@aifabrix/builder 2.52.0 → 2.52.1

package/lib/channels/channel-runtime-resolver.js

@@ -19,6 +19,12 @@ const {
   COPILOT_RUNTIME_TRANSPORT,
   COPILOT_RUNTIME_AUTH_MODE
 } = require('./chatgpt-runtime-contract');
+const { applyMicrosoftCopilotDisplayLimits } = require('./microsoft-copilot-limits');
+const {
+  resolveCopilotEntraScopes,
+  evaluateCopilotEntraSsoReadiness
+} = require('./microsoft-copilot-entra-sso');
+const { applyCopilotEntraSsoFormFields } = require('./microsoft-copilot-entra-sso-form');
 
 /** Default Slack slash prefix — matches dataplane `templates/slack/command_catalog.yaml`. */
 const DEFAULT_SLACK_COMMAND_PREFIX = 'af';
@@ -152,15 +158,62 @@ function buildDeterministicGuid(seed) {
  * @param {Object} resolved
  * @param {Object} params
  */
-function applyMicrosoftCopilotRuntimeValues(resolved, params) {
+/**
+ * Apply discovery-driven package context (plan 167.0).
+ * @param {Object} resolved
+ * @param {Object} [packageContext]
+ */
+function applyDiscoveryPackageContext(resolved, packageContext) {
+  if (!packageContext || typeof packageContext !== 'object') {
+    resolved.installReady = false;
+    resolved.discoveryBlocker = resolved.discoveryBlocker || 'discoveryUnavailable';
+    return;
+  }
+  if (Array.isArray(packageContext.governedToolNames) && packageContext.governedToolNames.length > 0) {
+    resolved.layerBToolNames = [...packageContext.governedToolNames];
+  }
+  if (packageContext.mcpServerUrl) {
+    resolved.mcpUrl = packageContext.mcpServerUrl;
+  }
+  if (packageContext.displayName && !resolved.brandingNameOverride) {
+    // Keep CLI --name as appName; discovery fills defaults only when requested upstream.
+  }
+  if (packageContext.description && !resolved.appDescription) {
+    resolved.appDescription = packageContext.description;
+  }
+  resolved.installReady = packageContext.installReady === true;
+  resolved.discoveryBlocker = packageContext.blocker || null;
+  resolved.discoveryAuthentication = packageContext.authentication || null;
+  resolved.discoveryAuthenticationCapabilities = packageContext.authenticationCapabilities || [];
+}
+
+/**
+ * @param {Object} resolved
+ * @returns {void}
+ */
+function applyCopilotRuntimeDomain(resolved) {
+  resolved.runtimeDomain = '';
+  try {
+    resolved.runtimeDomain = new URL(resolved.mcpUrl).hostname;
+  } catch {
+    try {
+      resolved.runtimeDomain = new URL(resolved.dataplaneBaseUrl).hostname;
+    } catch {
+      resolved.runtimeDomain = '';
+    }
+  }
+}
+
+/**
+ * @param {Object} resolved
+ * @param {Object} params
+ * @returns {void}
+ */
+function applyCopilotPackageIdentity(resolved, params) {
   resolved.runtimeSystemKey = COPILOT_RUNTIME_SYSTEM_KEY;
   resolved.runtimeTransport = COPILOT_RUNTIME_TRANSPORT;
   resolved.runtimeAuthMode = COPILOT_RUNTIME_AUTH_MODE;
   resolved.layerBToolNames = Array.isArray(params.layerBToolNames) ? [...params.layerBToolNames] : [];
-  resolved.scopes = Array.isArray(params.scopes)
-    ? [...params.scopes]
-    : ['openid', 'profile', 'offline_access'];
-  resolved.scopesJson = JSON.stringify(resolved.scopes);
   resolved.packageVersion = typeof params.packageVersion === 'string' ? params.packageVersion : '1.0.0';
   resolved.packageAppId = buildDeterministicGuid(
     `${resolved.channelTarget}:${resolved.baseName}:${resolved.environment}:app`
@@ -168,16 +221,45 @@ function applyMicrosoftCopilotRuntimeValues(resolved, params) {
   resolved.pluginId = buildDeterministicGuid(
     `${resolved.channelTarget}:${resolved.baseName}:${resolved.environment}:plugin`
   );
-  resolved.runtimeDomain = '';
-  try {
-    resolved.runtimeDomain = new URL(resolved.mcpUrl).hostname;
-  } catch {
-    try {
-      resolved.runtimeDomain = new URL(resolved.dataplaneBaseUrl).hostname;
-    } catch {
-      resolved.runtimeDomain = '';
-    }
+  const referenceId =
+    typeof params.oauthPluginVaultReferenceId === 'string' &&
+    params.oauthPluginVaultReferenceId.trim()
+      ? params.oauthPluginVaultReferenceId.trim()
+      : '';
+  resolved.oauthPluginVaultReferenceId = referenceId || null;
+}
+
+/**
+ * @param {Object} resolved
+ * @param {Object} params
+ * @returns {void}
+ */
+function applyMicrosoftCopilotRuntimeValues(resolved, params) {
+  applyCopilotPackageIdentity(resolved, params);
+  applyDiscoveryPackageContext(resolved, params.packageContext);
+  resolved.scopes = resolveCopilotEntraScopes({
+    explicitScopes: params.scopes,
+    packageContext: params.packageContext,
+    entraProvider: params.entraProvider
+  });
+  resolved.scopesJson = JSON.stringify(resolved.scopes);
+  const readiness = evaluateCopilotEntraSsoReadiness({
+    packageContext: params.packageContext,
+    oauthPluginVaultReferenceId: resolved.oauthPluginVaultReferenceId,
+    scopes: resolved.scopes,
+    entraProvider: params.entraProvider || null
+  });
+  resolved.installReady = readiness.installReady;
+  resolved.discoveryBlocker = readiness.blocker;
+  resolved.discoveryAuthentication = readiness.packageAuthentication;
+  if (params.entraProvider?.issuer) {
+    resolved.entraIssuer = params.entraProvider.issuer;
   }
+  if (params.iconColorPath) resolved.iconColorPath = params.iconColorPath;
+  if (params.iconOutlinePath) resolved.iconOutlinePath = params.iconOutlinePath;
+  applyCopilotRuntimeDomain(resolved);
+  applyCopilotEntraSsoFormFields(resolved, params);
+  applyMicrosoftCopilotDisplayLimits(resolved);
 }
 
