@aifabrix/builder 2.49.2 → 2.50.0

package/lib/build/builder-api-docker-staging.js

@@ -0,0 +1,47 @@
+/**
+ * Pre-build staging for builder-api Docker images.
+ * @fileoverview Runs scripts/stage_builder_api_for_docker.js before docker build
+ */
+
+'use strict';
+
+const fsSync = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const logger = require('../utils/logger');
+const { formatProgress, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+
+/**
+ * @param {string} contextPath
+ * @returns {void}
+ */
+function runBuilderApiDockerStaging(contextPath) {
+  const scriptPath = path.join(contextPath, 'scripts/stage_builder_api_for_docker.js');
+  if (!fsSync.existsSync(scriptPath)) {
+    throw new Error(`Missing builder-api staging script: ${scriptPath}`);
+  }
+  logger.log(formatProgress('Staging builder-api runtime tree for Docker…'));
+  const result = spawnSync(process.execPath, [scriptPath], {
+    cwd: contextPath,
+    encoding: 'utf8'
+  });
+  if (result.status !== 0) {
+    const detail = (result.stderr || result.stdout || '').trim();
+    throw new Error(detail || 'builder-api Docker staging failed');
+  }
+  logger.log(formatSuccessLine('Builder-api runtime staging ready'));
+}
+
+/**
+ * @param {string} contextPath
+ * @param {string} appName
+ * @returns {Promise<void>}
+ */
+async function maybeStageBuilderApiForDockerBuild(contextPath, appName) {
+  if (String(appName || '').trim() !== 'builder-api') {
+    return;
+  }
+  runBuilderApiDockerStaging(contextPath);
+}
+
+module.exports = { maybeStageBuilderApiForDockerBuild, runBuilderApiDockerStaging };

package/lib/build/miso-controller-npm-sdk-guard.js

@@ -4,8 +4,8 @@
  */
 
 const { execFileSync } = require('child_process');
-const fs = require('fs');
 const path = require('path');
+const { existsSync } = require('../internal/fs-real-sync');
 
 /**
  * @param {string} repoRoot - aifabrix-miso repo root (Docker build context)
@@ -16,7 +16,7 @@ function assertMisoControllerNpmSdkDeps(repoRoot) {
     repoRoot,
     'packages/miso-controller/scripts/assert-npm-sdk-deps.js'
   );
-  if (!fs.existsSync(script)) {
+  if (!existsSync(script)) {
     throw new Error(`miso-controller SDK guard not found: ${script}`);
   }
   execFileSync('node', [script], { cwd: repoRoot, stdio: 'inherit' });

package/lib/build/standard-docker-build.js

@@ -14,6 +14,7 @@ const { ensureRunSecretsForApp } = require('../app/run-env-compose');
 const { formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
 const { resolveDockerBuildArgsForApp } = require('./docker-build-args');
 const { maybeStageIntegrationForDockerBuild } = require('./integration-docker-staging');
+const { maybeStageBuilderApiForDockerBuild } = require('./builder-api-docker-staging');
 
 /**
  * Lazy require breaks circular dependency with lib/build/index.js.
@@ -70,6 +71,7 @@ async function executeDockerImageBuild(appName, options, buildConfig) {
   );
   const contextPath = prepareBuildContext(buildConfig, devDir);
   await maybeStageIntegrationForDockerBuild(contextPath);
+  await maybeStageBuilderApiForDockerBuild(contextPath, appName);
   const dockerfilePath = await handleDockerfileGeneration(
     appName,
     { devDir, buildConfig, contextPath, appConfig },

package/lib/certification/post-unified-cert-sync.js

@@ -1,44 +1,17 @@
 /**
- * @fileoverview After successful unified datasource validation, optionally sync system certification.
+ * @fileoverview Post-unified-test certification sync (removed — use validate --cert-sync).
  * @author AI Fabrix Team
  * @version 2.0.0
  */
 
 'use strict';
 
