@aifabrix/builder 2.52.0 → 2.52.1

package/lib/channels/microsoft-copilot-entra-sso.js

@@ -0,0 +1,264 @@
+/**
+ * Microsoft Copilot Entra SSO / trustedIssuer packaging helpers (plan 169.0).
+ *
+ * @fileoverview Readiness, scopes, and auth selection for microsoft-copilot
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const TRUSTED_ISSUER = 'trustedIssuer';
+const CUSTOMER_OAUTH = 'customerOAuth';
+const OPENID_ONLY = new Set(['openid', 'profile', 'offline_access']);
+
+/**
+ * @param {*} value
+ * @returns {boolean}
+ */
+function isPresent(value) {
+  return value !== undefined && value !== null && value !== '';
+}
+
+/**
+ * @param {string} channelTarget
+ * @returns {boolean}
+ */
+function skipsChannelOauthCredential(channelTarget) {
+  return channelTarget === 'microsoft-copilot';
+}
+
+/**
+ * @param {unknown} scopes
+ * @returns {string[]}
+ */
+function normalizeScopeList(scopes) {
+  if (!Array.isArray(scopes)) {
+    return [];
+  }
+  return scopes.map((s) => String(s).trim()).filter(Boolean);
+}
+
+/**
+ * True when scopes are empty or only OIDC login scopes (insufficient for Runtime MCP).
+ * @param {string[]} scopes
+ * @returns {boolean}
+ */
+function isOpenIdOnlyOrEmptyScopes(scopes) {
+  const list = normalizeScopeList(scopes);
+  if (list.length === 0) {
+    return true;
+  }
+  return list.every((scope) => OPENID_ONLY.has(scope));
+}
+
+/**
+ * @param {Object|null|undefined} auth
+ * @returns {string|null}
+ */
+function resolveRecommendedCapability(auth) {
+  const value = auth && typeof auth.recommendedCapability === 'string'
+    ? auth.recommendedCapability.trim()
+    : '';
+  return value || null;
+}
+
+/**
+ * Map adapter auth for Copilot packaging: keep trustedIssuer public fields;
+ * drop Keycloak/customerOAuth AS metadata from the package surface.
+ * @param {Object|null} auth
+ * @returns {Object|null}
+ */
+function mapCopilotPackageAuthentication(auth) {
+  if (!auth || typeof auth !== 'object') {
+    return null;
+  }
+  const recommended = resolveRecommendedCapability(auth);
+  const base = {
+    recommendedCapability: recommended,
+    issuer: auth.issuer || null,
+    openidConfigurationUrl: auth.openidConfigurationUrl || null,
+    protectedResourceMetadataUrl: auth.protectedResourceMetadataUrl || null,
+    resource: auth.resource || auth.apiResource || null,
+    operatorNote: auth.operatorNote || null,
+    pkceRequired: auth.pkceRequired === true,
+    audience: isPresent(auth.audience) ? auth.audience : null,
+    scopes: normalizeScopeList(auth.scopes || auth.allowedScopes)
+  };
+  if (recommended === TRUSTED_ISSUER) {
+    return {
+      ...base,
+      authorizationServerMetadataUrl: null,
+      clientRegistrationModes: []
+    };
+  }
+  return {
+    ...base,
+    authorizationServerMetadataUrl: auth.authorizationServerMetadataUrl || null,
+    clientRegistrationModes: Array.isArray(auth.clientRegistrationModes)
+      ? [...auth.clientRegistrationModes]
+      : []
+  };
+}
+
+/**
+ * Resolve Runtime MCP Entra scopes — never default to openid/profile/offline_access.
+ * @param {Object} params
+ * @param {string[]} [params.explicitScopes]
+ * @param {Object|null} [params.packageContext]
+ * @param {Object|null} [params.entraProvider]
+ * @returns {string[]}
+ */
+function resolveCopilotEntraScopes(params) {
+  const explicit = normalizeScopeList(params.explicitScopes);
+  if (explicit.length > 0 && !isOpenIdOnlyOrEmptyScopes(explicit)) {
+    return explicit;
+  }
+  const fromProvider = normalizeScopeList(params.entraProvider?.allowedScopes);
+  if (fromProvider.length > 0 && !isOpenIdOnlyOrEmptyScopes(fromProvider)) {
+    return fromProvider;
+  }
+  const auth = params.packageContext?.authentication || null;
+  const fromAuth = normalizeScopeList(auth?.scopes || auth?.allowedScopes);
+  if (fromAuth.length > 0 && !isOpenIdOnlyOrEmptyScopes(fromAuth)) {
