@aifabrix/builder 2.49.1 → 2.50.0

package/lib/utils/external-system-readiness-compact-display.js

@@ -0,0 +1,324 @@
+/**
+ * Compact TTY status card for external system upload/deploy (plan 156.0).
+ *
+ * @fileoverview Shared formatters + log helpers for compact readiness output
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('./logger');
+const {
+  formatSuccessLine,
+  formatBlockingError,
+  formatWarningLine
+} = require('./cli-test-layout-chalk');
+const { VERDICT } = require('../lifecycle/product-model');
+const {
+  summarizeProbeResults,
+  coerceProbeRunToResultRows,
+  connectivityCheckFailed
+} = require('./external-system-readiness-core');
+const { getAuthMethodFromAuthentication } = require('./authentication-shape');
+
+const PILLAR_LABELS = Object.freeze({
+  operations: 'Operations',
+  trust: 'AI Trust',
+  governance: 'Governance'
+});
+
+/**
+ * @param {string|null|undefined} status
+ * @returns {string}
+ */
+function formatLifecycleLabel(status) {
+  const raw = String(status || 'unknown').trim().toLowerCase();
+  if (!raw || raw === 'unknown') return 'Unknown';
+  return raw.charAt(0).toUpperCase() + raw.slice(1);
+}
+
+/**
+ * @param {string[]} keys
+ * @param {number} [maxShow]
+ * @returns {string}
+ */
+function truncateKeyList(keys, maxShow = 3) {
+  if (!Array.isArray(keys) || keys.length === 0) return '';
+  if (keys.length <= maxShow + 1) return keys.join(', ');
+  const shown = keys.slice(0, maxShow);
+  return `${shown.join(', ')}, +${keys.length - maxShow} more`;
+}
+
+/**
+ * @param {{ pushed?: number, keys?: string[], maxKeys?: number }} opts
+ * @returns {string|null}
+ */
+function formatCredentialPushLine(opts = {}) {
+  const pushed = opts.pushed || 0;
+  if (pushed <= 0) return null;
+  const keys = truncateKeyList(opts.keys || [], opts.maxKeys ?? 3);
+  const suffix = keys ? ` (${keys})` : '';
+  return formatSuccessLine(`Credentials: ${pushed} secret(s) pushed${suffix}`);
+}
+
+/**
+ * @param {{ count?: number, names?: string[] }} opts
+ * @returns {string|null}
+ */
+function formatConfigResolveLine(opts = {}) {
+  const count = opts.count || 0;
+  if (count <= 0) return null;
+  const names = (opts.names || []).join(', ');
+  const suffix = names ? ` (${names})` : '';
+  return formatSuccessLine(`Config: ${count} parameter(s) stored${suffix}`);
+}
+
+/**
+ * @param {{ method?: string }} opts
+ * @returns {string}
+ */
+function formatAuthenticationSummary(opts = {}) {
+  const method = opts.method && String(opts.method).trim() ? String(opts.method) : 'unknown';
+  return `Authentication: ${method}`;
+}
+
+/**
+ * Resolves method from a single auth block, authentications[] row, or legacy flat shape.
+ * @param {Object|Array|null|undefined} authBlock
+ * @returns {string}
+ */
+function resolveAuthMethodFromBlock(authBlock) {
+  if (!authBlock) {
+    return '';
+  }
+  if (Array.isArray(authBlock)) {
+    const primary =
+      authBlock.find((row) => row && (row.usage === 'api' || row.key === 'default')) ||
+      authBlock[0];
+    return resolveAuthMethodFromBlock(primary);
+  }
+  if (typeof authBlock !== 'object') {
+    return '';
+  }
+  if (authBlock.authType === 'none') {
+    return 'none';
+  }
+  if (authBlock.authType === 'apiProvider') {
+    return 'apiprovider';
+  }
+  return getAuthMethodFromAuthentication(authBlock);
+}
+
+/**
+ * True when the argument is an auth block, not a full manifest.system object.
