@aifabrix/builder 2.45.5 → 2.46.0

package/lib/app/run-env-compose.js

@@ -14,9 +14,28 @@ const fs = require('fs').promises;
 const fsSync = require('fs');
 const pathsUtil = require('../utils/paths');
 const adminSecrets = require('../core/admin-secrets');
+const config = require('../core/config');
 const secretsEnsure = require('../core/secrets-ensure');
 const secretsEnvWrite = require('../core/secrets-env-write');
 const { getContainerPort } = require('../utils/port-resolver');
+const { applyAdminSecretsPlatformOverlay } = require('../core/admin-secrets-env-overlay');
+
+/**
+ * Merge app env with admin-secrets; overlay ensures platform keys come from admin file.
+ * @param {Object.<string, string>} merged
+ * @param {Object.<string, string>} adminObj
+ */
+function mergeRunEnvWithAdminOverlay(merged, adminObj) {
+  applyAdminSecretsPlatformOverlay(merged, adminObj);
+}
+
+async function applyOnboardingPlatformModeIfNeeded(appName, merged) {
+  if (appName !== 'miso-controller') {
+    return;
+  }
+  const mode = await config.getSetupPlatformMode();
+  merged.ONBOARDING_FULL_PLATFORM = mode === 'full' ? 'true' : 'false';
+}
 
 /**
  * Backfill only secrets needed for `aifabrix run <app>`: kv:// keys from that app's env.template
@@ -194,31 +213,72 @@ async function readPasswordFromPgpassFile(pgpassPath) {
 }
 
 /**
- * Read POSTGRES_PASSWORD from `pgpass` next to the active infra compose (same as `resolveInfraStatePaths()`).
- * Does not use `getAifabrixHome()` alone, so a stale pgpass under the wrong base directory (e.g. when
- * `aifabrix-home` points at $HOME but compose lives under the config dir) cannot override admin-secrets.
+ * Read POSTGRES_PASSWORD from pgpass-style files beside the active infra compose
+ * (`resolveInfraStatePaths()`). Tries legacy `pgpass`, then `.pgpass.bootstrap` written at `up-infra`
+ * so db-init matches the password Postgres was started with when admin-secrets later drifted.
  * @param {number|string} developerId - Developer ID
  * @returns {Promise<string|undefined>} Password or undefined
  */
 async function readPostgresPasswordFromPgpass(developerId) {
-  const { resolveInfraStatePaths } = require('../infrastructure/helpers');
+  const { resolveInfraStatePaths, PGPASS_BOOTSTRAP_BASENAME } = require('../infrastructure/helpers');
   const { infraDir } = resolveInfraStatePaths(developerId);
-  const pgpassPath = path.join(infraDir, 'pgpass');
-  if (!fsSync.existsSync(pgpassPath)) {
-    return undefined;
-  }
-  try {
-    const pwd = await readPasswordFromPgpassFile(pgpassPath);
-    return pwd;
-  } catch {
-    return undefined;
+  const candidates = ['pgpass', PGPASS_BOOTSTRAP_BASENAME];
+  for (const name of candidates) {
+    const pgpassPath = path.join(infraDir, name);
+    if (!fsSync.existsSync(pgpassPath)) {
+      continue;
+    }
+    try {
+      const pwd = await readPasswordFromPgpassFile(pgpassPath);
+      if (pwd !== undefined && pwd !== '') {
+        return pwd;
+      }
+    } catch {
+      // try next candidate
+    }
   }
+  return undefined;
+}
+
+/**
+ * @returns {Function}
+ */
+function resolveEnsureAdminSecretsFn() {
+  const infra = require('../infrastructure');
+  return typeof infra.ensureAdminSecrets === 'function'
+    ? infra.ensureAdminSecrets
+    : require('../infrastructure/helpers').ensureAdminSecrets;
+}
+
+/**
+ * @param {Object} merged
+ * @param {number|string|undefined} developerId
+ * @returns {Promise<void>}
+ */
+async function applyPostgresPasswordFromPgpass(merged, developerId) {
+  if (developerId === undefined) return;
+  const pgpassPwd = await readPostgresPasswordFromPgpass(developerId);
+  if (pgpassPwd !== undefined) merged.POSTGRES_PASSWORD = pgpassPwd;
+}
+
+/**
+ * @param {string} runEnvPath
+ * @param {string} runEnvAdminPath
+ * @param {Object} appOnly
+ * @param {Object} dbInitOnly
+ * @returns {Promise<void>}
+ */
+async function writeRunEnvFiles(runEnvPath, runEnvAdminPath, appOnly, dbInitOnly) {
+  const toContent = adminSecrets.envObjectToContent;
+  await fs.writeFile(runEnvPath, toContent(appOnly), { mode: 0o600 });
+  await fs.writeFile(runEnvAdminPath, toContent(dbInitOnly), { mode: 0o600 });
 }
 
