@aifabrix/builder 2.46.0 → 2.47.0

package/templates/applications/miso-controller/application.yaml

@@ -23,8 +23,6 @@ port: 3000
 frontDoorRouting:
   pattern: /miso/*
   enabled: true
-  # Docker url://internal full URLs: http://miso-controller:PORT only (ingress /miso is not on in-container routes).
-  internalDockerUseOriginOnly: false
   host: ${DEV_USERNAME}.${REMOTE_HOST}
   tls: ${TLS_ENABLED}
 
@@ -54,6 +52,8 @@ authentication:
     - aifabrix-user
 
 # Build Configuration
+# Image policy (442.0): .dockerignore + explicit COPY; final image has dist/ + public/ only.
+# No integration/, .cursor/, builder/, package src/, or markdown except /app/README.md.
 build:
   context: ../.. # Docker build context (relative to builder/miso-controller/)
   dockerfile: builder/miso-controller/Dockerfile # Dockerfile name (relative to project root)

package/templates/applications/miso-controller/env.template

@@ -15,8 +15,10 @@
 #
 # =============================================================================
 
-# Skip automatic first-time onboarding (default: false)
-# Set to true to disable automatic onboarding on first startup
+# Skip automatic first-time bootstrap on controller startup (default: false).
+# Bootstrap = DB controller row, Keycloak realm/client, admin user, roles (empty DB only).
+# Keep false for normal dev — this is NOT the Azure tenant-activation UI wizard.
+# Set true only for tests that must not mutate Keycloak/DB on startup.
 SKIP_FIRST_TIME_SETUP=false
 
 # Force onboarding to run even when a controller row already exists (default: unset/false).
@@ -43,8 +45,12 @@ ONBOARDING_ADMIN_PASSWORD=kv://miso-controller-admin-passwordKeyVault
 ONBOARDING_ADMIN_EMAIL=kv://miso-controller-admin-emailKeyVault
 
 # Create development environment during onboarding (default: false)
+# Full platform: create miso, dev, tst, and pro during onboarding (default: false)
+# When true, supersedes ONBOARDING_CREATE_DEV_ENV for which extra environments are created
+ONBOARDING_FULL_PLATFORM=false
+
 # Set to true to create both miso and dev environments during onboarding
-# When false (default), only the miso environment is created
+# When false (default), only the miso environment is created (ignored when ONBOARDING_FULL_PLATFORM=true)
 ONBOARDING_CREATE_DEV_ENV=true
 
 # =============================================================================
@@ -101,15 +107,16 @@ REDIS_PERMISSIONS_TTL=900
 # Connects to external Keycloak from aifabrix-setup.
 #
 # URL semantics:
-#   KEYCLOAK_SERVER_URL        = Public URL (browser, issuer, OAuth callbacks)
-#   KEYCLOAK_INTERNAL_SERVER_URL = Internal URL (server-to-Keycloak HTTP only, e.g. Docker)
+#   KEYCLOAK_SERVER_URL        = Public URL (browser, device-code verification URI for CLI, issuer, OAuth callbacks)
+#   KEYCLOAK_INTERNAL_SERVER_URL = Internal URL (controller→Keycloak HTTP in Docker; include /auth when Keycloak uses KC_HTTP_RELATIVE_PATH)
 #
 # Usage: Env vars are used for bootstrap/onboarding only. Runtime config comes from DB
 # (KeycloakConfiguration + Application url/internalUrl). Sync env->DB at startup via
 # sync-application-urls-from-env.service.
 #
-# NOTE: Do NOT onboard Azure Entra SSO in Keycloak during onboarding (skipAzureEntraSso=true).
-# KEYCLOAK_SKIP_AZURE_ENTRA_SSO=false
+# After POST /api/ide/onboarding/entra-id/configure succeeds, controller adds Microsoft Entra IdP to stock Keycloak
+# using the customer enterprise app (AI Fabrix Miso), not the vendor ENTRA_ID_CLIENT_ID app.
+# After configure: Keycloak broker redirect is on the customer enterprise app (AI Fabrix Miso), not ENTRA_ID_CLIENT_ID.
 
