@friggframework/core 2.0.0--canary.707.df52379.0 → 2.0.0--canary.686.20eda6e.0

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Unreleased
 
+#### Netlify queue targets are allow-listed
+
+- `NetlifyBackgroundProvider.send()` now accepts only a background function path on the site (`/.netlify/functions/<name>-background`) and an absolute http(s) site URL without credentials. Anything else (`//host/x`, an absolute URL, `..`, a query, an empty `URL`) throws before any request. Previously the queue id was appended to the site URL as given, so an empty site URL and a stored `//host/x` sent a signed message to another host.
+- `NetlifySchedulerAdapter` maps any queue URL that is not such a path to the worker function, as it already did for SQS URLs.
+
 #### Behaviour change: module credential fields are now encrypted
 
 - `credentialFields` declared in an API module's `encryption` config (for example `Definition.encryption.credentialFields`) were never registered for encryption: `loadModuleEncryptionSchemas` required a path that does not exist and the error was swallowed. They are now registered, for modules bound by integrations and for modules registered in `appDefinition.entities` (ADR-059).

package/extensions/extension-loader.js

@@ -17,28 +17,6 @@ const {
     coreExtensionRoutePathError,
 } = require('../management-api/route-registry');
 
-const SCHEMA_DB_TYPES = ['postgresql', 'mongodb'];
-
-function schemaErrors(schema, label) {
-    if (typeof schema === 'string') {
-        return schema.endsWith('.prisma') ? [] : [`${label}: must end with .prisma`];
-    }
-    if (!schema || typeof schema !== 'object' || Array.isArray(schema)) {
-        return [`${label}: must be a string (path to .prisma file) or { postgresql, mongodb } paths`];
-    }
-    const errors = [];
-    const keys = Object.keys(schema);
-    if (keys.length === 0) errors.push(`${label}: names no database type`);
-    for (const key of keys) {
-        if (!SCHEMA_DB_TYPES.includes(key)) {
-            errors.push(`${label}.${key}: unknown database type (expected ${SCHEMA_DB_TYPES.join(' or ')})`);
-        } else if (typeof schema[key] !== 'string' || !schema[key].endsWith('.prisma')) {
-            errors.push(`${label}.${key}: must be a path ending in .prisma`);
-        }
-    }
-    return errors;
-}
-
 /**
  * Validates a single extension definition.
  * @param {Object} ext - Raw extension config from app definition
@@ -58,18 +36,13 @@ function validateExtension(ext, index) {
         errors.push(`${prefix}.name: required string`);
     }
 
-    // schema is optional: a .prisma file for every database, or one per
-    // database type ({ postgresql, mongodb }), since a model written for one
-    // (an autoincrement Int id, a String[] column) does not compile for the other.
+    // schema is optional — path to a .prisma file
     if (ext.schema !== undefined) {
-        errors.push(...schemaErrors(ext.schema, `${prefix}.schema`));
-    }
-
-    // migrations is optional: a directory of Prisma migration folders
-    // (<timestamp>_<name>/migration.sql) for the extension's PostgreSQL models.
-    // They are applied with the core migrations. MongoDB has no migrations.
-    if (ext.migrations !== undefined && (typeof ext.migrations !== 'string' || ext.migrations === '')) {
-        errors.push(`${prefix}.migrations: must be a string (path to a migrations directory)`);
+        if (typeof ext.schema !== 'string') {
+            errors.push(`${prefix}.schema: must be a string (path to .prisma file)`);
+        } else if (!ext.schema.endsWith('.prisma')) {
+            errors.push(`${prefix}.schema: must end with .prisma`);
+        }
     }
 
     // encryption is optional — object with model names → { fields: [...] }
@@ -179,7 +152,6 @@ function loadExtensions(appDefinition) {
         return {
             name: ext.name,
             schema: ext.schema || null,
-            migrations: ext.migrations || null,
             encryption: ext.encryption || null,
             routes: ext.routes
                 ? { path: ext.routes.path, handler: routeHandler }
@@ -197,34 +169,19 @@ function loadExtensions(appDefinition) {
     return normalized.filter(Boolean);
 }
 
-/**
- * The .prisma file an extension adds for one database type.
- * @param {Object} ext - Normalized extension
- * @param {'postgresql'|'mongodb'} [dbType] - Omitted: a string schema only
- * @returns {string|null}
- */
-function extensionSchemaPath(ext, dbType) {
-    if (!ext?.schema) return null;
-    if (typeof ext.schema === 'string') return ext.schema;
-    return dbType ? ext.schema[dbType] || null : null;
-}
-
 /**
  * Get extension schema file paths from loaded extensions.
  * @param {Array<Object>} extensions - Normalized extensions
- * @param {'postgresql'|'mongodb'} [dbType] - Database the paths are for. A
- *   per-database schema ({ postgresql, mongodb }) only answers when given one.
  * @returns {string[]} Array of absolute paths to .prisma schema files
  */
-function getExtensionSchemaPaths(extensions, dbType) {
+function getExtensionSchemaPaths(extensions) {
     return extensions
-        .map((ext) => extensionSchemaPath(ext, dbType))
-        .filter(Boolean);
+        .filter((ext) => ext.schema)
+        .map((ext) => ext.schema);
 }
 
 module.exports = {
     loadExtensions,
     validateExtension,
     getExtensionSchemaPaths,
-    extensionSchemaPath,
 };

package/extensions/index.js

@@ -12,7 +12,6 @@
 
 const { loadExtensions, validateExtension, getExtensionSchemaPaths } = require('./extension-loader');
 const { composeSchemas, extractModelBlocks, getSchemaFilePaths } = require('./schema-composer');
-const { composeExtensionPrisma, resolvePrismaDbTypes } = require('./prisma-composer');
 const {
     mountExtensionRoutes,
     createExtensionRoutesRouter,
@@ -30,8 +29,6 @@ module.exports = {
     composeSchemas,
     extractModelBlocks,
     getSchemaFilePaths,
-    composeExtensionPrisma,
-    resolvePrismaDbTypes,
 
