@friggframework/schemas 2.0.0--canary.690.08cd07e.0 → 2.0.0--canary.693.d8859c2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@friggframework/schemas",
-  "version": "2.0.0--canary.690.08cd07e.0",
+  "version": "2.0.0--canary.693.d8859c2.0",
   "description": "Canonical JSON Schema definitions for Frigg Framework",
   "main": "index.js",
   "author": "",
@@ -41,5 +41,5 @@
     "middleware/",
     "index.js"
   ],
-  "gitHead": "08cd07ef5720ad7a0d5141a442613d56d82e3730"
+  "gitHead": "d8859c23160346b2f8b15cd2caffc814dfd5bf6d"
 }

package/schemas/api-authorization.schema.json

@@ -6,13 +6,13 @@
   "definitions": {
     "authorizationRequirements": {
       "type": "object",
-      "description": "Authorization requirements response from GET /api/v2/authorize (GET /api/authorize in v1 returns the module requirements unwrapped)",
+      "description": "Authorization requirements response from GET /api/authorize",
       "required": ["type", "step", "totalSteps", "isMultiStep"],
       "properties": {
         "type": {
           "type": "string",
-          "description": "Type of authentication required: oauth2, form, api-key, basic, or a module-defined step type (e.g. email, otp)",
-          "examples": ["oauth2", "form", "api-key", "basic", "otp"]
+          "enum": ["oauth2", "form", "api-key", "basic"],
+          "description": "Type of authentication required"
         },
         "step": {
           "type": "integer",
@@ -112,13 +112,13 @@
     },
     "getEntityTypeRequirementsResponse": {
       "type": "object",
-      "description": "Authorization requirements response from GET /api/v2/entities/types/:entityType/requirements",
+      "description": "Authorization requirements response from GET /api/entities/types/:typeName/requirements",
       "required": ["type", "step", "totalSteps", "isMultiStep"],
       "properties": {
         "type": {
           "type": "string",
-          "description": "Type of authentication required: oauth2, form, api-key, basic, or a module-defined step type (e.g. email, otp)",
-          "examples": ["oauth2", "form", "api-key", "basic", "otp"]
+          "enum": ["oauth2", "form", "api-key", "basic"],
+          "description": "Type of authentication required"
         },
         "step": {
           "type": "integer",
@@ -151,7 +151,7 @@
     },
     "authorizationRequest": {
       "type": "object",
-      "description": "Authorization request to POST /api/v2/authorize (and v1 POST /api/authorize)",
+      "description": "Authorization request to POST /api/authorize",
       "required": ["entityType"],
       "properties": {
         "entityType": {
@@ -173,11 +173,6 @@
           "default": 1,
           "description": "Current step number for multi-step flows"
         },
-        "scope": {
-          "type": "string",
-          "enum": ["individual", "organization"],
-          "description": "The scope to connect at, from the entity type's allow list (ADR-056 §3.1). Omit to take the type's default. global is refused."
-        },
         "sessionId": {
           "type": "string",
           "description": "Session ID from previous step (required for step > 1)"
@@ -243,40 +238,6 @@
         }
       }
     },
-    "authorizeComplete": {
-      "type": "object",
-      "description": "POST /api/v2/authorize (or /api/v2/credentials/:credentialId/reauthorize) when the flow is complete. The credential is masked.",
-      "required": ["status", "entity", "credential"],
-      "properties": {
-        "status": { "const": "complete" },
-        "entity": { "type": "object", "description": "api-entities#/definitions/entity" },
-        "credential": { "type": "object", "description": "api-credentials#/definitions/credential, masked" },
-        "previousCredentialId": {
-          "type": "string",
-          "description": "Re-authorization only: set when the provider account changed and a new credential was stored"
-        }
-      }
-    },
-    "authorizePending": {
-      "type": "object",
-      "description": "POST /api/v2/authorize when another step is needed",
-      "required": ["status", "step", "totalSteps", "sessionId", "requirements"],
-      "properties": {
-        "status": { "const": "pending" },
-        "step": { "type": "integer", "minimum": 2 },
-        "totalSteps": { "type": "integer", "minimum": 2 },
-        "sessionId": { "type": "string" },
-        "requirements": { "$ref": "#/definitions/authorizationRequirements" },
-        "message": { "type": "string" }
-      }
-    },
-    "authorizeV2Response": {
-      "description": "Response from POST /api/v2/authorize and POST /api/v2/credentials/:credentialId/reauthorize",
-      "oneOf": [
-        { "$ref": "#/definitions/authorizeComplete" },
-        { "$ref": "#/definitions/authorizePending" }
-      ]
-    },
     "authorizationSession": {
       "type": "object",
       "description": "Authorization session stored in database",

package/schemas/api-credentials.schema.json

@@ -29,32 +29,10 @@
           "type": "boolean",
           "description": "Whether the authentication is currently valid"
         },
-        "scope": {
-          "type": "string",
-          "enum": ["individual", "organization"],
-          "description": "Whose the credential is (ADR-056 §3.4), from who owns the credential. `global` ones are not listed to tenants."
