@aifabrix/builder 2.44.6 → 2.45.5

package/lib/cli/infra-guided.js

@@ -23,6 +23,9 @@ const { handleLogin } = require('../commands/login');
 const healthCheck = require('../utils/health-check');
 const { prepareUrlsLocalRegistryForUpPlatform } = require('../commands/up-common');
 const { assertDevInfraUp } = require('../commands/dev-infra-gate');
+const {
+  emitSystemBuilderAppManifestLineIfTTY
+} = require('../utils/manifest-source-emit');
 
 const SEPARATOR = '────────────────────────────────────────';
 
@@ -67,22 +70,23 @@ async function hasErrorLogs(appName, opts = {}) {
 
 async function validateAppErrorLogs(appNames) {
   const names = Array.isArray(appNames) ? appNames : [];
-  const results = await Promise.all(
-    names.map(async(name) => {
-      try {
-        const hasErrors = await hasErrorLogs(name, { tailLines: 300 });
-        return { name, hasErrors };
-      } catch {
-        return { name, hasErrors: false };
+  const bad = [];
+  for (const name of names) {
+    try {
+      const hasErrors = await hasErrorLogs(name, { tailLines: 300 });
+      if (hasErrors) {
+        bad.push(name);
       }
-    })
-  );
-  const bad = results.filter(r => r && r.hasErrors);
-  if (bad.length === 0) return;
-
+    } catch {
+      // ignore per-app log failures
+    }
+  }
+  if (bad.length === 0) {
+    return;
+  }
   logger.log(chalk.yellow('⚠ Some services reported error logs'));
-  for (const r of bad) {
-    logger.log(chalk.gray(`  Run: aifabrix logs ${r.name} -l error`));
+  for (const name of bad) {
+    logger.log(chalk.gray(`  Run: aifabrix logs ${name} -l error`));
   }
   logger.log('');
 }
@@ -158,7 +162,7 @@ async function computeAppBaseUrl(appName) {
     return joinUrlPath(publicBase, mount);
   }
 
-  // No Traefik front-door routing: publicBase already includes correct scheme/host/port (localhost or remote-server).
+  // No Traefik front-door routing: publicBase is localhost + published port unless Traefik/proxy opts into remote.
   return String(publicBase).replace(/\/+$/, '');
 }
 
@@ -226,7 +230,9 @@ async function getInfraHostAndPorts() {
   const developerId = await config.getDeveloperId();
   const idNum = typeof developerId === 'string' ? parseInt(developerId, 10) : developerId;
   const ports = devConfig.getDevPorts(idNum);
-  const remoteServer = await config.getRemoteServer();
+  const cfg = await config.getConfig();
+  const traefikOn = Boolean(cfg && cfg.traefik === true);
+  const remoteServer = traefikOn ? await config.getRemoteServer() : null;
   const host = resolveInfraHost(remoteServer);
   return { idNum, ports, host };
 }
@@ -308,11 +314,13 @@ async function runGuidedUpDataplane(options, handleUpDataplane) {
   await runGuidedAuthStep(handleLogin);
 
   logger.log('');
+  emitSystemBuilderAppManifestLineIfTTY(logger, 'dataplane');
   const dpSpin = startSpinner('Starting Dataplane...');
   await withMutedLogger(() =>
     handleUpDataplane({ ...options, platformInstall: true, skipInfraCheck: true })
   );
   stopSpinnerSuccess(dpSpin, 'Dataplane ready');
+  await refreshDataplaneVersionAfterPlatformInstall();
   await validateAppErrorLogs(['dataplane']);
   await logDataplaneReadyFooter();
 }
@@ -346,6 +354,7 @@ function logGuidedPlatformSetupHeader() {
   logger.log('');
   logger.log(title('AI Fabrix Platform Setup'));
   logger.log(SEPARATOR);
+  logger.log(chalk.gray('This may take a few minutes...'));
   logger.log('');
 }
 
