@aifabrix/builder 2.48.0 → 2.49.1

package/lib/commands/up-dataplane.js

@@ -35,8 +35,23 @@ const {
   refreshUrlsLocalRegistryForCurrentProject
 } = require('./up-common');
 const { alignDataplaneCredentialsAfterDeploy } = require('./up-dataplane-credentials');
+const {
+  canUseBootstrapProvision,
+  bootstrapDataplaneApplication
+} = require('./up-dataplane-bootstrap');
 
 const CONTROLLER_HEALTH_PATH = '/health';
+/** Automation / af-server: wait for edge routing before dataplane (nginx + Traefik). */
+const CONTROLLER_HEALTH_RETRY_ATTEMPTS = 30;
+const CONTROLLER_HEALTH_RETRY_DELAY_MS = 2000;
+
+/**
+ * @param {number} ms
+ * @returns {Promise<void>}
+ */
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 
 /**
  * Check if controller is reachable (health endpoint).
@@ -72,19 +87,46 @@ function promptForControllerUrl(currentUrl) {
 }
 
 /**
- * Resolve controller URL and ensure it is healthy; if not, prompt once for new URL.
- * @returns {Promise<string>} Controller URL to use
- * @throws {Error} If controller unavailable and user aborts or new URL still unhealthy
+ * Poll controller /health until success or attempts exhausted.
+ * @param {string} baseUrl - Controller base URL (no trailing slash)
+ * @param {{ attempts?: number, delayMs?: number }} [opts]
+ * @returns {Promise<boolean>}
  */
-async function resolveControllerUrlWithHealthCheck() {
-  let controllerUrl = await resolveControllerUrl();
-  controllerUrl = controllerUrl.replace(/\/+$/, '');
-
-  let healthy = await isControllerHealthy(controllerUrl);
-  if (healthy) {
-    return controllerUrl;
+async function waitForControllerHealthy(baseUrl, opts = {}) {
+  const attempts = opts.attempts ?? CONTROLLER_HEALTH_RETRY_ATTEMPTS;
+  const delayMs = opts.delayMs ?? CONTROLLER_HEALTH_RETRY_DELAY_MS;
+  const normalized = baseUrl.replace(/\/+$/, '');
+  for (let i = 0; i < attempts; i += 1) {
+    if (await isControllerHealthy(normalized)) {
+      return true;
+    }
+    if (i < attempts - 1) {
+      await sleep(delayMs);
+    }
   }
+  return false;
+}
+
+/**
+ * @param {string} controllerUrl
+ * @returns {string}
+ */
+function buildControllerUnavailableMessage(controllerUrl) {
+  return (
+    `Controller at ${controllerUrl} is not responding after ${CONTROLLER_HEALTH_RETRY_ATTEMPTS} health checks ` +
+    `(~${Math.round((CONTROLLER_HEALTH_RETRY_ATTEMPTS * CONTROLLER_HEALTH_RETRY_DELAY_MS) / 1000)}s). ` +
+    'Miso may be up on localhost before nginx/Traefik routes are ready. ' +
+    'On the builder host run: sudo systemctl start aifabrix-sync-dev-traefik-nginx.service ' +
+    'then retry: aifabrix up-dataplane --force'
+  );
+}
 
+/**
+ * Prompt for a new controller URL and verify it responds to health checks.
+ * @param {string} controllerUrl - URL that failed the initial health check
+ * @returns {Promise<string>} Verified controller URL
+ */
+async function promptForHealthyControllerUrl(controllerUrl) {
   logger.log(chalk.yellow(`\nController at ${controllerUrl} is not responding (health check failed).\n`));
   const newUrl = await promptForControllerUrl(controllerUrl);
   if (!newUrl) {
@@ -99,7 +141,7 @@ async function resolveControllerUrlWithHealthCheck() {
 
   await setControllerUrl(newUrl);
   const normalizedNew = newUrl.trim().replace(/\/+$/, '');
-  healthy = await isControllerHealthy(normalizedNew);
+  const healthy = await isControllerHealthy(normalizedNew);
   if (!healthy) {
     throw new Error(`Controller at ${normalizedNew} is not responding. Ensure the controller is running and reachable, then run "aifabrix up-dataplane" again.`);
   }
@@ -108,6 +150,28 @@ async function resolveControllerUrlWithHealthCheck() {
   return normalizedNew;
 }
 