     // Route mounting
     mountExtensionRoutes,

package/handlers/app-definition-loader.js

@@ -12,7 +12,6 @@ const {
     getEntityTypeDefinitions,
 } = require('../modules/entity-type-registry');
 const { resolveOwnershipConfig } = require('../modules/entity-scope');
-const { assertProxyConfig } = require('../modules/proxy/proxy-bases');
 const {
     resolveManagementApiConfig,
 } = require('../management-api/management-api-config');
@@ -109,7 +108,6 @@ function discoverAppDefinition() {
  * @throws {Error} Throws error if user.authModes.adopterJwt is enabled without a usable user.jwtConfig.
  * @throws {OwnershipConfigError} Throws if an ownership or scope setting is invalid (ADR-056 §3.1).
  * @throws {ManagementApiConfigError} Throws if `managementApi.proxy.scopes` is invalid (ADR-056 §3.5).
- * @throws {ProxyConfigError} Throws if a module's `proxy.baseUrls` or an allow rule's `base` is invalid (ADR-052).
  * @throws {ScheduleConfigError} Throws if an integration's `Definition.schedule` is invalid.
  * @example
  * const { integrations, userConfig, telemetry } = loadAppDefinition();
@@ -150,12 +148,7 @@ function resolveAppDefinition(appDefinition) {
     // And for the Management API: `managementApi.proxy.scopes` decides whose
     // credentials the entity proxy may act through (ADR-056 §3.5), so an
     // unknown scope stops the app here rather than being read as a default.
-    const managementApiConfig = resolveManagementApiConfig(managementApi);
-
-    // Named proxy bases (ADR-052 amendment): a module that declares both
-    // `baseUrl` and `baseUrls`, a bad base URL or name, or an allow rule for a
-    // base the module lacks, stops the app here.
-    assertProxyConfig(moduleDefinitions, managementApiConfig.proxy);
+    resolveManagementApiConfig(managementApi);
 
     // And for each integration's `Definition.schedule`: a mistyped scope would
     // otherwise tick ONGOING_SYNC per class when per installation was meant.

package/index.js

@@ -268,7 +268,6 @@ module.exports = {
     extensions,
     loadExtensions: extensions.loadExtensions,
     composeSchemas: extensions.composeSchemas,
-    composeExtensionPrisma: extensions.composeExtensionPrisma,
     mountExtensionRoutes: extensions.mountExtensionRoutes,
     createExtensionRoutesRouter: extensions.createExtensionRoutesRouter,
     runExtensionBootstraps: extensions.runExtensionBootstraps,

package/infrastructure/scheduler/netlify-scheduler-adapter.js

@@ -23,6 +23,9 @@
  */
 
 const { SchedulerServiceInterface } = require('./scheduler-service-interface');
+const {
+    isBackgroundFunctionPath,
+} = require('../../queues/providers/netlify-background-provider');
 
 // The one queue worker every Netlify deployment has (provider-netlify's
 // worker-background function); it dispatches by integrationName.
@@ -58,16 +61,17 @@ class NetlifySchedulerAdapter extends SchedulerServiceInterface {
 
     /**
      * Where a due job is sent. Netlify has no per-integration queues, so an
-     * SQS-style queue URL (often unset here) maps to the worker function;
-     * a function path is kept as given.
+     * SQS-style queue URL (often unset here) maps to the worker function.
+     * A background function path ('/.netlify/functions/<name>-background')
+     * is kept; any other value, including '//host/x' or a path with '..',
+     * maps to the worker too, so a stored job can only ever reach a
+     * background function on this site.
      *
      * @param {string} [queueUrl]
      * @returns {string} a path NetlifyBackgroundProvider.send() accepts
      */
     toQueueResourceId(queueUrl) {
-        return typeof queueUrl === 'string' && queueUrl.startsWith('/')
-            ? queueUrl
-            : DEFAULT_WORKER_PATH;
+        return isBackgroundFunctionPath(queueUrl) ? queueUrl : DEFAULT_WORKER_PATH;
     }
 
     async scheduleOneTime({

package/management-api/openapi/components.js

@@ -40,7 +40,7 @@ const errorBody = {
                 code: {
                     type: 'string',
                     description:
-                        'Machine-readable code, e.g. VALIDATION_ERROR, NOT_FOUND, ENTITY_NOT_FOUND, AUTHORIZATION_SESSION_NOT_FOUND, PROXY_NOT_ALLOWED, PROXY_UNKNOWN_BASE. New codes may be added.',
+                        'Machine-readable code, e.g. VALIDATION_ERROR, NOT_FOUND, ENTITY_NOT_FOUND, AUTHORIZATION_SESSION_NOT_FOUND, PROXY_NOT_ALLOWED. New codes may be added.',
                 },
                 message: { type: 'string' },
                 details: { description: 'Optional structured details' },
@@ -287,13 +287,7 @@ const SCHEMAS = {
                 type: 'string',
                 pattern: '^/',
                 description:
-                    "Path relative to the module's base URL (the one named by `base`). No //, backslashes, ? or #, dot segments, encoded separators or double encoding. The host always comes from the module.",
-            },
-            base: {
-                type: 'string',
-                pattern: '^[a-z][a-z0-9-]*$',
-                description:
-                    "Name of one of the module's base URLs (ADR-052 amendment); default when omitted. A name the module declares, never a URL or host. An unknown name is 400 PROXY_UNKNOWN_BASE.",
+                    "Path relative to the module's base URL. No //, backslashes, ? or #, dot segments, encoded separators or double encoding. The host always comes from the module.",
             },
             query: {
                 type: 'object',
@@ -305,8 +299,7 @@ const SCHEMAS = {
                         { type: 'array', items: { type: 'string' } },
                     ],
                 },
-                description:
-                    'Array values are sent comma-separated (`ids: ["1","2"]` → `ids=1,2`), except under a key ending in `[]`, which is sent once per value (`"fields[]": ["a","b"]` → `fields%5B%5D=a&fields%5B%5D=b`; an empty array sends nothing).',
+                description: 'Array values are sent comma-separated',
             },
             headers: {
                 type: 'object',