@@ -353,43 +362,68 @@ async function runGuidedAuthStep(handleLogin) {
   const spin = startSpinner('Authenticating...');
   try {
     const controllerUrl = await resolveControllerUrl();
-    await handleLogin({ method: 'device', controller: controllerUrl, environment: 'dev', compact: true });
+    await handleLogin({
+      method: 'device',
+      controller: controllerUrl,
+      environment: 'dev',
+      compact: true,
+      // Dataplane is not up yet during guided platform/dataplane install; refresh after it starts.
+      skipDataplaneVersionRefresh: true
+    });
   } catch (authErr) {
     if (spin) spin.fail('Authentication failed');
     logger.error(formatBlockingError('Authentication failed'));
     logger.log(chalk.gray('\nRun:\n  af login\n\nThen retry:\n  af up-platform\n'));
     throw authErr;
   }
-  // Compact device-login already prints a success line; don't duplicate it.
-  if (spin) spin.stop();
+  // Compact device-login prints "Authentication successful"; close the step spinner cleanly.
+  stopSpinnerSuccess(spin, 'Authenticated');
 }
 
-async function runGuidedUpPlatform(options, handleUpMiso, handleUpDataplane, handleLogin, forceCleanSummary = null) {
-  logGuidedPlatformSetupHeader();
-  if (forceCleanSummary && forceCleanSummary.forceSummary) {
-    logUpPlatformForceCleanSummary(forceCleanSummary.forceSummary, forceCleanSummary.cleanedApps);
+async function refreshDataplaneVersionAfterPlatformInstall() {
+  try {
+    const { tryRefreshDataplaneVersionAfterLogin } = require('../commands/auth-status-dataplane-version');
+    const controllerUrl = await resolveControllerUrl();
+    await tryRefreshDataplaneVersionAfterLogin(controllerUrl, {});
+  } catch {
+    // best-effort only
   }
+}
 
-  await withMutedLogger(() => prepareUrlsLocalRegistryForUpPlatform());
-
+async function runGuidedKeycloakAndMisoControllerPhase(options, handleUpMiso) {
+  emitSystemBuilderAppManifestLineIfTTY(logger, 'keycloak');
   const kcSpin = startSpinner('Starting Keycloak...');
   await withMutedLogger(() => handleUpMiso({ ...options, platformInstall: true }));
   stopSpinnerSuccess(kcSpin, 'Keycloak ready');
   logger.log('');
-
+  emitSystemBuilderAppManifestLineIfTTY(logger, 'miso-controller');
   const mcSpin = startSpinner('Starting Miso Controller...');
   await waitForAppReady('miso-controller', { timeoutSeconds: 120 });
   stopSpinnerSuccess(mcSpin, 'Miso Controller ready');
   logger.log('');
+}
 
-  await runGuidedAuthStep(handleLogin);
-
+async function runGuidedDataplaneInstallPhase(options, handleUpDataplane) {
   logger.log('');
+  emitSystemBuilderAppManifestLineIfTTY(logger, 'dataplane');
   const dpSpin = startSpinner('Starting Dataplane...');
   await withMutedLogger(() =>
     handleUpDataplane({ ...options, platformInstall: true, skipInfraCheck: true })
   );
   stopSpinnerSuccess(dpSpin, 'Dataplane ready');
+  await refreshDataplaneVersionAfterPlatformInstall();
+}
+
+async function runGuidedUpPlatform(options, handleUpMiso, handleUpDataplane, handleLogin, forceCleanSummary = null) {
+  logGuidedPlatformSetupHeader();
+  if (forceCleanSummary && forceCleanSummary.forceSummary) {
+    logUpPlatformForceCleanSummary(forceCleanSummary.forceSummary, forceCleanSummary.cleanedApps);
+  }
+
+  await withMutedLogger(() => prepareUrlsLocalRegistryForUpPlatform());
+  await runGuidedKeycloakAndMisoControllerPhase(options, handleUpMiso);
+  await runGuidedAuthStep(handleLogin);
+  await runGuidedDataplaneInstallPhase(options, handleUpDataplane);
   await validateAppErrorLogs(['miso-controller', 'dataplane']);
   await logPlatformReadyFooter();
 }

