@aifabrix/builder 2.47.4 → 2.48.0

package/jest.isolated-projects.js

@@ -38,6 +38,10 @@ const ISOLATED_SUITE_ENTRIES = [
     'application-frontdoor-paths-contract',
     ['**/tests/lib/templates/application-frontdoor-paths.contract.test.js']
   ],
+  [
+    'dataplane-env-template-contract',
+    ['**/tests/lib/templates/dataplane-env-template.contract.test.js']
+  ],
   ['database-secret-values', ['**/tests/lib/parameters/database-secret-values.test.js']],
   ['infra-parameter-validate', ['**/tests/lib/parameters/infra-parameter-validate.test.js']],
   [

package/jest.projects.js

@@ -275,6 +275,10 @@ const defaultProject = {
       '\\\\tests\\\\lib\\\\templates\\\\application-frontdoor-paths.contract.test.js',
       'lib/templates/application-frontdoor-paths.contract.test.js',
       'application-frontdoor-paths\\.contract\\.test\\.js',
+      '/tests/lib/templates/dataplane-env-template.contract.test.js',
+      '\\\\tests\\\\lib\\\\templates\\\\dataplane-env-template.contract.test.js',
+      'lib/templates/dataplane-env-template.contract.test.js',
+      'dataplane-env-template\\.contract\\.test\\.js',
       '/tests/lib/core/admin-secrets.test.js',
       '\\\\tests\\\\lib\\\\core\\\\admin-secrets.test.js',
       'lib/core/admin-secrets.test.js',

package/lib/api/types/dev.types.js

@@ -31,7 +31,7 @@
  * @property {string} aifabrix-env-config - Env config path
  * @property {string} remote-server - Builder-server base URL
  * @property {string} docker-endpoint - Docker API endpoint
- * @property {boolean} [docker-tls-skip-verify] - When true and ca.pem is absent, Docker uses DOCKER_TLS_VERIFY=0; if ca.pem exists, daemon is always verified
+ * @property {boolean} [docker-tls-skip-verify] - When true, Docker uses DOCKER_TLS_VERIFY=0 even if ca.pem exists (client mTLS unchanged)
  * @property {string} sync-ssh-user - SSH user for Mutagen
  * @property {string} sync-ssh-host - SSH host for Mutagen
  */

package/lib/app/register.js

@@ -78,38 +78,40 @@ function buildRegistrationData(appConfig, options) {
 }
 
 /**
- * Save credentials to local secrets if localhost
+ * Save pipeline client credentials to ~/.aifabrix/secrets.local.yaml (always).
+ * env.template / in-memory resolve validation runs only for localhost controllers.
  * @async
  * @param {Object} responseData - Registration response data
  * @param {string} apiUrl - API URL
  */
 async function saveLocalCredentials(responseData, apiUrl) {
-  if (!isLocalhost(apiUrl)) {
-    return;
-  }
-
   const registeredAppKey = responseData.application.key;
   const clientIdKey = `${registeredAppKey}-client-idKeyVault`;
   const clientSecretKey = `${registeredAppKey}-client-secretKeyVault`;
+  const localhostController = isLocalhost(apiUrl);
 
   try {
     await saveLocalSecret(clientIdKey, responseData.credentials.clientId);
     await saveLocalSecret(clientSecretKey, responseData.credentials.clientSecret);
 
