@aifabrix/builder 2.48.0 → 2.49.0

package/lib/core/secrets-env-declarative-expand.js

@@ -14,6 +14,30 @@ const { readAppEnvironmentScopedFlagForAppPath } = require('../utils/app-scoped-
 const { expandDeclarativeUrlsInEnvContent } = require('../utils/url-declarative-resolve');
 const { rewriteInactiveDeclarativeVdirPublicContent } = require('../utils/url-declarative-vdir-inactive-env');
 const { refreshUrlsLocalRegistryFromBuilder } = require('../utils/urls-local-registry');
+
+/**
+ * @param {() => Promise<*>} getter
+ * @param {*} [fallback]
+ * @returns {Promise<*>}
+ */
+async function tryConfigValue(getter, fallback = null) {
+  try {
+    return await getter();
+  } catch {
+    return fallback;
+  }
+}
+
+/**
+ * @param {() => Promise<*>} getter
+ * @returns {Promise<string|null>}
+ */
+async function tryConfigTrimmedString(getter) {
+  const value = await tryConfigValue(getter, null);
+  const trimmed = value !== null && value !== undefined ? String(value).trim() : '';
+  return trimmed || null;
+}
+
 /**
  * Config inputs for declarative url:// expansion.
  * @param {string} appPath
@@ -21,30 +45,16 @@ const { refreshUrlsLocalRegistryFromBuilder } = require('../utils/urls-local-reg
  */
 async function loadDeclarativeUrlExpandInputs(appPath) {
   const userCfg = await config.getConfig();
-  let remoteServer = null;
-  try {
-    const rs = await config.getRemoteServer();
-    if (rs && String(rs).trim()) {
-      remoteServer = String(rs).trim();
-    }
-  } catch {
-    remoteServer = null;
-  }
-  let developerIdRaw = null;
-  try {
-    developerIdRaw = await config.getDeveloperId();
-  } catch {
-    developerIdRaw = null;
-  }
-  let infraTlsEnabled = false;
-  try {
-    infraTlsEnabled = await config.getTlsEnabled();
-  } catch {
-    infraTlsEnabled = false;
-  }
+  const [remoteServer, developerRootDomain, developerIdRaw, infraTlsEnabled] = await Promise.all([
+    tryConfigTrimmedString(() => config.getRemoteServer()),
+    tryConfigTrimmedString(() => config.getDeveloperRootDomain()),
+    tryConfigValue(() => config.getDeveloperId(), null),
+    tryConfigValue(() => config.getTlsEnabled(), false)
+  ]);
   return {
     userCfg,
     remoteServer,
+    developerRootDomain,
     developerIdRaw,
     infraTlsEnabled,
     appScopedFlag: readAppEnvironmentScopedFlagForAppPath(appPath)
@@ -60,7 +70,7 @@ async function loadDeclarativeUrlExpandInputs(appPath) {
  * @returns {Object}
  */
 function buildDeclarativeUrlExpandContextFromInputs(appName, variablesPath, environment, inputs) {
-  const { userCfg, remoteServer, developerIdRaw, infraTlsEnabled, appScopedFlag } = inputs;
+  const { userCfg, remoteServer, developerRootDomain, developerIdRaw, infraTlsEnabled, appScopedFlag } = inputs;
   let projectRoot = null;
   try {
     const r = pathsUtil.getProjectRoot();
@@ -77,6 +87,7 @@ function buildDeclarativeUrlExpandContextFromInputs(appName, variablesPath, envi
     useEnvironmentScopedResources: Boolean(userCfg.useEnvironmentScopedResources),
     appEnvironmentScopedResources: appScopedFlag,
     remoteServer,
+    developerRootDomain,
     developerIdRaw,
     infraTlsEnabled,
     userCfg,
@@ -136,12 +147,13 @@ async function expandDeclarativeUrlsIfPresent(resolved, appName, appPath, variab
   if (envOnly || !variablesPath) {
     return resolved;
   }
-  const { userCfg, remoteServer, developerIdRaw, infraTlsEnabled, appScopedFlag } =
+  const { userCfg, remoteServer, developerRootDomain, developerIdRaw, infraTlsEnabled, appScopedFlag } =
     await loadDeclarativeUrlExpandInputs(appPath);
   resolved = rewriteInactiveDeclarativeVdirPublicContent(resolved, variablesPath, userCfg);
   const ctx = buildDeclarativeUrlExpandContextFromInputs(appName, variablesPath, environment, {
     userCfg,
     remoteServer,
+    developerRootDomain,
     developerIdRaw,
     infraTlsEnabled,
     appScopedFlag