+/**
+ * Resolve controller URL and ensure it is healthy; if not, prompt once for new URL (TTY only).
+ * @returns {Promise<string>} Controller URL to use
+ * @throws {Error} If controller unavailable and user aborts or new URL still unhealthy
+ */
+async function resolveControllerUrlWithHealthCheck() {
+  let controllerUrl = await resolveControllerUrl();
+  controllerUrl = controllerUrl.replace(/\/+$/, '');
+
+  const healthy = await waitForControllerHealthy(controllerUrl);
+  if (healthy) {
+    return controllerUrl;
+  }
+
+  const isInteractive = Boolean(process.stdin && process.stdin.isTTY);
+  if (!isInteractive) {
+    throw new Error(buildControllerUnavailableMessage(controllerUrl));
+  }
+
+  return promptForHealthyControllerUrl(controllerUrl);
+}
+
 async function resolveUpDataplaneAuthContext(options, environmentKey) {
   if (options.skipInfraCheck !== true) {
     await assertDevInfraUp();
@@ -120,7 +184,9 @@ async function resolveUpDataplaneAuthContext(options, environmentKey) {
   if (options.allowNonDev !== true) {
     assertDevEnvironmentForDataplane(cfg);
   }
-  logger.log(formatSuccessLine(`Logged in (environment: ${environmentKey})`));
+  if (options.platformInstall !== true) {
+    logger.log(formatSuccessLine(`Logged in (environment: ${environmentKey})`));
+  }
   return { controllerUrl, authConfig };
 }
 
@@ -223,6 +289,57 @@ async function computeDataplaneRunOverrides(options) {
   return { runEnvKey, portOverride };
 }
 
+/**
+ * Resolve controller URL and auth for bootstrap vs device-login paths.
+ * @async
+ * @param {Object} options
+ * @param {string} environmentKey
+ * @returns {Promise<{ controllerUrl: string, authConfig: Object|null, useBootstrap: boolean }>}
+ */
+async function resolveUpDataplaneControllerContext(options, environmentKey) {
+  const useBootstrap = await canUseBootstrapProvision(options);
+  if (useBootstrap) {
+    if (options.skipInfraCheck !== true) {
+      await assertDevInfraUp();
+    }
+    const controllerUrl = await resolveControllerUrlWithHealthCheck();
+    const cfg = await config.getConfig();
+    if (options.allowNonDev !== true) {
+      assertDevEnvironmentForDataplane(cfg);
+    }
+    if (options.platformInstall !== true) {
+      logger.log(formatSuccessLine('Using bootstrap provision (no device login)'));
+    }
+    return { controllerUrl, authConfig: null, useBootstrap: true };
+  }
+
+  const authContext = await resolveUpDataplaneAuthContext(options, environmentKey);
+  return {
+    controllerUrl: authContext.controllerUrl,
+    authConfig: authContext.authConfig,
+    useBootstrap: false
+  };
+}
+
+/**
+ * Register/bootstrap, deploy manifest, align credentials.
+ * @async
+ */
+async function provisionAndDeployDataplane(options, environmentKey, controllerUrl, useBootstrap, authConfig) {
+  if (useBootstrap) {
+    await bootstrapDataplaneApplication(options, controllerUrl, environmentKey, buildDataplaneImageRef);
+  } else {
+    await registerOrRotateDataplane(options, controllerUrl, environmentKey, authConfig);
+  }
+
+  await deployDataplaneToController({
+    ...options,
+    envKey: environmentKey,
+    ...(useBootstrap ? { deploymentAuth: 'client-credentials' } : {})
+  });
+  logger.log('');
+}
+
 /**
  * Handle up-dataplane command: ensure logged in, environment dev, ensure dataplane,
  * register or rotate (if already registered), deploy (send manifest to controller),
@@ -239,43 +356,57 @@ async function computeDataplaneRunOverrides(options) {
  * @throws {Error} If infra not up, controller unavailable, not logged in, environment not dev, or any step fails
  */
 async function handleUpDataplane(options = {}) {
-  logger.log(chalk.blue('Starting up-dataplane (register/rotate, deploy, then run dataplane locally)...\n'));
+  if (options.platformInstall !== true) {
+    logger.log(chalk.blue('Starting up-dataplane (register/rotate, deploy, then run dataplane locally)...\n'));
+  }
 