 KEYCLOAK_REALM=aifabrix
 # Public issuer / browser URL (includes /auth when Keycloak uses KC_HTTP_RELATIVE_PATH=/auth).
@@ -171,6 +178,7 @@ CONTROLLER_EVALUATION=
 # ENTRA ID ONBOARDING (vendor multi-tenant app — admin consent)
 # =============================================================================
 # AI Fabrix vendor app for TA-1 admin consent and Entra ID configure flows.
+# Same ENTRA_ID_CLIENT_ID / ENTRA_ID_CLIENT_SECRET on every deployment.
 # Customer SSO after configure uses a separate enterprise app (AI Fabrix Miso);
 # Keycloak broker redirect is on that customer app, not ENTRA_ID_CLIENT_ID.
 #
@@ -178,6 +186,8 @@ CONTROLLER_EVALUATION=
 # Mori (e.g. …/entra-id-concent/callback), not the SPA or controller.
 # ENTRA_CALLBACK_STATE_SECRET — Shared HMAC secret (min 16 chars) for OAuth state
 # between controller and Mori callback service; same value on Mori and controller.
+#
+# Delegated Graph (second redirect URI on the same vendor app): see section below.
 ENTRA_CALLBACK_STATE_SECRET=kv://entra-callback-state-secret
 ENTRA_ID_CENTRAL_CALLBACK_URI=kv://entra-callback-uri
 ENTRA_ID_CLIENT_ID=kv://entra-client-idKeyVault
@@ -201,128 +211,27 @@ ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
 # =============================================================================
 
 AZURE_SUBSCRIPTION_ID=kv://azure-subscription-idKeyVault
-AZURE_TENANT_ID=kv://azure-tenant-idKeyVault
+TENANT_ID=kv://azure-tenant-idKeyVault
 AZURE_SERVICE_NAME=kv://azure-service-nameKeyVault
 AZURE_CLIENT_ID=kv://azure-client-idKeyVault
 AZURE_CLIENT_SECRET=kv://azure-client-secretKeyVault
 
