@friggframework/devtools 2.0.0-next.104 → 2.0.0-next.106

package/infrastructure/domains/admin-scripts/admin-script-builder.js

@@ -23,7 +23,15 @@ class AdminScriptBuilder extends InfrastructureBuilder {
     }
 
     shouldExecute(appDefinition) {
-        return Array.isArray(appDefinition.adminScripts) && appDefinition.adminScripts.length > 0;
+        const hasScripts =
+            Array.isArray(appDefinition.adminScripts) &&
+            appDefinition.adminScripts.length > 0;
+        const hasReports =
+            Array.isArray(appDefinition.reports) &&
+            appDefinition.reports.length > 0;
+        const hasBuiltinReports =
+            appDefinition.admin?.includeBuiltinReports === true;
+        return hasScripts || hasReports || hasBuiltinReports;
     }
 
     getDependencies() {
@@ -33,31 +41,53 @@ class AdminScriptBuilder extends InfrastructureBuilder {
     validate(appDefinition) {
         const result = new ValidationResult();
 
-        if (!appDefinition.adminScripts) {
-            return result; // Not an error, just no scripts
-        }
-
-        if (!Array.isArray(appDefinition.adminScripts)) {
-            result.addError('adminScripts must be an array');
-            return result;
+        if (appDefinition.adminScripts !== undefined) {
+            if (!Array.isArray(appDefinition.adminScripts)) {
+                result.addError('adminScripts must be an array');
+            } else {
+                appDefinition.adminScripts.forEach((script, index) => {
+                    if (!script?.Definition?.name) {
+                        result.addError(`Admin script at index ${index} is missing Definition or name`);
+                    }
+                });
+            }
         }
 
-        // Validate each script
-        appDefinition.adminScripts.forEach((script, index) => {
-            if (!script?.Definition?.name) {
-                result.addError(`Admin script at index ${index} is missing Definition or name`);
+        if (appDefinition.reports !== undefined) {
+            if (!Array.isArray(appDefinition.reports)) {
+                result.addError('reports must be an array');
+            } else {
+                appDefinition.reports.forEach((report, index) => {
+                    if (!report?.Definition?.name) {
+                        result.addError(`Report at index ${index} is missing Definition or name`);
+                    }
+                });
             }
-        });
+        }
 
         return result;
     }
 
     async build(appDefinition, discoveredResources) {
-        console.log(`\n[${this.name}] Configuring admin scripts...`);
-        console.log(`  Processing ${appDefinition.adminScripts.length} scripts...`);
+        console.log(`\n[${this.name}] Configuring admin operations...`);
 
         const usePrismaLayer = appDefinition.usePrismaLambdaLayer !== false;
         const adminConfig = appDefinition.admin || {};
+        const adminScripts = Array.isArray(appDefinition.adminScripts)
+            ? appDefinition.adminScripts
+            : [];
+        const reports = Array.isArray(appDefinition.reports)
+            ? appDefinition.reports
+            : [];
+        const hasReports =
+            reports.length > 0 || adminConfig.includeBuiltinReports === true;
+
+        // Only non-JSON report output is stored in S3, so provision the bucket
+        // only for that. Built-in reports emit JSON, so they don't trigger it.
+        const reportsNeedArtifacts = reports.some((report) => {
+            const format = report?.Definition?.output?.format;
+            return Boolean(format) && format !== 'json';
+        });
 
         const result = {
             functions: {},
@@ -67,27 +97,45 @@ class AdminScriptBuilder extends InfrastructureBuilder {
             iamStatements: [],
         };
 
-        // Create admin script queue
-        this.createAdminScriptQueue(result, appDefinition);
-
-        // Create Lambda function for script execution
-        this.createScriptExecutorFunction(appDefinition, result, usePrismaLayer);
+        if (adminScripts.length > 0) {
+            console.log(`  Processing ${adminScripts.length} scripts...`);
+            this.createAdminScriptQueue(result, appDefinition);
+            this.createScriptExecutorFunction(appDefinition, result, usePrismaLayer);
+            this.createAdminScriptRoutes(appDefinition, result, usePrismaLayer);
 
-        // Create API routes for script management
-        this.createAdminScriptRoutes(appDefinition, result, usePrismaLayer);
+            adminScripts.forEach(script => {
+                const name = script.Definition?.name || 'unknown';
+                console.log(`    ✓ Registered script: ${name}`);
+            });
+        }
 
