@aifabrix/builder 2.45.0 → 2.46.0

package/lib/commands/auth-status.js

@@ -11,14 +11,30 @@
 const chalk = require('chalk');
 const { failureGlyph, successGlyph } = require('../utils/cli-test-layout-chalk');
 const logger = require('../utils/logger');
-const config = require('../core/config');
-const { getConfig } = config;
 const { getOrRefreshDeviceToken } = require('../utils/token-manager');
 const { getAuthUser } = require('../api/auth.api');
 const { resolveControllerUrl } = require('../utils/controller-url');
 const { findDataplaneServiceAppKey } = require('./wizard-dataplane');
 const { getDataplaneUrl } = require('../datasource/deploy');
 const { checkDataplaneHealth } = require('../utils/dataplane-health');
+const {
+  displayDataplaneVersionSection,
+  displayCliUpgradeRequired
+} = require('./auth-status-display');
+const {
+  refreshDataplaneVersionInfo,
+  loadCachedVersionInfo
+} = require('./auth-status-dataplane-version');
+const {
+  EXIT_NOT_AUTHENTICATED,
+  EXIT_CLI_VERSION_INCOMPATIBLE,
+  EXIT_OK
+} = require('../utils/cli-exit-codes');
+const {
+  refreshExpiredClientTokensWherePossible,
+  displayStoredClientTokensSection,
+  tryResolveClientTokenAuth
+} = require('./auth-status-client-tokens');
 
 /**
  * Format expiration date for display
@@ -81,22 +97,6 @@ async function checkDeviceToken(controllerUrl) {
   }
 }
 
-/**
- * Decrypt token if encrypted
- * @async
- * @param {string} token - Token to decrypt
- * @returns {Promise<string>} Decrypted token
- */
-async function decryptTokenIfNeeded(token) {
-  const { decryptToken, isTokenEncrypted } = require('../utils/token-encryption');
-  const encryptionKey = await config.getSecretsEncryptionKey();
-
-  if (encryptionKey && isTokenEncrypted(token)) {
-    return await decryptToken(token, encryptionKey);
-  }
-  return token;
-}
-
 /**
  * Validate client token and return result
  * @async
@@ -143,29 +143,14 @@ async function validateClientToken(token, controllerUrl, environment, appName, e
 }
 
 /**
- * Check and validate client token
+ * Check and validate client token (refreshes when expired if client credentials exist).
  * @async
  * @param {string} controllerUrl - Controller URL
  * @param {string} environment - Environment key
  * @returns {Promise<Object|null>} Token validation result or null
  */
 async function checkClientToken(controllerUrl, environment) {
-  const configData = await getConfig();
-  const environments = configData.environments || {};
-  const envConfig = environments[environment];
-
-  if (!envConfig || !envConfig.clients) {
-    return null;
-  }
-
-  for (const [appName, tokenData] of Object.entries(envConfig.clients)) {
-    if (tokenData.controller === controllerUrl && tokenData.token) {
-      const token = await decryptTokenIfNeeded(tokenData.token);
-      return await validateClientToken(token, controllerUrl, environment, appName, tokenData.expiresAt);
-    }
-  }
-
-  return null;
+  return tryResolveClientTokenAuth(controllerUrl, environment, validateClientToken);
 }
 
 /**
@@ -290,6 +275,10 @@ function displayOpenApiDocs(controllerUrl, dataplaneUrl) {
  * @param {Object} [dataplaneInfo] - Optional dataplane URL and health
  * @param {string|null} [dataplaneInfo.url] - Dataplane URL
  * @param {boolean} [dataplaneInfo.connected] - Whether dataplane is reachable
+ * @param {string|undefined} [dataplaneInfo.dataplaneVersion]
+ * @param {string|undefined} [dataplaneInfo.minBuilderCliVersion]
+ * @param {string} [dataplaneInfo.cliVersion]
+ * @param {boolean} [dataplaneInfo.compatible]
  */
 function displayStatus(controllerUrl, environment, tokenInfo, dataplaneInfo) {
   logger.log(chalk.bold('\n🔐 Authentication Status\n'));
@@ -308,45 +297,109 @@ function displayStatus(controllerUrl, environment, tokenInfo, dataplaneInfo) {
 
