@aifabrix/builder 2.53.1 → 2.55.0

package/lib/channels/microsoft-copilot-entra-sso-form.js

@@ -26,7 +26,7 @@ function extractTenantIdFromIssuer(issuer) {
     return null;
   }
   const match = issuer.match(
-    /login\.microsoftonline\.com\/([0-9a-fA-F-]{36})(?:\/|$)/i
+    /login\.microsoft(?:online)?\.com\/([0-9a-fA-F-]{36})(?:\/|$)/i
   );
   return match ? match[1] : null;
 }
@@ -136,8 +136,37 @@ function trimNonEmptyString(value) {
 }
 
 /**
- * Teams Entra SSO Application ID URI: api://auth-{authConfigId}/{clientId}.
- * Only when oauthPluginVaultReferenceId is a GUID (Teams auth-config id).
+ * Teams Entra SSO auth-config id from vault reference_id.
+ * Accepts a bare GUID or opaque base64 `tenantId##authConfigId` (Developer Portal).
+ * @param {string|null|undefined} referenceId
+ * @returns {string|null}
+ */
+function parseOauthPluginVaultAuthConfigId(referenceId) {
+  const raw = trimNonEmptyString(referenceId);
+  if (!raw) {
+    return null;
+  }
+  if (TEAMS_AUTH_CONFIG_GUID.test(raw)) {
+    return raw;
+  }
+  try {
+    const decoded = Buffer.from(raw, 'base64').toString('utf8');
+    const parts = decoded.split('##');
+    if (
+      parts.length === 2 &&
+      TEAMS_AUTH_CONFIG_GUID.test(parts[0]) &&
+      TEAMS_AUTH_CONFIG_GUID.test(parts[1])
+    ) {
+      return parts[1];
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+
+/**
+ * Teams Application ID URI: api://auth-{authConfigId}/{clientId}.
  * @param {string|null} authConfigId
  * @param {string|null} clientId
  * @returns {string|null}
@@ -151,6 +180,24 @@ function buildTeamsWebApplicationInfoResource(authConfigId, clientId) {
   return `api://auth-${configId}/${appId}`;
 }
 
+/**
+ * Prefer Trust Application ID URI (audience), else api://{clientId}.
+ * @param {string|null} clientId
+ * @param {string|null|undefined} audience
+ * @returns {string|null}
+ */
+function buildApplicationIdUriResource(clientId, audience) {
+  const appId = trimNonEmptyString(clientId);
+  const aud = trimNonEmptyString(audience).replace(/\/$/, '');
+  if (aud.startsWith('api://')) {
+    return aud.endsWith('/invoke') ? aud.slice(0, -'/invoke'.length) : aud;
+  }
+  if (appId) {
+    return `api://${appId}`;
+  }
+  return null;
+}
+
 /**
  * @param {Object} resolved
  * @returns {string|null}
@@ -163,30 +210,69 @@ function resolveWebApplicationClientId(resolved) {
   );
 }
 