-        // Phase 2: Create EventBridge Scheduler resources
-        if (adminConfig.enableScheduling) {
-            this.createSchedulerResources(appDefinition, result);
+        if (hasReports) {
+            this.createReportQueue(result, appDefinition);
+            this.createReportExecutorFunction(appDefinition, result, usePrismaLayer);
+            this.createReportRoutes(appDefinition, result, usePrismaLayer);
+            if (reportsNeedArtifacts) {
+                this.createReportArtifactBucket(result, appDefinition);
+            }
+            reports.forEach(report => {
+                const name = report.Definition?.name || 'unknown';
+                console.log(`    ✓ Registered report: ${name}`);
+            });
+            if (adminConfig.includeBuiltinReports) {
+                console.log('    ✓ Built-in reports enabled');
+            }
         }
 
-        // Log registered scripts
-        appDefinition.adminScripts.forEach(script => {
-            const name = script.Definition?.name || 'unknown';
-            console.log(`    ✓ Registered: ${name}`);
-        });
+        if (
+            adminConfig.enableScheduling &&
+            (adminScripts.length > 0 || hasReports)
+        ) {
+            this.createSchedulerResources(appDefinition, result, {
+                scriptsPresent: adminScripts.length > 0,
+                hasReports,
+            });
+        }
 
-        console.log(`[${this.name}] ✅ Admin script configuration completed`);
+        console.log(`[${this.name}] ✅ Admin operations configuration completed`);
         return result;
     }
 
@@ -193,6 +241,151 @@ class AdminScriptBuilder extends InfrastructureBuilder {
         console.log('  ✓ Created adminScriptRouter function');
     }
 