-        },
-        "owner": {
-          "type": "object",
-          "properties": {
-            "type": { "type": "string", "enum": ["individual", "organization"] },
-            "id": { "type": "string" }
-          },
-          "description": "The user that owns it: the person, or the organization's user"
-        },
-        "organizationId": {
-          "type": ["string", "null"],
-          "description": "The organization it belongs to. Null for an individual credential connected outside an organization, or under ownership.individualAcross 'all'."
-        },
-        "access": {
-          "type": "string",
-          "enum": ["manage", "use", "view"],
-          "description": "What the caller may do: manage (reauthorize, delete) or use. A member only uses an organization's credential."
-        },
         "entityCount": {
           "type": "integer",
           "minimum": 0,
-          "description": "Number of entities using this credential that the caller may see"
+          "description": "Number of entities using this credential"
         },
         "createdAt": {
           "type": "string",
@@ -70,7 +48,7 @@
     },
     "listCredentialsResponse": {
       "type": "object",
-      "description": "Response from GET /api/v2/credentials - returns list of credentials for the authenticated user",
+      "description": "Response from GET /api/credentials - returns list of credentials for the authenticated user",
       "required": ["credentials"],
       "properties": {
         "credentials": {
@@ -83,7 +61,7 @@
       }
     },
     "getCredentialResponse": {
-      "description": "Response from GET /api/v2/credentials/:credentialId - returns a single credential",
+      "description": "Response from GET /api/credentials/:id - returns a single credential",
       "allOf": [
         {
           "$ref": "#/definitions/credential"
@@ -92,7 +70,7 @@
     },
     "deleteCredentialResponse": {
       "type": "object",
-      "description": "Legacy delete result. DELETE /api/v2/credentials/:credentialId answers 204 No Content.",
+      "description": "Response from DELETE /api/credentials/:id",
       "required": ["success"],
       "properties": {
         "success": {
@@ -107,7 +85,7 @@
     },
     "reauthorizeCredentialRequest": {
       "type": "object",
-      "description": "Request to POST /api/v2/credentials/:credentialId/reauthorize - refresh or update credential authentication",
+      "description": "Request to POST /api/credentials/:id/reauthorize - refresh or update credential authentication",
       "required": ["data"],
       "properties": {
         "data": {
@@ -129,7 +107,7 @@
     },
     "reauthorizeCredentialResponse": {
       "type": "object",
-      "description": "Legacy re-authorization result. POST /api/v2/credentials/:credentialId/reauthorize answers api-authorization#/definitions/authorizeV2Response.",
+      "description": "Response from POST /api/credentials/:id/reauthorize - either success or next step",
       "oneOf": [
         {
           "$ref": "#/definitions/reauthorizeCredentialSuccess"

package/schemas/api-entities.schema.json

@@ -37,28 +37,6 @@
           "type": "boolean",
           "description": "Whether authentication is currently valid"
         },
-        "scope": {
-          "type": "string",
-          "enum": ["individual", "organization"],
-          "description": "Whose the entity is (ADR-056 §3.4). `global` ones are not listed to tenants."
-        },
-        "owner": {
-          "type": "object",
-          "properties": {
-            "type": { "type": "string", "enum": ["individual", "organization"] },
-            "id": { "type": "string" }
-          },
-          "description": "The user that owns it: the person, or the organization's user"
-        },
-        "organizationId": {
-          "type": ["string", "null"],
-          "description": "The organization it belongs to. Null for an individual entity connected outside an organization, or under ownership.individualAcross 'all'."
