@friggframework/core 2.0.0--canary.707.df80bfd.0 → 2.0.0--canary.680.d670696.0

package/modules/scope-visibility.js

@@ -1,247 +0,0 @@
-/**
- * Which stored rows a caller may see and use (ADR-056 §3.4, §3.6).
- *
- * No I/O. One clause list (`ctx.clauses`) is what a repository is asked for and
- * what `describeRecord` checks every returned row against, so a list and an
- * access check cannot drift apart. The clauses are built once per request, when
- * the access context is.
- */
-
-const { isPresent, idString, sameId } = require('../user/membership');
-const { AUTH_SOURCES } = require('../user/user');
-const { SCOPES, ACCESS, DEFAULT_ORG_ADMIN_ROLES } = require('./scope-resolution');
-
-/**
- * One owner/organization pair a repository ORs into a single query.
- * `userId` is the owner's user id, and for an organization-owned row that is
- * the ORGANIZATION user's id, not a person's. `organizationId: null` means "has
- * no organization" (unset or null); otherwise the id of the organization.
- *
- * @typedef {Object} OwnershipClause
- * @property {string} userId
- * @property {(string|null)} organizationId
- */
-
-/**
- * Whether the caller's own rows with no organization belong to the context this
- * request acts in: always when it acts in no organization (today's behaviour),
- * always for an entity under `individualAcross: 'all'`, and otherwise only in
- * the person's legacy organization.
- */
-function unscopedRowsBelongHere(base, kind) {
-    return (
-        !base.activeOrgId ||
-        (kind === 'entity' && base.individualAcross === 'all') ||
-        sameId(base.legacyOrgId, base.activeOrgId)
-    );
-}
-
-/**
- * What a caller may see, as owner/organization pairs:
- *
- *   - the active organization's own rows (owner = the organization), whether
- *     they carry its id or, written before scoping, none;
- *   - the caller's rows in the active organization;
- *   - the caller's rows with no organization, when `unscopedRowsBelongHere`.
- *
- * `kind` is 'entity' or 'integration'; only entities may be
- * organization-independent under 'all' (an integration always belongs to the
- * organization it was created in).
- *
- * @returns {OwnershipClause[]}
- */
-function buildClauses(base, kind) {
-    const clauses = [];
-    if (base.activeOrgId) {
-        clauses.push({ userId: base.activeOrgId, organizationId: base.activeOrgId });
-        clauses.push({ userId: base.activeOrgId, organizationId: null });
-    }
-    if (base.callerId) {
-        if (base.activeOrgId) {
-            clauses.push({ userId: base.callerId, organizationId: base.activeOrgId });
-        }
-        if (unscopedRowsBelongHere(base, kind)) {
-            clauses.push({ userId: base.callerId, organizationId: null });
-        }
-    }
-    return clauses;
-}
-
-/**
- * Whether the caller may manage organization-level things (create, change,
- * delete), ADR-056 §3.6:
- *
- * - A shared-secret caller is the app's own backend and may.
- * - A Frigg bearer token (`/user/login`) predates organization roles and
- *   carries none. It keeps its pre-roles behaviour and may, unless the app
- *   sets `user.orgAdminGateBearerTokens: true`; then it is judged like any
- *   other caller below.
- * - Otherwise the role is the one the token carries; when it carries none,
- *   the role stored on the caller's membership of the active organization;
- *   when there is none, `MEMBER`. A missing role never means admin. An
- *   unknown source (a `User` built outside AuthenticateUser) is judged this
- *   way too.
- *
- * @param {{authSource: (string|null), orgRole: (string|null), membershipRole: (string|null)}} who
- * @param {string[]} adminRoles - `user.orgAdminRoles`, compared case-insensitively
- * @param {{gateBearerTokens?: boolean}} [options]
- */
-function canManageOrganization(
-    { authSource, orgRole, membershipRole },
-    adminRoles = DEFAULT_ORG_ADMIN_ROLES,
-    { gateBearerTokens = false } = {}
-) {
-    if (authSource === AUTH_SOURCES.SHARED_SECRET) return true;
-    if (authSource === AUTH_SOURCES.BEARER_TOKEN && !gateBearerTokens) return true;
-    let role = 'MEMBER';
-    if (isPresent(orgRole)) role = orgRole;
-    else if (isPresent(membershipRole)) role = membershipRole;
-    role = String(role).toUpperCase();
-    return adminRoles.some((admin) => String(admin).toUpperCase() === role);
-}
-
-/**
- * Who the caller is, for ownership and visibility: their individual user, the
- * organization this request acts in, the legacy `organizationId` pointer,
- * whether they may manage organization-level things, and the clauses that
- * follow from them (computed once).
- *
- * @param {Object} user - the authenticated `User` (or a `{ getId }` double)
- * @param {{individualAcross?: string, orgAdminRoles?: string[], gateBearerTokens?: boolean}} [options]
