@aifabrix/builder 2.51.0 → 2.51.1

package/lib/app/run-deploy-job.js

@@ -0,0 +1,108 @@
+/**
+ * Optional build.deployJob — one-shot before long-running aifabrix run start.
+ *
+ * @fileoverview Run deployJob once per aifabrix run
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+const config = require('../core/config');
+const logger = require('../utils/logger');
+const {
+  infoLine,
+  formatSuccessLine,
+  formatBlockingError
+} = require('../utils/cli-test-layout-chalk');
+const { runDockerRunEphemeral } = require('../utils/docker-run-ephemeral');
+const { getInfraBridgeNetworkName } = require('../infrastructure/orphan-infra-docker-teardown');
+
+/**
+ * Resolve trimmed deployJob from app config, or null if unset.
+ * @param {Object} appConfig - Application configuration
+ * @returns {string|null}
+ */
+function resolveDeployJobCommand(appConfig) {
+  const raw = appConfig?.build?.deployJob;
+  if (typeof raw !== 'string') {
+    return null;
+  }
+  const trimmed = raw.trim();
+  return trimmed ? trimmed : null;
+}
+
+/**
+ * Developer infra bridge so ephemeral jobs resolve compose DNS (e.g. postgres).
+ * @returns {Promise<string>}
+ */
+async function resolveDeployJobNetwork() {
+  const developerId = await config.getDeveloperId();
+  return getInfraBridgeNetworkName(developerId);
+}
+
+/**
+ * If build.deployJob is set, run it once in an ephemeral container (same image + env).
+ * Fail-closed on non-zero exit. No-op when unset.
+ *
+ * When `devMountPath` is set (aifabrix run --reload), bind-mount that path at `/app`
+ * so migrate/deploy sees the same tree as the long-running reload container.
+ *
+ * @async
+ * @param {Object} params
+ * @param {Object} params.appConfig - Application configuration
+ * @param {string} params.fullImage - Image:tag used for the run
+ * @param {string|null} [params.runEnvPath] - Ephemeral .env.run path for --env-file
+ * @param {string|null} [params.devMountPath] - Host path mounted at /app for --reload
+ * @param {boolean} [params.debug]
+ * @returns {Promise<void>}
+ * @throws {Error} If deployJob exits non-zero
+ */
+async function runDeployJobIfConfigured({
+  appConfig,
+  fullImage,
+  runEnvPath = null,
+  devMountPath = null,
+  debug = false
+}) {
+  const cmd = resolveDeployJobCommand(appConfig);
+  if (!cmd) {
+    return;
+  }
+  if (!fullImage || typeof fullImage !== 'string') {
+    throw new Error('build.deployJob requires a resolved container image');
+  }
+  const network = await resolveDeployJobNetwork();
+  const volumeMounts = _deployJobVolumeMounts(devMountPath);
+  logger.log(infoLine(`Running build.deployJob once before start (${fullImage})…`));
+  if (debug) {
+    logger.log(infoLine(`deployJob: ${cmd}`));
+    logger.log(infoLine(`deployJob network: ${network}`));
+    if (volumeMounts.length) {
+      logger.log(infoLine(`deployJob mount: ${volumeMounts[0].host} -> /app`));
+    }
+  }
+  const code = await runDockerRunEphemeral(fullImage, cmd, runEnvPath, {
+    network,
+    volumeMounts
+  });
+  if (code !== 0) {
+    logger.log(formatBlockingError(`build.deployJob failed with exit code ${code}`));
+    throw new Error(`build.deployJob failed with exit code ${code}`);
+  }
+  logger.log(formatSuccessLine('build.deployJob completed'));
+}
+
+/**
+ * @param {string|null|undefined} devMountPath
+ * @returns {Array<{ host: string, container: string }>}
+ */
+function _deployJobVolumeMounts(devMountPath) {
+  if (typeof devMountPath !== 'string' || !devMountPath.trim()) {
+    return [];
+  }
+  return [{ host: devMountPath.trim(), container: '/app' }];
+}
+
+module.exports = {
+  resolveDeployJobCommand,
+  runDeployJobIfConfigured
+};

