@aifabrix/builder 2.45.5 → 2.47.0

package/lib/utils/load-cip-capacity-display-config.js

@@ -8,8 +8,8 @@
 
 'use strict';
 
-const fs = require('fs');
 const path = require('path');
+const { existsSync, readFileSync } = require('../internal/fs-real-sync');
 
 /**
  * @param {object|null} schema - Parsed external-datasource.schema.json
@@ -33,8 +33,8 @@ function extractStandardOperationOrderFromSchema(schema) {
  */
 function tryReadJsonFile(p) {
   try {
-    if (!p || !fs.existsSync(p)) return null;
-    return JSON.parse(fs.readFileSync(p, 'utf8'));
+    if (!p || !existsSync(p)) return null;
+    return JSON.parse(readFileSync(p, 'utf8'));
   } catch {
     return null;
   }
@@ -48,25 +48,74 @@ function tryReadJsonFile(p) {
 function resolveExternalDatasourceSchemaPath() {
   if (process.env.AIFABRIX_EXTERNAL_DATASOURCE_SCHEMA) {
     const envPath = String(process.env.AIFABRIX_EXTERNAL_DATASOURCE_SCHEMA).trim();
-    if (envPath && fs.existsSync(envPath)) return envPath;
+    if (envPath && existsSync(envPath)) return envPath;
   }
   const candidates = [
+    path.join(__dirname, '../schema/external-datasource.schema.json'),
     path.join(process.cwd(), 'app/schemas/json/external-datasource.schema.json'),
     path.join(process.cwd(), 'aifabrix-dataplane/app/schemas/json/external-datasource.schema.json'),
     path.join(process.cwd(), '..', 'aifabrix-dataplane', 'app/schemas/json/external-datasource.schema.json'),
     path.join(__dirname, '../../../aifabrix-dataplane/app/schemas/json/external-datasource.schema.json')
   ];
   for (const c of candidates) {
-    if (c && fs.existsSync(c)) return c;
+    if (c && existsSync(c)) return c;
   }
   return null;
 }
 
 const FALLBACK_PATH = path.join(__dirname, '../schema/cip-capacity-display.fallback.json');
 
+/**
+ * When schema/fallback JSON cannot be read (missing file, parse error, or Jest fs mocks in a shared worker).
+ * Must stay aligned with `cip-capacity-display.fallback.json` and dataplane `cipDefinition.operations`.
+ */
+const HARDCODED_STANDARD_OPERATION_ORDER = ['list', 'get', 'create', 'update', 'delete'];
+const HARDCODED_DISPLAY_ALIASES = { create: 'insert (create)' };
+
 /** @type {{ standardOrder: string[], aliases: Record<string, string> }|null} */
 let _cache = null;
 
+/**
+ * @returns {{ standardOperationOrder: string[], displayAliases: Record<string, string> }}
+ */
+function readFallbackDisplayConfig() {
+  const fromFile = tryReadJsonFile(FALLBACK_PATH);
+  const order =
+    fromFile && Array.isArray(fromFile.standardOperationOrder) && fromFile.standardOperationOrder.length
+      ? fromFile.standardOperationOrder
+      : HARDCODED_STANDARD_OPERATION_ORDER;
+  const aliases =
+    fromFile && fromFile.displayAliases && typeof fromFile.displayAliases === 'object'
+      ? fromFile.displayAliases
+      : HARDCODED_DISPLAY_ALIASES;
+  return { standardOperationOrder: order, displayAliases: aliases };
+}
+
+/**
+ * Prefer schema key order, then append any fallback standard ops missing from the schema
+ * (guards partial/stale schema files and cross-test cache pollution in Jest).
+ * @param {string[]|null} fromSchema
+ * @param {string[]} fbOrder
+ * @returns {string[]}
+ */
+function mergeStandardOperationOrders(fromSchema, fbOrder) {
+  const schemaOps = Array.isArray(fromSchema)
+    ? fromSchema.map(op => String(op).trim().toLowerCase()).filter(Boolean)
+    : [];
+  const fallbackOps = Array.isArray(fbOrder)
+    ? fbOrder.map(op => String(op).trim().toLowerCase()).filter(Boolean)
+    : [];
+  if (!schemaOps.length) return fallbackOps;
+  const seen = new Set(schemaOps);
+  const merged = [...schemaOps];
+  for (const op of fallbackOps) {
+    if (seen.has(op)) continue;
+    seen.add(op);
+    merged.push(op);
+  }
+  return merged;
+}
+
 /**
  * @returns {{ standardOrder: string[], aliases: Record<string, string> }}
  */
@@ -75,16 +124,12 @@ function getCipCapacityDisplayConfig() {
   const schemaPath = resolveExternalDatasourceSchemaPath();
   const schema = schemaPath ? tryReadJsonFile(schemaPath) : null;
   const fromSchema = extractStandardOperationOrderFromSchema(schema);
-  const fallback = tryReadJsonFile(FALLBACK_PATH) || {};
-  const fbOrder = Array.isArray(fallback.standardOperationOrder)
-    ? fallback.standardOperationOrder
-    : [];
-  const standardOrder = fromSchema && fromSchema.length ? fromSchema : fbOrder;
-  const aliases =
-    fallback.displayAliases && typeof fallback.displayAliases === 'object'
-      ? fallback.displayAliases
-      : { create: 'insert (create)' };
-  _cache = { standardOrder, aliases };
+  const fallback = readFallbackDisplayConfig();
+  const standardOrder = mergeStandardOperationOrders(
+    fromSchema,
+    fallback.standardOperationOrder
+  );
+  _cache = { standardOrder, aliases: fallback.displayAliases };
   return _cache;
 }
 
