@friggframework/core 2.0.0--canary.686.df38e8e.0 → 2.0.0--canary.710.9045bbc.0

package/database/encryption/documentdb-encryption-service.md

@@ -225,84 +225,7 @@ Database (ENCRYPTED STORAGE) ✅ SECURE
 1. **Consistency**: Same encryption format and Cryptor as Prisma Extension
 2. **Reusability**: Single service used by all DocumentDB repositories
 3. **Schema-Driven**: Uses `encryption-schema-registry.js` (same as Prisma)
-4. **Fails Closed**: Same rule as the Prisma client; a deployed runtime with no key throws, only local runs skip encryption
-5. **Error-Tolerant**: Graceful handling of decryption failures
-6. **Testable**: Can be unit tested independently of repositories
-
----
-
-## Technical Specification
-
-### Class Design
-
-```javascript
-/**
- * Encryption service specifically for DocumentDB repositories
- * that use $runCommandRaw and bypass Prisma Extensions.
- *
- * Provides document-level encryption/decryption,
- * handling nested fields according to the encryption schema registry.
- */
-class DocumentDBEncryptionService {
-    constructor()
-    _initializeCryptor()
-    async encryptFields(modelName, document)
-    async decryptFields(modelName, document)
-    async _encryptFieldPath(document, fieldPath, modelName)
-    async _decryptFieldPath(document, fieldPath, modelName)
-    _isEncryptedValue(value)
-}
-```
-
-### Method Specifications
-
-#### `constructor()`
-
-**Purpose**: Initialize the service and configure Cryptor
-
-**Behavior**:
-
--   Calls `_initializeCryptor()` immediately
--   Sets up `this.cryptor` and `this.enabled` properties
-
-**No parameters**
-
----
-
-#### `_initializeCryptor()`
-
-**Purpose**: Initialize Cryptor with environment-based configuration
-
-**Logic**:
-
-```javascript
-1. loadCustomEncryptionSchema()
-2. config = getEncryptionConfig()   // encryption/encryption-config.js, shared with the Prisma client
-   - throws EncryptionConfigurationError in a deployed runtime with no key
-3. If !config.enabled (local dev/test/local stage, local run without keys,
-   or FRIGG_ENCRYPTION_DISABLED=true opt-out):
-   - Set this.cryptor = null
-   - Set this.enabled = false
-   - Return
-4. Create Cryptor({ shouldUseAws: config.method === 'kms' })
-5. Set this.enabled = true
-```
-
-**Environment Variables Used** (see "When Encryption Runs" in README.md):
-
--   `AWS_LAMBDA_FUNCTION_NAME` / `LAMBDA_TASK_ROOT` / `AWS_EXECUTION_ENV=AWS_Lambda_*`, or a non-`aws` `FRIGG_PROVIDER`, minus `IS_OFFLINE` / `IS_LOCAL` / `NETLIFY_DEV` / `JEST_WORKER_ID`: deployed or local run
--   `STAGE` or `NODE_ENV`: dev/test/local skip encryption on local runs only
--   `KMS_KEY_ARN`: AWS KMS key ARN (enables KMS encryption)
--   `AES_KEY_ID`: AES key identifier (enables AES encryption)
--   `AES_KEY`: AES encryption key (required with AES_KEY_ID in a deployed runtime)
--   `FRIGG_ENCRYPTION_DISABLED`: explicit plaintext opt-out for a deployed stage with no key
-
-### Design Principles
-
-1. **Consistency**: Same encryption format and Cryptor as Prisma Extension
-2. **Reusability**: Single service used by all DocumentDB repositories
-3. **Schema-Driven**: Uses `encryption-schema-registry.js` (same as Prisma)
-4. **Fails Closed**: Same rule as the Prisma client; a deployed runtime with no key throws, only local runs skip encryption
+4. **Environment-Aware**: Respects STAGE-based bypass (dev/test/local)
 5. **Error-Tolerant**: Graceful handling of decryption failures
 6. **Testable**: Can be unit tested independently of repositories
 

package/database/encryption/encryption-schema-registry.js

@@ -10,11 +10,6 @@
 
 const { logger } = require('./logger');
 const { registerDeniedKeys } = require('../../logs/denied-keys');
-const {
-    getEntityTypeRegistry,
-    getEntityTypeDefinitions,
-    EntityRegistryError,
-} = require('../../modules/entity-type-registry');
 
