@friggframework/core 2.0.0--canary.651.bc0e60a.0 → 2.0.0--canary.652.60de836.0

package/CLAUDE.md

@@ -211,31 +211,7 @@ packages/core/
 - `integration-repository-factory.js` - Creates database-specific repositories
 - `integration-repository-mongo.js` - MongoDB implementation
 - `integration-repository-postgres.js` - PostgreSQL implementation
-- `integration-mapping-repository-*.js` - Mapping data persistence.
-  `queryMappings(integrationId, { where, orderBy, skip, take, omit })`
-  returns `{ mappings, total }`: one filtered, ordered page of an
-  integration's mappings, for callers that cannot load every row through
-  `findMappingsByIntegration`. `where` is an array of ANDed conditions
-  (at most 20); an entry may be `{ anyOf: [...] }`, ORed, one level deep.
-  Conditions are `{ path: 'mapping.<segment>...', op: 'exists' | 'notExists' }`
-  (JSON null counts as absent), `{ path: 'mapping.…', op: 'in', value: string[] }`
-  (1–500 strings) and `{ path: 'sourceId', op: 'notStartsWith', value }`
-  (a NULL sourceId matches). `orderBy` is `{ path: 'mapping.…', direction:
-  'asc' | 'desc' }`, nulls last, ties broken by id in the same direction;
-  without it rows come in id order. `take` is 1–500. `omit` lists top-level
-  mapping keys to leave out of the rows; never write such rows back. Path
-  segments must match `^[A-Za-z_][A-Za-z0-9_]*$`. **PostgreSQL only**: the
-  MongoDB, DocumentDB and legacy repositories inherit the port's
-  "not supported by this database adapter yet" error. It also refuses to run
-  while field-level encryption still encrypts `IntegrationMapping.mapping` on
-  write (see `database/encryption/README.md`). Validation lives in
-  `integration-mapping-query.js`; a new operator is one entry in its
-  `OPERATORS` table and one in the Postgres adapter's `CONDITION_SQL`.
-  **Cost**: one SQL statement per call, which reads every row of the
-  integration and evaluates the JSON paths per row, because no JSON index
-  exists. With ~4 KB mappings on PostgreSQL 16 that is about 0.3 s per call
-  at 10⁴ rows per integration and 2.5–3 s at 10⁵; a deep offset or an empty
-  page past the end costs about the same as the first page.
+- `integration-mapping-repository-*.js` - Mapping data persistence
 - `process-repository-*.js` - Process (long-running job) persistence.
   Implements `applyProcessUpdate(processId, ops)` — a race-safe alternative
   to `update(id, patch)` that routes increments, sets, and bounded-array

package/database/encryption/README.md

@@ -814,22 +814,6 @@ export AES_KEY=$(openssl rand -hex 16)  # Generate 32-char key
 ❌ Query on encrypted fields (not supported)
 ❌ Manually decrypt data (use extension)
 
-`IntegrationMappingRepository.queryMappings()` (PostgreSQL) filters and sorts
-inside the `mapping` JSON, so it refuses to run while field-level encryption
-still encrypts `IntegrationMapping.mapping` on write. Opt the field out in the
-app definition, together with any nested `mapping.*` path that
-`encryption.schema` encrypts:
-
-```javascript
-encryption: {
-    disable: { IntegrationMapping: ['mapping'] },
-}
-```
-
-The opt-out applies to writes only. Rows written encrypted before it stay
-readable, but `queryMappings()` does not match them until they are written
-again.
-
 ## Future Enhancements
 
 ### Planned

package/integrations/repositories/integration-mapping-repository-interface.js

@@ -52,47 +52,6 @@ class IntegrationMappingRepositoryInterface {
         );
     }
 