package/management-api/openapi/v2-operations.js

@@ -165,11 +165,11 @@ const V2_OPERATIONS = {
     proxyEntityRequest: {
         summary: "Call the entity's API through Frigg (beta)",
         description:
-            "ADR-052. Off unless the app sets managementApi.proxy.enable. Path-only input relative to the module's base URL; `base` optionally names one of the module's several base URLs (default `default`; a name, never a URL), and allow-list rules match per base. Deny by default, only operations in the module's (or the app's) allow-list. ADR-056 §3.5: the caller needs use access to the entity in the active organization (an entity they cannot see there is 404), and the entity's scope must be in managementApi.proxy.scopes (default individual only; 403 PROXY_NOT_ALLOWED with details.reason 'scope', or 'access' for view-only access). The HTTP status follows the upstream status; upstream 5xx is 502 UPSTREAM_ERROR, 429 keeps Retry-After.",
+            "ADR-052. Off unless the app sets managementApi.proxy.enable. Path-only input relative to the module's base URL; deny by default, only operations in the module's (or the app's) allow-list. ADR-056 §3.5: the caller needs use access to the entity in the active organization (an entity they cannot see there is 404), and the entity's scope must be in managementApi.proxy.scopes (default individual only; 403 PROXY_NOT_ALLOWED with details.reason 'scope', or 'access' for view-only access). The HTTP status follows the upstream status; upstream 5xx is 502 UPSTREAM_ERROR, 429 keeps Retry-After.",
         requestBody: body(ref('ProxyRequest')),
         responses: {
             200: ok('Upstream answer (the status mirrors the upstream status)', ref('ProxyResponse')),
-            400: ok('INVALID_PROXY_REQUEST, or PROXY_UNKNOWN_BASE (`base` is not one of the module\'s base names; the message lists them)', ref('ProxyError')),
+            400: ok('INVALID_PROXY_REQUEST', ref('ProxyError')),
             401: ok('INVALID_CREDENTIALS or unauthenticated', ref('ProxyError')),
             403: ok("PROXY_NOT_ALLOWED: not in the allow-list, or details.reason 'scope' / 'access'", ref('ProxyError')),
             404: ok('Entity not found, or not visible in the active organization', ref('Error')),

package/modules/proxy/proxy-errors.js

@@ -17,15 +17,4 @@ class ProxyRequestError extends Error {
     }
 }
 
-/**
- * A module definition or the app's proxy settings are wrong. Thrown at load,
- * so the app stops starting instead of failing on the first proxied call.
- */
-class ProxyConfigError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'ProxyConfigError';
-    }
-}
-
-module.exports = { ProxyRequestError, ProxyConfigError };
+module.exports = { ProxyRequestError };

package/modules/proxy/proxy-path.js

@@ -1,5 +1,4 @@
 const { ProxyRequestError } = require('./proxy-errors');
-const { DEFAULT_BASE, ruleBase } = require('./proxy-bases');
 
 /**
  * Path rules for the entity proxy (ADR-052 §4). The caller supplies a path
@@ -134,7 +133,7 @@ function joinProxyUrl(baseUrl, normalizedPath) {
 }
 
 /**
- * Finds the allow-list rule that permits `method` on `path` of `base`.
+ * Finds the allow-list rule that permits `method` on `path`.
  *
  * Patterns use `:param` for exactly one segment and a trailing `/**` for a
  * subtree (the prefix itself included). `method: '*'` matches any method.
@@ -142,17 +141,14 @@ function joinProxyUrl(baseUrl, normalizedPath) {
  * @param {Array<{method: string, path: string}>} rules
  * @param {string} method - upper case
  * @param {string} path - normalised path
- * @param {string} [base='default'] - the named base the request targets; a
- *   rule applies to its own `base` only (no `base` means `default`)
- * @returns {{method: string, path: string, base?: string}|null}
+ * @returns {{method: string, path: string}|null}
  */
-function matchAllowRule(rules, method, path, base = DEFAULT_BASE) {
+function matchAllowRule(rules, method, path) {
     const requestSegments = path.split('/').slice(1);
     for (const rule of rules || []) {
         if (!rule || typeof rule.path !== 'string' || typeof rule.method !== 'string') {
             continue;
         }
-        if (ruleBase(rule) !== base) continue;
         const ruleMethod = rule.method.toUpperCase();
         if (ruleMethod !== '*' && ruleMethod !== method) continue;
         if (patternMatches(rule.path, requestSegments)) return rule;

package/modules/proxy/proxy-policy.js

@@ -1,5 +1,4 @@
 const { ProxyRequestError } = require('./proxy-errors');
-const { isValidBaseName } = require('./proxy-bases');
 
 /**
  * What the entity proxy accepts and returns (ADR-052 §5-§7). Pure functions:
@@ -53,13 +52,6 @@ const REMOVED_RESPONSE_HEADERS = [
 const invalid = (message, details) =>
     new ProxyRequestError('INVALID_PROXY_REQUEST', message, details);
 
-/**
- * A query key ending in `[]` is sent as one `key=value` pair per array
- * element; the requester applies the same rule (see
- * `_rawRequest` in requester.js).
- */
-const isRepeatedQueryKey = (key) => key.endsWith('[]');
-
 const isPlainObject = (value) =>
     value !== null && typeof value === 'object' && !Array.isArray(value);
 
@@ -69,7 +61,7 @@ const isPlainObject = (value) =>
  *
  * @param {unknown} request
  * @param {{ maxRequestBytes: number }} limits
- * @returns {{ method: string, path: string, base?: string, query?: Object, headers: Object, body?: string, requestBytes: number, bodyIsJson: boolean }}
+ * @returns {{ method: string, path: string, query?: Object, headers: Object, body?: string, requestBytes: number, bodyIsJson: boolean }}
  */
 function validateProxyRequest(request, { maxRequestBytes }) {
     if (!isPlainObject(request)) throw invalid('The proxy request must be a JSON object');
@@ -81,19 +73,6 @@ function validateProxyRequest(request, { maxRequestBytes }) {
         throw invalid('path is required', { field: 'path' });
     }
 
