@aifabrix/builder 2.46.0 → 2.47.1

package/lib/utils/paths.js

@@ -315,6 +315,30 @@ function getDevDirectory(appName, developerId) {
   return baseDir;
 }
 
+/**
+ * Target directory for `aifabrix create` — always under {@link process.cwd} (`builder/` or
+ * `integration/`) even when those folders do not exist yet. Platform system apps still
+ * materialize under {@link getAppsMaterializationParent}.
+ *
+ * Post-create lookup uses {@link getAppPath} / {@link getBuilderPath} / {@link getIntegrationPath}.
+ *
+ * @param {string} appName - Application name
+ * @param {string} [appType] - Application type (`external` or other)
+ * @returns {string} Absolute path to the new application directory
+ */
+function getAppCreatePath(appName, appType) {
+  if (!appName || typeof appName !== 'string') {
+    throw new Error('App name is required and must be a string');
+  }
+  if (appType === 'external') {
+    return path.join(path.resolve(process.cwd()), 'integration', appName);
+  }
+  if (isSystemBuilderAppName(appName)) {
+    return path.join(getAppsMaterializationParent(), 'builder', appName);
+  }
+  return path.join(path.resolve(process.cwd()), 'builder', appName);
+}
+
 /**
  * Gets the application path (builder or integration folder).
  * Matches {@link getBuilderPath} / {@link getIntegrationPath} (cwd `integration/` / `builder/`, then
@@ -881,6 +905,7 @@ module.exports = {
   getApplicationsBaseDir,
   getDevDirectory,
   getAppPath,
+  getAppCreatePath,
   getAppsMaterializationParent,
   getCwdIntegrationRoot,
   getCwdBuilderRoot,

package/lib/utils/platform-controller-url.js

@@ -18,6 +18,7 @@ const { loadConfigFile } = require('./config-format');
 const { computePublicUrlBaseString } = require('./url-declarative-public-base');
 const { joinUrlPath, normalizeFrontDoorPatternForHealth } = require('./health-check-url');
 const { getDevPorts } = require('./dev-config');
+const { flagsForSetupPlatformMode } = require('../core/setup-platform-mode');
 
 const MISO_CONTROLLER_APP = 'miso-controller';
 
@@ -74,7 +75,7 @@ function loadAppVariables(appName) {
 
 function computeLocalFullPlatformFrontDoorUrl(params) {
   const { setupPlatformMode, remoteServer, developerIdNum, frontDoorRouting } = params;
-  if (setupPlatformMode !== 'full') {
+  if (!flagsForSetupPlatformMode(setupPlatformMode).traefik) {
     return null;
   }
   if (remoteServer && String(remoteServer).trim()) {
@@ -102,12 +103,12 @@ async function computeAppBaseUrl(appName) {
   const userCfg = await config.getConfig();
   const remoteServer = await config.getRemoteServer();
   const infraTlsEnabled = Boolean(userCfg && userCfg.tlsEnabled);
+  const setupPlatformMode = await config.getSetupPlatformMode();
 
   const fd = variables.frontDoorRouting || null;
   const frontDoorEnabled = Boolean(fd && fd.enabled === true);
   const traefikOn = Boolean(userCfg && userCfg.traefik);
   const pathActive = Boolean(traefikOn && frontDoorEnabled);
-  const setupPlatformMode = await config.getSetupPlatformMode();
 
   const publicBase = computePublicUrlBaseString({
     traefik: traefikOn,
@@ -119,7 +120,8 @@ async function computeAppBaseUrl(appName) {
     profile: 'docker',
     listenPort: basePort,
     developerIdNum,
-    infraTlsEnabled
+    infraTlsEnabled,
+    setupPlatformMode
   });
 
   if (pathActive) {
@@ -147,10 +149,62 @@ async function resolvePlatformControllerUrl() {
   return computeAppBaseUrl(MISO_CONTROLLER_APP);
 }
 
