@aifabrix/builder 2.44.6 → 2.45.5

package/lib/app/register.js

@@ -94,19 +94,20 @@ async function saveLocalCredentials(responseData, apiUrl) {
     await saveLocalSecret(clientIdKey, responseData.credentials.clientId);
     await saveLocalSecret(clientSecretKey, responseData.credentials.clientSecret);
 
-    // Update env.template
+    // Update env.template (kv:// refs only; no resolved values touch disk)
     await updateEnvTemplate(registeredAppKey, clientIdKey, clientSecretKey, apiUrl);
 
-    // Regenerate .env file with updated credentials
+    // Resolve in-memory so any missing-secret / kv:// error surfaces here, but never
+    // materialize <appPath>/.env or envOutputPath — that is only done by `aifabrix resolve`.
     try {
-      await generateEnvFile(registeredAppKey, null, 'local', true);
-      logger.log(formatSuccessLine('.env file updated with new credentials'));
+      await generateEnvFile(registeredAppKey, null, 'local', true, { noWrite: true });
     } catch (error) {
-      logger.warn(chalk.yellow(`⚠  Could not regenerate .env file: ${error.message}`));
+      logger.warn(chalk.yellow(`⚠  Could not validate env resolution: ${error.message}`));
     }
 
     logger.log(formatSuccessParagraph('Credentials saved to ~/.aifabrix/secrets.local.yaml'));
-    logger.log(formatSuccessLine('env.template updated with MISO_CLIENTID, MISO_CLIENTSECRET, and MISO_CONTROLLER_URL\n'));
+    logger.log(formatSuccessLine('env.template updated with MISO_CLIENTID, MISO_CLIENTSECRET, and MISO_CONTROLLER_URL'));
+    logger.log(formatSuccessLine('Run "aifabrix resolve ' + registeredAppKey + '" to materialize an on-disk .env\n'));
   } catch (error) {
     logger.warn(chalk.yellow(`⚠  Could not save credentials locally: ${error.message}`));
   }

package/lib/app/restart-display.js

@@ -13,6 +13,7 @@ const config = require('../core/config');
 const { execWithDockerEnv } = require('../utils/docker-exec');
 const { sectionTitle, headerKeyValue, metadata } = require('../utils/cli-test-layout-chalk');
 const { isReloadBindMountOnEngineHost } = require('../utils/docker-reload-mount');
+const { isApplicationsReloadDefaultOn } = require('../utils/applications-config-defaults');
 
 /**
  * @param {unknown} mounts - docker inspect .Mounts
@@ -54,42 +55,72 @@ async function fetchContainerMountsJson(containerName) {
   }
 }
 
+/**
+ * Log saved reload default for the app (same source as `aifabrix run` dev persist / `aifabrix show`).
+ * @param {string|null|undefined} appName - Application key (e.g. miso-controller)
+ * @returns {Promise<void>}
+ */
+async function logReloadConfigSummaryForRestart(appName) {
+  if (!appName || typeof appName !== 'string') {
+    return;
+  }
+  const userCfg = await config.getConfig();
+  const reloadOn = isApplicationsReloadDefaultOn(userCfg, appName);
+  logger.log('');
+  logger.log(sectionTitle('Reload (config)'));
+  logger.log(
+    headerKeyValue(
+      'Next dev run:',
+      reloadOn ? 'reload on (applications.<app>.reload in config)' : 'reload off'
+    )
+  );
+  logger.log(
+    metadata(
+      'Persisted when you last ran this app in dev with or without --reload. Use aifabrix show <app> to inspect.'
+    )
+  );
+  logger.log('');
+}
+
 /**
  * Log workspace transport after a successful container restart (mounts unchanged).
  * @param {string} containerName - Docker container name
+ * @param {string|null} [appName] - Application key; when set, logs reload default from config after mount info
  * @returns {Promise<void>}
  */
-async function logRestartDevMountSummary(containerName) {
+async function logRestartDevMountSummary(containerName, appName = null) {
   if (!containerName || typeof containerName !== 'string') {
+    await logReloadConfigSummaryForRestart(appName);
     return;
   }
   const mounts = await fetchContainerMountsJson(containerName);
   const appBind = findAppBindMount(mounts);
-  if (!appBind) {
-    return;
-  }
-  const endpoint = await config.getDockerEndpoint();
-  const localEngine = isReloadBindMountOnEngineHost(endpoint);
+  if (appBind) {
+    const endpoint = await config.getDockerEndpoint();
+    const localEngine = isReloadBindMountOnEngineHost(endpoint);
 
