@aifabrix/builder 2.45.5 → 2.46.0

package/lib/commands/setup.js

@@ -2,8 +2,8 @@
  * Top-level handler for `aifabrix setup`.
  *
  * Decides between:
- *   - fresh install (no infra running) — wizard for admin creds + AI tool, then up-infra + up-platform.
- *   - mode menu (infra already running) — dispatch one of four destructive/refresh paths.
+ *   - fresh install (no infra running) — wipe volumes, wizard for admin creds + AI tool, then up-infra + up-platform.
+ *   - mode menu (infra already running) — dispatch one of three destructive/refresh paths.
  *
  * The mode handlers live in `setup-modes.js`; the prompts live in
  * `setup-prompts.js`. This module is a thin orchestrator so it stays well
@@ -28,8 +28,12 @@ const {
 } = require('../utils/cli-test-layout-chalk');
 
 const setupPrompts = require('./setup-prompts');
+const setupPlatformModePrompts = require('./setup-prompts-platform-mode');
+const { flagsForSetupPlatformMode } = require('../core/setup-platform-mode');
 const setupModes = require('./setup-modes');
+const { syncPlatformControllerUrlsInConfig } = require('./setup-platform-auth');
 const installationLog = require('../utils/installation-log');
+const { beginSetupCommandFlow, endSetupCommandFlow } = require('./setup-run-context');
 
 const MODE = setupPrompts.MODE;
 
@@ -54,10 +58,24 @@ async function maybePinDeveloperIdForFreshInstall(rawDeveloper) {
   logger.log(infoLine(`Developer ID pinned to ${dev}.`));
 }
 
+async function applySetupPlatformMode(options) {
+  const mode = await setupPlatformModePrompts.promptSetupPlatformMode(options);
+  await config.setSetupPlatformMode(mode);
+  const derived = flagsForSetupPlatformMode(mode);
+  // These are the user gates that control full-mode behavior.
+  const cfg = await config.getConfig();
+  cfg.traefik = derived.traefik;
+  cfg.useEnvironmentScopedResources = derived.useEnvironmentScopedResources;
+  await config.saveConfig(cfg);
+  await syncPlatformControllerUrlsInConfig();
+  return mode;
+}
+
 async function runFreshInstallFlow(options) {
   await maybePinDeveloperIdForFreshInstall(options.developer);
   logger.log(infoLine('No infrastructure detected; starting fresh install.'));
-  const adminCreds = await setupPrompts.promptAdminCredentials();
+  await applySetupPlatformMode(options);
+  const adminCreds = await setupPrompts.promptAdminCredentials(options);
   await config.setAdminEmail(adminCreds.adminEmail);
   await setupModes.runFreshInstall(adminCreds);
   logger.log(formatSuccessParagraph('aifabrix setup complete (fresh install).'));
@@ -74,6 +92,10 @@ async function runExistingInfraFlow(assumeYes) {
     logger.log(chalk.yellow('Aborted by user.'));
     return { aborted: true, mode };
   }
+  // Re-install / wipe-data can change platform topology; re-prompt so the next up-platform matches intent.
+  if (mode === MODE.REINSTALL || mode === MODE.WIPE_DATA) {
+    await applySetupPlatformMode({});
+  }
   await dispatchMode(mode);
   logger.log(formatSuccessParagraph(`aifabrix setup complete (mode: ${mode}).`));
   return { aborted: false, mode };
@@ -114,8 +136,6 @@ async function dispatchMode(mode) {
     return setupModes.runReinstall();
   case MODE.WIPE_DATA:
     return setupModes.runWipeData();
-  case MODE.CLEAN_FILES:
-    return setupModes.runCleanInstallFiles();
   case MODE.UPDATE_IMAGES:
     return setupModes.runUpdateImages();
   default:
@@ -224,6 +244,7 @@ async function handleSetup(options = {}) {
   let setupMode = null;
   let err = null;
 