-        },
-        "access": {
-          "type": "string",
-          "enum": ["manage", "use", "view"],
-          "description": "What the caller may do: manage (create, reauthorize, delete), use (bind it, proxy through it) or view (metadata only)"
-        },
         "createdAt": {
           "type": "string",
           "format": "date-time",
@@ -73,7 +51,7 @@
     },
     "listEntitiesResponse": {
       "type": "object",
-      "description": "Response from GET /api/v2/entities",
+      "description": "Response from GET /api/entities",
       "required": ["entities"],
       "properties": {
         "entities": {
@@ -87,7 +65,7 @@
     },
     "createEntityRequest": {
       "type": "object",
-      "description": "Request to POST /api/entities (v1 POST /api/entity). Not served by v2: POST /api/v2/authorize creates the entity.",
+      "description": "Request to POST /api/entities",
       "required": ["entityType", "data"],
       "properties": {
         "entityType": {
@@ -110,7 +88,7 @@
     },
     "createEntityResponse": {
       "type": "object",
-      "description": "Response from POST /api/entities (v1 POST /api/entity). Not served by v2.",
+      "description": "Response from POST /api/entities",
       "required": ["entity_id", "credential_id", "type"],
       "properties": {
         "entity_id": {
@@ -144,11 +122,6 @@
           "type": "string",
           "description": "Description of the entity type"
         },
-        "usedBy": {
-          "type": "array",
-          "items": { "type": "string" },
-          "description": "Names of the integrations that bind this entity type; empty for a type registered only in appDefinition.entities"
-        },
         "authType": {
           "type": "string",
           "enum": ["oauth2", "form", "api-key", "basic"],
@@ -169,21 +142,12 @@
             "type": "string"
           },
           "description": "List of capabilities this entity type supports"
-        },
-        "scope": {
-          "type": "object",
-          "description": "The scope a new connection of this type gets and the scopes a request may choose (ADR-056 §3.1). global is never offered.",
-          "properties": {
-            "default": { "type": "string", "enum": ["individual", "organization", "global"] },
-            "allow": { "type": "array", "items": { "type": "string", "enum": ["individual", "organization"] } },
-            "source": { "type": "string", "enum": ["binding", "integration", "entityType", "app", "default"] }
-          }
         }
       }
     },
     "listEntityTypesResponse": {
       "type": "object",
-      "description": "Response from GET /api/v2/entities/types",
+      "description": "Response from GET /api/entities/types",
       "required": ["types"],
       "properties": {
         "types": {
@@ -197,7 +161,7 @@
     },
     "getEntityTypeResponse": {
       "type": "object",
-      "description": "Response from GET /api/v2/entities/types/:entityType",
+      "description": "Response from GET /api/entities/types/:typeName",
       "required": ["type", "name"],
       "properties": {
         "type": {
@@ -237,7 +201,7 @@
     },
     "reauthorizeEntityRequest": {
       "type": "object",
-      "description": "Request to re-authorize an entity. Not served in 2.0.1: use POST /api/v2/credentials/:credentialId/reauthorize.",
+      "description": "Request to POST /api/entities/:id/reauthorize",
       "required": ["data"],
       "properties": {
         "data": {
@@ -259,7 +223,7 @@
     },
     "reauthorizeEntityResponse": {
       "type": "object",
-      "description": "Entity re-authorization result. Not served in 2.0.1: POST /api/v2/credentials/:credentialId/reauthorize answers api-authorization#/definitions/authorizeV2Response.",
+      "description": "Response from POST /api/entities/:id/reauthorize (success or next step)",
       "oneOf": [
         {
           "$ref": "#/definitions/reauthorizeEntitySuccess"

package/schemas/api-module-definition.schema.json

@@ -94,53 +94,6 @@
       },
       "additionalProperties": false
     },
-    "proxy": {
-      "type": "object",
-      "description": "Opt in to the Management API entity proxy (ADR-052). Without allow, nothing can be proxied.",
-      "properties": {
-        "allow": {
-          "type": "array",
-          "description": "Operations that may be proxied. :param matches one segment; a trailing /** matches a subtree. Wildcards (method * or path /**) are ignored here and only accepted in the app definition.",
-          "items": {
-            "type": "object",
-            "required": ["method", "path"],
-            "properties": {
-              "method": { "type": "string", "enum": ["GET", "POST", "PUT", "PATCH", "DELETE"] },
-              "path": { "type": "string", "pattern": "^/" },
-              "base": {
-                "type": "string",
-                "pattern": "^[a-z][a-z0-9-]*$",
-                "description": "Which of the module's named bases (baseUrls) the rule applies to. Default 'default'. Must be declared by the module (checked at load)."
