@friggframework/core 2.0.0--canary.654.5821f44.0 → 2.0.0--canary.654.0c31bb1.0

package/core/CLAUDE.md

@@ -158,8 +158,9 @@ class MyIntegration extends Delegate {
 
 5. **Flush** (in `runInvocationScope`'s `finally`):
    ```javascript
-   // Usage rollup first (unbounded), then telemetry + log sinks in parallel
-   // under one deadline: min(flushTimeoutMs, remaining time - 50 ms).
+   // Telemetry + log sinks under one deadline, fixed at flush start:
+   // min(flushTimeoutMs, remaining time - 50 ms). The usage rollup runs in
+   // parallel with no bound of its own.
    ```
 
 ### SQS Job Processing Lifecycle

package/core/create-handler.js

@@ -6,7 +6,7 @@ const { getLogger, toSanitizedSurrogate } = require('../logs');
 const {
     summarizeLambdaEvent,
     toScopeInvocation,
-    toRequestInvocation,
+    toRequestDetails,
 } = require('../logs/summarize-event');
 const {
     runInvocationScope,
@@ -58,8 +58,9 @@ const createHandler = (optionByName = {}) => {
             routeKey: eventSummary.routeKey,
             invocation: toScopeInvocation(eventSummary),
         };
-        // The full redacted summary goes only on the entry and failure records.
-        const requestInvocation = toRequestInvocation(eventSummary);
+        // Path, query keys and header names go only on the entry and failure
+        // records; the logger adds them to the scope's invocation.
+        const requestDetails = toRequestDetails(eventSummary);
 
         return runInvocationScope(
             scopeFields,
@@ -67,7 +68,7 @@ const createHandler = (optionByName = {}) => {
                 try {
                     log.info('Handler invoked', {
                         eventName: 'frigg.handler.invoked',
-                        invocation: requestInvocation,
+                        invocation: requestDetails,
                     });
 
                     // If enabled (i.e. if SECRET_ARN is set in process.env) Fetch secrets from AWS Secrets Manager, and set them as environment variables.
@@ -109,7 +110,7 @@ const createHandler = (optionByName = {}) => {
                     if (!isUserFacingResponse && error.isHaltError === true) {
                         log.error('Handler halted', {
                             eventName: 'frigg.handler.halted',
-                            invocation: requestInvocation,
+                            invocation: requestDetails,
                             error,
                         });
                         return;
@@ -117,7 +118,7 @@ const createHandler = (optionByName = {}) => {
 
                     log.error('Handler failed', {
                         eventName: 'frigg.handler.failed',
-                        invocation: requestInvocation,
+                        invocation: requestDetails,
                         error,
                     });
 

package/core/invocation-scope.js

@@ -1,4 +1,4 @@
-const { runInContext } = require('../logs/context');
+const { runInContext, LOGGER_SCOPE_KEY } = require('../logs/context');
 const { summarizeMessageBody } = require('../logs/summarize-event');
 const { flushSinks, hasFlushableSinks } = require('../logs/logger-runtime');
 
@@ -128,9 +128,19 @@ async function flushInvocation({
     flushTimeoutMs,
     context,
 }) {
-    // ADR-048 §11: usage first and unbounded, then one deadline for the rest.
-    await flushUsageRollup(usageRollup, eventSummary, shouldUseDatabase);
+    // ADR-048 §11: the deadline is fixed at flush start. The usage rollup
+    // emits no telemetry, so it runs in parallel with no bound of its own.
+    const deadline = Math.min(
+        flushTimeoutMs,
+        remainingTimeMs(context) - FLUSH_MARGIN_MS
+    );
+    await Promise.all([
+        flushUsageRollup(usageRollup, eventSummary, shouldUseDatabase),
+        flushBounded(telemetry, deadline),
+    ]);
+}
 
+function flushBounded(telemetry, deadline) {
     const flushes = [];
     if (isTelemetryEnabled(telemetry)) {
         flushes.push((signal) => flushTelemetry(telemetry, { signal }));
@@ -138,14 +148,8 @@ async function flushInvocation({
     if (hasFlushableSinks()) {
         flushes.push((signal) => flushSinks({ signal }));
     }
-    if (!flushes.length) return;
-
-    const deadline = Math.min(
-        flushTimeoutMs,
-        remainingTimeMs(context) - FLUSH_MARGIN_MS
-    );
-    if (!(deadline > 0)) return;
-    await withDeadline(deadline, (signal) =>
+    if (!flushes.length || !(deadline > 0)) return undefined;
+    return withDeadline(deadline, (signal) =>
         Promise.allSettled(flushes.map((flush) => flush(signal)))
     );
 }
@@ -164,22 +168,19 @@ async function runInvocationScope(fields, fn, opts = {}) {
         flushTimeoutMs = DEFAULT_FLUSH_TIMEOUT_MS,
         context,
     } = opts;
-    return runInContext({ log: { ...(fields || {}) } }, async () => {
+    return runInContext({ [LOGGER_SCOPE_KEY]: { ...(fields || {}) } }, async () => {
         try {
             return await fn();
         } finally {
-            try {
-                await flushInvocation({
-                    telemetry,
-                    usageRollup,
-                    eventSummary,
-                    shouldUseDatabase,
-                    flushTimeoutMs,
-                    context,
-                });
-            } catch (_) {
-                // A flush must never change the handler result.
-            }
+            // Every step is guarded, so a flush never changes the result.
+            await flushInvocation({
+                telemetry,
+                usageRollup,
+                eventSummary,
+                shouldUseDatabase,
+                flushTimeoutMs,
+                context,
+            });
         }
     });
 }
@@ -201,7 +202,7 @@ function runMessageScope(record, fn) {
     );
     return runInContext(
         {
-            log: {
+            [LOGGER_SCOPE_KEY]: {
                 messageId: record?.messageId,
                 receiveCount: toCount(record?.attributes?.ApproximateReceiveCount),
                 integrationEvent: event,

