@aifabrix/builder 2.49.1 → 2.50.0

package/templates/channels/slack/integration/slack-system.json

@@ -0,0 +1,86 @@
+{
+  "key": "slack",
+  "displayName": "Slack communication channel",
+  "description": "Slack communication channel — Role Assistants (workforce) and document approval workflows",
+  "type": "custom",
+  "systemKind": "communication",
+  "enabled": true,
+  "authentication": {
+    "authType": "credential",
+    "credential": {
+      "credentialKey": "slack-app",
+      "displayName": "Slack App",
+      "method": "hmac",
+      "writeOnce": true,
+      "variables": {
+        "algorithm": "sha256",
+        "signatureHeader": "X-Slack-Signature",
+        "timestampHeader": "X-Slack-Request-Timestamp",
+        "signaturePrefix": "v0=",
+        "timestampMaxAge": "300"
+      },
+      "security": {
+        "signingSecret": "kv://slack/signingSecret",
+        "botToken": "kv://slack/botToken",
+        "clientSecret": "kv://slack/clientSecret"
+      },
+      "formFields": [
+        { "name": "signingSecret", "required": true },
+        {
+          "name": "botToken",
+          "required": true,
+          "label": "Bot User OAuth Token (xoxb-)",
+          "placeholder": "xoxb-…"
+        },
+        { "name": "clientSecret", "required": false }
+      ]
+    }
+  },
+  "configuration": [],
+  "dataSources": ["slack-messages", "slack-conversations"],
+  "endpoints": [
+    {
+      "type": "commands",
+      "path": "/commands",
+      "router": "slack_commands_router",
+      "description": "Slack slash commands endpoint",
+      "active": true
+    },
+    {
+      "type": "events",
+      "path": "/events",
+      "router": "slack_events_router",
+      "description": "Slack Events API endpoint",
+      "active": true
+    },
+    {
+      "type": "interactive",
+      "path": "/interactive",
+      "router": "slack_interactive_router",
+      "description": "Slack interactive components endpoint",
+      "active": true
+    },
+    {
+      "type": "notifications",
+      "path": "/notifications",
+      "router": "slack_notifications_router",
+      "description": "Proactive notification endpoint",
+      "active": true
+    },
+    {
+      "type": "config",
+      "path": "/bot-config",
+      "router": "slack_config_router",
+      "description": "Slack bot configuration endpoint",
+      "active": true
+    },
+    {
+      "type": "documents",
+      "path": "/documents",
+      "router": "slack_documents_router",
+      "description": "Slack document review endpoint",
+      "active": true
+    }
+  ],
+  "endpointsActive": true
+}

package/templates/channels/slack/manifest.template.json.hbs

@@ -7,7 +7,7 @@
   "features": {
     "app_home": {
       "home_tab_enabled": true,
-      "messages_tab_enabled": false,
+      "messages_tab_enabled": true,
       "messages_tab_read_only_enabled": false
     },
     "bot_user": {
@@ -16,24 +16,34 @@
     },
     "slash_commands": [
       {
-        "command": "/aifabrix",
+        "command": "/{{commandPrefix}}-help",
         "url": "{{commandUrl}}",
-        "description": "Chat with your assistants",
-        "usage_hint": "[assistant or message]",
+        "description": "Guide to Role Assistants, work, and document review links",
         "should_escape": false
       },
       {
-        "command": "/assistants",
+        "command": "/{{commandPrefix}}-assistants",
         "url": "{{commandUrl}}",
-        "description": "Show available assistants",
+        "description": "See your Role Assistants and chat in DM",
+        "should_escape": false
+      },
+      {
+        "command": "/{{commandPrefix}}-tasks",
+        "url": "{{commandUrl}}",
+        "description": "Tasks waiting for you — View opens the Work hub",
+        "should_escape": false
+      },
+      {
+        "command": "/{{commandPrefix}}-documents",
+        "url": "{{commandUrl}}",
+        "description": "Documents waiting for review — Open in portal for full review",
+        "usage_hint": "[status] [count]",
         "should_escape": false
       }
     ]
   },
   "oauth_config": {
-    "redirect_urls": [
-      "{{oauthCallbackUrl}}"
-    ],
+    "redirect_urls": {{{slackRedirectUrlsJson}}},
     "scopes": {
       "bot": [
         "app_mentions:read",
@@ -60,7 +70,7 @@
     },
     "org_deploy_enabled": true,
     "socket_mode_enabled": false,
-    "token_rotation_enabled": true,
+    "token_rotation_enabled": {{slackTokenRotationEnabled}},
     "is_mcp_enabled": false
   }
 }