+/**
+ * @param {Object} resolved
+ * @param {Object} params
+ * @returns {string}
+ */
+function resolveWebApplicationAudience(resolved, params) {
+  return (
+    trimNonEmptyString(params.entraProvider && params.entraProvider.audience) ||
+    trimNonEmptyString(resolved.discoveryAuthentication && resolved.discoveryAuthentication.audience)
+  );
+}
+
+/**
+ * @param {Object} sources
+ * @returns {{ id: string|null, resource: string|null }}
+ */
+function pickWebApplicationInfo(sources) {
+  const {
+    explicitId,
+    explicitResource,
+    priorId,
+    priorResource,
+    clientId,
+    fromApp,
+    fromTeamsAuthConfig
+  } = sources;
+  const derivedId = fromApp || fromTeamsAuthConfig ? clientId : null;
+  return {
+    id: explicitId || derivedId || priorId || null,
+    resource: explicitResource || fromApp || priorResource || fromTeamsAuthConfig || null
+  };
+}
+
 /**
  * Preserve / derive Teams webApplicationInfo for Entra SSO packages.
- * Prefer explicit params, then prior package values, then GUID auth-config + SSO client id.
- * Do not invent resource URIs from opaque (non-GUID) vault references.
+ * Prefer explicit → Trust audience / api://{clientId} (matches Azure identifierUris)
+ * → prior package → Teams api://auth-{configId}/{clientId} only as last resort.
  * @param {Object} resolved
  * @param {Object} params
  * @returns {void}
  */
 function applyWebApplicationInfoFields(resolved, params = {}) {
   const prior = params.priorWebApplicationInfo || null;
-  const explicitId = trimNonEmptyString(params.webApplicationInfoId);
-  const explicitResource = trimNonEmptyString(params.webApplicationInfoResource);
-  const priorId = trimNonEmptyString(prior && prior.id);
-  const priorResource = trimNonEmptyString(prior && prior.resource);
   const clientId = resolveWebApplicationClientId(resolved);
-  const derivedResource = buildTeamsWebApplicationInfoResource(
-    resolved.oauthPluginVaultReferenceId,
-    clientId
-  );
-  const id = explicitId || priorId || (derivedResource ? clientId : null);
-  const resource = explicitResource || priorResource || derivedResource || null;
-  if (id && resource) {
-    resolved.webApplicationInfoId = id;
-    resolved.webApplicationInfoResource = resource;
+  const audience = resolveWebApplicationAudience(resolved, params);
+  const authConfigId = parseOauthPluginVaultAuthConfigId(resolved.oauthPluginVaultReferenceId);
+  const fromTeamsAuthConfig = buildTeamsWebApplicationInfoResource(authConfigId, clientId);
+  const fromApp = buildApplicationIdUriResource(clientId, audience);
+  resolved.entraSsoAuthConfigId = authConfigId;
+  resolved.teamsApplicationIdUri = fromTeamsAuthConfig;
+  resolved.azureApplicationIdUri = fromApp || (clientId ? `api://${clientId}` : null);
+  const picked = pickWebApplicationInfo({
+    explicitId: trimNonEmptyString(params.webApplicationInfoId),
+    explicitResource: trimNonEmptyString(params.webApplicationInfoResource),
+    priorId: trimNonEmptyString(prior && prior.id),
+    priorResource: trimNonEmptyString(prior && prior.resource),
+    clientId,
+    fromApp,
+    fromTeamsAuthConfig
+  });
+  if (picked.id && picked.resource) {
+    resolved.webApplicationInfoId = picked.id;
+    resolved.webApplicationInfoResource = picked.resource;
   }
 }
 
@@ -245,7 +331,9 @@ module.exports = {
   resolveEntraTenantId,
   applyCopilotEntraSsoFormFields,
   applyWebApplicationInfoFields,
+  parseOauthPluginVaultAuthConfigId,
   buildTeamsWebApplicationInfoResource,
+  buildApplicationIdUriResource,
   renderCopilotChannelTemplate,
   formatOauthPluginVaultReferenceRequiredError
 };

package/lib/channels/microsoft-copilot-entra-sso.js

@@ -25,7 +25,10 @@ function isPresent(value) {
  * @returns {boolean}
  */
 function skipsChannelOauthCredential(channelTarget) {
-  return channelTarget === 'microsoft-copilot';
+  return channelTarget === 'microsoft-copilot'
+    || channelTarget === 'mcp-client'
+    || channelTarget === 'claude'
+    || channelTarget === 'chatgpt';
 }
 
