@aifabrix/builder 2.43.0 → 2.44.1

package/lib/commands/test-e2e-external.js

@@ -7,6 +7,7 @@
  */
 
 'use strict';
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 
 const path = require('path');
 const fs = require('fs');
@@ -84,6 +85,23 @@ function getDatasourceKeys(appPath, configPath, variables, systemKey, systemPars
   return keys;
 }
 
+/**
+ * Full upload to dataplane when --sync (same path as `aifabrix upload <systemKey>`).
+ * @param {string} systemKey
+ * @param {Object} options
+ * @returns {Promise<void>}
+ */
+async function syncLocalIfRequested(systemKey, options) {
+  if (options.sync !== true) return;
+  logger.log(chalk.cyan('Syncing local config to dataplane…'));
+  const { uploadExternalSystem } = require('./upload');
+  await uploadExternalSystem(systemKey, {
+    verbose: !!options.verbose,
+    minimal: true
+  });
+  logger.log(formatSuccessLine('Sync complete'));
+}
+
 /* eslint-disable max-lines-per-function, max-statements -- Load context, then loop over keys */
 /**
  * Runs E2E for all datasources of an external system. Uses each datasource's payloadTemplate (no extra params required).
@@ -95,6 +113,7 @@ function getDatasourceKeys(appPath, configPath, variables, systemKey, systemPars
  * @param {boolean} [options.debug] - Include debug, write log
  * @param {boolean} [options.verbose] - Verbose output
  * @param {boolean} [options.async] - If false, sync mode (default true)
+ * @param {boolean} [options.sync] - When true, run full upload (`uploadExternalSystem`) before per-datasource E2E
  * @returns {Promise<{ success: boolean, results: Array<{ key: string, success: boolean, error?: string }> }>}
  */
 async function runTestE2EForExternalSystem(externalSystem, options = {}) {
@@ -137,6 +156,8 @@ async function runTestE2EForExternalSystem(externalSystem, options = {}) {
     return { success: true, results: [] };
   }
 
+  await syncLocalIfRequested(systemKey, options);
+
   const results = [];
   const opts = {
     app: externalSystem,
@@ -150,7 +171,12 @@ async function runTestE2EForExternalSystem(externalSystem, options = {}) {
       const data = await runDatasourceTestE2E(key, opts);
       const steps = data.steps || data.completedActions || [];
       const failed = data.success === false || steps.some(s => s.success === false || s.error);
-      results.push({ key, success: !failed });
+      results.push({
+        key,
+        success: !failed,
+        error: failed ? (data.error || 'E2E step failed') : undefined,
+        datasourceTestRun: data.datasourceTestRun
+      });
     } catch (err) {
       results.push({ key, success: false, error: err.message });
     }

package/lib/commands/up-common.js

@@ -1,3 +1,4 @@
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 /**
  * AI Fabrix Builder - Up Commands Shared Helpers
  *
@@ -213,7 +214,7 @@ async function ensureAppFromTemplate(appName) {
   const primaryCopied = await ensureTemplateAtPath(appName, appPath);
   if (primaryCopied) {
     logger.log(chalk.blue(`Creating builder/${appName} from template...`));
-    logger.log(chalk.green(`✓ Copied template for ${appName}`));
+    logger.log(formatSuccessLine(`Copied template for ${appName}`));
   }
 
   const cwdBuilderPath = path.join(process.cwd(), 'builder', appName);
@@ -221,7 +222,7 @@ async function ensureAppFromTemplate(appName) {
     const cwdCopied = await ensureTemplateAtPath(appName, cwdBuilderPath);
     if (cwdCopied) {
       logger.log(chalk.blue(`Creating builder/${appName} in project (from template)...`));
-      logger.log(chalk.green(`✓ Copied template for ${appName} into builder/`));
+      logger.log(formatSuccessLine(`Copied template for ${appName} into builder/`));
     }
   }
 

package/lib/commands/up-dataplane.js

@@ -1,3 +1,4 @@
+const { formatSuccessLine, formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
 /**
  * AI Fabrix Builder - Up Dataplane Command
  *
@@ -11,10 +12,12 @@
  * @version 2.0.0
  */
 
