@aifabrix/builder 2.53.0 → 2.54.1

package/templates/channels/claude/integration/rbac.json

@@ -0,0 +1,13 @@
+{
+  "roles": [
+    {
+      "name": "Everyone",
+      "value": "aifabrix-everyone",
+      "description": "Authenticated-user consume access for Enterprise LLM and platform search (not a Role Assistant)",
+      "groups": [
+        "AI-Fabrix-Everyone"
+      ]
+    }
+  ],
+  "permissions": []
+}

package/templates/channels/claude/manifest.template.json.hbs

@@ -0,0 +1,40 @@
+{
+  "channelTarget": "{{channelTarget}}",
+  "name": "{{appName}}",
+  "baseName": "{{baseName}}",
+  "description": "{{appDescription}}",
+  "environment": "{{environment}}",
+  "runtime": {
+    "runtimeSystemKey": "{{runtimeSystemKey}}",
+    "remoteMcpUrl": "{{{mcpUrl}}}",
+    "transport": "{{runtimeTransport}}",
+    "assistantCatalogUrl": "{{{assistantCatalogUrl}}}",
+    "roleAssistantResolution": "dynamic-runtime",
+    "layerBToolNames": [
+{{#each layerBToolNames}}
+      "{{this}}"{{#unless @last}},{{/unless}}
+{{/each}}
+    ]
+  },
+  "authentication": {
+    "mode": "{{runtimeAuthMode}}",
+    "credentialKey": "{{credentialKey}}",
+    "credentialPortalUrl": "{{{credentialPortalUrl}}}",
+    "scopes": {{{scopesJson}}}
+  },
+  "boundaries": {
+    "oneConnectionSupportsManyRoleAssistants": true,
+    "topLevelEvidenceToolsExposed": false,
+    "runtimeOwnsWorkInterface": true,
+    "evidenceCapabilityPath": "Claude -> runtime-orchestration -> Business Transformation Assistant -> internal evidence capabilities"
+  },
+  "lifecycle": {
+    "locallyValidated": true,
+    "runtimeValidated": false,
+    "requiresClaudeWorkspaceAdmin": true
+  },
+  "artifact": {
+    "format": "claude-custom-connector",
+    "version": "1.0.0"
+  }
+}

package/templates/channels/mcp-client/channel.json

@@ -0,0 +1,72 @@
+{
+  "key": "mcp-client",
+  "displayName": "MCP client",
+  "description": "Connect a developer MCP client such as Cursor, VS Code, or GitHub Copilot.",
+  "type": "custom",
+  "systemKind": "communication",
+  "enabled": true,
+  "authentication": {
+    "authType": "system"
+  },
+  "configuration": [
+    {
+      "name": "CHANNEL_APP_DESCRIPTION",
+      "value": "Enterprise AI assistant for employees. Approved assistants, enterprise knowledge, workflows, and governed actions via AI Fabrix.",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "textarea",
+        "label": "Description",
+        "placeholder": "Shown to people who connect this app",
+        "validation": {
+          "maxLength": 4000
+        }
+      }
+    }
+  ],
+  "dataSources": [],
+  "endpointsActive": false,
+  "channel": {
+    "definitionKey": "mcp-client",
+    "provisioning": {
+      "mode": "automatic"
+    },
+    "runtimeTarget": {
+      "defaultSystemKey": "runtime-orchestration",
+      "configurable": true
+    },
+    "experimental": false,
+    "profiles": [
+      {
+        "key": "cursor",
+        "displayLabel": "Cursor"
+      },
+      {
+        "key": "vscode",
+        "displayLabel": "VS Code"
+      },
+      {
+        "key": "github-copilot",
+        "displayLabel": "GitHub Copilot"
+      }
+    ],
+    "packaging": {
+      "channelType": "mcpClient",
+      "templateDir": "mcp-client",
+      "artifactFileName": "channel-mcp-client.json",
+      "artifactFormat": "json",
+      "credentialKey": "mcp-client-channel",
+      "capabilities": [
+        "chat",
+        "enterpriseActions"
+      ],
+      "displayLabel": "MCP client",
+      "category": "developer",
+      "wizardOrder": 35,
+      "remainingManualStep": "Reload the editor to pick up the MCP connection.",
+      "docsAnchor": "mcp-client",
+      "approvalRequired": false,
+      "vendorAuthRequired": true
+    }
+  }
+}

