@aifabrix/builder 2.51.0 → 2.52.0

package/templates/channels/chatgpt/manifest.template.json.hbs

@@ -1,9 +1,40 @@
 {
+  "channelTarget": "{{channelTarget}}",
   "name": "{{appName}}",
+  "baseName": "{{baseName}}",
   "description": "{{appDescription}}",
-  "credentialKey": "{{credentialKey}}",
-  "openapiUrl": "{{openapiUrl}}",
-  "mcpUrl": "{{mcpUrl}}",
-  "actionsBaseUrl": "{{actionsBaseUrl}}",
-  "assistantCatalogUrl": "{{assistantCatalogUrl}}"
+  "environment": "{{environment}}",
+  "runtime": {
+    "runtimeSystemKey": "{{runtimeSystemKey}}",
+    "remoteMcpUrl": "{{{mcpUrl}}}",
+    "transport": "{{runtimeTransport}}",
+    "assistantCatalogUrl": "{{{assistantCatalogUrl}}}",
+    "roleAssistantResolution": "dynamic-runtime",
+    "layerBToolNames": [
+{{#each layerBToolNames}}
+      "{{this}}"{{#unless @last}},{{/unless}}
+{{/each}}
+    ]
+  },
+  "authentication": {
+    "mode": "{{runtimeAuthMode}}",
+    "credentialKey": "{{credentialKey}}",
+    "credentialPortalUrl": "{{{credentialPortalUrl}}}",
+    "scopes": {{{scopesJson}}}
+  },
+  "boundaries": {
+    "oneConnectionSupportsManyRoleAssistants": true,
+    "topLevelEvidenceToolsExposed": false,
+    "runtimeOwnsWorkInterface": true,
+    "evidenceCapabilityPath": "ChatGPT -> runtime-orchestration -> Business Transformation Assistant -> internal evidence capabilities"
+  },
+  "lifecycle": {
+    "locallyValidated": true,
+    "runtimeValidated": false,
+    "requiresChatGptWorkspaceAdmin": true
+  },
+  "artifact": {
+    "format": "chatgpt-custom-mcp-app",
+    "version": "1.0.0"
+  }
 }

package/templates/channels/microsoft-copilot/ai-plugin.template.json.hbs

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/copilot/plugin/v2.4/schema.json",
+  "schema_version": "v2.4",
+  "name_for_human": "{{appName}}",
+  "name_for_model": "aifabrix_runtime_orchestration",
+  "description_for_human": "{{appDescription}}",
+  "description_for_model": "Runtime orchestration tools for governed enterprise work.",
+  "runtimes": [
+    {
+      "type": "RemoteMCPServer",
+      "spec": {
+        "url": "{{mcpUrl}}"
+      },
+      "auth": {
+        "type": "oauth",
+        "scopes": {{{scopesJson}}}
+      }
+    }
+  ],
+  "mcp_tool_description": {
+    "mode": "dynamic",
+    "layerBToolNames": [
+{{#each layerBToolNames}}
+      "{{this}}"{{#unless @last}},{{/unless}}
+{{/each}}
+    ]
+  }
+}

package/templates/channels/microsoft-copilot/declarative-agent.template.json.hbs

@@ -0,0 +1,22 @@
+{
+  "id": "{{packageAppId}}-agent",
+  "name": "{{appName}}",
+  "description": "{{appDescription}}",
+  "instructions": "Use Runtime Layer B tools only. Resolve Role Assistants dynamically and keep business reasoning inside authorized Role Assistant boundaries.",
+  "conversation_starters": [
+    {
+      "title": "Show my role assistants",
+      "text": "List my available Role Assistants and what they can do."
+    },
+    {
+      "title": "Start guided work",
+      "text": "Help me start work for my current business objective."
+    }
+  ],
+  "actions": [
+    {
+      "id": "{{pluginId}}",
+      "file": "ai-plugin.json"
+    }
+  ]
+}

package/templates/channels/microsoft-copilot/install.template.md.hbs

@@ -1,29 +1,37 @@
-# {{appName}} — Microsoft Copilot assistant channel install
+# {{appName}} — Microsoft 365 Copilot package setup
 
