@aifabrix/builder 2.47.4 → 2.49.0

package/lib/commands/setup.js

@@ -29,7 +29,9 @@ const {
 
 const setupPrompts = require('./setup-prompts');
 const setupPlatformModePrompts = require('./setup-prompts-platform-mode');
-const { flagsForSetupPlatformMode } = require('../core/setup-platform-mode');
+const {
+  applyPlatformTopologyFlagsToConfig
+} = require('../core/setup-platform-mode');
 const setupModes = require('./setup-modes');
 const { syncPlatformControllerUrlsInConfig } = require('./setup-platform-auth');
 const installationLog = require('../utils/installation-log');
@@ -37,6 +39,11 @@ const { beginSetupCommandFlow, endSetupCommandFlow } = require('./setup-run-cont
 
 const MODE = setupPrompts.MODE;
 
+const CLI_SETUP_MODES = Object.freeze({
+  FRESH: 'fresh',
+  UPDATE_IMAGES: 'update-images'
+});
+
 const SEPARATOR = '────────────────────────────────────────';
 
 function title(text) {
@@ -58,14 +65,53 @@ async function maybePinDeveloperIdForFreshInstall(rawDeveloper) {
   logger.log(infoLine(`Developer ID pinned to ${dev}.`));
 }
 
+/**
+ * @param {Object} options
+ * @returns {'fresh'|'update-images'|null}
+ */
+function normalizeCliMode(options) {
+  const raw = options.mode ?? options.setupMode;
+  if (raw === undefined || raw === null || String(raw).trim() === '') {
+    return null;
+  }
+  const mode = String(raw).trim().toLowerCase();
+  if (mode === CLI_SETUP_MODES.FRESH || mode === CLI_SETUP_MODES.UPDATE_IMAGES) {
+    return mode;
+  }
+  throw new Error(`Invalid --mode "${raw}". Use fresh or update-images.`);
+}
+
+/**
+ * Non-interactive path when --mode is set (af-server automation).
+ * @param {Object} options
+ * @param {'fresh'|'update-images'} cliMode
+ * @returns {Promise<{ outcome: string, setupMode: string }>}
+ */
+async function runSetupWithCliMode(options, cliMode) {
+  logSetupHeader();
+  logger.log(formatProgress('Detecting current installation state...'));
+  const running = await isInfraRunning();
+  if (cliMode === CLI_SETUP_MODES.FRESH) {
+    if (running) {
+      throw new Error(
+        'Infrastructure is already running; use --mode update-images or run teardown first.'
+      );
+    }
+    await runFreshInstallFlow(options);
+    return { outcome: 'success', setupMode: CLI_SETUP_MODES.FRESH };
+  }
+  if (!running) {
+    throw new Error('No infrastructure running; use --mode fresh for first-time install.');
+  }
+  await dispatchMode(MODE.UPDATE_IMAGES);
+  logger.log(formatSuccessParagraph(`aifabrix setup complete (mode: ${cliMode}).`));
+  return { outcome: 'success', setupMode: cliMode };
+}
+
 async function applySetupPlatformMode(options) {
   const mode = await setupPlatformModePrompts.promptSetupPlatformMode(options);
-  await config.setSetupPlatformMode(mode);
-  const derived = flagsForSetupPlatformMode(mode);
-  // These are the user gates that control full-mode behavior.
   const cfg = await config.getConfig();
-  cfg.traefik = derived.traefik;
-  cfg.useEnvironmentScopedResources = derived.useEnvironmentScopedResources;
+  applyPlatformTopologyFlagsToConfig(cfg, mode);
   await config.saveConfig(cfg);
   await syncPlatformControllerUrlsInConfig();
   return mode;
@@ -149,6 +195,11 @@ async function dispatchMode(mode) {
  * @returns {Promise<{ outcome: string, setupMode: string|null }>}
  */
 async function runSetupMainPath(options, assumeYes) {
+  const cliMode = normalizeCliMode(options);
+  if (cliMode) {
+    return runSetupWithCliMode(options, cliMode);
+  }
+
   logSetupHeader();
   logger.log(formatProgress('Detecting current installation state...'));
   const running = await isInfraRunning();
@@ -272,5 +323,7 @@ async function handleSetup(options = {}) {
 module.exports = {
   handleSetup,
   isInfraRunning,
-  dispatchMode
+  dispatchMode,
+  normalizeCliMode,
+  CLI_SETUP_MODES
 };