- */
-function accessContext(
-    user,
-    {
-        individualAcross = 'organization',
-        orgAdminRoles = DEFAULT_ORG_ADMIN_ROLES,
-        gateBearerTokens = false,
-    } = {}
-) {
-    const hasUserModel = typeof user?.getIndividualUser === 'function';
-    const individual = hasUserModel ? user.getIndividualUser() : null;
-    const base = {
-        callerId: hasUserModel ? idString(individual?.id) : idString(user?.getId?.()),
-        activeOrgId:
-            typeof user?.getActiveOrganizationId === 'function'
-                ? idString(user.getActiveOrganizationId())
-                : null,
-        legacyOrgId: idString(individual?.organizationId),
-        individualAcross,
-    };
-    const who = {
-        authSource:
-            typeof user?.getAuthSource === 'function' ? user.getAuthSource() : null,
-        orgRole: typeof user?.getOrgRole === 'function' ? user.getOrgRole() : null,
-        membershipRole:
-            typeof user?.getMembershipRole === 'function'
-                ? user.getMembershipRole()
-                : null,
-    };
-    return {
-        ...base,
-        canManageOrg: canManageOrganization(who, orgAdminRoles, {
-            gateBearerTokens,
-        }),
-        clauses: {
-            entity: buildClauses(base, 'entity'),
-            integration: buildClauses(base, 'integration'),
-        },
-    };
-}
-
-/** The clauses for `kind` ('entity' | 'integration'): what to ask the repository. */
-const visibilityClauses = (ctx, kind) => ctx.clauses[kind];
-
-const matchesClause = (record, clause) =>
-    sameId(record.userId, clause.userId) &&
-    (clause.organizationId === null
-        ? !isPresent(record.organizationId)
-        : sameId(record.organizationId, clause.organizationId));
-
-/** The scope a stored row has for this caller, from its owner. */
-function scopeOf(record, ctx) {
-    if (!isPresent(record?.userId)) return SCOPES.GLOBAL;
-    if (sameId(record.userId, ctx.activeOrgId)) return SCOPES.ORGANIZATION;
-    if (sameId(record.userId, ctx.callerId)) return SCOPES.INDIVIDUAL;
-    return null;
-}
-
-/** manage for the person's own; for the organization's, only an admin; use otherwise. */
-const accessFor = (scope, ctx) => {
-    if (scope === SCOPES.INDIVIDUAL) return ACCESS.MANAGE;
-    if (scope === SCOPES.ORGANIZATION) {
-        return ctx.canManageOrg ? ACCESS.MANAGE : ACCESS.USE;
-    }
-    return ACCESS.USE;
-};
-
-/**
- * Whether an access level lets the caller use a record: bind it, proxy through
- * it (§3.4). `manage` includes `use`; `view` (metadata only) does not, and
- * neither does anything unrecognised.
- */
-const grantsUse = (access) => access === ACCESS.USE || access === ACCESS.MANAGE;
-
-/**
- * What the caller may do with a record owned by `ownerId` that carries no
- * organization of its own (a credential): manage the person's own, manage the
- * active organization's only as an admin, nothing otherwise. Null when the
- * record is not theirs.
- */
-function accessToOwner(ownerId, ctx) {
-    const scope = scopeOf({ userId: ownerId }, ctx);
-    if (scope !== SCOPES.INDIVIDUAL && scope !== SCOPES.ORGANIZATION) return null;
-    return accessFor(scope, ctx);
-}
-
-/**
- * What a row is to this caller, or null when they may not see it.
- * `{ scope, owner: {type, id}, organizationId, access }` (§3.4). A `global`
- * row is never described: it is not the tenant's to see.
- */
-function describeRecord(record, ctx, kind) {
-    if (!record) return null;
-    const scope = scopeOf(record, ctx);
-    if (scope === null || scope === SCOPES.GLOBAL) return null;
-    if (!ctx.clauses[kind].some((clause) => matchesClause(record, clause))) {
-        return null;
-    }
-    return {
-        scope,
-        owner: { type: scope, id: idString(record.userId) },
-        organizationId:
-            scope === SCOPES.ORGANIZATION
-                ? idString(record.userId)
-                : idString(record.organizationId),
-        access: accessFor(scope, ctx),
-    };
-}
-
-/** `?owner=` values and the scope each one means. */
-const LIST_OWNERS = Object.freeze({
-    me: SCOPES.INDIVIDUAL,
-    org: SCOPES.ORGANIZATION,
-});
-
-/** Whether a described row passes `?scope=` and `?owner=`. */
-function matchesListFilters(description, { scope, owner } = {}) {
-    if (scope !== undefined && description.scope !== scope) return false;
-    if (owner !== undefined && description.owner.type !== LIST_OWNERS[owner]) {
-        return false;
-    }
-    return true;
-}
-
-module.exports = {
-    canManageOrganization,
-    accessToOwner,
-    accessContext,
-    unscopedRowsBelongHere,
-    visibilityClauses,
-    matchesClause,
-    scopeOf,
-    describeRecord,
-    grantsUse,
-    LIST_OWNERS,
-    matchesListFilters,
-};