+# When true, environment infrastructure deploy skips the ai.azureOpenAI module (no new Cognitive Services account).
+SKIP_AZURE_OPENAI=false
+
+# When true, environment deploy skips Postgres ARM/KV updates if the flexible server already exists (marketplace redeploy).
+SKIP_DB_REDEPLOY=true
+
 # =============================================================================
-# DEPLOYMENT TYPE CONFIGURATION
+# DEPLOYMENT TYPE
 # =============================================================================
-# Controls deployment behavior for Azure, mock Azure, local Docker, or database-only deployments
-#
-# DEPLOYMENT types: azure, azure-mock, local, database
-#
-# -----------------------------------------------------------------------------
-# DEPLOYMENT=azure: Real Azure Operations (Production Mode)
-# -----------------------------------------------------------------------------
-#   - Creates actual Azure resources (App Services, Databases, Key Vaults, etc.)
-#   - Requires valid Azure credentials (AZURE_SUBSCRIPTION_ID, AZURE_TENANT_ID, etc.)
-#   - Requires proper Azure RBAC permissions for resource creation
-#   - Use for: Production deployments, staging environments, integration testing
-#   - WARNING: This mode will create/modify/delete real Azure resources!
-#
-# -----------------------------------------------------------------------------
-# DEPLOYMENT=azure-mock: Mock Azure Operations (Development/Testing Mode)
-# -----------------------------------------------------------------------------
-#   - Mocks Azure SDK operations (no real resources created)
-#   - Azure SDK is initialized but operations return mock responses
-#   - Useful for: Local development, unit testing, CI/CD pipelines
-#   - No Azure credentials required (but can be set for SDK initialization)
-#   - Faster than real Azure mode, but still initializes Azure SDK
-#
-#   Example use cases:
-#   - Testing deployment workflows without creating real resources
-#   - Local development when you don't have Azure access
-#   - CI/CD pipelines that need to test deployment logic
-#
-# -----------------------------------------------------------------------------
-# DEPLOYMENT=local: Local Docker Deployment (Localhost Controller)
-# -----------------------------------------------------------------------------
-#   - Does NOT touch Azure at all (completely skips all Azure operations)
-#   - Deploys applications as Docker containers on localhost (runs "docker run")
-#   - Works with local PostgreSQL and Redis containers
-#   - Fastest mode for local development (no Azure SDK overhead)
-#   - No Azure SDK initialization (reduces startup time)
-#   - Use for: Local development, testing, rapid iteration
-#
-#   Example use cases:
-#   - Local development and testing of applications
-#   - Testing deployment workflows with actual containers
-#   - Development when Azure SDK is not needed
-#
-#   Requirements (controller must be able to run "docker" successfully):
-#   - Docker must be installed and running where the controller runs
-#   - Docker network (e.g. infra-<env>-aifabrix-network) must exist
-#
-#   When miso-controller runs INSIDE a Docker container (e.g. aifabrix up-miso):
-#   - The controller has no Docker CLI or host daemon by default, so deployments
-#     will fail with "docker: not found" unless you either:
-#     (A) Mount the host Docker socket and install Docker CLI in the controller
-#         image (e.g. -v /var/run/docker.sock:/var/run/docker.sock and docker
-#         client in the image), or
-#     (B) Use DEPLOYMENT=database instead and start apps from the host, e.g.:
-#         "aifabrix up-dataplane" (controller will only update DB; you run
-#         dataplane/other apps via aifabrix on the host).
-#   - Recommended when controller is in Docker: DEPLOYMENT=database and start
-#     dataplane with "aifabrix up-dataplane" (see QUICK-START.md).
-#
-# -----------------------------------------------------------------------------
-# DEPLOYMENT=database: Database-Only Mode (DB Updates Only)
-# -----------------------------------------------------------------------------
-#   - Performs only database operations (deployment/job/application records, RBAC sync)
-#   - Does NOT run Docker containers (no container startup, health checks, port mapping)
-#   - Does NOT use Azure SDK (no Azure SDK initialization overhead)
-#   - Fastest mode for CI/CD pipelines that only need DB state validation
-#   - Use for: Testing DB workflows, validating RBAC sync, testing deployment records
-#
-#   Example use cases:
-#   - CI/CD pipelines that validate deployment workflow without containers
-#   - Testing RBAC sync logic without Docker/Azure dependencies
-#   - Validating database schema changes and migrations
-#   - Testing deployment job creation and status updates
-#   - Fast validation of DB state changes
-#
-#   What happens:
-#   - Creates deployment job in database
-#   - Updates deployment status (DEPLOYING → COMPLETED)
-#   - Updates application record (status, version, repository URL)
-#   - Syncs roles and permissions (RBAC)
-#   - Marks deployment as completed
-#   - Cleans up expired tokens
-#   - Invalidates role/permission caches
-#
-#   What does NOT happen:
-#   - No Docker container execution
-#   - No Azure SDK initialization
-#   - No container URLs or health check URLs
-#
-#   Requirements:
-#   - Database connection (DATABASE_URL)
-#   - No Docker required
-#   - No Azure credentials required
-#
-# -----------------------------------------------------------------------------
-# Configuration Notes
-# -----------------------------------------------------------------------------
-# Default: azure (Real Azure) if not set or invalid value
-# Case insensitive: 'AZURE', 'azure', 'Azure' all work
-# Whitespace is trimmed
-#
-# Environment-specific recommendations:
-#   - Production: DEPLOYMENT=azure
-#   - Staging: DEPLOYMENT=azure
-#   - Local Development: DEPLOYMENT=azure-mock or DEPLOYMENT=local
-#   - CI/CD Testing: DEPLOYMENT=azure-mock or DEPLOYMENT=database
-#   - Local Docker development: DEPLOYMENT=local
-#   - DB-only validation/testing: DEPLOYMENT=database
-#
-# When to use each mode:
-#   - Need to deploy to actual Azure resources? → DEPLOYMENT=azure
-#   - Need to test deployment logic without creating resources? → DEPLOYMENT=azure-mock
-#   - Want to run applications locally in Docker? → DEPLOYMENT=local
-#   - Only need DB updates and RBAC sync (no containers/Azure)? → DEPLOYMENT=database
+# azure       — Real Azure resources + tenant activation wizard until completed
+# azure-mock  — Mock Azure SDK; dashboard after login (no wizard)
+# local       — Controller runs docker deploy; dashboard (no wizard)
+# database    — DB/RBAC only, no Docker from controller; dashboard (default dev)
 #
+# Missing or invalid value defaults to azure (wizard + Azure credentials).
+# Bootstrap (SKIP_FIRST_TIME_SETUP=false) is separate from the activation wizard.
 DEPLOYMENT=database
 
