@aifabrix/builder 2.52.0 → 2.53.0

package/lib/channels/microsoft-copilot-entra-sso-form.js

@@ -0,0 +1,251 @@
+/**
+ * Microsoft Copilot Entra SSO form field resolution + template rendering.
+ *
+ * @fileoverview Template-backed Teams Entra SSO registration guidance
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('../internal/fs-real-sync');
+const path = require('path');
+const Handlebars = require('handlebars');
+const { BUILDER_ROOT } = require('./channel-integration-template');
+
+const ENTRA_SSO_REGISTRATION_URL =
+  'https://dev.teams.microsoft.com/tools/entra-configuration';
+const TEMPLATES_DIR = path.join(BUILDER_ROOT, 'templates', 'channels', 'microsoft-copilot');
+
+/**
+ * @param {string} issuer
+ * @returns {string|null}
+ */
+function extractTenantIdFromIssuer(issuer) {
+  if (typeof issuer !== 'string' || !issuer.trim()) {
+    return null;
+  }
+  const match = issuer.match(
+    /login\.microsoftonline\.com\/([0-9a-fA-F-]{36})(?:\/|$)/i
+  );
+  return match ? match[1] : null;
+}
+
+/**
+ * @param {string} [url]
+ * @returns {string|null}
+ */
+function originFromUrl(url) {
+  if (typeof url !== 'string' || !url.trim()) {
+    return null;
+  }
+  try {
+    const parsed = new URL(url.trim());
+    return `${parsed.protocol}//${parsed.host}`;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Prefer Keycloak status enterpriseAppId (Entra SSO application/client id).
+ * @param {Object|null} entraIdentityProvider
+ * @param {Object|null} entraProvider
+ * @param {Object|null} auth
+ * @returns {string|null}
+ */
+function resolveEntraSsoClientId(entraIdentityProvider, entraProvider, auth) {
+  if (
+    entraIdentityProvider &&
+    typeof entraIdentityProvider.enterpriseAppId === 'string' &&
+    entraIdentityProvider.enterpriseAppId.trim()
+  ) {
+    return entraIdentityProvider.enterpriseAppId.trim();
+  }
+  if (entraProvider && typeof entraProvider.clientId === 'string' && entraProvider.clientId.trim()) {
+    return entraProvider.clientId.trim();
+  }
+  if (auth && typeof auth.clientId === 'string' && auth.clientId.trim()) {
+    return auth.clientId.trim();
+  }
+  return null;
+}
+
+/**
+ * @param {Object} resolved
+ * @param {Object|null} entraIdentityProvider
+ * @param {Object|null} entraProvider
+ * @param {Object|null} auth
+ * @returns {string|null}
+ */
+function resolveEntraTenantId(resolved, entraIdentityProvider, entraProvider, auth) {
+  if (
+    entraIdentityProvider &&
+    typeof entraIdentityProvider.tenantId === 'string' &&
+    entraIdentityProvider.tenantId.trim()
+  ) {
+    return entraIdentityProvider.tenantId.trim();
+  }
+  return extractTenantIdFromIssuer(
+    resolved.entraIssuer || entraProvider?.issuer || auth?.issuer || null
+  );
+}
+
+/**
+ * @param {Object} resolved
+ * @param {Object} [params]
+ * @returns {void}
+ */
+function applyCopilotEntraSsoFormFields(resolved, params = {}) {
+  const entraProvider = params.entraProvider || null;
+  const entraIdentityProvider = params.entraIdentityProvider || null;
+  const auth = resolved.discoveryAuthentication || null;
+  resolved.entraSsoRegistrationUrl = ENTRA_SSO_REGISTRATION_URL;
+  // Teams Entra SSO form Base URL = exact Remote MCP URL from package discovery.
