@friggframework/core 2.0.0--canary.703.12b980b.0 → 2.0.0--canary.707.df80bfd.0

package/prisma-mongodb/schema.prisma

@@ -56,6 +56,14 @@ model User {
   integrations Integration[]
   processes    Process[]
 
+  // Organization memberships (ADR-056 §3.6). `organizationId` above is the legacy
+  // single-org pointer: set on a person's first link, never moved afterwards, and
+  // read as an implicit membership when no row exists for it.
+  // As an individual: the organizations this person belongs to.
+  memberships OrganizationMembership[] @relation("IndividualMemberships")
+  // As an organization: the people who belong to it.
+  orgMembers OrganizationMembership[] @relation("OrganizationMemberships")
+
   @@unique([username, appUserId])
   @@index([type])
   @@index([appUserId])
@@ -126,6 +134,14 @@ model Entity {
   moduleName   String?
   externalId   String?
 
+  // Organization this entity was connected in (ADR-056 §3.6): the active
+  // organization for `individual`, the owner for `organization`, null for
+  // `global`. Null on an `individual` entity is also what every row written
+  // before this column existed has, and what `individualAcross: 'all'` writes.
+  // Deliberately not a relation: a deleted organization must leave its rows
+  // invisible, not turn them into "unscoped" ones (SetNull would do that).
+  organizationId String? @db.ObjectId
+
   data Json @default("{}")
 
   createdAt DateTime @default(now())
@@ -142,6 +158,7 @@ model Entity {
   associationObjects AssociationObject[]
 
   @@index([userId])
+  @@index([userId, organizationId])
   @@index([externalId])
   @@index([moduleName])
   @@index([credentialId])
@@ -159,6 +176,11 @@ model Integration {
   user   User?             @relation(fields: [userId], references: [id], onDelete: Cascade)
   status IntegrationStatus @default(IN_CREATION)
 
+  // Organization this integration was created in (ADR-056 §3.6): the active
+  // organization at create time. Null for rows that predate the column. Not a
+  // relation, for the same reason as Entity.organizationId.
+  organizationId String? @db.ObjectId
+
   // Configuration and version
   config  Json? // Integration configuration object
   version String?
@@ -181,9 +203,9 @@ model Integration {
   syncs        Sync[]
   mappings     IntegrationMapping[]
   processes    Process[]
-  workflowRuns WorkflowRun[]
 
   @@index([userId])
+  @@index([userId, organizationId])
   @@index([status])
   @@map("Integration")
 }
@@ -455,66 +477,71 @@ model UsageCounter {
   @@map("UsageCounter")
 }
 
-// Integrations published as definitions (ADR-063): one immutable row per published definition version.
-enum DefinitionStatus {
-  DRAFT
-  PUBLISHED
-  DEPRECATED
-  RETIRED
+// ============================================================================
+// MANAGEMENT API MODELS
+// ============================================================================
+
+/// Multi-step authorization state for Management API v2 (/api/v2/authorize,
+/// /api/v2/credentials/:id/reauthorize). Short-lived: expired documents are
+/// removed opportunistically. stepData is encrypted at rest.
+model AuthorizationSession {
+  id           String   @id @default(auto()) @map("_id") @db.ObjectId
+  sessionId    String   @unique
+  userId       String
+  entityType   String
+  credentialId String?
+  currentStep  Int      @default(1)
+  maxSteps     Int
+  stepData     Json     @default("{}")
+  expiresAt    DateTime
+  completed    Boolean  @default(false)
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@index([userId, entityType])
+  @@index([expiresAt])
+  @@map("AuthorizationSession")
 }
 
