@aifabrix/builder 2.52.1 → 2.53.1

package/lib/role-assistant/test-suite.js

@@ -1,41 +1,35 @@
 /**
  * Role Assistant suite discovery for multi-case CLI runs.
- * @fileoverview Discover YAML cases under tests/role-assistant/ra-* suite folders
+ * @fileoverview Discover YAML cases under tests/ra-* / package tests/
  */
 
 'use strict';
 
 const path = require('path');
 const fs = require('../internal/fs-real-sync');
-const { bareRoleKey } = require('../utils/role-assistant-paths');
+const { bareRoleKey, roleAssistantSystemKey } = require('../utils/role-assistant-paths');
 
-function loadNodeFs() {
-  if (global.__AIFABRIX_NODE_FS_UNMOCKED__) {
-    return global.__AIFABRIX_NODE_FS_UNMOCKED__;
-  }
-  return typeof jest !== 'undefined' && typeof jest.requireActual === 'function'
-    ? jest.requireActual('node:fs')
-    : require('node:fs');
-}
-
-const nodeFs = loadNodeFs();
-
-function exists(p) {
-  return nodeFs.existsSync(p) || fs.existsSync(p);
-}
-
-function readdir(p) {
-  if (nodeFs.existsSync(p)) {
-    return nodeFs.readdirSync(p, { withFileTypes: true });
-  }
-  return fs.readdirSync(p).map((name) => ({
-    name,
-    isDirectory: () => fs.statSync(path.join(p, name)).isDirectory()
-  }));
+/**
+ * Candidate case roots (first existing wins).
+ * 1. tests/<ra-key>/<role-key>/
+ * 2. tests/role-assistant/<ra-key>/ (legacy)
+ * 3. role-assistant/<ra-key>/tests/
+ * @param {string} roleKey
+ * @param {string} cwd
+ * @returns {string[]}
+ */
+function listCasesRootCandidates(roleKey, cwd) {
+  const bare = bareRoleKey(roleKey);
+  const raKey = roleAssistantSystemKey(bare);
+  return [
+    path.join(cwd, 'tests', raKey, bare),
+    path.join(cwd, 'tests', 'role-assistant', raKey),
+    path.join(cwd, 'role-assistant', raKey, 'tests')
+  ];
 }
 
 /**
- * Resolve cases root for a role: prefer tests/role-assistant/ra-{bare}, else package tests/.
+ * Resolve cases root for a role.
  * @param {string} roleKey
  * @param {{ casesRoot?: string, cwd?: string }} [options]
  * @returns {string}
@@ -45,16 +39,14 @@ function resolveCasesRoot(roleKey, options = {}) {
     return path.resolve(String(options.casesRoot));
   }
   const cwd = options.cwd || process.cwd();
-  const bare = bareRoleKey(roleKey);
-  const preferred = path.join(cwd, 'tests', 'role-assistant', `ra-${bare}`);
-  if (exists(preferred)) {
-    return preferred;
-  }
-  const packageTests = path.join(cwd, 'role-assistant', `ra-${bare}`, 'tests');
-  if (exists(packageTests)) {
-    return packageTests;
+  const candidates = listCasesRootCandidates(roleKey, cwd);
+  for (const candidate of candidates) {
+    if (fs.existsSync(candidate)) {
+      return candidate;
+    }
   }
-  return preferred;
+  // Prefer package path in errors — primary authoring location when repo-root tests/ is absent.
+  return candidates[candidates.length - 1];
 }
 
 /**
@@ -63,12 +55,12 @@ function resolveCasesRoot(roleKey, options = {}) {
  * @returns {Array<{ suite: string, file: string, absPath: string, caseIdHint: string }>}
  */
 function discoverSuiteCaseFiles(casesRoot, options = {}) {
-  if (!exists(casesRoot)) {
+  if (!fs.existsSync(casesRoot)) {
     return [];
   }
   const suiteFilter = options.suite ? String(options.suite).trim() : '';
   const rows = [];
-  for (const ent of readdir(casesRoot)) {
+  for (const ent of fs.readdirSync(casesRoot, { withFileTypes: true })) {
     if (!ent.isDirectory() || String(ent.name).startsWith('.')) {
       continue;
     }
@@ -76,9 +68,9 @@ function discoverSuiteCaseFiles(casesRoot, options = {}) {
       continue;
     }
     const suitePath = path.join(casesRoot, ent.name);
-    for (const fileEnt of readdir(suitePath)) {
-      const name = fileEnt.name || fileEnt;
-      if (typeof name !== 'string' || !/\.(ya?ml)$/i.test(name)) {
+    for (const fileEnt of fs.readdirSync(suitePath, { withFileTypes: true })) {
+      const name = fileEnt.name;
+      if (!fileEnt.isFile() || !/\.(ya?ml)$/i.test(name)) {
         continue;
       }
       const absPath = path.join(suitePath, name);
@@ -113,6 +105,7 @@ function filterDiscoveredCases(rows, caseSel) {
 }
 
