@aifabrix/builder 2.55.2 → 2.56.0

package/lib/api/pipeline.api.js

@@ -278,7 +278,10 @@ function resolvePipelineUploadTimeoutMs(raw) {
  * @param {Object} authConfig
  * @param {Object} payload
  * @param {Object} [options]
- * @param {number|string} [options.timeoutMs] - HTTP + dataplane publish budget (default 300000)
+ * @param {number|string} [options.timeoutMs] - HTTP + dataplane publish budget (default 300000); ignored when options.async is true.
+ * @param {boolean} [options.async=false] - When true, durably accept the upload for qualification (202 jobId/candidateFingerprint) instead of blocking for the ladder (plan 191.0 task 1).
+ * @param {string} [options.gate] - Optional comma-separated checks: operations, trust, governance, full.
+ * @param {string} [options.subjectEmail] - Optional comma-separated governance subject emails.
  */
 async function uploadApplicationViaPipeline(
   dataplaneUrl,
@@ -287,8 +290,17 @@ async function uploadApplicationViaPipeline(
   options = {}
 ) {
   const body = { ...payload, status: payload.status ?? 'draft' };
-  const timeoutMs = resolvePipelineUploadTimeoutMs(options.timeoutMs);
   const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  if (options.async === true) {
+    const params = { async: 'true' };
+    if (options.gate) params.gate = options.gate;
+    if (options.subjectEmail) params.subjectEmail = options.subjectEmail;
+    return await client.post('/api/v1/pipeline/upload', {
+      body,
+      params
+    });
+  }
+  const timeoutMs = resolvePipelineUploadTimeoutMs(options.timeoutMs);
   return await client.post('/api/v1/pipeline/upload', {
     body,
     timeoutMs,
@@ -297,6 +309,23 @@ async function uploadApplicationViaPipeline(
   });
 }
 
+/**
+ * Get durable publish/qualification job status.
+ * GET /api/v1/publish-jobs/{jobId}
+ * @requiresPermission {Dataplane} external-system:publish or external-system:read
+ * @async
+ * @function getPublishJobStatus
+ * @param {string} dataplaneUrl - Dataplane base URL
+ * @param {Object} authConfig - Authentication configuration
+ * @param {string} jobId - Publish/qualification job id returned by uploadApplicationViaPipeline({ async: true })
+ * @returns {Promise<Object>} API envelope `{ success, data }` where `data` is `{ jobId, state, targetType, targetKey, steps, error, result }`
+ * @throws {Error} If request fails
+ */
+async function getPublishJobStatus(dataplaneUrl, authConfig, jobId) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  return await client.get(`/api/v1/publish-jobs/${encodeURIComponent(jobId)}`);
+}
+
 module.exports = {
   validatePipeline,
   deployPipeline,
@@ -307,7 +336,7 @@ module.exports = {
   testSystemViaPipeline,
   testDatasourceViaPipeline,
   uploadApplicationViaPipeline,
+  getPublishJobStatus,
   resolvePipelineUploadTimeoutMs,
   PIPELINE_UPLOAD_TIMEOUT_MS
 };
-

package/lib/app/deploy.js

@@ -308,10 +308,12 @@ function validateImageIsPullable(imageRef, appName) {
  */
 function throwIfDeploymentFailed(status, statusObj) {
   if (status !== 'failed' && status !== 'cancelled') return;
-  const msg =
-    statusObj.message ||
-    statusObj.error ||
-    (status === 'cancelled' ? 'Deployment cancelled' : 'Deployment failed');
+  const reportedErrors = Array.isArray(statusObj.errors) ? statusObj.errors.filter(Boolean).join('; ') : '';
+  // A failed deployment can retain its last progress message (for example
+  // "Database-only mode"). Prefer the terminal error so the CLI reports the cause.
+  const msg = status === 'failed'
+    ? statusObj.error || reportedErrors || statusObj.message || 'Deployment failed'
+    : statusObj.message || statusObj.error || reportedErrors || 'Deployment cancelled';
   const err = new Error(`Deployment ${status}: ${msg}`);
   err.formatted = `Deployment ${status}.\n\n${msg}`;
   err.deploymentStatus = statusObj;
@@ -495,4 +497,3 @@ module.exports = {
   validateAppName,
   validateImageIsPullable
 };
-

package/lib/cli/setup-app.js

@@ -56,20 +56,21 @@ Examples:
       --client-id "$DEV_MISO_CLIENTID" \\
       --client-secret "$DEV_MISO_CLIENTSECRET"
 