-model IntegrationDefinitionVersion {
-  id              String           @id @default(auto()) @map("_id") @db.ObjectId
-  definitionId    String
-  version         String
-  schemaVersion   String
-  status          DefinitionStatus @default(DRAFT)
-  checksum        String
-  document        Json
-  changeLevel     String?
-  previousVersion String?
-  notes           String?
-  createdBy       String?
-  // The workspace an integration a user built belongs to (null: the app's own catalogue, offered to everyone).
-  workspaceId     String?
-  publishedAt     DateTime?
-  createdAt       DateTime         @default(now())
-  updatedAt       DateTime         @updatedAt
-
-  @@unique([definitionId, version])
-  @@index([definitionId, status])
-  @@index([workspaceId, status])
-  @@map("IntegrationDefinitionVersion")
+// ============================================================================
+// ORGANIZATION MEMBERSHIP (ADR-056 §3.6)
+// ============================================================================
+
+/// One person's membership of one organization. Unique on the pair, so adding a
+/// membership is an idempotent upsert. `orgRole` is the organization role the
+/// adopter token carried when the membership was created (MEMBER when it named none). NoAction on delete
+/// because MongoDB gives no referential integrity: delete a user's memberships
+/// before the user.
+model OrganizationMembership {
+  id                 String   @id @default(auto()) @map("_id") @db.ObjectId
+  individualUserId   String   @db.ObjectId
+  organizationUserId String   @db.ObjectId
+  orgRole            String   @default("MEMBER")
+  createdAt          DateTime @default(now())
+
+  individualUser   User @relation("IndividualMemberships", fields: [individualUserId], references: [id], onDelete: NoAction, onUpdate: NoAction)
+  organizationUser User @relation("OrganizationMemberships", fields: [organizationUserId], references: [id], onDelete: NoAction, onUpdate: NoAction)
+
+  @@unique([individualUserId, organizationUserId])
+  @@index([organizationUserId])
+  @@map("OrganizationMembership")
 }
 
-// One row per workflow run. trace holds step ids, statuses, timings and error messages, never request or
-// response bodies.
-model WorkflowRun {
-  id                String      @id @default(auto()) @map("_id") @db.ObjectId
-  integrationId     String      @db.ObjectId
-  integration       Integration @relation(fields: [integrationId], references: [id], onDelete: Cascade)
-  definitionId      String
-  definitionVersion String
-  workflowId        String
-  triggerType       String
-  eventId           String?
-  status            String
-  reason            String?
-  error             String?
-  retryable         Boolean     @default(false)
-  trace             Json        @default("[]")
-  /// The runtime's run id (run_...): how routes and resume jobs address a run
-  runKey            String?
-  /// A paused run (status waiting): which step, and what it waits for. Never request or response bodies.
-  waitingFor        Json?
-  resumeAt          DateTime?
-  startedAt         DateTime
-  endedAt           DateTime?
-  createdAt         DateTime    @default(now())
-
-  @@index([integrationId, runKey])
-  @@index([integrationId, startedAt])
-  @@index([integrationId, workflowId, startedAt])
-  @@index([integrationId, status])
-  @@map("WorkflowRun")
+/// One-time scheduled jobs for poll-and-dispatch scheduling pattern.
+/// Used by providers without native one-time scheduling APIs (e.g., Netlify).
+/// A cron function queries for due jobs and dispatches them to a queue.
+model ScheduledJob {
+  id              String   @id @default(auto()) @map("_id") @db.ObjectId
+  scheduleName    String   @unique
+  scheduledAt     DateTime
+  queueResourceId String
+  payload         Json?
+  state           String   @default("PENDING")
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@index([state, scheduledAt])
+  @@map("ScheduledJob")
 }

package/prisma-postgresql/migrations/20261003000000_add_authorization_session/migration.sql

