@aifabrix/builder 2.51.1 → 2.52.1

package/lib/commands/role-assistant.js

@@ -8,6 +8,7 @@
 
 'use strict';
 
+const path = require('path');
 const logger = require('../utils/logger');
 const { handleCommandError } = require('../utils/cli-utils');
 const {
@@ -22,6 +23,11 @@ const {
   loadRoleAssistantTestCase,
   evaluateRoleAssistantTestCase
 } = require('../role-assistant/test-cases');
+const {
+  resolveCasesRoot,
+  discoverSuiteCaseFiles,
+  filterDiscoveredCases
+} = require('../role-assistant/test-suite');
 const {
   isExecutableRoleAssistantCase,
   runRoleAssistantCaseLifecycle,
@@ -32,12 +38,17 @@ const { collectString } = require('./governance');
 const {
   sectionTitle,
   headerKeyValue,
-  formatSuccessLine,
-  formatSuccessParagraph,
-  formatWarningLine,
-  formatBlockingError,
   metadata
 } = require('../utils/cli-test-layout-chalk');
+const {
+  formatStepsRunSummary,
+  buildRoleAssistantTestEnvelope,
+  displayRoleAssistantTestSummary
+} = require('./role-assistant-test-output');
+const {
+  bareRoleKey,
+  roleAssistantSystemKey
+} = require('../utils/role-assistant-paths');
 
 function roleAssistantHelpAfter() {
   return `
@@ -46,8 +57,9 @@ Examples:
   $ aifabrix role-assistant test customer-support-bot --case smoke
   $ aifabrix role-assistant test customer-support-bot --case tests/customer-address-change.yaml
   $ aifabrix role-assistant test customer-support-bot --subject-email ops@example.com
-  $ aifabrix role-assistant test customer-support-bot --json
-  $ aifabrix role-assistant test customer-support-bot --publish --force
+  $ aifabrix role-assistant test customer-support-bot --suite 001
+  $ aifabrix role-assistant test customer-support-bot --list-cases
+  $ aifabrix role-assistant test customer-support-bot --suite 001 --fail-fast --json
 
 Notes:
   - Uses the public/running Role Assistant on the dataplane by default (does not publish local datasources).
@@ -55,6 +67,7 @@ Notes:
   - Runs lifecycle checks, then prints a portal deep link for full step-by-step status.
   - Case files with input.message/input.content execute Work Hub plan→accept (or work.start when executionPath: intent).
   - answers[] and approvals[] are matched to runtime wait payloads (questionKey/requestKey/waitReason).
+  - --suite runs all YAML under tests/role-assistant/ra-<roleKey>/<suite>/ (or --cases-root).
   - Use the portal URL for detailed human review while automation reads CLI/JSON output.
 `;
 }
@@ -91,97 +104,123 @@ function normalizeRoleAssistantTestOptions(options, cmd) {
     certificationProfile: options.certificationProfile || 'bronze',
     case: trimOptionalString(options.case),
     testsDir: trimOptionalString(options.testsDir),
+    suite: trimOptionalString(options.suite),
+    casesRoot: trimOptionalString(options.casesRoot),
+    listCases: optionOrFlag(options, 'listCases', cmd, '--list-cases'),
+    failFast: optionOrFlag(options, 'failFast', cmd, '--fail-fast'),
     run: true
   };
 }
 
