@aifabrix/builder 2.46.0 → 2.47.1

package/lib/cli/setup-app.js

@@ -112,6 +112,49 @@ function normalizeExternalOptions(options) {
   return normalized;
 }
 
+/**
+ * Whether normalized options include all external CLI fields for headless create.
+ * @param {Object} normalized - Normalized external create options
+ * @returns {boolean}
+ */
+function hasFullExternalCliOptions(normalized) {
+  return Boolean(
+    normalized.systemKey &&
+    normalized.systemDisplayName &&
+    normalized.systemDescription &&
+    normalized.systemType &&
+    normalized.authType &&
+    normalized.entityType &&
+    normalized.datasourceCount
+  );
+}
+
+/**
+ * Map positional systemKey and apply headless defaults for external create.
+ * @param {string} appName - Positional appKey or systemKey from CLI
+ * @param {Object} options - Raw CLI options
+ * @returns {Object} Normalized options ready for createApp
+ */
+function prepareExternalCreateOptions(appName, options) {
+  const normalized = normalizeExternalOptions(options);
+  const isExternalType = options.type === 'external' || !options.type;
+
+  if (isExternalType && appName) {
+    normalized.systemKey = appName;
+  }
+
+  if (isExternalType && hasFullExternalCliOptions(normalized)) {
+    if (!Object.prototype.hasOwnProperty.call(normalized, 'github')) {
+      normalized.github = false;
+    }
+    if (!Object.prototype.hasOwnProperty.call(normalized, 'controller')) {
+      normalized.controller = false;
+    }
+  }
+
+  return normalized;
+}
+
 /**
  * Validate required options for non-interactive external creation
  * @param {Object} normalizedOptions - Normalized options
@@ -149,7 +192,7 @@ async function handleCreateCommand(appName, options) {
   }
 
   const wizardOptions = { app: appName, ...options };
-  const normalizedOptions = normalizeExternalOptions(options);
+  const normalizedOptions = prepareExternalCreateOptions(appName, options);
 
   const isExternalType = options.type === 'external' || !options.type;
   const isNonInteractive = process.stdin && process.stdin.isTTY === false;
@@ -279,7 +322,10 @@ function setupBuildRunLogsDownCommands(program) {
     .option('-f, --force-template', 'Force rebuild from template')
     .option('--no-cache', 'Full Docker rebuild (disable layer cache); use after Dockerfile or context fixes')
     .option('-t, --tag <tag>', 'Image tag (default: latest). Set image.tag in application.yaml to match for deploy.')
-    .option('--base', 'Also tag the manifest base image name (after developer-scoped build when developer id > 0)')
+    .option(
+      '--base',
+      'When manifest omits image: also tag the base repository after a developer-scoped build (ignored when application.yaml defines image)'
+    )
     .action(async(appName, options) => {
       try {
         const imageTag = await app.buildApp(appName, options);
@@ -437,4 +483,9 @@ function setupAppCommands(program) {
   setupPushDeployDockerfileCommands(program);
 }
 
-module.exports = { setupAppCommands };
+module.exports = {
+  setupAppCommands,
+  normalizeExternalOptions,
+  prepareExternalCreateOptions,
+  validateNonInteractiveExternalOptions
+};

package/lib/cli/setup-infra-up-dataplane-action.js

@@ -15,7 +15,7 @@ const { handleCommandError, isAuthenticationError } = require('../utils/cli-util
 const { resolveControllerUrl } = require('../utils/controller-url');
 const { handleLogin } = require('../commands/login');
 const { handleUpDataplane } = require('../commands/up-dataplane');
-const { cleanBuilderAppDirs } = require('../commands/up-common');
+const { cleanBuilderAppDirs, DATAPLANE_BUILDER_APP_KEYS } = require('../commands/up-common');
 const { runGuidedUpDataplane } = require('./infra-guided');
 const { recordInfraInstallationCommand } = require('./installation-log-command');
 