package/lib/app/run-helpers.js

@@ -34,7 +34,12 @@ const runEnvCompose = require('./run-env-compose');
 const { getAppInfraRequirements } = require('./run-infra-requirements');
 const { resolveRunImage } = require('./run-resolve-image');
 const { startContainer } = require('./run-container-start');
-const { resolveEnvOutputPath, writeEnvOutputForReload, writeEnvOutputForLocal } = require('../utils/env-copy');
+const {
+  resolveEnvOutputPath,
+  resolveEnvLocalOutputPath,
+  writeEnvOutputForReload,
+  writeEnvOutputForLocal
+} = require('../utils/env-copy');
 const { resolveVersionForApp } = require('../utils/image-version');
 const healthCheckUtil = require('../utils/health-check');
 const { computeTraefikPublicAppUrl } = require('../utils/health-check-url');
@@ -303,8 +308,8 @@ async function generateComposeFile(appName, appConfig, composeOptions, devDir, l
 
 /**
  * Writes `build.envOutputPath` after each `aifabrix run`: **local**-flavored env for the host/IDE
- * when not using `--reload`; with **`--reload`**, merges container `.env.run` into the existing file
- * (preserves resolve comments) without appending run-only keys missing from the template.
+ * when not using `--reload`; with **`--reload`**, merges container `.env.run` into `.env` and also
+ * writes a sibling **`.env.local`** with localhost / published-port URLs for host CLI and manual tests.
  *
  * @async
  * @param {string} appName - Application name
@@ -326,6 +331,8 @@ async function writeEnvOutputIfConfigured(appName, appConfig, runEnvPath, option
   }
   if (options && options.reload === true) {
     await writeEnvOutputForReload(outputPath, runEnvPath, appName);
+    const localOutputPath = resolveEnvLocalOutputPath(outputPath);
+    await writeEnvOutputForLocal(appName, localOutputPath);
   } else {
     await writeEnvOutputForLocal(appName, outputPath);
   }

package/lib/app/run.js

@@ -404,6 +404,14 @@ async function runApp(appName, options = {}) {
       logger.log(chalk.gray(`[DEBUG] Compose file generated: ${prepared.tempComposePath}`));
     }
     logReloadDevSummary(Boolean(prepared.mergedRunOptions.reload), prepared.mergedRunOptions.reloadSyncSummary);
+    const { runDeployJobIfConfigured } = require('./run-deploy-job');
+    await runDeployJobIfConfigured({
+      appConfig: prepared.appConfig,
+      fullImage: prepared.mergedRunOptions.image,
+      runEnvPath: prepared.runEnvPath,
+      devMountPath: prepared.devMountPath || null,
+      debug
+    });
     await startAppContainer(appName, prepared.tempComposePath, prepared.hostPort, prepared.appConfig, {
       debug,
       runEnvPath: prepared.runEnvPath,

package/lib/channels/add-channel.js

@@ -12,6 +12,7 @@ const { getChannelTarget, getDefaultChannelDescription } = require('./channel-ta
 const { resolveAppDescription } = require('./channel-description');
 const { resolveChannelRuntimeValues } = require('./channel-runtime-resolver');
 const { generateChannelArtifact } = require('./channel-artifact-generator');
+const { fetchRuntimeLayerBToolNames } = require('./runtime-tool-catalog');
 const {
   getExistingChannelExtension,
   buildChannelExtensionBlock,
@@ -66,7 +67,9 @@ function toValidationDisplay(validation) {
     callbackReachable: validation.callbackReachable,
     credentialValid: validation.credentialValid,
     assistantCatalogReachable: validation.assistantCatalogReachable,
-    inboundVerification: Object.values(validation.inboundVerification).every(Boolean)
+    inboundVerification: Object.values(validation.inboundVerification).every(Boolean),
+    probeTiers: validation.probeTiers || null,
+    runtimeChecks: validation.runtimeChecks || null
   };
 }
 