 /**
  * Core encryption schema (immutable - cannot be overridden by custom schemas)
@@ -44,12 +39,6 @@ const CORE_ENCRYPTION_SCHEMA = {
     Token: {
         fields: ['token'],
     },
-
-    // Multi-step authorization (Management API v2): earlier steps can collect
-    // emails, usernames or one-time codes.
-    AuthorizationSession: {
-        fields: ['stepData'],
-    },
 };
 
 let customSchema = {};
@@ -171,9 +160,8 @@ function extractCredentialFieldsFromModules(moduleDefinitions) {
  * Each module can declare credentialFields to encrypt in its encryption config.
  *
  * @param {Array} integrations - Array of integration classes with modules
- * @param {object} [entities] - `appDefinition.entities` (ADR-059 registry)
  */
-function loadModuleEncryptionSchemas(integrations, entities) {
+function loadModuleEncryptionSchemas(integrations) {
     if (!integrations) {
         throw new Error('integrations parameter is required');
     }
@@ -182,42 +170,50 @@ function loadModuleEncryptionSchemas(integrations, entities) {
         throw new Error('integrations must be an array');
     }
 
-    // `entities` is the app definition's registry (ADR-059): a module an app
-    // registers without any integration still carries credentials to encrypt.
-    if (integrations.length === 0 && !entities) {
+    if (integrations.length === 0) {
         return;
     }
 
-    const moduleDefinitions = getEntityTypeDefinitions(
-        getEntityTypeRegistry({ integrations, entities })
+    const { getModulesDefinitionFromIntegrationClasses } = require('../../integrations/utils/map-integration-dto');
+
+    // Integrations without modules contribute no credential fields.
+    const integrationsWithModules = integrations.filter(
+        (integration) => integration?.Definition?.modules
     );
-    const credentialFields = extractCredentialFieldsFromModules(moduleDefinitions);
-
-    // Core fields are encrypted already and a custom schema may not repeat
-    // them. Everything the app registered itself stays: module fields are added
-    // to the custom schema, never substituted for it (other models included).
-    const coreFields = new Set(CORE_ENCRYPTION_SCHEMA.Credential?.fields || []);
-    const fields = [
-        ...new Set([
-            ...(customSchema.Credential?.fields || []),
-            ...credentialFields.filter((field) => !coreFields.has(field)),
-        ]),
-    ];
-
-    if (fields.length === 0) {
+    const moduleDefinitions = getModulesDefinitionFromIntegrationClasses(
+        integrationsWithModules
+    );
+
+    // Fields the core schema already encrypts (e.g. data.api_key) are
+    // covered; registering them again would fail validation and drop every
+    // other module field with them.
+    const coreCredentialFields = CORE_ENCRYPTION_SCHEMA.Credential.fields;
+    const credentialFields = extractCredentialFieldsFromModules(
+        moduleDefinitions
+    ).filter((field) => !coreCredentialFields.includes(field));
+
+    if (credentialFields.length === 0) {
         return;
     }
 
-    const moduleSchema = {
+    // Merge with whatever custom schema the app already registered rather
+    // than replacing it (registerCustomSchema overwrites).
+    const existingCredentialFields = customSchema.Credential?.fields || [];
+    const mergedSchema = {
         ...customSchema,
-        Credential: { ...customSchema.Credential, fields },
+        Credential: {
+            ...customSchema.Credential,
+            fields: [
+                ...new Set([...existingCredentialFields, ...credentialFields]),
+            ],
+        },
     };
 
     logger.info(
-        `Registering module-level encryption for ${fields.length} credential fields`
+        `Registering module-level encryption for ${credentialFields.length} credential fields`
     );
 
-    registerCustomSchema(moduleSchema);
+    registerCustomSchema(mergedSchema);
 }
 
