@aifabrix/builder 2.45.5 → 2.46.0

package/lib/datasource/audit-evidence-verify-matrix.js

@@ -113,22 +113,27 @@ async function buildListMatrixRows(ctx, polled, minExpected) {
 
 /**
  * @param {Object} ctx
- * @param {Array} executions
- * @param {string[]} executionIds
- * @returns {Promise<{ rows: import('../api/types/audit.types').AuditEvidenceMatrixRow[], execIds: string[] }>}
+ * @param {string[]} execIds
+ * @returns {Promise<import('../api/types/audit.types').AuditEvidenceMatrixRow[]>}
  */
-async function buildPerExecutionAndTailRows(ctx, executions, executionIds) {
+async function buildPerExecutionSubRows(ctx, execIds) {
   const { dataplaneUrl, authConfig } = ctx;
-  const execIds = resolveExecutionIdsForChecks(executions, executionIds);
-  const sampleId = execIds[0];
-  const base = { dataplaneUrl, authConfig, executionId: sampleId };
-  const rows = await Promise.all([
+  const base = { dataplaneUrl, authConfig, executionId: execIds[0] };
+  return Promise.all([
     checkPerExecutionSub({ ...base, rowNum: 4, label: 'rbac', fetcher: getExecutionRbac, isValid: isRbacSubResourceValid }),
     checkPerExecutionSub({ ...base, rowNum: 5, label: 'abac', fetcher: getExecutionAbac, isValid: isAbacSubResourceValid }),
     checkPerExecutionSub({ ...base, rowNum: 6, label: 'errors', fetcher: getExecutionErrors, isValid: isErrorsValid }),
     checkPerExecutionSub({ ...base, rowNum: 7, label: 'steps', fetcher: getExecutionSteps, isValid: isStepsValid })
   ]);
+}
 
+/**
+ * @param {Object} ctx
+ * @param {Array} executions
+ * @returns {Promise<Array>}
+ */
+async function resolveRow8PoolForMatrix(ctx, executions) {
+  const { dataplaneUrl, authConfig } = ctx;
   let corrQueryRows = [];
   if (ctx.correlationId) {
     const corr = await queryExecutions(dataplaneUrl, authConfig, {
@@ -137,28 +142,30 @@ async function buildPerExecutionAndTailRows(ctx, executions, executionIds) {
     });
     corrQueryRows = corr.data || [];
   }
-  let row8Pool = corrQueryRows.length ? corrQueryRows : executions;
+  const row8Pool = corrQueryRows.length ? corrQueryRows : executions;
   const expected = ctx.expectedOperations || [];
-  if (expected.length && ctx.correlationId) {
-    const byOp = await fetchCorrelationExecutionsByOperation(
-      dataplaneUrl,
-      authConfig,
-      ctx.correlationId,
-      expected
-    );
-    if (byOp.length) row8Pool = byOp;
+  if (!expected.length || !ctx.correlationId) {
+    return row8Pool;
   }
-  const row8Executions = resolveRow8Executions(ctx, executions, row8Pool);
-  rows.push(
-    checkRow8CorrelationGroup({
-      correlationId: ctx.correlationId,
-      executions: row8Executions,
-      expectedOperations: ctx.expectedOperations
-    })
+  const byOp = await fetchCorrelationExecutionsByOperation(
+    dataplaneUrl,
+    authConfig,
+    ctx.correlationId,
+    expected
   );
+  return byOp.length ? byOp : row8Pool;
+}
 