@@ -0,0 +1,28 @@
+-- CreateTable
+-- Multi-step authorization state for Management API v2 (/api/v2/authorize).
+-- Short-lived rows; "stepData" is encrypted at rest by the application.
+CREATE TABLE "AuthorizationSession" (
+    "id" SERIAL NOT NULL,
+    "sessionId" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "entityType" TEXT NOT NULL,
+    "credentialId" TEXT,
+    "currentStep" INTEGER NOT NULL DEFAULT 1,
+    "maxSteps" INTEGER NOT NULL,
+    "stepData" JSONB NOT NULL DEFAULT '{}',
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "completed" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "AuthorizationSession_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "AuthorizationSession_sessionId_key" ON "AuthorizationSession"("sessionId");
+
+-- CreateIndex
+CREATE INDEX "AuthorizationSession_userId_entityType_idx" ON "AuthorizationSession"("userId", "entityType");
+
+-- CreateIndex
+CREATE INDEX "AuthorizationSession_expiresAt_idx" ON "AuthorizationSession"("expiresAt");

package/prisma-postgresql/migrations/20261015000000_add_organization_membership/migration.sql

@@ -0,0 +1,26 @@
+-- CreateTable
+-- Organization memberships (ADR-056 §3.6). One row per person per organization.
+-- "User"."organizationId" stays as the legacy single-org pointer. It is NOT
+-- backfilled into this table: the domain (user/membership.js) reads it as an
+-- implicit membership when no row exists (see docs/guides/organization-memberships.md).
+CREATE TABLE "OrganizationMembership" (
+    "id" SERIAL NOT NULL,
+    "individualUserId" INTEGER NOT NULL,
+    "organizationUserId" INTEGER NOT NULL,
+    "orgRole" TEXT NOT NULL DEFAULT 'MEMBER',
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "OrganizationMembership_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "OrganizationMembership_organizationUserId_idx" ON "OrganizationMembership"("organizationUserId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "OrganizationMembership_individualUserId_organizationUserId_key" ON "OrganizationMembership"("individualUserId", "organizationUserId");
+
+-- AddForeignKey
+ALTER TABLE "OrganizationMembership" ADD CONSTRAINT "OrganizationMembership_individualUserId_fkey" FOREIGN KEY ("individualUserId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE NO ACTION;
+
+-- AddForeignKey
+ALTER TABLE "OrganizationMembership" ADD CONSTRAINT "OrganizationMembership_organizationUserId_fkey" FOREIGN KEY ("organizationUserId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE NO ACTION;

package/prisma-postgresql/migrations/20261016000000_add_entity_integration_organization/migration.sql

@@ -0,0 +1,25 @@
+-- Entity and Integration carry the organization they were created in (ADR-056 §3.6).
+-- Nullable, no default and no backfill: a row written before this migration keeps
+-- NULL, and the domain (modules/entity-scope.js) reads NULL as "predates scoping"
+-- (docs/guides/entity-scopes.md). No scope column: the owner's user type says it.
+-- Deliberately no foreign key: a deleted organization must leave its rows
+-- invisible, and ON DELETE SET NULL would turn them into unscoped ones.
+--
+-- Release note: the two CREATE INDEX statements below are plain (not
+-- CONCURRENTLY, which Prisma migrations cannot run inside a transaction). Each
+-- takes a SHARE lock on its table while it builds, so writes to "Entity" and
+-- "Integration" wait for it. Both tables are small in a typical Frigg
+-- deployment; on a very large one, create the indexes by hand first with
+-- CREATE INDEX CONCURRENTLY IF NOT EXISTS under the same names, then deploy.
+
+-- AlterTable
+ALTER TABLE "Entity" ADD COLUMN     "organizationId" INTEGER;
+
+-- AlterTable
+ALTER TABLE "Integration" ADD COLUMN     "organizationId" INTEGER;
+
+-- CreateIndex
+CREATE INDEX "Entity_userId_organizationId_idx" ON "Entity"("userId", "organizationId");
+
+-- CreateIndex
+CREATE INDEX "Integration_userId_organizationId_idx" ON "Integration"("userId", "organizationId");

package/prisma-postgresql/migrations/20261017000000_add_scheduled_job/migration.sql