-function buildRoleAssistantTestEnvelope(roleKey, verdict, portalUrl, result, opts, caseResult = null) {
-  const report = result.report || {};
-  const envelope = {
-    roleKey,
-    command: 'role-assistant test',
-    verdict,
-    portalUrl,
-    openApiPublished: result.openApiPublished === true,
-    certification: report.certification || null,
-    recommendations: Array.isArray(report.recommendations) ? report.recommendations : [],
-    warnings: Array.isArray(report.warnings) ? report.warnings : [],
-    stepsRun: result.stepsRun || [],
-    case: caseResult
-      ? {
-        caseId: caseResult.caseId,
-        sourceFile: caseResult.sourceFile,
-        passed: caseResult.passed,
-        lifecycleState: caseResult.lifecycleState,
-        assertions: caseResult.assertions,
-        failedAssertions: caseResult.failedAssertions,
-        warnings: Array.isArray(caseResult.warnings) ? caseResult.warnings : [],
-        execution: caseResult.execution || null
-      }
-      : null
-  };
-  if (opts.verbose || opts.debug) {
-    envelope.report = report;
+function computeRoleAssistantExitCode(verdict, caseResult) {
+  if (Array.isArray(caseResult)) {
+    if (caseResult.some((row) => row && row.passed === false)) {
+      return 2;
+    }
+    return 0;
   }
-  if (opts.debug) {
-    envelope.debug = {
-      observation: caseResult ? caseResult.observation : null,
-      lifecycleResult: result
-    };
+  if (caseResult) {
+    return caseResult.passed ? 0 : 2;
   }
-  return envelope;
+  if (verdict === VERDICT.VERIFIED) {
+    return 0;
+  }
+  return exitCodeFromVerdict(verdict, { partial: verdict === VERDICT.NOT_VERIFIED });
 }
 
-function displayCaseResultSummary(caseResult) {
-  if (!caseResult) {
-    return;
+function listRoleAssistantCases(roleKey, opts) {
+  const root = resolveCasesRoot(roleKey, { casesRoot: opts.casesRoot || undefined });
+  const rows = discoverSuiteCaseFiles(root, { suite: opts.suite || undefined });
+  const filtered = filterDiscoveredCases(rows, opts.case);
+  if (opts.json) {
+    logger.log(
+      JSON.stringify(
+        {
+          roleKey: bareRoleKey(roleKey),
+          command: 'role-assistant test',
+          mode: 'list-cases',
+          casesRoot: root,
+          cases: filtered.map((r) => ({
+            suite: r.suite,
+            file: r.file,
+            path: r.absPath,
+            caseIdHint: r.caseIdHint
+          }))
+        },
+        null,
+        2
+      )
+    );
+  } else {
+    logger.log(sectionTitle('ROLE ASSISTANT CASES'));
+    logger.log(headerKeyValue('Cases root:', root));
+    for (const row of filtered) {
+      logger.log(`${row.suite}\t${row.file}\t${row.absPath}`);
+    }
+    logger.log(metadata(`total ${filtered.length}`));
   }
-  logger.log(headerKeyValue('Case:', caseResult.caseId));
-  logger.log(headerKeyValue('Case file:', caseResult.sourceFile));
-  logger.log(headerKeyValue('Observed state:', caseResult.lifecycleState));
-  if (caseResult.execution) {
-    logger.log(headerKeyValue('Execution id:', caseResult.execution.processExecutionId || 'n/a'));
-    logger.log(headerKeyValue('Final runtime status:', caseResult.execution.finalStatus || 'n/a'));
+  return 0;
+}
+
+async function resolveSuiteCaseResults(systemKey, opts, result, verdict, portalUrl) {
+  const root = resolveCasesRoot(systemKey, { casesRoot: opts.casesRoot || undefined });
+  const discovered = discoverSuiteCaseFiles(root, { suite: opts.suite || undefined });
+  const selected = filterDiscoveredCases(discovered, opts.case);
+  if (selected.length === 0) {
+    throw new Error(
+      `No role-assistant cases found under ${root}` +
+        (opts.suite ? ` suite=${opts.suite}` : '')
+    );
   }
-  if (caseResult.passed) {
-    logger.log(formatSuccessLine('Case assertions passed.'));
-    const warnings = Array.isArray(caseResult.warnings) ? caseResult.warnings : [];
-    for (const row of warnings) {
-      logger.log(formatWarningLine(row.message || String(row)));
+  const outcomes = [];
+  for (const row of selected) {
+    const caseOpts = { ...opts, case: row.absPath, testsDir: path.dirname(row.absPath) };
+    const one = await resolveRoleAssistantCaseResult(systemKey, caseOpts, result, verdict, portalUrl);
+    outcomes.push(one);
+    if (opts.failFast && one && one.passed === false) {
+      break;
     }
-    return;
-  }
-  logger.log(formatBlockingError('Case assertions failed.'));
-  for (const row of caseResult.failedAssertions) {
-    logger.log(formatWarningLine(row.message));
   }
+  return outcomes;
 }
 