 /**
  * Build two run env files: .env.run (app-only, no admin secrets) and .env.run.admin (start-only, for db-init).
  * Admin password is never set in the app container; .env.run.admin is used only for start and then deleted.
- * When `pgpass` exists beside the active infra compose, POSTGRES_PASSWORD is taken from it so db-init matches Postgres.
+ * When `pgpass` or `.pgpass.bootstrap` exists beside the active infra compose, POSTGRES_PASSWORD is taken
+ * from it so db-init matches Postgres.
  * @async
  * @param {string} appName - Application name
  * @param {Object} appConfig - Application configuration
@@ -227,12 +287,8 @@ async function readPostgresPasswordFromPgpass(developerId) {
  * @returns {Promise<{ runEnvPath: string, runEnvAdminPath: string }>} Paths to .env.run and .env.run.admin
  */
 async function buildMergedRunEnvAndWrite(appName, appConfig, devDir, developerId, scopeOpts = null) {
-  const infra = require('../infrastructure');
-  const ensureAdminSecretsFn = typeof infra.ensureAdminSecrets === 'function'
-    ? infra.ensureAdminSecrets
-    : require('../infrastructure/helpers').ensureAdminSecrets;
   await ensureRunSecretsForApp(appName);
-  await ensureAdminSecretsFn();
+  await resolveEnsureAdminSecretsFn()();
   const adminObj = await adminSecrets.readAndDecryptAdminSecrets();
   const runEnvKey = scopeOpts && scopeOpts.runEnvKey ? String(scopeOpts.runEnvKey).toLowerCase() : 'dev';
   const appObj = await secretsEnvWrite.resolveAndGetEnvMap(appName, {
@@ -242,22 +298,20 @@ async function buildMergedRunEnvAndWrite(appName, appConfig, devDir, developerId
     runEnvKey
   });
   const merged = { ...adminObj, ...appObj };
-  if (developerId !== undefined) {
-    const pgpassPwd = await readPostgresPasswordFromPgpass(developerId);
-    if (pgpassPwd !== undefined) merged.POSTGRES_PASSWORD = pgpassPwd;
-  }
+  mergeRunEnvWithAdminOverlay(merged, adminObj);
+  await applyOnboardingPlatformModeIfNeeded(appName, merged);
+  await applyPostgresPasswordFromPgpass(merged, developerId);
   injectDatabaseNamesAndUsers(merged, appConfig, scopeOpts);
   injectContainerPortForRun(merged, appConfig, appName);
 
   const runEnvPath = path.join(devDir, '.env.run');
   const runEnvAdminPath = path.join(devDir, '.env.run.admin');
-
-  const appOnly = buildAppOnlyEnv(merged);
-  const dbInitOnly = buildDbInitOnlyEnv(merged);
-
-  await fs.writeFile(runEnvPath, adminSecrets.envObjectToContent(appOnly), { mode: 0o600 });
-  await fs.writeFile(runEnvAdminPath, adminSecrets.envObjectToContent(dbInitOnly), { mode: 0o600 });
-
+  await writeRunEnvFiles(
+    runEnvPath,
+    runEnvAdminPath,
+    buildAppOnlyEnv(merged),
+    buildDbInitOnlyEnv(merged)
+  );
   return { runEnvPath, runEnvAdminPath };
 }
 

package/lib/build/index.js

@@ -401,6 +401,11 @@ async function resolveDockerBuildArgsForApp(appName) {
   for (const [k, v] of Object.entries(bashOverlay)) {
     if (v && buildArgs[k] === undefined) buildArgs[k] = v;
   }
+  // Exported shell tokens win (local dev: export NPM_TOKEN=... before af build / docker build).
+  const shellNpm = typeof process.env.NPM_TOKEN === 'string' ? process.env.NPM_TOKEN.trim() : '';
+  const shellPypi = typeof process.env.PYPI_TOKEN === 'string' ? process.env.PYPI_TOKEN.trim() : '';
+  if (shellNpm) buildArgs.NPM_TOKEN = shellNpm;
+  if (shellPypi) buildArgs.PYPI_TOKEN = shellPypi;
   return buildArgs;
 }
 