 /**
@@ -109,6 +112,21 @@ function mapCopilotPackageAuthentication(auth) {
  * @param {Object|null} [params.entraProvider]
  * @returns {string[]}
  */
+/**
+ * @param {string|null|undefined} audience
+ * @returns {string[]}
+ */
+function scopesFromAudience(audience) {
+  const aud = typeof audience === 'string' ? audience.trim().replace(/\/$/, '') : '';
+  if (!aud.startsWith('api://')) {
+    return [];
+  }
+  if (aud.endsWith('/invoke')) {
+    return [aud];
+  }
+  return [`${aud}/invoke`];
+}
+
 function resolveCopilotEntraScopes(params) {
   const explicit = normalizeScopeList(params.explicitScopes);
   if (explicit.length > 0 && !isOpenIdOnlyOrEmptyScopes(explicit)) {
@@ -118,6 +136,17 @@ function resolveCopilotEntraScopes(params) {
   if (fromProvider.length > 0 && !isOpenIdOnlyOrEmptyScopes(fromProvider)) {
     return fromProvider;
   }
+  const fromProviderAudience = scopesFromAudience(params.entraProvider?.audience);
+  if (fromProviderAudience.length > 0) {
+    return fromProviderAudience;
+  }
+  const enterpriseAppId =
+    typeof params.entraIdentityProvider?.enterpriseAppId === 'string'
+      ? params.entraIdentityProvider.enterpriseAppId.trim()
+      : '';
+  if (enterpriseAppId) {
+    return scopesFromAudience(`api://${enterpriseAppId}`);
+  }
   const auth = params.packageContext?.authentication || null;
   const fromAuth = normalizeScopeList(auth?.scopes || auth?.allowedScopes);
   if (fromAuth.length > 0 && !isOpenIdOnlyOrEmptyScopes(fromAuth)) {
@@ -125,7 +154,7 @@ function resolveCopilotEntraScopes(params) {
   }
   const resource = typeof auth?.resource === 'string' ? auth.resource.trim() : '';
   if (resource.startsWith('api://')) {
-    return [resource];
+    return scopesFromAudience(resource);
   }
   return [];
 }

package/lib/channels/microsoft-copilot-package-prior.js

@@ -0,0 +1,107 @@
+/**
+ * Read prior Microsoft Copilot package identity from dist/source (regenerate).
+ *
+ * @fileoverview Preserve Entra webApplicationInfo / vault ref; bump Teams version
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('../internal/fs-real-sync');
+const path = require('path');
+const {
+  parseSemverTriple,
+  bumpMinorPackageVersion,
+  resolvePackageVersionForWrite
+} = require('./channel-package-version');
+
+/**
+ * @param {string} sourceDir
+ * @returns {string|null}
+ */
+function readPriorPackageVersion(sourceDir) {
+  const manifestPath = path.join(sourceDir, 'manifest.json');
+  if (!fs.existsSync(manifestPath)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    const version = parsed && parsed.version;
+    return parseSemverTriple(version) ? String(version).trim() : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Read prior webApplicationInfo from an existing source manifest (preserve on regenerate).
+ * @param {string} sourceDir
+ * @returns {{ id: string, resource: string }|null}
+ */
+function readPriorWebApplicationInfo(sourceDir) {
+  const manifestPath = path.join(sourceDir, 'manifest.json');
+  if (!fs.existsSync(manifestPath)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    const info = parsed && parsed.webApplicationInfo;
+    if (
+      info &&
+      typeof info.id === 'string' &&
+      info.id.trim() &&
+      typeof info.resource === 'string' &&
+      info.resource.trim()
+    ) {
+      return { id: info.id.trim(), resource: info.resource.trim() };
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+
+/**
+ * Reuse Teams Entra SSO OAuthPluginVault reference_id from a prior ai-plugin.json.
+ * @param {string} sourceDir
+ * @returns {string|null}
+ */
+function readPriorOauthPluginVaultReferenceId(sourceDir) {
+  const pluginPath = path.join(sourceDir, 'ai-plugin.json');
+  if (!fs.existsSync(pluginPath)) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(fs.readFileSync(pluginPath, 'utf8'));
+    const runtimes = Array.isArray(parsed?.runtimes) ? parsed.runtimes : [];
+    for (const runtime of runtimes) {
+      const ref = runtime?.auth?.reference_id;
+      if (typeof ref === 'string' && ref.trim()) {
+        return ref.trim();
+      }
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+
+/**
+ * @param {string} projectRoot
+ * @param {string} [channelTarget]
+ * @returns {string}
+ */
+function getCopilotPackageSourceDir(projectRoot, channelTarget = 'microsoft-copilot') {
+  return path.join(projectRoot, 'dist', 'channels', channelTarget, 'source');
+}
+
+module.exports = {
+  parseSemverTriple,
+  bumpMinorPackageVersion,
+  readPriorPackageVersion,
+  resolvePackageVersionForWrite,
+  readPriorWebApplicationInfo,
+  readPriorOauthPluginVaultReferenceId,
+  getCopilotPackageSourceDir
+};

