@aifabrix/builder 2.51.0 → 2.51.1

package/lib/commands/verify-governance-combined-external.js

@@ -10,6 +10,56 @@ const {
   buildSubjectsFromOptions,
   resolveGovernanceIntegrationContext
 } = require('./governance-cli-shared');
+const { VERDICT } = require('../lifecycle/product-model');
+const {
+  allDatasourcesAbacNotApplicable,
+  filterAbacRequiredDatasourceKeys
+} = require('../lifecycle/access-control-abac');
+const { runSystemLifecycle } = require('../api/lifecycle.api');
+
+/**
+ * @param {string} resolvedKey
+ * @param {string[]} keys
+ * @param {Object} [extra]
+ * @returns {Object}
+ */
+function buildNotApplicableGovernanceResult(resolvedKey, keys, extra = {}) {
+  return {
+    systemKey: resolvedKey,
+    command: 'verify-governance',
+    verdict: VERDICT.NOT_APPLICABLE,
+    policyCoveragePercent: 100,
+    dimensionCoveragePercent: 100,
+    enforcementScenarios: { passed: 0, total: 0 },
+    datasourceRows: keys.map(datasourceKey => ({
+      datasourceKey,
+      verdict: VERDICT.NOT_APPLICABLE
+    })),
+    ...extra
+  };
+}
+
+/**
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {string} resolvedKey
+ * @param {string[]} keys
+ * @param {Object} [extra]
+ * @returns {Promise<Object>}
+ */
+async function closeAllGovernanceAsNotApplicable(
+  dataplaneUrl,
+  authConfig,
+  resolvedKey,
+  keys,
+  extra = {}
+) {
+  await runSystemLifecycle(dataplaneUrl, authConfig, resolvedKey, {
+    steps: ['governance'],
+    datasourceKeys: keys
+  });
+  return buildNotApplicableGovernanceResult(resolvedKey, keys, extra);
+}
 
 /**
  * @async
@@ -23,22 +73,32 @@ async function runVerifyGovernanceCombined(systemKey, options = {}) {
   }
 
   const subjects = buildSubjectsFromOptions(options);
+  const { resolvedKey, keys, authConfig, dataplaneUrl } =
+    await resolveGovernanceIntegrationContext(systemKey, options);
+
   if (subjects.length === 0) {
-    throw new Error(
-      'At least one --subject-user-id or --subject-email is required for verify-governance'
-    );
+    if (!allDatasourcesAbacNotApplicable(resolvedKey, keys)) {
+      throw new Error(
+        'At least one --subject-user-id or --subject-email is required for verify-governance'
+      );
+    }
+    return closeAllGovernanceAsNotApplicable(dataplaneUrl, authConfig, resolvedKey, keys);
   }
 
-  const { resolvedKey, authConfig, dataplaneUrl } = await resolveGovernanceIntegrationContext(
-    systemKey,
-    options
-  );
+  const requiredKeys = filterAbacRequiredDatasourceKeys(resolvedKey, keys);
+  if (requiredKeys.length === 0) {
+    return closeAllGovernanceAsNotApplicable(dataplaneUrl, authConfig, resolvedKey, keys, {
+      generated: 0,
+      generateResults: []
+    });
+  }
 
   const pipelineOpts = {
     ...options,
     noPublish: true,
     authConfig,
-    dataplaneUrl
+    dataplaneUrl,
+    datasourceKeys: requiredKeys
   };
 
   const generateResult = await runGovernanceGenerateForExternalSystem(
@@ -46,7 +106,11 @@ async function runVerifyGovernanceCombined(systemKey, options = {}) {
     pipelineOpts
   );
 
