@aifabrix/builder 2.45.0 → 2.46.0

package/lib/validation/wizard-config-validator.js

@@ -164,36 +164,73 @@ function validateWizardConfigSchema(config) {
   };
 }
 
+/**
+ * Candidate bases for relative openapi-file paths (first existing wins).
+ * @param {string} configPath - Path to wizard.yaml
+ * @returns {string[]}
+ */
+function wizardOpenApiFilePathCandidates(filePath, configPath) {
+  const raw = String(filePath || '').trim();
+  if (!raw) {
+    return [];
+  }
+  if (path.isAbsolute(raw)) {
+    return [path.resolve(raw)];
+  }
+  const configDir = path.dirname(path.resolve(configPath));
+  return [...new Set([
+    path.resolve(process.cwd(), raw),
+    path.resolve(configDir, raw)
+  ])];
+}
+
+/**
+ * Resolve openapi-file path for wizard config (absolute path).
+ * Relative paths: process.cwd() first, then wizard.yaml directory.
+ * @param {string} filePath
+ * @param {string} configPath
+ * @returns {Promise<string>}
+ */
+async function resolveWizardOpenApiFilePath(filePath, configPath) {
+  const candidates = wizardOpenApiFilePathCandidates(filePath, configPath);
+  if (candidates.length === 0) {
+    return '';
+  }
+  for (const candidate of candidates) {
+    try {
+      await fs.access(candidate);
+      return candidate;
+    } catch (error) {
+      if (error.code !== 'ENOENT') {
+        throw error;
+      }
+    }
+  }
+  return candidates[0];
+}
+
 /**
  * Validate file path exists (for openapi-file source type)
  * @function validateFilePath
  * @param {string} filePath - Path to validate
- * @param {string} basePath - Base path for relative paths
- * @returns {Promise<Object>} Validation result with valid flag and errors
+ * @param {string} configPath - Path to wizard.yaml (relative paths resolve from cwd, then config dir)
+ * @returns {Promise<Object>} Validation result with valid flag, errors, and resolvedPath
  */
-async function validateFilePath(filePath, basePath) {
-  const baseDir = path.resolve(basePath);
-  const resolvedPath = path.isAbsolute(filePath)
-    ? path.resolve(filePath)
-    : path.resolve(baseDir, filePath);
-  if (!path.isAbsolute(filePath)) {
-    const baseWithSep = baseDir.endsWith(path.sep) ? baseDir : `${baseDir}${path.sep}`;
-    if (!resolvedPath.startsWith(baseWithSep)) {
-      return {
-        valid: false,
-        errors: [`OpenAPI file path must be within: ${baseDir}`]
-      };
-    }
+async function validateFilePath(filePath, configPath) {
+  const resolvedPath = await resolveWizardOpenApiFilePath(filePath, configPath);
+  if (!resolvedPath) {
+    return { valid: false, errors: ['OpenAPI file path is required'], resolvedPath: '' };
   }
   try {
     await fs.access(resolvedPath);
   } catch (error) {
     return {
       valid: false,
-      errors: [`OpenAPI file not found: ${resolvedPath}`]
+      errors: [`OpenAPI file not found: ${resolvedPath}`],
+      resolvedPath
     };
   }
-  return { valid: true, errors: [] };
+  return { valid: true, errors: [], resolvedPath };
 }
 
 /**
@@ -229,10 +266,11 @@ function validateSchemaAndResolveEnvVars(config, shouldResolveEnvVars) {
 async function performSemanticValidations(config, configPath, validateFilePaths) {
   const errors = [];
   if (validateFilePaths && config.source?.type === 'openapi-file' && config.source?.filePath) {
-    const basePath = path.dirname(path.resolve(configPath));
-    const fileResult = await validateFilePath(config.source.filePath, basePath);
+    const fileResult = await validateFilePath(config.source.filePath, configPath);
     if (!fileResult.valid) {
       errors.push(...fileResult.errors);
+    } else if (fileResult.resolvedPath) {
+      config.source.filePath = fileResult.resolvedPath;
     }
   }
   if (config.mode === 'add-datasource' && !config.systemIdOrKey) {
@@ -296,6 +334,7 @@ module.exports = {
   wizardConfigExists,
   validateWizardConfig,
   validateWizardConfigSchema,
+  resolveWizardOpenApiFilePath,
   resolveEnvVar,
   resolveEnvVarsInObject,
   formatValidationErrors,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.45.0",
+  "version": "2.46.0",
   "description": "AI Fabrix Local Fabric & Deployment SDK",
   "main": "lib/index.js",
   "bin": {

