@aifabrix/builder 2.53.0 → 2.54.1

package/templates/channels/slack/integration/slack-system.json

@@ -1,9 +1,8 @@
 {
   "key": "slack",
-  "displayName": "Slack communication channel",
-  "description": "Slack communication channel — Role Assistants (workforce) and document approval workflows",
+  "displayName": "Slack",
+  "description": "Chat with Role Assistants, send notifications, and review documents in Slack.",
   "type": "custom",
-  "systemKind": "communication",
   "enabled": true,
   "authentication": {
     "authType": "credential",
@@ -27,118 +26,197 @@
         "clientSecret": "kv://slack/clientSecret"
       },
       "formFields": [
-        { "name": "signingSecret", "required": true },
+        {
+          "name": "signingSecret",
+          "required": true,
+          "label": "Signing secret"
+        },
         {
           "name": "botToken",
           "required": true,
-          "label": "Bot User OAuth Token (xoxb-)",
+          "label": "Bot user OAuth token",
           "placeholder": "xoxb-…"
         },
-        { "name": "clientSecret", "required": false }
+        {
+          "name": "clientSecret",
+          "required": false,
+          "label": "Client secret"
+        }
       ]
     }
   },
+  "authentications": [
+    {
+      "key": "default",
+      "usage": "api",
+      "authType": "credential",
+      "credential": {
+        "credentialKey": "slack-app",
+        "displayName": "Slack App",
+        "method": "hmac",
+        "writeOnce": true,
+        "variables": {
+          "algorithm": "sha256",
+          "signatureHeader": "X-Slack-Signature",
+          "timestampHeader": "X-Slack-Request-Timestamp",
+          "signaturePrefix": "v0=",
+          "timestampMaxAge": "300",
+          "baseUrl": "https://slack.com",
+          "testEndpoint": "https://slack.com/api/auth.test"
+        },
+        "security": {
+          "signingSecret": "kv://slack/signingSecret",
+          "botToken": "kv://slack/botToken",
+          "clientSecret": "kv://slack/clientSecret"
+        },
+        "formFields": [
+          {
+            "name": "signingSecret",
+            "required": true,
+            "label": "Signing secret"
+          },
+          {
+            "name": "botToken",
+            "required": true,
+            "label": "Bot user OAuth token",
+            "placeholder": "xoxb-…"
+          },
+          {
+            "name": "clientSecret",
+            "required": false,
+            "label": "Client secret"
+          }
+        ]
+      }
+    },
+    {
+      "key": "webhookInbound",
+      "usage": "webhookInbound",
+      "authType": "credential",
+      "credential": {
+        "credentialKey": "slack-app",
+        "displayName": "Slack inbound webhook",
+        "method": "hmac",
+        "writeOnce": true,
+        "variables": {
+          "algorithm": "sha256",
+          "signatureHeader": "X-Slack-Signature",
+          "timestampHeader": "X-Slack-Request-Timestamp",
+          "signaturePrefix": "v0=",
+          "timestampMaxAge": "300"
+        },
+        "security": {
+          "signingSecret": "kv://slack/signingSecret"
+        },
+        "formFields": [
+          {
+            "name": "signingSecret",
+            "required": true,
+            "label": "Signing secret"
+          }
+        ]
+      }
+    }
+  ],
   "configuration": [
     {
-      "name": "ENABLE_PROACTIVE_MESSAGING",
-      "value": "true",
+      "name": "CHANNEL_APP_DESCRIPTION",
+      "value": "Enterprise AI assistant for employees. Approved assistants, enterprise knowledge, workflows, and governed actions via AI Fabrix.",
       "location": "variable",
       "required": false,
       "portalInput": {
-        "field": "select",
-        "label": "Enable proactive messaging",
-        "options": ["true", "false"]
+        "field": "textarea",
+        "label": "Description",
+        "placeholder": "Shown to people who connect this app",
+        "validation": {
+          "maxLength": 4000
+        }
       }
     },
