@aifabrix/builder 2.49.2 → 2.50.0

package/lib/commands/upload.js

@@ -1,7 +1,6 @@
 const {
   formatSuccessLine,
   formatWarningLine,
-  formatProgress,
   sectionTitle,
   headerKeyValue,
   metadata
@@ -15,7 +14,6 @@ const {
  * @version 2.0.0
  */
 
-const path = require('path');
 const chalk = require('chalk');
 const logger = require('../utils/logger');
 
@@ -23,38 +21,32 @@ const SEP = chalk.gray('──────────────────
 const { resolveControllerUrl } = require('../utils/controller-url');
 const { getDeploymentAuth } = require('../utils/token-manager');
 const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
-const { getIntegrationPath } = require('../utils/paths');
-const { pushCredentialSecrets } = require('../utils/credential-secrets-env');
-const { runWithCredentialPushSpinner } = require('../utils/credential-push-ui');
+const { resolveExternalSystemPath } = require('../utils/app-path-resolve');
 const { runWithUploadPipelineSpinner } = require('../utils/upload-pipeline-ui');
 const {
   buildResolvedEnvMapForIntegration,
-  resolveConfigurationValues,
-  collectResolvedVariableConfigurationNames
+  resolveConfigurationValues
 } = require('../utils/configuration-env-resolver');
-const { pushRuntimeConfigurationValues } = require('../utils/runtime-configuration-values');
 const { validateExternalSystemComplete } = require('../validation/validate');
 const { displayValidationResults } = require('../validation/validate-display');
 const { generateControllerManifest } = require('../generator/external-controller-manifest');
 const {
-  validatePipelineConfig,
-  testSystemViaPipeline
+  validatePipelineConfig
 } = require('../api/pipeline.api');
 const { uploadApplicationViaPipelineWithAuthRetry } = require('../utils/pipeline-upload-auth-retry');
 const { formatApiError } = require('../utils/api-error-handler');
 const { unwrapPublicationResult, unwrapApiData, isPublicationUnchanged } = require('../utils/external-system-readiness-core');
 const {
-  logServerValidationWarnings,
-  logProbeRuntimeBlock
+  logServerValidationWarnings
 } = require('../utils/external-system-readiness-display');
+const { maybeRunUploadProbe } = require('./upload-probe');
 const { maybeSyncOpenApiFilesForMcp } = require('./repair-openapi-sync');
+const { exportProgrammaticOpenApiForRepair } = require('./repair-openapi-export');
 const { resolveUploadPublishContext } = require('./upload-publish-context');
 const { syncDeployJsonFromSources } = require('../external-system/sync-deploy-manifest');
-const { isQuietMinimalSync } = require('../utils/upload-sync-options');
-const {
-  runUploadSidecarFollowups,
-  handlePublicationAndFollowups
-} = require('./upload-sidecar-followups');
+const { handlePublicationAndFollowups } = require('./upload-sidecar-followups');
+const { finalizeUploadPublishResult, finishUnchangedUploadPublication } = require('./upload-data-sync-finalize');
+const { pushAndLogCredentialSecrets } = require('./upload-credential-push-log');
 
 /**
  * Validates system-key format (same as download).
@@ -72,21 +64,22 @@ function validateSystemKeyFormat(systemKey) {
 