+/**
+ * @param {Object} ctx
+ * @param {string[]} execIds
+ * @returns {Promise<Set<string>>}
+ */
+async function collectTraceIdsForRow9(ctx, execIds) {
+  const { dataplaneUrl, authConfig } = ctx;
   const traceIds = new Set();
-  for (const id of execIds.slice(0, Math.min(execIds.length, 12))) {
+  const sample = execIds.slice(0, Math.min(execIds.length, 12));
+  for (const id of sample) {
     try {
       const tr = await getExecutionTrace(dataplaneUrl, authConfig, id);
       if (tr && tr.executionId) traceIds.add(String(tr.executionId));
@@ -167,7 +174,28 @@ async function buildPerExecutionAndTailRows(ctx, executions, executionIds) {
       /* row 9 may fail */
     }
   }
-  rows.push(checkRow9Traces(traceIds, execIds));
+  return traceIds;
+}
+
+/**
+ * @param {Object} ctx
+ * @param {Array} executions
+ * @param {string[]} executionIds
+ * @returns {Promise<{ rows: import('../api/types/audit.types').AuditEvidenceMatrixRow[], execIds: string[] }>}
+ */
+async function buildPerExecutionAndTailRows(ctx, executions, executionIds) {
+  const execIds = resolveExecutionIdsForChecks(executions, executionIds);
+  const rows = await buildPerExecutionSubRows(ctx, execIds);
+  const row8Pool = await resolveRow8PoolForMatrix(ctx, executions);
+  const row8Executions = resolveRow8Executions(ctx, executions, row8Pool);
+  rows.push(
+    checkRow8CorrelationGroup({
+      correlationId: ctx.correlationId,
+      executions: row8Executions,
+      expectedOperations: ctx.expectedOperations
+    })
+  );
+  rows.push(checkRow9Traces(await collectTraceIdsForRow9(ctx, execIds), execIds));
   return { rows, execIds };
 }
 

package/lib/datasource/bulk-loader-run-batches.js

@@ -34,9 +34,21 @@ function recordBatchFailure(state, index, err, batchRecords) {
  * @param {Object[]} batchRecords
  */
 function recordBatchSuccess(state, index, response, batchRecords) {
-  const inserted = response.insertedCount || 0;
-  const updated = response.updatedCount || 0;
-  const processed = response.totalProcessed || batchRecords.length;
+  if (!response || typeof response !== 'object') {
+    throw new Error('Bulk sync returned empty response');
+  }
+  if (response.success === false) {
+    throw new Error(
+      response.formattedError ||
+        response.error ||
+        `Bulk sync failed (HTTP ${response.status || 0})`
+    );
+  }
+  const payload =
+    response.data !== undefined && response.data !== null ? response.data : response;
+  const inserted = payload.insertedCount || 0;
+  const updated = payload.updatedCount || 0;
+  const processed = payload.totalProcessed || batchRecords.length;
   const failedInBatch = Math.max(0, batchRecords.length - processed);
 
   state.batches.push({

package/lib/datasource/datasource-load-export-context.js

@@ -8,6 +8,7 @@
 
 const { getConfig } = require('../core/config');
 const { setupIntegrationTestAuth } = require('../external-system/test-auth');
+const { applyLabDataplaneApiKeyBearer } = require('../utils/token-manager');
 const { resolveAppKeyForDatasource } = require('./resolve-app');
 const { getSystemKeyFromAppKey } = require('./integration-context');
 const { loadDatasourceForApp } = require('./unified-validation-run-resolve');
@@ -62,6 +63,8 @@ async function resolveLoadExportContext(datasourceKey, options = {}) {
     dataplaneUrl = auth.dataplaneUrl;
   }
 
+  authConfig = applyLabDataplaneApiKeyBearer(authConfig);
+
   return {
     appKey,
     systemKey,

package/lib/datasource/log-cleaner.js

@@ -1,6 +1,6 @@
 /**
  * Remove saved datasource test debug JSON under integration/<app>/logs/.
- * @fileoverview Local cleanup for test / test-integration / test-e2e / test-trust logs
+ * @fileoverview Local cleanup for test / test-integration / test-e2e / verify-trust logs
  * @author AI Fabrix Team
  * @version 1.0.0
  */
@@ -42,7 +42,7 @@ function matchesLogCleanType(fileName, type) {
     return fileName.startsWith('test-integration-');
   }
   if (type === 'e2e') return fileName.startsWith('test-e2e-');
-  if (type === 'trust') return fileName.startsWith('test-trust-');
+  if (type === 'trust') return fileName.startsWith('verify-trust-');
   return false;
 }
 

package/lib/datasource/log-viewer.js

@@ -59,7 +59,7 @@ function isStructuralTestLogFileName(name) {
   if (
     name.startsWith('test-e2e-') ||
     name.startsWith('test-integration-') ||
-    name.startsWith('test-trust-')
+    name.startsWith('verify-trust-')
   ) {
     return false;
   }
@@ -276,7 +276,7 @@ function logTrustFindingsSection(run) {
 }
 