+/**
+ * Direct localhost controller URL (published Docker port + optional front-door mount).
+ * Used when the CLI runs on the builder host but the public Traefik URL is unreachable.
+ *
+ * @async
+ * @param {string} [appName]
+ * @returns {Promise<string>}
+ */
+async function resolveLocalhostPlatformControllerUrl(appName = MISO_CONTROLLER_APP) {
+  const variables = loadAppVariables(appName);
+  const developerIdRaw = await config.getDeveloperId();
+  const developerIdNum =
+    typeof developerIdRaw === 'string' ? parseInt(developerIdRaw, 10) : developerIdRaw;
+  const basePort = Number(variables.port || 3000);
+  const hostPort = basePort + (Number.isFinite(developerIdNum) ? developerIdNum : 0) * 100;
+  const fd = variables.frontDoorRouting;
+  if (fd && fd.enabled === true && fd.pattern) {
+    const mount = normalizeFrontDoorPatternForHealth(fd.pattern);
+    if (mount && mount !== '/') {
+      return joinUrlPath(`http://localhost:${hostPort}`, mount).replace(/\/+$/, '');
+    }
+  }
+  return `http://localhost:${hostPort}`;
+}
+
+/**
+ * Controller URL for CLI HTTP calls on a remote dev host (builder-server).
+ * Keeps the public Traefik URL when reachable; otherwise falls back to localhost.
+ *
+ * @async
+ * @returns {Promise<string>}
+ */
+async function resolveCliPlatformControllerUrl() {
+  const publicUrl = await resolvePlatformControllerUrl();
+  const remoteServer = await config.getRemoteServer();
+  if (!remoteServer || !String(remoteServer).trim()) {
+    return publicUrl;
+  }
+  try {
+    const { checkHealthEndpoint } = require('./health-check-request');
+    const healthUrl = `${String(publicUrl).replace(/\/+$/, '')}/health`;
+    if (await checkHealthEndpoint(healthUrl)) {
+      return publicUrl;
+    }
+  } catch {
+    // fall through to localhost
+  }
+  return resolveLocalhostPlatformControllerUrl(MISO_CONTROLLER_APP);
+}
+
 module.exports = {
   MISO_CONTROLLER_APP,
   loadAppVariables,
   loadBundledApplicationVariables,
   computeAppBaseUrl,
-  resolvePlatformControllerUrl
+  resolvePlatformControllerUrl,
+  resolveLocalhostPlatformControllerUrl,
+  resolveCliPlatformControllerUrl
 };

package/lib/utils/platform-kv-ref.js

@@ -0,0 +1,57 @@
+/**
+ * Platform installation kv:// refs from infra.parameter.yaml (flat keys, no path segments).
+ *
+ * @fileoverview Distinguish platform catalog secrets from per-integration path-style kv refs
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { getInfraParameterCatalog } = require('../parameters/infra-parameter-catalog');
+
+/**
+ * Returns the single-segment path after kv:// when the ref has no slashes.
+ *
+ * @param {string} val - kv:// reference
+ * @returns {string|null}
+ */
+function kvRefSegment(val) {
+  if (typeof val !== 'string' || !val.trim().toLowerCase().startsWith('kv://')) return null;
+  const after = val.trim().slice(5);
+  if (!after || after.includes('/')) return null;
+  return after;
+}
+
+/**
+ * True when val is kv://<key> and key exists in shipped infra.parameter.yaml.
+ *
+ * @param {string} val - kv:// reference
+ * @returns {boolean}
+ */
+function isPlatformCatalogKvRef(val) {
+  const segment = kvRefSegment(val);
+  if (!segment) return false;
+  try {
+    const catalog = getInfraParameterCatalog();
+    return Boolean(catalog.findEntryForKey(segment));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * True when repair should normalize a kv value to path-style kv://systemKey/variable.
+ * Platform catalog refs (e.g. kv://secrets-openaiApiKeyVault) are never legacy.
+ *
+ * @param {string} val - Value from authentication.security or configuration
+ * @returns {boolean}
+ */
+function isLegacyKvValue(val) {
+  if (typeof val !== 'string' || !val.trim().toLowerCase().startsWith('kv://')) return false;
+  if (isPlatformCatalogKvRef(val)) return false;
+  const after = val.trim().slice(5);
+  return after.includes('KeyVault') || !after.includes('/');
+}
+
+module.exports = { kvRefSegment, isPlatformCatalogKvRef, isLegacyKvValue };

