@aifabrix/builder 2.50.0 → 2.51.1

package/lib/commands/upload-sidecar-followups.js

@@ -12,22 +12,123 @@ const { unwrapPublicationResult, isPublicationUnchanged } = require('../utils/ex
 const { logUploadReadinessSummary } = require('../utils/external-system-readiness-display');
 const { isQuietMinimalSync } = require('../utils/upload-sync-options');
 
+function buildRoleAssistantModel(payload) {
+  return {
+    application: payload?.application,
+    dataSources: payload?.dataSources || []
+  };
+}
+
+function buildRoleAssistantSyncContext(ctx, model) {
+  // Controller deploy env (e.g. miso) ≠ role-assistant.yaml section (dev|tst|pro).
+  const { resolveRoleAssistantSettingsEnvKey } = require('../role-assistant/knowledge-sync');
+  const raEnv = resolveRoleAssistantSettingsEnvKey(
+    (ctx.options && (ctx.options.env || ctx.options.roleAssistantEnv)) || 'dev'
+  );
+  return {
+    systemKey: ctx.systemKey,
+    dataplaneUrl: ctx.dataplaneUrl,
+    authConfig: ctx.authConfig,
+    model,
+    environment: raEnv,
+    pathOptions: ctx.options.pathOptions || {},
+    dryRun: ctx.options.dryRun === true
+  };
+}
+
+async function runGovernanceSidecar(ctx, sidecar, quietSidecar) {
+  try {
+    const { uploadGovernanceScenarioPacks } = require('../lifecycle/scenario-upload');
+    const uploaded = await uploadGovernanceScenarioPacks(ctx.systemKey, ctx.dataplaneUrl, ctx.authConfig, {
+      silent: quietSidecar
+    });
+    sidecar.governance = { uploaded: Number(uploaded || 0) };
+  } catch (err) {
+    sidecar.governance = { skipped: true, reason: err.message || String(err) };
+    if (!quietSidecar) {
+      logger.log(formatWarningLine(`Governance scenario upload skipped: ${err.message}`));
+    }
+  }
+}
+
+async function runEvidenceSidecar(ctx, model, sidecar, quietSidecar) {
+  const { importRoleAssistantEvidence, logRoleAssistantEvidenceImportSummary } = require('../role-assistant/evidence-sync');
+  const result = await importRoleAssistantEvidence(buildRoleAssistantSyncContext(ctx, model));
+  sidecar.evidence = result;
+  if (!quietSidecar) {
+    logRoleAssistantEvidenceImportSummary(ctx.systemKey, result, { verbose: ctx.options.verbose === true });
+  }
+}
+
+async function runKnowledgeSidecar(ctx, model, sidecar, quietSidecar) {
+  const {
+    importRoleAssistantKnowledge,
+    logKnowledgeImportSummary,
+    pushRoleAssistantDocumentStorageSettings,
+    logDocumentStorageSettingsPushSummary
+  } = require('../role-assistant/knowledge-sync');
+  const syncCtx = buildRoleAssistantSyncContext(ctx, model);
+  try {
+    const settingsResult = await pushRoleAssistantDocumentStorageSettings(syncCtx);
+    sidecar.documentStorageSettings = settingsResult;
+    if (!quietSidecar) {
+      logDocumentStorageSettingsPushSummary(ctx.systemKey, settingsResult, {
+        verbose: ctx.options.verbose === true
+      });
+    }
+  } catch (err) {
+    sidecar.documentStorageSettings = {
+      skipped: true,
+      reason: err.message || String(err)
+    };
+    if (!quietSidecar) {
+      logger.log(
+        formatWarningLine(
+          `Knowledge document storage settings update failed: ${err.message}`
+        )
+      );
+    }
+    throw err;
+  }
+  try {
+    const result = await importRoleAssistantKnowledge(syncCtx);
+    sidecar.knowledge = result;
+    if (!quietSidecar) {
+      logKnowledgeImportSummary(ctx.systemKey, result, { verbose: ctx.options.verbose === true });
+    }
+  } catch (err) {
+    sidecar.knowledge = { skipped: true, reason: err.message || String(err) };
+    if (!quietSidecar) {
+      logger.log(formatWarningLine(`Role assistant knowledge sync skipped: ${err.message}`));
+    }
+  }
+}
+
 /**
  * Sidecar follow-ups that are independent of pipeline publish hash (scenario packs).
  * @param {Object} ctx
  * @returns {Promise<void>}
  */
 async function runUploadSidecarFollowups(ctx) {
-  const { systemKey, options, dataplaneUrl, authConfig } = ctx;
-  const quietSidecar = isQuietMinimalSync(options);
+  const sidecar = {
+    governance: null,
+    evidence: null,
+    knowledge: null,
+    documentStorageSettings: null
+  };
+  const quietSidecar = isQuietMinimalSync(ctx.options);
+  const model = buildRoleAssistantModel(ctx.payload);
+  await runGovernanceSidecar(ctx, sidecar, quietSidecar);
   try {
-    const { uploadGovernanceScenarioPacks } = require('../lifecycle/scenario-upload');
-    await uploadGovernanceScenarioPacks(systemKey, dataplaneUrl, authConfig, { silent: quietSidecar });
+    await runEvidenceSidecar(ctx, model, sidecar, quietSidecar);
   } catch (err) {
-    if (!quietSidecar) {
-      logger.log(formatWarningLine(`Governance scenario upload skipped: ${err.message}`));
+    if (err && err.evidenceSummary) {
+      sidecar.evidence = err.evidenceSummary;
     }
+    throw err;
   }
+  await runKnowledgeSidecar(ctx, model, sidecar, quietSidecar);
+  return sidecar;
 }
 