-  logger.log('');
-  logger.log(sectionTitle('Dev workspace (unchanged by restart)'));
-  if (localEngine) {
-    logger.log(headerKeyValue('Transport:', 'Direct bind mount on the Docker host (no Mutagen).'));
-    logger.log(headerKeyValue('Host path → container:', `${appBind.Source} → /app`));
-    logger.log(metadata('Edits under the host path are visible inside the container immediately.'));
-  } else {
-    logger.log(
-      headerKeyValue(
-        'Transport:',
-        'Bind mount on the Docker engine (see path below; Mutagen may sync to this path when using --reload).'
-      )
-    );
-    logger.log(headerKeyValue('Engine path → container:', `${appBind.Source} → /app`));
+    logger.log('');
+    logger.log(sectionTitle('Dev workspace (unchanged by restart)'));
+    if (localEngine) {
+      logger.log(headerKeyValue('Transport:', 'Direct bind mount on the Docker host (no Mutagen).'));
+      logger.log(headerKeyValue('Host path → container:', `${appBind.Source} → /app`));
+      logger.log(metadata('Edits under the host path are visible inside the container immediately.'));
+    } else {
+      logger.log(
+        headerKeyValue(
+          'Transport:',
+          'Bind mount on the Docker engine (see path below; Mutagen may sync to this path when using --reload).'
+        )
+      );
+      logger.log(headerKeyValue('Engine path → container:', `${appBind.Source} → /app`));
+    }
+    logger.log('');
   }
-  logger.log('');
+  await logReloadConfigSummaryForRestart(appName);
 }
 
 module.exports = {
   findAppBindMount,
+  logReloadConfigSummaryForRestart,
   logRestartDevMountSummary
 };

package/lib/app/rotate-secret.js

@@ -281,20 +281,21 @@ async function saveCredentialsLocally(appKey, credentials, actualControllerUrl)
     await saveLocalSecret(clientIdKey, credentials.clientId);
     await saveLocalSecret(clientSecretKey, credentials.clientSecret);
 
-    // Update env.template if localhost
+    // Update env.template if localhost (kv:// refs only; no resolved values touch disk)
     if (isLocalhost(actualControllerUrl)) {
       await updateEnvTemplate(appKey, clientIdKey, clientSecretKey, actualControllerUrl);
 
-      // Regenerate .env file with updated credentials
+      // Resolve in-memory so any missing-secret / kv:// error surfaces here, but never
+      // materialize <appPath>/.env or envOutputPath — that is only done by `aifabrix resolve`.
       try {
-        await generateEnvFile(appKey, null, 'local', true);
-        logger.log(formatSuccessLine('.env file updated with new credentials'));
+        await generateEnvFile(appKey, null, 'local', true, { noWrite: true });
       } catch (error) {
-        logger.warn(chalk.yellow(`⚠  Could not regenerate .env file: ${error.message}`));
+        logger.warn(chalk.yellow(`⚠  Could not validate env resolution: ${error.message}`));
       }
 
       logger.log(formatSuccessParagraph('Credentials saved to ~/.aifabrix/secrets.local.yaml'));
-      logger.log(formatSuccessLine('env.template updated with MISO_CLIENTID, MISO_CLIENTSECRET, and MISO_CONTROLLER_URL\n'));
+      logger.log(formatSuccessLine('env.template updated with MISO_CLIENTID, MISO_CLIENTSECRET, and MISO_CONTROLLER_URL'));
+      logger.log(formatSuccessLine('Run "aifabrix resolve ' + appKey + '" to materialize an on-disk .env\n'));
     } else {
       logger.log(formatSuccessParagraph('Credentials saved to ~/.aifabrix/secrets.local.yaml\n'));
     }

package/lib/app/run-helpers.js

@@ -38,6 +38,7 @@ const { resolveEnvOutputPath, writeEnvOutputForReload, writeEnvOutputForLocal }
 const { resolveVersionForApp } = require('../utils/image-version');
 const healthCheckUtil = require('../utils/health-check');
 const { computeTraefikPublicAppUrl } = require('../utils/health-check-url');
+const { isFrontDoorRoutingEnabledInDoc } = require('../utils/url-declarative-vdir-inactive-env');
 