   if (tokenInfo.authenticated && dataplaneInfo) {
     displayDataplaneSection(dataplaneInfo.url, dataplaneInfo.connected);
+    displayDataplaneVersionSection({
+      connected: dataplaneInfo.connected,
+      dataplaneVersion: dataplaneInfo.dataplaneVersion,
+      minBuilderCliVersion: dataplaneInfo.minBuilderCliVersion,
+      cliVersion: dataplaneInfo.cliVersion,
+      compatible: dataplaneInfo.compatible
+    });
+    if (dataplaneInfo.minBuilderCliVersion && dataplaneInfo.compatible === false) {
+      displayCliUpgradeRequired({
+        required: dataplaneInfo.minBuilderCliVersion,
+        installed: dataplaneInfo.cliVersion
+      });
+    }
   }
 
   logger.log('');
 }
 
+/**
+ * Resolve the dataplane block for auth status (URL, reachability, versions,
+ * compatibility). Returns null when no dataplane is discovered.
+ *
+ * @async
+ * @function buildDataplaneInfo
+ * @param {string} controllerUrl
+ * @param {string} environment
+ * @param {Object} authConfig - Bearer auth config built from a valid token
+ * @returns {Promise<Object|null>}
+ */
+async function buildDataplaneInfo(controllerUrl, environment, authConfig) {
+  const dataplaneUrl = await resolveDataplaneUrlSilent(controllerUrl, environment, authConfig);
+  if (!dataplaneUrl) {
+    return { url: null, connected: false };
+  }
+  const connected = await checkDataplaneHealth(dataplaneUrl, 5000);
+  const versionInfo = connected
+    ? await refreshDataplaneVersionInfo(controllerUrl, dataplaneUrl)
+    : await loadCachedVersionInfo(controllerUrl);
+  return {
+    url: dataplaneUrl,
+    connected,
+    dataplaneVersion: versionInfo.dataplaneVersion,
+    minBuilderCliVersion: versionInfo.minBuilderCliVersion,
+    cliVersion: versionInfo.cliVersion,
+    compatible: versionInfo.compatible
+  };
+}
+
 /**
  * Handle auth status command
  * Controller and environment come from config.yaml (set via aifabrix login or aifabrix auth config).
  * @async
  * @function handleAuthStatus
  * @param {Object} options - Command options
- * @param {boolean} [options.validate] - If true, exit with code 1 when not authenticated
+ * @param {boolean} [options.validate] - If true, exit with code 1 when not authenticated, or code 3 when CLI is older than dataplane minimum
  * @returns {Promise<void>} Resolves when status is displayed
  */
+/**
+ * Prefer a working device token; fall back to environment client credentials when the
+ * stored device token is expired or rejected (common in long-lived dev VMs).
+ *
+ * @async
+ * @param {string} controllerUrl
+ * @param {string} environment
+ * @returns {Promise<Object|null>}
+ */
+async function resolveAuthenticatedTokenInfo(controllerUrl, environment) {
+  const deviceResult = await checkDeviceToken(controllerUrl);
+  if (deviceResult && deviceResult.authenticated) {
+    return deviceResult;
+  }
+  const clientResult = await checkClientToken(controllerUrl, environment);
+  if (clientResult && clientResult.authenticated) {
+    return clientResult;
+  }
+  return deviceResult || clientResult || null;
+}
+
 async function handleAuthStatus(options = {}) {
   const { resolveEnvironment } = require('../core/config');
   const controllerUrl = await resolveControllerUrl();
   const environment = await resolveEnvironment();
 
