@friggframework/devtools 2.0.0--canary.666.81647c4.0 → 2.0.0--canary.667.6dc4b39.0

package/frigg-cli/README.md

@@ -110,41 +110,6 @@ Found 5 modules matching "crm"
 
 ---
 
-#### `frigg validate [options]`
-
-Validate the app definition (`index.js`) before you build or deploy it (ADR-051).
-
-**Usage:**
-```bash
-frigg validate                 # schema + runtime checks
-frigg validate --stage prod    # also the stage checks (encryption, deploy-time environment)
-frigg validate --json          # machine-readable report for CI
-```
-
-**What it does:**
-1. Loads `index.js` the way `frigg build` does (current directory, or the nearest `backend/`)
-2. Validates it against the app-definition schema: unknown keys (with "did you mean"), types, and the values the infrastructure builders accept
-3. Checks what the schema cannot: integration classes (static `Definition` with a valid, unique `name`, `version`, `modules`, and API module definitions that pass core's checks), an enabled database, management settings that conflict or lack ids, encryption (`aes` keys in `environment`, KMS key source, stages that never encrypt), a user config with which login works, `'ssm'` entries without `ssm.enable`, and keys that have no effect
-4. Prints each problem with its JSON pointer and a fix; exits `1` when there are errors
-
-**Example output:**
-```
-Validating /path/to/backend/index.js (stage: prod)
-  error /encrpytion  Unknown key "encrpytion": nothing in Frigg reads it.
-        fix: Did you mean "encryption"?
-  error /database/postgres/management  /database/postgres/management is "create-new", which is not an allowed value.
-        fix: Use one of: "discover", "managed", "use-existing".
-  warning /custom  custom is not read by Frigg: it has no effect.
-        fix: Remove it.
-  ✗ 2 error(s), 1 warning(s)
-```
-
-`--json` prints `{ valid, source, stage, errors, warnings }`; each issue is `{ severity, code, pointer, message, hint }`.
-
-`frigg build` and `frigg deploy` run the same validation first and stop on errors (`--skip-validate` bypasses it, with a loud warning). `frigg start` runs it and only warns. `frigg init` validates the generated app the same way.
-
----
-
 #### `frigg start [options]`
 
 Start local development server with hot reload.
@@ -158,7 +123,7 @@ frigg start --frontend
 ```
 
 **What it does:**
-1. Validates DATABASE_URL environment variable, and the app definition (`frigg validate`; problems are printed as warnings, `--skip-validate` skips it)
+1. Validates DATABASE_URL environment variable
 2. Detects database type (MongoDB or PostgreSQL)
 3. Checks Prisma client generation status
 4. Tests database connection
@@ -217,12 +182,10 @@ frigg deploy --region us-west-2
 frigg deploy --force
 frigg deploy --skip-env-validation
 frigg deploy --skip-doctor              # Skip health check (not recommended)
-frigg deploy --skip-validate            # Skip app definition validation (not recommended)
 frigg deploy --no-interactive           # CI/CD mode (no prompts, auto-repair safe issues)
 ```
 
 **What it does:**
-0. **Validates the app definition** (`frigg validate`) and stops on errors, unless `--skip-validate`
 1. **Runs health check** (`frigg doctor`) to detect infrastructure issues
 2. **Auto-repairs safe issues** (or prompts for confirmation in interactive mode)
 3. **Fails if critical issues found** (unless `--skip-doctor` flag used)

package/frigg-cli/__tests__/unit/commands/build.test.js

@@ -14,9 +14,6 @@ jest.mock('child_process', () => ({
   spawnSync: jest.fn()
 }));
 
