@aifabrix/builder 2.45.5 → 2.46.0

package/lib/utils/url-declarative-vdir-inactive-env.js

@@ -15,6 +15,7 @@ const yaml = require('js-yaml');
 const { existsSync, readFileSync } = require('../internal/fs-real-sync');
 const { DECLARATIVE_URL_INFRA_DEFAULTS } = require('./infra-env-defaults');
 const { computePathActive } = require('./url-declarative-url-flags');
+const { resolveInactiveVdirRewriteEnvKeys } = require('./app-relative-path-env');
 
 /**
  * Treat common YAML / string forms as enabled (strict `=== true` alone missed some parsers).
@@ -52,16 +53,22 @@ const INACTIVE_VDIR_PUBLIC_ENV_FALLBACK =
 /**
  * @param {string} content - .env template fragment
  * @param {string} replacement
+ * @param {ReadonlySet<string>} rewriteKeys
  * @returns {string}
  */
-function applyInactiveVdirPublicTokenRewrite(content, replacement) {
+function applyInactiveVdirPublicTokenRewrite(content, replacement, rewriteKeys) {
   if (!content || !content.includes(URL_DECLARATIVE_VDIR_PUBLIC_TOKEN)) {
     return content;
   }
   const escaped = URL_DECLARATIVE_VDIR_PUBLIC_TOKEN.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
   // End line with [ \t]* only — \s would consume \n and strip line endings from the file.
-  const lineRe = new RegExp(`^(\\s*[A-Z][A-Z0-9_]*)\\s*=\\s*${escaped}[ \t]*$`, 'gm');
-  return content.replace(lineRe, (_, lhs) => `${lhs}=${replacement}`);
+  const lineRe = new RegExp(`^(\\s*)([A-Z][A-Z0-9_]*)\\s*=\\s*${escaped}[ \t]*$`, 'gm');
+  return content.replace(lineRe, (match, indent, key) => {
+    if (!rewriteKeys.has(key)) {
+      return match;
+    }
+    return `${indent}${key}=${replacement}`;
+  });
 }
 
 /**
@@ -88,12 +95,15 @@ function rewriteInactiveDeclarativeVdirPublicContent(content, variablesPath, use
   if (pathActive) {
     return content;
   }
-  return applyInactiveVdirPublicTokenRewrite(content, INACTIVE_VDIR_PUBLIC_ENV_FALLBACK);
+  const appKey = doc && doc.app && doc.app.key;
+  const rewriteKeys = resolveInactiveVdirRewriteEnvKeys(appKey);
+  return applyInactiveVdirPublicTokenRewrite(content, INACTIVE_VDIR_PUBLIC_ENV_FALLBACK, rewriteKeys);
 }
 
 module.exports = {
   URL_DECLARATIVE_VDIR_PUBLIC_TOKEN,
   INACTIVE_VDIR_PUBLIC_ENV_FALLBACK,
+  loadApplicationYamlDoc,
   applyInactiveVdirPublicTokenRewrite,
   rewriteInactiveDeclarativeVdirPublicContent,
   isFrontDoorRoutingEnabledInDoc

package/lib/utils/validation-poll-ui.js

@@ -48,6 +48,14 @@ const NON_TTY_THROTTLE_MS = 5000;
  * @returns {{ usesSpinner: boolean, onPollProgress: Function, finish: () => void }}
  */
 function createValidationPollHandlers(deadlineMs, opts = {}) {
+  if (opts.quiet === true) {
+    return {
+      usesSpinner: false,
+      onPollProgress: () => {},
+      finish: () => {}
+    };
+  }
+
   const subject = opts.subject;
   if (shouldUseValidationPollSpinner()) {
     const ora = require('ora');

