@friggframework/core 2.0.0--canary.654.e9530b8.0 → 2.0.0--canary.654.0c31bb1.0

package/core/CLAUDE.md

@@ -158,8 +158,9 @@ class MyIntegration extends Delegate {
 
 5. **Flush** (in `runInvocationScope`'s `finally`):
    ```javascript
-   // Usage rollup first (unbounded), then telemetry + log sinks in parallel
-   // under one deadline: min(flushTimeoutMs, remaining time - 50 ms).
+   // Telemetry + log sinks under one deadline, fixed at flush start:
+   // min(flushTimeoutMs, remaining time - 50 ms). The usage rollup runs in
+   // parallel with no bound of its own.
    ```
 
 ### SQS Job Processing Lifecycle

package/core/invocation-scope.js

@@ -128,9 +128,19 @@ async function flushInvocation({
     flushTimeoutMs,
     context,
 }) {
-    // ADR-048 §11: usage first and unbounded, then one deadline for the rest.
-    await flushUsageRollup(usageRollup, eventSummary, shouldUseDatabase);
+    // ADR-048 §11: the deadline is fixed at flush start. The usage rollup
+    // emits no telemetry, so it runs in parallel with no bound of its own.
+    const deadline = Math.min(
+        flushTimeoutMs,
+        remainingTimeMs(context) - FLUSH_MARGIN_MS
+    );
+    await Promise.all([
+        flushUsageRollup(usageRollup, eventSummary, shouldUseDatabase),
+        flushBounded(telemetry, deadline),
+    ]);
+}
 
+function flushBounded(telemetry, deadline) {
     const flushes = [];
     if (isTelemetryEnabled(telemetry)) {
         flushes.push((signal) => flushTelemetry(telemetry, { signal }));
@@ -138,14 +148,8 @@ async function flushInvocation({
     if (hasFlushableSinks()) {
         flushes.push((signal) => flushSinks({ signal }));
     }
-    if (!flushes.length) return;
-
-    const deadline = Math.min(
-        flushTimeoutMs,
-        remainingTimeMs(context) - FLUSH_MARGIN_MS
-    );
-    if (!(deadline > 0)) return;
-    await withDeadline(deadline, (signal) =>
+    if (!flushes.length || !(deadline > 0)) return undefined;
+    return withDeadline(deadline, (signal) =>
         Promise.allSettled(flushes.map((flush) => flush(signal)))
     );
 }

package/database/encryption/encryption-schema-registry.js

@@ -9,7 +9,7 @@
  */
 
 const { logger } = require('./logger');
-const { addDeniedKeys } = require('../../logs/redact');
+const { registerDeniedKeys } = require('../../logs/denied-keys');
 
 /**
  * Core encryption schema (immutable - cannot be overridden by custom schemas)
@@ -121,7 +121,7 @@ function registerCustomSchema(schema) {
     }
 
     customSchema = { ...schema };
-    addDeniedKeys(Object.values(schema).flatMap((config) => config.fields));
+    registerDeniedKeys(Object.values(schema).flatMap((config) => config.fields));
     logger.info(
         `Registered custom encryption schema for models: ${Object.keys(customSchema).join(', ')}`
     );
@@ -151,7 +151,7 @@ function extractCredentialFieldsFromModules(moduleDefinitions) {
         }
     }
 
-    addDeniedKeys(fields);
+    registerDeniedKeys(fields);
     return [...new Set(fields)];
 }
 

package/database/encryption/logger.js

@@ -17,9 +17,12 @@ class EncryptionLogger {
         this.minLevel = this._getMinLevel();
     }
 
+    // FRIGG_LOG_LEVEL also takes TRACE and FATAL (ADR-048); this logger has
+    // no such levels, so they map to its nearest ones.
     _getMinLevel() {
-        const level = process.env.FRIGG_LOG_LEVEL || 'INFO';
-        return LOG_LEVELS[level.toUpperCase()] ?? LOG_LEVELS.INFO;
+        const level = (process.env.FRIGG_LOG_LEVEL || 'INFO').trim().toUpperCase();
+        const mapped = { TRACE: 'DEBUG', FATAL: 'ERROR' }[level] ?? level;
+        return LOG_LEVELS[mapped] ?? LOG_LEVELS.INFO;
     }
 
     _shouldLog(level) {

package/handlers/app-definition-loader.js

@@ -2,8 +2,7 @@ const { findNearestBackendPackageJson } = require('@friggframework/core/utils');
 const path = require('node:path');
 const fs = require('fs-extra');
 const { resolveTelemetryConfig } = require('../telemetry/telemetry-config');
-const { addDeniedKeys } = require('../logs/redact');
-const { getLogger } = require('../logs');
+const { registerDeniedKeys } = require('../logs/denied-keys');
 const {
     extractCredentialFieldsFromModules,
 } = require('../database/encryption/encryption-schema-registry');
@@ -13,32 +12,18 @@ const {
 