-const chalk = require('chalk');
-const logger = require('../utils/logger');
-const { trySyncCertificationFromDataplaneForExternalApp } = require('./sync-after-external-command');
-const { cliOptsSkipCertSync } = require('./cli-cert-sync-skip');
-const { resolveDebugDisplayMode } = require('../utils/datasource-test-run-debug-display');
-
 /**
- * @async
- * @param {number} exitCode
- * @param {string} datasourceKey
- * @param {Object} options - CLI flags (app, noCertSync)
- * @param {string} label - Log label
- * @param {Object|null} [envelope] - Last DatasourceTestRun (optional); used for certificateIssuance failed hint
+ * No-op: local certification block sync is opt-in via `aifabrix validate --cert-sync` only.
  * @returns {Promise<void>}
  */
-async function afterUnifiedValidationCertSync(exitCode, datasourceKey, options, label, envelope = null) {
-  if (exitCode !== 0 || cliOptsSkipCertSync(options)) return;
-  try {
-    const { resolveAppKeyForDatasource } = require('../datasource/resolve-app');
-    const { appKey } = await resolveAppKeyForDatasource(datasourceKey, options.app);
-    let issuanceFailureHint = null;
-    if (envelope && envelope.certificateIssuance && envelope.certificateIssuance.status === 'failed') {
-      const ci = envelope.certificateIssuance;
-      issuanceFailureHint = [ci.reasonCode, ci.message].filter(Boolean).join(': ');
-    }
-    const verboseCertHints = resolveDebugDisplayMode(options.debug) !== null;
-    await trySyncCertificationFromDataplaneForExternalApp(appKey, label, {
-      issuanceFailureHint,
-      verboseCertHints
-    });
-  } catch (e) {
-    logger.log(chalk.yellow(`⚠ Certification sync (${label}) skipped: ${e.message}`));
-  }
+async function afterUnifiedValidationCertSync() {
+  return undefined;
 }
 
 module.exports = { afterUnifiedValidationCertSync };

package/lib/certification/sync-after-external-command.js

@@ -39,7 +39,6 @@ async function trySyncCertificationFromDataplaneForExternalApp(appKey, label, ex
     const dsKeys = (manifest.dataSources || []).map((ds) => ds && ds.key).filter(Boolean);
     await maybeSyncSystemCertificationFromDataplane({
       label,
-      noCertSync: false,
       systemKey: manifest.key,
       dataplaneUrl,
       authConfig,

package/lib/certification/sync-system-certification.js

@@ -185,7 +185,6 @@ async function syncSystemCertificationFromDataplane(params) {
  * @async
  * @param {Object} params
  * @param {string} [params.label] - e.g. "upload"
- * @param {boolean} [params.noCertSync]
  * @returns {Promise<void>}
  */
 function logCertificationSyncNotWritten(r, label, verboseCertHints = false) {
@@ -205,7 +204,6 @@ function logCertificationSyncNotWritten(r, label, verboseCertHints = false) {
 async function maybeSyncSystemCertificationFromDataplane(params) {
   const {
     label,
-    noCertSync,
     systemKey,
     dataplaneUrl,
     authConfig,
@@ -214,7 +212,6 @@ async function maybeSyncSystemCertificationFromDataplane(params) {
     verboseCertHints,
     silent
   } = params;
-  if (noCertSync === true) return;
   try {
     const r = await syncSystemCertificationFromDataplane({
       systemKey,

package/lib/channels/add-channel.js

@@ -1,5 +1,5 @@
 /**
- * Orchestrate aifabrix app add-channel (plan 152).
+ * Orchestrate aifabrix channel add (plan 152).
  *
  * @fileoverview Channel install after communication external system deploy
  * @author AI Fabrix Team
@@ -9,6 +9,7 @@
 'use strict';
 