+  const mcpUrl =
+    (typeof resolved.mcpUrl === 'string' && resolved.mcpUrl.trim()) || null;
+  resolved.entraSsoBaseUrl = mcpUrl || originFromUrl(resolved.dataplaneBaseUrl) || null;
+  resolved.entraSsoClientId = resolveEntraSsoClientId(
+    entraIdentityProvider,
+    entraProvider,
+    auth
+  );
+  const scopes = Array.isArray(resolved.scopes) ? resolved.scopes : [];
+  resolved.entraSsoScope = scopes.length > 0 ? scopes.join(', ') : null;
+  resolved.entraTenantId = resolveEntraTenantId(
+    resolved,
+    entraIdentityProvider,
+    entraProvider,
+    auth
+  );
+  if (entraIdentityProvider?.enterpriseAppId) {
+    resolved.entraEnterpriseAppId = String(entraIdentityProvider.enterpriseAppId).trim();
+  }
+  applyWebApplicationInfoFields(resolved, params);
+}
+
+const TEAMS_AUTH_CONFIG_GUID =
+  /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+
+/**
+ * @param {string|unknown} value
+ * @returns {string}
+ */
+function trimNonEmptyString(value) {
+  return typeof value === 'string' ? value.trim() : '';
+}
+
+/**
+ * Teams Entra SSO Application ID URI: api://auth-{authConfigId}/{clientId}.
+ * Only when oauthPluginVaultReferenceId is a GUID (Teams auth-config id).
+ * @param {string|null} authConfigId
+ * @param {string|null} clientId
+ * @returns {string|null}
+ */
+function buildTeamsWebApplicationInfoResource(authConfigId, clientId) {
+  const configId = trimNonEmptyString(authConfigId);
+  const appId = trimNonEmptyString(clientId);
+  if (!configId || !TEAMS_AUTH_CONFIG_GUID.test(configId) || !appId) {
+    return null;
+  }
+  return `api://auth-${configId}/${appId}`;
+}
+
+/**
+ * @param {Object} resolved
+ * @returns {string|null}
+ */
+function resolveWebApplicationClientId(resolved) {
+  return (
+    trimNonEmptyString(resolved.entraSsoClientId) ||
+    trimNonEmptyString(resolved.entraEnterpriseAppId) ||
+    null
+  );
+}
+
+/**
+ * Preserve / derive Teams webApplicationInfo for Entra SSO packages.
+ * Prefer explicit params, then prior package values, then GUID auth-config + SSO client id.
+ * Do not invent resource URIs from opaque (non-GUID) vault references.
+ * @param {Object} resolved
+ * @param {Object} params
+ * @returns {void}
+ */
+function applyWebApplicationInfoFields(resolved, params = {}) {
+  const prior = params.priorWebApplicationInfo || null;
+  const explicitId = trimNonEmptyString(params.webApplicationInfoId);
+  const explicitResource = trimNonEmptyString(params.webApplicationInfoResource);
+  const priorId = trimNonEmptyString(prior && prior.id);
+  const priorResource = trimNonEmptyString(prior && prior.resource);
+  const clientId = resolveWebApplicationClientId(resolved);
+  const derivedResource = buildTeamsWebApplicationInfoResource(
+    resolved.oauthPluginVaultReferenceId,
+    clientId
+  );
+  const id = explicitId || priorId || (derivedResource ? clientId : null);
+  const resource = explicitResource || priorResource || derivedResource || null;
+  if (id && resource) {
+    resolved.webApplicationInfoId = id;
+    resolved.webApplicationInfoResource = resource;
+  }
+}
+
+/**
+ * @param {string} fileName
+ * @returns {string}
+ */
+function readCopilotTemplate(fileName) {
+  const templatePath = path.join(TEMPLATES_DIR, fileName);
+  if (!fs.existsSync(templatePath)) {
+    throw new Error(`Microsoft Copilot template not found: ${templatePath}`);
+  }
+  return fs.readFileSync(templatePath, 'utf8');
+}
+
+/**
+ * @param {string} fileName
+ * @param {Object} context
+ * @returns {string}
+ */
+function renderCopilotChannelTemplate(fileName, context) {
+  const hb = Handlebars.create();
+  hb.registerPartial('entraSsoRegistration', readCopilotTemplate('entra-sso-registration.template.md.hbs'));
+  const template = hb.compile(readCopilotTemplate(fileName));
+  return template(context).trim();
+}
+
+/**
+ * Operator-facing error when Teams Entra SSO auth-config id is missing.
