@friggframework/core 2.0.0--canary.550.b8b9a2b.0 → 2.0.0--canary.545.e256e95.0

package/database/documentdb-utils.js

@@ -3,8 +3,10 @@ const { ObjectId } = require('bson');
 function toObjectId(value) {
     if (value === null || value === undefined || value === '') return undefined;
     if (value instanceof ObjectId) return value;
-    if (typeof value === 'object' && value.$oid) return new ObjectId(value.$oid);
-    if (typeof value === 'string') return ObjectId.isValid(value) ? new ObjectId(value) : undefined;
+    if (typeof value === 'object' && value.$oid)
+        return new ObjectId(value.$oid);
+    if (typeof value === 'string')
+        return ObjectId.isValid(value) ? new ObjectId(value) : undefined;
     return undefined;
 }
 
@@ -15,7 +17,8 @@ function toObjectIdArray(values) {
 
 function fromObjectId(value) {
     if (value instanceof ObjectId) return value.toHexString();
-    if (typeof value === 'object' && value !== null && value.$oid) return value.$oid;
+    if (typeof value === 'object' && value !== null && value.$oid)
+        return value.$oid;
     if (typeof value === 'string') return value;
     return value === undefined || value === null ? value : String(value);
 }
@@ -30,7 +33,10 @@ async function findMany(client, collection, filter = {}, options = {}) {
 }
 
 async function findOne(client, collection, filter = {}, options = {}) {
-    const docs = await findMany(client, collection, filter, { ...options, limit: 1 });
+    const docs = await findMany(client, collection, filter, {
+        ...options,
+        limit: 1,
+    });
     return docs[0] || null;
 }
 
@@ -47,7 +53,9 @@ async function insertOne(client, collection, document) {
     // Validate insert succeeded
     if (result.ok !== 1) {
         throw new Error(
-            `Insert command failed for collection '${collection}': ${JSON.stringify(result)}`
+            `Insert command failed for collection '${collection}': ${JSON.stringify(
+                result
+            )}`
         );
     }
 
@@ -67,7 +75,7 @@ async function insertOne(client, collection, document) {
     if (result.n !== 1) {
         throw new Error(
             `Expected to insert 1 document into '${collection}', but inserted ${result.n}. ` +
-            `Result: ${JSON.stringify(result)}`
+                `Result: ${JSON.stringify(result)}`
         );
     }
 
@@ -75,11 +83,13 @@ async function insertOne(client, collection, document) {
 }
 
 async function updateOne(client, collection, filter, update, options = {}) {
-    const updates = [{
-        q: filter,
-        u: update,
-        upsert: Boolean(options.upsert),
-    }];
+    const updates = [
+        {
+            q: filter,
+            u: update,
+            upsert: Boolean(options.upsert),
+        },
+    ];
     if (options.arrayFilters) updates[0].arrayFilters = options.arrayFilters;
     const result = await client.$runCommandRaw({
         update: collection,
@@ -133,4 +143,3 @@ module.exports = {
     deleteMany,
     aggregate,
 };
-

package/database/encryption/README.md

@@ -125,10 +125,11 @@ Or simply don't configure any encryption keys. In Production field level encrypt
 Core and custom encrypted fields are defined in `encryption-schema-registry.js`. See that file for the current list of encrypted fields.
 
 **Core fields include**:
-- OAuth tokens: `access_token`, `refresh_token`, `id_token`
-- API keys: `api_key`, `apiKey`, `API_KEY_VALUE`
-- Basic auth: `password`
-- OAuth client credentials: `client_secret`
+
+-   OAuth tokens: `access_token`, `refresh_token`, `id_token`
+-   API keys: `api_key`, `apiKey`, `API_KEY_VALUE`
+-   Basic auth: `password`
+-   OAuth client credentials: `client_secret`
 
 **Note**: API modules should use `api_key` (snake_case) in their `apiPropertiesToPersist.credential` arrays for consistency with OAuth2Requester and BasicAuthRequester conventions.
 