package/templates/applications/dataplane/application.yaml

@@ -64,7 +64,8 @@ build:
   dockerfile: builder/dataplane/Dockerfile  # Dockerfile path (relative to project root)
   envOutputPath: ../../.env       # Copy to repo root for local dev
   language: python                # Runtime language for template selection (typescript or python)
-  reloadStart: uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001} --reload  # PORT set from port above at run time; default 3001 must match port
+  # Dev reload: polling + watch /app/app only (avoids EMFILE on full repo bind-mount). See run_local.py, make af-reload.
+  reloadStart: WATCHFILES_FORCE_POLLING=1 uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001} --reload --reload-dir /app/app
   # Pulled-image local compose (no bind-mount): drives `command` in generated docker-compose. Override for non-standard images (e.g. stub ACR tags).
   imageRun: exec python -m uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001}
 

package/templates/applications/dataplane/env.template

@@ -21,7 +21,7 @@ LOG_FORMAT=json
 # Production with persistent logs: use /mnt/data/logs/app.log and mount a volume at /mnt/data.
 LOG_FILE_PATH=/mnt/data/logs/app.log
 # If true, run without Redis/Celery (single process)
-LOCAL_MODE=false
+LOCAL_MODE=true
 
 # When API_KEY is set, a matching Bearer token bypasses OAuth2 validation
 # Same kv:// as miso-controller API_KEY so pipeline Bearer bypass uses one secrets.local entry
@@ -30,9 +30,14 @@ API_KEY=kv://miso-controller-secrets-apiKeyVault
 # API Configuration
 API_V1_STR=/api/v1
 VERSION=1.9.5
+# Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
+# MIN_BUILDER_CLI_VERSION=2.45.0
+MIN_BUILDER_CLI_VERSION=2.45.5
 # Base URL for the dataplane web server (used for default OAuth2 callback URL when redirectUri is omitted)
 # url:// resolves after kv://; includes front-door path from application.yaml (e.g. /data)
 DATAPLANE_WEB_SERVER_URL=url://public
+# Relative URL path where dataplane is served by reverse proxy (for prefixed deployments, e.g. /data).
+DATAPLANE_RELATIVE_PATH=url://vdir-public
 DATAPLANE_INTERNAL_URL=url://internal
 
 # CORS Configuration
@@ -165,6 +170,23 @@ RBAC_EXPLAIN_MODE_ENABLED=false
 # validates only (no second DB write). Default false.
 AUDIT_ASYNC_SHADOW_ENQUEUE=false
 
+# Policy Library management HTTP API gate. When false (default), management
+# routes are not registered (404): /api/v1/policies/*, /api/v1/external/{key}/policies,
+# /api/v1/users/{id}/policies, /api/v1/groups/{id}/policies, IDE /validate/policy and
+# /simulate/policy-impact/{datasourceKey}. ABAC runtime evaluation is unaffected.
+# Set to true for local dev when iterating on policy CRUD APIs.
+# Policy Library management HTTP APIs (default false → routes not registered, 404).
+# Set true for local dev policy CRUD; pair with VITE_POLICY_MANAGEMENT_ENABLED=true in app-ui.
+POLICY_MANAGEMENT_API_ENABLED=false
+
+# First-party HTTP internal SpecFile (398.2 / plan 397). When true, lifespan upserts
+# internal:dataplane-first-party-http from the live COM-merged OpenAPI schema.
+FIRST_PARTY_HTTP_INTERNAL_SPEC_SYNC_ON_STARTUP=false
+# Upsert internal:dataplane-first-party-http after pipeline external-system publish.
+FIRST_PARTY_HTTP_INTERNAL_SPEC_SYNC_ON_PUBLISH=false
+# Optional external_systems.id for spec_files FK; empty uses first row when startup sync is on.
+FIRST_PARTY_HTTP_INTERNAL_SPEC_EXTERNAL_SYSTEM_ID=
+
 # =============================================================================
 # OBSERVABILITY CONFIGURATION
 # =============================================================================
@@ -186,6 +208,19 @@ CERTIFICATE_PUBLIC_KEY=
 # Optional public key identifier for issued certificates; default if unset: dataplane-signing-key
 CERTIFICATE_PUBLIC_KEY_ID=
 