 /**
- * Format agent trust log (`datasource test-trust --debug` → `test-trust-*.json`).
+ * Format agent trust log (`datasource verify-trust --debug` → `verify-trust-*.json`).
  * @param {Object} data - Parsed JSON { request, response?, error? }
  * @param {string} [fileName] - Log file name for header
  */
@@ -356,7 +356,7 @@ function formatStructuralTestLog(data, fileName) {
 /**
  * Format log content by type
  * @param {Object} parsed - Parsed JSON log
- * @param {'test'|'test-e2e'|'test-integration'|'test-trust'} logType - Log type
+ * @param {'test'|'test-e2e'|'test-integration'|'verify-trust'} logType - Log type
  * @param {string} [fileName] - File name for header
  */
 function formatLogContent(parsed, logType, fileName) {
@@ -364,7 +364,7 @@ function formatLogContent(parsed, logType, fileName) {
     formatStructuralTestLog(parsed, fileName);
     return;
   }
-  if (logType === 'test-trust') {
+  if (logType === 'verify-trust') {
     formatTrustLog(parsed, fileName);
     return;
   }
@@ -410,7 +410,7 @@ function parseDatasourceLogJson(content, logPath) {
  * @param {Object} options - Options
  * @param {string} [options.app] - App key (optional, resolved from key if omitted)
  * @param {string} [options.file] - Path to log file (overrides app resolution)
- * @param {'test'|'test-e2e'|'test-integration'|'test-trust'} options.logType - Log type
+ * @param {'test'|'test-e2e'|'test-integration'|'verify-trust'} options.logType - Log type
  * @throws {Error} When file not found or invalid JSON
  */
 /* eslint-disable-next-line max-statements -- Resolve path, read, parse, format */
@@ -433,11 +433,11 @@ async function runLogViewer(datasourceKey, options) {
           `No structural validation log found in ${logsDir}. Run: aifabrix datasource test <key> --debug`
         );
       }
-    } else if (logType === 'test-trust') {
-      logPath = await getLatestLogPath(logsDir, 'test-trust-');
+    } else if (logType === 'verify-trust') {
+      logPath = await getLatestLogPath(logsDir, 'verify-trust-');
       if (!logPath) {
         throw new Error(
-          `No test-trust log found in ${logsDir}. Run: aifabrix datasource test-trust <key> --debug`
+          `No verify-trust log found in ${logsDir}. Run: aifabrix datasource verify-trust <key> --debug`
         );
       }
     } else {

package/lib/datasource/test-e2e.js

@@ -42,8 +42,11 @@ function buildUnifiedE2eRunOptions(options, timeoutMs, pk) {
     capabilityKey: options.capabilityKey,
     timeout: timeoutMs,
     sync: options.sync === true,
+    force: options.force === true,
     authConfig: options.authConfig,
-    dataplaneUrl: options.dataplaneUrl || options.dataplane
+    dataplaneUrl: options.dataplaneUrl || options.dataplane,
+    quietPollUi: options.quietPollUi === true,
+    onPollProgress: options.onPollProgress
   };
 }
 

package/lib/datasource/unified-validation-run-body.js

@@ -10,6 +10,7 @@ const {
   includeDebugForRequest
 } = require('../utils/validation-run-request');
 const testHelpers = require('../utils/external-system-test-helpers');
+const { withStageOnValidationRunBody } = require('../utils/validation-run-stage');
 
 /**
  * @param {Object} params
@@ -52,7 +53,7 @@ async function buildUnifiedValidationBody(params) {
       })
       : undefined;
 
