@aifabrix/builder 2.45.0 → 2.46.0

package/lib/commands/setup-prompts-admin.js

@@ -0,0 +1,244 @@
+/**
+ * Admin credential prompts for `aifabrix setup` (dev / pro installation profiles).
+ *
+ * @fileoverview Setup installation profile + password bundle prompts
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const inquirer = require('inquirer');
+const logger = require('../utils/logger');
+const config = require('../core/config');
+const { generateProAdminPasswords } = require('../core/admin-password-generator');
+const {
+  singlePasswordBundle,
+  splitPasswordBundle
+} = require('../core/admin-secrets-bundle');
+const {
+  INSTALLATION_PROFILE,
+  normalizeInstallationProfile,
+  isProInstallationProfile
+} = require('../core/setup-installation-profile');
+const { validateEmail, validatePassword } = require('./setup-prompts-validators');
+
+/**
+ * Resolve installation profile from CLI options or config (interactive fallback in orchestrator).
+ * @param {Object} [options]
+ * @returns {Promise<'dev'|'pro'>}
+ */
+async function resolveInstallationProfileFromOptions(options = {}) {
+  const cli = options.installation ?? options.installationProfile;
+  if (cli !== undefined && cli !== null && String(cli).trim() !== '') {
+    return normalizeInstallationProfile(cli);
+  }
+  try {
+    return await config.getSetupInstallationProfile();
+  } catch {
+    return INSTALLATION_PROFILE.DEV;
+  }
+}
+
+/**
+ * @async
+ * @returns {Promise<'dev'|'pro'>}
+ */
+async function promptInstallationProfile() {
+  const { profile } = await inquirer.prompt([
+    {
+      type: 'list',
+      name: 'profile',
+      message: 'Installation profile:',
+      choices: [
+        {
+          name: 'Development (dev) — one admin password for all services',
+          value: INSTALLATION_PROFILE.DEV
+        },
+        {
+          name: 'Production (pro) — autogenerate strong passwords or enter manually',
+          value: INSTALLATION_PROFILE.PRO
+        }
+      ],
+      default: INSTALLATION_PROFILE.DEV
+    }
+  ]);
+  return profile;
+}
+
+/**
+ * @param {Object} [options]
+ * @returns {Promise<string>}
+ */
+async function promptAdminEmail(options = {}) {
+  const cli = String(options.adminEmail || '').trim();
+  if (cli) return cli;
+
+  let defaultEmail;
+  try {
+    const saved = await config.getAdminEmail();
+    defaultEmail = saved && saved.trim() ? saved.trim() : undefined;
+  } catch {
+    defaultEmail = undefined;
+  }
+  const emailQuestion = {
+    type: 'input',
+    name: 'adminEmail',
+    message: 'Admin email (Keycloak / pgAdmin login):',
+    validate: validateEmail
+  };
+  if (defaultEmail !== undefined) {
+    emailQuestion.default = defaultEmail;
+  }
+  const { adminEmail } = await inquirer.prompt([emailQuestion]);
+  return String(adminEmail).trim();
+}
+
+/**
+ * @async
+ * @returns {Promise<import('../core/admin-secrets-bundle').AdminPasswordBundleSingle>}
+ */
+async function promptDevPasswordBundle() {
+  const answers = await inquirer.prompt([
+    {
+      type: 'password',
+      name: 'adminPassword',
+      message: 'Admin password (Postgres / Keycloak / pgAdmin / platform login):',
+      mask: '*',
+      validate: validatePassword
+    },
+    {
+      type: 'password',
+      name: 'adminPasswordConfirm',
+      message: 'Confirm admin password:',
+      mask: '*',
+      validate(input, all) {
+        if (input !== all.adminPassword) return 'Passwords do not match';
+        return true;
+      }
+    }
+  ]);
+  return singlePasswordBundle(answers.adminPassword);
+}
+
+/**
+ * Print pro autogenerated passwords once (never log plaintext elsewhere).
+ * @param {{ infra: string, keycloak: string, platform: string }} passwords
+ */
+function displayProPasswordsOnce(passwords) {
+  logger.log('');
