@aifabrix/builder 2.45.5 → 2.47.0

package/lib/commands/up-dataplane.js

@@ -29,7 +29,12 @@ const { checkHealthEndpoint } = require('../utils/health-check');
 const { validateControllerUrl } = require('../utils/auth-config-validator');
 const app = require('../app');
 const { assertDevInfraUp } = require('./dev-infra-gate');
-const { ensureAppFromTemplate, validateEnvOutputPathFolderOrNull, refreshUrlsLocalRegistryForCurrentProject } = require('./up-common');
+const { dataplaneDockerHostPort } = require('../utils/declarative-url-ports');
+const {
+  ensureDataplaneAppsFromTemplate,
+  validateEnvOutputPathFolderOrNull,
+  refreshUrlsLocalRegistryForCurrentProject
+} = require('./up-common');
 
 const CONTROLLER_HEALTH_PATH = '/health';
 
@@ -103,6 +108,22 @@ async function resolveControllerUrlWithHealthCheck() {
   return normalizedNew;
 }
 
+async function resolveUpDataplaneAuthContext(options, environmentKey) {
+  if (options.skipInfraCheck !== true) {
+    await assertDevInfraUp();
+  }
+
+  const controllerUrl = await resolveControllerUrlWithHealthCheck();
+  const authConfig = await checkAuthentication(controllerUrl, environmentKey, { throwOnFailure: true });
+
+  const cfg = await config.getConfig();
+  if (options.allowNonDev !== true) {
+    assertDevEnvironmentForDataplane(cfg);
+  }
+  logger.log(formatSuccessLine(`Logged in (environment: ${environmentKey})`));
+  return { controllerUrl, authConfig };
+}
+
 /**
  * Register or rotate dataplane: if app exists in controller, rotate secret; otherwise register.
  * @async
@@ -118,7 +139,12 @@ async function registerOrRotateDataplane(options, controllerUrl, environmentKey,
     await rotateSecret('dataplane', options);
   } else {
     const imageOverride = options.image || buildDataplaneImageRef(options);
-    const registerOpts = { imageOverride, image: imageOverride, registryMode: options.registryMode };
+    const registerOpts = {
+      imageOverride,
+      image: imageOverride,
+      registryMode: options.registryMode,
+      envKey: environmentKey
+    };
     await registerApplication('dataplane', registerOpts);
   }
 }
@@ -134,6 +160,7 @@ async function deployDataplaneToController(options) {
     imageOverride,
     image: imageOverride,
     registryMode: options.registryMode,
+    envKey: options.envKey ? String(options.envKey).trim().toLowerCase() : undefined,
     // Guided up-platform already shows a top-level spinner for the dataplane step.
     // Avoid nested deploy polling spinners/logs.
     silentPoll: options.platformInstall === true
@@ -172,6 +199,13 @@ function emitDataplaneManifestLineFromBuilder() {
   emitSystemBuilderAppManifestLineIfTTY(logger, 'dataplane');
 }
 
+function computeDataplanePortOverride(runEnvKey, developerIdNum) {
+  if (runEnvKey !== 'dev' && runEnvKey !== 'tst') {
+    return undefined;
+  }
+  return dataplaneDockerHostPort(3001, developerIdNum, runEnvKey);
+}
+
 function assertDevEnvironmentForDataplane(cfg) {
   const environment = (cfg && cfg.environment) ? cfg.environment : 'dev';
   if (environment !== 'dev') {
@@ -181,6 +215,14 @@ function assertDevEnvironmentForDataplane(cfg) {
   }
 }
 
+async function computeDataplaneRunOverrides(options) {
+  const runEnvKey = options.runEnvKey ? String(options.runEnvKey).trim().toLowerCase() : undefined;
+  const developerIdRaw = await config.getDeveloperId();
+  const developerIdNum = typeof developerIdRaw === 'string' ? parseInt(developerIdRaw, 10) : developerIdRaw;
+  const portOverride = computeDataplanePortOverride(runEnvKey, developerIdNum);
+  return { runEnvKey, portOverride };
+}
+
 /**
  * Handle up-dataplane command: ensure logged in, environment dev, ensure dataplane,
  * register or rotate (if already registered), deploy (send manifest to controller),
@@ -199,19 +241,13 @@ function assertDevEnvironmentForDataplane(cfg) {
 async function handleUpDataplane(options = {}) {
   logger.log(chalk.blue('Starting up-dataplane (register/rotate, deploy, then run dataplane locally)...\n'));
 
