@aifabrix/builder 2.55.2 → 2.57.0

package/lib/commands/upload-qualification-client.js

@@ -0,0 +1,131 @@
+/**
+ * @fileoverview Resumable Dataplane qualification upload: accept, --wait/--no-wait, poll, resume.
+ * Mirrors dev-host-ops.js's job id + wait/no-wait contract (plan 191.0 task 1). Never invents
+ * qualification truth — accept/poll surface exactly what Dataplane returns.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatSuccessLine, formatWarningLine } = require('../utils/cli-test-layout-chalk');
+const { formatApiError } = require('../utils/api-error-handler');
+const { uploadApplicationViaPipelineWithAuthRetry } = require('../utils/pipeline-upload-auth-retry');
+const { pollQualificationJobUntilTerminal } = require('./upload-qualification-poll');
+const { createQualificationPollHandlers } = require('../utils/qualification-poll-ui');
+
+/**
+ * Ctrl-C / disconnect during polling must detach without corrupting truth (plan 191.0 task 4):
+ * the qualification job keeps running on Dataplane regardless of whether this CLI process exits.
+ * This only makes that safe fact visible, printing the resume command before exiting 130.
+ * @param {string} jobId
+ * @param {string} systemKey
+ * @returns {() => void} Call to remove the listeners once polling finishes normally.
+ */
+function registerUploadInterruptHint(jobId, systemKey) {
+  const onSignal = () => {
+    logger.log(
+      formatWarningLine(
+        `Interrupted — upload job ${jobId} is still running, unaffected. Resume with: aifabrix upload ${systemKey} --resume ${jobId}`
+      )
+    );
+    process.exit(130);
+  };
+  process.once('SIGINT', onSignal);
+  process.once('SIGTERM', onSignal);
+  return () => {
+    process.removeListener('SIGINT', onSignal);
+    process.removeListener('SIGTERM', onSignal);
+  };
+}
+
+/**
+ * Submit the candidate for durable Dataplane qualification (async). Always returns quickly —
+ * a 202 accept, or the current state when an equivalent job is already in flight — never blocks
+ * for the ladder to finish.
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {Object} payload
+ * @param {string} systemKey
+ * @param {Object} [options] - Forwarded to uploadApplicationViaPipeline (e.g. timeoutMs, ignored when async)
+ * @returns {Promise<{jobId: string, state: string, resumed: boolean, candidateFingerprint: string}>}
+ */
+async function acceptQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options = {}) {
+  const res = await uploadApplicationViaPipelineWithAuthRetry(dataplaneUrl, authConfig, payload, systemKey, {
+    ...options,
+    async: true
+  });
+  if (res?.success === false) {
+    const err = new Error(formatApiError(res, dataplaneUrl));
+    const status = Number(res.status || res.statusCode);
+    err.statusCode = status >= 400 && status < 600 ? status : 400;
+    throw err;
+  }
+  return res.data;
+}
+
+/**
+ * Poll an existing qualification job id to terminal state (resume without re-uploading).
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {string} jobId
+ * @param {string} systemKey - For the printed resume hint if interrupted mid-poll.
+ * @param {{ json?: boolean, silent?: boolean, timeoutMs?: number|string }} [options] - `timeoutMs`
+ *   bounds only how long this CLI process waits (CLI `--timeout`); Dataplane keeps running the
+ *   job regardless, so timing out returns a resumable jobId, never a fabricated failure.
+ * @returns {Promise<Object>} Terminal job status
+ */
+async function resumeQualificationUpload(dataplaneUrl, authConfig, jobId, systemKey, options = {}) {
+  const pollUi = options.json || options.silent
+    ? createQualificationPollHandlers(jobId, { silent: true })
+    : createQualificationPollHandlers(jobId, { verbose: options.verbose === true });
+  const unregisterInterruptHint = registerUploadInterruptHint(jobId, systemKey);
+  try {
+    return await pollQualificationJobUntilTerminal(
+      dataplaneUrl,
+      authConfig,
+      jobId,
+      pollUi,
+      options.timeoutMs !== undefined ? Number(options.timeoutMs) : undefined
+    );
+  } finally {
+    pollUi.finish();
+    unregisterInterruptHint();
+  }
+}
+
+/**
+ * Accept then, unless `--no-wait`, poll to terminal. On `--no-wait`, prints/returns the
+ * resumable job id immediately and never blocks.
