@aifabrix/builder 2.45.5 → 2.47.0

package/lib/core/admin-secrets.js

@@ -16,6 +16,31 @@ const config = require('./config');
 const { decryptSecret, isEncrypted } = require('../utils/secrets-encryption');
 const { ensureSecureFilePermissions } = require('../utils/secure-file-permissions');
 
+/**
+ * Whether an admin-secrets.env value must be double-quoted for safe round-trip parsing.
+ * @param {string} value
+ * @returns {boolean}
+ */
+function needsAdminEnvQuoting(value) {
+  const s = String(value ?? '');
+  return /[,\s#=]/.test(s) || s !== s.trim();
+}
+
+/**
+ * Format one KEY=value line for admin-secrets.env (quotes when needed).
+ * @param {string} key
+ * @param {string} value - Plaintext value (not yet encrypted)
+ * @returns {string}
+ */
+function formatAdminEnvLine(key, value) {
+  const safe = String(value ?? '').replace(/\n/g, ' ').trim();
+  if (!needsAdminEnvQuoting(safe)) {
+    return `${key}=${safe}`;
+  }
+  const escaped = safe.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+  return `${key}="${escaped}"`;
+}
+
 /**
  * Parse .env-style content into key-value map (excludes comments and empty lines).
  * Values are trimmed; does not unescape quotes.
@@ -33,7 +58,9 @@ function parseAdminEnvContent(content) {
     if (eq > 0) {
       const key = trimmed.substring(0, eq).trim();
       let value = trimmed.substring(eq + 1);
-      if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith('\'') && value.endsWith('\''))) {
+      if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+        value = value.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, '\\');
+      } else if (value.length >= 2 && value.startsWith('\'') && value.endsWith('\'')) {
         value = value.slice(1, -1);
       }
       map[key] = value.trim();
@@ -94,8 +121,7 @@ function envObjectToContent(obj) {
   const lines = [];
   for (const [key, value] of Object.entries(obj)) {
     if (key === undefined || key === '') continue;
-    const safe = String(value ?? '').replace(/\n/g, ' ').trim();
-    lines.push(`${key}=${safe}`);
+    lines.push(formatAdminEnvLine(key, value));
   }
   return lines.join('\n');
 }
@@ -103,5 +129,7 @@ function envObjectToContent(obj) {
 module.exports = {
   readAndDecryptAdminSecrets,
   parseAdminEnvContent,
-  envObjectToContent
+  envObjectToContent,
+  needsAdminEnvQuoting,
+  formatAdminEnvLine
 };

package/lib/core/config-attach-extensions.js

@@ -41,6 +41,9 @@ function attachConfigExtensions(exportsObj, deps) {
 
   const { createScopedResourcesPreferenceFunctions } = require('../utils/config-scoped-resources-preference');
   Object.assign(exportsObj, createScopedResourcesPreferenceFunctions(getConfig, saveConfig));
+
+  const { createSecretsPathFunctions } = require('../utils/config-secrets-path');
+  Object.assign(exportsObj, createSecretsPathFunctions(getConfig, saveConfig));
 }
 
 module.exports = { attachConfigExtensions };

package/lib/core/config-platform-controller.js

@@ -0,0 +1,44 @@
+/**
+ * `platform-controller` field in `config.yaml` — absolute Miso URL for setup / platform flows.
+ *
+ * @fileoverview config.yaml platform-controller helpers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {() => Promise<Object>} getConfig
+ * @returns {Promise<string|null>}
+ */
+async function getPlatformControllerUrlFromConfig(getConfig) {
+  const cfg = await getConfig();
+  const raw = cfg && cfg['platform-controller'];
+  if (typeof raw === 'string' && raw.trim()) {
+    return raw.trim().replace(/\/+$/, '');
+  }
+  return null;
+}
+
+/**
+ * @param {() => Promise<Object>} getConfig
+ * @param {(data: Object) => Promise<void>} saveConfig
+ * @param {(url: string) => string} normalizeControllerUrl
+ * @param {string} url
+ * @returns {Promise<void>}
+ */
+async function setPlatformControllerUrlInConfig(getConfig, saveConfig, normalizeControllerUrl, url) {
+  if (!url || typeof url !== 'string') {
+    throw new Error('Platform controller URL is required and must be a string');
+  }
+  const normalized = normalizeControllerUrl(url);
+  const cfg = await getConfig();
+  cfg['platform-controller'] = normalized;
+  await saveConfig(cfg);
+}
+
+module.exports = {
+  getPlatformControllerUrlFromConfig,
+  setPlatformControllerUrlInConfig
+};