-  // Check device token first (preferred)
-  let tokenInfo = await checkDeviceToken(controllerUrl);
-
-  // If no device token, check client token
-  if (!tokenInfo) {
-    tokenInfo = await checkClientToken(controllerUrl, environment);
-  }
+  const refreshedCount = await refreshExpiredClientTokensWherePossible(environment, controllerUrl);
+  const tokenInfo = await resolveAuthenticatedTokenInfo(controllerUrl, environment);
 
   let dataplaneInfo = null;
   if (tokenInfo && tokenInfo.authenticated && tokenInfo.token) {
     const authConfig = { type: 'bearer', token: tokenInfo.token };
-    const dataplaneUrl = await resolveDataplaneUrlSilent(controllerUrl, environment, authConfig);
-    const connected = dataplaneUrl ? await checkDataplaneHealth(dataplaneUrl, 5000) : false;
-    dataplaneInfo = { url: dataplaneUrl, connected };
+    dataplaneInfo = await buildDataplaneInfo(controllerUrl, environment, authConfig);
   }
 
   displayStatus(controllerUrl, environment, tokenInfo, dataplaneInfo);
+  await displayStoredClientTokensSection(environment, controllerUrl, refreshedCount);
 
-  if (options.validate && (!tokenInfo || !tokenInfo.authenticated)) {
-    process.exit(1);
+  if (options.validate) {
+    if (!tokenInfo || !tokenInfo.authenticated) {
+      process.exit(EXIT_NOT_AUTHENTICATED);
+    }
+    if (dataplaneInfo && dataplaneInfo.minBuilderCliVersion && dataplaneInfo.compatible === false) {
+      process.exit(EXIT_CLI_VERSION_INCOMPATIBLE);
+    }
+    process.exit(EXIT_OK);
   }
 }
 
@@ -363,10 +416,7 @@ async function getValidatedAuthContext() {
   const controllerUrl = await resolveControllerUrl();
   const environment = await resolveEnvironment();
 
-  let tokenInfo = await checkDeviceToken(controllerUrl);
-  if (!tokenInfo) {
-    tokenInfo = await checkClientToken(controllerUrl, environment);
-  }
+  const tokenInfo = await resolveAuthenticatedTokenInfo(controllerUrl, environment);
 
   if (!tokenInfo || !tokenInfo.authenticated || !tokenInfo.token) {
     throw new Error('Not authenticated. Run "aifabrix login" or configure client credentials.');
@@ -378,4 +428,12 @@ async function getValidatedAuthContext() {
   return { controllerUrl, environment, authConfig, dataplaneUrl };
 }
 
-module.exports = { handleAuthStatus, getValidatedAuthContext };
+module.exports = {
+  handleAuthStatus,
+  getValidatedAuthContext,
+  resolveAuthenticatedTokenInfo,
+  checkDeviceToken,
+  checkClientToken,
+  refreshExpiredClientTokensWherePossible,
+  displayStoredClientTokensSection
+};

package/lib/commands/credential-push.js

@@ -16,6 +16,7 @@ const { getDeploymentAuth, requireBearerForDataplanePipeline } = require('../uti
 const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
 const { getIntegrationPath } = require('../utils/paths');
 const { pushCredentialSecrets } = require('../utils/credential-secrets-env');
+const { runWithCredentialPushSpinner } = require('../utils/credential-push-ui');
 const { generateControllerManifest } = require('../generator/external-controller-manifest');
 
 /**
@@ -84,11 +85,15 @@ async function runCredentialPush(systemKey) {
   const dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig);
 
   const payload = await buildPayload(systemKey);
-  const pushResult = await pushCredentialSecrets(dataplaneUrl, authConfig, {
-    envFilePath,
-    appName: systemKey,
-    payload
-  });
+  const pushResult = await runWithCredentialPushSpinner(
+    () =>
+      pushCredentialSecrets(dataplaneUrl, authConfig, {
+        envFilePath,
+        appName: systemKey,
+        payload
+      }),
+    { systemKey }
+  );
 
   logPushResult(pushResult);
   return { pushed: pushResult.pushed || 0 };