@@ -156,7 +159,13 @@ async function patchConfigWithAudit(ctx, channelTarget, channelBlock, status, ar
 async function maybeRunProbe(ctx, channelBlock, channelTarget, probe) {
   if (!probe) return null;
   const validation = await runChannelProbe(
-    { dataplaneUrl: ctx.dataplaneUrl, authConfig: ctx.authConfig },
+    {
+      dataplaneUrl: ctx.dataplaneUrl,
+      authConfig: ctx.authConfig,
+      environment: ctx.environment,
+      controllerUrl: ctx.controllerUrl,
+      channelTarget
+    },
     channelBlock
   );
   if (validation.passed) {
@@ -268,6 +277,42 @@ function finishDryRunInstall(params) {
   return { dryRun: true, channelBlock: params.channelBlock, artifact: params.artifact };
 }
 
+/**
+ * @param {Object} params
+ * @returns {Promise<{ artifact: Object, channelBlock: Object, status: string }>}
+ */
+async function buildInstallArtifacts(params) {
+  const { channelTarget, options, target, existing, name, baseName, description, ctx } = params;
+  const runtimeToolNames =
+    channelTarget === 'chatgpt' || channelTarget === 'microsoft-copilot'
+      ? await fetchRuntimeLayerBToolNames(ctx.dataplaneUrl, ctx.authConfig, channelTarget)
+      : [];
+  const runtimeValues = resolveChannelRuntimeValues({
+    dataplaneBaseUrl: ctx.dataplaneUrl,
+    channelTarget,
+    appName: name,
+    baseName,
+    environment: ctx.environment,
+    appDescription: description,
+    icon: options.icon,
+    commandPrefix: options.commandPrefix,
+    layerBToolNames: runtimeToolNames
+  });
+  const projectRoot = options.projectRoot || process.cwd();
+  const artifact = generateArtifactWithAudit(channelTarget, {
+    projectRoot,
+    channelTarget,
+    runtimeValues,
+    dryRun: options.dryRun === true
+  });
+  const status = resolveInstallStatus(target, existing, options.dryRun === true);
+  const channelBlock = buildChannelExtensionBlock(
+    { name, baseName, description, artifactHash: artifact.artifactHash, status },
+    target
+  );
+  return { artifact, channelBlock, status };
+}
+
 /**
  * @param {string} channelTarget
  * @param {Object} options
@@ -289,31 +334,17 @@ async function runAddChannel(channelTarget, options = {}) {
   });
   if (skipped) return skipped;
 
-  const runtimeValues = resolveChannelRuntimeValues({
-    dataplaneBaseUrl: ctx.dataplaneUrl,
+  const { artifact, channelBlock, status } = await buildInstallArtifacts({
     channelTarget,
-    appName: name,
+    options,
+    target,
+    existing,
+    name,
     baseName,
-    environment: ctx.environment,
-    appDescription: description,
-    icon: options.icon,
-    commandPrefix: options.commandPrefix
-  });
-
-  const projectRoot = options.projectRoot || process.cwd();
-  const artifact = generateArtifactWithAudit(channelTarget, {
-    projectRoot,
-    channelTarget,
-    runtimeValues,
-    dryRun: options.dryRun === true
+    description,
+    ctx
   });
 
-  const status = resolveInstallStatus(target, existing, options.dryRun === true);
-  const channelBlock = buildChannelExtensionBlock(
-    { name, baseName, description, artifactHash: artifact.artifactHash, status },
-    target
-  );
-
   if (options.dryRun) {
     return finishDryRunInstall({ channelTarget, name, baseName, target, artifact, channelBlock });
   }