+# =============================================================================
+# VALIDATION ENGINE — YAML CONTRACTS
+# =============================================================================
+# Load rules from repo contracts/ and schedule hybrid YAML tasks (see docs/adr/0001-validation-engine-yaml-contracts.md).
+# Code defaults when unset: VALIDATION_CONTRACTS_ENABLED=false, VALIDATION_RULESET=legacy.
+# hybrid = legacy Python categories + YAML rules; yaml = YAML/hybrid only (requires contracts enabled).
+# Optional override for contract bundle root (default: <dataplane-repo>/contracts):
+# VALIDATION_CONTRACTS_ROOT=
+VALIDATION_CONTRACTS_ENABLED=true
+VALIDATION_RULESET=hybrid
+# Attach advisory yamlSuggestedLevel + contract metadata on certification details (does not change ICC/PDS level selection).
+VALIDATION_CERTIFICATION_YAML_ENABLED=true
+
 # After a successful POST /api/v1/validation/run (validation engine with certification passed, or E2E success),
 # persist an active integration certificate without a separate issue call. Set false to require explicit issue only.
 VALIDATION_AUTO_ISSUE_INTEGRATION_CERTIFICATE=true

package/templates/applications/dataplane/rbac.yaml

@@ -280,6 +280,10 @@ permissions:
   - name: "record:search"
     roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-deployment-admin", "aifabrix-compliance-admin", "aifabrix-developer", "aifabrix-observer"]
     description: "Search records"
+
+  - name: "governance:evaluate"
+    roles: ["aifabrix-platform-admin", "aifabrix-security-admin", "aifabrix-developer"]
+    description: "Run governance scenario acceptance (subject impersonation for ABAC proof)"
   
   # IDE simulation operations
   - name: "dataplane:abac-simulate"

package/templates/applications/miso-controller/env.template

@@ -167,6 +167,22 @@ MISO_CLIENTSECRET=kv://miso-controller-client-secretKeyVault
 # Unset = use DB only.
 CONTROLLER_EVALUATION=
 
+# =============================================================================
+# ENTRA ID ONBOARDING (vendor multi-tenant app — admin consent)
+# =============================================================================
+# AI Fabrix vendor app for TA-1 admin consent and Entra ID configure flows.
+# Customer SSO after configure uses a separate enterprise app (AI Fabrix Miso);
+# Keycloak broker redirect is on that customer app, not ENTRA_ID_CLIENT_ID.
+#
+# ENTRA_ID_CENTRAL_CALLBACK_URI — Web redirect on the vendor app; must point at
+# Mori (e.g. …/entra-id-concent/callback), not the SPA or controller.
+# ENTRA_CALLBACK_STATE_SECRET — Shared HMAC secret (min 16 chars) for OAuth state
+# between controller and Mori callback service; same value on Mori and controller.
+ENTRA_CALLBACK_STATE_SECRET=kv://entra-callback-state-secret
+ENTRA_ID_CENTRAL_CALLBACK_URI=kv://entra-callback-uri
+ENTRA_ID_CLIENT_ID=kv://entra-client-idKeyVault
+ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
+
 # =============================================================================
 # TENANT ACTIVATION (TA-3) — EXISTING LLM CATALOG
 # =============================================================================

package/templates/external-system/README.md.hbs

@@ -23,6 +23,7 @@
 | `{{systemKey}}-deploy.json` | Deploy manifest (`aifabrix json {{appName}}`) |
 | `deploy.js` | Deploy helper |
 | `wizard.yaml` | Wizard input |
+| `scenarios/*.yaml` | Governance scenario packs (optional; dataplane-first via `verify-governance` / `governance generate`; expert YAML via `governance download` / `upload`) |
 | `{{rbacOptionalFile}}` | Roles and permissions |
 
 ## Typical workflow
@@ -32,10 +33,48 @@
 3. **Adjust operations** — use `aifabrix datasource capability …` to copy, add, or remove **capabilities** (see below).
 4. **Check locally** — `aifabrix validate {{appName}}` and `aifabrix datasource validate` on files you touched.
 5. **Align manifest** — `aifabrix repair {{appName}}` after bigger edits.
-6. **Publish** — `aifabrix upload {{appName}}` or `aifabrix deploy {{appName}}`.
+6. **Publish** — see [Publish and credentials](#publish-and-credentials) (`upload`, `deploy`, or `credential push`).
+7. **Certify** — run [Enterprise AI Certification](#enterprise-ai-certification) (`verify-operations` → `verify-trust` → `verify-governance` → `lifecycle`).
+8. **Protection** (optional) — dimension grants in `integration/.protection/` — see [Protection manifests](#protection-manifests).
 