+    createReportRoutes(appDefinition, result, usePrismaLayer) {
+        result.functions.reportRouter = {
+            handler: 'node_modules/@friggframework/admin-scripts/src/infrastructure/report-router.handler',
+            skipEsbuild: true,
+            package: this.skipEsbuildPackageConfig(appDefinition, usePrismaLayer),
+            ...(usePrismaLayer && { layers: [{ Ref: 'PrismaLambdaLayer' }] }),
+            timeout: 30,
+            events: [
+                { httpApi: { path: '/api/v2/reports', method: 'GET' } },
+                // Definition detail, snapshots, executions, schedule, back-compat alias
+                { httpApi: { path: '/api/v2/reports/{proxy+}', method: 'GET' } },
+                // Run a report ({name}/run)
+                { httpApi: { path: '/api/v2/reports/{proxy+}', method: 'POST' } },
+                // Schedule management (PUT/DELETE {name}/schedule)
+                { httpApi: { path: '/api/v2/reports/{proxy+}', method: 'PUT' } },
+                { httpApi: { path: '/api/v2/reports/{proxy+}', method: 'DELETE' } },
+            ],
+        };
+        console.log('  ✓ Created reportRouter function');
+    }
+
+    createReportQueue(result, appDefinition) {
+        result.resources.ReportQueue = {
+            Type: 'AWS::SQS::Queue',
+            Properties: {
+                QueueName: '${self:service}-${self:provider.stage}-ReportQueue',
+                MessageRetentionPeriod: 86400, // 1 day
+                VisibilityTimeout: 900, // 15 minutes (Lambda max)
+                RedrivePolicy: {
+                    maxReceiveCount: 3,
+                    deadLetterTargetArn: {
+                        'Fn::GetAtt': ['InternalErrorQueue', 'Arn'],
+                    },
+                },
+            },
+        };
+
+        if (isScopedEnvironmentActive(appDefinition)) {
+            // Only the report functions read this queue URL
+            result.functionEnvironments = result.functionEnvironments || {};
+            for (const fnName of ['reportRouter', 'reportExecutor']) {
+                result.functionEnvironments[fnName] = {
+                    ...result.functionEnvironments[fnName],
+                    REPORT_QUEUE_URL: { Ref: 'ReportQueue' },
+                };
+            }
+        } else {
+            result.environment.REPORT_QUEUE_URL = { Ref: 'ReportQueue' };
+        }
+
+        // The report router enqueues async recorded/snapshot runs. The base
+        // role's wildcard does not cover this queue's name, so grant
+        // SendMessage explicitly.
+        result.iamStatements.push({
+            Effect: 'Allow',
+            Action: [
+                'sqs:SendMessage',
+                'sqs:SendMessageBatch',
+                'sqs:GetQueueUrl',
+                'sqs:GetQueueAttributes',
+            ],
+            Resource: { 'Fn::GetAtt': ['ReportQueue', 'Arn'] },
+        });
+
+        console.log('  ✓ Created ReportQueue');
+    }
+
+    createReportExecutorFunction(appDefinition, result, usePrismaLayer) {
+        result.functions.reportExecutor = {
+            handler: 'node_modules/@friggframework/admin-scripts/src/infrastructure/report-executor-handler.handler',
+            skipEsbuild: true,
+            package: this.skipEsbuildPackageConfig(appDefinition, usePrismaLayer),
+            ...(usePrismaLayer && { layers: [{ Ref: 'PrismaLambdaLayer' }] }),
+            timeout: 900, // 15 minutes max
+            memorySize: 1024,
+            events: [
+                {
+                    sqs: {
+                        arn: { 'Fn::GetAtt': ['ReportQueue', 'Arn'] },
+                        batchSize: 1,
+                    },
+                },
+            ],
+        };
+        console.log('  ✓ Created reportExecutor function');
+    }
+
+    // Non-JSON report output; the router mints short-lived presigned URLs for reads.
+    createReportArtifactBucket(result, appDefinition) {
+        result.resources.ReportArtifactBucket = {
+            Type: 'AWS::S3::Bucket',
+            Properties: {
+                BucketName:
+                    '${self:service}-${self:provider.stage}-report-artifacts',
+                BucketEncryption: {
+                    ServerSideEncryptionConfiguration: [
+                        {
+                            ServerSideEncryptionByDefault: {
+                                SSEAlgorithm: 'AES256',
+                            },
+                        },
+                    ],
+                },
+                PublicAccessBlockConfiguration: {
+                    BlockPublicAcls: true,
+                    BlockPublicPolicy: true,
+                    IgnorePublicAcls: true,
+                    RestrictPublicBuckets: true,
+                },
+            },
+        };
+
+        if (isScopedEnvironmentActive(appDefinition)) {
+            result.functionEnvironments = result.functionEnvironments || {};
+            for (const fnName of ['reportRouter', 'reportExecutor']) {
+                result.functionEnvironments[fnName] = {
+                    ...result.functionEnvironments[fnName],
+                    REPORT_ARTIFACT_BUCKET: { Ref: 'ReportArtifactBucket' },
+                };
+            }
+        } else {
+            result.environment.REPORT_ARTIFACT_BUCKET = {
+                Ref: 'ReportArtifactBucket',
+            };
+        }
+
+        // Executor writes and router reads (via presign); scope to this bucket's objects.
+        result.iamStatements.push({
+            Effect: 'Allow',
+            Action: ['s3:PutObject', 's3:GetObject'],
+            Resource: {
+                'Fn::Sub': [
+                    '${BucketArn}/*',
+                    {
+                        BucketArn: {
+                            'Fn::GetAtt': ['ReportArtifactBucket', 'Arn'],
+                        },
+                    },
+                ],
+            },
+        });
+
+        console.log('  ✓ Created ReportArtifactBucket');
+    }
+
     // Without this, the skipEsbuild functions package the whole node_modules
     // closure (aws-sdk, Prisma, dev deps) and blow past Lambda's 250 MB limit.
     // Mirrors the exclusions the framework's other node_modules handlers use.
@@ -248,13 +441,25 @@ class AdminScriptBuilder extends InfrastructureBuilder {
         };
     }
 
-    createSchedulerResources(appDefinition, result) {
-        // Constructed ARN, not Fn::GetAtt: a GetAtt edge to the executor closes a
+    createSchedulerResources(
+        appDefinition,
+        result,
+        { scriptsPresent = true, hasReports = false } = {}
+    ) {
+        // Constructed ARNs, not Fn::GetAtt: a GetAtt edge to an executor closes a
         // CloudFormation circular dependency via the shared Lambda execution role.
-        const executorArn = {
-            'Fn::Sub':
-                'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-adminScriptExecutor',
-        };
+        const fnArn = (logicalName) => ({
+            'Fn::Sub': `arn:aws:lambda:\${AWS::Region}:\${AWS::AccountId}:function:\${self:service}-\${self:provider.stage}-${logicalName}`,
+        });
+        const scriptExecutorArn = fnArn('adminScriptExecutor');
+        const reportExecutorArn = fnArn('reportExecutor');
+
+        const invokeResources = [
+            ...(scriptsPresent ? [scriptExecutorArn] : []),
+            ...(hasReports ? [reportExecutorArn] : []),
+        ];
+        const invokeResource =
+            invokeResources.length === 1 ? invokeResources[0] : invokeResources;
 