 # =============================================================================
@@ -364,6 +273,12 @@ LICENSE_JWT=DEVELOPMENT
 # ENTRA_GRAPH_DELEGATED_REDIRECT_URI=https://aifabrix001-mori-web-we.azurewebsites.net/entra-graph-delegated/callback
 ENTRA_GRAPH_DELEGATED_REDIRECT_URI=
 
+# Optional delegated Graph scopes for GET …/graph-auth-url (space- or comma-separated).
+# ENTRA_GRAPH_DELEGATED_SCOPES=https://graph.microsoft.com/Application.ReadWrite.All,https://graph.microsoft.com/Group.ReadWrite.All,https://graph.microsoft.com/Synchronization.ReadWrite.All,openid,profile,offline_access
+
+# Dev only: log full delegated Graph JWT in general_log_* as delegatedGraphJwt (default off).
+# LOG_GRAPH_TOKEN=true
+
 # =============================================================================
 # MORI SERVICE CONFIGURATION
 # =============================================================================

package/templates/applications/miso-controller/rbac.yaml

@@ -303,8 +303,23 @@ permissions:
     roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
     description: 'Delete dimensions and dimension values'
 
-  # Token Delegation
-  - name: 'delegation:link'
+  # Token Providers
+  - name: 'token-provider:read'
+    roles:
+      [
+        'aifabrix-platform-admin',
+        'aifabrix-security-admin',
+        'aifabrix-deployment-admin',
+        'aifabrix-observer'
+      ]
+    description: 'View token provider configurations'
+
+  - name: 'token-provider:write'
+    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    description: 'Create, update, and delete token provider configurations'
+
+  # Provider Grants
+  - name: 'provider-grant:link'
     roles:
       [
         'aifabrix-platform-admin',
@@ -312,9 +327,9 @@ permissions:
         'aifabrix-deployment-admin',
         'aifabrix-developer'
       ]
-    description: 'Link OAuth providers for token delegation'
+    description: 'Link OAuth providers for provider grants'
 
-  - name: 'delegation:mint'
+  - name: 'provider-grant:mint'
     roles:
       [
         'aifabrix-platform-admin',
@@ -322,9 +337,9 @@ permissions:
         'aifabrix-deployment-admin',
         'aifabrix-developer'
       ]
-    description: 'Mint delegated OAuth tokens for external API calls'
+    description: 'Mint OAuth tokens for granted provider access'
 
-  - name: 'delegation:read'
+  - name: 'provider-grant:read'
     roles:
       [
         'aifabrix-platform-admin',
@@ -333,9 +348,9 @@ permissions:
         'aifabrix-developer',
         'aifabrix-observer'
       ]
-    description: 'View delegated OAuth credentials'
+    description: 'View provider grants'
 
