@aifabrix/builder 2.52.0 → 2.53.0

package/templates/applications/miso-controller/env.template

@@ -74,8 +74,8 @@ ENABLE_API_DOCS=true
 # Rate Limiting Configuration (for local development)
 # Set DISABLE_RATE_LIMIT=true to disable rate limiting entirely (local development only)
 DISABLE_RATE_LIMIT=true
-# RATE_LIMIT_WINDOW_MS=600000  # 10 minutes in milliseconds (default: 600000)
-# RATE_LIMIT_MAX=100           # Max requests per window (default: 100)
+RATE_LIMIT_WINDOW_MS=600000
+RATE_LIMIT_MAX=100
 
 # Package Version (auto-set by npm/pnpm, optional override)
 # npm_package_version=1.0.0
@@ -142,6 +142,11 @@ KEYCLOAK_VERIFY_AUDIENCE=false
 KEYCLOAK_TOKEN_TIMEOUT=5000
 KEYCLOAK_DEFAULT_PASSWORD=kv://keycloak-default-passwordKeyVault
 
+# Password setup for new local users (plan 209.0)
+# email = send invitation email so the user sets their own password (default)
+# admin-reveal = show a one-time temporary password to the admin (labs / no mail)
+IDENTITY_LOCAL_PASSWORD_MODE=admin-reveal
+
 # Keycloak Events Configuration
 KEYCLOAK_EVENTS_ENABLED=true
 KEYCLOAK_EVENTS_VERIFY_SIGNATURE=true
@@ -317,6 +322,7 @@ MORI_PASSWORD=kv://mori-controller-basic-passwordKeyVault
 # LOG_FILE_PATH=/mnt/data/logs via deploy JSON and ensure the directory exists.
 
 LOG_TO_FILE=true
+LOG_LEVEL=info
 LOG_FILE_PATH=./logs
 
 # =============================================================================

package/templates/applications/miso-controller/rbac.yaml

@@ -156,6 +156,7 @@ permissions:
     roles:
       [
         'aifabrix-platform-admin',
+        'aifabrix-infrastructure-admin',
         'aifabrix-deployment-admin',
         'aifabrix-developer',
         'aifabrix-observer'

package/templates/channels/README.md

@@ -1,6 +1,6 @@
 # Channel integration templates
 
-Published copies of communication external-system manifests for `aifabrix channel scaffold <target>`.
+Published copies of communication external-system manifests for `aifabrix channel scaffold <target>` (also used automatically by `aifabrix channel add`).
 
 ## SSOT
 
@@ -13,6 +13,16 @@ Published copies of communication external-system manifests for `aifabrix channe
 
 Do **not** hardcode manifests in `lib/channels/*.js`.
 
+## Brand icons (`brand/`)
+
+Default AI Fabrix app icons for channel packages (from product icon pack).
+
+| File / folder | Use |
+| --- | --- |
+| `color-192.png` | Microsoft Copilot / Teams `color.png` (192×192) |
+| `outline-32.png` | Microsoft Copilot / Teams `outline.png` (32×32 mono) |
+| `light/`, `dark/`, `mono-white/` | Size variants 32–512 for overrides / other surfaces |
+
 ## Slack App manifest (install)
 
 `manifest.template.json.hbs` and `install.template.md.hbs` are for `aifabrix channel add slack` (Slack developer portal), separate from the external-system integration tree above.

package/templates/channels/chatgpt/install.template.md.hbs

@@ -54,7 +54,7 @@ Before ChatGPT can connect successfully, the MCP deployment must meet all of the
 
 If this development endpoint is deliberately anonymous, select **No authentication** instead and declare `noauth` on the applicable tools. Do not describe the app as “OAuth or API key”; the selected mechanism must match the behavior advertised by the MCP server.
 
-## Expected Runtime Layer B tools
+## Expected governed tools
 
 ChatGPT should discover the following tools from the live MCP server during **Scan tools**:
 
@@ -62,12 +62,14 @@ ChatGPT should discover the following tools from the live MCP server during **Sc
 - `{{this}}`
 {{/each}}
 
-The live server response is authoritative. This list is an expected deployment contract, not a substitute for MCP tool discovery.
+{{#if installReady}}Install ready: yes{{else}}Install ready: no{{#if discoveryBlocker}} ({{discoveryBlocker}}){{/if}}{{/if}}
+
+The live server response is authoritative. This list is an expected deployment contract from External AI Discovery, not a substitute for MCP tool discovery.
 