-  const verifyResult = await runVerifyGovernanceForExternalSystem(resolvedKey, pipelineOpts);
+  // Verify all datasources so notApplicable keys close as NOT_APPLICABLE.
+  const verifyResult = await runVerifyGovernanceForExternalSystem(resolvedKey, {
+    ...pipelineOpts,
+    datasourceKeys: keys
+  });
 
   return {
     ...verifyResult,

package/lib/commands/verify-governance-db.js

@@ -27,6 +27,58 @@ function attachUploadAuthToOptions(options, uploadCtx) {
   options.silentResolve = true;
 }
 
+/**
+ * @param {string} key
+ * @param {Object|null} config
+ * @returns {Object}
+ */
+function buildNotApplicableGovernanceRow(key, config) {
+  const {
+    parseAccessControlAbac
+  } = require('../lifecycle/access-control-abac');
+  const abac = parseAccessControlAbac(config);
+  return {
+    datasourceKey: key,
+    verdict: VERDICT.NOT_APPLICABLE,
+    scenarios: { passed: 0, total: 0 },
+    policyCoveragePercent: 100,
+    dimensionCoveragePercent: 100,
+    rationale: abac.rationale
+  };
+}
+
+/**
+ * @param {string} key
+ * @param {Object} ctx
+ * @returns {Promise<Object|null>}
+ */
+async function runRequiredGovernanceDatasource(key, ctx) {
+  try {
+    const packRow = await getDatasourceGovernancePack(ctx.dataplaneUrl, ctx.authConfig, key);
+    if (!packRow || !packRow.pack) {
+      return null;
+    }
+    const result = await runDatasourceGovernanceScenarios(ctx.dataplaneUrl, ctx.authConfig, key);
+    const summary = result.summary || {};
+    return {
+      datasourceKey: key,
+      verdict: summary.failed > 0 ? VERDICT.FAILED : VERDICT.VERIFIED,
+      scenarios: { passed: summary.passed || 0, total: summary.total || 0 },
+      policyCoveragePercent: result.policyCoveragePercent ?? 100,
+      dimensionCoveragePercent: result.dimensionCoveragePercent ?? 100,
+      packDocument: packRow.pack,
+      result
+    };
+  } catch (err) {
+    return {
+      datasourceKey: key,
+      verdict: VERDICT.FAILED,
+      error: err.message,
+      scenarios: { passed: 0, total: 0 }
+    };
+  }
+}
+
 /**
  * @async
  * @param {string[]} keys
@@ -35,35 +87,27 @@ function attachUploadAuthToOptions(options, uploadCtx) {
  * @returns {Promise<Array>}
  */
 async function runGovernanceForDatasourceKeys(keys, ctx, progress = {}) {
+  const {
+    filterAbacRequiredDatasourceKeys,
+    loadDatasourceConfigsByKey
+  } = require('../lifecycle/access-control-abac');
+  const configs = loadDatasourceConfigsByKey(ctx.systemKey || '');
+  const required = new Set(
+    filterAbacRequiredDatasourceKeys(ctx.systemKey || '', keys)
+  );
   const rows = [];
   for (let index = 0; index < keys.length; index += 1) {
     const key = keys[index];
     if (typeof progress.setLabel === 'function') {
       progress.setLabel(`Running governance scenarios: ${key} (${index + 1}/${keys.length})`);
     }
-    try {
-      const packRow = await getDatasourceGovernancePack(ctx.dataplaneUrl, ctx.authConfig, key);
-      if (!packRow || !packRow.pack) {
-        continue;
-      }
-      const result = await runDatasourceGovernanceScenarios(ctx.dataplaneUrl, ctx.authConfig, key);
-      const summary = result.summary || {};
-      rows.push({
-        datasourceKey: key,
-        verdict: summary.failed > 0 ? VERDICT.FAILED : VERDICT.VERIFIED,
-        scenarios: { passed: summary.passed || 0, total: summary.total || 0 },
-        policyCoveragePercent: result.policyCoveragePercent ?? 100,
-        dimensionCoveragePercent: result.dimensionCoveragePercent ?? 100,
-        packDocument: packRow.pack,
-        result
-      });
-    } catch (err) {
-      rows.push({
-        datasourceKey: key,
-        verdict: VERDICT.FAILED,
-        error: err.message,
-        scenarios: { passed: 0, total: 0 }
-      });
+    if (!required.has(key)) {
+      rows.push(buildNotApplicableGovernanceRow(key, configs.get(key) || null));
+      continue;
+    }
+    const row = await runRequiredGovernanceDatasource(key, ctx);
+    if (row) {
+      rows.push(row);
     }
   }
   return rows;
@@ -76,7 +120,12 @@ async function runGovernanceForDatasourceKeys(keys, ctx, progress = {}) {
  * @returns {Promise<Object>}
  */
 async function runVerifyGovernanceFromDbPacks(systemKey, options) {
-  const { systemKey: resolvedKey, keys } = resolveExternalIntegrationContext(systemKey);
+  const { systemKey: resolvedKey, keys: discoveredKeys } =
+    resolveExternalIntegrationContext(systemKey);
+  const keys =
+    Array.isArray(options.datasourceKeys) && options.datasourceKeys.length
+      ? options.datasourceKeys
+      : discoveredKeys;
   if (keys.length === 0) {
     return { resolvedKey, datasourceRows: [] };
   }
@@ -87,10 +136,16 @@ async function runVerifyGovernanceFromDbPacks(systemKey, options) {
   }
 