-    /**
-     * Query one filtered, ordered page of an integration's mappings without
-     * loading every row. Rows have the same shape as findMappingsByIntegration.
-     *
-     * Paths address the `mapping` JSON by identifier-only segments
-     * (`'mapping.c2h.lastStatus'`), or the `sourceId` column. Conditions:
-     * - `{ path: 'mapping.…', op: 'exists' | 'notExists' }` — JSON null counts
-     *   as absent; notExists is the exact negation of exists.
-     * - `{ path: 'mapping.…', op: 'in', value: string[] }` — matches JSON
-     *   strings; 1–500 values.
-     * - `{ path: 'sourceId', op: 'notStartsWith', value: string }` — a NULL
-     *   sourceId matches.
-     *
-     * Only rows whose `mapping` is a JSON object can match, so rows whose
-     * whole `mapping` is still ciphertext from before an encryption opt-out
-     * never do. Adapters refuse to run while field-level encryption is enabled
-     * and still encrypts `mapping`, or a path inside it, on write; opt out with
-     * `appDefinition.encryption.disable = { IntegrationMapping: ['mapping'] }`
-     * plus any nested `mapping.…` path a custom schema encrypts.
-     *
-     * @param {string|number} integrationId - The integration ID
-     * @param {Object} query
-     * @param {Array<Object>} [query.where=[]] - Conditions ANDed together; an
-     *   entry may be `{ anyOf: Condition[] }` (one level, ORed). At most 20
-     *   conditions, anyOf members included.
-     * @param {{path: string, direction: 'asc'|'desc'}} [query.orderBy] - A
-     *   mapping path; nulls last, ties broken by id in the same direction.
-     *   Without it rows are ordered by id ascending.
-     * @param {number} [query.skip=0] - Rows to skip (integer ≥ 0)
-     * @param {number} query.take - Page size (integer 1–500)
-     * @param {string[]} [query.omit=[]] - Top-level mapping keys to leave out of
-     *   the returned rows; such projected rows must not be written back
-     * @returns {Promise<{mappings: Array<Object>, total: number}>} The page, and
-     *   the number of rows matching `where`
-     */
-    async queryMappings(integrationId, query) {
-        throw new Error(
-            'queryMappings is not supported by this database adapter yet'
-        );
-    }
-
     /**
      * Delete a specific mapping
      *

package/integrations/repositories/integration-mapping-repository-postgres.js

@@ -1,30 +1,8 @@
 const { prisma } = require('../../database/prisma');
-const {
-    getMappingFieldsEncryptedOnWrite,
-} = require('../../database/encryption/integration-mapping-encryption');
 const {
     IntegrationMappingRepositoryInterface,
 } = require('./integration-mapping-repository-interface');
 const { strictIntId } = require('./report-id');
-const { validateMappingQuery } = require('./integration-mapping-query');
-
-const COLUMNS = { mapping: '"mapping"', sourceId: '"sourceId"' };
-const SQL_DIRECTIONS = { asc: 'ASC', desc: 'DESC' };
-
-const jsonPathOperand = (column, path) => ({
-    json: `${column} #> ${path}::text[]`,
-    text: `${column} #>> ${path}::text[]`,
-});
-const jsonType = (json) => `COALESCE(jsonb_typeof(${json}), 'null')`;
-
-const CONDITION_SQL = {
-    exists: ({ json }) => `${jsonType(json)} <> 'null'`,
-    notExists: ({ json }) => `${jsonType(json)} = 'null'`,
-    in: ({ json, text, value }) =>
-        `(jsonb_typeof(${json}) = 'string' AND ${text} = ANY(${value}::text[]))`,
-    notStartsWith: ({ text, value }) =>
-        `(${text} IS NULL OR NOT starts_with(${text}, ${value}::text))`,
-};
 
 /**
  * PostgreSQL Integration Mapping Repository Adapter
@@ -238,115 +216,6 @@ class IntegrationMappingRepositoryPostgres extends IntegrationMappingRepositoryI
         return counts;
     }
 
