@aifabrix/builder 2.45.0 → 2.45.5

package/lib/api/users.api.js

@@ -0,0 +1,95 @@
+/**
+ * @fileoverview Users API (Controller /api/v1/users)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { ApiClient } = require('./index');
+
+const BASE = '/api/v1/users';
+
+/**
+ * List users (paginated)
+ * @requiresPermission {Controller} users:read
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Object} [options]
+ * @returns {Promise<Object>}
+ */
+async function listUsers(controllerUrl, authConfig, options = {}) {
+  const client = new ApiClient(controllerUrl, authConfig);
+  return await client.get(BASE, { params: options });
+}
+
+/**
+ * Get user by id
+ * @requiresPermission {Controller} users:read
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {string} userId
+ * @param {Object} [options]
+ * @returns {Promise<Object>}
+ */
+async function getUser(controllerUrl, authConfig, userId, options = {}) {
+  const client = new ApiClient(controllerUrl, authConfig);
+  const params = {};
+  if (options.includeGroups) {
+    params.includeGroups = 'true';
+  }
+  return await client.get(`${BASE}/${encodeURIComponent(userId)}`, { params });
+}
+
+/**
+ * Create user
+ * @requiresPermission {Controller} users:create
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {Object} body
+ * @returns {Promise<Object>}
+ */
+async function createUser(controllerUrl, authConfig, body) {
+  const client = new ApiClient(controllerUrl, authConfig);
+  return await client.post(BASE, { body });
+}
+
+/**
+ * Patch user
+ * @requiresPermission {Controller} users:update
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {string} userId
+ * @param {Object} body
+ * @returns {Promise<Object>}
+ */
+async function updateUser(controllerUrl, authConfig, userId, body) {
+  const client = new ApiClient(controllerUrl, authConfig);
+  return await client.patch(`${BASE}/${encodeURIComponent(userId)}`, { body });
+}
+
+/**
+ * List groups for a user
+ * @requiresPermission {Controller} users:read
+ * @async
+ * @param {string} controllerUrl
+ * @param {Object} authConfig
+ * @param {string} userId
+ * @returns {Promise<Object>}
+ */
+async function listUserGroups(controllerUrl, authConfig, userId) {
+  const client = new ApiClient(controllerUrl, authConfig);
+  return await client.get(`${BASE}/${encodeURIComponent(userId)}/groups`);
+}
+
+module.exports = {
+  listUsers,
+  getUser,
+  createUser,
+  updateUser,
+  listUserGroups
+};

package/lib/api/validation-run.api.js

@@ -4,7 +4,7 @@
  * @version 2.0.0
  */
 
-const { ApiClient } = require('./index');
+const { createDataplaneApiClient } = require('./index');
 
 const POST_PATH = '/api/v1/validation/run';
 
@@ -52,7 +52,7 @@ function normalizeDataplaneAuth(authConfig) {
 async function postValidationRun(dataplaneUrl, authConfig, body, transportOpts = {}) {
   const hdrs = buildClientCredentialHeaders(authConfig);
   const clientAuth = hdrs ? {} : normalizeDataplaneAuth(authConfig);
-  const client = new ApiClient(dataplaneUrl, clientAuth);
+  const client = createDataplaneApiClient(dataplaneUrl, clientAuth);
   const postOpts = { body, headers: hdrs || undefined };
   if (Number.isFinite(transportOpts.timeoutMs) && transportOpts.timeoutMs > 0) {
     postOpts.timeoutMs = transportOpts.timeoutMs;
@@ -77,7 +77,7 @@ async function getValidationRun(dataplaneUrl, authConfig, testRunId, transportOp
   }
   const hdrs = buildClientCredentialHeaders(authConfig);
   const clientAuth = hdrs ? {} : normalizeDataplaneAuth(authConfig);
-  const client = new ApiClient(dataplaneUrl, clientAuth);
+  const client = createDataplaneApiClient(dataplaneUrl, clientAuth);
   const path = `${POST_PATH}/${encodeURIComponent(testRunId)}`;
   const getOpts = { headers: hdrs || undefined };
   if (Number.isFinite(transportOpts.timeoutMs) && transportOpts.timeoutMs > 0) {