+    return fromAuth;
+  }
+  const resource = typeof auth?.resource === 'string' ? auth.resource.trim() : '';
+  if (resource.startsWith('api://')) {
+    return [resource];
+  }
+  return [];
+}
+
+/**
+ * @param {Object} params
+ * @returns {string|null}
+ */
+function firstCopilotEntraBlocker(params) {
+  const {
+    discoveryReady,
+    discoveryBlocker,
+    recommended,
+    referenceId,
+    issuer,
+    audience,
+    scopes
+  } = params;
+  if (!discoveryReady) {
+    return discoveryBlocker || 'remoteMcpUnavailable';
+  }
+  if (recommended !== TRUSTED_ISSUER) {
+    return recommended === CUSTOMER_OAUTH
+      ? 'customerOAuthNotAllowed'
+      : 'trustedIssuerRequired';
+  }
+  if (!referenceId) {
+    return 'oauthPluginVaultReferenceRequired';
+  }
+  if (!issuer) {
+    return 'entraIssuerRequired';
+  }
+  if (!isPresent(audience)) {
+    return 'runtimeMcpAudienceRequired';
+  }
+  if (isOpenIdOnlyOrEmptyScopes(scopes)) {
+    return 'runtimeMcpScopeRequired';
+  }
+  return null;
+}
+
+/**
+ * @param {Object|null} auth
+ * @param {Object|null} entraProvider
+ * @returns {{ audience: * , issuer: string|null }}
+ */
+function resolveAudienceAndIssuer(auth, entraProvider) {
+  const audience = isPresent(entraProvider?.audience)
+    ? entraProvider.audience
+    : isPresent(auth?.audience)
+      ? auth.audience
+      : null;
+  const issuer =
+    (entraProvider && entraProvider.issuer) || (auth && auth.issuer) || null;
+  return { audience, issuer };
+}
+
+/**
+ * @param {Object} params
+ * @returns {{ installReady: boolean, blocker: string|null, packageAuthentication: Object|null }}
+ */
+function evaluateCopilotEntraSsoReadiness(params) {
+  const packageContext = params.packageContext || null;
+  const auth = mapCopilotPackageAuthentication(packageContext?.authentication || null);
+  const recommended = resolveRecommendedCapability(auth);
+  const referenceId =
+    typeof params.oauthPluginVaultReferenceId === 'string'
+      ? params.oauthPluginVaultReferenceId.trim()
+      : '';
+  const scopes = normalizeScopeList(params.scopes);
+  const { audience, issuer } = resolveAudienceAndIssuer(auth, params.entraProvider || null);
+
+  if (auth) {
+    auth.issuer = issuer;
+    auth.audience = audience;
+    auth.scopes = scopes;
+  }
+
+  const blocker = firstCopilotEntraBlocker({
+    discoveryReady: packageContext?.installReady === true,
+    discoveryBlocker: packageContext?.blocker || null,
+    recommended,
+    referenceId,
+    issuer,
+    audience,
+    scopes
+  });
+  return {
+    installReady: blocker === null,
+    blocker,
+    packageAuthentication: auth
+  };
+}
+
+const {
+  formatOauthPluginVaultReferenceRequiredError
+} = require('./microsoft-copilot-entra-sso-form');
+
+/**
+ * @param {Object} [options]
+ * @throws {Error}
+ */
+function assertOauthPluginVaultReferenceId(options = {}) {
+  const ref = options.oauthPluginVaultReferenceId;
+  if (typeof ref === 'string' && ref.trim()) {
+    return;
+  }
+  throw new Error(formatOauthPluginVaultReferenceRequiredError(options.formContext || options));
+}
+
+/**
+ * @param {Object} [runtimeValues]
+ * @throws {Error}
+ */
+function assertCopilotPackageOauthPluginVaultReference(runtimeValues = {}) {
+  const ref = runtimeValues.oauthPluginVaultReferenceId;
+  if (typeof ref === 'string' && ref.trim()) {
+    return;
+  }
+  throw new Error(formatOauthPluginVaultReferenceRequiredError(runtimeValues));
+}
+
+module.exports = {
+  TRUSTED_ISSUER,
+  CUSTOMER_OAUTH,
+  skipsChannelOauthCredential,
+  normalizeScopeList,
+  isOpenIdOnlyOrEmptyScopes,
+  resolveRecommendedCapability,
+  mapCopilotPackageAuthentication,
+  resolveCopilotEntraScopes,
+  evaluateCopilotEntraSsoReadiness,
+  formatOauthPluginVaultReferenceRequiredError,
+  assertOauthPluginVaultReferenceId,
+  assertCopilotPackageOauthPluginVaultReference
+};

