@aifabrix/builder 2.45.0 → 2.45.5

package/lib/datasource/audit-evidence-extract.js

@@ -0,0 +1,177 @@
+/**
+ * @fileoverview Extract audit evidence inputs from DatasourceTestRun envelope or debug log
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const fsp = require('node:fs').promises;
+const { getIntegrationPath } = require('../utils/paths');
+const { resolveAppKeyForDatasource } = require('./resolve-app');
+const { getLatestLogPath } = require('./log-viewer');
+const {
+  executionIdsFromDebugEnvelope,
+  cipOperationsFromDebugEnvelope,
+  dedupeIds: dedupeIdsFromDebug
+} = require('./audit-evidence-extract-debug');
+
+/** @param {Array<*>} ids @returns {string[]} */
+function dedupeIds(ids) {
+  return dedupeIdsFromDebug(ids);
+}
+
+/**
+ * @param {Object|null|undefined} envelope
+ * @returns {string[]}
+ */
+function executionIdsFromEnvelope(envelope) {
+  const audit = envelope && envelope.audit;
+  const merged = [
+    ...(audit && audit.executionIds ? audit.executionIds : []),
+    ...executionIdsFromDebugEnvelope(envelope)
+  ];
+  return dedupeIds(merged);
+}
+
+/**
+ * E2E uses testRunId as CipExecution.correlationId (see external_data_e2e_helpers).
+ * @param {Object|null|undefined} envelope
+ * @returns {string|null}
+ */
+function correlationIdFromAsyncDebug(envelope) {
+  const dbg = envelope && envelope.debug;
+  const asyncDbg = dbg && dbg.e2eAsyncDebug;
+  if (!asyncDbg || typeof asyncDbg !== 'object') return null;
+  const requestId =
+    asyncDbg.requestId !== undefined && asyncDbg.requestId !== null
+      ? String(asyncDbg.requestId).trim()
+      : '';
+  if (requestId) return requestId;
+  const nested =
+    asyncDbg.testRunId !== undefined && asyncDbg.testRunId !== null
+      ? String(asyncDbg.testRunId).trim()
+      : '';
+  return nested || null;
+}
+
+/**
+ * Ephemeral envelope runId (run-*) is not stored as CipExecution.correlationId.
+ * @param {string} runId
+ * @returns {boolean}
+ */
+function isEphemeralEnvelopeRunId(runId) {
+  return /^run-[a-f0-9]{12}$/i.test(runId);
+}
+
+function correlationIdFromEnvelope(envelope) {
+  if (!envelope || typeof envelope !== 'object') return null;
+  const testRunId =
+    envelope.testRunId !== undefined && envelope.testRunId !== null
+      ? String(envelope.testRunId).trim()
+      : '';
+  if (testRunId && !isEphemeralEnvelopeRunId(testRunId)) return testRunId;
+  const fromDebug = correlationIdFromAsyncDebug(envelope);
+  if (fromDebug) return fromDebug;
+  const runId =
+    envelope.runId !== undefined && envelope.runId !== null ? String(envelope.runId).trim() : '';
+  if (runId && !isEphemeralEnvelopeRunId(runId)) return runId;
+  return null;
+}
+
+/**
+ * Expected capacity/sync operations for matrix rows 1 and 8.
