@aifabrix/builder 2.42.1 → 2.44.0

package/lib/commands/secrets-set.js

@@ -9,13 +9,13 @@
  * @version 2.0.0
  */
 
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 const path = require('path');
-const chalk = require('chalk');
 const logger = require('../utils/logger');
 const { getAifabrixSecretsPath } = require('../core/config');
 const { saveLocalSecret, saveSecret } = require('../utils/local-secrets');
 const pathsUtil = require('../utils/paths');
-const { isRemoteSecretsUrl, getRemoteDevAuth } = require('../utils/remote-dev-auth');
+const remoteDevAuth = require('../utils/remote-dev-auth');
 const devApi = require('../api/dev.api');
 
 /**
@@ -39,20 +39,29 @@ const devApi = require('../api/dev.api');
  * @returns {Promise<void>}
  */
 async function setSharedSecret(key, value, generalSecretsPath) {
-  if (isRemoteSecretsUrl(generalSecretsPath)) {
-    const auth = await getRemoteDevAuth();
+  const target = await remoteDevAuth.resolveSharedSecretsEndpoint(generalSecretsPath);
+  if (remoteDevAuth.isRemoteSecretsUrl(target)) {
+    const auth = await remoteDevAuth.getRemoteDevAuth();
     if (!auth) {
       throw new Error('Remote server not configured or certificate missing. Run "aifabrix dev init" first.');
     }
-    await devApi.addSecret(auth.serverUrl, auth.clientCertPem, { key, value });
-    logger.log(chalk.green(`✓ Secret '${key}' saved to remote secrets (shared).`));
+    await devApi.addSecret(
+      auth.serverUrl,
+      auth.clientCertPem,
+      { key, value },
+      auth.serverCaPem || undefined,
+      target
+    );
+    const host = remoteDevAuth.getSharedSecretsRemoteHostname(target);
+    const where = host ? `shared secrets (remote - ${host})` : 'shared secrets (remote)';
+    logger.log(formatSuccessLine(`Secret '${key}' saved to ${where}.`));
     return;
   }
-  const resolvedPath = path.isAbsolute(generalSecretsPath)
-    ? generalSecretsPath
-    : path.resolve(process.cwd(), generalSecretsPath);
+  const resolvedPath = path.isAbsolute(target)
+    ? target
+    : path.resolve(process.cwd(), target);
   await saveSecret(key, value, resolvedPath);
-  logger.log(chalk.green(`✓ Secret '${key}' saved to general secrets file: ${resolvedPath}`));
+  logger.log(formatSuccessLine(`Secret '${key}' saved to general secrets file: ${resolvedPath}`));
 }
 
 async function handleSecretsSet(key, value, options) {
@@ -80,8 +89,8 @@ async function handleSecretsSet(key, value, options) {
     await setSharedSecret(key, value, generalSecretsPath);
   } else {
     await saveLocalSecret(key, value);
-    const userSecretsPath = path.join(pathsUtil.getAifabrixHome(), 'secrets.local.yaml');
-    logger.log(chalk.green(`✓ Secret '${key}' saved to user secrets file: ${userSecretsPath}`));
+    const userSecretsPath = pathsUtil.getPrimaryUserSecretsLocalPath();
+    logger.log(formatSuccessLine(`Secret '${key}' saved to user secrets file: ${userSecretsPath}`));
   }
 }
 

package/lib/commands/secrets-validate.js

@@ -1,3 +1,4 @@
+const { formatBlockingError, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 /**
  * AI Fabrix Builder – Secrets validate command
  *
@@ -9,9 +10,9 @@
  */
 
 const chalk = require('chalk');
-const path = require('path');
 const logger = require('../utils/logger');
 const { validateSecretsFile } = require('../utils/secrets-validation');
+const { validateDataplaneSecrets } = require('../utils/token-manager');
 const pathsUtil = require('../utils/paths');
 const secretsEnsure = require('../core/secrets-ensure');
 