+ * Prose lives in templates — not inline CLI copy.
+ * @param {Object|string} [context]
+ * @returns {string}
+ */
+function formatOauthPluginVaultReferenceRequiredError(context = {}) {
+  const values = typeof context === 'string' ? { appName: context, baseName: context } : context || {};
+  const appName =
+    (typeof values.appName === 'string' && values.appName.trim()) ||
+    (typeof values.baseName === 'string' && values.baseName.trim()) ||
+    'Your Assistant';
+  const baseName =
+    (typeof values.baseName === 'string' && values.baseName.trim()) || appName;
+  return renderCopilotChannelTemplate('oauth-plugin-vault-required.template.md.hbs', {
+    ...values,
+    appName,
+    baseName,
+    channelTarget: 'microsoft-copilot',
+    entraSsoRegistrationUrl: values.entraSsoRegistrationUrl || ENTRA_SSO_REGISTRATION_URL
+  });
+}
+
+module.exports = {
+  ENTRA_SSO_REGISTRATION_URL,
+  extractTenantIdFromIssuer,
+  originFromUrl,
+  resolveEntraSsoClientId,
+  resolveEntraTenantId,
+  applyCopilotEntraSsoFormFields,
+  applyWebApplicationInfoFields,
+  buildTeamsWebApplicationInfoResource,
+  renderCopilotChannelTemplate,
+  formatOauthPluginVaultReferenceRequiredError
+};

package/lib/channels/microsoft-copilot-entra-sso.js

@@ -0,0 +1,285 @@
+/**
+ * Microsoft Copilot Entra SSO / trustedIssuer packaging helpers (plan 169.0).
+ *
+ * @fileoverview Readiness, scopes, and auth selection for microsoft-copilot
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const TRUSTED_ISSUER = 'trustedIssuer';
+const CUSTOMER_OAUTH = 'customerOAuth';
+const OPENID_ONLY = new Set(['openid', 'profile', 'offline_access']);
+
+/**
+ * @param {*} value
+ * @returns {boolean}
+ */
+function isPresent(value) {
+  return value !== undefined && value !== null && value !== '';
+}
+
+/**
+ * @param {string} channelTarget
+ * @returns {boolean}
+ */
+function skipsChannelOauthCredential(channelTarget) {
+  return channelTarget === 'microsoft-copilot';
+}
+
+/**
+ * @param {unknown} scopes
+ * @returns {string[]}
+ */
+function normalizeScopeList(scopes) {
+  if (!Array.isArray(scopes)) {
+    return [];
+  }
+  return scopes.map((s) => String(s).trim()).filter(Boolean);
+}
+
+/**
+ * True when scopes are empty or only OIDC login scopes (insufficient for Runtime MCP).
+ * @param {string[]} scopes
+ * @returns {boolean}
+ */
+function isOpenIdOnlyOrEmptyScopes(scopes) {
+  const list = normalizeScopeList(scopes);
+  if (list.length === 0) {
+    return true;
+  }
+  return list.every((scope) => OPENID_ONLY.has(scope));
+}
+
+/**
+ * @param {Object|null|undefined} auth
+ * @returns {string|null}
+ */
+function resolveRecommendedCapability(auth) {
+  const value = auth && typeof auth.recommendedCapability === 'string'
+    ? auth.recommendedCapability.trim()
+    : '';
+  return value || null;
+}
+
+/**
+ * Map adapter auth for Copilot packaging: keep trustedIssuer public fields;
+ * drop Keycloak/customerOAuth AS metadata from the package surface.