package/lib/core/setup-platform-mode.js

@@ -61,6 +61,46 @@ function flagsForSetupPlatformMode(mode) {
   };
 }
 
+/** Platform app keys (setup does not modify `applications.<key>.proxy`; use `aifabrix run --proxy` / `--no-proxy`). */
+const PLATFORM_APPLICATION_KEYS = Object.freeze(['keycloak', 'miso-controller', 'dataplane']);
+
+/**
+ * Apply setup platform mode to config.yaml infra topology (`traefik`, `tlsEnabled`, env scope).
+ * Does **not** change per-app `applications.<key>.proxy` — that is owned by `aifabrix run`.
+ *
+ * @param {Object} cfg - Mutable config root
+ * @param {unknown} mode
+ * @returns {Object} Same cfg reference
+ */
+function applyPlatformTopologyFlagsToConfig(cfg, mode) {
+  const normalized = normalizeSetupPlatformMode(mode);
+  const derived = flagsForSetupPlatformMode(normalized);
+  cfg.setupPlatformMode = normalized;
+  cfg.traefik = derived.traefik;
+  cfg.tlsEnabled = derived.tlsEnabled;
+  cfg.useEnvironmentScopedResources = derived.useEnvironmentScopedResources;
+  return cfg;
+}
+
+/**
+ * True when persisted traefik/tls/env-scope flags disagree with setupPlatformMode.
+ *
+ * @param {Object} cfg
+ * @returns {boolean}
+ */
+function platformTopologyNeedsReconcile(cfg) {
+  if (!cfg || typeof cfg !== 'object' || !cfg.setupPlatformMode) {
+    return false;
+  }
+  const expected = flagsForSetupPlatformMode(cfg.setupPlatformMode || SETUP_PLATFORM_MODE.SINGLE);
+  if (Boolean(cfg.traefik) !== Boolean(expected.traefik)) return true;
+  if (Boolean(cfg.tlsEnabled) !== Boolean(expected.tlsEnabled)) return true;
+  if (Boolean(cfg.useEnvironmentScopedResources) !== Boolean(expected.useEnvironmentScopedResources)) {
+    return true;
+  }
+  return false;
+}
+
 /**
  * Interactive setup menu choices (full platform hidden until multi-env path ships).
  * Traefik front door requires `remote-server` (from `aifabrix dev init`); without it only direct ports is offered.
@@ -90,8 +130,11 @@ function getSetupPlatformModePromptChoices(opts = {}) {
 module.exports = {
   SETUP_PLATFORM_MODE,
   SETUP_PLATFORM_MODE_CLI_VALUES,
+  PLATFORM_APPLICATION_KEYS,
   normalizeSetupPlatformMode,
   flagsForSetupPlatformMode,
+  applyPlatformTopologyFlagsToConfig,
+  platformTopologyNeedsReconcile,
   getSetupPlatformModePromptChoices
 };
 

package/lib/deployment/deployer-status.js

@@ -18,15 +18,37 @@ function isTerminalStatus(status) {
   return status === 'completed' || status === 'failed' || status === 'cancelled';
 }
 
+/**
+ * True when pipeline calls should authenticate with a token header only (Bearer or x-client-token).
+ * @param {Object} authConfig
+ * @returns {boolean}
+ */
+function isTokenOnlyPipelineAuth(authConfig) {
+  if (!authConfig || !authConfig.token) {
+    return false;
+  }
+  if (authConfig.clientId || authConfig.clientSecret) {
+    return false;
+  }
+  return authConfig.type === 'bearer' || authConfig.type === 'client-token';
+}
+
 /**
  * Convert authConfig to pipeline auth config format
  * @param {Object} authConfig - Authentication configuration
  * @returns {Object} Pipeline auth config
  */
 function convertToPipelineAuthConfig(authConfig) {
-  return authConfig.type === 'bearer'
-    ? { type: 'bearer', token: authConfig.token }
-    : { type: 'client-credentials', clientId: authConfig.clientId, clientSecret: authConfig.clientSecret };
+  if (isTokenOnlyPipelineAuth(authConfig)) {
+    return authConfig.type === 'client-token'
+      ? { type: 'client-token', token: authConfig.token }
+      : { type: 'bearer', token: authConfig.token };
+  }
+  return {
+    type: 'client-credentials',
+    clientId: authConfig.clientId,
+    clientSecret: authConfig.clientSecret
+  };
 }
 
