@friggframework/devtools 2.0.0--canary.627.ce32cdc.0 → 2.0.0--canary.640.b31eb4a.0

package/infrastructure/__tests__/aurora-scale-to-zero-connectivity.test.js

@@ -0,0 +1,255 @@
+/**
+ * ADR-033: Aurora Serverless v2 scale-to-zero + NAT-free public connectivity
+ *
+ * These tests assert on the GENERATED CloudFormation template (via the full
+ * composer) plus the AuroraBuilder validator. They are deterministic and require
+ * neither a live AWS account nor Prisma client generation:
+ *   - Validator cases call AuroraBuilder.validate() directly (pure, no I/O).
+ *   - Template cases use vpc.management='create-new' + database.postgres
+ *     management='managed', which resolve to STACK ownership without depending on
+ *     any discovered AWS resource, so cloud discovery returning empty is fine.
+ *
+ * Both new capabilities are opt-in and default-off; the final describe block
+ * guards the no-regression promise: a default (vpc, no minCapacity) definition
+ * composes the same template as before.
+ */
+
+const { composeServerlessDefinition } = require('../infrastructure-composer');
+const { AuroraBuilder } = require('../domains/database/aurora-builder');
+
+// Shared: an app definition that creates a fresh VPC + a Frigg-owned Aurora
+// cluster in-stack, with overridable postgres config.
+function makeApp(postgresOverrides = {}) {
+    return {
+        name: 'adr033-app',
+        provider: 'aws',
+        region: 'us-east-1',
+        integrations: [],
+        vpc: { enable: true, management: 'create-new' },
+        database: {
+            postgres: {
+                enable: true,
+                management: 'managed',
+                ...postgresOverrides,
+            },
+        },
+    };
+}
+
+function findResources(template, predicate) {
+    return Object.entries(template.resources.Resources).filter(([, r]) => predicate(r));
+}
+
+describe('ADR-033: Aurora scale-to-zero + connectivity', () => {
+    beforeAll(() => {
+        process.env.AWS_REGION = 'us-east-1';
+        // Intentionally NOT setting FRIGG_SKIP_AWS_DISCOVERY — the builders must
+        // execute. create-new/managed resolve to STACK without needing discovery.
+    });
+
+    afterAll(() => {
+        delete process.env.AWS_REGION;
+    });
+
+    // ---------------------------------------------------------------------
+    // Validator
+    // ---------------------------------------------------------------------
+    describe('validator (AuroraBuilder.validate)', () => {
+        const build = new AuroraBuilder();
+        // ValidationResult exposes hasErrors(); "valid" means no errors.
+        const validateResult = (postgres) =>
+            build.validate({ database: { postgres: { enable: true, ...postgres } } });
+        const isValid = (postgres) => !validateResult(postgres).hasErrors();
+
+        test('accepts minCapacity: 0 (scale-to-zero)', () => {
+            expect(isValid({ minCapacity: 0 })).toBe(true);
+        });
+
+        test('rejects minCapacity: 0.3 (inside the forbidden (0, 0.5) band)', () => {
+            const r = validateResult({ minCapacity: 0.3 });
+            expect(r.hasErrors()).toBe(true);
+            expect(r.errors.join(' ')).toMatch(/minCapacity must be 0 \(scale-to-zero\) or between 0\.5 and 128/);
+        });
+
+        test('accepts minCapacity: 0.5 and minCapacity: 64', () => {
+            expect(isValid({ minCapacity: 0.5 })).toBe(true);
+            expect(isValid({ minCapacity: 64 })).toBe(true);
+        });
+
+        test('rejects secondsUntilAutoPause: 100 (below 300)', () => {
+            const r = validateResult({ minCapacity: 0, secondsUntilAutoPause: 100 });
+            expect(r.hasErrors()).toBe(true);
+            expect(r.errors.join(' ')).toMatch(/secondsUntilAutoPause must be an integer between 300 and 86400/);
+        });
+
+        test('accepts secondsUntilAutoPause: 3600', () => {
+            expect(isValid({ minCapacity: 0, secondsUntilAutoPause: 3600 })).toBe(true);
+        });
+
+        test("accepts connectivity: 'public'", () => {
+            expect(isValid({ connectivity: 'public' })).toBe(true);
+        });
+
+        test("rejects connectivity: 'nope'", () => {
+            const r = validateResult({ connectivity: 'nope' });
+            expect(r.hasErrors()).toBe(true);