-    /**
-     * @param {string} integrationId
-     * @param {Object} query - See IntegrationMappingRepositoryInterface.queryMappings
-     * @returns {Promise<{mappings: Array<Object>, total: number}>}
-     */
-    async queryMappings(integrationId, query) {
-        const { where, orderBy, skip, take, omit } =
-            validateMappingQuery(query);
-        const intIntegrationId = strictIntId(integrationId);
-        this._assertMappingWrittenUnencrypted();
-
-        const params = [];
-        const bind = (v) => {
-            params.push(v);
-            return `$${params.length}`;
-        };
-
-        const whereSql = [
-            `"integrationId" = ${bind(intIntegrationId)}::int`,
-            `jsonb_typeof("mapping") = 'object'`,
-            ...where.map((entry) => this._whereEntrySql(entry, bind)),
-        ].join(' AND ');
-        const orderSql = orderBy ? this._orderSql(orderBy, bind) : `"id" ASC`;
-        const mappingSql =
-            omit.length > 0
-                ? `"mapping" - ${bind(omit)}::text[] AS "mapping"`
-                : `"mapping"`;
-
-        const sql = `
-            WITH "matched" AS (
-                SELECT "id", "integrationId", "sourceId", "mapping", "createdAt", "updatedAt"
-                FROM "IntegrationMapping"
-                WHERE ${whereSql}
-            ),
-            "page" AS (
-                SELECT * FROM "matched"
-                ORDER BY ${orderSql}
-                OFFSET ${bind(skip)}::bigint
-                LIMIT ${bind(take)}::int
-            )
-            SELECT "id", "integrationId", "sourceId", ${mappingSql}, "createdAt", "updatedAt",
-                (SELECT COUNT(*)::int FROM "matched") AS "__total"
-            FROM (VALUES (1)) AS "one"
-            LEFT JOIN "page" ON true
-            ORDER BY ${orderSql}
-        `;
-        const rows = await this.prisma.$queryRawUnsafe(sql, ...params);
-
-        return {
-            mappings: rows
-                .filter((row) => row.id !== null)
-                .map(({ __total, ...row }) => this._convertMappingIds(row)),
-            total: rows[0].__total,
-        };
-    }
-
-    /** @private */
-    _assertMappingWrittenUnencrypted() {
-        const fields = getMappingFieldsEncryptedOnWrite();
-        if (fields.length === 0) return;
-
-        const encrypted = fields
-            .map((field) => `IntegrationMapping.${field}`)
-            .join(', ');
-        const optOut = fields.map((field) => `'${field}'`).join(', ');
-        throw new Error(
-            `queryMappings: field-level encryption still encrypts ${encrypted} on write, so it cannot be queried. Opt out by adding ${optOut} to appDefinition.encryption.disable.IntegrationMapping.`
-        );
-    }
-
-    /**
-     * One where entry: a condition, or an anyOf group as a parenthesized OR.
-     * @private
-     */
-    _whereEntrySql(entry, bind) {
-        if (!entry.anyOf) return this._conditionSql(entry, bind);
-        const alternatives = entry.anyOf.map((condition) =>
-            this._conditionSql(condition, bind)
-        );
-        return `(${alternatives.join(' OR ')})`;
-    }
-
-    /**
-     * SQL predicate for one validated queryMappings condition. `exists`
-     * treats JSON null as absent, and `notExists` is its exact negation.
-     * @private
-     */
-    _conditionSql({ field, path, op, value }, bind) {
-        const column = COLUMNS[field];
-        const operand = path
-            ? jsonPathOperand(column, bind(path))
-            : { text: column };
-        return CONDITION_SQL[op]({
-            ...operand,
-            value: value === undefined ? undefined : bind(value),
-        });
-    }
-
-    /**
-     * NULLIF folds JSON null into SQL NULL, so both sort after every value.
-     * @private
-     */
-    _orderSql({ path, direction }, bind) {
-        const { json } = jsonPathOperand(COLUMNS.mapping, bind(path));
-        const value = `NULLIF(${json}, 'null'::jsonb)`;
-        const sqlDirection = SQL_DIRECTIONS[direction];
-        return `${value} ${sqlDirection} NULLS LAST, "id" ${sqlDirection}`;
-    }
-
     /**
      * Find mapping by ID
      * @param {string} id - Mapping ID (string from application layer)