 /**
@@ -254,6 +336,7 @@ function resolveChannelRuntimeValues(params) {
 
   if (params.channelTarget === 'slack') {
     applySlackRuntimeValues(resolved, params);
+    applyDiscoveryPackageContext(resolved, params.packageContext);
   }
 
   if (params.channelTarget === 'microsoft-copilot') {
@@ -262,6 +345,11 @@ function resolveChannelRuntimeValues(params) {
 
   if (params.channelTarget === 'chatgpt') {
     applyChatGptRuntimeValues(resolved, params);
+    applyDiscoveryPackageContext(resolved, params.packageContext);
+  }
+
+  if (params.channelTarget === 'teams-bot') {
+    applyDiscoveryPackageContext(resolved, params.packageContext);
   }
 
   return resolved;
@@ -277,6 +365,7 @@ module.exports = {
   applySlackRuntimeValues,
   applyMicrosoftCopilotRuntimeValues,
   applyChatGptRuntimeValues,
+  applyDiscoveryPackageContext,
   resolveSlackOAuthManifestFields,
   resolveChannelRuntimeValues,
   DEFAULT_SLACK_COMMAND_PREFIX

package/lib/channels/channel-status-display.js

@@ -125,7 +125,13 @@ function displayChannelCoreFields(result) {
     logger.log(metadata(`Artifact: ${result.artifactPath}`));
   }
   if (result.installGuidePath) {
-    logger.log(metadata(`Install guide: ${result.installGuidePath}`));
+    logger.log(metadata(`Install guide (README): ${result.installGuidePath}`));
+  }
+  if (result.zipPath) {
+    logger.log(metadata(`Package ZIP: ${result.zipPath}`));
+  }
+  if (result.installReady === false && result.blocker) {
+    logger.log(metadata(`Install ready: no (${result.blocker})`));
   }
 }
 