-function displayRoleAssistantTestSummary(roleKey, verdict, portalUrl, result, caseResult = null) {
-  logger.log('');
-  logger.log(sectionTitle(`${String(roleKey).toUpperCase()} ROLE ASSISTANT TEST`));
-  logger.log('');
-  logger.log(headerKeyValue('Role key:', roleKey));
-  if (portalUrl) {
-    logger.log(headerKeyValue('Portal:', portalUrl));
+async function runRoleAssistantTestAction(roleKey, options, cmd) {
+  const opts = normalizeRoleAssistantTestOptions(options, cmd);
+  const systemKey = roleAssistantSystemKey(roleKey);
+  const displayKey = bareRoleKey(roleKey);
+
+  if (opts.listCases) {
+    return listRoleAssistantCases(systemKey, opts);
+  }
+
+  const result = await runLifecycleForExternalSystem(systemKey, opts);
+  const verdict = lifecycleVerdictFromReport(result.report || {});
+  const portalUrl = buildExternalSystemUiUrl(result.dataplaneUiBaseUrl, systemKey);
+
+  let caseResult = null;
+  if (opts.suite) {
+    caseResult = await resolveSuiteCaseResults(systemKey, opts, result, verdict, portalUrl);
   } else {
-    logger.log(formatWarningLine('Portal link unavailable. Configure dataplane public URL and retry.'));
+    caseResult = await resolveRoleAssistantCaseResult(systemKey, opts, result, verdict, portalUrl);
   }
-  const verdictMessage =
-    verdict === VERDICT.VERIFIED
-      ? 'Lifecycle checks passed. Open portal for full execution steps and logs.'
-      : 'Lifecycle checks are not fully verified. Open portal to inspect blocking steps.';
-  if (verdict === VERDICT.VERIFIED) {
-    logger.log(formatSuccessParagraph(verdictMessage));
+
+  if (opts.json) {
+    logger.log(
+      JSON.stringify(
+        buildRoleAssistantTestEnvelope(displayKey, verdict, portalUrl, result, opts, caseResult),
+        null,
+        2
+      )
+    );
   } else {
-    logger.log(formatWarningLine(verdictMessage));
+    displayRoleAssistantTestSummary(displayKey, verdict, portalUrl, result, caseResult);
   }
-  const steps = Array.isArray(result.stepsRun) ? result.stepsRun : [];
-  if (steps.length > 0) {
-    const labels = steps.map((row) => (row && row.pillar ? row.pillar : String(row)));
-    logger.log(metadata(`Steps run: ${labels.join(', ')}`));
+
+  const exitCode = computeRoleAssistantExitCode(verdict, caseResult);
+  if (exitCode !== 0) {
+    process.exit(exitCode);
   }
-  displayCaseResultSummary(caseResult);
+  return exitCode;
 }
 
 async function resolveRoleAssistantCaseResult(roleKey, opts, result, verdict, portalUrl) {
@@ -218,41 +257,6 @@ async function resolveRoleAssistantCaseResult(roleKey, opts, result, verdict, po
   return evaluation;
 }
 