-  # CI/CD — external integration (after upload/tests; promote to controller)
+  # CI/CD — external integration (qualify once via upload, then fast promote via deploy)
   $ aifabrix validate hubspot-demo
   $ aifabrix upload hubspot-demo --probe
   $ aifabrix deploy hubspot-demo --probe -v
-  # Prove pillars in tst/CI, then promote (plain deploy seals cert on published Deploy)
-  $ aifabrix deploy ek-sales --gate full --subject-email ops@example.com
   $ aifabrix deploy ek-sales
 
 Notes:
   - Login or set MISO_CONTROLLER_URL + environment (aifabrix login / aifabrix auth).
   - CI: register once (aifabrix app register <appKey>), store DEV_MISO_CLIENTID and DEV_MISO_CLIENTSECRET in pipeline secrets.
-  - upload = dataplane publish for dev iteration; deploy = controller validate + deploy (Azure or local Docker).
-  - Prove (tst/CI): use --gate full (optional --subject-email) before promote; plain deploy promotes without live E2E gates.
-  - After a successful published Deploy, the platform seals the integration certificate (no separate certificates issue step).
+  - For Connected Systems, upload validates, publishes, and finalizes the system; optional
+    checks run only with upload --gate. Deploy promotes the completed upload — the
+    server decides this automatically, no flag needed. A system that has never been uploaded
+    falls back to the full legacy ladder at deploy time instead.
+  - --gate is a no-op on deploy (kept for compatibility; prints a notice) — gates now run once
+    during "aifabrix upload", not at deploy time.
   - Default output is a compact status card; use -v for expanded preflight and readiness detail.
   - Controller deploy always polls to a terminal status (no --poll / --no-poll on this command).
   - --repository-url overrides repo URL for pipeline validate (default: application.yaml repository.repositoryUrl).

package/lib/cli/setup-external-system-help.js

@@ -6,11 +6,18 @@
 
 const UPLOAD_HELP_AFTER = `
 Examples:
-  # Publish integration/<systemKey>/ to the dataplane (typical lab flow after validate + resolve)
+  # Upload and wait for completion
   $ aifabrix upload hubspot-demo
   $ aifabrix upload hubspot-demo -v
   $ aifabrix upload hubspot-demo --probe
-  $ aifabrix upload hubspot-demo --timeout 600000
+  $ aifabrix upload hubspot-demo --gate operations,trust
+  $ aifabrix upload hubspot-demo --gate full --subject-email user@example.com
+
+  # Queue the upload and return immediately (script/CI-friendly)
+  $ aifabrix upload hubspot-demo --no-wait
+
+  # Resume watching an existing upload job (e.g. after Ctrl-C or a closed terminal)
+  $ aifabrix upload hubspot-demo --resume <jobId>
 
   # Build and validate payload only (no API calls)
   $ aifabrix upload hubspot-demo --dry-run
@@ -25,9 +32,14 @@ Examples:
 Notes:
   - Requires login (aifabrix auth status).
   - Reads files under integration/<systemKey>/ or role-assistant/<roleKey>/ for digital workers.
+  - Upload validates, publishes, and finalizes the system. Operations, trust, and governance
+    checks are optional and run only when selected with --gate. The upload keeps running on
+    Dataplane even if this CLI process is interrupted, closed, or times out — --resume re-attaches
+    to it later, it is never re-submitted or lost.
   - Default output is a compact readiness summary; use -v for expanded detail and server-side validate warnings.
   - --probe runs dataplane runtime checks after publish (slower).
-  - --timeout sets publish budget in ms (HTTP client and dataplane); default 300000.
+  - --timeout bounds only how long this CLI waits before printing a resume hint
+    (default 1800000ms/30min); it does not stop the upload job.
   - --env selects role-assistant.yaml section (dev|tst|pro) for digital workers; default dev.
   - Role Assistant packages under role-assistant/ do not use application.yaml; upload applies settings and Evidence only.
   - test-e2e and test-integration publish local files first by default; use --no-publish on those commands to skip.