@@ -122,6 +167,7 @@ function clearCipCapacityDisplayConfigCacheForTests() {
 
 module.exports = {
   extractStandardOperationOrderFromSchema,
+  mergeStandardOperationOrders,
   resolveExternalDatasourceSchemaPath,
   getCipCapacityDisplayConfig,
   standardOperationRank,

package/lib/utils/manifest-source-emit.js

@@ -104,6 +104,8 @@ function isStdoutTty() {
 function emitManifestMetadataLineIfTTY(logger, opts) {
   if (!logger || typeof logger.log !== 'function') return;
   if (!opts || opts.json || opts.envOnly) return;
+  const { isSetupQuietOutput } = require('./setup-quiet-output');
+  if (isSetupQuietOutput()) return;
   if (!isStdoutTty()) return;
   const appKey = opts.appKey && typeof opts.appKey === 'string' ? opts.appKey.trim() : '';
   const appPath = opts.appPath && typeof opts.appPath === 'string' ? opts.appPath.trim() : '';

package/lib/utils/paths.js

@@ -315,6 +315,30 @@ function getDevDirectory(appName, developerId) {
   return baseDir;
 }
 
+/**
+ * Target directory for `aifabrix create` — always under {@link process.cwd} (`builder/` or
+ * `integration/`) even when those folders do not exist yet. Platform system apps still
+ * materialize under {@link getAppsMaterializationParent}.
+ *
+ * Post-create lookup uses {@link getAppPath} / {@link getBuilderPath} / {@link getIntegrationPath}.
+ *
+ * @param {string} appName - Application name
+ * @param {string} [appType] - Application type (`external` or other)
+ * @returns {string} Absolute path to the new application directory
+ */
+function getAppCreatePath(appName, appType) {
+  if (!appName || typeof appName !== 'string') {
+    throw new Error('App name is required and must be a string');
+  }
+  if (appType === 'external') {
+    return path.join(path.resolve(process.cwd()), 'integration', appName);
+  }
+  if (isSystemBuilderAppName(appName)) {
+    return path.join(getAppsMaterializationParent(), 'builder', appName);
+  }
+  return path.join(path.resolve(process.cwd()), 'builder', appName);
+}
+
 /**
  * Gets the application path (builder or integration folder).
  * Matches {@link getBuilderPath} / {@link getIntegrationPath} (cwd `integration/` / `builder/`, then
@@ -881,6 +905,7 @@ module.exports = {
   getApplicationsBaseDir,
   getDevDirectory,
   getAppPath,
+  getAppCreatePath,
   getAppsMaterializationParent,
   getCwdIntegrationRoot,
   getCwdBuilderRoot,