package/lib/commands/datasource-load-export-cli.js

@@ -0,0 +1,178 @@
+/**
+ * @fileoverview CLI for `datasource load` and `datasource export` (plan 144)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatBlockingError } = require('../utils/cli-test-layout-chalk');
+const { runDatasourceLoad } = require('../datasource/bulk-loader-service');
+const { runDatasourceExport } = require('../datasource/datasource-exporter-service');
+const { displayDatasourceLoadTTY } = require('../utils/datasource-load-display');
+const { displayDatasourceExportTTY } = require('../utils/datasource-export-display');
+
+function loadHelpAfter() {
+  return `
+Examples:
+  $ aifabrix datasource load hubspot-test-datasource-company
+  $ aifabrix datasource load hubspot-test-company --file ./fixtures/rows.ndjson -v
+  $ aifabrix datasource load hubspot-test-company --dry-run
+  $ af ds load hubspot-test-company --batch-size 50 --sync-type incremental
+
+Notes:
+  - Imports local JSON/NDJSON via dataplane bulk record sync (not direct DB).
+  - Default file: integration/.data/<systemKey>-data-<entity>.json or .ndjson
+  - External integration folders only (integration/<systemKey>/).
+`;
+}
+
+function exportHelpAfter() {
+  return `
+Examples:
+  $ aifabrix datasource export hubspot-test-datasource-company
+  $ aifabrix datasource export hubspot-test-company --format ndjson --limit 500
+  $ aifabrix datasource export hubspot-test-company --filter '{"status":{"eq":"active"}}' -v
+  $ af ds export hubspot-test-company --fields email,name --strict
+
+Notes:
+  - Exports governed records search results (ABAC applied), not a raw DB dump.
+  - Default output: integration/.data/<systemKey>-data-<entity>.json or .ndjson
+  - Maximum 10000 rows per run (dataplane search limit).
+`;
+}
+
+/**
+ * @param {Object} result
+ * @returns {number}
+ */
+function computeLoadExitCode(result) {
+  if (result.dryRun) {
+    return 0;
+  }
+  return (result.totals.failedCount || 0) > 0 ? 1 : 0;
+}
+
+/**
+ * @param {Object} result
+ * @param {Object} options
+ * @returns {number}
+ */
+function computeExportExitCode(result, options) {
+  if (options.strict === true && result.recordCount === 0) {
+    return 1;
+  }
+  return 0;
+}
+
+async function datasourceLoadAction(datasourceKey, options) {
+  try {
+    const result = await runDatasourceLoad(datasourceKey, {
+      app: options.app,
+      env: options.env,
+      file: options.file,
+      verbose: options.verbose,
+      dryRun: options.dryRun,
+      batchSize: options.batchSize,
+      syncType: options.syncType,
+      format: options.format
+    });
+
+    if (options.json) {
+      const { context: _ctx, ...payload } = result;
+      logger.log(JSON.stringify(payload, null, 2));
+    } else {
+      displayDatasourceLoadTTY(result, { environment: options.env, verbose: options.verbose });
+    }
+
+    process.exit(computeLoadExitCode(result));
+  } catch (err) {
+    logger.error(formatBlockingError(`Load failed: ${err.message}`));
+    const code = err.message && /auth|login|token|version|unreachable/i.test(err.message) ? 3 : 1;
+    process.exit(code);