   const { authConfig, dataplaneUrl } = await resolveIntegrationAuth(resolvedKey, options);
+  options.authConfig = authConfig;
+  options.dataplaneUrl = dataplaneUrl;
   const datasourceRows = await runWithVerifyStepProgress(
     'Running governance scenarios',
     async(progress) =>
-      runGovernanceForDatasourceKeys(keys, { authConfig, dataplaneUrl }, progress),
+      runGovernanceForDatasourceKeys(
+        keys,
+        { authConfig, dataplaneUrl, systemKey: resolvedKey },
+        progress
+      ),
     options
   );
   return { resolvedKey, datasourceRows };

package/lib/commands/verify-governance-external.js

@@ -8,7 +8,7 @@
 
 const { runTestGovernanceForExternalSystem } = require('./test-governance-external');
 const { runVerifyGovernanceFromDbPacks } = require('./verify-governance-db');
-const { VERDICT, verdictFromPassed } = require('../lifecycle/product-model');
+const { VERDICT } = require('../lifecycle/product-model');
 const {
   sumEnforcementScenarios,
   aggregateCoverage,
@@ -20,14 +20,26 @@ const {
  * @returns {{ passed: number, total: number }}
  */
 function buildDbPackResult(resolvedKey, datasourceRows) {
-  const allVerified = datasourceRows.every(r => r.verdict === VERDICT.VERIFIED);
+  const hasFailed = datasourceRows.some(r => r.verdict === VERDICT.FAILED);
+  const allNa =
+    datasourceRows.length > 0
+    && datasourceRows.every(r => r.verdict === VERDICT.NOT_APPLICABLE);
+  const allClosed = datasourceRows.every(
+    r => r.verdict === VERDICT.VERIFIED || r.verdict === VERDICT.NOT_APPLICABLE
+  );
+  let verdict = VERDICT.FAILED;
+  if (allNa) {
+    verdict = VERDICT.NOT_APPLICABLE;
+  } else if (allClosed && !hasFailed) {
+    verdict = VERDICT.VERIFIED;
+  }
   const coverage = aggregateCoverage(datasourceRows);
   return {
     systemKey: resolvedKey,
     command: 'verify-governance',
-    verdict: verdictFromPassed(allVerified),
-    policyCoveragePercent: coverage.policy ?? (allVerified ? 100 : 0),
-    dimensionCoveragePercent: coverage.dimension ?? (allVerified ? 100 : 0),
+    verdict,
+    policyCoveragePercent: coverage.policy ?? (allClosed ? 100 : 0),
+    dimensionCoveragePercent: coverage.dimension ?? (allClosed ? 100 : 0),
     enforcementScenarios: sumEnforcementScenarios(datasourceRows),
     datasourceRows
   };
@@ -66,6 +78,18 @@ async function runVerifyGovernanceForExternalSystem(systemKey, options = {}) {
     };
   }
 