@@ -137,34 +138,36 @@ Core and custom encrypted fields are defined in `encryption-schema-registry.js`.
 When creating API module definitions, use **snake_case** for credential property names to ensure automatic encryption:
 
 **✅ Recommended (automatically encrypted):**
+
 ```javascript
 // API Module Definition
 const Definition = {
     requiredAuthMethods: {
         apiPropertiesToPersist: {
             // For API key authentication
-            credential: ['api_key'],           // ✅ Automatically encrypted
+            credential: ['api_key'], // ✅ Automatically encrypted
             // or for OAuth authentication
-            credential: ['access_token', 'refresh_token'],  // ✅ OAuth - encrypted
+            credential: ['access_token', 'refresh_token'], // ✅ OAuth - encrypted
             // or for Basic authentication
-            credential: ['username', 'password'],           // ✅ Basic auth - encrypted
-        }
-    }
+            credential: ['username', 'password'], // ✅ Basic auth - encrypted
+        },
+    },
 };
 
 // API class (extends ApiKeyRequester)
 class MyApi extends ApiKeyRequester {
     constructor(params) {
         super(params);
-        this.api_key = params.api_key;  // ✅ snake_case convention
+        this.api_key = params.api_key; // ✅ snake_case convention
     }
 }
 ```
 
 **❌ Avoid (requires manual encryption schema):**
+
 ```javascript
 apiPropertiesToPersist: {
-    credential: ['customToken', 'proprietaryKey']  // ❌ Not in core schema
+    credential: ['customToken', 'proprietaryKey']; // ❌ Not in core schema
 }
 ```
 
@@ -184,57 +187,61 @@ const Definition = {
 
     // Declare which credential fields need encryption
     encryption: {
-        credentialFields: ['api_key', 'webhook_secret']
+        credentialFields: ['api_key', 'webhook_secret'],
     },
 
     requiredAuthMethods: {
         apiPropertiesToPersist: {
-            credential: ['api_key', 'webhook_secret'],  // These will be auto-encrypted
-            entity: []
+            credential: ['api_key', 'webhook_secret'], // These will be auto-encrypted
+            entity: [],
         },
         // ... other methods
-    }
+    },
 };
 ```
 
 **How it works**:
+
 1. Module declares `encryption.credentialFields` array
 2. Framework automatically adds `data.` prefix: `['api_key']` → `['data.api_key']`
 3. Fields are merged with core encryption schema on app startup
 4. All modules across all integrations are scanned and combined
 
 **Benefits**:
-- ✅ Module authors control their own security requirements
-- ✅ No need to modify core framework or app configuration
-- ✅ Automatic encryption for API key-based integrations
-- ✅ Works seamlessly with `apiPropertiesToPersist`
+
+-   ✅ Module authors control their own security requirements
+-   ✅ No need to modify core framework or app configuration
+-   ✅ Automatic encryption for API key-based integrations
+-   ✅ Works seamlessly with `apiPropertiesToPersist`
 
 **Example - API Key Module**:
+
 ```javascript
 // API Module Definition
 const Definition = {
     moduleName: 'axiscare',
     API: AxisCareApi,
     encryption: {
-        credentialFields: ['api_key']  // Auto-encrypted as 'data.api_key'
+        credentialFields: ['api_key'], // Auto-encrypted as 'data.api_key'
     },
     requiredAuthMethods: {
         apiPropertiesToPersist: {
-            credential: ['api_key']  // Will be encrypted automatically
-        }
-    }
+            credential: ['api_key'], // Will be encrypted automatically
+        },
+    },
 };
 
 // API Class (extends ApiKeyRequester)
 class AxisCareApi extends ApiKeyRequester {
     constructor(params) {
         super(params);
-        this.api_key = params.api_key;  // snake_case convention
+        this.api_key = params.api_key; // snake_case convention
     }
 }
 ```
 
 **Example - Custom Authentication**:
+
 ```javascript
 const Definition = {
     moduleName: 'customService',
@@ -242,16 +249,17 @@ const Definition = {
         credentialFields: [
             'signing_key',
             'webhook_secret',
-            'data.custom_nested_field'  // Can specify data. prefix explicitly
-        ]
-    }
+            'data.custom_nested_field', // Can specify data. prefix explicitly
+        ],
+    },
 };
 ```
 
 **Limitations**:
-- Only supports Credential model fields (stored in `credential.data`)
-- Cannot encrypt entity fields or custom models (use app-level schema for those)
-- Applied globally once - module schemas loaded at app startup
+
+-   Only supports Credential model fields (stored in `credential.data`)
+-   Cannot encrypt entity fields or custom models (use app-level schema for those)
+-   Applied globally once - module schemas loaded at app startup
 
 #### Option 2: App-Level Custom Schema (Integration Developers)
 
@@ -529,7 +537,9 @@ For DocumentDB repositories, use `DocumentDBEncryptionService` to manually encry
 #### Usage Example
 