+ * @param {Object|null|undefined} envelope
+ * @returns {string[]}
+ */
+function expectedOperationsFromEnvelope(envelope) {
+  const fromCapacity = cipOperationsFromDebugEnvelope(envelope);
+  if (fromCapacity.length) return fromCapacity;
+  const ops = new Set();
+  const caps = envelope && Array.isArray(envelope.capabilities) ? envelope.capabilities : [];
+  for (const cap of caps) {
+    if (!cap || cap.status === 'skipped' || !cap.key) continue;
+    const key = String(cap.key).trim();
+    if (['insert', 'update', 'get', 'delete', 'list', 'create'].includes(key)) {
+      ops.add(key === 'create' ? 'insert' : key);
+    }
+  }
+  const integration = envelope && envelope.integration;
+  if (integration && integration.sync && integration.sync.status === 'ok') {
+    ops.add('list');
+  }
+  return [...ops];
+}
+
+/**
+ * @param {Object|null|undefined} envelope
+ * @returns {{ datasourceKey: string, correlationId: string|null, executionIds: string[], expectedOperations: string[] }}
+ */
+function extractAuditEvidenceContext(envelope, opts = {}) {
+  if (!envelope || typeof envelope !== 'object') {
+    return {
+      datasourceKey: opts.datasourceKey ? String(opts.datasourceKey).trim() : '',
+      correlationId: null,
+      executionIds: [],
+      expectedOperations: []
+    };
+  }
+  const datasourceKey =
+    opts.datasourceKey !== undefined && opts.datasourceKey !== null
+      ? String(opts.datasourceKey).trim()
+      : envelope.datasourceKey !== undefined && envelope.datasourceKey !== null
+        ? String(envelope.datasourceKey).trim()
+        : '';
+  return {
+    datasourceKey,
+    correlationId: correlationIdFromEnvelope(envelope),
+    executionIds: executionIdsFromEnvelope(envelope),
+    expectedOperations: expectedOperationsFromEnvelope(envelope)
+  };
+}
+
+/**
+ * @param {Object} logPayload - Saved test-e2e debug log `{ request, response }`
+ * @returns {Object|null}
+ */
+function envelopeFromLogPayload(logPayload) {
+  if (!logPayload || typeof logPayload !== 'object') return null;
+  if (logPayload.response && typeof logPayload.response === 'object') {
+    return logPayload.response;
+  }
+  return logPayload;
+}
+
+/**
+ * @async
+ * @param {string} datasourceKey
+ * @param {Object} options
+ * @param {string} [options.app]
+ * @param {string} [options.file]
+ * @returns {Promise<Object|null>}
+ */
+async function loadEnvelopeFromLatestE2eLog(datasourceKey, options = {}) {
+  if (options.file) {
+    const raw = await fsp.readFile(path.resolve(options.file), 'utf8');
+    const parsed = JSON.parse(raw);
+    return envelopeFromLogPayload(parsed);
+  }
+  const { appKey } = await resolveAppKeyForDatasource(datasourceKey, options.app);
+  const logsDir = path.join(getIntegrationPath(appKey), 'logs');
+  const logPath = await getLatestLogPath(logsDir, 'test-e2e-');
+  if (!logPath) return null;
+  const raw = await fsp.readFile(logPath, 'utf8');
+  const parsed = JSON.parse(raw);
+  return envelopeFromLogPayload(parsed);
+}
+
+module.exports = {
+  dedupeIds,
+  executionIdsFromEnvelope,
+  correlationIdFromEnvelope,
+  expectedOperationsFromEnvelope,
+  extractAuditEvidenceContext,
+  envelopeFromLogPayload,
+  loadEnvelopeFromLatestE2eLog
+};

package/lib/datasource/audit-evidence-matrix-rows.js

@@ -0,0 +1,158 @@
+/**
+ * @fileoverview Plan 407.1 nine-row audit evidence matrix checks (pure helpers)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const CAPTURED = 'captured';
+
+const RBAC_SKIP_REASON_PREFIXES = [
+  'rbacAuditInternalPath',
+  'rbacAuditApiKeyBypass',
+  'rbacAudit'
+];
+
+/**
+ * @param {import('../api/types/audit.types').AuditEvidenceMatrixRow} row
+ * @returns {import('../api/types/audit.types').AuditEvidenceMatrixRow}
+ */
+function passRow(row, detail, code) {
+  const out = { ...row, status: 'passed', detail };
+  if (code) {
+    out.code = code;
+  }
+  return out;
+}
+
+/**
+ * @param {import('../api/types/audit.types').AuditEvidenceMatrixRow} row
+ * @param {string} detail
+ * @param {string} [code]
+ * @returns {import('../api/types/audit.types').AuditEvidenceMatrixRow}
+ */
+function failRow(row, detail, code) {
+  return { ...row, status: 'failed', detail, code: code || row.code };
+}
+
+/**
+ * @param {*} ref
+ * @returns {boolean}
+ */
+function hasFkRef(ref) {
+  if (!ref || typeof ref !== 'object') return false;
+  const id = ref.id !== undefined && ref.id !== null ? String(ref.id).trim() : '';
+  const key = ref.key !== undefined && ref.key !== null ? String(ref.key).trim() : '';
+  return Boolean(id || key);
+}
+
+/**
+ * @param {Object} item
+ * @returns {boolean}
+ */
+function executionRowCaptured(item) {
+  if (!item || typeof item !== 'object') return false;
+  const rbacOk = item.rbacAuditStatus === CAPTURED && hasFkRef(item.rbacDecision);
+  const abacOk = item.abacAuditStatus === CAPTURED && hasFkRef(item.abacTrace);
+  return rbacOk && abacOk;
+}
+
+/**
+ * Row 1 — executions by datasource.