+ * @param {Object} value
+ * @returns {boolean}
+ */
+function looksLikeAuthBlock(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return Array.isArray(value);
+  }
+  if (value.authType !== undefined || value.credential !== undefined) {
+    return true;
+  }
+  return value.method !== undefined && value.displayName === undefined && value.key === undefined;
+}
+
+/**
+ * @param {Object|null|undefined} systemCfg - manifest.system (or legacy auth block)
+ * @returns {string}
+ */
+function resolveManifestAuthMethod(systemCfg) {
+  if (!systemCfg || typeof systemCfg !== 'object') {
+    return 'unknown';
+  }
+  if (looksLikeAuthBlock(systemCfg)) {
+    const method = resolveAuthMethodFromBlock(systemCfg);
+    return method || 'unknown';
+  }
+  const fromLegacy = resolveAuthMethodFromBlock(systemCfg.authentication);
+  if (fromLegacy) {
+    return fromLegacy;
+  }
+  const slots = systemCfg.authentications;
+  if (Array.isArray(slots) && slots.length > 0) {
+    const apiSlot =
+      slots.find((row) => row && (row.usage === 'api' || row.key === 'default')) || slots[0];
+    const fromSlot = resolveAuthMethodFromBlock(apiSlot);
+    if (fromSlot) {
+      return fromSlot;
+    }
+  }
+  return 'unknown';
+}
+
+/**
+ * @param {{ status?: string, systemFromDataplane?: Object, publication?: Object }} opts
+ * @returns {string}
+ */
+function resolveConnectedSystemStatus(opts = {}) {
+  const fromPub = opts.publication?.system?.status;
+  const fromGet = opts.systemFromDataplane?.status;
+  return formatLifecycleLabel(fromGet || fromPub || opts.status);
+}
+
+/**
+ * @param {{ ready?: number, partial?: number, failed?: number, mcp?: boolean }} opts
+ * @returns {string}
+ */
+function formatDatasourceAggregateLine(opts = {}) {
+  const ready = opts.ready ?? 0;
+  const partial = opts.partial ?? 0;
+  const failed = opts.failed ?? 0;
+  const mcpSuffix = opts.mcp === false ? '' : ' (MCP)';
+  let line = `Datasources: ${ready} ready`;
+  if (partial > 0) line += ` · ${partial} partial`;
+  if (failed > 0) line += ` · ${failed} failed`;
+  return line + mcpSuffix;
+}
+
+/**
+ * @param {{ failed?: number, partial?: number }} summary
+ * @returns {'passed'|'partial'|'failed'}
+ */
+function runtimeVerdictFromProbeSummary(summary) {
+  if ((summary.failed || 0) > 0) return 'failed';
+  if ((summary.partial || 0) > 0) return 'partial';
+  return 'passed';
+}
+
+/**
+ * @param {{ probeData?: Object }} opts
+ * @returns {{ runtimeVerdict: string, connectivityPassed: boolean, summary: Object, results: Object[] }|null}
+ */
+function buildProbeCompactContext(opts = {}) {
+  if (!opts.probeData) return null;
+  const results = coerceProbeRunToResultRows(opts.probeData);
+  const summary = summarizeProbeResults(results);
+  return {
+    runtimeVerdict: runtimeVerdictFromProbeSummary(summary),
+    connectivityPassed: !connectivityCheckFailed(results),
+    summary,
+    results
+  };
+}
+
+/**
+ * @param {{ issues?: Array<{ key: string, lines: string[] }>, maxKeys?: number }} opts
+ * @returns {string[]}
+ */
+function formatRuntimeDatasourceIssues(opts = {}) {
+  const issues = opts.issues || [];
+  const max = opts.maxKeys ?? 3;
+  const lines = [];
+  for (let i = 0; i < issues.length && i < max; i += 1) {
+    const item = issues[i];
+    const tier = item.tier || 'Partial';
+    const msg = item.lines?.[0] || 'check failed';
+    lines.push(`${tier}: ${item.key} — ${msg}`);
+  }
