@aifabrix/builder 2.48.0 → 2.49.0

package/lib/cli/infra-guided-auth.js

@@ -16,6 +16,7 @@ const { withMutedLogger } = require('../utils/with-muted-logger');
 const { formatBlockingError } = require('../utils/cli-test-layout-chalk');
 const { isAuthenticationError } = require('../utils/cli-utils');
 const { resolveControllerUrl, isPlatformAuthValidForController } = require('../utils/controller-url');
+const { canUseBootstrapProvision } = require('../commands/up-dataplane-bootstrap');
 
 /**
  * @param {Object} authOpts
@@ -59,7 +60,10 @@ async function runGuidedDeviceLogin(handleLoginFn, controllerUrl, opts = {}) {
     compact: true,
     skipControllerUrlPersist: Boolean(opts.tokenControllerUrl),
     skipDataplaneVersionRefresh: opts.skipDataplaneVersionRefresh === true,
-    exitOnFailure: false
+    exitOnFailure: false,
+    guidedInstall: opts.guidedInstall === true,
+    onProgressText: opts.onProgressText,
+    suppressSuccessLine: opts.suppressSuccessLine === true
   });
 }
 
@@ -74,12 +78,17 @@ async function runGuidedAuthStep(handleLoginFn, authOpts, spinners) {
   const spin = spinners.startSpinner('Authenticating...');
   const { apiUrl, tokenUrl } = await resolveGuidedAuthControllerUrls(authOpts);
   const loginOpts = { skipDataplaneVersionRefresh: true, tokenControllerUrl: tokenUrl };
+  const bootstrapEligible = await canUseBootstrapProvision({ skipInfraCheck: true });
   const skipLogin =
+    bootstrapEligible ||
     authOpts.skipLoginIfAuthenticated === true ||
     (await isPlatformAuthValidForController(tokenUrl));
   try {
     if (skipLogin) {
-      spinners.stopSpinnerSuccess(spin, 'Already authenticated');
+      spinners.stopSpinnerSuccess(
+        spin,
+        bootstrapEligible ? 'Bootstrap provision (no device login)' : 'Already authenticated'
+      );
       return;
     }
     await runGuidedDeviceLogin(handleLoginFn, apiUrl, loginOpts);
@@ -103,9 +112,17 @@ async function runGuidedAuthStep(handleLoginFn, authOpts, spinners) {
  * @param {Function} handleUpDataplane
  * @param {Function} handleLoginFn
  * @param {string} controllerUrl
+ * @param {{ onSpinnerText?: (text: string) => void }} [ui]
  * @returns {Promise<void>}
  */
-async function runGuidedDataplaneWithAuthRecovery(options, handleUpDataplane, handleLoginFn, controllerUrl) {
+async function runGuidedDataplaneWithAuthRecovery(
+  options,
+  handleUpDataplane,
+  handleLoginFn,
+  controllerUrl,
+  ui = {}
+) {
+  const onSpinnerText = typeof ui.onSpinnerText === 'function' ? ui.onSpinnerText : null;
   try {
     await withMutedLogger(() =>
       handleUpDataplane({ ...options, platformInstall: true, skipInfraCheck: true })
@@ -114,10 +131,29 @@ async function runGuidedDataplaneWithAuthRecovery(options, handleUpDataplane, ha
     if (!isAuthenticationError(error)) {
       throw error;
     }
+    const bootstrapEligible = await canUseBootstrapProvision({
+      skipInfraCheck: true,
+      allowNonDev: options.allowNonDev
+    });
+    if (bootstrapEligible) {
+      throw error;
+    }
     const loginUrl = error.controllerUrl || controllerUrl || (await resolveControllerUrl());
-    logger.log('');
-    logger.log(chalk.yellow('Device login required to register and deploy Dataplane.'));
-    await runGuidedDeviceLogin(handleLoginFn, loginUrl, { skipDataplaneVersionRefresh: false });
+    if (onSpinnerText) {
+      onSpinnerText('Authenticating...');
+    } else {
+      logger.log('');
+      logger.log(chalk.yellow('Device login required to register and deploy Dataplane.'));
+    }
+    await runGuidedDeviceLogin(handleLoginFn, loginUrl, {
+      skipDataplaneVersionRefresh: false,
+      compact: true,
+      guidedInstall: true,
+      onProgressText: onSpinnerText || undefined
+    });
+    if (onSpinnerText) {
+      onSpinnerText('Validating Dataplane...');
+    }
     await withMutedLogger(() =>
       handleUpDataplane({ ...options, platformInstall: true, skipInfraCheck: true })
     );