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {Object} payload
+ * @param {string} systemKey
+ * @param {{ wait?: boolean, json?: boolean, timeoutMs?: number|string }} [options]
+ * @returns {Promise<{jobId: string, candidateFingerprint: string, terminal: Object|null}>}
+ */
+async function runQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options = {}) {
+  const accepted = await acceptQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options);
+  const wait = options.wait !== false;
+  if (!wait) {
+    if (options.json) {
+      logger.log(JSON.stringify({ ...accepted, terminal: null }, null, 2));
+    } else {
+      logger.log(
+        formatSuccessLine(
+          `Upload queued (job ${accepted.jobId}). Resume with: aifabrix upload ${systemKey} --resume ${accepted.jobId}`
+        )
+      );
+    }
+    return { ...accepted, terminal: null };
+  }
+  const terminal = await resumeQualificationUpload(dataplaneUrl, authConfig, accepted.jobId, systemKey, options);
+  return { ...accepted, terminal };
+}
+
+module.exports = {
+  acceptQualificationUpload,
+  resumeQualificationUpload,
+  runQualificationUpload
+};

package/lib/commands/upload-qualification-followups.js

@@ -0,0 +1,104 @@
+/**
+ * @fileoverview Post-qualification follow-ups for the async upload path: credential push,
+ * local OpenAPI sync, sidecar governance/evidence sync, probe and a qualification-specific
+ * summary (plan 191.0 task 1).
+ *
+ * Note: this intentionally does not reconstruct the legacy tiered datasource-readiness summary
+ * (`logUploadReadinessSummary`) that the synchronous path shows — that summary classifies real
+ * server-assigned datasource state (status/isActive/mcpContract) which requires a fresh
+ * Dataplane fetch+remap not yet ported to this path. The qualification summary below reports
+ * what Dataplane actually returned instead of approximating server state from local data.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatSuccessLine, metadata, sectionTitle } = require('../utils/cli-test-layout-chalk');
+const { pushAndLogCredentialSecrets } = require('./upload-credential-push-log');
+const { finalizeUploadPublishResult } = require('./upload-data-sync-finalize');
+const { runUploadSidecarFollowups } = require('./upload-sidecar-followups');
+const { logAndSyncLocalOpenApiForUpload } = require('./upload-openapi-sync-followup');
+const { maybeRunUploadProbe } = require('./upload-probe');
+
+/**
+ * @param {string} systemKey
+ * @param {Object} _accepted - Machine-readable qualification identity (not shown in CLI output)
+ * @param {Object} job - Terminal PublishJobStatusResponse data
+ * @param {Object} options
+ */
+function logQualifiedUploadSummary(systemKey, _accepted, job, options) {
+  if (options.suppressSummary === true || options.json === true) {
+    return;
+  }
+  logger.log('');
+  logger.log(sectionTitle('Upload complete'));
+  logger.log(metadata(`System: ${systemKey}`));
+  if (options.verbose === true) {
+    logger.log(metadata(`Job: ${job.jobId}`));
+    const certificateIds = job.result && Array.isArray(job.result.certificateIds) ? job.result.certificateIds : [];
+    if (certificateIds.length > 0) {
+      logger.log(metadata(`Certificates: ${certificateIds.join(', ')}`));
+    }
+  }
+  logger.log(formatSuccessLine(`${systemKey} uploaded successfully.`));
+}
+
+/**
+ * Runs the same downstream follow-ups as the synchronous publish path (credential push, local
+ * OpenAPI sync, sidecar governance/evidence sync, optional probe) once a qualification job has
+ * reached `completed`, then finalizes with the same result-envelope shape as the sync path.