+  logger.log(chalk.bold.yellow('Save these passwords now — they will not be shown again.'));
+  logger.log(chalk.gray('────────────────────────────────────────'));
+  logger.log(`  Infra (Postgres / pgAdmin / Redis Commander): ${passwords.infra}`);
+  logger.log(`  Keycloak install admin:                     ${passwords.keycloak}`);
+  logger.log(`  Platform UI login (user admin):             ${passwords.platform}`);
+  logger.log(chalk.gray('────────────────────────────────────────'));
+  logger.log('');
+}
+
+/**
+ * @param {Object} [options]
+ * @returns {Promise<import('../core/admin-secrets-bundle').AdminPasswordBundleSingle|import('../core/admin-secrets-bundle').AdminPasswordBundleSplit>}
+ */
+async function promptProPasswordBundle(options = {}) {
+  const modeCli = String(options.proPasswordMode || '').trim().toLowerCase();
+  if (modeCli === 'autogen') {
+    const generated = generateProAdminPasswords();
+    if (options.quiet !== true) {
+      displayProPasswordsOnce(generated);
+    }
+    return splitPasswordBundle(generated);
+  }
+  if (modeCli === 'manual' && String(options.adminPassword || '').trim()) {
+    return singlePasswordBundle(String(options.adminPassword).trim());
+  }
+
+  const { method } = await inquirer.prompt([
+    {
+      type: 'list',
+      name: 'method',
+      message: 'How do you want to set admin passwords (pro installation)?',
+      choices: [
+        { name: 'Autogenerate strong passwords (recommended, shown once)', value: 'autogen' },
+        { name: 'Enter one password manually (same for all roles)', value: 'manual-single' },
+        { name: 'Enter separate passwords (infra / Keycloak / platform)', value: 'manual-split' }
+      ],
+      default: 'autogen'
+    }
+  ]);
+
+  if (method === 'autogen') {
+    const generated = generateProAdminPasswords();
+    displayProPasswordsOnce(generated);
+    return splitPasswordBundle(generated);
+  }
+  if (method === 'manual-split') {
+    return promptProManualSplitBundle();
+  }
+  return promptDevPasswordBundle();
+}
+
+/**
+ * @async
+ * @returns {Promise<import('../core/admin-secrets-bundle').AdminPasswordBundleSplit>}
+ */
+async function promptProManualSplitBundle() {
+  const answers = await inquirer.prompt([
+    {
+      type: 'password',
+      name: 'infra',
+      message: 'Infra password (Postgres / pgAdmin / Redis Commander):',
+      mask: '*',
+      validate: validatePassword
+    },
+    {
+      type: 'password',
+      name: 'keycloak',
+      message: 'Keycloak install admin password:',
+      mask: '*',
+      validate: validatePassword
+    },
+    {
+      type: 'password',
+      name: 'platform',
+      message: 'Platform UI login password (user admin):',
+      mask: '*',
+      validate: validatePassword
+    }
+  ]);
+  return splitPasswordBundle(answers);
+}
+
+/**
+ * @param {Object} [options]
+ * @returns {Promise<{ adminEmail: string, passwordBundle: object, profile: 'dev'|'pro' }>}
+ */
+async function promptAdminCredentialsWithProfile(options = {}) {
+  let profile = await resolveInstallationProfileFromOptions(options);
+  const hasCliProfile =
+    options.installation !== undefined ||
+    options.installationProfile !== undefined;
+  if (!hasCliProfile) {
+    profile = await promptInstallationProfile();
+  }
+  await config.setSetupInstallationProfile(profile);
+
+  const adminEmail = await promptAdminEmail(options);
+  const passwordBundle = isProInstallationProfile(profile)
+    ? await promptProPasswordBundle(options)
+    : await promptDevPasswordBundle();
+
+  return { adminEmail, passwordBundle, profile };
+}
+
+module.exports = {
+  INSTALLATION_PROFILE,
+  resolveInstallationProfileFromOptions,
+  promptInstallationProfile,
+  promptAdminEmail,
+  promptDevPasswordBundle,
+  promptProPasswordBundle,
+  displayProPasswordsOnce,
+  promptAdminCredentialsWithProfile
+};