@@ -0,0 +1,28 @@
+-- One-time scheduled jobs for the poll-and-dispatch scheduler
+-- (NetlifySchedulerAdapter, friggframework/frigg#545): a cron function reads
+-- PENDING rows that are due and dispatches them to a queue.
+--
+-- IF NOT EXISTS on purpose: #545 shipped this model in the Prisma schema with
+-- no migration, so an app that ran its canary may already have the table from
+-- `prisma db push`. On such a database this migration is a no-op; on a fresh
+-- one it is the SQL `prisma migrate diff` generates.
+
+-- CreateTable
+CREATE TABLE IF NOT EXISTS "ScheduledJob" (
+    "id" SERIAL NOT NULL,
+    "scheduleName" TEXT NOT NULL,
+    "scheduledAt" TIMESTAMP(3) NOT NULL,
+    "queueResourceId" TEXT NOT NULL,
+    "payload" JSONB,
+    "state" TEXT NOT NULL DEFAULT 'PENDING',
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "ScheduledJob_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "ScheduledJob_scheduleName_key" ON "ScheduledJob"("scheduleName");
+
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "ScheduledJob_state_scheduledAt_idx" ON "ScheduledJob"("state", "scheduledAt");

package/prisma-postgresql/schema.prisma

@@ -56,6 +56,14 @@ model User {
   integrations Integration[]
   processes    Process[]
 
+  // Organization memberships (ADR-056 §3.6). `organizationId` above is the legacy
+  // single-org pointer: set on a person's first link, never moved afterwards, and
+  // read as an implicit membership when no row exists for it.
+  // As an individual: the organizations this person belongs to.
+  memberships OrganizationMembership[] @relation("IndividualMemberships")
+  // As an organization: the people who belong to it.
+  orgMembers OrganizationMembership[] @relation("OrganizationMemberships")
+
   @@unique([username, appUserId])
   @@index([type])
   @@index([appUserId])
@@ -123,6 +131,14 @@ model Entity {
   moduleName   String?
   externalId   String?
 
+  // Organization this entity was connected in (ADR-056 §3.6): the active
+  // organization for `individual`, the owner for `organization`, null for
+  // `global`. Null on an `individual` entity is also what every row written
+  // before this column existed has, and what `individualAcross: 'all'` writes.
+  // Deliberately not a relation: a deleted organization must leave its rows
+  // invisible, not turn them into "unscoped" ones (SetNull would do that).
+  organizationId Int?
+
   data Json @default("{}")
 
   createdAt DateTime @default(now())
@@ -136,6 +152,7 @@ model Entity {
   associationObjects AssociationObject[]
 
   @@index([userId])
+  @@index([userId, organizationId])
   @@index([externalId])
   @@index([moduleName])
   @@index([credentialId])
@@ -152,6 +169,11 @@ model Integration {
   user   User?             @relation(fields: [userId], references: [id], onDelete: Cascade)
   status IntegrationStatus @default(IN_CREATION)
 
+  // Organization this integration was created in (ADR-056 §3.6): the active
+  // organization at create time. Null for rows that predate the column. Not a
+  // relation, for the same reason as Entity.organizationId.
+  organizationId Int?
+
   // Configuration and version
   config  Json? // Integration configuration object
   version String?
@@ -173,9 +195,9 @@ model Integration {
   syncs        Sync[]
   mappings     IntegrationMapping[]
   processes    Process[]
-  workflowRuns WorkflowRun[]
 
   @@index([userId])
+  @@index([userId, organizationId])
   @@index([status])
 }
 
@@ -436,64 +458,66 @@ model UsageCounter {
   @@index([metric, integrationType, window])
 }
 