package/lib/cli/infra-guided-footers.js

@@ -0,0 +1,164 @@
+/**
+ * @fileoverview Footer and header layout for guided infra/platform CLI flows.
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const config = require('../core/config');
+const { computeAppBaseUrl, resolvePlatformControllerUrl } = require('../utils/platform-controller-url');
+const { successGlyph } = require('../utils/cli-test-layout-chalk');
+
+const SEPARATOR = '────────────────────────────────────────';
+
+function title(text) {
+  return chalk.bold(text);
+}
+
+function logSection(label, value) {
+  logger.log(title(label));
+  logger.log(`  ${value}`);
+  logger.log('');
+}
+
+function logFooterStart(label) {
+  logger.log('');
+  logger.log(SEPARATOR);
+  logger.log(title(label));
+  logger.log(SEPARATOR);
+  logger.log('');
+}
+
+function logFooterEnd() {
+  logger.log(SEPARATOR);
+}
+
+/**
+ * @async
+ * @returns {Promise<string>}
+ */
+async function resolvePlatformControllerUrlForDisplay() {
+  const stored = await config.getPlatformControllerUrl();
+  if (stored) {
+    return stored;
+  }
+  return resolvePlatformControllerUrl();
+}
+
+async function logPlatformReadyFooter() {
+  const [controllerUrl, dataplaneUrl, keycloakUrl] = await Promise.all([
+    resolvePlatformControllerUrlForDisplay(),
+    computeAppBaseUrl('dataplane'),
+    computeAppBaseUrl('keycloak')
+  ]);
+  const cfg = await config.getConfig();
+  const env = cfg && cfg.environment ? cfg.environment : 'dev';
+
+  logFooterStart('Platform Ready');
+  logSection('Environment', env);
+  logSection('Miso Controller', controllerUrl);
+  logSection('Dataplane (DEV)', dataplaneUrl);
+  logSection('Keycloak', keycloakUrl);
+  logSection('API Documentation', `${dataplaneUrl}/api/docs`);
+  logSection('Knowledge Base', 'https://docs.aifabrix.ai');
+  logSection('Getting Started', 'https://docs.aifabrix.ai/get-started');
+  logFooterEnd();
+}
+
+async function logMisoReadyFooter() {
+  const [controllerUrl, keycloakUrl] = await Promise.all([
+    resolvePlatformControllerUrlForDisplay(),
+    computeAppBaseUrl('keycloak')
+  ]);
+  logFooterStart('Miso Ready');
+  logSection('Miso Controller', controllerUrl);
+  logSection('Keycloak', keycloakUrl);
+  logFooterEnd();
+}
+
+async function logDataplaneReadyFooter() {
+  const dataplaneUrl = await computeAppBaseUrl('dataplane');
+  const cfg = await config.getConfig();
+  const env = cfg && cfg.environment ? cfg.environment : 'dev';
+  logFooterStart('Dataplane Ready');
+  logSection('Environment', env);
+  logSection('Dataplane (DEV)', dataplaneUrl);
+  logSection('API Documentation', `${dataplaneUrl}/api/docs`);
+  logFooterEnd();
+}
+
+/**
+ * @param {'platform'|'dataplane'} [scope]
+ */
+function logPlatformSetupDurationHint(scope = 'platform') {
+  const line =
+    scope === 'dataplane'
+      ? 'Installation may take a few minutes. Authenticating and starting Dataplane — please wait.'
+      : 'Installation may take a few minutes. Keycloak, Miso Controller, and Dataplane are starting — please wait.';
+  logger.log(chalk.yellow(`⚠ ${line}`));
+}
+
+function logGuidedPlatformSetupHeader() {
+  logger.log('');
+  logger.log(title('AI Fabrix Platform Setup'));
+  logger.log(SEPARATOR);
+  logger.log('');
+  logPlatformSetupDurationHint('platform');
+  logger.log('');
+}
+
+/**
+ * @param {{ deviceCleared: number, clientCleared: number, environment: string, defaultControllerUrl: string }} forceSummary
+ * @param {string[]} cleanedApps
+ */
+function logUpPlatformForceCleanSummary(forceSummary, cleanedApps) {
+  const { isSetupQuietOutput } = require('../utils/setup-quiet-output');
+  if (isSetupQuietOutput()) return;
+  const check = successGlyph();
+  logger.log(chalk.bold('Clean installation files'));
+  logger.log(
+    chalk.gray(
+      ` ${check} Cleared ${forceSummary.deviceCleared} device token(s) and ${forceSummary.clientCleared} client token(s)`
+    )
+  );
+  logger.log(chalk.gray(` ${check} Environment set to ${forceSummary.environment}`));
+  logger.log(
+    chalk.gray(
+      ` ${check} Default controller set to ${forceSummary.defaultControllerUrl} (run aifabrix login after platform is up)`
+    )
+  );
+  for (const appName of cleanedApps || []) {
+    logger.log(chalk.gray(` ${check} Cleaned builder/${appName}`));
+  }
+  logger.log('');
+}
+
+/**
+ * @param {Object} cfg
+ */
+function logStoppedServices(cfg) {
+  logger.log(title('Stopped'));
+  logger.log('  postgres');
+  logger.log('  redis');
+  if (cfg.pgadmin !== false) logger.log('  pgadmin');
+  if (cfg.redisCommander !== false) logger.log('  redis-commander');
+  if (cfg.traefik) logger.log('  traefik');
+  logger.log('');
+}
+
+module.exports = {
+  SEPARATOR,
+  title,
+  logSection,
+  logFooterStart,
+  logFooterEnd,
+  resolvePlatformControllerUrlForDisplay,
+  logPlatformReadyFooter,
+  logMisoReadyFooter,
+  logDataplaneReadyFooter,
+  logPlatformSetupDurationHint,
+  logGuidedPlatformSetupHeader,
+  logUpPlatformForceCleanSummary,
+  logStoppedServices
+};