+ * @param {Object|null} auth
+ * @returns {Object|null}
+ */
+function mapCopilotPackageAuthentication(auth) {
+  if (!auth || typeof auth !== 'object') {
+    return null;
+  }
+  const recommended = resolveRecommendedCapability(auth);
+  const base = {
+    recommendedCapability: recommended,
+    issuer: auth.issuer || null,
+    openidConfigurationUrl: auth.openidConfigurationUrl || null,
+    protectedResourceMetadataUrl: auth.protectedResourceMetadataUrl || null,
+    resource: auth.resource || auth.apiResource || null,
+    operatorNote: auth.operatorNote || null,
+    pkceRequired: auth.pkceRequired === true,
+    audience: isPresent(auth.audience) ? auth.audience : null,
+    scopes: normalizeScopeList(auth.scopes || auth.allowedScopes)
+  };
+  if (recommended === TRUSTED_ISSUER) {
+    return {
+      ...base,
+      authorizationServerMetadataUrl: null,
+      clientRegistrationModes: []
+    };
+  }
+  return {
+    ...base,
+    authorizationServerMetadataUrl: auth.authorizationServerMetadataUrl || null,
+    clientRegistrationModes: Array.isArray(auth.clientRegistrationModes)
+      ? [...auth.clientRegistrationModes]
+      : []
+  };
+}
+
+/**
+ * Resolve Runtime MCP Entra scopes — never default to openid/profile/offline_access.
+ * @param {Object} params
+ * @param {string[]} [params.explicitScopes]
+ * @param {Object|null} [params.packageContext]
+ * @param {Object|null} [params.entraProvider]
+ * @returns {string[]}
+ */
+function resolveCopilotEntraScopes(params) {
+  const explicit = normalizeScopeList(params.explicitScopes);
+  if (explicit.length > 0 && !isOpenIdOnlyOrEmptyScopes(explicit)) {
+    return explicit;
+  }
+  const fromProvider = normalizeScopeList(params.entraProvider?.allowedScopes);
+  if (fromProvider.length > 0 && !isOpenIdOnlyOrEmptyScopes(fromProvider)) {
+    return fromProvider;
+  }
+  const auth = params.packageContext?.authentication || null;
+  const fromAuth = normalizeScopeList(auth?.scopes || auth?.allowedScopes);
+  if (fromAuth.length > 0 && !isOpenIdOnlyOrEmptyScopes(fromAuth)) {
+    return fromAuth;
+  }
+  const resource = typeof auth?.resource === 'string' ? auth.resource.trim() : '';
+  if (resource.startsWith('api://')) {
+    return [resource];
+  }
+  return [];
+}
+
+/**
+ * Package/Runtime readiness blocker (not Microsoft org-publish state).
+ * Having a Remote MCP URL is enough for packaging even when live remote status
+ * is temporarily unavailable — Microsoft publication is tracked separately.
+ * @param {Object} params
+ * @returns {string|null}
+ */
+function firstCopilotEntraBlocker(params) {
+  const {
+    discoveryReady,
+    discoveryBlocker,
+    mcpServerUrl,
+    recommended,
+    referenceId,
+    issuer,
+    audience,
+    scopes
+  } = params;
+  const hasMcpUrl = typeof mcpServerUrl === 'string' && mcpServerUrl.trim();
+  if (!hasMcpUrl && !discoveryReady) {
+    return discoveryBlocker || 'remoteMcpUnavailable';
+  }
+  if (recommended !== TRUSTED_ISSUER) {
+    return recommended === CUSTOMER_OAUTH
+      ? 'customerOAuthNotAllowed'
+      : 'trustedIssuerRequired';
+  }
+  if (!referenceId) {
+    return 'oauthPluginVaultReferenceRequired';
+  }
+  if (!issuer) {
+    return 'entraIssuerRequired';
+  }
+  if (!isPresent(audience)) {
+    return 'runtimeMcpAudienceRequired';
+  }
+  if (isOpenIdOnlyOrEmptyScopes(scopes)) {
+    return 'runtimeMcpScopeRequired';
+  }
+  return null;
+}
+
+/**
+ * @param {Object|null} auth