 /**
@@ -118,6 +140,7 @@ async function processDeploymentStatusResponse(
 
 module.exports = {
   isTerminalStatus,
+  isTokenOnlyPipelineAuth,
   convertToPipelineAuthConfig,
   handleDeploymentStatusError,
   extractDeploymentData,

package/lib/deployment/deployer.js

@@ -20,7 +20,8 @@ const { getAuthUser } = require('../api/auth.api');
 const { handleValidationResponse } = require('../utils/deployment-validation-helpers');
 const {
   convertToPipelineAuthConfig,
-  processDeploymentStatusResponse
+  processDeploymentStatusResponse,
+  isTokenOnlyPipelineAuth
 } = require('./deployer-status');
 const { resolvePollIntervalFromController } = require('./poll-interval');
 const { createDeployPollHandlers } = require('./deploy-poll-ui');
@@ -54,8 +55,8 @@ async function buildValidationData(manifest, validatedEnvKey, authConfig, option
     manifest?.repository?.repositoryUrl ||
     `https://github.com/aifabrix/${manifest.key}`;
 
-  if (authConfig.type === 'bearer' && authConfig.token && !authConfig.clientId) {
-    const pipelineAuthConfig = { type: 'bearer', token: authConfig.token };
+  if (isTokenOnlyPipelineAuth(authConfig)) {
+    const pipelineAuthConfig = convertToPipelineAuthConfig(authConfig);
     const validationData = {
       clientId: manifest.key,
       repositoryUrl,
@@ -181,15 +182,7 @@ function buildDeploymentData(validateToken, authConfig, options) {
     imageTag: imageTag
   };
 
-  const pipelineAuthConfig = authConfig.type === 'bearer' && authConfig.token && !authConfig.clientId
-    ? { type: 'bearer', token: authConfig.token }
-    : {
-      type: 'client-credentials',
-      clientId: authConfig.clientId,
-      clientSecret: authConfig.clientSecret
-    };
-
-  return { deployData, pipelineAuthConfig };
+  return { deployData, pipelineAuthConfig: convertToPipelineAuthConfig(authConfig) };
 }
 
 /**
@@ -254,8 +247,8 @@ async function sendDeploymentRequest(url, envKey, validateToken, authConfig, opt
   const validatedEnvKey = validateEnvironmentKey(envKey);
   const maxRetries = options.maxRetries || 3;
 
-  const useBearerOnly = authConfig.type === 'bearer' && authConfig.token && !authConfig.clientId;
-  if (!useBearerOnly) {
+  const useTokenOnlyAuth = isTokenOnlyPipelineAuth(authConfig);
+  if (!useTokenOnlyAuth) {
     validateDeploymentCredentials(authConfig);
   }
 

package/lib/external-system/download-helpers.js

@@ -16,6 +16,7 @@ const {
 } = require('../utils/cli-test-layout-chalk');
 const logger = require('../utils/logger');
 const { generateExternalReadmeContent } = require('../utils/external-readme');
+const { getAuthCredentialTemplate } = require('../utils/authentication-shape');
 
 /**
  * Validates system type from downloaded application
@@ -159,7 +160,15 @@ function generateReadme(systemKey, application, dataSources) {
     };
   });
 
-  const authType = application.authentication?.type || application.authentication?.method;
+  const auth = application.authentication;
+  let authType = auth?.authType;
+  if (auth?.authType === 'credential') {
+    authType = getAuthCredentialTemplate(auth)?.method || authType;
+  } else if (auth?.authType === 'apiProvider') {
+    authType = auth.apiProvider?.apiProviderKey || 'apiProvider';
+  } else {
+    authType = auth?.type || auth?.method || authType;
+  }
   return generateExternalReadmeContent({
     appName: systemKey,
     systemKey,

package/lib/infrastructure/compose.js

@@ -11,6 +11,9 @@
 const fs = require('fs');
 const handlebars = require('handlebars');
 const path = require('path');
+const {
+  writeTraefikTlsDynamicConfig
+} = require('./traefik-tls-dynamic');
 