package/templates/channels/teams-bot/install.template.md.hbs

@@ -1,25 +1,26 @@
-# {{appName}} — assistant channel install
+# {{appName}} — Microsoft Teams communication channel install
 
 {{appDescription}}
 
 Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
 
+One Teams bot delivers **Role Assistant** chat **and** **document approval** (plan 455.2).
+
+## Register the Teams bot (tenant admin)
+
+1. Open the [Teams Developer Portal](https://dev.teams.microsoft.com/) as a Teams tenant admin.
+2. Create a new app or **Import an existing app** using the Bot Framework manifest JSON from `dist/channels/teams-bot/channel-teams-bot.json` (same folder as this file).
+3. Set the **Bot messaging endpoint** to the **Bot messages** URL below (your dataplane `/messages` route).
+4. In [Azure Portal](https://portal.azure.com/), register or open the **Azure Bot** resource and copy the **Microsoft App ID**.
+5. In Microsoft Entra, create a **client secret** (or upload a certificate) for the bot app registration.
+6. Enable the **Microsoft Teams** channel on the Azure Bot resource.
+7. Save the **Microsoft App ID** and **client secret** in AI Fabrix: [Authentication settings]({{credentialPortalUrl}})
+8. Publish the app to your organization (or sideload for lab) and complete tenant admin approval if prompted.
+
 ## Platform callback URLs
 
-Configure these in your Slack app, Teams bot registration, or platform admin console. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+Configure these on the Azure Bot / Teams app registration. Do not embed secrets in generated files — use AI Fabrix credential storage only.
 
-{{#if eventsUrl}}
-- **Events:** {{eventsUrl}}
-{{/if}}
-{{#if interactionUrl}}
-- **Interactivity:** {{interactionUrl}}
-{{/if}}
-{{#if commandUrl}}
-- **Slash commands:** {{commandUrl}}
-{{/if}}
-{{#if oauthCallbackUrl}}
-- **OAuth redirect:** {{oauthCallbackUrl}}
-{{/if}}
 {{#if messagesUrl}}
 - **Bot messages:** {{messagesUrl}}
 {{/if}}
@@ -30,20 +31,33 @@ Configure these in your Slack app, Teams bot registration, or platform admin con
 - **Bot config:** {{botConfigUrl}}
 {{/if}}
 
+## Document approval bot commands
+
+Users message the bot with:
+
+| Command | Purpose |
+| --- | --- |
+| `documents [status] [count]` | List documents (default: pending, 10 max) |
+| `document <documentId>` | Open review Adaptive Card |
+| `approve <documentId> [notes]` | Quick-approve |
+| `help` | Command help |
+
+Review cards use **Approve**, **Reject**, and **Edit metadata** actions on the **Bot messages** endpoint. Proactive review notifications use the **Notifications** URL.
+
 ## Assistant catalog
 
 Runtime lists **assistants** available to each user from:
 
 {{assistantCatalogUrl}}
 
-## After admin approval
+## After Teams admin approval
 
 ```bash
-aifabrix app add-channel {{channelTarget}} --name "{{baseName}}"
+aifabrix channel add {{channelTarget}} --name "{{baseName}}"
 ```
 