package/database/encryption/encryption-schema-registry.js

@@ -9,7 +9,7 @@
  */
 
 const { logger } = require('./logger');
-const { addDeniedKeys } = require('../../logs/redact');
+const { registerDeniedKeys } = require('../../logs/denied-keys');
 
 /**
  * Core encryption schema (immutable - cannot be overridden by custom schemas)
@@ -121,7 +121,7 @@ function registerCustomSchema(schema) {
     }
 
     customSchema = { ...schema };
-    addDeniedKeys(Object.values(schema).flatMap((config) => config.fields));
+    registerDeniedKeys(Object.values(schema).flatMap((config) => config.fields));
     logger.info(
         `Registered custom encryption schema for models: ${Object.keys(customSchema).join(', ')}`
     );
@@ -151,7 +151,7 @@ function extractCredentialFieldsFromModules(moduleDefinitions) {
         }
     }
 
-    addDeniedKeys(fields);
+    registerDeniedKeys(fields);
     return [...new Set(fields)];
 }
 

package/database/encryption/logger.js

@@ -17,9 +17,12 @@ class EncryptionLogger {
         this.minLevel = this._getMinLevel();
     }
 
+    // FRIGG_LOG_LEVEL also takes TRACE and FATAL (ADR-048); this logger has
+    // no such levels, so they map to its nearest ones.
     _getMinLevel() {
-        const level = process.env.FRIGG_LOG_LEVEL || 'INFO';
-        return LOG_LEVELS[level.toUpperCase()] ?? LOG_LEVELS.INFO;
+        const level = (process.env.FRIGG_LOG_LEVEL || 'INFO').trim().toUpperCase();
+        const mapped = { TRACE: 'DEBUG', FATAL: 'ERROR' }[level] ?? level;
+        return LOG_LEVELS[mapped] ?? LOG_LEVELS.INFO;
     }
 
     _shouldLog(level) {

package/handlers/app-definition-loader.js

@@ -2,8 +2,7 @@ const { findNearestBackendPackageJson } = require('@friggframework/core/utils');
 const path = require('node:path');
 const fs = require('fs-extra');
 const { resolveTelemetryConfig } = require('../telemetry/telemetry-config');
-const { addDeniedKeys } = require('../logs/redact');
-const { getLogger } = require('../logs');
+const { registerDeniedKeys } = require('../logs/denied-keys');
 const {
     extractCredentialFieldsFromModules,
 } = require('../database/encryption/encryption-schema-registry');
@@ -13,32 +12,18 @@ const {
 
 // Handlers without a database never load the encryption registry, so the
 // credential leaf keys are registered for redaction here too.
-const warnedIgnoredKeys = new Set();
-
-function warnIgnoredKeys(ignored) {
-    for (const key of ignored) {
-        if (warnedIgnoredKeys.has(key)) continue;
-        warnedIgnoredKeys.add(key);
-        getLogger('frigg.logger').warn(
-            'Credential field name is a record field; it stays visible in logs',
-            { eventName: 'frigg.logger.denied_key_ignored', key }
-        );
-    }
-}
-
 function registerCredentialLogKeys(appDefinition, integrations) {
     try {
-        const fields = extractCredentialFieldsFromModules(
+        extractCredentialFieldsFromModules(
             getModulesDefinitionFromIntegrationClasses(integrations)
         );
-        warnIgnoredKeys(addDeniedKeys(fields));
     } catch {
         // An odd integration shape must not stop the app from loading.
     }
     const schema = appDefinition.encryption?.schema;
     if (schema && typeof schema === 'object') {
         for (const config of Object.values(schema)) {
-            warnIgnoredKeys(addDeniedKeys(config?.fields));
+            registerDeniedKeys(config?.fields);
         }
     }
 }

package/handlers/routers/websocket.js

@@ -1,5 +1,5 @@
 const { createHandler } = require('@friggframework/core');
-const { createWebsocketConnectionRepository } = require('../../database/websocket-connection-repository-factory');
+const { createWebsocketConnectionRepository } = require('../../websocket/repositories/websocket-connection-repository-factory');
 const { getLogger } = require('../../logs');
 
 const log = getLogger('frigg.websocket');

package/logs/context.js

@@ -64,15 +64,24 @@ function getContext() {
     return als().getStore() ?? null;
 }
 