package/lib/utils/runtime-configuration-download.js

@@ -0,0 +1,189 @@
+/**
+ * Sync runtime configuration_values from dataplane on download (values → env.template; manifest → placeholders).
+ *
+ * @fileoverview Download-time runtime configuration sync
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+const fs = require('fs');
+const fsPromises = require('fs').promises;
+const path = require('path');
+const yaml = require('js-yaml');
+
+const {
+  getExternalSystemConfigurationResolved,
+  getExternalDataSourceConfigurationResolved
+} = require('../api/runtime-configuration.api');
+const {
+  retemplateAllVariableDefinitions,
+  retemplateDatasourceConfigurationOverrides
+} = require('./configuration-env-resolver');
+const { mergeEnvTemplateWithExisting } = require('../generator/split');
+
+/**
+ * @param {Object} response - Dataplane API client response
+ * @returns {Record<string, string>}
+ */
+function extractResolvedVariableValues(response) {
+  if (!response || !response.success) {
+    return {};
+  }
+  const body = response.data && typeof response.data === 'object' ? response.data : {};
+  const variables = body.variables && typeof body.variables === 'object' ? body.variables : {};
+  const out = {};
+  for (const [name, entry] of Object.entries(variables)) {
+    if (!entry || typeof entry.value !== 'string') {
+      continue;
+    }
+    const value = entry.value.trim();
+    if (!value || value.startsWith('kv://')) {
+      continue;
+    }
+    out[name] = value;
+  }
+  return out;
+}
+
+/**
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {string} systemKey
+ * @param {Array<{ key?: string }>} dataSources
+ * @returns {Promise<Record<string, string>>}
+ */
+async function collectResolvedConfigurationEnvUpdates(
+  dataplaneUrl,
+  authConfig,
+  systemKey,
+  dataSources
+) {
+  const updates = {};
+  const systemResponse = await getExternalSystemConfigurationResolved(
+    dataplaneUrl,
+    systemKey,
+    authConfig
+  );
+  Object.assign(updates, extractResolvedVariableValues(systemResponse));
+
+  for (const ds of dataSources || []) {
+    if (!ds?.key) {
+      continue;
+    }
+    const dsResponse = await getExternalDataSourceConfigurationResolved(
+      dataplaneUrl,
+      ds.key,
+      authConfig
+    );
+    Object.assign(updates, extractResolvedVariableValues(dsResponse));
+  }
+  return updates;
+}
+
+/**
+ * @param {string} integrationPath
+ * @param {Record<string, string>} updates
+ * @returns {Promise<boolean>}
+ */
+async function mergeConfigurationUpdatesIntoEnvTemplate(integrationPath, updates) {
+  const keys = Object.keys(updates || {});
+  if (!keys.length) {
+    return false;
+  }
+  const envTemplatePath = path.join(integrationPath, 'env.template');
+  const expectedByKey = new Map();
+  for (const key of keys) {
+    expectedByKey.set(key, `${key}=${updates[key]}`);
+  }
+  const existingContent = fs.existsSync(envTemplatePath)
+    ? await fsPromises.readFile(envTemplatePath, 'utf8')
+    : '';
+  const merged = mergeEnvTemplateWithExisting(existingContent, expectedByKey);
+  await fsPromises.writeFile(envTemplatePath, merged, { mode: 0o644, encoding: 'utf8' });
+  return true;
+}
+
+/**
+ * @param {string} filePath
+ * @returns {Promise<boolean>}
+ */
+async function retemplateConfigurationFile(filePath, { system = false } = {}) {
+  if (!filePath || !fs.existsSync(filePath)) {
+    return false;
+  }
+  const raw = await fsPromises.readFile(filePath, 'utf8');
+  const isJson = filePath.endsWith('.json');
+  const parsed = isJson ? JSON.parse(raw) : yaml.load(raw);
+  if (!parsed || typeof parsed !== 'object') {
+    return false;
+  }
+  if (system) {
+    retemplateAllVariableDefinitions(parsed.configuration);
+  } else {
+    retemplateDatasourceConfigurationOverrides(parsed.configuration);
+  }
+  const next = isJson ? `${JSON.stringify(parsed, null, 2)}\n` : yaml.dump(parsed, { indent: 2, lineWidth: -1 });
+  await fsPromises.writeFile(filePath, next, { mode: 0o644, encoding: 'utf8' });
+  return true;
+}
+
+/**
+ * @param {string} integrationPath
+ * @param {string} systemKey
+ * @returns {Promise<void>}
+ */
+async function retemplateDownloadedConfigurationFiles(integrationPath, systemKey) {
+  for (const ext of ['yaml', 'json']) {
+    const systemPath = path.join(integrationPath, `${systemKey}-system.${ext}`);
+    if (fs.existsSync(systemPath)) {
+      await retemplateConfigurationFile(systemPath, { system: true });
+    }
+  }
+  const entries = await fsPromises.readdir(integrationPath);
+  for (const name of entries) {
+    if (!name.includes('-datasource-') || (!name.endsWith('.yaml') && !name.endsWith('.json'))) {
+      continue;
+    }
+    await retemplateConfigurationFile(path.join(integrationPath, name), { system: false });
+  }
+}
+
+/**
+ * Pulls configuration_values from dataplane, merges env.template, and re-templates manifests.
+ *
+ * @param {Object} params
+ * @param {string} params.dataplaneUrl
+ * @param {Object} params.authConfig
+ * @param {string} params.systemKey
+ * @param {string} params.integrationPath
+ * @param {Array<{ key?: string }>} params.dataSources
+ * @returns {Promise<{ merged: number, names: string[] }>}
+ */
+async function syncRuntimeConfigurationFromDataplane({
+  dataplaneUrl,
+  authConfig,
+  systemKey,
+  integrationPath,
+  dataSources
+}) {
+  const updates = await collectResolvedConfigurationEnvUpdates(
+    dataplaneUrl,
+    authConfig,
+    systemKey,
+    dataSources
+  );
+  const names = Object.keys(updates);
+  if (names.length) {
+    await mergeConfigurationUpdatesIntoEnvTemplate(integrationPath, updates);
+  }
+  await retemplateDownloadedConfigurationFiles(integrationPath, systemKey);
+  return { merged: names.length, names };
+}
+
+module.exports = {
+  extractResolvedVariableValues,
+  collectResolvedConfigurationEnvUpdates,
+  mergeConfigurationUpdatesIntoEnvTemplate,
+  retemplateDownloadedConfigurationFiles,
+  syncRuntimeConfigurationFromDataplane
+};