-    // `base` is a name, never a URL or host; anything else is refused before
-    // a module is looked up. Omitted means `default` (the caller applies it).
-    let base;
-    if (request.base !== undefined && request.base !== null) {
-        if (typeof request.base !== 'string' || !isValidBaseName(request.base)) {
-            throw invalid(
-                'base must be the name of one of the module\'s base URLs (lower case letters, digits and -), not a URL or host',
-                { field: 'base' }
-            );
-        }
-        base = request.base;
-    }
-
     let query;
     if (request.query !== undefined && request.query !== null) {
         if (!isPlainObject(request.query)) throw invalid('query must be an object', { field: 'query' });
@@ -106,13 +85,8 @@ function validateProxyRequest(request, { maxRequestBytes }) {
                     field: `query.${key}`,
                 });
             }
-            // A key ending in `[]` (`fields[]`) is sent once per value, as
-            // Airtable and Fathom expect; every other array goes comma-separated.
-            if (list) {
-                query[key] = isRepeatedQueryKey(key) ? [...value] : value.join(',');
-            } else {
-                query[key] = value;
-            }
+            // The requester sends one value per key; arrays go comma-separated.
+            query[key] = list ? value.join(',') : value;
         }
     }
 
@@ -147,19 +121,16 @@ function validateProxyRequest(request, { maxRequestBytes }) {
             `The proxied request body is larger than ${maxRequestBytes} bytes`
         );
     }
-    return { method, path: request.path, ...(base !== undefined && { base }), query, headers, body, bodyIsJson, requestBytes };
+    return { method, path: request.path, query, headers, body, bodyIsJson, requestBytes };
 }
 
 const isWildcardRule = (rule) => rule?.method === '*' || rule?.path === '/**';
 
-// A rule's `base` is checked against the module's declared bases at load, by
-// assertProxyConfig (proxy-bases.js); here only its shape is.
 const isValidRule = (rule) =>
     isPlainObject(rule) &&
     typeof rule.method === 'string' &&
     typeof rule.path === 'string' &&
-    rule.path.startsWith('/') &&
-    (rule.base === undefined || isValidBaseName(rule.base));
+    rule.path.startsWith('/');
 
 /**
  * The allow-list in force for a module: the app definition's list for it when

package/modules/requester/proxy-request.js

@@ -28,8 +28,7 @@ const MAX_REDIRECTS = 3;
  * @param {Object} [params.query]
  * @param {Object} [params.headers] - already filtered by the caller's policy
  * @param {string|Buffer} [params.body] - already serialised
- * @param {string} [params.baseUrl] - the module-declared URL of the base the
- *   caller named (ADR-052 amendment; resolved by the use case); falls
+ * @param {string} [params.baseUrl] - module-declared proxy base URL; falls
  *   back to the requester's `proxyBaseUrl`, `baseUrl` or `baseURL`
  * @param {number} params.timeoutMs - budget for the whole call
  * @param {number} params.maxResponseBytes

package/modules/requester/requester.js

@@ -219,14 +219,9 @@ class Requester extends Delegate {
         if (options.query) {
             let queryBuild = '?';
             for (const key in options.query) {
-                const value = options.query[key];
-                // `fields[]: ['a', 'b']` -> `fields%5B%5D=a&fields%5B%5D=b`.
-                // Any other array keeps String(value), i.e. comma-joined.
-                const values =
-                    Array.isArray(value) && key.endsWith('[]') ? value : [value];
-                for (const v of values) {
-                    queryBuild += `${encodeURIComponent(key)}=${encodeURIComponent(v)}&`;
-                }
+                queryBuild += `${encodeURIComponent(key)}=${encodeURIComponent(
+                    options.query[key]
+                )}&`;
             }
             encodedUrl += queryBuild.slice(0, -1);
         }

package/modules/use-cases/execute-entity-proxy-request.js

@@ -1,11 +1,10 @@
 const Boom = require('@hapi/boom');
 const { getLogger } = require('../../logs');
 const { getTelemetry } = require('../../telemetry/telemetry-runtime');
-const { ProxyRequestError, ProxyConfigError } = require('../proxy/proxy-errors');
+const { ProxyRequestError } = require('../proxy/proxy-errors');
 const { SCOPES } = require('../scope-resolution');
 const { grantsUse } = require('../scope-visibility');
 const { normalizeProxyPath, matchAllowRule } = require('../proxy/proxy-path');
-const { DEFAULT_BASE, resolveModuleBases } = require('../proxy/proxy-bases');
 const {
     validateProxyRequest,
     resolveAllowRules,
@@ -19,7 +18,6 @@ const log = getLogger('frigg.api.proxy');
 /** HTTP status and audit outcome for each proxy error code (ADR-052 §10). */
 const ERROR_MAP = {
     INVALID_PROXY_REQUEST: { status: 400, outcome: 'denied' },
-    PROXY_UNKNOWN_BASE: { status: 400, outcome: 'denied' },
     PROXY_NOT_ALLOWED: { status: 403, outcome: 'denied' },
     PAYLOAD_TOO_LARGE: { status: 413, outcome: 'too_large' },
     UNSUPPORTED_MEDIA_TYPE: { status: 415, outcome: 'denied' },
@@ -112,19 +110,6 @@ class ExecuteEntityProxyRequest {
             audit.module = definition.moduleName;
             this.assertProxyable(entityId, entity, definition, user);
 
-            // The base is a name the module declared; the host comes from the
-            // module's declaration, never from the request.
-            const base = validated.base ?? DEFAULT_BASE;
-            audit.base = base;
-            const bases = this.basesOf(definition);
-            if (!bases.names.includes(base)) {
-                throw new ProxyRequestError(
-                    'PROXY_UNKNOWN_BASE',
-                    `Module ${definition.moduleName} has no base named ${base}; use one of: ${bases.names.join(', ')}`,
-                    { module: definition.moduleName, base, bases: bases.names }
-                );
-            }
-
             const credentialRef = entity.credential;
             const credentialId =
                 credentialRef && typeof credentialRef === 'object'
@@ -135,14 +120,12 @@ class ExecuteEntityProxyRequest {
             }
 