package/lib/core/config-setup-installation-profile.js

@@ -0,0 +1,42 @@
+/**
+ * `setupInstallationProfile` field in `config.yaml` (`dev` | `pro`).
+ *
+ * @fileoverview Persists setup wizard installation profile
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { normalizeInstallationProfile, INSTALLATION_PROFILE } = require('./setup-installation-profile');
+
+/**
+ * @param {() => Promise<Object>} getConfig
+ * @returns {Promise<'dev'|'pro'>}
+ */
+async function getSetupInstallationProfileFromConfig(getConfig) {
+  const cfg = await getConfig();
+  if (cfg && cfg.setupInstallationProfile) {
+    return normalizeInstallationProfile(cfg.setupInstallationProfile);
+  }
+  return INSTALLATION_PROFILE.DEV;
+}
+
+/**
+ * @param {() => Promise<Object>} getConfig
+ * @param {(data: Object) => Promise<void>} saveConfig
+ * @param {unknown} profile
+ * @returns {Promise<'dev'|'pro'>}
+ */
+async function setSetupInstallationProfileInConfig(getConfig, saveConfig, profile) {
+  const normalized = normalizeInstallationProfile(profile);
+  const cfg = await getConfig();
+  cfg.setupInstallationProfile = normalized;
+  await saveConfig(cfg);
+  return normalized;
+}
+
+module.exports = {
+  getSetupInstallationProfileFromConfig,
+  setSetupInstallationProfileInConfig
+};

package/lib/core/config-setup-platform-mode.js

@@ -0,0 +1,46 @@
+/**
+ * `setupPlatformMode` field in `config.yaml` (`single` | `single-traefik` | `full`).
+ *
+ * @fileoverview Persists setup wizard platform mode
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const {
+  normalizeSetupPlatformMode,
+  SETUP_PLATFORM_MODE
+} = require('./setup-platform-mode');
+
+/**
+ * @param {() => Promise<Object>} getConfig
+ * @returns {Promise<'single'|'single-traefik'|'full'>}
+ */
+async function getSetupPlatformModeFromConfig(getConfig) {
+  const cfg = await getConfig();
+  if (cfg && cfg.setupPlatformMode) {
+    return normalizeSetupPlatformMode(cfg.setupPlatformMode);
+  }
+  return SETUP_PLATFORM_MODE.SINGLE;
+}
+
+/**
+ * @param {() => Promise<Object>} getConfig
+ * @param {(data: Object) => Promise<void>} saveConfig
+ * @param {unknown} mode
+ * @returns {Promise<'single'|'single-traefik'|'full'>}
+ */
+async function setSetupPlatformModeInConfig(getConfig, saveConfig, mode) {
+  const normalized = normalizeSetupPlatformMode(mode);
+  const cfg = await getConfig();
+  cfg.setupPlatformMode = normalized;
+  await saveConfig(cfg);
+  return normalized;
+}
+
+module.exports = {
+  getSetupPlatformModeFromConfig,
+  setSetupPlatformModeInConfig
+};
+