 /**
@@ -54,61 +155,57 @@ async function resolveUploadProbeData(ctx, maybeRunUploadProbeFn) {
   return { probeData: null, compact };
 }
 
+function logUploadSummary(ctx, publication, probeData) {
+  if (ctx.options.suppressSummary === true) {
+    return;
+  }
+  logUploadReadinessSummary({
+    environment: ctx.environment,
+    dataplaneUrl: ctx.dataplaneUrl,
+    systemKey: ctx.systemKey,
+    publication,
+    manifest: ctx.manifest,
+    minimal: !!ctx.options.minimal,
+    willProbe: false,
+    credentialPush: ctx.credentialPush,
+    configPush: ctx.configPush,
+    forcePublish: ctx.options.force === true,
+    probeData
+  });
+}
+
+async function runProbeAfterSummary(ctx, maybeRunUploadProbe, compact) {
+  if (ctx.options.probe && !compact) {
+    await maybeRunUploadProbe(ctx.dataplaneUrl, ctx.systemKey, ctx.authConfig, ctx.options.probeTimeout, {
+      compact: false
+    });
+  }
+}
+
+async function runSidecarAndWrap(ctx) {
+  const sidecar = await runUploadSidecarFollowups(ctx);
+  return { sidecar };
+}
+
 /**
  * @param {Object} ctx
  * @param {Function} maybeRunUploadProbe
  * @returns {Promise<void>}
  */
 async function handlePublicationAndFollowups(ctx, maybeRunUploadProbe) {
-  const {
-    systemKey,
-    options,
-    manifest,
-    payload,
-    environment,
-    dataplaneUrl,
-    authConfig,
-    rawRes,
-    credentialPush,
-    configPush
-  } = ctx;
-  const publication = unwrapPublicationResult(rawRes);
+  const publication = unwrapPublicationResult(ctx.rawRes);
   if (!publication) {
     throw new Error(
       'Unexpected response from dataplane upload: missing publication result (uploadId/system/datasources).'
     );
   }
   if (isPublicationUnchanged(publication)) {
-    await runUploadSidecarFollowups({ systemKey, options, payload, dataplaneUrl, authConfig });
-    return;
+    return runSidecarAndWrap(ctx);
   }
-
-  const suppressSummary = options.suppressSummary === true;
   const { probeData, compact } = await resolveUploadProbeData(ctx, maybeRunUploadProbe);
-
-  if (!suppressSummary) {
-    logUploadReadinessSummary({
-      environment,
-      dataplaneUrl,
-      systemKey,
-      publication,
-      manifest,
-      minimal: !!options.minimal,
-      willProbe: false,
-      credentialPush,
-      configPush,
-      forcePublish: options.force === true,
-      probeData
-    });
-  }
-
-  if (options.probe && !compact) {
-    await maybeRunUploadProbe(dataplaneUrl, systemKey, authConfig, options.probeTimeout, {
-      compact: false
-    });
-  }
-
-  await runUploadSidecarFollowups({ systemKey, options, payload, dataplaneUrl, authConfig });
+  logUploadSummary(ctx, publication, probeData);
+  await runProbeAfterSummary(ctx, maybeRunUploadProbe, compact);
+  return runSidecarAndWrap(ctx);
 }
 