 module.exports = {
+  listCasesRootCandidates,
   resolveCasesRoot,
   discoverSuiteCaseFiles,
   filterDiscoveredCases

package/lib/schema/external-datasource.schema.json

@@ -7,12 +7,12 @@
          "key":"external-datasource-schema",
          "name":"External Data Source Configuration Schema",
          "description":"JSON schema for validating ExternalDataSource configuration files",
-     "version":"2.9.6",
+     "version":"2.9.7",
          "type":"schema",
          "category":"integration",
          "author":"AI Fabrix Team",
          "createdAt":"2024-01-01T00:00:00Z",
-         "updatedAt":"2026-08-07T00:00:00Z",
+         "updatedAt":"2026-08-21T00:00:00Z",
          "compatibility":{
             "minVersion":"1.0.0",
             "maxVersion":"3.0.0",
@@ -31,6 +31,14 @@
          "external-system.schema.json"
       ],
       "changelog":[
+         {
+            "version":"2.9.7",
+            "date":"2026-08-21T00:00:00Z",
+            "changes":[
+               "Added record to CIP fetch.source for governed local record-storage operations."
+            ],
+            "breaking":false
+         },
          {
             "version":"2.9.5",
             "date":"2026-07-31T00:00:00Z",
@@ -2534,9 +2542,10 @@
                        "openapi",
                        "http",
                        "datasource",
-                       "viewpoint"
+                       "viewpoint",
+                       "record"
                      ],
-                    "description":"If 'openapi', refer to openapi.operations.*. If 'http', use explicit method/path. If 'datasource', execute another datasource operation. If 'viewpoint', execute saved SQL in fetch.query against records storage (storageType view)."
+                    "description":"If 'openapi', refer to openapi.operations.*. If 'http', use explicit method/path. If 'datasource', execute another datasource operation. If 'viewpoint', execute saved SQL in fetch.query against records storage (storageType view). If 'record', read or persist governed rows in local record storage with no vendor HTTP; read versus persist follows the CIP operation shape."
                   },
                   "openapiRef":{
                      "type":"string",

package/lib/utils/compose-generator.js

@@ -31,6 +31,7 @@ const {
   buildTraefikIngressBase,
   computeTraefikStripPathPrefix
 } = require('./compose-traefik-ingress-base');
+const { buildTraefikExtraRouters } = require('./compose-traefik-extra-routes');
 const { parseDeveloperIdNum } = require('./declarative-url-ports');
 
 registerComposeHelpers();
@@ -250,13 +251,20 @@ function buildTraefikConfig(config, devId, scopeOpts = null, remoteServer = null
   // Traefik must only attach routers to `web` for developer-id > 0; `websecure`+tls labels without
   // matching certs break routing on Traefik 3.6+ for HTTP traffic (404 on PathPrefix).
   const terminateTlsAtTraefik = base.tls === true && devNum === 0;
+  const stripPathPrefix = computeTraefikStripPathPrefix(base.path, resolvedHealth);
+  const extra = buildTraefikExtraRouters(config.frontDoorRouting, base.path);
   return {
     enabled: true,
     host: base.host,
     path: base.path,
     tls: terminateTlsAtTraefik,
     certStore: terminateTlsAtTraefik ? base.certStore || null : null,
-    stripPathPrefix: computeTraefikStripPathPrefix(base.path, resolvedHealth)
+    stripPathPrefix,
+    passThroughRouters: extra.passThroughRouters,
+    aliasRouters: extra.aliasRouters.map((r) => ({
+      ...r,
+      stripPrimary: stripPathPrefix === true && base.path !== '/'
+    }))
   };
 }
 