-// The app definition validation step is tested in validate-command/.
-jest.mock('../../../validate-command', () => ({ preflightValidation: jest.fn(() => true) }));
-
 // Require after mocks
 const { spawnSync } = require('child_process');
 const { buildCommand } = require('../../../build-command');

package/frigg-cli/__tests__/unit/commands/deploy.test.js

@@ -10,9 +10,6 @@
  */
 
 // Mock dependencies BEFORE requiring modules
-// The app definition validation step is tested in validate-command/.
-jest.mock('../../../validate-command', () => ({ preflightValidation: jest.fn(() => true) }));
-
 jest.mock('child_process', () => ({
   spawn: jest.fn()
 }));

package/frigg-cli/build-command/index.js

@@ -1,15 +1,9 @@
 const { spawnSync } = require('child_process');
 const path = require('path');
-const { preflightValidation } = require('../validate-command');
 
 async function buildCommand(options) {
     console.log('Building the serverless application...');
 
-    // Validate the app definition first (ADR-051); errors stop the build.
-    if (!preflightValidation({ command: 'build', options, failOnErrors: true })) {
-        return;
-    }
-
     // Suppress AWS SDK warning message about maintenance mode
     process.env.AWS_SDK_JS_SUPPRESS_MAINTENANCE_MODE_MESSAGE = '1';
 

package/frigg-cli/deploy-command/index.js

@@ -4,7 +4,6 @@ const fs = require('fs');
 
 // Import doctor command for post-deployment health check
 const { doctorCommand } = require('../doctor-command');
-const { preflightValidation } = require('../validate-command');
 
 // Configuration constants
 const PATHS = {
@@ -313,11 +312,6 @@ async function pushOffloadedParametersOrAbort(appDefinition, options) {
 async function deployCommand(options) {
     console.log('Deploying the serverless application...');
 
-    // Validate the app definition first (ADR-051); errors stop the deploy.
-    if (!preflightValidation({ command: 'deploy', options, failOnErrors: true })) {
-        return;
-    }
-
     const appDefinition = loadAppDefinition();
     const environment = validateAndBuildEnvironment(appDefinition, options);
 

package/frigg-cli/index.js

@@ -87,7 +87,6 @@ const { doctorCommand } = require('./doctor-command');
 const { repairCommand } = require('./repair-command');
 const { authCommand } = require('./auth-command');
 const { ssmPushCommand } = require('./ssm-command');
-const { validateCommand } = require('./validate-command');
 
 const program = new Command();
 
@@ -109,24 +108,14 @@ program
     .description('Run the backend and optional frontend')
     .option('-s, --stage <stage>', 'deployment stage', 'dev')
     .option('-v, --verbose', 'enable verbose output')
-    .option('--skip-validate', 'skip app definition validation')
     .action(startCommand);
 
-program
-    .command('validate')
-    .description('Validate the app definition (index.js) against the schema and the runtime rules')
-    .option('-s, --stage <stage>', 'also run the checks for this stage (encryption, deploy-time environment)')
-    .option('--json', 'print the report as JSON')
-    .option('-v, --verbose', 'enable verbose output')
-    .action(validateCommand);
-
 program
     .command('build')
     .description('Build the serverless application')
     .option('-s, --stage <stage>', 'deployment stage', 'dev')
     .option('-v, --verbose', 'enable verbose output')
     .option('-p, --production', 'build for production (enables AWS discovery)')
-    .option('--skip-validate', 'skip app definition validation (not recommended)')
     .action(buildCommand);
 
 program
@@ -136,7 +125,6 @@ program
     .option('-v, --verbose', 'enable verbose output')
     .option('-f, --force', 'force deployment (bypasses caching for layers and functions)')
     .option('--skip-doctor', 'skip post-deployment health check')
-    .option('--skip-validate', 'skip app definition validation (not recommended)')
     .action(deployCommand);
 
 program
@@ -232,4 +220,4 @@ authProgram
 
 program.parse(process.argv);
 
-module.exports = { initCommand, installCommand, startCommand, buildCommand, deployCommand, validateCommand, generateIamCommand, uiCommand, dbSetupCommand, doctorCommand, repairCommand, authCommand, ssmPushCommand };
+module.exports = { initCommand, installCommand, startCommand, buildCommand, deployCommand, generateIamCommand, uiCommand, dbSetupCommand, doctorCommand, repairCommand, authCommand, ssmPushCommand };

package/frigg-cli/init-command/backend-first-handler.js

@@ -5,8 +5,7 @@ const { select, confirm, multiselect } = require('@inquirer/prompts');
 const { execSync } = require('child_process');
 const spawn = require('cross-spawn');
 const npmRegistry = require('../utils/npm-registry');
-const { runValidation } = require('../validate-command');
-const { formatReport } = require('../validate-command/format-report');
+const { validateAppDefinition, formatErrors } = require('@friggframework/schemas');
 