-  - name: 'delegation:delete'
+  - name: 'provider-grant:delete'
     roles:
       [
         'aifabrix-platform-admin',
@@ -343,15 +358,15 @@ permissions:
         'aifabrix-deployment-admin',
         'aifabrix-developer'
       ]
-    description: 'Revoke delegated OAuth credentials'
+    description: 'Revoke provider grants'
 
-  - name: 'delegation:admin:read'
+  - name: 'provider-grant:admin:read'
     roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
-    description: 'Administrative read access to all delegated credentials'
+    description: 'Administrative read access to all provider grants'
 
-  - name: 'delegation:admin:delete'
+  - name: 'provider-grant:admin:delete'
     roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
-    description: 'Administrative delete access to all delegated credentials'
+    description: 'Administrative delete access to all provider grants'
 
   # Onboarding
   - name: 'onboarding:read'

package/templates/channels/chatgpt/install.template.md.hbs

@@ -0,0 +1,49 @@
+# {{appName}} — assistant channel install
+
+{{appDescription}}
+
+Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
+
+## Platform callback URLs
+
+Configure these in your Slack app, Teams bot registration, or platform admin console. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+
+{{#if eventsUrl}}
+- **Events:** {{eventsUrl}}
+{{/if}}
+{{#if interactionUrl}}
+- **Interactivity:** {{interactionUrl}}
+{{/if}}
+{{#if commandUrl}}
+- **Slash commands:** {{commandUrl}}
+{{/if}}
+{{#if oauthCallbackUrl}}
+- **OAuth redirect:** {{oauthCallbackUrl}}
+{{/if}}
+{{#if messagesUrl}}
+- **Bot messages:** {{messagesUrl}}
+{{/if}}
+{{#if notificationsUrl}}
+- **Notifications:** {{notificationsUrl}}
+{{/if}}
+{{#if botConfigUrl}}
+- **Bot config:** {{botConfigUrl}}
+{{/if}}
+
+## Assistant catalog
+
+Runtime lists **assistants** available to each user from:
+
+{{assistantCatalogUrl}}
+
+## After admin approval
+
+```bash
+aifabrix app add-channel {{channelTarget}} --name "{{baseName}}"
+```
+
+Optional validation:
+
+```bash
+aifabrix app add-channel {{channelTarget}} --name "{{baseName}}" --probe
+```

package/templates/channels/chatgpt/manifest.template.json.hbs

@@ -0,0 +1,9 @@
+{
+  "name": "{{appName}}",
+  "description": "{{appDescription}}",
+  "credentialKey": "{{credentialKey}}",
+  "openapiUrl": "{{openapiUrl}}",
+  "mcpUrl": "{{mcpUrl}}",
+  "actionsBaseUrl": "{{actionsBaseUrl}}",
+  "assistantCatalogUrl": "{{assistantCatalogUrl}}"
+}

package/templates/channels/microsoft-copilot/install.template.md.hbs

@@ -0,0 +1,49 @@
+# {{appName}} — assistant channel install
+
+{{appDescription}}
+
+Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
+
+## Platform callback URLs
+
+Configure these in your Slack app, Teams bot registration, or platform admin console. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+
+{{#if eventsUrl}}
+- **Events:** {{eventsUrl}}
+{{/if}}
+{{#if interactionUrl}}
+- **Interactivity:** {{interactionUrl}}
+{{/if}}
+{{#if commandUrl}}
+- **Slash commands:** {{commandUrl}}
+{{/if}}
+{{#if oauthCallbackUrl}}
+- **OAuth redirect:** {{oauthCallbackUrl}}
+{{/if}}
+{{#if messagesUrl}}
+- **Bot messages:** {{messagesUrl}}
+{{/if}}
+{{#if notificationsUrl}}
+- **Notifications:** {{notificationsUrl}}
+{{/if}}
+{{#if botConfigUrl}}
+- **Bot config:** {{botConfigUrl}}
+{{/if}}
+
+## Assistant catalog
+
+Runtime lists **assistants** available to each user from:
+
+{{assistantCatalogUrl}}
+
+## After admin approval
+
+```bash
+aifabrix app add-channel {{channelTarget}} --name "{{baseName}}"
+```
+
+Optional validation:
+
+```bash
+aifabrix app add-channel {{channelTarget}} --name "{{baseName}}" --probe
+```