-  if (options.skipInfraCheck !== true) {
-    await assertDevInfraUp();
-  }
+  const environmentKey =
+    options && options.envKey
+      ? String(options.envKey).trim().toLowerCase()
+      : await resolveEnvironment();
+  const { controllerUrl, authConfig } = await resolveUpDataplaneAuthContext(options, environmentKey);
 
-  const controllerUrl = await resolveControllerUrlWithHealthCheck();
-  const environmentKey = await resolveEnvironment();
-  const authConfig = await checkAuthentication(controllerUrl, environmentKey, { throwOnFailure: true });
-
-  const cfg = await config.getConfig();
-  assertDevEnvironmentForDataplane(cfg);
-  logger.log(formatSuccessLine('Logged in and environment is dev'));
-
-  await ensureAppFromTemplate('dataplane');
+  await ensureDataplaneAppsFromTemplate();
   // If envOutputPath target folder does not exist, set envOutputPath to null
   validateEnvOutputPathFolderOrNull('dataplane');
 
@@ -223,10 +259,15 @@ async function handleUpDataplane(options = {}) {
 
   await registerOrRotateDataplane(options, controllerUrl, environmentKey, authConfig);
 
-  await deployDataplaneToController(options);
+  await deployDataplaneToController({ ...options, envKey: environmentKey });
   logger.log('');
+
+  const { runEnvKey, portOverride } = await computeDataplaneRunOverrides(options);
+
   await app.runApp('dataplane', {
     skipEnvOutputPath: true,
+    env: runEnvKey,
+    port: portOverride,
     registry: options.registry || undefined,
     base: options.base !== false,
     skipManifestMetadataLine: true

package/lib/commands/upload-publish-context.js

@@ -0,0 +1,75 @@
+/**
+ * @fileoverview Upload publish preflight: auth resolve, CLI gate, target logging.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { sectionTitle, headerKeyValue } = require('../utils/cli-test-layout-chalk');
+const { resolveControllerUrl } = require('../utils/controller-url');
+const { requireBearerForDataplanePipeline } = require('../utils/token-manager');
+const { logDataplanePipelineWarning } = require('../utils/dataplane-pipeline-warning');
+const { assertDataplaneCliVersionCompatible } = require('../utils/dataplane-cli-version-gate');
+
+const SEP = chalk.gray('────────────────────────────────────────');
+
+function logForcePublishWarning() {
+  logger.log(
+    chalk.yellow(
+      'Warning: --force bypasses active-datasource schema replacement guards on publish. '
+        + 'Existing records and ABAC may be inconsistent; run validation/sync after upload.'
+    )
+  );
+}
+
+function logUploadTargetSection(environment, dataplaneUrl) {
+  logger.log('');
+  logger.log(sectionTitle('Target'));
+  logger.log(SEP);
+  logger.log(headerKeyValue('Environment:', environment));
+  logger.log(headerKeyValue('Dataplane:', dataplaneUrl));
+  logDataplanePipelineWarning();
+}
+
+/**
+ * Resolve dataplane auth and run upload preflight checks.
+ * @param {Function} resolveDataplaneAndAuth
+ * @param {Function} maybeRunVerboseServerValidation
+ * @param {string} systemKey
+ * @param {Object} options
+ * @param {Object} payload
+ * @returns {Promise<{ dataplaneUrl: string, authConfig: Object, environment: string }>}
+ */
+async function resolveUploadPublishContext(
+  resolveDataplaneAndAuth,
+  maybeRunVerboseServerValidation,
+  systemKey,
+  options,
+  payload
+) {
+  const resolved = await resolveDataplaneAndAuth(systemKey, {
+    silent: options.silentResolve === true
+  });
+  requireBearerForDataplanePipeline(resolved.authConfig);
+  if (options.force === true) {
+    logForcePublishWarning();
+  }
+  const controllerUrl = await resolveControllerUrl();
+  await assertDataplaneCliVersionCompatible(resolved.dataplaneUrl, { controllerUrl });
+  if (options.minimal !== true) {
+    logUploadTargetSection(resolved.environment, resolved.dataplaneUrl);
+  }
+  if (options.verbose) {
+    await maybeRunVerboseServerValidation(resolved.dataplaneUrl, resolved.authConfig, payload);
+  }
+  return resolved;
+}
+
+module.exports = {
+  logForcePublishWarning,
+  logUploadTargetSection,
+  resolveUploadPublishContext
+};