 const { getChannelTarget, getDefaultChannelDescription } = require('./channel-targets');
+const { resolveAppDescription } = require('./channel-description');
 const { resolveChannelRuntimeValues } = require('./channel-runtime-resolver');
 const { generateChannelArtifact } = require('./channel-artifact-generator');
 const {
@@ -27,6 +28,10 @@ const {
 const { runChannelProbe } = require('./channel-probe');
 const { resolveChannelAuthContext } = require('./channel-auth-context');
 const { ensureChannelCredential } = require('./channel-credential');
+const {
+  buildChannelApprovalGuide,
+  resolveApprovalPortalUrl
+} = require('./channel-approval-guide');
 const {
   normalizeBaseChannelName,
   resolveChannelDisplayName
@@ -40,24 +45,6 @@ const {
 /**
  * @param {typeof import('./channel-targets').CHANNEL_TARGETS[string]} target
  * @param {Object} channelExt
- * @param {Object} [context]
- * @returns {string|null}
- */
-function resolveApprovalUrl(target, channelExt, context = {}) {
-  if (!target.approvalRequired) return null;
-  if (channelExt?.status === 'installed' || channelExt?.status === 'validated') return null;
-  if (target.key === 'slack' && context.artifactPath) {
-    return `https://api.slack.com/apps/new — upload manifest: ${context.artifactPath}`;
-  }
-  if (target.key === 'teams-bot') {
-    return 'https://admin.teams.microsoft.com/ — configure Bot Channel Registration for this tenant';
-  }
-  return `https://platform-admin.example/configure/${target.key}`;
-}
-
-/**
- * @param {Object} target
- * @param {Object} channelExt
  * @param {boolean} dryRun
  * @returns {string}
  */
@@ -88,7 +75,7 @@ function toValidationDisplay(validation) {
  * @returns {Object|null}
  */
 function showExistingChannelStatus(params) {
-  const { existing, options, target, channelTarget, name, baseName } = params;
+  const { existing, options, channelTarget, name, baseName, ctx } = params;
   if (!existing || options.force || options.dryRun) return null;
   const sameInstall =
     (existing.baseName && existing.baseName === baseName) ||
@@ -99,11 +86,21 @@ function showExistingChannelStatus(params) {
         `Use --force to replace with "${name}".`
     );
   }
+  const projectRoot = options.projectRoot || process.cwd();
+  const approvalGuide =
+    existing.status === 'approvalRequired'
+      ? buildChannelApprovalGuide(channelTarget, {
+        projectRoot,
+        name: existing.name || name,
+        baseName,
+        dataplaneBaseUrl: ctx?.dataplaneUrl
+      })
+      : null;
   displayExistingChannelStatus({
     channelTarget,
     name: existing.name || name,
     channelExt: existing,
-    approvalUrl: resolveApprovalUrl(target, existing)
+    approvalGuide
   });
   return { skipped: true, channelExt: existing };
 }
@@ -183,16 +180,17 @@ async function prepareChannelContext(channelTarget, options) {
     );
   }
   if (!options.name || typeof options.name !== 'string' || !options.name.trim()) {
-    throw new Error('--name is required for app add-channel');
+    throw new Error('--name is required for channel add');
   }
 
   const baseName = normalizeBaseChannelName(options.name);
   const ctx = await resolveChannelAuthContext(channelTarget, { silent: options.quiet });
   const name = resolveChannelDisplayName(baseName, ctx.environment);
-  const description =
+  const rawDescription =
     options.description && String(options.description).trim()
       ? String(options.description).trim()
       : getDefaultChannelDescription();
+  const description = resolveAppDescription(channelTarget, rawDescription);
 
   const system = await fetchCommunicationSystem({
     dataplaneUrl: ctx.dataplaneUrl,
@@ -219,12 +217,19 @@ async function completeLiveInstall(params) {
 
   await patchConfigWithAudit(ctx, channelTarget, channelBlock, status, artifact.artifactHash);
 
-  const approvalUrl =
+  const projectRoot = options.projectRoot || process.cwd();
+  const approvalGuide =
     status === 'approvalRequired'
-      ? resolveApprovalUrl(target, channelBlock, { artifactPath: artifact.outputPath })
+      ? buildChannelApprovalGuide(channelTarget, {
+        projectRoot,
+        name,
+        baseName,
+        artifactPath: artifact.outputPath,
+        dataplaneBaseUrl: ctx.dataplaneUrl
+      })
       : null;
-  if (approvalUrl) {
-    auditApprovalRequired(channelTarget, { approvalUrl });
+  if (approvalGuide?.portalUrl) {
+    auditApprovalRequired(channelTarget, { approvalUrl: approvalGuide.portalUrl });
   }
 
   const validation = await maybeRunProbe(ctx, channelBlock, channelTarget, options.probe);
@@ -239,10 +244,10 @@ async function completeLiveInstall(params) {
     artifactPath: artifact.outputPath,
     installGuidePath: artifact.installPath,
     validation: toValidationDisplay(validation),
-    approvalUrl
+    approvalGuide
   });
 
-  return { channelBlock, artifact, validation, approvalUrl };
+  return { channelBlock, artifact, validation, approvalGuide };
 }
 
 /**
@@ -277,10 +282,10 @@ async function runAddChannel(channelTarget, options = {}) {
   const skipped = showExistingChannelStatus({
     existing,
     options,
-    target,
     channelTarget,
     name,
-    baseName
+    baseName,
+    ctx
   });
   if (skipped) return skipped;
 
