@aifabrix/builder 2.49.2 → 2.51.0

package/lib/commands/dev-host-ops.js

@@ -9,50 +9,30 @@ const chalk = require('chalk');
 const logger = require('../utils/logger');
 const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 const { getRemoteDevAuth } = require('../utils/remote-dev-auth');
+const { createHostOpsPollHandlers } = require('../utils/host-ops-poll-ui');
+const { buildHostOpsActionLabel, resolveHostOpsTargetLabel } = require('../utils/host-ops-job-labels');
+const { pollHostOpsJobUntilTerminal } = require('./dev-host-ops-poll');
+const { buildJobParams } = require('./dev-host-ops-params');
 const hostOpsApi = require('../api/host-ops.api');
+const { assertHostOpsJobSucceeded } = require('../utils/host-ops-job-result');
 
 const REMOTE_NOT_CONFIGURED_MSG =
   'Remote server is not configured. Set remote-server and run "aifabrix dev init" first.';
 
-const POLL_INTERVAL_MS = 3000;
-const POLL_TIMEOUT_MS = 3 * 60 * 60 * 1000;
-
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
 /**
- * Build job params from Commander options.
+ * @param {string} type
+ * @param {Object} params
  * @param {Object} options
- * @param {string} [developerId]
  * @returns {Object}
  */
-function buildJobParams(options, developerId) {
-  const params = {};
-  const id = developerId || options.developerId || options['developer-id'];
-  if (id) params.developerId = String(id).trim();
-  if (options.include) params.include = options.include;
-  if (options.exclude) params.exclude = options.exclude;
-  if (options.builderVersion || options['builder-version']) {
-    params.builderVersion = options.builderVersion || options['builder-version'];
-  }
-  if (options.adminEmail || options['admin-email']) {
-    params.adminEmail = options.adminEmail || options['admin-email'];
-  }
-  if (options.adminPassword || options['admin-password']) {
-    params.adminPassword = options.adminPassword || options['admin-password'];
-  }
-  if (options.platform) params.platform = options.platform;
-  if (options.installation) params.installation = options.installation;
-  if (options.skipCert || options['skip-cert']) params.skipCert = true;
-  if (options.skipPlatform || options['skip-platform']) params.skipPlatform = true;
-  if (options.skipCli || options['skip-cli']) params.skipCli = true;
-  if (options.check) params.check = true;
-  if (options.failOnBlocked) params.failOnBlocked = true;
-  if (options.timeoutMinutes || options['timeout-minutes']) {
-    params.timeoutMinutes = parseInt(options.timeoutMinutes || options['timeout-minutes'], 10);
-  }
-  return params;
+function buildHostOpsWaitOpts(type, params, options) {
+  return {
+    wait: options.wait !== false,
+    json: Boolean(options.json),
+    jobType: type,
+    targetLabel: resolveHostOpsTargetLabel(params),
+    params
+  };
 }
 
 /**
@@ -70,26 +50,20 @@ async function waitForHostOpsJob(auth, jobId, opts = {}) {
   if (!wait) {
     return { jobId, status: 'pending' };
   }
-  const started = Date.now();
-  while (Date.now() - started < POLL_TIMEOUT_MS) {
-    const job = await hostOpsApi.getHostOpsJob(
-      auth.serverUrl,
-      auth.clientCertPem,
-      jobId,
-      auth.serverCaPem || undefined
-    );
-    if (!json) {
-      logger.log(chalk.gray(`  host-ops job ${jobId}: ${job.status}`));
-    }
-    if (job.status === 'completed' || job.status === 'failed') {
-      if (job.status === 'failed') {
-        throw new Error(job.error || `Host-ops job ${jobId} failed`);
-      }
-      return job;
-    }
-    await sleep(POLL_INTERVAL_MS);
+  const pollContext = {
+    jobType: opts.jobType,
+    targetLabel: opts.targetLabel,
+    params: opts.params,
+    startedAt: Date.now()
+  };
+  const pollUi = json
+    ? { onPollProgress: () => {}, onTransientError: () => {}, finish: () => {} }
+    : createHostOpsPollHandlers(jobId, pollContext);
+  try {
+    return await pollHostOpsJobUntilTerminal(auth, jobId, pollUi, json);
+  } finally {
+    pollUi.finish();
   }
-  throw new Error(`Timed out waiting for host-ops job ${jobId}`);
 }
 
