@aifabrix/builder 2.45.0 → 2.46.0

package/lib/api/wizard.api.js

@@ -4,7 +4,7 @@
  * @version 2.0.0
  */
 
-const { ApiClient } = require('./index');
+const { createDataplaneApiClient } = require('./index');
 const { uploadFile } = require('../utils/file-upload');
 const { getPlatformDetails, discoverEntities } = require('./wizard-platform.api');
 
@@ -22,7 +22,7 @@ const { getPlatformDetails, discoverEntities } = require('./wizard-platform.api'
  * @throws {Error} If request fails
  */
 async function createWizardSession(dataplaneUrl, authConfig, mode, systemIdOrKey = null) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   const body = { mode };
   if (systemIdOrKey) {
     body.systemIdOrKey = systemIdOrKey;
@@ -45,7 +45,7 @@ async function createWizardSession(dataplaneUrl, authConfig, mode, systemIdOrKey
  * @throws {Error} If request fails
  */
 async function getWizardSession(dataplaneUrl, sessionId, authConfig) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.get(`/api/v1/wizard/sessions/${sessionId}`);
 }
 
@@ -75,7 +75,7 @@ async function getWizardSession(dataplaneUrl, sessionId, authConfig) {
  * @throws {Error} If request fails
  */
 async function updateWizardSession(dataplaneUrl, sessionId, authConfig, updateData) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.put(`/api/v1/wizard/sessions/${sessionId}`, {
     body: updateData
   });
@@ -94,7 +94,7 @@ async function updateWizardSession(dataplaneUrl, sessionId, authConfig, updateDa
  * @throws {Error} If request fails
  */
 async function deleteWizardSession(dataplaneUrl, sessionId, authConfig) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.delete(`/api/v1/wizard/sessions/${sessionId}`);
 }
 
@@ -111,7 +111,7 @@ async function deleteWizardSession(dataplaneUrl, sessionId, authConfig) {
  * @throws {Error} If request fails
  */
 async function getWizardProgress(dataplaneUrl, sessionId, authConfig) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.get(`/api/v1/wizard/sessions/${sessionId}/progress`);
 }
 
@@ -130,7 +130,7 @@ async function getWizardProgress(dataplaneUrl, sessionId, authConfig) {
  */
 async function parseOpenApi(dataplaneUrl, authConfig, openApiFilePathOrUrl, isUrl = false) {
   if (isUrl) {
-    const client = new ApiClient(dataplaneUrl, authConfig);
+    const client = createDataplaneApiClient(dataplaneUrl, authConfig);
     return await client.post(`/api/v1/wizard/parse-openapi?url=${encodeURIComponent(openApiFilePathOrUrl)}`);
   }
   const url = `${dataplaneUrl.replace(/\/$/, '')}/api/v1/wizard/parse-openapi`;
@@ -153,7 +153,7 @@ async function parseOpenApi(dataplaneUrl, authConfig, openApiFilePathOrUrl, isUr
  * @throws {Error} If request fails
  */
 async function credentialSelection(dataplaneUrl, authConfig, selectionData) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post('/api/v1/wizard/credential-selection', {
     body: selectionData
   });
@@ -172,7 +172,7 @@ async function credentialSelection(dataplaneUrl, authConfig, selectionData) {
  * @throws {Error} If request fails
  */
 async function detectType(dataplaneUrl, authConfig, openapiSpec) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post('/api/v1/wizard/detect-type', {
     body: { openapiSpec }
   });
@@ -199,7 +199,7 @@ async function detectType(dataplaneUrl, authConfig, openapiSpec) {
  * @throws {Error} If request fails
  */
 async function getPlatformConfig(dataplaneUrl, authConfig, platformKey, config) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post(`/api/v1/wizard/platforms/${encodeURIComponent(platformKey)}/config`, {
     body: config
   });
@@ -233,7 +233,7 @@ async function getPlatformConfig(dataplaneUrl, authConfig, platformKey, config)
  * @throws {Error} If request fails
  */
 async function generateConfig(dataplaneUrl, authConfig, config) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post('/api/v1/wizard/generate-config', {
     body: config
   });
@@ -252,7 +252,7 @@ async function generateConfig(dataplaneUrl, authConfig, config) {
  * @throws {Error} If request fails
  */
 async function generateConfigStream(dataplaneUrl, authConfig, config) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post('/api/v1/wizard/generate-config-stream', {
     body: config
   });
@@ -272,7 +272,7 @@ async function generateConfigStream(dataplaneUrl, authConfig, config) {
  * @throws {Error} If request fails
  */
 async function validateWizardConfig(dataplaneUrl, authConfig, systemConfig, datasourceConfig) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post('/api/v1/wizard/validate', {
     body: {
       systemConfig,
@@ -294,7 +294,7 @@ async function validateWizardConfig(dataplaneUrl, authConfig, systemConfig, data
  * @throws {Error} If request fails
  */
 async function validateAllSteps(dataplaneUrl, sessionId, authConfig) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.get(`/api/v1/wizard/sessions/${sessionId}/validate`);
 }
 