-    // Update env.template (kv:// refs only; no resolved values touch disk)
-    await updateEnvTemplate(registeredAppKey, clientIdKey, clientSecretKey, apiUrl);
-
-    // Resolve in-memory so any missing-secret / kv:// error surfaces here, but never
-    // materialize <appPath>/.env or envOutputPath — that is only done by `aifabrix resolve`.
-    try {
-      await generateEnvFile(registeredAppKey, null, 'local', true, { noWrite: true });
-    } catch (error) {
-      logger.warn(chalk.yellow(`⚠  Could not validate env resolution: ${error.message}`));
+    if (localhostController) {
+      // Update env.template (kv:// refs only; no resolved values touch disk)
+      await updateEnvTemplate(registeredAppKey, clientIdKey, clientSecretKey, apiUrl);
+
+      // Resolve in-memory so any missing-secret / kv:// error surfaces here, but never
+      // materialize <appPath>/.env or envOutputPath — that is only done by `aifabrix resolve`.
+      try {
+        await generateEnvFile(registeredAppKey, null, 'local', true, { noWrite: true });
+      } catch (error) {
+        logger.warn(chalk.yellow(`⚠  Could not validate env resolution: ${error.message}`));
+      }
+
+      logger.log(formatSuccessParagraph('Credentials saved to ~/.aifabrix/secrets.local.yaml'));
+      logger.log(formatSuccessLine('env.template updated with MISO_CLIENTID, MISO_CLIENTSECRET, and MISO_CONTROLLER_URL'));
+      logger.log(formatSuccessLine('Run "aifabrix resolve ' + registeredAppKey + '" to materialize an on-disk .env\n'));
+    } else {
+      logger.log(formatSuccessParagraph('Credentials saved to ~/.aifabrix/secrets.local.yaml\n'));
     }
-
-    logger.log(formatSuccessParagraph('Credentials saved to ~/.aifabrix/secrets.local.yaml'));
-    logger.log(formatSuccessLine('env.template updated with MISO_CLIENTID, MISO_CLIENTSECRET, and MISO_CONTROLLER_URL'));
-    logger.log(formatSuccessLine('Run "aifabrix resolve ' + registeredAppKey + '" to materialize an on-disk .env\n'));
   } catch (error) {
     logger.warn(chalk.yellow(`⚠  Could not save credentials locally: ${error.message}`));
   }

package/lib/app/rotate-secret.js

@@ -63,16 +63,34 @@ function validateEnvironment(environment) {
   }
 }
 
+/**
+ * @param {number} code
+ * @param {string} message
+ * @param {{ exitOnFailure?: boolean }} [options]
+ * @throws {Error}
+ */
+function failRotation(code, message, options = {}) {
+  if (options.exitOnFailure === false) {
+    throw new Error(message);
+  }
+  logger.error(formatBlockingError(message));
+  process.exit(code);
+}
+
 /**
  * Resolve controller URL and environment from config; exit if controller is missing.
  * @async
+ * @param {{ exitOnFailure?: boolean }} [options]
  * @returns {Promise<{controllerUrl: string, environment: string}>}
  */
-async function resolveControllerAndEnvironment() {
+async function resolveControllerAndEnvironment(options = {}) {
   const controllerUrl = await resolveControllerUrl();
   if (!controllerUrl) {
-    logger.error(formatBlockingError('Controller URL is required. Run "aifabrix login" to set the controller URL in config.yaml'));
-    process.exit(1);
+    failRotation(
+      1,
+      'Controller URL is required. Run "aifabrix login" to set the controller URL in config.yaml',
+      options
+    );
   }
   const environment = await resolveEnvironment();
   validateEnvironment(environment);
@@ -197,9 +215,10 @@ function displayRotationResults(appKey, environment, credentials, apiUrl, messag
  * Get device token from provided controller URL
  * @async
  * @param {string} controllerUrl - Controller URL
+ * @param {{ exitOnFailure?: boolean }} [options]
  * @returns {Promise<Object|null>} Object with token and controllerUrl, or null if failed
  */
-async function getTokenFromUrl(controllerUrl) {
+async function getTokenFromUrl(controllerUrl, options = {}) {
   try {
     const normalizedUrl = normalizeControllerUrl(controllerUrl);
     const deviceToken = await getOrRefreshDeviceToken(normalizedUrl);
@@ -210,9 +229,7 @@ async function getTokenFromUrl(controllerUrl) {
       };
     }
   } catch (error) {
-    logger.error(formatBlockingError(`Failed to authenticate with controller: ${controllerUrl}`));
-    logger.error(chalk.gray(`Error: ${error.message}`));
-    process.exit(1);
+    failRotation(1, `Failed to authenticate with controller: ${controllerUrl} (${error.message})`, options);
   }
   return null;
 }
@@ -222,9 +239,13 @@ async function getTokenFromUrl(controllerUrl) {
  * @param {string|null} token - Authentication token
  * @param {string|null} controllerUrl - Controller URL
  * @param {string} [providedUrl] - Original provided URL for error context
+ * @param {{ exitOnFailure?: boolean }} [options]
  */
-function validateAuthToken(token, controllerUrl, providedUrl) {
+function validateAuthToken(token, controllerUrl, providedUrl, options = {}) {
   if (!token || !controllerUrl) {
+    if (options.exitOnFailure === false) {
+      throw new Error('No valid authentication found');
+    }
     const formattedError = formatAuthenticationError({
       controllerUrl: providedUrl || undefined,
       message: 'No valid authentication found'
@@ -239,16 +260,17 @@ function validateAuthToken(token, controllerUrl, providedUrl) {
  * @async
  * @param {string} [controllerUrl] - Optional controller URL
  * @param {Object} config - Configuration object
+ * @param {{ exitOnFailure?: boolean }} [options]
  * @returns {Promise<Object>} Object with token and actualControllerUrl
  * @throws {Error} If authentication fails
  */
-async function getRotationAuthToken(controllerUrl, config) {
+async function getRotationAuthToken(controllerUrl, config, options = {}) {
   let token = null;
   let actualControllerUrl = null;
 