@@ -26,7 +26,7 @@ const { recordInfraInstallationCommand } = require('./installation-log-command')
 async function runUpDataplaneWork(options) {
   let cleanedAppKeys = [];
   if (options.force) {
-    const c = await cleanBuilderAppDirs(['dataplane']);
+    const c = await cleanBuilderAppDirs([...DATAPLANE_BUILDER_APP_KEYS]);
     cleanedAppKeys = Array.isArray(c) ? c : [];
   }
   if (!options.verbose) {

package/lib/cli/setup-infra-up-platform-action.js

@@ -19,6 +19,7 @@ const { handleUpDataplane } = require('../commands/up-dataplane');
 const {
   applyUpPlatformForceConfig,
   cleanBuilderAppDirs,
+  PLATFORM_BUILDER_CLEAN_APP_KEYS,
   prepareUrlsLocalRegistryForUpPlatform
 } = require('../commands/up-common');
 const { runGuidedUpPlatform } = require('./infra-guided');
@@ -35,7 +36,7 @@ async function runUpPlatformWork(options) {
   let platformForceCleanSummary = null;
   if (options.force) {
     const forceSummary = await applyUpPlatformForceConfig({ silent: !options.verbose });
-    const cleanedApps = await cleanBuilderAppDirs(PLATFORM_APPS, {
+    const cleanedApps = await cleanBuilderAppDirs(PLATFORM_BUILDER_CLEAN_APP_KEYS, {
       silent: !options.verbose
     });
     cleanedAppKeys = Array.isArray(cleanedApps) ? cleanedApps : [];

package/lib/cli/setup-npm.js

@@ -0,0 +1,59 @@
+/**
+ * CLI npm command setup (user-global registry auth).
+ *
+ * @fileoverview aifabrix npm config command registration
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+const { handleCommandError } = require('../utils/cli-utils');
+const { handleNpmConfig } = require('../commands/npm-config');
+
+const NPM_CONFIG_HELP_AFTER = `
+Writes @aifabrix scope registry auth to your user npm config (~/.npmrc by default).
+Does not modify repo-level .npmrc files.
+
+Token source (default): merged secrets key BASH_NPM_TOKEN (user or --shared store).
+Docker/build: BASH_NPM_TOKEN is also mapped to NPM_TOKEN for aifabrix build.
+
+Examples:
+  $ aifabrix secret set BASH_NPM_TOKEN "<token>" --shared
+  $ aifabrix npm config
+  $ aifabrix npm config --check
+  $ aifabrix npm config --dry-run
+  $ NPM_TOKEN="<token>" aifabrix npm config --from-env
+
+Migration from repo .npmrc.token:
+  1. aifabrix secret remove npm-token-secretKeyVault --shared
+  2. aifabrix secret set BASH_NPM_TOKEN "<token>" --shared
+  3. aifabrix npm config
+  4. npm whoami --registry=https://registry.npmjs.org/
+`;
+
+/**
+ * @param {import('commander').Command} program
+ */
+function setupNpmCommands(program) {
+  const npm = program.command('npm').description('User-global npm registry configuration');
+
+  npm
+    .command('config')
+    .description('Apply @aifabrix npm auth from BASH_NPM_TOKEN to user ~/.npmrc')
+    .option('--dry-run', 'Show what would be written without changing files')
+    .option('--check', 'Exit 0 when BASH_NPM_TOKEN is set and npm whoami succeeds')
+    .option('--from-env', 'Use NPM_TOKEN from the environment once (not merged secrets)')
+    .addHelpText('after', NPM_CONFIG_HELP_AFTER)
+    .action(async(opts) => {
+      try {
+        await handleNpmConfig({
+          dryRun: Boolean(opts.dryRun),
+          check: Boolean(opts.check),
+          fromEnv: Boolean(opts.fromEnv)
+        });
+      } catch (error) {
+        handleCommandError(error, 'npm config');
+      }
+    });
+}
+
+module.exports = { setupNpmCommands };