package/lib/commands/upload-sidecar-followups.js

@@ -0,0 +1,89 @@
+/**
+ * @fileoverview Upload sidecar follow-ups (governance packs, certification sync).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatWarningLine } = require('../utils/cli-test-layout-chalk');
+const { unwrapPublicationResult, isPublicationUnchanged } = require('../utils/external-system-readiness-core');
+const { logUploadReadinessSummary } = require('../utils/external-system-readiness-display');
+const { maybeSyncSystemCertificationFromDataplane } = require('../certification/sync-system-certification');
+const { cliOptsSkipCertSync } = require('../certification/cli-cert-sync-skip');
+const { isQuietMinimalSync } = require('../utils/upload-sync-options');
+
+/**
+ * Sidecar follow-ups that are independent of pipeline publish hash (scenario packs, cert sync).
+ * @param {Object} ctx
+ * @returns {Promise<void>}
+ */
+async function runUploadSidecarFollowups(ctx) {
+  const { systemKey, options, payload, dataplaneUrl, authConfig } = ctx;
+  const quietSidecar = isQuietMinimalSync(options);
+  const dsKeys = (payload.dataSources || []).map((ds) => ds && ds.key).filter(Boolean);
+  try {
+    const { uploadGovernanceScenarioPacks } = require('../lifecycle/scenario-upload');
+    await uploadGovernanceScenarioPacks(systemKey, dataplaneUrl, authConfig, { silent: quietSidecar });
+  } catch (err) {
+    if (!quietSidecar) {
+      logger.log(formatWarningLine(`Governance scenario upload skipped: ${err.message}`));
+    }
+  }
+  await maybeSyncSystemCertificationFromDataplane({
+    label: 'upload',
+    noCertSync: cliOptsSkipCertSync(options),
+    systemKey,
+    dataplaneUrl,
+    authConfig,
+    datasourceKeys: dsKeys,
+    silent: quietSidecar
+  });
+}
+
+/**
+ * @param {Object} ctx
+ * @param {Function} maybeRunUploadProbe
+ * @returns {Promise<void>}
+ */
+async function handlePublicationAndFollowups(ctx, maybeRunUploadProbe) {
+  const {
+    systemKey,
+    options,
+    manifest,
+    payload,
+    environment,
+    dataplaneUrl,
+    authConfig,
+    rawRes
+  } = ctx;
+  const publication = unwrapPublicationResult(rawRes);
+  if (!publication) {
+    throw new Error(
+      'Unexpected response from dataplane upload: missing publication result (uploadId/system/datasources).'
+    );
+  }
+  if (isPublicationUnchanged(publication)) {
+    await runUploadSidecarFollowups({ systemKey, options, payload, dataplaneUrl, authConfig });
+    return;
+  }
+  logUploadReadinessSummary({
+    environment,
+    dataplaneUrl,
+    systemKey,
+    publication,
+    manifest,
+    minimal: !!options.minimal,
+    willProbe: !!options.probe
+  });
+  if (options.probe) {
+    await maybeRunUploadProbe(dataplaneUrl, systemKey, authConfig, options.probeTimeout);
+  }
+  await runUploadSidecarFollowups({ systemKey, options, payload, dataplaneUrl, authConfig });
+}
+
+module.exports = {
+  runUploadSidecarFollowups,
+  handlePublicationAndFollowups
+};