@@ -33,18 +34,30 @@ async function handleSecretsValidate(pathArg, options = {}) {
     if (target.type === 'file' && target.filePath) {
       filePath = target.filePath;
     } else {
-      filePath = path.join(pathsUtil.getAifabrixHome(), 'secrets.local.yaml');
+      filePath = pathsUtil.getPrimaryUserSecretsLocalPath();
     }
   }
 
   const result = validateSecretsFile(filePath, { checkNaming: Boolean(options.naming) });
+  const dataplaneResult = validateDataplaneSecrets(filePath);
+  const allValid = result.valid && dataplaneResult.valid;
   if (result.valid) {
-    logger.log(chalk.green(`✓ Secrets file is valid: ${result.path}`));
-    return { valid: true, errors: [] };
+    logger.log(formatSuccessLine(`Secrets file is valid: ${result.path}`));
+  } else {
+    logger.log(formatBlockingError(`Validation failed: ${result.path}`));
+    result.errors.forEach((err) => logger.log(chalk.yellow(`  • ${err}`)));
   }
-  logger.log(chalk.red(`✗ Validation failed: ${result.path}`));
-  result.errors.forEach((err) => logger.log(chalk.yellow(`  • ${err}`)));
-  return { valid: false, errors: result.errors };
+  if (!dataplaneResult.valid) {
+    logger.log(chalk.yellow(`⚠ ${dataplaneResult.hint}`));
+    if (result.valid) {
+      logger.log(chalk.yellow('  Wizard/dataplane calls may fail until dataplane credentials are present.'));
+    }
+  }
+  return {
+    valid: allValid,
+    errors: allValid ? [] : [...result.errors, ...(dataplaneResult.valid ? [] : [dataplaneResult.hint])],
+    dataplaneValid: dataplaneResult.valid
+  };
 }
 
 module.exports = { handleSecretsValidate };

package/lib/commands/secure.js

@@ -1,3 +1,4 @@
+const { formatSuccessLine, formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
 /**
  * AI Fabrix Builder - Secure Command
  *
@@ -32,7 +33,7 @@ async function findSecretsFiles() {
   const files = [];
 
   // User's secrets file
-  const userSecretsPath = path.join(pathsUtil.getAifabrixHome(), 'secrets.local.yaml');
+  const userSecretsPath = pathsUtil.getPrimaryUserSecretsLocalPath();
   if (fs.existsSync(userSecretsPath)) {
     files.push({ path: userSecretsPath, type: 'user' });
   }
@@ -131,7 +132,7 @@ async function getEncryptionKey(options) {
     // Check if key already exists in config
     const existingKey = await getSecretsEncryptionKey();
     if (existingKey) {
-      logger.log(chalk.yellow('⚠️  Encryption key already configured in config.yaml'));
+      logger.log(chalk.yellow('⚠  Encryption key already configured in config.yaml'));
       const useExisting = await inquirer.prompt([{
         type: 'confirm',
         name: 'use',
@@ -143,18 +144,18 @@ async function getEncryptionKey(options) {
       } else {
         encryptionKey = await promptForEncryptionKey();
         await setSecretsEncryptionKey(encryptionKey);
-        logger.log(chalk.green('✓ Encryption key saved to config.yaml'));
+        logger.log(formatSuccessLine('Encryption key saved to config.yaml'));
       }
     } else {
       encryptionKey = await promptForEncryptionKey();
       await setSecretsEncryptionKey(encryptionKey);
-      logger.log(chalk.green('✓ Encryption key saved to config.yaml'));
+      logger.log(formatSuccessLine('Encryption key saved to config.yaml'));
     }
   } else {
     // Validate and save the provided key
     validateEncryptionKey(encryptionKey);
     await setSecretsEncryptionKey(encryptionKey);
-    logger.log(chalk.green('✓ Encryption key saved to config.yaml'));
+    logger.log(formatSuccessLine('Encryption key saved to config.yaml'));
   }
   return encryptionKey;
 }
@@ -178,12 +179,12 @@ async function processSecretsFiles(secretsFiles, encryptionKey) {
       totalValues += result.total;
 
       if (result.encrypted > 0) {
-        logger.log(chalk.green(`  ✓ Encrypted ${result.encrypted} of ${result.total} values`));
+        logger.log(chalk.green(`  ✔ Encrypted ${result.encrypted} of ${result.total} values`));
       } else {
         logger.log(chalk.gray(`  - All values already encrypted (${result.total} total)`));
       }
     } catch (error) {
-      logger.log(chalk.red(`  ✗ Error: ${error.message}`));
+      logger.log(chalk.red(`  ✖ Error: ${error.message}`));
     }
   }
 