 ```javascript
-const { DocumentDBEncryptionService } = require('../documentdb-encryption-service');
+const {
+    DocumentDBEncryptionService,
+} = require('../documentdb-encryption-service');
 const { insertOne, findOne } = require('../documentdb-utils');
 
 class MyRepositoryDocumentDB {
@@ -539,12 +549,18 @@ class MyRepositoryDocumentDB {
 
     async create(data) {
         // Encrypt before write
-        const encrypted = await this.encryptionService.encryptFields('ModelName', data);
+        const encrypted = await this.encryptionService.encryptFields(
+            'ModelName',
+            data
+        );
         const id = await insertOne(this.prisma, 'CollectionName', encrypted);
 
         // Decrypt after read
         const doc = await findOne(this.prisma, 'CollectionName', { _id: id });
-        const decrypted = await this.encryptionService.decryptFields('ModelName', doc);
+        const decrypted = await this.encryptionService.decryptFields(
+            'ModelName',
+            doc
+        );
 
         return decrypted;
     }
@@ -554,9 +570,10 @@ class MyRepositoryDocumentDB {
 #### Configuration
 
 Uses the same environment variables and Cryptor as the Prisma Extension:
-- `STAGE`: Bypasses encryption for dev/test/local
-- `KMS_KEY_ARN`: AWS KMS encryption (production)
-- `AES_KEY_ID` + `AES_KEY`: AES encryption (fallback)
+
+-   `STAGE`: Bypasses encryption for dev/test/local
+-   `KMS_KEY_ARN`: AWS KMS encryption (production)
+-   `AES_KEY_ID` + `AES_KEY`: AES encryption (fallback)
 
 ## Usage Examples
 

package/database/encryption/encryption-schema-registry.js

@@ -72,7 +72,9 @@ function validateCustomSchema(schema) {
 
         for (const fieldPath of config.fields) {
             if (typeof fieldPath !== 'string' || !fieldPath) {
-                errors.push(`Model "${modelName}" has invalid field path: ${fieldPath}`);
+                errors.push(
+                    `Model "${modelName}" has invalid field path: ${fieldPath}`
+                );
             }
 
             // Check if trying to override core fields
@@ -104,13 +106,17 @@ function registerCustomSchema(schema) {
     const validation = validateCustomSchema(schema);
     if (!validation.valid) {
         throw new Error(
-            `Invalid custom encryption schema:\n- ${validation.errors.join('\n- ')}`
+            `Invalid custom encryption schema:\n- ${validation.errors.join(
+                '\n- '
+            )}`
         );
     }
 
     customSchema = { ...schema };
     logger.info(
-        `Registered custom encryption schema for models: ${Object.keys(customSchema).join(', ')}`
+        `Registered custom encryption schema for models: ${Object.keys(
+            customSchema
+        ).join(', ')}`
     );
 }
 
@@ -133,7 +139,9 @@ function extractCredentialFieldsFromModules(moduleDefinitions) {
         }
 
         for (const field of credentialFields) {
-            const prefixedField = field.startsWith('data.') ? field : `data.${field}`;
+            const prefixedField = field.startsWith('data.')
+                ? field
+                : `data.${field}`;
             fields.push(prefixedField);
         }
     }
@@ -160,10 +168,14 @@ function loadModuleEncryptionSchemas(integrations) {
         return;
     }
 
-    const { getModulesDefinitionFromIntegrationClasses } = require('../integrations/utils/map-integration-dto');
+    const {
+        getModulesDefinitionFromIntegrationClasses,
+    } = require('../../integrations/utils/map-integration-dto');
 