+            expect(r.errors.join(' ')).toMatch(/Invalid database\.postgres\.connectivity/);
+        });
+
+        test('rejects non-array / non-CIDR allowedCidrs, accepts valid CIDRs', () => {
+            expect(isValid({ allowedCidrs: 'nope' })).toBe(false);
+            expect(isValid({ allowedCidrs: ['not-a-cidr'] })).toBe(false);
+            expect(isValid({ allowedCidrs: ['10.0.0.0/8', '203.0.113.5/32'] })).toBe(true);
+        });
+
+        test('warns (does not fail) when minCapacity:0 with an older pinned engine version', () => {
+            const r = validateResult({ minCapacity: 0, engineVersion: '15.4' });
+            expect(r.hasErrors()).toBe(false); // warning, not error
+            expect(r.warnings.join(' ')).toMatch(/may not support .*scale-to-zero/);
+        });
+
+        test('does not warn about engine when minCapacity:0 on a capable version', () => {
+            const r = validateResult({ minCapacity: 0, engineVersion: '15.13' });
+            expect(r.warnings.join(' ')).not.toMatch(/may not support .*scale-to-zero/);
+        });
+    });
+
+    // ---------------------------------------------------------------------
+    // Scale-to-zero (template shape)
+    // ---------------------------------------------------------------------
+    describe('scale-to-zero (minCapacity: 0)', () => {
+        test('MinCapacity is exactly 0 and SecondsUntilAutoPause defaults to 300', async () => {
+            const t = await composeServerlessDefinition(makeApp({ minCapacity: 0 }));
+            const scaling = t.resources.Resources.FriggAuroraCluster.Properties.ServerlessV2ScalingConfiguration;
+
+            // Mutation guard: with the old `|| 0.5` bug this would be 0.5, not 0.
+            expect(scaling.MinCapacity).toBe(0);
+            expect(scaling.MinCapacity).not.toBe(0.5);
+            expect(scaling.SecondsUntilAutoPause).toBe(300);
+        });
+
+        test('SecondsUntilAutoPause honors a custom value', async () => {
+            const t = await composeServerlessDefinition(makeApp({ minCapacity: 0, secondsUntilAutoPause: 1800 }));
+            const scaling = t.resources.Resources.FriggAuroraCluster.Properties.ServerlessV2ScalingConfiguration;
+            expect(scaling.MinCapacity).toBe(0);
+            expect(scaling.SecondsUntilAutoPause).toBe(1800);
+        });
+
+        test('MaxCapacity defaults to 4 and is preserved with scale-to-zero', async () => {
+            const t = await composeServerlessDefinition(makeApp({ minCapacity: 0 }));
+            const scaling = t.resources.Resources.FriggAuroraCluster.Properties.ServerlessV2ScalingConfiguration;
+            expect(scaling.MaxCapacity).toBe(4);
+        });
+    });
+
+    // ---------------------------------------------------------------------
+    // Public connectivity (template shape)
+    // ---------------------------------------------------------------------
+    describe("connectivity: 'public'", () => {
+        test('Aurora ingress uses CidrIp — one rule per allowedCidr — not SourceSecurityGroupId', async () => {
+            const t = await composeServerlessDefinition(
+                makeApp({ connectivity: 'public', allowedCidrs: ['10.1.0.0/16', '203.0.113.7/32'] })
+            );
+            const ingress = findResources(
+                t,
+                (r) => r.Type === 'AWS::EC2::SecurityGroupIngress' && r.Properties.FromPort === 5432
+            );
+            expect(ingress).toHaveLength(2);
+            const cidrs = ingress.map(([, r]) => r.Properties.CidrIp).sort();
+            expect(cidrs).toEqual(['10.1.0.0/16', '203.0.113.7/32']);
+            ingress.forEach(([, r]) => {
+                expect(r.Properties.CidrIp).toBeDefined();
+                expect(r.Properties.SourceSecurityGroupId).toBeUndefined();
+            });
+        });
+
+        test('allowedCidrs defaults to 0.0.0.0/0 when omitted', async () => {
+            const t = await composeServerlessDefinition(makeApp({ connectivity: 'public' }));
+            const ingress = findResources(
+                t,
+                (r) => r.Type === 'AWS::EC2::SecurityGroupIngress' && r.Properties.FromPort === 5432
+            );
+            expect(ingress).toHaveLength(1);
+            expect(ingress[0][1].Properties.CidrIp).toBe('0.0.0.0/0');
+        });
+