+ * @param {Object|null} entraProvider
+ * @returns {{ audience: * , issuer: string|null }}
+ */
+function resolveAudienceAndIssuer(auth, entraProvider) {
+  const audience = isPresent(entraProvider?.audience)
+    ? entraProvider.audience
+    : isPresent(auth?.audience)
+      ? auth.audience
+      : null;
+  const issuer =
+    (entraProvider && entraProvider.issuer) || (auth && auth.issuer) || null;
+  return { audience, issuer };
+}
+
+/**
+ * @param {Object} params
+ * @returns {{
+ *   installReady: boolean,
+ *   blocker: string|null,
+ *   packageReady: boolean,
+ *   packageBlocker: string|null,
+ *   microsoftPublicationPending: boolean,
+ *   packageAuthentication: Object|null
+ * }}
+ */
+function evaluateCopilotEntraSsoReadiness(params) {
+  const packageContext = params.packageContext || null;
+  const auth = mapCopilotPackageAuthentication(packageContext?.authentication || null);
+  const recommended = resolveRecommendedCapability(auth);
+  const referenceId =
+    typeof params.oauthPluginVaultReferenceId === 'string'
+      ? params.oauthPluginVaultReferenceId.trim()
+      : '';
+  const scopes = normalizeScopeList(params.scopes);
+  const { audience, issuer } = resolveAudienceAndIssuer(auth, params.entraProvider || null);
+  const mcpServerUrl =
+    (typeof packageContext?.mcpServerUrl === 'string' && packageContext.mcpServerUrl.trim()) ||
+    (typeof params.mcpServerUrl === 'string' && params.mcpServerUrl.trim()) ||
+    null;
+
+  if (auth) {
+    auth.issuer = issuer;
+    auth.audience = audience;
+    auth.scopes = scopes;
+  }
+
+  const packageBlocker = firstCopilotEntraBlocker({
+    discoveryReady: packageContext?.installReady === true,
+    discoveryBlocker: packageContext?.blocker || null,
+    mcpServerUrl,
+    recommended,
+    referenceId,
+    issuer,
+    audience,
+    scopes
+  });
+  const packageReady = packageBlocker === null;
+  return {
+    installReady: packageReady,
+    blocker: packageBlocker,
+    packageReady,
+    packageBlocker,
+    microsoftPublicationPending: true,
+    packageAuthentication: auth
+  };
+}
+
+const {
+  formatOauthPluginVaultReferenceRequiredError
+} = require('./microsoft-copilot-entra-sso-form');
+
+/**
+ * @param {Object} [options]
+ * @throws {Error}
+ */
+function assertOauthPluginVaultReferenceId(options = {}) {
+  const ref = options.oauthPluginVaultReferenceId;
+  if (typeof ref === 'string' && ref.trim()) {
+    return;
+  }
+  throw new Error(formatOauthPluginVaultReferenceRequiredError(options.formContext || options));
+}
+
+/**
+ * @param {Object} [runtimeValues]
+ * @throws {Error}
+ */
+function assertCopilotPackageOauthPluginVaultReference(runtimeValues = {}) {
+  const ref = runtimeValues.oauthPluginVaultReferenceId;
+  if (typeof ref === 'string' && ref.trim()) {
+    return;
+  }
+  throw new Error(formatOauthPluginVaultReferenceRequiredError(runtimeValues));
+}
+
+module.exports = {
+  TRUSTED_ISSUER,
+  CUSTOMER_OAUTH,
+  skipsChannelOauthCredential,
+  normalizeScopeList,
+  isOpenIdOnlyOrEmptyScopes,
+  resolveRecommendedCapability,
+  mapCopilotPackageAuthentication,
+  resolveCopilotEntraScopes,
+  evaluateCopilotEntraSsoReadiness,
+  formatOauthPluginVaultReferenceRequiredError,
+  assertOauthPluginVaultReferenceId,
+  assertCopilotPackageOauthPluginVaultReference
+};

package/lib/channels/microsoft-copilot-icons.js

@@ -0,0 +1,74 @@
+/**
+ * Valid Microsoft Teams / Copilot package icons (192×192 color, 32×32 outline).