-    const moduleDefinitions = getModulesDefinitionFromIntegrationClasses(integrations);
-    const credentialFields = extractCredentialFieldsFromModules(moduleDefinitions);
+    const moduleDefinitions =
+        getModulesDefinitionFromIntegrationClasses(integrations);
+    const credentialFields =
+        extractCredentialFieldsFromModules(moduleDefinitions);
 
     if (credentialFields.length === 0) {
         return;
@@ -171,8 +183,8 @@ function loadModuleEncryptionSchemas(integrations) {
 
     const moduleSchema = {
         Credential: {
-            fields: credentialFields
-        }
+            fields: credentialFields,
+        },
     };
 
     logger.info(
@@ -191,22 +203,48 @@ function loadModuleEncryptionSchemas(integrations) {
  *
  * Used by both Prisma (MongoDB/PostgreSQL) and DocumentDB encryption services.
  */
-function loadCustomEncryptionSchema() {
-    try {
-        // Lazy require to avoid circular dependency issues
-        const path = require('node:path');
-        const { findNearestBackendPackageJson } = require('../../utils');
+/**
+ * Registers encryption schemas from extensions.
+ * Each extension can declare encrypted fields for its custom models.
+ *
+ * @param {Array<Object>} extensions - Normalized extensions array
+ */
+function loadExtensionEncryptionSchemas(extensions) {
+    if (!extensions || !Array.isArray(extensions) || extensions.length === 0) {
+        return;
+    }
+
+    for (const ext of extensions) {
+        if (!ext.encryption || typeof ext.encryption !== 'object') {
+            continue;
+        }
 
-        const backendPackagePath = findNearestBackendPackageJson();
-        if (!backendPackagePath) {
-            return; // No backend found, skip custom schema
+        const schema = {};
+        for (const [modelName, config] of Object.entries(ext.encryption)) {
+            if (config && Array.isArray(config.fields) && config.fields.length > 0) {
+                schema[modelName] = { fields: config.fields };
+            }
         }
 
-        const backendDir = path.dirname(backendPackagePath);
-        const backendIndexPath = path.join(backendDir, 'index.js');
+        if (Object.keys(schema).length > 0) {
+            logger.info(
+                `Registering encryption schema from extension "${ext.name}" for models: ${Object.keys(schema).join(', ')}`
+            );
+            registerCustomSchema(schema);
+        }
+    }
+}
 
-        const backendModule = require(backendIndexPath);
-        const appDefinition = backendModule?.Definition;
+function loadCustomEncryptionSchema() {
+    try {
+        // Uses loadAppDefinition() which respects setAppDefinition() cache.
+        // This is critical for platforms like Netlify where process.cwd()-based
+        // discovery fails at runtime (process.cwd() is /var/task, not the project root).
+        const {
+            loadAppDefinition,
+        } = require('../../handlers/app-definition-loader');
+
+        const { appDefinition } = loadAppDefinition();
 
         if (!appDefinition) {
             return; // No app definition found
@@ -223,6 +261,13 @@ function loadCustomEncryptionSchema() {
         if (integrations && Array.isArray(integrations)) {
             loadModuleEncryptionSchemas(integrations);
         }
+
+        // Load extension-level encryption schemas
+        const { loadExtensions } = require('../../extensions/extension-loader');
+        const extensions = loadExtensions(appDefinition);
+        if (extensions.length > 0) {
+            loadExtensionEncryptionSchemas(extensions);
+        }
     } catch (error) {
         // Silently ignore errors - custom schema is optional
         // This handles cases like:
@@ -262,6 +307,7 @@ module.exports = {
     registerCustomSchema,
     loadCustomEncryptionSchema,
     loadModuleEncryptionSchemas,
+    loadExtensionEncryptionSchemas,
     extractCredentialFieldsFromModules,
     validateCustomSchema,
     resetCustomSchema,

package/database/encryption/field-encryption-service.js

@@ -35,7 +35,9 @@ class FieldEncryptionService {
 
             if (this._shouldEncrypt(value)) {
                 const serializedValue = this._serializeForEncryption(value);
-                const encryptedValue = await this.cryptor.encrypt(serializedValue);
+                const encryptedValue = await this.cryptor.encrypt(
+                    serializedValue
+                );
                 return { fieldPath, encryptedValue };
             }
             return null;
@@ -46,7 +48,11 @@ class FieldEncryptionService {
         // Apply encrypted values
         for (const result of results) {
             if (result) {
-                this._setNestedValue(encrypted, result.fieldPath, result.encryptedValue);
+                this._setNestedValue(
+                    encrypted,
+                    result.fieldPath,
+                    result.encryptedValue
+                );
             }
         }
 