+        test('Aurora instance is PubliclyAccessible and cluster sits in public subnets', async () => {
+            const t = await composeServerlessDefinition(makeApp({ connectivity: 'public' }));
+            expect(t.resources.Resources.FriggAuroraInstance.Properties.PubliclyAccessible).toBe(true);
+            expect(t.resources.Resources.FriggDBSubnetGroup.Properties.SubnetIds).toEqual([
+                { Ref: 'FriggPublicSubnet' },
+                { Ref: 'FriggPublicSubnet2' },
+            ]);
+        });
+
+        test('NO NAT Gateway resource is emitted', async () => {
+            const t = await composeServerlessDefinition(makeApp({ connectivity: 'public' }));
+            const nats = findResources(t, (r) => r.Type === 'AWS::EC2::NatGateway');
+            expect(nats).toHaveLength(0);
+        });
+
+        test('Lambda is NOT attached to the VPC (provider.vpc unset)', async () => {
+            const t = await composeServerlessDefinition(makeApp({ connectivity: 'public' }));
+            expect(t.provider.vpc).toBeUndefined();
+        });
+
+        test('DATABASE_URL enforces TLS (sslmode=require)', async () => {
+            const t = await composeServerlessDefinition(makeApp({ connectivity: 'public' }));
+            const url = t.provider.environment.DATABASE_URL;
+            expect(url['Fn::Sub'][0]).toContain('sslmode=require');
+        });
+
+        test('combines with scale-to-zero: $0-idle NAT-free Aurora', async () => {
+            const t = await composeServerlessDefinition(makeApp({ connectivity: 'public', minCapacity: 0 }));
+            const scaling = t.resources.Resources.FriggAuroraCluster.Properties.ServerlessV2ScalingConfiguration;
+            expect(scaling.MinCapacity).toBe(0);
+            expect(scaling.SecondsUntilAutoPause).toBe(300);
+            expect(findResources(t, (r) => r.Type === 'AWS::EC2::NatGateway')).toHaveLength(0);
+            expect(t.provider.vpc).toBeUndefined();
+        });
+    });
+
+    // ---------------------------------------------------------------------
+    // No-regression: default (vpc) connectivity, no new fields
+    // ---------------------------------------------------------------------
+    describe("default connectivity: 'vpc' (no regression)", () => {
+        test('MinCapacity defaults to 0.5 with no SecondsUntilAutoPause', async () => {
+            const t = await composeServerlessDefinition(makeApp());
+            const scaling = t.resources.Resources.FriggAuroraCluster.Properties.ServerlessV2ScalingConfiguration;
+            expect(scaling.MinCapacity).toBe(0.5);
+            expect(scaling.MaxCapacity).toBe(4);
+            expect(scaling.SecondsUntilAutoPause).toBeUndefined();
+        });
+
+        test('Aurora ingress uses SourceSecurityGroupId (Lambda SG), not CidrIp', async () => {
+            const t = await composeServerlessDefinition(makeApp());
+            const ingress = findResources(
+                t,
+                (r) => r.Type === 'AWS::EC2::SecurityGroupIngress' && r.Properties.FromPort === 5432
+            );
+            expect(ingress).toHaveLength(1);
+            expect(ingress[0][1].Properties.SourceSecurityGroupId).toEqual({ Ref: 'FriggLambdaSecurityGroup' });
+            expect(ingress[0][1].Properties.CidrIp).toBeUndefined();
+            // Logical ID unchanged for the vpc path
+            expect(ingress[0][0]).toBe('FriggAuroraIngressRule');
+        });
+
+        test('Aurora instance is not publicly accessible by default', async () => {
+            const t = await composeServerlessDefinition(makeApp());
+            expect(t.resources.Resources.FriggAuroraInstance.Properties.PubliclyAccessible).toBe(false);
+        });
+
+        test('Lambda IS attached to the VPC (provider.vpc set)', async () => {
+            const t = await composeServerlessDefinition(makeApp());
+            expect(t.provider.vpc).toBeDefined();
+            expect(t.provider.vpc.subnetIds).toBeDefined();
+            expect(t.provider.vpc.securityGroupIds).toBeDefined();
+        });
+
+        test('DATABASE_URL does not add sslmode in vpc mode', async () => {
+            const t = await composeServerlessDefinition(makeApp());
+            const url = t.provider.environment.DATABASE_URL;
+            expect(url['Fn::Sub'][0]).not.toContain('sslmode=require');
+        });
+    });
+});