@@ -424,6 +432,7 @@ module.exports = {
   getImageName,
   derivePathFromPattern,
   buildTraefikConfig,
+  buildTraefikExtraRouters,
   computeAlignedHealthCheckPath,
   resolveHealthCheckPathWithFrontDoorVdir,
   buildDevUsername,

package/lib/utils/compose-traefik-extra-routes.js

@@ -0,0 +1,107 @@
+/**
+ * Extra Traefik routers from frontDoorRouting.requiresRuleSet + ruleSetConditions.
+ *
+ * @fileoverview Schema-legal pass-through routes (plan 171.0). No invented keys.
+ * @author AI Fabrix Team
+ * @version 1.1.0
+ */
+
+/**
+ * Normalize a route pattern to a PathPrefix value (no trailing slash / wildcards).
+ * @param {unknown} pattern
+ * @returns {string|null}
+ */
+function normalizeRoutePrefix(pattern) {
+  if (!pattern || typeof pattern !== 'string') {
+    return null;
+  }
+  const trimmed = pattern.trim();
+  if (!trimmed.startsWith('/')) {
+    return null;
+  }
+  if (trimmed === '/' || trimmed === '/*') {
+    return '/';
+  }
+  const withoutWildcards = trimmed.replace(/\/\*+$/g, '').replace(/\*+$/g, '');
+  const withoutTrailing = withoutWildcards.replace(/\/+$/g, '');
+  return withoutTrailing || '/';
+}
+
+/**
+ * Safe Traefik label id fragment from a path prefix.
+ * @param {string} prefix
+ * @param {number} index
+ * @returns {string}
+ */
+function routeIdFromPrefix(prefix, index) {
+  const slug = String(prefix || 'x')
+    .replace(/^\//, '')
+    .replace(/[^a-zA-Z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 40);
+  return `${slug || 'route'}-${index}`;
+}
+
+/**
+ * Collect PathPrefix values from ruleSetConditions matchValues.
+ * @param {Object} frontDoor
+ * @returns {string[]}
+ */
+function matchValuesFromRuleSetConditions(frontDoor) {
+  if (frontDoor.requiresRuleSet !== true) {
+    return [];
+  }
+  const conditions = Array.isArray(frontDoor.ruleSetConditions)
+    ? frontDoor.ruleSetConditions
+    : [];
+  const prefixes = [];
+  conditions.forEach((condition) => {
+    if (!condition || typeof condition !== 'object') {
+      return;
+    }
+    const values = Array.isArray(condition.matchValues) ? condition.matchValues : [];
+    values.forEach((raw) => {
+      const pathPrefix = normalizeRoutePrefix(raw);
+      if (pathPrefix && pathPrefix !== '/') {
+        prefixes.push(pathPrefix);
+      }
+    });
+  });
+  return prefixes;
+}
+
+/**
+ * Build Traefik extra-route descriptors from frontDoorRouting (schema fields only).
+ * @param {Object|null|undefined} frontDoor
+ * @param {string} _primaryPath - Resolved primary PathPrefix (unused; reserved for callers)
+ * @returns {{ passThroughRouters: object[], aliasRouters: object[] }}
+ */
+function buildTraefikExtraRouters(frontDoor, _primaryPath) {
+  const passThroughRouters = [];
+  const aliasRouters = [];
+  if (!frontDoor || typeof frontDoor !== 'object') {
+    return { passThroughRouters, aliasRouters };
+  }
+
+  const prefixes = matchValuesFromRuleSetConditions(frontDoor);
+  const seen = new Set();
+  prefixes.forEach((pathPrefix, index) => {
+    if (seen.has(pathPrefix)) {
+      return;
+    }
+    seen.add(pathPrefix);
+    passThroughRouters.push({
+      id: routeIdFromPrefix(pathPrefix, index),
+      pathPrefix
+    });
+  });
+
+  return { passThroughRouters, aliasRouters };
+}
+
+module.exports = {
+  normalizeRoutePrefix,
+  routeIdFromPrefix,
+  matchValuesFromRuleSetConditions,
+  buildTraefikExtraRouters
+};

package/lib/utils/docker-build.js

@@ -253,12 +253,12 @@ async function executeBuild(imageName, dockerfilePath, contextPath, tag, options
   );
   await executeDockerBuild(imageName, dockerfilePath, contextPath, tag, buildArgs, noCache);
 