     {
-      "name": "ENABLE_CHANNEL_NOTIFICATIONS",
-      "value": "true",
+      "name": "CHANNEL_COMMAND_PREFIX",
+      "value": "af",
       "location": "variable",
       "required": false,
       "portalInput": {
-        "field": "select",
-        "label": "Enable channel notifications",
-        "options": ["true", "false"]
+        "field": "text",
+        "label": "Slash command prefix",
+        "placeholder": "Letters and numbers, for example af",
+        "validation": {
+          "pattern": "^[a-z][a-z0-9]{0,15}$"
+        }
       }
     },
+    {
+      "name": "ENABLE_PROACTIVE_MESSAGING",
+      "value": "true",
+      "location": "variable",
+      "required": false
+    },
+    {
+      "name": "ENABLE_CHANNEL_NOTIFICATIONS",
+      "value": "true",
+      "location": "variable",
+      "required": false
+    },
     {
       "name": "ENABLE_DIRECT_MESSAGES",
       "value": "true",
       "location": "variable",
-      "required": false,
-      "portalInput": {
-        "field": "select",
-        "label": "Enable direct messages",
-        "options": ["true", "false"]
-      }
+      "required": false
     },
     {
       "name": "ENABLE_MODALS",
       "value": "true",
       "location": "variable",
-      "required": false,
-      "portalInput": {
-        "field": "select",
-        "label": "Enable modals",
-        "options": ["true", "false"]
-      }
+      "required": false
     },
     {
       "name": "ENABLE_SHORTCUTS",
       "value": "true",
       "location": "variable",
-      "required": false,
-      "portalInput": {
-        "field": "select",
-        "label": "Enable shortcuts",
-        "options": ["true", "false"]
-      }
+      "required": false
     }
   ],
-  "dataSources": ["slack-messages", "slack-conversations"],
-  "endpoints": [
-    {
-      "type": "commands",
-      "path": "/commands",
-      "router": "slack_commands_router",
-      "description": "Slack slash commands endpoint",
-      "active": true
-    },
-    {
-      "type": "events",
-      "path": "/events",
-      "router": "slack_events_router",
-      "description": "Slack Events API endpoint",
-      "active": true
-    },
-    {
-      "type": "interactive",
-      "path": "/interactive",
-      "router": "slack_interactive_router",
-      "description": "Slack interactive components endpoint",
-      "active": true
-    },
-    {
-      "type": "notifications",
-      "path": "/notifications",
-      "router": "slack_notifications_router",
-      "description": "Proactive notification endpoint",
-      "active": true
+  "dataSources": [
+    "slack-interactive",
+    "slack-commands",
+    "slack-events",
+    "slack-conversations",
+    "slack-messages"
+  ],
+  "endpoints": [],
+  "endpointsActive": true,
+  "systemKind": "communication",
+  "channel": {
+    "definitionKey": "slack",
+    "provisioning": {
+      "mode": "automatic"
     },
-    {
-      "type": "config",
-      "path": "/bot-config",
-      "router": "slack_config_router",
-      "description": "Slack bot configuration endpoint",
-      "active": true
+    "runtimeTarget": {
+      "defaultSystemKey": "runtime-orchestration",
+      "configurable": true
     },
-    {
-      "type": "documents",
-      "path": "/documents",
-      "router": "slack_documents_router",
-      "description": "Slack document review endpoint",
-      "active": true
+    "experimental": false,
+    "profiles": [],
+    "packaging": {
+      "channelType": "slack",
+      "templateDir": "slack",
+      "artifactFileName": "channel-slack.json",
+      "artifactFormat": "json",
+      "credentialKey": "slack-app",
+      "capabilities": [
+        "chat",
+        "notify",
+        "documentApproval"
+      ],
+      "displayLabel": "Slack",
+      "category": "communication",
+      "wizardOrder": 40,
+      "remainingManualStep": "Workspace admin approval if Slack asks.",
+      "docsAnchor": "slack",
+      "approvalRequired": true,
+      "vendorAuthRequired": true
     }
-  ],
-  "endpointsActive": true
+  }
 }