package/lib/certification/sync-system-certification.js

@@ -211,7 +211,8 @@ async function maybeSyncSystemCertificationFromDataplane(params) {
     authConfig,
     datasourceKeys,
     issuanceFailureHint,
-    verboseCertHints
+    verboseCertHints,
+    silent
   } = params;
   if (noCertSync === true) return;
   try {
@@ -224,14 +225,20 @@ async function maybeSyncSystemCertificationFromDataplane(params) {
       verboseCertHints
     });
     if (r.written) {
-      logger.log(
-        chalk.gray(`Updated certification block from dataplane${label ? ` (${label})` : ''} in system file.`)
-      );
+      if (silent !== true) {
+        logger.log(
+          chalk.gray(`Updated certification block from dataplane${label ? ` (${label})` : ''} in system file.`)
+        );
+      }
     } else if (r.reason) {
-      logCertificationSyncNotWritten(r, label, verboseCertHints === true);
+      if (silent !== true) {
+        logCertificationSyncNotWritten(r, label, verboseCertHints === true);
+      }
     }
   } catch (e) {
-    logger.log(chalk.yellow(`⚠ Certification sync skipped: ${e.message}`));
+    if (silent !== true) {
+      logger.log(chalk.yellow(`⚠ Certification sync skipped: ${e.message}`));
+    }
   }
 }
 

package/lib/cli/index.js

@@ -27,6 +27,8 @@ const { setupProtectionCommands } = require('../commands/protection');
 const { setupCredentialDeploymentCommands } = require('./setup-credential-deployment');
 const { setupIntegrationClientCommands } = require('./setup-integration-client');
 const { setupPlatformCommands } = require('./setup-platform');
+const { setupCertificationCommands } = require('./setup-certification-commands');
+const { setupGovernanceCommands } = require('../commands/governance');
 
 /**
  * Sets up all CLI commands on the Commander program instance
@@ -36,6 +38,8 @@ function setupCommands(program) {
   setupInfraCommands(program);
   setupAuthCommands(program);
   setupAppCommands(program);
+  setupCertificationCommands(program);
+  setupGovernanceCommands(program);
   setupEnvironmentCommands(program);
   setupAppManagementCommands(program);
   setupDatasourceCommands(program);