package/lib/commands/setup-prompts-platform-mode.js

@@ -0,0 +1,67 @@
+/**
+ * Setup prompts for platform topology mode (single vs full).
+ *
+ * @fileoverview Setup platform mode prompt + CLI option normalization
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const inquirer = require('inquirer');
+const { normalizeSetupPlatformMode, SETUP_PLATFORM_MODE } = require('../core/setup-platform-mode');
+
+/**
+ * Resolve platform mode from CLI options, if provided.
+ * @param {Object} [options]
+ * @returns {'single'|'full'|null}
+ */
+function resolvePlatformModeFromOptions(options = {}) {
+  const raw = options.platform;
+  if (raw === undefined || raw === null || String(raw).trim() === '') {
+    return null;
+  }
+  const normalized = normalizeSetupPlatformMode(raw);
+  // Guard: only accept exact canonical values from CLI; reject unexpected to avoid silent typos.
+  const rawNorm = String(raw).trim().toLowerCase();
+  if (rawNorm !== 'single' && rawNorm !== 'full') {
+    throw new Error('--platform must be single or full (example: aifabrix setup --platform full)');
+  }
+  return normalized;
+}
+
+/**
+ * @async
+ * @param {Object} [options]
+ * @returns {Promise<'single'|'full'>}
+ */
+async function promptSetupPlatformMode(options = {}) {
+  const fromCli = resolvePlatformModeFromOptions(options);
+  if (fromCli) return fromCli;
+
+  const { mode } = await inquirer.prompt([
+    {
+      type: 'list',
+      name: 'mode',
+      message: 'Platform mode:',
+      choices: [
+        {
+          name: 'Single environment — direct ports (no Traefik front door)',
+          value: SETUP_PLATFORM_MODE.SINGLE
+        },
+        {
+          name: 'Full platform — Traefik front door + miso/dev/tst/pro (shared infra)',
+          value: SETUP_PLATFORM_MODE.FULL
+        }
+      ],
+      default: SETUP_PLATFORM_MODE.SINGLE
+    }
+  ]);
+  return normalizeSetupPlatformMode(mode);
+}
+
+module.exports = {
+  resolvePlatformModeFromOptions,
+  promptSetupPlatformMode
+};
+

package/lib/commands/setup-prompts-validators.js

@@ -0,0 +1,36 @@
+/**
+ * Shared validators for setup prompts.
+ *
+ * @fileoverview Email/password validation for setup wizard
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {string} input
+ * @returns {true|string}
+ */
+function validateEmail(input) {
+  const value = (input || '').trim();
+  if (!value) return 'Admin email is required';
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)) return 'Enter a valid email address';
+  return true;
+}
+
+/**
+ * @param {string} input
+ * @returns {true|string}
+ */
+function validatePassword(input) {
+  const value = String(input ?? '');
+  if (value.length === 0) return 'Admin password is required';
+  if (value.length < 8) return 'Admin password must be at least 8 characters';
+  return true;
+}
+
+module.exports = {
+  validateEmail,
+  validatePassword
+};

package/lib/commands/setup-prompts.js

@@ -28,16 +28,20 @@ const path = require('path');
 const inquirer = require('inquirer');
 const chalk = require('chalk');
 const logger = require('../utils/logger');
-const config = require('../core/config');
 const secretsCore = require('../core/secrets');
 const secretsEnsure = require('../core/secrets-ensure');
 const { formatSuccessLine, infoLine } = require('../utils/cli-test-layout-chalk');
+const { validateEmail, validatePassword } = require('./setup-prompts-validators');
+const {
+  promptAdminCredentialsWithProfile,
+  promptInstallationProfile,
+  INSTALLATION_PROFILE
+} = require('./setup-prompts-admin');
 
 /** Mode identifiers. Public so callers can switch on them without string typos. */
 const MODE = Object.freeze({
   REINSTALL: 'reinstall',
   WIPE_DATA: 'wipe-data',
-  CLEAN_FILES: 'clean-files',
   UPDATE_IMAGES: 'update-images'
 });
 
@@ -76,10 +80,6 @@ async function promptModeSelection() {
           name: 'Reset databases (keeps volumes, removes DBs/users)',
           value: MODE.WIPE_DATA
         },
-        {
-          name: 'Refresh platform config (keeps data, re-copy platform files)',
-          value: MODE.CLEAN_FILES
-        },
         {
           name: 'Update images + restart services (keeps data)',
           value: MODE.UPDATE_IMAGES
@@ -111,79 +111,23 @@ async function confirmDestructiveMode(mode, assumeYes) {
 }
 