@@ -71,7 +77,8 @@ class FieldEncryptionService {
 
             if (this._isEncrypted(value)) {
                 const decryptedValue = await this.cryptor.decrypt(value);
-                const deserializedValue = this._deserializeAfterDecryption(decryptedValue);
+                const deserializedValue =
+                    this._deserializeAfterDecryption(decryptedValue);
                 return { fieldPath, decryptedValue: deserializedValue };
             }
             return null;
@@ -82,7 +89,11 @@ class FieldEncryptionService {
         // Apply decrypted values
         for (const result of results) {
             if (result) {
-                this._setNestedValue(decrypted, result.fieldPath, result.decryptedValue);
+                this._setNestedValue(
+                    decrypted,
+                    result.fieldPath,
+                    result.decryptedValue
+                );
             }
         }
 

package/database/encryption/logger.js

@@ -30,8 +30,9 @@ class EncryptionLogger {
         // Remove potential key material or encrypted data from logs
         if (typeof message === 'string') {
             // Truncate long base64 strings that might be keys or encrypted data
-            return message.replace(/([A-Za-z0-9+/=]{50,})/g, (match) =>
-                `${match.substring(0, 10)}...[${match.length} chars]`
+            return message.replace(
+                /([A-Za-z0-9+/=]{50,})/g,
+                (match) => `${match.substring(0, 10)}...[${match.length} chars]`
             );
         }
         return message;

package/database/encryption/prisma-encryption-extension.js

@@ -12,9 +12,7 @@ function createEncryptionExtension({ cryptor, enabled = true }) {
     }
 
     if (!cryptor) {
-        throw new Error(
-            'Cryptor instance required for encryption extension'
-        );
+        throw new Error('Cryptor instance required for encryption extension');
     }
 
     const encryptionService = new FieldEncryptionService({
@@ -48,11 +46,10 @@ function createEncryptionExtension({ cryptor, enabled = true }) {
 
                 async createMany({ model, args, query }) {
                     if (args.data && Array.isArray(args.data)) {
-                        args.data =
-                            await encryptionService.encryptFieldsInBulk(
-                                model,
-                                args.data
-                            );
+                        args.data = await encryptionService.encryptFieldsInBulk(
+                            model,
+                            args.data
+                        );
                     } else if (args.data) {
                         args.data = await encryptionService.encryptFields(
                             model,

package/database/prisma.js

@@ -1,16 +1,19 @@
 const {
     createEncryptionExtension,
 } = require('./encryption/prisma-encryption-extension');
-const { loadCustomEncryptionSchema } = require('./encryption/encryption-schema-registry');
+const {
+    loadCustomEncryptionSchema,
+} = require('./encryption/encryption-schema-registry');
 const { logger } = require('./encryption/logger');
 const { Cryptor } = require('../encrypt/Cryptor');
+const path = require('path');
 const config = require('./config');
 
 /**
  * Ensures DATABASE_URL is set for MongoDB connections
  * Falls back to MONGO_URI if DATABASE_URL is not set
  * Infrastructure layer concern - maps legacy MONGO_URI to Prisma's expected DATABASE_URL
- * 
+ *
  * Note: This should only be called when DB_TYPE is 'mongodb' or 'documentdb'
  */
 function ensureMongoDbUrl() {
@@ -22,7 +25,9 @@ function ensureMongoDbUrl() {
     // Fallback to MONGO_URI for backwards compatibility with DocumentDB deployments
     if (process.env.MONGO_URI && process.env.MONGO_URI.trim()) {
         process.env.DATABASE_URL = process.env.MONGO_URI;
-        logger.debug('Using MONGO_URI as DATABASE_URL for Mongo-compatible connection');
+        logger.debug(
+            'Using MONGO_URI as DATABASE_URL for Mongo-compatible connection'
+        );
         return;
     }
 