package/lib/api/validation-runner.js

@@ -10,7 +10,6 @@ const { extractTestRunId } = require('./validation-run.api');
 const { postValidationRunWithTransportRetry } = require('../utils/validation-run-post-retry');
 const { pollValidationRunUntilComplete } = require('../utils/validation-run-poll');
 const { createValidationPollHandlers } = require('../utils/validation-poll-ui');
-const logger = require('../utils/logger');
 
 /**
  * POST /api/v1/validation/run and (when async) poll GET until reportCompleteness is full.
@@ -60,8 +59,9 @@ async function postValidationRunAndOptionalPoll(opts) {
     const remaining = Math.max(0, timeoutMs - elapsed);
     const deadlineMs = Date.now() + remaining;
 
-    logger.log('');
-    const pollUi = createValidationPollHandlers(deadlineMs);
+    const pollUi = createValidationPollHandlers(deadlineMs, {
+      subject: opts.pollSubject
+    });
     const mergeOnPollProgress =
       typeof opts.onPollProgress === 'function'
         ? (envelope, attemptIndex, meta) => {

package/lib/api/wizard-platform.api.js

@@ -4,7 +4,7 @@
  * @version 2.0.0
  */
 
-const { ApiClient } = require('./index');
+const { createDataplaneApiClient } = require('./index');
 
 /**
  * Get platform details including available datasources
@@ -19,7 +19,7 @@ const { ApiClient } = require('./index');
  * @throws {Error} If request fails or platform not found (404)
  */
 async function getPlatformDetails(dataplaneUrl, authConfig, platformKey) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   const response = await client.get(`/api/v1/wizard/platforms/${encodeURIComponent(platformKey)}`);
   if (!response.success) {
     const msg = response.status === 404
@@ -45,7 +45,7 @@ async function getPlatformDetails(dataplaneUrl, authConfig, platformKey) {
  * @throws {Error} If request fails
  */
 async function discoverEntities(dataplaneUrl, authConfig, openapiSpec) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   const response = await client.post('/api/v1/wizard/discover-entities', {
     body: { openapiSpec }
   });

package/lib/api/wizard.api.js

@@ -4,7 +4,7 @@
  * @version 2.0.0
  */
 
-const { ApiClient } = require('./index');
+const { createDataplaneApiClient } = require('./index');
 const { uploadFile } = require('../utils/file-upload');
 const { getPlatformDetails, discoverEntities } = require('./wizard-platform.api');
 
@@ -22,7 +22,7 @@ const { getPlatformDetails, discoverEntities } = require('./wizard-platform.api'
  * @throws {Error} If request fails
  */
 async function createWizardSession(dataplaneUrl, authConfig, mode, systemIdOrKey = null) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   const body = { mode };
   if (systemIdOrKey) {
     body.systemIdOrKey = systemIdOrKey;
@@ -45,7 +45,7 @@ async function createWizardSession(dataplaneUrl, authConfig, mode, systemIdOrKey
  * @throws {Error} If request fails
  */
 async function getWizardSession(dataplaneUrl, sessionId, authConfig) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.get(`/api/v1/wizard/sessions/${sessionId}`);
 }
 
@@ -75,7 +75,7 @@ async function getWizardSession(dataplaneUrl, sessionId, authConfig) {
  * @throws {Error} If request fails
  */
 async function updateWizardSession(dataplaneUrl, sessionId, authConfig, updateData) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.put(`/api/v1/wizard/sessions/${sessionId}`, {
     body: updateData
   });
@@ -94,7 +94,7 @@ async function updateWizardSession(dataplaneUrl, sessionId, authConfig, updateDa
  * @throws {Error} If request fails
  */
 async function deleteWizardSession(dataplaneUrl, sessionId, authConfig) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.delete(`/api/v1/wizard/sessions/${sessionId}`);
 }
 