 ## Runtime and Role Assistant boundaries
 
 - Runtime resolves assistants dynamically for the current user from `{{{assistantCatalogUrl}}}`.
-- ChatGPT's top-level tool surface remains limited to the Runtime Layer B tools listed above.
+- ChatGPT's top-level tool surface remains limited to the governed tools listed above.
 - Evidence authoring remains an internal Business Transformation Assistant capability. It is reached through `ChatGPT → runtime-orchestration → Business Transformation Assistant → internal evidence capabilities` and is not exposed as a top-level ChatGPT tool.
 - One authenticated Runtime connection can support multiple Role Assistants, subject to the current user's authorization.
 
@@ -90,7 +92,7 @@ Then run the AI Fabrix probe:
 aifabrix channel add {{channelTarget}} --name "{{baseName}}" --probe
 ```
 
-The probe should validate Runtime through the first-party MCP gateway, including Layer B discovery and BTA Evidence-authoring reachability. A successful AI Fabrix probe does not replace ChatGPT's own **Scan tools**, OAuth, and workspace publication checks.
+The probe should validate Runtime through the first-party MCP gateway, including governed tool discovery and BTA Evidence-authoring reachability. A successful AI Fabrix probe does not replace ChatGPT's own **Scan tools**, OAuth, and workspace publication checks.
 
 Use `--force` only to regenerate artifacts and patch channel metadata. It does not rotate credentials.
 

package/templates/channels/chatgpt/integration/README.md

@@ -5,11 +5,10 @@ Generated by `aifabrix channel scaffold chatgpt`.
 Recommended flow:
 
