@aifabrix/builder 2.49.2 → 2.51.0

package/lib/cli/index.js

@@ -23,15 +23,21 @@ const { setupAppCommands: setupAppManagementCommands } = require('../commands/ap
 const { setupDatasourceCommands } = require('../commands/datasource');
 const { setupDimensionCommands } = require('../commands/dimension');
 const { setupResourceTypeCommands } = require('../commands/resource-type');
+const { setupRoleCommands } = require('../commands/role');
+const { setupEvidenceKindCommands } = require('../commands/evidence-kind');
+const { setupEnterpriseKnowledgeCommands } = require('../commands/enterprise-knowledge');
 const { setupIdentityCommands } = require('../commands/identity');
 const { setupProtectionCommands } = require('../commands/protection');
+const { setupEvidenceCommands } = require('../commands/evidence');
 const { setupCredentialDeploymentCommands } = require('./setup-credential-deployment');
 const { setupIntegrationClientCommands } = require('./setup-integration-client');
 const { setupPlatformCommands } = require('./setup-platform');
 const { setupCertificationCommands } = require('./setup-certification-commands');
 const { setupGovernanceCommands } = require('../commands/governance');
 const { setupChannelCommands } = require('../commands/channel');
+const { setupManifestCommands } = require('../commands/manifest');
 const { setupNpmCommands } = require('./setup-npm');
+const { setupListCommand } = require('./setup-list');
 
 /**
  * Dev, secrets, parameters, and platform commands (keeps setupCommands under statement limit).
@@ -46,10 +52,10 @@ function setupDevAndPlatformCommands(program) {
 }
 
 /**
- * Sets up all CLI commands on the Commander program instance
- * @param {Command} program - Commander program instance
+ * Core platform and integration CLI command groups.
+ * @param {import('commander').Command} program
  */
-function setupCommands(program) {
+function setupCoreCliCommands(program) {
   setupInfraCommands(program);
   setupAuthCommands(program);
   setupAppCommands(program);
@@ -59,14 +65,36 @@ function setupCommands(program) {
   setupAppManagementCommands(program);
   setupChannelCommands(program);
   setupDatasourceCommands(program);
+  setupManifestCommands(program);
+}
+
+/**
+ * Extended catalog and policy CLI command groups.
+ * @param {import('commander').Command} program
+ */
+function setupExtendedCliCommands(program) {
   setupDimensionCommands(program);
   setupResourceTypeCommands(program);
+  setupRoleCommands(program);
+  setupEvidenceKindCommands(program);
+  setupEnterpriseKnowledgeCommands(program);
   setupIdentityCommands(program);
   setupProtectionCommands(program);
+  setupEvidenceCommands(program);
   setupUtilityCommands(program);
+  setupListCommand(program);
   setupCredentialDeploymentCommands(program);
   setupIntegrationClientCommands(program);
   setupExternalSystemCommands(program);
+}
+
+/**
+ * Sets up all CLI commands on the Commander program instance
+ * @param {Command} program - Commander program instance
+ */
+function setupCommands(program) {
+  setupCoreCliCommands(program);
+  setupExtendedCliCommands(program);
   setupDevAndPlatformCommands(program);
 }
 

package/lib/cli/infra-guided.js

@@ -15,6 +15,7 @@ const infra = require('../infrastructure');
 const { execWithDockerEnv } = require('../utils/docker-exec');
 const { getLogLevel, passesLevelFilter } = require('../commands/app-logs');
 const { handleLogin } = require('../commands/login');
+const { handleUpBuilderApi } = require('../commands/up-builder-api');
 const {
   resolveGuidedAuthControllerUrl,
   runGuidedAuthStep,
@@ -309,7 +310,10 @@ async function runGuidedUpPlatform(options, handleUpMiso, handleUpDataplane, han
   await runGuidedAuthStep(handleLogin, authOpts, { startSpinner, stopSpinnerSuccess });
   const controllerUrl = await resolveGuidedAuthControllerUrl(authOpts);
   await runGuidedDataplaneInstallPhase(options, handleUpDataplane, handleLogin, controllerUrl);
-  await validateAppErrorLogs(['miso-controller', 'dataplane']);
+  const baSpin = startSpinner('Starting builder-api...');
+  await withMutedLogger(() => handleUpBuilderApi({ ...options, platformInstall: true }));
+  stopSpinnerSuccess(baSpin, 'Builder API ready');
+  await validateAppErrorLogs(['miso-controller', 'dataplane', 'builder-api']);
   await logPlatformReadyFooter();
 }
 