         // Create IAM role for EventBridge Scheduler
         result.resources.AdminScriptSchedulerRole = {
@@ -276,7 +481,7 @@ class AdminScriptBuilder extends InfrastructureBuilder {
                         Statement: [{
                             Effect: 'Allow',
                             Action: 'lambda:InvokeFunction',
-                            Resource: executorArn,
+                            Resource: invokeResource,
                         }],
                     },
                 }],
@@ -293,18 +498,35 @@ class AdminScriptBuilder extends InfrastructureBuilder {
 
         // Router-scoped, not shared provider env. Two reasons: broadcasting the
         // resource references to every function creates CloudFormation circular
-        // deps; and SCHEDULER_PROVIDER='aws' is only valid for the admin-script
-        // adapter (the router's sole consumer) — core's scheduler factory, used
-        // by integration Lambdas, rejects 'aws', so it must not leak app-wide.
-        result.functions.adminScriptRouter.environment = {
-            ...(result.functions.adminScriptRouter.environment || {}),
-            SCHEDULER_PROVIDER: 'aws',
-            SCHEDULER_ROLE_ARN: {
-                'Fn::GetAtt': ['AdminScriptSchedulerRole', 'Arn'],
-            },
-            ADMIN_SCRIPT_SCHEDULE_GROUP: { Ref: 'AdminScriptScheduleGroup' },
-            ADMIN_SCRIPT_EXECUTOR_LAMBDA_ARN: executorArn,
-        };
+        // deps; and SCHEDULER_PROVIDER='aws' is only valid for the admin-scripts
+        // adapter (the routers are its sole consumers) — core's scheduler
+        // factory, used by integration Lambdas, rejects 'aws', so it must not
+        // leak app-wide.
+        if (scriptsPresent) {
+            result.functions.adminScriptRouter.environment = {
+                ...(result.functions.adminScriptRouter.environment || {}),
+                SCHEDULER_PROVIDER: 'aws',
+                SCHEDULER_ROLE_ARN: {
+                    'Fn::GetAtt': ['AdminScriptSchedulerRole', 'Arn'],
+                },
+                ADMIN_SCRIPT_SCHEDULE_GROUP: { Ref: 'AdminScriptScheduleGroup' },
+                ADMIN_SCRIPT_EXECUTOR_LAMBDA_ARN: scriptExecutorArn,
+            };
+        }
+
+        // Report schedules reuse the shared role/group but must target the
+        // report executor, not the script one (REPORT_EXECUTOR_LAMBDA_ARN).
+        if (hasReports) {
+            result.functions.reportRouter.environment = {
+                ...(result.functions.reportRouter.environment || {}),
+                SCHEDULER_PROVIDER: 'aws',
+                SCHEDULER_ROLE_ARN: {
+                    'Fn::GetAtt': ['AdminScriptSchedulerRole', 'Arn'],
+                },
+                REPORT_SCHEDULE_GROUP: { Ref: 'AdminScriptScheduleGroup' },
+                REPORT_EXECUTOR_LAMBDA_ARN: reportExecutorArn,
+            };
+        }
 
         // The router manages schedules through the AWS scheduler adapter, so it
         // needs scheduler:* on this group plus iam:PassRole for the role it hands

package/infrastructure/domains/admin-scripts/admin-script-builder.test.js

@@ -620,6 +620,319 @@ describe('AdminScriptBuilder', () => {
         });
     });
 