             const { rules } = resolveAllowRules(definition, this.proxyConfig.modules);
-            const rule = matchAllowRule(rules, validated.method, path, base);
+            const rule = matchAllowRule(rules, validated.method, path);
             if (!rule) {
                 throw new ProxyRequestError(
                     'PROXY_NOT_ALLOWED',
-                    `Module ${definition.moduleName} does not allow ${validated.method} on this path` +
-                        // Single-base modules keep the message they always had.
-                        (bases.names.length > 1 ? ` of base ${base}` : ''),
-                    { module: definition.moduleName, method: validated.method, base }
+                    `Module ${definition.moduleName} does not allow ${validated.method} on this path`,
+                    { module: definition.moduleName, method: validated.method }
                 );
             }
             audit.pattern = rule.path;
@@ -170,11 +153,11 @@ class ExecuteEntityProxyRequest {
                 query: validated.query,
                 headers,
                 body: validated.body,
-                baseUrl: this.resolveBaseUrl(bases, module.api, base),
+                baseUrl: this.resolveBaseUrl(definition, module.api),
                 timeoutMs: this.proxyConfig.timeoutMs,
                 maxResponseBytes: this.proxyConfig.maxResponseBytes,
                 isAllowedRedirect: (nextPath, nextMethod) =>
-                    Boolean(matchAllowRule(rules, nextMethod, nextPath, base)),
+                    Boolean(matchAllowRule(rules, nextMethod, nextPath)),
             });
             audit.upstreamStatus = upstream.status;
             audit.responseBytes = upstream.body?.length ?? 0;
@@ -266,40 +249,12 @@ class ExecuteEntityProxyRequest {
         }
     }
 
-    /**
-     * The module's bases. Load already validated the definition
-     * (assertProxyConfig), so this only fails for a definition that skipped
-     * load; that is a configuration fault (501), never an unmapped 500.
-     */
-    basesOf(definition) {
-        try {
-            return resolveModuleBases(definition);
-        } catch (error) {
-            if (!(error instanceof ProxyConfigError)) throw error;
-            throw new ProxyRequestError(
-                'PROXY_NOT_CONFIGURED',
-                `Module ${definition.moduleName} has invalid proxy settings`
-            );
-        }
-    }
-
-    /**
-     * The URL of the named base. A base the module declared never falls back
-     * to the requester's own host (that would send the module's token to a
-     * host the module did not name); only a module that declares nothing at
-     * all uses the requester's base URL, signalled by undefined.
-     */
-    resolveBaseUrl(bases, api, name) {
-        const declared = bases.values.get(name);
-        if (!bases.declared) return undefined;
-        const url = typeof declared === 'function' ? declared(api) : declared;
-        if (typeof url !== 'string' || url === '') {
-            throw new ProxyRequestError(
-                'PROXY_NOT_CONFIGURED',
-                `The module declares no usable URL for base ${name}`
-            );
-        }
-        return url;
+    /** A module may pin its proxy base URL (string, or a function of the api). */
+    resolveBaseUrl(definition, api) {
+        const declared = definition.proxy?.baseUrl;
+        if (typeof declared === 'function') return declared(api);
+        if (typeof declared === 'string') return declared;
+        return undefined;
     }
 
     /** One audit record (ADR-048) and one usage count (ADR-011) per call. */

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.707.df52379.0",
+    "version": "2.0.0--canary.686.20eda6e.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -48,9 +48,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.707.df52379.0",
-        "@friggframework/prettier-config": "2.0.0--canary.707.df52379.0",
-        "@friggframework/test": "2.0.0--canary.707.df52379.0",
+        "@friggframework/eslint-config": "2.0.0--canary.686.20eda6e.0",
+        "@friggframework/prettier-config": "2.0.0--canary.686.20eda6e.0",
+        "@friggframework/test": "2.0.0--canary.686.20eda6e.0",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -90,5 +90,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "df52379ae496d26aec99abe2127f304230e86f36"
+    "gitHead": "20eda6e4013af2a8b0432122b697a352b40350c0"
 }

package/queues/providers/netlify-background-provider.js

@@ -36,6 +36,43 @@ const {
     readRawBody,
 } = require('../queue-message-auth');
 
+// A queue target is a background function on this site, named by path and
+// nothing else: no scheme, no host, no '//', no '..', no query. Anything
+// else would let a stored or configured queue id send a signed message to
+// another host (a protocol-relative '//host/x' when the base URL is empty)
+// or to a function that is not a queue worker.
+const BACKGROUND_FUNCTION_PATH = /^\/\.netlify\/functions\/[A-Za-z0-9][A-Za-z0-9_-]*-background$/;
+
+function isBackgroundFunctionPath(queueId) {
+    return typeof queueId === 'string' && BACKGROUND_FUNCTION_PATH.test(queueId);
+}
+
+/**
+ * The URL a message for `queueId` is POSTed to, or a thrown error.
+ * The base must be an absolute http(s) origin; the path must be a
+ * background function (see BACKGROUND_FUNCTION_PATH).
+ */
+function backgroundFunctionUrl(baseUrl, queueId) {
+    if (!isBackgroundFunctionPath(queueId)) {
+        throw new Error(
+            `Refusing to send to queue id ${JSON.stringify(String(queueId))}: ` +
+                "a Netlify queue id must be '/.netlify/functions/<name>-background'"
+        );
+    }
+    let base;
+    try {
+        base = new URL(baseUrl);
+    } catch {
+        throw new Error(
+            'NetlifyBackgroundProvider needs an absolute site URL (options.baseUrl or the URL environment variable)'
+        );
+    }
+    if (!['http:', 'https:'].includes(base.protocol) || base.username || base.password) {
+        throw new Error('NetlifyBackgroundProvider site URL must be http(s) with no credentials');
+    }
+    return `${base.origin}${queueId}`;
+}
+
 class NetlifyBackgroundProvider extends QueueProvider {
     /**
      * @param {Object} [options]
@@ -68,7 +105,7 @@ class NetlifyBackgroundProvider extends QueueProvider {
      * @param {string} queueId - Background function path (e.g., '/.netlify/functions/worker-background')
      */
     async send(message, queueId) {
-        const url = `${this.baseUrl}${queueId}`;
+        const url = backgroundFunctionUrl(this.baseUrl, queueId);
         const body = JSON.stringify(message);
         const headers = { 'Content-Type': 'application/json' };
 
@@ -147,4 +184,4 @@ class NetlifyBackgroundProvider extends QueueProvider {
     }
 }
 