package/lib/utils/validation-run-stage.js

@@ -0,0 +1,45 @@
+/**
+ * @fileoverview Map legacy validation runType to contract stage (dataplane 370.07).
+ */
+
+'use strict';
+
+/** @typedef {'readiness'|'simulation'|'integration'|'e2e'} ValidationRunStage */
+
+/** @type {Record<string, ValidationRunStage>} */
+const RUN_TYPE_TO_STAGE = {
+  test: 'readiness',
+  integration: 'integration',
+  e2e: 'e2e'
+};
+
+/**
+ * Contract stage for a CLI/API runType (default product mapping).
+ * @param {string} runType - test | integration | e2e
+ * @returns {ValidationRunStage}
+ */
+function stageForRunType(runType) {
+  const key = String(runType || 'test');
+  return RUN_TYPE_TO_STAGE[key] || 'readiness';
+}
+
+/**
+ * Attach stage to a validation/run POST body when absent.
+ * @param {Object} body
+ * @param {string} [runType]
+ * @returns {Object}
+ */
+function withStageOnValidationRunBody(body, runType) {
+  const out = { ...body };
+  const rt = runType || out.runType || 'test';
+  if (!out.stage) {
+    out.stage = stageForRunType(rt);
+  }
+  return out;
+}
+
+module.exports = {
+  RUN_TYPE_TO_STAGE,
+  stageForRunType,
+  withStageOnValidationRunBody
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.45.5",
+  "version": "2.46.0",
   "description": "AI Fabrix Local Fabric & Deployment SDK",
   "main": "lib/index.js",
   "bin": {

package/templates/applications/dataplane/application.yaml

@@ -64,7 +64,8 @@ build:
   dockerfile: builder/dataplane/Dockerfile  # Dockerfile path (relative to project root)
   envOutputPath: ../../.env       # Copy to repo root for local dev
   language: python                # Runtime language for template selection (typescript or python)
-  reloadStart: uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001} --reload  # PORT set from port above at run time; default 3001 must match port
+  # Dev reload: polling + watch /app/app only (avoids EMFILE on full repo bind-mount). See run_local.py, make af-reload.
+  reloadStart: WATCHFILES_FORCE_POLLING=1 uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001} --reload --reload-dir /app/app
   # Pulled-image local compose (no bind-mount): drives `command` in generated docker-compose. Override for non-standard images (e.g. stub ACR tags).
   imageRun: exec python -m uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-3001}
 

package/templates/applications/dataplane/env.template

@@ -32,10 +32,12 @@ API_V1_STR=/api/v1
 VERSION=1.9.5
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
-MIN_BUILDER_CLI_VERSION=2.45.0
+MIN_BUILDER_CLI_VERSION=2.45.5
 # Base URL for the dataplane web server (used for default OAuth2 callback URL when redirectUri is omitted)
 # url:// resolves after kv://; includes front-door path from application.yaml (e.g. /data)
 DATAPLANE_WEB_SERVER_URL=url://public
+# Relative URL path where dataplane is served by reverse proxy (for prefixed deployments, e.g. /data).
+DATAPLANE_RELATIVE_PATH=url://vdir-public
 DATAPLANE_INTERNAL_URL=url://internal
 
 # CORS Configuration
@@ -177,6 +179,14 @@ AUDIT_ASYNC_SHADOW_ENQUEUE=false
 # Set true for local dev policy CRUD; pair with VITE_POLICY_MANAGEMENT_ENABLED=true in app-ui.
 POLICY_MANAGEMENT_API_ENABLED=false
 
+# First-party HTTP internal SpecFile (398.2 / plan 397). When true, lifespan upserts
+# internal:dataplane-first-party-http from the live COM-merged OpenAPI schema.
+FIRST_PARTY_HTTP_INTERNAL_SPEC_SYNC_ON_STARTUP=false
+# Upsert internal:dataplane-first-party-http after pipeline external-system publish.
+FIRST_PARTY_HTTP_INTERNAL_SPEC_SYNC_ON_PUBLISH=false
+# Optional external_systems.id for spec_files FK; empty uses first row when startup sync is on.
+FIRST_PARTY_HTTP_INTERNAL_SPEC_EXTERNAL_SYSTEM_ID=
+
 # =============================================================================
 # OBSERVABILITY CONFIGURATION
 # =============================================================================
@@ -198,6 +208,19 @@ CERTIFICATE_PUBLIC_KEY=
 # Optional public key identifier for issued certificates; default if unset: dataplane-signing-key
 CERTIFICATE_PUBLIC_KEY_ID=
 