@@ -197,7 +198,7 @@ async function processSecretsFiles(secretsFiles, encryptionKey) {
  * @param {number} totalValues - Total number of values
  */
 function displayEncryptionSummary(filesCount, totalEncrypted, totalValues) {
-  logger.log(chalk.green('\n✅ Encryption complete!'));
+  logger.log(formatSuccessParagraph('Encryption complete!'));
   logger.log(chalk.gray(`   Files processed: ${filesCount}`));
   logger.log(chalk.gray(`   Values encrypted: ${totalEncrypted} of ${totalValues} total`));
   logger.log(chalk.gray('   Encryption key stored in: ~/.aifabrix/config.yaml\n'));
@@ -224,7 +225,7 @@ async function handleSecure(options) {
   const secretsFiles = await findSecretsFiles();
 
   if (secretsFiles.length === 0) {
-    logger.log(chalk.yellow('⚠️  No secrets files found to encrypt'));
+    logger.log(chalk.yellow('⚠  No secrets files found to encrypt'));
     logger.log(chalk.gray('   Create ~/.aifabrix/secrets.local.yaml or configure aifabrix-secrets in config.yaml'));
     return;
   }

package/lib/commands/service-user.js

@@ -1,3 +1,4 @@
+const { formatBlockingError, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 /**
  * Service user create command – create service user and get one-time secret
  * POST /api/v1/service-users. Used by `aifabrix service-user create`.
@@ -12,7 +13,14 @@ const logger = require('../utils/logger');
 const { resolveControllerUrl } = require('../utils/controller-url');
 const { getOrRefreshDeviceToken } = require('../utils/token-manager');
 const { normalizeControllerUrl } = require('../core/config');
-const { createServiceUser } = require('../api/service-users.api');
+const {
+  createServiceUser,
+  listServiceUsers,
+  regenerateSecretServiceUser,
+  deleteServiceUser,
+  updateGroupsServiceUser,
+  updateRedirectUrisServiceUser
+} = require('../api/service-users.api');
 
 const ONE_TIME_WARNING =
   'Save this secret now; it will not be shown again.';
@@ -54,6 +62,12 @@ function extractCreateResponse(response) {
   return { clientId, clientSecret };
 }
 
+const ID_WIDTH = 38;
+const USERNAME_WIDTH = 22;
+const EMAIL_WIDTH = 28;
+const CLIENT_ID_WIDTH = 24;
+const TABLE_SEPARATOR_LENGTH = 130;
+
 /**
  * Log error for failed create response and exit
  * @param {Object} response - API response with success: false
@@ -62,25 +76,105 @@ function handleCreateError(response) {
   const status = response.status;
   const msg = response.formattedError || response.error || 'Request failed';
   if (status === 400) {
-    logger.error(chalk.red(`❌ Validation error: ${msg}`));
+    logger.error(formatBlockingError(`Validation error: ${msg}`));
   } else if (status === 401) {
-    logger.error(chalk.red('❌ Unauthorized. Run "aifabrix login" and try again.'));
+    logger.error(formatBlockingError('Unauthorized. Run "aifabrix login" and try again.'));
   } else if (status === 403) {
-    logger.error(chalk.red('❌ Missing permission: service-user:create'));
+    logger.error(formatBlockingError('Missing permission: service-user:create'));
     logger.error(chalk.gray('Your account needs the service-user:create permission on the controller.'));
   } else {
-    logger.error(chalk.red(`❌ Failed to create service user: ${msg}`));
+    logger.error(formatBlockingError(`Failed to create service user: ${msg}`));
   }
   process.exit(1);
 }
 