+    describe('reports (ReportQueue + reportExecutor)', () => {
+        it('creates ReportQueue + reportExecutor and wires REPORT_QUEUE_URL when reports are present', async () => {
+            const appDefinition = {
+                reports: [{ Definition: { name: 'my-report', version: '1.0.0' } }],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            // Queue
+            expect(result.resources.ReportQueue).toBeDefined();
+            expect(result.resources.ReportQueue.Type).toBe('AWS::SQS::Queue');
+            expect(
+                result.resources.ReportQueue.Properties.MessageRetentionPeriod
+            ).toBe(86400);
+            expect(
+                result.resources.ReportQueue.Properties.VisibilityTimeout
+            ).toBe(900);
+            expect(
+                result.resources.ReportQueue.Properties.RedrivePolicy
+            ).toEqual({
+                maxReceiveCount: 3,
+                deadLetterTargetArn: {
+                    'Fn::GetAtt': ['InternalErrorQueue', 'Arn'],
+                },
+            });
+
+            // Executor function
+            expect(result.functions.reportExecutor).toBeDefined();
+            expect(result.functions.reportExecutor.handler).toBe(
+                'node_modules/@friggframework/admin-scripts/src/infrastructure/report-executor-handler.handler'
+            );
+            expect(result.functions.reportExecutor.timeout).toBe(900);
+            expect(result.functions.reportExecutor.memorySize).toBe(1024);
+            expect(result.functions.reportExecutor.events).toEqual([
+                {
+                    sqs: {
+                        arn: { 'Fn::GetAtt': ['ReportQueue', 'Arn'] },
+                        batchSize: 1,
+                    },
+                },
+            ]);
+            expect(result.functions.reportExecutor.skipEsbuild).toBe(true);
+            expect(result.functions.reportExecutor.layers).toEqual([
+                { Ref: 'PrismaLambdaLayer' },
+            ]);
+
+            // Env wired app-wide (scoped flag off)
+            expect(result.environment.REPORT_QUEUE_URL).toEqual({
+                Ref: 'ReportQueue',
+            });
+
+            // IAM SendMessage grant on the queue Arn
+            const grant = result.iamStatements.find(
+                (s) =>
+                    Array.isArray(s.Action) &&
+                    s.Action.includes('sqs:SendMessage') &&
+                    s.Resource &&
+                    s.Resource['Fn::GetAtt'] &&
+                    s.Resource['Fn::GetAtt'][0] === 'ReportQueue'
+            );
+            expect(grant).toBeDefined();
+            expect(grant.Action).toContain('sqs:SendMessageBatch');
+        });
+
+        it('scopes REPORT_QUEUE_URL to reportRouter + reportExecutor when scopedEnvironment is on', async () => {
+            const appDefinition = {
+                lambda: { scopedEnvironment: true },
+                reports: [{ Definition: { name: 'my-report', version: '1.0.0' } }],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            expect(result.environment.REPORT_QUEUE_URL).toBeUndefined();
+            for (const fnName of ['reportRouter', 'reportExecutor']) {
+                expect(
+                    result.functionEnvironments[fnName].REPORT_QUEUE_URL
+                ).toEqual({ Ref: 'ReportQueue' });
+            }
+        });
+
+        it('creates ReportQueue + reportExecutor when only builtin reports are enabled', async () => {
+            const appDefinition = {
+                admin: { includeBuiltinReports: true },
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            expect(result.resources.ReportQueue).toBeDefined();
+            expect(result.functions.reportExecutor).toBeDefined();
+        });
+
+        it('does NOT create ReportQueue or reportExecutor when only adminScripts are present', async () => {
+            const appDefinition = {
+                adminScripts: [{ Definition: { name: 'test-script' } }],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            expect(result.resources.ReportQueue).toBeUndefined();
+            expect(result.functions.reportExecutor).toBeUndefined();
+            expect(result.functions.reportRouter).toBeUndefined();
+            expect(result.environment.REPORT_QUEUE_URL).toBeUndefined();
+        });
+    });
+
+    describe('report artifacts (ReportArtifactBucket for non-JSON output)', () => {
+        it('provisions a private encrypted bucket + IAM + env when a report emits non-JSON', async () => {
+            const appDefinition = {
+                reports: [
+                    {
+                        Definition: {
+                            name: 'sales-csv',
+                            version: '1.0.0',
+                            output: { format: 'csv' },
+                        },
+                    },
+                ],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            const bucket = result.resources.ReportArtifactBucket;
+            expect(bucket).toBeDefined();
+            expect(bucket.Type).toBe('AWS::S3::Bucket');
+            expect(
+                bucket.Properties.BucketEncryption
+                    .ServerSideEncryptionConfiguration[0]
+                    .ServerSideEncryptionByDefault.SSEAlgorithm
+            ).toBe('AES256');
+            expect(bucket.Properties.PublicAccessBlockConfiguration).toEqual({
+                BlockPublicAcls: true,
+                BlockPublicPolicy: true,
+                IgnorePublicAcls: true,
+                RestrictPublicBuckets: true,
+            });
+
+            // Env wired app-wide (scoped flag off).
+            expect(result.environment.REPORT_ARTIFACT_BUCKET).toEqual({
+                Ref: 'ReportArtifactBucket',
+            });
+
+            // IAM: object-level Put/Get scoped to the bucket keys.
+            const grant = result.iamStatements.find(
+                (s) =>
+                    Array.isArray(s.Action) &&
+                    s.Action.includes('s3:PutObject')
+            );
+            expect(grant).toBeDefined();
+            expect(grant.Action).toContain('s3:GetObject');
+            expect(grant.Resource['Fn::Sub'][0]).toBe('${BucketArn}/*');
+            expect(grant.Resource['Fn::Sub'][1]).toEqual({
+                BucketArn: { 'Fn::GetAtt': ['ReportArtifactBucket', 'Arn'] },
+            });
+        });
+
+        it('does NOT provision the bucket for JSON-only reports', async () => {
+            const appDefinition = {
+                reports: [
+                    {