+const path = require('path');
 const readline = require('readline');
 const chalk = require('chalk');
 const pathsUtil = require('../utils/paths');
 const { loadConfigFile } = require('../utils/config-format');
+const { resolveDockerImageRef, normalizeDockerRegistryPrefix } = require('../utils/resolve-docker-image-ref');
 const logger = require('../utils/logger');
 const config = require('../core/config');
 const { checkAuthentication } = require('../utils/app-register-auth');
@@ -96,7 +99,7 @@ async function resolveControllerUrlWithHealthCheck() {
     throw new Error(`Controller at ${normalizedNew} is not responding. Ensure the controller is running and reachable, then run "aifabrix up-dataplane" again.`);
   }
 
-  logger.log(chalk.green(`✓ Using controller: ${normalizedNew}`));
+  logger.log(formatSuccessLine(`Using controller: ${normalizedNew}`));
   return normalizedNew;
 }
 
@@ -114,7 +117,7 @@ async function registerOrRotateDataplane(options, controllerUrl, environmentKey,
     logger.log(chalk.blue('Dataplane already registered; rotating secret...'));
     await rotateSecret('dataplane', options);
   } else {
-    const imageOverride = options.image || (options.registry ? buildDataplaneImageRef(options.registry) : undefined);
+    const imageOverride = options.image || buildDataplaneImageRef(options);
     const registerOpts = { imageOverride, image: imageOverride, registryMode: options.registryMode };
     await registerApplication('dataplane', registerOpts);
   }
@@ -126,25 +129,32 @@ async function registerOrRotateDataplane(options, controllerUrl, environmentKey,
  * @returns {Promise<void>}
  */
 async function deployDataplaneToController(options) {
-  const imageOverride = options.image || (options.registry ? buildDataplaneImageRef(options.registry) : undefined);
+  const imageOverride = options.image || buildDataplaneImageRef(options);
   const deployOpts = { imageOverride, image: imageOverride, registryMode: options.registryMode };
   await app.deployApp('dataplane', deployOpts);
 }
 
 /**
- * Build full image ref from registry and dataplane config (registry/name:tag)
- * @param {string} registry - Registry URL
- * @returns {string|undefined} Full image reference or undefined
+ * Full pullable image ref when CLI `--registry` and/or manifest `image.registry` is set.
+ * Returns undefined when neither is set (register/deploy use application config as before).
+ * @param {Object} [options] - Commander options
+ * @param {string} [options.registry] - CLI registry override (wins over manifest)
+ * @returns {string|undefined} Full reference or undefined
  */
-function buildDataplaneImageRef(registry) {
+function buildDataplaneImageRef(options = {}) {
   try {
     const builderPath = pathsUtil.getBuilderPath('dataplane');
     const configPath = pathsUtil.resolveApplicationConfigPath(builderPath);
-    const variables = loadConfigFile(configPath);
-    const name = variables?.image?.name || variables?.app?.key || 'dataplane';
-    const tag = variables?.image?.tag || 'latest';
-    const base = (registry || '').replace(/\/+$/, '');
-    return base ? `${base}/${name}:${tag}` : undefined;
+    const variables = loadConfigFile(configPath) || {};
+    const cli = normalizeDockerRegistryPrefix(options.registry);
+    const manifestReg = normalizeDockerRegistryPrefix(variables.image?.registry);
+    if (!cli && !manifestReg) {
+      return undefined;
+    }
+    const { imageName, imageTag } = resolveDockerImageRef('dataplane', variables, {
+      registry: options.registry || undefined
+    });
+    return `${imageName}:${imageTag}`;
   } catch {
     return undefined;
   }
@@ -167,7 +177,7 @@ function buildDataplaneImageRef(registry) {
 async function handleUpDataplane(options = {}) {
   const builderDir = await config.getAifabrixBuilderDir();
   if (builderDir) {
-    process.env.AIFABRIX_BUILDER_DIR = builderDir;
+    process.env.AIFABRIX_BUILDER_DIR = path.resolve(builderDir);
   }
   logger.log(chalk.blue('Starting up-dataplane (register/rotate, deploy, then run dataplane locally)...\n'));
 