package/lib/utils/runtime-configuration-values.js

@@ -0,0 +1,119 @@
+/**
+ * Push runtime configuration_values to dataplane after publish (never logs values).
+ *
+ * @fileoverview Post-publish configuration PUT helpers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+const {
+  putExternalSystemConfiguration,
+  putExternalDataSourceConfiguration
+} = require('../api/runtime-configuration.api');
+const { buildResolvedEnvMapForIntegration } = require('./configuration-env-resolver');
+
+/**
+ * @param {Array<{ name?: string, location?: string }>|undefined} systemConfiguration
+ * @param {Object.<string, string>} envMap
+ * @returns {Array<{ name: string, value: string }>}
+ */
+function collectSystemVariablePutRequests(systemConfiguration, envMap) {
+  if (!Array.isArray(systemConfiguration)) {
+    return [];
+  }
+  const requests = [];
+  for (const item of systemConfiguration) {
+    if (!item || !item.name) {
+      continue;
+    }
+    const location = String(item.location || 'variable').toLowerCase();
+    if (location !== 'variable') {
+      continue;
+    }
+    const name = String(item.name).trim();
+    const raw = envMap[name];
+    if (raw === undefined || raw === null) {
+      continue;
+    }
+    const value = String(raw).trim();
+    if (!value || value.startsWith('kv://') || value.includes('{{')) {
+      continue;
+    }
+    requests.push({ name, value });
+  }
+  return requests;
+}
+
+/**
+ * Datasource overrides are name+value only; values may already be resolved in upload payload.
+ *
+ * @param {Array<{ name?: string, value?: string }>|undefined} datasourceConfiguration
+ * @returns {Array<{ name: string, value: string }>}
+ */
+function collectDatasourceOverridePutRequests(datasourceConfiguration) {
+  if (!Array.isArray(datasourceConfiguration)) {
+    return [];
+  }
+  const requests = [];
+  for (const item of datasourceConfiguration) {
+    if (!item || !item.name) {
+      continue;
+    }
+    const name = String(item.name).trim();
+    const raw = item.value;
+    if (typeof raw !== 'string') {
+      continue;
+    }
+    const value = raw.trim();
+    if (!value || value.startsWith('kv://') || value.includes('{{')) {
+      continue;
+    }
+    requests.push({ name, value });
+  }
+  return requests;
+}
+
+/**
+ * Upserts system-scoped and datasource-scoped configuration values after publish.
+ *
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {string} systemKey
+ * @param {{ application?: { configuration?: unknown[] }, dataSources?: Array<{ key?: string, configuration?: unknown[] }> }} payload
+ * @returns {Promise<{ pushed: number, names: string[] }>}
+ */
+async function pushRuntimeConfigurationValues(dataplaneUrl, authConfig, systemKey, payload) {
+  const { envMap } = await buildResolvedEnvMapForIntegration(systemKey);
+  const names = [];
+  let pushed = 0;
+
+  const systemRequests = collectSystemVariablePutRequests(
+    payload?.application?.configuration,
+    envMap
+  );
+  for (const body of systemRequests) {
+    await putExternalSystemConfiguration(dataplaneUrl, systemKey, authConfig, body);
+    names.push(body.name);
+    pushed += 1;
+  }
+
+  for (const ds of payload?.dataSources || []) {
+    if (!ds?.key) {
+      continue;
+    }
+    const dsRequests = collectDatasourceOverridePutRequests(ds.configuration);
+    for (const body of dsRequests) {
+      await putExternalDataSourceConfiguration(dataplaneUrl, ds.key, authConfig, body);
+      names.push(`${ds.key}:${body.name}`);
+      pushed += 1;
+    }
+  }
+
+  return { pushed, names };
+}
+
+module.exports = {
+  collectSystemVariablePutRequests,
+  collectDatasourceOverridePutRequests,
+  pushRuntimeConfigurationValues
+};