package/lib/cli/setup-external-system.js

@@ -50,7 +50,11 @@ async function handleUploadCommandAction(systemKey, options) {
     options.probeTimeout === undefined || options.probeTimeout === null
       ? 120000
       : Number(options.probeTimeout);
-  const timeoutMs = resolvePipelineUploadTimeoutMs(options.timeout);
+  // Only resolve --timeout when the caller explicitly set it; leaving it undefined otherwise
+  // lets the qualification poll fall back to its own default (30min) instead of the legacy
+  // 300000ms HTTP/dataplane-publish budget default, which no longer applies to the async path.
+  const timeoutMs =
+    options.timeout !== undefined ? resolvePipelineUploadTimeoutMs(options.timeout) : undefined;
   await upload.uploadExternalSystem(systemKey, {
     ...options,
     probeTimeout: Number.isFinite(probeTimeout) ? probeTimeout : 120000,
@@ -101,9 +105,17 @@ function setupUploadCommand(program) {
     .option('-v, --verbose', 'Expanded upload summary and server-side pipeline validate warnings before publish')
     .option('--probe', 'After publish, run dataplane runtime checks (validation/run); slower')
     .option('--probe-timeout <ms>', 'Timeout for --probe (default: 120000)', '120000')
+    .option(
+      '--gate <gates>',
+      'Optional upload checks (comma-separated): operations, trust, governance, full'
+    )
+    .option(
+      '--subject-email <emails>',
+      'Subject email(s) for governance checks (comma-separated; used with --gate governance|full)'
+    )
     .option(
       '--timeout <ms>',
-      'Publish timeout in ms for HTTP and dataplane budget (default: 300000; min 5000, max 2700000)'
+      'How long this CLI waits for the upload job before printing a resume hint (default: 1800000/30min; min 5000, max 2700000). The job keeps running regardless.'
     )
     .option(
       '--force',
@@ -114,6 +126,12 @@ function setupUploadCommand(program) {
       'Role Assistant settings environment section: dev, tst, or pro (default: dev)',
       'dev'
     )
+    .option('--wait', 'Wait for the upload job to complete (default)', true)
+    .option('--no-wait', 'Return the upload job id immediately without waiting')
+    .option(
+      '--resume <jobId>',
+      'Wait for an existing upload job instead of submitting again'
+    )
     .action(async(systemKey, options) => {
       try {
         await handleUploadCommandAction(systemKey, options);
@@ -341,4 +359,4 @@ function setupExternalSystemCommands(program) {
   setupExternalSystemTestCommands(program);
 }
 
-module.exports = { setupExternalSystemCommands };
+module.exports = { setupExternalSystemCommands, handleUploadCommandAction };

package/lib/commands/repair-datasource-auto-rbac.js

@@ -34,18 +34,14 @@ function buildRenameMap(operationMap) {
   if (!operationMap || typeof operationMap !== 'object' || Array.isArray(operationMap)) return {};
   const renameMap = {};
   for (const k of Object.keys(operationMap)) {
-    // If it's already schema-valid but contains capitals, normalize to lowercase to align
-    // with RBAC permission name restrictions (external-system schema forbids A-Z).
+    // Operation keys use the capability naming contract, which allows camelCase.
+    // RBAC permission names are normalized separately when permissions are generated.
     if (/^[a-z][a-zA-Z0-9]*$/.test(k)) {
-      if (/[A-Z]/.test(k)) {
-        renameMap[k] = k.toLowerCase();
-      }
       continue;
     }
     const camel = toCamelCaseKey(k);
     if (!camel || camel === k) continue;
-    // Use lowercase key to keep RBAC permission names schema-valid.
-    renameMap[k] = camel.toLowerCase();
+    renameMap[k] = camel;
   }
   return renameMap;
 }
@@ -212,7 +208,7 @@ function normalizeAutoRbacOperationKeys(parsed, changes) {
   if (updated && Array.isArray(changes)) {
     const pairs = keysToRename.map((k) => `${k}→${renameMap[k]}`).join(', ');
     changes.push(
-      `Normalized autoRbac operation keys (permission names are lowercase per schema; kebab aliases fold into canonical keys): ${pairs}`
+      `Normalized schema-invalid autoRbac operation aliases to camelCase keys (RBAC permission names remain lowercase): ${pairs}`
     );
   }
 