 {{appDescription}}
 
 Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
 
-## Publish the Copilot extension (M365 admin)
+This channel output is a Microsoft 365 Copilot app package:
 
-1. Sign in to [Microsoft 365 admin](https://admin.cloud.microsoft.com/) or **Copilot Studio** as a tenant admin.
-2. Create or open a Copilot extensibility project (declarative agent or API plugin).
-3. Import or configure using the generated manifest JSON from `dist/channels/microsoft-copilot/channel-microsoft-copilot.json`.
-4. Point the **OpenAPI** and **action** endpoints to the URLs in **Platform endpoints** below.
-5. Register OAuth client credentials for the API provider connection when the platform prompts for them.
-6. Save the **OAuth client ID** and **client secret** in AI Fabrix: [Authentication settings]({{credentialPortalUrl}})
-7. Submit for M365 admin approval and publish to your organization when review completes.
+```text
+dist/channels/microsoft-copilot/source/manifest.json
+dist/channels/microsoft-copilot/source/declarativeAgent.json
+dist/channels/microsoft-copilot/source/ai-plugin.json
+dist/channels/microsoft-copilot/build/appPackage.{{environment}}.zip
+```
+
+## Microsoft admin workflow (manual)
 
-## Platform endpoints
+1. Sign in to [Microsoft 365 admin](https://admin.cloud.microsoft.com/) or Copilot Studio as a tenant admin.
+2. Upload or sideload `appPackage.{{environment}}.zip` to your organization app catalog.
+3. Review the declarative agent + Remote MCP plugin metadata and approve tenant distribution.
+4. Configure workspace authentication and consent according to your Entra/OAuth policy.
+5. Store credential references in AI Fabrix authentication settings: [Authentication settings]({{credentialPortalUrl}})
+6. Assign the app to users/groups and complete first-user sign-in.
 
-Configure these on the Copilot connector / API plugin. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+## Runtime connection contract
 
-{{#if openapiUrl}}
-- **OpenAPI spec:** {{openapiUrl}}
-{{/if}}
-{{#if actionsBaseUrl}}
-- **Actions base:** {{actionsBaseUrl}}
-{{/if}}
+- **Runtime system key:** `{{runtimeSystemKey}}`
+- **Remote MCP URL:** `{{mcpUrl}}`
+- **Transport:** `{{runtimeTransport}}`
+- **Auth mode:** `{{runtimeAuthMode}}`
+- **Layer B tools expected:**
+{{#each layerBToolNames}}
+  - `{{this}}`
+{{/each}}
 
 ## Assistant catalog
 
@@ -31,14 +39,16 @@ Runtime lists **assistants** available to each user from:
 
 {{assistantCatalogUrl}}
 
-## After M365 admin approval
+## Probe truthfulness
 
-```bash
-aifabrix channel add {{channelTarget}} --name "{{baseName}}"
-```
+- `builderValidated` means package files, ZIP, hashes, and secret checks passed.
+- `runtimeValidated` means Runtime MCP is reachable and tool boundary checks pass.
+- `requiresMicrosoftAdmin` remains true until tenant upload/approval/assignment is complete.
 
-Optional validation:
+## Validate after admin setup
 
 ```bash
 aifabrix channel add {{channelTarget}} --name "{{baseName}}" --probe
 ```
+
+`--force` regenerates artifacts but does not rotate credentials.

package/templates/channels/microsoft-copilot/integration/README.md

@@ -1,11 +1,13 @@
-# Microsoft Copilot assistant channel (lab fixture)
+# Microsoft 365 Copilot package channel
 