+ * @param {string} systemKey
+ * @param {Object} options
+ * @param {Object} manifest
+ * @param {Object} payload
+ * @param {{ dataplaneUrl: string, authConfig: Object, environment: string, accepted: Object, job: Object }} ctx
+ * @returns {Promise<Object>}
+ */
+async function completeQualifiedUpload(systemKey, options, manifest, payload, ctx) {
+  const quietCompact = options.minimal === true && options.verbose !== true;
+  const pushMeta = await pushAndLogCredentialSecrets(ctx.dataplaneUrl, ctx.authConfig, systemKey, payload, {
+    json: options.json === true,
+    pathOptions: options.pathOptions,
+    suppressCredentialLog: quietCompact,
+    excludeSecretKeys: options.excludeSecretKeys
+  });
+  await logAndSyncLocalOpenApiForUpload(systemKey, manifest, {
+    dataplaneUrl: ctx.dataplaneUrl,
+    authConfig: ctx.authConfig,
+    pathOptions: options.pathOptions,
+    quiet: quietCompact
+  });
+  const sidecar = await runUploadSidecarFollowups({
+    systemKey,
+    options,
+    payload,
+    dataplaneUrl: ctx.dataplaneUrl,
+    authConfig: ctx.authConfig,
+    environment: ctx.environment
+  });
+  logQualifiedUploadSummary(systemKey, ctx.accepted, ctx.job, options);
+  if (options.probe === true) {
+    await maybeRunUploadProbe(ctx.dataplaneUrl, systemKey, ctx.authConfig, options.probeTimeout, {
+      compact: quietCompact
+    });
+  }
+  return finalizeUploadPublishResult(
+    {
+      dataplaneUrl: ctx.dataplaneUrl,
+      authConfig: ctx.authConfig,
+      environment: ctx.environment,
+      uploadSkipped: false,
+      sidecar,
+      credentialPush: pushMeta.credentialPush,
+      configPush: pushMeta.configPush,
+      jobId: ctx.job.jobId,
+      candidateFingerprint: ctx.accepted.candidateFingerprint
+    },
+    payload,
+    options
+  );
+}
+
+module.exports = { completeQualifiedUpload, logQualifiedUploadSummary };

package/lib/commands/upload-qualification-poll.js

@@ -0,0 +1,143 @@
+/**
+ * @fileoverview Poll a Dataplane qualification (publish) job until terminal (plan 191.0 task 1).
+ * Never invents success and never marks the candidate failed just because the CLI stopped polling —
+ * timing out returns a resumable jobId instead.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { getPublishJobStatus } = require('../api/pipeline.api');
+const { formatApiError } = require('../utils/api-error-handler');
+
+const POLL_INTERVAL_MS = 3000;
+const POLL_TIMEOUT_MS = 30 * 60 * 1000;
+const TRANSIENT_HTTP_STATUSES = new Set([502, 503, 504]);
+const MAX_TRANSIENT_POLL_ERRORS = 20;
+
+const GOVERNANCE_SCENARIOS_MISSING = 'GOVERNANCE_SCENARIOS_MISSING';
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * Convert repeated server error codes into one user-facing qualification failure.
+ * The raw job remains attached to the thrown error for JSON/programmatic callers.