   // If controller URL provided, try to get device token
   if (controllerUrl) {
-    const tokenResult = await getTokenFromUrl(controllerUrl);
+    const tokenResult = await getTokenFromUrl(controllerUrl, options);
     if (tokenResult) {
       token = tokenResult.token;
       actualControllerUrl = tokenResult.controllerUrl;
@@ -264,7 +286,7 @@ async function getRotationAuthToken(controllerUrl, config) {
     }
   }
 
-  validateAuthToken(token, actualControllerUrl, controllerUrl);
+  validateAuthToken(token, actualControllerUrl, controllerUrl, options);
   return { token, actualControllerUrl };
 }
 
@@ -323,6 +345,9 @@ async function executeRotation(appKey, actualControllerUrl, environment, token,
 
   if (!response.success) {
     const formattedError = response.formattedError || formatApiError(response, actualControllerUrl);
+    if (options.exitOnFailure === false) {
+      throw new Error(formattedError || `Rotate secret failed for ${appKey}`);
+    }
     logger.error(formattedError);
     logger.error(chalk.gray(`\nController URL: ${actualControllerUrl}`));
     process.exit(1);
@@ -351,16 +376,14 @@ async function rotateSecret(appKey, options = {}) {
   const { ensureSecretsEncryptionKey } = require('../core/config');
   await ensureSecretsEncryptionKey();
 
-  const { controllerUrl, environment } = await resolveControllerAndEnvironment();
+  const { controllerUrl, environment } = await resolveControllerAndEnvironment(options);
   const config = await getConfig();
-  const { token, actualControllerUrl } = await getRotationAuthToken(controllerUrl, config);
+  const { token, actualControllerUrl } = await getRotationAuthToken(controllerUrl, config, options);
 
   try {
     await executeRotation(appKey, actualControllerUrl, environment, token, options);
   } catch (error) {
-    logger.error(formatBlockingError(`Failed to rotate secret via controller: ${actualControllerUrl}`));
-    logger.error(chalk.gray(`Error: ${error.message}`));
-    process.exit(1);
+    failRotation(1, `Failed to rotate secret via controller: ${actualControllerUrl} (${error.message})`, options);
   }
 }
 