package/lib/cli/setup-app-external-create.js

@@ -0,0 +1,111 @@
+/**
+ * External-system create option normalization for setup-app.js.
+ *
+ * @fileoverview Headless external create CLI helpers
+ */
+
+const VALID_ENTITY_TYPES = ['recordStorage', 'documentStorage', 'vectorStore', 'messageService', 'none'];
+
+/**
+ * Normalize options for external system creation
+ * @param {Object} options - Raw CLI options
+ * @returns {Object} Normalized options
+ */
+function normalizeExternalOptions(options) {
+  const normalized = { ...options };
+  if (options.displayName) normalized.systemDisplayName = options.displayName;
+  if (options.description) normalized.systemDescription = options.description;
+  if (options.systemType) normalized.systemType = options.systemType;
+  if (options.authType) normalized.authType = options.authType;
+  if (options.entityType) {
+    if (!VALID_ENTITY_TYPES.includes(options.entityType)) {
+      throw new Error(`Invalid --entity-type. Must be one of: ${VALID_ENTITY_TYPES.join(', ')}`);
+    }
+    normalized.entityType = options.entityType;
+  }
+  if (options.datasources !== undefined) {
+    const parsedCount = parseInt(options.datasources, 10);
+    if (Number.isNaN(parsedCount) || parsedCount < 1 || parsedCount > 10) {
+      throw new Error('Datasources count must be a number between 1 and 10');
+    }
+    normalized.datasourceCount = parsedCount;
+  }
+  if (options.controller) {
+    normalized.controller = true;
+    normalized.controllerUrl = options.controller;
+  }
+  return normalized;
+}
+
+/**
+ * Whether normalized options include all external CLI fields for headless create.
+ * @param {Object} normalized - Normalized external create options
+ * @returns {boolean}
+ */
+function hasFullExternalCliOptions(normalized) {
+  return Boolean(
+    normalized.systemKey &&
+    normalized.systemDisplayName &&
+    normalized.systemDescription &&
+    normalized.systemType &&
+    normalized.authType &&
+    normalized.entityType &&
+    normalized.datasourceCount
+  );
+}
+
+/**
+ * Map positional systemKey and apply headless defaults for external create.
+ * @param {string} appName - Positional appKey or systemKey from CLI
+ * @param {Object} options - Raw CLI options
+ * @returns {Object} Normalized options ready for createApp
+ */
+function prepareExternalCreateOptions(appName, options) {
+  const normalized = normalizeExternalOptions(options);
+  const isExternalType = options.type === 'external' || !options.type;
+
+  if (isExternalType && appName) {
+    normalized.systemKey = appName;
+  }
+
+  if (isExternalType && hasFullExternalCliOptions(normalized)) {
+    if (!Object.prototype.hasOwnProperty.call(normalized, 'github')) {
+      normalized.github = false;
+    }
+    if (!Object.prototype.hasOwnProperty.call(normalized, 'controller')) {
+      normalized.controller = false;
+    }
+  }
+
+  return normalized;
+}
+
+/**
+ * Validate required options for non-interactive external creation
+ * @param {Object} normalizedOptions - Normalized options
+ * @throws {Error} If required options are missing
+ */
+function validateNonInteractiveExternalOptions(normalizedOptions) {
+  const missing = [];
+  if (!normalizedOptions.systemDisplayName) missing.push('--display-name');
+  if (!normalizedOptions.systemDescription) missing.push('--description');
+  if (!normalizedOptions.systemType) missing.push('--system-type');
+  if (!normalizedOptions.authType) missing.push('--auth-type');
+  if (!normalizedOptions.entityType) missing.push('--entity-type');
+  if (!normalizedOptions.datasourceCount) missing.push('--datasources');
+  if (missing.length > 0) {
+    throw new Error(`Missing required options for non-interactive external create: ${missing.join(', ')}`);
+  }
+  if (!Object.prototype.hasOwnProperty.call(normalizedOptions, 'github')) {
+    normalizedOptions.github = false;
+  }
+  if (!Object.prototype.hasOwnProperty.call(normalizedOptions, 'controller')) {
+    normalizedOptions.controller = false;
+  }
+}
+
+module.exports = {
+  normalizeExternalOptions,
+  prepareExternalCreateOptions,
+  validateNonInteractiveExternalOptions
+};