-// Integrations published as definitions (ADR-063): one immutable row per published definition version.
-enum DefinitionStatus {
-  DRAFT
-  PUBLISHED
-  DEPRECATED
-  RETIRED
+// ============================================================================
+// MANAGEMENT API MODELS
+// ============================================================================
+
+/// Multi-step authorization state for Management API v2 (/api/v2/authorize,
+/// /api/v2/credentials/:id/reauthorize). Short-lived: expired rows are removed
+/// opportunistically. stepData is encrypted at rest.
+model AuthorizationSession {
+  id           Int      @id @default(autoincrement())
+  sessionId    String   @unique
+  userId       String
+  entityType   String
+  credentialId String?
+  currentStep  Int      @default(1)
+  maxSteps     Int
+  stepData     Json     @default("{}")
+  expiresAt    DateTime
+  completed    Boolean  @default(false)
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@index([userId, entityType])
+  @@index([expiresAt])
 }
 
-model IntegrationDefinitionVersion {
-  id              Int              @id @default(autoincrement())
-  definitionId    String
-  version         String
-  schemaVersion   String
-  status          DefinitionStatus @default(DRAFT)
-  checksum        String
-  document        Json
-  changeLevel     String?
-  previousVersion String?
-  notes           String?
-  createdBy       String?
-  // The workspace an integration a user built belongs to (null: the app's own catalogue, offered to everyone).
-  workspaceId     String?
-  publishedAt     DateTime?
-  createdAt       DateTime         @default(now())
-  updatedAt       DateTime         @updatedAt
-
-  @@unique([definitionId, version])
-  @@index([definitionId, status])
-  @@index([workspaceId, status])
+// ============================================================================
+// ORGANIZATION MEMBERSHIP (ADR-056 §3.6)
+// ============================================================================
+
+/// One person's membership of one organization. Unique on the pair, so adding a
+/// membership is an idempotent upsert. `orgRole` is the organization role the
+/// adopter token carried when the membership was created (MEMBER when it named none).
+model OrganizationMembership {
+  id                 Int      @id @default(autoincrement())
+  individualUserId   Int
+  organizationUserId Int
+  orgRole            String   @default("MEMBER")
+  createdAt          DateTime @default(now())
+
+  individualUser   User @relation("IndividualMemberships", fields: [individualUserId], references: [id], onDelete: Cascade, onUpdate: NoAction)
+  organizationUser User @relation("OrganizationMemberships", fields: [organizationUserId], references: [id], onDelete: Cascade, onUpdate: NoAction)
+
+  @@unique([individualUserId, organizationUserId])
+  @@index([organizationUserId])
 }
 
-// One row per workflow run. trace holds step ids, statuses, timings and error messages, never request or
-// response bodies.
-model WorkflowRun {
-  id                Int         @id @default(autoincrement())
-  integrationId     Int
-  integration       Integration @relation(fields: [integrationId], references: [id], onDelete: Cascade)
-  definitionId      String
-  definitionVersion String
-  workflowId        String
-  triggerType       String
-  eventId           String?
-  status            String
-  reason            String?
-  error             String?
-  retryable         Boolean     @default(false)
-  trace             Json        @default("[]")
-  /// The runtime's run id (run_...): how routes and resume jobs address a run
-  runKey            String?
-  /// A paused run (status waiting): which step, and what it waits for. Never request or response bodies.
-  waitingFor        Json?
-  resumeAt          DateTime?
-  startedAt         DateTime
-  endedAt           DateTime?
-  createdAt         DateTime    @default(now())
-
-  @@index([integrationId, runKey])
-  @@index([integrationId, startedAt])
-  @@index([integrationId, workflowId, startedAt])
-  @@index([integrationId, status])
+/// One-time scheduled jobs for poll-and-dispatch scheduling pattern.
+/// Used by providers without native one-time scheduling APIs (e.g., Netlify).
+/// A cron function queries for due jobs and dispatches them to a queue.
+model ScheduledJob {
+  id              Int       @id @default(autoincrement())
+  scheduleName    String    @unique
+  scheduledAt     DateTime
+  queueResourceId String
+  payload         Json?
+  state           String    @default("PENDING")
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@index([state, scheduledAt])
 }