package/infrastructure/domains/admin-scripts/admin-script-builder.js

@@ -23,7 +23,15 @@ class AdminScriptBuilder extends InfrastructureBuilder {
     }
 
     shouldExecute(appDefinition) {
-        return Array.isArray(appDefinition.adminScripts) && appDefinition.adminScripts.length > 0;
+        const hasScripts =
+            Array.isArray(appDefinition.adminScripts) &&
+            appDefinition.adminScripts.length > 0;
+        const hasReports =
+            Array.isArray(appDefinition.reports) &&
+            appDefinition.reports.length > 0;
+        const hasBuiltinReports =
+            appDefinition.admin?.includeBuiltinReports === true;
+        return hasScripts || hasReports || hasBuiltinReports;
     }
 
     getDependencies() {
@@ -33,31 +41,53 @@ class AdminScriptBuilder extends InfrastructureBuilder {
     validate(appDefinition) {
         const result = new ValidationResult();
 
-        if (!appDefinition.adminScripts) {
-            return result; // Not an error, just no scripts
-        }
-
-        if (!Array.isArray(appDefinition.adminScripts)) {
-            result.addError('adminScripts must be an array');
-            return result;
+        if (appDefinition.adminScripts !== undefined) {
+            if (!Array.isArray(appDefinition.adminScripts)) {
+                result.addError('adminScripts must be an array');
+            } else {
+                appDefinition.adminScripts.forEach((script, index) => {
+                    if (!script?.Definition?.name) {
+                        result.addError(`Admin script at index ${index} is missing Definition or name`);
+                    }
+                });
+            }
         }
 
-        // Validate each script
-        appDefinition.adminScripts.forEach((script, index) => {
-            if (!script?.Definition?.name) {
-                result.addError(`Admin script at index ${index} is missing Definition or name`);
+        if (appDefinition.reports !== undefined) {
+            if (!Array.isArray(appDefinition.reports)) {
+                result.addError('reports must be an array');
+            } else {
+                appDefinition.reports.forEach((report, index) => {
+                    if (!report?.Definition?.name) {
+                        result.addError(`Report at index ${index} is missing Definition or name`);
+                    }
+                });
             }
-        });
+        }
 
         return result;
     }
 
     async build(appDefinition, discoveredResources) {
-        console.log(`\n[${this.name}] Configuring admin scripts...`);
-        console.log(`  Processing ${appDefinition.adminScripts.length} scripts...`);
+        console.log(`\n[${this.name}] Configuring admin operations...`);
 
         const usePrismaLayer = appDefinition.usePrismaLambdaLayer !== false;
         const adminConfig = appDefinition.admin || {};
+        const adminScripts = Array.isArray(appDefinition.adminScripts)
+            ? appDefinition.adminScripts
+            : [];
+        const reports = Array.isArray(appDefinition.reports)
+            ? appDefinition.reports
+            : [];
+        const hasReports =
+            reports.length > 0 || adminConfig.includeBuiltinReports === true;
+
+        // Only non-JSON report output is stored in S3, so provision the bucket
+        // only for that. Built-in reports emit JSON, so they don't trigger it.
+        const reportsNeedArtifacts = reports.some((report) => {
+            const format = report?.Definition?.output?.format;
+            return Boolean(format) && format !== 'json';
+        });
 
         const result = {
             functions: {},
@@ -67,27 +97,45 @@ class AdminScriptBuilder extends InfrastructureBuilder {
             iamStatements: [],
         };
 
-        // Create admin script queue
-        this.createAdminScriptQueue(result, appDefinition);
-
-        // Create Lambda function for script execution
-        this.createScriptExecutorFunction(appDefinition, result, usePrismaLayer);
+        if (adminScripts.length > 0) {
+            console.log(`  Processing ${adminScripts.length} scripts...`);
+            this.createAdminScriptQueue(result, appDefinition);
+            this.createScriptExecutorFunction(appDefinition, result, usePrismaLayer);
+            this.createAdminScriptRoutes(appDefinition, result, usePrismaLayer);
 