@@ -224,4 +220,3 @@ module.exports = {
   toCamelCaseKey,
   toKebabAliasKey
 };
-

package/lib/commands/upload-openapi-sync-followup.js

@@ -0,0 +1,59 @@
+/**
+ * @fileoverview Post-publish local OpenAPI sync follow-up, shared by the synchronous and
+ * qualification-async upload paths (extracted from upload.js per plan 191.0 file-size gate).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatSuccessLine, formatWarningLine } = require('../utils/cli-test-layout-chalk');
+const { resolveExternalSystemPath } = require('../utils/app-path-resolve');
+const { maybeSyncOpenApiFilesForMcp } = require('./repair-openapi-sync');
+const { exportProgrammaticOpenApiForRepair } = require('./repair-openapi-export');
+
+/**
+ * Upload local `integration/<systemKey>/openapi/*.json` specs when present so dataplane can store
+ * vendor OpenAPI keyed by each datasource `openapi.documentKey` (same behavior as repair --api OpenAPI sync).
+ * Call this **after** the external system row exists (successful publish or completed qualification):
+ * list/upload endpoints require it. First publish still succeeds because pipeline materializes
+ * internal specs from `openapi.operations` when needed.
+ *
+ * @param {string} systemKey
+ * @param {Object} manifest
+ * @param {Object} [uploadContext]
+ * @returns {Promise<void>}
+ */
+async function logAndSyncLocalOpenApiForUpload(systemKey, manifest, uploadContext = {}) {
+  const pathOptions = uploadContext.pathOptions || {};
+  const appPath = resolveExternalSystemPath(systemKey, pathOptions);
+  const ei = manifest && manifest.externalIntegration;
+  const datasourceFiles = ei && Array.isArray(ei.dataSources) ? ei.dataSources : [];
+  await exportProgrammaticOpenApiForRepair({
+    appPath,
+    systemKey,
+    datasourceFiles,
+    dryRun: false,
+    backupCtx: { dryRun: false, changedFiles: [] }
+  });
+  const openapiSyncLines = await maybeSyncOpenApiFilesForMcp({
+    enabled: true,
+    dryRun: false,
+    appPath,
+    systemKey,
+    datasourceFiles,
+    dataplaneUrl: uploadContext.dataplaneUrl,
+    authConfig: uploadContext.authConfig,
+    // Always replace SpecFile rows keyed by openapi.documentKey so vendor/full
+    // specs are not left missing while only thin internal:* slices remain.
+    force: true
+  });
+  if (!uploadContext.quiet) {
+    for (const line of openapiSyncLines) {
+      logger.log(line.startsWith('Skipped') ? formatWarningLine(line) : formatSuccessLine(line));
+    }
+  }
+}
+
+module.exports = { logAndSyncLocalOpenApiForUpload };