 Optional validation:
 
 ```bash
-aifabrix app add-channel {{channelTarget}} --name "{{baseName}}" --probe
+aifabrix channel add {{channelTarget}} --name "{{baseName}}" --probe
 ```

package/templates/channels/teams-bot/integration/README.md

@@ -0,0 +1,18 @@
+# teams-bot communication channel (lab fixture)
+
+SSOT for Teams Bot Framework communication channel — **Role Assistants** and **document approval** on one bot (plan 455.2). Published to builder via `make sync-json`.
+
+## Surfaces
+
+- **Workforce:** DMs, activation cards, task offers (Bot Framework `/messages`)
+- **Document approval:** `documents`, `document`, `approve`, `help` bot commands; review Adaptive Cards; proactive `/notifications`
+
+```bash
+cd aifabrix-dataplane
+aifabrix validate teams-bot
+aifabrix upload teams-bot --probe
+aifabrix deploy teams-bot
+aifabrix channel add teams-bot --name "Your Assistant"
+```
+
+Authentication: oidc — prefilled discovery settings; operators add Microsoft App ID + client secret on Connected Systems → Authentication.

package/templates/channels/teams-bot/integration/application.json

@@ -0,0 +1,17 @@
+{
+  "app": {
+    "key": "teams-bot",
+    "displayName": "teams-bot assistant channel",
+    "description": "Assistant communication channel — upload then channel add",
+    "type": "external"
+  },
+  "externalIntegration": {
+    "schemaBasePath": "./",
+    "systems": [
+      "teams-bot-system.json"
+    ],
+    "dataSources": [],
+    "autopublish": true,
+    "version": "1.0.0"
+  }
+}

package/templates/channels/teams-bot/integration/env.template

@@ -0,0 +1,5 @@
+# teams-bot assistant channel — lab fixture secrets
+# Microsoft App ID (JWT audience / Bot Framework app registration)
+# aifabrix secret set teams-bot/botAppId "<app-id>" --shared
+
+KV_TEAMS_BOT_BOTAPPID=kv://teams-bot/botAppId

package/templates/channels/teams-bot/integration/teams-bot-system.json

@@ -0,0 +1,55 @@
+{
+  "key": "teams-bot",
+  "displayName": "Microsoft Teams communication channel",
+  "description": "Teams communication channel — Role Assistants (workforce) and document approval workflows",
+  "type": "custom",
+  "systemKind": "communication",
+  "enabled": true,
+  "authentication": {
+    "authType": "credential",
+    "credential": {
+      "credentialKey": "teams-bot",
+      "displayName": "Microsoft Teams assistant bot",
+      "method": "oidc",
+      "writeOnce": true,
+      "variables": {
+        "openIdConfigUrl": "https://login.botframework.com/v1/.well-known/openid_configuration",
+        "expectedIssuer": "https://api.botframework.com",
+        "algorithms": "RS256",
+        "validateSignature": "true"
+      },
+      "security": {
+        "clientId": "kv://teams-bot/botAppId"
+      },
+      "formFields": [
+        { "name": "clientId", "required": true }
+      ]
+    }
+  },
+  "configuration": [],
+  "dataSources": [],
+  "endpoints": [
+    {
+      "type": "messages",
+      "path": "/messages",
+      "router": "teams_bot_router",
+      "description": "Bot Framework messaging endpoint",
+      "active": true
+    },
+    {
+      "type": "notifications",
+      "path": "/notifications",
+      "router": "teams_notifications_router",
+      "description": "Proactive notification endpoint",
+      "active": true
+    },
+    {
+      "type": "config",
+      "path": "/bot-config",
+      "router": "teams_config_router",
+      "description": "Bot configuration endpoint",
+      "active": true
+    }
+  ],
+  "endpointsActive": true
+}