 /** Template apps (keycloak, miso-controller, dataplane) - never update application config when running */
 const TEMPLATE_APP_KEYS = ['keycloak', 'miso-controller', 'dataplane'];
@@ -72,7 +73,7 @@ function checkBuilderDirectory(appName) {
 
 /**
  * Load and validate config file exists
- * Uses paths.getBuilderPath so AIFABRIX_BUILDER_DIR (e.g. from up-miso) is respected.
+ * Uses paths.getBuilderPath (cwd / material `builder/` only; no `AIFABRIX_BUILDER_DIR` override).
  * @param {string} appName - Application name
  * @returns {Object} Application configuration
  * @throws {Error} If config file not found
@@ -299,12 +300,15 @@ async function generateComposeFile(appName, appConfig, composeOptions, devDir) {
 }
 
 /**
- * Writes .env to envOutputPath when application.yaml build.envOutputPath is set.
+ * Writes `build.envOutputPath` after each `aifabrix run`: **local**-flavored env for the host/IDE
+ * when not using `--reload`; with **`--reload`**, merges container `.env.run` into the existing file
+ * (preserves resolve comments) without appending run-only keys missing from the template.
+ *
  * @async
  * @param {string} appName - Application name
  * @param {Object} appConfig - Application configuration
- * @param {string} runEnvPath - Path to .env.run
- * @param {Object} options - Run options (reload flag)
+ * @param {string} runEnvPath - Path to `.env.run`
+ * @param {Object} options - Run options (`reload`, `skipEnvOutputPath`)
  */
 async function writeEnvOutputIfConfigured(appName, appConfig, runEnvPath, options) {
   if (options && options.skipEnvOutputPath === true) return;
@@ -318,8 +322,8 @@ async function writeEnvOutputIfConfigured(appName, appConfig, runEnvPath, option
   if (!fsSync.existsSync(outputDir)) {
     await fs.mkdir(outputDir, { recursive: true });
   }
-  if (options.reload) {
-    await writeEnvOutputForReload(outputPath, runEnvPath);
+  if (options && options.reload === true) {
+    await writeEnvOutputForReload(outputPath, runEnvPath, appName);
   } else {
     await writeEnvOutputForLocal(appName, outputPath);
   }
@@ -362,7 +366,8 @@ async function prepareEnvironment(appName, appConfig, options) {
     envFilePath: runEnvPath,
     dbInitEnvFilePath: runEnvAdminPath,
     effectiveEnvironmentScopedResources,
-    env: runEnvKey
+    env: runEnvKey,
+    omitAppTraefikLabels: userCfg.traefik === false
   };
   composeOptions.port = calculateComposePort(composeOptions, appConfig, developerId);
   const composePath = await generateComposeFile(appName, appConfig, composeOptions, devDir);
@@ -383,7 +388,9 @@ async function prepareEnvironment(appName, appConfig, options) {
 async function displayRunStatus(appName, port, appConfig, runScopeOpts = null, runOptions = {}) {
   const containerName = containerHelpers.getContainerName(appName, appConfig.developerId, runScopeOpts);
   const ro = runOptions && typeof runOptions === 'object' ? runOptions : {};
-  const wantsPublic = Boolean(ro.probeViaTraefik === true || ro.traefikEnabled === true);
+  const frontDoorOn = isFrontDoorRoutingEnabledInDoc(appConfig);
+  const wantsPublic =
+    frontDoorOn && Boolean(ro.probeViaTraefik === true || ro.traefikEnabled === true);
 
   let primaryAppUrl = `http://localhost:${port}`;
   if (wantsPublic) {

package/lib/app/run.js

@@ -28,6 +28,7 @@ const helpers = require('./run-helpers');
 const { ensureReloadSync, logReloadDevSummary } = require('./run-reload-sync');
 const { logRestartDevMountSummary } = require('./restart-display');
 const { execWithDockerEnv } = require('../utils/docker-exec');
+const { isRunCliNoProxy } = require('../utils/run-cli-flags');
 