-module.exports = { NetlifyBackgroundProvider };
+module.exports = { NetlifyBackgroundProvider, isBackgroundFunctionPath, backgroundFunctionUrl };

package/types/modules/index.d.ts

@@ -15,7 +15,7 @@ declare module "@friggframework/core" {
 
   export interface EntityTypeEntry {
     /** The API module definition. */
-    definition: { moduleName?: string; proxy?: ModuleProxyConfig; [key: string]: any };
+    definition: any;
     /** Frozen. `{ kind: 'app' }` first when registered, then each binding integration. */
     sources: readonly EntityTypeSource[];
     /** Frozen. */
@@ -73,23 +73,6 @@ declare module "@friggframework/core" {
     method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "*";
     /** Relative to the module's base URL. `:param` is one segment; a trailing `/**` is a subtree. */
     path: string;
-    /** Which of the module's named base URLs the rule applies to. Default `"default"`. Must be declared by the module (checked at load). */
-    base?: string;
-  }
-
-  /**
-   * A module definition's `proxy` setting (ADR-052). Declare `baseUrl` (one host,
-   * meaning `{ default: baseUrl }`) or `baseUrls` (several), never both.
-   * `baseUrls` values are absolute https URLs with no credentials, query or
-   * fragment (strings only, unlike `baseUrl`); names match `^[a-z][a-z0-9-]*$`.
-   * A caller picks a base by name in the proxy request's `base`.
-   */
-  export interface ModuleProxyConfig {
-    baseUrl?: string | ((api: any) => string);
-    baseUrls?: Record<string, string>;
-    allow?: ProxyAllowRule[];
-    headers?: string[];
-    binary?: boolean;
   }
 
   /** `appDefinition.managementApi.proxy`: the entity proxy, POST /api/v2/entities/:id/proxy (ADR-052). */