+# =============================================================================
+# VALIDATION ENGINE — YAML CONTRACTS
+# =============================================================================
+# Load rules from repo contracts/ and schedule hybrid YAML tasks (see docs/adr/0001-validation-engine-yaml-contracts.md).
+# Code defaults when unset: VALIDATION_CONTRACTS_ENABLED=false, VALIDATION_RULESET=legacy.
+# hybrid = legacy Python categories + YAML rules; yaml = YAML/hybrid only (requires contracts enabled).
+# Optional override for contract bundle root (default: <dataplane-repo>/contracts):
+# VALIDATION_CONTRACTS_ROOT=
+VALIDATION_CONTRACTS_ENABLED=true
+VALIDATION_RULESET=hybrid
+# Attach advisory yamlSuggestedLevel + contract metadata on certification details (does not change ICC/PDS level selection).
+VALIDATION_CERTIFICATION_YAML_ENABLED=true
+
 # After a successful POST /api/v1/validation/run (validation engine with certification passed, or E2E success),
 # persist an active integration certificate without a separate issue call. Set false to require explicit issue only.
 VALIDATION_AUTO_ISSUE_INTEGRATION_CERTIFICATE=true

package/templates/applications/miso-controller/env.template

@@ -167,6 +167,22 @@ MISO_CLIENTSECRET=kv://miso-controller-client-secretKeyVault
 # Unset = use DB only.
 CONTROLLER_EVALUATION=
 
+# =============================================================================
+# ENTRA ID ONBOARDING (vendor multi-tenant app — admin consent)
+# =============================================================================
+# AI Fabrix vendor app for TA-1 admin consent and Entra ID configure flows.
+# Customer SSO after configure uses a separate enterprise app (AI Fabrix Miso);
+# Keycloak broker redirect is on that customer app, not ENTRA_ID_CLIENT_ID.
+#
+# ENTRA_ID_CENTRAL_CALLBACK_URI — Web redirect on the vendor app; must point at
+# Mori (e.g. …/entra-id-concent/callback), not the SPA or controller.
+# ENTRA_CALLBACK_STATE_SECRET — Shared HMAC secret (min 16 chars) for OAuth state
+# between controller and Mori callback service; same value on Mori and controller.
+ENTRA_CALLBACK_STATE_SECRET=kv://entra-callback-state-secret
+ENTRA_ID_CENTRAL_CALLBACK_URI=kv://entra-callback-uri
+ENTRA_ID_CLIENT_ID=kv://entra-client-idKeyVault
+ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
+
 # =============================================================================
 # TENANT ACTIVATION (TA-3) — EXISTING LLM CATALOG
 # =============================================================================

package/templates/external-system/README.md.hbs

@@ -23,6 +23,7 @@
 | `{{systemKey}}-deploy.json` | Deploy manifest (`aifabrix json {{appName}}`) |
 | `deploy.js` | Deploy helper |
 | `wizard.yaml` | Wizard input |
+| `scenarios/*.yaml` | Governance scenario packs (optional; dataplane-first via `verify-governance` / `governance generate`; expert YAML via `governance download` / `upload`) |
 | `{{rbacOptionalFile}}` | Roles and permissions |
 
 ## Typical workflow
@@ -33,7 +34,8 @@
 4. **Check locally** — `aifabrix validate {{appName}}` and `aifabrix datasource validate` on files you touched.
 5. **Align manifest** — `aifabrix repair {{appName}}` after bigger edits.
 6. **Publish** — see [Publish and credentials](#publish-and-credentials) (`upload`, `deploy`, or `credential push`).
-7. **Protection** (optional) — dimension grants in `integration/.protection/` — see [Protection manifests](#protection-manifests).
+7. **Certify** — run [Enterprise AI Certification](#enterprise-ai-certification) (`verify-operations` → `verify-trust` → `verify-governance` → `lifecycle`).
+8. **Protection** (optional) — dimension grants in `integration/.protection/` — see [Protection manifests](#protection-manifests).
 
 Rollback an experiment: `datasource capability remove …` → validate → upload/deploy again.
 
@@ -41,7 +43,8 @@ Rollback an experiment: `datasource capability remove …` → validate → uplo
 
 | Command | What it does |
 | --- | --- |
-| `aifabrix upload {{appName}}` | Publishes local integration files to the dataplane and pushes credential secrets from `integration/{{appName}}/.env` (when present). |
+| `aifabrix upload {{appName}}` | Publishes local integration files to the dataplane (refreshes `{{systemKey}}-deploy.json` from sources) and pushes credential secrets from `integration/{{appName}}/.env` (when present). |
+| `aifabrix upload {{appName}} --force` | Same publish path when the interface or datasource schema changed in ways **deploy cannot accept yet**; bypasses active-schema replacement guards. Read the CLI warning before use. |
 | `aifabrix deploy {{appName}}` | Deploys via the controller pipeline. Does **not** replace a full upload for credential secrets — run `upload` or `credential push` when `.env` changed. |
 | `aifabrix credential push {{appName}}` | Pushes `KV_*` values from `.env` only (no manifest publish). |
 