+// The store is frozen per scope, so one scope object per store is enough.
+const EMPTY_SCOPE = Object.freeze({});
+const scopeByStore = new WeakMap();
+
 function getLoggerScope() {
     const store = getContext();
-    if (!store) return {};
-    const scope = {};
-    for (const key of INTEGRATION_KEYS) {
-        if (store[key] !== undefined) scope[key] = store[key];
-    }
-    if (isPlainObject(store[LOGGER_SCOPE_KEY])) {
-        Object.assign(scope, store[LOGGER_SCOPE_KEY]);
+    if (!store) return EMPTY_SCOPE;
+    let scope = scopeByStore.get(store);
+    if (!scope) {
+        scope = {};
+        for (const key of INTEGRATION_KEYS) {
+            if (store[key] !== undefined) scope[key] = store[key];
+        }
+        if (isPlainObject(store[LOGGER_SCOPE_KEY])) {
+            Object.assign(scope, store[LOGGER_SCOPE_KEY]);
+        }
+        scope = Object.freeze(scope);
+        scopeByStore.set(store, scope);
     }
     return scope;
 }
@@ -89,4 +98,5 @@ module.exports = {
     getContext,
     getLoggerScope,
     hasOnlyLoggerKeys,
+    isPlainObject,
 };

package/logs/contract-keys.js

@@ -0,0 +1,67 @@
+// Field names of the record contract (ADR-048 §3). A leaf: no requires.
+
+const REQUIRED_KEYS = ['timestamp', 'level', 'message', 'logger'];
+const RESOURCE_KEYS = ['appName', 'stage'];
+const TRACE_KEYS = ['trace_id', 'span_id', 'trace_flags'];
+const DROPPED_KEYS_FIELD = 'droppedKeys';
+const OWNED_KEYS = new Set([
+    ...REQUIRED_KEYS,
+    ...RESOURCE_KEYS,
+    ...TRACE_KEYS,
+    DROPPED_KEYS_FIELD,
+]);
+
+// Set by the scope builders (logs/context.js, core/invocation-scope.js,
+// core/create-handler.js) and the Module and IntegrationBase bindings.
+const SCOPE_KEYS = [
+    'integrationId',
+    'integrationType',
+    'userId',
+    'version',
+    'entityId',
+    'credentialId',
+    'requestId',
+    'messageId',
+    'receiveCount',
+    'processId',
+    'integrationEvent',
+    'handlerName',
+    'method',
+    'route',
+    'routeKey',
+    'invocation',
+];
+
+const CONTRACT_KEYS = [
+    ...new Set([...OWNED_KEYS, ...SCOPE_KEYS, 'eventName', 'statusCode', 'error']),
+];
+
+const RESERVED_KEYS = new Set([
+    'tenantId',
+    'type',
+    'time',
+    'record',
+    'errorType',
+    'errorMessage',
+    'stackTrace',
+    'service',
+    'env',
+    'host',
+    'source',
+    'status',
+    'severity',
+]);
+
+const PAYLOAD_KEYS = new Set(['body', 'rawBody', 'payload', 'response']);
+
+module.exports = {
+    REQUIRED_KEYS,
+    RESOURCE_KEYS,
+    TRACE_KEYS,
+    DROPPED_KEYS_FIELD,
+    OWNED_KEYS,
+    SCOPE_KEYS,
+    CONTRACT_KEYS,
+    RESERVED_KEYS,
+    PAYLOAD_KEYS,
+};

package/logs/denied-keys.js

@@ -0,0 +1,21 @@
+const { addDeniedKeys } = require('./redact');
+const { getLogger } = require('./logger');
+
+const warnedKeys = new Set();
+
+// addDeniedKeys plus one WARN per record-contract key it had to skip, so a
+// credential field named like a record field is visible wherever it is set.
+function registerDeniedKeys(keys) {
+    const ignored = addDeniedKeys(keys);
+    for (const key of ignored) {
+        if (warnedKeys.has(key)) continue;
+        warnedKeys.add(key);
+        getLogger('frigg.logger').warn(
+            'Credential field name is a record field; it stays visible in logs',
+            { eventName: 'frigg.logger.denied_key_ignored', key }
+        );
+    }
+    return ignored;
+}
+
+module.exports = { registerDeniedKeys };

package/logs/logger-runtime.js

@@ -69,16 +69,11 @@ function hasFlushableSinks() {
 }
 
 async function flushSinks({ signal } = {}) {
-    const flushes = getSinks()
-        .filter((sink) => typeof sink.flush === 'function')
-        .map((sink) => {
-            try {
-                return Promise.resolve(sink.flush({ signal }));
-            } catch (error) {
-                return Promise.reject(error);
-            }
-        });
-    await Promise.allSettled(flushes);
+    await Promise.allSettled(
+        getSinks()
+            .filter((sink) => typeof sink.flush === 'function')
+            .map(async (sink) => sink.flush({ signal }))
+    );
 }
 