@@ -291,7 +296,8 @@ async function runAddChannel(channelTarget, options = {}) {
     baseName,
     environment: ctx.environment,
     appDescription: description,
-    icon: options.icon
+    icon: options.icon,
+    commandPrefix: options.commandPrefix
   });
 
   const projectRoot = options.projectRoot || process.cwd();
@@ -341,8 +347,8 @@ async function addChannelCommand(channelTarget, options = {}) {
 module.exports = {
   runAddChannel,
   addChannelCommand,
-  resolveApprovalUrl,
   resolveInstallStatus,
   normalizeBaseChannelName,
-  resolveChannelDisplayName
+  resolveChannelDisplayName,
+  resolveApprovalPortalUrl
 };

package/lib/channels/approval-guides/chatgpt.js

@@ -0,0 +1,33 @@
+/**
+ * ChatGPT enterprise channel admin approval steps (plan 152).
+ *
+ * @fileoverview OpenAI Platform / workspace connector guide
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { formatCredentialPortalStep } = require('./credential-portal');
+
+/**
+ * @param {Object} ctx
+ * @returns {{ portalUrl: string, steps: string[] }}
+ */
+function buildChatGptApprovalGuide(ctx) {
+  return {
+    portalUrl: 'https://platform.openai.com/',
+    steps: [
+      'Sign in to OpenAI Platform (https://platform.openai.com/) or your ChatGPT Enterprise workspace admin console.',
+      'Create a custom GPT, workspace connector, or MCP integration using the generated manifest (path shown below).',
+      'Configure the OpenAPI specification URL and MCP endpoint from INSTALL.md (dataplane ChatGPT routes).',
+      'Complete OAuth or API key setup as required by your ChatGPT deployment model.',
+      formatCredentialPortalStep(ctx, 'the API key or OAuth client credentials'),
+      'Publish the connector to your workspace and complete admin approval if your org requires it.',
+      `After ChatGPT lists the connector as active, re-run: ${ctx.resumeCommand}`,
+      'Optional: add --probe when dataplane ChatGPT runtime routes are live on your environment.'
+    ]
+  };
+}
+
+module.exports = { buildChatGptApprovalGuide };

package/lib/channels/approval-guides/credential-portal.js

@@ -0,0 +1,38 @@
+/**
+ * Dataplane Connected Systems authentication portal URLs (plan 152).
+ *
+ * @fileoverview Credential UI deep links for channel install guides
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { joinUrl, normalizeBaseUrl } = require('../channel-runtime-resolver');
+
+/**
+ * @param {string} dataplaneBaseUrl
+ * @param {string} channelTarget
+ * @returns {string}
+ */
+function buildCredentialPortalUrl(dataplaneBaseUrl, channelTarget) {
+  const base = normalizeBaseUrl(dataplaneBaseUrl);
+  return joinUrl(base, `/connected-systems/${channelTarget}?tab=authentication`);
+}
+
+/**
+ * @param {Object} ctx
+ * @param {string} secretHint - e.g. "the Bot User OAuth Token and Signing Secret"
+ * @returns {string}
+ */
+function formatCredentialPortalStep(ctx, secretHint) {
+  if (ctx.credentialPortalUrl) {
+    return `In AI Fabrix, open ${ctx.credentialPortalUrl} and save ${secretHint}.`;
+  }
+  return `In AI Fabrix, open Connected Systems → ${ctx.channelTarget} → Authentication and save ${secretHint}.`;
+}
+
+module.exports = {
+  buildCredentialPortalUrl,
+  formatCredentialPortalStep
+};