+  if (issues.length > max) {
+    lines.push(`+${issues.length - max} more datasource issue(s) — use -v`);
+  }
+  return lines;
+}
+
+/**
+ * @param {{ pillar?: string, verdict?: string, percent?: number, scenariosPassed?: number, scenariosTotal?: number }} opts
+ * @returns {string}
+ */
+function formatGatePillarLine(opts = {}) {
+  const label = PILLAR_LABELS[opts.pillar] || opts.pillar || 'Gate';
+  const verdict = opts.verdict || VERDICT.NOT_VERIFIED;
+  let suffix = '';
+  if (typeof opts.percent === 'number' && Number.isFinite(opts.percent)) {
+    suffix = ` (${Math.round(opts.percent)}%)`;
+  } else if (
+    typeof opts.scenariosPassed === 'number'
+    && typeof opts.scenariosTotal === 'number'
+    && opts.scenariosTotal > 0
+  ) {
+    suffix = ` (${opts.scenariosPassed}/${opts.scenariosTotal} scenarios)`;
+  }
+  if (verdict === VERDICT.VERIFIED) {
+    return formatSuccessLine(`${label} · VERIFIED${suffix}`);
+  }
+  if (verdict === VERDICT.FAILED) {
+    return formatBlockingError(`${label} · FAILED${suffix}`);
+  }
+  return formatWarningLine(`${label} · NOT VERIFIED${suffix}`);
+}
+
+/**
+ * @param {{ unitPassed?: boolean, integrationPassed?: boolean }} opts
+ * @returns {string|null}
+ */
+function formatPreflightLine(opts = {}) {
+  if (opts.unitPassed === false || opts.integrationPassed === false) {
+    return formatBlockingError('Preflight: unit or integration failed');
+  }
+  if (opts.unitPassed !== false && opts.integrationPassed !== false) {
+    return formatSuccessLine('Preflight: unit + integration');
+  }
+  return null;
+}
+
+/**
+ * @param {{ command: 'upload'|'deploy', systemKey: string, environment?: string, dataplaneUrl?: string }} opts
+ */
+function logCompactHeader(opts) {
+  const host = opts.dataplaneUrl
+    ? String(opts.dataplaneUrl).replace(/^https?:\/\//, '').replace(/\/+$/, '')
+    : '(unknown)';
+  const env = opts.environment || 'dev';
+  const label = String(opts.command || 'upload').toUpperCase();
+  logger.log('');
+  logger.log(chalk.bold(`  ${label}  ${opts.systemKey}  →  ${env}  @  ${host}`));
+  logger.log('');
+}
+
+/**
+ * @param {{ dataplaneUrl?: string, systemKey: string }} opts
+ */
+function logCompactPortalLinks(opts) {
+  const base = opts.dataplaneUrl ? String(opts.dataplaneUrl).replace(/\/+$/, '') : '';
+  if (!base) return;
+  logger.log(`  Portal: ${base}/connected-systems/${encodeURIComponent(opts.systemKey)}`);
+  logger.log(
+    `  MCP:    ${base}/api/v1/mcp/servers/tools?filter=systemKey:eq:${encodeURIComponent(opts.systemKey)}`
+  );
+}
+
+/**
+ * @param {{ systemKey: string, command: 'upload'|'deploy', probed?: boolean }} opts
+ */
+function logCompactTip(opts) {
+  const cmd = opts.command === 'deploy' ? 'deploy' : 'upload';
+  const probeHint = opts.probed
+    ? ''
+    : `af ${cmd} ${opts.systemKey} --probe for runtime check   ·   `;
+  logger.log(`  Tip: ${probeHint}-v for full report`);
+}
+
+module.exports = {
+  PILLAR_LABELS,
+  formatLifecycleLabel,
+  truncateKeyList,
+  formatCredentialPushLine,
+  formatConfigResolveLine,
+  formatAuthenticationSummary,
+  resolveManifestAuthMethod,
+  resolveAuthMethodFromBlock,
+  resolveConnectedSystemStatus,
+  formatDatasourceAggregateLine,
+  formatGatePillarLine,
+  formatPreflightLine,
+  formatRuntimeDatasourceIssues,
+  runtimeVerdictFromProbeSummary,
+  buildProbeCompactContext,
+  logCompactHeader,
+  logCompactPortalLinks,
+  logCompactTip
+};