package/lib/cli/infra-guided-auth.js

@@ -0,0 +1,109 @@
+/**
+ * Guided platform install authentication (device login URL + Dataplane recovery).
+ *
+ * @fileoverview Auth helpers for infra-guided up-platform / setup
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const config = require('../core/config');
+const { resolvePlatformControllerUrl } = require('../utils/platform-controller-url');
+const { withMutedLogger } = require('../utils/with-muted-logger');
+const { formatBlockingError } = require('../utils/cli-test-layout-chalk');
+const { isAuthenticationError } = require('../utils/cli-utils');
+const { resolveControllerUrl, isPlatformAuthValidForController } = require('../utils/controller-url');
+
+/**
+ * @param {Object} authOpts
+ * @returns {Promise<string>}
+ */
+async function resolveGuidedAuthControllerUrl(authOpts = {}) {
+  return (
+    authOpts.platformControllerUrl ||
+    (await config.getPlatformControllerUrl()) ||
+    (await resolvePlatformControllerUrl())
+  );
+}
+
+/**
+ * @async
+ * @param {Function} handleLoginFn
+ * @param {string} controllerUrl
+ * @param {{ skipDataplaneVersionRefresh?: boolean }} [opts]
+ * @returns {Promise<void>}
+ */
+async function runGuidedDeviceLogin(handleLoginFn, controllerUrl, opts = {}) {
+  await handleLoginFn({
+    method: 'device',
+    controller: controllerUrl,
+    environment: 'dev',
+    compact: true,
+    skipDataplaneVersionRefresh: opts.skipDataplaneVersionRefresh === true,
+    exitOnFailure: false
+  });
+}
+
+/**
+ * @async
+ * @param {Function} handleLoginFn
+ * @param {Object} authOpts
+ * @param {{ startSpinner: Function, stopSpinnerSuccess: Function }} spinners
+ * @returns {Promise<void>}
+ */
+async function runGuidedAuthStep(handleLoginFn, authOpts, spinners) {
+  const spin = spinners.startSpinner('Authenticating...');
+  const controllerUrl = await resolveGuidedAuthControllerUrl(authOpts);
+  const skipLogin =
+    authOpts.skipLoginIfAuthenticated === true ||
+    (await isPlatformAuthValidForController(controllerUrl));
+  try {
+    if (skipLogin) {
+      spinners.stopSpinnerSuccess(spin, 'Already authenticated');
+      return;
+    }
+    await runGuidedDeviceLogin(handleLoginFn, controllerUrl, { skipDataplaneVersionRefresh: true });
+  } catch (authErr) {
+    if (spin) spin.fail('Authentication required');
+    logger.error(formatBlockingError('Authentication required. Complete sign-in in your browser.'));
+    await runGuidedDeviceLogin(handleLoginFn, controllerUrl, { skipDataplaneVersionRefresh: true });
+  }
+  spinners.stopSpinnerSuccess(spin, 'Authenticated');
+}
+
+/**
+ * @async
+ * @param {Object} options
+ * @param {Function} handleUpDataplane
+ * @param {Function} handleLoginFn
+ * @param {string} controllerUrl
+ * @returns {Promise<void>}
+ */
+async function runGuidedDataplaneWithAuthRecovery(options, handleUpDataplane, handleLoginFn, controllerUrl) {
+  try {
+    await withMutedLogger(() =>
+      handleUpDataplane({ ...options, platformInstall: true, skipInfraCheck: true })
+    );
+  } catch (error) {
+    if (!isAuthenticationError(error)) {
+      throw error;
+    }
+    const loginUrl = error.controllerUrl || controllerUrl || (await resolveControllerUrl());
+    logger.log('');
+    logger.log(chalk.yellow('Device login required to register and deploy Dataplane.'));
+    await runGuidedDeviceLogin(handleLoginFn, loginUrl, { skipDataplaneVersionRefresh: false });
+    await withMutedLogger(() =>
+      handleUpDataplane({ ...options, platformInstall: true, skipInfraCheck: true })
+    );
+  }
+}
+
+module.exports = {
+  resolveGuidedAuthControllerUrl,
+  runGuidedDeviceLogin,
+  runGuidedAuthStep,
+  runGuidedDataplaneWithAuthRecovery
+};

package/lib/cli/infra-guided.js

@@ -10,16 +10,19 @@ const config = require('../core/config');
 const devConfig = require('../utils/dev-config');
 const pathsUtil = require('../utils/paths');
 const { loadConfigFile } = require('../utils/config-format');
-const { resolveControllerUrl } = require('../utils/controller-url');
+const { computeAppBaseUrl, resolvePlatformControllerUrl } = require('../utils/platform-controller-url');
 const { withMutedLogger } = require('../utils/with-muted-logger');
-const { formatBlockingError, formatProgress, formatSuccessLine, successGlyph } = require('../utils/cli-test-layout-chalk');
-const { computePublicUrlBaseString } = require('../utils/url-declarative-public-base');
-const { joinUrlPath, normalizeFrontDoorPatternForHealth } = require('../utils/health-check-url');
+const { formatProgress, formatSuccessLine, successGlyph } = require('../utils/cli-test-layout-chalk');
 const ora = require('ora');
 const infra = require('../infrastructure');
 const { execWithDockerEnv } = require('../utils/docker-exec');
 const { getLogLevel, passesLevelFilter } = require('../commands/app-logs');
 const { handleLogin } = require('../commands/login');
+const {
+  resolveGuidedAuthControllerUrl,
+  runGuidedAuthStep,
+  runGuidedDataplaneWithAuthRecovery
+} = require('./infra-guided-auth');
 const healthCheck = require('../utils/health-check');
 const { prepareUrlsLocalRegistryForUpPlatform } = require('../commands/up-common');
 const { assertDevInfraUp } = require('../commands/dev-infra-gate');
@@ -126,44 +129,17 @@ function resolveInfraHost(remoteServer) {
   }
 }
 