package/lib/build/index.js

@@ -1,6 +1,5 @@
 const {
   formatSuccessLine,
-  formatSuccessParagraph,
   formatProgress,
   formatWarningLine,
   sectionTitle,
@@ -31,12 +30,10 @@ const secrets = require('../core/secrets');
 const config = require('../core/config');
 const logger = require('../utils/logger');
 const dockerfileUtils = require('../utils/dockerfile-utils');
-const dockerBuild = require('../utils/docker-build');
 const buildCopy = require('../utils/build-copy');
 const { resolveBuildDockerTagNames } = require('../utils/build-resolve-image');
 const buildHelpers = require('../utils/build-helpers');
-const { ensureRunSecretsForApp } = require('../app/run-env-compose');
-const { resolveDockerBuildArgsForApp } = require('./docker-build-args');
+const { runStandardDockerBuild } = require('./standard-docker-build');
 
 /**
  * Loads application config for an application
@@ -353,18 +350,6 @@ function prepareBuildContext(buildConfig, devDir) {
   return contextPath;
 }
 
-/**
- * Handle Dockerfile generation
- * @async
- * @param {string} appName - Application name
- * @param {Object} params - Parameters
- * @param {string} params.devDir - Developer directory
- * @param {Object} params.buildConfig - Build configuration
- * @param {string} params.contextPath - Build context path
- * @param {Object} params.appConfig - Application configuration
- * @param {Object} options - Build options
- * @returns {Promise<string>} Dockerfile path
- */
 async function handleDockerfileGeneration(appName, params, options, buildHelpers) {
   const { devDir, buildConfig, contextPath, appConfig } = params;
   const appDockerfilePath = path.join(devDir, 'Dockerfile');
@@ -393,38 +378,6 @@ async function handleDockerfileGeneration(appName, params, options, buildHelpers
   }, generateDockerfile);
 }
 
-/**
- * Standard Docker build path after CLI header is printed (non-external apps).
- * @param {string} appName
- * @param {Object} options
- * @returns {Promise<string>} Built image ref e.g. name:tag
- */
-async function runStandardDockerBuild(appName, options) {
-  const { buildConfig } = await buildHelpers.loadAndValidateConfig(appName);
-  const { emitManifestMetadataLineIfTTY } = require('../utils/manifest-source-emit');
-  const { appPath } = await detectAppType(appName);
-  emitManifestMetadataLineIfTTY(logger, { appKey: appName, appPath, envOnly: false, json: false });
-  const { devDir, effectiveImageName, imageName, appConfig } = await prepareDevDirectory(appName, buildConfig, options);
-  const contextPath = prepareBuildContext(buildConfig, devDir);
-  const dockerfilePath = await handleDockerfileGeneration(appName, {
-    devDir,
-    buildConfig,
-    contextPath,
-    appConfig
-  }, options, buildHelpers);
-  await ensureRunSecretsForApp(appName);
-  const buildArgs = await resolveDockerBuildArgsForApp(appName, contextPath);
-  const buildOptions = { ...options, buildArgs };
-  const tag = options.tag || 'latest';
-  if (typeof tag === 'string' && tag.includes(',')) {
-    throw new Error('Use a single image tag per build (comma-separated multiple tags are not supported).');
-  }
-  await dockerBuild.executeDockerBuildWithTag(effectiveImageName, imageName, dockerfilePath, contextPath, tag, buildOptions);
-  await postBuildTasks(appName, buildConfig);
-  logger.log(formatSuccessParagraph('Build completed successfully!'));
-  return `${effectiveImageName}:${tag}`;
-}
-
 /**
  * Builds a container image for the specified application
  * Auto-detects runtime and generates Dockerfile if needed
@@ -458,4 +411,14 @@ async function buildApp(appName, options = {}) {
     throw new Error(`Build failed: ${error.message}`);
   }
 }
-module.exports = { loadVariablesYaml, resolveContextPath, detectLanguage, generateDockerfile, buildApp, postBuildTasks };
+module.exports = {
+  loadVariablesYaml,
+  resolveContextPath,
+  detectLanguage,
+  generateDockerfile,
+  buildApp,
+  postBuildTasks,
+  prepareDevDirectory,
+  prepareBuildContext,
+  handleDockerfileGeneration
+};