package/lib/utils/pipeline-upload-auth-retry.js

@@ -0,0 +1,82 @@
+/**
+ * Retry dataplane pipeline upload with application client token when device Bearer fails.
+ *
+ * @fileoverview Pipeline publish auth fallback when device Bearer is rejected
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('./logger');
+const { uploadApplicationViaPipeline } = require('../api/pipeline.api');
+const { getDeploymentAuth } = require('./token-manager');
+const { resolveControllerUrl } = require('./controller-url');
+const config = require('../core/config');
+
+/**
+ * @param {Object} apiResponse
+ * @returns {boolean}
+ */
+function isPipelineAuthFailure(apiResponse) {
+  if (!apiResponse || apiResponse.success !== false) {
+    return false;
+  }
+  const status = Number(apiResponse.status) || 0;
+  if (status === 401 || status === 403) {
+    return true;
+  }
+  const text = String(
+    apiResponse.formattedError || apiResponse.error || apiResponse.message || ''
+  ).toLowerCase();
+  return text.includes('invalid token') || text.includes('unauthorized') || text.includes('authentication');
+}
+
+/**
+ * @param {string} systemKey
+ * @returns {Promise<Object|null>}
+ */
+async function resolveClientTokenAuthForPipelineRetry(systemKey) {
+  try {
+    const controllerUrl = await resolveControllerUrl();
+    const environment = await config.resolveEnvironment();
+    return await getDeploymentAuth(controllerUrl, environment, systemKey, {
+      deploymentAuth: 'client-credentials'
+    });
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * POST /api/v1/pipeline/upload with optional client-token retry after device Bearer 401.
+ *
+ * @async
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {Object} payload
+ * @param {string} systemKey - External system key for credential lookup on retry
+ * @returns {Promise<Object>}
+ */
+async function uploadApplicationViaPipelineWithAuthRetry(dataplaneUrl, authConfig, payload, systemKey) {
+  const first = await uploadApplicationViaPipeline(dataplaneUrl, authConfig, payload);
+  if (!isPipelineAuthFailure(first) || authConfig.type !== 'bearer') {
+    return first;
+  }
+  const clientAuth = await resolveClientTokenAuthForPipelineRetry(systemKey);
+  if (!clientAuth || clientAuth.type === 'bearer') {
+    return first;
+  }
+  logger.log(
+    chalk.yellow(
+      'Device login token was rejected for pipeline publish; retrying with application client token…'
+    )
+  );
+  return uploadApplicationViaPipeline(dataplaneUrl, clientAuth, payload);
+}
+
+module.exports = {
+  isPipelineAuthFailure,
+  uploadApplicationViaPipelineWithAuthRetry
+};