package/lib/commands/up-dataplane-bootstrap.js

@@ -0,0 +1,149 @@
+/**
+ * Headless dataplane bootstrap provisioning (plan 197.0).
+ *
+ * @fileoverview up-dataplane bootstrap path when Docker + ENCRYPTION_KEY available
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const config = require('../core/config');
+const dockerUtils = require('../utils/docker');
+const { loadSecrets } = require('../core/secrets-load');
+const { callBootstrapApi } = require('../utils/app-bootstrap-api');
+const {
+  loadVariablesYaml,
+  extractAppConfiguration
+} = require('../utils/app-register-config');
+const { buildRegistrationData, saveLocalCredentials, applyLocalhostPortAdjustment } = require('../app/register');
+const { loadDataplanePipelineCredentialsFromSecretsFile } = require('./up-dataplane-credentials');
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+
+const ENCRYPTION_VAULT_KEYS = [
+  'miso-controller-secrets-encryptionKeyVault',
+  'secrets-encryptionKeyVault'
+];
+
+/**
+ * @param {Record<string, unknown>} secrets
+ * @returns {string|null}
+ */
+function pickBootstrapEncryptionKeyFromSecrets(secrets) {
+  if (!secrets || typeof secrets !== 'object') {
+    return null;
+  }
+  for (const vaultKey of ENCRYPTION_VAULT_KEYS) {
+    const raw = secrets[vaultKey];
+    if (raw === undefined || raw === null) {
+      continue;
+    }
+    const trimmed = String(raw).trim();
+    if (trimmed) {
+      return trimmed;
+    }
+  }
+  return null;
+}
+
+/**
+ * Resolve shared ENCRYPTION_KEY for bootstrap header (never log).
+ * Uses the same merged secrets store as kv:// resolution (local + aifabrix-secrets / remote API).
+ * Must match miso-controller `ENCRYPTION_KEY` (kv://miso-controller-secrets-encryptionKeyVault),
+ * not `secrets-encryption` in config.yaml (CLI file-encryption key only).
+ *
+ * @async
+ * @returns {Promise<string|null>}
+ */
+async function resolveBootstrapEncryptionKey() {
+  await config.ensureSecretsEncryptionKey();
+  const secrets = await loadSecrets(undefined);
+  return pickBootstrapEncryptionKeyFromSecrets(secrets);
+}
+
+/**
+ * True when bootstrap path is eligible (dev + Docker + encryption key).
+ * @async
+ * @param {Object} [options]
+ * @returns {Promise<boolean>}
+ */
+async function canUseBootstrapProvision(options = {}) {
+  if (options.allowNonDev === true) {
+    return false;
+  }
+  const cfg = await config.getConfig();
+  const environment = cfg && cfg.environment ? cfg.environment : 'dev';
+  if (environment !== 'dev') {
+    return false;
+  }
+  try {
+    await dockerUtils.ensureDockerAndCompose();
+  } catch {
+    return false;
+  }
+  const encryptionKey = await resolveBootstrapEncryptionKey();
+  return Boolean(encryptionKey);
+}
+
+/**
+ * Register dataplane via bootstrap endpoint (idempotent).
+ * @async
+ * @param {Object} options - up-dataplane options
+ * @param {string} controllerUrl
+ * @param {string} environmentKey
+ * @param {Function} buildDataplaneImageRefFn
+ * @returns {Promise<void>}
+ */
+async function bootstrapDataplaneApplication(options, controllerUrl, environmentKey, buildDataplaneImageRefFn) {
+  const encryptionKey = await resolveBootstrapEncryptionKey();
+  if (!encryptionKey) {
+    throw new Error(
+      'Bootstrap encryption key is not available. Ensure miso-controller-secrets-encryptionKeyVault ' +
+        'exists in merged secrets (local secrets.local.yaml or aifabrix-secrets remote store) after up-miso resolve.'
+    );
+  }
+
+  const { variables } = await loadVariablesYaml('dataplane');
+  const appConfig = await extractAppConfiguration(variables, 'dataplane', options);
+  await applyLocalhostPortAdjustment(appConfig, controllerUrl, options);
+
+  const imageOverride = options.image || buildDataplaneImageRefFn(options);
+  const registerOpts = {
+    imageOverride,
+    image: imageOverride,
+    registryMode: options.registryMode,
+    envKey: environmentKey
+  };
+  const registrationData = buildRegistrationData(appConfig, registerOpts);
+
+  logger.log(chalk.blue('Provisioning dataplane via bootstrap (no device login)...'));
+  const responseData = await callBootstrapApi(
+    controllerUrl,
+    encryptionKey,
+    environmentKey,
+    registrationData
+  );
+
+  if (responseData.credentials && responseData.credentials.clientSecret) {
+    await saveLocalCredentials(responseData, controllerUrl);
+    logger.log(formatSuccessLine('Dataplane bootstrap credentials saved locally'));
+  } else if (responseData.status === 'already_provisioned') {
+    logger.log(formatSuccessLine('Dataplane already provisioned (bootstrap idempotent)'));
+    const localCredentials = await loadDataplanePipelineCredentialsFromSecretsFile();
+    if (!localCredentials) {
+      throw new Error(
+        'Dataplane is registered on the controller but pipeline credentials are missing locally. ' +
+          'Run fresh setup with volume wipe, or: aifabrix login && aifabrix app rotate-secret dataplane'
+      );
+    }
+  }
+}
+
+module.exports = {
+  canUseBootstrapProvision,
+  resolveBootstrapEncryptionKey,
+  bootstrapDataplaneApplication,
+  pickBootstrapEncryptionKeyFromSecrets
+};