package/templates/channels/slack/manifest.template.json.hbs

@@ -2,11 +2,12 @@
   "display_information": {
     "name": "{{appName}}",
     "description": "{{appDescription}}",
+    "long_description": {{{appLongDescriptionJson}}},
     "background_color": "#0F172A"
   },
   "features": {
     "app_home": {
-      "home_tab_enabled": true,
+      "home_tab_enabled": false,
       "messages_tab_enabled": true,
       "messages_tab_read_only_enabled": false
     },
@@ -51,7 +52,9 @@
         "commands",
         "im:history",
         "im:read",
-        "im:write"
+        "im:write",
+        "users:read",
+        "users:read.email"
       ]
     },
     "pkce_enabled": false

package/templates/channels/teams-bot/channel.json

@@ -0,0 +1,161 @@
+{
+  "key": "teams-bot",
+  "displayName": "Microsoft Teams",
+  "description": "Chat with Role Assistants, send notifications, and review documents in Microsoft Teams.",
+  "type": "custom",
+  "systemKind": "communication",
+  "enabled": true,
+  "authentication": {
+    "authType": "credential",
+    "credential": {
+      "credentialKey": "teams-bot",
+      "displayName": "Microsoft Teams assistant bot",
+      "method": "oidc",
+      "writeOnce": true,
+      "variables": {
+        "openIdConfigUrl": "https://login.botframework.com/v1/.well-known/openid_configuration",
+        "expectedIssuer": "https://api.botframework.com",
+        "algorithms": "RS256",
+        "validateSignature": "true"
+      },
+      "security": {
+        "clientId": "kv://teams-bot/botAppId"
+      },
+      "formFields": [
+        {
+          "name": "clientId",
+          "required": true,
+          "label": "Bot application ID"
+        }
+      ]
+    }
+  },
+  "authentications": [
+    {
+      "key": "default",
+      "usage": "api",
+      "authType": "credential",
+      "credential": {
+        "credentialKey": "teams-bot",
+        "displayName": "Microsoft Teams assistant bot",
+        "method": "oidc",
+        "writeOnce": true,
+        "variables": {
+          "openIdConfigUrl": "https://login.botframework.com/v1/.well-known/openid_configuration",
+          "expectedIssuer": "https://api.botframework.com",
+          "algorithms": "RS256",
+          "validateSignature": "true"
+        },
+        "security": {
+          "clientId": "kv://teams-bot/botAppId"
+        },
+        "formFields": [
+          {
+            "name": "clientId",
+            "required": true,
+            "label": "Bot application ID"
+          }
+        ]
+      }
+    },
+    {
+      "key": "webhookInbound",
+      "usage": "webhookInbound",
+      "authType": "credential",
+      "credential": {
+        "credentialKey": "teams-bot",
+        "displayName": "Microsoft Teams inbound webhook",
+        "method": "oidc",
+        "writeOnce": true,
+        "variables": {
+          "openIdConfigUrl": "https://login.botframework.com/v1/.well-known/openid_configuration",
+          "expectedIssuer": "https://api.botframework.com",
+          "algorithms": "RS256",
+          "validateSignature": "true"
+        },
+        "security": {
+          "clientId": "kv://teams-bot/botAppId"
+        },
+        "formFields": [
+          {
+            "name": "clientId",
+            "required": true,
+            "label": "Bot application ID"
+          }
+        ]
+      }
+    }
+  ],
+  "configuration": [
+    {
+      "name": "CHANNEL_APP_DESCRIPTION",
+      "value": "Enterprise AI assistant for employees. Approved assistants, enterprise knowledge, workflows, and governed actions via AI Fabrix.",
+      "location": "variable",
+      "required": false,
+      "portalInput": {
+        "field": "textarea",
+        "label": "Description",
+        "placeholder": "Shown to people who connect this app",
+        "validation": {
+          "maxLength": 4000
+        }
+      }
+    }
+  ],
+  "dataSources": [
+    "teams-bot-activities"
+  ],
+  "endpoints": [],
+  "endpointsActive": true,
+  "roles": [
+    {
+      "name": "Everyone",
+      "value": "aifabrix-everyone",
+      "description": "Authenticated-user consume access for Enterprise LLM and platform search (not a Role Assistant)",
+      "groups": [
+        "AI-Fabrix-Everyone"
+      ]
+    }
+  ],
+  "permissions": [
+    {
+      "name": "teams-bot-activities:create",
+      "roles": [
+        "aifabrix-everyone"
+      ],
+      "description": "Permission: teams-bot-activities:create"
+    }
+  ],
+  "channel": {
+    "definitionKey": "teams-bot",
+    "provisioning": {
+      "mode": "automatic"
+    },
+    "runtimeTarget": {
+      "defaultSystemKey": "runtime-orchestration",
+      "configurable": true
+    },
+    "experimental": false,
+    "maxInstances": 1,
+    "profiles": [],
+    "packaging": {
+      "channelType": "teamsBot",
+      "templateDir": "teams-bot",
+      "artifactFileName": "channel-teams-bot.json",
+      "artifactFormat": "json",
+      "credentialKey": "teams-bot",
+      "capabilities": [
+        "chat",
+        "notify",
+        "documentApproval"
+      ],
+      "displayLabel": "Microsoft Teams",
+      "category": "communication",
+      "wizardOrder": 20,
+      "remainingManualStep": "Approve custom app upload or organization publish if your tenant requires it.",
+      "docsAnchor": "teams-bot",
+      "approvalRequired": true,
+      "vendorAuthRequired": true
+    }
+  }
+}