 /**
  * Backend-first template handler that treats frontend as optional demonstration
@@ -648,39 +647,61 @@ To integrate Frigg into your production application:
     }
 
     /**
-     * Validate the generated app definition with the same code path as
-     * `frigg validate`, `frigg build` and `frigg deploy` (ADR-051). Problems
-     * are reported as warnings: they never stop `frigg init`.
+     * Validate generated app definition against schema
      */
     async validateGeneratedAppDefinition(appDefPath) {
         try {
-            const report = runValidation({ cwd: path.dirname(appDefPath) });
-            const issues = [...report.errors, ...report.warnings];
-            if (issues.length === 0) {
-                if (this.options.verbose) {
-                    console.log(chalk.green('✅ App definition passes validation'));
-                }
-                return true;
+            if (this.options.verbose) {
+                console.log(chalk.gray('🔍 Validating app definition against schema...'));
             }
-            if (report.errors.length === 1 && report.errors[0].code === 'load-failed') {
-                // Before `npm install`, index.js cannot load its dependencies yet.
+
+            // Read the generated index.js file
+            const content = await fs.readFile(appDefPath, 'utf8');
+            
+            // Extract the appDefinition object (simplified approach)
+            // In a real scenario, we might use AST parsing for more robust extraction
+            const appDefinitionMatch = content.match(/const appDefinition = ({[\s\S]*?});/);
+            if (!appDefinitionMatch) {
+                throw new Error('Could not extract appDefinition from generated file');
+            }
+
+            // Create a minimal representation for validation
+            // Since we can't easily execute the file, we'll validate the structure we know we generated
+            const appDefinition = {
+                integrations: [], // Will be populated based on selected integrations
+                user: { password: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                vpc: { enable: true },
+                security: {
+                    cors: {
+                        origin: 'http://localhost:3000',
+                        credentials: true
+                    }
+                },
+                logging: { level: 'info', retentionInDays: 30 },
+                custom: {
+                    appName: 'My Frigg Application',
+                    version: '1.0.0',
+                    environment: 'development'
+                }
+            };
+
+            // Validate against schema
+            const result = validateAppDefinition(appDefinition);
+            
+            if (result.valid) {
                 if (this.options.verbose) {
-                    console.log(chalk.gray('App definition not validated yet: run `frigg validate` after `npm install`.'));
+                    console.log(chalk.green('✅ App definition passes schema validation'));
                 }
                 return true;
+            } else {
+                console.log(chalk.yellow('⚠️  App definition has validation warnings:'));
+                console.log(chalk.gray(formatErrors(result.errors)));
+                return false;
             }
-            console.log(chalk.yellow('⚠️  App definition validation:'));
-            console.log(
-                formatReport({
-                    ...report,
-                    errors: [],
-                    warnings: issues.map((issue) => ({ ...issue, severity: 'warning' })),
-                })
-            );
-            return report.errors.length === 0;
         } catch (error) {
             if (this.options.verbose) {
-                console.log(chalk.yellow(`⚠️  Validation skipped: ${error.message}`));
+                console.log(chalk.yellow(`⚠️  Schema validation skipped: ${error.message}`));
             }
             return true; // Don't fail the process for validation issues
         }

package/frigg-cli/start-command/index.js

@@ -12,7 +12,6 @@ const {
     getDatabaseTypeNotConfiguredError,
     getPrismaClientNotGeneratedError
 } = require('../utils/error-messages');
-const { preflightValidation } = require('../validate-command');
 
 async function startCommand(options) {
     if (options.verbose) {
@@ -26,9 +25,6 @@ async function startCommand(options) {
     const envPath = path.join(process.cwd(), '.env');
     dotenv.config({ path: envPath });
 