@@ -312,7 +312,7 @@ async function validateAllSteps(dataplaneUrl, sessionId, authConfig) {
  * @throws {Error} If request fails
  */
 async function validateStep(dataplaneUrl, sessionId, authConfig, stepNumber) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post(`/api/v1/wizard/sessions/${sessionId}/validate-step?step=${stepNumber}`);
 }
 
@@ -329,7 +329,7 @@ async function validateStep(dataplaneUrl, sessionId, authConfig, stepNumber) {
  * @throws {Error} If request fails
  */
 async function getPreview(dataplaneUrl, sessionId, authConfig) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.get(`/api/v1/wizard/preview/${sessionId}`);
 }
 
@@ -347,7 +347,7 @@ async function getPreview(dataplaneUrl, sessionId, authConfig) {
  * @throws {Error} If request fails
  */
 async function testMcpConnection(dataplaneUrl, authConfig, serverUrl, token) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post('/api/v1/wizard/test-mcp-connection', {
     body: {
       serverUrl,
@@ -369,7 +369,7 @@ async function testMcpConnection(dataplaneUrl, authConfig, serverUrl, token) {
  * @throws {Error} If request fails
  */
 async function getDeploymentDocs(dataplaneUrl, authConfig, systemKey) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.get(`/api/v1/wizard/deployment-docs/${systemKey}`);
 }
 
@@ -390,7 +390,7 @@ async function getDeploymentDocs(dataplaneUrl, authConfig, systemKey) {
  * @throws {Error} If request fails
  */
 async function postDeploymentDocs(dataplaneUrl, authConfig, systemKey, body = null) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post(`/api/v1/wizard/deployment-docs/${systemKey}`, {
     body: body || {}
   });
@@ -410,7 +410,7 @@ async function postDeploymentDocs(dataplaneUrl, authConfig, systemKey, body = nu
  */
 async function getWizardPlatforms(dataplaneUrl, authConfig) {
   try {
-    const client = new ApiClient(dataplaneUrl, authConfig);
+    const client = createDataplaneApiClient(dataplaneUrl, authConfig);
     const response = await client.get('/api/v1/wizard/platforms');
     const platforms = response?.data?.platforms ?? response?.platforms ?? [];
     return Array.isArray(platforms) ? platforms : [];
@@ -433,7 +433,7 @@ async function getWizardPlatforms(dataplaneUrl, authConfig) {
  * @throws {Error} If request fails
  */
 async function listWizardCredentials(dataplaneUrl, authConfig, options = {}) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.get('/api/v1/wizard/credentials', {
     params: options
   });

package/lib/app/deploy-config.js

@@ -60,7 +60,10 @@ async function extractDeploymentConfig(options, _variables) {
   const { resolveEnvironment } = require('../core/config');
 
   const controllerUrl = await resolveControllerUrl();
-  const envKey = await resolveEnvironment();
+  const envKey =
+    options && options.envKey
+      ? String(options.envKey).trim().toLowerCase()
+      : await resolveEnvironment();
 
   const pollIntervalExplicit =
     options.pollInterval !== undefined && options.pollInterval !== null

package/lib/app/deploy.js

@@ -421,6 +421,35 @@ async function tryExternalDeployFallback(appName, options) {
   return { usedExternalDeploy: false, result: null };
 }
 