 /**
@@ -135,13 +109,26 @@ async function runHostOpsJob(type, params, options = {}) {
     { type, params },
     auth.serverCaPem || undefined
   );
+  const waitOpts = buildHostOpsWaitOpts(type, params, options);
+  if (options.wait === false) {
+    if (options.json) {
+      logger.log(JSON.stringify({ jobId, status: 'pending', type }, null, 2));
+    } else {
+      const action = buildHostOpsActionLabel(type, waitOpts.targetLabel);
+      logger.log(formatSuccessLine(`${action} queued (job ${jobId}).`));
+    }
+    return { jobId, status: 'pending' };
+  }
   if (options.json) {
-    const job = await waitForHostOpsJob(auth, jobId, { wait: options.wait !== false, json: true });
+    const job = await waitForHostOpsJob(auth, jobId, waitOpts);
+    assertHostOpsJobSucceeded(job);
     logger.log(JSON.stringify(job, null, 2));
     return job;
   }
-  const job = await waitForHostOpsJob(auth, jobId, { wait: options.wait !== false, json: false });
-  logger.log(formatSuccessLine(`Host-ops job ${jobId} completed (${type}).`));
+  const job = await waitForHostOpsJob(auth, jobId, waitOpts);
+  assertHostOpsJobSucceeded(job);
+  const action = buildHostOpsActionLabel(type, waitOpts.targetLabel);
+  logger.log(formatSuccessLine(`${action} completed.`));
   return job;
 }
 
@@ -161,6 +148,63 @@ async function handlePlatformUpdate(developerId, options) {
   await runHostOpsJob('update-dev-platform', params, options);
 }
 
+function logPlatformInstallOutcomes(developerId, job, json) {
+  if (json) {
+    logger.log(JSON.stringify(job, null, 2));
+    return;
+  }
+  if (!Array.isArray(job.outcomes)) {
+    return;
+  }
+  job.outcomes.forEach((row) => {
+    logger.log(`  ${row.linuxUser || developerId}: ${row.overall || row.status}${row.detail ? ` — ${row.detail}` : ''}`);
+  });
+}
+
+async function runPlatformInstallPreflight(auth, params) {
+  const { jobId } = await hostOpsApi.preflightHostOps(
+    auth.serverUrl,
+    auth.clientCertPem,
+    { type: 'install-dev-platform', params },
+    auth.serverCaPem || undefined
+  );
+  return waitForHostOpsJob(auth, jobId, buildHostOpsWaitOpts('install-dev-platform', params, {}));
+}
+
+async function handlePlatformInstallCheck(developerId, params, options) {
+  const auth = await getRemoteDevAuth();
+  if (!auth) throw new Error(REMOTE_NOT_CONFIGURED_MSG);
+  params.check = true;
+  const { jobId } = await hostOpsApi.preflightHostOps(
+    auth.serverUrl,
+    auth.clientCertPem,
+    { type: 'install-dev-platform', params },
+    auth.serverCaPem || undefined
+  );
+  const job = await waitForHostOpsJob(auth, jobId, buildHostOpsWaitOpts('install-dev-platform', params, options));
+  logPlatformInstallOutcomes(developerId, job, options.json);
+  assertHostOpsJobSucceeded(job);
+  return job;
+}
+
+async function confirmPlatformReinstall(developerId, params, options) {
+  const auth = await getRemoteDevAuth();
+  if (!auth) throw new Error(REMOTE_NOT_CONFIGURED_MSG);
+  const preflight = await runPlatformInstallPreflight(auth, { ...params, developerId });
+  if (!platformAlreadyInstalled(preflight.outcomes)) {
+    return null;
+  }
+  const ok = await promptYesNo(
+    `Platform already installed for dev${String(developerId).padStart(2, '0')}. Re-install?`
+  );
+  if (!ok) {
+    logger.log(chalk.gray('Cancelled.'));
+    return preflight;
+  }
+  await runHostOpsJob('reinstall-dev-platform', params, options);
+  return undefined;
+}
+
 async function handlePlatformInstall(developerId, options) {
   if (!developerId) {
     throw new Error('Developer ID is required (positional argument).');
@@ -168,46 +212,13 @@ async function handlePlatformInstall(developerId, options) {
   const params = buildJobParams(options, developerId);
 