-SSOT for `aifabrix channel scaffold microsoft-copilot` templates (`make sync-json` → builder).
+Generated by `aifabrix channel scaffold microsoft-copilot`.
+
+Recommended flow:
 
 ```bash
-cd aifabrix-dataplane
-aifabrix validate microsoft-copilot
-aifabrix upload microsoft-copilot --probe
-aifabrix deploy microsoft-copilot
-aifabrix app add-channel microsoft-copilot --name "Your Assistant"
+aifabrix upload microsoft-copilot --force
+aifabrix channel add microsoft-copilot --name "Your Assistant" --probe
 ```
+
+`channel add` generates package artifacts under
+`dist/channels/microsoft-copilot/` for Microsoft 365 tenant admins.

package/templates/channels/microsoft-copilot/integration/application.json

@@ -1,8 +1,8 @@
 {
   "app": {
     "key": "microsoft-copilot",
-    "displayName": "Microsoft Copilot assistant channel",
-    "description": "Assistant communication channel — deploy then app add-channel",
+    "displayName": "Microsoft Copilot package channel",
+    "description": "Assistant communication channel — deploy then channel add",
     "type": "external"
   },
   "externalIntegration": {

package/templates/channels/microsoft-copilot/integration/env.template

@@ -1,4 +1,4 @@
-# Microsoft Copilot assistant channel — lab fixture secrets
+# Microsoft Copilot package channel credential references
 # aifabrix secret set microsoft-copilot/clientId "<value>" --shared
 # aifabrix secret set microsoft-copilot/clientSecret "<value>" --shared
 

package/templates/channels/microsoft-copilot/integration/microsoft-copilot-system.json

@@ -1,7 +1,7 @@
 {
   "key": "microsoft-copilot",
-  "displayName": "Microsoft Copilot assistant channel",
-  "description": "Communication external system for Microsoft Copilot assistant channel install",
+  "displayName": "Microsoft Copilot package channel",
+  "description": "Communication external system for Microsoft Copilot package onboarding",
   "type": "custom",
   "systemKind": "communication",
   "enabled": true,
@@ -9,14 +9,15 @@
     "authType": "credential",
     "credential": {
       "credentialKey": "microsoft-copilot-channel",
-      "displayName": "Microsoft Copilot assistant channel",
+      "displayName": "Microsoft Copilot package channel",
       "method": "oauth2",
       "writeOnce": true,
       "variables": {
+        "baseUrl": "https://login.microsoftonline.com",
+        "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
         "tokenUrl": "https://login.microsoftonline.com/common/oauth2/v2.0/token",
-        "grantType": "client_credentials",
-        "scope": "https://graph.microsoft.com/.default",
-        "baseUrl": "https://graph.microsoft.com/v1.0"
+        "grantType": "authorization_code",
+        "scope": "openid profile offline_access"
       },
       "security": {
         "clientId": "kv://microsoft-copilot/clientId",

package/templates/channels/microsoft-copilot/manifest.template.json.hbs

@@ -1,8 +1,36 @@
 {
-  "name": "{{appName}}",
-  "description": "{{appDescription}}",
-  "credentialKey": "{{credentialKey}}",
-  "openapiUrl": "{{openapiUrl}}",
-  "actionsBaseUrl": "{{actionsBaseUrl}}",
-  "assistantCatalogUrl": "{{assistantCatalogUrl}}"
+  "$schema": "https://developer.microsoft.com/json-schemas/teams/v1.21/MicrosoftTeams.schema.json",
+  "manifestVersion": "1.21",
+  "version": "{{packageVersion}}",
+  "id": "{{packageAppId}}",
+  "name": {
+    "short": "{{baseName}}",
+    "full": "{{appName}}"
+  },
+  "description": {
+    "short": "{{appDescription}}",
+    "full": "{{appDescription}}"
+  },
+  "developer": {
+    "name": "AI Fabrix",
+    "websiteUrl": "{{dataplaneBaseUrl}}",
+    "privacyUrl": "{{dataplaneBaseUrl}}/privacy",
+    "termsOfUseUrl": "{{dataplaneBaseUrl}}/terms"
+  },
+  "icons": {
+    "color": "color.png",
+    "outline": "outline.png"
+  },
+  "accentColor": "#0F172A",
+  "copilotAgents": {
+    "declarativeAgents": [
+      {
+        "id": "{{packageAppId}}-agent",
+        "file": "declarativeAgent.json"
+      }
+    ]
+  },
+  "validDomains": [
+    "{{runtimeDomain}}"
+  ]
 }