package/templates/channels/teams-bot/manifest.template.json.hbs

@@ -9,5 +9,32 @@
     "notificationsUrl": "{{notificationsUrl}}",
     "botConfigUrl": "{{botConfigUrl}}",
     "assistantCatalogUrl": "{{assistantCatalogUrl}}"
+  },
+  "botCommands": [
+    {
+      "title": "documents",
+      "description": "List pending documents (usage: documents [status] [count])"
+    },
+    {
+      "title": "document",
+      "description": "View document details (usage: document <documentId>)"
+    },
+    {
+      "title": "approve",
+      "description": "Approve a document (usage: approve <documentId> [notes])"
+    },
+    {
+      "title": "help",
+      "description": "Show available commands"
+    }
+  ],
+  "surfaces": {
+    "workforce": {
+      "description": "Role Assistant DMs, activation cards, task offers (Bot Framework messages + Adaptive Cards)"
+    },
+    "documentApproval": {
+      "description": "Document review cards, approve/reject actions, proactive notifications",
+      "notificationsUrl": "{{notificationsUrl}}"
+    }
   }
 }

package/templates/channels/web-embed/install.template.md.hbs

@@ -1,33 +1,23 @@
-# {{appName}} — assistant channel install
+# {{appName}} — Web embed assistant channel install
 
 {{appDescription}}
 
 Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
 
-## Platform callback URLs
+> **Experimental** — confirm product requirement before production use. No Slack/Teams-style platform admin approval.
 
-Configure these in your Slack app, Teams bot registration, or platform admin console. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+## Embed on your site
 
-{{#if eventsUrl}}
-- **Events:** {{eventsUrl}}
-{{/if}}
-{{#if interactionUrl}}
-- **Interactivity:** {{interactionUrl}}
-{{/if}}
-{{#if commandUrl}}
-- **Slash commands:** {{commandUrl}}
-{{/if}}
-{{#if oauthCallbackUrl}}
-- **OAuth redirect:** {{oauthCallbackUrl}}
-{{/if}}
-{{#if messagesUrl}}
-- **Bot messages:** {{messagesUrl}}
-{{/if}}
-{{#if notificationsUrl}}
-- **Notifications:** {{notificationsUrl}}
-{{/if}}
-{{#if botConfigUrl}}
-- **Bot config:** {{botConfigUrl}}
+1. Review the generated embed configuration JSON from `dist/channels/web-embed/channel-web-embed.json` (same folder as this file).
+2. Confirm **allowed origins** and the **embed config URL** below match your customer web application.
+3. Save the **embed API key** in AI Fabrix: [Authentication settings]({{credentialPortalUrl}})
+4. Add the embed snippet or widget loader to your web application (use values from the config artifact).
+5. Validate in a browser that the widget loads and lists assistants for signed-in users.
+
+## Platform endpoints
+
+{{#if configUrl}}
+- **Embed config:** {{configUrl}}
 {{/if}}
 
 ## Assistant catalog
@@ -36,14 +26,14 @@ Runtime lists **assistants** available to each user from:
 
 {{assistantCatalogUrl}}
 
-## After admin approval
+## After embed is live
 
 ```bash
-aifabrix app add-channel {{channelTarget}} --name "{{baseName}}"
+aifabrix channel add {{channelTarget}} --name "{{baseName}}"
 ```
 
 Optional validation:
 
 ```bash
-aifabrix app add-channel {{channelTarget}} --name "{{baseName}}" --probe
+aifabrix channel add {{channelTarget}} --name "{{baseName}}" --probe
 ```

package/templates/channels/web-embed/integration/README.md

@@ -0,0 +1,11 @@
+# Web embed assistant channel (lab fixture, experimental)
+
+SSOT for `aifabrix channel scaffold web-embed --allow-experimental` templates (`make sync-json` → builder).
+
+```bash
+cd aifabrix-dataplane
+aifabrix validate web-embed
+aifabrix upload web-embed --probe
+aifabrix deploy web-embed
+aifabrix app add-channel web-embed --name "Your Assistant" --allow-experimental
+```