package/templates/channels/teams-bot/icon.svg

@@ -0,0 +1 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Microsoft Teams</title><path d="M20.625 8.127q-.55 0-1.025-.205-.475-.205-.832-.563-.358-.357-.563-.832Q18 6.053 18 5.502q0-.54.205-1.02t.563-.837q.357-.358.832-.563.474-.205 1.025-.205.54 0 1.02.205t.837.563q.358.357.563.837.205.48.205 1.02 0 .55-.205 1.025-.205.475-.563.832-.357.358-.837.563-.48.205-1.02.205zm0-3.75q-.469 0-.797.328-.328.328-.328.797 0 .469.328.797.328.328.797.328.469 0 .797-.328.328-.328.328-.797 0-.469-.328-.797-.328-.328-.797-.328zM24 10.002v5.578q0 .774-.293 1.46-.293.685-.803 1.194-.51.51-1.195.803-.686.293-1.459.293-.445 0-.908-.105-.463-.106-.85-.329-.293.95-.855 1.729-.563.78-1.319 1.336-.756.557-1.67.861-.914.305-1.898.305-1.148 0-2.162-.398-1.014-.399-1.805-1.102-.79-.703-1.312-1.664t-.674-2.086h-5.8q-.411 0-.704-.293T0 16.881V6.873q0-.41.293-.703t.703-.293h8.59q-.34-.715-.34-1.5 0-.727.275-1.365.276-.639.75-1.114.475-.474 1.114-.75.638-.275 1.365-.275t1.365.275q.639.276 1.114.75.474.475.75 1.114.275.638.275 1.365t-.275 1.365q-.276.639-.75 1.113-.475.475-1.114.75-.638.276-1.365.276-.188 0-.375-.024-.188-.023-.375-.058v1.078h10.875q.469 0 .797.328.328.328.328.797zM12.75 2.373q-.41 0-.78.158-.368.158-.638.434-.27.275-.428.639-.158.363-.158.773 0 .41.158.78.159.368.428.638.27.27.639.428.369.158.779.158.41 0 .773-.158.364-.159.64-.428.274-.27.433-.639.158-.369.158-.779 0-.41-.158-.773-.159-.364-.434-.64-.275-.275-.639-.433-.363-.158-.773-.158zM6.937 9.814h2.25V7.94H2.814v1.875h2.25v6h1.875zm10.313 7.313v-6.75H12v6.504q0 .41-.293.703t-.703.293H8.309q.152.809.556 1.5.405.691.985 1.19.58.497 1.318.779.738.281 1.582.281.926 0 1.746-.352.82-.351 1.436-.966.615-.616.966-1.43.352-.815.352-1.752zm5.25-1.547v-5.203h-3.75v6.855q.305.305.691.452.387.146.809.146.469 0 .879-.176.41-.175.715-.48.304-.305.48-.715t.176-.879Z"/></svg>