package/templates/channels/mcp-client/icon.svg

@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Model Context Protocol</title><path d="M13.85 0a4.16 4.16 0 0 0-2.95 1.217L1.456 10.66a.835.835 0 0 0 0 1.18.835.835 0 0 0 1.18 0l9.442-9.442a2.49 2.49 0 0 1 3.541 0 2.49 2.49 0 0 1 0 3.541L8.59 12.97l-.1.1a.835.835 0 0 0 0 1.18.835.835 0 0 0 1.18 0l.1-.098 7.03-7.034a2.49 2.49 0 0 1 3.542 0l.049.05a2.49 2.49 0 0 1 0 3.54l-8.54 8.54a1.96 1.96 0 0 0 0 2.755l1.753 1.753a.835.835 0 0 0 1.18 0 .835.835 0 0 0 0-1.18l-1.753-1.753a.266.266 0 0 1 0-.394l8.54-8.54a4.185 4.185 0 0 0 0-5.9l-.05-.05a4.16 4.16 0 0 0-2.95-1.218c-.2 0-.401.02-.6.048a4.17 4.17 0 0 0-1.17-3.552A4.16 4.16 0 0 0 13.85 0m0 3.333a.84.84 0 0 0-.59.245L6.275 10.56a4.186 4.186 0 0 0 0 5.902 4.186 4.186 0 0 0 5.902 0L19.16 9.48a.835.835 0 0 0 0-1.18.835.835 0 0 0-1.18 0l-6.985 6.984a2.49 2.49 0 0 1-3.54 0 2.49 2.49 0 0 1 0-3.54l6.983-6.985a.835.835 0 0 0 0-1.18.84.84 0 0 0-.59-.245"/></svg>

package/templates/channels/mcp-client/install.template.md.hbs

@@ -0,0 +1,24 @@
+# {{baseName}} — {{mcpClientDisplayName}}
+
+Status: {{#if installReady}}Ready{{else}}Not ready{{/if}}
+{{#unless installReady}}
+Reason: {{discoveryBlockerLabel}}
+
+Fix the Runtime connection, then run:
+
+aifabrix channel add mcp-client --target {{mcpClientProfileKey}} --name "{{baseName}}"
+{{/unless}}
+
+When ready:
+
+1. Confirm the editor MCP config includes the AI Fabrix server URL:
+   {{{mcpUrl}}}
+
+2. Authentication is OAuth with client id `{{oauth2ProfileId}}`.
+   Do not paste an API key.
+
+3. Reload the editor.
+
+4. Sign in with your user account when the editor starts OAuth.
+
+AI Fabrix validates Runtime and OAuth automatically. Remaining step: Reload the editor.

package/templates/channels/mcp-client/integration/README.md

@@ -0,0 +1,13 @@
+# MCP client
+
+Generated by `aifabrix channel scaffold mcp-client`.
+
+Recommended flow:
+
+```bash
+aifabrix channel add mcp-client --target cursor --name "Your Assistant" --probe
+```
+
+`channel add` scaffolds (if needed), uploads when missing (always with `--force`), then
+ensures the Integration Client and merges the Runtime MCP URL into the editor MCP config.
+Reload the editor and complete user OAuth there. Do not paste a static API key.

package/templates/channels/mcp-client/integration/application.json

@@ -0,0 +1,15 @@
+{
+  "app": {
+    "key": "mcp-client",
+    "displayName": "MCP client",
+    "description": "Connect a developer MCP client such as Cursor, VS Code, or GitHub Copilot.",
+    "type": "external"
+  },
+  "externalIntegration": {
+    "schemaBasePath": "./",
+    "systems": ["mcp-client-system.json"],
+    "dataSources": [],
+    "autopublish": true,
+    "version": "1.0.0"
+  }
+}

package/templates/channels/mcp-client/integration/env.template

@@ -0,0 +1,2 @@
+# MCP client
+# OAuth is the Integration Client on External Access — do not store API keys here.