+function assertDeployNotProtectionScope(appName) {
+  const { isProtectionScope } = require('../protection/scope');
+  if (!isProtectionScope(appName)) {
+    return;
+  }
+  const { formatDeployProtectionNotImplementedTTY } = require('../protection/protection-display');
+  logger.error(formatDeployProtectionNotImplementedTTY());
+  process.exit(1);
+}
+
+/**
+ * Run external, fallback, or standard deployment paths.
+ * @param {string} appName
+ * @param {Object} options
+ * @returns {Promise<{ result: Object, usedExternalDeploy: boolean, controllerUrl?: string }>}
+ */
+async function executeDeployPipeline(appName, options) {
+  const externalResult = await handleExternalDeployment(appName, options);
+  if (externalResult) {
+    return { result: externalResult, usedExternalDeploy: true };
+  }
+  const fallback = await tryExternalDeployFallback(appName, options);
+  if (fallback.result) {
+    return { result: fallback.result, usedExternalDeploy: fallback.usedExternalDeploy };
+  }
+  const { result, controllerUrl } = await executeStandardDeployment(appName, options);
+  return { result, usedExternalDeploy: false, controllerUrl };
+}
+
 /**
  * Deploys application to Miso Controller
  * Orchestrates manifest generation, key creation, and deployment
@@ -446,26 +475,12 @@ async function deployApp(appName, options = {}) {
   let usedExternalDeploy = false;
 
   try {
-    if (!appName || typeof appName !== 'string' || appName.trim().length === 0) {
-      throw new Error('App name is required');
-    }
+    assertDeployNotProtectionScope(appName);
     validateAppName(appName);
-
-    const externalResult = await handleExternalDeployment(appName, options);
-    if (externalResult) {
-      usedExternalDeploy = true;
-      return { result: externalResult, usedExternalDeploy: true };
-    }
-
-    const fallback = await tryExternalDeployFallback(appName, options);
-    if (fallback.result) {
-      usedExternalDeploy = fallback.usedExternalDeploy;
-      return { result: fallback.result, usedExternalDeploy };
-    }
-
-    const { result, controllerUrl: url } = await executeStandardDeployment(appName, options);
-    controllerUrl = url;
-    return { result, usedExternalDeploy: false };
+    const pipeline = await executeDeployPipeline(appName, options);
+    controllerUrl = pipeline.controllerUrl ?? null;
+    usedExternalDeploy = pipeline.usedExternalDeploy;
+    return { result: pipeline.result, usedExternalDeploy };
   } catch (error) {
     await handleDeploymentError(error, appName, controllerUrl, usedExternalDeploy);
   }

package/lib/app/down.js

@@ -48,6 +48,8 @@ function execAsync(command, options = {}) {
  * @param {number|string} developerId - Developer ID
  * @returns {string} Docker volume name
  */
+const { collectDeveloperVolumeIdSuffixes } = require('../utils/developer-volume-id');
+
 function getAppVolumeName(appName, developerId) {
   const idNum = typeof developerId === 'string' ? parseInt(developerId, 10) : developerId;
   if (idNum === 0) {
@@ -56,6 +58,22 @@ function getAppVolumeName(appName, developerId) {
   return `aifabrix_dev${developerId}_${appName}_data`;
 }
 