+/**
+ * Log error for service-user API response and exit
+ * @param {Object} response - API response with success: false
+ * @param {string} permissionScope - Permission hint: 'read' | 'update' | 'delete'
+ */
+function handleServiceUserApiError(response, permissionScope) {
+  const status = response.status;
+  const msg = response.formattedError || response.error || 'Request failed';
+  if (status === 400) {
+    logger.error(formatBlockingError(`Validation error: ${msg}`));
+  } else if (status === 401) {
+    logger.error(formatBlockingError('Unauthorized. Run "aifabrix login" and try again.'));
+  } else if (status === 403) {
+    logger.error(formatBlockingError(`Missing permission: service-user:${permissionScope}`));
+    logger.error(chalk.gray(`Your account needs the service-user:${permissionScope} permission on the controller.`));
+  } else if (status === 404) {
+    logger.error(formatBlockingError('Service user not found.'));
+    const detail = response.error || '';
+    if (detail) {
+      logger.error(chalk.gray(detail));
+    }
+  } else {
+    logger.error(formatBlockingError(`Request failed: ${msg}`));
+  }
+  process.exit(1);
+}
+
+/**
+ * Resolve controller URL and auth for list/rotate/delete/update (no create-specific validation)
+ * @async
+ * @param {Object} options - CLI options (controller optional)
+ * @returns {Promise<{ controllerUrl: string, authConfig: Object }>}
+ */
+async function resolveControllerAndAuth(options) {
+  const controllerUrl = options.controller || (await resolveControllerUrl());
+  if (!controllerUrl) {
+    logger.error(formatBlockingError('Controller URL is required. Run "aifabrix login" first.'));
+    process.exit(1);
+  }
+  const authResult = await getServiceUserAuth(controllerUrl);
+  if (!authResult || !authResult.token) {
+    logger.error(formatBlockingError(`No authentication token for controller: ${controllerUrl}`));
+    logger.error(chalk.gray('Run: aifabrix login'));
+    process.exit(1);
+  }
+  return {
+    controllerUrl: authResult.controllerUrl,
+    authConfig: { type: 'bearer', token: authResult.token }
+  };
+}
+
+/**
+ * Display service user list as a table (id, username, email, clientId, active).
+ * API shape: items have id, username, email, status, federatedIdentity.keycloakClientId.
+ * @param {Array<{ id?: string, username?: string, email?: string, status?: string, active?: boolean, clientId?: string, federatedIdentity?: { keycloakClientId?: string } }>} items - Service users
+ */
+function displayServiceUserList(items) {
+  logger.log(chalk.bold('\n📋 Service users:\n'));
+  if (!items || items.length === 0) {
+    logger.log(chalk.gray('  No service users found.\n'));
+    return;
+  }
+  const idCol = 'Id'.padEnd(ID_WIDTH);
+  const usernameCol = 'Username'.padEnd(USERNAME_WIDTH);
+  const emailCol = 'Email'.padEnd(EMAIL_WIDTH);
+  const clientIdCol = 'ClientId'.padEnd(CLIENT_ID_WIDTH);
+  const activeCol = 'Active';
+  logger.log(chalk.gray(`${idCol}${usernameCol}${emailCol}${clientIdCol}${activeCol}`));
+  logger.log(chalk.gray('-'.repeat(TABLE_SEPARATOR_LENGTH)));
+  items.forEach((row) => {
+    const id = (row.id ?? '').toString().padEnd(ID_WIDTH);
+    const username = (row.username ?? '—').padEnd(USERNAME_WIDTH);
+    const email = (row.email ?? '—').padEnd(EMAIL_WIDTH);
+    const clientId = (row.federatedIdentity?.keycloakClientId ?? row.clientId ?? '—').padEnd(CLIENT_ID_WIDTH);
+    const active = row.status === 'active' ? 'yes' : (row.status ?? (row.active === true ? 'yes' : row.active === false ? 'no' : '—'));
+    logger.log(`${id}${username}${email}${clientId}${active}`);
+  });
+  logger.log('');
+}
+
 /**
  * Display success output with clientId, clientSecret and one-time warning
  * @param {string} clientId - Service user client ID
  * @param {string} clientSecret - One-time client secret
  */
 function displayCreateSuccess(clientId, clientSecret) {
-  logger.log(chalk.bold('\n✓ Service user created\n'));
+  logger.log(chalk.bold('\n✔ Service user created\n'));
   logger.log(chalk.cyan('  clientId:    ') + clientId);
   logger.log(chalk.cyan('  clientSecret: ') + clientSecret);
   logger.log('');
@@ -114,19 +208,19 @@ function validateServiceUserOptions(options) {
   const redirectUris = parseList(options.redirectUris);
   const groupNames = parseList(options.groupNames);
   if (!username) {
-    logger.error(chalk.red('❌ Username is required. Use --username <username>.'));
+    logger.error(formatBlockingError('Username is required. Use --username <username>.'));
     process.exit(1);
   }
   if (!email) {
-    logger.error(chalk.red('❌ Email is required. Use --email <email>.'));
+    logger.error(formatBlockingError('Email is required. Use --email <email>.'));
     process.exit(1);
   }
   if (redirectUris.length === 0) {
-    logger.error(chalk.red('❌ At least one redirect URI is required. Use --redirect-uris <uri1,uri2,...>.'));
+    logger.error(formatBlockingError('At least one redirect URI is required. Use --redirect-uris <uri1,uri2,...>.'));
     process.exit(1);
   }
   if (groupNames.length === 0) {
-    logger.error(chalk.red('❌ At least one group name is required. Use --group-names <name1,name2,...>.'));
+    logger.error(formatBlockingError('At least one group name is required. Use --group-names <name1,name2,...>.'));
     process.exit(1);
   }
   return {
@@ -148,12 +242,12 @@ async function resolveOptionsAndAuth(options) {
   const validated = validateServiceUserOptions(options);
   const controllerUrl = options.controller || (await resolveControllerUrl());
   if (!controllerUrl) {
-    logger.error(chalk.red('❌ Controller URL is required. Run "aifabrix login" first.'));
+    logger.error(formatBlockingError('Controller URL is required. Run "aifabrix login" first.'));
     process.exit(1);
   }
   const authResult = await getServiceUserAuth(controllerUrl);
   if (!authResult || !authResult.token) {
-    logger.error(chalk.red(`❌ No authentication token for controller: ${controllerUrl}`));
+    logger.error(formatBlockingError(`No authentication token for controller: ${controllerUrl}`));
     logger.error(chalk.gray('Run: aifabrix login'));
     process.exit(1);
   }
@@ -194,6 +288,142 @@ async function runServiceUserCreate(options = {}) {
   displayCreateSuccess(clientId, clientSecret);
 }
 