@@ -182,7 +192,7 @@ async function handleUpDataplane(options = {}) {
       'Dataplane is only supported in dev environment. Set with: aifabrix auth --set-environment dev.'
     );
   }
-  logger.log(chalk.green('✓ Logged in and environment is dev'));
+  logger.log(formatSuccessLine('Logged in and environment is dev'));
 
   await ensureAppFromTemplate('dataplane');
   // If envOutputPath target folder does not exist, set envOutputPath to null
@@ -192,9 +202,12 @@ async function handleUpDataplane(options = {}) {
 
   await deployDataplaneToController(options);
   logger.log('');
-  await app.runApp('dataplane', { skipEnvOutputPath: true });
+  await app.runApp('dataplane', {
+    skipEnvOutputPath: true,
+    registry: options.registry || undefined
+  });
 
-  logger.log(chalk.green('\n✓ up-dataplane complete. Dataplane is registered, deployed in dev, and running locally.'));
+  logger.log(formatSuccessParagraph('up-dataplane complete. Dataplane is registered, deployed in dev, and running locally.'));
 }
 
 module.exports = { handleUpDataplane, buildDataplaneImageRef };

package/lib/commands/up-miso.js

@@ -1,3 +1,4 @@
+const { formatSuccessLine, formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
 /**
  * AI Fabrix Builder - Up Miso Command
  *
@@ -9,9 +10,8 @@
  * @version 2.0.0
  */
 
+const path = require('path');
 const chalk = require('chalk');
-const pathsUtil = require('../utils/paths');
-const { loadConfigFile } = require('../utils/config-format');
 const logger = require('../utils/logger');
 const config = require('../core/config');
 const infra = require('../infrastructure');
@@ -38,26 +38,6 @@ function parseImageOptions(imageOpts) {
   return map;
 }
 
-/**
- * Build full image ref from registry and app config (registry/name:tag)
- * @param {string} appName - keycloak or miso-controller
- * @param {string} registry - Registry URL
- * @returns {string} Full image reference
- */
-function buildImageRefFromRegistry(appName, registry) {
-  try {
-    const builderPath = pathsUtil.getBuilderPath(appName);
-    const configPath = pathsUtil.resolveApplicationConfigPath(builderPath);
-    const variables = loadConfigFile(configPath);
-    const name = variables?.image?.name || variables?.app?.key || appName;
-    const tag = variables?.image?.tag || 'latest';
-    const base = (registry || '').replace(/\/+$/, '');
-    return base ? `${base}/${name}:${tag}` : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
 /**
  * Build run options and run keycloak, then miso-controller
  * @async
@@ -65,10 +45,20 @@ function buildImageRefFromRegistry(appName, registry) {
  */
 async function runMisoApps(options) {
   const imageMap = parseImageOptions(options.image);
-  const keycloakImage = imageMap.keycloak || (options.registry ? buildImageRefFromRegistry('keycloak', options.registry) : undefined);
-  const misoImage = imageMap['miso-controller'] || (options.registry ? buildImageRefFromRegistry('miso-controller', options.registry) : undefined);
-  const keycloakRunOpts = { image: keycloakImage, registry: options.registry, registryMode: options.registryMode, skipEnvOutputPath: true, skipInfraCheck: true };
-  const misoRunOpts = { image: misoImage, registry: options.registry, registryMode: options.registryMode, skipEnvOutputPath: true, skipInfraCheck: true };
+  const common = {
+    registry: options.registry,
+    registryMode: options.registryMode,
+    skipEnvOutputPath: true,
+    skipInfraCheck: true
+  };
+  const keycloakRunOpts = { ...common };
+  if (imageMap.keycloak) {
+    keycloakRunOpts.image = imageMap.keycloak;
+  }
+  const misoRunOpts = { ...common };
+  if (imageMap['miso-controller']) {
+    misoRunOpts.image = imageMap['miso-controller'];
+  }
   logger.log(chalk.blue('Starting keycloak...'));
   await app.runApp('keycloak', keycloakRunOpts);
   logger.log(chalk.blue('Starting miso-controller...'));
@@ -90,7 +80,7 @@ async function runMisoApps(options) {
 async function handleUpMiso(options = {}) {
   const builderDir = await config.getAifabrixBuilderDir();
   if (builderDir) {
-    process.env.AIFABRIX_BUILDER_DIR = builderDir;
+    process.env.AIFABRIX_BUILDER_DIR = path.resolve(builderDir);
   }
   logger.log(chalk.blue('Starting up-miso (keycloak + miso-controller from images)...\n'));
   // Strict: only this developer's infra (same as status), so up-miso and status agree
@@ -99,7 +89,7 @@ async function handleUpMiso(options = {}) {
   if (!allHealthy) {
     throw new Error('Infrastructure is not up. Run \'aifabrix up-infra\' first.');
   }
-  logger.log(chalk.green('✓ Infrastructure is up'));
+  logger.log(formatSuccessLine('Infrastructure is up'));
   await ensureAppFromTemplate('keycloak');
   await ensureAppFromTemplate('miso-controller');
   // If envOutputPath target folder does not exist, set envOutputPath to null
@@ -109,7 +99,7 @@ async function handleUpMiso(options = {}) {
   patchEnvOutputPathForDeployOnly('keycloak');
   patchEnvOutputPathForDeployOnly('miso-controller');
   await runMisoApps(options);
-  logger.log(chalk.green('\n✓ up-miso complete. Keycloak and miso-controller are running.') +
+  logger.log(formatSuccessParagraph('up-miso complete. Keycloak and miso-controller are running.') +
     chalk.gray('\n  Run onboarding and register Keycloak from the miso-controller repo if needed. Use \'aifabrix up-dataplane\' for dataplane.'));
 }
 