 module.exports = {

package/lib/commands/upload.js

@@ -47,6 +47,12 @@ const { syncDeployJsonFromSources } = require('../external-system/sync-deploy-ma
 const { handlePublicationAndFollowups } = require('./upload-sidecar-followups');
 const { finalizeUploadPublishResult, finishUnchangedUploadPublication } = require('./upload-data-sync-finalize');
 const { pushAndLogCredentialSecrets } = require('./upload-credential-push-log');
+const {
+  SYSTEM_KIND_DIGITAL_WORKER,
+  readRoleAssistantSettings,
+  resolveRoleAssistantSettingsVersion,
+  resolveRoleAssistantEnvironmentSettings
+} = require('../role-assistant/settings');
 
 /**
  * Validates system-key format (same as download).
@@ -123,14 +129,24 @@ async function resolveDataplaneAndAuth(systemKey, opts = {}) {
  * @param {string} dataplaneUrl - Dataplane base URL
  * @param {Object} authConfig - Auth config
  * @param {Object} payload - { version, application, dataSources, status: "draft" }
+ * @param {string} systemKey
+ * @param {Object} [options]
+ * @param {number|string} [options.timeoutMs]
  * @returns {Promise<Object>} Raw API response envelope
  */
-async function runUploadValidatePublish(dataplaneUrl, authConfig, payload, systemKey) {
+async function runUploadValidatePublish(
+  dataplaneUrl,
+  authConfig,
+  payload,
+  systemKey,
+  options = {}
+) {
   const res = await uploadApplicationViaPipelineWithAuthRetry(
     dataplaneUrl,
     authConfig,
     payload,
-    systemKey
+    systemKey,
+    { timeoutMs: options.timeoutMs }
   );
   if (res?.success === false) {
     throw new Error(formatApiError(res, dataplaneUrl));
@@ -231,6 +247,14 @@ async function buildValidatedUploadManifestPayload(systemKey, opts = {}) {
     force: opts.force === true,
     status: opts.uploadStatus === 'published' ? 'published' : 'draft'
   });
+  if (String(manifest?.system?.systemKind || '').trim() === SYSTEM_KIND_DIGITAL_WORKER) {
+    const settings = readRoleAssistantSettings(systemKey, { required: true, pathOptions });
+    resolveRoleAssistantEnvironmentSettings(settings, opts.env || 'dev', { required: true });
+    const settingsVersion = resolveRoleAssistantSettingsVersion(settings);
+    if (settingsVersion) {
+      payload.version = settingsVersion;
+    }
+  }
   await resolvePayloadConfiguration(systemKey, payload, pathOptions);
   return { manifest, payload };
 }
@@ -264,7 +288,10 @@ async function logAndSyncLocalOpenApiForUpload(systemKey, manifest, uploadContex
     systemKey,
     datasourceFiles,
     dataplaneUrl: uploadContext.dataplaneUrl,
-    authConfig: uploadContext.authConfig
+    authConfig: uploadContext.authConfig,
+    // Always replace SpecFile rows keyed by openapi.documentKey so vendor/full
+    // specs are not left missing while only thin internal:* slices remain.
+    force: true
   });
   if (!uploadContext.quiet) {
     for (const line of openapiSyncLines) {
@@ -293,7 +320,7 @@ async function completeUploadAfterPublish(systemKey, options, manifest, payload,
     pathOptions: options.pathOptions,
     quiet: quietCompact
   });
-  await handlePublicationAndFollowups(
+  const followupResult = await handlePublicationAndFollowups(
     {
       systemKey,
       options,
@@ -309,7 +336,13 @@ async function completeUploadAfterPublish(systemKey, options, manifest, payload,
     maybeRunUploadProbe
   );
   return finalizeUploadPublishResult(
-    { dataplaneUrl: ctx.dataplaneUrl, authConfig: ctx.authConfig, environment: ctx.environment, uploadSkipped: false },
+    {
+      dataplaneUrl: ctx.dataplaneUrl,
+      authConfig: ctx.authConfig,
+      environment: ctx.environment,
+      uploadSkipped: false,
+      sidecar: followupResult?.sidecar || null
+    },
     payload,
     options
   );
@@ -331,7 +364,10 @@ async function runUploadPublishAndSummary(systemKey, options, manifest, payload)
     payload
   );
   const rawRes = await runWithUploadPipelineSpinner(
-    async() => runUploadValidatePublish(dataplaneUrl, authConfig, payload, systemKey),
+    async() =>
+      runUploadValidatePublish(dataplaneUrl, authConfig, payload, systemKey, {
+        timeoutMs: options.timeoutMs
+      }),
     {
       systemKey,
       json: options.json === true,
@@ -367,6 +403,7 @@ async function runUploadPublishAndSummary(systemKey, options, manifest, payload)
  * @param {boolean} [options.verbose] - Expanded summary and server-side pipeline validate warnings
  * @param {boolean} [options.probe] - POST validation/run after publish
  * @param {number} [options.probeTimeout] - Probe timeout ms (default 120000)
+ * @param {number} [options.timeoutMs] - Pipeline publish timeout ms (HTTP + dataplane; default 300000)
  * @param {boolean} [options.minimal] - Short summary (default: compact unless --verbose)
  * @returns {Promise<{ dataplaneUrl: string, authConfig: Object, environment: string }|void>}
  * @throws {Error} If validation or API calls fail