 /**
  * Builds pipeline upload payload from controller manifest.
- * Payload: { version, application, dataSources, status }; Builder always uses status "draft".
+ * Payload: { version, application, dataSources, status }; upload uses "draft", deploy preflight uses "published".
  * @param {Object} manifest - Controller manifest from generateControllerManifest
- * @returns {Object} { version, application, dataSources, status: "draft" }
+ * @returns {Object} { version, application, dataSources, status }
  */
 /**
  * @param {Object} manifest - Controller manifest from generateControllerManifest
- * @param {{ force?: boolean }} [opts]
+ * @param {{ force?: boolean, status?: 'draft'|'published' }} [opts]
  * @returns {Object}
  */
 function buildUploadPayload(manifest, opts = {}) {
+  const lifecycleStatus = opts.status === 'published' ? 'published' : 'draft';
   const payload = {
     version: manifest.version || '1.0.0',
     application: manifest.system,
     dataSources: manifest.dataSources || [],
-    status: 'draft'
+    status: lifecycleStatus
   };
   if (opts.force === true) {
     payload.force = true;
@@ -101,6 +94,13 @@ function buildUploadPayload(manifest, opts = {}) {
  * @returns {Promise<{ dataplaneUrl: string, authConfig: Object, environment: string }>}
  */
 async function resolveDataplaneAndAuth(systemKey, opts = {}) {
+  if (opts.authConfig && opts.dataplaneUrl && opts.environment) {
+    return {
+      dataplaneUrl: opts.dataplaneUrl,
+      authConfig: opts.authConfig,
+      environment: opts.environment
+    };
+  }
   const silent = opts.silent === true;
   const { resolveEnvironment } = require('../core/config');
   const environment = await resolveEnvironment();
@@ -170,8 +170,11 @@ function throwIfValidationFailed(validationResult) {
  * @param {string} systemKey - System key
  * @param {Object} payload - Upload payload (mutated)
  */
-async function resolvePayloadConfiguration(systemKey, payload) {
-  const { envMap, secrets } = await buildResolvedEnvMapForIntegration(systemKey);
+async function resolvePayloadConfiguration(systemKey, payload, pathOptions = {}) {
+  const { envMap, secrets } = await buildResolvedEnvMapForIntegration(systemKey, {
+    dataplaneRuntime: true,
+    ...pathOptions
+  });
   if (Array.isArray(payload.application?.configuration) && payload.application.configuration.length > 0) {
     resolveConfigurationValues(payload.application.configuration, envMap, secrets, systemKey);
   }
@@ -182,64 +185,6 @@ async function resolvePayloadConfiguration(systemKey, payload) {
   }
 }
 
-/**
- * Pushes credential secrets from .env and payload to dataplane; logs result or warning.
- * @param {string} dataplaneUrl - Dataplane URL
- * @param {Object} authConfig - Auth config
- * @param {string} systemKey - System key
- * @param {Object} payload - Upload payload
- */
-async function pushAndLogCredentialSecrets(dataplaneUrl, authConfig, systemKey, payload, uiOpts = {}) {
-  const envFilePath = path.join(getIntegrationPath(systemKey), '.env');
-  const pushResult = await runWithCredentialPushSpinner(
-    () =>
-      pushCredentialSecrets(dataplaneUrl, authConfig, {
-        envFilePath,
-        appName: systemKey,
-        payload
-      }),
-    { systemKey, json: uiOpts.json === true }
-  );
-  if (pushResult.pushed > 0) {
-    const keyList = pushResult.keys?.length ? ` (${pushResult.keys.join(', ')})` : '';
-    logger.log(
-      formatSuccessLine(`Pushed ${pushResult.pushed} credential secret(s) to dataplane${keyList}.`)
-    );
-  } else {
-    logger.log(chalk.yellow('Secret push skipped'));
-  }
-  const resolvedParamNames = collectResolvedVariableConfigurationNames(payload);
-  if (resolvedParamNames.length > 0) {
-    const nameList = ` (${resolvedParamNames.join(', ')})`;
-    logger.log(
-      formatSuccessLine(
-        `Resolved ${resolvedParamNames.length} integration parameter(s) from .env for publish${nameList}.`
-      )
-    );
-  }
-  if (pushResult.warning) {
-    logger.log(chalk.yellow(`Warning: ${pushResult.warning}`));
-  }
-  try {
-    const configPush = await pushRuntimeConfigurationValues(
-      dataplaneUrl,
-      authConfig,
-      systemKey,
-      payload
-    );
-    if (configPush.pushed > 0) {
-      const nameList = configPush.names.length ? ` (${configPush.names.join(', ')})` : '';
-      logger.log(
-        formatSuccessLine(
-          `Stored ${configPush.pushed} runtime configuration value(s) in dataplane${nameList}.`
-        )
-      );
-    }
-  } catch (err) {
-    logger.log(chalk.yellow(`Warning: runtime configuration store skipped: ${err.message}`));
-  }
-}
-
 /**
  * Optional server-side pipeline validate when --verbose.
  * @param {string} dataplaneUrl
@@ -261,46 +206,6 @@ async function maybeRunVerboseServerValidation(dataplaneUrl, authConfig, payload
   logServerValidationWarnings(body);
 }
 