-  return buildExternalDataSourceValidationRequest({
+  const body = buildExternalDataSourceValidationRequest({
     systemKey,
     datasourceKey,
     runType,
@@ -62,6 +63,7 @@ async function buildUnifiedValidationBody(params) {
     explain: options.verbose === true,
     e2eOptions: e2eOptions && Object.keys(e2eOptions).length > 0 ? e2eOptions : undefined
   });
+  return withStageOnValidationRunBody(body, runType);
 }
 
 module.exports = { buildUnifiedValidationBody };

package/lib/datasource/unified-validation-run.js

@@ -18,6 +18,7 @@ const { buildUnifiedValidationBody } = require('./unified-validation-run-body');
 const { postValidationRunAndOptionalPoll } = require('./unified-validation-run-post');
 const { requireBearerForDataplanePipeline } = require('../utils/token-manager');
 const logger = require('../utils/logger');
+const { buildMinimalUploadSyncOptions } = require('../utils/upload-sync-options');
 
 function _resourceTypeFromDatasource(datasource) {
   return datasource && typeof datasource === 'object' && typeof datasource.resourceType === 'string'
@@ -59,7 +60,7 @@ async function maybeSyncDatasourceToDataplane({ options, authConfig, systemKey }
   // are updated before validation runs. Datasource-only publish can still fail DP-SEC-013 when the
   // dataplane system permissions[] are stale.
   const { uploadExternalSystem } = require('../commands/upload');
-  await uploadExternalSystem(systemKey, { minimal: true });
+  await uploadExternalSystem(systemKey, buildMinimalUploadSyncOptions(options));
   logger.log(formatSuccessLine('Sync complete'));
 }
 
@@ -139,7 +140,9 @@ async function runUnifiedDatasourceValidation(datasourceKey, options) {
     useAsync,
     noAsync: options.noAsync === true || options.async === false,
     verbosePoll: options.verbose === true,
-    pollSubject: datasourceKey
+    quietPollUi: options.quietPollUi === true,
+    pollSubject: datasourceKey,
+    onPollProgress: options.onPollProgress
   });
 
