    return true;
+  }
+  return isAtLeast(cliVersion, minBuilderCliVersion);
+}
+
+/**
+ * Read `device.<controllerUrl>` cache without throwing.
+ * @private
+ * @async
+ * @param {string} controllerUrl
+ * @returns {Promise<Object|null>}
+ */
+async function safeReadCache(controllerUrl) {
+  if (!controllerUrl) return null;
+  try {
+    return await getDeviceDataplaneVersions(controllerUrl);
+  } catch (_error) {
+    return null;
+  }
+}
+
+/**
+ * Refresh dataplane health, persist `device.<controllerUrl>` version cache,
+ * and derive the compatibility verdict against the installed Builder CLI.
+ * Falls back to the cached entry when the live probe fails so `auth status`
+ * still shows the last-known values offline.
+ *
+ * @async
+ * @param {string} controllerUrl - Controller URL (cache key)
+ * @param {string} dataplaneUrl - Dataplane base URL for the health probe
+ * @returns {Promise<{
+ *   dataplaneVersion: string|undefined,
+ *   minBuilderCliVersion: string|undefined,
+ *   cliVersion: string,
+ *   compatible: boolean
+ * }>}
+ */
+async function refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl) {
+  const cliVersion = getInstalledCliVersion();
+  let dataplaneVersion;
+  let minBuilderCliVersion;
+
+  try {
+    const snapshot = await fetchDataplaneGeneralHealth(dataplaneUrl);
+    if (snapshot) {
+      dataplaneVersion = snapshot.version;
+      minBuilderCliVersion = snapshot.minBuilderCliVersion;
+      try {
+        await updateDeviceDataplaneVersions(controllerUrl, {
+          version: dataplaneVersion,
+          minBuilderCliVersion: minBuilderCliVersion || null
+        });
+      } catch (_persistError) {
+        // cache write failure must not break the display
+      }
+    }
+  } catch (_fetchError) {
+    // ignore — fall through to cached values
+  }
+
+  if (!dataplaneVersion && !minBuilderCliVersion) {
+    const cached = await safeReadCache(controllerUrl);
+    if (cached) {
+      dataplaneVersion = cached.version;
+      minBuilderCliVersion = cached.minBuilderCliVersion;
+    }
+  }
+
+  const compatible = computeCompatibility(cliVersion, minBuilderCliVersion);
+  return { dataplaneVersion, minBuilderCliVersion, cliVersion, compatible };
+}
+
+/**
+ * Load cached versions only (no live probe). Used when the dataplane is
+ * unreachable so `auth status` can still surface a known compatibility floor.
+ *
+ * @async
+ * @param {string} controllerUrl
+ * @returns {Promise<{
+ *   dataplaneVersion: string|undefined,
+ *   minBuilderCliVersion: string|undefined,
+ *   cliVersion: string,
+ *   compatible: boolean
+ * }>}
+ */
+async function loadCachedVersionInfo(controllerUrl) {
+  const cliVersion = getInstalledCliVersion();
+  const cached = await safeReadCache(controllerUrl);
+  const dataplaneVersion = cached ? cached.version : undefined;
+  const minBuilderCliVersion = cached ? cached.minBuilderCliVersion : undefined;
+  return {
+    dataplaneVersion,
+    minBuilderCliVersion,
+    cliVersion,
+    compatible: computeCompatibility(cliVersion, minBuilderCliVersion)
+  };
+}
+
+/**
+ * Resolve bearer auth after login (device token preferred, else client app token).
+ * @private
+ * @async
+ * @param {string} controllerUrl
+ * @param {string} environment
+ * @param {Object} loginOptions
+ * @returns {Promise<Object|null>}
+ */
+async function resolveAuthConfigAfterLogin(controllerUrl, environment, loginOptions) {
+  const { getOrRefreshDeviceToken, getDeploymentAuth } = require('../utils/token-manager');
+  const device = await getOrRefreshDeviceToken(controllerUrl);
+  if (device && device.token) {
+    return { type: 'bearer', token: device.token };
+  }
+  if (!loginOptions.app) {
+    return null;
+  }
+  try {
+    return await getDeploymentAuth(controllerUrl, environment, loginOptions.app);
+  } catch (_authError) {
+    return null;
+  }
+}
+
+/**
+ * Resolve dataplane URL after login (mirrors auth-status silent resolver).
+ * @private
+ * @async
+ * @param {string} controllerUrl
+ * @param {string} environment
+ * @param {Object} authConfig
+ * @returns {Promise<string|null>}
+ */
+async function resolveDataplaneUrlAfterLogin(controllerUrl, environment, authConfig) {
+  const { findDataplaneServiceAppKey } = require('./wizard-dataplane');
+  const { getDataplaneUrl } = require('../datasource/deploy');
+  try {
+    const dataplaneAppKey = await findDataplaneServiceAppKey(
+      controllerUrl,
+      environment,
+      authConfig
+    );
+    if (dataplaneAppKey) {
+      return await getDataplaneUrl(controllerUrl, dataplaneAppKey, environment, authConfig);
+    }
+    return await getDataplaneUrl(controllerUrl, 'dataplane', environment, authConfig);
+  } catch (_resolveError) {
+    return null;
+  }
+}
+
+/**
+ * Best-effort health refresh after login when dataplane URL is discoverable.
+ * Never throws — cache failures must not block login success.
+ *
+ * @async
+ * @param {string} controllerUrl - Controller URL (device cache key)
+ * @param {Object} [loginOptions]
+ * @param {string} [loginOptions.app] - App name (credentials login) for client-token auth
+ * @returns {Promise<void>}
+ */
+async function tryRefreshDataplaneVersionAfterLogin(controllerUrl, loginOptions = {}) {
+  if (!controllerUrl || typeof controllerUrl !== 'string') {
+    return;
+  }
+  try {
+    const { resolveEnvironment } = require('../core/config');
+    const environment = await resolveEnvironment();
+    const authConfig = await resolveAuthConfigAfterLogin(
+      controllerUrl,
+      environment,
+      loginOptions
+    );
+    if (!authConfig) {
+      return;
+    }
+    const dataplaneUrl = await resolveDataplaneUrlAfterLogin(
+      controllerUrl,
+      environment,
+      authConfig
+    );
+    if (dataplaneUrl) {
+      await refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl);
+    }
+  } catch (_error) {
+    // best-effort only
+  }
+}
+
+module.exports = {
+  refreshDataplaneVersionInfo,
+  loadCachedVersionInfo,
+  computeCompatibility,
+  tryRefreshDataplaneVersionAfterLogin
+};