package/lib/channels/microsoft-copilot-icons.js

@@ -0,0 +1,74 @@
+/**
+ * Valid Microsoft Teams / Copilot package icons (192×192 color, 32×32 outline).
+ *
+ * Defaults from templates/channels/brand (plan 167.0):
+ * - color-192.png ← light/192 (color app icon)
+ * - outline-32.png ← mono-white/32 (Teams outline)
+ * Variant packs: light/, dark/, mono-white/ at 32–512.
+ *
+ * @fileoverview Loads AI Fabrix brand PNGs from templates/channels/brand
+ * @author AI Fabrix Team
+ * @version 2.1.0
+ */
+
+'use strict';
+
+const path = require('path');
+const fs = require('../internal/fs-real-sync');
+const { BUILDER_ROOT } = require('./channel-integration-template');
+
+const BRAND_DIR = path.join(BUILDER_ROOT, 'templates', 'channels', 'brand');
+const DEFAULT_COLOR_PATH = path.join(BRAND_DIR, 'color-192.png');
+const DEFAULT_OUTLINE_PATH = path.join(BRAND_DIR, 'outline-32.png');
+
+/**
+ * @param {string} filePath
+ * @returns {Buffer}
+ */
+function readPngFile(filePath) {
+  if (!fs.existsSync(filePath)) {
+    throw new Error(`Brand icon not found: ${filePath}`);
+  }
+  return fs.readFileSync(filePath);
+}
+
+/**
+ * @param {{ colorPath?: string, outlinePath?: string }} [options]
+ * @returns {{ color: Buffer, outline: Buffer }}
+ */
+function getMicrosoftCopilotIcons(options = {}) {
+  const colorPath =
+    typeof options.colorPath === 'string' && options.colorPath.trim()
+      ? options.colorPath.trim()
+      : DEFAULT_COLOR_PATH;
+  const outlinePath =
+    typeof options.outlinePath === 'string' && options.outlinePath.trim()
+      ? options.outlinePath.trim()
+      : DEFAULT_OUTLINE_PATH;
+  return {
+    color: readPngFile(colorPath),
+    outline: readPngFile(outlinePath)
+  };
+}
+
+/**
+ * Read PNG IHDR width/height without external deps.
+ * @param {Buffer} buf
+ * @returns {{ width: number, height: number } | null}
+ */
+function readPngDimensions(buf) {
+  if (!Buffer.isBuffer(buf) || buf.length < 24) return null;
+  if (buf.toString('hex', 0, 8) !== '89504e470d0a1a0a') return null;
+  return {
+    width: buf.readUInt32BE(16),
+    height: buf.readUInt32BE(20)
+  };
+}
+
+module.exports = {
+  getMicrosoftCopilotIcons,
+  readPngDimensions,
+  BRAND_DIR,
+  DEFAULT_COLOR_PATH,
+  DEFAULT_OUTLINE_PATH
+};