   if (result && result.envelope) {

package/lib/deployment/environment-poll-status.js

@@ -0,0 +1,138 @@
+/**
+ * Poll helpers for environment deploy status (deployment-by-ID).
+ *
+ * @fileoverview Parse pipeline/environments deployment poll responses and fail fast on terminal HTTP errors
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+const TERMINAL_POLL_HTTP_STATUSES = new Set([400, 401, 403, 404, 410, 422]);
+
+/**
+ * @param {Object|null|undefined} response - API client response
+ * @returns {boolean}
+ */
+function isTerminalPollApiResponse(response) {
+  return Boolean(
+    response &&
+    response.success === false &&
+    typeof response.status === 'number' &&
+    TERMINAL_POLL_HTTP_STATUSES.has(response.status)
+  );
+}
+
+/**
+ * @param {Object|null|undefined} response - Successful API client response
+ * @returns {Object|null} Deployment record or null
+ */
+function extractDeploymentRecord(response) {
+  if (!response || response.success === false) {
+    return null;
+  }
+  if (response?.data?.data) {
+    return response.data.data;
+  }
+  if (response?.data && typeof response.data === 'object' && response.data.status) {
+    return response.data;
+  }
+  return null;
+}
+
+/**
+ * @param {Object|null|undefined} pipelineRes
+ * @param {Object|null|undefined} envRes
+ * @returns {Error}
+ */
+/**
+ * @param {string} requestedEnvKey
+ * @param {Error} error
+ * @returns {Error}
+ */
+function enrichPollTerminalError(requestedEnvKey, error) {
+  if (!error?.pollTerminal || error.status !== 404) {
+    return error;
+  }
+  const base = error.message || '';
+  if (!base.includes('Environment with key')) {
+    return error;
+  }
+  error.message =
+    `${base}\n\n` +
+    'The deployment may have been created under a different environment key ' +
+    '(for example evaluation-mode fallback to miso). Check controller logs for ' +
+    `effectiveEnvironmentKey, register '${requestedEnvKey}' in the controller, or run ` +
+    'aifabrix env deploy miso.';
+  return error;
+}
+
+function buildPollStatusError(pipelineRes, envRes) {
+  const terminal = [pipelineRes, envRes].filter(isTerminalPollApiResponse);
+  const source = terminal[0] || pipelineRes || envRes;
+  const message = source?.formattedError || source?.error || 'Unable to retrieve deployment status';
+  const err = new Error(message);
+  err.pollTerminal = true;
+  if (typeof source?.status === 'number') {
+    err.status = source.status;
+  }
+  return err;
+}
+
+/**
+ * Fetches deployment status by ID (pipeline endpoint first, then environments).
+ *
+ * @async
+ * @param {Function} getPipelineDeployment - pipeline.api getPipelineDeployment
+ * @param {Function} getDeployment - deployments.api getDeployment
+ * @param {string} controllerUrl
+ * @param {string} envKey
+ * @param {string} deploymentId
+ * @param {Object} apiAuthConfig
+ * @returns {Promise<Object|null>} Deployment record or null when status is not yet available (retry)
+ * @throws {Error} When both endpoints return a terminal HTTP error (e.g. environment not found)
+ */
+async function fetchDeploymentStatusById(
+  getPipelineDeployment,
+  getDeployment,
+  controllerUrl,
+  envKey,
+  deploymentId,
+  apiAuthConfig
+) {
+  let pipelineRes;
+  let envRes;
+
+  try {
+    pipelineRes = await getPipelineDeployment(controllerUrl, envKey, deploymentId, apiAuthConfig);
+    const fromPipeline = extractDeploymentRecord(pipelineRes);
+    if (fromPipeline) {
+      return fromPipeline;
+    }
+  } catch (err) {
+    pipelineRes = { success: false, error: err?.message || String(err) };
+  }
+
+  try {
+    envRes = await getDeployment(controllerUrl, envKey, deploymentId, apiAuthConfig);
+    const fromEnv = extractDeploymentRecord(envRes);
+    if (fromEnv) {
+      return fromEnv;
+    }
+  } catch (err) {
+    envRes = { success: false, error: err?.message || String(err) };
+  }
+
+  if (isTerminalPollApiResponse(pipelineRes) || isTerminalPollApiResponse(envRes)) {
+    throw buildPollStatusError(pipelineRes, envRes);
+  }
+
+  return null;
+}
+
+module.exports = {
+  TERMINAL_POLL_HTTP_STATUSES,
+  isTerminalPollApiResponse,
+  extractDeploymentRecord,
+  enrichPollTerminalError,
+  buildPollStatusError,
+  fetchDeploymentStatusById
+};

package/lib/deployment/environment.js

@@ -25,6 +25,7 @@ const {
   buildEnvironmentConfigFromPreset,
   loadAndValidateEnvironmentDeployConfig
 } = require('./environment-config');
+const { fetchDeploymentStatusById, enrichPollTerminalError } = require('./environment-poll-status');
 
 /**
  * Validates environment deployment prerequisites
@@ -161,31 +162,24 @@ async function sendEnvironmentDeployment(controllerUrl, envKey, authConfig, opti
 }
 
 /**
- * Fetches deployment status by ID (pipeline endpoint first, then environments)
- * Mirrors miso-controller manual test: GET pipeline/deployments/:id then GET environments/deployments/:id
+ * Fetches deployment status by ID (pipeline endpoint first, then environments).
  * @async
  * @param {string} controllerUrl - Controller URL
  * @param {string} envKey - Environment key
  * @param {string} deploymentId - Deployment ID
  * @param {Object} apiAuthConfig - Auth config { type: 'bearer', token }
- * @returns {Promise<Object|null>} Deployment record (status, progress, etc.) or null
+ * @returns {Promise<Object|null>} Deployment record or null when still in progress
+ * @throws {Error} On terminal poll errors (e.g. environment or deployment not found)
  */
 async function getDeploymentStatusById(controllerUrl, envKey, deploymentId, apiAuthConfig) {
-  try {
-    const pipelineRes = await getPipelineDeployment(controllerUrl, envKey, deploymentId, apiAuthConfig);
-    if (pipelineRes?.data?.data) return pipelineRes.data.data;
-    if (pipelineRes?.data && typeof pipelineRes.data === 'object' && pipelineRes.data.status) return pipelineRes.data;
-  } catch {
-    // Fallback to environments endpoint
-  }
-  try {
-    const envRes = await getDeployment(controllerUrl, envKey, deploymentId, apiAuthConfig);
-    if (envRes?.data?.data) return envRes.data.data;
-    if (envRes?.data && typeof envRes.data === 'object' && envRes.data.status) return envRes.data;
-  } catch {
-    // Ignore
-  }
-  return null;
+  return fetchDeploymentStatusById(
+    getPipelineDeployment,
+    getDeployment,
+    controllerUrl,
+    envKey,
+    deploymentId,
+    apiAuthConfig
+  );
 }
 