package/lib/commands/upload-qualification-client.js

@@ -0,0 +1,131 @@
+/**
+ * @fileoverview Resumable Dataplane qualification upload: accept, --wait/--no-wait, poll, resume.
+ * Mirrors dev-host-ops.js's job id + wait/no-wait contract (plan 191.0 task 1). Never invents
+ * qualification truth — accept/poll surface exactly what Dataplane returns.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatSuccessLine, formatWarningLine } = require('../utils/cli-test-layout-chalk');
+const { formatApiError } = require('../utils/api-error-handler');
+const { uploadApplicationViaPipelineWithAuthRetry } = require('../utils/pipeline-upload-auth-retry');
+const { pollQualificationJobUntilTerminal } = require('./upload-qualification-poll');
+const { createQualificationPollHandlers } = require('../utils/qualification-poll-ui');
+
+/**
+ * Ctrl-C / disconnect during polling must detach without corrupting truth (plan 191.0 task 4):
+ * the qualification job keeps running on Dataplane regardless of whether this CLI process exits.
+ * This only makes that safe fact visible, printing the resume command before exiting 130.
+ * @param {string} jobId
+ * @param {string} systemKey
+ * @returns {() => void} Call to remove the listeners once polling finishes normally.
+ */
+function registerUploadInterruptHint(jobId, systemKey) {
+  const onSignal = () => {
+    logger.log(
+      formatWarningLine(
+        `Interrupted — upload job ${jobId} is still running, unaffected. Resume with: aifabrix upload ${systemKey} --resume ${jobId}`
+      )
+    );
+    process.exit(130);
+  };
+  process.once('SIGINT', onSignal);
+  process.once('SIGTERM', onSignal);
+  return () => {
+    process.removeListener('SIGINT', onSignal);
+    process.removeListener('SIGTERM', onSignal);
+  };
+}
+
+/**
+ * Submit the candidate for durable Dataplane qualification (async). Always returns quickly —
+ * a 202 accept, or the current state when an equivalent job is already in flight — never blocks
+ * for the ladder to finish.
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {Object} payload
+ * @param {string} systemKey
+ * @param {Object} [options] - Forwarded to uploadApplicationViaPipeline (e.g. timeoutMs, ignored when async)
+ * @returns {Promise<{jobId: string, state: string, resumed: boolean, candidateFingerprint: string}>}
+ */
+async function acceptQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options = {}) {
+  const res = await uploadApplicationViaPipelineWithAuthRetry(dataplaneUrl, authConfig, payload, systemKey, {
+    ...options,
+    async: true
+  });
+  if (res?.success === false) {
+    const err = new Error(formatApiError(res, dataplaneUrl));
+    const status = Number(res.status || res.statusCode);
+    err.statusCode = status >= 400 && status < 600 ? status : 400;
+    throw err;
+  }
+  return res.data;
+}
+
+/**
+ * Poll an existing qualification job id to terminal state (resume without re-uploading).
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {string} jobId
+ * @param {string} systemKey - For the printed resume hint if interrupted mid-poll.
+ * @param {{ json?: boolean, silent?: boolean, timeoutMs?: number|string }} [options] - `timeoutMs`
+ *   bounds only how long this CLI process waits (CLI `--timeout`); Dataplane keeps running the
+ *   job regardless, so timing out returns a resumable jobId, never a fabricated failure.
+ * @returns {Promise<Object>} Terminal job status
+ */
+async function resumeQualificationUpload(dataplaneUrl, authConfig, jobId, systemKey, options = {}) {
+  const pollUi = options.json || options.silent
+    ? createQualificationPollHandlers(jobId, { silent: true })
+    : createQualificationPollHandlers(jobId, { verbose: options.verbose === true });
+  const unregisterInterruptHint = registerUploadInterruptHint(jobId, systemKey);
+  try {
+    return await pollQualificationJobUntilTerminal(
+      dataplaneUrl,
+      authConfig,
+      jobId,
+      pollUi,
+      options.timeoutMs !== undefined ? Number(options.timeoutMs) : undefined
+    );
+  } finally {
+    pollUi.finish();
+    unregisterInterruptHint();
+  }
+}
+
+/**
+ * Accept then, unless `--no-wait`, poll to terminal. On `--no-wait`, prints/returns the
+ * resumable job id immediately and never blocks.
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {Object} payload
+ * @param {string} systemKey
+ * @param {{ wait?: boolean, json?: boolean, timeoutMs?: number|string }} [options]
+ * @returns {Promise<{jobId: string, candidateFingerprint: string, terminal: Object|null}>}
+ */
+async function runQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options = {}) {
+  const accepted = await acceptQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options);
+  const wait = options.wait !== false;
+  if (!wait) {
+    if (options.json) {
+      logger.log(JSON.stringify({ ...accepted, terminal: null }, null, 2));
+    } else {
+      logger.log(
+        formatSuccessLine(
+          `Upload queued (job ${accepted.jobId}). Resume with: aifabrix upload ${systemKey} --resume ${accepted.jobId}`
+        )
+      );
+    }
+    return { ...accepted, terminal: null };
+  }
+  const terminal = await resumeQualificationUpload(dataplaneUrl, authConfig, accepted.jobId, systemKey, options);
+  return { ...accepted, terminal };
+}
+
+module.exports = {
+  acceptQualificationUpload,
+  resumeQualificationUpload,
+  runQualificationUpload
+};