package/lib/commands/up-dataplane-credentials.js

@@ -16,12 +16,22 @@ const { loadClientCredentials } = require('../utils/token-manager');
 const { rotateSecret } = require('../app/rotate-secret');
 const logger = require('../utils/logger');
 const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+const {
+  resolveLocalhostPlatformControllerUrl,
+  resolveCliPlatformControllerUrl
+} = require('../utils/platform-controller-url');
 
 const DATAPLANE_APP_KEY = 'dataplane';
 const MISALIGN_ERROR =
   'Dataplane pipeline credentials are not aligned with the controller. ' +
   'Run: aifabrix app rotate-secret dataplane && aifabrix run dataplane';
 
+const BOOTSTRAP_MISALIGN_ERROR =
+  'Dataplane bootstrap credentials are not accepted by the controller after deploy. ' +
+  'Ensure miso-controller has BOOTSTRAP_APPKEYS=dataplane and ENCRYPTION_KEY set, then re-run: aifabrix up-dataplane';
+
+const BOOTSTRAP_PROBE_RETRY = { maxAttempts: 15, delayMs: 3000 };
+
 /**
  * @param {string} controllerUrl
  * @returns {string}
@@ -30,6 +40,31 @@ function normalizeControllerUrl(controllerUrl) {
   return String(controllerUrl || '').replace(/\/+$/, '');
 }
 