package/lib/cli/installation-log-command.js

@@ -0,0 +1,73 @@
+/**
+ * Shared completion hook for infra/platform CLI commands (installation.log).
+ *
+ * @fileoverview installation.log CLI helper
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const config = require('../core/config');
+const installationLog = require('../utils/installation-log');
+
+/**
+ * @param {Object} params
+ * @param {string} params.command
+ * @param {Object} params.options
+ * @param {Date} params.startedAt
+ * @param {'success'|'failure'} params.outcome
+ * @param {Error} [params.error]
+ * @param {string[]} [params.platformAppList]
+ * @param {Object} [params.cleanup]
+ * @param {boolean} [params.upPlatformForce]
+ * @param {boolean} [params.omitInfraSection]
+ * @returns {Promise<void>}
+ */
+async function recordInfraInstallationCommand(params) {
+  const {
+    command,
+    options,
+    startedAt,
+    outcome,
+    error,
+    platformAppList,
+    cleanup,
+    upPlatformForce,
+    omitInfraSection
+  } = params;
+
+  const completedAt = new Date();
+  let cfg = {};
+  try {
+    cfg = await config.getConfig();
+  } catch {
+    cfg = {};
+  }
+
+  try {
+    await installationLog.appendInstallationRecord({
+      command,
+      outcome,
+      startedAt,
+      completedAt,
+      options,
+      infra: !omitInfraSection && cfg ? { cfg, options } : undefined,
+      platformAppList,
+      cleanup,
+      upPlatformForce: upPlatformForce === true,
+      configExtra: {
+        controllerUrl: await installationLog.resolveControllerUrlForLog(),
+        adminEmail: await installationLog.resolveAdminEmailPresence()
+      },
+      error,
+      errorCode: error && error.code ? String(error.code) : undefined
+    });
+  } catch {
+    // never block CLI on log failure
+  }
+}
+
+module.exports = {
+  recordInfraInstallationCommand
+};

package/lib/cli/setup-app.help.js

@@ -56,12 +56,60 @@ Examples:
 Notes:
   - To run E2E for one datasource, use:
       aifabrix datasource test-e2e <datasourceKey>
-  - External integration: local system and datasource files are published to the dataplane before E2E (same as upload). Use --no-sync to exercise only config already deployed. The old --sync flag is a no-op (kept for scripts).
+  - External integration: local system and datasource files are published to the dataplane before E2E (same as upload). Use --no-sync to exercise only config already deployed.
+`;
+
+const IDENTITY_HELP_AFTER = `
+Examples:
+  # Bulk seed from demo users.csv (test-protection prefix) + sync + cache purge
+  $ aifabrix identity apply --file ./users.csv --filter-prefix test-protection -e dev --sync --purge-cache
+  $ aifabrix identity sync -e dev --purge-cache
+  $ aifabrix identity cache clear
+
+  # Single user / group
+  $ aifabrix identity user create --email alice@example.com --first-name Alice --last-name HR
+  $ aifabrix identity group create --name test-protection-sales-fi --description "Sales Finland"
+
+Notes:
+  - Requires aifabrix login (controller token). See docs/commands/identity-management.md.
+  - Prefer identity apply over SQL in tests/fixtures/protection/optional-dev-identity-dataplane.sql.
+`;
+
+const TEST_GOVERNANCE_HELP_AFTER = `
+Examples:
+  # External system — ABAC visibility acceptance (governance scenario pack)
+  $ aifabrix test-governance test-protection
+  $ aifabrix test-governance test-protection --pack scenarios/test-protection-v1.yaml
+  $ aifabrix test-governance test-protection -v --no-sync
+  $ aifabrix test-governance test-protection --scenario country-isolation-maria-fi --json
+
+Notes:
+  - Separate from test-e2e (vendor connectivity). Does not call external vendor APIs.
+  - Load baseline fixtures first (datasource load, protection upload) — not auto-run by this command.
+  - Default pack: integration/<systemKey>/scenarios/default.yaml or <systemKey>-v1.yaml
+  - Requires governance:evaluate on the operator token (see permissions.md).
+`;
+
+const TEST_TRUST_HELP_AFTER = `
+Examples:
+  # External system — semantic trust for every datasource (dataplane 404.5)
+  $ aifabrix test-trust hubspot
+  $ aifabrix test-trust hubspot -v --revalidate
+  $ aifabrix test-trust hubspot --no-sync
+  $ aifabrix test-trust hubspot --summary --timeout 120000
+
+Notes:
+  - For one datasource: aifabrix datasource test-trust <datasourceKey>
+  - Does not call external APIs (use test-e2e for live proof).
+  - Local integration files are published before run unless --no-sync.
 `;
 
 module.exports = {
   TEST_HELP_AFTER,
   TEST_INTEGRATION_HELP_AFTER,
-  TEST_E2E_HELP_AFTER
+  TEST_E2E_HELP_AFTER,
+  TEST_TRUST_HELP_AFTER,
+  TEST_GOVERNANCE_HELP_AFTER,
+  IDENTITY_HELP_AFTER
 };
 