package/lib/cli/infra-guided-spinners.js

@@ -0,0 +1,57 @@
+/**
+ * @fileoverview Spinner helpers for guided infra/platform CLI flows.
+ */
+
+'use strict';
+
+const ora = require('ora');
+const logger = require('../utils/logger');
+const { formatProgress, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+
+function shouldUseSpinner() {
+  return Boolean(process && process.stdout && process.stdout.isTTY);
+}
+
+/**
+ * @param {string} text
+ * @returns {import('ora').Ora|null}
+ */
+function startSpinner(text) {
+  if (!shouldUseSpinner()) {
+    logger.log(formatProgress(text));
+    return null;
+  }
+  return ora({ text, spinner: 'dots' }).start();
+}
+
+/**
+ * @param {import('ora').Ora|null} spinner
+ * @param {string} text
+ */
+function stopSpinnerSuccess(spinner, text) {
+  if (!spinner) {
+    logger.log(formatSuccessLine(text));
+    return;
+  }
+  spinner.succeed(text);
+}
+
+/**
+ * @param {import('ora').Ora|null} spinner
+ * @returns {(text: string) => void}
+ */
+function createSpinnerTextUpdater(spinner) {
+  return (text) => {
+    if (spinner) {
+      spinner.text = text;
+      return;
+    }
+    logger.log(formatProgress(text));
+  };
+}
+
+module.exports = {
+  startSpinner,
+  stopSpinnerSuccess,
+  createSpinnerTextUpdater
+};