 ```bash
-aifabrix upload chatgpt --force
 aifabrix channel add chatgpt --name "Your Assistant" --probe
 ```
 
-The `channel add` step generates `dist/channels/chatgpt/channel-chatgpt.json` and
-`INSTALL.md`. Those files are deployment references for workspace admins: ChatGPT
-connects to the remote Runtime MCP URL (OAuth) and discovers tools; it does not
-install the JSON as a plugin archive.
+`channel add` scaffolds (if needed), uploads when missing (always with `--force`), then
+generates `dist/channels/chatgpt/channel-chatgpt.json` and `INSTALL.md`. Those files are
+deployment references for workspace admins: ChatGPT connects to the remote Runtime MCP URL
+(OAuth) and discovers tools; it does not install the JSON as a plugin archive.

package/templates/channels/chatgpt/integration/chatgpt-system.json

@@ -6,22 +6,7 @@
   "systemKind": "communication",
   "enabled": true,
   "authentication": {
-    "authType": "credential",
-    "credential": {
-      "credentialKey": "chatgpt-channel",
-      "displayName": "ChatGPT custom MCP app channel",
-      "method": "apikey",
-      "writeOnce": true,
-      "variables": {
-        "baseUrl": "https://api.openai.com/v1"
-      },
-      "security": {
-        "apiKey": "kv://chatgpt/apiKey"
-      },
-      "formFields": [
-        { "name": "apiKey", "required": true }
-      ]
-    }
+    "authType": "system"
   },
   "configuration": [],
   "dataSources": [],

package/templates/channels/microsoft-copilot/ai-plugin.template.json.hbs

@@ -1,28 +1,26 @@
 {
   "$schema": "https://developer.microsoft.com/json-schemas/copilot/plugin/v2.4/schema.json",
   "schema_version": "v2.4",
-  "name_for_human": "{{appName}}",
-  "name_for_model": "aifabrix_runtime_orchestration",
-  "description_for_human": "{{appDescription}}",
-  "description_for_model": "Runtime orchestration tools for governed enterprise work.",
+  "name_for_human": "{{pluginNameForHuman}}",
+  "description_for_human": "{{pluginDescriptionForHuman}}",
+  "description_for_model": "Governed enterprise work tools for Role Assistants. Prefer discovery tool names only; resolve Role Assistants dynamically for the signed-in user. For listing available Role Assistants use work.roles; use assistant.describe only when an assistantKey is already known.",
+  "namespace": "{{pluginNamespace}}",
+  "privacy_policy_url": "{{{dataplaneBaseUrl}}}/privacy",
+  "legal_info_url": "{{{dataplaneBaseUrl}}}/terms",
+  "functions": [],
   "runtimes": [
     {
       "type": "RemoteMCPServer",
       "spec": {
-        "url": "{{mcpUrl}}"
+        "url": "{{{mcpUrl}}}"
       },
+      "run_for_functions": [
+        "*"
+      ],
       "auth": {
-        "type": "oauth",
-        "scopes": {{{scopesJson}}}
+        "type": "OAuthPluginVault",
+        "reference_id": "{{{oauthPluginVaultReferenceId}}}"
       }
     }
-  ],
-  "mcp_tool_description": {
-    "mode": "dynamic",
-    "layerBToolNames": [
-{{#each layerBToolNames}}
-      "{{this}}"{{#unless @last}},{{/unless}}
-{{/each}}
-    ]
-  }
+  ]
 }

package/templates/channels/microsoft-copilot/declarative-agent.template.json.hbs

@@ -1,8 +1,10 @@
 {
+  "$schema": "https://developer.microsoft.com/json-schemas/copilot/declarative-agent/v1.4/schema.json",
+  "version": "v1.4",
   "id": "{{packageAppId}}-agent",
-  "name": "{{appName}}",
-  "description": "{{appDescription}}",
-  "instructions": "Use Runtime Layer B tools only. Resolve Role Assistants dynamically and keep business reasoning inside authorized Role Assistant boundaries.",
+  "name": "{{fullName}}",
+  "description": "{{fullDescription}}",
+  "instructions": "Use governed enterprise work tools only. Resolve Role Assistants dynamically and keep business reasoning inside authorized Role Assistant boundaries.",
   "conversation_starters": [
     {
       "title": "Show my role assistants",

package/templates/channels/microsoft-copilot/entra-sso-registration.template.md.hbs

@@ -0,0 +1,30 @@
+## Microsoft Entra SSO registration (Teams Developer Portal)
+
+Direct URL:
+
+{{{entraSsoRegistrationUrl}}}
+
+Open **Tools → Microsoft Entra SSO client ID registration → Register client ID** (or New).
+
+Do this **before** organisation publish. The registration / auth-config ID becomes `--oauth-plugin-vault-reference-id`. It is **not** the Entra Client (application) ID.
+
+### Values to paste into the form
+
+| Field | Value |
+| --- | --- |
+| Registration name | `{{appName}}` |
+| Base URL | {{#if entraSsoBaseUrl}}`{{{entraSsoBaseUrl}}}`{{else}}*(missing — Remote MCP URL not resolved)*{{/if}} |
+| Restrict usage by organization | My organization only |
+| Restrict usage by Teams app | Stable Teams app / manifest ID `{{packageAppId}}` (known before Import — bind to this ID at registration; do not use “Any Teams app”) |
+| Client (application) ID | {{#if entraSsoClientId}}`{{entraSsoClientId}}`{{else}}*(missing — Entra SSO enterprise app (client) id from controller Keycloak status `entraIdentityProvider.enterpriseAppId`; complete Entra onboarding if empty)*{{/if}} |
+| Scope | {{#if entraSsoScope}}`{{entraSsoScope}}`{{else}}*(missing — set Runtime MCP delegated scopes on Trust source `microsoft-entra-id` `allowedScopes`; not openid/profile alone)*{{/if}} |
+
+### Related (for your records)
+
+{{#if mcpUrl}}- **Remote MCP URL (package):** `{{{mcpUrl}}}`{{/if}}
+{{#if packageAppId}}- **Teams app / manifest ID:** `{{packageAppId}}` (preserve on Import app — do not create a new unrelated app){{/if}}
+{{#if entraIssuer}}- **Entra issuer (Trust source):** `{{{entraIssuer}}}`{{/if}}
+{{#if entraTenantId}}- **Tenant id:** `{{entraTenantId}}`{{/if}}
+{{#if entraEnterpriseAppId}}- **Entra Client (application) ID (Keycloak enterprise app):** `{{entraEnterpriseAppId}}`{{/if}}
+
+After Save, copy the **Microsoft Entra SSO registration ID** (auth-config id). Pass that value as `--oauth-plugin-vault-reference-id` and re-run `channel add` so `ai-plugin.json` embeds `OAuthPluginVault.reference_id`.

package/templates/channels/microsoft-copilot/fi-fi.template.json.hbs

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://developer.microsoft.com/en-us/json-schemas/teams/v1.21/MicrosoftTeams.Localization.schema.json",
+  "name.short": "{{shortName}}",
+  "name.full": "{{fullName}}",
+  "description.short": "{{fiShortDescription}}",
+  "description.full": "{{fiFullDescription}}"
+}

package/templates/channels/microsoft-copilot/install.template.md.hbs

@@ -2,53 +2,124 @@
 
 {{appDescription}}
 
-Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
+Environment: **{{environment}}**
 
-This channel output is a Microsoft 365 Copilot app package:
+This channel uses **Microsoft Entra SSO** (trustedIssuer). Users already signed into
+Microsoft 365 do **not** complete a separate AI Fabrix sign-in. Admin consent may still
+apply for the Runtime MCP delegated scope.
 