package/lib/build/integration-docker-staging.js

@@ -0,0 +1,35 @@
+/**
+ * Pre-build integration manifest staging for Docker context.
+ * @fileoverview Runs scripts/stage_integration_for_docker.py when present in build context
+ */
+
+'use strict';
+
+const fsSync = require('fs');
+const path = require('path');
+const { promisify } = require('util');
+const { exec } = require('child_process');
+const logger = require('../utils/logger');
+const {
+  formatProgress,
+  formatSuccessLine
+} = require('../utils/cli-test-layout-chalk');
+
+const run = promisify(exec);
+
+/**
+ * When repo ships scripts/stage_integration_for_docker.py, run it before docker build.
+ * @param {string} contextPath
+ * @returns {Promise<void>}
+ */
+async function maybeStageIntegrationForDockerBuild(contextPath) {
+  const scriptPath = path.join(contextPath, 'scripts/stage_integration_for_docker.py');
+  if (!fsSync.existsSync(scriptPath)) {
+    return;
+  }
+  logger.log(formatProgress('Staging integration runtime manifests for Docker…'));
+  await run('python3 scripts/stage_integration_for_docker.py', { cwd: contextPath });
+  logger.log(formatSuccessLine('Integration staging ready'));
+}
+
+module.exports = { maybeStageIntegrationForDockerBuild };