package/modules/tests/doubles/ownership-matching.js

@@ -1,18 +0,0 @@
-/**
- * Test double helper: answers an owner/organization clause the way a database
- * does, so in-memory repositories run the clauses a use case hands them.
- * `clause.organizationId === null` matches a row with no organization (unset
- * or null).
- */
-const same = (a, b) =>
-    a !== undefined && a !== null && b !== undefined && b !== null && String(a) === String(b);
-
-const matchesClause = (row, clause) =>
-    same(row.userId, clause.userId) &&
-    (clause.organizationId === null
-        ? row.organizationId === null || row.organizationId === undefined
-        : same(row.organizationId, clause.organizationId));
-
-const matchesAnyClause = (row, clauses) => clauses.some((clause) => matchesClause(row, clause));
-
-module.exports = { same, matchesClause, matchesAnyClause };

package/modules/use-cases/authorize-entity-for-user.js

@@ -1,61 +0,0 @@
-/**
- * Authorizes an entity for a caller: decides who will own it and in which
- * organization (ADR-056 §3.2, §3.6), then runs the module's authorization.
- * Shared by the v1 `POST /api/authorize` and the v2 authorize flow, so the
- * owner is decided in one place and never by `user.primary`.
- */
-class AuthorizeEntityForUser {
-    /**
-     * @param {Object} params
-     * @param {Object} params.scopePolicy - from createScopePolicy
-     * @param {import('./process-authorization-callback').ProcessAuthorizationCallback} params.processAuthorizationCallback
-     */
-    constructor({ scopePolicy, processAuthorizationCallback }) {
-        this.scopePolicy = scopePolicy;
-        this.processAuthorizationCallback = processAuthorizationCallback;
-    }
-
-    /**
-     * The scope, owner and organization a new entity of `entityType` gets for
-     * this caller. Throws a 400/403 when the request cannot have one.
-     *
-     * @param {{user: Object, entityType: string, scope?: string, fixedScope?: string}} params
-     *   `fixedScope`: a re-authorization keeps the scope its connection has
-     */
-    resolveOwnership({ user, entityType, scope, fixedScope }) {
-        if (fixedScope) return this.scopePolicy.ownershipForScope({ scope: fixedScope, user });
-        return this.scopePolicy.resolveOwnership({
-            entityType,
-            requestScope: scope,
-            user,
-        });
-    }
-
-    /**
-     * @param {Object} params
-     * @param {Object} params.user - authenticated User
-     * @param {string} params.entityType
-     * @param {Object} params.data - what the module's authorization needs
-     * @param {string} [params.scope] - the scope the request asks for
-     * @param {Object} [params.ownership] - from `resolveOwnership`, when the
-     *   caller needed it earlier (a multi-step flow does)
-     * @returns {Promise<{result: Object, ownership: Object}>} the callback's
-     *   `{ credential_id, entity_id, type }` and the ownership it ran with
-     */
-    async execute({ user, entityType, data, scope, ownership }) {
-        const resolved = ownership ?? this.resolveOwnership({ user, entityType, scope });
-        const result = await this.processAuthorizationCallback.execute(
-            resolved.ownerId,
-            entityType,
-            data,
-            {
-                scope: resolved.scope,
-                organizationId: resolved.organizationId,
-                legacyOrgId: resolved.legacyOrgId,
-            }
-        );
-        return { result, ownership: resolved };
-    }
-}
-
-module.exports = { AuthorizeEntityForUser };