@@ -49,6 +52,10 @@ Rollback an experiment: `datasource capability remove …` → validate → uplo
 aifabrix upload {{appName}}
 # or secrets only:
 aifabrix credential push {{appName}}
+
+# Breaking schema / interface change — deploy blocked; publish for dev iteration
+aifabrix validate {{appName}}
+aifabrix upload {{appName}} --force
 ```
 
 ## Protection manifests
@@ -103,9 +110,9 @@ af ds cap remove {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}
 
 For flags, run `af ds cap <command> --help`.
 
-## Single datasource lifecycle (production-ready)
+## Per-datasource debug ladder
 
-Start with one datasource and iterate until it’s stable.
+Start with one datasource and iterate until it’s stable (architect / CI — use [Enterprise AI Certification](#enterprise-ai-certification) for the product path).
 
 ```bash
 af ds validate {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}<datasource-key>{{/if}}
@@ -137,7 +144,62 @@ aifabrix repair {{appName}}
 
 Useful flags: `--dry-run`, `--auth <method>`, `--rbac`, `--expose`, `--sync`, `--test`.
 
-## Validate and test
+## Enterprise AI Certification
+
+Product-facing commands that prove operational readiness, AI trust, governance enforcement, and an **Enterprise AI Certification** report. Run after [publish](#publish-and-credentials).
+
+| Command | What it proves |
+| --- | --- |
+| `aifabrix verify-operations {{appName}}` | Operational readiness — orchestrates validate, unit test, integration, and E2E for the whole system |
+| `aifabrix verify-trust {{appName}}` | AI business context confidence (semantic agent metadata; not live vendor API calls) |
+| `aifabrix verify-governance {{appName}}` | **Recommended** — publish (unless `--no-sync`), generate scenario packs on the dataplane, then verify ABAC visibility per subject |
+| `aifabrix governance generate {{appName}}` | Granular: generate packs only (after protection + sync) |
+| `aifabrix governance verify {{appName}}` | Granular: verify only (active packs on dataplane, or `--pack` for local YAML override) |
+| `aifabrix lifecycle {{appName}}` | Certification report from persisted pillar results on the dataplane |
+
+**Recommended order:** `upload` → `verify-operations` → `verify-trust` → `verify-governance` → `lifecycle`
+
+Integration validation packs live under `integration/{{appName}}/scenarios/` (YAML per datasource). Prefer **`verify-governance`** (dataplane-first) after identity sync, protection upload, and `datasource load`. Granular: `governance generate` then `governance verify`. Expert YAML: `governance download` / `governance upload` (424.0 schema; pre-424 files fail with a hint to regenerate). **`governance download`** is read-only and does not publish this folder.
+
+```bash
+aifabrix upload {{appName}}
+
+aifabrix verify-operations {{appName}}
+aifabrix verify-operations {{appName}} -v
+
+aifabrix verify-trust {{appName}} -v
+aifabrix verify-trust {{appName}} --no-sync --revalidate
+
+# Governance pillar (replace <email> with a subject from your scenario pack)
+aifabrix verify-governance {{appName}} --subject-email <email> -v
+aifabrix verify-governance {{appName}} --subject-email <email> --no-sync
+
+# Granular governance (debugging)
+aifabrix governance generate {{appName}} --subject-email <email>
+aifabrix governance verify {{appName}} -v
+
+# Report only (GET persisted results)
+aifabrix lifecycle {{appName}}
+aifabrix lifecycle {{appName}} -v
+
+# Run missing verify steps, publish local files, then print report
+aifabrix lifecycle {{appName}} --run
+aifabrix lifecycle {{appName}} --run --no-sync
+```
+
+**Prerequisites:** `aifabrix login`, dataplane reachable, config published (`upload`). Governance also needs identity sync, protection upload, `datasource load` for fixture records, at least one `--subject-email` or `--subject-user-id`, and `governance:evaluate` on your token. Run `aifabrix verify-governance --help` for flags.
+
+**Single-datasource trust** (same semantic check as system `verify-trust`, one key):
+
+```bash
+aifabrix datasource verify-trust {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}<datasource-key>{{/if}} --app {{appName}} -v
+```
+
+Common flags: `-v` / `--verbose`, `-d` / `--debug` (trust), `--no-sync` (skip pre-run upload), `--json` (machine-readable envelope).
+
+## Debug and low-level tests
+
+Advanced commands for architects and CI. Prefer [Enterprise AI Certification](#enterprise-ai-certification) for integrator proof unless you need step-by-step debugging.
 