+  const naKeys = datasourceRows
+    .filter(row => row.verdict === VERDICT.NOT_APPLICABLE)
+    .map(row => row.datasourceKey)
+    .filter(Boolean);
+  if (naKeys.length > 0 && options.authConfig && options.dataplaneUrl) {
+    const { runSystemLifecycle } = require('../api/lifecycle.api');
+    await runSystemLifecycle(options.dataplaneUrl, options.authConfig, resolvedKey, {
+      steps: ['governance'],
+      datasourceKeys: naKeys
+    });
+  }
+
   return buildDbPackResult(resolvedKey, datasourceRows);
 }
 

package/lib/commands/wizard-core-helpers.js

@@ -232,15 +232,19 @@ function buildPlatformConfigPayload({ credentialIdOrKey, datasourceKeys, configu
 }
 
 /**
- * Extract configuration from API response
+ * Extract configuration from API response.
+ * add-datasource generation returns datasourceConfig(s) only (systemConfig is null by design).
+ * Callers must load the existing workspace system when systemConfig is missing.
  * @param {Object} generateResponse - API response
  * @returns {Object} Extracted configuration
  */
 function extractConfigurationFromResponse(generateResponse) {
-  const systemConfig = generateResponse.data?.systemConfig;
+  const systemConfig = generateResponse.data?.systemConfig || null;
   const datasourceConfigs = generateResponse.data?.datasourceConfigs ||
     (generateResponse.data?.datasourceConfig ? [generateResponse.data.datasourceConfig] : []);
-  if (!systemConfig) throw new Error('System configuration not found');
+  if (!systemConfig && (!Array.isArray(datasourceConfigs) || datasourceConfigs.length === 0)) {
+    throw new Error('System configuration not found');
+  }
   return { systemConfig, datasourceConfigs, systemKey: generateResponse.data?.systemKey };
 }
 

package/lib/commands/wizard-core.js

@@ -312,6 +312,72 @@ async function callGenerateApi(dataplaneUrl, authConfig, options, prefs) {
   return await generateConfig(dataplaneUrl, authConfig, configPayload);
 }
 