-  // Also apply floating `main` when building a version tag (matches dev-promote dual tags).
+  // Also apply floating `latest` when building a version tag (matches dev-promote dual tags).
   if (options && options.tag && options.tag !== 'latest' && options.tag !== 'main') {
     const { execFileWithDockerEnv } = require('./docker-exec');
     const { getDockerExecEnv } = require('./remote-docker-env');
     const env = await getDockerExecEnv();
-    await execFileWithDockerEnv('docker', ['tag', `${imageName}:${tag}`, `${imageName}:main`], { env });
+    await execFileWithDockerEnv('docker', ['tag', `${imageName}:${tag}`, `${imageName}:latest`], { env });
   }
 }
 

package/lib/utils/help-builder.js

@@ -98,7 +98,8 @@ const CATEGORIES = [
       { name: 'validate', term: 'validate [appKey|systemKey|file]' },
       { name: 'validate-json', term: 'validate-json [appKey|systemKey]' },
       { name: 'parameters', term: 'parameters validate' },
-      { name: 'diff', term: 'diff <file1> <file2>' }
+      { name: 'diff', term: 'diff <file1> <file2>' },
+      { name: 'package-score', term: 'package-score --reference <dir> --candidate <dir>' }
     ]
   },
   {

package/lib/utils/promote-dev-docker-image.js

@@ -2,9 +2,9 @@
  * Promote a developer-scoped local Docker image to the manifest base repository (tag only).
  *
  * @fileoverview Used by `aifabrix build --base --from-dev` and dev-promote workflows.
- * Promote always applies two base tags: `main` (floating) and the version tag (TAG / package version).
+ * Promote always applies two base tags: `latest` (floating) and the version tag (TAG / package version).
  * @author AI Fabrix Team
- * @version 1.1.0
+ * @version 1.2.0
  */
 
 'use strict';
@@ -16,8 +16,11 @@ const { execWithDockerEnv } = require('./docker-exec');
 const logger = require('./logger');
 const { formatSuccessLine } = require('./cli-test-layout-chalk');
 
-/** Floating base tag applied on every promote alongside the version tag. */
-const PROMOTE_MAIN_TAG = 'main';
+/** Floating base tag applied on every promote alongside the version tag (matches setup manifests). */
+const PROMOTE_FLOATING_TAG = 'latest';
+
+/** @deprecated Use {@link PROMOTE_FLOATING_TAG}. Kept for callers that imported the old name. */
+const PROMOTE_MAIN_TAG = PROMOTE_FLOATING_TAG;
 
 /**
  * @param {string} value
@@ -72,22 +75,23 @@ async function dockerTagImageRef(sourceRef, targetRef) {
  */
 function resolvePromoteVersionTag(options = {}) {
   const raw = String(options.tag || '').trim();
-  if (!raw || raw === 'latest' || raw === PROMOTE_MAIN_TAG) {
-    return 'latest';
+  // `main` accepted as legacy alias for the floating tag.
+  if (!raw || raw === PROMOTE_FLOATING_TAG || raw === 'main') {
+    return PROMOTE_FLOATING_TAG;
   }
   return raw;
 }
 
 /**
- * Base tags to apply on promote: version first, then `main` when distinct.
+ * Base tags to apply on promote: version first, then `latest` when distinct.
  * @param {Object} options
  * @returns {string[]}
  */
 function resolvePromoteBaseTags(options = {}) {
   const versionTag = resolvePromoteVersionTag(options);
   const tags = [versionTag];
-  if (versionTag !== PROMOTE_MAIN_TAG) {
-    tags.push(PROMOTE_MAIN_TAG);
+  if (versionTag !== PROMOTE_FLOATING_TAG) {
+    tags.push(PROMOTE_FLOATING_TAG);
   }
   return tags;
 }
@@ -182,7 +186,7 @@ async function allBaseTagsMatchDev(baseName, baseTags, devId) {
 