 Rollback an experiment: `datasource capability remove …` → validate → upload/deploy again.
 
+## Publish and credentials
+
+| Command | What it does |
+| --- | --- |
+| `aifabrix upload {{appName}}` | Publishes local integration files to the dataplane (refreshes `{{systemKey}}-deploy.json` from sources) and pushes credential secrets from `integration/{{appName}}/.env` (when present). |
+| `aifabrix upload {{appName}} --force` | Same publish path when the interface or datasource schema changed in ways **deploy cannot accept yet**; bypasses active-schema replacement guards. Read the CLI warning before use. |
+| `aifabrix deploy {{appName}}` | Deploys via the controller pipeline. Does **not** replace a full upload for credential secrets — run `upload` or `credential push` when `.env` changed. |
+| `aifabrix credential push {{appName}}` | Pushes `KV_*` values from `.env` only (no manifest publish). |
+
+```bash
+aifabrix upload {{appName}}
+# or secrets only:
+aifabrix credential push {{appName}}
+
+# Breaking schema / interface change — deploy blocked; publish for dev iteration
+aifabrix validate {{appName}}
+aifabrix upload {{appName}} --force
+```
+
+## Protection manifests
+
+Protection rules live in **`integration/.protection/`** at the **repository root** (sibling to `integration/{{appName}}/`, not inside this app folder). One manifest per **datasource key** (`spec.datasourceKey`). Use YAML or JSON; store expressions only — no secrets in Git.
+
+```bash
+# From repo root (where integration/ lives)
+aifabrix protection create {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}<datasource-key>{{/if}} --type country-sales
+aifabrix protection validate {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}<datasource-key>{{/if}}
+aifabrix protection upload {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}<datasource-key>{{/if}}
+
+# Batch (entire folder)
+aifabrix validate .protection
+aifabrix upload .protection
+```
+
+See `aifabrix protection --help` for flags (`--no-sync` on upload skips datasource sync after upload only).
+
 ## Capabilities (per datasource)
 
 Each `*-datasource-*` file lists **capabilities**: named slices that tie together HTTP/API definitions and execution steps. Use the CLI to clone or drop them safely instead of editing huge JSON by hand.
@@ -71,9 +110,9 @@ af ds cap remove {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}
 
 For flags, run `af ds cap <command> --help`.
 
-## Single datasource lifecycle (production-ready)
+## Per-datasource debug ladder
 