package/templates/channels/mcp-client/integration/mcp-client-system.json

@@ -0,0 +1,72 @@
+{
+  "key": "mcp-client",
+  "displayName": "MCP client",
+  "description": "Connect a developer MCP client such as Cursor, VS Code, or GitHub Copilot.",
+  "type": "custom",
+  "systemKind": "communication",
+  "enabled": true,
+  "authentication": {
+    "authType": "system"
+  },
+  "configuration": [
+    {
+      "name": "CHANNEL_APP_DESCRIPTION",
+      "value": "Enterprise AI assistant for employees. Approved assistants, enterprise knowledge, workflows, and governed actions via AI Fabrix.",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "textarea",
+        "label": "Description",
+        "placeholder": "Shown to people who connect this app",
+        "validation": {
+          "maxLength": 4000
+        }
+      }
+    }
+  ],
+  "dataSources": [],
+  "endpointsActive": false,
+  "channel": {
+    "definitionKey": "mcp-client",
+    "provisioning": {
+      "mode": "automatic"
+    },
+    "runtimeTarget": {
+      "defaultSystemKey": "runtime-orchestration",
+      "configurable": true
+    },
+    "experimental": false,
+    "profiles": [
+      {
+        "key": "cursor",
+        "displayLabel": "Cursor"
+      },
+      {
+        "key": "vscode",
+        "displayLabel": "VS Code"
+      },
+      {
+        "key": "github-copilot",
+        "displayLabel": "GitHub Copilot"
+      }
+    ],
+    "packaging": {
+      "channelType": "mcpClient",
+      "templateDir": "mcp-client",
+      "artifactFileName": "channel-mcp-client.json",
+      "artifactFormat": "json",
+      "credentialKey": "mcp-client-channel",
+      "capabilities": [
+        "chat",
+        "enterpriseActions"
+      ],
+      "displayLabel": "MCP client",
+      "category": "developer",
+      "wizardOrder": 35,
+      "remainingManualStep": "Reload the editor to pick up the MCP connection.",
+      "docsAnchor": "mcp-client",
+      "approvalRequired": false,
+      "vendorAuthRequired": true
+    }
+  }
+}

package/templates/channels/mcp-client/integration/rbac.json

@@ -0,0 +1,13 @@
+{
+  "roles": [
+    {
+      "name": "Everyone",
+      "value": "aifabrix-everyone",
+      "description": "Authenticated-user consume access for Enterprise LLM and platform search (not a Role Assistant)",
+      "groups": [
+        "AI-Fabrix-Everyone"
+      ]
+    }
+  ],
+  "permissions": []
+}

package/templates/channels/mcp-client/manifest.template.json.hbs

@@ -0,0 +1,41 @@
+{
+  "channelTarget": "{{channelTarget}}",
+  "profile": "{{mcpClientProfileKey}}",
+  "name": "{{appName}}",
+  "baseName": "{{baseName}}",
+  "description": "{{appDescription}}",
+  "environment": "{{environment}}",
+  "runtime": {
+    "runtimeSystemKey": "{{runtimeSystemKey}}",
+    "remoteMcpUrl": "{{{mcpUrl}}}",
+    "transport": "{{runtimeTransport}}",
+    "assistantCatalogUrl": "{{{assistantCatalogUrl}}}",
+    "roleAssistantResolution": "dynamic-runtime",
+    "layerBToolNames": [
+{{#each layerBToolNames}}
+      "{{this}}"{{#unless @last}},{{/unless}}
+{{/each}}
+    ]
+  },
+  "authentication": {
+    "mode": "{{runtimeAuthMode}}",
+    "credentialKey": "{{credentialKey}}",
+    "oauth2ProfileId": "{{oauth2ProfileId}}",
+    "oauth2ProfilePath": "{{oauth2ProfilePath}}",
+    "scopes": {{{scopesJson}}}
+  },
+  "boundaries": {
+    "oneConnectionSupportsManyRoleAssistants": true,
+    "topLevelEvidenceToolsExposed": false,
+    "runtimeOwnsWorkInterface": true
+  },
+  "lifecycle": {
+    "locallyValidated": true,
+    "runtimeValidated": false,
+    "requiresEditorReload": true
+  },
+  "artifact": {
+    "format": "mcp-client",
+    "version": "1.0.0"
+  }
+}