package/lib/channels/approval-guides/index.js

@@ -0,0 +1,110 @@
+/**
+ * Channel approval / go-live guide registry (plan 152).
+ *
+ * @fileoverview Per-target admin steps for channel add TTY output
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const { getArtifactOutputPath } = require('../channel-artifact-generator');
+const { getChannelTarget } = require('../channel-targets');
+const { buildSlackApprovalGuide } = require('./slack');
+const { buildTeamsBotApprovalGuide } = require('./teams-bot');
+const { buildMicrosoftCopilotApprovalGuide } = require('./microsoft-copilot');
+const { buildChatGptApprovalGuide } = require('./chatgpt');
+const { buildWebEmbedInstallGuide } = require('./web-embed');
+const { buildCredentialPortalUrl } = require('./credential-portal');
+
+/** @type {Record<string, (ctx: Object) => { portalUrl: string|null, steps: string[] }>} */
+const GUIDE_BUILDERS = {
+  slack: buildSlackApprovalGuide,
+  'teams-bot': buildTeamsBotApprovalGuide,
+  'microsoft-copilot': buildMicrosoftCopilotApprovalGuide,
+  chatgpt: buildChatGptApprovalGuide,
+  'web-embed': buildWebEmbedInstallGuide
+};
+
+/**
+ * @param {string} projectRoot
+ * @param {string} channelTarget
+ * @param {string} [artifactPath]
+ * @returns {string}
+ */
+function resolveArtifactPath(projectRoot, channelTarget, artifactPath) {
+  if (artifactPath && String(artifactPath).trim()) {
+    return path.resolve(artifactPath);
+  }
+  return getArtifactOutputPath(projectRoot, channelTarget);
+}
+
+/**
+ * @param {string} channelTarget
+ * @param {string} name
+ * @returns {string}
+ */
+function buildResumeCommand(channelTarget, name) {
+  return `aifabrix channel add ${channelTarget} --name "${name}"`;
+}
+
+/**
+ * @param {string} channelTarget
+ * @param {Object} [context]
+ * @returns {Object}
+ */
+function buildChannelApprovalGuide(channelTarget, context = {}) {
+  const target = getChannelTarget(channelTarget);
+  const builder = GUIDE_BUILDERS[channelTarget];
+  if (!builder) {
+    throw new Error(`No approval guide for channel target "${channelTarget}"`);
+  }
+
+  const projectRoot = context.projectRoot || process.cwd();
+  const name = context.name || '';
+  const artifactPath = resolveArtifactPath(projectRoot, channelTarget, context.artifactPath);
+  const installGuidePath = path.join(path.dirname(artifactPath), 'INSTALL.md');
+  const resumeCommand = buildResumeCommand(channelTarget, name);
+  const credentialPortalUrl = context.dataplaneBaseUrl
+    ? buildCredentialPortalUrl(context.dataplaneBaseUrl, channelTarget)
+    : null;
+  const baseCtx = {
+    channelTarget,
+    artifactPath,
+    resumeCommand,
+    credentialKey: target.credentialKey,
+    credentialPortalUrl
+  };
+
+  const guide = builder(baseCtx);
+
+  return {
+    channelTarget,
+    portalUrl: guide.portalUrl,
+    artifactPath,
+    installGuidePath,
+    resumeCommand,
+    credentialKey: target.credentialKey,
+    credentialPortalUrl,
+    steps: guide.steps,
+    approvalRequired: target.approvalRequired === true
+  };
+}
+
+/**
+ * @param {string} channelTarget
+ * @param {Object} [context]
+ * @returns {string|null}
+ */
+function resolveApprovalPortalUrl(channelTarget, context = {}) {
+  return buildChannelApprovalGuide(channelTarget, context).portalUrl;
+}
+
+module.exports = {
+  GUIDE_BUILDERS,
+  buildChannelApprovalGuide,
+  resolveApprovalPortalUrl,
+  resolveArtifactPath,
+  buildResumeCommand
+};

package/lib/channels/approval-guides/microsoft-copilot.js

@@ -0,0 +1,34 @@
+/**
+ * Microsoft Copilot channel admin approval steps (plan 152).
+ *
+ * @fileoverview Copilot Studio / M365 admin connector guide
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { formatCredentialPortalStep } = require('./credential-portal');
+
+/**
+ * @param {Object} ctx
+ * @returns {{ portalUrl: string, steps: string[] }}
+ */
+function buildMicrosoftCopilotApprovalGuide(ctx) {
+  return {
+    portalUrl: 'https://admin.cloud.microsoft.com/',
+    steps: [
+      'Sign in to Microsoft 365 admin (https://admin.cloud.microsoft.com/) or Copilot Studio as a tenant admin.',
+      'Create or open a Copilot extensibility project (declarative agent or API plugin).',
+      'Import or configure using the generated manifest artifact (path shown below).',
+      'Point the OpenAPI / action endpoints to the URLs in INSTALL.md (dataplane Copilot routes).',
+      'Register OAuth client credentials for the API provider connection if the platform prompts for them.',
+      formatCredentialPortalStep(ctx, 'the OAuth client ID and client secret'),
+      'Submit for M365 admin approval and publish to your organization when review completes.',
+      `After Copilot shows the extension as available, re-run: ${ctx.resumeCommand}`,
+      'Optional: add --probe when dataplane Copilot runtime routes are live on your environment.'
+    ]
+  };
+}
+
+module.exports = { buildMicrosoftCopilotApprovalGuide };