package/lib/commands/upload.js

@@ -1,7 +1,8 @@
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 /**
- * Upload external system to dataplane (single pipeline upload: upload → validate → publish).
+ * Upload external system to dataplane (single pipeline upload: validate → publish → controller register).
  *
- * @fileoverview Upload command handler for aifabrix upload <system-key>
+ * @fileoverview Upload command handler for aifabrix upload <systemKey>
  * @author AI Fabrix Team
  * @version 2.0.0
  */
@@ -21,9 +22,21 @@ const {
 const { validateExternalSystemComplete } = require('../validation/validate');
 const { displayValidationResults } = require('../validation/validate-display');
 const { generateControllerManifest } = require('../generator/external-controller-manifest');
-const { uploadApplicationViaPipeline } = require('../api/pipeline.api');
+const {
+  uploadApplicationViaPipeline,
+  validatePipelineConfig,
+  testSystemViaPipeline
+} = require('../api/pipeline.api');
 const { formatApiError } = require('../utils/api-error-handler');
 const { logDataplanePipelineWarning } = require('../utils/dataplane-pipeline-warning');
+const { unwrapPublicationResult, unwrapApiData } = require('../utils/external-system-readiness-core');
+const {
+  logUploadReadinessSummary,
+  logServerValidationWarnings,
+  logProbeRuntimeBlock
+} = require('../utils/external-system-readiness-display');
+const { maybeSyncSystemCertificationFromDataplane } = require('../certification/sync-system-certification');
+const { cliOptsSkipCertSync } = require('../certification/cli-cert-sync-skip');
 
 /**
  * Validates system-key format (same as download).
@@ -66,10 +79,10 @@ async function resolveDataplaneAndAuth(systemKey) {
   const authConfig = await getDeploymentAuth(controllerUrl, environment, systemKey);
 
   if (!authConfig.token && !authConfig.clientId) {
-    throw new Error('Authentication required. Run "aifabrix login" or "aifabrix app register <system-key>" first.');
+    throw new Error('Authentication required. Run "aifabrix login" or "aifabrix app register <systemKey>" first.');
   }
 