package/lib/commands/auth-status-display.js

@@ -0,0 +1,94 @@
+/**
+ * Auth-status dataplane version block + blocking upgrade UX (plan 142.0).
+ *
+ * Kept in a separate module so `auth-status.js` stays under the 500-line
+ * limit and so the same display helpers can be reused by future dataplane
+ * gate surfaces (`upload`, `wizard`, `deploy`, …).
+ *
+ * @fileoverview TTY rendering for dataplane / Builder CLI compatibility
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const {
+  successGlyph,
+  failureGlyph
+} = require('../utils/cli-test-layout-chalk');
+const {
+  formatCliVersionGateError
+} = require('../utils/dataplane-cli-version-help');
+
+/**
+ * Format a single key/value version line indented under the dataplane block.
+ * @private
+ * @param {string} label
+ * @param {string|undefined|null} value
+ * @returns {string}
+ */
+function versionLine(label, value) {
+  const display = value && String(value).trim() ? chalk.cyan(value) : chalk.gray('—');
+  return `  ${label}: ${display}`;
+}
+
+/**
+ * Render the dataplane version subsection on `aifabrix auth status`.
+ *
+ * Designed to be called immediately after the existing connection/status line,
+ * so the output reads as a single grouped block per layout.md §HEADER BLOCK.
+ *
+ * @param {Object} params
+ * @param {boolean} params.connected - Whether dataplane reachability probe passed
+ * @param {string|undefined} params.dataplaneVersion - From `device.<controllerUrl>.dataplane-version`
+ * @param {string|undefined} params.minBuilderCliVersion - From `device.<controllerUrl>.dataplane-min-cli-version`
+ * @param {string} params.cliVersion - Installed Builder CLI version
+ * @param {boolean} params.compatible - true when CLI ≥ minimum (or no minimum enforced)
+ * @returns {void}
+ */
+function displayDataplaneVersionSection({
+  connected,
+  dataplaneVersion,
+  minBuilderCliVersion,
+  cliVersion,
+  compatible
+}) {
+  if (!connected && !dataplaneVersion) {
+    // Nothing to add — keep auth status quiet when the dataplane probe failed
+    // and no cached version is known (the reachability line already told the user).
+    return;
+  }
+  logger.log(versionLine('Dataplane version', dataplaneVersion));
+  logger.log(versionLine('Min Builder CLI', minBuilderCliVersion));
+  logger.log(versionLine('This CLI', cliVersion));
+  if (!minBuilderCliVersion) {
+    logger.log(`  Compatibility: ${chalk.gray('Not enforced')}`);
+    return;
+  }
+  if (compatible) {
+    logger.log(`  Compatibility: ${successGlyph()} ${chalk.green('OK')}`);
+  } else {
+    logger.log(`  Compatibility: ${failureGlyph()} ${chalk.red('Upgrade required')}`);
+  }
+}
+
+/**
+ * Render the blocking upgrade block (red ✖ + Next actions) under the
+ * dataplane subsection when the CLI is incompatible.
+ *
+ * @param {Object} params
+ * @param {string} params.required - Required minimum semver
+ * @param {string} params.installed - Currently installed semver
+ * @returns {void}
+ */
+function displayCliUpgradeRequired({ required, installed }) {
+  logger.log('');
+  logger.log(formatCliVersionGateError(required, installed));
+}
+
+module.exports = {
+  displayDataplaneVersionSection,
+  displayCliUpgradeRequired
+};