package/lib/cli/infra-guided.js

@@ -10,10 +10,7 @@ const config = require('../core/config');
 const devConfig = require('../utils/dev-config');
 const pathsUtil = require('../utils/paths');
 const { loadConfigFile } = require('../utils/config-format');
-const { computeAppBaseUrl, resolvePlatformControllerUrl } = require('../utils/platform-controller-url');
 const { withMutedLogger } = require('../utils/with-muted-logger');
-const { formatProgress, formatSuccessLine, successGlyph } = require('../utils/cli-test-layout-chalk');
-const ora = require('ora');
 const infra = require('../infrastructure');
 const { execWithDockerEnv } = require('../utils/docker-exec');
 const { getLogLevel, passesLevelFilter } = require('../commands/app-logs');
@@ -23,6 +20,26 @@ const {
   runGuidedAuthStep,
   runGuidedDataplaneWithAuthRecovery
 } = require('./infra-guided-auth');
+const {
+  startSpinner,
+  stopSpinnerSuccess,
+  createSpinnerTextUpdater
+} = require('./infra-guided-spinners');
+const {
+  SEPARATOR,
+  title,
+  logSection,
+  logFooterStart,
+  logFooterEnd,
+  resolvePlatformControllerUrlForDisplay,
+  logPlatformReadyFooter,
+  logMisoReadyFooter,
+  logDataplaneReadyFooter,
+  logPlatformSetupDurationHint,
+  logGuidedPlatformSetupHeader,
+  logUpPlatformForceCleanSummary,
+  logStoppedServices
+} = require('./infra-guided-footers');
 const healthCheck = require('../utils/health-check');
 const { prepareUrlsLocalRegistryForUpPlatform } = require('../commands/up-common');
 const { assertDevInfraUp } = require('../commands/dev-infra-gate');
@@ -30,32 +47,6 @@ const {
   emitSystemBuilderAppManifestLineIfTTY
 } = require('../utils/manifest-source-emit');
 
-const SEPARATOR = '────────────────────────────────────────';
-
-function title(text) {
-  return chalk.bold(text);
-}
-
-function shouldUseSpinner() {
-  return Boolean(process && process.stdout && process.stdout.isTTY);
-}
-
-function startSpinner(text) {
-  if (!shouldUseSpinner()) {
-    logger.log(formatProgress(text));
-    return null;
-  }
-  return ora({ text, spinner: 'dots' }).start();
-}
-
-function stopSpinnerSuccess(spinner, text) {
-  if (!spinner) {
-    logger.log(formatSuccessLine(text));
-    return;
-  }
-  spinner.succeed(text);
-}
-
 async function getRunningContainerNameForApp(appName) {
   const apps = await infra.getAppStatus();
   const hit = (apps || []).find(a => a && a.name === appName && a.container);
@@ -124,84 +115,10 @@ function resolveInfraHost(remoteServer) {
     const u = new URL(withScheme);
     return u.hostname || 'localhost';
   } catch {
-    // Fallback for non-URL strings.
     return raw.replace(/^https?:\/\//i, '').split('/')[0].split(':')[0] || 'localhost';
   }
 }
 
-/**
- * Prefer stored platform controller URL, then compute from routing rules.
- * @async
- * @returns {Promise<string>}
- */
-async function resolvePlatformControllerUrlForDisplay() {
-  const stored = await config.getPlatformControllerUrl();
-  if (stored) {
-    return stored;
-  }
-  return resolvePlatformControllerUrl();
-}
-
-function logSection(label, value) {
-  logger.log(title(label));
-  logger.log(`  ${value}`);
-  logger.log('');
-}
-
-function logFooterStart(label) {
-  logger.log('');
-  logger.log(SEPARATOR);
-  logger.log(title(label));
-  logger.log(SEPARATOR);
-  logger.log('');
-}
-
-function logFooterEnd() {
-  logger.log(SEPARATOR);
-}
-
-async function logPlatformReadyFooter() {
-  const [controllerUrl, dataplaneUrl, keycloakUrl] = await Promise.all([
-    resolvePlatformControllerUrlForDisplay(),
-    computeAppBaseUrl('dataplane'),
-    computeAppBaseUrl('keycloak')
-  ]);
-  const cfg = await config.getConfig();
-  const env = (cfg && cfg.environment) ? cfg.environment : 'dev';
-
-  logFooterStart('Platform Ready');
-  logSection('Environment', env);
-  logSection('Miso Controller', controllerUrl);
-  logSection('Dataplane (DEV)', dataplaneUrl);
-  logSection('Keycloak', keycloakUrl);
-  logSection('API Documentation', `${dataplaneUrl}/api/docs`);
-  logSection('Knowledge Base', 'https://docs.aifabrix.ai');
-  logSection('Getting Started', 'https://docs.aifabrix.ai/get-started');
-  logFooterEnd();
-}
-
-async function logMisoReadyFooter() {
-  const [controllerUrl, keycloakUrl] = await Promise.all([
-    resolvePlatformControllerUrlForDisplay(),
-    computeAppBaseUrl('keycloak')
-  ]);
-  logFooterStart('Miso Ready');
-  logSection('Miso Controller', controllerUrl);
-  logSection('Keycloak', keycloakUrl);
-  logFooterEnd();
-}
-
-async function logDataplaneReadyFooter() {
-  const dataplaneUrl = await computeAppBaseUrl('dataplane');
-  const cfg = await config.getConfig();
-  const env = (cfg && cfg.environment) ? cfg.environment : 'dev';
-  logFooterStart('Dataplane Ready');
-  logSection('Environment', env);
-  logSection('Dataplane (DEV)', dataplaneUrl);
-  logSection('API Documentation', `${dataplaneUrl}/api/docs`);
-  logFooterEnd();
-}
-
 async function getInfraHostAndPorts() {
   const developerId = await config.getDeveloperId();
   const idNum = typeof developerId === 'string' ? parseInt(developerId, 10) : developerId;
@@ -269,17 +186,12 @@ async function runGuidedUpMiso(options, handleUpMiso) {
   await validateAppErrorLogs(['miso-controller']);
 }
 