-    // Validate the app definition (ADR-051); local development only warns.
-    preflightValidation({ command: 'start', options, failOnErrors: false });
-
     // Pre-flight database checks
     try {
         await performDatabaseChecks(options.verbose);

package/frigg-cli/start-command/start-command.test.js

@@ -23,9 +23,6 @@ jest.mock('node:child_process', () => ({
 }));
 
 jest.mock('../utils/database-validator', () => mockValidator);
-// The app definition validation step is tested in validate-command/.
-jest.mock('../validate-command', () => ({ preflightValidation: jest.fn(() => true) }));
-
 jest.mock('dotenv');
 
 const { spawn } = require('node:child_process');

package/infrastructure/__tests__/management-api-gateway-routes.test.js

@@ -0,0 +1,281 @@
+/**
+ * Management API ↔ API Gateway route coverage
+ *
+ * The Management API is an Express app (core's createIntegrationRouter)
+ * served by the `auth` Lambda. API Gateway HTTP APIs have no implicit
+ * catch-all: a request whose path matches no declared route gets a gateway
+ * 404 and never reaches Express. So every route the integration router
+ * registers must be covered by an httpApi event on the `auth` function, and
+ * no more-specific route on another function may shadow it.
+ *
+ * The Express routes are read from the live router (not a hard-coded list),
+ * so a route added to core later fails this test until the gateway routes
+ * are updated alongside it.
+ */
+
+// Avoid AWS calls: hand the builders a fixed discovery result.
+jest.mock('../domains/shared/resource-discovery', () => {
+    const actual = jest.requireActual('../domains/shared/resource-discovery');
+    return {
+        ...actual,
+        gatherDiscoveredResources: jest.fn().mockResolvedValue({
+            defaultVpcId: 'vpc-123456',
+            vpcCidr: '172.31.0.0/16',
+            defaultSecurityGroupId: 'sg-123456',
+            privateSubnetId1: 'subnet-123456',
+            privateSubnetId2: 'subnet-789012',
+            publicSubnetId1: 'subnet-public-1',
+            publicSubnetId2: 'subnet-public-2',
+            defaultRouteTableId: 'rtb-123456',
+            defaultKmsKeyId:
+                'arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012',
+            existingNatGatewayId: 'nat-default123',
+            auroraClusterEndpoint:
+                'test-cluster.cluster-abc123.us-east-1.rds.amazonaws.com',
+            auroraPort: 5432,
+            auroraEngine: 'aurora-postgresql',
+        }),
+    };
+});
+
+// createIntegrationRouter loads the app definition from the consuming
+// backend; give it an empty one so the router can be built in isolation.
+jest.mock('@friggframework/core/handlers/app-definition-loader', () => ({
+    loadAppDefinition: () => ({ integrations: [], userConfig: {} }),
+}));
+
+const { composeServerlessDefinition } = require('../infrastructure-composer');
+
+// Routes the auth Lambda's handler (core/handlers/routers/auth.js) adds on
+// top of createIntegrationRouter().
+const AUTH_HANDLER_EXTRA_ROUTES = [
+    { method: 'GET', path: '/api/integrations/redirect/:appId' },
+];
+
+function getIntegrationRouterRoutes() {
+    const { createIntegrationRouter } = require('@friggframework/core');
+    // The repository factories pick an adapter from DB_TYPE (or the backend's
+    // app definition, which doesn't exist here). Nothing connects.
+    const previousDbType = process.env.DB_TYPE;
+    process.env.DB_TYPE = 'postgresql';
+    let app;
+    try {
+        app = createIntegrationRouter();
+    } finally {
+        if (previousDbType === undefined) delete process.env.DB_TYPE;
+        else process.env.DB_TYPE = previousDbType;
+    }
+    const stack = (app._router || app.router).stack;
+    const routes = [];
+    for (const layer of stack) {
+        if (!layer.route) continue;
+        for (const method of Object.keys(layer.route.methods)) {
+            routes.push({
+                method: method === '_all' ? 'ANY' : method.toUpperCase(),
+                path: layer.route.path,
+            });
+        }
+    }
+    return routes;
+}
+
+function getGatewayRoutes(definition) {
+    const routes = [];
+    for (const [functionName, fn] of Object.entries(definition.functions)) {
+        for (const event of fn.events || []) {