-              }
-            },
-            "additionalProperties": false
-          }
-        },
-        "headers": {
-          "type": "array",
-          "description": "Provider-specific request headers callers may send, in addition to accept, content-type, accept-language, if-match and if-none-match",
-          "items": { "type": "string" }
-        },
-        "baseUrl": {
-          "description": "Proxy base URL (https). A string, or a function of the Api instance for tenant hosts. Means { default: baseUrl }. Defaults to the Api's baseUrl. Declare this or baseUrls, not both.",
-          "type": ["string", "object"]
-        },
-        "baseUrls": {
-          "type": "object",
-          "description": "Named proxy base URLs for a module whose API spans several hosts (ADR-052, amendment 1). The proxy request names one in `base`; omitted means 'default'. Strings only, absolute https URLs with no credentials, query or fragment (checked at load). Declare this or baseUrl, not both.",
-          "minProperties": 1,
-          "propertyNames": { "pattern": "^[a-z][a-z0-9-]*$" },
-          "additionalProperties": { "type": "string", "pattern": "^https://" }
-        },
-        "binary": {
-          "type": "boolean",
-          "default": false,
-          "description": "Return binary upstream bodies base64-encoded instead of refusing them (415)"
-        }
-      },
-      "not": { "required": ["baseUrl", "baseUrls"] },
-      "additionalProperties": false
-    },
     "env": {
       "type": "object",
       "description": "Environment variable configuration",

package/schemas/api-proxy.schema.json

@@ -6,7 +6,7 @@
   "definitions": {
     "proxyRequest": {
       "type": "object",
-      "description": "Proxy request to POST /api/v2/entities/:entityId/proxy (ADR-052). Off unless the app sets managementApi.proxy.enable, and only for paths the module (or the app definition) allow-lists.",
+      "description": "Proxy request to POST /api/entities/:id/proxy or POST /api/credentials/:id/proxy",
       "required": ["method", "path"],
       "properties": {
         "method": {
@@ -16,15 +16,10 @@
         },
         "path": {
           "type": "string",
-          "description": "Path relative to the module's base URL (e.g. '/v3/contacts'). Must start with a single /. Rejected: //, backslashes, ? and # (use query), . and .. segments, encoded separators (%2f, %5c), double encoding, control and whitespace characters other than %20. The host always comes from the module.",
+          "description": "API path to call on the upstream service (e.g., '/v3/contacts' or '/api/users')",
           "pattern": "^/",
           "minLength": 1
         },
-        "base": {
-          "type": "string",
-          "pattern": "^[a-z][a-z0-9-]*$",
-          "description": "Name of one of the module's base URLs (ADR-052 amendment); 'default' when omitted. A name the module declares in proxy.baseUrls, never a URL or host. An unknown name is 400 PROXY_UNKNOWN_BASE; a value that is not shaped like a name is 400 INVALID_PROXY_REQUEST."
-        },
         "query": {
           "type": "object",
           "description": "Query parameters to include in the request as key-value pairs",
@@ -42,7 +37,7 @@
         },
         "headers": {
           "type": "object",
-          "description": "Request headers. Only accept, content-type, accept-language, if-match, if-none-match and headers the module lists in proxy.headers are forwarded; others are dropped. Authorization, Proxy-Authorization, Cookie, Host, Forwarded, X-Forwarded-*, X-Real-IP, X-API-Key and the module's own auth header are refused (400). Auth headers come only from the module.",
+          "description": "Additional headers to include in the upstream request (authorization headers are added automatically)",
           "additionalProperties": { "type": "string" }
         },
         "body": {
@@ -89,23 +84,19 @@
     },
     "proxyResponse": {
       "type": "object",
-      "description": "Upstream answer relayed by the proxy. The HTTP status of the Frigg response equals `status`; `success` is false for upstream 4xx.",
+      "description": "Successful proxy response with data from upstream API",
       "required": ["success", "status", "data"],
       "properties": {
         "success": {
           "type": "boolean",
-          "description": "True when the upstream status is below 400"
+          "const": true,
+          "description": "Indicates successful proxy operation"
         },
         "status": {
           "type": "integer",
           "minimum": 200,
-          "maximum": 499,
-          "description": "HTTP status code from the upstream API response (5xx, 401 and 429 are reported as proxy errors)"
-        },
-        "dataEncoding": {
-          "type": "string",
-          "enum": ["base64"],
-          "description": "Present when data is a base64-encoded binary body (only for modules with proxy.binary: true)"
+          "maximum": 299,
+          "description": "HTTP status code from the upstream API response"
         },
         "headers": {
           "type": "object",
@@ -180,26 +171,16 @@
               "type": "string",
               "description": "Error code identifying the type of failure",
               "enum": [
-                "INVALID_PROXY_REQUEST",
-                "PROXY_NOT_ALLOWED",
-                "PROXY_UNKNOWN_BASE",
-                "PROXY_NOT_CONFIGURED",
-                "PAYLOAD_TOO_LARGE",
-                "UNSUPPORTED_MEDIA_TYPE",
-                "RESPONSE_TOO_LARGE",
-                "INVALID_CREDENTIALS",
-                "RATE_LIMITED",