package/lib/commands/auth-status.js

@@ -19,6 +19,19 @@ const { resolveControllerUrl } = require('../utils/controller-url');
 const { findDataplaneServiceAppKey } = require('./wizard-dataplane');
 const { getDataplaneUrl } = require('../datasource/deploy');
 const { checkDataplaneHealth } = require('../utils/dataplane-health');
+const {
+  displayDataplaneVersionSection,
+  displayCliUpgradeRequired
+} = require('./auth-status-display');
+const {
+  refreshDataplaneVersionInfo,
+  loadCachedVersionInfo
+} = require('./auth-status-dataplane-version');
+const {
+  EXIT_NOT_AUTHENTICATED,
+  EXIT_CLI_VERSION_INCOMPATIBLE,
+  EXIT_OK
+} = require('../utils/cli-exit-codes');
 
 /**
  * Format expiration date for display
@@ -290,6 +303,10 @@ function displayOpenApiDocs(controllerUrl, dataplaneUrl) {
  * @param {Object} [dataplaneInfo] - Optional dataplane URL and health
  * @param {string|null} [dataplaneInfo.url] - Dataplane URL
  * @param {boolean} [dataplaneInfo.connected] - Whether dataplane is reachable
+ * @param {string|undefined} [dataplaneInfo.dataplaneVersion]
+ * @param {string|undefined} [dataplaneInfo.minBuilderCliVersion]
+ * @param {string} [dataplaneInfo.cliVersion]
+ * @param {boolean} [dataplaneInfo.compatible]
  */
 function displayStatus(controllerUrl, environment, tokenInfo, dataplaneInfo) {
   logger.log(chalk.bold('\n🔐 Authentication Status\n'));
@@ -308,18 +325,61 @@ function displayStatus(controllerUrl, environment, tokenInfo, dataplaneInfo) {
 
   if (tokenInfo.authenticated && dataplaneInfo) {
     displayDataplaneSection(dataplaneInfo.url, dataplaneInfo.connected);
+    displayDataplaneVersionSection({
+      connected: dataplaneInfo.connected,
+      dataplaneVersion: dataplaneInfo.dataplaneVersion,
+      minBuilderCliVersion: dataplaneInfo.minBuilderCliVersion,
+      cliVersion: dataplaneInfo.cliVersion,
+      compatible: dataplaneInfo.compatible
+    });
+    if (dataplaneInfo.minBuilderCliVersion && dataplaneInfo.compatible === false) {
+      displayCliUpgradeRequired({
+        required: dataplaneInfo.minBuilderCliVersion,
+        installed: dataplaneInfo.cliVersion
+      });
+    }
   }
 