 /**
  * Normalize a host path for Docker Compose bind mounts. Docker Desktop sends
@@ -91,6 +94,40 @@ function validateTraefikConfig(traefikConfig) {
   return { valid: errors.length === 0, errors };
 }
 
+/**
+ * Normalize Traefik config for compose template (bind mounts + dynamic TLS file).
+ *
+ * @param {string} infraDir
+ * @param {Object|boolean} traefikConfig
+ * @returns {Object|boolean}
+ */
+function buildTraefikComposeContext(infraDir, traefikConfig) {
+  if (!traefikConfig || typeof traefikConfig !== 'object') {
+    return traefikConfig;
+  }
+  const traefikForCompose = {
+    ...traefikConfig,
+    trustForwardedHeaders: !!traefikConfig.trustForwardedHeaders,
+    ...(traefikConfig.certFile
+      ? { certFile: toDockerBindMountSource(traefikConfig.certFile) }
+      : {}),
+    ...(traefikConfig.keyFile
+      ? { keyFile: toDockerBindMountSource(traefikConfig.keyFile) }
+      : {})
+  };
+  const tlsDynamic = writeTraefikTlsDynamicConfig(infraDir, traefikConfig);
+  if (!tlsDynamic) {
+    return traefikForCompose;
+  }
+  return {
+    ...traefikForCompose,
+    tlsDynamicBind: toDockerBindMountSource(tlsDynamic.hostPath),
+    tlsDynamicContainerPath: tlsDynamic.containerPath,
+    certContainerPath: tlsDynamic.certContainerPath,
+    keyContainerPath: tlsDynamic.keyContainerPath
+  };
+}
+
 /**
  * Generate docker-compose file from template
  * @param {string} templatePath - Path to compose template
@@ -129,21 +166,12 @@ function generateComposeFile(templatePath, devId, idNum, ports, infraDir, option
   const redisCommanderConfig = options.redisCommander && typeof options.redisCommander.enabled === 'boolean'
     ? options.redisCommander
     : { enabled: true };
-  const traefikForCompose = traefikConfig && typeof traefikConfig === 'object'
-    ? {
-      ...traefikConfig,
-      trustForwardedHeaders: !!traefikConfig.trustForwardedHeaders,
-      ...(traefikConfig.certFile
-        ? { certFile: toDockerBindMountSource(traefikConfig.certFile) }
-        : {}),
-      ...(traefikConfig.keyFile
-        ? { keyFile: toDockerBindMountSource(traefikConfig.keyFile) }
-        : {})
-    }
-    : traefikConfig;
+  const traefikForCompose = buildTraefikComposeContext(infraDir, traefikConfig);
   const initScriptsBind = toDockerBindMountSource(path.join(infraDir, 'init-scripts'));
   const composeContent = template({
     devId: devId,
+    idNum,
+    traefikScoped: idNum > 0,
     postgresPort: ports.postgres,
     redisPort: ports.redis,
     pgadminPort: ports.pgadmin,

package/lib/infrastructure/services.js

@@ -117,10 +117,12 @@ async function waitForServices(devId = null, opts = {}) {
   const maxAttempts = 30;
   const delay = 2000; // 2 seconds
   const { pgadmin = true, redisCommander = true, traefik = false } = opts;
+  let lastHealth = {};
 
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     const health = await checkInfraHealth(devId, { pgadmin, redisCommander, traefik });
-    const allHealthy = Object.values(health).every(status => status === 'healthy');
+    lastHealth = health;
+    const allHealthy = Object.values(health).every((status) => status === 'healthy');
 
     if (allHealthy) {
       return;
@@ -128,11 +130,21 @@ async function waitForServices(devId = null, opts = {}) {
 
     if (attempt < maxAttempts) {
       logger.log(`Waiting for services to be healthy... (${attempt}/${maxAttempts})`);
-      await new Promise(resolve => setTimeout(resolve, delay));
+      await new Promise((resolve) => setTimeout(resolve, delay));
     }
   }
 