package/lib/utils/platform-controller-url.js

@@ -0,0 +1,157 @@
+/**
+ * Absolute public base URLs for platform apps (Keycloak, Miso Controller, Dataplane).
+ * Used by setup (`platform-controller`), guided footers, and declarative routing.
+ *
+ * @fileoverview Platform app public URL resolution (Traefik / localhost + dev ports)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const config = require('../core/config');
+const pathsUtil = require('./paths');
+const { loadConfigFile } = require('./config-format');
+const { computePublicUrlBaseString } = require('./url-declarative-public-base');
+const { joinUrlPath, normalizeFrontDoorPatternForHealth } = require('./health-check-url');
+const { getDevPorts } = require('./dev-config');
+const { flagsForSetupPlatformMode } = require('../core/setup-platform-mode');
+
+const MISO_CONTROLLER_APP = 'miso-controller';
+
+/**
+ * Bundled `templates/applications/<app>/application.yaml` (fresh install has no builder copy yet).
+ *
+ * @param {string} appName
+ * @returns {Object|null}
+ */
+function loadBundledApplicationVariables(appName) {
+  const templateConfigPath = path.join(
+    pathsUtil.getProjectRoot(),
+    'templates',
+    'applications',
+    appName,
+    'application.yaml'
+  );
+  if (!fs.existsSync(templateConfigPath)) {
+    return null;
+  }
+  const variables = loadConfigFile(templateConfigPath);
+  return variables && typeof variables === 'object' ? variables : null;
+}
+
+/**
+ * Load platform app variables from materialized builder config, or from bundled template
+ * when `aifabrix setup` runs before `up-platform` has copied templates.
+ *
+ * @param {string} appName
+ * @returns {Object}
+ */
+function loadAppVariables(appName) {
+  const builderPath = pathsUtil.getBuilderPath(appName);
+  if (fs.existsSync(builderPath)) {
+    try {
+      const configPath = pathsUtil.resolveApplicationConfigPath(builderPath);
+      return loadConfigFile(configPath) || {};
+    } catch (err) {
+      const msg = err && err.message ? String(err.message) : '';
+      if (!msg.includes('Application config not found')) {
+        throw err;
+      }
+    }
+  }
+  const fromTemplate = loadBundledApplicationVariables(appName);
+  if (fromTemplate) {
+    return fromTemplate;
+  }
+  throw new Error(
+    `Application config not found for platform app "${appName}". ` +
+      'Run `aifabrix setup` or `aifabrix up-platform` to materialize builder templates.'
+  );
+}
+
+function computeLocalFullPlatformFrontDoorUrl(params) {
+  const { setupPlatformMode, remoteServer, developerIdNum, frontDoorRouting } = params;
+  if (!flagsForSetupPlatformMode(setupPlatformMode).traefik) {
+    return null;
+  }
+  if (remoteServer && String(remoteServer).trim()) {
+    return null;
+  }
+  const ports = getDevPorts(Number.isFinite(developerIdNum) ? developerIdNum : 0);
+  const mount = normalizeFrontDoorPatternForHealth(frontDoorRouting.pattern);
+  // Full local platform uses a single front-door port (3000 + devId×100), not the infra Traefik port.
+  return joinUrlPath(`http://localhost:${ports.app}`, mount);
+}
+
+/**
+ * Compute the absolute base URL for a platform app (same rules as guided `up-platform` footer).
+ *
+ * @async
+ * @param {string} appName - e.g. `miso-controller`, `keycloak`, `dataplane`
+ * @returns {Promise<string>}
+ */
+async function computeAppBaseUrl(appName) {
+  const variables = loadAppVariables(appName);
+  const basePort = Number(variables.port || 3000);
+  const developerIdRaw = await config.getDeveloperId();
+  const developerIdNum =
+    typeof developerIdRaw === 'string' ? parseInt(developerIdRaw, 10) : developerIdRaw;
+  const userCfg = await config.getConfig();
+  const remoteServer = await config.getRemoteServer();
+  const infraTlsEnabled = Boolean(userCfg && userCfg.tlsEnabled);
+
+  const fd = variables.frontDoorRouting || null;
+  const frontDoorEnabled = Boolean(fd && fd.enabled === true);
+  const traefikOn = Boolean(userCfg && userCfg.traefik);
+  const pathActive = Boolean(traefikOn && frontDoorEnabled);
+  const setupPlatformMode = await config.getSetupPlatformMode();
+
+  const publicBase = computePublicUrlBaseString({
+    traefik: traefikOn,
+    pathActive,
+    hostTemplate: fd ? fd.host : null,
+    tls: fd ? fd.tls : true,
+    developerIdRaw,
+    remoteServer,
+    profile: 'docker',
+    listenPort: basePort,
+    developerIdNum,
+    infraTlsEnabled
+  });
+
+  if (pathActive) {
+    const localFullUrl = computeLocalFullPlatformFrontDoorUrl({
+      setupPlatformMode,
+      remoteServer,
+      developerIdNum,
+      frontDoorRouting: fd
+    });
+    if (localFullUrl) return localFullUrl;
+    const mount = normalizeFrontDoorPatternForHealth(fd.pattern);
+    return joinUrlPath(publicBase, mount);
+  }
+
+  return String(publicBase).replace(/\/+$/, '');
+}
+
+/**
+ * Absolute Miso Controller URL for local platform install / setup auth.
+ *
+ * @async
+ * @returns {Promise<string>}
+ */
+async function resolvePlatformControllerUrl() {
+  return computeAppBaseUrl(MISO_CONTROLLER_APP);
+}
+
+module.exports = {
+  MISO_CONTROLLER_APP,
+  loadAppVariables,
+  loadBundledApplicationVariables,
+  computeAppBaseUrl,
+  resolvePlatformControllerUrl
+};

package/lib/utils/platform-kv-ref.js

@@ -0,0 +1,57 @@
+/**
+ * Platform installation kv:// refs from infra.parameter.yaml (flat keys, no path segments).
+ *
+ * @fileoverview Distinguish platform catalog secrets from per-integration path-style kv refs
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { getInfraParameterCatalog } = require('../parameters/infra-parameter-catalog');
+
+/**
+ * Returns the single-segment path after kv:// when the ref has no slashes.
+ *
+ * @param {string} val - kv:// reference
+ * @returns {string|null}
+ */
+function kvRefSegment(val) {
+  if (typeof val !== 'string' || !val.trim().toLowerCase().startsWith('kv://')) return null;
+  const after = val.trim().slice(5);
+  if (!after || after.includes('/')) return null;
+  return after;
+}
+
+/**
+ * True when val is kv://<key> and key exists in shipped infra.parameter.yaml.
+ *
+ * @param {string} val - kv:// reference
+ * @returns {boolean}
+ */
+function isPlatformCatalogKvRef(val) {
+  const segment = kvRefSegment(val);
+  if (!segment) return false;
+  try {
+    const catalog = getInfraParameterCatalog();
+    return Boolean(catalog.findEntryForKey(segment));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * True when repair should normalize a kv value to path-style kv://systemKey/variable.
+ * Platform catalog refs (e.g. kv://secrets-openaiApiKeyVault) are never legacy.
+ *
+ * @param {string} val - Value from authentication.security or configuration
+ * @returns {boolean}
+ */
+function isLegacyKvValue(val) {
+  if (typeof val !== 'string' || !val.trim().toLowerCase().startsWith('kv://')) return false;
+  if (isPlatformCatalogKvRef(val)) return false;
+  const after = val.trim().slice(5);
+  return after.includes('KeyVault') || !after.includes('/');
+}
+
+module.exports = { kvRefSegment, isPlatformCatalogKvRef, isLegacyKvValue };