package/lib/channels/microsoft-copilot-limits.js

@@ -0,0 +1,84 @@
+/**
+ * Microsoft Copilot / Teams package string limits.
+ *
+ * @fileoverview Truncate and normalize Copilot package display fields to schema limits
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const TEAMS_NAME_SHORT_MAX = 30;
+const TEAMS_NAME_FULL_MAX = 100;
+const TEAMS_DESCRIPTION_SHORT_MAX = 80;
+const TEAMS_DESCRIPTION_FULL_MAX = 4000;
+const PLUGIN_NAME_FOR_HUMAN_MAX = 20;
+const PLUGIN_DESCRIPTION_FOR_HUMAN_MAX = 100;
+
+/**
+ * @param {string} text
+ * @param {number} max
+ * @returns {string}
+ */
+function truncateForSchema(text, max) {
+  const value = String(text ?? '').trim();
+  if (!value) return '';
+  if (value.length <= max) return value;
+  if (max <= 1) return value.slice(0, max);
+  return `${value.slice(0, max - 1)}…`;
+}
+
+/**
+ * Plugin namespace: lowercase alphanumeric/hyphen only (plugin schema ^[A-Za-z0-9-]+$).
+ * @param {string} baseName
+ * @returns {string}
+ */
+function buildPluginNamespace(baseName) {
+  const raw = String(baseName ?? 'aifabrix')
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9-]+/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '');
+  const ns = raw || 'aifabrix';
+  return truncateForSchema(ns, 32).replace(/[^a-z0-9-]/g, '') || 'aifabrix';
+}
+
+/**
+ * @param {Object} runtimeValues
+ * @returns {Object}
+ */
+function applyMicrosoftCopilotDisplayLimits(runtimeValues) {
+  const appDescription = String(runtimeValues.appDescription || '').trim();
+  const baseName = String(runtimeValues.baseName || runtimeValues.appName || 'Assistant').trim();
+  const appName = String(runtimeValues.appName || baseName).trim();
+  runtimeValues.shortName = truncateForSchema(baseName, TEAMS_NAME_SHORT_MAX);
+  runtimeValues.fullName = truncateForSchema(appName, TEAMS_NAME_FULL_MAX);
+  runtimeValues.shortDescription = truncateForSchema(
+    appDescription || 'Enterprise AI assistant via AI Fabrix Runtime.',
+    TEAMS_DESCRIPTION_SHORT_MAX
+  );
+  runtimeValues.fullDescription = truncateForSchema(
+    appDescription || runtimeValues.shortDescription,
+    TEAMS_DESCRIPTION_FULL_MAX
+  );
+  runtimeValues.pluginNameForHuman = truncateForSchema(baseName, PLUGIN_NAME_FOR_HUMAN_MAX);
+  runtimeValues.pluginDescriptionForHuman = truncateForSchema(
+    appDescription || runtimeValues.shortDescription,
+    PLUGIN_DESCRIPTION_FOR_HUMAN_MAX
+  );
+  runtimeValues.pluginNamespace = buildPluginNamespace(baseName);
+  return runtimeValues;
+}
+
+module.exports = {
+  TEAMS_NAME_SHORT_MAX,
+  TEAMS_NAME_FULL_MAX,
+  TEAMS_DESCRIPTION_SHORT_MAX,
+  TEAMS_DESCRIPTION_FULL_MAX,
+  PLUGIN_NAME_FOR_HUMAN_MAX,
+  PLUGIN_DESCRIPTION_FOR_HUMAN_MAX,
+  truncateForSchema,
+  buildPluginNamespace,
+  applyMicrosoftCopilotDisplayLimits
+};

package/lib/channels/microsoft-copilot-package.js

@@ -9,12 +9,16 @@
 'use strict';
 
 const crypto = require('crypto');
-const fs = require('fs');
+const fs = require('../internal/fs-real-sync');
 const path = require('path');
 const AdmZip = require('adm-zip');
-
-const PLACEHOLDER_ICON_BASE64 =
-  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO2s9WQAAAAASUVORK5CYII=';
+const { getMicrosoftCopilotIcons } = require('./microsoft-copilot-icons');
+const { assertValidMicrosoftCopilotPackage } = require('./microsoft-copilot-validate');
+const { applyMicrosoftCopilotDisplayLimits } = require('./microsoft-copilot-limits');
+const {
+  assertCopilotPackageOauthPluginVaultReference
+} = require('./microsoft-copilot-entra-sso');
+const { renderCopilotChannelTemplate } = require('./microsoft-copilot-entra-sso-form');
 