   const environmentKey =
     options && options.envKey
       ? String(options.envKey).trim().toLowerCase()
       : await resolveEnvironment();
-  const { controllerUrl, authConfig } = await resolveUpDataplaneAuthContext(options, environmentKey);
+
+  const { controllerUrl, authConfig, useBootstrap } = await resolveUpDataplaneControllerContext(
+    options,
+    environmentKey
+  );
 
   await ensureDataplaneAppsFromTemplate();
-  // If envOutputPath target folder does not exist, set envOutputPath to null
   validateEnvOutputPathFolderOrNull('dataplane');
-
   refreshUrlsLocalRegistryForCurrentProject();
 
   if (options.platformInstall !== true) {
     emitDataplaneManifestLineFromBuilder();
   }
 
-  await registerOrRotateDataplane(options, controllerUrl, environmentKey, authConfig);
-
-  await deployDataplaneToController({ ...options, envKey: environmentKey });
-  logger.log('');
+  await provisionAndDeployDataplane(options, environmentKey, controllerUrl, useBootstrap, authConfig);
 
-  await alignDataplaneCredentialsAfterDeploy(options, controllerUrl);
+  await alignDataplaneCredentialsAfterDeploy(
+    { ...options, useBootstrap },
+    controllerUrl
+  );
 
   const { runEnvKey, portOverride } = await computeDataplaneRunOverrides(options);
 
-  await app.runApp('dataplane', {
+  const runAppOpts = {
     skipEnvOutputPath: true,
     env: runEnvKey,
     port: portOverride,
     registry: options.registry || undefined,
     base: options.base !== false,
     skipManifestMetadataLine: true
-  });
+  };
+  if (options.platformInstall === true) {
+    if (typeof options.onPollText === 'function') {
+      runAppOpts.onPollText = options.onPollText;
+    } else {
+      runAppOpts.silentPoll = true;
+    }
+  }
+  await app.runApp('dataplane', runAppOpts);
 
-  logger.log(formatSuccessParagraph('up-dataplane complete. Dataplane is registered, deployed in dev, and running locally.'));
+  if (options.platformInstall !== true) {
+    logger.log(formatSuccessParagraph('up-dataplane complete. Dataplane is registered, deployed in dev, and running locally.'));
+  }
 }
 
 module.exports = { handleUpDataplane, buildDataplaneImageRef };

package/lib/commands/up-miso.js

@@ -57,11 +57,15 @@ async function runMisoApps(options) {
     base: useBaseImage,
     skipManifestMetadataLine: true
   };
-  const keycloakRunOpts = { ...common };
+  const platformPollOpts =
+    options.platformInstall === true
+      ? { silentPoll: true }
+      : {};
+  const keycloakRunOpts = { ...common, ...platformPollOpts };
   if (imageMap.keycloak) {
     keycloakRunOpts.image = imageMap.keycloak;
   }
-  const misoRunOpts = { ...common };
+  const misoRunOpts = { ...common, ...platformPollOpts };
   if (imageMap['miso-controller']) {
     misoRunOpts.image = imageMap['miso-controller'];
   }