+  beginSetupCommandFlow();
   try {
     const main = await runSetupMainPath(options, assumeYes);
     outcome = main.outcome;
@@ -232,6 +253,7 @@ async function handleSetup(options = {}) {
     outcome = 'failure';
     err = e;
   } finally {
+    endSetupCommandFlow();
     await appendSetupInstallationRecord({
       outcome,
       startedAt,

package/lib/commands/teardown.js

@@ -118,6 +118,37 @@ function cleanAifabrixSystemDir() {
   return { removed, failed };
 }
 
+/**
+ * Remove materialized `builder/` trees (aifabrix-work, aifabrix-home / config dir, cwd).
+ * Complements {@link cleanAifabrixSystemDir} when `builder/` lives under `aifabrix-work` outside
+ * the config directory.
+ *
+ * @returns {{ removed: string[], failed: string[] }}
+ */
+function cleanMaterializedBuilderTrees() {
+  const candidates = [
+    pathsUtil.getBuilderRoot(),
+    path.join(pathsUtil.getAifabrixSystemDir(), 'builder'),
+    path.join(process.cwd(), 'builder')
+  ];
+  const seen = new Set();
+  const removed = [];
+  const failed = [];
+  for (const candidate of candidates) {
+    const resolved = path.resolve(candidate);
+    if (seen.has(resolved)) continue;
+    seen.add(resolved);
+    if (!fs.existsSync(resolved)) continue;
+    try {
+      fs.rmSync(resolved, { recursive: true, force: true });
+      removed.push(resolved);
+    } catch {
+      failed.push(resolved);
+    }
+  }
+  return { removed, failed };
+}
+
 /**
  * Stop infra with `down-infra -v` semantics. Tolerates already-down state.
  * @async
@@ -259,6 +290,13 @@ async function handleTeardown(options = {}) {
   try {
     await stopInfraQuietly();
     const { removed, failed } = cleanFilesWithSpinner();
+    const builderClean = cleanMaterializedBuilderTrees();
+    for (const p of builderClean.removed) {
+      removed.push(p);
+    }
+    for (const p of builderClean.failed) {
+      failed.push(p);
+    }
     const devStr = await buildDeveloperLabel();
     logTeardownFooter({ devStr, removedCount: removed.length, failedCount: failed.length });
 
@@ -271,6 +309,7 @@ async function handleTeardown(options = {}) {
 module.exports = {
   handleTeardown,
   cleanAifabrixSystemDir,
+  cleanMaterializedBuilderTrees,
   stopInfraQuietly,
   PRESERVE_FILE,
   PRESERVE_CERTS_DIR

package/lib/commands/test-e2e-external.js

@@ -19,6 +19,7 @@ const { loadConfigFile } = require('../utils/config-format');
 const { discoverIntegrationFiles, buildEffectiveDatasourceFiles } = require('./repair-internal');
 const { runDatasourceTestE2E } = require('../datasource/test-e2e');
 const { cliOptsSkipSync } = require('../utils/cli-sync-options');
+const { buildMinimalUploadSyncOptions, isQuietMinimalSync } = require('../utils/upload-sync-options');
 const { getConfig } = require('../core/config');
 const { setupIntegrationTestAuth } = require('../external-system/test-auth');
 
@@ -96,13 +97,12 @@ function getDatasourceKeys(appPath, configPath, variables, systemKey, systemPars
  */
 async function syncLocalIfRequested(systemKey, options) {
   if (cliOptsSkipSync(options)) return null;
-  logger.log(chalk.cyan('Syncing local config to dataplane…'));
   const { uploadExternalSystem } = require('./upload');
-  const uploadCtx = await uploadExternalSystem(systemKey, {
-    verbose: !!options.verbose,
-    minimal: true
-  });
-  logger.log(formatSuccessLine('Sync complete'));
+  const uploadOpts = buildMinimalUploadSyncOptions(options);
+  const uploadCtx = await uploadExternalSystem(systemKey, uploadOpts);
+  if (uploadCtx?.uploadSkipped !== true && !isQuietMinimalSync(uploadOpts)) {
+    logger.log(formatSuccessLine('Sync complete'));
+  }
   return uploadCtx && uploadCtx.dataplaneUrl && uploadCtx.authConfig ? uploadCtx : null;
 }
 