+/**
+ * Docker volume name candidates for an app (handles dev6 vs dev06 naming drift).
+ *
+ * @param {string} appName
+ * @param {string|number} developerId
+ * @returns {string[]}
+ */
+function getAppVolumeNameCandidates(appName, developerId) {
+  const idNum = typeof developerId === 'string' ? parseInt(developerId, 10) : developerId;
+  if (idNum === 0) {
+    return [`aifabrix_${appName}_data`, `aifabrix_dev0_${appName}_data`];
+  }
+  const suffixes = collectDeveloperVolumeIdSuffixes(developerId);
+  return suffixes.map((suffix) => `aifabrix_dev${suffix}_${appName}_data`);
+}
+
 /**
  * Stops and removes a specific application's container.
  * If --volumes is passed, attempts to remove the app's named Docker volume.
@@ -120,6 +138,7 @@ async function downApp(appName, options = {}) {
 
 module.exports = {
   downApp,
-  getAppVolumeName
+  getAppVolumeName,
+  getAppVolumeNameCandidates
 };
 

package/lib/app/push.js

@@ -19,7 +19,7 @@ const {
 
 const pushUtils = require('../deployment/push');
 const logger = require('../utils/logger');
-const { detectAppType } = require('../utils/paths');
+const paths = require('../utils/paths');
 
 /**
  * Validate application name format
@@ -92,11 +92,10 @@ function extractImageName(config, appName) {
  * @throws {Error} If configuration cannot be loaded
  */
 async function loadPushConfig(appName, options) {
-  const { detectAppType, resolveApplicationConfigPath } = require('../utils/paths');
   const { loadConfigFile } = require('../utils/config-format');
-  const { appPath } = await detectAppType(appName);
   try {
-    const configPath = resolveApplicationConfigPath(appPath);
+    const { appPath } = await paths.detectAppType(appName);
+    const configPath = paths.resolveApplicationConfigPath(appPath);
     const config = loadConfigFile(configPath);
     const effective = getEffectiveConfig(config);
     const registry = options.registry || effective.image?.registry;
@@ -242,7 +241,7 @@ function displayPushResults(registry, imageName, tags) {
  */
 async function pushApp(appName, options = {}) {
   try {
-    const { isExternal } = await detectAppType(appName);
+    const { isExternal } = await paths.detectAppType(appName);
     if (isExternal) {
       logExternalIntegrationPushNotice(appName);
       return;

package/lib/app/register.js

@@ -25,6 +25,8 @@ const { callRegisterApi } = require('../utils/app-register-api');
 const { displayRegistrationResults, getEnvironmentPrefix } = require('../utils/app-register-display');
 const pathsUtil = require('../utils/paths');
 const { refreshUrlsLocalRegistryFromBuilder } = require('../utils/urls-local-registry');
+const { resolveControllerUrl } = require('../utils/controller-url');
+const config = require('../core/config');
 
 /**
  * Build registration data payload from app configuration
@@ -152,9 +154,6 @@ async function applyLocalhostPortAdjustment(appConfig, apiUrl, options) {
  */
 async function registerApplication(appKey, options = {}) {
   logger.log(chalk.blue('📋 Registering application...\n'));
-
-  const { resolveControllerUrl } = require('../utils/controller-url');
-  const config = require('../core/config');
   await config.ensureSecretsEncryptionKey();
   const { resolveEnvironment } = config;
 
@@ -168,7 +167,11 @@ async function registerApplication(appKey, options = {}) {
   const appConfig = await extractAppConfiguration(finalVariables, appKey, options);
   await validateAppRegistrationData(appConfig, appKey);
 