 /**
- * Validate an email address (RFC 5322-lite for CLI use).
- * @param {string} input
- * @returns {true|string}
- */
-function validateEmail(input) {
-  const value = (input || '').trim();
-  if (!value) return 'Admin email is required';
-  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)) return 'Enter a valid email address';
-  return true;
-}
-
-/**
- * Validate a password (non-empty, at least 8 chars).
- * @param {string} input
- * @returns {true|string}
- */
-function validatePassword(input) {
-  const value = String(input ?? '');
-  if (value.length === 0) return 'Admin password is required';
-  if (value.length < 8) return 'Admin password must be at least 8 characters';
-  return true;
-}
-
-/**
- * Prompt for admin email + password (fresh install only).
- * Reads {@link module:lib/core/config.getAdminEmail} so a previous `aifabrix setup` can prefill the
- * email field (user may change it before continuing).
- * Asks once for the password and once for confirmation; returns trimmed email
- * and the verbatim password (never logged).
+ * Prompt for admin credentials (dev or pro installation profile).
  *
  * @async
- * @returns {Promise<{ adminEmail: string, adminPassword: string }>}
+ * @param {Object} [options] - CLI options (`installation`, `proPasswordMode`, `adminEmail`, `adminPassword`, `quiet`)
+ * @returns {Promise<{ adminEmail: string, adminPassword: string, passwordBundle: object, profile: string }>}
  */
-async function promptAdminCredentials() {
-  let defaultEmail;
-  try {
-    const saved = await config.getAdminEmail();
-    defaultEmail = saved && saved.trim() ? saved.trim() : undefined;
-  } catch {
-    defaultEmail = undefined;
-  }
-  const emailQuestion = {
-    type: 'input',
-    name: 'adminEmail',
-    message: 'Admin email (Keycloak / pgAdmin login):',
-    validate: validateEmail
-  };
-  if (defaultEmail !== undefined) {
-    emailQuestion.default = defaultEmail;
-  }
-  const answers = await inquirer.prompt([
-    emailQuestion,
-    {
-      type: 'password',
-      name: 'adminPassword',
-      message: 'Admin password (Postgres / Keycloak / pgAdmin):',
-      mask: '*',
-      validate: validatePassword
-    },
-    {
-      type: 'password',
-      name: 'adminPasswordConfirm',
-      message: 'Confirm admin password:',
-      mask: '*',
-      validate(input, all) {
-        if (input !== all.adminPassword) return 'Passwords do not match';
-        return true;
-      }
-    }
-  ]);
+async function promptAdminCredentials(options = {}) {
+  const result = await promptAdminCredentialsWithProfile(options);
+  const legacyPassword =
+    result.passwordBundle.mode === 'single'
+      ? result.passwordBundle.password
+      : result.passwordBundle.platform;
   return {
-    adminEmail: String(answers.adminEmail).trim(),
-    adminPassword: answers.adminPassword
+    adminEmail: result.adminEmail,
+    adminPassword: legacyPassword,
+    passwordBundle: result.passwordBundle,
+    profile: result.profile
   };
 }
 
@@ -411,11 +355,15 @@ module.exports = {
   MODE,
   AI_KEYS,
   BUILDER_DIR_ACTION,
+  INSTALLATION_PROFILE,
   formatBuilderPlatformReplaceLines,
   promptModeSelection,
   confirmDestructiveMode,
+  promptInstallationProfile,
   promptAdminCredentials,
   promptAiTool,
   detectAiToolStatus,
-  promptBuilderDirConflict
+  promptBuilderDirConflict,
+  validateEmail,
+  validatePassword
 };

package/lib/commands/setup-run-context.js

@@ -0,0 +1,45 @@
+/**
+ * Marks when `aifabrix setup` is running platform bring-up (suppress noisy token refresh warnings).
+ *
+ * @fileoverview Setup flow context flag
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+let setupPlatformFlowActive = false;
+let setupCommandFlowActive = false;
+
+function beginSetupCommandFlow() {
+  setupCommandFlowActive = true;
+}
+
+function endSetupCommandFlow() {
+  setupCommandFlowActive = false;
+}
+
+function isSetupCommandFlow() {
+  return setupCommandFlowActive === true;
+}
+
+function beginSetupPlatformFlow() {
+  setupPlatformFlowActive = true;
+}
+
+function endSetupPlatformFlow() {
+  setupPlatformFlowActive = false;
+}
+
+function isSetupPlatformFlow() {
+  return setupPlatformFlowActive === true;
+}
+
+module.exports = {
+  beginSetupCommandFlow,
+  endSetupCommandFlow,
+  isSetupCommandFlow,
+  beginSetupPlatformFlow,
+  endSetupPlatformFlow,
+  isSetupPlatformFlow
+};

package/lib/commands/setup-spinners.js

@@ -0,0 +1,39 @@
+/**
+ * Spinner helpers for `aifabrix setup` mode handlers.
+ *
+ * @fileoverview TTY progress spinners for setup commands
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const ora = require('ora');
+const logger = require('../utils/logger');
+const { formatProgress, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+
+function shouldUseSpinner() {
+  return Boolean(process && process.stdout && process.stdout.isTTY);
+}
+
+function startSpinner(text) {
+  if (!shouldUseSpinner()) {
+    logger.log(formatProgress(text));
+    return null;
+  }
+  return ora({ text, spinner: 'dots' }).start();
+}
+
+function stopSpinnerSuccess(spinner, text) {
+  if (!spinner) {
+    logger.log(formatSuccessLine(text));
+    return;
+  }
+  spinner.succeed(text);
+}
+
+module.exports = {
+  shouldUseSpinner,
+  startSpinner,
+  stopSpinnerSuccess
+};