 function setSpanContextProvider(provider) {
@@ -117,7 +112,7 @@ function resetLoggerForTests({ level, sinks, trackViolations } = {}) {
     const s = state();
     s.config = null;
     s.levelOverride = parseLevel(level);
-    s.sinks = Array.isArray(sinks) ? [...sinks] : [require('./sinks').createStdoutSink()];
+    setSinks(sinks);
     s.spanContextProvider = null;
     s.warned.clear();
     s.violations.length = 0;

package/logs/logger.js

@@ -5,31 +5,33 @@ const { buildRecord, DEFAULT_LOGGER_NAME } = require('./record');
 
 const LOGGER_OWN_NAME = 'frigg.logger';
 
-function copyBindings(bindings) {
-    const copy = {};
-    if (!bindings || typeof bindings !== 'object') return copy;
+function copyBindings(bindings, into = {}) {
+    if (!bindings || typeof bindings !== 'object') return into;
     for (const key of Object.keys(bindings)) {
         try {
-            copy[key] = bindings[key];
+            into[key] = bindings[key];
         } catch {
             // A throwing getter drops only that binding.
         }
     }
-    return copy;
+    return into;
 }
 
+// One plain object per record. Static sources were copied at child() time.
 function evaluateBindings(sources) {
     const merged = {};
     for (const source of sources) {
-        let value = source;
-        if (typeof source === 'function') {
-            try {
-                value = source();
-            } catch {
-                continue;
-            }
+        if (typeof source !== 'function') {
+            Object.assign(merged, source);
+            continue;
+        }
+        let value;
+        try {
+            value = source();
+        } catch {
+            continue;
         }
-        Object.assign(merged, copyBindings(value));
+        copyBindings(value, merged);
     }
     return merged;
 }

package/logs/record.js

@@ -1,42 +1,17 @@
 const { LEVELS } = require('./levels');
-const { serializeValue, serializeError } = require('./serialize');
+const { serializeValue, serializeError, isError } = require('./serialize');
+const { isPlainObject } = require('./context');
+const {
+    RESOURCE_KEYS,
+    DROPPED_KEYS_FIELD,
+    OWNED_KEYS,
+    RESERVED_KEYS,
+    PAYLOAD_KEYS,
+} = require('./contract-keys');
 
 const MAX_RECORD_BYTES = 16 * 1024;
-const REQUIRED_KEYS = ['timestamp', 'level', 'message', 'logger'];
-const RESOURCE_KEYS = ['appName', 'stage'];
-const TRACE_KEYS = ['trace_id', 'span_id', 'trace_flags'];
-const DROPPED_KEYS_FIELD = 'droppedKeys';
-const OWNED_KEYS = new Set([
-    ...REQUIRED_KEYS,
-    ...RESOURCE_KEYS,
-    ...TRACE_KEYS,
-    DROPPED_KEYS_FIELD,
-]);
-const RESERVED_KEYS = new Set([
-    'tenantId',
-    'type',
-    'time',
-    'record',
-    'errorType',
-    'errorMessage',
-    'stackTrace',
-    'service',
-    'env',
-    'host',
-    'source',
-    'status',
-    'severity',
-]);
-const PAYLOAD_KEYS = new Set(['body', 'rawBody', 'payload', 'response']);
 const DEFAULT_LOGGER_NAME = 'frigg.unknown';
 
-function isError(value) {
-    return (
-        value instanceof Error ||
-        Object.prototype.toString.call(value) === '[object Error]'
-    );
-}
-
 function deepFreeze(value) {
     if (value && typeof value === 'object' && !Object.isFrozen(value)) {
         for (const key of Object.keys(value)) deepFreeze(value[key]);
@@ -64,39 +39,31 @@ function readFields(source) {
     return result;
 }
 
+// Returns the message text. An Error message is serialized once; when the
+// call site has no `error`, that result becomes the record's `error`.
 function buildMessage(message, callSite) {
     if (typeof message === 'string') {
-        return serializeValue(message);
+        return { text: serializeValue(message) };
     }
-    if (message === undefined || message === null) return '';
+    if (message === undefined || message === null) return { text: '' };
     if (isError(message)) {
         const error = serializeError(message);
-        if (callSite.error === undefined) callSite.error = message;
-        return typeof error?.message === 'string' ? error.message : '';
+        const text = typeof error?.message === 'string' ? error.message : '';
+        if (callSite.error !== undefined) return { text };
+        callSite.error = message;
+        return { text, error };
     }
     if (callSite.value === undefined) callSite.value = message;
-    return '[non-string message]';
+    return { text: '[non-string message]' };
 }
 
 const INVOCATION_KEY = 'invocation';
 