package/lib/channels/microsoft-copilot-channel-add.js

@@ -0,0 +1,138 @@
+/**
+ * microsoft-copilot channel-add helpers (Entra SSO form context for operator errors).
+ *
+ * @fileoverview Keep add-channel.js under size limits
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { resolveChannelAuthContext } = require('./channel-auth-context');
+const {
+  normalizeBaseChannelName,
+  resolveChannelDisplayName
+} = require('./channel-display-name');
+const { getDefaultChannelDescription } = require('./channel-targets');
+const { resolveAppDescription } = require('./channel-description');
+const { loadChannelPackageContext } = require('./channel-discovery');
+const { getInboundMicrosoftEntraIdProvider } = require('../api/token-providers.api');
+const { getKeycloakEntraIdentityProvider } = require('../api/keycloak.api');
+const { resolveChannelRuntimeValues } = require('./channel-runtime-resolver');
+const { assertOauthPluginVaultReferenceId } = require('./microsoft-copilot-entra-sso');
+
+/**
+ * @param {Object} options
+ * @returns {boolean}
+ */
+function hasOauthPluginVaultReference(options) {
+  return (
+    typeof options.oauthPluginVaultReferenceId === 'string' &&
+    Boolean(options.oauthPluginVaultReferenceId.trim())
+  );
+}
+
+/**
+ * Load Trust source + Keycloak Entra IdP for Copilot packaging (null on miss/error).
+ * @param {Object} ctx
+ * @returns {Promise<{ entraProvider: Object|null, entraIdentityProvider: Object|null }>}
+ */
+async function loadMicrosoftCopilotEntraContext(ctx) {
+  let entraProvider = null;
+  let entraIdentityProvider = null;
+  if (!ctx?.controllerUrl) {
+    return { entraProvider, entraIdentityProvider };
+  }
+  try {
+    entraProvider = await getInboundMicrosoftEntraIdProvider(ctx.controllerUrl, ctx.authConfig);
+  } catch {
+    entraProvider = null;
+  }
+  try {
+    entraIdentityProvider = await getKeycloakEntraIdentityProvider(
+      ctx.controllerUrl,
+      ctx.authConfig
+    );
+  } catch {
+    entraIdentityProvider = null;
+  }
+  return { entraProvider, entraIdentityProvider };
+}
+
+/**
+ * @param {Object} params
+ * @returns {Promise<Object>}
+ */
+async function resolveCopilotFormContextForError(params) {
+  const { options, ctx, name, baseName, description } = params;
+  let packageContext = null;
+  try {
+    packageContext = await loadChannelPackageContext({
+      dataplaneBaseUrl: ctx.dataplaneUrl,
+      authConfig: ctx.authConfig,
+      channelTarget: 'microsoft-copilot',
+      branding: { displayName: name, description }
+    });
+  } catch {
+    packageContext = null;
+  }
+  const { entraProvider, entraIdentityProvider } = await loadMicrosoftCopilotEntraContext(ctx);
+  return resolveChannelRuntimeValues({
+    dataplaneBaseUrl: ctx.dataplaneUrl,
+    channelTarget: 'microsoft-copilot',
+    appName: name,
+    baseName,
+    environment: ctx.environment,
+    appDescription: description,
+    packageContext,
+    entraProvider,
+    entraIdentityProvider,
+    oauthPluginVaultReferenceId: options.oauthPluginVaultReferenceId
+  });
+}
+
+/**
+ * @param {Object} params
+ * @throws {Error}
+ */
+async function assertMicrosoftCopilotOauthReference(params) {
+  const { options } = params;
+  if (hasOauthPluginVaultReference(options)) {
+    return;
+  }
+  const formContext = await resolveCopilotFormContextForError(params);
+  assertOauthPluginVaultReferenceId({ ...options, formContext });
+}
+
+/**
+ * Fail before force upload when Teams Entra SSO auth-config id is missing.
+ * @param {Object} options
+ * @throws {Error}
+ */
+async function assertMicrosoftCopilotOauthReferenceBeforeForce(options) {
+  if (hasOauthPluginVaultReference(options)) {
+    return;
+  }
+  const ctx = await resolveChannelAuthContext('microsoft-copilot', { silent: options.quiet });
+  const baseName = normalizeBaseChannelName(options.name);
+  const name = resolveChannelDisplayName(baseName, ctx.environment);
+  const rawDescription =
+    options.description && String(options.description).trim()
+      ? String(options.description).trim()
+      : getDefaultChannelDescription();
+  await assertMicrosoftCopilotOauthReference({
+    options,
+    ctx,
+    name,
+    baseName,
+    description: resolveAppDescription('microsoft-copilot', rawDescription)
+  });
+}
+
+module.exports = {
+  hasOauthPluginVaultReference,
+  loadMicrosoftCopilotEntraContext,
+  resolveCopilotFormContextForError,
+  assertMicrosoftCopilotOauthReference,
+  assertMicrosoftCopilotOauthReferenceBeforeForce
+};