 /**
  * True if host is localhost or 127.0.0.1 (case-insensitive).
@@ -68,7 +69,7 @@ function isLocalhostEndpoint(urlOrEndpoint) {
  * @async
  * @param {string} appName - Application name
  * @param {boolean} _debug - Debug flag (unused)
- * @returns {Promise<boolean>} True if should continue, false if external system
+ * @returns {Promise<boolean>} True if run should continue, false if app is integration-scoped or external (not a runnable container app)
  * @throws {Error} If app name is invalid
  */
 async function validateAppForRun(appName, _debug) {
@@ -88,9 +89,16 @@ async function validateAppForRun(appName, _debug) {
         formatWarningLine('External integrations are not started as local Docker containers.')
       );
       logger.log(
-        metadata('Build and deploy the integration, then use its APIs from your environment.')
+        metadata(
+          'Publish config to the dataplane (upload) or through the controller (deploy), then use the integration APIs from your environment.'
+        )
+      );
+      logger.log(
+        formatNextActions([
+          `aifabrix upload ${appName}`,
+          `aifabrix deploy ${appName}`
+        ])
       );
-      logger.log(formatNextActions([`aifabrix build ${appName}`]));
       return false;
     }
   } catch (error) {
@@ -263,12 +271,12 @@ async function resolveRunOptions(appName, appConfig, options, envKey, debug, eff
 }
 
 /**
- * When Traefik is enabled in user config, pass through for health checks (DNS + localhost order).
+ * When Traefik is enabled in user config and this run should use proxy hints (`runOptions.noProxy` is false), enable Traefik/DNS URL hints.
  * @param {Object} runOptions
  * @param {Object} userCfg
  */
 function applyTraefikFlagToRunOptions(runOptions, userCfg) {
-  if (userCfg && userCfg.traefik === true) {
+  if (userCfg && userCfg.traefik === true && !runOptions.noProxy) {
     runOptions.traefikEnabled = true;
   }
 }
@@ -335,10 +343,28 @@ async function computeRunPreparationCore(appName, appConfig, options, envKey, us
   return result;
 }
 
+/**
+ * Gray **Manifest:** line before container start (skipped when orchestration already emitted).
+ * @param {string} appName
+ * @param {Object} options
+ * @returns {void}
+ */
+function emitRunManifestMetadataIfRequested(appName, options) {
+  if (options.skipManifestMetadataLine === true) return;
+  const { emitManifestMetadataLineIfTTY } = require('../utils/manifest-source-emit');
+  emitManifestMetadataLineIfTTY(logger, {
+    appKey: appName,
+    appPath: pathsUtil.getBuilderPath(appName),
+    envOnly: false,
+    json: false
+  });
+}
+
 /**
  * Prepare run: validate app, load config, check prereqs, stop existing container, resolve port and reload, prepare env.
  * @param {string} appName - Application name
  * @param {Object} options - Run options
+ * @param {boolean} [options.skipManifestMetadataLine] - When true, skip gray **Manifest:** line (caller already emitted for platform orchestration)
  * @param {boolean} debug - Debug flag
  * @returns {Promise<{ appConfig: Object, tempComposePath: string, hostPort: number }|null>} Prepared run context or null if should not continue
  */
@@ -349,12 +375,25 @@ async function prepareAppRun(appName, options, debug) {
   if (!shouldContinue) {
     return null;
   }
+  let userCfg = await config.getConfig();
+  const appsDefaults = require('../utils/applications-config-defaults');
+  await appsDefaults.persistApplicationRunProxyFlag(appName, !isRunCliNoProxy(options));
+  if (envKey === 'dev') {
+    await appsDefaults.persistApplicationReloadFlag(appName, options.reload === true);
+  }
+  userCfg = await config.getConfig();
+  const savedProxyHint = appsDefaults.getApplicationsRunProxyHint(userCfg, appName);
+  const mergedOpts = {
+    ...options,
+    reload: options.reload === true,
+    noProxy: isRunCliNoProxy(options) || !savedProxyHint
+  };
   logger.log('');
   logger.log(sectionTitle('Run'));
   logger.log(headerKeyValue('Application:', appName));
   const appConfig = await loadAndConfigureApp(appName, debug);
-  const userCfg = await config.getConfig();
-  return computeRunPreparationCore(appName, appConfig, options, envKey, userCfg, debug);
+  emitRunManifestMetadataIfRequested(appName, options);
+  return computeRunPreparationCore(appName, appConfig, mergedOpts, envKey, userCfg, debug);
 }
 