+ * @param {Object} job
+ * @returns {{ message: string, userFacing: boolean }}
+ */
+function formatQualificationJobFailure(job) {
+  const raw = String(job && job.error ? job.error : '').trim();
+  const parts = raw.split(';').map((part) => part.trim()).filter(Boolean);
+  const missingCount = parts.filter((part) => part === GOVERNANCE_SCENARIOS_MISSING).length;
+  if (missingCount > 0 && missingCount === parts.length) {
+    const scope = `${missingCount} datasource${missingCount === 1 ? '' : 's'}`;
+    return {
+      message: `Governance checks could not run because scenario packs are missing for ${scope}.`,
+      userFacing: true
+    };
+  }
+  const unique = [...new Set(parts)];
+  return {
+    message: unique.join('; ') || `Upload checks failed for job ${job && job.jobId ? job.jobId : ''}`.trim(),
+    userFacing: false
+  };
+}
+
+/**
+ * @param {number|string} status
+ * @returns {boolean}
+ */
+function isTransientQualificationPollError(status) {
+  return TRANSIENT_HTTP_STATUSES.has(Number(status));
+}
+
+/**
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {string} jobId
+ * @param {Object} [pollUi]
+ * @returns {Promise<Object>} Raw job status data
+ */
+async function fetchQualificationJobWithRetry(dataplaneUrl, authConfig, jobId, pollUi = {}) {
+  const started = Date.now();
+  for (let attempt = 0; attempt <= MAX_TRANSIENT_POLL_ERRORS; attempt += 1) {
+    const res = await getPublishJobStatus(dataplaneUrl, authConfig, jobId);
+    if (res?.success !== false) {
+      return res.data;
+    }
+    if (!isTransientQualificationPollError(res.status)) {
+      const err = new Error(formatApiError(res, dataplaneUrl));
+      const status = Number(res.status);
+      err.statusCode = status >= 400 && status < 600 ? status : 400;
+      throw err;
+    }
+    if (attempt >= MAX_TRANSIENT_POLL_ERRORS) {
+      throw new Error(
+        `The upload service returned HTTP ${res.status} repeatedly while waiting for job ${jobId}.`
+      );
+    }
+    if (typeof pollUi.onTransientError === 'function') {
+      pollUi.onTransientError(res.status, Date.now() - started);
+    }
+    await sleep(POLL_INTERVAL_MS);
+  }
+  throw new Error(`Failed to check upload job ${jobId} after transient retries`);
+}
+
+/**
+ * Poll a Dataplane qualification job to terminal state (completed|failed). The timeout only
+ * bounds how long *this CLI process* waits — Dataplane keeps running the job regardless; timing
+ * out returns a resumable jobId, never a fabricated failure (plan 191.0 task 4).
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {string} jobId
+ * @param {Object} [pollUi] - { onPollProgress(job), onTransientError(status, elapsedMs) }
+ * @param {number} [timeoutMs] - Defaults to POLL_TIMEOUT_MS (30 min); CLI `--timeout` overrides it.
+ * @returns {Promise<Object>} Terminal job status data (state: 'completed')
+ * @throws {Error} With `.jobId` set, when the job fails or the CLI-side wait times out (resumable).
+ */
+async function pollQualificationJobUntilTerminal(
+  dataplaneUrl,
+  authConfig,
+  jobId,
+  pollUi = {},
+  timeoutMs = POLL_TIMEOUT_MS
+) {
+  const started = Date.now();
+  while (Date.now() - started < timeoutMs) {
+    const job = await fetchQualificationJobWithRetry(dataplaneUrl, authConfig, jobId, pollUi);
+    if (typeof pollUi.onPollProgress === 'function') {
+      pollUi.onPollProgress(job);
+    }
+    if (job.state === 'failed') {
+      const failure = formatQualificationJobFailure(job);
+      const err = new Error(failure.message);
+      err.jobId = jobId;
+      err.job = job;
+      err.skipDoctor = failure.userFacing;
+      throw err;
+    }
+    if (job.state === 'completed') {
+      return job;
+    }
+    await sleep(POLL_INTERVAL_MS);
+  }
+  const timeoutErr = new Error(
+    `Timed out waiting for upload job ${jobId}. It is still running — resume with: aifabrix upload <systemKey> --resume ${jobId}`
+  );
+  timeoutErr.jobId = jobId;
+  timeoutErr.resumable = true;
+  throw timeoutErr;
+}
+
+module.exports = {
+  POLL_INTERVAL_MS,