package/lib/core/config.js

@@ -9,14 +9,24 @@
  */
 
 const fs = require('fs').promises;
-const path = require('path');
 const yaml = require('js-yaml');
-const os = require('os');
 const { encryptToken, decryptToken, isTokenEncrypted } = require('../utils/token-encryption');
 const { ensureSecureFilePermissions, ensureSecureDirPermissions } = require('../utils/secure-file-permissions');
 const { getRuntimeConfigDir, getRuntimeConfigFile } = require('./config-runtime-paths');
 const { getAdminEmailFromConfig, setAdminEmailInConfig } = require('./config-admin-email');
+const {
+  getSetupInstallationProfileFromConfig,
+  setSetupInstallationProfileInConfig
+} = require('./config-setup-installation-profile');
+const {
+  getSetupPlatformModeFromConfig,
+  setSetupPlatformModeInConfig
+} = require('./config-setup-platform-mode');
 const { getRegisteredControllerUrlsWithLoader } = require('./config-registered-controller-urls');
+const {
+  getPlatformControllerUrlFromConfig,
+  setPlatformControllerUrlInConfig
+} = require('./config-platform-controller');
 const { normalizeControllerUrl, validateAndNormalizeDeveloperId } = require('./config-normalize');
 // Avoid importing paths.js here to prevent circular dependency; use shared runtime config dir helper.
 // Config location: AIFABRIX_CONFIG dirname → AIFABRIX_HOME (with ~/.aifabrix fallback when config lives there) → ~/.aifabrix
@@ -34,6 +44,9 @@ function applyConfigDefaults(config) {
   if (typeof config.environment === 'undefined') {
     config.environment = 'dev';
   }
+  if (typeof config.setupPlatformMode === 'undefined') {
+    config.setupPlatformMode = 'single';
+  }
   // Ensure environments object exists
   if (typeof config.environments !== 'object' || config.environments === null) {
     config.environments = {};
@@ -59,6 +72,7 @@ function getDefaultConfig() {
   return {
     'developer-id': '0',
     environment: 'dev',
+    setupPlatformMode: 'single',
     controller: undefined,
     environments: {},
     device: {},
@@ -230,6 +244,12 @@ async function setAdminEmail(email) {
   return setAdminEmailInConfig(getConfig, saveConfig, email);
 }
 
+/** @returns {Promise<'dev'|'pro'>} */
+const getSetupInstallationProfile = () => getSetupInstallationProfileFromConfig(getConfig);
+/** @param {unknown} profile @returns {Promise<'dev'|'pro'>} */
+const setSetupInstallationProfile = (profile) =>
+  setSetupInstallationProfileInConfig(getConfig, saveConfig, profile);
+
 /**
  * Whether Traefik is enabled (`traefik: true` in config; infra compose includes the proxy).
  * @returns {Promise<boolean>}
@@ -259,6 +279,21 @@ async function setCurrentEnvironment(environment) {
   await saveConfig(config);
 }
 
+/**
+ * @returns {Promise<'single'|'full'>}
+ */
+async function getSetupPlatformMode() {
+  return getSetupPlatformModeFromConfig(getConfig);
+}
+
+/**
+ * @param {unknown} mode
+ * @returns {Promise<'single'|'full'>}
+ */
+async function setSetupPlatformMode(mode) {
+  return setSetupPlatformModeInConfig(getConfig, saveConfig, mode);
+}
+
 /**
  * Set controller URL in configuration
  * @async
@@ -392,38 +427,11 @@ async function setSecretsEncryptionKey(key) {
  */
 async function ensureSecretsEncryptionKey() {
   const { ensureSecretsEncryptionKey: run } = require('./ensure-encryption-key');
+  const { createSecretsPathFunctions } = require('../utils/config-secrets-path');
+  const { getSecretsPath } = createSecretsPathFunctions(getConfig, saveConfig);
   await run({ getSecretsEncryptionKey, setSecretsEncryptionKey, getSecretsPath });
 }
 