 ```text
 dist/channels/microsoft-copilot/source/manifest.json
 dist/channels/microsoft-copilot/source/declarativeAgent.json
 dist/channels/microsoft-copilot/source/ai-plugin.json
+dist/channels/microsoft-copilot/source/fi-fi.json
 dist/channels/microsoft-copilot/build/appPackage.{{environment}}.zip
 ```
 
-## Microsoft admin workflow (manual)
+## Three Microsoft records (do not confuse)
 
-1. Sign in to [Microsoft 365 admin](https://admin.cloud.microsoft.com/) or Copilot Studio as a tenant admin.
-2. Upload or sideload `appPackage.{{environment}}.zip` to your organization app catalog.
-3. Review the declarative agent + Remote MCP plugin metadata and approve tenant distribution.
-4. Configure workspace authentication and consent according to your Entra/OAuth policy.
-5. Store credential references in AI Fabrix authentication settings: [Authentication settings]({{credentialPortalUrl}})
-6. Assign the app to users/groups and complete first-user sign-in.
+| Record | What it is | Typical ID |
+| --- | --- | --- |
+| **Entra app registration** | Protects the Runtime MCP API. **Client (application) ID** from Entra / Keycloak Trust. | Entra Client (application) ID |
+| **Teams Developer Portal app** | Package definition (`manifest.json.id`) and organisation publish request. | Teams app / manifest ID |
+| **Teams admin centre catalogue** | Approval, availability, policy, published state. | Catalogue entry after org publish |
+
+`--oauth-plugin-vault-reference-id` is the **Teams Entra SSO registration / auth-config ID** from Developer Portal Tools → Microsoft Entra SSO. It is **not** the Entra Client (application) ID and **not** a client secret.
+
+Do **not** configure AI Fabrix OAuth client secrets under Connected Systems → Authentication for this Entra SSO flow.
+
+## Package prerequisites (before Import)
+
+1. Generate the channel package with `aifabrix channel add microsoft-copilot`.
+2. Configure Microsoft Entra SSO: **Tools → Microsoft Entra SSO client ID registration** (see table below). Copy the generated registration / auth-config ID.
+3. Re-run packaging so `ai-plugin.json` gets `auth.type = OAuthPluginVault` and `auth.reference_id = <auth-config-id>`:
+
+```bash
+aifabrix channel add microsoft-copilot --name "{{baseName}}" --oauth-plugin-vault-reference-id "<auth-config-id>"
+```
+
+Keep any `webApplicationInfo` the portal binds for Entra SSO — do not strip it on re-import.
+
+Upload **only** the ZIP package. Do not upload individual source files or `channel-microsoft-copilot.json`.
+
+## Install and publish
+
+1. Open [Teams Developer Portal](https://dev.teams.microsoft.com/).
+2. Click **Import an app** → import `appPackage.{{environment}}.zip`. Preserve the generated stable `manifest.json.id`. Do not create an unrelated new Teams app.
+3. Developer Portal → selected app → **Publish to your org** → Distribute / submit.
+4. Teams admin approves in [Teams admin centre → Manage apps](https://admin.teams.microsoft.com/policies/manage-apps) (Manage apps → search → allow). Expect **Published** / **Unblocked** per organisation policy. Allow several minutes for propagation.
+5. Open **Teams** → **Apps** (**Built for your org**), click **{{appName}}**, **Add** the application, then choose **Open with Copilot**.
+6. In Copilot, click **Show my role assistants** and run the command.
+7. Confirm Runtime MCP and governed tools using this guide, then re-run with `--probe` after organisation publish:
+
+```bash
+aifabrix channel add {{channelTarget}} --name "{{baseName}}" --oauth-plugin-vault-reference-id "{{{oauthPluginVaultReferenceId}}}" --probe
+```
+
+8. After the app is available under **Built for your org**, re-run:
+
+```bash
+aifabrix channel add {{channelTarget}} --name "{{appName}}"
+```
+
+This is a **tenant-private organisation publish**. Microsoft Store app validation is not the Runtime/MCP functional test for this integration.
+
+Do **not** use Developer Portal **Preview in Teams** as the normal organisation installation test (it sideloads and may be blocked by tenant policy).
+
+### Optional sideloading for development
+
+Use **Upload a custom app** or **Preview in Teams** only if tenant policy permits custom app uploads. Sideloading is **not** required for central organisation publishing. A policy failure such as “Uploading custom apps is not allowed” does **not** mean the organisation-published package is invalid.