-function computeRoleAssistantExitCode(verdict, caseResult) {
-  if (caseResult) {
-    return caseResult.passed ? 0 : 2;
-  }
-  if (verdict === VERDICT.VERIFIED) {
-    return 0;
-  }
-  return exitCodeFromVerdict(verdict, { partial: verdict === VERDICT.NOT_VERIFIED });
-}
-
-async function runRoleAssistantTestAction(roleKey, options, cmd) {
-  const opts = normalizeRoleAssistantTestOptions(options, cmd);
-  const result = await runLifecycleForExternalSystem(roleKey, opts);
-  const verdict = lifecycleVerdictFromReport(result.report || {});
-  const portalUrl = buildExternalSystemUiUrl(result.dataplaneUiBaseUrl, roleKey);
-  const caseResult = await resolveRoleAssistantCaseResult(roleKey, opts, result, verdict, portalUrl);
-
-  if (opts.json) {
-    logger.log(
-      JSON.stringify(
-        buildRoleAssistantTestEnvelope(roleKey, verdict, portalUrl, result, opts, caseResult),
-        null,
-        2
-      )
-    );
-  } else {
-    displayRoleAssistantTestSummary(roleKey, verdict, portalUrl, result, caseResult);
-  }
-
-  const exitCode = computeRoleAssistantExitCode(verdict, caseResult);
-  if (exitCode !== 0) {
-    process.exit(exitCode);
-  }
-}
-
 async function roleAssistantTestHandler(roleKey, options, cmd) {
   try {
     await runRoleAssistantTestAction(roleKey, options, cmd);
@@ -273,6 +277,16 @@ function setupRoleAssistantCommands(program) {
     .option('-e, --env <env>', 'Environment: dev, tst, or pro', 'dev')
     .option('--case <caseIdOrPath>', 'Run and evaluate one role-assistant test case')
     .option('--tests-dir <dir>', 'Override role-assistant test case directory')
+    .option(
+      '--suite <suiteId>',
+      'Run all YAML cases under tests/role-assistant/ra-<roleKey>/<suiteId>/'
+    )
+    .option(
+      '--cases-root <dir>',
+      'Override cases root (default: tests/role-assistant/ra-<roleKey>/)'
+    )
+    .option('--list-cases', 'List discoverable case files and exit')
+    .option('--fail-fast', 'Stop suite run after the first failing case')
     .option('-v, --verbose', 'Include full lifecycle report payload in --json output')
     .option('-d, --debug', 'Write debug logs under role-assistant/<roleKey>/logs/')
     .option(
@@ -309,5 +323,8 @@ module.exports = {
   normalizeRoleAssistantTestOptions,
   buildRoleAssistantTestEnvelope,
   computeRoleAssistantExitCode,
-  resolveRoleAssistantCaseResult
+  resolveRoleAssistantCaseResult,
+  resolveSuiteCaseResults,
+  listRoleAssistantCases,
+  formatStepsRunSummary
 };

package/lib/commands/test-governance-external.js

@@ -23,12 +23,9 @@ const { syncLocalIfRequested } = require('./test-e2e-external');
  */
 async function runTestGovernanceForExternalSystem(externalSystem, options = {}) {
   const pathsUtil = require('../utils/paths');
+  const { assertCertifyExternalWorkspace } = require('../utils/certify-external-workspace');
   const appType = await pathsUtil.detectAppType(externalSystem).catch(() => null);
-  if (!appType || appType.baseDir !== 'integration') {
-    throw new Error(
-      'verify-governance applies to external integration folders only (integration/<systemKey>/).'
-    );
-  }
+  assertCertifyExternalWorkspace(appType && appType.baseDir, 'verify-governance');
 
   const systemKey = externalSystem;
   const packPath = resolveGovernancePackPath(systemKey, {