-async function computeAppBaseUrl(appName) {
-  const builderPath = pathsUtil.getBuilderPath(appName);
-  const configPath = pathsUtil.resolveApplicationConfigPath(builderPath);
-  const variables = loadConfigFile(configPath) || {};
-  const basePort = Number(variables.port || 3000);
-  const developerIdRaw = await config.getDeveloperId();
-  const developerIdNum = typeof developerIdRaw === 'string' ? parseInt(developerIdRaw, 10) : developerIdRaw;
-  const userCfg = await config.getConfig();
-  const remoteServer = await config.getRemoteServer();
-  const infraTlsEnabled = Boolean(userCfg && userCfg.tlsEnabled);
-
-  const fd = variables.frontDoorRouting || null;
-  const frontDoorEnabled = Boolean(fd && fd.enabled === true);
-  const traefikOn = Boolean(userCfg && userCfg.traefik);
-  const pathActive = Boolean(traefikOn && frontDoorEnabled);
-
-  const publicBase = computePublicUrlBaseString({
-    traefik: traefikOn,
-    pathActive,
-    hostTemplate: fd ? fd.host : null,
-    tls: fd ? fd.tls : true,
-    developerIdRaw,
-    remoteServer,
-    // These guided bootstrap commands start services via Docker Compose, so we want the
-    // docker-published host port (no workstation +10 offset).
-    profile: 'docker',
-    listenPort: basePort,
-    developerIdNum,
-    infraTlsEnabled
-  });
-
-  if (pathActive) {
-    const mount = normalizeFrontDoorPatternForHealth(fd.pattern);
-    return joinUrlPath(publicBase, mount);
+/**
+ * Prefer stored platform controller URL, then compute from routing rules.
+ * @async
+ * @returns {Promise<string>}
+ */
+async function resolvePlatformControllerUrlForDisplay() {
+  const stored = await config.getPlatformControllerUrl();
+  if (stored) {
+    return stored;
   }
-
-  // No Traefik front-door routing: publicBase is localhost + published port unless Traefik/proxy opts into remote.
-  return String(publicBase).replace(/\/+$/, '');
+  return resolvePlatformControllerUrl();
 }
 
 function logSection(label, value) {
@@ -186,7 +162,7 @@ function logFooterEnd() {
 
 async function logPlatformReadyFooter() {
   const [controllerUrl, dataplaneUrl, keycloakUrl] = await Promise.all([
-    resolveControllerUrl(),
+    resolvePlatformControllerUrlForDisplay(),
     computeAppBaseUrl('dataplane'),
     computeAppBaseUrl('keycloak')
   ]);
@@ -206,7 +182,7 @@ async function logPlatformReadyFooter() {
 
 async function logMisoReadyFooter() {
   const [controllerUrl, keycloakUrl] = await Promise.all([
-    resolveControllerUrl(),
+    resolvePlatformControllerUrlForDisplay(),
     computeAppBaseUrl('keycloak')
   ]);
   logFooterStart('Miso Ready');
@@ -280,6 +256,8 @@ async function runGuidedUpMiso(options, handleUpMiso) {
   logger.log(title('AI Fabrix Platform Setup'));
   logger.log(SEPARATOR);
   logger.log('');
+  logPlatformSetupDurationHint('platform');
+  logger.log('');
   const kcSpin = startSpinner('Starting Keycloak...');
   await withMutedLogger(() => handleUpMiso({ ...options, platformInstall: true }));
   stopSpinnerSuccess(kcSpin, 'Keycloak ready');
@@ -291,13 +269,11 @@ async function runGuidedUpMiso(options, handleUpMiso) {
   await validateAppErrorLogs(['miso-controller']);
 }
 
-async function runGuidedUpDataplane(options, handleUpDataplane) {
-  logger.log('');
-  logger.log(title('AI Fabrix Dataplane Setup'));
-  logger.log(SEPARATOR);
-  logger.log('');
-  // Infra must be checked before auth: device login talks to the controller, which needs
-  // Postgres/Redis when the controller runs locally — a down infra looks like "network error".
+/**
+ * Infra must be checked before auth: device login talks to the controller, which needs
+ * Postgres/Redis when the controller runs locally — a down infra looks like "network error".
+ */
+async function assertDevInfraForGuidedDataplane() {
   const infraSpin = startSpinner('Checking infrastructure...');
   try {
     await assertDevInfraUp({ quietSuccess: true });
@@ -307,11 +283,21 @@ async function runGuidedUpDataplane(options, handleUpDataplane) {
     if (infraSpin) infraSpin.stop();
     throw infraErr;
   }
+}
+
+async function runGuidedUpDataplane(options, handleUpDataplane) {
+  logger.log('');
+  logger.log(title('AI Fabrix Dataplane Setup'));
+  logger.log(SEPARATOR);
+  logger.log('');
+  logPlatformSetupDurationHint('dataplane');
+  logger.log('');
+  await assertDevInfraForGuidedDataplane();
   // Avoid an outer long-running spinner here: up-dataplane has multiple internal
   // phases and may print some output. An outer spinner causes "spinner over spinner"
   // rendering artifacts. Instead, do the same single auth step as up-platform, then
   // show one spinner for the dataplane install/run phase.
-  await runGuidedAuthStep(handleLogin);
+  await runGuidedAuthStep(handleLogin, {}, { startSpinner, stopSpinnerSuccess });
 