package/lib/channels/microsoft-copilot-package.js

@@ -22,6 +22,12 @@ const {
   renderCopilotChannelTemplate,
   applyWebApplicationInfoFields
 } = require('./microsoft-copilot-entra-sso-form');
+const {
+  readPriorWebApplicationInfo,
+  readPriorPackageVersion,
+  readPriorOauthPluginVaultReferenceId,
+  resolvePackageVersionForWrite
+} = require('./microsoft-copilot-package-prior');
 
 /**
  * @param {string} outputPath
@@ -330,43 +336,36 @@ function buildCopilotPackagePayload(params, runtimeValues, paths, icons) {
 }
 
 /**
- * Read prior webApplicationInfo from an existing source manifest (preserve on regenerate).
- * @param {string} sourceDir
- * @returns {{ id: string, resource: string }|null}
+ * Apply prior vault / Teams version / webApplicationInfo before render.
+ * @param {Object} runtimeValues
+ * @param {Object} paths
+ * @returns {void}
  */
-function readPriorWebApplicationInfo(sourceDir) {
-  const manifestPath = path.join(sourceDir, 'manifest.json');
-  if (!fs.existsSync(manifestPath)) {
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
-    const info = parsed && parsed.webApplicationInfo;
-    if (
-      info &&
-      typeof info.id === 'string' &&
-      info.id.trim() &&
-      typeof info.resource === 'string' &&
-      info.resource.trim()
-    ) {
-      return { id: info.id.trim(), resource: info.resource.trim() };
+function applyPriorPackageFields(runtimeValues, paths) {
+  if (!runtimeValues.oauthPluginVaultReferenceId) {
+    const priorVault = readPriorOauthPluginVaultReferenceId(paths.sourceDir);
+    if (priorVault) {
+      runtimeValues.oauthPluginVaultReferenceId = priorVault;
     }
-  } catch {
-    return null;
   }
-  return null;
-}
-
-function generateMicrosoftCopilotPackage(params) {
-  const runtimeValues = applyMicrosoftCopilotDisplayLimits({ ...(params.runtimeValues || {}) });
-  assertCopilotPackageOauthPluginVaultReference(runtimeValues);
-  const paths = buildCopilotOutputPaths(params.outputPath, runtimeValues);
+  const priorVersion = readPriorPackageVersion(paths.sourceDir);
+  const explicitVersion =
+    runtimeValues.packageVersionExplicit === true ? runtimeValues.packageVersion : null;
+  runtimeValues.packageVersion = resolvePackageVersionForWrite(explicitVersion, priorVersion);
+  runtimeValues.priorPackageVersion = priorVersion;
   const prior = readPriorWebApplicationInfo(paths.sourceDir);
   applyWebApplicationInfoFields(runtimeValues, {
     webApplicationInfoId: runtimeValues.webApplicationInfoId,
     webApplicationInfoResource: runtimeValues.webApplicationInfoResource,
     priorWebApplicationInfo: prior
   });
+}
+
+function generateMicrosoftCopilotPackage(params) {
+  const runtimeValues = applyMicrosoftCopilotDisplayLimits({ ...(params.runtimeValues || {}) });
+  const paths = buildCopilotOutputPaths(params.outputPath, runtimeValues);
+  applyPriorPackageFields(runtimeValues, paths);
+  assertCopilotPackageOauthPluginVaultReference(runtimeValues);
   const icons = resolvePackageIcons(runtimeValues);
   const payload = buildCopilotPackagePayload(params, runtimeValues, paths, icons);
   if (!params.dryRun) {
@@ -387,6 +386,8 @@ function generateMicrosoftCopilotPackage(params) {
     installPath: paths.installPath,
     zipPath: paths.zipPath,
     links: payload.summary.links,
+    packageVersion: runtimeValues.packageVersion,
+    priorPackageVersion: runtimeValues.priorPackageVersion || null,
     installReady: payload.summary.installReady === true,
     blocker: payload.summary.blocker || null,
     packageReady: payload.summary.packageReady === true,