+  POLL_TIMEOUT_MS,
+  isTransientQualificationPollError,
+  fetchQualificationJobWithRetry,
+  formatQualificationJobFailure,
+  pollQualificationJobUntilTerminal
+};

package/lib/commands/upload.js

@@ -1,6 +1,5 @@
 const {
   formatSuccessLine,
-  formatWarningLine,
   sectionTitle,
   headerKeyValue,
   metadata
@@ -21,8 +20,6 @@ const SEP = chalk.gray('──────────────────
 const { resolveControllerUrl } = require('../utils/controller-url');
 const { getDeploymentAuth } = require('../utils/token-manager');
 const { resolveDataplaneUrl } = require('../utils/dataplane-resolver');
-const { resolveExternalSystemPath } = require('../utils/app-path-resolve');
-const { runWithUploadPipelineSpinner } = require('../utils/upload-pipeline-ui');
 const {
   buildResolvedEnvMapForIntegration,
   resolveConfigurationValues
@@ -33,21 +30,16 @@ const { generateControllerManifest } = require('../generator/external-controller
 const {
   validatePipelineConfig
 } = require('../api/pipeline.api');
-const { uploadApplicationViaPipelineWithAuthRetry } = require('../utils/pipeline-upload-auth-retry');
 const { formatApiError } = require('../utils/api-error-handler');
-const { unwrapPublicationResult, unwrapApiData, isPublicationUnchanged } = require('../utils/external-system-readiness-core');
+const { unwrapApiData } = require('../utils/external-system-readiness-core');
 const {
   logServerValidationWarnings
 } = require('../utils/external-system-readiness-display');
-const { maybeRunUploadProbe } = require('./upload-probe');
-const { maybeSyncOpenApiFilesForMcp } = require('./repair-openapi-sync');
-const { exportProgrammaticOpenApiForRepair } = require('./repair-openapi-export');
 const { resolveUploadPublishContext } = require('./upload-publish-context');
+const { runQualificationUpload, resumeQualificationUpload } = require('./upload-qualification-client');
+const { completeQualifiedUpload } = require('./upload-qualification-followups');
 const { syncDeployJsonFromSources } = require('../external-system/sync-deploy-manifest');
 const { assertUploadPackageIdentity } = require('../external-system/upload-identity');
-const { handlePublicationAndFollowups } = require('./upload-sidecar-followups');
-const { finalizeUploadPublishResult, finishUnchangedUploadPublication } = require('./upload-data-sync-finalize');
-const { pushAndLogCredentialSecrets } = require('./upload-credential-push-log');
 const {
   SYSTEM_KIND_DIGITAL_WORKER,
   readRoleAssistantSettings,
@@ -129,39 +121,6 @@ async function resolveDataplaneAndAuth(systemKey, opts = {}) {
   return { dataplaneUrl, authConfig, environment };
 }
 
-/**
- * Runs single pipeline upload (upload → validate → publish) on the dataplane.
- * @param {string} dataplaneUrl - Dataplane base URL
- * @param {Object} authConfig - Auth config
- * @param {Object} payload - { version, application, dataSources, status: "draft" }
- * @param {string} systemKey
- * @param {Object} [options]
- * @param {number|string} [options.timeoutMs]
- * @returns {Promise<Object>} Raw API response envelope
- */
-async function runUploadValidatePublish(
-  dataplaneUrl,
-  authConfig,
-  payload,
-  systemKey,
-  options = {}
-) {
-  const res = await uploadApplicationViaPipelineWithAuthRetry(
-    dataplaneUrl,
-    authConfig,
-    payload,
-    systemKey,
-    { timeoutMs: options.timeoutMs }
-  );
-  if (res?.success === false) {
-    const err = new Error(formatApiError(res, dataplaneUrl));
-    const status = Number(res.status || res.statusCode);
-    err.statusCode = status >= 400 && status < 600 ? status : 400;
-    throw err;
-  }
-  return res;
-}
-
 /**
  * @param {Object} validationResult - Result from validateExternalSystemComplete
  * @returns {string}
@@ -269,97 +228,30 @@ async function buildValidatedUploadManifestPayload(systemKey, opts = {}) {
 }
 
 /**
- * Upload local `integration/<systemKey>/openapi/*.json` specs when present so dataplane can store
- * vendor OpenAPI keyed by each datasource `openapi.documentKey` (same behavior as repair --api OpenAPI sync).