package/lib/commands/up-miso.js

@@ -41,40 +41,73 @@ function parseImageOptions(imageOpts) {
   return map;
 }
 
-/**
- * Build run options and run keycloak, then miso-controller
- * @async
- * @param {Object} options - Commander options (image, registry, registryMode)
- */
-async function runMisoApps(options) {
-  const imageMap = parseImageOptions(options.image);
+function buildPlatformCommonRunOpts(options) {
   const useBaseImage = options.base !== false;
-  const common = {
+  return {
     registry: options.registry,
     registryMode: options.registryMode,
     skipEnvOutputPath: true,
     skipInfraCheck: true,
     base: useBaseImage,
-    skipManifestMetadataLine: true
+    skipManifestMetadataLine: true,
+    ...(options.platformInstall === true ? { silentPoll: true } : {})
   };
-  const platformPollOpts =
-    options.platformInstall === true
-      ? { silentPoll: true }
-      : {};
-  const keycloakRunOpts = { ...common, ...platformPollOpts };
+}
+
+function applyDeferredPublicUrlWarning(runOpts, options) {
+  if (typeof options.onDeferredPublicUrlWarning !== 'function') {
+    return runOpts;
+  }
+  return {
+    ...runOpts,
+    deferPublicUrlWarning: true,
+    onDeferredPublicUrlWarning: options.onDeferredPublicUrlWarning
+  };
+}
+
+function buildKeycloakRunOpts(options, imageMap) {
+  const runOpts = applyDeferredPublicUrlWarning(buildPlatformCommonRunOpts(options), options);
   if (imageMap.keycloak) {
-    keycloakRunOpts.image = imageMap.keycloak;
+    runOpts.image = imageMap.keycloak;
   }
-  const misoRunOpts = { ...common, ...platformPollOpts };
+  return runOpts;
+}
+
+function buildMisoControllerRunOpts(options, imageMap) {
+  const runOpts = applyDeferredPublicUrlWarning(buildPlatformCommonRunOpts(options), options);
   if (imageMap['miso-controller']) {
-    misoRunOpts.image = imageMap['miso-controller'];
+    runOpts.image = imageMap['miso-controller'];
   }
+  if (typeof options.onMisoPollText === 'function') {
+    runOpts.onPollText = options.onMisoPollText;
+    delete runOpts.silentPoll;
+  }
+  return runOpts;
+}
+
+/**
+ * Build run options and run keycloak, then miso-controller
+ * @async
+ * @param {Object} options - Commander options (image, registry, registryMode)
+ */
+async function runMisoApps(options) {
+  const imageMap = parseImageOptions(options.image);
+  const keycloakRunOpts = buildKeycloakRunOpts(options, imageMap);
+  const misoRunOpts = buildMisoControllerRunOpts(options, imageMap);
   const { emitSystemBuilderAppManifestLineIfTTY } = require('../utils/manifest-source-emit');
-  logger.log(chalk.blue('Starting keycloak...'));
-  emitSystemBuilderAppManifestLineIfTTY(logger, 'keycloak');
+  const platformInstall = options.platformInstall === true;
+  if (!platformInstall) {
+    logger.log(chalk.blue('Starting keycloak...'));
+    emitSystemBuilderAppManifestLineIfTTY(logger, 'keycloak');
+  }
   await app.runApp('keycloak', keycloakRunOpts);
-  logger.log(chalk.blue('Starting miso-controller...'));
-  emitSystemBuilderAppManifestLineIfTTY(logger, 'miso-controller');
+  if (typeof options.onAfterKeycloak === 'function') {
+    options.onAfterKeycloak();
+  }
+  if (!platformInstall) {
+    logger.log(chalk.blue('Starting miso-controller...'));
+    emitSystemBuilderAppManifestLineIfTTY(logger, 'miso-controller');
+  }
   await app.runApp('miso-controller', misoRunOpts);
 }
 
@@ -91,7 +124,9 @@ async function runMisoApps(options) {
  * @throws {Error} If infra not up or any step fails
  */
 async function handleUpMiso(options = {}) {
-  logger.log(chalk.blue('Starting up-miso (keycloak + miso-controller from images)...\n'));
+  if (options.platformInstall !== true) {
+    logger.log(chalk.blue('Starting up-miso (keycloak + miso-controller from images)...\n'));
+  }
   await assertDevInfraUp();
   await ensureAppFromTemplate('keycloak');
   await ensureAppFromTemplate('miso-controller');
@@ -103,8 +138,10 @@ async function handleUpMiso(options = {}) {
   patchEnvOutputPathForDeployOnly('miso-controller');
   refreshUrlsLocalRegistryForCurrentProject();
   await runMisoApps(options);
-  logger.log(formatSuccessParagraph('up-miso complete. Keycloak and miso-controller are running.') +
-    chalk.gray('\n  Run onboarding and register Keycloak from the miso-controller repo if needed. Use \'aifabrix up-dataplane\' for dataplane.'));
+  if (options.platformInstall !== true) {
+    logger.log(formatSuccessParagraph('up-miso complete. Keycloak and miso-controller are running.') +
+      chalk.gray('\n  Run onboarding and register Keycloak from the miso-controller repo if needed. Use \'aifabrix up-dataplane\' for dataplane.'));
+  }
 }
 