 /**
@@ -229,80 +225,22 @@ function loadModuleEncryptionSchemas(integrations, entities) {
  *
  * Used by both Prisma (MongoDB/PostgreSQL) and DocumentDB encryption services.
  */
-/**
- * Registers encryption schemas declared by app-level extensions
- * (`appDefinition.coreExtensions[].encryption`), e.g. the db-credentials
- * extension's `OAuthAppCredential.clientSecret`.
- *
- * @param {Array<Object>} extensions - Normalized extensions (extension-loader)
- */
-function loadExtensionEncryptionSchemas(extensions) {
-    if (!extensions || !Array.isArray(extensions) || extensions.length === 0) {
-        return;
-    }
-
-    for (const ext of extensions) {
-        if (!ext.encryption || typeof ext.encryption !== 'object') {
-            continue;
-        }
-
-        const schema = {};
-        for (const [modelName, config] of Object.entries(ext.encryption)) {
-            if (config && Array.isArray(config.fields) && config.fields.length > 0) {
-                schema[modelName] = { fields: config.fields };
-            }
-        }
+function loadCustomEncryptionSchema() {
+    try {
+        // Lazy require to avoid circular dependency issues
+        const path = require('node:path');
+        const { findNearestBackendPackageJson } = require('../../utils');
 
-        if (Object.keys(schema).length > 0) {
-            logger.info(
-                `Registering encryption schema from extension "${ext.name}" for models: ${Object.keys(schema).join(', ')}`
-            );
-            // registerCustomSchema replaces the registered schema, so merge:
-            // an extension adds its models to the app's encryption.schema
-            // rather than dropping it.
-            const merged = { ...customSchema };
-            for (const [modelName, config] of Object.entries(schema)) {
-                const existing = merged[modelName]?.fields || [];
-                merged[modelName] = {
-                    ...merged[modelName],
-                    fields: [...new Set([...existing, ...config.fields])],
-                };
-            }
-            registerCustomSchema(merged);
+        const backendPackagePath = findNearestBackendPackageJson();
+        if (!backendPackagePath) {
+            return; // No backend found, skip custom schema
         }
-    }
-}
 
-function readAppDefinitionForEncryption() {
-    // Lazy require to avoid circular dependency issues
-    const {
-        getPresetAppDefinition,
-    } = require('../../handlers/app-definition-loader');
-    // A definition preset with setAppDefinition() (provider-netlify's
-    // preamble) wins: on Netlify process.cwd() cannot find the backend.
-    const preset = getPresetAppDefinition();
-    if (preset) {
-        return preset;
-    }
-
-    const path = require('node:path');
-    const { findNearestBackendPackageJson } = require('../../utils');
-
-    const backendPackagePath = findNearestBackendPackageJson();
-    if (!backendPackagePath) {
-        return null; // No backend found, skip custom schema
-    }
+        const backendDir = path.dirname(backendPackagePath);
+        const backendIndexPath = path.join(backendDir, 'index.js');
 
-    const backendDir = path.dirname(backendPackagePath);
-    const backendIndexPath = path.join(backendDir, 'index.js');
-
-    const backendModule = require(backendIndexPath);
-    return backendModule?.Definition || null;
-}
-
-function loadCustomEncryptionSchema() {
-    try {
-        const appDefinition = readAppDefinitionForEncryption();
+        const backendModule = require(backendIndexPath);
+        const appDefinition = backendModule?.Definition;
 
         if (!appDefinition) {
             return; // No app definition found
@@ -322,26 +260,12 @@ function loadCustomEncryptionSchema() {
             registerEncryptionOptOut(disable);
         }
 
-        // Load app-level extension encryption schemas. Before the module
-        // schemas: loadModuleEncryptionSchemas currently throws (see the
-        // NOTE inside it) and the throw would skip anything after it.
-        const { loadExtensions } = require('../../extensions/extension-loader');
-        const extensions = loadExtensions(appDefinition);
-        if (extensions.length > 0) {
-            loadExtensionEncryptionSchemas(extensions);
-        }
-
         // Load module-level encryption schemas from integrations
         const integrations = appDefinition.integrations;
-        if (Array.isArray(integrations) || appDefinition.entities) {
-            loadModuleEncryptionSchemas(
-                Array.isArray(integrations) ? integrations : [],
-                appDefinition.entities
-            );
+        if (integrations && Array.isArray(integrations)) {
+            loadModuleEncryptionSchemas(integrations);
         }
     } catch (error) {
-        // A bad entity registry is a configuration error, not "no custom schema".
-        if (error instanceof EntityRegistryError) throw error;
         // Silently ignore errors - custom schema is optional
         // This handles cases like:
         // - Backend package.json not found (tests, standalone usage)
@@ -492,7 +416,6 @@ module.exports = {
     registerEncryptionOptOut,
     loadCustomEncryptionSchema,
     loadModuleEncryptionSchemas,
-    loadExtensionEncryptionSchemas,
     extractCredentialFieldsFromModules,
     validateCustomSchema,
     validateOptOut,