+/**
+ * Load existing system JSON/YAML from the integration workspace (add-datasource).
+ * @param {string} appName - Integration app / system key
+ * @returns {Object|null}
+ */
+function loadExistingWorkspaceSystemConfig(appName) {
+  if (!appName || typeof appName !== 'string') {
+    return null;
+  }
+  const { getIntegrationPath } = require('../utils/paths');
+  const { loadConfigFile } = require('../utils/config-format');
+  const fsSync = require('fs');
+  const appPath = getIntegrationPath(appName);
+  for (const ext of ['.json', '.yaml', '.yml']) {
+    const candidate = path.join(appPath, `${appName}-system${ext}`);
+    if (fsSync.existsSync(candidate)) {
+      try {
+        return loadConfigFile(candidate);
+      } catch {
+        return null;
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * @param {Object|null|undefined} systemConfig
+ * @param {Object} options
+ * @returns {Object}
+ */
+function resolveSystemConfigForWizardMode(systemConfig, options) {
+  if (systemConfig) {
+    return systemConfig;
+  }
+  if (options.mode === 'add-datasource') {
+    const existing = loadExistingWorkspaceSystemConfig(
+      options.appName || options.systemIdOrKey
+    );
+    if (!existing) {
+      throw new Error(
+        'System configuration not found for add-datasource. ' +
+          'Run create-system wizard first so the workspace has a system file.'
+      );
+    }
+    return existing;
+  }
+  throw new Error('System configuration not found');
+}
+
+/**
+ * @param {Object} generateResponse
+ * @param {Object} prefs
+ * @param {Object} options
+ * @returns {Promise<void>}
+ */
+async function maybeWriteWizardDebugLog(generateResponse, prefs, options) {
+  if (!prefs.debug || !options.appName) {
+    return;
+  }
+  const debugLog = generateResponse.data?.debugLog;
+  if (debugLog && typeof debugLog === 'string') {
+    await writeDebugLog(options.appName, debugLog);
+  }
+}
+
 async function handleConfigurationGeneration(dataplaneUrl, authConfig, options) {
   logger.log(chalk.blue('\n\uD83D\uDCCB Step 5: Generate Configuration'));
   const prefs = buildConfigPreferences(options.configPrefs);
@@ -320,18 +386,21 @@ async function handleConfigurationGeneration(dataplaneUrl, authConfig, options)
     const generateResponse = await callGenerateApi(dataplaneUrl, authConfig, options, prefs);
     spinner.stop();
     if (!generateResponse.success) {
-      await saveDebugManifestOnErrorAndThrow(generateResponse, { enableDebug: prefs.debug, appName: options.appName });
+      await saveDebugManifestOnErrorAndThrow(generateResponse, {
+        enableDebug: prefs.debug,
+        appName: options.appName
+      });
     }
     const result = extractConfigurationFromResponse(generateResponse);
-    const normalized = normalizeWizardConfigs(result.systemConfig, result.datasourceConfigs);
-    if (prefs.debug && options.appName) {
-      const debugLog = generateResponse.data?.debugLog;
-      if (debugLog && typeof debugLog === 'string') {
-        await writeDebugLog(options.appName, debugLog);
-      }
-    }
+    const systemConfig = resolveSystemConfigForWizardMode(result.systemConfig, options);
+    const normalized = normalizeWizardConfigs(systemConfig, result.datasourceConfigs);
+    await maybeWriteWizardDebugLog(generateResponse, prefs, options);
     logger.log(formatSuccessLine('Configuration generated successfully'));
-    return { systemConfig: normalized.systemConfig, datasourceConfigs: normalized.datasourceConfigs, systemKey: result.systemKey };
+    return {
+      systemConfig: normalized.systemConfig,
+      datasourceConfigs: normalized.datasourceConfigs,
+      systemKey: result.systemKey || options.systemIdOrKey || options.appName
+    };
   } catch (error) {
     spinner.stop();
     throw error;

package/lib/datasource/bulk-loader-run-batches.js

@@ -70,19 +70,21 @@ function recordBatchSuccess(state, index, response, batchRecords) {
  * @returns {Promise<{ batches: Object[], totals: Object }>}
  */
 async function uploadRecordBatches(params) {
-  const { chunks, syncType, dataplaneUrl, datasourceKey, authConfig } = params;
+  const { chunks, syncType, dataplaneUrl, datasourceKey, authConfig, timeoutMs } = params;
   const state = {
     batches: [],
     totals: { insertedCount: 0, updatedCount: 0, failedCount: 0 },
     chunkCount: chunks.length
   };
+  const transportOpts =
+    timeoutMs !== undefined && timeoutMs !== null ? { timeoutMs } : {};
 
   for (let i = 0; i < chunks.length; i += 1) {
     const batchRecords = chunks[i];
     const body = { syncType, sync: false, records: batchRecords };
     try {
       const response = await withTransientRetry(() =>
-        bulkSyncRecords(dataplaneUrl, datasourceKey, authConfig, body)
+        bulkSyncRecords(dataplaneUrl, datasourceKey, authConfig, body, transportOpts)
       );
       recordBatchSuccess(state, i, response, batchRecords);
     } catch (err) {

package/lib/datasource/bulk-loader-service.js

@@ -81,12 +81,16 @@ async function executeDatasourceLoadWork(params) {
     return { ...result, context: ctx };
   }
 