-  logger.log(chalk.blue('Resolving dataplane URL...'));
+  logger.log(chalk.gray('Resolving dataplane URL...'));
   const dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig);
   return { dataplaneUrl, authConfig, environment };
 }
@@ -79,7 +92,7 @@ async function resolveDataplaneAndAuth(systemKey) {
  * @param {string} dataplaneUrl - Dataplane base URL
  * @param {Object} authConfig - Auth config
  * @param {Object} payload - { version, application, dataSources, status: "draft" }
- * @returns {Promise<Object>} Publication result from Dataplane
+ * @returns {Promise<Object>} Raw API response envelope
  */
 async function runUploadValidatePublish(dataplaneUrl, authConfig, payload) {
   const res = await uploadApplicationViaPipeline(dataplaneUrl, authConfig, payload);
@@ -91,9 +104,8 @@ async function runUploadValidatePublish(dataplaneUrl, authConfig, payload) {
 }
 
 /**
- * Builds a short summary of validation errors for the thrown message.
  * @param {Object} validationResult - Result from validateExternalSystemComplete
- * @returns {string} First few errors joined for the error message
+ * @returns {string}
  */
 function formatValidationErrorSummary(validationResult) {
   const errors = validationResult.errors || [];
@@ -108,7 +120,6 @@ function formatValidationErrorSummary(validationResult) {
 }
 
 /**
- * Throws if validation result is invalid (displays results first).
  * @param {Object} validationResult - Result from validateExternalSystemComplete
  * @throws {Error} If validationResult.valid is false
  */
@@ -162,52 +173,151 @@ async function pushAndLogCredentialSecrets(dataplaneUrl, authConfig, systemKey,
 }
 
 /**
- * Uploads external system to dataplane (single pipeline upload). No controller deploy.
- * @param {string} systemKey - External system key (integration/<system-key>/)
- * @param {Object} [options] - Options
- * @param {boolean} [options.dryRun] - Validate and build payload only; no API calls
- * @returns {Promise<void>}
- * @throws {Error} If validation or API calls fail
+ * Optional server-side pipeline validate when --verbose.
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {Object} payload
  */
-async function uploadExternalSystem(systemKey, options = {}) {
-  validateSystemKeyFormat(systemKey);
-  logger.log(chalk.blue(`\nUploading external system to dataplane: ${systemKey}`));
+async function maybeRunVerboseServerValidation(dataplaneUrl, authConfig, payload) {
+  const vr = await validatePipelineConfig(dataplaneUrl, authConfig, {
+    config: {
+      version: payload.version,
+      application: payload.application,
+      dataSources: payload.dataSources
+    }
+  });
+  if (vr?.success === false) {
+    throw new Error(formatApiError(vr, dataplaneUrl));
+  }
+  const body = unwrapApiData(vr);
+  logServerValidationWarnings(body);
+}
+
+/**
+ * Omit payloadTemplate so POST /validation/run uses the **validation-engine** path
+ * (same as deploy --probe). Needed for certification and dataplane auto-issue of integration
+ * certificates after a successful run. If RBAC/live checks fail right after upload until the
+ * controller syncs permissions, skip --probe or retry once permissions are visible.
+ */
+const UPLOAD_PROBE_TEST_DATA = {};
 
+/**
+ * Optional POST validation/run after successful upload.
+ * @param {string} dataplaneUrl
+ * @param {string} systemKey
+ * @param {Object} authConfig
+ * @param {number|undefined} probeTimeoutMs
+ */
+async function maybeRunUploadProbe(dataplaneUrl, systemKey, authConfig, probeTimeoutMs) {
+  logger.log(chalk.blue('\nRunning runtime checks (--probe)...'));
+  const timeoutMs = probeTimeoutMs === undefined || probeTimeoutMs === null ? 120000 : probeTimeoutMs;
+  try {
+    const pr = await testSystemViaPipeline(
+      dataplaneUrl,
+      systemKey,
+      authConfig,
+      UPLOAD_PROBE_TEST_DATA,
+      { timeout: timeoutMs }
+    );
+    if (pr.success === false) {
+      logger.log(chalk.yellow(`⚠ Probe request failed: ${pr.formattedError || pr.error || 'unknown error'}`));
+      return;
+    }
+    const probeData = unwrapApiData(pr);
+    logProbeRuntimeBlock(probeData, systemKey);
+  } catch (e) {
+    logger.log(chalk.yellow(`⚠ Probe failed: ${e.message}`));
+  }
+}
+
+/**
+ * Local validation, manifest, payload, and configuration resolution.
+ * @param {string} systemKey
+ * @returns {Promise<{ manifest: Object, payload: Object }>}
+ */
+async function buildValidatedUploadManifestPayload(systemKey) {
   const validationResult = await validateExternalSystemComplete(systemKey, { type: 'external' });
   throwIfValidationFailed(validationResult);
-  logger.log(chalk.green('Validation passed.'));
-
+  logger.log(formatSuccessLine('Local validation passed'));
   const manifest = await generateControllerManifest(systemKey, { type: 'external' });
   const payload = buildUploadPayload(manifest);
   await resolvePayloadConfiguration(systemKey, payload);
+  return { manifest, payload };
+}
 