 | Command | Network | Notes |
 | --- | --- | --- |
@@ -145,14 +207,11 @@ Useful flags: `--dry-run`, `--auth <method>`, `--rbac`, `--expose`, `--sync`, `-
 | `aifabrix test {{appName}}` | Off | Local checks |
 | `aifabrix test-integration {{appName}}` | On | Needs login + dataplane |
 | `aifabrix test-e2e {{appName}}` | On | E2E for every datasource; uploads local files first unless `--no-sync` |
-| `aifabrix test-trust {{appName}}` | On | Semantic agent metadata trust (not live API E2E); uploads first unless `--no-sync` |
 
 System-level tests publish local integration files before the run (same path as `upload`). Use **`--no-sync`** to validate against config already on the dataplane.
 
 ```bash
-aifabrix test-trust {{appName}}
-aifabrix test-trust {{appName}} --no-sync
-aifabrix test-e2e {{appName}} --no-sync
+aifabrix test-e2e {{appName}} --no-sync -d
 ```
 
 Single datasource E2E:
@@ -171,14 +230,9 @@ aifabrix datasource test-e2e <datasource-key> --app {{appName}}
 ```
 {{/if}}
 
-Common flags: `-v` / `--verbose`, `-d` / `--debug`, `--no-async` (datasource E2E only), `--no-sync` (skip pre-run upload on system `test-e2e` / `test-trust`).
+Common flags: `-v` / `--verbose`, `-d` / `--debug`, `--no-async` (datasource E2E only), `--no-sync` (skip pre-run upload on system `test-e2e`).
 
-Datasource trust (one key; uploads before run unless `--no-sync`):
-
-```bash
-aifabrix datasource test-trust {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}<datasource-key>{{/if}} --app {{appName}}
-aifabrix datasource test-trust {{#if hasDatasources}}{{datasources.[0].datasourceKey}}{{else}}<datasource-key>{{/if}} --app {{appName}} --no-sync --revalidate
-```
+Debug logs (when using `--debug` on datasource commands) are written under `integration/{{appName}}/logs/` — use `aifabrix datasource log-test`, `log-integration`, `log-e2e`, or `log-trust` to inspect the latest file for each type.
 
 ## Deploy
 
@@ -195,5 +249,8 @@ aifabrix delete {{appName}}
 ## When something fails
 
 - **Validation errors** — Fix JSON/schema issues; run `aifabrix validate {{appName}}` and `aifabrix datasource validate` on the file you changed.
-- **Auth** — `aifabrix auth config` + `aifabrix login` before upload, deploy, or remote tests.
+- **Deploy blocked by schema changes** — When the interface changed and deploy rejects the update, validate locally then `aifabrix upload {{appName}} --force` to publish for dev iteration (see [Publish and credentials](#publish-and-credentials)).
+- **Auth** — `aifabrix auth config` + `aifabrix login` before upload, deploy, remote tests, or certification.
+- **Certification gaps** — Run pillars in order (`verify-operations` → `verify-trust` → `verify-governance`), then `aifabrix lifecycle {{appName}} -v` for per-datasource breakdown; use `lifecycle --run` to execute missing steps and refresh the report.
+- **Governance upload rejected** — Local `scenarios/*.yaml` must meet the 424.0 pack schema; use `verify-governance` or `governance generate` instead of hand-editing old YAML.
 - **Wrong folder** — Run CLI from the project root (where `integration/{{appName}}/` lives).

package/templates/python/docker-compose.hbs

@@ -51,7 +51,7 @@ services:
     env_file:
       - {{envFile}}
     {{#if reloadStartCommand}}
-    command: ["sh", "-c", "cd /app && {{reloadStartCommand}}"]
+    command: ["sh", "-c", "cd /app && {{{reloadStartCommand}}}"]
     {{/if}}
     ports:
       - "{{hostPort}}:{{containerPort}}"
@@ -134,27 +134,28 @@ services:
         done &&
         {{#if databases}}
         {{#each databases}}
-        echo 'Creating {{name}} database and user...' &&
-        if psql -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname = '{{name}}'" 2>/dev/null | grep -q '^1$$'; then
-          echo 'Database "{{name}}" already exists, syncing user password...' &&
-          psql -d postgres -c "ALTER USER \"{{pgUserName name}}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