package/templates/channels/teams-bot/install.template.md.hbs

@@ -1,25 +1,24 @@
-# {{appName}} — Microsoft Teams communication channel install
+# {{appName}} — Microsoft Teams install
 
 {{appDescription}}
 
 Environment: **{{environment}}** · Credential key: `{{credentialKey}}`
 
-One Teams bot delivers **Role Assistant** chat **and** **document approval** (plan 455.2).
+One Teams bot delivers **Role Assistant** chat **and** document approval.
 
-## Register the Teams bot (tenant admin)
+`aifabrix channel add teams-bot` provisions an **Azure-managed** bot around the existing AI Fabrix messaging endpoint. It does not scaffold a Teams SDK bot.
 
-1. Open the [Teams Developer Portal](https://dev.teams.microsoft.com/) as a Teams tenant admin.
-2. Create a new app or **Import an existing app** using the Bot Framework manifest JSON from `dist/channels/teams-bot/channel-teams-bot.json` (same folder as this file).
-3. Set the **Bot messaging endpoint** to the **Bot messages** URL below (your dataplane `/messages` route).
-4. In [Azure Portal](https://portal.azure.com/), register or open the **Azure Bot** resource and copy the **Microsoft App ID**.
-5. In Microsoft Entra, create a **client secret** (or upload a certificate) for the bot app registration.
-6. Enable the **Microsoft Teams** channel on the Azure Bot resource.
-7. Save the **Microsoft App ID** and **client secret** in AI Fabrix: [Authentication settings]({{credentialPortalUrl}})
-8. Publish the app to your organization (or sideload for lab) and complete tenant admin approval if prompted.
+## Remaining Microsoft steps
+
+1. Open [Teams](https://teams.microsoft.com) and install the generated package if sideloading is allowed.
+2. Approve custom app upload or organization publish if your tenant requires it.
+3. If upload is restricted, approve in [Teams admin centre → Manage apps](https://admin.teams.microsoft.com/policies/manage-apps).
+
+Bot App ID and client secret are stored in AI Fabrix (`kv://teams-bot/…`). Do not paste secrets into this file.
 
 ## Platform callback URLs
 
-Configure these on the Azure Bot / Teams app registration. Do not embed secrets in generated files — use AI Fabrix credential storage only.
+These URLs are already configured on the Azure-managed bot when provision succeeds. Public HTTPS only.
 
 {{#if messagesUrl}}
 - **Bot messages:** {{messagesUrl}}
@@ -54,7 +53,7 @@ Runtime lists **assistants** available to each user from:
 
 {{assistantCatalogUrl}}
 
-## After Teams admin approval
+## After tenant policy approval
 
 ```bash
 aifabrix channel add {{channelTarget}} --name "{{baseName}}"

package/templates/channels/teams-bot/integration/README.md

@@ -1,16 +1,17 @@
-# teams-bot communication channel (lab fixture)
+# Microsoft Teams
 
-SSOT for Teams Bot Framework communication channel — **Role Assistants** and **document approval** on one bot (plan 455.2). Published to builder via `make sync-json`.
+SSOT for Microsoft Teams — **Role Assistants** and **document approval** on one bot. Edit this tree in `aifabrix-builder/templates/channels/teams-bot/`.
 
 ## Surfaces
 
-- **Workforce:** DMs, activation cards, task offers (Bot Framework `/messages`)
+- **Role Assistants:** DMs, activation cards, task offers (`POST /api/v1/webhooks/teams-bot/teams-bot-activities`)
 - **Document approval:** `documents`, `document`, `approve`, `help` bot commands; review Adaptive Cards; proactive `/notifications`
+- **Inbound python CIP:** `teams-bot-activities` via webhookInbound OIDC so Execution logs include inbound
 