- * Call this **after** a successful pipeline publish: list/upload endpoints require the external system row.
- * First publish still succeeds because pipeline materializes internal specs from `openapi.operations` when needed.
- *
+ * Accept (unless --resume) then poll a Dataplane qualification job to terminal state.
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {Object} payload
  * @param {string} systemKey
- * @param {Object} manifest
- * @returns {Promise<void>}
+ * @param {Object} options - { resume?: string, wait?: boolean, json?: boolean, timeoutMs? }
+ * @returns {Promise<{ accepted: Object, terminal: Object|null }>}
  */
-async function logAndSyncLocalOpenApiForUpload(systemKey, manifest, uploadContext = {}) {
-  const pathOptions = uploadContext.pathOptions || {};
-  const appPath = resolveExternalSystemPath(systemKey, pathOptions);
-  const ei = manifest && manifest.externalIntegration;
-  const datasourceFiles = ei && Array.isArray(ei.dataSources) ? ei.dataSources : [];
-  await exportProgrammaticOpenApiForRepair({
-    appPath,
-    systemKey,
-    datasourceFiles,
-    dryRun: false,
-    backupCtx: { dryRun: false, changedFiles: [] }
-  });
-  const openapiSyncLines = await maybeSyncOpenApiFilesForMcp({
-    enabled: true,
-    dryRun: false,
-    appPath,
-    systemKey,
-    datasourceFiles,
-    dataplaneUrl: uploadContext.dataplaneUrl,
-    authConfig: uploadContext.authConfig,
-    // Always replace SpecFile rows keyed by openapi.documentKey so vendor/full
-    // specs are not left missing while only thin internal:* slices remain.
-    force: true
-  });
-  if (!uploadContext.quiet) {
-    for (const line of openapiSyncLines) {
-      logger.log(line.startsWith('Skipped') ? formatWarningLine(line) : formatSuccessLine(line));
-    }
+async function acceptOrResumeQualification(dataplaneUrl, authConfig, payload, systemKey, options) {
+  if (options.resume) {
+    const terminal = await resumeQualificationUpload(dataplaneUrl, authConfig, options.resume, systemKey, options);
+    return {
+      accepted: { jobId: options.resume, candidateFingerprint: terminal.result?.candidateFingerprint },
+      terminal
+    };
   }
+  const result = await runQualificationUpload(dataplaneUrl, authConfig, payload, systemKey, options);
+  return { accepted: result, terminal: result.terminal };
 }
 
 /**
- * @param {string} systemKey
- * @param {Object} options
- * @param {Object} manifest
- * @param {Object} payload
- * @param {{ dataplaneUrl: string, authConfig: Object, environment: string, rawRes: Object }} ctx
- */
-async function completeUploadAfterPublish(systemKey, options, manifest, payload, ctx) {
-  const quietCompact = options.minimal === true && options.verbose !== true;
-  const pushMeta = await pushAndLogCredentialSecrets(ctx.dataplaneUrl, ctx.authConfig, systemKey, payload, {
-    json: options.json === true,
-    pathOptions: options.pathOptions,
-    suppressCredentialLog: quietCompact,
-    excludeSecretKeys: options.excludeSecretKeys
-  });
-  await logAndSyncLocalOpenApiForUpload(systemKey, manifest, {
-    dataplaneUrl: ctx.dataplaneUrl,
-    authConfig: ctx.authConfig,
-    pathOptions: options.pathOptions,
-    quiet: quietCompact
-  });
-  const followupResult = await handlePublicationAndFollowups(
-    {
-      systemKey,
-      options,
-      manifest,
-      payload,
-      environment: ctx.environment,
-      dataplaneUrl: ctx.dataplaneUrl,
-      authConfig: ctx.authConfig,
-      rawRes: ctx.rawRes,
-      credentialPush: pushMeta.credentialPush,
-      configPush: pushMeta.configPush
-    },
-    maybeRunUploadProbe
-  );
-  return finalizeUploadPublishResult(
-    {
-      dataplaneUrl: ctx.dataplaneUrl,
-      authConfig: ctx.authConfig,
-      environment: ctx.environment,
-      uploadSkipped: false,
-      sidecar: followupResult?.sidecar || null
-    },
-    payload,
-    options
-  );
-}
-
-/**
- * Upload path after dry-run check.