package/lib/utils/external-system-readiness-core.js

@@ -116,6 +116,9 @@ function summarizeDatasourceTiersA(datasources, generateMcpContract) {
     if (detail.tier === 'partial' && detail.partialReason) {
       row.partialReason = detail.partialReason;
     }
+    if (detail.tier === 'ready' && generateMcpContract === true && ds.mcpContract) {
+      row.mcpReady = true;
+    }
     rows.push(row);
     if (detail.tier === 'ready') ready += 1;
     else if (detail.tier === 'partial') partial += 1;
@@ -317,6 +320,18 @@ function coerceProbeRunToResultRows(probeRaw) {
   return [];
 }
 
+/**
+ * @param {Object[]} results - Probe result rows
+ * @returns {boolean}
+ */
+function connectivityCheckFailed(results) {
+  return (results || []).some(
+    row =>
+      row?.endpointTestResults?.success === false
+      || row?.endpointTestResults?.endpointReachable === false
+  );
+}
+
 /**
  * @param {Array<Object>} results - ExternalSystemTestResponse.results
  * @returns {{ rows: Array<{ key: string, tier: string }>, ready: number, partial: number, failed: number, issues: Array<{ key: string, lines: string[] }> }}
@@ -448,6 +463,7 @@ module.exports = {
   summarizeDatasourceTiersA,
   aggregateVerdictFromCounts,
   classifyDatasourceTierB,
+  connectivityCheckFailed,
   summarizeProbeResults,
   coerceProbeRunToResultRows,
   isDatasourceTestRunEnvelope,

package/lib/utils/external-system-readiness-deploy-display.js

@@ -28,6 +28,8 @@ const {
   logDocsBlock,
   logNextActions
 } = require('./external-system-readiness-display-internals');
+const { logDeployReadinessSummaryCompact } = require('./external-system-readiness-compact-blocks');
+const { resolveManifestAuthMethod } = require('./external-system-readiness-compact-display');
 
 /**
  * @param {Array<Object>|undefined} dsFromCtx
@@ -179,7 +181,7 @@ function logDeployConfigDeploymentRuntime(systemCfg, deploymentOk, probeData, su
   logger.log(verdictLine(verdict));
   logSectionTitle('Config:');
   logger.log(formatSuccessLine('Manifest valid'));
-  const method = systemCfg.authentication?.method || 'unknown';
+  const method = resolveManifestAuthMethod(systemCfg);
   logger.log(formatSuccessLine(`Authentication configured (${method})`));
   logDeployDeploymentSubsection(deploymentOk, deploymentDetail);
   logSectionTitle('Runtime:');
@@ -215,17 +217,8 @@ function logDeployIdentityAndCredentialBlocks(systemCfg, withProbe) {
 
 /**
  * @param {Object} ctx
- * @param {string} ctx.environment
- * @param {string} ctx.dataplaneUrl
- * @param {Object} ctx.manifest
- * @param {Array<Object>} [ctx.datasources]
- * @param {Object|null} ctx.systemFromDataplane
- * @param {Error|null} ctx.fetchError
- * @param {boolean} ctx.deploymentOk
- * @param {Object|null} [ctx.deploymentDetail]
- * @param {Object|null} ctx.probeData
  */
-function logDeployReadinessSummary(ctx) {
+function logDeployReadinessSummaryVerbose(ctx) {
   const {
     environment,
     dataplaneUrl,
@@ -264,6 +257,31 @@ function logDeployReadinessSummary(ctx) {
   logDeployNextActionsSection(systemKey, probeData, summary, genMcp);
 }
 
+/**
+ * @param {Object} ctx
+ * @param {string} ctx.environment
+ * @param {string} ctx.dataplaneUrl
+ * @param {Object} ctx.manifest
+ * @param {Array<Object>} [ctx.datasources]
+ * @param {Object|null} ctx.systemFromDataplane
+ * @param {Error|null} ctx.fetchError
+ * @param {boolean} ctx.deploymentOk
+ * @param {Object|null} [ctx.deploymentDetail]
+ * @param {Object|null} ctx.probeData
+ * @param {boolean} [ctx.verbose] - Expanded summary when true
+ * @param {Object} [ctx.gateOutcomes] - Preflight + optional gate results for compact card
+ * @param {Object} [ctx.credentialPush]
+ * @param {Object} [ctx.configPush]
+ * @param {string|null} [ctx.draftDeploymentId]
+ */
+function logDeployReadinessSummary(ctx) {
+  if (ctx.verbose !== true) {
+    logDeployReadinessSummaryCompact(ctx);
+    return;
+  }
+  logDeployReadinessSummaryVerbose(ctx);
+}
+
 module.exports = {
   logDeployReadinessSummary
 };

package/lib/utils/external-system-readiness-display-internals.js

@@ -63,7 +63,9 @@ function logDatasourceTable(rows, counts, title) {
     const hint =
       r.tier === 'partial' && r.partialReason
         ? chalk.gray(` — ${formatTierAPartialHint(r.partialReason)}`)
-        : '';
+        : r.mcpReady === true
+          ? chalk.gray(' — MCP ready')
+          : '';
     logger.log(
       `${tierGlyph(r.tier)} ${r.key.padEnd(14, ' ')} ${chalk.gray('(' + statusLabel + ')')}${hint}`
     );

package/lib/utils/external-system-readiness-display.js

@@ -14,8 +14,10 @@ const {
   summarizeDatasourceTiersA,
   summarizeProbeResults,
   buildNextActionsTierA,
-  coerceProbeRunToResultRows
+  coerceProbeRunToResultRows,
+  connectivityCheckFailed
 } = require('./external-system-readiness-core');
+const { logUploadReadinessSummaryCompact } = require('./external-system-readiness-compact-blocks');
 const {
   logSeparator,
   logSectionTitle,
@@ -56,20 +58,6 @@ function logPublishResultBlock(publication) {
   }
 }
 
