@friggframework/core 2.0.0--canary.654.e9530b8.0 → 2.0.0--canary.654.70623e2.0

package/core/CLAUDE.md

@@ -158,8 +158,9 @@ class MyIntegration extends Delegate {
 
 5. **Flush** (in `runInvocationScope`'s `finally`):
    ```javascript
-   // Usage rollup first (unbounded), then telemetry + log sinks in parallel
-   // under one deadline: min(flushTimeoutMs, remaining time - 50 ms).
+   // Telemetry + log sinks under one deadline, fixed at flush start:
+   // min(flushTimeoutMs, remaining time - 50 ms). The usage rollup runs in
+   // parallel with no bound of its own.
    ```
 
 ### SQS Job Processing Lifecycle

package/core/invocation-scope.js

@@ -128,9 +128,19 @@ async function flushInvocation({
     flushTimeoutMs,
     context,
 }) {
-    // ADR-048 §11: usage first and unbounded, then one deadline for the rest.
-    await flushUsageRollup(usageRollup, eventSummary, shouldUseDatabase);
+    // ADR-048 §11: the deadline is fixed at flush start. The usage rollup
+    // emits no telemetry, so it runs in parallel with no bound of its own.
+    const deadline = Math.min(
+        flushTimeoutMs,
+        remainingTimeMs(context) - FLUSH_MARGIN_MS
+    );
+    await Promise.all([
+        flushUsageRollup(usageRollup, eventSummary, shouldUseDatabase),
+        flushBounded(telemetry, deadline),
+    ]);
+}
 
+function flushBounded(telemetry, deadline) {
     const flushes = [];
     if (isTelemetryEnabled(telemetry)) {
         flushes.push((signal) => flushTelemetry(telemetry, { signal }));
@@ -138,14 +148,8 @@ async function flushInvocation({
     if (hasFlushableSinks()) {
         flushes.push((signal) => flushSinks({ signal }));
     }
-    if (!flushes.length) return;
-
-    const deadline = Math.min(
-        flushTimeoutMs,
-        remainingTimeMs(context) - FLUSH_MARGIN_MS
-    );
-    if (!(deadline > 0)) return;
-    await withDeadline(deadline, (signal) =>
+    if (!flushes.length || !(deadline > 0)) return undefined;
+    return withDeadline(deadline, (signal) =>
         Promise.allSettled(flushes.map((flush) => flush(signal)))
     );
 }

package/database/encryption/encryption-schema-registry.js

@@ -9,7 +9,7 @@
  */
 
 const { logger } = require('./logger');
-const { addDeniedKeys } = require('../../logs/redact');
+const { registerDeniedKeys } = require('../../logs/denied-keys');
 
 /**
  * Core encryption schema (immutable - cannot be overridden by custom schemas)
@@ -121,7 +121,7 @@ function registerCustomSchema(schema) {
     }
 
     customSchema = { ...schema };
-    addDeniedKeys(Object.values(schema).flatMap((config) => config.fields));
+    registerDeniedKeys(Object.values(schema).flatMap((config) => config.fields));
     logger.info(
         `Registered custom encryption schema for models: ${Object.keys(customSchema).join(', ')}`
     );
@@ -151,7 +151,7 @@ function extractCredentialFieldsFromModules(moduleDefinitions) {
         }
     }
 
-    addDeniedKeys(fields);
+    registerDeniedKeys(fields);
     return [...new Set(fields)];
 }
 

package/database/encryption/logger.js

@@ -17,9 +17,12 @@ class EncryptionLogger {
         this.minLevel = this._getMinLevel();
     }
 
+    // FRIGG_LOG_LEVEL also takes TRACE and FATAL (ADR-048); this logger has
+    // no such levels, so they map to its nearest ones.
     _getMinLevel() {
-        const level = process.env.FRIGG_LOG_LEVEL || 'INFO';
-        return LOG_LEVELS[level.toUpperCase()] ?? LOG_LEVELS.INFO;
+        const level = (process.env.FRIGG_LOG_LEVEL || 'INFO').trim().toUpperCase();
+        const mapped = { TRACE: 'DEBUG', FATAL: 'ERROR' }[level] ?? level;
+        return LOG_LEVELS[mapped] ?? LOG_LEVELS.INFO;
     }
 
     _shouldLog(level) {

package/handlers/app-definition-loader.js

@@ -2,8 +2,7 @@ const { findNearestBackendPackageJson } = require('@friggframework/core/utils');
 const path = require('node:path');
 const fs = require('fs-extra');
 const { resolveTelemetryConfig } = require('../telemetry/telemetry-config');
-const { addDeniedKeys } = require('../logs/redact');
-const { getLogger } = require('../logs');
+const { registerDeniedKeys } = require('../logs/denied-keys');
 const {
     extractCredentialFieldsFromModules,
 } = require('../database/encryption/encryption-schema-registry');
@@ -13,32 +12,18 @@ const {
 