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.651.bc0e60a.0",
+    "version": "2.0.0--canary.652.60de836.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -48,9 +48,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.651.bc0e60a.0",
-        "@friggframework/prettier-config": "2.0.0--canary.651.bc0e60a.0",
-        "@friggframework/test": "2.0.0--canary.651.bc0e60a.0",
+        "@friggframework/eslint-config": "2.0.0--canary.652.60de836.0",
+        "@friggframework/prettier-config": "2.0.0--canary.652.60de836.0",
+        "@friggframework/test": "2.0.0--canary.652.60de836.0",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -90,5 +90,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "bc0e60a39a4ee32316d346a02ef8da77d4d41b1f"
+    "gitHead": "60de83654af65d71fc331c7dbfee727c4f2534ff"
 }

package/database/encryption/integration-mapping-encryption.js

@@ -1,41 +0,0 @@
-const { getEncryptionConfig } = require('../prisma');
-const {
-    getFieldsToEncryptOnWrite,
-    loadCustomEncryptionSchema,
-} = require('./encryption-schema-registry');
-
-let mappingWrittenPlain = false;
-
-/**
- * The `IntegrationMapping` fields, `mapping` itself or a nested `mapping.*`
- * path, that field-level encryption encrypts on write. An empty result is
- * kept for the life of the process.
- *
- * @returns {string[]} Empty when every mapping path is written as plain JSON
- */
-function getMappingFieldsEncryptedOnWrite() {
-    if (mappingWrittenPlain) return [];
-
-    const fields = encryptedMappingFields();
-    mappingWrittenPlain = fields.length === 0;
-    return fields;
-}
-
-function encryptedMappingFields() {
-    if (!getEncryptionConfig().enabled) return [];
-
-    loadCustomEncryptionSchema();
-    return getFieldsToEncryptOnWrite('IntegrationMapping').filter(
-        (field) => field === 'mapping' || field.startsWith('mapping.')
-    );
-}
-
-/** Test helper: forget a kept result. */
-function resetMappingEncryptionCheck() {
-    mappingWrittenPlain = false;
-}
-
-module.exports = {
-    getMappingFieldsEncryptedOnWrite,
-    resetMappingEncryptionCheck,
-};