-/**
- * Infra must be checked before auth: device login talks to the controller, which needs
- * Postgres/Redis when the controller runs locally — a down infra looks like "network error".
- */
 async function assertDevInfraForGuidedDataplane() {
   const infraSpin = startSpinner('Checking infrastructure...');
   try {
     await assertDevInfraUp({ quietSuccess: true });
     stopSpinnerSuccess(infraSpin, 'Infrastructure is up');
   } catch (infraErr) {
-    // Match up-miso: one error block from handleCommandError only (no spinner.fail / extra hints).
     if (infraSpin) infraSpin.stop();
     throw infraErr;
   }
@@ -293,17 +205,18 @@ async function runGuidedUpDataplane(options, handleUpDataplane) {
   logPlatformSetupDurationHint('dataplane');
   logger.log('');
   await assertDevInfraForGuidedDataplane();
-  // Avoid an outer long-running spinner here: up-dataplane has multiple internal
-  // phases and may print some output. An outer spinner causes "spinner over spinner"
-  // rendering artifacts. Instead, do the same single auth step as up-platform, then
-  // show one spinner for the dataplane install/run phase.
   await runGuidedAuthStep(handleLogin, {}, { startSpinner, stopSpinnerSuccess });
 
   logger.log('');
   emitSystemBuilderAppManifestLineIfTTY(logger, 'dataplane');
   const dpSpin = startSpinner('Starting Dataplane...');
-  await withMutedLogger(() =>
-    handleUpDataplane({ ...options, platformInstall: true, skipInfraCheck: true })
+  const controllerUrl = await resolveGuidedAuthControllerUrl({});
+  await runGuidedDataplaneWithAuthRecovery(
+    { ...options, platformInstall: true, skipInfraCheck: true },
+    handleUpDataplane,
+    handleLogin,
+    controllerUrl,
+    { onSpinnerText: createSpinnerTextUpdater(dpSpin) }
   );
   stopSpinnerSuccess(dpSpin, 'Dataplane ready');
   await refreshDataplaneVersionAfterPlatformInstall();
@@ -311,54 +224,6 @@ async function runGuidedUpDataplane(options, handleUpDataplane) {
   await logDataplaneReadyFooter();
 }
 