 /**
  * @param {string} outputPath
@@ -37,16 +41,20 @@ function buildCopilotOutputPaths(outputPath, runtimeValues) {
     zipFileName,
     zipPath: path.join(buildDir, zipFileName),
     validationPath: path.join(installDir, 'validation.json'),
-    installPath: path.join(installDir, 'README.md')
+    installPath: path.join(rootDir, 'INSTALL.md'),
+    installReadmePath: path.join(installDir, 'README.md')
   };
 }
 
 /**
+ * @param {Object} [runtimeValues]
  * @returns {{ color: Buffer, outline: Buffer }}
  */
-function getPlaceholderIcons() {
-  const icon = Buffer.from(PLACEHOLDER_ICON_BASE64, 'base64');
-  return { color: icon, outline: icon };
+function resolvePackageIcons(runtimeValues) {
+  return getMicrosoftCopilotIcons({
+    colorPath: runtimeValues?.iconColorPath,
+    outlinePath: runtimeValues?.iconOutlinePath
+  });
 }
 
 /**
@@ -67,7 +75,8 @@ function renderCopilotTemplates(runtimeValues, renderTemplateFile, templatesDir)
       runtimeValues
     )
   };
-  const installText = renderTemplateFile(path.join(templatesDir, 'install.template.md.hbs'), runtimeValues);
+  // INSTALL prose + Entra SSO form table live in templates (partial entraSsoRegistration).
+  const installText = renderCopilotChannelTemplate('install.template.md.hbs', runtimeValues);
   return { sourceFiles, installText };
 }
 
@@ -112,6 +121,9 @@ function buildCopilotValidation(runtimeValues, paths, sourceFileNames) {
     runtimeMcpUrl: runtimeValues.mcpUrl,
     runtimeTransport: runtimeValues.runtimeTransport,
     expectedLayerBToolNames: runtimeValues.layerBToolNames || [],
+    governedToolNames: runtimeValues.layerBToolNames || [],
+    installReady: runtimeValues.installReady === true,
+    blocker: runtimeValues.discoveryBlocker || null,
     boundaries: {
       onePackagePerEnvironment: true,
       topLevelVendorToolsExposed: false,
@@ -142,6 +154,65 @@ function computeCopilotArtifactHash(parts) {
   return hash.digest('hex');
 }
 