 /**
  * Tag developer-scoped image as manifest base when present locally.
- * Always applies the version tag and `main`.
+ * Always applies the version tag and `latest`.
  * @param {string} appName
  * @param {Object} options - build options (`base`, `tag`, `registry`, `fromDev`)
  * @returns {Promise<string|null>} primary base image ref (version) when promoted; null when missing
@@ -236,6 +240,7 @@ function shouldAttemptDevPromote(options) {
 }
 
 module.exports = {
+  PROMOTE_FLOATING_TAG,
   PROMOTE_MAIN_TAG,
   tryPromoteDevImageToBase,
   shouldAttemptDevPromote,

package/package.json

@@ -1,12 +1,19 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.52.1",
+  "version": "2.53.1",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {
     "aifabrix": "bin/aifabrix.js",
     "af": "bin/aifabrix.js"
   },
+  "files": [
+    "bin/aifabrix.js",
+    "lib/",
+    "templates/",
+    "README.md",
+    "LICENSE"
+  ],
   "scripts": {
     "help": "node scripts/pnpm/help.mjs",
     "dev-install": "node scripts/pnpm/dev-install.mjs",
@@ -21,32 +28,23 @@
     "lint:fix": "eslint . --ext .js --fix",
     "test": "node tests/scripts/test-wrapper.js",
     "build": "npm run lint && npm run test",
-    "build:ci": "npm run lint && npm run check:schema-sync && npm run check:flags && npm run test:ci",
+    "build:ci": "npm run lint && npm run check:schema-sync && npm run check:flags && npm run check:cli-help && npm run test:ci",
     "test:ci": "bash tests/scripts/ci-simulate.sh",
-    "install:local": "node scripts/install-local.js && which aifabrix && which af",
-    "uninstall:local": "node scripts/install-local.js uninstall && which aifabrix && which af",
-    "sync-json": "node scripts/sync-builder-api-template.js",
-    "builder-api:build": "tsc -p packages/builder-api/tsconfig.json",
-    "builder-api:nest": "node bin/builder-api-nest.js",
-    "builder-api:cleanup": "node bin/builder-api-cleanup.js",
-    "check:builder-api-arch": "node scripts/check-builder-api-architecture-grep.js",
     "check:schema-sync": "node scripts/check-datasource-test-run-schema-sync.js",
     "check:flags": "jest tests/lib/schema/flag-map-validation-run.test.js --runInBand --config jest.config.default.js",
-    "test:154": "npm run check:builder-api-arch && jest --runInBand tests/lib/programmatic/ tests/packages/builder-api/ tests/lib/commands/up-builder-api.test.js tests/lib/commands/up-common.test.js tests/lib/commands/repair-deploy-script.test.js tests/lib/generator/deploy-script.test.js tests/lib/generator/wizard-generator.test.js tests/lib/scripts/sync-builder-api-template.test.js tests/lib/platform-integrations-manifest.test.js",
-    "test:154-docker-ip": "jest --runInBand tests/scripts/stage_builder_api_for_docker.test.js tests/scripts/docker_image_content_gate.test.js",
-    "stage-builder-api-docker": "node scripts/stage_builder_api_for_docker.js",
-    "docker-image-build-builder-api": "npm run stage-builder-api-docker && docker build -f builder/builder-api/Dockerfile -t builder-api:gate .",
-    "docker-image-gate-builder-api": "npm run docker-image-build-builder-api && node scripts/docker_image_content_gate.js builder-api:gate builder-api",
+    "check:cli-help": "node scripts/check-cli-help-examples.js",
     "test:manual": "jest --config jest.config.manual.js --runInBand",
     "test:integration": "jest --config jest.config.integration.js --runInBand",
     "test:integration:fixtures": "jest --config jest.config.integration.fixtures.js --runInBand",
     "test:hubspot-wizard": "node integration/hubspot-test/test.js",
     "test:hubspot-dataplane-down": "node integration/hubspot-test/test-dataplane-down.js",
     "test:coverage": "cross-env RUN_COVERAGE=1 node tests/scripts/test-wrapper.js",
-    "test:watch": "jest --watch",
-    "diagnose:cli": "node scripts/diagnose-cli.js",
+    "docker-image-gate-builder-api": "node scripts/stage_builder_api_for_docker.js && docker build -f builder/builder-api/Dockerfile -t builder-api:gate . && node scripts/docker_image_content_gate.js builder-api:gate builder-api",
+    "install:local": "node scripts/install-local.js && which aifabrix && which af",
+    "uninstall:local": "node scripts/install-local.js uninstall && which aifabrix && which af",
     "install:global": "npm install -g . --force && which aifabrix && which af && aifabrix --version",
     "uninstall:global": "npm uninstall -g @aifabrix/builder",
+    "sync-json": "node scripts/sync-builder-api-template.js",
     "pack": "npm run build && npm pack",
     "validate": "npm run build",
     "prepublishOnly": "npm run validate"