 module.exports = { handleUpMiso, parseImageOptions };

package/lib/commands/upload-data-sync-finalize.js

@@ -8,9 +8,18 @@
 
 const { runPostPublishDataSync } = require('./run-post-publish-data-sync');
 const { runUploadSidecarFollowups } = require('./upload-sidecar-followups');
-const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+const { formatSuccessLine, formatWarningLine, metadata } = require('../utils/cli-test-layout-chalk');
 const logger = require('../utils/logger');
-const { isQuietMinimalSync } = require('../utils/upload-sync-options');
+
+/**
+ * Internal verify/test --sync / deploy-preflight paths suppress upload banners.
+ * Default CLI `aifabrix upload` uses minimal=true but must still announce "unchanged".
+ * @param {Object} [options]
+ * @returns {boolean}
+ */
+function suppressUnchangedUploadBanner(options = {}) {
+  return options.syncMode === true || options.suppressSummary === true;
+}
 
 /**
  * @async
@@ -37,8 +46,16 @@ async function finalizeUploadPublishResult(ctx, payload, options) {
  */
 async function finishUnchangedUploadPublication(params) {
   const { systemKey, options, payload, dataplaneUrl, authConfig, environment } = params;
-  if (!isQuietMinimalSync(options)) {
+  if (!suppressUnchangedUploadBanner(options)) {
+    logger.log('');
     logger.log(formatSuccessLine('Config unchanged on dataplane — upload skipped.'));
+    logger.log(metadata(`System: ${systemKey}`));
+    if (options.probe === true) {
+      logger.log(
+        formatWarningLine('Probe skipped (nothing published). Use --force to republish, then --probe.')
+      );
+    }
+    logger.log('');
   }
   const sidecar = await runUploadSidecarFollowups({
     systemKey,

package/lib/commands/verify-governance-external.js

@@ -53,12 +53,9 @@ function buildDbPackResult(resolvedKey, datasourceRows) {
  */
 async function runVerifyGovernanceForExternalSystem(systemKey, options = {}) {
   const pathsUtil = require('../utils/paths');
+  const { assertCertifyExternalWorkspace } = require('../utils/certify-external-workspace');
   const appType = await pathsUtil.detectAppType(systemKey).catch(() => null);
-  if (!appType || appType.baseDir !== 'integration') {
-    throw new Error(
-      'verify-governance applies to external integration folders only (integration/<systemKey>/).'
-    );
-  }
+  assertCertifyExternalWorkspace(appType && appType.baseDir, 'verify-governance');
 
   if (options.pack) {
     const runPayload = await runTestGovernanceForExternalSystem(systemKey, options);

package/lib/commands/verify-operations-external.js

@@ -162,12 +162,9 @@ async function buildOperationsResult({
  */
 async function assertIntegrationExternalSystem(systemKey) {
   const pathsUtil = require('../utils/paths');
+  const { assertCertifyExternalWorkspace } = require('../utils/certify-external-workspace');
   const appType = await pathsUtil.detectAppType(systemKey).catch(() => null);
-  if (!appType || appType.baseDir !== 'integration') {
-    throw new Error(
-      'verify-operations applies to external integration folders only (integration/<systemKey>/).'
-    );
-  }
+  assertCertifyExternalWorkspace(appType && appType.baseDir, 'verify-operations');
 }
 
 /**

package/lib/commands/verify-operations-step-plan.js

@@ -66,6 +66,17 @@ function buildE2eStep(systemKey, options) {
       ok: () => true
     };
   }
+  if (shouldSkipE2eForRoleAssistant(systemKey, options)) {
+    return {
+      key: 'e2e',
+      run: async() => ({
+        success: true,
+        skipped: true,
+        reason: 'role-assistant-auth-none'
+      }),
+      ok: () => true
+    };
+  }
   return {
     key: 'e2e',
     run: (progress) =>
@@ -88,6 +99,26 @@ function buildE2eStep(systemKey, options) {
   };
 }
 