-Start with one datasource and iterate until it’s stable.
+Start with one datasource and iterate until it’s stable (architect / CI — use [Enterprise AI Certification](#enterprise-ai-certification) for the product path).
 
 ```bash
 af ds validate {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}<datasource-key>{{/if}}
@@ -105,14 +144,75 @@ aifabrix repair {{appName}}
 
 Useful flags: `--dry-run`, `--auth <method>`, `--rbac`, `--expose`, `--sync`, `--test`.
 
-## Validate and test
+## Enterprise AI Certification
+
+Product-facing commands that prove operational readiness, AI trust, governance enforcement, and an **Enterprise AI Certification** report. Run after [publish](#publish-and-credentials).
 
-| Command | Network |
+| Command | What it proves |
 | --- | --- |
-| `aifabrix validate {{appName}}` | Off — schemas and files only |
-| `aifabrix test {{appName}}` | Off — local checks |
-| `aifabrix test-integration {{appName}}` | On — needs login + dataplane |
-| `aifabrix test-e2e {{appName}}` | On — full pipeline per datasource |
+| `aifabrix verify-operations {{appName}}` | Operational readiness — orchestrates validate, unit test, integration, and E2E for the whole system |
+| `aifabrix verify-trust {{appName}}` | AI business context confidence (semantic agent metadata; not live vendor API calls) |
+| `aifabrix verify-governance {{appName}}` | **Recommended** — publish (unless `--no-sync`), generate scenario packs on the dataplane, then verify ABAC visibility per subject |
+| `aifabrix governance generate {{appName}}` | Granular: generate packs only (after protection + sync) |
+| `aifabrix governance verify {{appName}}` | Granular: verify only (active packs on dataplane, or `--pack` for local YAML override) |
+| `aifabrix lifecycle {{appName}}` | Certification report from persisted pillar results on the dataplane |
+
+**Recommended order:** `upload` → `verify-operations` → `verify-trust` → `verify-governance` → `lifecycle`
+
+Integration validation packs live under `integration/{{appName}}/scenarios/` (YAML per datasource). Prefer **`verify-governance`** (dataplane-first) after identity sync, protection upload, and `datasource load`. Granular: `governance generate` then `governance verify`. Expert YAML: `governance download` / `governance upload` (424.0 schema; pre-424 files fail with a hint to regenerate). **`governance download`** is read-only and does not publish this folder.
+
+```bash
+aifabrix upload {{appName}}
+
+aifabrix verify-operations {{appName}}
+aifabrix verify-operations {{appName}} -v
+
+aifabrix verify-trust {{appName}} -v
+aifabrix verify-trust {{appName}} --no-sync --revalidate
+
+# Governance pillar (replace <email> with a subject from your scenario pack)
+aifabrix verify-governance {{appName}} --subject-email <email> -v
+aifabrix verify-governance {{appName}} --subject-email <email> --no-sync
+
+# Granular governance (debugging)
+aifabrix governance generate {{appName}} --subject-email <email>
+aifabrix governance verify {{appName}} -v
+
+# Report only (GET persisted results)
+aifabrix lifecycle {{appName}}
+aifabrix lifecycle {{appName}} -v
+
+# Run missing verify steps, publish local files, then print report
+aifabrix lifecycle {{appName}} --run
+aifabrix lifecycle {{appName}} --run --no-sync
+```
+
+**Prerequisites:** `aifabrix login`, dataplane reachable, config published (`upload`). Governance also needs identity sync, protection upload, `datasource load` for fixture records, at least one `--subject-email` or `--subject-user-id`, and `governance:evaluate` on your token. Run `aifabrix verify-governance --help` for flags.
+
+**Single-datasource trust** (same semantic check as system `verify-trust`, one key):
+
+```bash
+aifabrix datasource verify-trust {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}<datasource-key>{{/if}} --app {{appName}} -v
+```
+
+Common flags: `-v` / `--verbose`, `-d` / `--debug` (trust), `--no-sync` (skip pre-run upload), `--json` (machine-readable envelope).
+
+## Debug and low-level tests
+
+Advanced commands for architects and CI. Prefer [Enterprise AI Certification](#enterprise-ai-certification) for integrator proof unless you need step-by-step debugging.
+
+| Command | Network | Notes |
+| --- | --- | --- |
+| `aifabrix validate {{appName}}` | Off | Schemas and files only |
+| `aifabrix test {{appName}}` | Off | Local checks |
+| `aifabrix test-integration {{appName}}` | On | Needs login + dataplane |
+| `aifabrix test-e2e {{appName}}` | On | E2E for every datasource; uploads local files first unless `--no-sync` |
+
+System-level tests publish local integration files before the run (same path as `upload`). Use **`--no-sync`** to validate against config already on the dataplane.
+
+```bash
+aifabrix test-e2e {{appName}} --no-sync -d
+```
 
 Single datasource E2E:
 
@@ -130,7 +230,9 @@ aifabrix datasource test-e2e <datasource-key> --app {{appName}}
 ```
 {{/if}}
 
-Common E2E flags: `-v` / `--verbose`, `-d` / `--debug`, `--no-async`.
+Common flags: `-v` / `--verbose`, `-d` / `--debug`, `--no-async` (datasource E2E only), `--no-sync` (skip pre-run upload on system `test-e2e`).
+
+Debug logs (when using `--debug` on datasource commands) are written under `integration/{{appName}}/logs/` — use `aifabrix datasource log-test`, `log-integration`, `log-e2e`, or `log-trust` to inspect the latest file for each type.
 