package/templates/channels/web-embed/integration/application.json

@@ -0,0 +1,15 @@
+{
+  "app": {
+    "key": "web-embed",
+    "displayName": "Web embed assistant channel",
+    "description": "Assistant communication channel — deploy then app add-channel",
+    "type": "external"
+  },
+  "externalIntegration": {
+    "schemaBasePath": "./",
+    "systems": ["web-embed-system.json"],
+    "dataSources": [],
+    "autopublish": true,
+    "version": "1.0.0"
+  }
+}

package/templates/channels/web-embed/integration/env.template

@@ -0,0 +1,4 @@
+# Web embed assistant channel — lab fixture secrets (experimental channel target)
+# aifabrix secret set web-embed/apiKey "<value>" --shared
+
+KV_WEB_EMBED_APIKEY=kv://web-embed/apiKey

package/templates/channels/web-embed/integration/web-embed-system.json

@@ -0,0 +1,29 @@
+{
+  "key": "web-embed",
+  "displayName": "Web embed assistant channel",
+  "description": "Communication external system for embeddable web assistant channel install",
+  "type": "custom",
+  "systemKind": "communication",
+  "enabled": true,
+  "authentication": {
+    "authType": "credential",
+    "credential": {
+      "credentialKey": "web-embed-channel",
+      "displayName": "Web embed assistant channel",
+      "method": "apikey",
+      "writeOnce": true,
+      "variables": {
+        "baseUrl": "https://embed.aifabrix.dev"
+      },
+      "security": {
+        "apiKey": "kv://web-embed/apiKey"
+      },
+      "formFields": [
+        { "name": "apiKey", "required": true }
+      ]
+    }
+  },
+  "configuration": [],
+  "dataSources": [],
+  "endpointsActive": false
+}

package/templates/openapi/redoc_page.html

@@ -0,0 +1,86 @@
+<!doctype html>
+<html>
+<head>
+    <title>@@TITLE@@</title>
+    <meta charset="utf-8"/>
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <link href="https://fonts.googleapis.com/css?family=Montserrat:300,400,700|Roboto:300,400,700" rel="stylesheet">
+    <style>
+        body { margin: 0; padding: 0; }
+        .download-buttons {
+            position: fixed;
+            top: 10px;
+            right: 10px;
+            z-index: 1000;
+            display: flex;
+            gap: 10px;
+            flex-wrap: wrap;
+            transition: opacity 0.2s ease, visibility 0.2s ease;
+        }
+        .download-buttons.download-buttons--pending {
+            visibility: hidden;
+            opacity: 0;
+            pointer-events: none;
+        }
+        .download-btn {
+            background-color: rgb(24, 111, 175);
+            color: white;
+            border: none;
+            padding: 3px 10px;
+            text-align: center;
+            text-decoration: none;
+            display: inline-block;
+            font-size: 12px;
+            font-weight: 500;
+            border-radius: 4px;
+            cursor: pointer;
+            transition: background-color 0.3s;
+            font-family: 'Roboto', sans-serif;
+        }
+        .download-btn:hover { background-color: #0b7dda; }
+    </style>
+</head>
+<body>
+    <noscript>
+        ReDoc requires Javascript to function. Please enable it to browse the documentation.
+    </noscript>
+    <div class="download-buttons download-buttons--pending">
+        <a href="@@JSON_DOWNLOAD_URL@@" download="@@JSON_DOWNLOAD_NAME@@" class="download-btn">Download OpenAPI (JSON)</a>
+    </div>
+    <div id="redoc-root" data-spec-url="@@SPEC_URL@@"></div>
+    <script src="@@REDOC_JS_URL@@"></script>
+    <script>
+      (function () {
+        var root = document.getElementById('redoc-root');
+        var bar = document.querySelector('.download-buttons');
+        var specUrl = root && root.getAttribute('data-spec-url');
+
+        function revealDownloads() {
+          if (bar) {
+            bar.classList.remove('download-buttons--pending');
+          }
+        }
+
+        if (!root || !specUrl) {
+          revealDownloads();
+          return;
+        }
+
+        if (typeof Redoc === 'undefined' || typeof Redoc.init !== 'function') {
+          revealDownloads();
+          return;
+        }
+
+        try {
+          Redoc.init(specUrl, {}, root, function () {
+            revealDownloads();
+          });
+        } catch (_e) {
+          revealDownloads();
+        }
+
+        window.setTimeout(revealDownloads, 60000);
+      })();
+    </script>
+</body>
+</html>