+/**
+ * Require service user id option; exit with message if missing
+ * @param {string} [id] - Service user ID from options
+ * @returns {string} Trimmed id
+ */
+function requireServiceUserId(id) {
+  const trimmed = (id && typeof id === 'string' ? id.trim() : '') || '';
+  if (!trimmed) {
+    logger.error(formatBlockingError('Service user ID is required. Use --id <uuid>.'));
+    process.exit(1);
+  }
+  return trimmed;
+}
+
+/**
+ * Run service-user list: call GET /api/v1/service-users and display table
+ * @async
+ * @param {Object} options - CLI options (controller, page, pageSize, sort, filter, search)
+ * @returns {Promise<void>}
+ */
+async function runServiceUserList(options = {}) {
+  const { controllerUrl, authConfig } = await resolveControllerAndAuth(options);
+  const listOptions = {
+    page: options.page,
+    pageSize: options.pageSize,
+    sort: options.sort,
+    filter: options.filter,
+    search: options.search
+  };
+  const response = await listServiceUsers(controllerUrl, authConfig, listOptions);
+  if (response && response.success === false) {
+    handleServiceUserApiError(response, 'read');
+    return;
+  }
+  const body = response?.data?.data ?? response?.data ?? response ?? {};
+  const items = Array.isArray(body) ? body : (body.data ?? []);
+  displayServiceUserList(items);
+}
+
+/**
+ * Run service-user rotate-secret: call POST .../regenerate-secret and print new secret once with warning
+ * @async
+ * @param {Object} options - CLI options (controller, id required)
+ * @returns {Promise<void>}
+ */
+async function runServiceUserRotateSecret(options = {}) {
+  const id = requireServiceUserId(options.id);
+  const { controllerUrl, authConfig } = await resolveControllerAndAuth(options);
+  const response = await regenerateSecretServiceUser(controllerUrl, authConfig, id);
+  if (response && response.success === false) {
+    handleServiceUserApiError(response, 'update');
+    return;
+  }
+  const payload = response?.data?.data ?? response?.data ?? response ?? {};
+  const clientSecret = payload?.clientSecret ?? '';
+  if (response && response.success === true) {
+    logger.log(chalk.bold('\n✔ Secret rotated\n'));
+    logger.log(chalk.cyan('  clientSecret: ') + clientSecret);
+    logger.log('');
+    logger.log(chalk.yellow('⚠ ' + ONE_TIME_WARNING));
+    logger.log('');
+  }
+}
+
+/**
+ * Run service-user delete: call DELETE .../service-users/{id} (deactivates the user)
+ * @async
+ * @param {Object} options - CLI options (controller, id required)
+ * @returns {Promise<void>}
+ */
+async function runServiceUserDelete(options = {}) {
+  const id = requireServiceUserId(options.id);
+  const { controllerUrl, authConfig } = await resolveControllerAndAuth(options);
+  const response = await deleteServiceUser(controllerUrl, authConfig, id);
+  if (response && response.success === false) {
+    handleServiceUserApiError(response, 'delete');
+    return;
+  }
+  if (response && response.success === true) {
+    logger.log(formatSuccessLine('Service user deactivated.\n'));
+  }
+}
+
+/**
+ * Run service-user update-groups: call PUT .../groups with groupNames
+ * @async
+ * @param {Object} options - CLI options (controller, id, groupNames required)
+ * @returns {Promise<void>}
+ */
+async function runServiceUserUpdateGroups(options = {}) {
+  const id = requireServiceUserId(options.id);
+  const groupNames = parseList(options.groupNames);
+  if (groupNames.length === 0) {
+    logger.error(formatBlockingError('At least one group name is required. Use --group-names <name1,name2,...>.'));
+    process.exit(1);
+  }
+  const { controllerUrl, authConfig } = await resolveControllerAndAuth(options);
+  const response = await updateGroupsServiceUser(controllerUrl, authConfig, id, { groupNames });
+  if (response && response.success === false) {
+    handleServiceUserApiError(response, 'update');
+    return;
+  }
+  if (response && response.success === true) {
+    logger.log(formatSuccessLine('Service user groups updated.\n'));
+  }
+}
+
+/**
+ * Run service-user update-redirect-uris: call PUT .../redirect-uris (min 1 URI)
+ * @async
+ * @param {Object} options - CLI options (controller, id, redirectUris required, min 1)
+ * @returns {Promise<void>}
+ */
+async function runServiceUserUpdateRedirectUris(options = {}) {
+  const id = requireServiceUserId(options.id);
+  const redirectUris = parseList(options.redirectUris);
+  if (redirectUris.length === 0) {
+    logger.error(formatBlockingError('At least one redirect URI is required. Use --redirect-uris <uri1,uri2,...>.'));
+    process.exit(1);
+  }
+  const { controllerUrl, authConfig } = await resolveControllerAndAuth(options);
+  const response = await updateRedirectUrisServiceUser(controllerUrl, authConfig, id, { redirectUris });
+  if (response && response.success === false) {
+    handleServiceUserApiError(response, 'update');
+    return;
+  }
+  if (response && response.success === true) {
+    logger.log(formatSuccessLine('Service user redirect URIs updated.\n'));
+  }
+}
+
 module.exports = {
-  runServiceUserCreate
+  runServiceUserCreate,
+  runServiceUserList,
+  runServiceUserRotateSecret,
+  runServiceUserDelete,
+  runServiceUserUpdateGroups,
+  runServiceUserUpdateRedirectUris
 };