package/lib/commands/upload.js

@@ -21,7 +21,7 @@ const logger = require('../utils/logger');
 
 const SEP = chalk.gray('────────────────────────────────────────');
 const { resolveControllerUrl } = require('../utils/controller-url');
-const { getDeploymentAuth, requireBearerForDataplanePipeline } = require('../utils/token-manager');
+const { getDeploymentAuth } = require('../utils/token-manager');
 const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
 const { getIntegrationPath } = require('../utils/paths');
 const { pushCredentialSecrets } = require('../utils/credential-secrets-env');
@@ -32,26 +32,29 @@ const {
   resolveConfigurationValues,
   collectResolvedVariableConfigurationNames
 } = require('../utils/configuration-env-resolver');
+const { pushRuntimeConfigurationValues } = require('../utils/runtime-configuration-values');
 const { validateExternalSystemComplete } = require('../validation/validate');
 const { displayValidationResults } = require('../validation/validate-display');
 const { generateControllerManifest } = require('../generator/external-controller-manifest');
 const {
-  uploadApplicationViaPipeline,
   validatePipelineConfig,
   testSystemViaPipeline
 } = require('../api/pipeline.api');
+const { uploadApplicationViaPipelineWithAuthRetry } = require('../utils/pipeline-upload-auth-retry');
 const { formatApiError } = require('../utils/api-error-handler');
-const { logDataplanePipelineWarning } = require('../utils/dataplane-pipeline-warning');
-const { unwrapPublicationResult, unwrapApiData } = require('../utils/external-system-readiness-core');
+const { unwrapPublicationResult, unwrapApiData, isPublicationUnchanged } = require('../utils/external-system-readiness-core');
 const {
-  logUploadReadinessSummary,
   logServerValidationWarnings,
   logProbeRuntimeBlock
 } = require('../utils/external-system-readiness-display');
-const { maybeSyncSystemCertificationFromDataplane } = require('../certification/sync-system-certification');
-const { cliOptsSkipCertSync } = require('../certification/cli-cert-sync-skip');
 const { maybeSyncOpenApiFilesForMcp } = require('./repair-openapi-sync');
-const { assertDataplaneCliVersionCompatible } = require('../utils/dataplane-cli-version-gate');
+const { resolveUploadPublishContext } = require('./upload-publish-context');
+const { syncDeployJsonFromSources } = require('../external-system/sync-deploy-manifest');
+const { isQuietMinimalSync } = require('../utils/upload-sync-options');
+const {
+  runUploadSidecarFollowups,
+  handlePublicationAndFollowups
+} = require('./upload-sidecar-followups');
 
 /**
  * Validates system-key format (same as download).
@@ -73,13 +76,22 @@ function validateSystemKeyFormat(systemKey) {
  * @param {Object} manifest - Controller manifest from generateControllerManifest
  * @returns {Object} { version, application, dataSources, status: "draft" }
  */
-function buildUploadPayload(manifest) {
-  return {
+/**
+ * @param {Object} manifest - Controller manifest from generateControllerManifest
+ * @param {{ force?: boolean }} [opts]
+ * @returns {Object}
+ */
+function buildUploadPayload(manifest, opts = {}) {
+  const payload = {
     version: manifest.version || '1.0.0',
     application: manifest.system,
     dataSources: manifest.dataSources || [],
     status: 'draft'
   };
+  if (opts.force === true) {
+    payload.force = true;
+  }
+  return payload;
 }
 