 /**
@@ -218,6 +212,33 @@ function processDeploymentStatusResponse(deployment, validatedEnvKey) {
   return null;
 }
 
+/**
+ * @param {number} attempt
+ * @param {number} maxAttempts
+ * @param {Object|null} deployment
+ */
+function logPollAttemptProgress(attempt, maxAttempts, deployment) {
+  const progress = deployment?.progress ?? 0;
+  const statusLabel = deployment?.status ?? 'pending';
+  logger.log(chalk.gray(`   Attempt ${attempt}/${maxAttempts}... Status: ${statusLabel} (${progress}%)`));
+}
+
+/**
+ * @param {Error} error
+ * @param {string} validatedEnvKey
+ * @throws {Error}
+ */
+function handlePollIterationError(error, validatedEnvKey) {
+  const msg = error?.message || '';
+  const isDeploymentFailed =
+    msg.includes('Environment deployment failed') ||
+    (msg.includes('failed') && !error.pollTerminal);
+  if (error.pollTerminal || isDeploymentFailed) {
+    throw enrichPollTerminalError(validatedEnvKey, error);
+  }
+  logger.log(chalk.yellow(`   ⚠ Status check failed (will retry): ${msg}`));
+}
+
 /**
  * Polls environment deployment status
  * @async
@@ -231,44 +252,31 @@ function processDeploymentStatusResponse(deployment, validatedEnvKey) {
 async function pollEnvironmentStatus(deploymentId, controllerUrl, envKey, authConfig, options = {}) {
   const validatedUrl = validateControllerUrl(controllerUrl);
   const validatedEnvKey = validateEnvironmentKey(envKey);
-
   const pollInterval = options.pollInterval || 5000;
   const maxAttempts = options.maxAttempts || 60;
+  const apiAuthConfig = { type: 'bearer', token: authConfig.token };
 
   logger.log(chalk.blue(`⏳ Polling environment status (${pollInterval}ms intervals)...`));
 
-  // Use centralized API client
-  const apiAuthConfig = { type: 'bearer', token: authConfig.token };
-
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     try {
       await new Promise(resolve => setTimeout(resolve, pollInterval));
-
       const deployment = await getDeploymentStatusById(
         validatedUrl,
         validatedEnvKey,
         deploymentId,
         apiAuthConfig
       );
-      const progress = deployment?.progress ?? 0;
-      const statusLabel = deployment?.status ?? 'pending';
-      if (attempt <= maxAttempts) {
-        logger.log(chalk.gray(`   Attempt ${attempt}/${maxAttempts}... Status: ${statusLabel} (${progress}%)`));
-      }
+      logPollAttemptProgress(attempt, maxAttempts, deployment);
       const statusResult = processDeploymentStatusResponse(deployment, validatedEnvKey);
       if (statusResult) {
         return statusResult;
       }
     } catch (error) {
-      // If it's a terminal error (not a timeout), throw it
-      if (error.message && error.message.includes('failed')) {
-        throw error;
-      }
-      // Otherwise, continue polling
+      handlePollIterationError(error, validatedEnvKey);
     }
   }
 