+ * @param {Object} input
+ * @returns {import('../api/types/audit.types').AuditEvidenceMatrixRow}
+ */
+function checkRow1ExecutionsByDatasource(input) {
+  const row = { row: 1, status: 'failed', detail: '', code: 'executionsByDatasource' };
+  const { executions, minExpected } = input;
+  const total = input.totalItems !== undefined ? input.totalItems : executions.length;
+  if (total < minExpected) {
+    return failRow(row, `executions=${total} expected>=${minExpected}`, 'executionsCountLow');
+  }
+  const captured = executions.filter(executionRowCaptured).length;
+  if (captured < minExpected) {
+    return failRow(
+      row,
+      `executions=${total} captured=${captured} (need captured rbac/abac FKs)`,
+      'executionsNotCaptured'
+    );
+  }
+  return passRow(row, `executions=${total} captured=${captured}`, 'executionsByDatasource');
+}
+
+/**
+ * Row 2 — RBAC decisions list.
+ * @param {Object} input
+ * @returns {import('../api/types/audit.types').AuditEvidenceMatrixRow}
+ */
+function checkRow2RbacDecisionsList(input) {
+  const row = { row: 2, status: 'failed', detail: '', code: 'rbacListEmpty' };
+  const items = input.rbacItems || [];
+  const total = input.totalItems !== undefined ? input.totalItems : items.length;
+  if (total < 1 || items.length < 1) {
+    return failRow(row, 'rbac-decisions list empty', 'rbacListEmpty');
+  }
+  const first = items[0];
+  const execRef = first && first.executionId;
+  if (!hasFkRef(execRef)) {
+    return failRow(row, 'rbac row missing executionId ref', 'rbacMissingExecutionId');
+  }
+  const reason = first && first.reason ? String(first.reason) : '';
+  const skipOk =
+    reason &&
+    RBAC_SKIP_REASON_PREFIXES.some(prefix => reason.startsWith(prefix) || reason.includes(prefix));
+  if (!skipOk && !reason) {
+    return failRow(row, 'rbac row missing skip/capture reason', 'rbacReasonMissing');
+  }
+  return passRow(row, `rbac rows=${total} reason=${reason || 'present'}`, 'rbacListOk');
+}
+
+/**
+ * Row 3 — ABAC traces list.
+ * @param {Object} input
+ * @returns {import('../api/types/audit.types').AuditEvidenceMatrixRow}
+ */
+function checkRow3AbacTracesList(input) {
+  const row = { row: 3, status: 'failed', detail: '', code: 'abacListEmpty' };
+  const items = input.abacItems || [];
+  const total = input.totalItems !== undefined ? input.totalItems : items.length;
+  if (total < 1 || items.length < 1) {
+    return failRow(row, 'abac-traces list empty', 'abacListEmpty');
+  }
+  const first = items[0];
+  const decision = first && first.decision ? String(first.decision) : '';
+  const reason = first && first.reason ? String(first.reason) : '';
+  if (!reason) {
+    return failRow(row, 'abac row missing reason', 'abacReasonMissing');
+  }
+  return passRow(row, `abac rows=${total} decision=${decision || 'n/a'} reason=${reason}`, 'abacListOk');
+}
+
+/**
+ * Rows 4–7, 9 — per-execution sub-resources.
+ * @param {number} rowNum
+ * @param {string} code
+ * @param {string} label
+ * @param {*} payload
+ * @param {(payload: *) => boolean} isValid
+ * @returns {import('../api/types/audit.types').AuditEvidenceMatrixRow}
+ */
+function checkPerExecutionRow(rowNum, code, label, payload, isValid) {
+  const row = { row: rowNum, status: 'failed', detail: '', code };
+  if (!isValid(payload)) {
+    return failRow(row, `${label} missing or invalid`, code);
+  }
+  return passRow(row, `${label} ok`, `${label}Ok`);
+}
+
+module.exports = {
+  CAPTURED,
+  RBAC_SKIP_REASON_PREFIXES,
+  hasFkRef,
+  executionRowCaptured,
+  checkRow1ExecutionsByDatasource,
+  checkRow2RbacDecisionsList,
+  checkRow3AbacTracesList,
+  checkPerExecutionRow
+};

package/lib/datasource/audit-evidence-operation-aliases.js

@@ -0,0 +1,63 @@
+/**
+ * @fileoverview Normalize CIP execution operation labels for Plan 407 audit matrix
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * Align list API operation values with builder E2E expectations (matches e2e_audit_operation.py).