package/lib/cli/setup-platform.js

@@ -54,7 +54,7 @@ function registerSetup(program) {
     .command('setup')
     .description('Install or refresh the full AI Fabrix platform (infra + miso + dataplane)')
     .option('-d, --developer <id>', 'Pin developer ID before fresh install (fresh path only; ignored when infra is already up)')
-    .option('--platform <mode>', 'Platform mode: single (direct ports) or full (Traefik front door + multi-env)')
+    .option('--platform <mode>', 'Platform mode: single, single-traefik (Traefik + TLS), or full (multi-env; advanced)')
     .option('--installation <profile>', 'Installation profile: dev (one password) or pro (autogen/manual)')
     .option('--pro-password-mode <mode>', 'Pro profile only: autogen or manual')
     .option('--admin-email <email>', 'Admin email (non-interactive fresh install)')

package/lib/cli/setup-secrets.js

@@ -101,7 +101,7 @@ Examples:
 const SECRET_SET_SECRETS_FILE_HELP_AFTER = `
 Examples:
   $ aifabrix secret set-secrets-file ./shared-secrets.yaml
-  $ aifabrix secret set-secrets-file https://dev.example.com/api/secrets
+  $ aifabrix secret set-secrets-file https://builder01.local/api/dev/secrets
   $ aifabrix secret set-secrets-file ""
 `;
 

package/lib/cli/setup-utility-help-after.js

@@ -46,8 +46,11 @@ Examples:
   $ aifabrix resolve hubspot-demo
     External integration: resolves integration/<systemKey>/env.template to .env using local host ports (no Docker rewrite).
 
+  $ aifabrix resolve dataplane --force
+    Seed missing secret keys and replace the full .env from env.template (no merge with an existing file).
+
   $ aifabrix resolve dataplane --fresh
-    Regenerate the full .env from env.template (no merge with an existing file). Use after adding many new variables or when a normal resolve did not pick up new template lines.
+    Replace the full .env only (no merge; does not seed missing secret keys). Same .env output as --force when secrets are already set.
 
   $ aifabrix secret set hubspot-demo/token "<your-token>"
     Store a secret when resolve reports a missing kv:// reference.

package/lib/cli/setup-utility-resolve.js

@@ -60,8 +60,8 @@ async function runResolveJsonOutput(appName, appPath, envOnly, envPath, options,
  */
 async function runResolveHumanOutput(appName, envPath, envOnly, options, environment) {
   logger.log(`✔ Generated .env file: ${envPath}`);
-  if (options.fresh) {
-    logger.log(chalk.gray('  Wrote full resolved content (--fresh; did not merge with an existing .env).'));
+  if (options.fresh || options.force) {
+    logger.log(chalk.gray('  Wrote full resolved content (replaced existing .env from env.template; no merge).'));
   }
   if (environment === 'local') {
     logger.log(chalk.gray('  Resolved for local use (host ports; no Docker port rewrite).'));
@@ -130,7 +130,7 @@ async function runResolveAppAction(appName, options) {
       skipOutputPath: false,
       preserveFromPath: null,
       preferLocalEnvOutputPath,
-      freshEnv: options.fresh === true
+      freshEnv: options.fresh === true || options.force === true
     }
   );
   if (jsonMode) {
@@ -148,10 +148,13 @@ function setupResolveCommand(program) {
   program.command('resolve <appKey|systemKey>')
     .description('Generate .env from template (builder/<appKey>/ or integration/<systemKey>/); optional validate after')
     .addHelpText('after', RESOLVE_HELP_AFTER)
-    .option('-f, --force', 'Generate missing secret keys in secrets file')
+    .option(
+      '-f, --force',
+      'Seed missing secret keys and replace .env from env.template (no merge with existing .env or envOutputPath)'
+    )
     .option(
       '--fresh',
-      'Replace .env from env.template (no merge with existing .env or envOutputPath; same as deleting .env first)'
+      'Same full .env replace as --force without seeding missing secret keys in the secrets file'
     )
     .option('--skip-validation', 'Skip file validation after generating .env')
     .option('--json', 'Print JSON summary (envPath, manifestSource, optional validation)')

package/lib/commands/app-logs.js

@@ -13,6 +13,10 @@ const logger = require('../utils/logger');
 const config = require('../core/config');
 const containerHelpers = require('../utils/app-run-containers');
 const { validateAppName } = require('../app/push');
+const {
+  getCeleryCompanionAppKeys,
+  loadBuilderApplicationConfig
+} = require('../utils/celery-companion-apps');
 
 const { execWithDockerEnv } = require('../utils/docker-exec');
 const { maskEnvLine } = require('../utils/log-redaction');
@@ -295,6 +299,36 @@ async function runDockerLogsFollow(containerName, tail, minLevel) {
   });
 }
 