package/providers/index.js

@@ -0,0 +1,23 @@
+const {
+    resolveProvider,
+    determineProviderName,
+    providerPackageName,
+    KNOWN_PROVIDERS,
+} = require('./resolve-provider');
+const {
+    isDeployedRuntime,
+    isAwsLambdaRuntime,
+    isLocalRun,
+    resolveActiveProvider,
+} = require('./runtime-detection');
+
+module.exports = {
+    resolveProvider,
+    determineProviderName,
+    providerPackageName,
+    KNOWN_PROVIDERS,
+    isDeployedRuntime,
+    isAwsLambdaRuntime,
+    isLocalRun,
+    resolveActiveProvider,
+};

package/providers/resolve-provider.js

@@ -0,0 +1,93 @@
+/**
+ * Provider Resolver
+ *
+ * Resolves a provider name from the appDefinition into the corresponding
+ * @friggframework/provider-{name} package. This is the bridge between
+ * `appDefinition.provider` and the provider plugin interface.
+ *
+ * Resolution order:
+ *   1. Explicit `providerName` argument
+ *   2. `appDefinition.provider`
+ *   3. `FRIGG_PROVIDER` environment variable
+ *   4. Default: 'aws'
+ *
+ * Package naming convention:
+ *   provider: 'netlify'  →  require('@friggframework/provider-netlify')
+ *   provider: 'aws'      →  require('@friggframework/provider-aws')
+ *
+ * @example
+ *   const provider = resolveProvider({ provider: 'netlify' });
+ *   // provider.name === 'netlify'
+ *   // provider.deploy(appDefinition, options)
+ *   // provider.createHandler(options)
+ *   // provider.QueueProvider  (class)
+ *   // etc.
+ */
+
+const KNOWN_PROVIDERS = ['aws', 'netlify'];
+
+/**
+ * Determine the provider name from available sources.
+ *
+ * @param {Object} [appDefinition] - Frigg app definition
+ * @param {string} [providerName] - Explicit override
+ * @returns {string} Provider name (e.g. 'netlify', 'aws')
+ */
+function determineProviderName(appDefinition, providerName) {
+    if (providerName) {
+        return providerName;
+    }
+    if (appDefinition?.provider) {
+        return appDefinition.provider;
+    }
+    if (process.env.FRIGG_PROVIDER) {
+        return process.env.FRIGG_PROVIDER;
+    }
+    return 'aws';
+}
+
+/**
+ * Resolve a provider name to a package name.
+ *
+ * @param {string} name - Provider name (e.g. 'netlify')
+ * @returns {string} npm package name (e.g. '@friggframework/provider-netlify')
+ */
+function providerPackageName(name) {
+    return `@friggframework/provider-${name}`;
+}
+
+/**
+ * Resolve and load the provider plugin for the given app definition.
+ *
+ * @param {Object} [appDefinition] - Frigg app definition (reads .provider)
+ * @param {Object} [options]
+ * @param {string} [options.provider] - Explicit provider name override
+ * @returns {Object} Provider plugin (conforms to the provider plugin interface)
+ * @throws {Error} If the provider package is not installed
+ */
+function resolveProvider(appDefinition, options = {}) {
+    const name = determineProviderName(appDefinition, options.provider);
+    const packageName = providerPackageName(name);
+
+    try {
+        return require(packageName);
+    } catch (error) {
+        if (error.code === 'MODULE_NOT_FOUND') {
+            const hint = KNOWN_PROVIDERS.includes(name)
+                ? `Install it with: npm install ${packageName}`
+                : `Is '${name}' a valid Frigg provider? Known providers: ${KNOWN_PROVIDERS.join(', ')}`;
+
+            throw new Error(
+                `Provider '${name}' specified in appDefinition but package '${packageName}' is not installed.\n  ${hint}`
+            );
+        }
+        throw error;
+    }
+}
+
+module.exports = {
+    resolveProvider,
+    determineProviderName,
+    providerPackageName,
+    KNOWN_PROVIDERS,
+};