+ * @param {*} operation
+ * @returns {string}
+ */
+function normalizeAuditOperation(operation) {
+  const raw = operation !== undefined && operation !== null ? String(operation).trim() : '';
+  if (!raw) return '';
+  let op = raw === 'updateBasic' ? 'updatebasic' : raw.toLowerCase();
+  if (op === 'create') op = 'insert';
+  return op;
+}
+
+/**
+ * @param {Array<{ operation?: string }>} executions
+ * @param {string[]} expectedOperations
+ * @returns {boolean}
+ */
+/**
+ * API filter values to try for a matrix-expected operation (DB may use create vs insert).
+ * @param {string} expectedOp
+ * @returns {string[]}
+ */
+function operationQueryVariants(expectedOp) {
+  const n = normalizeAuditOperation(expectedOp);
+  if (!n) return [];
+  const variants = new Set([n]);
+  if (n === 'insert') variants.add('create');
+  if (n === 'updatebasic') {
+    variants.add('updateBasic');
+    variants.add('updatebasic');
+  }
+  if (n === 'updateaddress') {
+    variants.add('updateAddress');
+    variants.add('updateaddress');
+  }
+  return [...variants];
+}
+
+function executionsCoverExpectedOperations(executions, expectedOperations) {
+  const expected = (expectedOperations || [])
+    .map(normalizeAuditOperation)
+    .filter(Boolean);
+  if (!expected.length) return true;
+  const ops = new Set(
+    (executions || []).map(e => normalizeAuditOperation(e && e.operation)).filter(Boolean)
+  );
+  return expected.every(op => ops.has(op));
+}
+
+module.exports = {
+  normalizeAuditOperation,
+  operationQueryVariants,
+  executionsCoverExpectedOperations
+};

package/lib/datasource/audit-evidence-poll.js

@@ -0,0 +1,109 @@
+/**
+ * @fileoverview Bounded poll until audit execution rows are captured (407.3)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { executionRowCaptured } = require('./audit-evidence-matrix-rows');
+
+const DEFAULT_MAX_WAIT_MS = 15000;
+const DEFAULT_INTERVAL_MS = 2000;
+
+/**
+ * @param {number} ms
+ * @returns {Promise<void>}
+ */
+function sleep(ms) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+/**
+ * @param {Array} executions
+ * @param {number} minExpected
+ * @returns {boolean}
+ */
+function executionsReady(executions, minExpected) {
+  if (!Array.isArray(executions) || executions.length < minExpected) return false;
+  const captured = executions.filter(executionRowCaptured).length;
+  return captured >= minExpected;
+}
+
+/**
+ * @param {Array} executions
+ * @param {string[]} executionIds
+ * @returns {boolean}
+ */
+function allEnvelopeIdsPresent(executions, executionIds) {
+  if (!Array.isArray(executionIds) || !executionIds.length) return true;
+  const found = new Set(
+    (executions || []).map(e => (e && e.id ? String(e.id) : '')).filter(Boolean)
+  );
+  return executionIds.every(id => found.has(String(id)));
+}
+
+/**
+ * E2E: wait until envelope executionIds are visible and captured in list API.