package/lib/cli/setup-app.help.js

@@ -56,7 +56,7 @@ Examples:
 Notes:
   - To run E2E for one datasource, use:
       aifabrix datasource test-e2e <datasourceKey>
-  - External integration: local system and datasource files are published to the dataplane before E2E (same as upload). Use --no-sync to exercise only config already deployed.
+  - External integration: local system and datasource files are published to the dataplane before E2E (same as upload). Use --no-publish to exercise only config already deployed.
 `;
 
 const IDENTITY_HELP_AFTER = `

package/lib/cli/setup-app.js

@@ -13,6 +13,10 @@ const app = require('../app');
 const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
 const { setupInstallTestE2eLintCommands } = require('./setup-app.test-commands');
+const {
+  prepareExternalCreateOptions,
+  validateNonInteractiveExternalOptions
+} = require('./setup-app-external-create');
 
 const CREATE_HELP_AFTER = `
 Examples:
@@ -46,18 +50,20 @@ Examples:
   $ aifabrix push myapp --registry $ACR_REGISTRY --tag $IMAGE_TAG
   $ aifabrix deploy myapp \\
       --client-id "$DEV_MISO_CLIENTID" \\
-      --client-secret "$DEV_MISO_CLIENTSECRET" \\
-      --no-poll
+      --client-secret "$DEV_MISO_CLIENTSECRET"
 
   # CI/CD — external integration (after upload/tests; promote to controller)
   $ aifabrix validate hubspot-demo
   $ aifabrix upload hubspot-demo --probe
-  $ aifabrix deploy hubspot-demo --probe --no-poll
+  $ aifabrix deploy hubspot-demo --probe -v
+  $ aifabrix deploy ek-sales --gate full --subject-email ops@example.com
 
 Notes:
   - Login or set MISO_CONTROLLER_URL + environment (aifabrix login / aifabrix auth).
   - CI: register once (aifabrix app register <appKey>), store DEV_MISO_CLIENTID and DEV_MISO_CLIENTSECRET in pipeline secrets.
   - upload = dataplane publish for dev iteration; deploy = controller validate + deploy (Azure or local Docker).
+  - Default output is a compact status card; use -v for expanded preflight and readiness detail.
+  - Controller deploy always polls to a terminal status (no --poll / --no-poll on this command).
   - --repository-url overrides repo URL for pipeline validate (default: application.yaml repository.repositoryUrl).
 `;
 
@@ -79,106 +85,6 @@ Notes:
   - Use -t 0 (--tail 0) for the full buffered log; default is 100 lines.
 `;
 