-/**
- * Expand leading ~ to home directory so config paths like ~/.aifabrix/secrets.local.yaml resolve correctly.
- * @param {string} filePath - Path that may start with ~ or ~/
- * @returns {string} Path with ~ expanded, or unchanged if no leading ~
- */
-function expandTilde(filePath) {
-  if (!filePath || typeof filePath !== 'string') return filePath;
-  if (filePath === '~') return os.homedir();
-  if (filePath.startsWith('~/') || filePath.startsWith('~' + path.sep)) {
-    return path.join(os.homedir(), filePath.slice(2));
-  }
-  return filePath;
-}
-
-async function getSecretsPath() {
-  const config = await getConfig();
-  const raw = config['aifabrix-secrets'] || config['secrets-path'] || null;
-  return raw ? expandTilde(raw) : null;
-}
-
-async function setSecretsPath(secretsPath) {
-  if (typeof secretsPath !== 'string') {
-    throw new Error('Secrets path is required and must be a string');
-  }
-  const config = await getConfig();
-  config['aifabrix-secrets'] = secretsPath.trim() || undefined;
-  await saveConfig(config);
-}
-
 // Create exports object
 const exportsObj = {
   getConfig,
@@ -436,6 +444,10 @@ const exportsObj = {
   getTlsEnabled,
   getAdminEmail,
   setAdminEmail,
+  getSetupInstallationProfile,
+  setSetupInstallationProfile,
+  getSetupPlatformMode,
+  setSetupPlatformMode,
   getTraefikEnabled,
   setCurrentEnvironment,
   resolveEnvironment,
@@ -446,11 +458,11 @@ const exportsObj = {
   getSecretsEncryptionKey,
   setSecretsEncryptionKey,
   ensureSecretsEncryptionKey,
-  getSecretsPath,
-  setSecretsPath,
   normalizeControllerUrl,
   setControllerUrl,
   getControllerUrl,
+  getPlatformControllerUrl: () => getPlatformControllerUrlFromConfig(getConfig),
+  setPlatformControllerUrl: (url) => setPlatformControllerUrlInConfig(getConfig, saveConfig, normalizeControllerUrl, url),
   getRegisteredControllerUrls,
   get CONFIG_DIR() {
     return getRuntimeConfigDir();
@@ -460,9 +472,7 @@ const exportsObj = {
   }
 };
 
-// Add developerId as a property getter for direct access
-// After getConfig() or getDeveloperId() is called, config.developerId will be available
-// Developer ID: 0 = default infra, > 0 = developer-specific
+// Developer ID: 0 = default infra, > 0 = developer-specific (getter after getConfig loads cache)
 Object.defineProperty(exportsObj, 'developerId', {
   get() {
     return cachedDeveloperId !== null ? cachedDeveloperId : '0'; // Default to "0" if not loaded yet

package/lib/core/secrets-admin-env.js

@@ -20,6 +20,7 @@ const {
 const { createDefaultSecrets } = require('../utils/secrets-generator');
 const pathsUtil = require('../utils/paths');
 const { loadSecrets } = require('./secrets-load');
+const { formatAdminEnvLine } = require('./admin-secrets');
 
 /**
  * Writes admin env key-value pairs to content; encrypts values when encryption key is set.
@@ -34,7 +35,7 @@ async function formatAdminSecretsContent(adminObj) {
   for (const [k, v] of Object.entries(adminObj)) {
     const value = (v === null || v === undefined) ? '' : String(v).replace(/\n/g, ' ').trim();
     const valueToWrite = encryptionKey ? encryptSecret(value, encryptionKey) : value;
-    lines.push(`${k}=${valueToWrite}`);
+    lines.push(formatAdminEnvLine(k, valueToWrite));
   }
   return lines.join('\n');
 }
@@ -76,7 +77,10 @@ function buildLocalAdminSecretsObject(secrets, infraDefaults) {
     PGADMIN_DEFAULT_PASSWORD: postgresPassword,
     REDIS_HOST: 'local:redis:6379:0:',
     REDIS_COMMANDER_USER: 'admin',
-    REDIS_COMMANDER_PASSWORD: postgresPassword
+    REDIS_COMMANDER_PASSWORD: postgresPassword,
+    KEYCLOAK_ADMIN_USERNAME: 'admin',
+    KEYCLOAK_ADMIN_PASSWORD: postgresPassword,
+    PLATFORM_ADMIN_PASSWORD: postgresPassword
   };
 }
 