-  const [controllerUrl, environmentKey] = await Promise.all([resolveControllerUrl(), resolveEnvironment()]);
+  const controllerUrl = await resolveControllerUrl();
+  const environmentKey =
+    options && options.envKey
+      ? String(options.envKey).trim().toLowerCase()
+      : await resolveEnvironment();
   const authConfig = await checkAuthentication(controllerUrl, environmentKey);
   const environment = registerApplicationSchema.environmentId(environmentKey);
 

package/lib/app/run-env-compose.js

@@ -14,9 +14,28 @@ const fs = require('fs').promises;
 const fsSync = require('fs');
 const pathsUtil = require('../utils/paths');
 const adminSecrets = require('../core/admin-secrets');
+const config = require('../core/config');
 const secretsEnsure = require('../core/secrets-ensure');
 const secretsEnvWrite = require('../core/secrets-env-write');
 const { getContainerPort } = require('../utils/port-resolver');
+const { applyAdminSecretsPlatformOverlay } = require('../core/admin-secrets-env-overlay');
+
+/**
+ * Merge app env with admin-secrets; overlay ensures platform keys come from admin file.
+ * @param {Object.<string, string>} merged
+ * @param {Object.<string, string>} adminObj
+ */
+function mergeRunEnvWithAdminOverlay(merged, adminObj) {
+  applyAdminSecretsPlatformOverlay(merged, adminObj);
+}
+
+async function applyOnboardingPlatformModeIfNeeded(appName, merged) {
+  if (appName !== 'miso-controller') {
+    return;
+  }
+  const mode = await config.getSetupPlatformMode();
+  merged.ONBOARDING_FULL_PLATFORM = mode === 'full' ? 'true' : 'false';
+}
 
 /**
  * Backfill only secrets needed for `aifabrix run <app>`: kv:// keys from that app's env.template
@@ -194,31 +213,72 @@ async function readPasswordFromPgpassFile(pgpassPath) {
 }
 
 /**
- * Read POSTGRES_PASSWORD from `pgpass` next to the active infra compose (same as `resolveInfraStatePaths()`).
- * Does not use `getAifabrixHome()` alone, so a stale pgpass under the wrong base directory (e.g. when
- * `aifabrix-home` points at $HOME but compose lives under the config dir) cannot override admin-secrets.
+ * Read POSTGRES_PASSWORD from pgpass-style files beside the active infra compose
+ * (`resolveInfraStatePaths()`). Tries legacy `pgpass`, then `.pgpass.bootstrap` written at `up-infra`
+ * so db-init matches the password Postgres was started with when admin-secrets later drifted.
  * @param {number|string} developerId - Developer ID
  * @returns {Promise<string|undefined>} Password or undefined
  */
 async function readPostgresPasswordFromPgpass(developerId) {
-  const { resolveInfraStatePaths } = require('../infrastructure/helpers');
+  const { resolveInfraStatePaths, PGPASS_BOOTSTRAP_BASENAME } = require('../infrastructure/helpers');
   const { infraDir } = resolveInfraStatePaths(developerId);
-  const pgpassPath = path.join(infraDir, 'pgpass');
-  if (!fsSync.existsSync(pgpassPath)) {
-    return undefined;
-  }
-  try {
-    const pwd = await readPasswordFromPgpassFile(pgpassPath);
-    return pwd;
-  } catch {
-    return undefined;
+  const candidates = ['pgpass', PGPASS_BOOTSTRAP_BASENAME];
+  for (const name of candidates) {
+    const pgpassPath = path.join(infraDir, name);
+    if (!fsSync.existsSync(pgpassPath)) {
+      continue;
+    }
+    try {
+      const pwd = await readPasswordFromPgpassFile(pgpassPath);
+      if (pwd !== undefined && pwd !== '') {
+        return pwd;
+      }
+    } catch {
+      // try next candidate
+    }
   }
+  return undefined;
+}
+
+/**
+ * @returns {Function}
+ */
+function resolveEnsureAdminSecretsFn() {
+  const infra = require('../infrastructure');
+  return typeof infra.ensureAdminSecrets === 'function'
+    ? infra.ensureAdminSecrets
+    : require('../infrastructure/helpers').ensureAdminSecrets;
+}
+
+/**
+ * @param {Object} merged
+ * @param {number|string|undefined} developerId
+ * @returns {Promise<void>}
+ */
+async function applyPostgresPasswordFromPgpass(merged, developerId) {
+  if (developerId === undefined) return;
+  const pgpassPwd = await readPostgresPasswordFromPgpass(developerId);
+  if (pgpassPwd !== undefined) merged.POSTGRES_PASSWORD = pgpassPwd;
+}
+
+/**
+ * @param {string} runEnvPath
+ * @param {string} runEnvAdminPath
+ * @param {Object} appOnly
+ * @param {Object} dbInitOnly
+ * @returns {Promise<void>}
+ */
+async function writeRunEnvFiles(runEnvPath, runEnvAdminPath, appOnly, dbInitOnly) {
+  const toContent = adminSecrets.envObjectToContent;
+  await fs.writeFile(runEnvPath, toContent(appOnly), { mode: 0o600 });
+  await fs.writeFile(runEnvAdminPath, toContent(dbInitOnly), { mode: 0o600 });
 }
 