+
+## Activate languages
+
+The package includes `localizationInfo` with **en-us** (default) and **fi-fi** (`fi-fi.json`). After import in Developer Portal, open the app → **Languages** (or localization) and **activate** additional languages you need for the organisation. Re-import an updated ZIP if you regenerate translations.
 
 ## Runtime connection contract
 
 - **Runtime system key:** `{{runtimeSystemKey}}`
-- **Remote MCP URL:** `{{mcpUrl}}`
+- **Remote MCP URL:** `{{{mcpUrl}}}`
 - **Transport:** `{{runtimeTransport}}`
-- **Auth mode:** `{{runtimeAuthMode}}`
-- **Layer B tools expected:**
+- **Auth mode:** `{{runtimeAuthMode}}` (Entra SSO / trustedIssuer; controller exchanges the Microsoft user token)
+- **Plugin auth:** `OAuthPluginVault` · Teams auth-config reference id `{{{oauthPluginVaultReferenceId}}}`
+{{#if entraIssuer}}- **Entra issuer (from Trust source):** `{{{entraIssuer}}}`{{/if}}
+- **Delegated scopes:** {{#if entraSsoScope}}`{{entraSsoScope}}`{{else}}{{#each scopes}}`{{this}}` {{else}}*(set Runtime MCP delegated scopes on Trust source `microsoft-entra-id` `allowedScopes` — not openid/profile alone)*{{/each}}{{/if}}
+- **Package / Runtime ready:** {{#if packageReady}}yes{{else}}no{{#if packageBlocker}} ({{packageBlocker}}){{/if}}{{/if}}
+- **Microsoft publication:** {{#if microsoftPublicationPending}}pending — Developer Portal import → Publish to your org → Teams admin approval{{else}}cleared{{/if}}
+- **Governed tools expected:**
 {{#each layerBToolNames}}
   - `{{this}}`
 {{/each}}
 
+{{> entraSsoRegistration}}
+
+## Package links
+
+- README / install guide: `INSTALL.md`
+- Package ZIP: `build/appPackage.{{environment}}.zip`
+
 ## Assistant catalog
 
-Runtime lists **assistants** available to each user from:
+Runtime lists the assistants available to the signed-in user from:
 
-{{assistantCatalogUrl}}
+{{{assistantCatalogUrl}}}
 
 ## Probe truthfulness
 
-- `builderValidated` means package files, ZIP, hashes, and secret checks passed.
-- `runtimeValidated` means Runtime MCP is reachable and tool boundary checks pass.
-- `requiresMicrosoftAdmin` remains true until tenant upload/approval/assignment is complete.
+- `builderValidated` — package files, ZIP structure, hashes, and secret checks passed.
+- `runtimeValidated` — Runtime MCP is reachable and tool-boundary checks passed.
+- `requiresMicrosoftAdmin` — organisation publish / Teams admin approval is still pending. This is **not** a sideload requirement and is separate from package/Runtime readiness.
 
-## Validate after admin setup
+`--force` regenerates the package artifacts. microsoft-copilot does not create Fabrix oauth2 channel credentials for Entra SSO.
 
-```bash
-aifabrix channel add {{channelTarget}} --name "{{baseName}}" --probe
-```
+## Delete / remove from the organisation
+
+Use this when replacing the app, cleaning a failed publish, or removing **{{appName}}** entirely. Delete in this order so catalogue and Developer Portal records stay consistent.
+
+1. Open [Teams admin centre → Manage apps](https://admin.teams.microsoft.com/policies/manage-apps).
+2. Search for **{{appName}}**, open the app, open the action menu, choose **Delete**, and confirm.
+3. Open [Teams Developer Portal → Apps](https://dev.teams.microsoft.com/apps).
+4. Find the app in the list, open **…** (Actions) → **Delete**, and confirm by typing the app name.
+5. Open [Microsoft Entra SSO client ID registration](https://dev.teams.microsoft.com/tools/entra-configuration).
+6. Find the registration for this channel (same registration / auth-config used as `--oauth-plugin-vault-reference-id`), open **…** (Actions) → **Delete**, and confirm.
 
-`--force` regenerates artifacts but does not rotate credentials.
+After Microsoft cleanup, delete local package output if needed (`dist/channels/microsoft-copilot/`) and re-run `aifabrix channel add` with a **new** Entra SSO registration / auth-config ID. Do not reuse a deleted registration id.

package/templates/channels/microsoft-copilot/integration/README.md

@@ -5,9 +5,8 @@ Generated by `aifabrix channel scaffold microsoft-copilot`.
 Recommended flow:
 