+                "INVALID_AUTH",
+                "EXPIRED_TOKEN",
                 "UPSTREAM_ERROR",
                 "TIMEOUT",
                 "NETWORK_ERROR",
-                "ENTITY_NOT_FOUND",
-                "NOT_FOUND",
-                "UNAUTHORIZED",
-                "VALIDATION_ERROR",
-                "INVALID_AUTH",
-                "EXPIRED_TOKEN",
+                "RATE_LIMITED",
                 "INVALID_REQUEST",
+                "NOT_FOUND",
                 "PERMISSION_DENIED",
+                "INVALID_CREDENTIALS",
                 "SERVICE_UNAVAILABLE"
               ]
             },

package/schemas/app-definition.schema.json

@@ -16,8 +16,8 @@
     },
     "provider": {
       "type": "string",
-      "description": "Deployment provider. Determines which @friggframework/provider-{name} package handles config generation and deploy. Built-in providers: 'aws' (default, serverless/Lambda), 'netlify' (Netlify Functions).",
-      "enum": ["aws", "netlify"],
+      "description": "Cloud provider for deployment",
+      "enum": ["aws"],
       "default": "aws"
     },
     "label": {
@@ -75,6 +75,39 @@
       },
       "default": []
     },
+    "adminScripts": {
+      "type": "array",
+      "description": "Admin script classes (extending AdminScriptBase from @friggframework/admin-scripts) served under /admin/scripts",
+      "items": {
+        "description": "Admin script class"
+      },
+      "default": []
+    },
+    "reports": {
+      "type": "array",
+      "description": "Report classes served by the admin report runner",
+      "items": {
+        "description": "Report class"
+      },
+      "default": []
+    },
+    "admin": {
+      "type": "object",
+      "description": "Admin script and report runner options",
+      "properties": {
+        "enableScheduling": {
+          "type": "boolean",
+          "description": "Provision the EventBridge Scheduler group and role so admin scripts and reports can run on a schedule",
+          "default": false
+        },
+        "includeBuiltinReports": {
+          "type": "boolean",
+          "description": "Serve the built-in reports alongside the app's own reports",
+          "default": false
+        }
+      },
+      "additionalProperties": false
+    },
     "user": {
       "type": "object",
       "description": "User management and authentication configuration",
@@ -105,28 +138,6 @@
           "description": "Require organization user for authentication",
           "default": false
         },
-        "strictMembership": {
-          "type": "boolean",
-          "description": "Reject x-frigg headers that name an organization the person is not already a member of, instead of adding the membership (ADR-056 §3.6). Turn on once entities and integrations are scoped by organization and your app manages membership itself.",
-          "default": false
-        },
-        "strictUserValidation": {
-          "type": "boolean",
-          "description": "DEPRECATED alias of strictMembership; its meaning changed.",
-          "default": false
-        },
-        "orgAdminRoles": {
-          "type": "array",
-          "description": "Organization roles that may manage organization-level things: connect or delete an organization-level account, re-authorize or delete its credential, create, change or delete an organization-owned integration (ADR-056 §3). The role is the adopter token's role claim; when the token carries none, the role stored on the caller's membership of the active organization (OrganizationMembership.orgRole); when there is none, MEMBER, never admin. A shared-secret (x-frigg header) caller needs no role, and so does a Frigg bearer token unless orgAdminGateBearerTokens is true. Compared case-insensitively.",
-          "items": { "type": "string", "minLength": 1 },
-          "minItems": 1,
-          "default": ["ADMIN"]
-        },
-        "orgAdminGateBearerTokens": {
-          "type": "boolean",
-          "description": "Judge Frigg bearer-token callers (/user/login) by organization role like adopter-token callers. Default false: a bearer token carries no role and keeps its behaviour from before organization roles, so it may manage the organization it acts in.",
-          "default": false
-        },
         "authModes": {
           "type": "object",
           "description": "Authentication mode configuration - enables multiple authentication strategies. x-frigg-appUserId and x-frigg-appOrgId headers are automatically supported for user identification with any auth mode.",
@@ -151,72 +162,30 @@
         },
         "jwtConfig": {
           "type": "object",
-          "description": "Adopter token (JWT) verification for authModes.adopterJwt. Set exactly one of jwksUri (asymmetric keys, rotating) or secret (HMAC). With jwksUri, audience is required and issuer should be set.",
+          "description": "JWT configuration for adopter JWT authentication mode (when authModes.adopterJwt is true)",
           "properties": {
-            "jwksUri": {
-              "type": "string",
-              "format": "uri",
-              "description": "URL of the issuer's JWKS (https; http only for localhost, 127.0.0.0/8 or ::1). Keys are fetched, cached and rotated per process."
-            },
             "secret": {
               "type": "string",
-              "description": "Shared HMAC secret for HS* tokens (set via an environment variable, never in source)"
-            },
-            "issuer": {
-              "type": "string",
-              "description": "Required iss claim. Not checked when omitted; with jwksUri a startup warning is logged when it is unset."