 /**
@@ -367,6 +406,7 @@ async function prepareAppRun(appName, options, debug) {
  * @param {Object} options - Run options
  * @param {number} [options.port] - Override local port
  * @param {boolean} [options.debug] - Enable debug output
+ * @param {boolean} [options.skipManifestMetadataLine] - When true, skip gray **Manifest:** line in prepare (orchestration already emitted)
  * @returns {Promise<void>} Resolves when app is running
  * @throws {Error} If run fails or app is not built
  *
@@ -388,7 +428,7 @@ async function runApp(appName, options = {}) {
     if (debug) {
       logger.log(chalk.gray(`[DEBUG] Compose file generated: ${prepared.tempComposePath}`));
     }
-    logReloadDevSummary(Boolean(options.reload), prepared.mergedRunOptions.reloadSyncSummary);
+    logReloadDevSummary(Boolean(prepared.mergedRunOptions.reload), prepared.mergedRunOptions.reloadSyncSummary);
     await startAppContainer(appName, prepared.tempComposePath, prepared.hostPort, prepared.appConfig, {
       debug,
       runEnvPath: prepared.runEnvPath,
@@ -422,11 +462,18 @@ async function restartApp(appName) {
   if (!appName || typeof appName !== 'string') {
     throw new Error('Application name is required and must be a string');
   }
+  const { emitManifestMetadataLineIfTTY } = require('../utils/manifest-source-emit');
+  emitManifestMetadataLineIfTTY(logger, {
+    appKey: appName,
+    appPath: pathsUtil.getBuilderPath(appName),
+    envOnly: false,
+    json: false
+  });
   const developerId = await config.getDeveloperId();
   const containerName = containerHelpers.getContainerName(appName, developerId);
   try {
     await execWithDockerEnv(`docker restart ${containerName}`);
-    await logRestartDevMountSummary(containerName);
+    await logRestartDevMountSummary(containerName, appName);
   } catch (error) {
     const msg = (error.stderr || error.stdout || error.message || '').toLowerCase();
     if (msg.includes('no such container') || msg.includes('is not running')) {
@@ -439,6 +486,7 @@ async function restartApp(appName) {
 module.exports = {
   runApp,
   restartApp,
+  validateAppForRun,
   ensureReloadSync,
   isLocalhostHost,
   isLocalhostEndpoint,

package/lib/app/show-display.js

@@ -96,6 +96,13 @@ function logApplicationSection(a, summary) {
   } else {
     logApplicationFields(a);
   }
+  if (summary.runReloadDefault && !summary.isExternal) {
+    logger.log(`  ${'Run default:'.padEnd(16)} reload on (config)`);
+  }
+  if (!summary.isExternal) {
+    const proxyOn = summary.runProxyDefault === true;
+    logger.log(`  ${'Run default:'.padEnd(16)} proxy ${proxyOn ? 'on' : 'off'} (config)`);
+  }
   /* External integration is logged after Dataplane block in display() when external */
 }
 

package/lib/app/show.js

@@ -14,7 +14,7 @@
 
 const path = require('path');
 const logger = require('../utils/logger');
-const { detectAppType, resolveApplicationConfigPath } = require('../utils/paths');
+const { detectAppType, resolveApplicationConfigPath, getBuilderPath } = require('../utils/paths');
 const { loadConfigFile } = require('../utils/config-format');
 const generator = require('../generator');
 const { getConfig, normalizeControllerUrl } = require('../core/config');
@@ -38,6 +38,58 @@ const {
   sanitizeCertificationForJson
 } = require('./certification-show-enrich');
 