 /**
@@ -113,11 +125,15 @@ async function resolveDataplaneAndAuth(systemKey, opts = {}) {
  * @param {Object} payload - { version, application, dataSources, status: "draft" }
  * @returns {Promise<Object>} Raw API response envelope
  */
-async function runUploadValidatePublish(dataplaneUrl, authConfig, payload) {
-  const res = await uploadApplicationViaPipeline(dataplaneUrl, authConfig, payload);
+async function runUploadValidatePublish(dataplaneUrl, authConfig, payload, systemKey) {
+  const res = await uploadApplicationViaPipelineWithAuthRetry(
+    dataplaneUrl,
+    authConfig,
+    payload,
+    systemKey
+  );
   if (res?.success === false) {
-    const msg = formatApiError(res, dataplaneUrl);
-    throw new Error(msg);
+    throw new Error(formatApiError(res, dataplaneUrl));
   }
   return res;
 }
@@ -204,6 +220,24 @@ async function pushAndLogCredentialSecrets(dataplaneUrl, authConfig, systemKey,
   if (pushResult.warning) {
     logger.log(chalk.yellow(`Warning: ${pushResult.warning}`));
   }
+  try {
+    const configPush = await pushRuntimeConfigurationValues(
+      dataplaneUrl,
+      authConfig,
+      systemKey,
+      payload
+    );
+    if (configPush.pushed > 0) {
+      const nameList = configPush.names.length ? ` (${configPush.names.join(', ')})` : '';
+      logger.log(
+        formatSuccessLine(
+          `Stored ${configPush.pushed} runtime configuration value(s) in dataplane${nameList}.`
+        )
+      );
+    }
+  } catch (err) {
+    logger.log(chalk.yellow(`Warning: runtime configuration store skipped: ${err.message}`));
+  }
 }
 
 /**
@@ -269,18 +303,22 @@ async function maybeRunUploadProbe(dataplaneUrl, systemKey, authConfig, probeTim
 
 /**
  * Local validation, manifest, payload, and configuration resolution.
- * Does not write *-deploy.json; run `aifabrix json <systemKey>` to regenerate the deployment manifest from sources.
+ * Regenerates integration/<systemKey>/<systemKey>-deploy.json from sources (same as `aifabrix json`).
  *
  * @param {string} systemKey
  * @param {{ dryRun?: boolean }} [_opts] - Reserved for callers (e.g. dry-run); manifest is always built from current disk files
  * @returns {Promise<{ manifest: Object, payload: Object }>}
  */
-async function buildValidatedUploadManifestPayload(systemKey, _opts = {}) {
+async function buildValidatedUploadManifestPayload(systemKey, opts = {}) {
+  const quiet = opts.minimal === true || opts.quiet === true;
   const validationResult = await validateExternalSystemComplete(systemKey, { type: 'external' });
   throwIfValidationFailed(validationResult);
-  logger.log(formatSuccessLine('Local validation passed'));
+  if (!quiet) {
+    logger.log(formatSuccessLine('Local validation passed'));
+  }
+  await syncDeployJsonFromSources(systemKey, { quiet });
   const manifest = await generateControllerManifest(systemKey, { type: 'external' });
-  const payload = buildUploadPayload(manifest);
+  const payload = buildUploadPayload(manifest, { force: opts.force === true });
   await resolvePayloadConfiguration(systemKey, payload);
   return { manifest, payload };
 }
@@ -295,7 +333,7 @@ async function buildValidatedUploadManifestPayload(systemKey, _opts = {}) {
  * @param {Object} manifest
  * @returns {Promise<void>}
  */
-async function logAndSyncLocalOpenApiForUpload(systemKey, manifest) {
+async function logAndSyncLocalOpenApiForUpload(systemKey, manifest, uploadContext = {}) {
   const appPath = getIntegrationPath(systemKey);
   const ei = manifest && manifest.externalIntegration;
   const datasourceFiles = ei && Array.isArray(ei.dataSources) ? ei.dataSources : [];
@@ -304,65 +342,15 @@ async function logAndSyncLocalOpenApiForUpload(systemKey, manifest) {
     dryRun: false,
     appPath,
     systemKey,
-    datasourceFiles
+    datasourceFiles,
+    dataplaneUrl: uploadContext.dataplaneUrl,
+    authConfig: uploadContext.authConfig
   });
   for (const line of openapiSyncLines) {
     logger.log(line.startsWith('Skipped') ? formatWarningLine(line) : formatSuccessLine(line));
   }
 }
 