+            if (!event.httpApi) continue;
+            routes.push({
+                functionName,
+                method: String(event.httpApi.method).toUpperCase(),
+                path: event.httpApi.path,
+            });
+        }
+    }
+    return routes;
+}
+
+const segmentsOf = (p) => p.split('/').filter(Boolean);
+
+// Turn an Express path into a concrete request path, e.g.
+// /api/entities/:entityId/options -> /api/entities/sample-entityId/options
+const toConcretePath = (expressPath) =>
+    expressPath.replace(/:([A-Za-z0-9_]+)/g, 'sample-$1');
+
+/**
+ * HTTP API path matching: literal segments match exactly, {param} matches
+ * one segment, a trailing {proxy+} greedily matches one or more segments.
+ * Returns null on no match, otherwise a specificity descriptor.
+ */
+function matchGatewayPath(gatewayPath, requestPath) {
+    const g = segmentsOf(gatewayPath);
+    const r = segmentsOf(requestPath);
+    let literals = 0;
+    for (let i = 0; i < g.length; i++) {
+        const seg = g[i];
+        if (/^\{[^}]+\+\}$/.test(seg)) {
+            if (i !== g.length - 1 || r.length <= i) return null;
+            return { greedy: true, literals, prefixLength: i };
+        }
+        if (i >= r.length) return null;
+        if (/^\{[^}]+\}$/.test(seg)) continue;
+        if (seg !== r[i]) return null;
+        literals++;
+    }
+    if (g.length !== r.length) return null;
+    return { greedy: false, literals, prefixLength: g.length };
+}
+
+/**
+ * Select the route API Gateway would invoke: a non-greedy match beats a
+ * greedy one, then more literal segments, then the longer greedy prefix,
+ * then an explicit method beats ANY.
+ */
+function selectGatewayRoute(gatewayRoutes, method, requestPath) {
+    const candidates = gatewayRoutes
+        .filter(
+            (r) => r.method === 'ANY' || method === 'ANY' || r.method === method
+        )
+        .map((r) => ({
+            route: r,
+            match: matchGatewayPath(r.path, requestPath),
+        }))
+        .filter((c) => c.match);
+    candidates.sort(
+        (a, b) =>
+            Number(a.match.greedy) - Number(b.match.greedy) ||
+            b.match.literals - a.match.literals ||
+            b.match.prefixLength - a.match.prefixLength ||
+            Number(a.route.method === 'ANY') - Number(b.route.method === 'ANY')
+    );
+    return candidates.length ? candidates[0].route : null;
+}
+
+describe('Management API routes are reachable through API Gateway', () => {
+    let gatewayRoutes;
+    let managementRoutes;
+    const originalArgv = process.argv;
+
+    beforeAll(async () => {
+        process.argv = ['node', 'test'];
+        process.env.AWS_REGION = 'us-east-1';
+        // The builders narrate their progress; keep the test output quiet.
+        const logSpy = jest.spyOn(console, 'log').mockImplementation(() => {});
+        const warnSpy = jest
+            .spyOn(console, 'warn')
+            .mockImplementation(() => {});
+        try {
+            const definition = await composeServerlessDefinition({
+                name: 'route-coverage-app',
+                provider: 'aws',
+                usePrismaLambdaLayer: false,
+                database: { postgres: { enable: true } },
+                websockets: { enable: true },
+                adminScripts: [
+                    class ExampleScript {
+                        static Definition = { name: 'example-script' };
+                    },
+                ],
+                admin: { includeBuiltinReports: true },
+                integrations: [
+                    {
+                        Definition: {
+                            name: 'acme',
+                            webhooks: true,
+                            extensions: {
+                                inbound: {
+                                    extension: {
+                                        routes: [
+                                            { path: '/events', method: 'POST' },
+                                        ],
+                                    },
+                                },
+                            },
+                        },
+                    },
+                    // Integration names share the /api/ namespace with the