package/lib/cli/setup-app.js

@@ -16,14 +16,23 @@ const { setupInstallTestE2eLintCommands } = require('./setup-app.test-commands')
 
 const CREATE_HELP_AFTER = `
 Examples:
+  # Builder app → builder/<appKey>/
   $ aifabrix create myapi --type webapp -l typescript
-  $ aifabrix create mycrm --wizard
+  $ aifabrix create mysvc --type api -l python
+
+  # External system → integration/<systemKey>/ (default --type external)
+  $ aifabrix create hubspot --wizard
+  $ aifabrix create mycrm --type external --display-name "My CRM" --description "..." \\
+      --system-type openapi --auth-type oauth2 --entity-type recordStorage --datasources 1
+
+Positional: appKey for builder types; systemKey for --type external (folder under integration/).
+Prefer aifabrix wizard [systemKey] for guided external setup.
 `;
 
 const DEPLOY_HELP_AFTER = `
 Examples:
-  $ aifabrix deploy myapp
-  $ aifabrix deploy myext --local
+  $ aifabrix deploy myapp              # builder appKey → builder/myapp/
+  $ aifabrix deploy hubspot --local    # systemKey → integration/hubspot/
 `;
 
 const PUSH_HELP_AFTER = `
@@ -133,8 +142,8 @@ async function handleCreateCommand(appName, options) {
 }
 
 function setupCreateCommand(program) {
-  program.command('create <app>')
-    .description('Scaffold builder or external app (flags or --wizard)')
+  program.command('create <appKey|systemKey>')
+    .description('Create builder app (builder/<appKey>/) or external system (integration/<systemKey>/; --type, flags, or --wizard)')
     .addHelpText('after', CREATE_HELP_AFTER)
     .option('-p, --port <port>', 'Application port', '3000')
     .option('-d, --database', 'Requires database')
@@ -148,7 +157,7 @@ function setupCreateCommand(program) {
     .option('-g, --github', 'Generate GitHub Actions workflows')
     .option('--github-steps <steps>', 'Extra GitHub workflow steps (comma-separated, e.g., npm,test)')
     .option('--main-branch <branch>', 'Main branch name for workflows', 'main')
-    .option('--wizard', 'Use interactive wizard for external system creation')
+    .option('--wizard', 'Run wizard for external system (systemKey → integration/<systemKey>/; same as aifabrix wizard)')
     .option('--display-name <name>', 'External system display name')
     .option('--description <desc>', 'External system description')
     .option('--system-type <type>', 'External system type (openapi, mcp, custom)')
@@ -207,15 +216,25 @@ Examples:
   $ aifabrix run myapp --env tst
   $ aifabrix run myapp --tag v1.0.0
   $ aifabrix run myapp --base
-  $ aifabrix run myapp --reload`;
-  program.command('run <app>')
-    .description('Run app locally or on remote Docker host')
+  $ aifabrix run myapp --reload
+  $ aifabrix run myapp --no-proxy   # same as --proxy false: localhost for Docker declarative public URLs; saves applications.<app>.proxy: false`;
+  program.command('run <appKey>')
+    .description('Run builder app by appKey locally or on remote Docker host')
     .option('-p, --port <port>', 'Override local port')
     .option('-d, --debug', 'Enable debug output with detailed container information')
     .option('-t, --tag <tag>', 'Image tag to run (e.g. v1.0.0); overrides application.yaml image.tag')
     .option('-e, --env <env>', 'Environment: dev (default), tst, or pro', 'dev')
     .option('--base', 'Use manifest base image only (skip local developer-scoped tag preference)')
     .option('--reload', 'In dev: mount workspace into container (Mutagen only if docker-endpoint is a remote host)')
+    .option(
+      '--proxy',
+      'Use Traefik/front-door public URL hints when infra has Traefik and application.yaml enables frontDoorRouting (default: on)',
+      true
+    )
+    .option(
+      '--no-proxy',
+      'Docker declarative public url://* use localhost + published port (saves applications.<app>.proxy: false); overrides --proxy'
+    )
     .addHelpText('after', runHelp)
     .action(async(appName, options) => {
       try {
@@ -228,8 +247,8 @@ Examples:
 }
 
 function setupBuildRunLogsDownCommands(program) {
-  program.command('build <app>')
-    .description('Build Docker image (auto-detect runtime)')
+  program.command('build <appKey>')
+    .description('Build Docker image for builder appKey (auto-detect runtime)')
     .option('-l, --language <lang>', 'Override language detection')
     .option('-f, --force-template', 'Force rebuild from template')
     .option('--no-cache', 'Full Docker rebuild (disable layer cache); use after Dockerfile or context fixes')
@@ -247,8 +266,8 @@ function setupBuildRunLogsDownCommands(program) {
 
   registerRunCommand(program);
 