+function parseLogLevelOption(options) {
+  const rawLevel =
+    options.level !== undefined && options.level !== null && options.level !== ''
+      ? String(options.level).trim()
+      : undefined;
+  const level = rawLevel ? rawLevel.toLowerCase() : undefined;
+  if (level !== undefined && level !== null && !LOG_LEVELS.includes(level)) {
+    throw new Error(
+      `Invalid log level '${rawLevel}'; use one of: ${LOG_LEVELS.join(', ')}`
+    );
+  }
+  return level;
+}
+
+async function logFollowStream(companionKeys, containerName, tail, level) {
+  await runDockerLogsFollow(containerName, tail, level);
+  if (companionKeys.length > 0) {
+    const hint = companionKeys.map((key) => `aifabrix logs ${key}`).join(' or ');
+    logger.log(chalk.gray(`Tip: sidecar logs — ${hint}`));
+  }
+}
+
+async function logContainerSnapshot(containerName, tail, level) {
+  try {
+    await runDockerLogs(containerName, { tail, level });
+  } catch (err) {
+    logger.log(chalk.yellow(`No logs for ${containerName}: ${err.message}`));
+  }
+}
+
 /**
  * Run app logs command: optional env dump (masked), then docker logs
  * @async
@@ -307,39 +341,33 @@ async function runDockerLogsFollow(containerName, tail, minLevel) {
  */
 async function runAppLogs(appKey, options = {}) {
   validateAppName(appKey);
-  const rawLevel =
-    options.level !== undefined && options.level !== null && options.level !== ''
-      ? String(options.level).trim()
-      : undefined;
-  const level = rawLevel ? rawLevel.toLowerCase() : undefined;
-  if (level !== undefined && level !== null && !LOG_LEVELS.includes(level)) {
-    throw new Error(
-      `Invalid log level '${rawLevel}'; use one of: ${LOG_LEVELS.join(', ')}`
-    );
-  }
-
+  const level = parseLogLevelOption(options);
   const developerId = await config.getDeveloperId();
-  const containerName = containerHelpers.getContainerName(appKey, developerId);
-
   const follow = !!options.follow;
   const tail = typeof options.tail === 'number' ? options.tail : DEFAULT_TAIL_LINES;
+  const appConfig = loadBuilderApplicationConfig(appKey);
+  const companionKeys = getCeleryCompanionAppKeys(appKey, appConfig);
+  const appKeysToLog = follow ? [appKey] : [appKey, ...companionKeys];
 
-  logger.log(chalk.blue(`Container: ${containerName}\n`));
+  for (const key of appKeysToLog) {
+    const containerName = containerHelpers.getContainerName(key, developerId);
 
-  if (!follow) {
-    await dumpMaskedEnv(containerName);
-  }
+    logger.log(chalk.blue(`Container: ${containerName}\n`));
 
-  if (follow) {
-    await runDockerLogsFollow(containerName, tail, level);
-    return;
-  }
+    if (!follow) {
+      await dumpMaskedEnv(containerName);
+    }
 
-  try {
-    await runDockerLogs(containerName, { tail, level });
-  } catch (err) {
-    logger.log(chalk.red(`Error: ${err.message}`));
-    throw new Error(`Failed to show logs: ${err.message}`);
+    if (follow) {
+      await logFollowStream(companionKeys, containerName, tail, level);
+      return;
+    }
+
+    await logContainerSnapshot(containerName, tail, level);
+
+    if (key !== appKeysToLog[appKeysToLog.length - 1]) {
+      logger.log('');
+    }
   }
 }
 

package/lib/commands/app.js

@@ -17,6 +17,8 @@ const { registerApplication } = require('../app/register');
 const { rotateSecret } = require('../app/rotate-secret');
 const { showApp } = require('../app/show');
 const { runAppDeploymentList } = require('./deployment-list');
+const { isChannelTargetKey } = require('../channels/channel-targets');
+const { addChannelCommand } = require('../channels/add-channel');
 
 const APP_HELP_AFTER = `
 Subcommands:
@@ -25,6 +27,7 @@ Subcommands:
   rotate-secret <key>   New ClientSecret (shown once)
   show <key>            From controller (like show --online)
   deployment <key>      Deployment history for app
+  add-channel <target>  Configure assistant channel install (after deploy)
 