package/templates/channels/microsoft-copilot/manifest.template.json.hbs

@@ -0,0 +1,8 @@
+{
+  "name": "{{appName}}",
+  "description": "{{appDescription}}",
+  "credentialKey": "{{credentialKey}}",
+  "openapiUrl": "{{openapiUrl}}",
+  "actionsBaseUrl": "{{actionsBaseUrl}}",
+  "assistantCatalogUrl": "{{assistantCatalogUrl}}"
+}

package/templates/channels/slack/install.template.md.hbs

@@ -0,0 +1,49 @@
+# {{appName}} — assistant channel install
+
+{{appDescription}}
+
+Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
+
+## Platform callback URLs
+
+Configure these in your Slack app, Teams bot registration, or platform admin console. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+
+{{#if eventsUrl}}
+- **Events:** {{eventsUrl}}
+{{/if}}
+{{#if interactionUrl}}
+- **Interactivity:** {{interactionUrl}}
+{{/if}}
+{{#if commandUrl}}
+- **Slash commands:** {{commandUrl}}
+{{/if}}
+{{#if oauthCallbackUrl}}
+- **OAuth redirect:** {{oauthCallbackUrl}}
+{{/if}}
+{{#if messagesUrl}}
+- **Bot messages:** {{messagesUrl}}
+{{/if}}
+{{#if notificationsUrl}}
+- **Notifications:** {{notificationsUrl}}
+{{/if}}
+{{#if botConfigUrl}}
+- **Bot config:** {{botConfigUrl}}
+{{/if}}
+
+## Assistant catalog
+
+Runtime lists **assistants** available to each user from:
+
+{{assistantCatalogUrl}}
+
+## After admin approval
+
+```bash
+aifabrix app add-channel {{channelTarget}} --name "{{baseName}}"
+```
+
+Optional validation:
+
+```bash
+aifabrix app add-channel {{channelTarget}} --name "{{baseName}}" --probe
+```

package/templates/channels/slack/manifest.template.json.hbs

@@ -0,0 +1,66 @@
+{
+  "display_information": {
+    "name": "{{appName}}",
+    "description": "{{appDescription}}",
+    "background_color": "#0F172A"
+  },
+  "features": {
+    "app_home": {
+      "home_tab_enabled": true,
+      "messages_tab_enabled": false,
+      "messages_tab_read_only_enabled": false
+    },
+    "bot_user": {
+      "display_name": "{{appName}}",
+      "always_online": true
+    },
+    "slash_commands": [
+      {
+        "command": "/aifabrix",
+        "url": "{{commandUrl}}",
+        "description": "Chat with your assistants",
+        "usage_hint": "[assistant or message]",
+        "should_escape": false
+      },
+      {
+        "command": "/assistants",
+        "url": "{{commandUrl}}",
+        "description": "Show available assistants",
+        "should_escape": false
+      }
+    ]
+  },
+  "oauth_config": {
+    "redirect_urls": [
+      "{{oauthCallbackUrl}}"
+    ],
+    "scopes": {
+      "bot": [
+        "app_mentions:read",
+        "chat:write",
+        "commands",
+        "im:history",
+        "im:read",
+        "im:write"
+      ]
+    },
+    "pkce_enabled": false
+  },
+  "settings": {
+    "event_subscriptions": {
+      "request_url": "{{eventsUrl}}",
+      "bot_events": [
+        "app_mention",
+        "message.im"
+      ]
+    },
+    "interactivity": {
+      "is_enabled": true,
+      "request_url": "{{interactionUrl}}"
+    },
+    "org_deploy_enabled": true,
+    "socket_mode_enabled": false,
+    "token_rotation_enabled": true,
+    "is_mcp_enabled": false
+  }
+}