@@ -111,7 +111,7 @@ async function deleteWizardSession(dataplaneUrl, sessionId, authConfig) {
  * @throws {Error} If request fails
  */
 async function getWizardProgress(dataplaneUrl, sessionId, authConfig) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.get(`/api/v1/wizard/sessions/${sessionId}/progress`);
 }
 
@@ -130,7 +130,7 @@ async function getWizardProgress(dataplaneUrl, sessionId, authConfig) {
  */
 async function parseOpenApi(dataplaneUrl, authConfig, openApiFilePathOrUrl, isUrl = false) {
   if (isUrl) {
-    const client = new ApiClient(dataplaneUrl, authConfig);
+    const client = createDataplaneApiClient(dataplaneUrl, authConfig);
     return await client.post(`/api/v1/wizard/parse-openapi?url=${encodeURIComponent(openApiFilePathOrUrl)}`);
   }
   const url = `${dataplaneUrl.replace(/\/$/, '')}/api/v1/wizard/parse-openapi`;
@@ -153,7 +153,7 @@ async function parseOpenApi(dataplaneUrl, authConfig, openApiFilePathOrUrl, isUr
  * @throws {Error} If request fails
  */
 async function credentialSelection(dataplaneUrl, authConfig, selectionData) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post('/api/v1/wizard/credential-selection', {
     body: selectionData
   });
@@ -172,7 +172,7 @@ async function credentialSelection(dataplaneUrl, authConfig, selectionData) {
  * @throws {Error} If request fails
  */
 async function detectType(dataplaneUrl, authConfig, openapiSpec) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post('/api/v1/wizard/detect-type', {
     body: { openapiSpec }
   });
@@ -199,7 +199,7 @@ async function detectType(dataplaneUrl, authConfig, openapiSpec) {
  * @throws {Error} If request fails
  */
 async function getPlatformConfig(dataplaneUrl, authConfig, platformKey, config) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post(`/api/v1/wizard/platforms/${encodeURIComponent(platformKey)}/config`, {
     body: config
   });
@@ -233,7 +233,7 @@ async function getPlatformConfig(dataplaneUrl, authConfig, platformKey, config)
  * @throws {Error} If request fails
  */
 async function generateConfig(dataplaneUrl, authConfig, config) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post('/api/v1/wizard/generate-config', {
     body: config
   });
@@ -252,7 +252,7 @@ async function generateConfig(dataplaneUrl, authConfig, config) {
  * @throws {Error} If request fails
  */
 async function generateConfigStream(dataplaneUrl, authConfig, config) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post('/api/v1/wizard/generate-config-stream', {
     body: config
   });
@@ -272,7 +272,7 @@ async function generateConfigStream(dataplaneUrl, authConfig, config) {
  * @throws {Error} If request fails
  */
 async function validateWizardConfig(dataplaneUrl, authConfig, systemConfig, datasourceConfig) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post('/api/v1/wizard/validate', {
     body: {
       systemConfig,
@@ -294,7 +294,7 @@ async function validateWizardConfig(dataplaneUrl, authConfig, systemConfig, data
  * @throws {Error} If request fails
  */
 async function validateAllSteps(dataplaneUrl, sessionId, authConfig) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.get(`/api/v1/wizard/sessions/${sessionId}/validate`);
 }
 
@@ -312,7 +312,7 @@ async function validateAllSteps(dataplaneUrl, sessionId, authConfig) {
  * @throws {Error} If request fails
  */
 async function validateStep(dataplaneUrl, sessionId, authConfig, stepNumber) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post(`/api/v1/wizard/sessions/${sessionId}/validate-step?step=${stepNumber}`);
 }
 
@@ -329,7 +329,7 @@ async function validateStep(dataplaneUrl, sessionId, authConfig, stepNumber) {
  * @throws {Error} If request fails
  */
 async function getPreview(dataplaneUrl, sessionId, authConfig) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.get(`/api/v1/wizard/preview/${sessionId}`);
 }
 