package/lib/commands/setup.js

@@ -2,8 +2,8 @@
  * Top-level handler for `aifabrix setup`.
  *
  * Decides between:
- *   - fresh install (no infra running) — wizard for admin creds + AI tool, then up-infra + up-platform.
- *   - mode menu (infra already running) — dispatch one of four destructive/refresh paths.
+ *   - fresh install (no infra running) — wipe volumes, wizard for admin creds + AI tool, then up-infra + up-platform.
+ *   - mode menu (infra already running) — dispatch one of three destructive/refresh paths.
  *
  * The mode handlers live in `setup-modes.js`; the prompts live in
  * `setup-prompts.js`. This module is a thin orchestrator so it stays well
@@ -28,8 +28,12 @@ const {
 } = require('../utils/cli-test-layout-chalk');
 
 const setupPrompts = require('./setup-prompts');
+const setupPlatformModePrompts = require('./setup-prompts-platform-mode');
+const { flagsForSetupPlatformMode } = require('../core/setup-platform-mode');
 const setupModes = require('./setup-modes');
+const { syncPlatformControllerUrlsInConfig } = require('./setup-platform-auth');
 const installationLog = require('../utils/installation-log');
+const { beginSetupCommandFlow, endSetupCommandFlow } = require('./setup-run-context');
 
 const MODE = setupPrompts.MODE;
 
@@ -54,10 +58,24 @@ async function maybePinDeveloperIdForFreshInstall(rawDeveloper) {
   logger.log(infoLine(`Developer ID pinned to ${dev}.`));
 }
 
+async function applySetupPlatformMode(options) {
+  const mode = await setupPlatformModePrompts.promptSetupPlatformMode(options);
+  await config.setSetupPlatformMode(mode);
+  const derived = flagsForSetupPlatformMode(mode);
+  // These are the user gates that control full-mode behavior.
+  const cfg = await config.getConfig();
+  cfg.traefik = derived.traefik;
+  cfg.useEnvironmentScopedResources = derived.useEnvironmentScopedResources;
+  await config.saveConfig(cfg);
+  await syncPlatformControllerUrlsInConfig();
+  return mode;
+}
+
 async function runFreshInstallFlow(options) {
   await maybePinDeveloperIdForFreshInstall(options.developer);
   logger.log(infoLine('No infrastructure detected; starting fresh install.'));
-  const adminCreds = await setupPrompts.promptAdminCredentials();
+  await applySetupPlatformMode(options);
+  const adminCreds = await setupPrompts.promptAdminCredentials(options);
   await config.setAdminEmail(adminCreds.adminEmail);
   await setupModes.runFreshInstall(adminCreds);
   logger.log(formatSuccessParagraph('aifabrix setup complete (fresh install).'));
@@ -74,6 +92,10 @@ async function runExistingInfraFlow(assumeYes) {
     logger.log(chalk.yellow('Aborted by user.'));
     return { aborted: true, mode };
   }
+  // Re-install / wipe-data can change platform topology; re-prompt so the next up-platform matches intent.
+  if (mode === MODE.REINSTALL || mode === MODE.WIPE_DATA) {
+    await applySetupPlatformMode({});
+  }
   await dispatchMode(mode);
   logger.log(formatSuccessParagraph(`aifabrix setup complete (mode: ${mode}).`));
   return { aborted: false, mode };
@@ -114,8 +136,6 @@ async function dispatchMode(mode) {
     return setupModes.runReinstall();
   case MODE.WIPE_DATA:
     return setupModes.runWipeData();
-  case MODE.CLEAN_FILES:
-    return setupModes.runCleanInstallFiles();
   case MODE.UPDATE_IMAGES:
     return setupModes.runUpdateImages();
   default:
@@ -224,6 +244,7 @@ async function handleSetup(options = {}) {
   let setupMode = null;
   let err = null;
 
+  beginSetupCommandFlow();
   try {
     const main = await runSetupMainPath(options, assumeYes);
     outcome = main.outcome;
@@ -232,6 +253,7 @@ async function handleSetup(options = {}) {
     outcome = 'failure';
     err = e;
   } finally {
+    endSetupCommandFlow();
     await appendSetupInstallationRecord({
       outcome,
       startedAt,