package/lib/utils/postgres-platform-bootstrap.js

@@ -0,0 +1,199 @@
+/**
+ * Recreate platform Postgres databases and roles after setup "wipe data".
+ *
+ * Infra init scripts run only on first volume creation; dropping DBs in a
+ * running Postgres container requires explicit bootstrap before Keycloak/Miso start.
+ *
+ * @fileoverview Platform database bootstrap after postgres wipe
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const config = require('../core/config');
+const adminSecrets = require('../core/admin-secrets');
+const logger = require('./logger');
+const chalk = require('chalk');
+const { successGlyph } = require('./cli-test-layout-chalk');
+const { getPostgresContainerName } = require('./postgres-wipe');
+const dockerExec = require('./docker-exec');
+const { isSetupQuietOutput } = require('./setup-quiet-output');
+
+const SUPERUSER_ROLE = 'pgadmin';
+
+/** @type {{ dbName: string, secretKey: string }[]} */
+const PLATFORM_DATABASE_SLOTS = [
+  { dbName: 'keycloak', secretKey: 'databases-keycloak-0-passwordKeyVault' },
+  { dbName: 'miso', secretKey: 'databases-miso-controller-0-passwordKeyVault' },
+  { dbName: 'miso-logs', secretKey: 'databases-miso-controller-1-passwordKeyVault' },
+  { dbName: 'dataplane', secretKey: 'databases-dataplane-0-passwordKeyVault' },
+  { dbName: 'dataplane-vector', secretKey: 'databases-dataplane-1-passwordKeyVault' },
+  { dbName: 'dataplane-logs', secretKey: 'databases-dataplane-2-passwordKeyVault' },
+  { dbName: 'dataplane-records', secretKey: 'databases-dataplane-3-passwordKeyVault' }
+];
+
+/**
+ * @param {string} dbName
+ * @returns {string}
+ */
+function pgRoleName(dbName) {
+  return `${String(dbName).replace(/-/g, '_')}_user`;
+}
+
+/**
+ * @param {string} s
+ * @returns {string}
+ */
+function escapePgString(s) {
+  if (s === null || s === undefined || typeof s !== 'string') return '';
+  return s.replace(/'/g, '\'\'');
+}
+
+/**
+ * @param {string} urlOrPassword
+ * @returns {string|null}
+ */
+function extractPasswordFromUrlOrValue(urlOrPassword) {
+  if (typeof urlOrPassword !== 'string' || urlOrPassword.length === 0) return null;
+  if (!urlOrPassword.includes('://')) return urlOrPassword;
+  try {
+    const u = new URL(
+      urlOrPassword.replace(/\$\{DB_HOST\}/g, 'postgres').replace(/\$\{DB_PORT\}/g, '5432')
+    );
+    return u.password || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Escape SQL for embedding in a double-quoted shell argument (-c "...").
+ * Bash expands `$` and `$$` (PID) inside double quotes; backslash-escape every `$`.
+ *
+ * @param {string} s
+ * @returns {string}
+ */
+function escapeShellDoubleQuoted(s) {
+  return s.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\$/g, '\\$');
+}
+
+/**
+ * @async
+ * @param {string} container
+ * @param {string} sql
+ * @param {string} adminPassword
+ * @returns {Promise<void>}
+ */
+async function runPsqlCommand(container, sql, adminPassword, database = 'postgres') {
+  const escapedSql = escapeShellDoubleQuoted(sql);
+  const cmd =
+    `docker exec -e PGPASSWORD -i ${container} psql -U ${SUPERUSER_ROLE} -d ${database} ` +
+    `-v ON_ERROR_STOP=1 -c "${escapedSql}"`;
+  await dockerExec.execWithDockerEnv(cmd, { env: { PGPASSWORD: adminPassword } });
+}
+
+/**
+ * @async
+ * @param {string} container
+ * @param {string} dbName
+ * @param {string} role
+ * @param {string} password
+ * @param {string} adminPassword
+ * @returns {Promise<void>}
+ */