package/templates/python/docker-compose.hbs

@@ -64,13 +64,24 @@ services:
     volumes:
       - {{devMountPath}}:/app
       {{#if requiresStorage}}
+      {{#if localDataMountPath}}
+      - {{localDataMountPath}}:/mnt/data
+      {{else}}
       - {{#if (eq devId 0)}}aifabrix_{{app.key}}_data{{else}}aifabrix_dev{{devId}}_{{app.key}}_data{{/if}}:/mnt/data
       {{/if}}
+      {{/if}}
     user: "${AIFABRIX_UID:-1000}:${AIFABRIX_GID:-1000}"
     {{else}}
     {{#if requiresStorage}}
     volumes:
+      {{#if localDataMountPath}}
+      - {{localDataMountPath}}:/mnt/data
+      {{else}}
       - {{#if (eq devId 0)}}aifabrix_{{app.key}}_data{{else}}aifabrix_dev{{devId}}_{{app.key}}_data{{/if}}:/mnt/data
+      {{/if}}
+    {{#if localDataMountPath}}
+    user: "${AIFABRIX_UID:-1000}:${AIFABRIX_GID:-1000}"
+    {{/if}}
     {{/if}}
     {{/if}}
     healthcheck:

package/templates/python/requirements.txt

@@ -1,4 +1,4 @@
-Flask==3.0.0
+Flask==3.1.3
 gunicorn==21.2.0
 psycopg2-binary==2.9.9
 

package/templates/typescript/docker-compose.hbs

@@ -64,13 +64,24 @@ services:
     volumes:
       - {{devMountPath}}:/app
       {{#if requiresStorage}}
+      {{#if localDataMountPath}}
+      - {{localDataMountPath}}:/mnt/data
+      {{else}}
       - {{#if (eq devId 0)}}aifabrix_{{app.key}}_data{{else}}aifabrix_dev{{devId}}_{{app.key}}_data{{/if}}:/mnt/data
       {{/if}}
+      {{/if}}
     user: "${AIFABRIX_UID:-1000}:${AIFABRIX_GID:-1000}"
     {{else}}
     {{#if requiresStorage}}
     volumes:
+      {{#if localDataMountPath}}
+      - {{localDataMountPath}}:/mnt/data
+      {{else}}
       - {{#if (eq devId 0)}}aifabrix_{{app.key}}_data{{else}}aifabrix_dev{{devId}}_{{app.key}}_data{{/if}}:/mnt/data
+      {{/if}}
+    {{#if localDataMountPath}}
+    user: "${AIFABRIX_UID:-1000}:${AIFABRIX_GID:-1000}"
+    {{/if}}
     {{/if}}
     {{/if}}
     healthcheck:

package/lib/certification/cli-cert-sync-skip.js

@@ -1,21 +0,0 @@
-/**
- * @fileoverview Detect skip-cert-sync from Commander + legacy option shapes.
- * Commander registers `--no-cert-sync` as `certSync` defaulting to true; `--no-cert-sync` sets `certSync: false`.
- * @author AI Fabrix Team
- * @version 2.0.0
- */
-
-'use strict';
-
-/**
- * @param {Object|null|undefined} options
- * @returns {boolean}
- */
-function cliOptsSkipCertSync(options) {
-  if (!options || typeof options !== 'object') return false;
-  if (options.noCertSync === true) return true;
-  if (options.certSync === false) return true;
-  return false;
-}
-
-module.exports = { cliOptsSkipCertSync };