+/**
+ * Role Assistant packages use authType none + nested builder-api CIP.
+ * Live capacity E2E expects a system baseUrl credential and is not the RA certify path.
+ * @param {string} systemKey
+ * @param {Object} options
+ * @returns {boolean}
+ */
+function shouldSkipE2eForRoleAssistant(systemKey, options) {
+  if (options.forceE2e === true) {
+    return false;
+  }
+  try {
+    const { resolveAppWorkspace } = require('../utils/app-path-resolve');
+    const { baseDir } = resolveAppWorkspace(systemKey, {});
+    return baseDir === 'role-assistant';
+  } catch {
+    return false;
+  }
+}
+
 /**
  * @param {string} systemKey
  * @param {Object} options

package/lib/commands/verify-trust-command-action.js

@@ -17,12 +17,9 @@ const { buildJsonEnvelope } = require('../lifecycle/json-envelope');
 async function runVerifyTrustCommandAction(appName, options, cmd) {
   const opts = normalizeTestTrustCliOptions(options, cmd);
   const pathsUtil = require('../utils/paths');
+  const { assertCertifyExternalWorkspace } = require('../utils/certify-external-workspace');
   const appType = await pathsUtil.detectAppType(appName).catch(() => null);
-  if (!appType || appType.baseDir !== 'integration') {
-    throw new Error(
-      'verify-trust applies to external integration folders only (integration/<systemKey>/).'
-    );
-  }
+  assertCertifyExternalWorkspace(appType && appType.baseDir, 'verify-trust');
 
   const result = await runVerifyTrustForExternalSystem(appName, {
     env: opts.env,

package/lib/datasource/capability/capability-resolve.js

@@ -6,7 +6,7 @@
  * @version 2.0.0
  */
 
-const { capabilitiesIncludes } = require('./capability-manifest');
+const { capabilitiesIncludes, capabilityKeyFromEntry } = require('./capability-manifest');
 
 /**
  * @param {object|undefined} operations
@@ -44,6 +44,16 @@ function resolveSingleOpsKey(operations, logicalKey, label) {
   );
 }
 
+/**
+ * @param {unknown} entry
+ * @param {string} userKey
+ * @returns {boolean}
+ */
+function capabilityEntryMatches(entry, userKey) {
+  const key = capabilityKeyFromEntry(entry);
+  return Boolean(key) && key.toLowerCase() === String(userKey).toLowerCase();
+}
+
 /**
  * For --from on copy: when capabilities[] is non-empty, the name must appear there (case-insensitive).
  *
@@ -56,14 +66,14 @@ function resolveSourceCapabilityForCopy(doc, userKey) {
   const u = String(userKey).trim();
   const caps = doc.capabilities;
   if (Array.isArray(caps) && caps.length > 0) {
-    const hit = caps.find((c) => String(c).toLowerCase() === u.toLowerCase());
+    const hit = caps.find((c) => capabilityEntryMatches(c, u));
     if (hit === undefined) {
       throw new Error(
         `Source capability "${userKey}" not found in capabilities[]. ` +
           'Use a name that appears in capabilities[] (case-insensitive match is allowed).'
       );
     }
-    return String(hit);
+    return capabilityKeyFromEntry(hit) || u;
   }
   return u;
 }
@@ -79,9 +89,9 @@ function resolveLogicalNameForRemove(doc, userKey) {
   const u = String(userKey).trim();
   const caps = doc.capabilities;
   if (Array.isArray(caps) && caps.length > 0) {
-    const hit = caps.find((c) => String(c).toLowerCase() === u.toLowerCase());
+    const hit = caps.find((c) => capabilityEntryMatches(c, u));
     if (hit !== undefined) {
-      return String(hit);
+      return capabilityKeyFromEntry(hit) || u;
     }
   }
   return u;