package/templates/channels/mcp-client/profiles/cursor.json

@@ -0,0 +1,26 @@
+{
+  "key": "cursor",
+  "displayName": "Cursor",
+  "transport": "streamable-http",
+  "config": {
+    "scope": "user",
+    "relativePath": ".cursor/mcp.json",
+    "serversKey": "mcpServers",
+    "serverKey": "aifabrix"
+  },
+  "oauth": {
+    "integrationClientKey": "cursor",
+    "keycloakClientId": "miso-cursor",
+    "registrationMode": "predefinedClient",
+    "redirectUris": [
+      "http://localhost:8787/callback",
+      "https://www.cursor.com/agents/mcp/oauth/callback"
+    ]
+  },
+  "reload": {
+    "remainingStep": "Reload the editor."
+  },
+  "uninstall": {
+    "removeServerKeyOnly": true
+  }
+}

package/templates/channels/mcp-client/profiles/github-copilot.json

@@ -0,0 +1,29 @@
+{
+  "key": "github-copilot",
+  "displayName": "GitHub Copilot",
+  "transport": "streamable-http",
+  "config": {
+    "scope": "user",
+    "relativePath": "mcp.json",
+    "serversKey": "servers",
+    "serverKey": "aifabrix"
+  },
+  "oauth": {
+    "integrationClientKey": "vscode",
+    "keycloakClientId": "miso-vscode",
+    "registrationMode": "cimd",
+    "redirectUris": [
+      "https://vscode.dev/redirect",
+      "https://insiders.vscode.dev/redirect",
+      "http://127.0.0.1:33418",
+      "http://localhost:33418"
+    ],
+    "cimdDocumentHosts": ["vscode.dev", "insiders.vscode.dev"]
+  },
+  "reload": {
+    "remainingStep": "Reload the editor."
+  },
+  "uninstall": {
+    "removeServerKeyOnly": true
+  }
+}

package/templates/channels/mcp-client/profiles/vscode.json

@@ -0,0 +1,29 @@
+{
+  "key": "vscode",
+  "displayName": "VS Code",
+  "transport": "streamable-http",
+  "config": {
+    "scope": "user",
+    "relativePath": "mcp.json",
+    "serversKey": "servers",
+    "serverKey": "aifabrix"
+  },
+  "oauth": {
+    "integrationClientKey": "vscode",
+    "keycloakClientId": "miso-vscode",
+    "registrationMode": "cimd",
+    "redirectUris": [
+      "https://vscode.dev/redirect",
+      "https://insiders.vscode.dev/redirect",
+      "http://127.0.0.1:33418",
+      "http://localhost:33418"
+    ],
+    "cimdDocumentHosts": ["vscode.dev", "insiders.vscode.dev"]
+  },
+  "reload": {
+    "remainingStep": "Reload the editor."
+  },
+  "uninstall": {
+    "removeServerKeyOnly": true
+  }
+}