-/**
- * Omit payloadTemplate so POST /validation/run uses the **validation-engine** path
- * (same as deploy --probe). Needed for certification and dataplane auto-issue of integration
- * certificates after a successful run. If RBAC/live checks fail right after upload until the
- * controller syncs permissions, skip --probe or retry once permissions are visible.
- */
-const UPLOAD_PROBE_TEST_DATA = {};
-
-/**
- * Optional POST validation/run after successful upload.
- * @param {string} dataplaneUrl
- * @param {string} systemKey
- * @param {Object} authConfig
- * @param {number|undefined} probeTimeoutMs
- */
-async function maybeRunUploadProbe(dataplaneUrl, systemKey, authConfig, probeTimeoutMs) {
-  logger.log('');
-  logger.log(sectionTitle('Runtime checks (--probe)'));
-  logger.log(SEP);
-  logger.log(formatProgress('Running runtime checks...'));
-  const timeoutMs = probeTimeoutMs === undefined || probeTimeoutMs === null ? 120000 : probeTimeoutMs;
-  try {
-    const pr = await testSystemViaPipeline(
-      dataplaneUrl,
-      systemKey,
-      authConfig,
-      UPLOAD_PROBE_TEST_DATA,
-      { timeout: timeoutMs }
-    );
-    if (pr.success === false) {
-      logger.log(chalk.yellow(`⚠ Probe request failed: ${pr.formattedError || pr.error || 'unknown error'}`));
-      return;
-    }
-    const probeData = unwrapApiData(pr);
-    logProbeRuntimeBlock(probeData, systemKey);
-  } catch (e) {
-    logger.log(chalk.yellow(`⚠ Probe failed: ${e.message}`));
-  }
-}
-
 /**
  * Local validation, manifest, payload, and configuration resolution.
  * Regenerates integration/<systemKey>/<systemKey>-deploy.json from sources (same as `aifabrix json`).
@@ -311,15 +216,22 @@ async function maybeRunUploadProbe(dataplaneUrl, systemKey, authConfig, probeTim
  */
 async function buildValidatedUploadManifestPayload(systemKey, opts = {}) {
   const quiet = opts.minimal === true || opts.quiet === true;
-  const validationResult = await validateExternalSystemComplete(systemKey, { type: 'external' });
+  const pathOptions = opts.pathOptions || {};
+  const validationResult = await validateExternalSystemComplete(systemKey, {
+    type: 'external',
+    ...pathOptions
+  });
   throwIfValidationFailed(validationResult);
   if (!quiet) {
     logger.log(formatSuccessLine('Local validation passed'));
   }
-  await syncDeployJsonFromSources(systemKey, { quiet });
-  const manifest = await generateControllerManifest(systemKey, { type: 'external' });
-  const payload = buildUploadPayload(manifest, { force: opts.force === true });
-  await resolvePayloadConfiguration(systemKey, payload);
+  await syncDeployJsonFromSources(systemKey, { quiet, ...pathOptions });
+  const manifest = await generateControllerManifest(systemKey, { type: 'external', ...pathOptions });
+  const payload = buildUploadPayload(manifest, {
+    force: opts.force === true,
+    status: opts.uploadStatus === 'published' ? 'published' : 'draft'
+  });
+  await resolvePayloadConfiguration(systemKey, payload, pathOptions);
   return { manifest, payload };
 }
 