 /**
  * Build two run env files: .env.run (app-only, no admin secrets) and .env.run.admin (start-only, for db-init).
  * Admin password is never set in the app container; .env.run.admin is used only for start and then deleted.
- * When `pgpass` exists beside the active infra compose, POSTGRES_PASSWORD is taken from it so db-init matches Postgres.
+ * When `pgpass` or `.pgpass.bootstrap` exists beside the active infra compose, POSTGRES_PASSWORD is taken
+ * from it so db-init matches Postgres.
  * @async
  * @param {string} appName - Application name
  * @param {Object} appConfig - Application configuration
@@ -227,12 +287,8 @@ async function readPostgresPasswordFromPgpass(developerId) {
  * @returns {Promise<{ runEnvPath: string, runEnvAdminPath: string }>} Paths to .env.run and .env.run.admin
  */
 async function buildMergedRunEnvAndWrite(appName, appConfig, devDir, developerId, scopeOpts = null) {
-  const infra = require('../infrastructure');
-  const ensureAdminSecretsFn = typeof infra.ensureAdminSecrets === 'function'
-    ? infra.ensureAdminSecrets
-    : require('../infrastructure/helpers').ensureAdminSecrets;
   await ensureRunSecretsForApp(appName);
-  await ensureAdminSecretsFn();
+  await resolveEnsureAdminSecretsFn()();
   const adminObj = await adminSecrets.readAndDecryptAdminSecrets();
   const runEnvKey = scopeOpts && scopeOpts.runEnvKey ? String(scopeOpts.runEnvKey).toLowerCase() : 'dev';
   const appObj = await secretsEnvWrite.resolveAndGetEnvMap(appName, {
@@ -242,22 +298,20 @@ async function buildMergedRunEnvAndWrite(appName, appConfig, devDir, developerId
     runEnvKey
   });
   const merged = { ...adminObj, ...appObj };
-  if (developerId !== undefined) {
-    const pgpassPwd = await readPostgresPasswordFromPgpass(developerId);
-    if (pgpassPwd !== undefined) merged.POSTGRES_PASSWORD = pgpassPwd;
-  }
+  mergeRunEnvWithAdminOverlay(merged, adminObj);
+  await applyOnboardingPlatformModeIfNeeded(appName, merged);
+  await applyPostgresPasswordFromPgpass(merged, developerId);
   injectDatabaseNamesAndUsers(merged, appConfig, scopeOpts);
   injectContainerPortForRun(merged, appConfig, appName);
 
   const runEnvPath = path.join(devDir, '.env.run');
   const runEnvAdminPath = path.join(devDir, '.env.run.admin');
-
-  const appOnly = buildAppOnlyEnv(merged);
-  const dbInitOnly = buildDbInitOnlyEnv(merged);
-
-  await fs.writeFile(runEnvPath, adminSecrets.envObjectToContent(appOnly), { mode: 0o600 });
-  await fs.writeFile(runEnvAdminPath, adminSecrets.envObjectToContent(dbInitOnly), { mode: 0o600 });
-
+  await writeRunEnvFiles(
+    runEnvPath,
+    runEnvAdminPath,
+    buildAppOnlyEnv(merged),
+    buildDbInitOnlyEnv(merged)
+  );
   return { runEnvPath, runEnvAdminPath };
 }
 