package/lib/build/standard-docker-build.js

@@ -0,0 +1,113 @@
+/**
+ * Standard Docker build orchestration (dev-promote shortcut + full build).
+ * @fileoverview Extracted from lib/build/index.js for file-size limits
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const { detectAppType } = require('../utils/paths');
+const logger = require('../utils/logger');
+const dockerBuild = require('../utils/docker-build');
+const buildHelpers = require('../utils/build-helpers');
+const { ensureRunSecretsForApp } = require('../app/run-env-compose');
+const { formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
+const { resolveDockerBuildArgsForApp } = require('./docker-build-args');
+const { maybeStageIntegrationForDockerBuild } = require('./integration-docker-staging');
+
+/**
+ * Lazy require breaks circular dependency with lib/build/index.js.
+ * @returns {Object}
+ */
+function getBuildIndexDeps() {
+  return require('./index');
+}
+
+/**
+ * When --from-dev --base: tag dev image as base and skip docker build when possible.
+ * @param {string} appName
+ * @param {Object} options
+ * @returns {Promise<string|null>} image ref when promote completed; null to continue full build
+ */
+async function tryCompleteDevPromoteBuild(appName, options) {
+  const { shouldAttemptDevPromote, tryPromoteDevImageToBase } = require('../utils/promote-dev-docker-image');
+  if (!shouldAttemptDevPromote(options)) {
+    return null;
+  }
+  const promotedRef = await tryPromoteDevImageToBase(appName, options);
+  if (!promotedRef) {
+    logger.log(chalk.blue('No local dev-scoped image found; building base image...'));
+    return null;
+  }
+  const { buildConfig } = await buildHelpers.loadAndValidateConfig(appName);
+  const { postBuildTasks } = getBuildIndexDeps();
+  await postBuildTasks(appName, buildConfig);
+  logger.log(formatSuccessParagraph('Build completed successfully! (promoted from dev image)'));
+  return promotedRef;
+}
+
+/**
+ * Run docker build after workspace prep (shared by standard build path).
+ * @param {string} appName
+ * @param {Object} options
+ * @param {Object} buildConfig
+ * @returns {Promise<string>}
+ */
+async function executeDockerImageBuild(appName, options, buildConfig) {
+  const { emitManifestMetadataLineIfTTY } = require('../utils/manifest-source-emit');
+  const {
+    prepareDevDirectory,
+    prepareBuildContext,
+    handleDockerfileGeneration,
+    postBuildTasks
+  } = getBuildIndexDeps();
+  const { appPath } = await detectAppType(appName);
+  emitManifestMetadataLineIfTTY(logger, { appKey: appName, appPath, envOnly: false, json: false });
+  const { devDir, effectiveImageName, imageName, appConfig } = await prepareDevDirectory(
+    appName,
+    buildConfig,
+    options
+  );
+  const contextPath = prepareBuildContext(buildConfig, devDir);
+  await maybeStageIntegrationForDockerBuild(contextPath);
+  const dockerfilePath = await handleDockerfileGeneration(
+    appName,
+    { devDir, buildConfig, contextPath, appConfig },
+    options,
+    buildHelpers
+  );
+  await ensureRunSecretsForApp(appName);
+  const buildArgs = await resolveDockerBuildArgsForApp(appName, contextPath);
+  const tag = options.tag || 'latest';
+  if (typeof tag === 'string' && tag.includes(',')) {
+    throw new Error('Use a single image tag per build (comma-separated multiple tags are not supported).');
+  }
+  await dockerBuild.executeDockerBuildWithTag(
+    effectiveImageName,
+    imageName,
+    dockerfilePath,
+    contextPath,
+    tag,
+    { ...options, buildArgs }
+  );
+  await postBuildTasks(appName, buildConfig);
+  logger.log(formatSuccessParagraph('Build completed successfully!'));
+  return `${effectiveImageName}:${tag}`;
+}
+
+/**
+ * Standard Docker build path after CLI header is printed (non-external apps).
+ * @param {string} appName
+ * @param {Object} options
+ * @returns {Promise<string>} Built image ref e.g. name:tag
+ */
+async function runStandardDockerBuild(appName, options) {
+  const promotedRef = await tryCompleteDevPromoteBuild(appName, options);
+  if (promotedRef) {
+    return promotedRef;
+  }
+  const { buildConfig } = await buildHelpers.loadAndValidateConfig(appName);
+  return executeDockerImageBuild(appName, options, buildConfig);
+}
+
+module.exports = { runStandardDockerBuild };

package/lib/cli/setup-app.js

@@ -326,6 +326,10 @@ function setupBuildRunLogsDownCommands(program) {
       '--base',
       'Build/run the manifest base image (no -devN suffix). Default local build uses a developer-scoped repository when developer-id > 0.'
     )
+    .option(
+      '--from-dev',
+      'With --base: tag the existing developer-scoped image as the base image instead of rebuilding when possible'
+    )
     .action(async(appName, options) => {
       try {
         const imageTag = await app.buildApp(appName, options);

package/lib/commands/dev-init.js

@@ -16,6 +16,7 @@ const {
   getCertDir,
   readClientCertPem,
   readClientKeyPem,
+  readServerCaPem,
   getCertValidNotAfter,
   normalizePemNewlines,
   mergeCaPemBlocks
@@ -40,6 +41,7 @@ const {
   formatEnsureServerTrustedFailure
 } = require('../utils/dev-init-health-messages');
 const { getBadRequestHint, logCertTroubleshootingHint } = require('../utils/dev-init-cert-hints');
+const { augmentAndSaveCaPemForRemoteDocker } = require('../utils/dev-ca-docker-augment');
 