-/**
- * Guided-mode summary after `up-platform --force` (printed under the platform header).
- * @param {{ deviceCleared: number, clientCleared: number, environment: string, defaultControllerUrl: string }} forceSummary
- * @param {string[]} cleanedApps
- */
-function logUpPlatformForceCleanSummary(forceSummary, cleanedApps) {
-  const { isSetupQuietOutput } = require('../utils/setup-quiet-output');
-  if (isSetupQuietOutput()) return;
-  const check = successGlyph();
-  logger.log(chalk.bold('Clean installation files'));
-  logger.log(
-    chalk.gray(
-      ` ${check} Cleared ${forceSummary.deviceCleared} device token(s) and ${forceSummary.clientCleared} client token(s)`
-    )
-  );
-  logger.log(chalk.gray(` ${check} Environment set to ${forceSummary.environment}`));
-  logger.log(
-    chalk.gray(
-      ` ${check} Default controller set to ${forceSummary.defaultControllerUrl} (run aifabrix login after platform is up)`
-    )
-  );
-  for (const appName of cleanedApps || []) {
-    logger.log(chalk.gray(` ${check} Cleaned builder/${appName}`));
-  }
-  logger.log('');
-}
-
-/**
- * Yellow notice before long-running platform/dataplane install steps (setup and guided up-*).
- * @param {'platform'|'dataplane'} [scope]
- */
-function logPlatformSetupDurationHint(scope = 'platform') {
-  const line =
-    scope === 'dataplane'
-      ? 'Installation may take a few minutes. Authenticating and starting Dataplane — please wait.'
-      : 'Installation may take a few minutes. Keycloak, Miso Controller, and Dataplane are starting — please wait.';
-  logger.log(chalk.yellow(`⚠ ${line}`));
-}
-
-function logGuidedPlatformSetupHeader() {
-  logger.log('');
-  logger.log(title('AI Fabrix Platform Setup'));
-  logger.log(SEPARATOR);
-  logger.log('');
-  logPlatformSetupDurationHint('platform');
-  logger.log('');
-}
-
 async function refreshDataplaneVersionAfterPlatformInstall() {
   try {
     const { tryRefreshDataplaneVersionAfterLogin } = require('../commands/auth-status-dataplane-version');
@@ -386,20 +251,27 @@ async function runGuidedDataplaneInstallPhase(options, handleUpDataplane, handle
   logger.log('');
   emitSystemBuilderAppManifestLineIfTTY(logger, 'dataplane');
   const dpSpin = startSpinner('Starting Dataplane...');
+  const onSpinnerText = createSpinnerTextUpdater(dpSpin);
   const platformMode = await config.getSetupPlatformMode();
   if (platformMode === 'full') {
-    // Full platform: three dataplane containers + per-env registrations.
     const envKeys = ['pro', 'dev', 'tst'];
     for (const envKey of envKeys) {
       await runGuidedDataplaneWithAuthRecovery(
         { ...options, envKey, runEnvKey: envKey, allowNonDev: true },
         handleUpDataplane,
         handleLoginFn,
-        controllerUrl
+        controllerUrl,
+        { onSpinnerText }
       );
     }
   } else {
-    await runGuidedDataplaneWithAuthRecovery(options, handleUpDataplane, handleLoginFn, controllerUrl);
+    await runGuidedDataplaneWithAuthRecovery(
+      options,
+      handleUpDataplane,
+      handleLoginFn,
+      controllerUrl,
+      { onSpinnerText }
+    );
   }
   stopSpinnerSuccess(dpSpin, 'Dataplane ready');
   await refreshDataplaneVersionAfterPlatformInstall();
@@ -423,6 +295,7 @@ async function runGuidedUpPlatform(options, handleUpMiso, handleUpDataplane, han
     const realmSpin = startSpinner('Waiting for Keycloak realm (aifabrix)...');
     await waitForKeycloakRealmReady({ timeoutSeconds: 180 });
     stopSpinnerSuccess(realmSpin, 'Keycloak realm ready');
+    logger.log('');
   }
   await runGuidedAuthStep(handleLogin, authOpts, { startSpinner, stopSpinnerSuccess });
   const controllerUrl = await resolveGuidedAuthControllerUrl(authOpts);
@@ -431,17 +304,7 @@ async function runGuidedUpPlatform(options, handleUpMiso, handleUpDataplane, han
   await logPlatformReadyFooter();
 }
 