-  if (options.dryRun) {
-    logger.log(chalk.yellow('Dry run: would upload payload (no API calls).'));
-    logger.log(chalk.gray(`  System: ${manifest.key}, version: ${payload.version}, datasources: ${payload.dataSources.length}`));
-    return;
-  }
-
+/**
+ * Upload path after dry-run check.
+ * @param {string} systemKey
+ * @param {Object} options
+ * @param {Object} manifest
+ * @param {Object} payload
+ */
+async function runUploadPublishAndSummary(systemKey, options, manifest, payload) {
   const { dataplaneUrl, authConfig, environment } = await resolveDataplaneAndAuth(systemKey);
   requireBearerForDataplanePipeline(authConfig);
-  logger.log(chalk.blue(`Dataplane: ${dataplaneUrl}`));
+  logger.log(chalk.gray('Target:'));
+  logger.log(chalk.gray(`Environment: ${environment}`));
+  logger.log(chalk.gray(`Dataplane: ${dataplaneUrl}`));
   logDataplanePipelineWarning();
-
+  if (options.verbose) {
+    await maybeRunVerboseServerValidation(dataplaneUrl, authConfig, payload);
+  }
   await pushAndLogCredentialSecrets(dataplaneUrl, authConfig, systemKey, payload);
-  await runUploadValidatePublish(dataplaneUrl, authConfig, payload);
-  logUploadSuccess(environment, systemKey, dataplaneUrl);
+  const rawRes = await runUploadValidatePublish(dataplaneUrl, authConfig, payload);
+  const publication = unwrapPublicationResult(rawRes);
+  if (!publication) {
+    throw new Error(
+      'Unexpected response from dataplane upload: missing publication result (uploadId/system/datasources).'
+    );
+  }
+  logUploadReadinessSummary({
+    environment,
+    dataplaneUrl,
+    systemKey,
+    publication,
+    manifest,
+    minimal: !!options.minimal,
+    willProbe: !!options.probe
+  });
+  if (options.probe) {
+    await maybeRunUploadProbe(dataplaneUrl, systemKey, authConfig, options.probeTimeout);
+  }
+
+  const dsKeys = (payload.dataSources || []).map((ds) => ds && ds.key).filter(Boolean);
+  await maybeSyncSystemCertificationFromDataplane({
+    label: 'upload',
+    noCertSync: cliOptsSkipCertSync(options),
+    systemKey,
+    dataplaneUrl,
+    authConfig,
+    datasourceKeys: dsKeys
+  });
 }
 