package/modules/use-cases/create-entity-from-credential.js

@@ -1,113 +0,0 @@
-const Boom = require('@hapi/boom');
-const { Module } = require('../module');
-
-const sameId = (a, b) =>
-    a !== undefined && a !== null && b !== undefined && b !== null &&
-    String(a) === String(b);
-
-/**
- * Creates (or finds) the entity for a credential the caller already holds:
- * the v1 `POST /api/entity`. The owner and organization follow the scope of
- * `entityType`, exactly as an authorization does (ADR-056 §3.2, §3.6), so the
- * owner is decided by `AuthorizeEntityForUser.resolveOwnership` and never by
- * `user.getId()`. Whatever that resolution refuses (a missing identity, and
- * an organization-level connection by a non-admin) is refused here too.
- *
- * The credential must belong to that owner: an organization entity is built
- * on the organization's credential, an individual one on the person's own.
- */
-class CreateEntityFromCredential {
-    /**
-     * @param {Object} params
-     * @param {import('./authorize-entity-for-user').AuthorizeEntityForUser} params.authorizeEntityForUser
-     * @param {import('./process-authorization-callback').ProcessAuthorizationCallback} params.processAuthorizationCallback
-     * @param {Object} params.credentialRepository
-     * @param {Array<Object>} params.moduleDefinitions
-     * @param {Function} [params.createModule] - builds a Module; injectable for tests
-     */
-    constructor({
-        authorizeEntityForUser,
-        processAuthorizationCallback,
-        credentialRepository,
-        moduleDefinitions,
-        createModule,
-    }) {
-        this.authorizeEntityForUser = authorizeEntityForUser;
-        this.processAuthorizationCallback = processAuthorizationCallback;
-        this.credentialRepository = credentialRepository;
-        this.moduleDefinitions = moduleDefinitions || [];
-        this.createModule = createModule || ((params) => Module.create(params));
-    }
-
-    /**
-     * @param {Object} params
-     * @param {Object} params.user - authenticated User
-     * @param {string} params.entityType
-     * @param {string} params.credentialId
-     * @returns {Promise<Object>} the persisted entity
-     */
-    async execute({ user, entityType, credentialId }) {
-        const definition = this.moduleDefinitions.find(
-            (def) =>
-                def.moduleName === entityType ||
-                (typeof def.getName === 'function' && def.getName() === entityType)
-        );
-        if (!definition) {
-            throw Boom.badRequest(`Unknown entity type ${entityType}`, {
-                code: 'ENTITY_TYPE_NOT_FOUND',
-            });
-        }
-
-        const ownership = this.authorizeEntityForUser.resolveOwnership({
-            user,
-            entityType,
-        });
-
-        const credential =
-            await this.credentialRepository.findCredentialById(credentialId);
-        // A missing credential and someone else's are the same answer, so ids
-        // cannot be probed.
-        if (!credential || !sameId(credential.userId, ownership.ownerId)) {
-            throw Boom.badRequest('Invalid credential ID', {
-                code: 'INVALID_CREDENTIAL',
-            });
-        }
-
-        // Built for the owner, with the credential loaded (the repository
-        // returns its tokens flat; a Module reads them from `data`), so the
-        // API can call the provider and a token refresh during
-        // getEntityDetails updates the owner's credential.
-        const { id, userId, externalId, authIsValid, ...data } = credential;
-        const module = await this.createModule({
-            userId: ownership.ownerId,
-            definition,
-            entity: {
-                credential: { id, userId, externalId, authIsValid, data },
-            },
-        });
-        const entityDetails =
-            await definition.requiredAuthMethods.getEntityDetails(
-                module.api,
-                null,
-                null,
-                ownership.ownerId
-            );
-        Object.assign(
-            entityDetails.details,
-            module.apiParamsFromEntity(module.api)
-        );
-
-        return this.processAuthorizationCallback.findOrCreateEntity(
-            entityDetails,
-            definition.moduleName,
-            credential.id,
-            {
-                scope: ownership.scope,
-                organizationId: ownership.organizationId,
-                legacyOrgId: ownership.legacyOrgId,
-            }
-        );
-    }
-}
-
-module.exports = { CreateEntityFromCredential };

package/modules/use-cases/manage-access.js

@@ -1,21 +0,0 @@
-const Boom = require('@hapi/boom');
-const { ACCESS } = require('../scope-resolution');
-
-/**
- * The one check behind every "may this caller change or delete it" gate
- * (ADR-056 §3 permissions): the caller may use it but not manage it, so 403
- * `ORG_ADMIN_REQUIRED`. `access` comes from describeRecord (entities,
- * integrations) or scopePolicy.accessToOwnedBy (credentials).
- *
- * @param {string|null} access - ACCESS value
- * @param {string} subject - e.g. `entity 5`, for the message
- */
-function assertCanManage(access, subject) {
-    if (access !== ACCESS.MANAGE) {
-        throw Boom.forbidden(`You may use ${subject} but not change or delete it`, {
-            code: 'ORG_ADMIN_REQUIRED',
-        });
-    }
-}
-
-module.exports = { assertCanManage };

package/prisma-postgresql/migrations/20261015000000_add_organization_membership/migration.sql