package/extensions/prisma-composer.js

@@ -1,270 +0,0 @@
-/**
- * Prisma composer: puts core extensions' models into the Prisma client.
- *
- * Core ships one generated client per database (`generated/prisma-<db>`),
- * built from `prisma-<db>/schema.prisma`. A core extension that declares a
- * schema (`coreExtensions[].schema`) needs its models in that client, and on
- * PostgreSQL its tables need migrations (`coreExtensions[].migrations`).
- * Without this step the extension's models exist nowhere: every call to
- * `prisma.<model>` is undefined, and the table is never created.
- *
- * At build time, for each database the app uses:
- *   1. The pristine core schema is kept as `schema.base.prisma` (taken from
- *      `schema.prisma` the first time), so composing again never appends twice.
- *   2. `schema.prisma` becomes base + the extensions' models. Everything that
- *      reads the schema (prisma generate, the migration runner, the Lambda
- *      layer, which copies the generated client's schema) sees the composed one.
- *   3. PostgreSQL: each extension migration folder is copied into
- *      `prisma-postgresql/migrations`, so `prisma migrate deploy` applies it in
- *      timestamp order with the core migrations.
- *   4. `prisma generate` rebuilds `generated/prisma-<db>` from the composed
- *      schema, only when the schema changed or the client is missing.
- *
- * Removing every extension restores the base schema and regenerates. Copied
- * migrations are left in place: a migration that may already be applied must
- * not disappear from the history.
- */
-
-const fs = require('fs');
-const path = require('path');
-const { execFileSync } = require('child_process');
-const {
-    loadExtensions,
-    getExtensionSchemaPaths,
-} = require('./extension-loader');
-const { extractModelBlocks } = require('./schema-composer');
-
-const DB_TYPES = ['postgresql', 'mongodb'];
-
-/**
- * The Prisma databases an app definition uses. DocumentDB uses the MongoDB client.
- * @param {Object} appDefinition
- * @returns {Array<'postgresql'|'mongodb'>}
- */
-function resolvePrismaDbTypes(appDefinition) {
-    const db = appDefinition?.database || {};
-    const types = [];
-    if (db.postgres?.enable) types.push('postgresql');
-    if (db.mongoDB?.enable || db.documentDB?.enable) types.push('mongodb');
-    return types;
-}
-
-function blockNames(schemaContent) {
-    const names = [];
-    const re = /^\s*(model|enum|type|view)\s+(\w+)\s*\{/gm;
-    let match;
-    while ((match = re.exec(schemaContent)) !== null) names.push(match[2]);
-    return names;
-}
-
-/**
- * Base schema + the extensions' model blocks. Throws when an extension
- * declares a model, enum or type the base (or another extension) already has.
- */
-function buildComposedSchema(baseContent, extensionSchemaPaths) {
-    const seen = new Map(
-        blockNames(baseContent).map((name) => [name, 'the core schema'])
-    );
-    const sections = [];
-
-    for (const extPath of extensionSchemaPaths) {
-        if (!fs.existsSync(extPath)) {
-            throw new Error(`Extension schema not found: ${extPath}`);
-        }
-        const blocks = extractModelBlocks(fs.readFileSync(extPath, 'utf-8'));
-        if (!blocks) continue;
-        for (const name of blockNames(blocks)) {
-            if (seen.has(name)) {
-                throw new Error(
-                    `Extension schema ${extPath} declares "${name}", already declared by ${seen.get(
-                        name
-                    )}`
-                );
-            }
-            seen.set(name, extPath);
-        }
-        sections.push(`// --- Extension schema: ${extPath} ---`, blocks, '');
-    }
-
-    if (sections.length === 0) return baseContent;
-
-    return [
-        baseContent.trimEnd(),
-        '',
-        '// =========================================================================',
-        '// Extension models (composed by @friggframework/core at build; do not edit)',
-        '// =========================================================================',
-        '',
-        ...sections,
-    ].join('\n');
-}
-
-/**
- * Copies each extension's migration folders into the core migrations
- * directory. A folder already there with the same migration.sql is skipped;
- * a different one under the same name is an error (it would silently be a
- * different migration with an applied migration's name).
- * @returns {string[]} names of the folders copied
- */
-function copyExtensionMigrations(extensions, migrationsDir) {
-    const copied = [];
-    for (const ext of extensions) {
-        if (!ext.migrations) continue;
-        if (
-            !fs.existsSync(ext.migrations) ||
-            !fs.statSync(ext.migrations).isDirectory()
-        ) {
-            throw new Error(
-                `Extension "${ext.name}" migrations directory not found: ${ext.migrations}`
-            );
-        }
-        const folders = fs
-            .readdirSync(ext.migrations, { withFileTypes: true })
-            .filter((entry) => entry.isDirectory())
-            .map((entry) => entry.name)
-            .sort();
-        for (const folder of folders) {
-            const source = path.join(ext.migrations, folder, 'migration.sql');
-            if (!fs.existsSync(source)) {
-                throw new Error(
-                    `Extension "${ext.name}" migration ${folder} has no migration.sql`
-                );
-            }
-            const sql = fs.readFileSync(source, 'utf-8');
-            const destDir = path.join(migrationsDir, folder);
-            const dest = path.join(destDir, 'migration.sql');
-            if (fs.existsSync(dest)) {
-                if (fs.readFileSync(dest, 'utf-8') !== sql) {
-                    throw new Error(
-                        `Migration ${folder} from extension "${ext.name}" conflicts with an existing migration of the same name`
-                    );
-                }
-                continue;
-            }
-            fs.mkdirSync(destDir, { recursive: true });
-            fs.writeFileSync(dest, sql, 'utf-8');
-            copied.push(folder);
-        }
-    }
-    return copied;
-}
-
-/**
- * Runs `prisma generate` with the Prisma CLI installed beside core (the app's
- * own `prisma`), falling back to npx.
- */
-function defaultGenerate({ schemaPath, corePath }) {
-    let cli;
-    try {
-        cli = require.resolve('prisma/build/index.js', {
-            paths: [corePath, process.cwd()],
-        });
-    } catch {
-        cli = null;
-    }
-    const [command, args] = cli
-        ? [process.execPath, [cli, 'generate', `--schema=${schemaPath}`]]
-        : ['npx', ['prisma', 'generate', `--schema=${schemaPath}`]];
-    execFileSync(command, args, { cwd: corePath, stdio: 'inherit' });
-}
-
-/**
- * Composes the extensions' schemas and migrations into core's Prisma schema
- * and regenerates the client when it changed.
- *
- * @param {Object} params
- * @param {Object} params.appDefinition
- * @param {string} params.corePath - Directory of the installed @friggframework/core
- * @param {Array<'postgresql'|'mongodb'>} [params.dbTypes] - Defaults to the app definition's databases
- * @param {Function} [params.generate] - ({ schemaPath, corePath, dbType }) => void
- * @param {Function} [params.log]
- * @returns {{ changed: boolean, results: Array<Object> }}
- */
-function composeExtensionPrisma({
-    appDefinition,
-    corePath,
-    dbTypes,
-    generate = defaultGenerate,
-    log = (message) => console.log(message),
-}) {
-    if (!corePath) throw new Error('corePath is required');
-    const extensions = loadExtensions(appDefinition);
-    const types = (dbTypes || resolvePrismaDbTypes(appDefinition)).filter((t) =>
-        DB_TYPES.includes(t)
-    );
-    const results = [];
-
-    for (const dbType of types) {
-        const schemaDir = path.join(corePath, `prisma-${dbType}`);
-        const schemaPath = path.join(schemaDir, 'schema.prisma');
-        const basePath = path.join(schemaDir, 'schema.base.prisma');
-        if (!fs.existsSync(schemaPath)) {
-            throw new Error(`Core Prisma schema not found: ${schemaPath}`);
-        }
-
-        const extensionSchemas = getExtensionSchemaPaths(extensions, dbType);
-        // Migrations do not depend on a schema: an extension may ship only
-        // SQL (a table it reads with raw queries), and it must still be applied.
-        const migrations =
-            dbType === 'postgresql'
-                ? copyExtensionMigrations(
-                      extensions,
-                      path.join(schemaDir, 'migrations')
-                  )
-                : [];
-        if (migrations.length > 0) {
-            log(`[Frigg] Added extension migrations: ${migrations.join(', ')}`);
-        }
-
-        // No schema to compose and none composed before: the schema and the
-        // client stay exactly as core shipped them.
-        if (extensionSchemas.length === 0 && !fs.existsSync(basePath)) {
-            results.push({
-                dbType,
-                changed: migrations.length > 0,
-                migrations,
-            });
-            continue;
-        }
-
-        if (!fs.existsSync(basePath)) fs.copyFileSync(schemaPath, basePath);
-        const target = buildComposedSchema(
-            fs.readFileSync(basePath, 'utf-8'),
-            extensionSchemas
-        );
-        const current = fs.readFileSync(schemaPath, 'utf-8');
-        const schemaChanged = current !== target;
-        if (schemaChanged) fs.writeFileSync(schemaPath, target, 'utf-8');
-
-        const clientPath = path.join(
-            corePath,
-            'generated',
-            `prisma-${dbType}`,
-            'schema.prisma'
-        );
-        const clientStale =
-            !fs.existsSync(clientPath) ||
-            fs.readFileSync(clientPath, 'utf-8') !== target;
-
-        if (schemaChanged || clientStale) {
-            log(
-                `[Frigg] Composing ${extensionSchemas.length} extension schema(s) into the ${dbType} Prisma client`
-            );
-            generate({ schemaPath, corePath, dbType });
-        }
-        results.push({
-            dbType,
-            changed: schemaChanged || clientStale || migrations.length > 0,
-            migrations,
-        });
-    }
-
-    return { changed: results.some((r) => r.changed), results };
-}
-
-module.exports = {
-    composeExtensionPrisma,
-    resolvePrismaDbTypes,
-    buildComposedSchema,
-    copyExtensionMigrations,
-};

