| Constraint |
Value |
| App names |
DNS-label-safe: lowercase letters, digits, hyphens only; must start with a letter; no leading/trailing hyphen; no consecutive hyphens; 3-40 characters. The labels admin, auth, gateway, and transfer are reserved for platform hosts (admin.apps.<domain>, etc.) and cannot be used as app names |
| Publish archives |
Two tar.gz archives per publish - the project source and the built bundle - each up to 100 MiB compressed and 200 MiB expanded; the caps are identical for both. Uploads use exact 4 MiB blocks except for the final block, so no request body grows with archive size |
| Transfer grants |
Valid for 15 minutes; one opaque bearer grant is scoped to one artifact, direction, app, version, size, and digest. Prepare again and restart begin_publish after expiry |
| Abandoned publish data |
Staging archives (source and bundle) and unactivated generated bundle blobs become eligible for automatic deletion after one day; active and rollback artifacts and the retained source of activated versions are kept |
| Files per archive |
Up to 10,000 regular files (each archive) |
| File size |
Up to 50 MiB per file (each archive) |
| Archive paths |
Relative forward-slash paths. Dot-prefixed files and folders such as .gitignore and .well-known/ are accepted; empty, . and .. segments and backslashes are rejected |
| App content |
Static assets - the gateway serves an SPA bundle; no serverless backend functions in Phase 1 |
| Sharing |
Entra groups only, via Ops approval |
| Data sources |
Azure SQL Database (mssql, per-user access) - DAB’s OBO auth is mssql-only today; and Fabric Warehouse / lakehouse SQL analytics endpoints (fabric-dw, registrable now, read-only, gateway-enforced only, served by a shared service identity rather than per-user). Both Fabric kinds need the Fabric inputs (including the extra Entra app registration) supplied at install time; fabric-semantic access itself stays user-delegated, and sprig holds no data credential for it. Warehouse tables that declare a primary key are servable; lakehouse tables without one are not yet, because the endpoint cannot be given a key. Fabric semantic models (fabric-semantic) are registered by workspace and item GUID and served end to end: model tables and measures expose read-only under the model. prefix, queries support $select, $filter (eq ne gt ge lt le and or not; date/time fields and field names containing spaces are not yet filterable), $orderby, and $first/$after offset paging, and every query runs under the viewer’s own identity so the model’s row-level security applies (viewers need a Power BI Pro/PPU license, or the workspace on an F64-or-larger capacity). PostgreSQL/MySQL/Cosmos/Snowflake/Databricks are out of scope |
Response-size, pagination, and timeout limits for exposed sources are whatever the
underlying Azure SQL Database engine and DAB impose; there’s no sprig-specific ceiling
documented on top of that yet. If you hit one in practice, it’s worth filing so this section
can carry real numbers instead of a placeholder. fabric-dw sources are read-only:
there is no write path, and none is planned.
| Constraint |
Value |
| Platform app registrations |
Four, fixed, regardless of app count: sprig-gateway, sprig-connector, sprig-cli, sprig-obo. One more, only if you enable Fabric sources: an API registration whose Application ID URI and client id you pass to the installer. It is a different registration from sprig-connector, which is the client for the claude.ai remote MCP connector and exists regardless |
| Per-app isolation |
Entra groups (app-<name>-viewers, app-<name>-builders), not per-app app registrations |
| Sign-in audience |
Single tenant, always |