+/**
+ * Controller bases to try for token probe (public Traefik, CLI-resolved, localhost).
+ * @async
+ * @param {string} controllerUrl
+ * @returns {Promise<string[]>}
+ */
+async function resolveControllerUrlsForCredentialProbe(controllerUrl) {
+  const urls = [];
+  const add = (url) => {
+    const normalized = normalizeControllerUrl(url);
+    if (normalized && !urls.includes(normalized)) {
+      urls.push(normalized);
+    }
+  };
+
+  add(controllerUrl);
+  try {
+    add(await resolveCliPlatformControllerUrl());
+    add(await resolveLocalhostPlatformControllerUrl());
+  } catch {
+    // optional fallbacks only
+  }
+  return urls;
+}
+
 /**
  * Exchange dataplane client id/secret for a controller token (probe only).
  * @async
@@ -52,17 +87,69 @@ async function probeDataplaneClientToken(controllerUrl, credentials) {
   return response.success === true;
 }
 
+/**
+ * Load dataplane pipeline credentials from secrets.local.yaml only (ignore process env).
+ * @async
+ * @returns {Promise<{ clientId: string, clientSecret: string }|null>}
+ */
+async function loadDataplanePipelineCredentialsFromSecretsFile() {
+  return loadClientCredentials(DATAPLANE_APP_KEY, { secretsFileOnly: true });
+}
+
+/**
+ * @param {number} ms
+ * @returns {Promise<void>}
+ */
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * Probe token endpoint with retries (controller Redis may briefly serve stale pipeline config).
+ * @async
+ * @param {string} controllerUrl
+ * @param {number} [maxAttempts]
+ * @param {number} [delayMs]
+ * @returns {Promise<boolean>}
+ */
+async function credentialsAcceptTokenWithRetry(controllerUrl, maxAttempts = 5, delayMs = 2000) {
+  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+    if (await credentialsAcceptToken(controllerUrl)) {
+      return true;
+    }
+    if (attempt < maxAttempts - 1 && delayMs > 0) {
+      await sleep(delayMs);
+    }
+  }
+  return false;
+}
+
+function resolveCredentialProbeRetry(options = {}) {
+  const retry = options.credentialProbeRetry || {};
+  const bootstrapDefaults = options.useBootstrap === true ? BOOTSTRAP_PROBE_RETRY : { maxAttempts: 5, delayMs: 2000 };
+  return {
+    maxAttempts: Number.isFinite(retry.maxAttempts) ? retry.maxAttempts : bootstrapDefaults.maxAttempts,
+    delayMs: Number.isFinite(retry.delayMs) ? retry.delayMs : bootstrapDefaults.delayMs
+  };
+}
+
 /**
  * @async
  * @param {string} controllerUrl
  * @returns {Promise<boolean>}
  */
 async function credentialsAcceptToken(controllerUrl) {
-  const credentials = await loadClientCredentials(DATAPLANE_APP_KEY);
+  const credentials = await loadDataplanePipelineCredentialsFromSecretsFile();
   if (!credentials) {
     return false;
   }
-  return probeDataplaneClientToken(controllerUrl, credentials);
+  const urls = await resolveControllerUrlsForCredentialProbe(controllerUrl);
+  for (const url of urls) {
+    if (await probeDataplaneClientToken(url, credentials)) {
+      return true;
+    }
+  }
+  return false;
 }
 
 /**
@@ -75,7 +162,12 @@ async function credentialsAcceptToken(controllerUrl) {
  */
 async function alignDataplaneCredentialsAfterDeploy(options, controllerUrl) {
   const quiet = options.platformInstall === true || options.quiet === true;
-  const aligned = await credentialsAcceptToken(controllerUrl);
+  const bootstrapPath = options.useBootstrap === true;
+  const { maxAttempts, delayMs } = resolveCredentialProbeRetry(options);
+
+  const aligned = bootstrapPath
+    ? await credentialsAcceptTokenWithRetry(controllerUrl, maxAttempts, delayMs)
+    : await credentialsAcceptToken(controllerUrl);
   if (aligned) {
     if (!quiet) {
       logger.log(formatSuccessLine('Dataplane pipeline credentials verified.'));
@@ -83,12 +175,16 @@ async function alignDataplaneCredentialsAfterDeploy(options, controllerUrl) {
     return;
   }
 