-  // Timeout
   throw new Error(`Environment deployment timeout after ${maxAttempts} attempts. Check controller logs for status.`);
 }
 

package/lib/external-system/download.js

@@ -437,30 +437,24 @@ function logDownloadCommandHeader(systemKey) {
 }
 
 /**
- * Downloads external system from dataplane to local development structure
+ * Downloads external system from dataplane to local development structure.
  * @async
- * @function downloadExternalSystem
- * @param {string} systemKey - System key or ID
- * @param {Object} options - Download options
- * @param {string} [options.format] - Output format: 'yaml' (default) or 'json' (runs convert after split)
- * @param {string} [options.environment] - Environment (dev, tst, pro)
- * @param {string} [options.controller] - Controller URL
- * @param {boolean} [options.dryRun] - Show what would be downloaded without actually downloading
- * @param {boolean} [options.force] - Overwrite existing README.md without prompting
- * @returns {Promise<void>} Resolves when download completes
- * @throws {Error} If download fails
+ * @param {string} systemKey
+ * @param {Object} [options]
+ * @returns {Promise<void>}
  */
 async function downloadExternalSystem(systemKey, options = {}) {
   validateSystemKeyFormat(systemKey);
-
   const format = (options.format || 'yaml').toLowerCase();
 
   try {
     logDownloadCommandHeader(systemKey);
-
     const config = await getConfig();
-    const { authConfig, dataplaneUrl } = await setupAuthenticationAndDataplane(systemKey, options, config);
-
+    const { authConfig, dataplaneUrl } = await setupAuthenticationAndDataplane(
+      systemKey,
+      options,
+      config
+    );
     if (options.dryRun) {
       handleDryRun(systemKey, dataplaneUrl);
       return;
@@ -468,15 +462,22 @@ async function downloadExternalSystem(systemKey, options = {}) {
 
     const manifest = await downloadFullManifest(dataplaneUrl, systemKey, authConfig);
     validateAndLogDownloadedData(manifest.application, manifest.dataSources);
-
     const finalPath = getIntegrationPath(systemKey);
-    const splitOptions = await resolveDownloadSplitOptions(finalPath, options);
-    await processDownloadedSystem(systemKey, manifest, splitOptions);
-
+    await processDownloadedSystem(
+      systemKey,
+      manifest,
+      await resolveDownloadSplitOptions(finalPath, options)
+    );
+    const { downloadGovernanceScenarioPacksFromManifest } = require('../lifecycle/scenario-upload');
+    await downloadGovernanceScenarioPacksFromManifest(
+      systemKey,
+      manifest,
+      dataplaneUrl,
+      authConfig
+    );
     if (format === 'json') {
       await runConvertToJsonIfRequested(systemKey);
     }
-
     displayDownloadSuccess(systemKey, finalPath, manifest.dataSources.length);
   } catch (error) {
     throw new Error(`Failed to download external system: ${error.message}`);

package/lib/external-system/generator.js

@@ -26,7 +26,7 @@ handlebars.registerHelper('json', (obj) => JSON.stringify(obj));
  * Build authentication object per schema authenticationVariablesByMethod.
  * Security values use canonical kv://<systemKey>/<segment> paths (segment from getKvPathSegmentForSecurityKey).
  * @param {string} systemKey - External system key
- * @param {string} authType - Auth method (oauth2, aad, apikey, basic, queryParam, oidc, hmac, none)
+ * @param {string} authType - Auth method (oauth2, aad, apikey, bearerToken, basic, queryParam, oidc, hmac, none)
  * @returns {{ method: string, variables: Object, security: Object }} Authentication object
  */
 function buildAuthenticationFromMethod(systemKey, authType) {
@@ -50,6 +50,10 @@ function buildAuthenticationFromMethod(systemKey, authType) {
       variables: { baseUrl: base, headerName: 'X-API-Key' },
       security: { apiKey: kvPath('apiKey') }
     },
+    bearerToken: {
+      variables: { baseUrl: base, headerName: 'Authorization', prefix: 'Bearer' },
+      security: { token: kvPath('token') }
+    },
     basic: {
       variables: { baseUrl: base },
       security: { username: kvPath('username'), password: kvPath('password') }