+                        Definition: {
+                            name: 'json-report',
+                            version: '1.0.0',
+                            output: { format: 'json' },
+                        },
+                    },
+                    // No output field defaults to JSON.
+                    { Definition: { name: 'plain', version: '1.0.0' } },
+                ],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            expect(result.resources.ReportArtifactBucket).toBeUndefined();
+            expect(result.environment.REPORT_ARTIFACT_BUCKET).toBeUndefined();
+            const grant = result.iamStatements.find(
+                (s) =>
+                    Array.isArray(s.Action) &&
+                    s.Action.includes('s3:PutObject')
+            );
+            expect(grant).toBeUndefined();
+        });
+
+        it('scopes REPORT_ARTIFACT_BUCKET to report functions when scopedEnvironment is on', async () => {
+            const appDefinition = {
+                lambda: { scopedEnvironment: true },
+                reports: [
+                    {
+                        Definition: {
+                            name: 'sales-csv',
+                            version: '1.0.0',
+                            output: { format: 'csv' },
+                        },
+                    },
+                ],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            expect(result.environment.REPORT_ARTIFACT_BUCKET).toBeUndefined();
+            for (const fnName of ['reportRouter', 'reportExecutor']) {
+                expect(
+                    result.functionEnvironments[fnName].REPORT_ARTIFACT_BUCKET
+                ).toEqual({ Ref: 'ReportArtifactBucket' });
+            }
+        });
+    });
+
+    describe('report scheduling (enableScheduling && reports)', () => {
+        it('wires the report scheduler env onto reportRouter targeting the report executor', async () => {
+            const appDefinition = {
+                reports: [{ Definition: { name: 'my-report', version: '1.0.0' } }],
+                admin: { enableScheduling: true },
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            // Shared scheduler role + group are created even without scripts.
+            expect(result.resources.AdminScriptSchedulerRole).toBeDefined();
+            expect(result.resources.AdminScriptScheduleGroup).toBeDefined();
+
+            const routerEnv = result.functions.reportRouter.environment;
+            expect(routerEnv.SCHEDULER_PROVIDER).toBe('aws');
+            expect(routerEnv.SCHEDULER_ROLE_ARN).toEqual({
+                'Fn::GetAtt': ['AdminScriptSchedulerRole', 'Arn'],
+            });
+            expect(routerEnv.REPORT_SCHEDULE_GROUP).toEqual({
+                Ref: 'AdminScriptScheduleGroup',
+            });
+            // Constructed ARN (Fn::Sub), not Fn::GetAtt — avoids a circular dep.
+            expect(routerEnv.REPORT_EXECUTOR_LAMBDA_ARN).toEqual({
+                'Fn::Sub':
+                    'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-reportExecutor',
+            });
+
+            // Must NOT leak onto the shared provider env.
+            expect(result.environment.SCHEDULER_PROVIDER).toBeUndefined();
+            expect(result.environment.REPORT_EXECUTOR_LAMBDA_ARN).toBeUndefined();
+        });
+
+        it('grants the scheduler role invoke on the report executor (reports-only)', async () => {
+            const appDefinition = {
+                reports: [{ Definition: { name: 'my-report', version: '1.0.0' } }],
+                admin: { enableScheduling: true },
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            const statement =
+                result.resources.AdminScriptSchedulerRole.Properties.Policies[0]
+                    .PolicyDocument.Statement[0];
+            // Only reports present -> single Resource, the report executor ARN.
+            expect(statement.Resource).toEqual({
+                'Fn::Sub':
+                    'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-reportExecutor',
+            });
+
+            // scheduler:* + iam:PassRole grants present.
+            const schedulerGrant = result.iamStatements.find(
+                (s) =>
+                    Array.isArray(s.Action) &&
+                    s.Action.includes('scheduler:CreateSchedule')
+            );
+            expect(schedulerGrant).toBeDefined();
+        });
+
+        it('lets the scheduler role invoke BOTH executors when scripts and reports coexist', async () => {
+            const appDefinition = {
+                adminScripts: [{ Definition: { name: 'test-script' } }],
+                reports: [{ Definition: { name: 'my-report', version: '1.0.0' } }],
+                admin: { enableScheduling: true },
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            const statement =
+                result.resources.AdminScriptSchedulerRole.Properties.Policies[0]
+                    .PolicyDocument.Statement[0];
+            expect(statement.Resource).toEqual([
+                {
+                    'Fn::Sub':
+                        'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-adminScriptExecutor',
+                },
+                {
+                    'Fn::Sub':
+                        'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${self:service}-${self:provider.stage}-reportExecutor',
+                },
+            ]);
+
+            // Both routers get their own scheduler env.
+            expect(
+                result.functions.adminScriptRouter.environment
+                    .ADMIN_SCRIPT_EXECUTOR_LAMBDA_ARN
+            ).toBeDefined();
+            expect(
+                result.functions.reportRouter.environment
+                    .REPORT_EXECUTOR_LAMBDA_ARN
+            ).toBeDefined();
+        });
+
+        it('does NOT wire report scheduler env when enableScheduling is off', async () => {
+            const appDefinition = {
+                reports: [{ Definition: { name: 'my-report', version: '1.0.0' } }],
+            };
+
+            const result = await adminScriptBuilder.build(appDefinition, {});
+
+            expect(result.resources.AdminScriptSchedulerRole).toBeUndefined();
+            expect(
+                result.functions.reportRouter.environment
+            ).toBeUndefined();
+        });
+    });
+
     describe('getName()', () => {
         it('should return AdminScriptBuilder', () => {
             expect(adminScriptBuilder.getName()).toBe('AdminScriptBuilder');