package/templates/channels/teams-bot/install.template.md.hbs

@@ -0,0 +1,49 @@
+# {{appName}} — assistant channel install
+
+{{appDescription}}
+
+Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
+
+## Platform callback URLs
+
+Configure these in your Slack app, Teams bot registration, or platform admin console. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+
+{{#if eventsUrl}}
+- **Events:** {{eventsUrl}}
+{{/if}}
+{{#if interactionUrl}}
+- **Interactivity:** {{interactionUrl}}
+{{/if}}
+{{#if commandUrl}}
+- **Slash commands:** {{commandUrl}}
+{{/if}}
+{{#if oauthCallbackUrl}}
+- **OAuth redirect:** {{oauthCallbackUrl}}
+{{/if}}
+{{#if messagesUrl}}
+- **Bot messages:** {{messagesUrl}}
+{{/if}}
+{{#if notificationsUrl}}
+- **Notifications:** {{notificationsUrl}}
+{{/if}}
+{{#if botConfigUrl}}
+- **Bot config:** {{botConfigUrl}}
+{{/if}}
+
+## Assistant catalog
+
+Runtime lists **assistants** available to each user from:
+
+{{assistantCatalogUrl}}
+
+## After admin approval
+
+```bash
+aifabrix app add-channel {{channelTarget}} --name "{{baseName}}"
+```
+
+Optional validation:
+
+```bash
+aifabrix app add-channel {{channelTarget}} --name "{{baseName}}" --probe
+```

package/templates/channels/teams-bot/manifest.template.json.hbs

@@ -0,0 +1,13 @@
+{
+  "name": "{{appName}}",
+  "baseName": "{{baseName}}",
+  "description": "{{appDescription}}",
+  "credentialKey": "{{credentialKey}}",
+  "environment": "{{environment}}",
+  "endpoints": {
+    "messagesUrl": "{{messagesUrl}}",
+    "notificationsUrl": "{{notificationsUrl}}",
+    "botConfigUrl": "{{botConfigUrl}}",
+    "assistantCatalogUrl": "{{assistantCatalogUrl}}"
+  }
+}

package/templates/channels/web-embed/install.template.md.hbs

@@ -0,0 +1,49 @@
+# {{appName}} — assistant channel install
+
+{{appDescription}}
+
+Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
+
+## Platform callback URLs
+
+Configure these in your Slack app, Teams bot registration, or platform admin console. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+
+{{#if eventsUrl}}
+- **Events:** {{eventsUrl}}
+{{/if}}
+{{#if interactionUrl}}
+- **Interactivity:** {{interactionUrl}}
+{{/if}}
+{{#if commandUrl}}
+- **Slash commands:** {{commandUrl}}
+{{/if}}
+{{#if oauthCallbackUrl}}
+- **OAuth redirect:** {{oauthCallbackUrl}}
+{{/if}}
+{{#if messagesUrl}}
+- **Bot messages:** {{messagesUrl}}
+{{/if}}
+{{#if notificationsUrl}}
+- **Notifications:** {{notificationsUrl}}
+{{/if}}
+{{#if botConfigUrl}}
+- **Bot config:** {{botConfigUrl}}
+{{/if}}
+
+## Assistant catalog
+
+Runtime lists **assistants** available to each user from:
+
+{{assistantCatalogUrl}}
+
+## After admin approval
+
+```bash
+aifabrix app add-channel {{channelTarget}} --name "{{baseName}}"
+```
+
+Optional validation:
+
+```bash
+aifabrix app add-channel {{channelTarget}} --name "{{baseName}}" --probe
+```

package/templates/channels/web-embed/manifest.template.json.hbs

@@ -0,0 +1,8 @@
+{
+  "name": "{{appName}}",
+  "description": "{{appDescription}}",
+  "credentialKey": "{{credentialKey}}",
+  "configUrl": "{{configUrl}}",
+  "assistantCatalogUrl": "{{assistantCatalogUrl}}",
+  "experimental": true
+}