@friggframework/schemas 2.0.0--canary.680.b3ca7f1.0 → 2.0.0--canary.681.d970b9e.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@friggframework/schemas",
-  "version": "2.0.0--canary.680.b3ca7f1.0",
+  "version": "2.0.0--canary.681.d970b9e.0",
   "description": "Canonical JSON Schema definitions for Frigg Framework",
   "main": "index.js",
   "author": "",
@@ -41,5 +41,5 @@
     "middleware/",
     "index.js"
   ],
-  "gitHead": "b3ca7f1295d79b4d0cb5fb9fb4ec41093033ba4d"
+  "gitHead": "d970b9e1776a2ec45a07e08a527bf5c02c248461"
 }

package/schemas/api-entities.schema.json

@@ -122,11 +122,6 @@
           "type": "string",
           "description": "Description of the entity type"
         },
-        "usedBy": {
-          "type": "array",
-          "items": { "type": "string" },
-          "description": "Names of the integrations that bind this entity type; empty for a type registered only in appDefinition.entities"
-        },
         "authType": {
           "type": "string",
           "enum": ["oauth2", "form", "api-key", "basic"],

package/schemas/app-definition.schema.json

@@ -129,30 +129,72 @@
         },
         "jwtConfig": {
           "type": "object",
-          "description": "JWT configuration for adopter JWT authentication mode (when authModes.adopterJwt is true)",
+          "description": "Adopter token (JWT) verification for authModes.adopterJwt. Set exactly one of jwksUri (asymmetric keys, rotating) or secret (HMAC). With jwksUri, audience is required and issuer should be set.",
           "properties": {
+            "jwksUri": {
+              "type": "string",
+              "format": "uri",
+              "description": "URL of the issuer's JWKS (https; http only for localhost, 127.0.0.0/8 or ::1). Keys are fetched, cached and rotated per process."
+            },
             "secret": {
               "type": "string",
-              "description": "JWT secret key for signature validation (should be set via environment variable)"
+              "description": "Shared HMAC secret for HS* tokens (set via an environment variable, never in source)"
+            },
+            "issuer": {
+              "type": "string",
+              "description": "Required iss claim. Not checked when omitted; with jwksUri a startup warning is logged when it is unset."
+            },
+            "audience": {
+              "description": "Accepted aud claim value(s). Required with jwksUri; optional (not checked when omitted) with secret.",
+              "oneOf": [
+                { "type": "string" },
+                { "type": "array", "items": { "type": "string" }, "minItems": 1 }
+              ]
+            },
+            "algorithms": {
+              "type": "array",
+              "description": "Allowed signing algorithms. Defaults to ES256 and RS256 with jwksUri, HS256 with secret. HS* only with secret, never with jwksUri.",
+              "items": {
+                "type": "string",
+                "enum": ["ES256", "ES384", "RS256", "RS384", "RS512", "HS256", "HS384", "HS512"]
+              },
+              "minItems": 1
+            },
+            "algorithm": {
+              "type": "string",
+              "description": "Deprecated alias for a one-item algorithms list. Setting both algorithm and algorithms is an error.",
+              "enum": ["ES256", "ES384", "RS256", "RS384", "RS512", "HS256", "HS384", "HS512"]
+            },
+            "clockToleranceSec": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Clock skew allowed on exp and nbf, in seconds",
+              "default": 30
             },
             "userIdClaim": {
               "type": "string",
-              "description": "JWT claim name containing the user ID",
+              "description": "JWT claim name containing the app user ID",
               "default": "sub"
             },
             "orgIdClaim": {
               "type": "string",
-              "description": "JWT claim name containing the organization ID",
+              "description": "JWT claim name containing the app organization ID",
               "default": "org_id"
             },
-            "algorithm": {
+            "roleClaim": {
               "type": "string",
-              "description": "JWT signing algorithm",
-              "enum": ["HS256", "HS384", "HS512", "RS256", "RS384", "RS512"],
-              "default": "HS256"
+              "description": "JWT claim name containing the organization role. Read and exposed on the authenticated user; not stored yet.",
+              "default": "org_role"
             }
           },
-          "required": ["secret"],
+          "oneOf": [
+            { "required": ["secret"] },
+            { "required": ["jwksUri"] }
+          ],
+          "dependencies": {
+            "jwksUri": ["audience"]
+          },
+          "not": { "required": ["algorithm", "algorithms"] },
           "additionalProperties": false
         },
         "fields": {
@@ -643,56 +685,6 @@
       },
       "additionalProperties": false
     },
-    "entities": {
-      "type": "object",
-      "description": "App-level entity type registry (ADR-059). Keyed by entity type name; each key must equal its definition's moduleName / getName(). Registered types can be connected without any integration. Entity types bound by declared integrations are inferred and merged unless $infer is false.",
-      "properties": {
-        "$infer": {
-          "type": "boolean",
-          "default": true,
-          "description": "false turns inference off: every module an integration binds must then be registered here, or the app fails to load."
-        }
-      },
-      "additionalProperties": {
-        "type": "object",
-        "description": "One entity type: its module definition plus app-level settings.",
-        "required": ["definition"],
-        "properties": {
-          "definition": {
-            "type": "object",
-            "description": "The API module definition (the object an integration binds as modules.<key>.definition)."
-          },
-          "scope": {
-            "description": "Who owns entities of this type (ADR-056): one scope, or a default plus the scopes callers may choose.",
-            "oneOf": [
-              { "type": "string", "enum": ["individual", "organization", "global"] },
-              {
-                "type": "object",
-                "properties": {
-                  "default": { "type": "string", "enum": ["individual", "organization", "global"] },
-                  "allow": {
-                    "type": "array",
-                    "items": { "type": "string", "enum": ["individual", "organization", "global"] },
-                    "minItems": 1,
-                    "uniqueItems": true
-                  }
-                },
-                "additionalProperties": false
-              }
-            ]
-          },
-          "proxy": {
-            "type": "object",
-            "description": "Per-type entity proxy allow-list override (ADR-052)."
-          },
-          "display": {
-            "type": "object",
-            "description": "Label, icon and description shown by UIs and GET /api/v2/entity-types."
-          }
-        },
-        "additionalProperties": false
-      }
-    },
     "managementApi": {
       "type": "object",
       "description": "Management API settings (ADR-053 versioning, ADR-052 entity proxy).",