-function isPlainObject(value) {
-    return (
-        value !== null &&
-        typeof value === 'object' &&
-        Object.getPrototypeOf(value) === Object.prototype
-    );
-}
-
 // A boundary adds request detail to the scope's invocation; scope keys win.
-function extendInvocation(scoped, detail, dropped) {
+function extendInvocation(scoped, detail) {
     const merged = { ...scoped };
-    for (const [key, value] of Object.entries(detail)) {
-        if (!Object.prototype.hasOwnProperty.call(scoped, key)) {
-            merged[key] = value;
-        } else if (JSON.stringify(scoped[key]) !== JSON.stringify(value)) {
-            dropped.add(`${INVOCATION_KEY}.${key}`);
-        }
+    for (const key of Object.keys(detail)) {
+        if (!(key in merged)) merged[key] = detail[key];
     }
     return merged;
 }
@@ -117,10 +84,73 @@ function traceFields(spanContext) {
     };
 }
 
+function sameValue(a, b) {
+    if (a === b) return true;
+    return (
+        typeof a === 'object' &&
+        typeof b === 'object' &&
+        JSON.stringify(a) === JSON.stringify(b)
+    );
+}
+
 function byteLength(record) {
     return Buffer.byteLength(JSON.stringify(record));
 }
 
+function isDroppedKey(key, dropPayloads) {
+    return (
+        OWNED_KEYS.has(key) ||
+        RESERVED_KEYS.has(key) ||
+        (dropPayloads && PAYLOAD_KEYS.has(key))
+    );
+}
+
+// Filters and serializes one source. `error` is serialized on its own, once
+// (or taken from `preSerializedError`), and never walked by serializeValue.
+function prepareSource(source, dropPayloads, preSerializedError) {
+    const accepted = {};
+    const keys = [];
+    const dropped = [];
+    let rawError;
+    for (const [key, value] of Object.entries(source)) {
+        if (value === undefined || value === null) continue;
+        if (isDroppedKey(key, dropPayloads)) {
+            dropped.push(key);
+            continue;
+        }
+        keys.push(key);
+        if (key === 'error') rawError = value;
+        else accepted[key] = value;
+    }
+    // One pass over the object, so key rules (denied keys, digests,
+    // headers, OAuth shapes) apply to top-level fields too.
+    const safe = serializeValue(accepted);
+    const entries = [];
+    for (const key of keys) {
+        const value =
+            key === 'error'
+                ? preSerializedError ?? serializeError(rawError)
+                : safe?.[key];
+        if (value !== undefined && value !== null) entries.push([key, value]);
+    }
+    return { entries, dropped };
+}
+
+// The scope object is frozen and shared by every record of one scope.
+const preparedScopes = new WeakMap();
+
+function prepareScope(scope, dropPayloads) {
+    if (!scope || typeof scope !== 'object') return { entries: [], dropped: [] };
+    let byLevel = preparedScopes.get(scope);
+    if (!byLevel) {
+        byLevel = {};
+        preparedScopes.set(scope, byLevel);
+    }
+    const slot = dropPayloads ? 'info' : 'debug';
+    if (!byLevel[slot]) byLevel[slot] = prepareSource(scope, dropPayloads);
+    return byLevel[slot];
+}
+
 function buildRecord({
     level,
     logger,
@@ -135,10 +165,11 @@ function buildRecord({
     const dropPayloads = LEVELS[level] >= LEVELS.INFO;
     // log.error('msg', err): own props of an Error (axios config, request) must not become fields.
     const callSite = readFields(isError(fields) ? { error: fields } : fields);
+    const built = buildMessage(message, callSite);
     const record = {
         timestamp: now.toISOString(),
         level,
-        message: buildMessage(message, callSite),
+        message: built.text,
         logger: typeof logger === 'string' && logger ? logger : DEFAULT_LOGGER_NAME,
     };
     for (const key of RESOURCE_KEYS) {
@@ -150,52 +181,38 @@ function buildRecord({
 