package/lib/channels/approval-guides/chatgpt.js

@@ -19,13 +19,14 @@ function buildChatGptApprovalGuide(ctx) {
     portalUrl: 'https://platform.openai.com/',
     steps: [
       'Sign in to OpenAI Platform (https://platform.openai.com/) or your ChatGPT Enterprise workspace admin console.',
-      'Create a custom GPT, workspace connector, or MCP integration using the generated manifest (path shown below).',
-      'Configure the OpenAPI specification URL and MCP endpoint from INSTALL.md (dataplane ChatGPT routes).',
-      'Complete OAuth or API key setup as required by your ChatGPT deployment model.',
-      formatCredentialPortalStep(ctx, 'the API key or OAuth client credentials'),
-      'Publish the connector to your workspace and complete admin approval if your org requires it.',
-      `After ChatGPT lists the connector as active, re-run: ${ctx.resumeCommand}`,
-      'Optional: add --probe when dataplane ChatGPT runtime routes are live on your environment.'
+      'Enable Developer mode / custom MCP app creation for the workspace (if policy requires admin allow-listing).',
+      'Create a custom MCP app using the generated channel-chatgpt.json reference artifact (path shown below).',
+      'Configure the Runtime MCP endpoint from INSTALL.md and verify Runtime Layer B tool discovery.',
+      'Complete workspace authentication setup for the custom MCP app.',
+      formatCredentialPortalStep(ctx, 'workspace credential references used by the ChatGPT channel'),
+      'Publish the app to your workspace and configure end-user access controls.',
+      `After ChatGPT lists the app as active, re-run: ${ctx.resumeCommand}`,
+      'Optional: use --probe for AI Fabrix-side runtime checks; OpenAI-side publication remains a manual admin responsibility.'
     ]
   };
 }

package/lib/channels/approval-guides/microsoft-copilot.js

@@ -19,14 +19,13 @@ function buildMicrosoftCopilotApprovalGuide(ctx) {
     portalUrl: 'https://admin.cloud.microsoft.com/',
     steps: [
       'Sign in to Microsoft 365 admin (https://admin.cloud.microsoft.com/) or Copilot Studio as a tenant admin.',
-      'Create or open a Copilot extensibility project (declarative agent or API plugin).',
-      'Import or configure using the generated manifest artifact (path shown below).',
-      'Point the OpenAPI / action endpoints to the URLs in INSTALL.md (dataplane Copilot routes).',
-      'Register OAuth client credentials for the API provider connection if the platform prompts for them.',
-      formatCredentialPortalStep(ctx, 'the OAuth client ID and client secret'),
-      'Submit for M365 admin approval and publish to your organization when review completes.',
-      `After Copilot shows the extension as available, re-run: ${ctx.resumeCommand}`,
-      'Optional: add --probe when dataplane Copilot runtime routes are live on your environment.'
+      'Upload or sideload the generated appPackage.<env>.zip package artifact.',
+      'Review declarative agent + Remote MCP plugin details and approve tenant distribution.',
+      'Configure Entra/OAuth consent and user assignment for target groups.',
+      formatCredentialPortalStep(ctx, 'Copilot channel credential references (no secrets in package files)'),
+      'Verify Runtime MCP endpoint and Layer B tool visibility using INSTALL.md guidance.',
+      `After Copilot shows the package as available, re-run: ${ctx.resumeCommand}`,
+      'Optional: use --probe for AI Fabrix-side checks; tenant upload/approval remains Microsoft-admin responsibility.'
     ]
   };
 }

package/lib/channels/channel-artifact-generator.js

@@ -14,6 +14,7 @@ const path = require('path');
 const Handlebars = require('handlebars');
 const { getChannelTarget } = require('./channel-targets');
 const { BUILDER_ROOT } = require('./channel-integration-template');
+const { generateMicrosoftCopilotPackage } = require('./microsoft-copilot-package');
 