package/lib/build/index.js

@@ -401,6 +401,11 @@ async function resolveDockerBuildArgsForApp(appName) {
   for (const [k, v] of Object.entries(bashOverlay)) {
     if (v && buildArgs[k] === undefined) buildArgs[k] = v;
   }
+  // Exported shell tokens win (local dev: export NPM_TOKEN=... before af build / docker build).
+  const shellNpm = typeof process.env.NPM_TOKEN === 'string' ? process.env.NPM_TOKEN.trim() : '';
+  const shellPypi = typeof process.env.PYPI_TOKEN === 'string' ? process.env.PYPI_TOKEN.trim() : '';
+  if (shellNpm) buildArgs.NPM_TOKEN = shellNpm;
+  if (shellPypi) buildArgs.PYPI_TOKEN = shellPypi;
   return buildArgs;
 }
 

package/lib/certification/sync-system-certification.js

@@ -211,7 +211,8 @@ async function maybeSyncSystemCertificationFromDataplane(params) {
     authConfig,
     datasourceKeys,
     issuanceFailureHint,
-    verboseCertHints
+    verboseCertHints,
+    silent
   } = params;
   if (noCertSync === true) return;
   try {
@@ -224,14 +225,20 @@ async function maybeSyncSystemCertificationFromDataplane(params) {
       verboseCertHints
     });
     if (r.written) {
-      logger.log(
-        chalk.gray(`Updated certification block from dataplane${label ? ` (${label})` : ''} in system file.`)
-      );
+      if (silent !== true) {
+        logger.log(
+          chalk.gray(`Updated certification block from dataplane${label ? ` (${label})` : ''} in system file.`)
+        );
+      }
     } else if (r.reason) {
-      logCertificationSyncNotWritten(r, label, verboseCertHints === true);
+      if (silent !== true) {
+        logCertificationSyncNotWritten(r, label, verboseCertHints === true);
+      }
     }
   } catch (e) {
-    logger.log(chalk.yellow(`⚠ Certification sync skipped: ${e.message}`));
+    if (silent !== true) {
+      logger.log(chalk.yellow(`⚠ Certification sync skipped: ${e.message}`));
+    }
   }
 }
 

package/lib/cli/index.js

@@ -22,10 +22,13 @@ const { setupExternalSystemCommands } = require('./setup-external-system');
 const { setupAppCommands: setupAppManagementCommands } = require('../commands/app');
 const { setupDatasourceCommands } = require('../commands/datasource');
 const { setupDimensionCommands } = require('../commands/dimension');
-const { setupDimensionValueCommands } = require('../commands/dimension-value');
+const { setupIdentityCommands } = require('../commands/identity');
+const { setupProtectionCommands } = require('../commands/protection');
 const { setupCredentialDeploymentCommands } = require('./setup-credential-deployment');
 const { setupIntegrationClientCommands } = require('./setup-integration-client');
 const { setupPlatformCommands } = require('./setup-platform');
+const { setupCertificationCommands } = require('./setup-certification-commands');
+const { setupGovernanceCommands } = require('../commands/governance');
 
 /**
  * Sets up all CLI commands on the Commander program instance
@@ -35,11 +38,14 @@ function setupCommands(program) {
   setupInfraCommands(program);
   setupAuthCommands(program);
   setupAppCommands(program);
+  setupCertificationCommands(program);
+  setupGovernanceCommands(program);
   setupEnvironmentCommands(program);
   setupAppManagementCommands(program);
   setupDatasourceCommands(program);
   setupDimensionCommands(program);
-  setupDimensionValueCommands(program);
+  setupIdentityCommands(program);
+  setupProtectionCommands(program);
   setupUtilityCommands(program);
   setupCredentialDeploymentCommands(program);
   setupIntegrationClientCommands(program);