+  if (bootstrapPath) {
+    throw new Error(BOOTSTRAP_MISALIGN_ERROR);
+  }
+
   if (!quiet) {
     logger.log(chalk.blue('Aligning dataplane pipeline credentials with controller...'));
   }
-  await rotateSecret(DATAPLANE_APP_KEY, { ...options, quiet });
+  await rotateSecret(DATAPLANE_APP_KEY, { ...options, quiet, exitOnFailure: false });
 
-  const stillMisaligned = !(await credentialsAcceptToken(controllerUrl));
+  const stillMisaligned = !(await credentialsAcceptTokenWithRetry(controllerUrl, maxAttempts, delayMs));
   if (stillMisaligned) {
     throw new Error(MISALIGN_ERROR);
   }
@@ -100,5 +196,7 @@ async function alignDataplaneCredentialsAfterDeploy(options, controllerUrl) {
 module.exports = {
   alignDataplaneCredentialsAfterDeploy,
   probeDataplaneClientToken,
-  credentialsAcceptToken
+  credentialsAcceptToken,
+  loadDataplanePipelineCredentialsFromSecretsFile,
+  resolveControllerUrlsForCredentialProbe
 };

package/lib/commands/up-dataplane.js

@@ -35,6 +35,10 @@ const {
   refreshUrlsLocalRegistryForCurrentProject
 } = require('./up-common');
 const { alignDataplaneCredentialsAfterDeploy } = require('./up-dataplane-credentials');
+const {
+  canUseBootstrapProvision,
+  bootstrapDataplaneApplication
+} = require('./up-dataplane-bootstrap');
 
 const CONTROLLER_HEALTH_PATH = '/health';
 
@@ -120,7 +124,9 @@ async function resolveUpDataplaneAuthContext(options, environmentKey) {
   if (options.allowNonDev !== true) {
     assertDevEnvironmentForDataplane(cfg);
   }
-  logger.log(formatSuccessLine(`Logged in (environment: ${environmentKey})`));
+  if (options.platformInstall !== true) {
+    logger.log(formatSuccessLine(`Logged in (environment: ${environmentKey})`));
+  }
   return { controllerUrl, authConfig };
 }
 
@@ -223,6 +229,57 @@ async function computeDataplaneRunOverrides(options) {
   return { runEnvKey, portOverride };
 }
 
+/**
+ * Resolve controller URL and auth for bootstrap vs device-login paths.
+ * @async
+ * @param {Object} options
+ * @param {string} environmentKey
+ * @returns {Promise<{ controllerUrl: string, authConfig: Object|null, useBootstrap: boolean }>}
+ */
+async function resolveUpDataplaneControllerContext(options, environmentKey) {
+  const useBootstrap = await canUseBootstrapProvision(options);
+  if (useBootstrap) {
+    if (options.skipInfraCheck !== true) {
+      await assertDevInfraUp();
+    }
+    const controllerUrl = await resolveControllerUrlWithHealthCheck();
+    const cfg = await config.getConfig();
+    if (options.allowNonDev !== true) {
+      assertDevEnvironmentForDataplane(cfg);
+    }
+    if (options.platformInstall !== true) {
+      logger.log(formatSuccessLine('Using bootstrap provision (no device login)'));
+    }
+    return { controllerUrl, authConfig: null, useBootstrap: true };
+  }
+
+  const authContext = await resolveUpDataplaneAuthContext(options, environmentKey);
+  return {
+    controllerUrl: authContext.controllerUrl,
+    authConfig: authContext.authConfig,
+    useBootstrap: false
+  };
+}
+
+/**
+ * Register/bootstrap, deploy manifest, align credentials.
+ * @async
+ */
+async function provisionAndDeployDataplane(options, environmentKey, controllerUrl, useBootstrap, authConfig) {
+  if (useBootstrap) {
+    await bootstrapDataplaneApplication(options, controllerUrl, environmentKey, buildDataplaneImageRef);
+  } else {
+    await registerOrRotateDataplane(options, controllerUrl, environmentKey, authConfig);
+  }
+
+  await deployDataplaneToController({
+    ...options,
+    envKey: environmentKey,
+    ...(useBootstrap ? { deploymentAuth: 'client-credentials' } : {})
+  });
+  logger.log('');
+}
+
 /**
  * Handle up-dataplane command: ensure logged in, environment dev, ensure dataplane,
  * register or rotate (if already registered), deploy (send manifest to controller),
@@ -239,30 +296,34 @@ async function computeDataplaneRunOverrides(options) {
  * @throws {Error} If infra not up, controller unavailable, not logged in, environment not dev, or any step fails
  */
 async function handleUpDataplane(options = {}) {
-  logger.log(chalk.blue('Starting up-dataplane (register/rotate, deploy, then run dataplane locally)...\n'));
+  if (options.platformInstall !== true) {
+    logger.log(chalk.blue('Starting up-dataplane (register/rotate, deploy, then run dataplane locally)...\n'));
+  }
 