package/templates/README.md

@@ -15,7 +15,18 @@ Application templates are folder-based and located under `templates/applications
 - `templates/applications/keycloak/` - Keycloak application template
 - `templates/applications/builder-api/` - Builder API platform webapp (published from `builder/builder-api/` via `npm run sync-json`)
 
-**Platform SSOT (builder-api, plan 154.2):** Edit `builder/builder-api/` in the aifabrix-builder repo, then run `npm run sync-json` to publish `application.yaml`, `Dockerfile`, and `env.template` into `templates/applications/builder-api/`. Install with `aifabrix up-platform` or `aifabrix up-builder-api` — not hand-editing the template copy.
+**Platform template sync (`pnpm run sync-json`):** Publishes local `builder/builder-api/` (`application.yaml`, `Dockerfile`, `env.template`) and, when sibling checkouts exist, pulls the same file sets as miso/dataplane sync-json:
+
+| SSOT | → template |
+| --- | --- |
+| `aifabrix-builder/builder/builder-api/` | `templates/applications/builder-api/` |
+| `aifabrix-miso/builder/miso-controller/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/miso-controller/` |
+| `aifabrix-miso/builder/keycloak/` (`env.template`, `application.yaml`) | `templates/applications/keycloak/` |
+| `aifabrix-dataplane/builder/dataplane/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/dataplane/` |
+
+**Schema master (dataplane):** Also copies dataplane `app/schemas/json/` core integration schemas + `type/*` and `configs/deployment-rules.yaml` into `lib/schema/` (same contract as dataplane `make sync-json`). Do not hand-edit those mirrors — edit dataplane SSOT, then sync. Builder-owned schemas in `lib/schema/` (wizard, infra, etc.) are left alone.
+
+Overrides: `AIFABRIX_MISO_SRC`, `AIFABRIX_DATAPLANE_SRC` / `AIFABRIX_DATAPLANE_ROOT` (repo roots). Install with `aifabrix up-platform` / `up-builder-api` — do not hand-edit the template copies as primary.
 
 **Template Validation:**
 - Template folder must exist in `templates/applications/<name>/`

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.26
+  version: 2.0.31
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).
@@ -29,6 +29,13 @@ frontDoorRouting:
   internalDockerUseOriginOnly: false
   host: ${DEV_USERNAME}.${REMOTE_HOST}
   tls: ${TLS_ENABLED}
+  # Origin RFC 9728 PRM (outside /data PathPrefix) — Builder Traefik pass-through (plan 171.0).
+  requiresRuleSet: true
+  ruleSetConditions:
+    - type: UrlPath
+      operator: BeginsWith
+      matchValues:
+        - /.well-known/oauth-protected-resource/data
 
 # Azure Requirements
 requires:

package/templates/applications/dataplane/env.template

@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.26
+VERSION=2.0.31
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,8 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.29'
+  version: '2.0.34'
+
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).

package/templates/applications/miso-controller/rbac.yaml

@@ -156,6 +156,7 @@ permissions:
     roles:
       [
         'aifabrix-platform-admin',
+        'aifabrix-infrastructure-admin',
         'aifabrix-deployment-admin',
         'aifabrix-developer',
         'aifabrix-observer'