+  }
+}
+
+async function datasourceExportAction(datasourceKey, options) {
+  try {
+    const result = await runDatasourceExport(datasourceKey, {
+      app: options.app,
+      env: options.env,
+      file: options.file,
+      verbose: options.verbose,
+      format: options.format,
+      filter: options.filter,
+      fields: options.fields,
+      limit: options.limit,
+      intent: options.intent,
+      strict: options.strict
+    });
+
+    if (options.json) {
+      const { context: _ctx, ...payload } = result;
+      logger.log(JSON.stringify(payload, null, 2));
+    } else {
+      displayDatasourceExportTTY(result, { environment: options.env, verbose: options.verbose });
+    }
+
+    process.exit(computeExportExitCode(result, options));
+  } catch (err) {
+    logger.error(formatBlockingError(`Export failed: ${err.message}`));
+    const code = err.message && /auth|login|token|version|unreachable/i.test(err.message) ? 3 : 1;
+    process.exit(code);
+  }
+}
+
+/**
+ * @param {import('commander').Command} datasource
+ */
+function setupDatasourceLoadExportCommands(datasource) {
+  datasource
+    .command('load <datasourceKey>')
+    .description('Import local JSON/NDJSON records via dataplane bulk sync')
+    .option('-a, --app <app>', 'Integration folder name')
+    .option('-e, --env <env>', 'Environment: dev, tst, or pro')
+    .option('--file <path>', 'Input file (default: integration/.data/...)')
+    .option('--format <json|ndjson>', 'File format when extension is ambiguous')
+    .option('--batch-size <n>', 'Records per bulk request', '100')
+    .option(
+      '--sync-type <incremental|bulk|validate>',
+      'Dataplane syncType',
+      'incremental'
+    )
+    .option('--dry-run', 'Parse and validate only; no upload')
+    .option('-v, --verbose', 'Per-batch progress')
+    .option('--json', 'Machine-readable result JSON')
+    .addHelpText('after', loadHelpAfter())
+    .action(datasourceLoadAction);
+
+  datasource
+    .command('export <datasourceKey>')
+    .description('Export governed records to local JSON/NDJSON via records search')
+    .option('-a, --app <app>', 'Integration folder name')
+    .option('-e, --env <env>', 'Environment: dev, tst, or pro')
+    .option('--file <path>', 'Output file (default: integration/.data/...)')
+    .option('--format <json|ndjson>', 'Output format')
+    .option('--filter <json>', 'Records search filters (JSON object)')
+    .option('--fields <csv>', 'Project metadata keys in export rows')
+    .option('--limit <n>', 'Max records (1–10000)', '1000')
+    .option(
+      '--intent <retrieval|grounding|analytics|validation>',
+      'Search intent',
+      'validation'
+    )
+    .option('--strict', 'Exit 1 when zero rows are exported')
+    .option('-v, --verbose', 'Search stats and file size')
+    .option('--json', 'Machine-readable result JSON')
+    .addHelpText('after', exportHelpAfter())
+    .action(datasourceExportAction);
+}
+
+module.exports = {
+  setupDatasourceLoadExportCommands,
+  datasourceLoadAction,
+  datasourceExportAction,
+  computeLoadExitCode,
+  computeExportExitCode
+};