package/lib/core/secrets-env-declarative-expand.js

@@ -14,6 +14,30 @@ const { readAppEnvironmentScopedFlagForAppPath } = require('../utils/app-scoped-
 const { expandDeclarativeUrlsInEnvContent } = require('../utils/url-declarative-resolve');
 const { rewriteInactiveDeclarativeVdirPublicContent } = require('../utils/url-declarative-vdir-inactive-env');
 const { refreshUrlsLocalRegistryFromBuilder } = require('../utils/urls-local-registry');
+
+/**
+ * @param {() => Promise<*>} getter
+ * @param {*} [fallback]
+ * @returns {Promise<*>}
+ */
+async function tryConfigValue(getter, fallback = null) {
+  try {
+    return await getter();
+  } catch {
+    return fallback;
+  }
+}
+
+/**
+ * @param {() => Promise<*>} getter
+ * @returns {Promise<string|null>}
+ */
+async function tryConfigTrimmedString(getter) {
+  const value = await tryConfigValue(getter, null);
+  const trimmed = value !== null && value !== undefined ? String(value).trim() : '';
+  return trimmed || null;
+}
+
 /**
  * Config inputs for declarative url:// expansion.
  * @param {string} appPath
@@ -21,30 +45,16 @@ const { refreshUrlsLocalRegistryFromBuilder } = require('../utils/urls-local-reg
  */
 async function loadDeclarativeUrlExpandInputs(appPath) {
   const userCfg = await config.getConfig();
-  let remoteServer = null;
-  try {
-    const rs = await config.getRemoteServer();
-    if (rs && String(rs).trim()) {
-      remoteServer = String(rs).trim();
-    }
-  } catch {
-    remoteServer = null;
-  }
-  let developerIdRaw = null;
-  try {
-    developerIdRaw = await config.getDeveloperId();
-  } catch {
-    developerIdRaw = null;
-  }
-  let infraTlsEnabled = false;
-  try {
-    infraTlsEnabled = await config.getTlsEnabled();
-  } catch {
-    infraTlsEnabled = false;
-  }
+  const [remoteServer, developerRootDomain, developerIdRaw, infraTlsEnabled] = await Promise.all([
+    tryConfigTrimmedString(() => config.getRemoteServer()),
+    tryConfigTrimmedString(() => config.getDeveloperRootDomain()),
+    tryConfigValue(() => config.getDeveloperId(), null),
+    tryConfigValue(() => config.getTlsEnabled(), false)
+  ]);
   return {
     userCfg,
     remoteServer,
+    developerRootDomain,
     developerIdRaw,
     infraTlsEnabled,
     appScopedFlag: readAppEnvironmentScopedFlagForAppPath(appPath)
@@ -60,7 +70,7 @@ async function loadDeclarativeUrlExpandInputs(appPath) {
  * @returns {Object}
  */
 function buildDeclarativeUrlExpandContextFromInputs(appName, variablesPath, environment, inputs) {
-  const { userCfg, remoteServer, developerIdRaw, infraTlsEnabled, appScopedFlag } = inputs;
+  const { userCfg, remoteServer, developerRootDomain, developerIdRaw, infraTlsEnabled, appScopedFlag } = inputs;
   let projectRoot = null;
   try {
     const r = pathsUtil.getProjectRoot();
@@ -77,6 +87,7 @@ function buildDeclarativeUrlExpandContextFromInputs(appName, variablesPath, envi
     useEnvironmentScopedResources: Boolean(userCfg.useEnvironmentScopedResources),
     appEnvironmentScopedResources: appScopedFlag,
     remoteServer,
+    developerRootDomain,
     developerIdRaw,
     infraTlsEnabled,
     userCfg,
@@ -136,12 +147,13 @@ async function expandDeclarativeUrlsIfPresent(resolved, appName, appPath, variab
   if (envOnly || !variablesPath) {
     return resolved;
   }
-  const { userCfg, remoteServer, developerIdRaw, infraTlsEnabled, appScopedFlag } =
+  const { userCfg, remoteServer, developerRootDomain, developerIdRaw, infraTlsEnabled, appScopedFlag } =
     await loadDeclarativeUrlExpandInputs(appPath);
   resolved = rewriteInactiveDeclarativeVdirPublicContent(resolved, variablesPath, userCfg);
   const ctx = buildDeclarativeUrlExpandContextFromInputs(appName, variablesPath, environment, {
     userCfg,
     remoteServer,
+    developerRootDomain,
     developerIdRaw,
     infraTlsEnabled,
     appScopedFlag