package/infrastructure/domains/shared/utilities/base-definition-factory.js

@@ -311,16 +311,7 @@ function createBaseDefinition(
                     { httpApi: { path: '/health/{proxy+}', method: 'GET' } },
                 ],
             },
-            reporting: {
-                handler: 'node_modules/@friggframework/core/handlers/routers/reporting.handler',
-                ...(usePrismaLayer && { layers: [{ Ref: 'PrismaLambdaLayer' }] }),
-                skipEsbuild: true,  // Handlers in node_modules don't need bundling
-                package: skipEsbuildPackageConfig,
-                events: [
-                    { httpApi: { path: '/api/v2/reports', method: 'GET' } },
-                    { httpApi: { path: '/api/v2/reports/{proxy+}', method: 'GET' } },
-                ],
-            },
+            // Reporting is an admin operation (ADR-010): the report router runs on the admin-scripts Lambda, not as a standalone function here.
             // Note: dbMigrate removed - MigrationBuilder now handles migration infrastructure
             // See: packages/devtools/infrastructure/domains/database/migration-builder.js
         },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0-next.104",
+  "version": "2.0.0-next.106",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -26,9 +26,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0-next.104",
-    "@friggframework/schemas": "2.0.0-next.104",
-    "@friggframework/test": "2.0.0-next.104",
+    "@friggframework/core": "2.0.0-next.106",
+    "@friggframework/schemas": "2.0.0-next.106",
+    "@friggframework/test": "2.0.0-next.106",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.18.0",
@@ -56,8 +56,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0-next.104",
-    "@friggframework/prettier-config": "2.0.0-next.104",
+    "@friggframework/eslint-config": "2.0.0-next.106",
+    "@friggframework/prettier-config": "2.0.0-next.106",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -89,5 +89,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "deb915ccac00c3928ba337a202b500ffbfabe01a"
+  "gitHead": "979c1a62fe226206ec3801d1d7aacbfe2a8fac78"
 }