 /**
- * Logs upload success summary.
- * @param {string} environment - Environment key
- * @param {string} systemKey - System key
- * @param {string} dataplaneUrl - Dataplane URL
+ * Uploads external system: publishes to dataplane and registers with controller (draft).
+ * @param {string} systemKey - External system key (integration/<systemKey>/)
+ * @param {Object} [options] - Options
+ * @param {boolean} [options.dryRun] - Validate and build payload only; no API calls
+ * @param {boolean} [options.verbose] - POST pipeline/validate for server warnings
+ * @param {boolean} [options.probe] - POST validation/run after publish
+ * @param {number} [options.probeTimeout] - Probe timeout ms (default 120000)
+ * @param {boolean} [options.minimal] - Short summary only
+ * @returns {Promise<void>}
+ * @throws {Error} If validation or API calls fail
  */
-function logUploadSuccess(environment, systemKey, dataplaneUrl) {
-  logger.log(chalk.green('\nUpload validated and published to dataplane.'));
-  logger.log(chalk.blue(`Environment: ${environment}`));
-  logger.log(chalk.blue(`System: ${systemKey}`));
-  logger.log(chalk.blue(`Dataplane: ${dataplaneUrl}`));
+async function uploadExternalSystem(systemKey, options = {}) {
+  validateSystemKeyFormat(systemKey);
+  logger.log(chalk.blue(`\nUploading external system: ${chalk.bold(systemKey)}`));
+  const { manifest, payload } = await buildValidatedUploadManifestPayload(systemKey);
+  if (options.dryRun) {
+    logger.log(chalk.yellow('Dry run: would upload payload (no API calls).'));
+    logger.log(
+      chalk.gray(`  System: ${manifest.key}, version: ${payload.version}, datasources: ${payload.dataSources.length}`)
+    );
+    return;
+  }
+  await runUploadPublishAndSummary(systemKey, options, manifest, payload);
 }
 
 module.exports = {

package/lib/commands/wizard-core-helpers.js

@@ -308,7 +308,7 @@ function throwConfigGenerationError(generateResponse, options = {}) {
 }
 
 /**
- * Write debug log to integration/<appName>/debug.log
+ * Write debug log to integration/<systemKey>/debug.log
  * @async
  * @param {string} appName - Application name
  * @param {string} content - Debug log content

package/lib/commands/wizard-dataplane.js

@@ -6,6 +6,7 @@
 
 const chalk = require('chalk');
 const logger = require('../utils/logger');
+const { infoLine, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
 const { getDataplaneUrl } = require('../datasource/deploy');
 const { listEnvironmentApplications } = require('../api/environments.api');
 
@@ -75,7 +76,7 @@ function createDataplaneNotFoundError() {
 async function tryFallbackDataplaneUrl(controllerUrl, environment, authConfig) {
   try {
     const fallbackUrl = await getDataplaneUrl(controllerUrl, 'dataplane', environment, authConfig);
-    logger.log(chalk.green(`\u2713 Dataplane URL: ${fallbackUrl}`));
+    logger.log(formatSuccessLine(`Dataplane URL: ${fallbackUrl}`));
     return fallbackUrl;
   } catch (fallbackError) {
     if (isNotFoundError(fallbackError)) {
@@ -96,12 +97,12 @@ async function tryFallbackDataplaneUrl(controllerUrl, environment, authConfig) {
  * @throws {Error} If dataplane URL cannot be discovered
  */
 async function discoverDataplaneUrl(controllerUrl, environment, authConfig) {
-  logger.log(chalk.blue('\uD83C\uDF10 Getting dataplane URL from controller...'));
+  logger.log(infoLine('🌐 Getting dataplane URL from controller...'));
   try {
     const dataplaneAppKey = await findDataplaneServiceAppKey(controllerUrl, environment, authConfig);
     if (dataplaneAppKey) {
       const dataplaneUrl = await getDataplaneUrl(controllerUrl, dataplaneAppKey, environment, authConfig);
-      logger.log(chalk.green(`\u2713 Dataplane URL: ${dataplaneUrl}`));
+      logger.log(formatSuccessLine(`Dataplane URL: ${dataplaneUrl}`));
       return dataplaneUrl;
     }
     return await tryFallbackDataplaneUrl(controllerUrl, environment, authConfig);

package/lib/commands/wizard-helpers.js

@@ -117,9 +117,9 @@ function showWizardConfigSummary(config, displayPath) {
 }
 
 /**
- * Ensure integration/<appKey> directory exists
- * @param {string} appKey - Application key
- * @returns {Promise<string>} Resolved config path (integration/<appKey>/wizard.yaml)
+ * Ensure integration/<systemKey> directory exists
+ * @param {string} appKey - Integration folder name (system key)
+ * @returns {Promise<string>} Resolved config path (integration/<systemKey>/wizard.yaml)
  */
 async function ensureIntegrationDir(appKey) {
   const dir = path.join(process.cwd(), 'integration', appKey);

package/lib/commands/wizard.js

@@ -344,7 +344,7 @@ async function executeWizardFlow(appKey, dataplaneUrl, authConfig, flowOpts = {}
 