+ * Upload path after dry-run check: submit for durable Dataplane qualification (async, no
+ * request-lifetime failure), then — unless `--no-wait` — poll to terminal and run the same
+ * downstream follow-ups (credential push, OpenAPI sync, sidecar, probe) as before.
  * @param {string} systemKey
  * @param {Object} options
  * @param {Object} manifest
@@ -373,40 +265,28 @@ async function runUploadPublishAndSummary(systemKey, options, manifest, payload)
     options,
     payload
   );
-  const rawRes = await runWithUploadPipelineSpinner(
-    async() =>
-      runUploadValidatePublish(dataplaneUrl, authConfig, payload, systemKey, {
-        timeoutMs: options.timeoutMs
-      }),
-    {
-      systemKey,
-      json: options.json === true,
-      syncMode: options.syncMode === true,
-      suppressPipelineSpinner: options.suppressPipelineSpinner === true
-    }
+  const { accepted, terminal } = await acceptOrResumeQualification(
+    dataplaneUrl,
+    authConfig,
+    payload,
+    systemKey,
+    options
   );
-  const publication = unwrapPublicationResult(rawRes);
-  if (isPublicationUnchanged(publication)) {
-    return finishUnchangedUploadPublication({
-      systemKey,
-      options,
-      payload,
-      dataplaneUrl,
-      authConfig,
-      environment
-    });
+  if (!terminal) {
+    return accepted;
   }
-
-  return completeUploadAfterPublish(systemKey, options, manifest, payload, {
+  return completeQualifiedUpload(systemKey, options, manifest, payload, {
     dataplaneUrl,
     authConfig,
     environment,
-    rawRes
+    accepted,
+    job: terminal
   });
 }
 
 /**
- * Uploads external system: publishes to dataplane and registers with controller (draft).
+ * Uploads external system: durably qualifies on dataplane (async ladder, no request-lifetime
+ * failure) then registers with controller (draft).
  * @param {string} systemKey - External system key (integration/<systemKey>/)
  * @param {Object} [options] - Options
  * @param {boolean} [options.dryRun] - Validate and build payload only; no API calls
@@ -415,7 +295,9 @@ async function runUploadPublishAndSummary(systemKey, options, manifest, payload)
  * @param {number} [options.probeTimeout] - Probe timeout ms (default 120000)
  * @param {number} [options.timeoutMs] - Pipeline publish timeout ms (HTTP + dataplane; default 300000)
  * @param {boolean} [options.minimal] - Short summary (default: compact unless --verbose)
- * @returns {Promise<{ dataplaneUrl: string, authConfig: Object, environment: string }|void>}
+ * @param {boolean} [options.wait=true] - Poll the qualification job to terminal state; --no-wait returns the job id immediately
+ * @param {string} [options.resume] - Poll an existing qualification job id instead of submitting a new candidate
+ * @returns {Promise<Object|void>} Terminal result when waited, `{jobId, candidateFingerprint}` when `--no-wait`, or `undefined` on dry-run
  * @throws {Error} If validation or API calls fail
  */
 async function uploadExternalSystem(systemKey, options = {}) {
@@ -461,6 +343,5 @@ module.exports = {
   buildValidatedUploadManifestPayload,
   buildUploadPayload,
   resolveDataplaneAndAuth,
-  runUploadValidatePublish,
   validateSystemKeyFormat
 };