package/lib/utils/schema-loader.js

@@ -28,6 +28,23 @@ function resetValidators() {
   externalDataSourceValidator = null;
 }
 
+/**
+ * Register AJV schemas required to compile or validate external-datasource manifests.
+ * Includes type schemas and external-system (for $defs/subscriptionFilter cross-ref).
+ *
+ * @function registerExternalDatasourceAjvDependencies
+ * @param {import('ajv').default} ajv - AJV instance
+ */
+function registerExternalDatasourceAjvDependencies(ajv) {
+  ajv.addSchema(require('../schema/type/document-storage.json'));
+  ajv.addSchema(require('../schema/type/message-service.json'));
+  ajv.addSchema(require('../schema/type/vector-store.json'));
+  const externalSystemSchema = require('../schema/external-system.schema.json');
+  if (!ajv.getSchema(externalSystemSchema.$id)) {
+    ajv.addSchema(externalSystemSchema, externalSystemSchema.$id);
+  }
+}
+
 /**
  * Loads and compiles external-system schema
  * Caches the compiled validator for performance
@@ -115,10 +132,7 @@ function loadExternalDataSourceSchema() {
 
   const ajv = new Ajv({ allErrors: true, strict: false, strictSchema: false });
   addFormats(ajv);
-  // external-datasource.schema.json references these by $id (aifabrix://schema/type/*)
-  ajv.addSchema(require('../schema/type/document-storage.json'));
-  ajv.addSchema(require('../schema/type/message-service.json'));
-  ajv.addSchema(require('../schema/type/vector-store.json'));
+  registerExternalDatasourceAjvDependencies(ajv);
   externalDataSourceValidator = ajv.compile(schemaToCompile);
 
   return externalDataSourceValidator;
@@ -333,6 +347,7 @@ function detectSchemaType(filePath, content) {
 module.exports = {
   loadExternalSystemSchema,
   loadExternalDataSourceSchema,
+  registerExternalDatasourceAjvDependencies,
   detectSchemaType,
   detectSchemaTypeFromParsed,
   resetValidators

package/lib/utils/url-declarative-public-base.js

@@ -10,26 +10,11 @@
 
 const { expandFrontDoorHostPlaceholders } = require('./compose-generator');
 const { publishedHostPort, localHostPort } = require('./declarative-url-ports');
-
-/**
- * Public URL authorities that must use `http://` (browsers hit loopback without TLS in practice).
- *
- * @param {string} hostname - Parsed URL hostname
- * @returns {boolean}
- */
-function isLocalhostPublicSchemeHostname(hostname) {
-  const h = String(hostname || '').trim().toLowerCase();
-  if (!h) {
-    return false;
-  }
-  if (h === 'localhost') {
-    return true;
-  }
-  if (h === '127.0.0.1') {
-    return true;
-  }
-  return h === '::1';
-}
+const {
+  normalizeSetupPlatformMode,
+  SETUP_PLATFORM_MODE
+} = require('../core/setup-platform-mode');
+const { isLocalhostPublicSchemeHostname } = require('./localhost-public-host');
 