package/lib/channels/microsoft-copilot-entra-sso-form.js

@@ -0,0 +1,180 @@
+/**
+ * Microsoft Copilot Entra SSO form field resolution + template rendering.
+ *
+ * @fileoverview Template-backed Teams Entra SSO registration guidance
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('../internal/fs-real-sync');
+const path = require('path');
+const Handlebars = require('handlebars');
+const { BUILDER_ROOT } = require('./channel-integration-template');
+
+const ENTRA_SSO_REGISTRATION_URL =
+  'https://dev.teams.microsoft.com/tools/entra-configuration';
+const TEMPLATES_DIR = path.join(BUILDER_ROOT, 'templates', 'channels', 'microsoft-copilot');
+
+/**
+ * @param {string} issuer
+ * @returns {string|null}
+ */
+function extractTenantIdFromIssuer(issuer) {
+  if (typeof issuer !== 'string' || !issuer.trim()) {
+    return null;
+  }
+  const match = issuer.match(
+    /login\.microsoftonline\.com\/([0-9a-fA-F-]{36})(?:\/|$)/i
+  );
+  return match ? match[1] : null;
+}
+
+/**
+ * @param {string} [url]
+ * @returns {string|null}
+ */
+function originFromUrl(url) {
+  if (typeof url !== 'string' || !url.trim()) {
+    return null;
+  }
+  try {
+    const parsed = new URL(url.trim());
+    return `${parsed.protocol}//${parsed.host}`;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Prefer Keycloak status enterpriseAppId (Entra SSO application/client id).
+ * @param {Object|null} entraIdentityProvider
+ * @param {Object|null} entraProvider
+ * @param {Object|null} auth
+ * @returns {string|null}
+ */
+function resolveEntraSsoClientId(entraIdentityProvider, entraProvider, auth) {
+  if (
+    entraIdentityProvider &&
+    typeof entraIdentityProvider.enterpriseAppId === 'string' &&
+    entraIdentityProvider.enterpriseAppId.trim()
+  ) {
+    return entraIdentityProvider.enterpriseAppId.trim();
+  }
+  if (entraProvider && typeof entraProvider.clientId === 'string' && entraProvider.clientId.trim()) {
+    return entraProvider.clientId.trim();
+  }
+  if (auth && typeof auth.clientId === 'string' && auth.clientId.trim()) {
+    return auth.clientId.trim();
+  }
+  return null;
+}
+
+/**
+ * @param {Object} resolved
+ * @param {Object|null} entraIdentityProvider
+ * @param {Object|null} entraProvider
+ * @param {Object|null} auth
+ * @returns {string|null}
+ */
+function resolveEntraTenantId(resolved, entraIdentityProvider, entraProvider, auth) {
+  if (
+    entraIdentityProvider &&
+    typeof entraIdentityProvider.tenantId === 'string' &&
+    entraIdentityProvider.tenantId.trim()
+  ) {
+    return entraIdentityProvider.tenantId.trim();
+  }
+  return extractTenantIdFromIssuer(
+    resolved.entraIssuer || entraProvider?.issuer || auth?.issuer || null
+  );
+}
+
+/**
+ * @param {Object} resolved
+ * @param {Object} [params]
+ * @returns {void}
+ */
+function applyCopilotEntraSsoFormFields(resolved, params = {}) {