@@ -347,7 +347,7 @@ async function getPreview(dataplaneUrl, sessionId, authConfig) {
  * @throws {Error} If request fails
  */
 async function testMcpConnection(dataplaneUrl, authConfig, serverUrl, token) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post('/api/v1/wizard/test-mcp-connection', {
     body: {
       serverUrl,
@@ -369,7 +369,7 @@ async function testMcpConnection(dataplaneUrl, authConfig, serverUrl, token) {
  * @throws {Error} If request fails
  */
 async function getDeploymentDocs(dataplaneUrl, authConfig, systemKey) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.get(`/api/v1/wizard/deployment-docs/${systemKey}`);
 }
 
@@ -390,7 +390,7 @@ async function getDeploymentDocs(dataplaneUrl, authConfig, systemKey) {
  * @throws {Error} If request fails
  */
 async function postDeploymentDocs(dataplaneUrl, authConfig, systemKey, body = null) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.post(`/api/v1/wizard/deployment-docs/${systemKey}`, {
     body: body || {}
   });
@@ -410,7 +410,7 @@ async function postDeploymentDocs(dataplaneUrl, authConfig, systemKey, body = nu
  */
 async function getWizardPlatforms(dataplaneUrl, authConfig) {
   try {
-    const client = new ApiClient(dataplaneUrl, authConfig);
+    const client = createDataplaneApiClient(dataplaneUrl, authConfig);
     const response = await client.get('/api/v1/wizard/platforms');
     const platforms = response?.data?.platforms ?? response?.platforms ?? [];
     return Array.isArray(platforms) ? platforms : [];
@@ -433,7 +433,7 @@ async function getWizardPlatforms(dataplaneUrl, authConfig) {
  * @throws {Error} If request fails
  */
 async function listWizardCredentials(dataplaneUrl, authConfig, options = {}) {
-  const client = new ApiClient(dataplaneUrl, authConfig);
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
   return await client.get('/api/v1/wizard/credentials', {
     params: options
   });

package/lib/app/deploy.js

@@ -421,6 +421,35 @@ async function tryExternalDeployFallback(appName, options) {
   return { usedExternalDeploy: false, result: null };
 }
 
+function assertDeployNotProtectionScope(appName) {
+  const { isProtectionScope } = require('../protection/scope');
+  if (!isProtectionScope(appName)) {
+    return;
+  }
+  const { formatDeployProtectionNotImplementedTTY } = require('../protection/protection-display');
+  logger.error(formatDeployProtectionNotImplementedTTY());
+  process.exit(1);
+}
+
+/**
+ * Run external, fallback, or standard deployment paths.
+ * @param {string} appName
+ * @param {Object} options
+ * @returns {Promise<{ result: Object, usedExternalDeploy: boolean, controllerUrl?: string }>}
+ */
+async function executeDeployPipeline(appName, options) {
+  const externalResult = await handleExternalDeployment(appName, options);
+  if (externalResult) {
+    return { result: externalResult, usedExternalDeploy: true };
+  }
+  const fallback = await tryExternalDeployFallback(appName, options);
+  if (fallback.result) {
+    return { result: fallback.result, usedExternalDeploy: fallback.usedExternalDeploy };
+  }
+  const { result, controllerUrl } = await executeStandardDeployment(appName, options);
+  return { result, usedExternalDeploy: false, controllerUrl };
+}
+
 /**
  * Deploys application to Miso Controller
  * Orchestrates manifest generation, key creation, and deployment
@@ -446,26 +475,12 @@ async function deployApp(appName, options = {}) {
   let usedExternalDeploy = false;
 