 /**
  * Expand frontDoorRouting.host placeholders for url:// (same rules as Traefik labels in compose-generator).
@@ -156,6 +141,28 @@ function templateUsesRemoteHostPlaceholder(hostTemplate) {
   return /\$\{REMOTE_HOST\}/.test(String(hostTemplate || ''));
 }
 
+/**
+ * HTTPS for Traefik front-door public host when infra TLS is on, remote-server is https,
+ * or setup mode is single-traefik/full (builder-server nginx edge TLS).
+ *
+ * @param {Object} opts
+ * @param {boolean} [opts.infraTlsEnabled]
+ * @param {string|null|undefined} [opts.remoteServer]
+ * @param {string|null|undefined} [opts.setupPlatformMode]
+ * @returns {boolean}
+ */
+function traefikFrontDoorUsesHttps(opts = {}) {
+  if (opts.infraTlsEnabled) {
+    return true;
+  }
+  const remote = String(opts.remoteServer || '').trim();
+  if (remote && /^https:\/\//i.test(remote)) {
+    return true;
+  }
+  const mode = normalizeSetupPlatformMode(opts.setupPlatformMode);
+  return mode === SETUP_PLATFORM_MODE.SINGLE_TRAEFIK || mode === SETUP_PLATFORM_MODE.FULL;
+}
+
 /**
  * @param {Object} opts - same shape as computePublicUrlBaseString
  * @returns {string|null}
@@ -167,7 +174,6 @@ function buildTraefikPublicBaseIfApplicable(opts) {
     hostTemplate,
     developerIdRaw,
     remoteServer,
-    infraTlsEnabled,
     profile,
     developerIdNum
   } = opts;
@@ -189,8 +195,7 @@ function buildTraefikPublicBaseIfApplicable(opts) {
   if (!expanded) {
     return null;
   }
-  // Scheme follows global `tlsEnabled` (`up-infra --tls`) only — not `frontDoorRouting.tls` when infra TLS is off.
-  const useHttps = Boolean(infraTlsEnabled);
+  const useHttps = traefikFrontDoorUsesHttps(opts);
   let scheme = useHttps ? 'https' : 'http';
   if (isLocalhostPublicSchemeHostname(expanded)) {
     scheme = 'http';
@@ -210,7 +215,8 @@ function buildTraefikPublicBaseIfApplicable(opts) {
  * @param {'docker'|'local'} opts.profile
  * @param {number} opts.listenPort
  * @param {number} opts.developerIdNum
- * @param {boolean} [opts.infraTlsEnabled] - `tlsEnabled` from ~/.aifabrix/config.yaml (`up-infra --tls`); Traefik front-door public bases use **`https`** only when this is **true** (even if `frontDoorRouting.tls` is **false**). When **false**, front-door bases use **`http`** regardless of `frontDoorRouting.tls`. Loopback hostnames stay **http** always.
+ * @param {boolean} [opts.infraTlsEnabled] - `tlsEnabled` from ~/.aifabrix/config.yaml (`up-infra --tls`). Traefik front-door public bases also use **`https`** when `remote-server` is **`https://`** or `setupPlatformMode` is **`single-traefik`** / **`full`** (builder-server nginx edge TLS). Loopback hostnames stay **http** always.
+ * @param {string|null|undefined} [opts.setupPlatformMode] - From config; used with remote-server for edge TLS scheme
  * @param {boolean} [opts.pathActive] - traefik ∧ frontDoorRouting.enabled; required for Traefik host branch (plan 124)
  * @param {boolean|undefined} [opts.declarativePublicUrlsUseLocalhost] - **`true`**: force localhost authority (+ port rules below). **`false`**: allow `remote-server` as authority when Traefik is on, or when global `traefik` is not `false` and per-app `proxy` opts in without Traefik. **`undefined`**: default — omit `remote-server` when Traefik is off so published services use `http://localhost:<port>` (e.g. `af setup` / device login URLs). When user config has **`traefik: false`**, expansion forces localhost for public bases regardless of per-app `proxy`.
  * @returns {string}
@@ -270,5 +276,7 @@ function computePublicUrlBaseString(opts) {
 module.exports = {
   expandFrontDoorHostTemplateForUrls,
   computePublicUrlBaseString,
-  resolveHostPortForDeclarativePublic
+  resolveHostPortForDeclarativePublic,
+  isLocalhostPublicSchemeHostname,
+  traefikFrontDoorUsesHttps
 };