+/**
+ * @param {Object} runtimeValues
+ * @returns {Object}
+ */
+function buildCopilotSummaryRuntime(runtimeValues) {
+  return {
+    runtimeSystemKey: runtimeValues.runtimeSystemKey,
+    remoteMcpUrl: runtimeValues.mcpUrl,
+    transport: runtimeValues.runtimeTransport,
+    assistantCatalogUrl: runtimeValues.assistantCatalogUrl,
+    roleAssistantResolution: 'dynamic-runtime',
+    layerBToolNames: runtimeValues.layerBToolNames || [],
+    governedToolNames: runtimeValues.layerBToolNames || []
+  };
+}
+
+/**
+ * @param {Object} runtimeValues
+ * @returns {Object}
+ */
+function buildCopilotSummaryAuthentication(runtimeValues) {
+  const discovery = runtimeValues.discoveryAuthentication || null;
+  const serialized = discovery ? JSON.stringify(discovery) : '';
+  if (/authorizationServerMetadataUrl":"[^"]+"/i.test(serialized)) {
+    throw new Error('Keycloak authorizationServerMetadata must not appear in Copilot package summary');
+  }
+  return {
+    mode: runtimeValues.runtimeAuthMode,
+    pluginAuthType: 'OAuthPluginVault',
+    oauthPluginVaultReferenceId: runtimeValues.oauthPluginVaultReferenceId || null,
+    recommendedCapability: discovery?.recommendedCapability || null,
+    entraIssuer: runtimeValues.entraIssuer || discovery?.issuer || null,
+    entraEnterpriseAppId: runtimeValues.entraEnterpriseAppId || null,
+    entraTenantId: runtimeValues.entraTenantId || null,
+    entraSsoClientId: runtimeValues.entraSsoClientId || null,
+    scopes: runtimeValues.scopes || [],
+    discovery,
+    note:
+      'Microsoft Entra SSO via OAuthPluginVault (Teams auth-config reference_id); ' +
+      'miso-controller performs exchange — package carries public specs only; no Fabrix OAuth secrets'
+  };
+}
+
+/**
+ * @param {Object} runtimeValues
+ * @param {Object} paths
+ * @returns {Object}
+ */
+function buildCopilotSummaryPackage(runtimeValues, paths) {
+  return {
+    appId: runtimeValues.packageAppId,
+    version: runtimeValues.packageVersion,
+    sourceFiles: ['manifest.json', 'declarativeAgent.json', 'ai-plugin.json', 'color.png', 'outline.png'],
+    zipFileName: paths.zipFileName,
+    installGuide: 'INSTALL.md',
+    validationFile: path.relative(paths.rootDir, paths.validationPath)
+  };
+}
+
 /**
  * @param {Object} runtimeValues
  * @param {Object} paths
@@ -156,27 +227,16 @@ function buildCopilotSummary(runtimeValues, paths, validation, artifactHash) {
     baseName: runtimeValues.baseName,
     description: runtimeValues.appDescription,
     environment: runtimeValues.environment,
-    runtime: {
-      runtimeSystemKey: runtimeValues.runtimeSystemKey,
-      remoteMcpUrl: runtimeValues.mcpUrl,
-      transport: runtimeValues.runtimeTransport,
-      assistantCatalogUrl: runtimeValues.assistantCatalogUrl,
-      roleAssistantResolution: 'dynamic-runtime',
-      layerBToolNames: runtimeValues.layerBToolNames || []
-    },
-    authentication: {
-      mode: runtimeValues.runtimeAuthMode,
-      credentialKey: runtimeValues.credentialKey,
-      credentialPortalUrl: runtimeValues.credentialPortalUrl,
-      scopes: runtimeValues.scopes || []
-    },
-    package: {
-      appId: runtimeValues.packageAppId,
-      version: runtimeValues.packageVersion,
-      sourceFiles: ['manifest.json', 'declarativeAgent.json', 'ai-plugin.json', 'color.png', 'outline.png'],
-      zipFileName: paths.zipFileName,
-      installGuide: path.relative(paths.rootDir, paths.installPath),
-      validationFile: path.relative(paths.rootDir, paths.validationPath)
+    runtime: buildCopilotSummaryRuntime(runtimeValues),
+    authentication: buildCopilotSummaryAuthentication(runtimeValues),
+    package: buildCopilotSummaryPackage(runtimeValues, paths),
+    installReady: runtimeValues.installReady === true,
+    blocker: runtimeValues.discoveryBlocker || null,
+    links: {
+      readme: paths.installPath,
+      zip: paths.zipPath,
+      filesRoot: paths.sourceDir,
+      validation: paths.validationPath
     },
     probeTiers: {
       builderValidated: true,
@@ -211,24 +271,21 @@ function writeCopilotArtifacts(params) {
   fs.writeFileSync(path.join(paths.sourceDir, 'outline.png'), icons.outline);
   fs.writeFileSync(paths.zipPath, zipBuffer);
   fs.writeFileSync(paths.installPath, installText, 'utf8');
+  if (paths.installReadmePath) {
+    fs.writeFileSync(paths.installReadmePath, installText, 'utf8');
+  }
   fs.writeFileSync(paths.validationPath, validationText, 'utf8');
   fs.writeFileSync(paths.summaryPath, summaryText, 'utf8');
 }
 