package/lib/commands/validate-json.js

@@ -0,0 +1,230 @@
+/**
+ * Offline validate then write *-deploy.json (same quality as validate + same write as json).
+ *
+ * @fileoverview aifabrix validate-json command
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const validate = require('../validation/validate');
+const generator = require('../generator');
+const { listIntegrationAppNames, listBuilderAppNames } = require('../utils/paths');
+const {
+  formatSuccessLine,
+  formatBlockingError,
+  formatWarningLine
+} = require('../utils/cli-test-layout-chalk');
+
+/**
+ * @param {string} appKey
+ * @returns {boolean}
+ */
+function looksLikeExistingFilePath(appKey) {
+  try {
+    return Boolean(appKey && fs.existsSync(appKey) && fs.statSync(appKey).isFile());
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {object} opts
+ * @returns {string[]}
+ */
+function collectBatchAppNames(opts) {
+  const names = [];
+  if (opts.integration === true) {
+    names.push(...listIntegrationAppNames());
+  }
+  if (opts.builder === true) {
+    names.push(...listBuilderAppNames());
+  }
+  return [...new Set(names)];
+}
+
+/**
+ * @param {string} appKey
+ * @param {object} result
+ * @param {string} outFormat
+ */
+function emitManifestLine(appKey, result, outFormat) {
+  if (outFormat === 'json' || !result?.appPath) {
+    return;
+  }
+  try {
+    const { emitManifestMetadataLineIfTTY } = require('../utils/manifest-source-emit');
+    emitManifestMetadataLineIfTTY(logger, {
+      appKey,
+      appPath: result.appPath,
+      envOnly: false,
+      json: false
+    });
+  } catch {
+    /* ignore */
+  }
+}
+
+/**
+ * Validate one app/systemKey; write deploy JSON only when local validate succeeds.
+ * @param {string} appKey
+ * @param {object} [options]
+ * @returns {Promise<{ appKey: string, valid: boolean, validation: object, deploy?: object|null, error?: string }>}
+ */
+async function validateThenWriteDeploy(appKey, options = {}) {
+  let validation;
+  try {
+    validation = await validate.validateAppOrFile(appKey, { ...options, certSync: false });
+  } catch (err) {
+    return {
+      appKey,
+      valid: false,
+      validation: { valid: false, errors: [err.message || String(err)] },
+      deploy: null,
+      error: err.message || String(err)
+    };
+  }
+  if (!validation.valid) {
+    return { appKey, valid: false, validation, deploy: null };
+  }
+  const deploy = await generator.generateDeployJsonWithValidation(appKey, options);
+  const ok = deploy.success === true;
+  return {
+    appKey,
+    valid: ok,
+    validation,
+    deploy,
+    error: ok ? undefined : (deploy.validation?.errors || []).join('; ') || 'deploy JSON validation failed'
+  };
+}
+
+/**
+ * @param {object} item
+ * @param {string} outFormat
+ */
+function displayOneHumanResult(item, outFormat) {
+  emitManifestLine(item.appKey, item.validation, outFormat);
+  if (outFormat === 'json') {
+    return;
+  }
+  validate.displayValidationResults(item.validation);
+  if (!item.validation.valid) {
+    logger.log(formatBlockingError(`Skipped deploy JSON for ${item.appKey} (validation failed)`));
+    return;
+  }
+  if (item.deploy?.success && item.deploy.path) {
+    logger.log(formatSuccessLine(`Generated deployment JSON: ${item.deploy.path}`));
+    const warnings = item.deploy.validation?.warnings || [];