package/lib/core/secrets-ensure.js

@@ -204,6 +204,8 @@ function summarizeSecretsStoreForLog(target) {
  */
 function logNewSecretValuesWritten(added, target) {
   if (!Array.isArray(added) || added.length === 0) return;
+  const { isSetupQuietOutput } = require('../utils/setup-quiet-output');
+  if (isSetupQuietOutput()) return;
   const where = summarizeSecretsStoreForLog(target);
   logger.log(
     formatSuccessLine(
@@ -352,6 +354,8 @@ async function ensureSecretsFromEnvTemplate(envTemplatePathOrContent, options =
  * @returns {Promise<void>}
  */
 async function writeSecretToStoreFile(filePath, key, strValue) {
+  const { assertWritableSecretsPathForTests } = require('../utils/aifabrix-test-runtime-guard');
+  assertWritableSecretsPathForTests(filePath);
   const existing = loadExistingSecrets(filePath);
   const encryptionKey = await config.getSecretsEncryptionKey();
   let valueToWrite = strValue;

package/lib/core/secrets-env-content.js

@@ -15,7 +15,6 @@ const config = require('./config');
 const {
   interpolateEnvVars,
   collectMissingSecrets,
-  formatMissingSecretsFileInfo,
   replaceKvInContent,
   loadEnvTemplate,
   adjustLocalEnvPortsInContent,
@@ -43,6 +42,8 @@ const {
   rewriteDockerManifestPublicPortEnvLine
 } = require('../utils/docker-manifest-public-port');
 const { loadSecrets } = require('./secrets-load');
+const { buildMissingSecretsErrorMessage } = require('../utils/secrets-missing-error');
+const { commentOrphanKvEnvLines } = require('../utils/env-kv-orphan-lines');
 
 /**
  * Resolves kv:// references in environment template
@@ -54,10 +55,24 @@ const { loadSecrets } = require('./secrets-load');
  * @param {string} [environment='local'] - Environment context (docker/local)
  * @param {Object|string|null} [secretsFilePaths] - Paths object with userPath and buildPath, or string path (for backward compatibility)
  * @param {string} [appName] - Application name (optional, for error messages)
+ * @param {Object|null} [resolveOpts] - Scoped kv (`envKey`, `effective`) and/or `envTemplatePath` for error hints
  * @returns {Promise<string>} Resolved environment content
  * @throws {Error} If kv:// reference cannot be resolved
  */
-async function resolveKvReferences(envTemplate, secrets, environment = 'local', secretsFilePaths = null, appName = null, scopedKv = null) {
+async function resolveKvReferences(
+  envTemplate,
+  secrets,
+  environment = 'local',
+  secretsFilePaths = null,
+  appName = null,
+  resolveOpts = null
+) {
+  const envTemplatePath =
+    resolveOpts && typeof resolveOpts === 'object' ? resolveOpts.envTemplatePath || null : null;
+  const scopedKv =
+    resolveOpts && typeof resolveOpts === 'object' && (resolveOpts.envKey !== undefined || resolveOpts.effective !== undefined)
+      ? { envKey: resolveOpts.envKey, effective: resolveOpts.effective }
+      : null;
   const os = require('os');
 