   if (options.check) {
-    params.check = true;
-    const auth = await getRemoteDevAuth();
-    if (!auth) throw new Error(REMOTE_NOT_CONFIGURED_MSG);
-    const { jobId } = await hostOpsApi.preflightHostOps(
-      auth.serverUrl,
-      auth.clientCertPem,
-      { type: 'install-dev-platform', params },
-      auth.serverCaPem || undefined
-    );
-    const job = await waitForHostOpsJob(auth, jobId, options);
-    if (options.json) {
-      logger.log(JSON.stringify(job, null, 2));
-    } else if (Array.isArray(job.outcomes)) {
-      job.outcomes.forEach((row) => {
-        logger.log(`  ${row.linuxUser || developerId}: ${row.overall || row.status}${row.detail ? ` — ${row.detail}` : ''}`);
-      });
-    }
-    return job;
+    return handlePlatformInstallCheck(developerId, params, options);
   }
 
   if (!options.force && !options.yes) {
-    const auth = await getRemoteDevAuth();
-    if (!auth) throw new Error(REMOTE_NOT_CONFIGURED_MSG);
-    const { jobId } = await hostOpsApi.preflightHostOps(
-      auth.serverUrl,
-      auth.clientCertPem,
-      { type: 'install-dev-platform', params: { ...params, developerId } },
-      auth.serverCaPem || undefined
-    );
-    const preflight = await waitForHostOpsJob(auth, jobId, { ...options, json: false });
-    if (platformAlreadyInstalled(preflight.outcomes)) {
-      const ok = await promptYesNo(
-        `Platform already installed for dev${String(developerId).padStart(2, '0')}. Re-install?`
-      );
-      if (!ok) {
-        logger.log(chalk.gray('Cancelled.'));
-        return preflight;
-      }
-      await runHostOpsJob('reinstall-dev-platform', params, options);
-      return;
+    const cancelled = await confirmPlatformReinstall(developerId, params, options);
+    if (cancelled) {
+      return cancelled;
     }
   }
 
@@ -230,7 +241,9 @@ async function handleRemoveDevUser(developerId, options) {
 
 module.exports = {
   buildJobParams,
+  buildHostOpsWaitOpts,
   waitForHostOpsJob,
+  runHostOpsJob,
   handlePlatformInstallCli,
   handlePlatformUpdate,
   handlePlatformInstall,

package/lib/commands/dev-init.js

@@ -14,10 +14,6 @@ const { getConfigDirForPaths } = require('../utils/paths');
 const {
   generateCSR,
   getCertDir,
-  readClientCertPem,
-  readClientKeyPem,
-  readServerCaPem,
-  getCertValidNotAfter,
   normalizePemNewlines,
   mergeCaPemBlocks
 } = require('../utils/dev-cert-helper');
@@ -35,7 +31,6 @@ const {
 const { runOptionalHostsSetup } = require('../utils/dev-hosts-helper');
 const { mergeDevSshConfigAfterInit } = require('../utils/dev-init-ssh-merge');
 const { resolveInitOptions } = require('../utils/dev-init-resolve');
-const { displayDevConfig } = require('./dev-show-display');
 const {
   isHealthHttpServerError,
   formatEnsureServerTrustedFailure
@@ -383,104 +378,9 @@ async function runDevInit(options) {
   logOnboardingFinished(sshInfo);
 }
 