-  program.command('logs <app>')
-    .description('Tail app container logs (optional env summary; secrets masked)')
+  program.command('logs <appKey>')
+    .description('Tail container logs for appKey (optional env summary; secrets masked)')
     .option('-f', 'Follow log stream')
     .option('-t, --tail <lines>', 'Number of lines (default: 100); 0 = full list', '100')
     .option('-l, --level <level>', 'Show only logs at this level or above (debug|info|warn|error)')
@@ -265,8 +284,8 @@ function setupBuildRunLogsDownCommands(program) {
       }
     });
 
-  program.command('down-app <app>')
-    .description('Stop and remove app container (--volumes removes data volume)')
+  program.command('down-app <appKey>')
+    .description('Stop and remove container for appKey (--volumes removes data volume)')
     .option('--volumes', 'Remove application Docker volume')
     .action(async(appName, options) => {
       try {
@@ -280,8 +299,8 @@ function setupBuildRunLogsDownCommands(program) {
 }
 
 function setupShellTestStopCommands(program) {
-  program.command('stop <app>')
-    .description('Alias for down-app: stop and remove container')
+  program.command('stop <appKey>')
+    .description('Alias for down-app: stop and remove container for appKey')
     .option('--volumes', 'Remove application Docker volume')
     .action(async(appName, options) => {
       try {
@@ -293,8 +312,8 @@ function setupShellTestStopCommands(program) {
       }
     });
 
-  program.command('shell <app>')
-    .description('Interactive shell in running or ephemeral container')
+  program.command('shell <appKey>')
+    .description('Interactive shell in container for builder appKey')
     .option('--env <env>', 'Environment (dev|tst); dev uses running container', 'dev')
     .action(async(appName, options) => {
       try {
@@ -308,8 +327,8 @@ function setupShellTestStopCommands(program) {
 }
 
 function setupDockerfileGenerateCommand(program) {
-  program.command('dockerfile <app>')
-    .description('Generate Dockerfile from detected runtime')
+  program.command('dockerfile <appKey>')
+    .description('Generate Dockerfile for builder appKey from detected runtime')
     .option('-l, --language <lang>', 'Override language detection')
     .option('-f, --force', 'Overwrite existing Dockerfile')
     .action(async(appName, options) => {
@@ -325,8 +344,8 @@ function setupDockerfileGenerateCommand(program) {
 }
 
 function setupPushDeployDockerfileCommands(program) {
-  program.command('push <app>')
-    .description('Push image to Azure Container Registry')
+  program.command('push <appKey>')
+    .description('Push builder appKey image to Azure Container Registry')
     .addHelpText('after', PUSH_HELP_AFTER)
     .option('-r, --registry <registry>', 'ACR registry URL (overrides application.yaml)')
     .option('-t, --tag <tag>', 'Image tag(s) - comma-separated for multiple (default: latest)')
@@ -339,8 +358,8 @@ function setupPushDeployDockerfileCommands(program) {
       }
     });
 
-  program.command('deploy <app>')
-    .description('Deploy via Miso Controller (Azure or --local)')
+  program.command('deploy <appKey|systemKey>')
+    .description('Deploy builder app or external system via Miso Controller (Azure or --local)')
     .addHelpText('after', DEPLOY_HELP_AFTER)
     .option('--local', 'Send manifest to controller then run app locally (app: same as aifabrix run <app>; external: restart dataplane)')
     .option('--client-id <id>', 'Client ID (overrides config)')

package/lib/cli/setup-app.test-commands.js

@@ -8,11 +8,16 @@ const chalk = require('chalk');
 const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
 const { cliOptsSkipCertSync } = require('../certification/cli-cert-sync-skip');
-const { TEST_HELP_AFTER, TEST_E2E_HELP_AFTER } = require('./setup-app.help');
+const {
+  TEST_HELP_AFTER,
+  TEST_E2E_HELP_AFTER,
+  TEST_TRUST_HELP_AFTER,
+  TEST_GOVERNANCE_HELP_AFTER
+} = require('./setup-app.help');
 