     const dropped = new Set();
     const callSiteKeys = [];
-    const place = (source, isCallSite) => {
-        const accepted = {};
-        for (const [key, value] of Object.entries(source)) {
-            if (value === undefined || value === null) continue;
-            if (
-                OWNED_KEYS.has(key) ||
-                RESERVED_KEYS.has(key) ||
-                (dropPayloads && PAYLOAD_KEYS.has(key)) ||
-                (Object.prototype.hasOwnProperty.call(record, key) &&
-                    !canExtendInvocation(key, value))
-            ) {
-                dropped.add(key);
-                continue;
-            }
-            accepted[key] = value;
-        }
-        // One pass over the object, so key rules (denied keys, digests,
-        // headers, OAuth shapes) apply to top-level fields too.
-        const safe = serializeValue(accepted);
-        for (const key of Object.keys(accepted)) {
-            const value =
-                key === 'error' ? serializeError(accepted[key]) : safe?.[key];
-            if (value === undefined || value === null) continue;
-            if (key === INVOCATION_KEY && isPlainObject(record[key])) {
-                record[key] = extendInvocation(record[key], value, dropped);
+    const place = ({ entries, dropped: droppedHere }, isCallSite) => {
+        for (const key of droppedHere) dropped.add(key);
+        for (const [key, value] of entries) {
+            if (Object.prototype.hasOwnProperty.call(record, key)) {
+                if (
+                    key === INVOCATION_KEY &&
+                    isPlainObject(record[key]) &&
+                    isPlainObject(value)
+                ) {
+                    record[key] = extendInvocation(record[key], value);
+                } else if (!sameValue(record[key], value)) {
+                    // A repeat of the winning value is no conflict.
+                    dropped.add(key);
+                }
                 continue;
             }
             record[key] = value;
             if (isCallSite) callSiteKeys.push(key);
         }
     };
-    const canExtendInvocation = (key, value) =>
-        key === INVOCATION_KEY &&
-        isPlainObject(record[key]) &&
-        isPlainObject(value);
-    place(readFields(scope), false);
-    place(readFields(bindings), false);
-    place(callSite, true);
-
-    const measure = () => {
+    place(prepareScope(scope, dropPayloads), false);
+    place(prepareSource(bindings || {}, dropPayloads), false);
+    place(prepareSource(callSite, dropPayloads, built.error), true);
+
+    const setDroppedKeys = () => {
         delete record[DROPPED_KEYS_FIELD];
         if (dropped.size) record[DROPPED_KEYS_FIELD] = [...dropped];
-        return byteLength(record);
     };
+    setDroppedKeys();
+    let size = byteLength(record);
 
-    if (measure() > MAX_RECORD_BYTES) {
+    if (size > MAX_RECORD_BYTES) {
         const bySize = callSiteKeys
             .filter((key) => key !== 'error')
             .map((key) => [key, Buffer.byteLength(JSON.stringify(record[key]))])
@@ -203,27 +220,30 @@ function buildRecord({
         for (const [key] of bySize) {
             delete record[key];
             dropped.add(key);
-            if (measure() <= MAX_RECORD_BYTES) break;
+            setDroppedKeys();
+            size = byteLength(record);
+            if (size <= MAX_RECORD_BYTES) break;
         }
     }
     for (const part of ['stack', 'cause']) {
         if (
+            size > MAX_RECORD_BYTES &&
             record.error &&
             typeof record.error === 'object' &&
-            record.error[part] !== undefined &&
-            measure() > MAX_RECORD_BYTES
+            record.error[part] !== undefined
         ) {
             const { [part]: _removed, ...rest } = record.error;
             record.error = rest;
+            size = byteLength(record);
         }
     }
-    measure();
 
     return deepFreeze(record);
 }
 
 module.exports = {
     buildRecord,
+    deepFreeze,
     MAX_RECORD_BYTES,
     RESERVED_KEYS,
     PAYLOAD_KEYS,

package/logs/redact.js

@@ -1,3 +1,5 @@
+const { CONTRACT_KEYS } = require('./contract-keys');
+
 const DENIED_SUFFIXES = [
     'token',
     'secret',
@@ -27,27 +29,9 @@ const deniedKeys = new Set([
 
 // Record-contract fields. A credential field with one of these names must not
 // blank the field in every record.
-const PROTECTED_KEYS = new Set(
-    [
-        'integrationId',
-        'integrationType',
-        'userId',
-        'version',
-        'entityId',
-        'credentialId',
-        'requestId',
-        'messageId',
-        'processId',
-        'integrationEvent',
-        'eventName',
-        'handlerName',
-        'method',
-        'route',
-        'routeKey',
-        'statusCode',
-    ].map((key) => key.toLowerCase())
-);
+const PROTECTED_KEYS = new Set(CONTRACT_KEYS.map(normalizeKey));
 
+const DENIED_SUFFIX = new RegExp(`(?:${DENIED_SUFFIXES.join('|')})$`);
 const PAIR_KEYS = new Set(['code', 'codeverifier']);
 const DIGEST_KEY = /(sha(1|256)|hash|digest|checksum)$/;
 
@@ -71,7 +55,6 @@ const JSON_PAIR = /"([^"\\]{1,100})"(\s*:\s*)"((?:[^"\\]|\\.)*)"/g;
 const TEXT_PAIR = /(?<![A-Za-z0-9_.-])([A-Za-z0-9_.-]{1,100})=([^\s&"'<>,;)]+)/g;
 const HEX_RUN = /(?<![A-Za-z0-9])[0-9a-fA-F]{40,}(?![A-Za-z0-9])/g;
 const BASE64_RUN = /(?<![A-Za-z0-9+/=_-])[A-Za-z0-9+/_-]{40,}={0,2}(?![A-Za-z0-9+/=_-])/g;
-const BASE64_SEGMENT_RUN = /(?<![A-Za-z0-9+=_-])[A-Za-z0-9+_-]{40,}={0,2}(?![A-Za-z0-9+=_-])/g;
 const FORM_TEXT = /^[A-Za-z0-9_.%[\]-]+=[^&\s]*(?:&[A-Za-z0-9_.%[\]-]+=[^&\s]*)+$/;
 const PATH_SEGMENT = /^[A-Za-z0-9_-]*$/;
 