-        // Create API routes for script management
-        this.createAdminScriptRoutes(appDefinition, result, usePrismaLayer);
+            adminScripts.forEach(script => {
+                const name = script.Definition?.name || 'unknown';
+                console.log(`    ✓ Registered script: ${name}`);
+            });
+        }
 
-        // Phase 2: Create EventBridge Scheduler resources
-        if (adminConfig.enableScheduling) {
-            this.createSchedulerResources(appDefinition, result);
+        if (hasReports) {
+            this.createReportQueue(result, appDefinition);
+            this.createReportExecutorFunction(appDefinition, result, usePrismaLayer);
+            this.createReportRoutes(appDefinition, result, usePrismaLayer);
+            if (reportsNeedArtifacts) {
+                this.createReportArtifactBucket(result, appDefinition);
+            }
+            reports.forEach(report => {
+                const name = report.Definition?.name || 'unknown';
+                console.log(`    ✓ Registered report: ${name}`);
+            });
+            if (adminConfig.includeBuiltinReports) {
+                console.log('    ✓ Built-in reports enabled');
+            }
         }
 
-        // Log registered scripts
-        appDefinition.adminScripts.forEach(script => {
-            const name = script.Definition?.name || 'unknown';
-            console.log(`    ✓ Registered: ${name}`);
-        });
+        if (
+            adminConfig.enableScheduling &&
+            (adminScripts.length > 0 || hasReports)
+        ) {
+            this.createSchedulerResources(appDefinition, result, {
+                scriptsPresent: adminScripts.length > 0,
+                hasReports,
+            });
+        }
 
-        console.log(`[${this.name}] ✅ Admin script configuration completed`);
+        console.log(`[${this.name}] ✅ Admin operations configuration completed`);
         return result;
     }
 
@@ -193,6 +241,151 @@ class AdminScriptBuilder extends InfrastructureBuilder {
         console.log('  ✓ Created adminScriptRouter function');
     }
 