-  throw new Error('Services failed to become healthy within timeout period');
+  const timeoutSec = (maxAttempts * delay) / 1000;
+  const unhealthy = Object.entries(lastHealth)
+    .filter(([, status]) => status !== 'healthy')
+    .map(([name, status]) => `${name}=${status}`)
+    .join(', ');
+  const detail = unhealthy || 'unknown';
+  throw new Error(
+    `Infrastructure services did not become healthy within ${timeoutSec}s. ` +
+      `Unhealthy: ${detail}. ` +
+      'Check container logs (e.g. `docker ps`, `aifabrix doctor`, or `aifabrix logs` for platform apps).'
+  );
 }
 
 /**

package/lib/infrastructure/traefik-tls-dynamic.js

@@ -0,0 +1,88 @@
+/**
+ * Traefik v3 dynamic TLS configuration (file provider).
+ * Static CLI flags for certificate stores were removed in Traefik v3.
+ *
+ * @fileoverview Write traefik-tls.yaml for infra compose
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const TRAEFIK_TLS_DYNAMIC_BASENAME = 'traefik-tls.yaml';
+const TRAEFIK_TLS_CONTAINER_PATH = '/etc/traefik/dynamic/tls.yaml';
+const TRAEFIK_CERT_CONTAINER_PATH = '/etc/traefik/certs/tls.crt';
+const TRAEFIK_KEY_CONTAINER_PATH = '/etc/traefik/certs/tls.key';
+
+/**
+ * @param {string} storeName
+ * @returns {string}
+ */
+function buildTraefikTlsDynamicYaml(storeName) {
+  const store = String(storeName || 'default').trim() || 'default';
+  const certLine = `        certFile: ${TRAEFIK_CERT_CONTAINER_PATH}`;
+  const keyLine = `        keyFile: ${TRAEFIK_KEY_CONTAINER_PATH}`;
+  const blocks = [
+    'tls:',
+    '  stores:',
+    '    default:',
+    '      defaultCertificate:',
+    certLine,
+    keyLine
+  ];
+  if (store !== 'default') {
+    blocks.push(`    ${store}:`);
+    blocks.push('      defaultCertificate:');
+    blocks.push(certLine);
+    blocks.push(keyLine);
+  }
+  return `${blocks.join('\n')}\n`;
+}
+
+/**
+ * @param {Object} traefikConfig
+ * @returns {boolean}
+ */
+function traefikConfigHasTlsFiles(traefikConfig) {
+  return Boolean(
+    traefikConfig &&
+      traefikConfig.certStore &&
+      traefikConfig.certFile &&
+      traefikConfig.keyFile
+  );
+}
+
+/**
+ * Write dynamic TLS config for Traefik file provider when cert store + files are set.
+ *
+ * @param {string} infraDir
+ * @param {Object} traefikConfig
+ * @returns {{ hostPath: string, containerPath: string, certContainerPath: string, keyContainerPath: string }|null}
+ */
+function writeTraefikTlsDynamicConfig(infraDir, traefikConfig) {
+  if (!traefikConfigHasTlsFiles(traefikConfig)) {
+    return null;
+  }
+  const hostPath = path.join(infraDir, TRAEFIK_TLS_DYNAMIC_BASENAME);
+  const content = buildTraefikTlsDynamicYaml(traefikConfig.certStore);
+  fs.writeFileSync(hostPath, content, { mode: 0o600 });
+  return {
+    hostPath,
+    containerPath: TRAEFIK_TLS_CONTAINER_PATH,
+    certContainerPath: TRAEFIK_CERT_CONTAINER_PATH,
+    keyContainerPath: TRAEFIK_KEY_CONTAINER_PATH
+  };
+}
+
+module.exports = {
+  TRAEFIK_TLS_DYNAMIC_BASENAME,
+  TRAEFIK_TLS_CONTAINER_PATH,
+  TRAEFIK_CERT_CONTAINER_PATH,
+  TRAEFIK_KEY_CONTAINER_PATH,
+  buildTraefikTlsDynamicYaml,
+  traefikConfigHasTlsFiles,
+  writeTraefikTlsDynamicConfig
+};