 Requires: aifabrix login
 `;
@@ -118,6 +121,43 @@ function setupAppDeploymentCommand(app) {
     });
 }
 
+function setupAppAddChannelCommand(app) {
+  app.command('add-channel <channelTarget>')
+    .description(
+      'Configure assistant channel install (teams-bot, slack, …) after aifabrix deploy <target>'
+    )
+    .requiredOption('-n, --name <name>', 'Customer-visible channel name')
+    .option('-d, --description <text>', 'Channel description (default generated)')
+    .option('--icon <path>', 'Path to channel icon asset')
+    .option('--template <name>', 'Template override (default from channel target)')
+    .option('--dry-run', 'Generate artifacts only; do not patch external system or credentials')
+    .option('--force', 'Regenerate artifacts and patch config (does not rotate secrets)')
+    .option('--probe', 'After install, validate callbacks and assistant catalog')
+    .action(async(channelTarget, options) => {
+      try {
+        if (!isChannelTargetKey(channelTarget)) {
+          throw new Error(
+            `Unknown channel target "${channelTarget}". Use teams-bot, slack, microsoft-copilot, or chatgpt.`
+          );
+        }
+        await addChannelCommand(channelTarget, {
+          name: options.name,
+          description: options.description,
+          icon: options.icon,
+          template: options.template,
+          dryRun: options.dryRun === true,
+          force: options.force === true,
+          probe: options.probe === true
+        });
+      } catch (error) {
+        if (!error.message?.includes('Authentication required')) {
+          logger.error(formatBlockingError('Channel install failed:'), error.message);
+        }
+        process.exit(1);
+      }
+    });
+}
+
 /**
  * Setup application management commands
  * @param {Command} program - Commander program instance
@@ -129,6 +169,7 @@ function setupAppCommands(program) {
   setupAppRotateSecretCommand(app);
   setupAppShowCommand(app);
   setupAppDeploymentCommand(app);
+  setupAppAddChannelCommand(app);
 }
 
 module.exports = { setupAppCommands };

package/lib/commands/auth-status-dataplane-version.js

@@ -17,7 +17,8 @@
 const { fetchDataplaneGeneralHealth } = require('../api/dataplane-health.api');
 const {
   updateDeviceDataplaneVersions,
-  getDeviceDataplaneVersions
+  getDeviceDataplaneVersions,
+  isCacheStale
 } = require('../core/config-device-dataplane');
 const {
   getInstalledCliVersion
@@ -25,10 +26,10 @@ const {
 const { isAtLeast, isValidSemver } = require('../utils/semver-compare');
 
 /** Max wall time for post-login version cache refresh (silent after success banner). */
-const LOGIN_POST_REFRESH_BUDGET_MS = 12000;
+const LOGIN_POST_REFRESH_BUDGET_MS = 8000;
 
-/** Per health probe during login refresh (two endpoints may be tried). */
-const LOGIN_HEALTH_PROBE_TIMEOUT_MS = 6000;
+/** Per health probe during login refresh (legacy /health first, then v1). */
+const LOGIN_HEALTH_PROBE_TIMEOUT_MS = 3000;
 
 /**
  * Resolve when `promise` settles or when `timeoutMs` elapses (returns undefined).
@@ -79,29 +80,32 @@ async function safeReadCache(controllerUrl) {
 }
 