-/**
- * Normalize options for external system creation
- * @param {Object} options - Raw CLI options
- * @returns {Object} Normalized options
- */
-const VALID_ENTITY_TYPES = ['recordStorage', 'documentStorage', 'vectorStore', 'messageService', 'none'];
-
-function normalizeExternalOptions(options) {
-  const normalized = { ...options };
-  if (options.displayName) normalized.systemDisplayName = options.displayName;
-  if (options.description) normalized.systemDescription = options.description;
-  if (options.systemType) normalized.systemType = options.systemType;
-  if (options.authType) normalized.authType = options.authType;
-  if (options.entityType) {
-    if (!VALID_ENTITY_TYPES.includes(options.entityType)) {
-      throw new Error(`Invalid --entity-type. Must be one of: ${VALID_ENTITY_TYPES.join(', ')}`);
-    }
-    normalized.entityType = options.entityType;
-  }
-  if (options.datasources !== undefined) {
-    const parsedCount = parseInt(options.datasources, 10);
-    if (Number.isNaN(parsedCount) || parsedCount < 1 || parsedCount > 10) {
-      throw new Error('Datasources count must be a number between 1 and 10');
-    }
-    normalized.datasourceCount = parsedCount;
-  }
-  if (options.controller) {
-    normalized.controller = true;
-    normalized.controllerUrl = options.controller;
-  }
-  return normalized;
-}
-
-/**
- * Whether normalized options include all external CLI fields for headless create.
- * @param {Object} normalized - Normalized external create options
- * @returns {boolean}
- */
-function hasFullExternalCliOptions(normalized) {
-  return Boolean(
-    normalized.systemKey &&
-    normalized.systemDisplayName &&
-    normalized.systemDescription &&
-    normalized.systemType &&
-    normalized.authType &&
-    normalized.entityType &&
-    normalized.datasourceCount
-  );
-}
-
-/**
- * Map positional systemKey and apply headless defaults for external create.
- * @param {string} appName - Positional appKey or systemKey from CLI
- * @param {Object} options - Raw CLI options
- * @returns {Object} Normalized options ready for createApp
- */
-function prepareExternalCreateOptions(appName, options) {
-  const normalized = normalizeExternalOptions(options);
-  const isExternalType = options.type === 'external' || !options.type;
-
-  if (isExternalType && appName) {
-    normalized.systemKey = appName;
-  }
-
-  if (isExternalType && hasFullExternalCliOptions(normalized)) {
-    if (!Object.prototype.hasOwnProperty.call(normalized, 'github')) {
-      normalized.github = false;
-    }
-    if (!Object.prototype.hasOwnProperty.call(normalized, 'controller')) {
-      normalized.controller = false;
-    }
-  }
-
-  return normalized;
-}
-
-/**
- * Validate required options for non-interactive external creation
- * @param {Object} normalizedOptions - Normalized options
- * @throws {Error} If required options are missing
- */
-function validateNonInteractiveExternalOptions(normalizedOptions) {
-  const missing = [];
-  if (!normalizedOptions.systemDisplayName) missing.push('--display-name');
-  if (!normalizedOptions.systemDescription) missing.push('--description');
-  if (!normalizedOptions.systemType) missing.push('--system-type');
-  if (!normalizedOptions.authType) missing.push('--auth-type');
-  if (!normalizedOptions.entityType) missing.push('--entity-type');
-  if (!normalizedOptions.datasourceCount) missing.push('--datasources');
-  if (missing.length > 0) {
-    throw new Error(`Missing required options for non-interactive external create: ${missing.join(', ')}`);
-  }
-  if (!Object.prototype.hasOwnProperty.call(normalizedOptions, 'github')) {
-    normalizedOptions.github = false;
-  }
-  if (!Object.prototype.hasOwnProperty.call(normalizedOptions, 'controller')) {
-    normalizedOptions.controller = false;
-  }
-}
-
 /**
  * Handle create command execution
  * @async
@@ -315,7 +221,7 @@ Examples:
     });
 }
 
-function setupBuildRunLogsDownCommands(program) {
+function registerBuildCommand(program) {
   program.command('build <appKey>')
     .description('Build Docker image for builder appKey (auto-detect runtime)')
     .option('-l, --language <lang>', 'Override language detection')
@@ -339,9 +245,9 @@ function setupBuildRunLogsDownCommands(program) {
         process.exit(1);
       }
     });
+}
 
-  registerRunCommand(program);
-
+function registerLogsCommand(program) {
   program.command('logs <appKey>')
     .description('Tail container logs for appKey (optional env summary; secrets masked)')
     .option('-f', 'Follow log stream')
@@ -352,14 +258,22 @@ function setupBuildRunLogsDownCommands(program) {
       try {
         const { runAppLogs } = require('../commands/app-logs');
         const tailNum = parseInt(options.tail, 10);
-        const level = options.level !== undefined && options.level !== null && options.level !== '' ? String(options.level).trim() : undefined;
-        await runAppLogs(appName, { follow: options.f, tail: Number.isNaN(tailNum) ? 100 : tailNum, level });
+        const level = options.level !== undefined && options.level !== null && options.level !== ''
+          ? String(options.level).trim()
+          : undefined;
+        await runAppLogs(appName, {
+          follow: options.f,
+          tail: Number.isNaN(tailNum) ? 100 : tailNum,
+          level
+        });
       } catch (error) {
         handleCommandError(error, 'logs');
         process.exit(1);
       }
     });
+}
 