package/lib/commands/datasource-test-trust-cli.js

@@ -0,0 +1,118 @@
+/**
+ * @fileoverview CLI wiring for `datasource verify-trust` (404.5 / plan 143).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatBlockingError } = require('../utils/cli-test-layout-chalk');
+const { runDatasourceAgentTrust } = require('../datasource/agent-trust-run');
+const { writeTrustDebugLogAndPrint } = require('../datasource/agent-trust-debug-log');
+const { displayAgentTrustRunTTY } = require('../utils/agent-trust-run-display');
+const { computeExitCodeFromTrustRun } = require('../utils/agent-trust-run-exit');
+const { attachDatasourceTestCommonOptions } = require('./datasource-unified-test-cli.options');
+const { cliOptsSkipSync } = require('../utils/cli-sync-options');
+
+function datasourceVerifyTrustHelpAfter() {
+  return `
+Examples:
+  $ aifabrix datasource verify-trust hubspot-companies
+  $ aifabrix datasource verify-trust hubspot-companies --app test-e2e-hubspot -v
+  $ aifabrix datasource verify-trust hubspot-companies --revalidate --strict
+  $ aifabrix verify-trust test-e2e-hubspot
+
+Notes:
+  - Semantic trust only (agent metadata validation). For live API proof use test-e2e.
+  - Local files are published before run unless --no-sync.
+  - With --debug, JSON is saved under integration/<app>/logs/ (verify-trust-<key>-*.json). View with: aifabrix datasource log-trust <key>
+`;
+}
+
+async function runDatasourceVerifyTrustOnce(datasourceKey, options) {
+  const { trustRun, apiError } = await runDatasourceAgentTrust(datasourceKey, {
+    app: options.app,
+    environment: options.env,
+    noSync: options.noSync === true,
+    force: options.force === true,
+    revalidate: options.revalidate === true,
+    summary: options.summary === true,
+    timeout: options.timeout
+  });
+  return { trustRun, apiError };
+}
+
+async function finalizeDatasourceVerifyTrust(datasourceKey, options, result) {
+  const displayOpts = {
+    json: options.json,
+    verbose: options.verbose,
+    environment: options.env,
+    noSync: options.noSync === true,
+    strict: options.strict === true
+  };
+  if (options.json) {
+    logger.log(JSON.stringify(result.trustRun, null, 2));
+  } else if (options.summary) {
+    const tr = result.trustRun;
+    logger.log(
+      `${tr.datasourceKey}: ${tr.trustDecision} (${tr.validationStatus}, ${Math.round((tr.confidence || 0) * 100)}%)`
+    );
+  } else {
+    displayAgentTrustRunTTY(result.trustRun, displayOpts);
+  }
+  const exitOpts = {
+    warningsAsErrors: options.warningsAsErrors === true,
+    strict: options.strict === true
+  };
+  return computeExitCodeFromTrustRun(result.trustRun, exitOpts);
+}
+
+async function datasourceVerifyTrustAction(datasourceKey, options, cmd) {
+  try {
+    const merged = { ...options, noSync: cliOptsSkipSync(options, cmd) };
+    const result = await runDatasourceVerifyTrustOnce(datasourceKey, merged);
+    const { resolveAppKeyForDatasource } = require('../datasource/resolve-app');
+    const { appKey } = await resolveAppKeyForDatasource(datasourceKey, options.app);
+    if (options.debug) {
+      await writeTrustDebugLogAndPrint(appKey, datasourceKey, {
+        request: { datasourceKey, revalidate: options.revalidate === true },
+        response: result.trustRun,
+        error: result.apiError ? result.apiError.message : null
+      });
+    }
+    const exitCode = await finalizeDatasourceVerifyTrust(datasourceKey, merged, result);
+    process.exit(exitCode);
+  } catch (err) {
+    logger.error(formatBlockingError('Agent trust validation failed:'), err.message);
+    process.exit(3);
+  }
+}
+
+function attachDatasourceTrustOptions(cmd) {
+  attachDatasourceTestCommonOptions(cmd, {
+    includeNoAsync: false,
+    includePayload: false,
+    timeoutHelp: 'HTTP timeout for validate request (ms)',
+    timeoutDefault: '120000'
+  });
+  cmd
+    .option('--no-sync', 'Skip publishing local integration files before validate')
+    .option('--revalidate', 'Force new validation (ignore inputHash cache)')
+    .option('--strict', 'Exit 1 unless trustDecision is trusted');
+}
+
+function setupDatasourceVerifyTrustCommand(datasource) {
+  const cmd = datasource
+    .command('verify-trust <datasourceKey>')
+    .description('Semantic agent metadata validation for one datasource');
+  attachDatasourceTrustOptions(cmd);
+  cmd.addHelpText('after', datasourceVerifyTrustHelpAfter()).action(datasourceVerifyTrustAction);
+}
+
+module.exports = {
+  setupDatasourceVerifyTrustCommand,
+  runDatasourceVerifyTrustOnce,
+  finalizeDatasourceVerifyTrust,
+  datasourceVerifyTrustAction
+};

package/lib/commands/datasource-unified-test-cli.js

@@ -28,6 +28,7 @@ const {
   finalizeDatasourceTestE2ELegacyPath,
   displayDatasourceTestE2EEnvelopeResults
 } = require('./datasource-unified-test-e2e-cli-helpers');
+const { maybeVerifyAuditAfterE2E } = require('../datasource/audit-evidence-run');
 const {
   datasourceTestHelpAfter,
   datasourceTestIntegrationHelpAfter,
@@ -76,7 +77,8 @@ function buildDatasourceTestRunOpts(options) {
     timeout: options.timeout,
     async: options.async !== false,
     noAsync: options.async === false,
-    sync: options.sync === true
+    sync: options.sync === true,
+    force: options.force === true
   };
 }
 