package/templates/channels/microsoft-copilot/ai-plugin.template.json.hbs

@@ -3,19 +3,23 @@
   "schema_version": "v2.4",
   "name_for_human": "{{pluginNameForHuman}}",
   "description_for_human": "{{pluginDescriptionForHuman}}",
-  "description_for_model": "Governed enterprise work tools for Role Assistants. Prefer discovery tool names only; resolve Role Assistants dynamically for the signed-in user.",
+  "description_for_model": "Governed enterprise work tools for Role Assistants. Prefer discovery tool names only; resolve Role Assistants dynamically for the signed-in user. For listing available Role Assistants use work.roles; use assistant.describe only when an assistantKey is already known.",
   "namespace": "{{pluginNamespace}}",
   "privacy_policy_url": "{{{dataplaneBaseUrl}}}/privacy",
   "legal_info_url": "{{{dataplaneBaseUrl}}}/terms",
+  "functions": [],
   "runtimes": [
     {
       "type": "RemoteMCPServer",
       "spec": {
         "url": "{{{mcpUrl}}}"
       },
+      "run_for_functions": [
+        "*"
+      ],
       "auth": {
         "type": "OAuthPluginVault",
-        "reference_id": "{{oauthPluginVaultReferenceId}}"
+        "reference_id": "{{{oauthPluginVaultReferenceId}}}"
       }
     }
   ]

package/templates/channels/microsoft-copilot/entra-sso-registration.template.md.hbs

@@ -6,22 +6,25 @@ Direct URL:
 
 Open **Tools → Microsoft Entra SSO client ID registration → Register client ID** (or New).
 
+Do this **before** organisation publish. The registration / auth-config ID becomes `--oauth-plugin-vault-reference-id`. It is **not** the Entra Client (application) ID.
+
 ### Values to paste into the form
 
 | Field | Value |
 | --- | --- |
 | Registration name | `{{appName}}` |
-| Base URL | {{#if entraSsoBaseUrl}}`{{{entraSsoBaseUrl}}}`{{else}}*(missing — dataplane URL not resolved)*{{/if}} |
-| Restrict usage by organization | My organization only (DEV) |
-| Restrict usage by Teams app | Any Teams app (until the Teams app id is stable) |
+| Base URL | {{#if entraSsoBaseUrl}}`{{{entraSsoBaseUrl}}}`{{else}}*(missing — Remote MCP URL not resolved)*{{/if}} |
+| Restrict usage by organization | My organization only |
+| Restrict usage by Teams app | Stable Teams app / manifest ID `{{packageAppId}}` (known before Import — bind to this ID at registration; do not use “Any Teams app”) |
 | Client (application) ID | {{#if entraSsoClientId}}`{{entraSsoClientId}}`{{else}}*(missing — Entra SSO enterprise app (client) id from controller Keycloak status `entraIdentityProvider.enterpriseAppId`; complete Entra onboarding if empty)*{{/if}} |
 | Scope | {{#if entraSsoScope}}`{{entraSsoScope}}`{{else}}*(missing — set Runtime MCP delegated scopes on Trust source `microsoft-entra-id` `allowedScopes`; not openid/profile alone)*{{/if}} |
 
 ### Related (for your records)
 
 {{#if mcpUrl}}- **Remote MCP URL (package):** `{{{mcpUrl}}}`{{/if}}
+{{#if packageAppId}}- **Teams app / manifest ID:** `{{packageAppId}}` (preserve on Import app — do not create a new unrelated app){{/if}}
 {{#if entraIssuer}}- **Entra issuer (Trust source):** `{{{entraIssuer}}}`{{/if}}
 {{#if entraTenantId}}- **Tenant id:** `{{entraTenantId}}`{{/if}}
-{{#if entraEnterpriseAppId}}- **Enterprise app id (Keycloak):** `{{entraEnterpriseAppId}}`{{/if}}
+{{#if entraEnterpriseAppId}}- **Entra Client (application) ID (Keycloak enterprise app):** `{{entraEnterpriseAppId}}`{{/if}}
 
-After Save, copy the **Microsoft Entra SSO registration ID** (auth config id). That value is `--oauth-plugin-vault-reference-id`.
+After Save, copy the **Microsoft Entra SSO registration ID** (auth-config id). Pass that value as `--oauth-plugin-vault-reference-id` and re-run `channel add` so `ai-plugin.json` embeds `OAuthPluginVault.reference_id`.

package/templates/channels/microsoft-copilot/fi-fi.template.json.hbs

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://developer.microsoft.com/en-us/json-schemas/teams/v1.21/MicrosoftTeams.Localization.schema.json",
+  "name.short": "{{shortName}}",
+  "name.full": "{{fullName}}",
+  "description.short": "{{fiShortDescription}}",
+  "description.full": "{{fiFullDescription}}"
+}