+ *
+ * Defaults from templates/channels/brand (plan 167.0):
+ * - color-192.png ← light/192 (color app icon)
+ * - outline-32.png ← mono-white/32 (Teams outline)
+ * Variant packs: light/, dark/, mono-white/ at 32–512.
+ *
+ * @fileoverview Loads AI Fabrix brand PNGs from templates/channels/brand
+ * @author AI Fabrix Team
+ * @version 2.1.0
+ */
+
+'use strict';
+
+const path = require('path');
+const fs = require('../internal/fs-real-sync');
+const { BUILDER_ROOT } = require('./channel-integration-template');
+
+const BRAND_DIR = path.join(BUILDER_ROOT, 'templates', 'channels', 'brand');
+const DEFAULT_COLOR_PATH = path.join(BRAND_DIR, 'color-192.png');
+const DEFAULT_OUTLINE_PATH = path.join(BRAND_DIR, 'outline-32.png');
+
+/**
+ * @param {string} filePath
+ * @returns {Buffer}
+ */
+function readPngFile(filePath) {
+  if (!fs.existsSync(filePath)) {
+    throw new Error(`Brand icon not found: ${filePath}`);
+  }
+  return fs.readFileSync(filePath);
+}
+
+/**
+ * @param {{ colorPath?: string, outlinePath?: string }} [options]
+ * @returns {{ color: Buffer, outline: Buffer }}
+ */
+function getMicrosoftCopilotIcons(options = {}) {
+  const colorPath =
+    typeof options.colorPath === 'string' && options.colorPath.trim()
+      ? options.colorPath.trim()
+      : DEFAULT_COLOR_PATH;
+  const outlinePath =
+    typeof options.outlinePath === 'string' && options.outlinePath.trim()
+      ? options.outlinePath.trim()
+      : DEFAULT_OUTLINE_PATH;
+  return {
+    color: readPngFile(colorPath),
+    outline: readPngFile(outlinePath)
+  };
+}
+
+/**
+ * Read PNG IHDR width/height without external deps.
+ * @param {Buffer} buf
+ * @returns {{ width: number, height: number } | null}
+ */
+function readPngDimensions(buf) {
+  if (!Buffer.isBuffer(buf) || buf.length < 24) return null;
+  if (buf.toString('hex', 0, 8) !== '89504e470d0a1a0a') return null;
+  return {
+    width: buf.readUInt32BE(16),
+    height: buf.readUInt32BE(20)
+  };
+}
+
+module.exports = {
+  getMicrosoftCopilotIcons,
+  readPngDimensions,
+  BRAND_DIR,
+  DEFAULT_COLOR_PATH,
+  DEFAULT_OUTLINE_PATH
+};

package/lib/channels/microsoft-copilot-limits.js

@@ -0,0 +1,103 @@
+/**
+ * Microsoft Copilot / Teams package string limits.
+ *
+ * @fileoverview Truncate and normalize Copilot package display fields to schema limits
+ * @author AI Fabrix Team
+ * @version 1.1.0
+ */
+
+'use strict';
+
+const TEAMS_NAME_SHORT_MAX = 30;
+const TEAMS_NAME_FULL_MAX = 100;
+const TEAMS_DESCRIPTION_SHORT_MAX = 80;
+const TEAMS_DESCRIPTION_FULL_MAX = 4000;
+const PLUGIN_NAME_FOR_HUMAN_MAX = 20;
+const PLUGIN_DESCRIPTION_FOR_HUMAN_MAX = 100;
+
+const FI_DEFAULT_SHORT =
+  'Yrityksen tekoälyavustaja työntekijöille AI Fabrix Runtime -ympäristössä.';
+const FI_DEFAULT_FULL =
+  'Yrityksen tekoälyavustaja työntekijöille. Hyväksytyt avustajat, yritystieto, työnkulut ja hallitut toiminnot AI Fabrixin kautta.';
+
+/**
+ * @param {string} text
+ * @param {number} max
+ * @returns {string}
+ */
+function truncateForSchema(text, max) {
+  const value = String(text ?? '').trim();
+  if (!value) return '';
+  if (value.length <= max) return value;
+  if (max <= 1) return value.slice(0, max);
+  return `${value.slice(0, max - 1)}…`;
+}
+
+/**
+ * Plugin namespace: lowercase alphanumeric/hyphen only (plugin schema ^[A-Za-z0-9-]+$).