+    if (warnings.length > 0) {
+      warnings.forEach((w) => logger.log(formatWarningLine(w)));
+    }
+    return;
+  }
+  logger.log(formatBlockingError(`Deploy JSON write failed for ${item.appKey}`));
+  (item.deploy?.validation?.errors || []).forEach((e) => logger.log(`   • ${e}`));
+}
+
+/**
+ * @param {Array<object>} items
+ * @param {string} outFormat
+ */
+function displayBatchSummary(items, outFormat) {
+  if (outFormat === 'json') {
+    logger.log(JSON.stringify({
+      batch: true,
+      valid: items.every((i) => i.valid),
+      results: items.map((i) => ({
+        appKey: i.appKey,
+        valid: i.valid,
+        path: i.deploy?.path || null,
+        error: i.error || null
+      }))
+    }, null, 2));
+    return;
+  }
+  const passed = items.filter((i) => i.valid);
+  const failed = items.filter((i) => !i.valid);
+  logger.log('');
+  logger.log(chalk.bold('validate-json summary'));
+  logger.log(`  Passed: ${passed.length}`);
+  logger.log(`  Failed: ${failed.length}`);
+  failed.forEach((i) => {
+    logger.log(formatBlockingError(`${i.appKey}${i.error ? `: ${i.error}` : ''}`));
+  });
+}
+
+/**
+ * @param {object} opts
+ * @param {string} outFormat
+ * @returns {Promise<{ exitCode: number }>}
+ */
+async function runValidateJsonBatch(opts, outFormat) {
+  const names = collectBatchAppNames(opts);
+  const items = [];
+  for (const name of names) {
+    const item = await validateThenWriteDeploy(name, opts);
+    displayOneHumanResult(item, outFormat);
+    items.push(item);
+  }
+  displayBatchSummary(items, outFormat);
+  return { exitCode: items.every((i) => i.valid) ? 0 : 1 };
+}
+
+/**
+ * @param {string} appKey
+ * @param {object} opts
+ * @param {string} outFormat
+ * @returns {Promise<{ exitCode: number }>}
+ */
+async function runValidateJsonSingle(appKey, opts, outFormat) {
+  if (looksLikeExistingFilePath(appKey)) {
+    logger.log(
+      chalk.red(
+        'validate-json requires an appKey or systemKey (not a file path). Use aifabrix validate <file> for files.'
+      )
+    );
+    return { exitCode: 1 };
+  }
+  const item = await validateThenWriteDeploy(appKey, opts);
+  if (outFormat === 'json') {
+    logger.log(JSON.stringify({
+      appKey: item.appKey,
+      valid: item.valid,
+      path: item.deploy?.path || null,
+      validation: item.validation,
+      error: item.error || null
+    }, null, 2));
+  } else {
+    displayOneHumanResult(item, outFormat);
+  }
+  return { exitCode: item.valid ? 0 : 1 };
+}
+
+/**
+ * @param {string|undefined} appKey
+ * @param {object} options - Commander options or opts()
+ * @returns {Promise<{ exitCode: number }>}
+ */
+async function runValidateJsonCommand(appKey, options) {
+  const opts = options.opts ? options.opts() : options;
+  const outFormat = (opts.format || 'default').toLowerCase();
+  if (opts.integration === true || opts.builder === true) {
+    return runValidateJsonBatch(opts, outFormat);
+  }
+  if (!appKey || typeof appKey !== 'string') {
+    logger.log(chalk.red('App or system key is required, or use --integration / --builder'));
+    return { exitCode: 1 };
+  }
+  return runValidateJsonSingle(appKey, opts, outFormat);
+}
+
+module.exports = {
+  runValidateJsonCommand,
+  validateThenWriteDeploy,
+  collectBatchAppNames,
+  looksLikeExistingFilePath
+};