 /**
  * @param {Object} params
- * @param {Object} params.runtimeValues
- * @param {string} params.templatesDir
- * @param {string} params.outputPath
- * @param {boolean} [params.dryRun]
- * @param {(content: string) => void} params.assertNoSecretsInArtifact
- * @param {(templatePath: string, context: Object) => string} params.renderTemplateFile
- * @returns {{ outputPath: string, artifactHash: string, content: string, installPath: string }}
+ * @param {Object} runtimeValues
+ * @param {Object} paths
+ * @param {{ color: Buffer, outline: Buffer }} icons
+ * @returns {{ summary: Object, summaryText: string, zipBuffer: Buffer, sourceFiles: Object, installText: string, validationText: string }}
  */
-function generateMicrosoftCopilotPackage(params) {
-  const runtimeValues = params.runtimeValues || {};
-  const paths = buildCopilotOutputPaths(params.outputPath, runtimeValues);
-  const icons = getPlaceholderIcons();
+function buildCopilotPackagePayload(params, runtimeValues, paths, icons) {
   const { sourceFiles, installText } = renderCopilotTemplates(
     runtimeValues,
     params.renderTemplateFile,
@@ -236,6 +293,7 @@ function generateMicrosoftCopilotPackage(params) {
   );
   assertNoSecretsInSourceFiles(sourceFiles, params.assertNoSecretsInArtifact);
   params.assertNoSecretsInArtifact(installText);
+  assertValidMicrosoftCopilotPackage(sourceFiles, icons);
   const zipBuffer = buildCopilotZipBuffer(sourceFiles, icons);
   const validation = buildCopilotValidation(runtimeValues, paths, Object.keys(sourceFiles));
   const validationText = JSON.stringify(validation, null, 2);
@@ -250,22 +308,45 @@ function generateMicrosoftCopilotPackage(params) {
   const summary = buildCopilotSummary(runtimeValues, paths, validation, artifactHash);
   const summaryText = JSON.stringify(summary, null, 2);
   params.assertNoSecretsInArtifact(summaryText);
+  return { summary, summaryText, zipBuffer, sourceFiles, installText, validationText };
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} params.runtimeValues
+ * @param {string} params.templatesDir
+ * @param {string} params.outputPath
+ * @param {boolean} [params.dryRun]
+ * @param {(content: string) => void} params.assertNoSecretsInArtifact
+ * @param {(templatePath: string, context: Object) => string} params.renderTemplateFile
+ * @returns {{ outputPath: string, artifactHash: string, content: string, installPath: string }}
+ */
+function generateMicrosoftCopilotPackage(params) {
+  const runtimeValues = applyMicrosoftCopilotDisplayLimits({ ...(params.runtimeValues || {}) });
+  assertCopilotPackageOauthPluginVaultReference(runtimeValues);
+  const paths = buildCopilotOutputPaths(params.outputPath, runtimeValues);
+  const icons = resolvePackageIcons(runtimeValues);
+  const payload = buildCopilotPackagePayload(params, runtimeValues, paths, icons);
   if (!params.dryRun) {
     writeCopilotArtifacts({
       paths,
-      sourceFiles,
+      sourceFiles: payload.sourceFiles,
       icons,
-      zipBuffer,
-      installText,
-      validationText,
-      summaryText
+      zipBuffer: payload.zipBuffer,
+      installText: payload.installText,
+      validationText: payload.validationText,
+      summaryText: payload.summaryText
     });
   }
   return {
     outputPath: paths.summaryPath,
-    artifactHash,
-    content: summaryText,
-    installPath: paths.installPath
+    artifactHash: payload.summary.artifact.hash,
+    content: payload.summaryText,
+    installPath: paths.installPath,
+    zipPath: paths.zipPath,
+    links: payload.summary.links,
+    installReady: payload.summary.installReady === true,
+    blocker: payload.summary.blocker || null
   };
 }