 ## Deploy
 
@@ -147,5 +249,8 @@ aifabrix delete {{appName}}
 ## When something fails
 
 - **Validation errors** — Fix JSON/schema issues; run `aifabrix validate {{appName}}` and `aifabrix datasource validate` on the file you changed.
-- **Auth** — `aifabrix auth config` + `aifabrix login` before upload, deploy, or remote tests.
+- **Deploy blocked by schema changes** — When the interface changed and deploy rejects the update, validate locally then `aifabrix upload {{appName}} --force` to publish for dev iteration (see [Publish and credentials](#publish-and-credentials)).
+- **Auth** — `aifabrix auth config` + `aifabrix login` before upload, deploy, remote tests, or certification.
+- **Certification gaps** — Run pillars in order (`verify-operations` → `verify-trust` → `verify-governance`), then `aifabrix lifecycle {{appName}} -v` for per-datasource breakdown; use `lifecycle --run` to execute missing steps and refresh the report.
+- **Governance upload rejected** — Local `scenarios/*.yaml` must meet the 424.0 pack schema; use `verify-governance` or `governance generate` instead of hand-editing old YAML.
 - **Wrong folder** — Run CLI from the project root (where `integration/{{appName}}/` lives).

package/templates/python/docker-compose.hbs

@@ -51,7 +51,7 @@ services:
     env_file:
       - {{envFile}}
     {{#if reloadStartCommand}}
-    command: ["sh", "-c", "cd /app && {{reloadStartCommand}}"]
+    command: ["sh", "-c", "cd /app && {{{reloadStartCommand}}}"]
     {{/if}}
     ports:
       - "{{hostPort}}:{{containerPort}}"
@@ -134,27 +134,28 @@ services:
         done &&
         {{#if databases}}
         {{#each databases}}
-        echo 'Creating {{name}} database and user...' &&
-        if psql -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname = '{{name}}'" 2>/dev/null | grep -q '^1$$'; then
-          echo 'Database "{{name}}" already exists, syncing user password...' &&
-          psql -d postgres -c "ALTER USER \"{{pgUserName name}}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
-          echo 'Database "{{name}}" ok.'
+        echo "Creating $${DB_{{@index}}_NAME} database and user..." &&
+        if psql -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname = '$${DB_{{@index}}_NAME}'" 2>/dev/null | grep -q '^1$$'; then
+          echo "Database \"$${DB_{{@index}}_NAME}\" already exists, syncing user password..." &&
+          psql -d postgres -c "ALTER USER \"$${DB_{{@index}}_USER}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
+          echo "Database \"$${DB_{{@index}}_NAME}\" ok."
         else
-          echo 'Creating database "{{name}}"...' &&
-          psql -d postgres -c "CREATE DATABASE \"{{name}}\";" &&
-          echo 'Dropping old user if exists...' &&
+          echo "Creating database \"$${DB_{{@index}}_NAME}\"..." &&
+          psql -d postgres -c "CREATE DATABASE \"$${DB_{{@index}}_NAME}\";" &&
+          echo "Dropping old user if exists..." &&
           psql -d postgres -c "DROP USER IF EXISTS \"{{pgUserOld name}}\";" || true &&
-          echo 'Creating user "{{pgUserName name}}"...' &&
-          psql -d postgres -c "CREATE USER \"{{pgUserName name}}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
-          echo 'Granting privileges...' &&
-          psql -d postgres -c "GRANT ALL PRIVILEGES ON DATABASE \"{{name}}\" TO \"{{pgUserName name}}\";" &&
-          psql -d {{name}} -c "ALTER SCHEMA public OWNER TO \"{{pgUserName name}}\";" &&
-          psql -d {{name}} -c "GRANT ALL ON SCHEMA public TO \"{{pgUserName name}}\";" &&
-          echo 'Database "{{name}}" created successfully!'
+          psql -d postgres -c "DROP USER IF EXISTS \"$${DB_{{@index}}_USER}\";" || true &&
+          echo "Creating user \"$${DB_{{@index}}_USER}\"..." &&
+          psql -d postgres -c "CREATE USER \"$${DB_{{@index}}_USER}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
+          echo "Granting privileges..." &&
+          psql -d postgres -c "GRANT ALL PRIVILEGES ON DATABASE \"$${DB_{{@index}}_NAME}\" TO \"$${DB_{{@index}}_USER}\";" &&
+          psql -d "$${DB_{{@index}}_NAME}" -c "ALTER SCHEMA public OWNER TO \"$${DB_{{@index}}_USER}\";" &&
+          psql -d "$${DB_{{@index}}_NAME}" -c "GRANT ALL ON SCHEMA public TO \"$${DB_{{@index}}_USER}\";" &&
+          echo "Database \"$${DB_{{@index}}_NAME}\" created successfully!"
         fi &&
         {{#each (extensionsForDb this)}}
-        (psql -d {{../name}} -c 'CREATE EXTENSION IF NOT EXISTS {{pgQuote this}};' || echo 'Warning: could not create extension {{this}}') &&
-        echo 'Extension "{{this}}" enabled on "{{../name}}".' &&
+        (psql -d "$${DB_{{@../index}}_NAME}" -c 'CREATE EXTENSION IF NOT EXISTS {{pgQuote this}};' || echo "Warning: could not create extension {{this}}") &&
+        echo "Extension \"{{this}}\" enabled on \"$${DB_{{@../index}}_NAME}\"." &&
         {{/each}}
         {{/each}}
         {{else}}

