@friggframework/schemas 2.0.0--canary.678.58db4b2.0 → 2.0.0--canary.680.b3ca7f1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@friggframework/schemas",
-  "version": "2.0.0--canary.678.58db4b2.0",
+  "version": "2.0.0--canary.680.b3ca7f1.0",
   "description": "Canonical JSON Schema definitions for Frigg Framework",
   "main": "index.js",
   "author": "",
@@ -41,5 +41,5 @@
     "middleware/",
     "index.js"
   ],
-  "gitHead": "58db4b2bc17529f46b8dae1110771f5df39033ed"
+  "gitHead": "b3ca7f1295d79b4d0cb5fb9fb4ec41093033ba4d"
 }

package/schemas/api-entities.schema.json

@@ -122,6 +122,11 @@
           "type": "string",
           "description": "Description of the entity type"
         },
+        "usedBy": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Names of the integrations that bind this entity type; empty for a type registered only in appDefinition.entities"
+        },
         "authType": {
           "type": "string",
           "enum": ["oauth2", "form", "api-key", "basic"],

package/schemas/app-definition.schema.json

@@ -129,72 +129,30 @@
         },
         "jwtConfig": {
           "type": "object",
-          "description": "Adopter token (JWT) verification for authModes.adopterJwt. Set exactly one of jwksUri (asymmetric keys, rotating) or secret (HMAC). With jwksUri, audience is required and issuer should be set.",
+          "description": "JWT configuration for adopter JWT authentication mode (when authModes.adopterJwt is true)",
           "properties": {
-            "jwksUri": {
-              "type": "string",
-              "format": "uri",
-              "description": "URL of the issuer's JWKS (https; http only for localhost, 127.0.0.0/8 or ::1). Keys are fetched, cached and rotated per process."
-            },
             "secret": {
               "type": "string",
-              "description": "Shared HMAC secret for HS* tokens (set via an environment variable, never in source)"
-            },
-            "issuer": {
-              "type": "string",
-              "description": "Required iss claim. Not checked when omitted; with jwksUri a startup warning is logged when it is unset."
-            },
-            "audience": {
-              "description": "Accepted aud claim value(s). Required with jwksUri; optional (not checked when omitted) with secret.",
-              "oneOf": [
-                { "type": "string" },
-                { "type": "array", "items": { "type": "string" }, "minItems": 1 }
-              ]
-            },
-            "algorithms": {
-              "type": "array",
-              "description": "Allowed signing algorithms. Defaults to ES256 and RS256 with jwksUri, HS256 with secret. HS* only with secret, never with jwksUri.",
-              "items": {
-                "type": "string",
-                "enum": ["ES256", "ES384", "RS256", "RS384", "RS512", "HS256", "HS384", "HS512"]
-              },
-              "minItems": 1
-            },
-            "algorithm": {
-              "type": "string",
-              "description": "Deprecated alias for a one-item algorithms list. Setting both algorithm and algorithms is an error.",
-              "enum": ["ES256", "ES384", "RS256", "RS384", "RS512", "HS256", "HS384", "HS512"]
-            },
-            "clockToleranceSec": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Clock skew allowed on exp and nbf, in seconds",
-              "default": 30
+              "description": "JWT secret key for signature validation (should be set via environment variable)"
             },
             "userIdClaim": {
               "type": "string",
-              "description": "JWT claim name containing the app user ID",
+              "description": "JWT claim name containing the user ID",
               "default": "sub"
             },
             "orgIdClaim": {
               "type": "string",
-              "description": "JWT claim name containing the app organization ID",
+              "description": "JWT claim name containing the organization ID",
               "default": "org_id"
             },
-            "roleClaim": {
+            "algorithm": {
               "type": "string",
-              "description": "JWT claim name containing the organization role. Read and exposed on the authenticated user; not stored yet.",
-              "default": "org_role"
+              "description": "JWT signing algorithm",
+              "enum": ["HS256", "HS384", "HS512", "RS256", "RS384", "RS512"],
+              "default": "HS256"
             }
           },
-          "oneOf": [
-            { "required": ["secret"] },
-            { "required": ["jwksUri"] }
-          ],
-          "dependencies": {
-            "jwksUri": ["audience"]
-          },
-          "not": { "required": ["algorithm", "algorithms"] },
+          "required": ["secret"],
           "additionalProperties": false
         },
         "fields": {
@@ -685,6 +643,56 @@
       },
       "additionalProperties": false
     },
+    "entities": {
+      "type": "object",
+      "description": "App-level entity type registry (ADR-059). Keyed by entity type name; each key must equal its definition's moduleName / getName(). Registered types can be connected without any integration. Entity types bound by declared integrations are inferred and merged unless $infer is false.",
+      "properties": {
+        "$infer": {
+          "type": "boolean",
+          "default": true,
+          "description": "false turns inference off: every module an integration binds must then be registered here, or the app fails to load."
+        }
+      },
+      "additionalProperties": {
+        "type": "object",
+        "description": "One entity type: its module definition plus app-level settings.",
+        "required": ["definition"],
+        "properties": {
+          "definition": {
+            "type": "object",
+            "description": "The API module definition (the object an integration binds as modules.<key>.definition)."
+          },
+          "scope": {
+            "description": "Who owns entities of this type (ADR-056): one scope, or a default plus the scopes callers may choose.",
+            "oneOf": [
+              { "type": "string", "enum": ["individual", "organization", "global"] },
+              {
+                "type": "object",
+                "properties": {
+                  "default": { "type": "string", "enum": ["individual", "organization", "global"] },
+                  "allow": {
+                    "type": "array",
+                    "items": { "type": "string", "enum": ["individual", "organization", "global"] },
+                    "minItems": 1,
+                    "uniqueItems": true
+                  }
+                },
+                "additionalProperties": false
+              }
+            ]
+          },
+          "proxy": {
+            "type": "object",
+            "description": "Per-type entity proxy allow-list override (ADR-052)."
+          },
+          "display": {
+            "type": "object",
+            "description": "Label, icon and description shown by UIs and GET /api/v2/entity-types."
+          }
+        },
+        "additionalProperties": false
+      }
+    },
     "managementApi": {
       "type": "object",
       "description": "Management API settings (ADR-053 versioning, ADR-052 entity proxy).",