+  const timeoutMs = options.timeoutMs
+    ? parseInt(String(options.timeoutMs), 10)
+    : undefined;
   const { batches, totals } = await uploadRecordBatches({
     chunks: chunkRecords(records, batchSize),
     syncType,
     dataplaneUrl: ctx.dataplaneUrl,
     datasourceKey: ctx.datasourceKey,
-    authConfig: ctx.authConfig
+    authConfig: ctx.authConfig,
+    timeoutMs: Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : undefined
   });
 
   return { ...result, batches, totals, context: ctx };

package/lib/datasource/datasource-validate-summary.js

@@ -167,10 +167,10 @@ function assembleSummary(parsed) {
     foreignKeys: fks,
     dimensionKeys,
     dimensions,
-    exposedProfileNames: summarizeExposedProfileNames(parsed),
-    openapiLine: oa.openapiLine,
     hasOpenapi: oa.hasOpenapi,
+    openapiLine: oa.openapiLine,
     capabilityKeys: oa.capabilityKeys,
+    exposedProfileNames: summarizeExposedProfileNames(parsed),
     testPayloadLine: summarizeTestPayloadLine(parsed),
     hasTestPayload: !!parsed.testPayload && typeof parsed.testPayload === 'object',
     syncLine: summarizeSyncLine(sync)

package/lib/datasource/validate.js

@@ -242,9 +242,7 @@ async function validateDatasourceFile(filePathOrKey) {
     };
   }
 
-  const fieldRefErrors = validateFieldReferences(parsed);
-  const abacErrors = validateAbac(parsed);
-  const postSchemaErrors = [...fieldRefErrors, ...abacErrors];
+  const postSchemaErrors = collectPostSchemaErrors(parsed);
   if (postSchemaErrors.length > 0) {
     return {
       valid: false,
@@ -264,6 +262,17 @@ async function validateDatasourceFile(filePathOrKey) {
   };
 }
 
+/**
+ * @param {object} parsed
+ * @returns {string[]}
+ */
+function collectPostSchemaErrors(parsed) {
+  return [
+    ...validateFieldReferences(parsed),
+    ...validateAbac(parsed)
+  ];
+}
+
 /**
  * Validates parsed datasource JSON (same rules as {@link validateDatasourceFile}, without reading a file).
  *
@@ -294,9 +303,7 @@ function validateDatasourceParsed(parsed) {
     };
   }
 
-  const fieldRefErrors = validateFieldReferences(parsed);
-  const abacErrors = validateAbac(parsed);
-  const postSchemaErrors = [...fieldRefErrors, ...abacErrors];
+  const postSchemaErrors = collectPostSchemaErrors(parsed);
   if (postSchemaErrors.length > 0) {
     return {
       valid: false,

package/lib/external-system/deploy-helpers.js

@@ -133,12 +133,46 @@ function extractSystemKey(systemFilePath) {
   return systemFileName.replace(/-deploy$/, '');
 }
 
+/**
+ * Role Assistant (digitalWorker) deploy uses upload, not controller deploy.
+ * @async
+ * @param {string} appName - Application name
+ * @param {Object} options - Deploy options
+ * @param {boolean} compact - Quiet UI when true
+ * @param {Object} manifest - Controller manifest
+ * @returns {Promise<Object|null>} Upload result, or null when not a digital worker
+ */
+async function uploadDigitalWorkerIfNeeded(appName, options, compact, manifest) {
+  const systemKind =
+    manifest && manifest.system && typeof manifest.system.systemKind === 'string'
+      ? manifest.system.systemKind.trim()
+      : '';
+  if (systemKind !== 'digitalWorker') {
+    return null;
+  }
+  if (!compact) {
+    const { formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
+    const logger = require('../utils/logger');
+    logger.log(
+      formatSuccessParagraph(
+        'Role Assistant deployment uses upload pipeline (controller deploy is skipped).'
+      )
+    );
+  }
+  const { uploadExternalSystem } = require('../commands/upload');
+  return uploadExternalSystem(appName, {
+    ...options,
+    uploadStatus: 'published'
+  });
+}
+
 module.exports = {
   loadVariablesYaml,
   validateSingleSystemFile,
   validateSystemFiles,
   validateSingleDatasourceFile,
   validateDatasourceFiles,
-  extractSystemKey
+  extractSystemKey,
+  uploadDigitalWorkerIfNeeded
 };
 