package/lib/core/setup-platform-mode.js

@@ -61,6 +61,46 @@ function flagsForSetupPlatformMode(mode) {
   };
 }
 
+/** Platform app keys (setup does not modify `applications.<key>.proxy`; use `aifabrix run --proxy` / `--no-proxy`). */
+const PLATFORM_APPLICATION_KEYS = Object.freeze(['keycloak', 'miso-controller', 'dataplane']);
+
+/**
+ * Apply setup platform mode to config.yaml infra topology (`traefik`, `tlsEnabled`, env scope).
+ * Does **not** change per-app `applications.<key>.proxy` — that is owned by `aifabrix run`.
+ *
+ * @param {Object} cfg - Mutable config root
+ * @param {unknown} mode
+ * @returns {Object} Same cfg reference
+ */
+function applyPlatformTopologyFlagsToConfig(cfg, mode) {
+  const normalized = normalizeSetupPlatformMode(mode);
+  const derived = flagsForSetupPlatformMode(normalized);
+  cfg.setupPlatformMode = normalized;
+  cfg.traefik = derived.traefik;
+  cfg.tlsEnabled = derived.tlsEnabled;
+  cfg.useEnvironmentScopedResources = derived.useEnvironmentScopedResources;
+  return cfg;
+}
+
+/**
+ * True when persisted traefik/tls/env-scope flags disagree with setupPlatformMode.
+ *
+ * @param {Object} cfg
+ * @returns {boolean}
+ */
+function platformTopologyNeedsReconcile(cfg) {
+  if (!cfg || typeof cfg !== 'object' || !cfg.setupPlatformMode) {
+    return false;
+  }
+  const expected = flagsForSetupPlatformMode(cfg.setupPlatformMode || SETUP_PLATFORM_MODE.SINGLE);
+  if (Boolean(cfg.traefik) !== Boolean(expected.traefik)) return true;
+  if (Boolean(cfg.tlsEnabled) !== Boolean(expected.tlsEnabled)) return true;
+  if (Boolean(cfg.useEnvironmentScopedResources) !== Boolean(expected.useEnvironmentScopedResources)) {
+    return true;
+  }
+  return false;
+}
+
 /**
  * Interactive setup menu choices (full platform hidden until multi-env path ships).
  * Traefik front door requires `remote-server` (from `aifabrix dev init`); without it only direct ports is offered.
@@ -90,8 +130,11 @@ function getSetupPlatformModePromptChoices(opts = {}) {
 module.exports = {
   SETUP_PLATFORM_MODE,
   SETUP_PLATFORM_MODE_CLI_VALUES,
+  PLATFORM_APPLICATION_KEYS,
   normalizeSetupPlatformMode,
   flagsForSetupPlatformMode,
+  applyPlatformTopologyFlagsToConfig,
+  platformTopologyNeedsReconcile,
   getSetupPlatformModePromptChoices
 };
 

package/lib/deployment/deployer-status.js

@@ -18,15 +18,37 @@ function isTerminalStatus(status) {
   return status === 'completed' || status === 'failed' || status === 'cancelled';
 }
 
+/**
+ * True when pipeline calls should authenticate with a token header only (Bearer or x-client-token).
+ * @param {Object} authConfig
+ * @returns {boolean}
+ */
+function isTokenOnlyPipelineAuth(authConfig) {
+  if (!authConfig || !authConfig.token) {
+    return false;
+  }
+  if (authConfig.clientId || authConfig.clientSecret) {
+    return false;
+  }
+  return authConfig.type === 'bearer' || authConfig.type === 'client-token';
+}
+
 /**
  * Convert authConfig to pipeline auth config format
  * @param {Object} authConfig - Authentication configuration
  * @returns {Object} Pipeline auth config
  */
 function convertToPipelineAuthConfig(authConfig) {
-  return authConfig.type === 'bearer'
-    ? { type: 'bearer', token: authConfig.token }
-    : { type: 'client-credentials', clientId: authConfig.clientId, clientSecret: authConfig.clientSecret };
+  if (isTokenOnlyPipelineAuth(authConfig)) {
+    return authConfig.type === 'client-token'
+      ? { type: 'client-token', token: authConfig.token }
+      : { type: 'bearer', token: authConfig.token };
+  }
+  return {
+    type: 'client-credentials',
+    clientId: authConfig.clientId,
+    clientSecret: authConfig.clientSecret
+  };
 }
 