+function registerDownAppCommand(program) {
   program.command('down-app <appKey>')
     .description('Stop and remove container for appKey (--volumes removes data volume)')
     .option('--volumes', 'Remove application Docker volume')
@@ -374,6 +288,13 @@ function setupBuildRunLogsDownCommands(program) {
     });
 }
 
+function setupBuildRunLogsDownCommands(program) {
+  registerBuildCommand(program);
+  registerRunCommand(program);
+  registerLogsCommand(program);
+  registerDownAppCommand(program);
+}
+
 function setupShellTestStopCommands(program) {
   program.command('stop <appKey>')
     .description('Alias for down-app: stop and remove container for appKey')
@@ -419,21 +340,7 @@ function setupDockerfileGenerateCommand(program) {
     });
 }
 
-function setupPushDeployDockerfileCommands(program) {
-  program.command('push <appKey>')
-    .description('Push builder appKey image to Azure Container Registry')
-    .addHelpText('after', PUSH_HELP_AFTER)
-    .option('-r, --registry <registry>', 'ACR registry URL (overrides application.yaml)')
-    .option('-t, --tag <tag>', 'Image tag(s) - comma-separated for multiple (default: latest)')
-    .action(async(appName, options) => {
-      try {
-        await app.pushApp(appName, options);
-      } catch (error) {
-        handleCommandError(error, 'push');
-        process.exit(1);
-      }
-    });
-
+function setupDeployCommand(program) {
   program.command('deploy <appKey|systemKey>')
     .description('Deploy builder app or external system via Miso Controller (Azure or --local)')
     .addHelpText('after', DEPLOY_HELP_AFTER)
@@ -441,13 +348,20 @@ function setupPushDeployDockerfileCommands(program) {
     .option('--client-id <id>', 'Client ID (overrides config)')
     .option('--client-secret <secret>', 'Client Secret (overrides config)')
     .option('--repository-url <url>', 'Repository URL for pipeline validation (default: application.yaml repository.repositoryUrl, else https://github.com/aifabrix/<appKey>)')
-    .option('--poll', 'Poll for deployment status', true)
-    .option('--no-poll', 'Do not poll for status')
+    .option('-v, --verbose', 'Expanded deploy summary and preflight progress')
     .option('--probe', 'After external deploy, run dataplane runtime checks (validation/run); slower')
     .option('--probe-timeout <ms>', 'Timeout for --probe on external deploy (default: 120000)', '120000')
     .option(
-      '--no-cert-sync',
-      'Skip updating integration certification in the system file from the dataplane after external deploy'
+      '--sync',
+      'After deploy, run full datasource data sync for every datasource on the system (default: bootstrap-if-empty only)'
+    )
+    .option(
+      '--gate <gates>',
+      'Optional pre-promote gates (comma-separated): operations, trust, governance, full'
+    )
+    .option(
+      '--subject-email <emails>',
+      'Subject email(s) for governance gate (comma-separated; used with --gate governance|full)'
     )
     .action(async(appName, options) => {
       try {
@@ -458,6 +372,7 @@ function setupPushDeployDockerfileCommands(program) {
         const opts = {
           ...options,
           local: !!options.local,
+          verbose: options.verbose === true,
           probeTimeout: Number.isFinite(probeTimeout) ? probeTimeout : 120000
         };
         const outcome = await app.deployApp(appName, opts);
@@ -470,7 +385,24 @@ function setupPushDeployDockerfileCommands(program) {
         process.exit(1);
       }
     });
+}
 