package/lib/external-system/deploy.js

@@ -30,6 +30,7 @@ const { displayValidationResults } = require('../validation/validate-display');
 const { syncDeployJsonFromSources } = require('./sync-deploy-manifest');
 const { runDeployGateOrchestrator } = require('../commands/deploy-gate-orchestrator');
 const { runPostPublishDataSync } = require('../commands/run-post-publish-data-sync');
+const { uploadDigitalWorkerIfNeeded } = require('./deploy-helpers');
 
 /**
  * Validates manifest on dataplane (dry-run) before controller deploy.
@@ -342,8 +343,20 @@ async function executeDeployAndDisplay(manifest, controllerUrl, environment, aut
  * @param {Object} options - Deployment options
  * @returns {Promise<Object>} Deployment configuration
  */
-async function prepareDeploymentConfig(appName, _options) {
+async function prepareDeploymentConfig(appName, options = {}) {
   const { resolveEnvironment } = require('../core/config');
+  if (options.authConfig && (options.authConfig.token || options.authConfig.clientId)) {
+    const environment = options.environment || (await resolveEnvironment());
+    let controllerUrl = options.controllerUrl || '';
+    if (!controllerUrl) {
+      controllerUrl = await resolveControllerUrl();
+    }
+    if (!controllerUrl) {
+      throw new Error('Controller URL is required. Run "aifabrix login" first.');
+    }
+    return { environment, controllerUrl, authConfig: options.authConfig };
+  }
+
   const environment = await resolveEnvironment();
   const controllerUrl = await resolveControllerUrl();
   const authConfig = await getDeploymentAuth(controllerUrl, environment, appName);
@@ -413,24 +426,26 @@ async function runExternalSystemDeployFlow(appName, options) {
   const compact = options.verbose !== true;
   const { appPath } = await detectAppType(appName);
   logOfflinePathWhenType(appPath);
-
   if (!compact) {
     logger.log(chalk.blue(`\n🚀 Deploying external system: ${appName}`));
   }
-
   await validateExternalSystemForDeploy(appName, options, compact);
-
   const gateOutcomes = await runDeployGateOrchestrator(appName, {
     ...options,
     quietDeployUi: compact
   });
-
   await syncDeployJsonFromSources(appName);
-
   const manifest = await generateControllerManifest(appName, options);
-
+  const digitalWorkerResult = await uploadDigitalWorkerIfNeeded(
+    appName,
+    options,
+    compact,
+    manifest
+  );
+  if (digitalWorkerResult) {
+    return digitalWorkerResult;
+  }
   const { environment, controllerUrl, authConfig } = await prepareDeploymentConfig(appName, options);
-
   let dataplaneUrl;
   try {
     dataplaneUrl = await resolveDataplaneUrl(controllerUrl, environment, authConfig, {
@@ -439,9 +454,7 @@ async function runExternalSystemDeployFlow(appName, options) {
   } catch (err) {
     throw new Error(`Failed to resolve dataplane URL before deploy: ${err.message}`);
   }
-
   await validateDataplaneManifestForDeploy(manifest, authConfig, dataplaneUrl, compact);
-
   return executeDeployAndDisplay(manifest, controllerUrl, environment, authConfig, {
     ...options,
     gateOutcomes,