 const SECRET_PATTERNS = [/xoxb-/i, /xoxp-/i, /client_secret/i, /signing_secret/i, /Bearer\s+/i];
 const PLACEHOLDER_DOMAIN_RE = /\byour-domain\.com\b/i;
@@ -115,11 +116,22 @@ function renderInstallGuideIfPresent(templatesDir, runtimeValues, outputDir, dry
  */
 function generateChannelArtifact(params) {
   const templatesDir = getChannelTemplatesDir(params.channelTarget);
+  const outputPath = getArtifactOutputPath(params.projectRoot, params.channelTarget);
+
+  if (params.channelTarget === 'microsoft-copilot') {
+    return generateMicrosoftCopilotPackage({
+      runtimeValues: params.runtimeValues,
+      templatesDir,
+      outputPath,
+      dryRun: params.dryRun === true,
+      assertNoSecretsInArtifact,
+      renderTemplateFile
+    });
+  }
+
   const manifestTemplate = path.join(templatesDir, 'manifest.template.json.hbs');
   const content = renderTemplateFile(manifestTemplate, params.runtimeValues);
   assertNoSecretsInArtifact(content);
-
-  const outputPath = getArtifactOutputPath(params.projectRoot, params.channelTarget);
   const artifactHash = crypto.createHash('sha256').update(content, 'utf8').digest('hex');
   const outputDir = path.dirname(outputPath);
 

package/lib/channels/channel-credential.js

@@ -48,8 +48,10 @@ const CREDENTIAL_SPECS = {
     method: 'oauth2',
     credentialConfig: {
       type: 'oauth2',
-      grantType: 'client_credentials',
+      grantType: 'authorization_code',
+      authorizationUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
       tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+      scope: 'openid profile offline_access',
       clientId: 'pending-channel-install',
       clientSecret: 'pending-channel-install'
     }

package/lib/channels/channel-probe-evidence.js

@@ -0,0 +1,79 @@
+/**
+ * Probe BTA Evidence authoring reachability for channel installs (plan 163 T7).
+ *
+ * @fileoverview Evidence metadata/download live checks without mutating activate/upload
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const {
+  getEvidenceMetadata,
+  downloadEvidence
+} = require('../api/evidence-authoring.api');
+
+const EVIDENCE_AUTHORING_CAPABILITY_KEYS = Object.freeze([
+  'evidence.metadata',
+  'evidence.download',
+  'evidence.upload',
+  'evidence.activate'
+]);
+
+/**
+ * Prefer Business Transformation when present; otherwise first catalog role key.
+ *
+ * @param {Object[]} catalogItems
+ * @returns {string}
+ */
+function pickEvidenceRoleKey(catalogItems) {
+  const keys = (Array.isArray(catalogItems) ? catalogItems : [])
+    .map((item) => String(item?.key || item?.roleKey || item?.roleRef || '').trim())
+    .filter(Boolean);
+  const preferred = keys.find((key) => key.includes('business-transformation'));
+  return preferred || keys[0] || '';
+}
+
+/**
+ * Live metadata + download prove Evidence path; upload/activate remain contract keys.
+ *
+ * @async
+ * @param {Object} ctx
+ * @param {Object[]} catalogItems
+ * @returns {Promise<{ reachable: boolean, roleKey: string, capabilityKeys: string[] }>}
+ */
+async function probeEvidenceAuthoringReachable(ctx, catalogItems) {
+  const roleKey = pickEvidenceRoleKey(catalogItems);
+  const capabilityKeys = [...EVIDENCE_AUTHORING_CAPABILITY_KEYS];
+  if (!roleKey || !ctx?.dataplaneUrl || !ctx?.authConfig || !ctx?.controllerUrl) {
+    return { reachable: false, roleKey, capabilityKeys };
+  }
+  try {
+    const options = { controllerUrl: ctx.controllerUrl };
+    const metadata = await getEvidenceMetadata(
+      ctx.dataplaneUrl,
+      ctx.authConfig,
+      roleKey,
+      options
+    );
+    const downloaded = await downloadEvidence(
+      ctx.dataplaneUrl,
+      ctx.authConfig,
+      { roleKey, pageSize: 1 },
+      options
+    );
+    const reachable =
+      Boolean(metadata?.roleKey) &&
+      Array.isArray(metadata?.evidenceKinds) &&
+      Array.isArray(downloaded?.data);
+    return { reachable, roleKey, capabilityKeys };
+  } catch {
+    return { reachable: false, roleKey, capabilityKeys };
+  }
+}
+
+module.exports = {
+  EVIDENCE_AUTHORING_CAPABILITY_KEYS,
+  pickEvidenceRoleKey,
+  probeEvidenceAuthoringReachable
+};