@@ -176,11 +176,18 @@ async function runTestE2EForExternalSystem(externalSystem, options = {}) {
   let dataplaneUrl;
   if (uploadCtx) {
     ({ authConfig, dataplaneUrl } = uploadCtx);
+  } else if (options.authConfig && options.dataplaneUrl) {
+    ({ authConfig, dataplaneUrl } = options);
   } else {
     const configObj = await getConfig();
     ({ authConfig, dataplaneUrl } = await setupIntegrationTestAuth(
       externalSystem,
-      { environment: options.env },
+      {
+        environment: options.env,
+        authConfig: options.authConfig,
+        dataplaneUrl: options.dataplaneUrl,
+        silentResolve: options.silentResolve === true
+      },
       configObj
     ));
   }
@@ -193,9 +200,18 @@ async function runTestE2EForExternalSystem(externalSystem, options = {}) {
     verbose: options.verbose,
     async: options.async !== false,
     authConfig,
-    dataplaneUrl
+    dataplaneUrl,
+    quietPollUi: options.quietPollUi === true,
+    onPollProgress: options.onPollProgress
   };
   for (const key of keys) {
+    if (typeof options.onDatasourceProgress === 'function') {
+      options.onDatasourceProgress({
+        key,
+        index: results.length,
+        total: keys.length
+      });
+    }
     try {
       const data = await runDatasourceTestE2E(key, opts);
       const steps = data.steps || data.completedActions || [];

package/lib/commands/test-governance-external.js

@@ -6,9 +6,6 @@
 
 'use strict';
 
-const chalk = require('chalk');
-const logger = require('../utils/logger');
-const { cliOptsSkipSync } = require('../utils/cli-sync-options');
 const { getConfig } = require('../core/config');
 const { setupIntegrationTestAuth } = require('../external-system/test-auth');
 const { runGovernanceScenarios } = require('../api/governance-scenarios.api');
@@ -16,25 +13,7 @@ const {
   resolveGovernancePackPath,
   loadGovernancePackYaml
 } = require('../governance/governance-pack-loader');
-
-/**
- * @param {string} systemKey
- * @param {Object} options
- * @returns {Promise<{ authConfig: Object, dataplaneUrl: string }|null>}
- */
-async function syncLocalIfRequested(systemKey, options) {
-  if (cliOptsSkipSync(options)) {
-    return null;
-  }
-  const { uploadExternalSystem } = require('./upload');
-  logger.log(chalk.cyan('Syncing local config to dataplane…'));
-  const uploadCtx = await uploadExternalSystem(systemKey, {
-    minimal: true,
-    verbose: !!options.verbose
-  });
-  logger.log(chalk.green('✔ Sync complete'));
-  return uploadCtx && uploadCtx.dataplaneUrl && uploadCtx.authConfig ? uploadCtx : null;
-}
+const { syncLocalIfRequested } = require('./test-e2e-external');
 
 /**
  * @async
@@ -47,7 +26,7 @@ async function runTestGovernanceForExternalSystem(externalSystem, options = {})
   const appType = await pathsUtil.detectAppType(externalSystem).catch(() => null);
   if (!appType || appType.baseDir !== 'integration') {
     throw new Error(
-      'test-governance applies to external integration folders only (integration/<systemKey>/).'
+      'verify-governance applies to external integration folders only (integration/<systemKey>/).'
     );
   }
 