-          echo 'Database "{{name}}" ok.'
+        echo "Creating $${DB_{{@index}}_NAME} database and user..." &&
+        if psql -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname = '$${DB_{{@index}}_NAME}'" 2>/dev/null | grep -q '^1$$'; then
+          echo "Database \"$${DB_{{@index}}_NAME}\" already exists, syncing user password..." &&
+          psql -d postgres -c "ALTER USER \"$${DB_{{@index}}_USER}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
+          echo "Database \"$${DB_{{@index}}_NAME}\" ok."
         else
-          echo 'Creating database "{{name}}"...' &&
-          psql -d postgres -c "CREATE DATABASE \"{{name}}\";" &&
-          echo 'Dropping old user if exists...' &&
+          echo "Creating database \"$${DB_{{@index}}_NAME}\"..." &&
+          psql -d postgres -c "CREATE DATABASE \"$${DB_{{@index}}_NAME}\";" &&
+          echo "Dropping old user if exists..." &&
           psql -d postgres -c "DROP USER IF EXISTS \"{{pgUserOld name}}\";" || true &&
-          echo 'Creating user "{{pgUserName name}}"...' &&
-          psql -d postgres -c "CREATE USER \"{{pgUserName name}}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
-          echo 'Granting privileges...' &&
-          psql -d postgres -c "GRANT ALL PRIVILEGES ON DATABASE \"{{name}}\" TO \"{{pgUserName name}}\";" &&
-          psql -d {{name}} -c "ALTER SCHEMA public OWNER TO \"{{pgUserName name}}\";" &&
-          psql -d {{name}} -c "GRANT ALL ON SCHEMA public TO \"{{pgUserName name}}\";" &&
-          echo 'Database "{{name}}" created successfully!'
+          psql -d postgres -c "DROP USER IF EXISTS \"$${DB_{{@index}}_USER}\";" || true &&
+          echo "Creating user \"$${DB_{{@index}}_USER}\"..." &&
+          psql -d postgres -c "CREATE USER \"$${DB_{{@index}}_USER}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
+          echo "Granting privileges..." &&
+          psql -d postgres -c "GRANT ALL PRIVILEGES ON DATABASE \"$${DB_{{@index}}_NAME}\" TO \"$${DB_{{@index}}_USER}\";" &&
+          psql -d "$${DB_{{@index}}_NAME}" -c "ALTER SCHEMA public OWNER TO \"$${DB_{{@index}}_USER}\";" &&
+          psql -d "$${DB_{{@index}}_NAME}" -c "GRANT ALL ON SCHEMA public TO \"$${DB_{{@index}}_USER}\";" &&
+          echo "Database \"$${DB_{{@index}}_NAME}\" created successfully!"
         fi &&
         {{#each (extensionsForDb this)}}
-        (psql -d {{../name}} -c 'CREATE EXTENSION IF NOT EXISTS {{pgQuote this}};' || echo 'Warning: could not create extension {{this}}') &&
-        echo 'Extension "{{this}}" enabled on "{{../name}}".' &&
+        (psql -d "$${DB_{{@../index}}_NAME}" -c 'CREATE EXTENSION IF NOT EXISTS {{pgQuote this}};' || echo "Warning: could not create extension {{this}}") &&
+        echo "Extension \"{{this}}\" enabled on \"$${DB_{{@../index}}_NAME}\"." &&
         {{/each}}
         {{/each}}
         {{else}}

package/templates/typescript/docker-compose.hbs

@@ -134,27 +134,28 @@ services:
         done &&
         {{#if databases}}
         {{#each databases}}
-        echo 'Creating {{name}} database and user...' &&
-        if psql -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname = '{{name}}'" 2>/dev/null | grep -q '^1$$'; then
-          echo 'Database "{{name}}" already exists, syncing user password...' &&
-          psql -d postgres -c "ALTER USER \"{{pgUserName name}}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
-          echo 'Database "{{name}}" ok.'
+        echo "Creating $${DB_{{@index}}_NAME} database and user..." &&
+        if psql -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname = '$${DB_{{@index}}_NAME}'" 2>/dev/null | grep -q '^1$$'; then
+          echo "Database \"$${DB_{{@index}}_NAME}\" already exists, syncing user password..." &&
+          psql -d postgres -c "ALTER USER \"$${DB_{{@index}}_USER}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