+    createReportRoutes(appDefinition, result, usePrismaLayer) {
+        result.functions.reportRouter = {
+            handler: 'node_modules/@friggframework/admin-scripts/src/infrastructure/report-router.handler',
+            skipEsbuild: true,
+            package: this.skipEsbuildPackageConfig(appDefinition, usePrismaLayer),
+            ...(usePrismaLayer && { layers: [{ Ref: 'PrismaLambdaLayer' }] }),
+            timeout: 30,
+            events: [
+                { httpApi: { path: '/api/v2/reports', method: 'GET' } },
+                // Definition detail, snapshots, executions, schedule, back-compat alias
+                { httpApi: { path: '/api/v2/reports/{proxy+}', method: 'GET' } },
+                // Run a report ({name}/run)
+                { httpApi: { path: '/api/v2/reports/{proxy+}', method: 'POST' } },
+                // Schedule management (PUT/DELETE {name}/schedule)
+                { httpApi: { path: '/api/v2/reports/{proxy+}', method: 'PUT' } },
+                { httpApi: { path: '/api/v2/reports/{proxy+}', method: 'DELETE' } },
+            ],
+        };
+        console.log('  ✓ Created reportRouter function');
+    }
+
+    createReportQueue(result, appDefinition) {
+        result.resources.ReportQueue = {
+            Type: 'AWS::SQS::Queue',
+            Properties: {
+                QueueName: '${self:service}-${self:provider.stage}-ReportQueue',
+                MessageRetentionPeriod: 86400, // 1 day
+                VisibilityTimeout: 900, // 15 minutes (Lambda max)
+                RedrivePolicy: {
+                    maxReceiveCount: 3,
+                    deadLetterTargetArn: {
+                        'Fn::GetAtt': ['InternalErrorQueue', 'Arn'],
+                    },
+                },
+            },
+        };
+
+        if (isScopedEnvironmentActive(appDefinition)) {
+            // Only the report functions read this queue URL
+            result.functionEnvironments = result.functionEnvironments || {};
+            for (const fnName of ['reportRouter', 'reportExecutor']) {
+                result.functionEnvironments[fnName] = {
+                    ...result.functionEnvironments[fnName],
+                    REPORT_QUEUE_URL: { Ref: 'ReportQueue' },
+                };
+            }
+        } else {
+            result.environment.REPORT_QUEUE_URL = { Ref: 'ReportQueue' };
+        }
+
+        // The report router enqueues async recorded/snapshot runs. The base
+        // role's wildcard does not cover this queue's name, so grant
+        // SendMessage explicitly.
+        result.iamStatements.push({
+            Effect: 'Allow',
+            Action: [
+                'sqs:SendMessage',
+                'sqs:SendMessageBatch',
+                'sqs:GetQueueUrl',
+                'sqs:GetQueueAttributes',
+            ],
+            Resource: { 'Fn::GetAtt': ['ReportQueue', 'Arn'] },
+        });
+
+        console.log('  ✓ Created ReportQueue');
+    }
+
+    createReportExecutorFunction(appDefinition, result, usePrismaLayer) {
+        result.functions.reportExecutor = {
+            handler: 'node_modules/@friggframework/admin-scripts/src/infrastructure/report-executor-handler.handler',
+            skipEsbuild: true,
+            package: this.skipEsbuildPackageConfig(appDefinition, usePrismaLayer),
+            ...(usePrismaLayer && { layers: [{ Ref: 'PrismaLambdaLayer' }] }),
+            timeout: 900, // 15 minutes max
+            memorySize: 1024,
+            events: [
+                {
+                    sqs: {
+                        arn: { 'Fn::GetAtt': ['ReportQueue', 'Arn'] },
+                        batchSize: 1,
+                    },
+                },
+            ],
+        };
+        console.log('  ✓ Created reportExecutor function');
+    }
+
+    // Non-JSON report output; the router mints short-lived presigned URLs for reads.
+    createReportArtifactBucket(result, appDefinition) {
+        result.resources.ReportArtifactBucket = {
+            Type: 'AWS::S3::Bucket',
+            Properties: {
+                BucketName:
+                    '${self:service}-${self:provider.stage}-report-artifacts',
+                BucketEncryption: {
+                    ServerSideEncryptionConfiguration: [
+                        {
+                            ServerSideEncryptionByDefault: {
+                                SSEAlgorithm: 'AES256',
+                            },
+                        },
+                    ],
+                },
+                PublicAccessBlockConfiguration: {
+                    BlockPublicAcls: true,
+                    BlockPublicPolicy: true,
+                    IgnorePublicAcls: true,
+                    RestrictPublicBuckets: true,
+                },
+            },
+        };
+
+        if (isScopedEnvironmentActive(appDefinition)) {
+            result.functionEnvironments = result.functionEnvironments || {};
+            for (const fnName of ['reportRouter', 'reportExecutor']) {
+                result.functionEnvironments[fnName] = {
+                    ...result.functionEnvironments[fnName],
+                    REPORT_ARTIFACT_BUCKET: { Ref: 'ReportArtifactBucket' },
+                };
+            }
+        } else {
+            result.environment.REPORT_ARTIFACT_BUCKET = {
+                Ref: 'ReportArtifactBucket',
+            };
+        }
+
+        // Executor writes and router reads (via presign); scope to this bucket's objects.
+        result.iamStatements.push({
+            Effect: 'Allow',
+            Action: ['s3:PutObject', 's3:GetObject'],
+            Resource: {
+                'Fn::Sub': [
+                    '${BucketArn}/*',
+                    {
+                        BucketArn: {
+                            'Fn::GetAtt': ['ReportArtifactBucket', 'Arn'],
+                        },
+                    },
+                ],
+            },
+        });
+
+        console.log('  ✓ Created ReportArtifactBucket');
+    }
+
     // Without this, the skipEsbuild functions package the whole node_modules
     // closure (aws-sdk, Prisma, dev deps) and blow past Lambda's 250 MB limit.
     // Mirrors the exclusions the framework's other node_modules handlers use.
@@ -248,13 +441,25 @@ class AdminScriptBuilder extends InfrastructureBuilder {
         };
     }
 