   logger.log('');
   emitSystemBuilderAppManifestLineIfTTY(logger, 'dataplane');
@@ -331,6 +317,8 @@ async function runGuidedUpDataplane(options, handleUpDataplane) {
  * @param {string[]} cleanedApps
  */
 function logUpPlatformForceCleanSummary(forceSummary, cleanedApps) {
+  const { isSetupQuietOutput } = require('../utils/setup-quiet-output');
+  if (isSetupQuietOutput()) return;
   const check = successGlyph();
   logger.log(chalk.bold('Clean installation files'));
   logger.log(
@@ -350,40 +338,31 @@ function logUpPlatformForceCleanSummary(forceSummary, cleanedApps) {
   logger.log('');
 }
 
+/**
+ * Yellow notice before long-running platform/dataplane install steps (setup and guided up-*).
+ * @param {'platform'|'dataplane'} [scope]
+ */
+function logPlatformSetupDurationHint(scope = 'platform') {
+  const line =
+    scope === 'dataplane'
+      ? 'Installation may take a few minutes. Authenticating and starting Dataplane — please wait.'
+      : 'Installation may take a few minutes. Keycloak, Miso Controller, and Dataplane are starting — please wait.';
+  logger.log(chalk.yellow(`⚠ ${line}`));
+}
+
 function logGuidedPlatformSetupHeader() {
   logger.log('');
   logger.log(title('AI Fabrix Platform Setup'));
   logger.log(SEPARATOR);
-  logger.log(chalk.gray('This may take a few minutes...'));
   logger.log('');
-}
-
-async function runGuidedAuthStep(handleLogin) {
-  const spin = startSpinner('Authenticating...');
-  try {
-    const controllerUrl = await resolveControllerUrl();
-    await handleLogin({
-      method: 'device',
-      controller: controllerUrl,
-      environment: 'dev',
-      compact: true,
-      // Dataplane is not up yet during guided platform/dataplane install; refresh after it starts.
-      skipDataplaneVersionRefresh: true
-    });
-  } catch (authErr) {
-    if (spin) spin.fail('Authentication failed');
-    logger.error(formatBlockingError('Authentication failed'));
-    logger.log(chalk.gray('\nRun:\n  af login\n\nThen retry:\n  af up-platform\n'));
-    throw authErr;
-  }
-  // Compact device-login prints "Authentication successful"; close the step spinner cleanly.
-  stopSpinnerSuccess(spin, 'Authenticated');
+  logPlatformSetupDurationHint('platform');
+  logger.log('');
 }
 
 async function refreshDataplaneVersionAfterPlatformInstall() {
   try {
     const { tryRefreshDataplaneVersionAfterLogin } = require('../commands/auth-status-dataplane-version');
-    const controllerUrl = await resolveControllerUrl();
+    const controllerUrl = await resolvePlatformControllerUrlForDisplay();
     await tryRefreshDataplaneVersionAfterLogin(controllerUrl, {});
   } catch {
     // best-effort only
@@ -403,13 +382,25 @@ async function runGuidedKeycloakAndMisoControllerPhase(options, handleUpMiso) {
   logger.log('');
 }
 