   try {
-    if (!appName || typeof appName !== 'string' || appName.trim().length === 0) {
-      throw new Error('App name is required');
-    }
+    assertDeployNotProtectionScope(appName);
     validateAppName(appName);
-
-    const externalResult = await handleExternalDeployment(appName, options);
-    if (externalResult) {
-      usedExternalDeploy = true;
-      return { result: externalResult, usedExternalDeploy: true };
-    }
-
-    const fallback = await tryExternalDeployFallback(appName, options);
-    if (fallback.result) {
-      usedExternalDeploy = fallback.usedExternalDeploy;
-      return { result: fallback.result, usedExternalDeploy };
-    }
-
-    const { result, controllerUrl: url } = await executeStandardDeployment(appName, options);
-    controllerUrl = url;
-    return { result, usedExternalDeploy: false };
+    const pipeline = await executeDeployPipeline(appName, options);
+    controllerUrl = pipeline.controllerUrl ?? null;
+    usedExternalDeploy = pipeline.usedExternalDeploy;
+    return { result: pipeline.result, usedExternalDeploy };
   } catch (error) {
     await handleDeploymentError(error, appName, controllerUrl, usedExternalDeploy);
   }

package/lib/cli/index.js

@@ -22,7 +22,8 @@ const { setupExternalSystemCommands } = require('./setup-external-system');
 const { setupAppCommands: setupAppManagementCommands } = require('../commands/app');
 const { setupDatasourceCommands } = require('../commands/datasource');
 const { setupDimensionCommands } = require('../commands/dimension');
-const { setupDimensionValueCommands } = require('../commands/dimension-value');
+const { setupIdentityCommands } = require('../commands/identity');
+const { setupProtectionCommands } = require('../commands/protection');
 const { setupCredentialDeploymentCommands } = require('./setup-credential-deployment');
 const { setupIntegrationClientCommands } = require('./setup-integration-client');
 const { setupPlatformCommands } = require('./setup-platform');
@@ -39,7 +40,8 @@ function setupCommands(program) {
   setupAppManagementCommands(program);
   setupDatasourceCommands(program);
   setupDimensionCommands(program);
-  setupDimensionValueCommands(program);
+  setupIdentityCommands(program);
+  setupProtectionCommands(program);
   setupUtilityCommands(program);
   setupCredentialDeploymentCommands(program);
   setupIntegrationClientCommands(program);

package/lib/cli/infra-guided.js

@@ -320,6 +320,7 @@ async function runGuidedUpDataplane(options, handleUpDataplane) {
     handleUpDataplane({ ...options, platformInstall: true, skipInfraCheck: true })
   );
   stopSpinnerSuccess(dpSpin, 'Dataplane ready');
+  await refreshDataplaneVersionAfterPlatformInstall();
   await validateAppErrorLogs(['dataplane']);
   await logDataplaneReadyFooter();
 }
@@ -361,15 +362,32 @@ async function runGuidedAuthStep(handleLogin) {
   const spin = startSpinner('Authenticating...');
   try {
     const controllerUrl = await resolveControllerUrl();
-    await handleLogin({ method: 'device', controller: controllerUrl, environment: 'dev', compact: true });
+    await handleLogin({
+      method: 'device',
+      controller: controllerUrl,
+      environment: 'dev',
+      compact: true,
+      // Dataplane is not up yet during guided platform/dataplane install; refresh after it starts.
+      skipDataplaneVersionRefresh: true
+    });
   } catch (authErr) {
     if (spin) spin.fail('Authentication failed');
     logger.error(formatBlockingError('Authentication failed'));
     logger.log(chalk.gray('\nRun:\n  af login\n\nThen retry:\n  af up-platform\n'));
     throw authErr;
   }
-  // Compact device-login already prints a success line; don't duplicate it.
-  if (spin) spin.stop();
+  // Compact device-login prints "Authentication successful"; close the step spinner cleanly.
+  stopSpinnerSuccess(spin, 'Authenticated');
+}
+
+async function refreshDataplaneVersionAfterPlatformInstall() {
+  try {
+    const { tryRefreshDataplaneVersionAfterLogin } = require('../commands/auth-status-dataplane-version');
+    const controllerUrl = await resolveControllerUrl();
+    await tryRefreshDataplaneVersionAfterLogin(controllerUrl, {});
+  } catch {
+    // best-effort only
+  }
 }
 