 /**
  * Load wizard config from configPath if it exists (for prefill)
- * @param {string} [configPath] - Path to wizard.yaml (e.g. integration/<app>/wizard.yaml)
+ * @param {string} [configPath] - Path to wizard.yaml (e.g. integration/<systemKey>/wizard.yaml)
  * @param {string} [appName] - App name (for log message)
  * @returns {Promise<Object|null>} Loaded config or null
  */
@@ -441,7 +441,7 @@ async function handleWizardError(appKey, configPath, mode, systemIdOrKey, error)
  * @param {Object} options - Command options
  * @param {string} [options.app] - Application name (from positional or -a)
  * @param {string} [options.config] - Path to wizard.yaml (headless mode)
- * @param {string} [options.configPath] - Resolved path integration/<app>/wizard.yaml for load/save
+ * @param {string} [options.configPath] - Resolved path integration/<systemKey>/wizard.yaml for load/save
  * @returns {Promise<void>} Resolves when wizard completes
  * @throws {Error} If wizard fails (wizardResumeMessage set when appKey known)
  */

package/lib/core/admin-secrets.js

@@ -11,7 +11,7 @@
 'use strict';
 
 const path = require('path');
-const fs = require('fs');
+const fsRealSync = require('../internal/fs-real-sync');
 const config = require('./config');
 const { decryptSecret, isEncrypted } = require('../utils/secrets-encryption');
 const { ensureSecureFilePermissions } = require('../utils/secure-file-permissions');
@@ -48,18 +48,27 @@ function parseAdminEnvContent(content) {
  * Use the returned object only in memory (e.g. to build a temporary .env for docker compose).
  *
  * @async
- * @param {string} [adminSecretsPath] - Path to admin-secrets.env; default: ~/.aifabrix/admin-secrets.env
+ * @param {string} [adminSecretsPath] - Path to admin-secrets.env; default: beside config.yaml (typically ~/.aifabrix), with legacy fallback under aifabrix-home when only that file exists
  * @returns {Promise<Object.<string, string>>} Plain object e.g. { POSTGRES_PASSWORD, PGADMIN_DEFAULT_EMAIL, ... }
  * @throws {Error} If file missing, or encrypted value and decryption fails / no key configured
  */
 async function readAndDecryptAdminSecrets(adminSecretsPath) {
   const pathsUtil = require('../utils/paths');
-  const resolvedPath = adminSecretsPath || path.join(pathsUtil.getAifabrixHome(), 'admin-secrets.env');
-  if (!fs.existsSync(resolvedPath)) {
+  let resolvedPath = adminSecretsPath;
+  if (!resolvedPath) {
+    const systemPath = path.join(pathsUtil.getAifabrixSystemDir(), 'admin-secrets.env');
+    const legacyPath = path.join(pathsUtil.getAifabrixHome(), 'admin-secrets.env');
+    resolvedPath = fsRealSync.existsSync(systemPath)
+      ? systemPath
+      : fsRealSync.existsSync(legacyPath)
+        ? legacyPath
+        : systemPath;
+  }
+  if (!fsRealSync.existsSync(resolvedPath)) {
     throw new Error(`Admin secrets file not found: ${resolvedPath}. Run 'aifabrix up-infra' or ensure admin-secrets.env exists.`);
   }
   ensureSecureFilePermissions(resolvedPath);
-  const content = fs.readFileSync(resolvedPath, 'utf8');
+  const content = fsRealSync.readFileSync(resolvedPath, 'utf8');
   const raw = parseAdminEnvContent(content);
   const encryptionKey = await config.getSecretsEncryptionKey();
   const out = {};