package/templates/typescript/docker-compose.hbs

@@ -134,27 +134,28 @@ services:
         done &&
         {{#if databases}}
         {{#each databases}}
-        echo 'Creating {{name}} database and user...' &&
-        if psql -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname = '{{name}}'" 2>/dev/null | grep -q '^1$$'; then
-          echo 'Database "{{name}}" already exists, syncing user password...' &&
-          psql -d postgres -c "ALTER USER \"{{pgUserName name}}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
-          echo 'Database "{{name}}" ok.'
+        echo "Creating $${DB_{{@index}}_NAME} database and user..." &&
+        if psql -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname = '$${DB_{{@index}}_NAME}'" 2>/dev/null | grep -q '^1$$'; then
+          echo "Database \"$${DB_{{@index}}_NAME}\" already exists, syncing user password..." &&
+          psql -d postgres -c "ALTER USER \"$${DB_{{@index}}_USER}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
+          echo "Database \"$${DB_{{@index}}_NAME}\" ok."
         else
-          echo 'Creating database "{{name}}"...' &&
-          psql -d postgres -c "CREATE DATABASE \"{{name}}\";" &&
-          echo 'Dropping old user if exists...' &&
+          echo "Creating database \"$${DB_{{@index}}_NAME}\"..." &&
+          psql -d postgres -c "CREATE DATABASE \"$${DB_{{@index}}_NAME}\";" &&
+          echo "Dropping old user if exists..." &&
           psql -d postgres -c "DROP USER IF EXISTS \"{{pgUserOld name}}\";" || true &&
-          echo 'Creating user "{{pgUserName name}}"...' &&
-          psql -d postgres -c "CREATE USER \"{{pgUserName name}}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
-          echo 'Granting privileges...' &&
-          psql -d postgres -c "GRANT ALL PRIVILEGES ON DATABASE \"{{name}}\" TO \"{{pgUserName name}}\";" &&
-          psql -d {{name}} -c "ALTER SCHEMA public OWNER TO \"{{pgUserName name}}\";" &&
-          psql -d {{name}} -c "GRANT ALL ON SCHEMA public TO \"{{pgUserName name}}\";" &&
-          echo 'Database "{{name}}" created successfully!'
+          psql -d postgres -c "DROP USER IF EXISTS \"$${DB_{{@index}}_USER}\";" || true &&
+          echo "Creating user \"$${DB_{{@index}}_USER}\"..." &&
+          psql -d postgres -c "CREATE USER \"$${DB_{{@index}}_USER}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
+          echo "Granting privileges..." &&
+          psql -d postgres -c "GRANT ALL PRIVILEGES ON DATABASE \"$${DB_{{@index}}_NAME}\" TO \"$${DB_{{@index}}_USER}\";" &&
+          psql -d "$${DB_{{@index}}_NAME}" -c "ALTER SCHEMA public OWNER TO \"$${DB_{{@index}}_USER}\";" &&
+          psql -d "$${DB_{{@index}}_NAME}" -c "GRANT ALL ON SCHEMA public TO \"$${DB_{{@index}}_USER}\";" &&
+          echo "Database \"$${DB_{{@index}}_NAME}\" created successfully!"
         fi &&
         {{#each (extensionsForDb this)}}
-        (psql -d {{../name}} -c 'CREATE EXTENSION IF NOT EXISTS {{pgQuote this}};' || echo 'Warning: could not create extension {{this}}') &&
-        echo 'Extension "{{this}}" enabled on "{{../name}}".' &&
+        (psql -d "$${DB_{{@../index}}_NAME}" -c 'CREATE EXTENSION IF NOT EXISTS {{pgQuote this}};' || echo "Warning: could not create extension {{this}}") &&
+        echo "Extension \"{{this}}\" enabled on \"$${DB_{{@../index}}_NAME}\"." &&
         {{/each}}
         {{/each}}
         {{else}}