package/templates/channels/microsoft-copilot/channel.json

@@ -0,0 +1,73 @@
+{
+  "key": "microsoft-copilot",
+  "displayName": "Microsoft Copilot",
+  "description": "Publish a Microsoft Copilot package for Microsoft 365.",
+  "type": "custom",
+  "systemKind": "communication",
+  "enabled": true,
+  "authentication": {
+    "authType": "system"
+  },
+  "configuration": [
+    {
+      "name": "CHANNEL_APP_DESCRIPTION",
+      "value": "Enterprise AI assistant for employees. Approved assistants, enterprise knowledge, workflows, and governed actions via AI Fabrix.",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "textarea",
+        "label": "Description",
+        "placeholder": "Shown to people who connect this app",
+        "validation": {
+          "maxLength": 4000
+        }
+      }
+    },
+    {
+      "name": "CHANNEL_PACKAGE_VERSION",
+      "value": "1.0.0",
+      "location": "variable",
+      "required": false
+    },
+    {
+      "name": "CHANNEL_OAUTH_PLUGIN_VAULT_REFERENCE_ID",
+      "value": "",
+      "location": "variable",
+      "required": false
+    }
+  ],
+  "dataSources": [],
+  "endpointsActive": false,
+  "channel": {
+    "definitionKey": "microsoft-copilot",
+    "provisioning": {
+      "mode": "automatic"
+    },
+    "runtimeTarget": {
+      "defaultSystemKey": "runtime-orchestration",
+      "configurable": true
+    },
+    "experimental": false,
+    "profiles": [],
+    "packaging": {
+      "channelType": "microsoftCopilot",
+      "templateDir": "microsoft-copilot",
+      "artifactFileName": "channel-microsoft-copilot.json",
+      "artifactFormat": "json",
+      "credentialKey": "microsoft-copilot-channel",
+      "capabilities": [
+        "chat",
+        "notify",
+        "documentApproval",
+        "enterpriseActions"
+      ],
+      "displayLabel": "Microsoft Copilot",
+      "category": "employee-ai",
+      "wizardOrder": 10,
+      "remainingManualStep": "Publish the app in Microsoft 365.",
+      "docsAnchor": "microsoft-copilot",
+      "approvalRequired": true,
+      "vendorAuthRequired": true
+    }
+  }
+}

package/templates/channels/microsoft-copilot/declarative-agent.template.json.hbs

@@ -7,12 +7,16 @@
   "instructions": "Use governed enterprise work tools only. Resolve Role Assistants dynamically and keep business reasoning inside authorized Role Assistant boundaries.",
   "conversation_starters": [
     {
-      "title": "Show my role assistants",
-      "text": "List my available Role Assistants and what they can do."
+      "title": "v{{packageVersion}} — Role Assistants",
+      "text": "Package {{packageVersion}}: List my available Role Assistants and what they can do."
     },
     {
-      "title": "Start guided work",
-      "text": "Help me start work for my current business objective."
+      "title": "v{{packageVersion}} — Start work",
+      "text": "Package {{packageVersion}}: Help me start work for my current business objective."
+    },
+    {
+      "title": "v{{packageVersion}} — Confirm tools",
+      "text": "Package {{packageVersion}}: Call Runtime MCP and confirm which governed tools you can use for me."
     }
   ],
   "actions": [

package/templates/channels/microsoft-copilot/entra-sso-registration.template.md.hbs

@@ -1,12 +1,14 @@
-## Microsoft Entra SSO registration (Teams Developer Portal)
+## Microsoft auth-config (fallback / inspection)
 
-Direct URL:
+AI Fabrix normally creates this auth-config with **Microsoft 365 Agents Toolkit**. Use Teams Developer Portal only when Toolkit cannot complete the operation, or to inspect, restrict, or recover a registration.
+
+Fallback URL:
 
 {{{entraSsoRegistrationUrl}}}
 
-Open **Tools → Microsoft Entra SSO client ID registration → Register client ID** (or New).
+Open **Tools → Microsoft Entra SSO client ID registration → Register client ID** (or New) only for that fallback.
 
-Do this **before** organisation publish. The registration / auth-config ID becomes `--oauth-plugin-vault-reference-id`. It is **not** the Entra Client (application) ID.
+The registration / auth-config ID is **not** the Entra Client (application) ID.
 
 ### Values to paste into the form
 
@@ -19,6 +21,62 @@ Do this **before** organisation publish. The registration / auth-config ID becom
 | Client (application) ID | {{#if entraSsoClientId}}`{{entraSsoClientId}}`{{else}}*(missing — Entra SSO enterprise app (client) id from controller Keycloak status `entraIdentityProvider.enterpriseAppId`; complete Entra onboarding if empty)*{{/if}} |
 | Scope | {{#if entraSsoScope}}`{{entraSsoScope}}`{{else}}*(missing — set Runtime MCP delegated scopes on Trust source `microsoft-entra-id` `allowedScopes`; not openid/profile alone)*{{/if}} |
 