-/**
- * @param {Object} ctx
- * @param {string} ctx.systemKey
- * @param {Object} ctx.options
- * @param {Object} ctx.manifest
- * @param {Object} ctx.payload
- * @param {string} ctx.environment
- * @param {string} ctx.dataplaneUrl
- * @param {Object} ctx.authConfig
- * @param {Object} ctx.rawRes
- * @returns {Promise<void>}
- */
-async function handlePublicationAndFollowups(ctx) {
-  const {
-    systemKey,
-    options,
-    manifest,
-    payload,
-    environment,
-    dataplaneUrl,
-    authConfig,
-    rawRes
-  } = ctx;
-  const publication = unwrapPublicationResult(rawRes);
-  if (!publication) {
-    throw new Error(
-      'Unexpected response from dataplane upload: missing publication result (uploadId/system/datasources).'
-    );
-  }
-  logUploadReadinessSummary({
-    environment,
-    dataplaneUrl,
-    systemKey,
-    publication,
-    manifest,
-    minimal: !!options.minimal,
-    willProbe: !!options.probe
-  });
-  if (options.probe) {
-    await maybeRunUploadProbe(dataplaneUrl, systemKey, authConfig, options.probeTimeout);
-  }
-  const dsKeys = (payload.dataSources || []).map((ds) => ds && ds.key).filter(Boolean);
-  await maybeSyncSystemCertificationFromDataplane({
-    label: 'upload',
-    noCertSync: cliOptsSkipCertSync(options),
-    systemKey,
-    dataplaneUrl,
-    authConfig,
-    datasourceKeys: dsKeys
-  });
-}
-
 /**
  * Upload path after dry-run check.
  * @param {string} systemKey
@@ -371,45 +359,55 @@ async function handlePublicationAndFollowups(ctx) {
  * @param {Object} payload
  */
 async function runUploadPublishAndSummary(systemKey, options, manifest, payload) {
-  const { dataplaneUrl, authConfig, environment } = await resolveDataplaneAndAuth(systemKey, {
-    silent: options.silentResolve === true
-  });
-  requireBearerForDataplanePipeline(authConfig);
-  const controllerUrl = await resolveControllerUrl();
-  // Plan 142.0: gate dataplane API entrypoints by the dataplane-advertised minimum Builder CLI version.
-  await assertDataplaneCliVersionCompatible(dataplaneUrl, { controllerUrl });
-  logger.log('');
-  logger.log(sectionTitle('Target'));
-  logger.log(SEP);
-  logger.log(headerKeyValue('Environment:', environment));
-  logger.log(headerKeyValue('Dataplane:', dataplaneUrl));
-  logDataplanePipelineWarning();
-  if (options.verbose) {
-    await maybeRunVerboseServerValidation(dataplaneUrl, authConfig, payload);
+  const { dataplaneUrl, authConfig, environment } = await resolveUploadPublishContext(
+    resolveDataplaneAndAuth,
+    maybeRunVerboseServerValidation,
+    systemKey,
+    options,
+    payload
+  );
+  const rawRes = await runWithUploadPipelineSpinner(
+    async() => runUploadValidatePublish(dataplaneUrl, authConfig, payload, systemKey),
+    {
+      systemKey,
+      json: options.json === true,
+      syncMode: options.syncMode === true,
+      suppressPipelineSpinner: options.suppressPipelineSpinner === true
+    }
+  );
+  const publication = unwrapPublicationResult(rawRes);
+  if (isPublicationUnchanged(publication)) {
+    if (!isQuietMinimalSync(options)) {
+      logger.log(formatSuccessLine('Config unchanged on dataplane — upload skipped.'));
+    }
+    await runUploadSidecarFollowups({
+      systemKey,
+      options,
+      payload,
+      dataplaneUrl,
+      authConfig
+    });
+    return { dataplaneUrl, authConfig, environment, uploadSkipped: true };
   }
+
   await pushAndLogCredentialSecrets(dataplaneUrl, authConfig, systemKey, payload, {
     json: options.json === true
   });
-
-  const rawRes = await runWithUploadPipelineSpinner(
-    async() => {
-      const res = await runUploadValidatePublish(dataplaneUrl, authConfig, payload);
-      await logAndSyncLocalOpenApiForUpload(systemKey, manifest);
-      return res;
+  await logAndSyncLocalOpenApiForUpload(systemKey, manifest, { dataplaneUrl, authConfig });
+  await handlePublicationAndFollowups(
+    {
+      systemKey,
+      options,
+      manifest,
+      payload,
+      environment,
+      dataplaneUrl,
+      authConfig,
+      rawRes
     },
-    { systemKey, json: options.json === true }
+    maybeRunUploadProbe
   );
-  await handlePublicationAndFollowups({
-    systemKey,
-    options,
-    manifest,
-    payload,
-    environment,
-    dataplaneUrl,
-    authConfig,
-    rawRes
-  });
-  return { dataplaneUrl, authConfig, environment };
+  return { dataplaneUrl, authConfig, environment, uploadSkipped: false };
 }
 