 // Handlers without a database never load the encryption registry, so the
 // credential leaf keys are registered for redaction here too.
-const warnedIgnoredKeys = new Set();
-
-function warnIgnoredKeys(ignored) {
-    for (const key of ignored) {
-        if (warnedIgnoredKeys.has(key)) continue;
-        warnedIgnoredKeys.add(key);
-        getLogger('frigg.logger').warn(
-            'Credential field name is a record field; it stays visible in logs',
-            { eventName: 'frigg.logger.denied_key_ignored', key }
-        );
-    }
-}
-
 function registerCredentialLogKeys(appDefinition, integrations) {
     try {
-        const fields = extractCredentialFieldsFromModules(
+        extractCredentialFieldsFromModules(
             getModulesDefinitionFromIntegrationClasses(integrations)
         );
-        warnIgnoredKeys(addDeniedKeys(fields));
     } catch {
         // An odd integration shape must not stop the app from loading.
     }
     const schema = appDefinition.encryption?.schema;
     if (schema && typeof schema === 'object') {
         for (const config of Object.values(schema)) {
-            warnIgnoredKeys(addDeniedKeys(config?.fields));
+            registerDeniedKeys(config?.fields);
         }
     }
 }

package/handlers/backend-utils.js

@@ -1,4 +1,5 @@
 const { Router } = require('express');
+const { runInContext, LOGGER_SCOPE_KEY } = require('../logs/context');
 const { Worker } = require('@friggframework/core');
 const {
     IntegrationEventDispatcher,
@@ -19,6 +20,7 @@ const {
 const {
     getModulesDefinitionFromIntegrationClasses,
 } = require('../integrations/utils/map-integration-dto');
+const { processNotFound } = require('../integrations/use-cases/process-errors');
 
 const loadRouterFromObject = (IntegrationClass, routerObject) => {
     const router = Router();
@@ -37,12 +39,11 @@ const loadRouterFromObject = (IntegrationClass, routerObject) => {
             const dispatcher = new IntegrationEventDispatcher(
                 integrationInstance
             );
-            const result = await dispatcher.dispatchHttp({
-                event,
-                req,
-                res,
-                next,
-            });
+            // Logs only: a route :integrationId is unauthenticated input.
+            const result = await runInContext(
+                { [LOGGER_SCOPE_KEY]: { integrationId: req.params?.integrationId } },
+                () => dispatcher.dispatchHttp({ event, req, res, next })
+            );
             res.json(result);
         } catch (error) {
             next(error);
@@ -149,7 +150,7 @@ const loadIntegrationForProcess = async (processId, integrationClass) => {
     const process = await processRepository.findById(processId);
 
     if (!process) {
-        throw new Error(`Process not found: ${processId}`);
+        throw processNotFound(`Process not found: ${processId}`);
     }
 
     const instance = await getIntegrationInstance.execute(

package/handlers/routers/integration-webhook-routers.js

@@ -1,6 +1,7 @@
 const { createAppHandler } = require('./../app-handler-helpers');
 const { loadAppDefinition } = require('../app-definition-loader');
 const { Router } = require('express');
+const { runInContext, LOGGER_SCOPE_KEY } = require('../../logs/context');
 const {
     IntegrationEventDispatcher,
 } = require('../integration-event-dispatcher');
@@ -55,12 +56,18 @@ for (const IntegrationClass of integrationClasses) {
             const dispatcher = new IntegrationEventDispatcher(
                 integrationInstance
             );
-            await dispatcher.dispatchHttp({
-                event: 'WEBHOOK_RECEIVED',
-                req,
-                res,
-                next,
-            });
+            // Logs only: the id comes from an unauthenticated URL, so it must
+            // not reach the telemetry context that drives usage attribution.
+            await runInContext(
+                { [LOGGER_SCOPE_KEY]: { integrationId: req.params.integrationId } },
+                () =>
+                    dispatcher.dispatchHttp({
+                        event: 'WEBHOOK_RECEIVED',
+                        req,
+                        res,
+                        next,
+                    })
+            );
         } catch (error) {
             next(error);
         }

package/handlers/routers/websocket.js

@@ -1,5 +1,5 @@
 const { createHandler } = require('@friggframework/core');
-const { createWebsocketConnectionRepository } = require('../../database/websocket-connection-repository-factory');
+const { createWebsocketConnectionRepository } = require('../../websocket/repositories/websocket-connection-repository-factory');
 const { getLogger } = require('../../logs');
 
 const log = getLogger('frigg.websocket');