@@ -79,7 +58,7 @@ async function runTestGovernanceForExternalSystem(externalSystem, options = {})
     scenarios: options.scenarioIds
   };
   const result = await runGovernanceScenarios(dataplaneUrl, authConfig, body);
-  return { result, packPath, systemKey };
+  return { result, packPath, systemKey, packDocument: pack };
 }
 
 module.exports = {

package/lib/commands/test-trust-external.js

@@ -1,5 +1,5 @@
 /**
- * @fileoverview test-trust <systemKey> — semantic agent metadata validation for all datasources.
+ * @fileoverview verify-trust <systemKey> — semantic agent metadata validation for all datasources.
  * @author AI Fabrix Team
  * @version 1.0.0
  */
@@ -8,28 +8,13 @@
 
 const chalk = require('chalk');
 const logger = require('../utils/logger');
-const { cliOptsSkipSync } = require('../utils/cli-sync-options');
 const { getConfig } = require('../core/config');
 const { setupIntegrationTestAuth } = require('../external-system/test-auth');
 const { runDatasourceAgentTrust } = require('../datasource/agent-trust-run');
-const { resolveExternalIntegrationContext } = require('./test-e2e-external');
-
-/**
- * @param {string} systemKey
- * @param {Object} options
- * @returns {Promise<{ authConfig: Object, dataplaneUrl: string }|null>}
- */
-async function syncLocalIfRequested(systemKey, options) {
-  if (cliOptsSkipSync(options)) return null;
-  const { uploadExternalSystem } = require('./upload');
-  logger.log(chalk.cyan('Syncing local config to dataplane…'));
-  const uploadCtx = await uploadExternalSystem(systemKey, {
-    minimal: true,
-    verbose: !!options.verbose
-  });
-  logger.log(chalk.green('✔ Sync complete'));
-  return uploadCtx && uploadCtx.dataplaneUrl && uploadCtx.authConfig ? uploadCtx : null;
-}
+const {
+  resolveExternalIntegrationContext,
+  syncLocalIfRequested
+} = require('./test-e2e-external');
 
 function pushTrustResult(results, key, trustRun, apiError) {
   const failed =
@@ -61,7 +46,16 @@ async function resolveTrustAuthContext(uploadCtx, externalSystem, options) {
     return { authConfig: uploadCtx.authConfig, dataplaneUrl: uploadCtx.dataplaneUrl };
   }
   const configObj = await getConfig();
-  return setupIntegrationTestAuth(externalSystem, { environment: options.env }, configObj);
+  return setupIntegrationTestAuth(
+    externalSystem,
+    {
+      environment: options.env,
+      authConfig: options.authConfig,
+      dataplaneUrl: options.dataplaneUrl,
+      silentResolve: options.silentResolve === true
+    },
+    configObj
+  );
 }
 
 /**
@@ -95,6 +89,11 @@ async function runTestTrustForExternalSystem(externalSystem, options = {}) {
   }
 
   const uploadCtx = await syncLocalIfRequested(systemKey, options);
+  if (uploadCtx?.authConfig && uploadCtx?.dataplaneUrl) {
+    options.authConfig = uploadCtx.authConfig;
+    options.dataplaneUrl = uploadCtx.dataplaneUrl;
+    options.silentResolve = true;
+  }
   if (options.revalidate === true) {
     logger.log(chalk.cyan('Forcing revalidation (cache bypass) for each datasource…'));
   }

package/lib/commands/up-common.js

@@ -14,7 +14,7 @@ const fs = require('fs');
 const chalk = require('chalk');
 const logger = require('../utils/logger');
 const config = require('../core/config');
-const { getDefaultControllerUrl } = require('../utils/controller-url');
+const { resolvePlatformControllerUrl } = require('../utils/platform-controller-url');
 const pathsUtil = require('../utils/paths');
 const { loadConfigFile, writeConfigFile } = require('../utils/config-format');
 const { isYamlPath } = require('../utils/config-format');
@@ -189,19 +189,29 @@ function patchEnvOutputPathForDeployOnly(appName) {
 