+  const entraProvider = params.entraProvider || null;
+  const entraIdentityProvider = params.entraIdentityProvider || null;
+  const auth = resolved.discoveryAuthentication || null;
+  resolved.entraSsoRegistrationUrl = ENTRA_SSO_REGISTRATION_URL;
+  resolved.entraSsoBaseUrl =
+    originFromUrl(resolved.dataplaneBaseUrl) || originFromUrl(resolved.mcpUrl) || null;
+  resolved.entraSsoClientId = resolveEntraSsoClientId(
+    entraIdentityProvider,
+    entraProvider,
+    auth
+  );
+  const scopes = Array.isArray(resolved.scopes) ? resolved.scopes : [];
+  resolved.entraSsoScope = scopes.length > 0 ? scopes.join(', ') : null;
+  resolved.entraTenantId = resolveEntraTenantId(
+    resolved,
+    entraIdentityProvider,
+    entraProvider,
+    auth
+  );
+  if (entraIdentityProvider?.enterpriseAppId) {
+    resolved.entraEnterpriseAppId = String(entraIdentityProvider.enterpriseAppId).trim();
+  }
+}
+
+/**
+ * @param {string} fileName
+ * @returns {string}
+ */
+function readCopilotTemplate(fileName) {
+  const templatePath = path.join(TEMPLATES_DIR, fileName);
+  if (!fs.existsSync(templatePath)) {
+    throw new Error(`Microsoft Copilot template not found: ${templatePath}`);
+  }
+  return fs.readFileSync(templatePath, 'utf8');
+}
+
+/**
+ * @param {string} fileName
+ * @param {Object} context
+ * @returns {string}
+ */
+function renderCopilotChannelTemplate(fileName, context) {
+  const hb = Handlebars.create();
+  hb.registerPartial('entraSsoRegistration', readCopilotTemplate('entra-sso-registration.template.md.hbs'));
+  const template = hb.compile(readCopilotTemplate(fileName));
+  return template(context).trim();
+}
+
+/**
+ * Operator-facing error when Teams Entra SSO auth-config id is missing.
+ * Prose lives in templates — not inline CLI copy.
+ * @param {Object|string} [context]
+ * @returns {string}
+ */
+function formatOauthPluginVaultReferenceRequiredError(context = {}) {
+  const values = typeof context === 'string' ? { appName: context, baseName: context } : context || {};
+  const appName =
+    (typeof values.appName === 'string' && values.appName.trim()) ||
+    (typeof values.baseName === 'string' && values.baseName.trim()) ||
+    'Your Assistant';
+  const baseName =
+    (typeof values.baseName === 'string' && values.baseName.trim()) || appName;
+  return renderCopilotChannelTemplate('oauth-plugin-vault-required.template.md.hbs', {
+    ...values,
+    appName,
+    baseName,
+    channelTarget: 'microsoft-copilot',
+    entraSsoRegistrationUrl: values.entraSsoRegistrationUrl || ENTRA_SSO_REGISTRATION_URL
+  });
+}
+
+module.exports = {
+  ENTRA_SSO_REGISTRATION_URL,
+  extractTenantIdFromIssuer,
+  originFromUrl,
+  resolveEntraSsoClientId,
+  resolveEntraTenantId,
+  applyCopilotEntraSsoFormFields,
+  renderCopilotChannelTemplate,
+  formatOauthPluginVaultReferenceRequiredError
+};