   logger.log('');
 }
 
+/**
+ * Resolve the dataplane block for auth status (URL, reachability, versions,
+ * compatibility). Returns null when no dataplane is discovered.
+ *
+ * @async
+ * @function buildDataplaneInfo
+ * @param {string} controllerUrl
+ * @param {string} environment
+ * @param {Object} authConfig - Bearer auth config built from a valid token
+ * @returns {Promise<Object|null>}
+ */
+async function buildDataplaneInfo(controllerUrl, environment, authConfig) {
+  const dataplaneUrl = await resolveDataplaneUrlSilent(controllerUrl, environment, authConfig);
+  if (!dataplaneUrl) {
+    return { url: null, connected: false };
+  }
+  const connected = await checkDataplaneHealth(dataplaneUrl, 5000);
+  const versionInfo = connected
+    ? await refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl)
+    : await loadCachedVersionInfo(controllerUrl);
+  return {
+    url: dataplaneUrl,
+    connected,
+    dataplaneVersion: versionInfo.dataplaneVersion,
+    minBuilderCliVersion: versionInfo.minBuilderCliVersion,
+    cliVersion: versionInfo.cliVersion,
+    compatible: versionInfo.compatible
+  };
+}
+
 /**
  * Handle auth status command
  * Controller and environment come from config.yaml (set via aifabrix login or aifabrix auth config).
  * @async
  * @function handleAuthStatus
  * @param {Object} options - Command options
- * @param {boolean} [options.validate] - If true, exit with code 1 when not authenticated
+ * @param {boolean} [options.validate] - If true, exit with code 1 when not authenticated, or code 3 when CLI is older than dataplane minimum
  * @returns {Promise<void>} Resolves when status is displayed
  */
 async function handleAuthStatus(options = {}) {
@@ -338,15 +398,19 @@ async function handleAuthStatus(options = {}) {
   let dataplaneInfo = null;
   if (tokenInfo && tokenInfo.authenticated && tokenInfo.token) {
     const authConfig = { type: 'bearer', token: tokenInfo.token };
-    const dataplaneUrl = await resolveDataplaneUrlSilent(controllerUrl, environment, authConfig);
-    const connected = dataplaneUrl ? await checkDataplaneHealth(dataplaneUrl, 5000) : false;
-    dataplaneInfo = { url: dataplaneUrl, connected };
+    dataplaneInfo = await buildDataplaneInfo(controllerUrl, environment, authConfig);
   }
 
   displayStatus(controllerUrl, environment, tokenInfo, dataplaneInfo);
 
-  if (options.validate && (!tokenInfo || !tokenInfo.authenticated)) {
-    process.exit(1);
+  if (options.validate) {
+    if (!tokenInfo || !tokenInfo.authenticated) {
+      process.exit(EXIT_NOT_AUTHENTICATED);
+    }
+    if (dataplaneInfo && dataplaneInfo.minBuilderCliVersion && dataplaneInfo.compatible === false) {
+      process.exit(EXIT_CLI_VERSION_INCOMPATIBLE);
+    }
+    process.exit(EXIT_OK);
   }
 }
 

package/lib/commands/credential-push.js

@@ -16,6 +16,7 @@ const { getDeploymentAuth, requireBearerForDataplanePipeline } = require('../uti
 const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
 const { getIntegrationPath } = require('../utils/paths');
 const { pushCredentialSecrets } = require('../utils/credential-secrets-env');
+const { runWithCredentialPushSpinner } = require('../utils/credential-push-ui');
 const { generateControllerManifest } = require('../generator/external-controller-manifest');
 
 /**
@@ -84,11 +85,15 @@ async function runCredentialPush(systemKey) {
   const dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig);
 
   const payload = await buildPayload(systemKey);
-  const pushResult = await pushCredentialSecrets(dataplaneUrl, authConfig, {
-    envFilePath,
-    appName: systemKey,
-    payload
-  });
+  const pushResult = await runWithCredentialPushSpinner(
+    () =>
+      pushCredentialSecrets(dataplaneUrl, authConfig, {
+        envFilePath,
+        appName: systemKey,
+        payload
+      }),
+    { systemKey }
+  );
 
   logPushResult(pushResult);
   return { pushed: pushResult.pushed || 0 };