+After Save, Teams may **display** Application ID URI as `api://auth-{registrationId}/{clientId}`. Entra **onboarding already adds** `api://{clientId}` — keep that URI, and **also** add the Teams URI as a second `identifierUri` (required for Microsoft Enterprise token store / Copilot SSO).
+
+Package `manifest.json` `webApplicationInfo` stays on the **Azure / Trust** URI (`api://{clientId}`), not the Teams `api://auth-…` display string. Re-run `channel add --force` after registration so the vault `reference_id` is embedded.
+
+### Add Teams Application ID URI on the Entra app (az)
+
+Entra **onboarding already sets** the first URI: `api://{clientId}` (Trust / Azure Application ID URI). Do not remove it.
+
+**Channel add** merges the Teams URI automatically when Azure CLI is signed in with permission to update the app (it keeps every existing identifier URI and adds `api://auth-{registrationId}/{clientId}`). If that step is skipped (no Azure CLI in this environment, or the signed-in account cannot update the app), run Azure CLI yourself. `az ad app update --identifier-uris` replaces the full list, so existing URIs must be listed:
+
+{{#if entraSsoClientId}}
+{{#if entraSsoAuthConfigId}}
+```bash
+az ad app update --id "{{entraSsoClientId}}" \
+  --identifier-uris \
+    "api://{{entraSsoClientId}}" \
+    "api://auth-{{entraSsoAuthConfigId}}/{{entraSsoClientId}}"
+```
+
+Verify:
+
+```bash
+az ad app show --id "{{entraSsoClientId}}" --query identifierUris -o json
+```
+
+Expected URIs include:
+
+- `api://{{entraSsoClientId}}`
+- `api://auth-{{entraSsoAuthConfigId}}/{{entraSsoClientId}}`
+{{else}}
+```bash
+# Replace <REGISTRATION_ID> with the Teams Entra SSO auth-config id from Developer Portal
+az ad app update --id "{{entraSsoClientId}}" \
+  --identifier-uris \
+    "api://{{entraSsoClientId}}" \
+    "api://auth-<REGISTRATION_ID>/{{entraSsoClientId}}"
+```
+
+Verify:
+
+```bash
+az ad app show --id "{{entraSsoClientId}}" --query identifierUris -o json
+```
+{{/if}}
+{{else}}
+```bash
+# Replace <CLIENT_ID> and <REGISTRATION_ID> after Entra onboarding + Teams SSO registration
+az ad app update --id "<CLIENT_ID>" \
+  --identifier-uris \
+    "api://<CLIENT_ID>" \
+    "api://auth-<REGISTRATION_ID>/<CLIENT_ID>"
+```
+{{/if}}
+
+Do **not** remove `api://{clientId}`. Do **not** use only `api://auth-…` as the package `webApplicationInfo.resource`.
+
 ### Related (for your records)
 
 {{#if mcpUrl}}- **Remote MCP URL (package):** `{{{mcpUrl}}}`{{/if}}
@@ -26,5 +84,7 @@ Do this **before** organisation publish. The registration / auth-config ID becom
 {{#if entraIssuer}}- **Entra issuer (Trust source):** `{{{entraIssuer}}}`{{/if}}
 {{#if entraTenantId}}- **Tenant id:** `{{entraTenantId}}`{{/if}}
 {{#if entraEnterpriseAppId}}- **Entra Client (application) ID (Keycloak enterprise app):** `{{entraEnterpriseAppId}}`{{/if}}
+{{#if teamsApplicationIdUri}}- **Teams Application ID URI (channel add adds this when Azure CLI can update the app):** `{{{teamsApplicationIdUri}}}`{{/if}}
+{{#if azureApplicationIdUri}}- **Azure / Trust Application ID URI (keep):** `{{{azureApplicationIdUri}}}`{{/if}}
 
-After Save, copy the **Microsoft Entra SSO registration ID** (auth-config id). Pass that value as `--oauth-plugin-vault-reference-id` and re-run `channel add` so `ai-plugin.json` embeds `OAuthPluginVault.reference_id`.
+After Save, copy the **Microsoft Entra SSO registration ID** (auth-config id). Pass that value as `--oauth-plugin-vault-reference-id` and re-run `channel add` so `ai-plugin.json` embeds `OAuthPluginVault.reference_id`. Channel add also merges the Teams identifier URI when Azure CLI is available; otherwise run the **az** command above before testing Copilot tool discovery.

