feat(core): rename data-defined internals, give webhook checks the raw body, real HubSpot components

[seanspeaks]

Stack 8 of 9. Stacked on #698.

Summary

• Rename. integrations/data-defined/ becomes integrations/definitions/, data-defined-integration.js becomes integration-runtime.js, and the env vars move to INTEGRATION_DEFINITIONS_*. A published integration is just an integration, so its internals no longer say "data-defined". The diff is mostly moved files.
• Signature checks get exact bytes. HubSpot, Slack, Stripe and Linear sign the exact body bytes; HubSpot v3 also signs the method and public URL. Until now, verification received only the parsed body.
  • The HTTP app keeps req.rawBody.
  • onWebhookReceived queues the method, the public URL (from x-forwarded-proto/host plus originalUrl) and the raw body, up to 96 KB.
  • Above 96 KB the body is left out and verification fails closed. SQS messages are capped at 256 KB.
  • webhookVerificationInput(data) gives a code integration the same values.
  • Eight modules' webhook blocks are no longer unimplemented. They need the api-module-library release from feat(webhooks): verifyWebhookSignature on eight modules, and fix HubSpot updateDeal api-module-library#105.
  • Salesforce has no signed push webhook, so its deliveries are rejected.
• HubSpot components checked against @hubspot/ui-extensions 0.17.1 (the package's d.ts files). Most names were right. Fixed:
  • EmptyState takes its text as children.
  • A button's action is now a node-level field, not a prop.
  • open_url uses the real href prop.
  • A test pins the emitted components and prop values to 0.17.1.

Test plan

• Same 31 pre-existing failures as next at this commit. Nothing new fails.
• Tests for raw-body capture, the 96 KB fail-closed path, and the HubSpot component allowlist (four mutations killed).
• One real webhook delivery per vendor in dev.

---

Generated by Claude Code

---

Note

High Risk
Breaking API/path and config-type renames plus webhook acceptance changes (raw body, size limit, and stricter verify) can reject or mishandle deliveries until modules and proxies are aligned.

Overview
Renames the definition-based integration stack from data-defined to integrations/definitions and IntegrationRuntime, including catalogue route GET /api/integration-definitions, shared host type integration-runtime, and test env vars INTEGRATION_DEFINITIONS_*. ADRs 013/030/063 are updated to match the new vocabulary.

Webhook verification now preserves req.rawBody in the HTTP layer and queues method, public URL, and raw body (capped at 96 KB, fail-closed beyond that) through onWebhookReceived and the definition runtime’s manifest verify. webhookVerificationInput exposes the same shape to code integrations. Capability manifests drop “unimplemented” on eight vendors’ verifyWebhookSignature (pending api-module-library release); Salesforce stays rejected.

HubSpot preview output is aligned with @hubspot/ui-extensions 0.17.1: EmptyState text as children, userAction on a node-level action, open_url via href, plus allowlist tests.

^{Reviewed by Cursor Bugbot for commit 0d57ee8. Bugbot is set up for automated code reviews on this repo. Configure here.}

📦 Published PR as canary version: 2.0.0--canary.699.0d57ee8.0

✨ Test out this PR locally via:

npm install @friggframework/admin-scripts@2.0.0--canary.699.0d57ee8.0
npm install @friggframework/core@2.0.0--canary.699.0d57ee8.0
npm install @friggframework/devtools@2.0.0--canary.699.0d57ee8.0
npm install @friggframework/eslint-config@2.0.0--canary.699.0d57ee8.0
npm install @friggframework/prettier-config@2.0.0--canary.699.0d57ee8.0
npm install @friggframework/schemas@2.0.0--canary.699.0d57ee8.0
npm install @friggframework/serverless-plugin@2.0.0--canary.699.0d57ee8.0
npm install @friggframework/test@2.0.0--canary.699.0d57ee8.0
npm install @friggframework/ui@2.0.0--canary.699.0d57ee8.0
# or 
yarn add @friggframework/admin-scripts@2.0.0--canary.699.0d57ee8.0
yarn add @friggframework/core@2.0.0--canary.699.0d57ee8.0
yarn add @friggframework/devtools@2.0.0--canary.699.0d57ee8.0
yarn add @friggframework/eslint-config@2.0.0--canary.699.0d57ee8.0
yarn add @friggframework/prettier-config@2.0.0--canary.699.0d57ee8.0
yarn add @friggframework/schemas@2.0.0--canary.699.0d57ee8.0
yarn add @friggframework/serverless-plugin@2.0.0--canary.699.0d57ee8.0
yarn add @friggframework/test@2.0.0--canary.699.0d57ee8.0
yarn add @friggframework/ui@2.0.0--canary.699.0d57ee8.0

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.

[seanspeaks]

ADR reconciliation needed after Stack A/B — drafted with Claude Code at Sean's request

Severity: cross-ref only.

• ADR-054 extension contract 2 (docs(adr): ADR-054 one-file integrations via module extensions, ADR-055 recurring triggers #669) declares webhook verification for module extensions. webhookVerificationInput(data) (raw body ≤ 96 KB, method, public URL) should be the one input both paths use. Ask docs(adr): ADR-054 one-file integrations via module extensions, ADR-055 recurring triggers #669 to name it in §2 so contract-2 verifiers and manifest webhook.verify get the same bytes.
• Provider parity. req.rawBody is captured by core's HTTP app. feat: Netlify provider on the v2 stack (port of #545) (F7) #686's Netlify handlers wrap core's createApp, so this should carry over, but add a Netlify test: an exact-bytes check that silently gets no rawBody fails closed and drops every delivery.
• Fail closed above 96 KB matches the repo's webhook-security rule (CLAUDE.md: HMAC validation on all webhook endpoints). Note the limit in ADR-063 §14's delivery-guarantee list.
• The rename data-defined/ → definitions/ resolves the earlier naming concern, but definitions still overlaps the @friggframework/schemas integration-definition.schema.json (see docs(adr): ADR-063 integration definitions as data #692).

[sonarqubecloud]

Quality Gate passed

Issues
224 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.3% Duplication on New Code

See analysis details on SonarQube Cloud