-async function runGuidedDataplaneInstallPhase(options, handleUpDataplane) {
+async function runGuidedDataplaneInstallPhase(options, handleUpDataplane, handleLoginFn, controllerUrl) {
   logger.log('');
   emitSystemBuilderAppManifestLineIfTTY(logger, 'dataplane');
   const dpSpin = startSpinner('Starting Dataplane...');
-  await withMutedLogger(() =>
-    handleUpDataplane({ ...options, platformInstall: true, skipInfraCheck: true })
-  );
+  const platformMode = await config.getSetupPlatformMode();
+  if (platformMode === 'full') {
+    // Full platform: three dataplane containers + per-env registrations.
+    const envKeys = ['pro', 'dev', 'tst'];
+    for (const envKey of envKeys) {
+      await runGuidedDataplaneWithAuthRecovery(
+        { ...options, envKey, runEnvKey: envKey, allowNonDev: true },
+        handleUpDataplane,
+        handleLoginFn,
+        controllerUrl
+      );
+    }
+  } else {
+    await runGuidedDataplaneWithAuthRecovery(options, handleUpDataplane, handleLoginFn, controllerUrl);
+  }
   stopSpinnerSuccess(dpSpin, 'Dataplane ready');
   await refreshDataplaneVersionAfterPlatformInstall();
 }
@@ -420,10 +411,22 @@ async function runGuidedUpPlatform(options, handleUpMiso, handleUpDataplane, han
     logUpPlatformForceCleanSummary(forceCleanSummary.forceSummary, forceCleanSummary.cleanedApps);
   }
 
+  const authOpts = {
+    platformControllerUrl: options && options.platformControllerUrl,
+    skipLoginIfAuthenticated: options && options.skipLoginIfAuthenticated === true
+  };
+
   await withMutedLogger(() => prepareUrlsLocalRegistryForUpPlatform());
   await runGuidedKeycloakAndMisoControllerPhase(options, handleUpMiso);
-  await runGuidedAuthStep(handleLogin);
-  await runGuidedDataplaneInstallPhase(options, handleUpDataplane);
+  if (options && options.requireKeycloakRealm === true) {
+    const { waitForKeycloakRealmReady } = require('../utils/keycloak-realm-ready');
+    const realmSpin = startSpinner('Waiting for Keycloak realm (aifabrix)...');
+    await waitForKeycloakRealmReady({ timeoutSeconds: 180 });
+    stopSpinnerSuccess(realmSpin, 'Keycloak realm ready');
+  }
+  await runGuidedAuthStep(handleLogin, authOpts, { startSpinner, stopSpinnerSuccess });
+  const controllerUrl = await resolveGuidedAuthControllerUrl(authOpts);
+  await runGuidedDataplaneInstallPhase(options, handleUpDataplane, handleLogin, controllerUrl);
   await validateAppErrorLogs(['miso-controller', 'dataplane']);
   await logPlatformReadyFooter();
 }

package/lib/cli/setup-app.help.js

@@ -75,41 +75,10 @@ Notes:
   - Prefer identity apply over SQL in tests/fixtures/protection/optional-dev-identity-dataplane.sql.
 `;
 
-const TEST_GOVERNANCE_HELP_AFTER = `
-Examples:
-  # External system — ABAC visibility acceptance (governance scenario pack)
-  $ aifabrix test-governance test-protection
-  $ aifabrix test-governance test-protection --pack scenarios/test-protection-v1.yaml
-  $ aifabrix test-governance test-protection -v --no-sync
-  $ aifabrix test-governance test-protection --scenario country-isolation-maria-fi --json
-
-Notes:
-  - Separate from test-e2e (vendor connectivity). Does not call external vendor APIs.
-  - Load baseline fixtures first (datasource load, protection upload) — not auto-run by this command.
-  - Default pack: integration/<systemKey>/scenarios/default.yaml or <systemKey>-v1.yaml
-  - Requires governance:evaluate on the operator token (see permissions.md).
-`;
-
-const TEST_TRUST_HELP_AFTER = `
-Examples:
-  # External system — semantic trust for every datasource (dataplane 404.5)
-  $ aifabrix test-trust hubspot
-  $ aifabrix test-trust hubspot -v --revalidate
-  $ aifabrix test-trust hubspot --no-sync
-  $ aifabrix test-trust hubspot --summary --timeout 120000
-
-Notes:
-  - For one datasource: aifabrix datasource test-trust <datasourceKey>
-  - Does not call external APIs (use test-e2e for live proof).
-  - Local integration files are published before run unless --no-sync.
-`;
-
 module.exports = {
   TEST_HELP_AFTER,
   TEST_INTEGRATION_HELP_AFTER,
   TEST_E2E_HELP_AFTER,
-  TEST_TRUST_HELP_AFTER,
-  TEST_GOVERNANCE_HELP_AFTER,
   IDENTITY_HELP_AFTER
 };