package/lib/channels/microsoft-provisioning/a365.js

@@ -0,0 +1,80 @@
+/**
+ * Agent 365 BYO MCP register wrap (preview). Not used by microsoft-copilot DA packaging.
+ *
+ * @fileoverview Checkpoint + optional a365 CLI; remaining admin/UI stays honest
+ */
+
+'use strict';
+
+const { AGENT365_CHECKPOINT } = require('./constants');
+const {
+  microsoftProvisioningError,
+  wrongEnvironmentRegistrationError
+} = require('./errors');
+
+/**
+ * @returns {{ preview: boolean, declarativeAgentsSupported: boolean, republishSupported: boolean, copilotStudioApiAttach: boolean, adminApprovalRequired: boolean, byoMcpRegisterCli: boolean, reason: string }}
+ */
+function evaluateAgent365Checkpoint() {
+  return { ...AGENT365_CHECKPOINT };
+}
+
+/**
+ * Declarative Agent packaging must not consume Agent 365 BYO registrations.
+ * @returns {boolean}
+ */
+function agent365AppliesToDeclarativeAgents() {
+  return evaluateAgent365Checkpoint().declarativeAgentsSupported === true;
+}
+
+/**
+ * @param {Object} existing
+ * @param {Object} requested
+ * @returns {void}
+ */
+function assertMatchingRegistration(existing, requested) {
+  if (!existing || !existing.registrationId) {
+    return;
+  }
+  if (existing.environment && existing.environment !== requested.environment) {
+    throw wrongEnvironmentRegistrationError(requested.environment, existing.environment);
+  }
+  if (existing.mcpServerUrl && existing.mcpServerUrl !== requested.mcpServerUrl) {
+    throw microsoftProvisioningError(
+      'Existing Agent 365 registration points at a different MCP URL. Republish is not supported.',
+      'REPUBLISH_UNSUPPORTED'
+    );
+  }
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} [deps]
+ * @returns {Promise<{ skipped: boolean, reason?: string, registrationId?: string }>}
+ */
+async function registerExternalMcpServer(params, deps = {}) {
+  const checkpoint = evaluateAgent365Checkpoint();
+  if (params && params.forDeclarativeAgent === true && !checkpoint.declarativeAgentsSupported) {
+    return { skipped: true, reason: checkpoint.reason };
+  }
+  const existing = params && params.existingRegistration;
+  if (existing && existing.registrationId) {
+    assertMatchingRegistration(existing, params);
+    return { skipped: false, registrationId: existing.registrationId, reused: true };
+  }
+  if (typeof deps.runA365 !== 'function') {
+    return { skipped: true, reason: checkpoint.reason };
+  }
+  const registrationId = await deps.runA365(params);
+  if (!registrationId) {
+    throw microsoftProvisioningError('Agent 365 register did not return a registration id.', 'A365');
+  }
+  return { skipped: false, registrationId, reused: false };
+}
+
+module.exports = {
+  evaluateAgent365Checkpoint,
+  agent365AppliesToDeclarativeAgents,
+  assertMatchingRegistration,
+  registerExternalMcpServer
+};