@@ -87,15 +70,23 @@ function normalizeKey(key) {
     return key.toLowerCase().replace(/[-_\s]/g, '');
 }
 
-function isDeniedKey(key) {
-    const normalized = normalizeKey(key);
+// The *Normalized variants take a normalizeKey() result, so a walk
+// normalizes each key once.
+function isDeniedNormalized(normalized) {
     if (!normalized || PROTECTED_KEYS.has(normalized)) return false;
-    if (deniedKeys.has(normalized)) return true;
-    return DENIED_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
+    return deniedKeys.has(normalized) || DENIED_SUFFIX.test(normalized);
+}
+
+function isDeniedKey(key) {
+    return isDeniedNormalized(normalizeKey(key));
+}
+
+function isDigestNormalized(normalized) {
+    return DIGEST_KEY.test(normalized);
 }
 
 function isDigestKey(key) {
-    return DIGEST_KEY.test(normalizeKey(key));
+    return isDigestNormalized(normalizeKey(key));
 }
 
 function isPairKey(key, { withState = false } = {}) {
@@ -139,7 +130,7 @@ function isRedactedValue(value) {
     return value === 'REDACTED' || value.startsWith('[REDACTED');
 }
 
-function scrubTokens(text, { allowHex = false, segment = false } = {}) {
+function scrubTokens(text, { allowHex = false } = {}) {
     let out = text.replace(PREFIXED_TOKEN, redacted);
     out = out.replace(JWT, redacted);
     out = out.replace(AUTH_SCHEME, (match, scheme, space, credential) => {
@@ -170,8 +161,8 @@ function scrubTokens(text, { allowHex = false, segment = false } = {}) {
             : match
     );
     if (!allowHex) out = out.replace(HEX_RUN, redacted);
-    out = out.replace(segment ? BASE64_SEGMENT_RUN : BASE64_RUN, (run) =>
-        hasMixedClasses(run) && (segment || !isPathLike(run))
+    out = out.replace(BASE64_RUN, (run) =>
+        hasMixedClasses(run) && !isPathLike(run)
             ? redacted(run)
             : run
     );
@@ -204,7 +195,7 @@ function redactPathSegment(segment) {
     if (PATH_TOKEN_SEGMENT.test(segment) && hasMixedClasses(segment)) {
         return redacted(segment);
     }
-    return scrubTokens(segment, { segment: true });
+    return scrubTokens(segment);
 }
 
 // The raw path, not URL#pathname, which percent-encodes `{proxy+}`.
@@ -308,12 +299,13 @@ function scrubString(str, { allowHex = false } = {}) {
     }
 }
 
+function isOAuthCallbackShapeNormalized(normalizedKeys) {
+    const keys = new Set(normalizedKeys);
+    return keys.has('code') && (keys.has('state') || keys.has('codeverifier'));
+}
+
 function isOAuthCallbackShape(keys) {
-    const normalized = new Set(keys.map(normalizeKey));
-    return (
-        normalized.has('code') &&
-        (normalized.has('state') || normalized.has('codeverifier'))
-    );
+    return isOAuthCallbackShapeNormalized(keys.map(normalizeKey));
 }
 
 function redactValue(value) {
@@ -324,8 +316,11 @@ function redactValue(value) {
 module.exports = {
     normalizeKey,
     isDeniedKey,
+    isDeniedNormalized,
     isDigestKey,
+    isDigestNormalized,
     isOAuthCallbackShape,
+    isOAuthCallbackShapeNormalized,
     addDeniedKeys,
     redactUrl,
     scrubString,

package/logs/serialize.js

@@ -1,7 +1,7 @@
 const {
-    isDeniedKey,
-    isDigestKey,
-    isOAuthCallbackShape,
+    isDeniedNormalized,
+    isDigestNormalized,
+    isOAuthCallbackShapeNormalized,
     normalizeKey,
     redactUrl,
     scrubString,
@@ -27,8 +27,10 @@ function cutString(value) {
     return value.slice(0, MAX_STRING - suffix.length) + suffix;
 }
 
-function cleanString(value, key) {
-    return cutString(scrubString(value, { allowHex: isDigestKey(key) }));
+function cleanString(value, normalizedKey = '') {
+    return cutString(
+        scrubString(value, { allowHex: isDigestNormalized(normalizedKey) })
+    );
 }
 