-/**
- * @param {string} systemKey
- * @param {{ ready: number, partial: number, failed: number }} summary
- * @param {boolean} willProbe
- */
-function logUploadReadinessSummaryMinimal(systemKey, summary, willProbe) {
-  logger.log(chalk.green(`\nUpload complete: ${systemKey}`));
-  logger.log(
-    chalk.gray('Summary:') +
-      ` ${chalk.green('Ready: ' + summary.ready)} · ${chalk.yellow('Partial: ' + summary.partial)} · ${chalk.red('Failed: ' + summary.failed)}`
-  );
-  if (!willProbe) logger.log(chalk.gray('Use --probe for runtime verification'));
-}
-
 /**
  * @param {string} systemKey
  * @param {Object} publication
@@ -101,15 +89,29 @@ function logUploadReadinessSummaryExpanded(systemKey, publication, manifest, sum
  * @param {string} ctx.systemKey
  * @param {Object} ctx.publication - PublicationResult
  * @param {Object} ctx.manifest
- * @param {boolean} [ctx.minimal] - One-line summary + probe hint only
+ * @param {boolean} [ctx.minimal] - Compact status card (default when not verbose)
  * @param {boolean} [ctx.willProbe] - True when caller will run --probe immediately after this summary
+ * @param {Object|null} [ctx.probeData] - Probe payload when already run (compact path)
+ * @param {Object} [ctx.credentialPush] - Credential push summary for compact card
+ * @param {Object} [ctx.configPush] - Config store summary for compact card
+ * @param {boolean} [ctx.forcePublish] - Show forced publish warning in compact card
  */
 function logUploadReadinessSummary(ctx) {
-  const { systemKey, publication, manifest, minimal, willProbe } = ctx;
+  const { systemKey, publication, manifest, minimal, willProbe, environment, dataplaneUrl } = ctx;
   const genMcp = publication.generateMcpContract === true;
   const summary = summarizeDatasourceTiersA(publication.datasources || [], genMcp);
   if (minimal) {
-    logUploadReadinessSummaryMinimal(systemKey, summary, willProbe);
+    logUploadReadinessSummaryCompact({
+      systemKey,
+      environment,
+      dataplaneUrl,
+      publication,
+      manifest,
+      credentialPush: ctx.credentialPush,
+      configPush: ctx.configPush,
+      forcePublish: ctx.forcePublish === true,
+      probeData: ctx.probeData || null
+    });
     return;
   }
   logUploadReadinessSummaryExpanded(systemKey, publication, manifest, summary, genMcp, willProbe);
@@ -128,18 +130,6 @@ function logServerValidationWarnings(validationBody) {
   }
 }
 
-/**
- * @param {Object[]} results - Probe result rows
- * @returns {boolean}
- */
-function connectivityCheckFailed(results) {
-  return results.some(
-    row =>
-      row?.endpointTestResults?.success === false
-      || row?.endpointTestResults?.endpointReachable === false
-  );
-}
-
 /**
  * @param {Object} results - Probe result rows
  * @param {Object} summary - summarizeProbeResults output