+function setupPushDeployDockerfileCommands(program) {
+  program.command('push <appKey>')
+    .description('Push builder appKey image to Azure Container Registry')
+    .addHelpText('after', PUSH_HELP_AFTER)
+    .option('-r, --registry <registry>', 'ACR registry URL (overrides application.yaml)')
+    .option('-t, --tag <tag>', 'Image tag(s) - comma-separated for multiple (default: latest)')
+    .action(async(appName, options) => {
+      try {
+        await app.pushApp(appName, options);
+      } catch (error) {
+        handleCommandError(error, 'push');
+        process.exit(1);
+      }
+    });
+
+  setupDeployCommand(program);
   setupDockerfileGenerateCommand(program);
 }
 
@@ -489,7 +421,5 @@ function setupAppCommands(program) {
 
 module.exports = {
   setupAppCommands,
-  normalizeExternalOptions,
-  prepareExternalCreateOptions,
-  validateNonInteractiveExternalOptions
+  ...require('./setup-app-external-create')
 };

package/lib/cli/setup-app.test-commands.js

@@ -7,7 +7,6 @@
 const chalk = require('chalk');
 const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
-const { cliOptsSkipCertSync } = require('../certification/cli-cert-sync-skip');
 const {
   TEST_HELP_AFTER,
   TEST_E2E_HELP_AFTER
@@ -18,7 +17,7 @@ function setupTestCommand(program) {
     .description('Tests: builder appKey in container; external systemKey = local validation')
     .option('-e, --env <env>', 'For builder app: dev (running container) or tst (ephemeral)', 'dev')
     .option('-v, --verbose', 'Verbose output')
-    .option('-d, --debug', 'Write debug log to integration/<systemKey>/logs/ (external only)')
+    .option('-d, --debug', 'Certification debug + log to integration/<systemKey>/logs/ (external only)')
     .option(
       '--sync',
       'Not supported for this command (local validation only). Use aifabrix upload <systemKey> or dataplane test commands with --sync.'
@@ -58,45 +57,22 @@ function setupTestCommand(program) {
 }
 
 /**
- * First failed `certificateIssuance` across E2E datasource rows (for cert-sync hint).
- * @param {Array<{ key?: string, datasourceTestRun?: { certificateIssuance?: { status?: string, reasonCode?: string, message?: string } } }>} results
- * @returns {string|null}
- */
-function firstIssuanceFailureHintFromE2eResults(results) {
-  const failed = [];
-  for (const row of results || []) {
-    const ci = row.datasourceTestRun && row.datasourceTestRun.certificateIssuance;
-    if (ci && ci.status === 'failed') {
-      failed.push({ key: row.key, ci });
-    }
-  }
-  if (failed.length === 0) return null;
-  const firstRc = failed[0].ci.reasonCode;
-  const sameAll = failed.every(f => f.ci.reasonCode === firstRc);
-  if (sameAll && failed.length > 1) {
-    const parts = [firstRc, failed[0].ci.message].filter(Boolean);
-    return `${parts.join(': ')} (${failed.length} datasource scopes; first: ${failed[0].key})`;
-  }
-  const parts = [failed[0].ci.reasonCode, failed[0].ci.message].filter(Boolean);
-  return `[${failed[0].key}] ${parts.join(': ')}`.trim();
-}
-
-/**
- * External integration E2E: run, display, exit on aggregate, optional cert sync.
+ * External integration E2E: run, display, exit on aggregate.
  * @param {string} appName
  * @param {Object} options
  * @returns {Promise<void>}
  */
-async function runExternalIntegrationE2EAndCertSync(appName, options, cmd) {
-  const { cliOptsSkipSync } = require('../utils/cli-sync-options');
+async function runExternalIntegrationE2EAndExit(appName, options, cmd) {
+  const { cliOptsSkipPublish } = require('../utils/cli-sync-options');
   const { runTestE2EForExternalSystem } = require('../commands/test-e2e-external');
-  const noSync = cliOptsSkipSync(options, cmd);
+  const noPublish = cliOptsSkipPublish(options, cmd);
   const { success, results } = await runTestE2EForExternalSystem(appName, {
     env: options.env,
     debug: options.debug,
     verbose: options.verbose,
     async: options.async !== false,
-    noSync
+    noPublish,
+    syncMode: options.syncMode
   });
   const { displayIntegrationTestResults } = require('../utils/external-system-display');
   const datasourceResults = results.map(r => ({
@@ -117,25 +93,21 @@ async function runExternalIntegrationE2EAndCertSync(appName, options, cmd) {
     requireCert: options.requireCert === true
   });
   if (exitCode !== 0) process.exit(exitCode);
-  if (cliOptsSkipCertSync(options)) return;
-  const { trySyncCertificationFromDataplaneForExternalApp } = require('../certification/sync-after-external-command');
-  const issuanceFailureHint = firstIssuanceFailureHintFromE2eResults(results);
-  await trySyncCertificationFromDataplaneForExternalApp(appName, 'test-e2e', { issuanceFailureHint });
 }
 