@@ -334,9 +246,17 @@ async function buildValidatedUploadManifestPayload(systemKey, opts = {}) {
  * @returns {Promise<void>}
  */
 async function logAndSyncLocalOpenApiForUpload(systemKey, manifest, uploadContext = {}) {
-  const appPath = getIntegrationPath(systemKey);
+  const pathOptions = uploadContext.pathOptions || {};
+  const appPath = resolveExternalSystemPath(systemKey, pathOptions);
   const ei = manifest && manifest.externalIntegration;
   const datasourceFiles = ei && Array.isArray(ei.dataSources) ? ei.dataSources : [];
+  await exportProgrammaticOpenApiForRepair({
+    appPath,
+    systemKey,
+    datasourceFiles,
+    dryRun: false,
+    backupCtx: { dryRun: false, changedFiles: [] }
+  });
   const openapiSyncLines = await maybeSyncOpenApiFilesForMcp({
     enabled: true,
     dryRun: false,
@@ -346,11 +266,55 @@ async function logAndSyncLocalOpenApiForUpload(systemKey, manifest, uploadContex
     dataplaneUrl: uploadContext.dataplaneUrl,
     authConfig: uploadContext.authConfig
   });
-  for (const line of openapiSyncLines) {
-    logger.log(line.startsWith('Skipped') ? formatWarningLine(line) : formatSuccessLine(line));
+  if (!uploadContext.quiet) {
+    for (const line of openapiSyncLines) {
+      logger.log(line.startsWith('Skipped') ? formatWarningLine(line) : formatSuccessLine(line));
+    }
   }
 }
 
+/**
+ * @param {string} systemKey
+ * @param {Object} options
+ * @param {Object} manifest
+ * @param {Object} payload
+ * @param {{ dataplaneUrl: string, authConfig: Object, environment: string, rawRes: Object }} ctx
+ */
+async function completeUploadAfterPublish(systemKey, options, manifest, payload, ctx) {
+  const quietCompact = options.minimal === true && options.verbose !== true;
+  const pushMeta = await pushAndLogCredentialSecrets(ctx.dataplaneUrl, ctx.authConfig, systemKey, payload, {
+    json: options.json === true,
+    pathOptions: options.pathOptions,
+    suppressCredentialLog: quietCompact
+  });
+  await logAndSyncLocalOpenApiForUpload(systemKey, manifest, {
+    dataplaneUrl: ctx.dataplaneUrl,
+    authConfig: ctx.authConfig,
+    pathOptions: options.pathOptions,
+    quiet: quietCompact
+  });
+  await handlePublicationAndFollowups(
+    {
+      systemKey,
+      options,
+      manifest,
+      payload,
+      environment: ctx.environment,
+      dataplaneUrl: ctx.dataplaneUrl,
+      authConfig: ctx.authConfig,
+      rawRes: ctx.rawRes,
+      credentialPush: pushMeta.credentialPush,
+      configPush: pushMeta.configPush
+    },
+    maybeRunUploadProbe
+  );
+  return finalizeUploadPublishResult(
+    { dataplaneUrl: ctx.dataplaneUrl, authConfig: ctx.authConfig, environment: ctx.environment, uploadSkipped: false },
+    payload,
+    options
+  );
+}
+
 /**
  * Upload path after dry-run check.
  * @param {string} systemKey
@@ -377,37 +341,22 @@ async function runUploadPublishAndSummary(systemKey, options, manifest, payload)
   );
   const publication = unwrapPublicationResult(rawRes);
   if (isPublicationUnchanged(publication)) {
-    if (!isQuietMinimalSync(options)) {
-      logger.log(formatSuccessLine('Config unchanged on dataplane — upload skipped.'));
-    }
-    await runUploadSidecarFollowups({
+    return finishUnchangedUploadPublication({
       systemKey,
       options,
       payload,
       dataplaneUrl,
-      authConfig
+      authConfig,
+      environment
     });
-    return { dataplaneUrl, authConfig, environment, uploadSkipped: true };
   }
 
-  await pushAndLogCredentialSecrets(dataplaneUrl, authConfig, systemKey, payload, {
-    json: options.json === true
+  return completeUploadAfterPublish(systemKey, options, manifest, payload, {
+    dataplaneUrl,
+    authConfig,
+    environment,
+    rawRes
   });
-  await logAndSyncLocalOpenApiForUpload(systemKey, manifest, { dataplaneUrl, authConfig });
-  await handlePublicationAndFollowups(
-    {
-      systemKey,
-      options,
-      manifest,
-      payload,
-      environment,
-      dataplaneUrl,
-      authConfig,
-      rawRes
-    },
-    maybeRunUploadProbe
-  );
-  return { dataplaneUrl, authConfig, environment, uploadSkipped: false };
 }
 