 ```bash
 aifabrix channel add teams-bot --name "Your Assistant" --probe
 ```
 
-Optional low-level (dataplane fixture tree): `validate` / `upload` / `deploy` before add.
+Optional low-level: `channel scaffold` / `upload` from a workspace that has the package.
 
 Authentication: oidc — prefilled discovery settings; operators add Microsoft App ID + client secret on Connected Systems → Authentication.

package/templates/channels/teams-bot/integration/application.json

@@ -1,8 +1,8 @@
 {
   "app": {
     "key": "teams-bot",
-    "displayName": "teams-bot assistant channel",
-    "description": "Assistant communication channel — upload then channel add",
+    "displayName": "Microsoft Teams",
+    "description": "Chat with Role Assistants, send notifications, and review documents in Microsoft Teams.",
     "type": "external"
   },
   "externalIntegration": {
@@ -10,8 +10,10 @@
     "systems": [
       "teams-bot-system.json"
     ],
-    "dataSources": [],
+    "dataSources": [
+      "teams-bot-datasource-activities.json"
+    ],
     "autopublish": true,
     "version": "1.0.0"
   }
-}
+}

package/templates/channels/teams-bot/integration/env.template

@@ -1,5 +1,6 @@
-# teams-bot assistant channel — lab fixture secrets
-# Microsoft App ID (JWT audience / Bot Framework app registration)
+# Microsoft Teams assistant bot
+# Bot App ID is written by `aifabrix channel add teams-bot` via secret set
+# when Azure-managed Teams app create returns it. Do not require it here:
+# missing botAppId must not block publishing the communication system.
 # aifabrix secret set teams-bot/botAppId "<app-id>" --shared
-
-KV_TEAMS_BOT_BOTAPPID=kv://teams-bot/botAppId
+# KV_TEAMS_BOT_BOTAPPID=kv://teams-bot/botAppId

package/templates/channels/teams-bot/integration/openapi/openapi.json

@@ -0,0 +1,68 @@
+{
+  "openapi": "3.0.3",
+  "info": {
+    "title": "Teams-bot inbound python CIP",
+    "version": "1.0.0",
+    "description": "Contract surface for Teams-bot inbound python CIP. Vendor Request URL is POST /api/v1/webhooks/teams-bot/teams-bot-activities; this path is a CIP operation id."
+  },
+  "paths": {
+    "/inbound/activities": {
+      "post": {
+        "operationId": "teamsBotActivitiesCreate",
+        "summary": "Accept an inbound Bot Framework activity",
+        "x-aifabrix-capability": "create",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ChannelInboundCreateRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Inbound handler record",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ChannelInboundCreateResponse"
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "schemas": {
+      "ChannelInboundCreateRequest": {
+        "type": "object",
+        "description": "CIP create body. payload is the Bot Framework activity after OIDC validation.",
+        "properties": {
+          "payload": {
+            "type": "object",
+            "additionalProperties": true
+          }
+        }
+      },
+      "ChannelInboundCreateResponse": {
+        "type": "object",
+        "description": "Normalized inbound handler record for fieldMappings.",
+        "required": ["channel", "action", "outcome"],
+        "properties": {
+          "channel": { "type": "string" },
+          "action": { "type": "string" },
+          "outcome": { "type": "string" },
+          "externalId": { "type": "string" },
+          "response": {
+            "type": "object",
+            "additionalProperties": true
+          }
+        }
+      }
+    }
+  }
+}