   let developerId = null;
@@ -77,9 +92,16 @@ async function resolveKvReferences(envTemplate, secrets, environment = 'local',
   const resolved = interpolateEnvVars(envTemplate, envVars);
   const missing = collectMissingSecrets(resolved, secrets, scopedKv);
   if (missing.length > 0) {
-    const fileInfo = formatMissingSecretsFileInfo(secretsFilePaths);
-    const resolveCommand = appName ? `aifabrix resolve ${appName}` : 'aifabrix resolve <app-name>';
-    throw new Error(`Missing secrets: ${missing.join(', ')}${fileInfo}\n\nRun "${resolveCommand}" to generate missing secrets.`);
+    throw new Error(
+      buildMissingSecretsErrorMessage({
+        missing,
+        secrets,
+        secretsFilePaths,
+        appName,
+        envTemplatePath,
+        envTemplate
+      })
+    );
   }
   return replaceKvInContent(resolved, secrets, envVars, scopedKv);
 }
@@ -178,7 +200,11 @@ async function generateEnvContent(appName, secretsPath, environment = 'local', f
   const secrets = await loadSecrets(secretsPath, appName);
   const { runEnvKey, effective } = await buildScopedKvContext(appPath, options);
   const scopedKv = { envKey: runEnvKey, effective };
-  let resolved = await resolveKvReferences(template, secrets, environment, secretsPaths, appName, scopedKv);
+  let resolved = await resolveKvReferences(template, secrets, environment, secretsPaths, appName, {
+    envKey: runEnvKey,
+    effective,
+    envTemplatePath: templatePath
+  });
   if (!secretsPath) {
     await materializeResolvedKvSecretsToUserLocal(template, secrets, scopedKv, options);
   }
@@ -227,42 +253,6 @@ function parseEnvContentToMap(content) {
   return map;
 }
 
-/**
- * Merges new .env content with existing .env: newly resolved content wins for keys it
- * defines (so project secrets take effect when re-running). Keys only in existing .env
- * are appended so manual additions are kept.
- *
- * @param {string} newContent - Newly generated .env content (from template + loadSecrets)
- * @param {Object.<string, string>} existingMap - Existing key-to-value map from current .env
- * @returns {string} Merged content: new values for keys in newContent, plus extra existing keys
- */
-function mergeEnvContentPreservingExisting(newContent, existingMap) {
-  const lines = newContent.split(/\r?\n/);
-  const newKeys = new Set();
-  const out = [];
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith('#')) {
-      out.push(line);
-      continue;
-    }
-    const eq = trimmed.indexOf('=');
-    if (eq > 0) {
-      const key = trimmed.substring(0, eq).trim();
-      newKeys.add(key);
-    }
-    out.push(line);
-  }
-  if (existingMap && Object.keys(existingMap).length > 0) {
-    for (const key of Object.keys(existingMap)) {
-      if (!newKeys.has(key)) {
-        out.push(`${key}=${existingMap[key]}`);
-      }
-    }
-  }
-  return out.join('\n');
-}
-
 /**
  * Merges a key-value map into existing .env file content, preserving comments and blank lines.
  * For each KEY=value line in existing content, replaces value with newMap[KEY] when the key exists
@@ -320,15 +310,27 @@ function mergeEnvMapIntoContent(existingContent, newMap, options = {}) {
 
 /**
  * Resolves content to write for .env: merges with existing file when present.
+ * Uses {@link mergeEnvMapIntoContent} so new template keys are appended and comments in the
+ * existing file are preserved (unlike a full replace).
+ *
  * @param {string} resolved - Newly generated content
  * @param {string} pathToPreserve - Path to existing .env to merge from (or null)
+ * @param {Object} [options]
+ * @param {boolean} [options.freshEnv=false] - When true, write full resolved content (no merge)
  * @returns {string} Content to write
  */
-function resolveEnvContentToWrite(resolved, pathToPreserve) {
-  if (!pathToPreserve || !fs.existsSync(pathToPreserve)) return resolved;
+function resolveEnvContentToWrite(resolved, pathToPreserve, options = {}) {
+  if (options.freshEnv === true || !pathToPreserve || !fs.existsSync(pathToPreserve)) {
+    return resolved;
+  }
   const existingContent = fs.readFileSync(pathToPreserve, 'utf8');
-  const existingMap = parseEnvContentToMap(existingContent);
-  return mergeEnvContentPreservingExisting(resolved, existingMap);
+  const resolvedMap = parseEnvContentToMap(resolved);
+  let merged = mergeEnvMapIntoContent(existingContent, resolvedMap, { appendMissingFromNewMap: true });
+  if (options.pruneOrphanKv === true) {
+    const { content: pruned } = commentOrphanKvEnvLines(merged, new Set(Object.keys(resolvedMap)));
+    merged = pruned;
+  }
+  return merged;
 }
 