package/templates/channels/microsoft-copilot/icon.svg

@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>GitHub Copilot</title><path d="M23.922 16.997C23.061 18.492 18.063 22.02 12 22.02 5.937 22.02.939 18.492.078 16.997A.641.641 0 0 1 0 16.741v-2.869a.883.883 0 0 1 .053-.22c.372-.935 1.347-2.292 2.605-2.656.167-.429.414-1.055.644-1.517a10.098 10.098 0 0 1-.052-1.086c0-1.331.282-2.499 1.132-3.368.397-.406.89-.717 1.474-.952C7.255 2.937 9.248 1.98 11.978 1.98c2.731 0 4.767.957 6.166 2.093.584.235 1.077.546 1.474.952.85.869 1.132 2.037 1.132 3.368 0 .368-.014.733-.052 1.086.23.462.477 1.088.644 1.517 1.258.364 2.233 1.721 2.605 2.656a.841.841 0 0 1 .053.22v2.869a.641.641 0 0 1-.078.256Zm-11.75-5.992h-.344a4.359 4.359 0 0 1-.355.508c-.77.947-1.918 1.492-3.508 1.492-1.725 0-2.989-.359-3.782-1.259a2.137 2.137 0 0 1-.085-.104L4 11.746v6.585c1.435.779 4.514 2.179 8 2.179 3.486 0 6.565-1.4 8-2.179v-6.585l-.098-.104s-.033.045-.085.104c-.793.9-2.057 1.259-3.782 1.259-1.59 0-2.738-.545-3.508-1.492a4.359 4.359 0 0 1-.355-.508Zm2.328 3.25c.549 0 1 .451 1 1v2c0 .549-.451 1-1 1-.549 0-1-.451-1-1v-2c0-.549.451-1 1-1Zm-5 0c.549 0 1 .451 1 1v2c0 .549-.451 1-1 1-.549 0-1-.451-1-1v-2c0-.549.451-1 1-1Zm3.313-6.185c.136 1.057.403 1.913.878 2.497.442.544 1.134.938 2.344.938 1.573 0 2.292-.337 2.657-.751.384-.435.558-1.15.558-2.361 0-1.14-.243-1.847-.705-2.319-.477-.488-1.319-.862-2.824-1.025-1.487-.161-2.192.138-2.533.529-.269.307-.437.808-.438 1.578v.021c0 .265.021.562.063.893Zm-1.626 0c.042-.331.063-.628.063-.894v-.02c-.001-.77-.169-1.271-.438-1.578-.341-.391-1.046-.69-2.533-.529-1.505.163-2.347.537-2.824 1.025-.462.472-.705 1.179-.705 2.319 0 1.211.175 1.926.558 2.361.365.414 1.084.751 2.657.751 1.21 0 1.902-.394 2.344-.938.475-.584.742-1.44.878-2.497Z"/></svg>

package/templates/channels/microsoft-copilot/install.template.md.hbs

@@ -24,21 +24,21 @@ dist/channels/microsoft-copilot/build/appPackage.{{environment}}.zip
 | **Teams Developer Portal app** | Package definition (`manifest.json.id`) and organisation publish request. | Teams app / manifest ID |
 | **Teams admin centre catalogue** | Approval, availability, policy, published state. | Catalogue entry after org publish |
 
-`--oauth-plugin-vault-reference-id` is the **Teams Entra SSO registration / auth-config ID** from Developer Portal Tools → Microsoft Entra SSO. It is **not** the Entra Client (application) ID and **not** a client secret.
+`--oauth-plugin-vault-reference-id` is the **Microsoft auth-config ID** that Microsoft 365 Agents Toolkit (`atk` / `oauth/register`) writes into `OAuthPluginVault.reference_id`. It is **not** the Entra Client (application) ID and **not** a client secret. That CLI registration is stored in Microsoft’s token store; it often **does not** appear as a Teams Developer Portal “Entra SSO registration” you can browse. Teams Developer Portal is fallback, inspection, or recovery only.
 