package/database/encryption/field-encryption-service.js

@@ -4,41 +4,8 @@
  * Infrastructure layer service that orchestrates field-level encryption/decryption.
  * Handles nested JSON paths (e.g., 'data.access_token') and bulk operations.
  */
-const { logger } = require('./logger');
-const { isDeployedRuntime } = require('./encryption-config');
-
-/**
- * Thrown when a value that looks like ciphertext cannot be decrypted in a
- * deployed runtime (a wrong, rotated or missing key). Returning the stored
- * ciphertext would hand it to API modules as if it were a token.
- */
-class FieldDecryptionError extends Error {
-    constructor(message, options) {
-        super(message, options);
-        this.name = 'FieldDecryptionError';
-    }
-}
-
-// Cryptor.encrypt() returns `${keyId}:${iv}:${ciphertext}:${encryptedKey}`:
-// keyId and encryptedKey are base64, iv is 16 bytes of hex, ciphertext is hex.
-// Plaintext with three colons (`https://user:pw@host:443`, `a:b:c:d`) must not
-// be mistaken for it.
-const BASE64_PART = /^[A-Za-z0-9+/]+={0,2}$/;
-const IV_PART = /^[0-9a-f]{32}$/i;
-const CIPHERTEXT_PART = /^(?:[0-9a-f]{2})+$/i;
-
 class FieldEncryptionService {
-    /**
-     * @param {Object} params
-     * @param {Object} params.cryptor
-     * @param {Object} params.schema
-     * @param {() => boolean} [params.failClosedOnDecryptError] - whether a
-     *   ciphertext-shaped value that fails to decrypt throws. Defaults to
-     *   "running deployed" (encryption-config's isDeployedRuntime), read on
-     *   each failure. Locally such a value is returned as stored, with a
-     *   warning.
-     */
-    constructor({ cryptor, schema, failClosedOnDecryptError }) {
+    constructor({ cryptor, schema }) {
         if (!cryptor) {
             throw new Error('Cryptor instance required');
         }
@@ -48,10 +15,6 @@ class FieldEncryptionService {
 
         this.cryptor = cryptor;
         this.schema = schema;
-        this.failClosedOnDecryptError =
-            typeof failClosedOnDecryptError === 'function'
-                ? failClosedOnDecryptError
-                : () => isDeployedRuntime();
     }
 
     /**
@@ -134,33 +97,12 @@ class FieldEncryptionService {
         const decryptionPromises = fields.map(async (fieldPath) => {
             const value = this._getNestedValue(decrypted, fieldPath);
 
-            if (!this._isEncrypted(value)) {
-                return null;
-            }
-            try {
+            if (this._isEncrypted(value)) {
                 const decryptedValue = await this.cryptor.decrypt(value);
                 const deserializedValue = this._deserializeAfterDecryption(decryptedValue);
                 return { fieldPath, decryptedValue: deserializedValue };
-            } catch (error) {
-                // Deployed: a ciphertext-shaped value under a wrong, rotated or
-                // missing key fails the read rather than reaching an API
-                // module as a token. Legacy plaintext never gets here: it does
-                // not look like ciphertext (_isEncrypted).
-                if (this.failClosedOnDecryptError()) {
-                    throw new FieldDecryptionError(
-                        `Could not decrypt ${modelName}.${fieldPath}`,
-                        { cause: error }
-                    );
-                }
-                // Local: a value that looks like ciphertext but is not is read
-                // as it is stored. One such field must not fail the whole
-                // read, findMany included.
-                logger.warn(
-                    `Could not decrypt ${modelName}.${fieldPath}; returning the stored value`,
-                    { errorName: error?.name }
-                );
-                return null;
             }
+            return null;
         });
 
         const results = await Promise.all(decryptionPromises);
@@ -210,13 +152,7 @@ class FieldEncryptionService {
         }
 
         const parts = value.split(':');
-        return (
-            parts.length === 4 &&
-            BASE64_PART.test(parts[0]) &&
-            IV_PART.test(parts[1]) &&
-            CIPHERTEXT_PART.test(parts[2]) &&
-            BASE64_PART.test(parts[3])
-        );
+        return parts.length >= 4;
     }
 