@@ -173,7 +175,8 @@ function buildIntegrationTestOpts(options) {
     debug: options.debug,
     verbose: options.verbose,
     timeout: options.timeout,
-    sync: options.sync === true
+    sync: options.sync === true,
+    force: options.force === true
   };
 }
 
@@ -333,8 +336,9 @@ async function runDatasourceTestE2ECliOnce(datasourceKey, options) {
     minProcessed: options.minProcessed,
     minRecordCount: options.minRecordCount,
     timeout: options.timeout,
-    capabilityKey: options.capability,
-    sync: options.sync === true
+    capabilityKey: options.capabilityKey,
+    sync: options.sync === true,
+    force: options.force === true
   });
   const unifiedModes =
     options.json || options.summary || options.warningsAsErrors || options.requireCert;
@@ -352,7 +356,7 @@ async function runDatasourceTestE2ECliOnce(datasourceKey, options) {
         warningsAsErrors: options.warningsAsErrors,
         requireCert: options.requireCert,
         debug: options.debug,
-        requestedCapabilityKey: options.capability,
+        requestedCapabilityKey: options.capabilityKey,
         strictCapabilityScope: options.strictCapabilityScope === true
       }
     );
@@ -370,24 +374,24 @@ async function runDatasourceTestE2ECliOnce(datasourceKey, options) {
 
 async function runDatasourceTestE2ECliAction(datasourceKey, options) {
   const { exitCode, envelope } = await runDatasourceTestE2ECliOnce(datasourceKey, options);
-  await afterUnifiedValidationCertSync(exitCode, datasourceKey, options, 'datasource test-e2e', envelope);
-  process.exit(exitCode);
+  const finalExit = await maybeVerifyAuditAfterE2E(exitCode, datasourceKey, envelope, options);
+  await afterUnifiedValidationCertSync(
+    finalExit,
+    datasourceKey,
+    options,
+    'datasource test-e2e',
+    envelope
+  );
+  process.exit(finalExit);
 }
 
 async function e2eTestCommandAction(datasourceKey, capabilityKey, options) {
   const optObj = options && typeof options === 'object' ? options : {};
   const capFromArg = typeof capabilityKey === 'string' ? capabilityKey.trim() : '';
-  const capFromFlag = optObj.capability !== undefined && optObj.capability !== null
-    ? String(optObj.capability).trim()
-    : '';
-  const requestedCapability = capFromArg || capFromFlag;
-  if (capFromArg && capFromFlag && capFromArg !== capFromFlag) {
-    logger.warn(
-      chalk.yellow('⚠ Capability mismatch:'),
-      `using positional '${capFromArg}' instead of --capability '${capFromFlag}'.`
-    );
-  }
-  const mergedOptions = { ...optObj, capability: requestedCapability || undefined };
+  const mergedOptions = {
+    ...optObj,
+    capabilityKey: capFromArg || undefined
+  };
   try {
     if (mergedOptions.watch) {
       const { appKey } = await resolveAppKeyForDatasource(datasourceKey, mergedOptions.app);
@@ -400,14 +404,20 @@ async function e2eTestCommandAction(datasourceKey, capabilityKey, options) {
         runOnce: async() => {
           try {
             const r = await runDatasourceTestE2ECliOnce(datasourceKey, mergedOptions);
-            await afterUnifiedValidationCertSync(
+            const finalExit = await maybeVerifyAuditAfterE2E(
               r.exitCode,
               datasourceKey,
+              r.envelope,
+              mergedOptions
+            );
+            await afterUnifiedValidationCertSync(
+              finalExit,
+              datasourceKey,
               mergedOptions,
               'datasource test-e2e (watch)',
               r.envelope
             );
-            return r;
+            return { exitCode: finalExit, envelope: r.envelope };
           } catch (err) {
             logger.error(formatBlockingError('E2E test failed:'), err.message);
             return { exitCode: 3, envelope: null };
@@ -459,5 +469,6 @@ module.exports = {
   runIntegrationOnceForWatch,
   integrationTestCommandAction,
   runDatasourceTestE2ECliOnce,
+  maybeVerifyAuditAfterE2E,
   e2eTestCommandAction
 };