package/lib/commands/verify-governance-combined-external.js

@@ -10,6 +10,56 @@ const {
   buildSubjectsFromOptions,
   resolveGovernanceIntegrationContext
 } = require('./governance-cli-shared');
+const { VERDICT } = require('../lifecycle/product-model');
+const {
+  allDatasourcesAbacNotApplicable,
+  filterAbacRequiredDatasourceKeys
+} = require('../lifecycle/access-control-abac');
+const { runSystemLifecycle } = require('../api/lifecycle.api');
+
+/**
+ * @param {string} resolvedKey
+ * @param {string[]} keys
+ * @param {Object} [extra]
+ * @returns {Object}
+ */
+function buildNotApplicableGovernanceResult(resolvedKey, keys, extra = {}) {
+  return {
+    systemKey: resolvedKey,
+    command: 'verify-governance',
+    verdict: VERDICT.NOT_APPLICABLE,
+    policyCoveragePercent: 100,
+    dimensionCoveragePercent: 100,
+    enforcementScenarios: { passed: 0, total: 0 },
+    datasourceRows: keys.map(datasourceKey => ({
+      datasourceKey,
+      verdict: VERDICT.NOT_APPLICABLE
+    })),
+    ...extra
+  };
+}
+
+/**
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {string} resolvedKey
+ * @param {string[]} keys
+ * @param {Object} [extra]
+ * @returns {Promise<Object>}
+ */
+async function closeAllGovernanceAsNotApplicable(
+  dataplaneUrl,
+  authConfig,
+  resolvedKey,
+  keys,
+  extra = {}
+) {
+  await runSystemLifecycle(dataplaneUrl, authConfig, resolvedKey, {
+    steps: ['governance'],
+    datasourceKeys: keys
+  });
+  return buildNotApplicableGovernanceResult(resolvedKey, keys, extra);
+}
 
 /**
  * @async
@@ -23,22 +73,32 @@ async function runVerifyGovernanceCombined(systemKey, options = {}) {
   }
 
   const subjects = buildSubjectsFromOptions(options);
+  const { resolvedKey, keys, authConfig, dataplaneUrl } =
+    await resolveGovernanceIntegrationContext(systemKey, options);
+
   if (subjects.length === 0) {
-    throw new Error(
-      'At least one --subject-user-id or --subject-email is required for verify-governance'
-    );
+    if (!allDatasourcesAbacNotApplicable(resolvedKey, keys)) {
+      throw new Error(
+        'At least one --subject-user-id or --subject-email is required for verify-governance'
+      );
+    }
+    return closeAllGovernanceAsNotApplicable(dataplaneUrl, authConfig, resolvedKey, keys);
   }
 
-  const { resolvedKey, authConfig, dataplaneUrl } = await resolveGovernanceIntegrationContext(
-    systemKey,
-    options
-  );
+  const requiredKeys = filterAbacRequiredDatasourceKeys(resolvedKey, keys);
+  if (requiredKeys.length === 0) {
+    return closeAllGovernanceAsNotApplicable(dataplaneUrl, authConfig, resolvedKey, keys, {
+      generated: 0,
+      generateResults: []
+    });
+  }
 
   const pipelineOpts = {
     ...options,
     noPublish: true,
     authConfig,
-    dataplaneUrl
+    dataplaneUrl,
+    datasourceKeys: requiredKeys
   };
 
   const generateResult = await runGovernanceGenerateForExternalSystem(
@@ -46,7 +106,11 @@ async function runVerifyGovernanceCombined(systemKey, options = {}) {
     pipelineOpts
   );
 
-  const verifyResult = await runVerifyGovernanceForExternalSystem(resolvedKey, pipelineOpts);
+  // Verify all datasources so notApplicable keys close as NOT_APPLICABLE.
+  const verifyResult = await runVerifyGovernanceForExternalSystem(resolvedKey, {
+    ...pipelineOpts,
+    datasourceKeys: keys
+  });
 
   return {
     ...verifyResult,