 /**
@@ -118,6 +140,7 @@ async function processDeploymentStatusResponse(
 
 module.exports = {
   isTerminalStatus,
+  isTokenOnlyPipelineAuth,
   convertToPipelineAuthConfig,
   handleDeploymentStatusError,
   extractDeploymentData,

package/lib/deployment/deployer.js

@@ -20,7 +20,8 @@ const { getAuthUser } = require('../api/auth.api');
 const { handleValidationResponse } = require('../utils/deployment-validation-helpers');
 const {
   convertToPipelineAuthConfig,
-  processDeploymentStatusResponse
+  processDeploymentStatusResponse,
+  isTokenOnlyPipelineAuth
 } = require('./deployer-status');
 const { resolvePollIntervalFromController } = require('./poll-interval');
 const { createDeployPollHandlers } = require('./deploy-poll-ui');
@@ -54,8 +55,8 @@ async function buildValidationData(manifest, validatedEnvKey, authConfig, option
     manifest?.repository?.repositoryUrl ||
     `https://github.com/aifabrix/${manifest.key}`;
 
-  if (authConfig.type === 'bearer' && authConfig.token && !authConfig.clientId) {
-    const pipelineAuthConfig = { type: 'bearer', token: authConfig.token };
+  if (isTokenOnlyPipelineAuth(authConfig)) {
+    const pipelineAuthConfig = convertToPipelineAuthConfig(authConfig);
     const validationData = {
       clientId: manifest.key,
       repositoryUrl,
@@ -181,15 +182,7 @@ function buildDeploymentData(validateToken, authConfig, options) {
     imageTag: imageTag
   };
 
-  const pipelineAuthConfig = authConfig.type === 'bearer' && authConfig.token && !authConfig.clientId
-    ? { type: 'bearer', token: authConfig.token }
-    : {
-      type: 'client-credentials',
-      clientId: authConfig.clientId,
-      clientSecret: authConfig.clientSecret
-    };
-
-  return { deployData, pipelineAuthConfig };
+  return { deployData, pipelineAuthConfig: convertToPipelineAuthConfig(authConfig) };
 }
 
 /**
@@ -254,8 +247,8 @@ async function sendDeploymentRequest(url, envKey, validateToken, authConfig, opt
   const validatedEnvKey = validateEnvironmentKey(envKey);
   const maxRetries = options.maxRetries || 3;
 
-  const useBearerOnly = authConfig.type === 'bearer' && authConfig.token && !authConfig.clientId;
-  if (!useBearerOnly) {
+  const useTokenOnlyAuth = isTokenOnlyPipelineAuth(authConfig);
+  if (!useTokenOnlyAuth) {
     validateDeploymentCredentials(authConfig);
   }
 

package/lib/external-system/download-helpers.js

@@ -16,6 +16,7 @@ const {
 } = require('../utils/cli-test-layout-chalk');
 const logger = require('../utils/logger');
 const { generateExternalReadmeContent } = require('../utils/external-readme');
+const { getAuthCredentialTemplate } = require('../utils/authentication-shape');
 
 /**
  * Validates system type from downloaded application
@@ -159,7 +160,15 @@ function generateReadme(systemKey, application, dataSources) {
     };
   });
 
-  const authType = application.authentication?.type || application.authentication?.method;
+  const auth = application.authentication;
+  let authType = auth?.authType;
+  if (auth?.authType === 'credential') {
+    authType = getAuthCredentialTemplate(auth)?.method || authType;
+  } else if (auth?.authType === 'apiProvider') {
+    authType = auth.apiProvider?.apiProviderKey || 'apiProvider';
+  } else {
+    authType = auth?.type || auth?.method || authType;
+  }
   return generateExternalReadmeContent({
     appName: systemKey,
     systemKey,

package/lib/infrastructure/compose.js

@@ -11,6 +11,9 @@
 const fs = require('fs');
 const handlebars = require('handlebars');
 const path = require('path');
+const {
+  writeTraefikTlsDynamicConfig
+} = require('./traefik-tls-dynamic');
 
 /**
  * Normalize a host path for Docker Compose bind mounts. Docker Desktop sends
@@ -91,6 +94,40 @@ function validateTraefikConfig(traefikConfig) {
   return { valid: errors.length === 0, errors };
 }
 