     _getNestedValue(obj, path) {
@@ -315,4 +251,4 @@ class FieldEncryptionService {
     }
 }
 
-module.exports = { FieldEncryptionService, FieldDecryptionError };
+module.exports = { FieldEncryptionService };

package/database/encryption/integration-mapping-encryption.js

@@ -1,4 +1,4 @@
-const { getEncryptionConfig } = require('./encryption-config');
+const { getEncryptionConfig } = require('../prisma');
 const { Cryptor } = require('../../encrypt/Cryptor');
 const {
     getFieldsToDecryptOnRead,

package/database/prisma.js

@@ -4,7 +4,6 @@ const {
 const { loadCustomEncryptionSchema } = require('./encryption/encryption-schema-registry');
 const { logger } = require('./encryption/logger');
 const { Cryptor } = require('../encrypt/Cryptor');
-const { getEncryptionConfig } = require('./encryption/encryption-config');
 const config = require('./config');
 
 /**
@@ -33,6 +32,33 @@ function ensureMongoDbUrl() {
     );
 }
 
+function getEncryptionConfig() {
+    const STAGE = process.env.STAGE || process.env.NODE_ENV || 'development';
+    const shouldBypassEncryption = ['dev', 'test', 'local'].includes(STAGE);
+
+    if (shouldBypassEncryption) {
+        return { enabled: false };
+    }
+
+    const hasKMS =
+        process.env.KMS_KEY_ARN && process.env.KMS_KEY_ARN.trim() !== '';
+    const hasAES =
+        process.env.AES_KEY_ID && process.env.AES_KEY_ID.trim() !== '';
+
+    if (!hasKMS && !hasAES) {
+        logger.warn(
+            'No encryption keys configured (KMS_KEY_ARN or AES_KEY_ID). ' +
+            'Field-level encryption disabled. Set STAGE=production and configure keys to enable.'
+        );
+        return { enabled: false };
+    }
+
+    return {
+        enabled: true,
+        method: hasKMS ? 'kms' : 'aes',
+    };
+}
+
 const prismaClientSingleton = () => {
     let PrismaClient;
 
@@ -41,15 +67,13 @@ const prismaClientSingleton = () => {
         const paths = [
             // Lambda layer location (when using Prisma Lambda layer)
             `/opt/nodejs/node_modules/generated/prisma-${dbType}`,
-            // __dirname-based absolute path (Netlify functions and bundlers)
-            require('node:path').resolve(__dirname, `../generated/prisma-${dbType}`),
             // Local development location (relative to core package)
             `../generated/prisma-${dbType}`,
         ];
 
-        for (const candidate of paths) {
+        for (const path of paths) {
             try {
-                return require(candidate).PrismaClient;
+                return require(path).PrismaClient;
             } catch (err) {
                 // Continue to next path
             }
@@ -79,13 +103,9 @@ const prismaClientSingleton = () => {
         errorFormat: 'pretty',
     });
 
-    // Throws when a deployed runtime has no encryption key: the app must not
-    // start and write sensitive fields in plaintext.
     const encryptionConfig = getEncryptionConfig();
 
     if (encryptionConfig.enabled) {
-        // Fail closed: if the extension cannot be installed, do not hand out
-        // a client that would write plaintext.
         try {
             // Load custom encryption schema from appDefinition before creating extension
             loadCustomEncryptionSchema();
@@ -100,14 +120,17 @@ const prismaClientSingleton = () => {
                     enabled: true,
                 })
             );
+
+            logger.info(
+                `Field-level encryption enabled using ${encryptionConfig.method.toUpperCase()}`
+            );
         } catch (error) {
-            logger.error('Failed to initialize encryption extension:', error);
-            throw error;
+            logger.error(
+                'Failed to initialize encryption extension:',
+                error
+            );
+            logger.warn('Continuing without encryption...');
         }
-
-        logger.info(
-            `Field-level encryption enabled using ${encryptionConfig.method.toUpperCase()}`
-        );
     } else {
         logger.info('Field-level encryption disabled');
     }