 /**
- * Refresh dataplane health, persist `device.<controllerUrl>` version cache,
- * and derive the compatibility verdict against the installed Builder CLI.
- * Falls back to the cached entry when the live probe fails so `auth status`
- * still shows the last-known values offline.
- *
- * @async
- * @param {string} controllerUrl - Controller URL (cache key)
- * @param {string} dataplaneUrl - Dataplane base URL for the health probe
- * @returns {Promise<{
- *   dataplaneVersion: string|undefined,
- *   minBuilderCliVersion: string|undefined,
- *   cliVersion: string,
- *   compatible: boolean
- * }>}
+ * Build optional fetch args for {@link fetchDataplaneGeneralHealth}.
+ * @param {Object} [options]
+ * @returns {Object}
  */
-async function refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl, options = {}) {
-  const cliVersion = getInstalledCliVersion();
-  let dataplaneVersion;
-  let minBuilderCliVersion;
+function buildHealthFetchOptions(options = {}) {
   const healthOpts = {};
   if (options.healthTimeoutMs !== undefined && options.healthTimeoutMs !== null) {
     healthOpts.timeoutMs = options.healthTimeoutMs;
   }
+  if (options.endpointOrder) {
+    healthOpts.endpointOrder = options.endpointOrder;
+  }
+  return healthOpts;
+}
+
+/**
+ * Probe dataplane health and persist version fields when available.
+ * @async
+ * @param {string} controllerUrl
+ * @param {string} dataplaneUrl
+ * @param {Object} healthOpts
+ * @returns {Promise<{ dataplaneVersion: string|undefined, minBuilderCliVersion: string|undefined }>}
+ */
+async function fetchAndPersistHealthSnapshot(controllerUrl, dataplaneUrl, healthOpts) {
+  let dataplaneVersion;
+  let minBuilderCliVersion;
 
   try {
     const snapshot = await fetchDataplaneGeneralHealth(dataplaneUrl, healthOpts);
@@ -121,14 +125,63 @@ async function refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl, options
     // ignore — fall through to cached values
   }
 
-  if (!dataplaneVersion && !minBuilderCliVersion) {
-    const cached = await safeReadCache(controllerUrl);
-    if (cached) {
-      dataplaneVersion = cached.version;
-      minBuilderCliVersion = cached.minBuilderCliVersion;
-    }
+  return { dataplaneVersion, minBuilderCliVersion };
+}
+
+/**
+ * Fill missing version fields from the device cache when live probe failed.
+ * @async
+ * @param {string} controllerUrl
+ * @param {string|undefined} dataplaneVersion
+ * @param {string|undefined} minBuilderCliVersion
+ * @returns {Promise<{ dataplaneVersion: string|undefined, minBuilderCliVersion: string|undefined }>}
+ */
+async function resolveVersionFieldsFromCache(controllerUrl, dataplaneVersion, minBuilderCliVersion) {
+  if (dataplaneVersion || minBuilderCliVersion) {
+    return { dataplaneVersion, minBuilderCliVersion };
   }
 
+  const cached = await safeReadCache(controllerUrl);
+  if (!cached) {
+    return { dataplaneVersion, minBuilderCliVersion };
+  }
+
+  return {
+    dataplaneVersion: cached.version,
+    minBuilderCliVersion: cached.minBuilderCliVersion
+  };
+}
+
+/**
+ * Refresh dataplane health, persist `device.<controllerUrl>` version cache,
+ * and derive the compatibility verdict against the installed Builder CLI.
+ * Falls back to the cached entry when the live probe fails so `auth status`
+ * still shows the last-known values offline.
+ *
+ * @async
+ * @param {string} controllerUrl - Controller URL (cache key)
+ * @param {string} dataplaneUrl - Dataplane base URL for the health probe
+ * @returns {Promise<{
+ *   dataplaneVersion: string|undefined,
+ *   minBuilderCliVersion: string|undefined,
+ *   cliVersion: string,
+ *   compatible: boolean
+ * }>}
+ */
+async function refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl, options = {}) {
+  const cliVersion = getInstalledCliVersion();
+  const healthOpts = buildHealthFetchOptions(options);
+  let { dataplaneVersion, minBuilderCliVersion } = await fetchAndPersistHealthSnapshot(
+    controllerUrl,
+    dataplaneUrl,
+    healthOpts
+  );
+  ({ dataplaneVersion, minBuilderCliVersion } = await resolveVersionFieldsFromCache(
+    controllerUrl,
+    dataplaneVersion,
+    minBuilderCliVersion
+  ));
+
   const compatible = computeCompatibility(cliVersion, minBuilderCliVersion);
   return { dataplaneVersion, minBuilderCliVersion, cliVersion, compatible };
 }
@@ -184,33 +237,6 @@ async function resolveAuthConfigAfterLogin(controllerUrl, environment, loginOpti
   }
 }
 