-            },
-            "audience": {
-              "description": "Accepted aud claim value(s). Required with jwksUri; optional (not checked when omitted) with secret.",
-              "oneOf": [
-                { "type": "string" },
-                { "type": "array", "items": { "type": "string" }, "minItems": 1 }
-              ]
-            },
-            "algorithms": {
-              "type": "array",
-              "description": "Allowed signing algorithms. Defaults to ES256 and RS256 with jwksUri, HS256 with secret. HS* only with secret, never with jwksUri.",
-              "items": {
-                "type": "string",
-                "enum": ["ES256", "ES384", "RS256", "RS384", "RS512", "HS256", "HS384", "HS512"]
-              },
-              "minItems": 1
-            },
-            "algorithm": {
-              "type": "string",
-              "description": "Deprecated alias for a one-item algorithms list. Setting both algorithm and algorithms is an error.",
-              "enum": ["ES256", "ES384", "RS256", "RS384", "RS512", "HS256", "HS384", "HS512"]
-            },
-            "clockToleranceSec": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Clock skew allowed on exp and nbf, in seconds",
-              "default": 30
+              "description": "JWT secret key for signature validation (should be set via environment variable)"
             },
             "userIdClaim": {
               "type": "string",
-              "description": "JWT claim name containing the app user ID",
+              "description": "JWT claim name containing the user ID",
               "default": "sub"
             },
             "orgIdClaim": {
               "type": "string",
-              "description": "JWT claim name containing the app organization ID",
+              "description": "JWT claim name containing the organization ID",
               "default": "org_id"
             },
-            "roleClaim": {
+            "algorithm": {
               "type": "string",
-              "description": "JWT claim name containing the organization role. Read and exposed on the authenticated user; not stored yet.",
-              "default": "org_role"
+              "description": "JWT signing algorithm",
+              "enum": ["HS256", "HS384", "HS512", "RS256", "RS384", "RS512"],
+              "default": "HS256"
             }
           },
-          "oneOf": [
-            { "required": ["secret"] },
-            { "required": ["jwksUri"] }
-          ],
-          "dependencies": {
-            "jwksUri": ["audience"]
-          },
-          "not": { "required": ["algorithm", "algorithms"] },
+          "required": ["secret"],
           "additionalProperties": false
         },
         "fields": {
@@ -707,204 +676,6 @@
       },
       "additionalProperties": false
     },
-    "entities": {
-      "type": "object",
-      "description": "App-level entity type registry (ADR-059). Keyed by entity type name; each key must equal its definition's moduleName / getName(). Registered types can be connected without any integration. Entity types bound by declared integrations are inferred and merged unless $infer is false.",
-      "properties": {
-        "$infer": {
-          "type": "boolean",
-          "default": true,
-          "description": "false turns inference off: every module an integration binds must then be registered here, or the app fails to load."
-        }
-      },
-      "additionalProperties": {
-        "type": "object",
-        "description": "One entity type: its module definition plus app-level settings.",
-        "required": ["definition"],
-        "properties": {
-          "definition": {
-            "type": "object",
-            "description": "The API module definition (the object an integration binds as modules.<key>.definition)."
-          },
-          "scope": {
-            "description": "Who owns entities of this type (ADR-056): one scope, or a default plus the scopes callers may choose.",
-            "oneOf": [
-              { "type": "string", "enum": ["individual", "organization", "global"] },
-              {
-                "type": "object",
-                "properties": {
-                  "default": { "type": "string", "enum": ["individual", "organization", "global"] },
-                  "allow": {
-                    "type": "array",
-                    "items": { "type": "string", "enum": ["individual", "organization", "global"] },
-                    "minItems": 1,
-                    "uniqueItems": true
-                  }
-                },
-                "additionalProperties": false
-              }
-            ]
-          },
-          "proxy": {
-            "type": "object",
-            "description": "Per-type entity proxy allow-list override (ADR-052)."
-          },
-          "display": {
-            "type": "object",
-            "description": "Label, icon and description shown by UIs and GET /api/v2/entity-types."
-          }
-        },
-        "additionalProperties": false
-      }
-    },
-    "ownership": {
-      "type": "object",
-      "description": "Who owns what a person connects (ADR-056 §3). `scope` is the app-level default for any entity type or integration binding that sets none; the order is request, binding, integration, entity type, app, then `organization` for an organization-primary app and `individual` otherwise.",
-      "properties": {
-        "scope": {
-        "description": "One scope, or a default plus the scopes a request may choose from.",
-        "oneOf": [
-          { "type": "string", "enum": ["individual", "organization", "global"] },
-          {
-            "type": "object",
-            "properties": {
-              "default": { "type": "string", "enum": ["individual", "organization", "global"] },
-              "allow": {
-                "type": "array",
-                "items": { "type": "string", "enum": ["individual", "organization", "global"] },
-                "minItems": 1,
-                "uniqueItems": true
-              }
-            },
-            "additionalProperties": false
-          }
-        ]
-      },
-        "individualAcross": {
-          "type": "string",
-          "enum": ["organization", "all"],
-          "default": "organization",
-          "description": "`organization` (default): an individual entity belongs to the organization it was connected in and is not visible in another. `all`: one connection per person across every organization they belong to, stored with no organizationId."