 async function runGuidedKeycloakAndMisoControllerPhase(options, handleUpMiso) {
@@ -393,6 +411,7 @@ async function runGuidedDataplaneInstallPhase(options, handleUpDataplane) {
     handleUpDataplane({ ...options, platformInstall: true, skipInfraCheck: true })
   );
   stopSpinnerSuccess(dpSpin, 'Dataplane ready');
+  await refreshDataplaneVersionAfterPlatformInstall();
 }
 
 async function runGuidedUpPlatform(options, handleUpMiso, handleUpDataplane, handleLogin, forceCleanSummary = null) {

package/lib/cli/setup-app.help.js

@@ -56,12 +56,60 @@ Examples:
 Notes:
   - To run E2E for one datasource, use:
       aifabrix datasource test-e2e <datasourceKey>
-  - External integration: local system and datasource files are published to the dataplane before E2E (same as upload). Use --no-sync to exercise only config already deployed. The old --sync flag is a no-op (kept for scripts).
+  - External integration: local system and datasource files are published to the dataplane before E2E (same as upload). Use --no-sync to exercise only config already deployed.
+`;
+
+const IDENTITY_HELP_AFTER = `
+Examples:
+  # Bulk seed from demo users.csv (test-protection prefix) + sync + cache purge
+  $ aifabrix identity apply --file ./users.csv --filter-prefix test-protection -e dev --sync --purge-cache
+  $ aifabrix identity sync -e dev --purge-cache
+  $ aifabrix identity cache clear
+
+  # Single user / group
+  $ aifabrix identity user create --email alice@example.com --first-name Alice --last-name HR
+  $ aifabrix identity group create --name test-protection-sales-fi --description "Sales Finland"
+
+Notes:
+  - Requires aifabrix login (controller token). See docs/commands/identity-management.md.
+  - Prefer identity apply over SQL in tests/fixtures/protection/optional-dev-identity-dataplane.sql.
+`;
+
+const TEST_GOVERNANCE_HELP_AFTER = `
+Examples:
+  # External system — ABAC visibility acceptance (governance scenario pack)
+  $ aifabrix test-governance test-protection
+  $ aifabrix test-governance test-protection --pack scenarios/test-protection-v1.yaml
+  $ aifabrix test-governance test-protection -v --no-sync
+  $ aifabrix test-governance test-protection --scenario country-isolation-maria-fi --json
+
+Notes:
+  - Separate from test-e2e (vendor connectivity). Does not call external vendor APIs.
+  - Load baseline fixtures first (datasource load, protection upload) — not auto-run by this command.
+  - Default pack: integration/<systemKey>/scenarios/default.yaml or <systemKey>-v1.yaml
+  - Requires governance:evaluate on the operator token (see permissions.md).
+`;
+
+const TEST_TRUST_HELP_AFTER = `
+Examples:
+  # External system — semantic trust for every datasource (dataplane 404.5)
+  $ aifabrix test-trust hubspot
+  $ aifabrix test-trust hubspot -v --revalidate
+  $ aifabrix test-trust hubspot --no-sync
+  $ aifabrix test-trust hubspot --summary --timeout 120000
+
+Notes:
+  - For one datasource: aifabrix datasource test-trust <datasourceKey>
+  - Does not call external APIs (use test-e2e for live proof).
+  - Local integration files are published before run unless --no-sync.
 `;
 
 module.exports = {
   TEST_HELP_AFTER,
   TEST_INTEGRATION_HELP_AFTER,
-  TEST_E2E_HELP_AFTER
+  TEST_E2E_HELP_AFTER,
+  TEST_TRUST_HELP_AFTER,
+  TEST_GOVERNANCE_HELP_AFTER,
+  IDENTITY_HELP_AFTER
 };