 /**
  * Install dev CA into the OS trust store. On Linux without sudo, log and return false so the caller can use in-process PEM.
@@ -371,6 +373,11 @@ async function runDevInit(options) {
   await saveCertAndConfig(configDir, devId, issueResponse.certificate, keyPem, caPem);
 
   await applySettingsFromServer(baseUrl, devId, issueResponse, keyPem, serverCaPemForTls || undefined);
+  await augmentAndSaveCaPemForRemoteDocker(configDir, devId, caPem, {
+    settings: issueResponse.settings,
+    remoteServerUrl: baseUrl,
+    warn: (msg) => logger.log(chalk.yellow(`  ⚠ ${msg}`))
+  });
   await _runSshKeyRegistrationStep(baseUrl, issueResponse, keyPem, configDir, devId, serverCaPemForTls || undefined);
   const sshInfo = await mergeDevSshConfigAfterInit(baseUrl, devId);
   logOnboardingFinished(sshInfo);
@@ -413,6 +420,11 @@ async function runCertificateRefresh(auth) {
   const caPem = mergeCaPemBlocks(serverCaPem, issueResponse.caCertificate, issueResponse.ca);
   await saveCertAndConfig(configDir, devId, issueResponse.certificate, keyPem, caPem);
   await applySettingsFromServer(auth.serverUrl, devId, issueResponse, keyPem, serverCaPem);
+  await augmentAndSaveCaPemForRemoteDocker(configDir, devId, caPem, {
+    settings: issueResponse.settings,
+    remoteServerUrl: auth.serverUrl,
+    warn: (msg) => logger.log(chalk.yellow(`  ⚠ ${msg}`))
+  });
   logger.log(formatSuccessLine('Certificate refreshed and config updated from server.\n'));
 }
 
@@ -433,6 +445,12 @@ async function fetchAndMergeRemoteSettings(auth, clientCertPem, clientKeyPem, de
     auth.serverCaPem || undefined
   );
   await config.mergeRemoteSettings(settings);
+  const existingCa = readServerCaPem(getCertDir(getConfigDirForPaths(), devId));
+  await augmentAndSaveCaPemForRemoteDocker(getConfigDirForPaths(), devId, existingCa, {
+    settings,
+    remoteServerUrl: auth.serverUrl,
+    warn: (msg) => logger.log(chalk.yellow(`  ⚠ ${msg}`))
+  });
   logger.log(formatSuccessLine('Config updated from server.\n'));
   await displayDevConfig(devId);
 }

package/lib/commands/setup-prompts-platform-mode.js

@@ -9,12 +9,14 @@
 'use strict';
 
 const inquirer = require('inquirer');
+const config = require('../core/config');
 const {
   normalizeSetupPlatformMode,
   SETUP_PLATFORM_MODE,
   SETUP_PLATFORM_MODE_CLI_VALUES,
   getSetupPlatformModePromptChoices
 } = require('../core/setup-platform-mode');
+const { isRemoteServerConfigured } = require('../utils/applications-config-defaults');
 
 /**
  * Resolve platform mode from CLI options, if provided.
@@ -51,12 +53,20 @@ async function promptSetupPlatformMode(options = {}) {
   const fromCli = resolvePlatformModeFromOptions(options);
   if (fromCli) return fromCli;
 
+  const remoteServer = await config.getRemoteServer();
+  const choices = getSetupPlatformModePromptChoices({
+    remoteServerConfigured: isRemoteServerConfigured(remoteServer)
+  });
+  if (choices.length === 1) {
+    return SETUP_PLATFORM_MODE.SINGLE;
+  }
+
   const { mode } = await inquirer.prompt([
     {
       type: 'list',
       name: 'mode',
       message: 'Platform mode:',
-      choices: getSetupPlatformModePromptChoices(),
+      choices,
       default: SETUP_PLATFORM_MODE.SINGLE
     }
   ]);

package/lib/commands/setup.js

@@ -65,6 +65,7 @@ async function applySetupPlatformMode(options) {
   // These are the user gates that control full-mode behavior.
   const cfg = await config.getConfig();
   cfg.traefik = derived.traefik;
+  cfg.tlsEnabled = derived.tlsEnabled;
   cfg.useEnvironmentScopedResources = derived.useEnvironmentScopedResources;
   await config.saveConfig(cfg);
   await syncPlatformControllerUrlsInConfig();