+ * @param {Array} executions
+ * @param {number} minExpected
+ * @param {string[]} [executionIds]
+ * @returns {boolean}
+ */
+function executionsReadyForVerify(executions, minExpected, executionIds) {
+  const min = Math.max(1, minExpected || 1);
+  if (Array.isArray(executionIds) && executionIds.length) {
+    const need = Math.min(min, executionIds.length);
+    if (!allEnvelopeIdsPresent(executions, executionIds)) return false;
+    const captured = executionIds.filter(id =>
+      (executions || []).some(
+        e => String(e.id) === String(id) && executionRowCaptured(e)
+      )
+    ).length;
+    return captured >= need;
+  }
+  return executionsReady(executions, min);
+}
+
+/**
+ * @async
+ * @param {Object} opts
+ * @param {() => Promise<{ data: Array, meta: Object|null }>} opts.fetchExecutions
+ * @param {number} opts.minExpected
+ * @param {number} [opts.maxWaitMs]
+ * @param {number} [opts.intervalMs]
+ * @returns {Promise<{ data: Array, meta: Object|null, timedOut: boolean }>}
+ */
+async function pollExecutionsUntilReady(opts) {
+  const minExpected = Math.max(1, opts.minExpected || 1);
+  const executionIds = Array.isArray(opts.executionIds) ? opts.executionIds : [];
+  const maxWaitMs =
+    opts.maxWaitMs !== undefined && opts.maxWaitMs !== null ? opts.maxWaitMs : DEFAULT_MAX_WAIT_MS;
+  const intervalMs =
+    opts.intervalMs !== undefined && opts.intervalMs !== null
+      ? opts.intervalMs
+      : DEFAULT_INTERVAL_MS;
+  const deadline = Date.now() + maxWaitMs;
+  let last = { data: [], meta: null };
+
+  while (Date.now() <= deadline) {
+    last = await opts.fetchExecutions();
+    if (executionsReadyForVerify(last.data, minExpected, executionIds)) {
+      return { ...last, timedOut: false };
+    }
+    if (Date.now() + intervalMs > deadline) break;
+    await sleep(intervalMs);
+  }
+
+  return { ...last, timedOut: true };
+}
+
+module.exports = {
+  DEFAULT_MAX_WAIT_MS,
+  DEFAULT_INTERVAL_MS,
+  sleep,
+  executionsReady,
+  allEnvelopeIdsPresent,
+  executionsReadyForVerify,
+  pollExecutionsUntilReady
+};

package/lib/datasource/audit-evidence-run.js

@@ -0,0 +1,177 @@
+/**
+ * @fileoverview Orchestrate audit evidence verification after E2E or from saved logs
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { resolveAppKeyForDatasource } = require('./resolve-app');
+const { setupIntegrationTestAuth } = require('../external-system/test-auth');
+const { getConfig } = require('../core/config');
+const {
+  extractAuditEvidenceContext,
+  loadEnvelopeFromLatestE2eLog
+} = require('./audit-evidence-extract');
+const { verifyAuditEvidenceMatrix } = require('./audit-evidence-verify');
+const {
+  displayAuditEvidenceMatrixTTY,
+  printAuditEvidenceVerificationJson
+} = require('./audit-evidence-display');
+
+/**
+ * @param {string} datasourceKey
+ * @param {Object} options
+ * @returns {Promise<{ authConfig: Object, dataplaneUrl: string }>}
+ */
+async function resolveAuditVerifyAuth(datasourceKey, options) {
+  if (options.authConfig && options.dataplaneUrl) {
+    return { authConfig: options.authConfig, dataplaneUrl: options.dataplaneUrl };
+  }
+  const { appKey } = await resolveAppKeyForDatasource(datasourceKey, options.app);
+  const configObj = await getConfig();
+  const auth = await setupIntegrationTestAuth(appKey, options, configObj);
+  return { authConfig: auth.authConfig, dataplaneUrl: auth.dataplaneUrl };
+}
+
+/**
+ * @param {Object} envelope
+ * @param {string} datasourceKey
+ * @param {Object} [opts]
+ * @returns {Object}
+ */
+function buildVerifyContext(envelope, datasourceKey, opts = {}) {
+  const ctx = extractAuditEvidenceContext(envelope);
+  if (datasourceKey) ctx.datasourceKey = String(datasourceKey).trim();
+  if (opts.correlationId) ctx.correlationId = String(opts.correlationId).trim();
+  if (opts.executionId) {
+    const id = String(opts.executionId).trim();
+    if (id && !ctx.executionIds.includes(id)) ctx.executionIds.unshift(id);
+  }
+  return ctx;
+}
+
+/**
+ * @async
+ * @param {string} datasourceKey
+ * @param {Object} envelope - DatasourceTestRun
+ * @param {Object} options