+ * @param {string} baseName
+ * @returns {string}
+ */
+function buildPluginNamespace(baseName) {
+  const raw = String(baseName ?? 'aifabrix')
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9-]+/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '');
+  const ns = raw || 'aifabrix';
+  return truncateForSchema(ns, 32).replace(/[^a-z0-9-]/g, '') || 'aifabrix';
+}
+
+/**
+ * @param {Object} runtimeValues
+ * @returns {Object}
+ */
+function applyMicrosoftCopilotDisplayLimits(runtimeValues) {
+  const appDescription = String(runtimeValues.appDescription || '').trim();
+  const baseName = String(runtimeValues.baseName || runtimeValues.appName || 'Assistant').trim();
+  const appName = String(runtimeValues.appName || baseName).trim();
+  // Teams short + full both use the environment-scoped display name (e.g. "Onni (dev)").
+  runtimeValues.shortName = truncateForSchema(appName, TEAMS_NAME_SHORT_MAX);
+  runtimeValues.fullName = truncateForSchema(appName, TEAMS_NAME_FULL_MAX);
+  runtimeValues.shortDescription = truncateForSchema(
+    appDescription || 'Enterprise AI assistant via AI Fabrix Runtime.',
+    TEAMS_DESCRIPTION_SHORT_MAX
+  );
+  runtimeValues.fullDescription = truncateForSchema(
+    appDescription || runtimeValues.shortDescription,
+    TEAMS_DESCRIPTION_FULL_MAX
+  );
+  // Plugin name_for_human matches the env-scoped display name (e.g. "Onni (dev)").
+  runtimeValues.pluginNameForHuman = truncateForSchema(appName, PLUGIN_NAME_FOR_HUMAN_MAX);
+  runtimeValues.pluginDescriptionForHuman = truncateForSchema(
+    appDescription || runtimeValues.shortDescription,
+    PLUGIN_DESCRIPTION_FOR_HUMAN_MAX
+  );
+  runtimeValues.pluginNamespace = buildPluginNamespace(baseName);
+  const fiShort =
+    typeof runtimeValues.fiShortDescription === 'string' && runtimeValues.fiShortDescription.trim()
+      ? runtimeValues.fiShortDescription.trim()
+      : FI_DEFAULT_SHORT;
+  const fiFull =
+    typeof runtimeValues.fiFullDescription === 'string' && runtimeValues.fiFullDescription.trim()
+      ? runtimeValues.fiFullDescription.trim()
+      : FI_DEFAULT_FULL;
+  runtimeValues.fiShortDescription = truncateForSchema(fiShort, TEAMS_DESCRIPTION_SHORT_MAX);
+  runtimeValues.fiFullDescription = truncateForSchema(fiFull, TEAMS_DESCRIPTION_FULL_MAX);
+  return runtimeValues;
+}
+
+module.exports = {
+  TEAMS_NAME_SHORT_MAX,
+  TEAMS_NAME_FULL_MAX,
+  TEAMS_DESCRIPTION_SHORT_MAX,
+  TEAMS_DESCRIPTION_FULL_MAX,
+  PLUGIN_NAME_FOR_HUMAN_MAX,
+  PLUGIN_DESCRIPTION_FOR_HUMAN_MAX,
+  FI_DEFAULT_SHORT,
+  FI_DEFAULT_FULL,
+  truncateForSchema,
+  buildPluginNamespace,
+  applyMicrosoftCopilotDisplayLimits
+};