+          echo "Database \"$${DB_{{@index}}_NAME}\" ok."
         else
-          echo 'Creating database "{{name}}"...' &&
-          psql -d postgres -c "CREATE DATABASE \"{{name}}\";" &&
-          echo 'Dropping old user if exists...' &&
+          echo "Creating database \"$${DB_{{@index}}_NAME}\"..." &&
+          psql -d postgres -c "CREATE DATABASE \"$${DB_{{@index}}_NAME}\";" &&
+          echo "Dropping old user if exists..." &&
           psql -d postgres -c "DROP USER IF EXISTS \"{{pgUserOld name}}\";" || true &&
-          echo 'Creating user "{{pgUserName name}}"...' &&
-          psql -d postgres -c "CREATE USER \"{{pgUserName name}}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
-          echo 'Granting privileges...' &&
-          psql -d postgres -c "GRANT ALL PRIVILEGES ON DATABASE \"{{name}}\" TO \"{{pgUserName name}}\";" &&
-          psql -d {{name}} -c "ALTER SCHEMA public OWNER TO \"{{pgUserName name}}\";" &&
-          psql -d {{name}} -c "GRANT ALL ON SCHEMA public TO \"{{pgUserName name}}\";" &&
-          echo 'Database "{{name}}" created successfully!'
+          psql -d postgres -c "DROP USER IF EXISTS \"$${DB_{{@index}}_USER}\";" || true &&
+          echo "Creating user \"$${DB_{{@index}}_USER}\"..." &&
+          psql -d postgres -c "CREATE USER \"$${DB_{{@index}}_USER}\" WITH PASSWORD '"$${DB_{{@index}}_PASSWORD}"';" &&
+          echo "Granting privileges..." &&
+          psql -d postgres -c "GRANT ALL PRIVILEGES ON DATABASE \"$${DB_{{@index}}_NAME}\" TO \"$${DB_{{@index}}_USER}\";" &&
+          psql -d "$${DB_{{@index}}_NAME}" -c "ALTER SCHEMA public OWNER TO \"$${DB_{{@index}}_USER}\";" &&
+          psql -d "$${DB_{{@index}}_NAME}" -c "GRANT ALL ON SCHEMA public TO \"$${DB_{{@index}}_USER}\";" &&
+          echo "Database \"$${DB_{{@index}}_NAME}\" created successfully!"
         fi &&
         {{#each (extensionsForDb this)}}
-        (psql -d {{../name}} -c 'CREATE EXTENSION IF NOT EXISTS {{pgQuote this}};' || echo 'Warning: could not create extension {{this}}') &&
-        echo 'Extension "{{this}}" enabled on "{{../name}}".' &&
+        (psql -d "$${DB_{{@../index}}_NAME}" -c 'CREATE EXTENSION IF NOT EXISTS {{pgQuote this}};' || echo "Warning: could not create extension {{this}}") &&
+        echo "Extension \"{{this}}\" enabled on \"$${DB_{{@../index}}_NAME}\"." &&
         {{/each}}
         {{/each}}
         {{else}}

package/lib/commands/test-governance-command-action.js

@@ -1,55 +0,0 @@
-/**
- * @fileoverview CLI action for `aifabrix test-governance` (plan 406)
- * @author AI Fabrix Team
- * @version 1.0.0
- */
-
-'use strict';
-
-const { handleCommandError } = require('../utils/cli-utils');
-const { runTestGovernanceForExternalSystem } = require('./test-governance-external');
-const { normalizeTestGovernanceCliOptions } = require('./test-governance-cli-options');
-const {
-  displayGovernanceRunTTY,
-  printGovernanceRunJson,
-  exitCodeFromGovernanceSummary
-} = require('../governance/governance-run-display');
-
-/**
- * @async
- * @param {string} appName
- * @param {Object} options
- * @param {import('commander').Command} [cmd]
- */
-async function runTestGovernanceCommandAction(appName, options, cmd) {
-  const opts = normalizeTestGovernanceCliOptions(options, cmd);
-  const { result, packPath, systemKey } = await runTestGovernanceForExternalSystem(appName, opts);
-
-  if (opts.json) {
-    printGovernanceRunJson(result);
-  } else {
-    displayGovernanceRunTTY(systemKey, result, {
-      verbose: opts.verbose,
-      packPath
-    });
-  }
-
-  const exitCode = exitCodeFromGovernanceSummary(result.summary);
-  if (exitCode !== 0) {
-    process.exit(exitCode);
-  }
-}
-
-async function testGovernanceCommandHandler(appName, options, cmd) {
-  try {
-    await runTestGovernanceCommandAction(appName, options, cmd);
-  } catch (error) {
-    handleCommandError(error, 'test-governance');