@@ -1,26 +0,0 @@
--- CreateTable
--- Organization memberships (ADR-056 §3.6). One row per person per organization.
--- "User"."organizationId" stays as the legacy single-org pointer. It is NOT
--- backfilled into this table: the domain (user/membership.js) reads it as an
--- implicit membership when no row exists (see docs/guides/organization-memberships.md).
-CREATE TABLE "OrganizationMembership" (
-    "id" SERIAL NOT NULL,
-    "individualUserId" INTEGER NOT NULL,
-    "organizationUserId" INTEGER NOT NULL,
-    "orgRole" TEXT NOT NULL DEFAULT 'MEMBER',
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-
-    CONSTRAINT "OrganizationMembership_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
-CREATE INDEX "OrganizationMembership_organizationUserId_idx" ON "OrganizationMembership"("organizationUserId");
-
--- CreateIndex
-CREATE UNIQUE INDEX "OrganizationMembership_individualUserId_organizationUserId_key" ON "OrganizationMembership"("individualUserId", "organizationUserId");
-
--- AddForeignKey
-ALTER TABLE "OrganizationMembership" ADD CONSTRAINT "OrganizationMembership_individualUserId_fkey" FOREIGN KEY ("individualUserId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE NO ACTION;
-
--- AddForeignKey
-ALTER TABLE "OrganizationMembership" ADD CONSTRAINT "OrganizationMembership_organizationUserId_fkey" FOREIGN KEY ("organizationUserId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE NO ACTION;

package/prisma-postgresql/migrations/20261016000000_add_entity_integration_organization/migration.sql

@@ -1,25 +0,0 @@
--- Entity and Integration carry the organization they were created in (ADR-056 §3.6).
--- Nullable, no default and no backfill: a row written before this migration keeps
--- NULL, and the domain (modules/entity-scope.js) reads NULL as "predates scoping"
--- (docs/guides/entity-scopes.md). No scope column: the owner's user type says it.
--- Deliberately no foreign key: a deleted organization must leave its rows
--- invisible, and ON DELETE SET NULL would turn them into unscoped ones.
---
--- Release note: the two CREATE INDEX statements below are plain (not
--- CONCURRENTLY, which Prisma migrations cannot run inside a transaction). Each
--- takes a SHARE lock on its table while it builds, so writes to "Entity" and
--- "Integration" wait for it. Both tables are small in a typical Frigg
--- deployment; on a very large one, create the indexes by hand first with
--- CREATE INDEX CONCURRENTLY IF NOT EXISTS under the same names, then deploy.
-
--- AlterTable
-ALTER TABLE "Entity" ADD COLUMN     "organizationId" INTEGER;
-
--- AlterTable
-ALTER TABLE "Integration" ADD COLUMN     "organizationId" INTEGER;
-
--- CreateIndex
-CREATE INDEX "Entity_userId_organizationId_idx" ON "Entity"("userId", "organizationId");
-
--- CreateIndex
-CREATE INDEX "Integration_userId_organizationId_idx" ON "Integration"("userId", "organizationId");

package/prisma-postgresql/migrations/20261017000000_add_scheduled_job/migration.sql

@@ -1,28 +0,0 @@
--- One-time scheduled jobs for the poll-and-dispatch scheduler
--- (NetlifySchedulerAdapter, friggframework/frigg#545): a cron function reads
--- PENDING rows that are due and dispatches them to a queue.
---
--- IF NOT EXISTS on purpose: #545 shipped this model in the Prisma schema with
--- no migration, so an app that ran its canary may already have the table from
--- `prisma db push`. On such a database this migration is a no-op; on a fresh
--- one it is the SQL `prisma migrate diff` generates.
-
--- CreateTable
-CREATE TABLE IF NOT EXISTS "ScheduledJob" (
-    "id" SERIAL NOT NULL,
-    "scheduleName" TEXT NOT NULL,
-    "scheduledAt" TIMESTAMP(3) NOT NULL,
-    "queueResourceId" TEXT NOT NULL,
-    "payload" JSONB,
-    "state" TEXT NOT NULL DEFAULT 'PENDING',
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "ScheduledJob_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
-CREATE UNIQUE INDEX IF NOT EXISTS "ScheduledJob_scheduleName_key" ON "ScheduledJob"("scheduleName");
-
--- CreateIndex
-CREATE INDEX IF NOT EXISTS "ScheduledJob_state_scheduledAt_idx" ON "ScheduledJob"("state", "scheduledAt");