 /**
@@ -415,16 +364,23 @@ async function runUploadPublishAndSummary(systemKey, options, manifest, payload)
  * @param {string} systemKey - External system key (integration/<systemKey>/)
  * @param {Object} [options] - Options
  * @param {boolean} [options.dryRun] - Validate and build payload only; no API calls
- * @param {boolean} [options.verbose] - POST pipeline/validate for server warnings
+ * @param {boolean} [options.verbose] - Expanded summary and server-side pipeline validate warnings
  * @param {boolean} [options.probe] - POST validation/run after publish
  * @param {number} [options.probeTimeout] - Probe timeout ms (default 120000)
- * @param {boolean} [options.minimal] - Short summary only
+ * @param {boolean} [options.minimal] - Short summary (default: compact unless --verbose)
  * @returns {Promise<{ dataplaneUrl: string, authConfig: Object, environment: string }|void>}
  * @throws {Error} If validation or API calls fail
  */
 async function uploadExternalSystem(systemKey, options = {}) {
   validateSystemKeyFormat(systemKey);
-  const minimal = options.minimal === true;
+  const pathOptions = options.pathOptions || {};
+  const minimal =
+    options.minimal === true
+      ? true
+      : options.minimal === false
+        ? false
+        : options.verbose !== true;
+  const uploadOptions = { ...options, minimal };
   if (!minimal) {
     logger.log('');
     logger.log(sectionTitle('Upload external system'));
@@ -434,7 +390,9 @@ async function uploadExternalSystem(systemKey, options = {}) {
   const { manifest, payload } = await buildValidatedUploadManifestPayload(systemKey, {
     dryRun: !!options.dryRun,
     force: options.force === true,
-    minimal
+    minimal,
+    pathOptions,
+    uploadStatus: options.uploadStatus
   });
   if (options.dryRun) {
     logger.log(chalk.yellow('Dry run: would upload payload (no API calls).'));
@@ -443,11 +401,12 @@ async function uploadExternalSystem(systemKey, options = {}) {
     );
     return undefined;
   }
-  return runUploadPublishAndSummary(systemKey, options, manifest, payload);
+  return runUploadPublishAndSummary(systemKey, uploadOptions, manifest, payload);
 }
 
 module.exports = {
   uploadExternalSystem,
+  buildValidatedUploadManifestPayload,
   buildUploadPayload,
   resolveDataplaneAndAuth,
   runUploadValidatePublish,

package/lib/commands/verify-governance-combined-external.js

@@ -36,7 +36,7 @@ async function runVerifyGovernanceCombined(systemKey, options = {}) {
 
   const pipelineOpts = {
     ...options,
-    noSync: true,
+    noPublish: true,
     authConfig,
     dataplaneUrl
   };

package/lib/commands/verify-governance-db.js

@@ -10,7 +10,7 @@ const {
 } = require('./test-e2e-external');
 const { runDatasourceGovernanceScenarios, getDatasourceGovernancePack } = require('../api/governance-scenario-pack.api');
 const { resolveIntegrationAuth } = require('../external-system/integration-auth-context');
-const { cliOptsSkipSync } = require('../utils/cli-sync-options');
+const { cliOptsSkipPublish } = require('../utils/cli-sync-options');
 const { VERDICT } = require('../lifecycle/product-model');
 const { runWithVerifyStepProgress } = require('../lifecycle/verify-step-progress');
 
@@ -81,7 +81,7 @@ async function runVerifyGovernanceFromDbPacks(systemKey, options) {
     return { resolvedKey, datasourceRows: [] };
   }
 
-  if (!cliOptsSkipSync(options)) {
+  if (!cliOptsSkipPublish(options)) {
     const uploadCtx = await syncLocalIfRequested(resolvedKey, options);
     attachUploadAuthToOptions(options, uploadCtx);
   }

package/lib/commands/verify-operations-command-action.js

@@ -8,7 +8,7 @@
 
 const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
-const { cliOptsSkipSync } = require('../utils/cli-sync-options');
+const { cliOptsSkipPublish } = require('../utils/cli-sync-options');
 const { runVerifyOperationsForExternalSystem } = require('./verify-operations-external');
 const { displayVerifyOperationsTTY } = require('../lifecycle/report-display');
 const { exitCodeFromVerdict } = require('../lifecycle/exit-codes');
@@ -27,7 +27,7 @@ function normalizeVerifyOperationsCliOptions(options, cmd) {
     verbose: options.verbose === true || has('-v') || has('--verbose'),
     debug: options.debug === true || has('-d') || has('--debug'),
     json: options.json === true || has('--json'),
-    noSync: cliOptsSkipSync(options, cmd),
+    noPublish: cliOptsSkipPublish(options, cmd),
     continue: options.continue === true || has('--continue'),
     async: options.async !== false
   };