+async function ensureRoleAndDatabase(container, dbName, role, password, adminPassword) {
+  if (!/^[A-Za-z_][A-Za-z0-9_-]*$/.test(dbName) || !/^[A-Za-z_][A-Za-z0-9_-]*$/.test(role)) {
+    throw new Error(`Unsafe database or role name: ${dbName} / ${role}`);
+  }
+  const pwd = escapePgString(password);
+  await runPsqlCommand(
+    container,
+    `DO $$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${role}') THEN CREATE USER "${role}" WITH PASSWORD '${pwd}'; ELSE ALTER USER "${role}" WITH PASSWORD '${pwd}'; END IF; END $$;`,
+    adminPassword
+  );
+  const exists = await dockerExec.execWithDockerEnv(
+    `docker exec -e PGPASSWORD -i ${container} psql -U ${SUPERUSER_ROLE} -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname = '${dbName}'"`,
+    { env: { PGPASSWORD: adminPassword } }
+  );
+  const hasDb = String((exists && exists.stdout) || '').trim() === '1';
+  if (!hasDb) {
+    await runPsqlCommand(
+      container,
+      `CREATE DATABASE "${dbName}" OWNER "${role}";`,
+      adminPassword
+    );
+  }
+  await runPsqlCommand(
+    container,
+    `GRANT ALL ON SCHEMA public TO "${role}"; ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO "${role}";`,
+    adminPassword,
+    dbName
+  );
+}
+
+/**
+ * @async
+ * @param {string} container
+ * @param {{ dbName: string, secretKey: string }} slot
+ * @param {Object} secrets
+ * @param {string} adminPassword
+ * @returns {Promise<string>}
+ */
+async function ensurePlatformDatabaseSlot(container, slot, secrets, adminPassword) {
+  const raw = secrets[slot.secretKey];
+  const password = extractPasswordFromUrlOrValue(raw);
+  if (!password || !password.trim()) {
+    throw new Error(
+      `Secret ${slot.secretKey} is missing or empty. Run "aifabrix up-infra" to ensure infra secrets.`
+    );
+  }
+  const role = pgRoleName(slot.dbName);
+  await ensureRoleAndDatabase(container, slot.dbName, role, password.trim(), adminPassword);
+  if (!isSetupQuietOutput()) {
+    logger.log(chalk.gray(` ${successGlyph()} Ensured database ${slot.dbName} (${role})`));
+  }
+  return slot.dbName;
+}
+
+/**
+ * @async
+ * @returns {Promise<{ container: string, adminPassword: string, secrets: Object }>}
+ */
+async function resolveBootstrapContext() {
+  const devId = await config.getDeveloperId();
+  const container = getPostgresContainerName(devId);
+  const admin = await adminSecrets.readAndDecryptAdminSecrets();
+  const adminPassword = admin && admin.POSTGRES_PASSWORD;
+  if (!adminPassword) {
+    throw new Error('POSTGRES_PASSWORD not found in admin-secrets.env. Run "aifabrix up-infra" first.');
+  }
+  const secretsEnsure = require('../core/secrets-ensure');
+  await secretsEnsure.ensureInfraSecrets();
+  const { loadSecrets } = require('../core/secrets');
+  const secrets = await loadSecrets(undefined);
+  return { container, adminPassword, secrets };
+}
+
+/**
+ * Recreate platform DB users and databases from resolved kv secrets.
+ *
+ * @async
+ * @returns {Promise<string[]>} database names ensured
+ */
+async function bootstrapPlatformPostgresDatabases() {
+  const { container, adminPassword, secrets } = await resolveBootstrapContext();
+  const ensured = [];
+  for (const slot of PLATFORM_DATABASE_SLOTS) {
+    ensured.push(await ensurePlatformDatabaseSlot(container, slot, secrets, adminPassword));
+  }
+  return ensured;
+}
+
+module.exports = {
+  PLATFORM_DATABASE_SLOTS,
+  bootstrapPlatformPostgresDatabases,
+  pgRoleName,
+  extractPasswordFromUrlOrValue,
+  escapeShellDoubleQuoted
+};