 /**
@@ -381,14 +383,18 @@ function resolveEnvContentToWrite(resolved, pathToPreserve) {
 async function writeResolvedEnv({ appName, envPath, resolved, variablesPath, secretsPath, opts }) {
   const preservePath = opts.preserveFromPath !== undefined && opts.preserveFromPath !== null ? opts.preserveFromPath : null;
   const pathToPreserve = preservePath !== null ? preservePath : envPath;
-  const toWrite = resolveEnvContentToWrite(resolved, pathToPreserve);
+  const toWrite = resolveEnvContentToWrite(resolved, pathToPreserve, {
+    freshEnv: opts.freshEnv === true,
+    pruneOrphanKv: opts.envOnly === true && opts.freshEnv !== true
+  });
   fs.writeFileSync(envPath, toWrite, { mode: 0o600 });
 
   if (!opts.skipOutputPath) {
     const { processEnvVariables } = require('../utils/env-copy');
     await processEnvVariables(envPath, variablesPath, appName, secretsPath, {
       preferLocalEnvOutputPath: opts.preferLocalEnvOutputPath === true,
-      appPath: opts.appPath || null
+      appPath: opts.appPath || null,
+      freshEnv: opts.freshEnv === true
     });
   }
   return envPath;

package/lib/core/secrets-env-write.js

@@ -207,7 +207,16 @@ async function resolveAndGetEnvMap(appName, options = {}) {
   let content = await secrets.generateEnvContent(appName, secretsPath, environment, force);
   content = await injectRegistryTokens(content, secretsPath, appName);
   content = await injectBashPrefixedExportLines(content, secretsPath, appName);
-  return parseEnvContentToMap(content);
+  const map = parseEnvContentToMap(content);
+  try {
+    const adminSecrets = require('./admin-secrets');
+    const { applyAdminSecretsPlatformOverlay } = require('./admin-secrets-env-overlay');
+    const adminObj = await adminSecrets.readAndDecryptAdminSecrets();
+    applyAdminSecretsPlatformOverlay(map, adminObj);
+  } catch {
+    // admin-secrets.env optional until up-infra/setup
+  }
+  return map;
 }
 
 module.exports = { resolveAndWriteEnvFile, resolveAndGetEnvMap };

package/lib/core/secrets-infra-placeholder-sync.js

@@ -43,6 +43,8 @@ async function syncLiteralKvSecretsFromCliOverrides(
       const val = ipc.generateValueFromCatalogEntry(key, entry, crypto, placeholderContext);
       await setSecretInStore(key, val);
     }
+    const { isSetupQuietOutput } = require('../utils/setup-quiet-output');
+    if (isSetupQuietOutput()) return;
     logger.log(
       `Updated ${keys.length} secret(s) in store (catalog literals using {{${placeholder}}}).`
     );

package/lib/core/setup-installation-profile.js

@@ -0,0 +1,43 @@
+/**
+ * Setup installation profile identifiers (`dev` / `pro`).
+ *
+ * @fileoverview Normalization for setup wizard profile (local install, not login environment)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/** @enum {string} */
+const INSTALLATION_PROFILE = Object.freeze({
+  DEV: 'dev',
+  PRO: 'pro'
+});
+
+/**
+ * @param {unknown} value
+ * @returns {'dev'|'pro'}
+ */
+function normalizeInstallationProfile(value) {
+  const raw = String(value ?? '')
+    .trim()
+    .toLowerCase();
+  if (raw === INSTALLATION_PROFILE.PRO || raw === 'production') {
+    return INSTALLATION_PROFILE.PRO;
+  }
+  return INSTALLATION_PROFILE.DEV;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+function isProInstallationProfile(value) {
+  return normalizeInstallationProfile(value) === INSTALLATION_PROFILE.PRO;
+}
+
+module.exports = {
+  INSTALLATION_PROFILE,
+  normalizeInstallationProfile,
+  isProInstallationProfile
+};