package/modules/proxy/proxy-bases.js

@@ -1,169 +0,0 @@
-const { ProxyConfigError } = require('./proxy-errors');
-
-/**
- * Named base URLs for the entity proxy (ADR-052, amendment 2026-10-18).
- *
- * A module declares where its API lives. One host is `proxy.baseUrl`, which
- * means `{ default: baseUrl }`. A module whose API spans several hosts (Google:
- * Drive, Docs, Sheets, Analytics Data, Ads) declares `proxy.baseUrls`, a map of
- * name to URL. A caller picks a base by NAME in the proxy request's `base`
- * field; it never supplies a URL or a host, so the host still comes only from
- * the module.
- */
-
-const DEFAULT_BASE = 'default';
-const BASE_NAME = /^[a-z][a-z0-9-]*$/;
-
-const isPlainObject = (value) =>
-    value !== null && typeof value === 'object' && !Array.isArray(value);
-
-const describeRule = (rule) =>
-    `${rule && typeof rule.method === 'string' ? rule.method : '?'} ${
-        rule && typeof rule.path === 'string' ? rule.path : '?'
-    }`;
-
-function isValidBaseName(name) {
-    return typeof name === 'string' && name.length <= 64 && BASE_NAME.test(name);
-}
-
-function assertBaseUrl(moduleName, name, value) {
-    const where = `Module ${moduleName} proxy.baseUrls.${name}`;
-    if (typeof value !== 'string') {
-        throw new ProxyConfigError(`${where} must be an absolute https URL string (functions are not accepted)`);
-    }
-    let url;
-    try {
-        url = new URL(value);
-    } catch {
-        throw new ProxyConfigError(`${where} is not a valid absolute URL`);
-    }
-    if (url.protocol !== 'https:') {
-        throw new ProxyConfigError(`${where} must use https`);
-    }
-    if (url.username || url.password || url.search || url.hash) {
-        throw new ProxyConfigError(
-            `${where} must not carry credentials, a query or a fragment`
-        );
-    }
-}
-
-/**
- * The bases a module declares, validated.
- *
- * @param {object} definition - a module definition
- * @returns {{ names: string[], values: Map<string, string|Function|undefined>, declared: boolean }}
- *   `declared` is false when the module names no base of its own; it then has
- *   the single base `default`, resolved from the requester at call time.
- * @throws {ProxyConfigError}
- */
-function resolveModuleBases(definition) {
-    const moduleName = definition?.moduleName ?? '(unnamed)';
-    const proxy = definition?.proxy;
-    const hasBaseUrl = proxy?.baseUrl !== undefined;
-    const hasBaseUrls = proxy?.baseUrls !== undefined;
-
-    if (hasBaseUrl && hasBaseUrls) {
-        throw new ProxyConfigError(
-            `Module ${moduleName} declares both proxy.baseUrl and proxy.baseUrls; use one ` +
-                '(baseUrl means { default: baseUrl })'
-        );
-    }
-    if (hasBaseUrls) {
-        if (!isPlainObject(proxy.baseUrls) || Object.keys(proxy.baseUrls).length === 0) {
-            throw new ProxyConfigError(
-                `Module ${moduleName} proxy.baseUrls must be a non-empty object of name to URL`
-            );
-        }
-        const values = new Map();
-        for (const [name, value] of Object.entries(proxy.baseUrls)) {
-            if (!isValidBaseName(name)) {
-                throw new ProxyConfigError(
-                    `Module ${moduleName} proxy.baseUrls has the invalid name ${JSON.stringify(
-                        name
-                    )}; names match ${BASE_NAME}`
-                );
-            }
-            assertBaseUrl(moduleName, name, value);
-            values.set(name, value);
-        }
-        return { names: [...values.keys()], values, declared: true };
-    }
-    return {
-        names: [DEFAULT_BASE],
-        values: new Map([[DEFAULT_BASE, proxy?.baseUrl]]),
-        declared: hasBaseUrl,
-    };
-}
-
-/** The base a rule applies to; a rule without `base` applies to `default`. */
-const ruleBase = (rule) => (rule && rule.base !== undefined ? rule.base : DEFAULT_BASE);
-
-/**
- * Load-time check of every allow rule that names a base: the app's
- * `managementApi.proxy.modules.<module>.allow` and each module's own
- * `proxy.allow`. A rule for a base the module does not declare could never
- * match, which reads as "allowed" and is not, so it stops the app.
- *
- * @param {Array<object>} moduleDefinitions
- * @param {{ modules?: Object }} [proxyConfig] - resolved managementApi.proxy
- * @throws {ProxyConfigError}
- */
-function assertProxyConfig(moduleDefinitions, proxyConfig = {}) {
-    const namesByModule = new Map();
-    for (const definition of moduleDefinitions || []) {
-        if (!definition?.moduleName) continue;
-        const { names } = resolveModuleBases(definition);
-        namesByModule.set(definition.moduleName, names);
-        const own = definition.proxy?.allow;
-        if (Array.isArray(own)) {
-            assertRulesUseDeclaredBases(
-                definition.moduleName,
-                names,
-                own,
-                `Module ${definition.moduleName} proxy.allow`
-            );
-        }
-    }
-    for (const [moduleName, override] of Object.entries(proxyConfig.modules || {})) {
-        const names = namesByModule.get(moduleName);
-        // An override for a module that is not registered is not new: it never applied.
-        if (!names || !Array.isArray(override?.allow)) continue;
-        assertRulesUseDeclaredBases(
-            moduleName,
-            names,
-            override.allow,
-            `managementApi.proxy.modules.${moduleName}.allow`
-        );
-    }
-}
-
-function assertRulesUseDeclaredBases(moduleName, names, rules, where) {
-    for (const rule of rules) {
-        if (!isPlainObject(rule) || rule.base === undefined) continue;
-        if (!isValidBaseName(rule.base) || !names.includes(rule.base)) {
-            throw new ProxyConfigError(
-                `${where}: the rule ${describeRule(rule)} names the base ${JSON.stringify(
-                    rule.base
-                )}, which module ${moduleName} does not declare (declared: ${names.join(', ')})`
-            );
-        }
-    }
-    // A rule with no base means `default`; the module must have one.
-    if (!names.includes(DEFAULT_BASE)) {
-        const bare = rules.find((rule) => isPlainObject(rule) && rule.base === undefined);
-        if (bare) {
-            throw new ProxyConfigError(
-                `${where}: the rule ${describeRule(bare)} names no base, so it applies to ` +
-                    `"default", which module ${moduleName} does not declare (declared: ${names.join(', ')})`
-            );
-        }
-    }
-}
-
-module.exports = {
-    DEFAULT_BASE,
-    isValidBaseName,
-    resolveModuleBases,
-    ruleBase,
-    assertProxyConfig,
-};