package/lib/commands/verify-operations-step-plan.js

@@ -33,7 +33,7 @@ function buildOperationsVerifyStepPlan(systemKey, options) {
         run: () =>
           testExternalSystemIntegration(systemKey, {
             environment: options.env,
-            noSync: true,
+            noPublish: true,
             verbose: false,
             debug: options.debug === true
           }),
@@ -45,7 +45,7 @@ function buildOperationsVerifyStepPlan(systemKey, options) {
       run: (progress) =>
         runTestE2EForExternalSystem(systemKey, {
           env: options.env,
-          noSync: true,
+          noPublish: true,
           verbose: false,
           debug: options.debug === true,
           async: options.async !== false,

package/lib/commands/verify-operations-steps.js

@@ -5,7 +5,7 @@
 'use strict';
 
 const { syncLocalIfRequested } = require('./test-e2e-external');
-const { cliOptsSkipSync } = require('../utils/cli-sync-options');
+const { cliOptsSkipPublish } = require('../utils/cli-sync-options');
 const { buildOperationsVerifyStepPlan } = require('./verify-operations-step-plan');
 const { runWithVerifyStepProgress } = require('../lifecycle/verify-step-progress');
 
@@ -86,7 +86,7 @@ async function runOperationsVerifySteps(systemKey, options) {
     }
   }
 
-  if (!cliOptsSkipSync(options)) {
+  if (!cliOptsSkipPublish(options)) {
     const uploadCtx = await syncLocalIfRequested(systemKey, options);
     attachUploadAuthToOptions(options, uploadCtx);
   }

package/lib/commands/verify-trust-command-action.js

@@ -28,7 +28,7 @@ async function runVerifyTrustCommandAction(appName, options, cmd) {
     env: opts.env,
     verbose: opts.verbose,
     debug: opts.debug,
-    noSync: opts.noSync === true,
+    noPublish: opts.noPublish === true,
     revalidate: opts.revalidate === true,
     timeout: opts.timeout
   });

package/lib/commands/wizard-core.js

@@ -468,7 +468,7 @@ async function handleFileSaving(appName, systemConfig, datasourceConfigs, system
   const spinner = ora('Saving files...').start();
   try {
     const config = require('../core/config');
-    const format = (await config.getFormat()) || 'yaml';
+    const format = ctx?.format || (await config.getFormat()) || 'yaml';
     const generatedFiles = await generateWizardFiles(appName, systemConfig, datasourceConfigs, systemKey, { aiGeneratedReadme: null, format });
     if (enableRBAC && generatedFiles.appPath && generatedFiles.systemFilePath) {
       try {

package/lib/commands/wizard-headless.js

@@ -115,7 +115,8 @@ async function executeWizardFromConfig(wizardConfig, dataplaneUrl, authConfig, o
     {
       dataplaneUrl,
       authConfig,
-      enableRBAC: Boolean(preferences?.enableRBAC)
+      enableRBAC: Boolean(preferences?.enableRBAC),
+      format: opts.format
     }
   );
 }

package/lib/core/admin-secrets.js

@@ -33,12 +33,8 @@ function needsAdminEnvQuoting(value) {
  * @returns {string}
  */
 function formatAdminEnvLine(key, value) {
-  const safe = String(value ?? '').replace(/\n/g, ' ').trim();
-  if (!needsAdminEnvQuoting(safe)) {
-    return `${key}=${safe}`;
-  }
-  const escaped = safe.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
-  return `${key}="${escaped}"`;
+  const { formatDotenvLine } = require('../utils/env-dotenv-format');
+  return formatDotenvLine(key, value);
 }
 