-function logStoppedServices(cfg) {
-  logger.log(title('Stopped'));
-  logger.log('  postgres');
-  logger.log('  redis');
-  if (cfg.pgadmin !== false) logger.log('  pgadmin');
-  if (cfg.redisCommander !== false) logger.log('  redis-commander');
-  if (cfg.traefik) logger.log('  traefik');
-  logger.log('');
-}
-
-async function runGuidedDownInfra(appName, options, infra, appLib) {
+async function runGuidedDownInfra(appName, options, infraMod, appLib) {
   logger.log('');
   logger.log(title('AI Fabrix Shutdown'));
   logger.log(SEPARATOR);
@@ -453,8 +316,8 @@ async function runGuidedDownInfra(appName, options, infra, appLib) {
       await appLib.downApp(appName, { volumes: !!options.volumes });
       return;
     }
-    if (options.volumes) await infra.stopInfraWithVolumes();
-    else await infra.stopInfra();
+    if (options.volumes) await infraMod.stopInfraWithVolumes();
+    else await infraMod.stopInfra();
   });
   stopSpinnerSuccess(spin, 'Infrastructure stopped');
 
@@ -479,4 +342,3 @@ module.exports = {
   runGuidedUpPlatform,
   runGuidedDownInfra
 };
-

package/lib/cli/setup-app.js

@@ -297,7 +297,7 @@ Examples:
     .option('--reload', 'In dev: mount workspace into container (Mutagen only if docker-endpoint is a remote host)')
     .option(
       '--proxy',
-      'Use Traefik/front-door public URL hints when infra has Traefik and application.yaml enables frontDoorRouting (default: on)',
+      'Use Traefik/front-door public URL hints when infra has Traefik (ignored when traefik: false in config)',
       true
     )
     .option(

package/lib/cli/setup-dev.js

@@ -39,6 +39,7 @@ Examples:
   $ aifabrix dev add --developer-id 02 --name "Jane Doe" --email jane@example.com
   $ aifabrix dev add --developer-id 03 --name "Build admin" --email admin@example.com --groups admin,developer
   $ aifabrix dev add --developer-id 04 --name "CI user" --email ci@example.com --groups secret-manager,developer
+  $ aifabrix dev add --developer-id 05 --name "Integrator" --email integrator@example.com --groups developer,secret-reader
 
 Requires a configured remote Builder Server and an admin client certificate (same machine setup as dev list / dev pin). After add, run dev pin <id> once to create a PIN for aifabrix dev init.
 `;
@@ -274,7 +275,7 @@ function setupDevListAddCommands(dev) {
     .requiredOption('--developer-id <id>', 'Unique id, digits only (e.g. 02); used with dev init --developer-id')
     .requiredOption('--name <name>', 'Display name')
     .requiredOption('--email <email>', 'Email address')
-    .option('--groups <items>', 'Comma-separated roles: admin, secret-manager, developer, docker', 'developer')
+    .option('--groups <items>', 'Comma-separated roles: admin, secret-manager, secret-reader, developer, docker', 'developer')
     .addHelpText('after', DEV_ADD_HELP_AFTER)
     .action(async(options) => {
       try {
@@ -297,7 +298,7 @@ function setupDevUpdatePinDeleteCommands(dev) {
     .option('--developer-id <id>', 'Developer ID (same as dev add)')
     .option('--name <name>', 'Display name')
     .option('--email <email>', 'Email address')
-    .option('--groups <items>', 'Comma-separated groups (admin, secret-manager, developer, docker)')
+    .option('--groups <items>', 'Comma-separated groups (admin, secret-manager, secret-reader, developer, docker)')
     .addHelpText('after', DEV_UPDATE_HELP_AFTER)
     .action(async(developerId, options) => {
       try {

package/lib/cli/setup-infra.js

@@ -34,7 +34,8 @@ const {
 
 const {
   computeEffectiveInfraOptionalFlags,
-  persistMissingInfraOptionalServiceFlags
+  persistMissingInfraOptionalServiceFlags,
+  resolveEffectiveTlsEnabled
 } = require('../utils/infra-optional-service-flags');
 
 const UP_INFRA_HELP_AFTER = `
@@ -137,7 +138,7 @@ async function runUpInfraCommand(options) {
   const { passwordBundleFromCliOptions } = require('../core/admin-secrets-bundle');
   const bundle = passwordBundleFromCliOptions(options);
   const adminPass = options.adminPassword || options.adminPwd;
-  const tlsEnabledEffective = cfg.tlsEnabled === true;
+  const tlsEnabledEffective = resolveEffectiveTlsEnabled(cfg, options);
   const effective = computeEffectiveInfraOptionalFlags(cfg, options);
   await infra.startInfra(developerId, {
     traefik: effective.traefik,