package/database/use-cases/check-encryption-health-use-case.js

@@ -1,12 +1,3 @@
-const {
-    resolveEncryptionConfig,
-    OPT_OUT_VAR,
-} = require('../encryption/encryption-config');
-
-/**
- * Reports whether field-level encryption is on and working, using the same
- * rule the Prisma client applies at startup (encryption/encryption-config.js).
- */
 class CheckEncryptionHealthUseCase {
     constructor({ testEncryptionUseCase }) {
         this.testEncryptionUseCase = testEncryptionUseCase;
@@ -14,60 +5,78 @@ class CheckEncryptionHealthUseCase {
 
     async execute() {
         const config = this._getEncryptionConfiguration();
-        const summary = {
-            mode: config.mode,
-            bypassed: config.bypassed,
-            optedOut: config.optedOut,
-            runtime: config.runtime,
-            stage: config.stage,
-            debug: {
-                hasKMS: config.hasKMS,
-                hasAES: config.hasAES,
-            },
-        };
 
-        if (config.error) {
-            return {
-                status: 'unhealthy',
-                ...summary,
-                testResult: config.error,
-                encryptionWorks: false,
-            };
-        }
+        if (config.isBypassed || config.mode === 'none') {
+            const testResult = config.isBypassed
+                ? 'Encryption bypassed for this stage'
+                : 'No encryption keys configured';
 
-        if (!config.enabled) {
             return {
                 status: 'disabled',
-                ...summary,
-                testResult: this._disabledReason(config),
+                mode: config.mode,
+                bypassed: config.isBypassed,
+                stage: config.stage,
+                testResult,
                 encryptionWorks: false,
+                debug: {
+                    hasKMS: config.hasKMS,
+                    hasAES: config.hasAES,
+                },
             };
         }
 
         try {
             const testResults = await this.testEncryptionUseCase.execute();
-            return { ...testResults, ...summary };
+
+            return {
+                ...testResults,
+                mode: config.mode,
+                bypassed: config.isBypassed,
+                stage: config.stage,
+                debug: {
+                    hasKMS: config.hasKMS,
+                    hasAES: config.hasAES,
+                },
+            };
         } catch (error) {
             return {
                 status: 'unhealthy',
-                ...summary,
+                mode: config.mode,
+                bypassed: config.isBypassed,
+                stage: config.stage,
                 testResult: `Encryption test failed: ${error.message}`,
                 encryptionWorks: false,
+                debug: {
+                    hasKMS: config.hasKMS,
+                    hasAES: config.hasAES,
+                },
             };
         }
     }
 
-    _disabledReason(config) {
-        if (config.bypassed) return 'Encryption bypassed for this stage';
-        if (config.optedOut) {
-            return `Encryption explicitly disabled (${OPT_OUT_VAR}=true); sensitive fields are stored in plaintext`;
-        }
-        return 'No encryption keys configured';
-    }
-
     _getEncryptionConfiguration() {
-        const config = resolveEncryptionConfig(process.env);
-        return { ...config, stage: process.env.STAGE || null };
+        const { STAGE, BYPASS_ENCRYPTION_STAGE, KMS_KEY_ARN, AES_KEY_ID } =
+            process.env;
+
+        const defaultBypassStages = ['dev', 'test', 'local'];
+        const useEnv = BYPASS_ENCRYPTION_STAGE !== undefined;
+        const bypassStages = useEnv
+            ? BYPASS_ENCRYPTION_STAGE.split(',').map((s) => s.trim())
+            : defaultBypassStages;
+
+        const isBypassed = bypassStages.includes(STAGE);
+        const hasAES = AES_KEY_ID && AES_KEY_ID.trim() !== '';
+        const hasKMS = KMS_KEY_ARN && KMS_KEY_ARN.trim() !== '';
+        // Prefer KMS over AES when both are configured (KMS is more secure)
+        const mode = hasKMS ? 'kms' : hasAES ? 'aes' : 'none';
+
+        return {
+            stage: STAGE || null,
+            isBypassed,
+            hasAES,
+            hasKMS,
+            mode,
+        };
     }
 }
 

package/errors/index.js

@@ -6,6 +6,9 @@ const {
     ParameterTypeError,
 } = require('./validation-errors');
 const { ClientSafeError } = require('./client-safe-error');
+const {
+    MappingAlreadyExistsError,
+} = require('./mapping-already-exists-error');
 
 module.exports = {
     BaseError,
@@ -14,4 +17,5 @@ module.exports = {
     RequiredPropertyError,
     ParameterTypeError,
     ClientSafeError,
+    MappingAlreadyExistsError,
 };