+/**
+ * Attach `runReloadDefault` / `runProxyDefault` from ~/.aifabrix `applications.<appKey>`.
+ * @param {Object} summary
+ * @param {string} appKey
+ * @param {Object} userCfg
+ */
+function attachRunDefaultsFromUserConfig(summary, appKey, userCfg) {
+  const { isApplicationsReloadDefaultOn, getApplicationsRunProxyHint } = require('../utils/applications-config-defaults');
+  if (isApplicationsReloadDefaultOn(userCfg, appKey)) {
+    summary.runReloadDefault = true;
+  }
+  summary.runProxyDefault = getApplicationsRunProxyHint(userCfg, appKey);
+}
+
+/**
+ * Overlay `application.url` / `application.internalUrl` from declarative url:// rules (same profile as run `.env`, default `docker`).
+ * Used for offline and **online** show so controller metadata does not stale local proxy/TLS hints.
+ * @param {Object} summary
+ * @param {string} appKey
+ */
+async function attachDeclarativeUrlsToShowApplication(summary, appKey) {
+  if (!summary || summary.isExternal) return;
+  const t = summary.application && summary.application.type;
+  if (String(t || 'webapp').toLowerCase() === 'external') return;
+  try {
+    const { resolveDeclarativeShowUrlsForApp } = require('../core/secrets-env-declarative-expand');
+    const appPath = getBuilderPath(appKey);
+    const variablesPath = resolveApplicationConfigPath(appPath);
+    const urls = await resolveDeclarativeShowUrlsForApp(appKey, appPath, variablesPath, 'docker');
+    if (!urls) return;
+    summary.application.url = urls.publicUrl;
+    summary.application.internalUrl = urls.internalUrl;
+  } catch {
+    /* display-only */
+  }
+}
+
+/**
+ * Local manifest provenance for `--json` (plan 141); null when the app is not on disk locally.
+ * @param {string} appKey
+ * @returns {Promise<{ tier: string, tierLabel: string, configPath: string }|null>}
+ */
+async function tryGetLocalManifestSourceForJson(appKey) {
+  try {
+    const { getManifestSourcePayload } = require('../utils/manifest-source-emit');
+    const { appPath } = await detectAppType(appKey);
+    return getManifestSourcePayload(appKey, appPath);
+  } catch {
+    return { tier: 'unknown', tierLabel: 'unknown', configPath: '' };
+  }
+}
+
 /** Truncate deployment key for display */
 const DEPLOYMENT_KEY_TRUNCATE_LEN = 12;
 
@@ -651,16 +703,34 @@ async function loadOfflineShowSummary(appKey) {
   }
 }
 
+async function emitShowOfflineManifestLine(appKey, json) {
+  if (json) return;
+  try {
+    const { detectAppType } = require('../utils/paths');
+    const { emitManifestMetadataLineIfTTY } = require('../utils/manifest-source-emit');
+    const { appPath } = await detectAppType(appKey);
+    emitManifestMetadataLineIfTTY(logger, { appKey, appPath, envOnly: false, json: false });
+  } catch {
+    /* ignore */
+  }
+}
+
 async function runOffline(appKey, json, permissionsOnly, verifyCert = false) {
   const summary = await loadOfflineShowSummary(appKey);
+  await emitShowOfflineManifestLine(appKey, json);
+  const userCfg = await getConfig();
+  attachRunDefaultsFromUserConfig(summary, appKey, userCfg);
+  await attachDeclarativeUrlsToShowApplication(summary, appKey);
 
   if (json) {
+    const manifestSource = await tryGetLocalManifestSourceForJson(appKey);
     if (permissionsOnly) {
       const out = {
         source: summary.source,
         path: summary.path,
         appKey: summary.appKey,
-        permissions: summary.permissions || []
+        permissions: summary.permissions || [],
+        manifestSource
       };
       logger.log(JSON.stringify(out, null, 2));
       return;
@@ -669,6 +739,9 @@ async function runOffline(appKey, json, permissionsOnly, verifyCert = false) {
       source: summary.source,
       path: summary.path,
       appKey: summary.appKey,
+      runReloadDefault: Boolean(summary.runReloadDefault),
+      runProxyDefault: Boolean(summary.runProxyDefault),
+      manifestSource,
       application: {
         ...summary.application,
         roles: summary.roles,
@@ -717,13 +790,14 @@ async function fetchExternalSystemForOnline(controllerUrl, appKey, authConfig) {
   }
 }
 