   const environmentKey =
     options && options.envKey
       ? String(options.envKey).trim().toLowerCase()
       : await resolveEnvironment();
-  const { controllerUrl, authConfig } = await resolveUpDataplaneAuthContext(options, environmentKey);
+
+  const { controllerUrl, authConfig, useBootstrap } = await resolveUpDataplaneControllerContext(
+    options,
+    environmentKey
+  );
 
   await ensureDataplaneAppsFromTemplate();
-  // If envOutputPath target folder does not exist, set envOutputPath to null
   validateEnvOutputPathFolderOrNull('dataplane');
-
   refreshUrlsLocalRegistryForCurrentProject();
 
   if (options.platformInstall !== true) {
     emitDataplaneManifestLineFromBuilder();
   }
 
-  await registerOrRotateDataplane(options, controllerUrl, environmentKey, authConfig);
+  await provisionAndDeployDataplane(options, environmentKey, controllerUrl, useBootstrap, authConfig);
 
-  await deployDataplaneToController({ ...options, envKey: environmentKey });
-  logger.log('');
-
-  await alignDataplaneCredentialsAfterDeploy(options, controllerUrl);
+  await alignDataplaneCredentialsAfterDeploy(
+    { ...options, useBootstrap },
+    controllerUrl
+  );
 
   const { runEnvKey, portOverride } = await computeDataplaneRunOverrides(options);
 
@@ -275,7 +336,9 @@ async function handleUpDataplane(options = {}) {
     skipManifestMetadataLine: true
   });
 
-  logger.log(formatSuccessParagraph('up-dataplane complete. Dataplane is registered, deployed in dev, and running locally.'));
+  if (options.platformInstall !== true) {
+    logger.log(formatSuccessParagraph('up-dataplane complete. Dataplane is registered, deployed in dev, and running locally.'));
+  }
 }
 
 module.exports = { handleUpDataplane, buildDataplaneImageRef };