 /**
@@ -426,12 +424,17 @@ async function runUploadPublishAndSummary(systemKey, options, manifest, payload)
  */
 async function uploadExternalSystem(systemKey, options = {}) {
   validateSystemKeyFormat(systemKey);
-  logger.log('');
-  logger.log(sectionTitle('Upload external system'));
-  logger.log(SEP);
-  logger.log(headerKeyValue('System:', systemKey));
+  const minimal = options.minimal === true;
+  if (!minimal) {
+    logger.log('');
+    logger.log(sectionTitle('Upload external system'));
+    logger.log(SEP);
+    logger.log(headerKeyValue('System:', systemKey));
+  }
   const { manifest, payload } = await buildValidatedUploadManifestPayload(systemKey, {
-    dryRun: !!options.dryRun
+    dryRun: !!options.dryRun,
+    force: options.force === true,
+    minimal
   });
   if (options.dryRun) {
     logger.log(chalk.yellow('Dry run: would upload payload (no API calls).'));

package/lib/commands/verify-governance-combined-external.js

@@ -0,0 +1,61 @@
+/**
+ * @fileoverview verify-governance — sync, generate, verify (424.0 dataplane-first).
+ */
+
+'use strict';
+
+const { runGovernanceGenerateForExternalSystem } = require('./governance-generate-external');
+const { runVerifyGovernanceForExternalSystem } = require('./verify-governance-external');
+const {
+  buildSubjectsFromOptions,
+  resolveGovernanceIntegrationContext
+} = require('./governance-cli-shared');
+
+/**
+ * @async
+ * @param {string} systemKey
+ * @param {Object} options
+ * @returns {Promise<Object>}
+ */
+async function runVerifyGovernanceCombined(systemKey, options = {}) {
+  if (options.pack) {
+    return runVerifyGovernanceForExternalSystem(systemKey, options);
+  }
+
+  const subjects = buildSubjectsFromOptions(options);
+  if (subjects.length === 0) {
+    throw new Error(
+      'At least one --subject-user-id or --subject-email is required for verify-governance'
+    );
+  }
+
+  const { resolvedKey, authConfig, dataplaneUrl } = await resolveGovernanceIntegrationContext(
+    systemKey,
+    options
+  );
+
+  const pipelineOpts = {
+    ...options,
+    noSync: true,
+    authConfig,
+    dataplaneUrl
+  };
+
+  const generateResult = await runGovernanceGenerateForExternalSystem(
+    resolvedKey,
+    pipelineOpts
+  );
+
+  const verifyResult = await runVerifyGovernanceForExternalSystem(resolvedKey, pipelineOpts);
+
+  return {
+    ...verifyResult,
+    command: 'verify-governance',
+    generated: generateResult.generated,
+    generateResults: generateResult.results
+  };
+}
+
+module.exports = {
+  runVerifyGovernanceCombined
+};