 ```bash
-aifabrix upload microsoft-copilot --force
 aifabrix channel add microsoft-copilot --name "Your Assistant" --probe
 ```
 
-`channel add` generates package artifacts under
-`dist/channels/microsoft-copilot/` for Microsoft 365 tenant admins.
+`channel add` scaffolds (if needed), uploads when missing (always with `--force`), then
+generates package artifacts under `dist/channels/microsoft-copilot/` for Microsoft 365 tenant admins.

package/templates/channels/microsoft-copilot/integration/microsoft-copilot-system.json

@@ -6,28 +6,7 @@
   "systemKind": "communication",
   "enabled": true,
   "authentication": {
-    "authType": "credential",
-    "credential": {
-      "credentialKey": "microsoft-copilot-channel",
-      "displayName": "Microsoft Copilot package channel",
-      "method": "oauth2",
-      "writeOnce": true,
-      "variables": {
-        "baseUrl": "https://login.microsoftonline.com",
-        "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
-        "tokenUrl": "https://login.microsoftonline.com/common/oauth2/v2.0/token",
-        "grantType": "authorization_code",
-        "scope": "openid profile offline_access"
-      },
-      "security": {
-        "clientId": "kv://microsoft-copilot/clientId",
-        "clientSecret": "kv://microsoft-copilot/clientSecret"
-      },
-      "formFields": [
-        { "name": "clientId", "required": true },
-        { "name": "clientSecret", "required": true }
-      ]
-    }
+    "authType": "system"
   },
   "configuration": [],
   "dataSources": [],

package/templates/channels/microsoft-copilot/manifest.template.json.hbs

@@ -1,36 +1,51 @@
 {
-  "$schema": "https://developer.microsoft.com/json-schemas/teams/v1.21/MicrosoftTeams.schema.json",
-  "manifestVersion": "1.21",
+  "$schema": "https://developer.microsoft.com/en-us/json-schemas/teams/v1.27/MicrosoftTeams.schema.json",
   "version": "{{packageVersion}}",
+  "manifestVersion": "1.27",
   "id": "{{packageAppId}}",
   "name": {
-    "short": "{{baseName}}",
-    "full": "{{appName}}"
-  },
-  "description": {
-    "short": "{{appDescription}}",
-    "full": "{{appDescription}}"
+    "short": "{{shortName}}",
+    "full": "{{fullName}}"
   },
   "developer": {
     "name": "AI Fabrix",
-    "websiteUrl": "{{dataplaneBaseUrl}}",
-    "privacyUrl": "{{dataplaneBaseUrl}}/privacy",
-    "termsOfUseUrl": "{{dataplaneBaseUrl}}/terms"
+    "websiteUrl": "{{{dataplaneBaseUrl}}}",
+    "privacyUrl": "{{{dataplaneBaseUrl}}}/privacy",
+    "termsOfUseUrl": "{{{dataplaneBaseUrl}}}/terms"
+  },
+  "description": {
+    "short": "{{shortDescription}}",
+    "full": "{{fullDescription}}"
   },
   "icons": {
-    "color": "color.png",
-    "outline": "outline.png"
+    "outline": "outline.png",
+    "color": "color.png"
   },
   "accentColor": "#0F172A",
+  "validDomains": [
+    "{{runtimeDomain}}"
+  ],
+{{#if webApplicationInfoId}}
+  "webApplicationInfo": {
+    "id": "{{webApplicationInfoId}}",
+    "resource": "{{{webApplicationInfoResource}}}"
+  },
+{{/if}}
+  "localizationInfo": {
+    "defaultLanguageTag": "en-us",
+    "additionalLanguages": [
+      {
+        "languageTag": "fi-fi",
+        "file": "fi-fi.json"
+      }
+    ]
+  },
   "copilotAgents": {
     "declarativeAgents": [
       {
-        "id": "{{packageAppId}}-agent",
-        "file": "declarativeAgent.json"
+        "file": "declarativeAgent.json",
+        "id": "{{packageAppId}}-agent"
       }
     ]
-  },
-  "validDomains": [
-    "{{runtimeDomain}}"
-  ]
+  }
 }

package/templates/channels/microsoft-copilot/oauth-plugin-vault-required.template.md.hbs

@@ -0,0 +1,15 @@
+microsoft-copilot packaging requires `--oauth-plugin-vault-reference-id` with the Teams Entra SSO **registration / auth-config ID**.
+
+That value is **not** the Entra Client (application) ID and **not** a client secret.
+
+Register Entra SSO in the Teams Developer Portal **before** packaging (no ZIP needed first): paste the values below, Save, copy the registration id, then re-run.
+
+{{> entraSsoRegistration}}
+
+Then:
+
+```bash
+aifabrix channel add microsoft-copilot --name "{{baseName}}" --oauth-plugin-vault-reference-id "<Teams-Entra-SSO-registration-id>"
+```
+
+Next: Developer Portal → Apps → Import app (`appPackage.<env>.zip`) → Publish to your org → Teams admin centre approval. Sideloading is optional and not the organisation path.

package/templates/channels/slack/integration/README.md

@@ -30,9 +30,7 @@ Registered at `/api/v1/external/systems/slack/`:
 ## Workflow
 