 /**

package/lib/core/secrets-env-content.js

@@ -236,6 +236,7 @@ function parseEnvContentToMap(content) {
   if (!content || typeof content !== 'string') {
     return {};
   }
+  const { parseDotenvRawValue } = require('../utils/env-dotenv-format');
   const map = {};
   const lines = content.split(/\r?\n/);
   for (const line of lines) {
@@ -246,8 +247,7 @@ function parseEnvContentToMap(content) {
     const eq = trimmed.indexOf('=');
     if (eq > 0) {
       const key = trimmed.substring(0, eq).trim();
-      const value = trimmed.substring(eq + 1);
-      map[key] = value;
+      map[key] = parseDotenvRawValue(trimmed.substring(eq + 1));
     }
   }
   return map;
@@ -279,7 +279,12 @@ function collectSeenKeysAndMergeEnvLines(lines, newMap) {
     if (eq > 0) {
       const key = trimmed.substring(0, eq).trim();
       seen.add(key);
-      out.push(Object.prototype.hasOwnProperty.call(newMap, key) ? `${key}=${newMap[key]}` : line);
+      if (Object.prototype.hasOwnProperty.call(newMap, key)) {
+        const { formatDotenvLine } = require('../utils/env-dotenv-format');
+        out.push(formatDotenvLine(key, newMap[key]));
+      } else {
+        out.push(line);
+      }
       continue;
     }
     out.push(line);
@@ -288,9 +293,10 @@ function collectSeenKeysAndMergeEnvLines(lines, newMap) {
 }
 
 function appendMissingEnvKeysFromMap(out, seen, newMap) {
+  const { formatDotenvLine } = require('../utils/env-dotenv-format');
   for (const key of Object.keys(newMap)) {
     if (!seen.has(key)) {
-      out.push(`${key}=${newMap[key]}`);
+      out.push(formatDotenvLine(key, newMap[key]));
     }
   }
 }

package/lib/core/secrets-env-write.js

@@ -130,19 +130,8 @@ async function injectBashPrefixedExportLines(content, secretsPath, appName) {
  * @returns {Object.<string, string>} Map of variable name to value
  */
 function parseEnvContentToMap(content) {
-  const map = {};
-  if (!content || typeof content !== 'string') return map;
-  const lines = content.split(/\r?\n/);
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith('#')) continue;
-    const eq = trimmed.indexOf('=');
-    if (eq > 0) {
-      const key = trimmed.substring(0, eq).trim();
-      map[key] = trimmed.substring(eq + 1);
-    }
-  }
-  return map;
+  const { parseEnvContentToMap: parseMap } = require('./secrets-env-content');
+  return parseMap(content);
 }
 
 /**

package/lib/datasource/agent-trust-run.js

@@ -17,8 +17,8 @@ const { requireBearerForDataplanePipeline } = require('../utils/token-manager');
 const { buildMinimalUploadSyncOptions } = require('../utils/upload-sync-options');
 const { fetchTrustRunFromDataplane } = require('./agent-trust-fetch');
 
-async function maybeSyncBeforeTrust({ noSync, authConfig, systemKey, options = {} }) {
-  if (noSync === true) return;
+async function maybeSyncBeforeTrust({ noPublish, authConfig, systemKey, options = {} }) {
+  if (noPublish === true) return;
   requireBearerForDataplanePipeline(authConfig);
   logger.log(chalk.cyan('Syncing local config to dataplane…'));
   const { uploadExternalSystem } = require('../commands/upload');
@@ -66,7 +66,7 @@ async function runDatasourceAgentTrust(datasourceKey, options = {}) {
   }
 
   await maybeSyncBeforeTrust({
-    noSync: options.noSync === true,
+    noPublish: options.noPublish === true,
     authConfig,
     systemKey,
     options

package/lib/datasource/deploy.js

@@ -255,7 +255,9 @@ async function deployDatasource(fileOrKey, _options) {
   }
 
   if (Array.isArray(datasourceConfig.configuration) && datasourceConfig.configuration.length > 0) {
-    const { envMap, secrets } = await buildResolvedEnvMapForIntegration(systemKey);
+    const { envMap, secrets } = await buildResolvedEnvMapForIntegration(systemKey, {
+      dataplaneRuntime: true
+    });
     resolveConfigurationValues(datasourceConfig.configuration, envMap, secrets, systemKey);
   }