 function setupTestCommand(program) {
-  program.command('test <app>')
-    .description('Tests: builder in container; external = local validation')
+  program.command('test <appKey|systemKey>')
+    .description('Tests: builder appKey in container; external systemKey = local validation')
     .option('-e, --env <env>', 'For builder app: dev (running container) or tst (ephemeral)', 'dev')
     .option('-v, --verbose', 'Verbose output')
     .option('-d, --debug', 'Write debug log to integration/<systemKey>/logs/ (external only)')
@@ -84,14 +89,16 @@ function firstIssuanceFailureHintFromE2eResults(results) {
  * @param {Object} options
  * @returns {Promise<void>}
  */
-async function runExternalIntegrationE2EAndCertSync(appName, options) {
+async function runExternalIntegrationE2EAndCertSync(appName, options, cmd) {
+  const { cliOptsSkipSync } = require('../utils/cli-sync-options');
   const { runTestE2EForExternalSystem } = require('../commands/test-e2e-external');
+  const noSync = cliOptsSkipSync(options, cmd);
   const { success, results } = await runTestE2EForExternalSystem(appName, {
     env: options.env,
     debug: options.debug,
     verbose: options.verbose,
     async: options.async !== false,
-    noSync: options.noSync === true
+    noSync
   });
   const { displayIntegrationTestResults } = require('../utils/external-system-display');
   const datasourceResults = results.map(r => ({
@@ -118,17 +125,19 @@ async function runExternalIntegrationE2EAndCertSync(appName, options) {
   await trySyncCertificationFromDataplaneForExternalApp(appName, 'test-e2e', { issuanceFailureHint });
 }
 
-async function runTestE2ECommand(appName, options) {
+async function runTestE2ECommand(appName, options, cmd) {
+  const { cliOptsSkipSync } = require('../utils/cli-sync-options');
+  const noSync = cliOptsSkipSync(options, cmd);
   const pathsUtil = require('../utils/paths');
   const appType = await pathsUtil.detectAppType(appName).catch(() => null);
-  if (options.noSync === true && appType && appType.baseDir === 'builder') {
+  if (noSync && appType && appType.baseDir === 'builder') {
     throw new Error(
       'Option --no-sync applies only to external integration E2E (integration/<systemKey>/). ' +
         'Remove --no-sync for builder app E2E.'
     );
   }
   if (appType && appType.baseDir === 'integration') {
-    await runExternalIntegrationE2EAndCertSync(appName, options);
+    await runExternalIntegrationE2EAndCertSync(appName, options, cmd);
     return;
   }
   const { runAppTestE2e } = require('../commands/app-test');
@@ -136,8 +145,8 @@ async function runTestE2ECommand(appName, options) {
 }
 
 function setupInstallCommand(program) {
-  program.command('install <app>')
-    .description('Install deps in container (builder apps only)')
+  program.command('install <appKey>')
+    .description('Install deps in container (builder appKey only)')
     .option('--env <env>', 'dev (running container) or tst (ephemeral with .env)', 'dev')
     .action(async(appName, options) => {
       try {
@@ -145,7 +154,7 @@ function setupInstallCommand(program) {
         const appType = await pathsUtil.detectAppType(appName).catch(() => null);
         if (appType && appType.baseDir === 'integration') {
           logger.log(
-            chalk.gray('Install is for builder applications only. Use aifabrix shell <app> to run commands in external setups.')
+            chalk.gray('Install is for builder appKey only. Use aifabrix shell <appKey> for builder apps or External Systems commands for integrations.')
           );
           return;
         }
@@ -159,15 +168,11 @@ function setupInstallCommand(program) {
 }
 
 function setupTestE2eCommand(program) {
-  program.command('test-e2e <app>')
-    .description('E2E: builder in container; external = all datasources via dataplane')
+  program.command('test-e2e <appKey|systemKey>')
+    .description('E2E: builder appKey in container; external systemKey = all datasources via dataplane')
     .option('-e, --env <env>', 'Environment: dev, tst, or pro (builder: dev/tst for container)', 'dev')
     .option('-v, --verbose', 'Show detailed step output and poll progress')
     .option('-d, --debug', 'Include debug output and write log to integration/<systemKey>/logs/')
-    .option(
-      '--sync',
-      '(Deprecated; no-op.) Local integration files are published before E2E by default; use --no-sync to skip.'
-    )
     .option(
       '--no-sync',
       'Skip publishing local integration files; E2E uses the system config already on the dataplane (external integration only)'
@@ -188,7 +193,7 @@ function setupTestE2eCommand(program) {
           env: envExplicit ? options.env : undefined,
           async: true // system-level command surface omits --no-async; always poll for completeness
         };
-        await runTestE2ECommand(appName, externalOpts);
+        await runTestE2ECommand(appName, externalOpts, cmd);
       } catch (error) {
         handleCommandError(error, 'test-e2e');
         process.exit(1);
@@ -197,15 +202,15 @@ function setupTestE2eCommand(program) {
 }
 