package/integrations/repositories/integration-mapping-query.js

@@ -1,193 +0,0 @@
-const SEGMENT_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const MAX_TAKE = 500;
-const MAX_IN_VALUES = 500;
-const MAX_CONDITIONS = 20;
-const DIRECTIONS = ['asc', 'desc'];
-
-const OPERATORS = {
-    exists: { fields: ['mapping'] },
-    notExists: { fields: ['mapping'] },
-    in: { fields: ['mapping'], value: toStringList },
-    notStartsWith: { fields: ['sourceId'], value: toPrefix },
-};
-
-/**
- * Checks a queryMappings query and normalizes it for an adapter.
- *
- * @param {Object} query - See IntegrationMappingRepositoryInterface.queryMappings
- * @returns {{where: Array<Object>, orderBy: ({path: string[], direction: 'asc'|'desc'}|null), skip: number, take: number, omit: string[]}}
- * @throws {Error} When the query does not fit that shape
- */
-function validateMappingQuery(query) {
-    if (!isPlainObject(query)) {
-        throw new Error('queryMappings: query must be an object');
-    }
-    const { where = [], orderBy, skip = 0, take, omit = [] } = query;
-    if (!Array.isArray(where)) {
-        throw new Error('queryMappings: where must be an array');
-    }
-    if (!Number.isInteger(take) || take < 1 || take > MAX_TAKE) {
-        throw new Error(
-            `queryMappings: take must be an integer between 1 and ${MAX_TAKE}`
-        );
-    }
-    if (!Number.isSafeInteger(skip) || skip < 0) {
-        throw new Error('queryMappings: skip must be a non-negative integer');
-    }
-    if (
-        !Array.isArray(omit) ||
-        !omit.every((key) => typeof key === 'string' && SEGMENT_REGEX.test(key))
-    ) {
-        throw new Error(
-            `queryMappings: omit must be an array of top-level mapping keys matching ${SEGMENT_REGEX}`
-        );
-    }
-
-    const whereEntries = where.map(toWhereEntry);
-    const conditionCount = whereEntries.reduce(
-        (count, entry) => count + (entry.anyOf ? entry.anyOf.length : 1),
-        0
-    );
-    if (conditionCount > MAX_CONDITIONS) {
-        throw new Error(
-            `queryMappings: where must have at most ${MAX_CONDITIONS} conditions, anyOf members included`
-        );
-    }
-
-    return {
-        where: whereEntries,
-        orderBy: orderBy === undefined ? null : toOrderBy(orderBy),
-        skip,
-        take,
-        omit,
-    };
-}
-
-function toOrderBy(orderBy) {
-    if (!isPlainObject(orderBy)) {
-        throw new Error('queryMappings: orderBy must be an object');
-    }
-    const { field, segments } = parsePath(orderBy.path);
-    if (field !== 'mapping') {
-        throw new Error(
-            "queryMappings: orderBy.path must be a mapping path ('mapping.<segment>...')"
-        );
-    }
-    if (!DIRECTIONS.includes(orderBy.direction)) {
-        throw new Error(
-            "queryMappings: orderBy.direction must be 'asc' or 'desc'"
-        );
-    }
-    return { path: segments, direction: orderBy.direction };
-}
-
-function toWhereEntry(entry) {
-    assertWhereEntryShape(entry);
-    if (!('anyOf' in entry)) return toCondition(entry);
-
-    const { anyOf } = entry;
-    if (!Array.isArray(anyOf) || anyOf.length === 0) {
-        throw new Error('queryMappings: anyOf must be a non-empty array');
-    }
-    return {
-        anyOf: anyOf.map((condition) => {
-            assertWhereEntryShape(condition);
-            if ('anyOf' in condition) {
-                throw new Error('queryMappings: nested anyOf is not supported');
-            }
-            return toCondition(condition);
-        }),
-    };
-}
-
-function assertWhereEntryShape(entry) {
-    if (!isPlainObject(entry)) {
-        throw new Error('queryMappings: each where entry must be an object');
-    }
-}
-
-function isPlainObject(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
-
-/**
- * `{ path: 'mapping.c2h.lastStatus', op: 'in', value: ['failed'] }` →
- * `{ field: 'mapping', path: ['c2h', 'lastStatus'], op: 'in', value: ['failed'] }`.
- * A `sourceId` condition has no `path`; an op without a value has no `value`.
- */
-function toCondition({ path, op, value }) {
-    const { field, segments } = parsePath(path);
-    const operator = Object.hasOwn(OPERATORS, op) ? OPERATORS[op] : null;
-    if (!operator?.fields.includes(field)) {
-        throw new Error(
-            `queryMappings: op ${JSON.stringify(
-                op
-            )} is not allowed on '${path}' (allowed: ${operatorsOn(field).join(
-                ', '
-            )})`
-        );
-    }
-    return {
-        field,
-        ...(segments.length > 0 && { path: segments }),
-        op,
-        ...(operator.value && { value: operator.value(value, path) }),
-    };
-}
-
-function operatorsOn(field) {
-    return Object.keys(OPERATORS).filter((op) =>
-        OPERATORS[op].fields.includes(field)
-    );
-}
-
-function toStringList(value, path) {
-    if (
-        !Array.isArray(value) ||
-        value.length === 0 ||
-        !value.every((v) => typeof v === 'string')
-    ) {
-        throw new Error(
-            `queryMappings: 'in' value must be a non-empty array of strings on '${path}'`
-        );
-    }
-    if (value.length > MAX_IN_VALUES) {
-        throw new Error(
-            `queryMappings: 'in' value must have at most ${MAX_IN_VALUES} strings on '${path}'`
-        );
-    }
-    return value;
-}
-
-function toPrefix(value, path) {
-    if (typeof value !== 'string' || value.length === 0) {
-        throw new Error(
-            `queryMappings: 'notStartsWith' value must be a non-empty string on '${path}'`
-        );
-    }
-    return value;
-}
-
-/**
- * `'mapping.c2h.lastStatus'` → `{ field: 'mapping', segments: ['c2h', 'lastStatus'] }`,
- * `'sourceId'` → `{ field: 'sourceId', segments: [] }`.
- */
-function parsePath(path) {
-    const [field, ...segments] =
-        typeof path === 'string' ? path.split('.') : [];
-    const valid =
-        (field === 'sourceId' && segments.length === 0) ||
-        (field === 'mapping' &&
-            segments.length > 0 &&
-            segments.every((segment) => SEGMENT_REGEX.test(segment)));
-    if (!valid) {
-        throw new Error(
-            `queryMappings: invalid path ${JSON.stringify(
-                path
-            )} (must be 'sourceId' or 'mapping.<segment>...' with segments matching ${SEGMENT_REGEX})`
-        );
-    }
-    return { field, segments };
-}
-
-module.exports = { validateMappingQuery };