-/** Days before cert expiry at which we auto-refresh on dev refresh. */
-const CERT_REFRESH_DAYS = 14;
-
-/**
- * True if the cert in certDir expires within CERT_REFRESH_DAYS (or we cannot read expiry).
- * @param {string} certDir - Certificate directory
- * @returns {boolean}
- */
-function shouldRefreshDevCert(certDir) {
-  const validNotAfter = getCertValidNotAfter(certDir);
-  if (!validNotAfter) return true;
-  const now = Date.now();
-  const threshold = now + CERT_REFRESH_DAYS * 24 * 60 * 60 * 1000;
-  return validNotAfter.getTime() < threshold;
-}
-
-/**
- * Refresh developer certificate: create PIN (with current cert), issue new cert, save and apply settings.
- * @param {{ serverUrl: string, clientCertPem: string, serverCaPem?: string|null }} auth - Current auth from getRemoteDevAuth
- * @returns {Promise<void>}
- */
-async function runCertificateRefresh(auth) {
-  const devId = await config.getDeveloperId();
-  if (!devId) throw new Error('developer-id not set in config.');
-  const configDir = getConfigDirForPaths();
-  const serverCaPem = auth.serverCaPem || undefined;
-  logger.log(chalk.blue('\n🔄 Refreshing certificate (create PIN + issue-cert)...\n'));
-  const pinRes = await devApi.createPin(auth.serverUrl, auth.clientCertPem, devId, serverCaPem);
-  const pin = pinRes.pin;
-  if (!pin || typeof pin !== 'string') throw new Error('Server did not return a PIN.');
-  logger.log(chalk.gray('  Generating new certificate request...'));
-  const { csrPem, keyPem } = generateCSR(devId);
-  logger.log(chalk.gray('  Requesting new certificate (issue-cert)...'));
-  const issueResponse = await requestCertificate(auth.serverUrl, devId, pin, csrPem, serverCaPem);
-  const caPem = mergeCaPemBlocks(serverCaPem, issueResponse.caCertificate, issueResponse.ca);
-  await saveCertAndConfig(configDir, devId, issueResponse.certificate, keyPem, caPem);
-  await applySettingsFromServer(auth.serverUrl, devId, issueResponse, keyPem, serverCaPem);
-  await augmentAndSaveCaPemForRemoteDocker(configDir, devId, caPem, {
-    settings: issueResponse.settings,
-    remoteServerUrl: auth.serverUrl,
-    warn: (msg) => logger.log(chalk.yellow(`  ⚠ ${msg}`))
-  });
-  logger.log(formatSuccessLine('Certificate refreshed and config updated from server.\n'));
-}
-
-/**
- * GET /api/dev/settings and merge into local config (used by dev refresh when cert is still valid).
- * @param {{ serverUrl: string, serverCaPem?: string|null }} auth
- * @param {string} clientCertPem
- * @param {string|null|undefined} clientKeyPem
- * @param {string} devId
- * @returns {Promise<void>}
- */
-async function fetchAndMergeRemoteSettings(auth, clientCertPem, clientKeyPem, devId) {
-  logger.log(chalk.blue('\n🔄 Fetching settings from Builder Server...\n'));
-  const settings = await devApi.getSettings(
-    auth.serverUrl,
-    clientCertPem,
-    clientKeyPem || undefined,
-    auth.serverCaPem || undefined
-  );
-  await config.mergeRemoteSettings(settings);
-  const existingCa = readServerCaPem(getCertDir(getConfigDirForPaths(), devId));
-  await augmentAndSaveCaPemForRemoteDocker(getConfigDirForPaths(), devId, existingCa, {
-    settings,
-    remoteServerUrl: auth.serverUrl,
-    warn: (msg) => logger.log(chalk.yellow(`  ⚠ ${msg}`))
-  });
-  logger.log(formatSuccessLine('Config updated from server.\n'));
-  await displayDevConfig(devId);
-}
-
-/**
- * Fetch settings from Builder Server and merge into config (GET /api/dev/settings).
- * If certificate expires within CERT_REFRESH_DAYS (or --cert), refresh cert first (create PIN + issue-cert).
- * @param {Object} [options] - Commander options; options.cert = true forces cert refresh
- * @returns {Promise<void>}
- * @throws {Error} If remote server or certificate not configured, or getSettings fails
- */
-async function runDevRefresh(options = {}) {
-  const { getRemoteDevAuth } = require('../utils/remote-dev-auth');
-  const auth = await getRemoteDevAuth();
-  if (!auth) {
-    throw new Error('Remote server is not configured. Set remote-server and run "aifabrix dev init" first.');
-  }
-  const devId = await config.getDeveloperId();
-  const certDir = getCertDir(getConfigDirForPaths(), devId);
-  const clientCertPem = readClientCertPem(certDir);
-  const clientKeyPem = readClientKeyPem(certDir);
-  if (!clientCertPem) {
-    throw new Error('Client certificate not found. Run "aifabrix dev init" first.');
-  }
-  if (Boolean(options.cert) || shouldRefreshDevCert(certDir)) {
-    await runCertificateRefresh(auth);
-    await displayDevConfig(devId);
-    return;
-  }
-  await fetchAndMergeRemoteSettings(auth, clientCertPem, clientKeyPem, devId);
-}
-
-module.exports = { runDevInit, runDevRefresh };
+module.exports = {
+  runDevInit,
+  requestCertificate,
+  saveCertAndConfig,
+  applySettingsFromServer
+};