-function outputOnlineJson(summary, permissionsOnly) {
+function outputOnlineJson(summary, permissionsOnly, manifestSource) {
   if (permissionsOnly) {
     const out = {
       source: summary.source,
       controllerUrl: summary.controllerUrl,
       appKey: summary.appKey,
-      permissions: summary.permissions || []
+      permissions: summary.permissions || [],
+      manifestSource
     };
     logger.log(JSON.stringify(out, null, 2));
     return;
@@ -733,6 +807,7 @@ function outputOnlineJson(summary, permissionsOnly) {
     source: summary.source,
     controllerUrl: summary.controllerUrl,
     appKey: summary.appKey,
+    manifestSource,
     application: {
       key: app.key,
       displayName: app.displayName,
@@ -751,6 +826,10 @@ function outputOnlineJson(summary, permissionsOnly) {
     }
   };
   if (app.version !== undefined && app.version !== null) out.application.version = app.version;
+  if (summary.runReloadDefault) {
+    out.runReloadDefault = true;
+  }
+  out.runProxyDefault = Boolean(summary.runProxyDefault);
   if (summary.externalSystem !== undefined && summary.externalSystem !== null) {
     out.externalSystem = summary.externalSystem && summary.externalSystem.error
       ? { error: summary.externalSystem.error }
@@ -787,8 +866,11 @@ async function runOnline(appKey, json, permissionsOnly, verifyCert = false) {
     token: authConfig.token,
     controllerUrl: authResult.actualControllerUrl
   });
+  attachRunDefaultsFromUserConfig(summary, appKey, await getConfig());
+  await attachDeclarativeUrlsToShowApplication(summary, appKey);
   if (json) {
-    outputOnlineJson(summary, permissionsOnly);
+    const manifestSource = await tryGetLocalManifestSourceForJson(appKey);
+    outputOnlineJson(summary, permissionsOnly, manifestSource);
     return;
   }
   displayShow(summary, { permissionsOnly: !!permissionsOnly });

package/lib/build/index.js

@@ -196,12 +196,13 @@ async function generateDockerfile(appNameOrPath, language, config, buildConfig =
 
 async function postBuildTasks(appName, buildConfig) {
   try {
-    const envPath = await secrets.generateEnvFile(appName, buildConfig.secrets, 'docker');
-    logger.log(formatSuccessLine(`Generated .env file: ${envPath}`));
-    // Note: processEnvVariables is already called by generateEnvFile to generate local .env
-    // at the envOutputPath, so we don't need to manually copy the docker .env file
+    // Validate that env.template + secrets resolve cleanly, but never write <appPath>/.env or
+    // envOutputPath. Build args still flow through resolveAndGetEnvMap (in-memory). Run
+    // `aifabrix resolve <app>` to materialize an on-disk .env.
+    await secrets.generateEnvFile(appName, buildConfig.secrets, 'docker', false, { noWrite: true });
+    logger.log(formatSuccessLine('Env resolution validated (in-memory only; run "aifabrix resolve ' + appName + '" for on-disk .env)'));
   } catch (error) {
-    logger.log(formatWarningLine(`Could not generate .env file: ${error.message}`));
+    logger.log(formatWarningLine(`Could not resolve env: ${error.message}`));
   }
 }
 
@@ -411,6 +412,9 @@ async function resolveDockerBuildArgsForApp(appName) {
  */
 async function runStandardDockerBuild(appName, options) {
   const { buildConfig } = await buildHelpers.loadAndValidateConfig(appName);
+  const { emitManifestMetadataLineIfTTY } = require('../utils/manifest-source-emit');
+  const { appPath } = await detectAppType(appName);
+  emitManifestMetadataLineIfTTY(logger, { appKey: appName, appPath, envOnly: false, json: false });
   const { devDir, effectiveImageName, imageName, appConfig } = await prepareDevDirectory(appName, buildConfig, options);
   const contextPath = prepareBuildContext(buildConfig, devDir);
   const dockerfilePath = await handleDockerfileGeneration(appName, {

package/lib/cli/index.js

@@ -22,7 +22,8 @@ const { setupExternalSystemCommands } = require('./setup-external-system');
 const { setupAppCommands: setupAppManagementCommands } = require('../commands/app');
 const { setupDatasourceCommands } = require('../commands/datasource');
 const { setupDimensionCommands } = require('../commands/dimension');
-const { setupDimensionValueCommands } = require('../commands/dimension-value');
+const { setupIdentityCommands } = require('../commands/identity');
+const { setupProtectionCommands } = require('../commands/protection');
 const { setupCredentialDeploymentCommands } = require('./setup-credential-deployment');
 const { setupIntegrationClientCommands } = require('./setup-integration-client');
 const { setupPlatformCommands } = require('./setup-platform');
@@ -39,7 +40,8 @@ function setupCommands(program) {
   setupAppManagementCommands(program);
   setupDatasourceCommands(program);
   setupDimensionCommands(program);
-  setupDimensionValueCommands(program);
+  setupIdentityCommands(program);
+  setupProtectionCommands(program);
   setupUtilityCommands(program);
   setupCredentialDeploymentCommands(program);
   setupIntegrationClientCommands(program);