package/lib/utils/app-bootstrap-api.js

@@ -0,0 +1,53 @@
+const { formatBlockingError } = require('./cli-test-layout-chalk');
+/**
+ * Bootstrap API utilities for install-time application provisioning.
+ *
+ * @fileoverview Bootstrap API call helpers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+const chalk = require('chalk');
+const logger = require('./logger');
+const { bootstrapApplication } = require('../api/applications.api');
+const { formatApiError } = require('./api-error-handler');
+
+/**
+ * Call bootstrap provisioning API.
+ * @async
+ * @param {string} apiUrl - Controller URL
+ * @param {string} encryptionKey - Shared ENCRYPTION_KEY (never log)
+ * @param {string} environment - Environment key
+ * @param {Object} registrationData - Registration payload
+ * @returns {Promise<Object>} Application data (credentials only when newly created)
+ */
+async function callBootstrapApi(apiUrl, encryptionKey, environment, registrationData) {
+  try {
+    const response = await bootstrapApplication(apiUrl, environment, encryptionKey, registrationData);
+
+    if (!response.success) {
+      const formattedError = response.formattedError || formatApiError(response, apiUrl);
+      logger.error(formattedError);
+      logger.error(chalk.gray(`\nController URL: ${apiUrl}`));
+      throw new Error(formattedError);
+    }
+
+    const apiResponse = response.data;
+    if (apiResponse && apiResponse.data) {
+      return apiResponse.data;
+    }
+    if (apiResponse && (apiResponse.application || apiResponse.status)) {
+      return apiResponse;
+    }
+
+    logger.error(formatBlockingError('Invalid bootstrap response: missing application data'));
+    throw new Error('Invalid bootstrap response');
+  } catch (error) {
+    logger.error(formatBlockingError('Bootstrap API call failed'));
+    logger.error(chalk.gray(`Controller URL: ${apiUrl}`));
+    logger.error(chalk.gray(`Error: ${error.message}`));
+    throw error;
+  }
+}
+
+module.exports = { callBootstrapApi };

package/lib/utils/app-run-containers.js

@@ -136,10 +136,19 @@ async function checkContainerRunning(appName, developerId, debug = false, scopeO
  * @param {number|string} developerId - Developer ID (0 = default infra, > 0 = developer-specific; string allowed)
  * @param {boolean} [debug=false] - Enable debug logging
  */
-async function stopAndRemoveContainer(appName, developerId, debug = false, scopeOpts = null) {
+async function stopAndRemoveContainer(
+  appName,
+  developerId,
+  debug = false,
+  scopeOpts = null,
+  opts = {}
+) {
+  const suppressLog = opts && opts.suppressLog === true;
   try {
     const containerName = getContainerName(appName, developerId, scopeOpts);
-    logger.log(formatProgress(`Stopping container ${containerName}…`));
+    if (!suppressLog) {
+      logger.log(formatProgress(`Stopping container ${containerName}…`));
+    }
     const stopCmd = `docker stop ${containerName}`;
     if (debug) {
       logger.log(chalk.gray(`[DEBUG] Executing: ${stopCmd}`));
@@ -150,7 +159,9 @@ async function stopAndRemoveContainer(appName, developerId, debug = false, scope
       logger.log(chalk.gray(`[DEBUG] Executing: ${rmCmd}`));
     }
     await execWithDockerEnv(rmCmd);
-    logger.log(formatSuccessLine(`Container ${containerName} stopped and removed`));
+    if (!suppressLog) {
+      logger.log(formatSuccessLine(`Container ${containerName} stopped and removed`));
+    }
   } catch (error) {
     if (debug) {
       logger.log(chalk.gray(`[DEBUG] Stop/remove container error: ${error.message}`));

package/lib/utils/applications-config-defaults.js

@@ -120,8 +120,8 @@ function coerceTriStateBool(v) {
 }
 
 /**
- * Whether `aifabrix run` / resolve should use Traefik-style public URL hints for this app when infra allows.
- * Default **false** when unset. Legacy `noProxy: true` ⇒ false; legacy `noProxy: false` with no `proxy` ⇒ true.
+ * Stored per-app `proxy` preference from config (may be stale when `traefik: false`).
+ * Use {@link getEffectiveApplicationsRunProxyHint} for runtime / display.
  *
  * @param {Object|null|undefined} userConfig - Parsed config.yaml root
  * @param {string} appKey - Application key
@@ -183,6 +183,21 @@ async function persistApplicationRunProxyFlag(appKey, proxyEnabled) {
   await config.saveConfig(cfg);
 }
 