package/providers/index.js

@@ -1,23 +0,0 @@
-const {
-    resolveProvider,
-    determineProviderName,
-    providerPackageName,
-    KNOWN_PROVIDERS,
-} = require('./resolve-provider');
-const {
-    isDeployedRuntime,
-    isAwsLambdaRuntime,
-    isLocalRun,
-    resolveActiveProvider,
-} = require('./runtime-detection');
-
-module.exports = {
-    resolveProvider,
-    determineProviderName,
-    providerPackageName,
-    KNOWN_PROVIDERS,
-    isDeployedRuntime,
-    isAwsLambdaRuntime,
-    isLocalRun,
-    resolveActiveProvider,
-};

package/providers/resolve-provider.js

@@ -1,93 +0,0 @@
-/**
- * Provider Resolver
- *
- * Resolves a provider name from the appDefinition into the corresponding
- * @friggframework/provider-{name} package. This is the bridge between
- * `appDefinition.provider` and the provider plugin interface.
- *
- * Resolution order:
- *   1. Explicit `providerName` argument
- *   2. `appDefinition.provider`
- *   3. `FRIGG_PROVIDER` environment variable
- *   4. Default: 'aws'
- *
- * Package naming convention:
- *   provider: 'netlify'  →  require('@friggframework/provider-netlify')
- *   provider: 'aws'      →  require('@friggframework/provider-aws')
- *
- * @example
- *   const provider = resolveProvider({ provider: 'netlify' });
- *   // provider.name === 'netlify'
- *   // provider.deploy(appDefinition, options)
- *   // provider.createHandler(options)
- *   // provider.QueueProvider  (class)
- *   // etc.
- */
-
-const KNOWN_PROVIDERS = ['aws', 'netlify'];
-
-/**
- * Determine the provider name from available sources.
- *
- * @param {Object} [appDefinition] - Frigg app definition
- * @param {string} [providerName] - Explicit override
- * @returns {string} Provider name (e.g. 'netlify', 'aws')
- */
-function determineProviderName(appDefinition, providerName) {
-    if (providerName) {
-        return providerName;
-    }
-    if (appDefinition?.provider) {
-        return appDefinition.provider;
-    }
-    if (process.env.FRIGG_PROVIDER) {
-        return process.env.FRIGG_PROVIDER;
-    }
-    return 'aws';
-}
-
-/**
- * Resolve a provider name to a package name.
- *
- * @param {string} name - Provider name (e.g. 'netlify')
- * @returns {string} npm package name (e.g. '@friggframework/provider-netlify')
- */
-function providerPackageName(name) {
-    return `@friggframework/provider-${name}`;
-}
-
-/**
- * Resolve and load the provider plugin for the given app definition.
- *
- * @param {Object} [appDefinition] - Frigg app definition (reads .provider)
- * @param {Object} [options]
- * @param {string} [options.provider] - Explicit provider name override
- * @returns {Object} Provider plugin (conforms to the provider plugin interface)
- * @throws {Error} If the provider package is not installed
- */
-function resolveProvider(appDefinition, options = {}) {
-    const name = determineProviderName(appDefinition, options.provider);
-    const packageName = providerPackageName(name);
-
-    try {
-        return require(packageName);
-    } catch (error) {
-        if (error.code === 'MODULE_NOT_FOUND') {
-            const hint = KNOWN_PROVIDERS.includes(name)
-                ? `Install it with: npm install ${packageName}`
-                : `Is '${name}' a valid Frigg provider? Known providers: ${KNOWN_PROVIDERS.join(', ')}`;
-
-            throw new Error(
-                `Provider '${name}' specified in appDefinition but package '${packageName}' is not installed.\n  ${hint}`
-            );
-        }
-        throw error;
-    }
-}
-
-module.exports = {
-    resolveProvider,
-    determineProviderName,
-    providerPackageName,
-    KNOWN_PROVIDERS,
-};