 /**
  * For ``up-platform --force`` only: clear all stored auth tokens, set ``environment`` to ``dev``,
- * set ``controller`` to the default URL for the current ``developer-id`` (``http://localhost`` +
- * app port = 3000 + developerId × 100), and persist config. Does not change ``developer-id``.
+ * set ``controller`` and ``platform-controller`` to the default URL (or ``defaultControllerUrl`` when
+ * provided), and persist config. Does not change ``developer-id``. Pass ``clearTokens: false`` to
+ * keep device/client tokens (setup when already logged in to the platform controller).
  * Builder dirs (keycloak, miso-controller, dataplane) are cleaned separately.
  *
  * @returns {Promise<void>}
  */
 async function applyUpPlatformForceConfig(opts = {}) {
   const silent = Boolean(opts.silent);
-  const deviceCleared = await config.clearAllDeviceTokens();
-  const clientCleared = await config.clearAllClientTokens();
+  const clearTokens = opts.clearTokens !== false;
+  let deviceCleared = 0;
+  let clientCleared = 0;
+  if (clearTokens) {
+    deviceCleared = await config.clearAllDeviceTokens();
+    clientCleared = await config.clearAllClientTokens();
+  }
   await config.setCurrentEnvironment('dev');
-  const defaultControllerUrl = await getDefaultControllerUrl();
+  const defaultControllerUrl =
+    opts.defaultControllerUrl && typeof opts.defaultControllerUrl === 'string'
+      ? String(opts.defaultControllerUrl).replace(/\/+$/, '')
+      : await resolvePlatformControllerUrl();
   await config.setControllerUrl(defaultControllerUrl);
+  await config.setPlatformControllerUrl(defaultControllerUrl);
 
   const summary = { deviceCleared, clientCleared, defaultControllerUrl, environment: 'dev' };
   if (!silent) {
@@ -287,14 +297,15 @@ async function cleanBuilderAppDirs(appNames, opts = {}) {
  * @example
  * await ensureAppFromTemplate('keycloak');
  */
-async function ensureAppFromTemplate(appName) {
+async function ensureAppFromTemplate(appName, opts = {}) {
   if (!appName || typeof appName !== 'string') {
     throw new Error('Application name is required and must be a string');
   }
+  const silent = Boolean(opts.silent);
 
   const appPath = pathsUtil.getBuilderPath(appName);
   const primaryCopied = await ensureTemplateAtPath(appName, appPath);
-  if (primaryCopied) {
+  if (primaryCopied && !silent) {
     logger.log(chalk.blue(`Creating builder/${appName} from template...`));
     logger.log(formatSuccessLine(`Copied template for ${appName}`));
   }
@@ -307,7 +318,7 @@ async function ensureAppFromTemplate(appName) {
     !pathsUtil.isSystemBuilderAppName(appName)
   ) {
     const cwdCopied = await ensureTemplateAtPath(appName, cwdBuilderPath);
-    if (cwdCopied) {
+    if (cwdCopied && !silent) {
       logger.log(chalk.blue(`Creating builder/${appName} in project (from template)...`));
       logger.log(formatSuccessLine(`Copied template for ${appName} into builder/`));
     }
@@ -339,10 +350,11 @@ function refreshUrlsLocalRegistryForCurrentProject() {
  *
  * @returns {Promise<void>}
  */
-async function prepareUrlsLocalRegistryForUpPlatform() {
-  await ensureAppFromTemplate('keycloak');
-  await ensureAppFromTemplate('miso-controller');
-  await ensureAppFromTemplate('dataplane');
+async function prepareUrlsLocalRegistryForUpPlatform(opts = {}) {
+  const templateOpts = { silent: Boolean(opts.silent) };
+  await ensureAppFromTemplate('keycloak', templateOpts);
+  await ensureAppFromTemplate('miso-controller', templateOpts);
+  await ensureAppFromTemplate('dataplane', templateOpts);
   refreshUrlsLocalRegistryForCurrentProject();
 }
 

package/lib/commands/up-dataplane.js

@@ -103,6 +103,22 @@ async function resolveControllerUrlWithHealthCheck() {
   return normalizedNew;
 }
 