 function isError(value) {
@@ -73,10 +75,13 @@ function headerNames(value) {
 
 function walkObject(value, depth, seen) {
     const keys = Object.keys(value);
-    const dropAll = isOAuthCallbackShape(keys);
+    const normalizedKeys = keys.map(normalizeKey);
+    const dropAll = isOAuthCallbackShapeNormalized(normalizedKeys);
     const out = {};
-    for (const key of keys) {
-        if (dropAll || isDeniedKey(key)) {
+    for (let i = 0; i < keys.length; i += 1) {
+        const key = keys[i];
+        const normalized = normalizedKeys[i];
+        if (dropAll || isDeniedNormalized(normalized)) {
             out[key] = '[REDACTED]';
             continue;
         }
@@ -87,11 +92,11 @@ function walkObject(value, depth, seen) {
             out[key] = '[Getter threw]';
             continue;
         }
-        if (HEADER_KEYS.has(normalizeKey(key))) {
+        if (HEADER_KEYS.has(normalized)) {
             out[key] = attempt(() => headerNames(child), '[Unserializable]');
             continue;
         }
-        const result = walk(child, depth + 1, seen, key);
+        const result = walk(child, depth + 1, seen, normalized);
         if (result !== undefined) out[key] = result;
     }
     return out;
@@ -102,11 +107,12 @@ function walkContainer(value, depth, seen) {
         const out = {};
         for (const [k, v] of value) {
             const key = String(k);
-            if (isDeniedKey(key)) {
+            const normalized = normalizeKey(key);
+            if (isDeniedNormalized(normalized)) {
                 out[key] = '[REDACTED]';
                 continue;
             }
-            const result = walk(v, depth + 1, seen, key);
+            const result = walk(v, depth + 1, seen, normalized);
             if (result !== undefined) out[key] = result;
         }
         return out;
@@ -151,10 +157,10 @@ function walkSpecial(value) {
     return undefined;
 }
 
-function walk(value, depth, seen, key) {
+function walk(value, depth, seen, normalizedKey) {
     switch (typeof value) {
         case 'string':
-            return cleanString(value, key);
+            return cleanString(value, normalizedKey);
         case 'number':
             return Number.isFinite(value) ? value : String(value);
         case 'boolean':
@@ -313,6 +319,7 @@ function toSanitizedSurrogate(err) {
 }
 
 module.exports = {
+    isError,
     serializeValue,
     serializeError,
     toSanitizedSurrogate,

package/logs/sinks.js

@@ -1,4 +1,5 @@
 const fs = require('node:fs');
+const { deepFreeze } = require('./record');
 
 const DEFAULT_MAX_RETRIES = 10;
 const MAX_SLEEP_MS = 20;
@@ -42,42 +43,35 @@ function createStdoutSink({
             }
             let offset = 0;
             let retries = 0;
+            // EAGAIN and a zero-byte write share one bounded retry budget.
+            const retry = () => {
+                if (retries >= maxRetries) {
+                    reportFailure('EAGAIN');
+                    return false;
+                }
+                retries += 1;
+                sleep(Math.min(retries, MAX_SLEEP_MS));
+                return true;
+            };
             while (offset < buffer.length) {
                 let written;
                 try {
                     written = writeSync(fd, buffer, offset, buffer.length - offset);
                 } catch (error) {
-                    if (error?.code === 'EAGAIN' && retries < maxRetries) {
-                        retries += 1;
-                        sleep(Math.min(retries, MAX_SLEEP_MS));
-                        continue;
-                    }
-                    reportFailure(error?.code);
-                    return;
-                }
-                if (!(written > 0)) {
-                    if (retries >= maxRetries) {
-                        reportFailure('EAGAIN');
+                    if (error?.code !== 'EAGAIN') {
+                        reportFailure(error?.code);
                         return;
                     }
-                    retries += 1;
-                    sleep(Math.min(retries, MAX_SLEEP_MS));
+                    if (!retry()) return;
                     continue;
                 }
-                offset += written;
+                if (written > 0) offset += written;
+                else if (!retry()) return;
             }
         },
     };
 }
 
-function deepFreeze(value) {
-    if (value && typeof value === 'object') {
-        for (const key of Object.keys(value)) deepFreeze(value[key]);
-        Object.freeze(value);
-    }
-    return value;
-}
-
 function createMemorySink({ install = true } = {}) {
     const records = [];
     const sink = {

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.654.5821f44.0",
+    "version": "2.0.0--canary.654.0c31bb1.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -47,9 +47,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.654.5821f44.0",
-        "@friggframework/prettier-config": "2.0.0--canary.654.5821f44.0",
-        "@friggframework/test": "2.0.0--canary.654.5821f44.0",
+        "@friggframework/eslint-config": "2.0.0--canary.654.0c31bb1.0",
+        "@friggframework/prettier-config": "2.0.0--canary.654.0c31bb1.0",
+        "@friggframework/test": "2.0.0--canary.654.0c31bb1.0",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -89,5 +89,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "5821f44da7972564eb82727042b9760556114670"
+    "gitHead": "0c31bb15ef0497cc321c4d2103a752de6449d234"
 }

package/user/repositories/user-repository-documentdb.js

@@ -274,7 +274,7 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
         // Defensive check: verify document was found after update
         if (!updated) {
             throw new Error(
-                'Failed to update individual user: Document not found after update. ' +
+                `Failed to update individual user: Document not found after update (userId ${userId}). ` +
                     'This indicates a database consistency issue.'
             );
         }
@@ -308,7 +308,7 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
 
         if (!updated) {
             throw new Error(
-                'Failed to update organization user: Document not found after update. ' +
+                `Failed to update organization user: Document not found after update (userId ${userId}). ` +
                     'This indicates a database consistency issue.'
             );
         }