package/lib/commands/dev-refresh.js

@@ -0,0 +1,197 @@
+/**
+ * @fileoverview aifabrix dev refresh – sync remote settings and renew client cert when due
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const config = require('../core/config');
+const { getConfigDirForPaths } = require('../utils/paths');
+const {
+  generateCSR,
+  getCertDir,
+  readClientCertPem,
+  readClientKeyPem,
+  readServerCaPem,
+  getCertValidNotAfter,
+  mergeCaPemBlocks
+} = require('../utils/dev-cert-helper');
+const devApi = require('../api/dev.api');
+const logger = require('../utils/logger');
+const { mergeDevSshConfigAfterInit, logDevSshConnectHint } = require('../utils/dev-init-ssh-merge');
+const { displayDevConfig } = require('./dev-show-display');
+const { augmentAndSaveCaPemForRemoteDocker } = require('../utils/dev-ca-docker-augment');
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+const {
+  requestCertificate,
+  saveCertAndConfig,
+  applySettingsFromServer
+} = require('./dev-init');
+
+/** Days before cert expiry at which we auto-refresh on dev refresh / auto-renew. */
+const CERT_REFRESH_DAYS = 14;
+
+/**
+ * True if the cert expires within CERT_REFRESH_DAYS (or expiry cannot be read).
+ * Used by explicit `dev refresh` (also attempts when expiry is unknown).
+ * @param {string} certDir
+ * @returns {boolean}
+ */
+function shouldRefreshDevCert(certDir) {
+  const validNotAfter = getCertValidNotAfter(certDir);
+  if (!validNotAfter) return true;
+  const now = Date.now();
+  const threshold = now + CERT_REFRESH_DAYS * 24 * 60 * 60 * 1000;
+  return validNotAfter.getTime() < threshold;
+}
+
+/**
+ * True when cert is still valid but expires within CERT_REFRESH_DAYS.
+ * Used for automatic renew (never tries when already expired).
+ * @param {string} certDir
+ * @returns {boolean}
+ */
+function isDevCertAutoRenewalDue(certDir) {
+  const validNotAfter = getCertValidNotAfter(certDir);
+  if (!validNotAfter) return false;
+  const now = Date.now();
+  if (validNotAfter.getTime() <= now) return false;
+  const threshold = now + CERT_REFRESH_DAYS * 24 * 60 * 60 * 1000;
+  return validNotAfter.getTime() < threshold;
+}
+
+/**
+ * Refresh developer certificate: create PIN (with current cert), issue new cert, save and apply settings.
+ * @param {{ serverUrl: string, clientCertPem: string, serverCaPem?: string|null }} auth
+ * @returns {Promise<void>}
+ */
+async function runCertificateRefresh(auth) {
+  const devId = await config.getDeveloperId();
+  if (!devId) throw new Error('developer-id not set in config.');
+  const configDir = getConfigDirForPaths();
+  const serverCaPem = auth.serverCaPem || undefined;
+  logger.log(chalk.blue('\n🔄 Refreshing certificate (create PIN + issue-cert)...\n'));
+  const pinRes = await devApi.createPin(auth.serverUrl, auth.clientCertPem, devId, serverCaPem);
+  const pin = pinRes.pin;
+  if (!pin || typeof pin !== 'string') throw new Error('Server did not return a PIN.');
+  logger.log(chalk.gray('  Generating new certificate request...'));
+  const { csrPem, keyPem } = generateCSR(devId);
+  logger.log(chalk.gray('  Requesting new certificate (issue-cert)...'));
+  const issueResponse = await requestCertificate(auth.serverUrl, devId, pin, csrPem, serverCaPem);
+  const caPem = mergeCaPemBlocks(serverCaPem, issueResponse.caCertificate, issueResponse.ca);
+  await saveCertAndConfig(configDir, devId, issueResponse.certificate, keyPem, caPem);
+  await applySettingsFromServer(auth.serverUrl, devId, issueResponse, keyPem, serverCaPem);
+  await augmentAndSaveCaPemForRemoteDocker(configDir, devId, caPem, {
+    settings: issueResponse.settings,
+    remoteServerUrl: auth.serverUrl,
+    warn: (msg) => logger.log(chalk.yellow(`  ⚠ ${msg}`))
+  });
+  logger.log(formatSuccessLine('Certificate refreshed and config updated from server.\n'));
+  logDevSshConnectHint(await mergeDevSshConfigAfterInit(auth.serverUrl, devId));
+}
+
+/**