+                    // Management API; make sure they don't shadow it.
+                    { Definition: { name: 'entities' } },
+                ],
+            });
+            gatewayRoutes = getGatewayRoutes(definition);
+        } finally {
+            logSpy.mockRestore();
+            warnSpy.mockRestore();
+        }
+        managementRoutes = [
+            ...getIntegrationRouterRoutes(),
+            ...AUTH_HANDLER_EXTRA_ROUTES,
+        ];
+    });
+
+    afterAll(() => {
+        process.argv = originalArgv;
+        delete process.env.AWS_REGION;
+    });
+
+    it('reads the Management API routes from the core integration router', () => {
+        const paths = managementRoutes.map((r) => r.path);
+        expect(paths).toEqual(
+            expect.arrayContaining([
+                '/api/integrations',
+                '/api/authorize',
+                '/api/entity',
+                '/api/entity/options/:credentialId',
+                '/api/entities/:entityId',
+            ])
+        );
+    });
+
+    it('routes every Management API route to the auth function', () => {
+        const unreachable = managementRoutes
+            .map(({ method, path: expressPath }) => {
+                const requestPath = toConcretePath(expressPath);
+                const selected = selectGatewayRoute(
+                    gatewayRoutes,
+                    method,
+                    requestPath
+                );
+                return {
+                    route: `${method} ${expressPath}`,
+                    reachedBy: selected
+                        ? `${selected.method} ${selected.path} -> ${selected.functionName}`
+                        : 'no API Gateway route',
+                    ok: selected && selected.functionName === 'auth',
+                };
+            })
+            .filter((r) => !r.ok)
+            .map(({ route, reachedBy }) => `${route} (${reachedBy})`);
+
+        expect(unreachable).toEqual([]);
+    });
+
+    it.each([
+        ['GET', '/api/v2/reports', 'reportRouter'],
+        ['POST', '/api/v2/reports/daily/run', 'reportRouter'],
+        ['GET', '/admin/scripts/example-script', 'adminScriptRouter'],
+        ['POST', '/api/acme-integration/webhooks', 'acmeWebhook'],
+        ['POST', '/api/acme-integration/inbound/events', 'acme__inbound'],
+        ['GET', '/api/acme-integration/custom', 'acme'],
+        ['GET', '/api/entities-integration/custom', 'entities'],
+        ['POST', '/user/login', 'user'],
+        ['GET', '/health/ready', 'health'],
+    ])('leaves %s %s on %s', (method, requestPath, functionName) => {
+        const selected = selectGatewayRoute(gatewayRoutes, method, requestPath);
+        expect(selected && selected.functionName).toBe(functionName);
+    });
+
+    it('declares no method + path pair on more than one function', () => {
+        const seen = new Map();
+        const duplicates = [];
+        for (const r of gatewayRoutes) {
+            const key = `${r.method} ${r.path}`;
+            if (seen.has(key) && seen.get(key) !== r.functionName) {
+                duplicates.push(
+                    `${key}: ${seen.get(key)} and ${r.functionName}`
+                );
+            }
+            seen.set(key, r.functionName);
+        }
+        expect(duplicates).toEqual([]);
+    });
+});

package/infrastructure/create-frigg-infrastructure.js

@@ -3,7 +3,6 @@ const fs = require('fs-extra');
 const crypto = require('crypto');
 const { composeServerlessDefinition } = require('./infrastructure-composer');
 const { findNearestBackendPackageJson } = require('@friggframework/core');
-const { applyAppDefinitionDefaults } = require('@friggframework/schemas');
 
 // Filesystem-based cache to persist across osls require cache clears
 const getCachePath = (backendDir) => {
@@ -103,9 +102,7 @@ async function createFriggInfrastructure() {
 
     try {
         const backend = require(backendFilePath);
-        // Same defaults step as core's loadAppDefinition (ADR-051), so the
-        // builders and the runtime see the same definition.
-        const appDefinition = applyAppDefinitionDefaults(backend.Definition);
+        const appDefinition = backend.Definition;
 
         const definition = await composeServerlessDefinition(
             appDefinition,