 async function runTestE2ECommand(appName, options, cmd) {
-  const { cliOptsSkipSync } = require('../utils/cli-sync-options');
-  const noSync = cliOptsSkipSync(options, cmd);
+  const { cliOptsSkipPublish } = require('../utils/cli-sync-options');
+  const noPublish = cliOptsSkipPublish(options, cmd);
   const pathsUtil = require('../utils/paths');
   const appType = await pathsUtil.detectAppType(appName).catch(() => null);
-  if (noSync && appType && appType.baseDir === 'builder') {
+  if (noPublish && appType && appType.baseDir === 'builder') {
     throw new Error(
-      'Option --no-sync applies only to external integration E2E (integration/<systemKey>/). ' +
-        'Remove --no-sync for builder app E2E.'
+      'Option --no-publish applies only to external integration E2E (integration/<systemKey>/). ' +
+        'Remove --no-publish for builder app E2E.'
     );
   }
   if (appType && appType.baseDir === 'integration') {
-    await runExternalIntegrationE2EAndCertSync(appName, options, cmd);
+    await runExternalIntegrationE2EAndExit(appName, options, cmd);
     return;
   }
   const { runAppTestE2e } = require('../commands/app-test');
@@ -170,21 +142,24 @@ function setupTestE2eCommand(program) {
     .description('E2E: builder appKey in container; external systemKey = all datasources via dataplane')
     .option('-e, --env <env>', 'Environment: dev, tst, or pro (builder: dev/tst for container)', 'dev')
     .option('-v, --verbose', 'Show detailed step output and poll progress')
-    .option('-d, --debug', 'Include debug output and write log to integration/<systemKey>/logs/')
-    .option(
-      '--no-sync',
-      'Skip publishing local integration files; E2E uses the system config already on the dataplane (external integration only)'
-    )
+    .option('-d, --debug', 'Certification debug + log to integration/<systemKey>/logs/')
+    .option('--no-publish', 'Skip publishing local integration files before E2E')
     .option(
       '--force',
       'With default sync, pass force to upload (bypass active-datasource schema replacement guards; same as aifabrix upload --force)'
     )
-    .option('--warnings-as-errors', 'Treat aggregate warn as failure (exit 1)')
-    .option('--require-cert', 'Require certification passed on every datasource (exit 2 if not)')
     .option(
-      '--no-cert-sync',
-      'Skip updating the system file certification block from the dataplane after a successful run'
+      '--version <target>',
+      'Manifest version for E2E (latest, running, or explicit version id)',
+      'latest'
     )
+    .option(
+      '--sync-mode <mode>',
+      'Sync policy during E2E: auto (default), never, or force. Distinct from default pre-run publish.',
+      'auto'
+    )
+    .option('--warnings-as-errors', 'Treat aggregate warn as failure (exit 1)')
+    .option('--require-cert', 'Require certification passed on every datasource (exit 2 if not)')
     .addHelpText('after', TEST_E2E_HELP_AFTER)
     .action(async(appName, options, cmd) => {
       try {
@@ -232,7 +207,6 @@ function setupInstallTestE2eLintCommands(program) {
 }
 
 module.exports = {
-  setupInstallTestE2eLintCommands,
-  firstIssuanceFailureHintFromE2eResults
+  setupInstallTestE2eLintCommands
 };