+ * @returns {Promise<{ verification: import('../api/types/audit.types').AuditEvidenceVerification, exitCode: number }>}
+ */
+async function runAuditEvidenceVerification(datasourceKey, envelope, options = {}) {
+  const ctx = buildVerifyContext(envelope, datasourceKey, options);
+  if (!ctx.executionIds.length && !ctx.correlationId) {
+    const verification = failedVerification(
+      datasourceKey,
+      ctx,
+      'missing audit.executionIds and testRunId/correlationId',
+      'auditIdsMissing'
+    );
+    emitVerificationOutput(verification, options);
+    return { verification, exitCode: 1 };
+  }
+  let auth;
+  try {
+    auth = await resolveAuditVerifyAuth(datasourceKey, options);
+  } catch (err) {
+    const verification = failedVerification(datasourceKey, ctx, err.message, 'authFailed');
+    emitVerificationOutput(verification, options);
+    return { verification, exitCode: 3 };
+  }
+
+  try {
+    const verification = await verifyAuditEvidenceMatrix({
+      dataplaneUrl: auth.dataplaneUrl,
+      authConfig: auth.authConfig,
+      datasourceKey: ctx.datasourceKey,
+      correlationId: ctx.correlationId,
+      executionIds: ctx.executionIds,
+      expectedOperations: ctx.expectedOperations,
+      maxWaitMs: options.auditPollMaxWaitMs,
+      intervalMs: options.auditPollIntervalMs
+    });
+    emitVerificationOutput(verification, options);
+    return { verification, exitCode: verification.status === 'passed' ? 0 : 1 };
+  } catch (err) {
+    const verification = failedVerification(datasourceKey, ctx, err.message, 'verifyError');
+    emitVerificationOutput(verification, options);
+    const code = err.status === 401 || err.status === 403 ? 3 : 1;
+    return { verification, exitCode: code };
+  }
+}
+
+/**
+ * @param {string} datasourceKey
+ * @param {Object} ctx
+ * @param {string} message
+ * @param {string} code
+ * @returns {import('../api/types/audit.types').AuditEvidenceVerification}
+ */
+function failedVerification(datasourceKey, ctx, message, code) {
+  return {
+    status: 'failed',
+    datasourceKey,
+    correlationId: ctx.correlationId || null,
+    executionIds: ctx.executionIds || [],
+    matrix: [{ row: 0, status: 'failed', detail: message, code }]
+  };
+}
+
+/**
+ * @param {import('../api/types/audit.types').AuditEvidenceVerification} verification
+ * @param {Object} options
+ */
+function emitVerificationOutput(verification, options) {
+  if (options.json) {
+    printAuditEvidenceVerificationJson(verification);
+    return;
+  }
+  if (!options.quiet) {
+    displayAuditEvidenceMatrixTTY(verification, options.verbose === true);
+  }
+}
+
+/**
+ * Run audit matrix when E2E succeeded and --verify-audit is set.
+ * @param {number} e2eExitCode
+ * @param {string} datasourceKey
+ * @param {Object|null} envelope
+ * @param {Object} options
+ * @returns {Promise<number>}
+ */
+async function maybeVerifyAuditAfterE2E(e2eExitCode, datasourceKey, envelope, options = {}) {
+  const enabled =
+    options.verifyAudit === true && options.noVerifyAudit !== true;
+  if (!enabled || e2eExitCode !== 0 || !envelope) {
+    return e2eExitCode;
+  }
+  const pollMsRaw = parseInt(String(options.auditPollMs || options.auditPollMaxWaitMs || '15000'), 10);
+  const pollInterval = parseInt(
+    String(options.auditPollIntervalMs || '2000'),
+    10
+  );
+  const ctx = buildVerifyContext(envelope, datasourceKey, options);
+  const pollMs = Math.max(
+    Number.isFinite(pollMsRaw) ? pollMsRaw : 15000,
+    (ctx.executionIds && ctx.executionIds.length >= 7) ? 30000 : 0
+  );
+  const { exitCode } = await runAuditEvidenceVerification(datasourceKey, envelope, {
+    app: options.app,
+    env: options.env,
+    verbose: options.verbose,
+    json: options.json,
+    authConfig: options.authConfig,
+    dataplaneUrl: options.dataplaneUrl,
+    auditPollMaxWaitMs: pollMs,
+    auditPollIntervalMs: Number.isFinite(pollInterval) ? pollInterval : 2000
+  });
+  return exitCode;
+}
+
+module.exports = {
+  runAuditEvidenceVerification,
+  maybeVerifyAuditAfterE2E,
+  loadEnvelopeFromLatestE2eLog,
+  buildVerifyContext,
+  resolveAuditVerifyAuth
+};