+/**
+ * Normalize Traefik config for compose template (bind mounts + dynamic TLS file).
+ *
+ * @param {string} infraDir
+ * @param {Object|boolean} traefikConfig
+ * @returns {Object|boolean}
+ */
+function buildTraefikComposeContext(infraDir, traefikConfig) {
+  if (!traefikConfig || typeof traefikConfig !== 'object') {
+    return traefikConfig;
+  }
+  const traefikForCompose = {
+    ...traefikConfig,
+    trustForwardedHeaders: !!traefikConfig.trustForwardedHeaders,
+    ...(traefikConfig.certFile
+      ? { certFile: toDockerBindMountSource(traefikConfig.certFile) }
+      : {}),
+    ...(traefikConfig.keyFile
+      ? { keyFile: toDockerBindMountSource(traefikConfig.keyFile) }
+      : {})
+  };
+  const tlsDynamic = writeTraefikTlsDynamicConfig(infraDir, traefikConfig);
+  if (!tlsDynamic) {
+    return traefikForCompose;
+  }
+  return {
+    ...traefikForCompose,
+    tlsDynamicBind: toDockerBindMountSource(tlsDynamic.hostPath),
+    tlsDynamicContainerPath: tlsDynamic.containerPath,
+    certContainerPath: tlsDynamic.certContainerPath,
+    keyContainerPath: tlsDynamic.keyContainerPath
+  };
+}
+
 /**
  * Generate docker-compose file from template
  * @param {string} templatePath - Path to compose template
@@ -129,21 +166,12 @@ function generateComposeFile(templatePath, devId, idNum, ports, infraDir, option
   const redisCommanderConfig = options.redisCommander && typeof options.redisCommander.enabled === 'boolean'
     ? options.redisCommander
     : { enabled: true };
-  const traefikForCompose = traefikConfig && typeof traefikConfig === 'object'
-    ? {
-      ...traefikConfig,
-      trustForwardedHeaders: !!traefikConfig.trustForwardedHeaders,
-      ...(traefikConfig.certFile
-        ? { certFile: toDockerBindMountSource(traefikConfig.certFile) }
-        : {}),
-      ...(traefikConfig.keyFile
-        ? { keyFile: toDockerBindMountSource(traefikConfig.keyFile) }
-        : {})
-    }
-    : traefikConfig;
+  const traefikForCompose = buildTraefikComposeContext(infraDir, traefikConfig);
   const initScriptsBind = toDockerBindMountSource(path.join(infraDir, 'init-scripts'));
   const composeContent = template({
     devId: devId,
+    idNum,
+    traefikScoped: idNum > 0,
     postgresPort: ports.postgres,
     redisPort: ports.redis,
     pgadminPort: ports.pgadmin,

package/lib/infrastructure/services.js

@@ -117,10 +117,12 @@ async function waitForServices(devId = null, opts = {}) {
   const maxAttempts = 30;
   const delay = 2000; // 2 seconds
   const { pgadmin = true, redisCommander = true, traefik = false } = opts;
+  let lastHealth = {};
 
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     const health = await checkInfraHealth(devId, { pgadmin, redisCommander, traefik });
-    const allHealthy = Object.values(health).every(status => status === 'healthy');
+    lastHealth = health;
+    const allHealthy = Object.values(health).every((status) => status === 'healthy');
 
     if (allHealthy) {
       return;
@@ -128,11 +130,21 @@ async function waitForServices(devId = null, opts = {}) {
 
     if (attempt < maxAttempts) {
       logger.log(`Waiting for services to be healthy... (${attempt}/${maxAttempts})`);
-      await new Promise(resolve => setTimeout(resolve, delay));
+      await new Promise((resolve) => setTimeout(resolve, delay));
     }
   }
 
-  throw new Error('Services failed to become healthy within timeout period');
+  const timeoutSec = (maxAttempts * delay) / 1000;
+  const unhealthy = Object.entries(lastHealth)
+    .filter(([, status]) => status !== 'healthy')
+    .map(([name, status]) => `${name}=${status}`)
+    .join(', ');
+  const detail = unhealthy || 'unknown';
+  throw new Error(
+    `Infrastructure services did not become healthy within ${timeoutSec}s. ` +
+      `Unhealthy: ${detail}. ` +
+      'Check container logs (e.g. `docker ps`, `aifabrix doctor`, or `aifabrix logs` for platform apps).'
+  );
 }
 
 /**