package/lib/core/secrets-env-declarative-expand.js

@@ -14,6 +14,30 @@ const { readAppEnvironmentScopedFlagForAppPath } = require('../utils/app-scoped-
 const { expandDeclarativeUrlsInEnvContent } = require('../utils/url-declarative-resolve');
 const { rewriteInactiveDeclarativeVdirPublicContent } = require('../utils/url-declarative-vdir-inactive-env');
 const { refreshUrlsLocalRegistryFromBuilder } = require('../utils/urls-local-registry');
+
+/**
+ * @param {() => Promise<*>} getter
+ * @param {*} [fallback]
+ * @returns {Promise<*>}
+ */
+async function tryConfigValue(getter, fallback = null) {
+  try {
+    return await getter();
+  } catch {
+    return fallback;
+  }
+}
+
+/**
+ * @param {() => Promise<*>} getter
+ * @returns {Promise<string|null>}
+ */
+async function tryConfigTrimmedString(getter) {
+  const value = await tryConfigValue(getter, null);
+  const trimmed = value !== null && value !== undefined ? String(value).trim() : '';
+  return trimmed || null;
+}
+
 /**
  * Config inputs for declarative url:// expansion.
  * @param {string} appPath
@@ -21,30 +45,16 @@ const { refreshUrlsLocalRegistryFromBuilder } = require('../utils/urls-local-reg
  */
 async function loadDeclarativeUrlExpandInputs(appPath) {
   const userCfg = await config.getConfig();
-  let remoteServer = null;
-  try {
-    const rs = await config.getRemoteServer();
-    if (rs && String(rs).trim()) {
-      remoteServer = String(rs).trim();
-    }
-  } catch {
-    remoteServer = null;
-  }
-  let developerIdRaw = null;
-  try {
-    developerIdRaw = await config.getDeveloperId();
-  } catch {
-    developerIdRaw = null;
-  }
-  let infraTlsEnabled = false;
-  try {
-    infraTlsEnabled = await config.getTlsEnabled();
-  } catch {
-    infraTlsEnabled = false;
-  }
+  const [remoteServer, developerRootDomain, developerIdRaw, infraTlsEnabled] = await Promise.all([
+    tryConfigTrimmedString(() => config.getRemoteServer()),
+    tryConfigTrimmedString(() => config.getDeveloperRootDomain()),
+    tryConfigValue(() => config.getDeveloperId(), null),
+    tryConfigValue(() => config.getTlsEnabled(), false)
+  ]);
   return {
     userCfg,
     remoteServer,
+    developerRootDomain,
     developerIdRaw,
     infraTlsEnabled,
     appScopedFlag: readAppEnvironmentScopedFlagForAppPath(appPath)
@@ -60,7 +70,7 @@ async function loadDeclarativeUrlExpandInputs(appPath) {
  * @returns {Object}
  */
 function buildDeclarativeUrlExpandContextFromInputs(appName, variablesPath, environment, inputs) {
-  const { userCfg, remoteServer, developerIdRaw, infraTlsEnabled, appScopedFlag } = inputs;
+  const { userCfg, remoteServer, developerRootDomain, developerIdRaw, infraTlsEnabled, appScopedFlag } = inputs;
   let projectRoot = null;
   try {
     const r = pathsUtil.getProjectRoot();
@@ -77,6 +87,7 @@ function buildDeclarativeUrlExpandContextFromInputs(appName, variablesPath, envi
     useEnvironmentScopedResources: Boolean(userCfg.useEnvironmentScopedResources),
     appEnvironmentScopedResources: appScopedFlag,
     remoteServer,
+    developerRootDomain,
     developerIdRaw,
     infraTlsEnabled,
     userCfg,
@@ -136,12 +147,13 @@ async function expandDeclarativeUrlsIfPresent(resolved, appName, appPath, variab
   if (envOnly || !variablesPath) {
     return resolved;
   }
-  const { userCfg, remoteServer, developerIdRaw, infraTlsEnabled, appScopedFlag } =
+  const { userCfg, remoteServer, developerRootDomain, developerIdRaw, infraTlsEnabled, appScopedFlag } =
     await loadDeclarativeUrlExpandInputs(appPath);
   resolved = rewriteInactiveDeclarativeVdirPublicContent(resolved, variablesPath, userCfg);
   const ctx = buildDeclarativeUrlExpandContextFromInputs(appName, variablesPath, environment, {
     userCfg,
     remoteServer,
+    developerRootDomain,
     developerIdRaw,
     infraTlsEnabled,
     appScopedFlag