package/lib/commands/upload-qualification-followups.js

@@ -0,0 +1,104 @@
+/**
+ * @fileoverview Post-qualification follow-ups for the async upload path: credential push,
+ * local OpenAPI sync, sidecar governance/evidence sync, probe and a qualification-specific
+ * summary (plan 191.0 task 1).
+ *
+ * Note: this intentionally does not reconstruct the legacy tiered datasource-readiness summary
+ * (`logUploadReadinessSummary`) that the synchronous path shows — that summary classifies real
+ * server-assigned datasource state (status/isActive/mcpContract) which requires a fresh
+ * Dataplane fetch+remap not yet ported to this path. The qualification summary below reports
+ * what Dataplane actually returned instead of approximating server state from local data.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatSuccessLine, metadata, sectionTitle } = require('../utils/cli-test-layout-chalk');
+const { pushAndLogCredentialSecrets } = require('./upload-credential-push-log');
+const { finalizeUploadPublishResult } = require('./upload-data-sync-finalize');
+const { runUploadSidecarFollowups } = require('./upload-sidecar-followups');
+const { logAndSyncLocalOpenApiForUpload } = require('./upload-openapi-sync-followup');
+const { maybeRunUploadProbe } = require('./upload-probe');
+
+/**
+ * @param {string} systemKey
+ * @param {Object} _accepted - Machine-readable qualification identity (not shown in CLI output)
+ * @param {Object} job - Terminal PublishJobStatusResponse data
+ * @param {Object} options
+ */
+function logQualifiedUploadSummary(systemKey, _accepted, job, options) {
+  if (options.suppressSummary === true || options.json === true) {
+    return;
+  }
+  logger.log('');
+  logger.log(sectionTitle('Upload complete'));
+  logger.log(metadata(`System: ${systemKey}`));
+  if (options.verbose === true) {
+    logger.log(metadata(`Job: ${job.jobId}`));
+    const certificateIds = job.result && Array.isArray(job.result.certificateIds) ? job.result.certificateIds : [];
+    if (certificateIds.length > 0) {
+      logger.log(metadata(`Certificates: ${certificateIds.join(', ')}`));
+    }
+  }
+  logger.log(formatSuccessLine(`${systemKey} uploaded successfully.`));
+}
+
+/**
+ * Runs the same downstream follow-ups as the synchronous publish path (credential push, local
+ * OpenAPI sync, sidecar governance/evidence sync, optional probe) once a qualification job has
+ * reached `completed`, then finalizes with the same result-envelope shape as the sync path.
+ * @param {string} systemKey
+ * @param {Object} options
+ * @param {Object} manifest
+ * @param {Object} payload
+ * @param {{ dataplaneUrl: string, authConfig: Object, environment: string, accepted: Object, job: Object }} ctx
+ * @returns {Promise<Object>}
+ */
+async function completeQualifiedUpload(systemKey, options, manifest, payload, ctx) {
+  const quietCompact = options.minimal === true && options.verbose !== true;
+  const pushMeta = await pushAndLogCredentialSecrets(ctx.dataplaneUrl, ctx.authConfig, systemKey, payload, {
+    json: options.json === true,
+    pathOptions: options.pathOptions,
+    suppressCredentialLog: quietCompact,
+    excludeSecretKeys: options.excludeSecretKeys
+  });
+  await logAndSyncLocalOpenApiForUpload(systemKey, manifest, {
+    dataplaneUrl: ctx.dataplaneUrl,
+    authConfig: ctx.authConfig,
+    pathOptions: options.pathOptions,
+    quiet: quietCompact
+  });
+  const sidecar = await runUploadSidecarFollowups({
+    systemKey,
+    options,
+    payload,
+    dataplaneUrl: ctx.dataplaneUrl,
+    authConfig: ctx.authConfig,
+    environment: ctx.environment
+  });
+  logQualifiedUploadSummary(systemKey, ctx.accepted, ctx.job, options);
+  if (options.probe === true) {
+    await maybeRunUploadProbe(ctx.dataplaneUrl, systemKey, ctx.authConfig, options.probeTimeout, {
+      compact: quietCompact
+    });
+  }
+  return finalizeUploadPublishResult(
+    {
+      dataplaneUrl: ctx.dataplaneUrl,
+      authConfig: ctx.authConfig,
+      environment: ctx.environment,
+      uploadSkipped: false,
+      sidecar,
+      credentialPush: pushMeta.credentialPush,
+      configPush: pushMeta.configPush,
+      jobId: ctx.job.jobId,
+      candidateFingerprint: ctx.accepted.candidateFingerprint
+    },
+    payload,
+    options
+  );
+}
+
+module.exports = { completeQualifiedUpload, logQualifiedUploadSummary };