+ * GET /api/dev/settings and merge into local config (when cert is still valid).
+ * @param {{ serverUrl: string, serverCaPem?: string|null }} auth
+ * @param {string} clientCertPem
+ * @param {string|null|undefined} clientKeyPem
+ * @param {string} devId
+ * @returns {Promise<void>}
+ */
+async function fetchAndMergeRemoteSettings(auth, clientCertPem, clientKeyPem, devId) {
+  logger.log(chalk.blue('\n🔄 Fetching settings from Builder Server...\n'));
+  const settings = await devApi.getSettings(
+    auth.serverUrl,
+    clientCertPem,
+    clientKeyPem || undefined,
+    auth.serverCaPem || undefined
+  );
+  await config.mergeRemoteSettings(settings);
+  const existingCa = readServerCaPem(getCertDir(getConfigDirForPaths(), devId));
+  await augmentAndSaveCaPemForRemoteDocker(getConfigDirForPaths(), devId, existingCa, {
+    settings,
+    remoteServerUrl: auth.serverUrl,
+    warn: (msg) => logger.log(chalk.yellow(`  ⚠ ${msg}`))
+  });
+  logger.log(formatSuccessLine('Config updated from server.\n'));
+  await displayDevConfig(devId);
+}
+
+/**
+ * Fetch settings from Builder Server and merge into config.
+ * If certificate expires within CERT_REFRESH_DAYS (or --cert), refresh cert first.
+ * @param {Object} [options] - Commander options; options.cert = true forces cert refresh
+ * @returns {Promise<void>}
+ */
+async function runDevRefresh(options = {}) {
+  const { readRemoteDevAuth } = require('../utils/remote-dev-auth');
+  const auth = await readRemoteDevAuth();
+  if (!auth) {
+    throw new Error('Remote server is not configured. Set remote-server and run "aifabrix dev init" first.');
+  }
+  const devId = await config.getDeveloperId();
+  const certDir = getCertDir(getConfigDirForPaths(), devId);
+  const clientCertPem = readClientCertPem(certDir);
+  const clientKeyPem = readClientKeyPem(certDir);
+  if (!clientCertPem) {
+    throw new Error('Client certificate not found. Run "aifabrix dev init" first.');
+  }
+  if (Boolean(options.cert) || shouldRefreshDevCert(certDir)) {
+    await runCertificateRefresh(auth);
+    await displayDevConfig(devId);
+    return;
+  }
+  await fetchAndMergeRemoteSettings(auth, clientCertPem, clientKeyPem, devId);
+  logDevSshConnectHint(await mergeDevSshConfigAfterInit(auth.serverUrl, devId));
+}
+
+/**
+ * Automatically renew the developer client certificate when still valid but due within
+ * CERT_REFRESH_DAYS. Safe for any cert-using command: no-op when not due / offline.
+ * Uses readRemoteDevAuth (not getRemoteDevAuth) to avoid recursion with auto-renew.
+ * Does not display config (caller shows status afterward).
+ *
+ * @param {{ quiet?: boolean }} [opts] - quiet=true suppresses failure warnings
+ * @returns {Promise<{ refreshed: boolean, reason?: string, error?: Error }>}
+ */
+async function ensureDevCertFreshIfDue(opts = {}) {
+  const quiet = opts.quiet === true;
+  const { readRemoteDevAuth } = require('../utils/remote-dev-auth');
+  const auth = await readRemoteDevAuth();
+  if (!auth) {
+    return { refreshed: false, reason: 'no-remote-auth' };
+  }
+  const devId = await config.getDeveloperId();
+  if (!devId) {
+    return { refreshed: false, reason: 'no-developer-id' };
+  }
+  const certDir = getCertDir(getConfigDirForPaths(), devId);
+  if (!readClientCertPem(certDir)) {
+    return { refreshed: false, reason: 'no-cert' };
+  }
+  if (!isDevCertAutoRenewalDue(certDir)) {
+    return { refreshed: false, reason: 'not-due' };
+  }
+  try {
+    await runCertificateRefresh(auth);
+    return { refreshed: true };
+  } catch (error) {
+    if (!quiet) {
+      logger.warn(
+        chalk.yellow(`Could not auto-refresh developer certificate: ${error.message}`)
+      );
+      logger.warn(chalk.gray('  Run: aifabrix dev refresh --cert'));
+    }
+    return { refreshed: false, reason: 'refresh-failed', error };
+  }
+}
+
+module.exports = {
+  runDevRefresh,
+  ensureDevCertFreshIfDue,
+  isDevCertAutoRenewalDue,
+  shouldRefreshDevCert,
+  CERT_REFRESH_DAYS
+};