 // Handlers without a database never load the encryption registry, so the
 // credential leaf keys are registered for redaction here too.
-const warnedIgnoredKeys = new Set();
-
-function warnIgnoredKeys(ignored) {
-    for (const key of ignored) {
-        if (warnedIgnoredKeys.has(key)) continue;
-        warnedIgnoredKeys.add(key);
-        getLogger('frigg.logger').warn(
-            'Credential field name is a record field; it stays visible in logs',
-            { eventName: 'frigg.logger.denied_key_ignored', key }
-        );
-    }
-}
-
 function registerCredentialLogKeys(appDefinition, integrations) {
     try {
-        const fields = extractCredentialFieldsFromModules(
+        extractCredentialFieldsFromModules(
             getModulesDefinitionFromIntegrationClasses(integrations)
         );
-        warnIgnoredKeys(addDeniedKeys(fields));
     } catch {
         // An odd integration shape must not stop the app from loading.
     }
     const schema = appDefinition.encryption?.schema;
     if (schema && typeof schema === 'object') {
         for (const config of Object.values(schema)) {
-            warnIgnoredKeys(addDeniedKeys(config?.fields));
+            registerDeniedKeys(config?.fields);
         }
     }
 }

package/handlers/routers/websocket.js

@@ -1,5 +1,5 @@
 const { createHandler } = require('@friggframework/core');
-const { createWebsocketConnectionRepository } = require('../../database/websocket-connection-repository-factory');
+const { createWebsocketConnectionRepository } = require('../../websocket/repositories/websocket-connection-repository-factory');
 const { getLogger } = require('../../logs');
 
 const log = getLogger('frigg.websocket');

package/logs/denied-keys.js

@@ -0,0 +1,21 @@
+const { addDeniedKeys } = require('./redact');
+const { getLogger } = require('./logger');
+
+const warnedKeys = new Set();
+
+// addDeniedKeys plus one WARN per record-contract key it had to skip, so a
+// credential field named like a record field is visible wherever it is set.
+function registerDeniedKeys(keys) {
+    const ignored = addDeniedKeys(keys);
+    for (const key of ignored) {
+        if (warnedKeys.has(key)) continue;
+        warnedKeys.add(key);
+        getLogger('frigg.logger').warn(
+            'Credential field name is a record field; it stays visible in logs',
+            { eventName: 'frigg.logger.denied_key_ignored', key }
+        );
+    }
+    return ignored;
+}
+
+module.exports = { registerDeniedKeys };

package/logs/record.js

@@ -84,6 +84,15 @@ function traceFields(spanContext) {
     };
 }
 
+function sameValue(a, b) {
+    if (a === b) return true;
+    return (
+        typeof a === 'object' &&
+        typeof b === 'object' &&
+        JSON.stringify(a) === JSON.stringify(b)
+    );
+}
+
 function byteLength(record) {
     return Buffer.byteLength(JSON.stringify(record));
 }
@@ -182,7 +191,8 @@ function buildRecord({
                     isPlainObject(value)
                 ) {
                     record[key] = extendInvocation(record[key], value);
-                } else {
+                } else if (!sameValue(record[key], value)) {
+                    // A repeat of the winning value is no conflict.
                     dropped.add(key);
                 }
                 continue;

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.654.e9530b8.0",
+    "version": "2.0.0--canary.654.0c31bb1.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -47,9 +47,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.654.e9530b8.0",
-        "@friggframework/prettier-config": "2.0.0--canary.654.e9530b8.0",
-        "@friggframework/test": "2.0.0--canary.654.e9530b8.0",
+        "@friggframework/eslint-config": "2.0.0--canary.654.0c31bb1.0",
+        "@friggframework/prettier-config": "2.0.0--canary.654.0c31bb1.0",
+        "@friggframework/test": "2.0.0--canary.654.0c31bb1.0",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -89,5 +89,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "e9530b84cdbe42939e8061edc241acb55222cf34"
+    "gitHead": "0c31bb15ef0497cc321c4d2103a752de6449d234"
 }

package/user/repositories/user-repository-documentdb.js

@@ -274,7 +274,7 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
         // Defensive check: verify document was found after update
         if (!updated) {
             throw new Error(
-                'Failed to update individual user: Document not found after update. ' +
+                `Failed to update individual user: Document not found after update (userId ${userId}). ` +
                     'This indicates a database consistency issue.'
             );
         }
@@ -308,7 +308,7 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
 
         if (!updated) {
             throw new Error(
-                'Failed to update organization user: Document not found after update. ' +
+                `Failed to update organization user: Document not found after update (userId ${userId}). ` +
                     'This indicates a database consistency issue.'
             );
         }