package/logs/context.js

@@ -77,8 +77,15 @@ function getLoggerScope() {
         for (const key of INTEGRATION_KEYS) {
             if (store[key] !== undefined) scope[key] = store[key];
         }
-        if (isPlainObject(store[LOGGER_SCOPE_KEY])) {
-            Object.assign(scope, store[LOGGER_SCOPE_KEY]);
+        // A set (hydrated) id beats a logger-only one, e.g. from a URL or a
+        // message body; a null id leaves the logger-only value in place.
+        const loggerKeys = store[LOGGER_SCOPE_KEY];
+        if (isPlainObject(loggerKeys)) {
+            for (const [key, value] of Object.entries(loggerKeys)) {
+                if (scope[key] === undefined || scope[key] === null) {
+                    scope[key] = value;
+                }
+            }
         }
         scope = Object.freeze(scope);
         scopeByStore.set(store, scope);

package/logs/denied-keys.js

@@ -0,0 +1,21 @@
+const { addDeniedKeys } = require('./redact');
+const { getLogger } = require('./logger');
+
+const warnedKeys = new Set();
+
+// addDeniedKeys plus one WARN per record-contract key it had to skip, so a
+// credential field named like a record field is visible wherever it is set.
+function registerDeniedKeys(keys) {
+    const ignored = addDeniedKeys(keys);
+    for (const key of ignored) {
+        if (warnedKeys.has(key)) continue;
+        warnedKeys.add(key);
+        getLogger('frigg.logger').warn(
+            'Credential field name is a record field; it stays visible in logs',
+            { eventName: 'frigg.logger.denied_key_ignored', key }
+        );
+    }
+    return ignored;
+}
+
+module.exports = { registerDeniedKeys };

package/logs/record.js

@@ -84,6 +84,15 @@ function traceFields(spanContext) {
     };
 }
 
+function sameValue(a, b) {
+    if (a === b) return true;
+    return (
+        typeof a === 'object' &&
+        typeof b === 'object' &&
+        JSON.stringify(a) === JSON.stringify(b)
+    );
+}
+
 function byteLength(record) {
     return Buffer.byteLength(JSON.stringify(record));
 }
@@ -182,7 +191,8 @@ function buildRecord({
                     isPlainObject(value)
                 ) {
                     record[key] = extendInvocation(record[key], value);
-                } else {
+                } else if (!sameValue(record[key], value)) {
+                    // A repeat of the winning value is no conflict.
                     dropped.add(key);
                 }
                 continue;

package/logs/summarize-event.js

@@ -1,14 +1,15 @@
 const { redactUrl } = require('./redact');
 
 // Best-effort extraction of the logical event/processId/integrationId from a
-// JSON message body. Used only for log correlation. Never throws.
+// JSON message body: `data.*` first, then the top level. Used only for log
+// correlation. Never throws.
 function summarizeMessageBody(bodyStr) {
     try {
         const parsed = JSON.parse(bodyStr);
         return {
             event: parsed?.event,
-            processId: parsed?.data?.processId,
-            integrationId: parsed?.data?.integrationId,
+            processId: parsed?.data?.processId ?? parsed?.processId,
+            integrationId: parsed?.data?.integrationId ?? parsed?.integrationId,
         };
     } catch {
         return {};

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.654.e9530b8.0",
+    "version": "2.0.0--canary.654.70623e2.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -47,9 +47,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.654.e9530b8.0",
-        "@friggframework/prettier-config": "2.0.0--canary.654.e9530b8.0",
-        "@friggframework/test": "2.0.0--canary.654.e9530b8.0",
+        "@friggframework/eslint-config": "2.0.0--canary.654.70623e2.0",
+        "@friggframework/prettier-config": "2.0.0--canary.654.70623e2.0",
+        "@friggframework/test": "2.0.0--canary.654.70623e2.0",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -89,5 +89,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "e9530b84cdbe42939e8061edc241acb55222cf34"
+    "gitHead": "70623e2fbe9d93afb370528085ea543c784775c4"
 }

package/user/repositories/user-repository-documentdb.js

@@ -274,7 +274,7 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
         // Defensive check: verify document was found after update
         if (!updated) {
             throw new Error(
-                'Failed to update individual user: Document not found after update. ' +
+                `Failed to update individual user: Document not found after update (userId ${userId}). ` +
                     'This indicates a database consistency issue.'
             );
         }
@@ -308,7 +308,7 @@ class UserRepositoryDocumentDB extends UserRepositoryInterface {
 
         if (!updated) {
             throw new Error(
-                'Failed to update organization user: Document not found after update. ' +
+                `Failed to update organization user: Document not found after update (userId ${userId}). ` +
                     'This indicates a database consistency issue.'
             );
         }