package/lib/commands/test-e2e-external.js

@@ -7,6 +7,7 @@
  */
 
 'use strict';
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 
 const path = require('path');
 const fs = require('fs');
@@ -84,6 +85,23 @@ function getDatasourceKeys(appPath, configPath, variables, systemKey, systemPars
   return keys;
 }
 
+/**
+ * Full upload to dataplane when --sync (same path as `aifabrix upload <systemKey>`).
+ * @param {string} systemKey
+ * @param {Object} options
+ * @returns {Promise<void>}
+ */
+async function syncLocalIfRequested(systemKey, options) {
+  if (options.sync !== true) return;
+  logger.log(chalk.cyan('Syncing local config to dataplane…'));
+  const { uploadExternalSystem } = require('./upload');
+  await uploadExternalSystem(systemKey, {
+    verbose: !!options.verbose,
+    minimal: true
+  });
+  logger.log(formatSuccessLine('Sync complete'));
+}
+
 /* eslint-disable max-lines-per-function, max-statements -- Load context, then loop over keys */
 /**
  * Runs E2E for all datasources of an external system. Uses each datasource's payloadTemplate (no extra params required).
@@ -95,6 +113,7 @@ function getDatasourceKeys(appPath, configPath, variables, systemKey, systemPars
  * @param {boolean} [options.debug] - Include debug, write log
  * @param {boolean} [options.verbose] - Verbose output
  * @param {boolean} [options.async] - If false, sync mode (default true)
+ * @param {boolean} [options.sync] - When true, run full upload (`uploadExternalSystem`) before per-datasource E2E
  * @returns {Promise<{ success: boolean, results: Array<{ key: string, success: boolean, error?: string }> }>}
  */
 async function runTestE2EForExternalSystem(externalSystem, options = {}) {
@@ -137,6 +156,8 @@ async function runTestE2EForExternalSystem(externalSystem, options = {}) {
     return { success: true, results: [] };
   }
 