package/lib/channels/approval-guides/slack.js

@@ -0,0 +1,34 @@
+/**
+ * Slack channel admin approval steps (plan 152).
+ *
+ * @fileoverview Slack app manifest install guide
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { formatCredentialPortalStep } = require('./credential-portal');
+
+/**
+ * @param {Object} ctx
+ * @returns {{ portalUrl: string, steps: string[] }}
+ */
+function buildSlackApprovalGuide(ctx) {
+  return {
+    portalUrl: 'https://api.slack.com/apps',
+    steps: [
+      'Open https://api.slack.com/apps and sign in as a Slack workspace admin.',
+      'Click Create New App → From an app manifest.',
+      'Select your workspace, then paste or upload the Slack app manifest (path shown below).',
+      'Review callback URLs and OAuth scopes (pre-filled from AI Fabrix), then create the app.',
+      'Open Install App → Install to Workspace and approve the installation.',
+      'Copy the Bot User OAuth Token and Signing Secret from the Slack app settings.',
+      formatCredentialPortalStep(ctx, 'the Bot User OAuth Token and Signing Secret'),
+      `When Slack shows the app as installed, re-run: ${ctx.resumeCommand}`,
+      'Optional: add --probe to verify callbacks and the assistant catalog.'
+    ]
+  };
+}
+
+module.exports = { buildSlackApprovalGuide };

package/lib/channels/approval-guides/teams-bot.js

@@ -0,0 +1,35 @@
+/**
+ * Microsoft Teams bot channel admin approval steps (plan 152).
+ *
+ * @fileoverview Teams Developer Portal + Azure Bot registration guide
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { formatCredentialPortalStep } = require('./credential-portal');
+
+/**
+ * @param {Object} ctx
+ * @returns {{ portalUrl: string, steps: string[] }}
+ */
+function buildTeamsBotApprovalGuide(ctx) {
+  return {
+    portalUrl: 'https://dev.teams.microsoft.com/',
+    steps: [
+      'Open the Teams Developer Portal (https://dev.teams.microsoft.com/) as a Teams tenant admin.',
+      'Create a new app or import the Bot Framework manifest JSON (path shown below).',
+      'Set the bot messaging endpoint to the Bot messages URL in INSTALL.md (your dataplane /messages route).',
+      'In Azure Portal, register or link the Azure Bot resource and copy the Microsoft App ID.',
+      'Create a client secret (or upload certificate) for the bot app registration in Microsoft Entra.',
+      'Enable the Microsoft Teams channel on the Azure Bot resource.',
+      formatCredentialPortalStep(ctx, 'the Microsoft App ID and client secret'),
+      'Publish the app to your org (or sideload for lab) and complete tenant admin approval if prompted.',
+      `After the bot is live in Teams, re-run: ${ctx.resumeCommand}`,
+      'Optional: add --probe to verify inbound JWT validation and the assistant catalog.'
+    ]
+  };
+}
+
+module.exports = { buildTeamsBotApprovalGuide };

package/lib/channels/approval-guides/web-embed.js

@@ -0,0 +1,32 @@
+/**
+ * Web embed channel go-live steps (plan 152) — no platform admin approval.
+ *
+ * @fileoverview Customer-site embed configuration guide
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { formatCredentialPortalStep } = require('./credential-portal');
+
+/**
+ * @param {Object} ctx
+ * @returns {{ portalUrl: null, steps: string[] }}
+ */
+function buildWebEmbedInstallGuide(ctx) {
+  return {
+    portalUrl: null,
+    steps: [
+      'Review the generated embed configuration JSON (path shown below).',
+      'Confirm allowed origins and the embed config URL in INSTALL.md match your customer site.',
+      formatCredentialPortalStep(ctx, 'the embed API key'),
+      'Add the embed snippet or widget loader to your web application (see INSTALL.md).',
+      'No Slack/Teams-style admin approval is required — validate in your browser after deploy.',
+      `Re-run: ${ctx.resumeCommand}`,
+      'Optional: add --probe to verify the config endpoint and assistant catalog.'
+    ]
+  };
+}
+
+module.exports = { buildWebEmbedInstallGuide };

package/lib/channels/channel-approval-guide.js

@@ -0,0 +1,11 @@
+/**
+ * Re-export channel approval guides (plan 152).
+ *
+ * @fileoverview Back-compat shim — implementation in approval-guides/
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+module.exports = require('./approval-guides');