-    createSchedulerResources(appDefinition, result) {
-        // Constructed ARN, not Fn::GetAtt: a GetAtt edge to the executor closes a
+    createSchedulerResources(
+        appDefinition,
+        result,
+        { scriptsPresent = true, hasReports = false } = {}
+    ) {
+        // Constructed ARNs, not Fn::GetAtt: a GetAtt edge to an executor closes a
         // CloudFormation circular dependency via the shared Lambda execution role.
-        const executorArn = {
-            'Fn::Sub':
-                'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-adminScriptExecutor',
-        };
+        const fnArn = (logicalName) => ({
+            'Fn::Sub': `arn:aws:lambda:\${AWS::Region}:\${AWS::AccountId}:function:\${self:service}-\${self:provider.stage}-${logicalName}`,
+        });
+        const scriptExecutorArn = fnArn('adminScriptExecutor');
+        const reportExecutorArn = fnArn('reportExecutor');
+
+        const invokeResources = [
+            ...(scriptsPresent ? [scriptExecutorArn] : []),
+            ...(hasReports ? [reportExecutorArn] : []),
+        ];
+        const invokeResource =
+            invokeResources.length === 1 ? invokeResources[0] : invokeResources;
 
         // Create IAM role for EventBridge Scheduler
         result.resources.AdminScriptSchedulerRole = {
@@ -276,7 +481,7 @@ class AdminScriptBuilder extends InfrastructureBuilder {
                         Statement: [{
                             Effect: 'Allow',
                             Action: 'lambda:InvokeFunction',
-                            Resource: executorArn,
+                            Resource: invokeResource,
                         }],
                     },
                 }],
@@ -293,18 +498,35 @@ class AdminScriptBuilder extends InfrastructureBuilder {
 
         // Router-scoped, not shared provider env. Two reasons: broadcasting the
         // resource references to every function creates CloudFormation circular
-        // deps; and SCHEDULER_PROVIDER='aws' is only valid for the admin-script
-        // adapter (the router's sole consumer) — core's scheduler factory, used
-        // by integration Lambdas, rejects 'aws', so it must not leak app-wide.
-        result.functions.adminScriptRouter.environment = {
-            ...(result.functions.adminScriptRouter.environment || {}),
-            SCHEDULER_PROVIDER: 'aws',
-            SCHEDULER_ROLE_ARN: {
-                'Fn::GetAtt': ['AdminScriptSchedulerRole', 'Arn'],
-            },
-            ADMIN_SCRIPT_SCHEDULE_GROUP: { Ref: 'AdminScriptScheduleGroup' },
-            ADMIN_SCRIPT_EXECUTOR_LAMBDA_ARN: executorArn,
-        };
+        // deps; and SCHEDULER_PROVIDER='aws' is only valid for the admin-scripts
+        // adapter (the routers are its sole consumers) — core's scheduler
+        // factory, used by integration Lambdas, rejects 'aws', so it must not
+        // leak app-wide.
+        if (scriptsPresent) {
+            result.functions.adminScriptRouter.environment = {
+                ...(result.functions.adminScriptRouter.environment || {}),
+                SCHEDULER_PROVIDER: 'aws',
+                SCHEDULER_ROLE_ARN: {
+                    'Fn::GetAtt': ['AdminScriptSchedulerRole', 'Arn'],
+                },
+                ADMIN_SCRIPT_SCHEDULE_GROUP: { Ref: 'AdminScriptScheduleGroup' },
+                ADMIN_SCRIPT_EXECUTOR_LAMBDA_ARN: scriptExecutorArn,
+            };
+        }
+
+        // Report schedules reuse the shared role/group but must target the
+        // report executor, not the script one (REPORT_EXECUTOR_LAMBDA_ARN).
+        if (hasReports) {
+            result.functions.reportRouter.environment = {
+                ...(result.functions.reportRouter.environment || {}),
+                SCHEDULER_PROVIDER: 'aws',
+                SCHEDULER_ROLE_ARN: {
+                    'Fn::GetAtt': ['AdminScriptSchedulerRole', 'Arn'],
+                },
+                REPORT_SCHEDULE_GROUP: { Ref: 'AdminScriptScheduleGroup' },
+                REPORT_EXECUTOR_LAMBDA_ARN: reportExecutorArn,
+            };
+        }
 
         // The router manages schedules through the AWS scheduler adapter, so it
         // needs scheduler:* on this group plus iam:PassRole for the role it hands