package/templates/channels/slack/install.template.md.hbs

@@ -17,7 +17,7 @@ One Slack app delivers **Role Assistant** chat, **Work hub** shortcuts, and **do
 5. Confirm **App Home → Messages tab** is **ON** in the manifest (required for bot DMs and proactive notifications; slash commands work without it).
 6. Click **Create**, then open **Install App** → **Install to Workspace** and approve.
 7. Copy **Bot User OAuth Token** and **Signing Secret** from the Slack app settings.
-8. Save **Bot User OAuth Token** and **Signing Secret** in AI Fabrix: [Authentication settings]({{credentialPortalUrl}})
+8. Save **Bot User OAuth Token** and **Signing Secret** in AI Fabrix: [Authentication settings]({{{credentialPortalUrl}}})
 
 ## Platform callback URLs
 
@@ -32,6 +32,11 @@ Configure these in your Slack app if you edit settings manually. Do not embed se
 {{#if commandUrl}}
 - **Slash commands:** {{commandUrl}}
 {{/if}}
+{{#if oauthCallbackUrl}}
+- **OAuth Redirect URL:** {{oauthCallbackUrl}}
+{{/if}}
+
+Paste the **OAuth Redirect URL** into Slack app settings → **OAuth & Permissions** → **Redirect URLs** (required for Add to Slack / OAuth).
 
 Register these **V1** slash commands in the manifest (all use the same request URL):
 

package/templates/python/docker-compose.hbs

@@ -53,6 +53,10 @@ services:
     {{/if}}
     env_file:
       - {{envFile}}
+    {{#if devMountPath}}
+    # Bind-mount replaces /app and hides image ENTRYPOINT scripts (e.g. docker-entrypoint.sh).
+    entrypoint: []
+    {{/if}}
     {{#if reloadStartCommand}}
     command: ["sh", "-c", "cd /app && {{{reloadStartCommand}}}"]
     {{/if}}
@@ -111,6 +115,9 @@ services:
       - LOCAL_MODE=false
     env_file:
       - {{envFile}}
+    {{#if devMountPath}}
+    entrypoint: []
+    {{/if}}
     command: ["sh", "-c", "cd /app && {{{workerSidecars.worker.command}}}"]
     networks:
       - {{networkName}}
@@ -136,6 +143,9 @@ services:
       - LOCAL_MODE=false
     env_file:
       - {{envFile}}
+    {{#if devMountPath}}
+    entrypoint: []
+    {{/if}}
     command: ["sh", "-c", "cd /app && {{{workerSidecars.beat.command}}}"]
     networks:
       - {{networkName}}

package/templates/typescript/docker-compose.hbs

@@ -53,6 +53,10 @@ services:
     {{/if}}
     env_file:
       - {{envFile}}
+    {{#if devMountPath}}
+    # Bind-mount replaces /app and hides image ENTRYPOINT scripts (e.g. docker-entrypoint.sh).
+    entrypoint: []
+    {{/if}}
     {{#if reloadStartCommand}}
     command: ["sh", "-c", "cd /app && {{reloadStartCommand}}"]
     {{/if}}
@@ -111,6 +115,9 @@ services:
       - LOCAL_MODE=false
     env_file:
       - {{envFile}}
+    {{#if devMountPath}}
+    entrypoint: []
+    {{/if}}
     command: ["sh", "-c", "cd /app && {{{workerSidecars.worker.command}}}"]
     networks:
       - {{networkName}}
@@ -134,6 +141,9 @@ services:
       - LOCAL_MODE=false
     env_file:
       - {{envFile}}
+    {{#if devMountPath}}
+    entrypoint: []
+    {{/if}}
     command: ["sh", "-c", "cd /app && {{{workerSidecars.beat.command}}}"]
     networks:
       - {{networkName}}