-    process.exit(3);
-  }
-}
-
-module.exports = {
-  runTestGovernanceCommandAction,
-  testGovernanceCommandHandler
-};

package/lib/commands/test-trust-command-action.js

@@ -1,118 +0,0 @@
-/**
- * @fileoverview CLI action for `aifabrix test-trust` (plan 143).
- * @author AI Fabrix Team
- * @version 1.0.0
- */
-
-'use strict';
-
-const chalk = require('chalk');
-const logger = require('../utils/logger');
-const { handleCommandError } = require('../utils/cli-utils');
-const { runTestTrustForExternalSystem } = require('./test-trust-external');
-const {
-  displaySystemTrustRollupTTY,
-  displayAgentTrustRunTTY
-} = require('../utils/agent-trust-run-display');
-const { computeSystemExitCodeFromTrustRows } = require('../utils/agent-trust-run-exit');
-const { writeTrustDebugLogAndPrint } = require('../datasource/agent-trust-debug-log');
-const { normalizeTestTrustCliOptions } = require('./test-trust-cli-options');
-
-/**
- * @async
- * @param {string} appName
- * @param {Object} options
- */
-async function writeSystemTrustDebugLogs(appName, results, options) {
-  if (!options.debug) return;
-  logger.log('');
-  logger.log(chalk.gray('Debug logs:'));
-  for (const row of results) {
-    await writeTrustDebugLogAndPrint(appName, row.key, {
-      request: {
-        datasourceKey: row.key,
-        revalidate: options.revalidate === true,
-        noSync: options.noSync === true
-      },
-      response: row.trustRun,
-      error: row.error || null
-    });
-  }
-}
-
-function displaySystemTrustResults(systemKey, appName, results, options) {
-  if (options.json) {
-    logger.log(JSON.stringify(results, null, 2));
-    return;
-  }
-  if (options.summary) {
-    for (const row of results) {
-      const tr = row.trustRun;
-      const line = tr
-        ? `${row.key}: ${tr.trustDecision} (${tr.validationStatus})`
-        : `${row.key}: fail (${row.error || 'error'})`;
-      logger.log(line);
-    }
-    return;
-  }
-
-  const displayOpts = {
-    strict: options.strict === true,
-    showCache: options.verbose === true || options.revalidate === true
-  };
-  displaySystemTrustRollupTTY(systemKey || appName, results, displayOpts);
-
-  if (!options.verbose) return;
-
-  for (const row of results) {
-    if (!row.trustRun) continue;
-    displayAgentTrustRunTTY(row.trustRun, {
-      environment: options.env,
-      verbose: true,
-      noSync: options.noSync === true,
-      strict: options.strict === true
-    });
-  }
-}
-
-async function runTestTrustCommandAction(appName, options, cmd) {
-  const opts = normalizeTestTrustCliOptions(options, cmd);
-  const pathsUtil = require('../utils/paths');
-  const appType = await pathsUtil.detectAppType(appName).catch(() => null);
-  if (!appType || appType.baseDir !== 'integration') {
-    throw new Error(
-      'test-trust applies to external integration folders only (integration/<systemKey>/).'
-    );
-  }
-  const { success, results, systemKey } = await runTestTrustForExternalSystem(appName, {
-    env: opts.env,
-    verbose: opts.verbose,
-    debug: opts.debug,
-    noSync: opts.noSync === true,
-    revalidate: opts.revalidate === true,
-    summary: opts.summary === true,
-    timeout: opts.timeout
-  });
-  displaySystemTrustResults(systemKey, appName, results, opts);
-  await writeSystemTrustDebugLogs(appName, results, opts);
-  const exitCode = computeSystemExitCodeFromTrustRows(results, {
-    warningsAsErrors: opts.warningsAsErrors === true,
-    strict: opts.strict === true
-  });
-  if (exitCode !== 0) process.exit(exitCode);
-  if (!success) process.exit(1);
-}
-
-async function testTrustCommandHandler(appName, options, cmd) {
-  try {
-    await runTestTrustCommandAction(appName, options, cmd);
-  } catch (error) {
-    handleCommandError(error, 'test-trust');
-    process.exit(3);
-  }
-}
-
-module.exports = {
-  runTestTrustCommandAction,
-  testTrustCommandHandler
-};