+/**
+ * Effective proxy hint for URL expansion and CLI display.
+ * Always **false** when infra Traefik is off — stored `applications.<app>.proxy` is ignored.
+ *
+ * @param {Object|null|undefined} userConfig
+ * @param {string} appKey
+ * @returns {boolean}
+ */
+function getEffectiveApplicationsRunProxyHint(userConfig, appKey) {
+  if (!userConfig || userConfig.traefik !== true) {
+    return false;
+  }
+  return getApplicationsRunProxyHint(userConfig, appKey);
+}
+
 /**
  * Whether declarative `url://*` expansion should treat Traefik as on (infra Traefik + per-app `proxy: true`).
  *
@@ -191,11 +206,12 @@ async function persistApplicationRunProxyFlag(appKey, proxyEnabled) {
  * @returns {boolean}
  */
 function isDeclarativeTraefikUrlsEnabled(userConfig, appKey) {
-  return Boolean(userConfig && userConfig.traefik === true) && getApplicationsRunProxyHint(userConfig, appKey);
+  return getEffectiveApplicationsRunProxyHint(userConfig, appKey);
 }
 
 module.exports = {
   getApplicationsRunProxyHint,
+  getEffectiveApplicationsRunProxyHint,
   isApplicationsReloadDefaultOn,
   isDeclarativeTraefikUrlsEnabled,
   isPreferLocalEnvOutputPath,

package/lib/utils/compose-generate-docker-compose.js

@@ -144,6 +144,8 @@ function buildComposeTemplateContext(ctx) {
     dbInitEnvFile: ctx.dbInitEnvFileAbsolutePath,
     databasePasswords: ctx.databasePasswords,
     devId: ctx.idNum,
+    idNum: ctx.idNum,
+    traefikScoped: ctx.idNum > 0,
     networkName: ctx.networkName,
     containerName: ctx.containerName,
     misoEnvironment: resolveMisoEnvironment(ctx.options),
@@ -201,7 +203,12 @@ async function readDatabasePasswordsIfNeeded(readDatabasePasswords, requiresData
  * @returns {Promise<object>}
  */
 async function loadComposeHead(deps, appName, appConfig, options) {
-  const { loadDockerComposeTemplate, resolveComposeImageOverrideString, getDeveloperIdAndNumeric, getRemoteServerForCompose } = deps;
+  const {
+    loadDockerComposeTemplate,
+    resolveComposeImageOverrideString,
+    getDeveloperIdAndNumeric,
+    getFrontDoorHostContextForCompose
+  } = deps;
   const language = appConfig.build?.language || appConfig.language || 'typescript';
   const template = loadDockerComposeTemplate(language);
   const port = options.port || appConfig.port || 3000;
@@ -209,10 +216,13 @@ async function loadComposeHead(deps, appName, appConfig, options) {
   const { devId, idNum } = await getDeveloperIdAndNumeric();
   const { scoped } = resolveScopedComposeOpts(options);
   let remoteServer = null;
-  if (typeof getRemoteServerForCompose === 'function') {
-    remoteServer = await getRemoteServerForCompose();
+  let developerRootDomain = null;
+  if (typeof getFrontDoorHostContextForCompose === 'function') {
+    const frontDoorCtx = await getFrontDoorHostContextForCompose();
+    remoteServer = frontDoorCtx.remoteServer;
+    developerRootDomain = frontDoorCtx.developerRootDomain;
   }
-  return { template, port, imageOverride, devId, idNum, scoped, remoteServer };
+  return { template, port, imageOverride, devId, idNum, scoped, remoteServer, developerRootDomain };
 }
 
 /**
@@ -224,12 +234,13 @@ async function loadComposeHead(deps, appName, appConfig, options) {
  */
 function buildComposeLayouts(deps, appName, appConfig, head, options) {
   const { buildNetworkAndContainerNames, buildServiceConfig, buildVolumesConfig, buildNetworksConfig } = deps;
-  const { port, imageOverride, devId, idNum, scoped, remoteServer } = head;
+  const { port, imageOverride, devId, idNum, scoped, remoteServer, developerRootDomain } = head;
   const { networkName, containerName } = buildNetworkAndContainerNames(appName, devId, idNum, scoped);
   const serviceConfig = buildServiceConfig(appName, appConfig, port, devId, {
     imageOverride,
     scopeOpts: scoped,
     remoteServer,
+    developerRootDomain,
     omitAppTraefikLabels: options && options.omitAppTraefikLabels === true
   });
   const volumesConfig = buildVolumesConfig(appName);