 function setupLintCommand(program) {
-  program.command('lint <app>')
-    .description('Lint in container (builder apps only)')
+  program.command('lint <appKey>')
+    .description('Lint in container (builder appKey only)')
     .option('--env <env>', 'dev (running container) or tst (ephemeral with .env)', 'dev')
     .action(async(appName, options) => {
       try {
         const pathsUtil = require('../utils/paths');
         const appType = await pathsUtil.detectAppType(appName).catch(() => null);
         if (appType && appType.baseDir === 'integration') {
-          logger.log(chalk.gray('lint is for builder applications only. Use aifabrix shell <app> then make lint or pnpm lint.'));
+          logger.log(chalk.gray('lint is for builder appKey only. Use aifabrix shell <appKey> then make lint or pnpm lint.'));
           return;
         }
         const { runAppLint } = require('../commands/app-test');
@@ -217,10 +222,64 @@ function setupLintCommand(program) {
     });
 }
 
+function collectScenarioId(value, previous) {
+  return previous.concat([value]);
+}
+
+function setupTestGovernanceCommand(program) {
+  const { testGovernanceCommandHandler } = require('../commands/test-governance-command-action');
+  program
+    .command('test-governance <appKey|systemKey>')
+    .description(
+      'Governance scenario acceptance: ABAC visibility via governed search (key sets only)'
+    )
+    .option('-e, --env <env>', 'Environment: dev, tst, or pro', 'dev')
+    .option('--pack <path>', 'Scenario pack YAML (default: scenarios/default.yaml or <systemKey>-v1.yaml)')
+    .option('-a, --app <path>', 'Integration folder override')
+    .option(
+      '--scenario <id>',
+      'Run subset of scenario ids (repeatable)',
+      collectScenarioId,
+      []
+    )
+    .option('--no-sync', 'Skip publishing local integration files before run')
+    .option('-v, --verbose', 'Per-scenario verdict lines with subject and counts')
+    .option('--json', 'Machine-readable redacted result (same allowlist as API)')
+    .addHelpText('after', TEST_GOVERNANCE_HELP_AFTER)
+    .action((appName, options, cmd) => testGovernanceCommandHandler(appName, options, cmd));
+}
+
+function setupTestTrustCommand(program) {
+  const { testTrustCommandHandler } = require('../commands/test-trust-command-action');
+  program
+    .command('test-trust <appKey|systemKey>')
+    .description(
+      'Semantic agent metadata validation for external system (all datasources via dataplane 404.5)'
+    )
+    .option('-e, --env <env>', 'Environment: dev, tst, or pro', 'dev')
+    .option('-v, --verbose', 'Show findings and observed business model')
+    .option('-d, --debug', 'Write debug log under integration/<systemKey>/logs/')
+    .option('--no-sync', 'Skip publishing local integration files before validate')
+    .option('--revalidate', 'Force new validation for each datasource')
+    .option(
+      '--timeout <ms>',
+      'HTTP timeout for validate/latest requests (ms)',
+      '120000'
+    )
+    .option('--strict', 'Exit 1 unless every datasource is trusted')
+    .option('--warnings-as-errors', 'Exit 1 when any datasource is usableWithWarnings')
+    .option('--json', 'Print JSON array of trust runs')
+    .option('--summary', 'One line per datasource')
+    .addHelpText('after', TEST_TRUST_HELP_AFTER)
+    .action((appName, options, cmd) => testTrustCommandHandler(appName, options, cmd));
+}
+
 function setupInstallTestE2eLintCommands(program) {
   setupInstallCommand(program);
   setupTestCommand(program);
   setupTestE2eCommand(program);
+  setupTestGovernanceCommand(program);
+  setupTestTrustCommand(program);
   setupLintCommand(program);
 }