+  await syncLocalIfRequested(systemKey, options);
+
   const results = [];
   const opts = {
     app: externalSystem,
@@ -150,7 +171,12 @@ async function runTestE2EForExternalSystem(externalSystem, options = {}) {
       const data = await runDatasourceTestE2E(key, opts);
       const steps = data.steps || data.completedActions || [];
       const failed = data.success === false || steps.some(s => s.success === false || s.error);
-      results.push({ key, success: !failed });
+      results.push({
+        key,
+        success: !failed,
+        error: failed ? (data.error || 'E2E step failed') : undefined,
+        datasourceTestRun: data.datasourceTestRun
+      });
     } catch (err) {
       results.push({ key, success: false, error: err.message });
     }

package/lib/commands/up-common.js

@@ -1,3 +1,4 @@
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 /**
  * AI Fabrix Builder - Up Commands Shared Helpers
  *
@@ -165,6 +166,30 @@ function patchEnvOutputPathForDeployOnly(appName) {
   }
 }
 
+/**
+ * Removes builder app directories for the given app names. Only removes paths under the builder root
+ * to prevent path traversal. Uses getBuilderPath for each app and validates before removal.
+ *
+ * @param {string[]} appNames - Application names (e.g. ['keycloak', 'miso-controller', 'dataplane'])
+ * @returns {Promise<void>}
+ * @throws {Error} If any path is outside builder root (path traversal attempt)
+ */
+async function cleanBuilderAppDirs(appNames) {
+  if (!Array.isArray(appNames) || appNames.length === 0) return;
+  const builderRoot = path.resolve(pathsUtil.getBuilderRoot());
+  for (const appName of appNames) {
+    if (!appName || typeof appName !== 'string') continue;
+    const appPath = path.resolve(pathsUtil.getBuilderPath(appName));
+    if (!appPath.startsWith(builderRoot + path.sep) && appPath !== builderRoot) {
+      throw new Error(`Path ${appPath} is outside builder root ${builderRoot}; refusing to clean`);
+    }
+    if (fs.existsSync(appPath)) {
+      fs.rmSync(appPath, { recursive: true });
+      logger.log(chalk.blue(`Cleaned builder/${appName}`));
+    }
+  }
+}
+
 /**
  * Ensures builder app directory exists from template if application config is missing.
  * If builder/<appName>/application config does not exist, copies from templates/applications/<appName>.
@@ -189,7 +214,7 @@ async function ensureAppFromTemplate(appName) {
   const primaryCopied = await ensureTemplateAtPath(appName, appPath);
   if (primaryCopied) {
     logger.log(chalk.blue(`Creating builder/${appName} from template...`));
-    logger.log(chalk.green(`✓ Copied template for ${appName}`));
+    logger.log(formatSuccessLine(`Copied template for ${appName}`));
   }
 
   const cwdBuilderPath = path.join(process.cwd(), 'builder', appName);
@@ -197,7 +222,7 @@ async function ensureAppFromTemplate(appName) {
     const cwdCopied = await ensureTemplateAtPath(appName, cwdBuilderPath);
     if (cwdCopied) {
       logger.log(chalk.blue(`Creating builder/${appName} in project (from template)...`));
-      logger.log(chalk.green(`✓ Copied template for ${appName} into builder/`));
+      logger.log(formatSuccessLine(`Copied template for ${appName} into builder/`));
     }
   }
 
@@ -206,6 +231,7 @@ async function ensureAppFromTemplate(appName) {
 }
 
 module.exports = {
+  cleanBuilderAppDirs,
   ensureAppFromTemplate,
   patchEnvOutputPathForDeployOnly,
   validateEnvOutputPathFolderOrNull,