-        }
-      },
-      "additionalProperties": false
-    },
-    "managementApi": {
-      "type": "object",
-      "description": "Management API settings (ADR-053 versioning, ADR-052 entity proxy).",
-      "properties": {
-        "v1": {
-          "type": "boolean",
-          "default": true,
-          "description": "Serve the deprecated v1 routes (unprefixed /api/*). false removes them from the router and from the generated API Gateway routes."
-        },
-        "proxy": {
-          "type": "object",
-          "description": "Entity proxy, POST /api/v2/entities/:id/proxy (ADR-052). Off by default.",
-          "properties": {
-            "enable": {
-              "type": "boolean",
-              "default": false,
-              "description": "Mount the entity proxy route and advertise the entityProxy capability."
-            },
-            "timeoutMs": {
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 25000,
-              "default": 25000,
-              "description": "Upstream timeout for one proxied call, in milliseconds (can only be lowered)."
-            },
-            "maxRequestBytes": {
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 10485760,
-              "default": 1048576,
-              "description": "Largest proxied request body, in bytes."
-            },
-            "maxResponseBytes": {
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 5242880,
-              "default": 5242880,
-              "description": "Largest proxied response body, in bytes (can only be lowered)."
-            },
-            "scopes": {
-              "type": "array",
-              "minItems": 1,
-              "uniqueItems": true,
-              "items": {
-                "type": "string",
-                "enum": [
-                  "individual",
-                  "organization"
-                ]
-              },
-              "default": [
-                "individual"
-              ],
-              "description": "Entity scopes the proxy accepts (ADR-056 §3.5). Narrowest by default: proxying through an organization entity lets any member with use access act on the organization's account, so an app opts in to 'organization' explicitly. 'global' is never accepted."
-            },
-            "modules": {
-              "type": "object",
-              "description": "Per-module allow-list override, keyed by module name. 'module' uses the module's own proxy.allow list.",
-              "additionalProperties": {
-                "type": "object",
-                "properties": {
-                  "allow": {
-                    "oneOf": [
-                      {
-                        "type": "string",
-                        "enum": [
-                          "module"
-                        ]
-                      },
-                      {
-                        "type": "array",
-                        "items": {
-                          "type": "object",
-                          "required": [
-                            "method",
-                            "path"
-                          ],
-                          "properties": {
-                            "method": {
-                              "type": "string",
-                              "enum": [
-                                "GET",
-                                "POST",
-                                "PUT",
-                                "PATCH",
-                                "DELETE",
-                                "*"
-                              ],
-                              "description": "HTTP method, or * for any (app definition only; frigg validate warns)"
-                            },
-                            "path": {
-                              "type": "string",
-                              "pattern": "^/",
-                              "description": "Path pattern relative to the module's base URL. `:param` matches one segment; a trailing `/**` matches a subtree."
-                            },
-                            "base": {
-                              "type": "string",
-                              "pattern": "^[a-z][a-z0-9-]*$",
-                              "description": "Which of the module's named bases the rule applies to. Default 'default'. A base the module does not declare stops the app at load."
-                            }
-                          },
-                          "additionalProperties": false
-                        }
-                      }
-                    ]
-                  }
-                },
-                "additionalProperties": false
-              }
-            }
-          },
-          "additionalProperties": false
-        }
-      },
-      "additionalProperties": false
-    },
     "custom": {
       "type": "object",
       "description": "Custom application-specific configuration",
@@ -938,74 +709,6 @@
         }
       },
       "additionalProperties": true
-    },
-    "extensions": {
-      "type": "object",
-      "description": "ADR-017 Core Extensions: a keyed object { <binding>: { extension, config } }. Reserved for that design; the core extension loader does not read it. The array of { name, schema, encryption, routes, bootstrap } lives at coreExtensions, and an array here is rejected.",
-      "additionalProperties": {
-        "type": "object",
-        "properties": {
-          "extension": {},
-          "config": { "type": "object" }
-        },
-        "required": ["extension"]
-      }
-    },
-    "coreExtensions": {
-      "type": "array",
-      "description": "Core extensions that add custom Prisma models, encrypted fields, admin routes, and bootstrap lifecycle hooks to a Frigg app. Each extension can declare a schema fragment, encryption config, route handler, and bootstrap function. App-level; distinct from an integration's Definition.extensions (Tier 3 integration extensions) and from ADR-017's keyed appDefinition.extensions.",
-      "items": {
-        "type": "object",
-        "required": ["name"],
-        "properties": {