 ```bash
-aifabrix channel scaffold slack   # or use this folder as SSOT
-aifabrix upload slack --force
-aifabrix channel add slack --name "Your Assistant"
+aifabrix channel add slack --name "Your Assistant" --probe
 ```
 
-Publish template changes: `make sync-json` in dataplane → `aifabrix-builder/templates/channels/slack/integration/`.
+Optional low-level: `channel scaffold` / `upload`. Publish template changes: `make sync-json` in dataplane → `aifabrix-builder/templates/channels/slack/integration/`.

package/templates/channels/teams-bot/install.template.md.hbs

@@ -44,6 +44,10 @@ Users message the bot with:
 
 Review cards use **Approve**, **Reject**, and **Edit metadata** actions on the **Bot messages** endpoint. Proactive review notifications use the **Notifications** URL.
 
+## Authentication
+
+Teams bot authentication uses a **Microsoft token**. AI Fabrix controller performs token exchange — generated package and INSTALL files carry public connection specs only (no secrets).
+
 ## Assistant catalog
 
 Runtime lists **assistants** available to each user from:

package/templates/channels/teams-bot/integration/README.md

@@ -8,11 +8,9 @@ SSOT for Teams Bot Framework communication channel — **Role Assistants** and *
 - **Document approval:** `documents`, `document`, `approve`, `help` bot commands; review Adaptive Cards; proactive `/notifications`
 
 ```bash
-cd aifabrix-dataplane
-aifabrix validate teams-bot
-aifabrix upload teams-bot --probe
-aifabrix deploy teams-bot
-aifabrix channel add teams-bot --name "Your Assistant"
+aifabrix channel add teams-bot --name "Your Assistant" --probe
 ```
 
+Optional low-level (dataplane fixture tree): `validate` / `upload` / `deploy` before add.
+
 Authentication: oidc — prefilled discovery settings; operators add Microsoft App ID + client secret on Connected Systems → Authentication.