package/lib/utils/external-system-system-test-tty-certification.js

@@ -0,0 +1,135 @@
+/**
+ * @fileoverview Plan §17 certification TTY block (split for file-size limits).
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('./logger');
+const { SEP } = require('./datasource-test-run-display');
+const { sectionTitle, metadata: metaGray } = require('./cli-test-layout-chalk');
+const { certificationOutputFromEnvelope } = require('./datasource-test-run-certification-debug');
+
+function certificateBucket(env) {
+  const cert = env && env.certificate;
+  if (!cert || typeof cert !== 'object') return { status: null, level: null };
+  return {
+    status: cert.status ? String(cert.status) : null,
+    level: cert.level ? String(cert.level) : null
+  };
+}
+
+function systemCertStatus(rows) {
+  const certs = rows
+    .map(r => (r && r.datasourceTestRun ? certificateBucket(r.datasourceTestRun) : { status: null, level: null }))
+    .filter(c => c.status !== null);
+  if (certs.length === 0) return null;
+  if (certs.some(c => c.status === 'not_passed')) return 'not_passed';
+  return 'passed';
+}
+
+function filterIssuanceFailureRows(rows) {
+  return rows.filter(r => {
+    const ci = r && r.datasourceTestRun && r.datasourceTestRun.certificateIssuance;
+    return ci && typeof ci === 'object' && String(ci.status || '') === 'failed';
+  });
+}
+
+function filterCertificationOutputRows(rows) {
+  return rows.filter(r => {
+    const out = certificationOutputFromEnvelope(r && r.datasourceTestRun);
+    return out && typeof out === 'object';
+  });
+}
+
+function logCertificationBreakdown(rows) {
+  logger.log('');
+  logger.log(chalk.white('Breakdown:'));
+  for (const r of rows) {
+    const env = r && r.datasourceTestRun;
+    if (!env) continue;
+    const cert = certificateBucket(env);
+    if (!cert.status) continue;
+    const g = cert.status === 'passed' ? '✔' : '✖';
+    const tier = cert.level ? cert.level : '(no level)';
+    logger.log(chalk.white(`- ${env.datasourceKey}: ${g} ${tier}`));
+  }
+}
+
+function logIssuanceFailures(issuanceRows) {
+  logger.log('');
+  logger.log(chalk.white('Certificate issuance failures:'));
+  for (const r of issuanceRows) {
+    const env = r.datasourceTestRun;
+    const ci = env.certificateIssuance;
+    const reason = ci.reasonCode ? ` (${ci.reasonCode})` : '';
+    logger.log(chalk.white(`- ${env.datasourceKey}: ✖ ${ci.status || 'failed'}${reason}`));
+    if (ci.message) logger.log(chalk.yellow(`    ${String(ci.message)}`));
+  }
+}
+
+function logBlockers(out) {
+  const blockers = Array.isArray(out.blockers) ? out.blockers : [];
+  const cap = Math.min(3, blockers.length);
+  for (let i = 0; i < cap; i += 1) {
+    const b = blockers[i];
+    const code = b && b.code ? String(b.code) : '';
+    const msg = b && b.message ? String(b.message) : '';
+    const tail = [code, msg].filter(Boolean).join(' — ');
+    if (tail) logger.log(chalk.yellow(`    • ${tail}`));
+  }
+}
+
+function logEngineDebugRow(env, out) {
+  const passed = out.passed === true;
+  const level = out.level ? String(out.level) : '';
+  const glyph = passed ? '✔' : '✖';
+  logger.log(
+    chalk.white(`- ${env.datasourceKey}: ${glyph} ${passed ? 'passed' : 'not passed'}${level ? ` (${level})` : ''}`)
+  );
+  logBlockers(out);
+}
+
+function logCertificationEngineDebug(outputRows) {
+  logger.log('');
+  logger.log(chalk.white('Certification engine (debug):'));
+  for (const r of outputRows) {
+    const env = r.datasourceTestRun;
+    const out = certificationOutputFromEnvelope(env);
+    if (!out) continue;
+    logEngineDebugRow(env, out);
+  }
+}
+
+function logCertificationSection(rows, opts = {}) {
+  const certSt = systemCertStatus(rows);
+  const showIssuance = Boolean(opts.debug) || Boolean(opts.verbose);
+  const issuanceRows = filterIssuanceFailureRows(rows);
+  const outputRows = filterCertificationOutputRows(rows);
+  if (!certSt && issuanceRows.length === 0 && outputRows.length === 0) return;
+
+  logger.log('');
+  logger.log(metaGray(SEP));
+  logger.log('');
+  logger.log(sectionTitle('Certification:'));
+
+  if (certSt) {
+    logger.log('');
+    logger.log(chalk.white(`System level: ${certSt === 'passed' ? '✔ Achieved' : '✖ Not achieved'}`));
+    logCertificationBreakdown(rows);
+  }
+
+  if (showIssuance && issuanceRows.length > 0) {
+    logIssuanceFailures(issuanceRows);
+  }
+
+  if (showIssuance && outputRows.length > 0) {
+    logCertificationEngineDebug(outputRows);
+  }
+}
+
+module.exports = {
+  certificateBucket,
+  systemCertStatus,
+  logCertificationSection
+};