 Do **not** configure AI Fabrix OAuth client secrets under Connected Systems → Authentication for this Entra SSO flow.
 
 ## Package prerequisites (before Import)
 
-1. Generate the channel package with `aifabrix channel add microsoft-copilot`.
-2. Configure Microsoft Entra SSO: **Tools → Microsoft Entra SSO client ID registration** (see table below). Copy the generated registration / auth-config ID.
-3. Re-run packaging so `ai-plugin.json` gets `auth.type = OAuthPluginVault` and `auth.reference_id = <auth-config-id>`:
+1. Run `aifabrix channel add microsoft-copilot` (or continue from the portal). Sign in with Microsoft when asked so Agents Toolkit can create or reuse the auth-config.
+2. Toolkit captures the auth-config ID and Application ID URI, then embeds `auth.type = OAuthPluginVault` and `auth.reference_id` in `ai-plugin.json`.
+3. Use `--oauth-plugin-vault-reference-id` only when Toolkit cannot create the id (fallback / recovery):
 
 ```bash
-aifabrix channel add microsoft-copilot --name "{{baseName}}" --oauth-plugin-vault-reference-id "<auth-config-id>"
+aifabrix channel add microsoft-copilot --name "{{appName}}" --oauth-plugin-vault-reference-id "<auth-config-id>"
 ```
 
-Keep any `webApplicationInfo` the portal binds for Entra SSO — do not strip it on re-import.
+Keep package `webApplicationInfo` aligned with the **Azure** Application ID URI (`api://{clientId}` / Trust audience). Do not replace it with the Teams portal display URI `api://auth-…` on re-import.
 
 Upload **only** the ZIP package. Do not upload individual source files or `channel-microsoft-copilot.json`.
 
@@ -49,11 +49,11 @@ Upload **only** the ZIP package. Do not upload individual source files or `chann
 3. Developer Portal → selected app → **Publish to your org** → Distribute / submit.
 4. Teams admin approves in [Teams admin centre → Manage apps](https://admin.teams.microsoft.com/policies/manage-apps) (Manage apps → search → allow). Expect **Published** / **Unblocked** per organisation policy. Allow several minutes for propagation.
 5. Open **Teams** → **Apps** (**Built for your org**), click **{{appName}}**, **Add** the application, then choose **Open with Copilot**.
-6. In Copilot, click **Show my role assistants** and run the command.
+6. In Copilot, click a starter titled like **vX.Y.Z — Role Assistants** (package version in the title) and run it.
 7. Confirm Runtime MCP and governed tools using this guide, then re-run with `--probe` after organisation publish:
 
 ```bash
-aifabrix channel add {{channelTarget}} --name "{{baseName}}" --oauth-plugin-vault-reference-id "{{{oauthPluginVaultReferenceId}}}" --probe
+aifabrix channel add {{channelTarget}} --name "{{appName}}" --oauth-plugin-vault-reference-id "{{{oauthPluginVaultReferenceId}}}" --probe
 ```
 
 8. After the app is available under **Built for your org**, re-run:
@@ -119,7 +119,7 @@ Use this when replacing the app, cleaning a failed publish, or removing **{{appN
 2. Search for **{{appName}}**, open the app, open the action menu, choose **Delete**, and confirm.
 3. Open [Teams Developer Portal → Apps](https://dev.teams.microsoft.com/apps).
 4. Find the app in the list, open **…** (Actions) → **Delete**, and confirm by typing the app name.
-5. Open [Microsoft Entra SSO client ID registration](https://dev.teams.microsoft.com/tools/entra-configuration).
+5. Open [Teams Developer Portal → Microsoft Entra SSO client ID registration](https://dev.teams.microsoft.com/tools/entra-configuration).
 6. Find the registration for this channel (same registration / auth-config used as `--oauth-plugin-vault-reference-id`), open **…** (Actions) → **Delete**, and confirm.
 
 After Microsoft cleanup, delete local package output if needed (`dist/channels/microsoft-copilot/`) and re-run `aifabrix channel add` with a **new** Entra SSO registration / auth-config ID. Do not reuse a deleted registration id.