+async function resolveUpDataplaneAuthContext(options, environmentKey) {
+  if (options.skipInfraCheck !== true) {
+    await assertDevInfraUp();
+  }
+
+  const controllerUrl = await resolveControllerUrlWithHealthCheck();
+  const authConfig = await checkAuthentication(controllerUrl, environmentKey, { throwOnFailure: true });
+
+  const cfg = await config.getConfig();
+  if (options.allowNonDev !== true) {
+    assertDevEnvironmentForDataplane(cfg);
+  }
+  logger.log(formatSuccessLine(`Logged in (environment: ${environmentKey})`));
+  return { controllerUrl, authConfig };
+}
+
 /**
  * Register or rotate dataplane: if app exists in controller, rotate secret; otherwise register.
  * @async
@@ -118,7 +134,12 @@ async function registerOrRotateDataplane(options, controllerUrl, environmentKey,
     await rotateSecret('dataplane', options);
   } else {
     const imageOverride = options.image || buildDataplaneImageRef(options);
-    const registerOpts = { imageOverride, image: imageOverride, registryMode: options.registryMode };
+    const registerOpts = {
+      imageOverride,
+      image: imageOverride,
+      registryMode: options.registryMode,
+      envKey: environmentKey
+    };
     await registerApplication('dataplane', registerOpts);
   }
 }
@@ -134,6 +155,7 @@ async function deployDataplaneToController(options) {
     imageOverride,
     image: imageOverride,
     registryMode: options.registryMode,
+    envKey: options.envKey ? String(options.envKey).trim().toLowerCase() : undefined,
     // Guided up-platform already shows a top-level spinner for the dataplane step.
     // Avoid nested deploy polling spinners/logs.
     silentPoll: options.platformInstall === true
@@ -172,6 +194,14 @@ function emitDataplaneManifestLineFromBuilder() {
   emitSystemBuilderAppManifestLineIfTTY(logger, 'dataplane');
 }
 
+function computeDataplanePortOverride(runEnvKey, developerIdNum) {
+  if (runEnvKey !== 'dev' && runEnvKey !== 'tst') {
+    return undefined;
+  }
+  const baseHostPort = 3001 + (Number.isFinite(developerIdNum) ? developerIdNum : 0) * 100;
+  return runEnvKey === 'dev' ? baseHostPort + 10 : baseHostPort + 20;
+}
+
 function assertDevEnvironmentForDataplane(cfg) {
   const environment = (cfg && cfg.environment) ? cfg.environment : 'dev';
   if (environment !== 'dev') {
@@ -181,6 +211,14 @@ function assertDevEnvironmentForDataplane(cfg) {
   }
 }
 
+async function computeDataplaneRunOverrides(options) {
+  const runEnvKey = options.runEnvKey ? String(options.runEnvKey).trim().toLowerCase() : undefined;
+  const developerIdRaw = await config.getDeveloperId();
+  const developerIdNum = typeof developerIdRaw === 'string' ? parseInt(developerIdRaw, 10) : developerIdRaw;
+  const portOverride = computeDataplanePortOverride(runEnvKey, developerIdNum);
+  return { runEnvKey, portOverride };
+}
+
 /**
  * Handle up-dataplane command: ensure logged in, environment dev, ensure dataplane,
  * register or rotate (if already registered), deploy (send manifest to controller),
@@ -199,17 +237,11 @@ function assertDevEnvironmentForDataplane(cfg) {
 async function handleUpDataplane(options = {}) {
   logger.log(chalk.blue('Starting up-dataplane (register/rotate, deploy, then run dataplane locally)...\n'));
 