@@ -48,7 +53,7 @@ function getEncryptionConfig() {
     if (!hasKMS && !hasAES) {
         logger.warn(
             'No encryption keys configured (KMS_KEY_ARN or AES_KEY_ID). ' +
-            'Field-level encryption disabled. Set STAGE=production and configure keys to enable.'
+                'Field-level encryption disabled. Set STAGE=production and configure keys to enable.'
         );
         return { enabled: false };
     }
@@ -67,20 +72,24 @@ const prismaClientSingleton = () => {
         const paths = [
             // Lambda layer location (when using Prisma Lambda layer)
             `/opt/nodejs/node_modules/generated/prisma-${dbType}`,
+            // __dirname-based resolution (works on Netlify + any bundler)
+            path.resolve(__dirname, `../generated/prisma-${dbType}`),
             // Local development location (relative to core package)
             `../generated/prisma-${dbType}`,
         ];
 
-        for (const path of paths) {
+        for (const tryPath of paths) {
             try {
-                return require(path).PrismaClient;
+                return require(tryPath).PrismaClient;
             } catch (err) {
                 // Continue to next path
             }
         }
 
         throw new Error(
-            `Cannot find Prisma client for ${dbType}. Tried paths: ${paths.join(', ')}`
+            `Cannot find Prisma client for ${dbType}. Tried paths: ${paths.join(
+                ', '
+            )}`
         );
     };
 
@@ -125,10 +134,7 @@ const prismaClientSingleton = () => {
                 `Field-level encryption enabled using ${encryptionConfig.method.toUpperCase()}`
             );
         } catch (error) {
-            logger.error(
-                'Failed to initialize encryption extension:',
-                error
-            );
+            logger.error('Failed to initialize encryption extension:', error);
             logger.warn('Continuing without encryption...');
         }
     } else {
@@ -149,11 +155,14 @@ function getPrismaClient() {
 }
 
 // Export a getter for lazy initialization
-const prisma = new Proxy({}, {
-    get(target, prop) {
-        return getPrismaClient()[prop];
+const prisma = new Proxy(
+    {},
+    {
+        get(target, prop) {
+            return getPrismaClient()[prop];
+        },
     }
-});
+);
 
 async function disconnectPrisma() {
     await getPrismaClient().$disconnect();
@@ -166,7 +175,9 @@ async function connectPrisma() {
     // Only run for MongoDB/DocumentDB (not PostgreSQL)
     // This prevents "Cannot create namespace in multi-document transaction" errors
     if (config.DB_TYPE === 'mongodb' || config.DB_TYPE === 'documentdb') {
-        const { initializeMongoDBSchema } = require('./utils/mongodb-schema-init');
+        const {
+            initializeMongoDBSchema,
+        } = require('./utils/mongodb-schema-init');
         await initializeMongoDBSchema();
     }
 

package/database/repositories/health-check-repository-factory.js

@@ -1,6 +1,6 @@
-const { HealthCheckRepositoryMongoDB } = require('./health-check-repository-mongodb');
-const { HealthCheckRepositoryPostgreSQL } = require('./health-check-repository-postgres');
-const { HealthCheckRepositoryDocumentDB } = require('./health-check-repository-documentdb');
+const {
+    HealthCheckRepositoryPostgreSQL,
+} = require('./health-check-repository-postgres');
 const config = require('../config');
 
 /**
@@ -25,12 +25,14 @@ function createHealthCheckRepository({ prismaClient } = {}) {
 
     switch (dbType) {
         case 'mongodb':
+            const { HealthCheckRepositoryMongoDB } = require('./health-check-repository-mongodb');
             return new HealthCheckRepositoryMongoDB({ prismaClient });
 
         case 'postgresql':
             return new HealthCheckRepositoryPostgreSQL({ prismaClient });
 
         case 'documentdb':
+            const { HealthCheckRepositoryDocumentDB } = require('./health-check-repository-documentdb');
             return new HealthCheckRepositoryDocumentDB({ prismaClient });
 
         default:
@@ -42,7 +44,7 @@ function createHealthCheckRepository({ prismaClient } = {}) {
 
 module.exports = {
     createHealthCheckRepository,
-    HealthCheckRepositoryMongoDB,
+    get HealthCheckRepositoryMongoDB() { return require('./health-check-repository-mongodb').HealthCheckRepositoryMongoDB; },
     HealthCheckRepositoryPostgreSQL,
-    HealthCheckRepositoryDocumentDB,
+    get HealthCheckRepositoryDocumentDB() { return require('./health-check-repository-documentdb').HealthCheckRepositoryDocumentDB; },
 };