-/**
- * Resolve dataplane URL after login (mirrors auth-status silent resolver).
- * @private
- * @async
- * @param {string} controllerUrl
- * @param {string} environment
- * @param {Object} authConfig
- * @returns {Promise<string|null>}
- */
-async function resolveDataplaneUrlAfterLogin(controllerUrl, environment, authConfig) {
-  const { findDataplaneServiceAppKey } = require('./wizard-dataplane');
-  const { getDataplaneUrl } = require('../datasource/deploy');
-  try {
-    const dataplaneAppKey = await findDataplaneServiceAppKey(
-      controllerUrl,
-      environment,
-      authConfig
-    );
-    if (dataplaneAppKey) {
-      return await getDataplaneUrl(controllerUrl, dataplaneAppKey, environment, authConfig);
-    }
-    return await getDataplaneUrl(controllerUrl, 'dataplane', environment, authConfig);
-  } catch (_resolveError) {
-    return null;
-  }
-}
-
 /**
  * Best-effort health refresh after login when dataplane URL is discoverable.
  * Never throws — cache failures must not block login success.
@@ -222,7 +248,13 @@ async function resolveDataplaneUrlAfterLogin(controllerUrl, environment, authCon
  * @returns {Promise<void>}
  */
 async function tryRefreshDataplaneVersionAfterLoginWork(controllerUrl, loginOptions = {}) {
+  const cached = await safeReadCache(controllerUrl);
+  if (cached && !isCacheStale(cached)) {
+    return;
+  }
+
   const { resolveEnvironment } = require('../core/config');
+  const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
   const environment = await resolveEnvironment();
   const authConfig = await resolveAuthConfigAfterLogin(
     controllerUrl,
@@ -232,14 +264,18 @@ async function tryRefreshDataplaneVersionAfterLoginWork(controllerUrl, loginOpti
   if (!authConfig) {
     return;
   }
-  const dataplaneUrl = await resolveDataplaneUrlAfterLogin(
-    controllerUrl,
-    environment,
-    authConfig
-  );
+  let dataplaneUrl = null;
+  try {
+    dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig, {
+      silent: true
+    });
+  } catch (_resolveError) {
+    return;
+  }
   if (dataplaneUrl) {
     await refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl, {
-      healthTimeoutMs: LOGIN_HEALTH_PROBE_TIMEOUT_MS
+      healthTimeoutMs: LOGIN_HEALTH_PROBE_TIMEOUT_MS,
+      endpointOrder: 'legacy-first'
     });
   }
 }

package/lib/commands/auth-status.js

@@ -14,8 +14,7 @@ const logger = require('../utils/logger');
 const { getOrRefreshDeviceToken } = require('../utils/token-manager');
 const { getAuthUser } = require('../api/auth.api');
 const { resolveControllerUrl } = require('../utils/controller-url');
-const { findDataplaneServiceAppKey } = require('./wizard-dataplane');
-const { getDataplaneUrl } = require('../datasource/deploy');
+const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
 const { checkDataplaneHealth } = require('../utils/dataplane-health');
 const {
   displayDataplaneVersionSection,
@@ -211,11 +210,7 @@ function displayTokenInfo(tokenInfo) {
  */
 async function resolveDataplaneUrlSilent(controllerUrl, environment, authConfig) {
   try {
-    const dataplaneAppKey = await findDataplaneServiceAppKey(controllerUrl, environment, authConfig);
-    if (dataplaneAppKey) {
-      return await getDataplaneUrl(controllerUrl, dataplaneAppKey, environment, authConfig);
-    }
-    return await getDataplaneUrl(controllerUrl, 'dataplane', environment, authConfig);
+    return await resolveDataplaneUrl(controllerUrl, environment, authConfig, { silent: true });
   } catch {
     return null;
   }