-          "name": {
-            "type": "string",
-            "description": "Unique identifier for this extension",
-            "minLength": 1,
-            "examples": ["db-credentials", "audit-log"]
-          },
-          "schema": {
-            "type": "string",
-            "description": "Absolute path to a .prisma schema fragment. Models/enums from this file are composed into the main Prisma schema at build time.",
-            "pattern": "\\.prisma$"
-          },
-          "encryption": {
-            "type": "object",
-            "description": "Encryption schema additions. Maps model names to arrays of field paths that should be encrypted at rest.",
-            "patternProperties": {
-              "^[A-Z][a-zA-Z0-9]*$": {
-                "type": "object",
-                "required": ["fields"],
-                "properties": {
-                  "fields": {
-                    "type": "array",
-                    "items": { "type": "string" },
-                    "minItems": 1
-                  }
-                },
-                "additionalProperties": false
-              }
-            },
-            "additionalProperties": false
-          },
-          "routes": {
-            "type": "object",
-            "description": "Express router to mount on the app. The handler factory receives (prisma, appDefinition) and returns an Express Router. Routes are protected by admin auth middleware.",
-            "required": ["path"],
-            "properties": {
-              "path": {
-                "type": "string",
-                "description": "Base URL path for the extension routes. Admin routes live under /admin (never /api): /admin/<segment>[/<segment>...]. /admin/scripts, /admin/db-migrate and /admin/queue are reserved. Core's route registry turns the path into the API Gateway routes and netlify.toml redirects (auth function).",
-                "pattern": "^/admin(/[A-Za-z0-9_-]+)+$",
-                "not": { "pattern": "^/admin/(scripts|db-migrate|queue)(/|$)" },
-                "examples": ["/admin/oauth-credentials"]
-              }
-            },
-            "additionalProperties": true
-          }
-        },
-        "additionalProperties": true
-      }
     }
   },
   "additionalProperties": false,

package/schemas/integration-definition.schema.json

@@ -263,62 +263,11 @@
           "definition": {
             "type": "object",
             "description": "The API module definition (e.g., from @friggframework/api-module-*)"
-          },
-          "scope": {
-            "description": "The scope this binding accepts (ADR-056 §3.1): an entity bound here must have it. Overrides ownership.scope.",
-            "oneOf": [
-              { "type": "string", "enum": ["individual", "organization", "global"] },
-              {
-                "type": "object",
-                "properties": {
-                  "default": { "type": "string", "enum": ["individual", "organization", "global"] },
-                  "allow": {
-                    "type": "array",
-                    "items": { "type": "string", "enum": ["individual", "organization", "global"] },
-                    "minItems": 1,
-                    "uniqueItems": true
-                  }
-                },
-                "additionalProperties": false
-              }
-            ]
           }
         },
         "additionalProperties": true
       }
     },
-    "ownership": {
-      "type": "object",
-      "description": "Who owns this integration and what scope its bindings accept (ADR-056 §3.1, §3.3).",
-      "properties": {
-        "scope": {
-          "description": "One scope, or a default plus the scopes a request may choose from.",
-          "oneOf": [
-            { "type": "string", "enum": ["individual", "organization", "global"] },
-            {
-              "type": "object",
-              "properties": {
-                "default": { "type": "string", "enum": ["individual", "organization", "global"] },
-                "allow": {
-                  "type": "array",
-                  "items": { "type": "string", "enum": ["individual", "organization", "global"] },
-                  "minItems": 1,
-                  "uniqueItems": true
-                }
-              },
-              "additionalProperties": false
-            }
-          ]
-        },
-        "owner": {
-          "type": "string",
-          "enum": ["derive", "individual", "organization"],
-          "default": "derive",
-          "description": "`derive` (default): the organization when every entity it uses is organization-scoped, otherwise the person. An organization-owned integration cannot bind an individual entity."
-        }
-      },
-      "additionalProperties": false
-    },
     "hasUserConfig": {
       "type": "boolean",
       "description": "Whether integration requires user-specific configuration",
@@ -336,22 +285,6 @@
       },
       "additionalProperties": true
     },
-    "schedule": {
-      "type": "object",
-      "description": "How a host that ticks ONGOING_SYNC from a cron (provider-netlify's scheduled-sync) dispatches it for this integration. Applies to integrations that implement startOngoingSync.",
-      "properties": {
-        "scope": {
-          "type": "string",
-          "enum": ["class", "installation"],
-          "default": "class",
-          "description": "'class': one ONGOING_SYNC per integration class per tick, with no integration id (the handler finds its own installations). 'installation': one per ENABLED integration record, carrying data.integrationId so the worker hydrates that installation."
-        },
-        "isDue": {
-          "description": "Optional function (integration, { now }) => boolean | Promise<boolean>, scope 'installation' only. Return true to dispatch that installation this tick; without it every installation is dispatched on every tick."
-        }
-      },
-      "additionalProperties": false
-    },
     "display": {
       "type": "object",
       "description": "Display properties for UI representation",