-  if (options.skipInfraCheck !== true) {
-    await assertDevInfraUp();
-  }
-
-  const controllerUrl = await resolveControllerUrlWithHealthCheck();
-  const environmentKey = await resolveEnvironment();
-  const authConfig = await checkAuthentication(controllerUrl, environmentKey, { throwOnFailure: true });
-
-  const cfg = await config.getConfig();
-  assertDevEnvironmentForDataplane(cfg);
-  logger.log(formatSuccessLine('Logged in and environment is dev'));
+  const environmentKey =
+    options && options.envKey
+      ? String(options.envKey).trim().toLowerCase()
+      : await resolveEnvironment();
+  const { controllerUrl, authConfig } = await resolveUpDataplaneAuthContext(options, environmentKey);
 
   await ensureAppFromTemplate('dataplane');
   // If envOutputPath target folder does not exist, set envOutputPath to null
@@ -223,10 +255,15 @@ async function handleUpDataplane(options = {}) {
 
   await registerOrRotateDataplane(options, controllerUrl, environmentKey, authConfig);
 
-  await deployDataplaneToController(options);
+  await deployDataplaneToController({ ...options, envKey: environmentKey });
   logger.log('');
+
+  const { runEnvKey, portOverride } = await computeDataplaneRunOverrides(options);
+
   await app.runApp('dataplane', {
     skipEnvOutputPath: true,
+    env: runEnvKey,
+    port: portOverride,
     registry: options.registry || undefined,
     base: options.base !== false,
     skipManifestMetadataLine: true

package/lib/commands/upload-publish-context.js

@@ -0,0 +1,75 @@
+/**
+ * @fileoverview Upload publish preflight: auth resolve, CLI gate, target logging.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { sectionTitle, headerKeyValue } = require('../utils/cli-test-layout-chalk');
+const { resolveControllerUrl } = require('../utils/controller-url');
+const { requireBearerForDataplanePipeline } = require('../utils/token-manager');
+const { logDataplanePipelineWarning } = require('../utils/dataplane-pipeline-warning');
+const { assertDataplaneCliVersionCompatible } = require('../utils/dataplane-cli-version-gate');
+
+const SEP = chalk.gray('────────────────────────────────────────');
+
+function logForcePublishWarning() {
+  logger.log(
+    chalk.yellow(
+      'Warning: --force bypasses active-datasource schema replacement guards on publish. '
+        + 'Existing records and ABAC may be inconsistent; run validation/sync after upload.'
+    )
+  );
+}
+
+function logUploadTargetSection(environment, dataplaneUrl) {
+  logger.log('');
+  logger.log(sectionTitle('Target'));
+  logger.log(SEP);
+  logger.log(headerKeyValue('Environment:', environment));
+  logger.log(headerKeyValue('Dataplane:', dataplaneUrl));
+  logDataplanePipelineWarning();
+}
+
+/**
+ * Resolve dataplane auth and run upload preflight checks.
+ * @param {Function} resolveDataplaneAndAuth
+ * @param {Function} maybeRunVerboseServerValidation
+ * @param {string} systemKey
+ * @param {Object} options
+ * @param {Object} payload
+ * @returns {Promise<{ dataplaneUrl: string, authConfig: Object, environment: string }>}
+ */
+async function resolveUploadPublishContext(
+  resolveDataplaneAndAuth,
+  maybeRunVerboseServerValidation,
+  systemKey,
+  options,
+  payload
+) {
+  const resolved = await resolveDataplaneAndAuth(systemKey, {
+    silent: options.silentResolve === true
+  });
+  requireBearerForDataplanePipeline(resolved.authConfig);
+  if (options.force === true) {
+    logForcePublishWarning();
+  }
+  const controllerUrl = await resolveControllerUrl();
+  await assertDataplaneCliVersionCompatible(resolved.dataplaneUrl, { controllerUrl });
+  if (options.minimal !== true) {
+    logUploadTargetSection(resolved.environment, resolved.dataplaneUrl);
+  }
+  if (options.verbose) {
+    await maybeRunVerboseServerValidation(resolved.dataplaneUrl, resolved.authConfig, payload);
+  }
+  return resolved;
+}
+
+module.exports = {
+  logForcePublishWarning,
+  logUploadTargetSection,
+  resolveUploadPublishContext
+};