fix(frameworks): normalize EvidenceFormType in sync manifests

Sync to a newly-published framework version was 500ing on prod for any
customer whose instance was pinned to a backfilled v1.0.0. Root cause:

- EvidenceFormType has `@map` directives, so underscored Prisma enum
  names (`infrastructure_inventory`) have hyphenated DB labels
  (`infrastructure-inventory`).
- The one-shot backfill data migration serialized doc types via
  `to_jsonb(ct."documentTypes"::text[])`, which renders the DB @Map'd
  hyphen form. So every backfilled v1.0.0 manifest stored hyphens.
- The TS manifest builder reads `ct.documentTypes` from Prisma client,
  which returns the underscored Prisma enum name. So CX-published
  v2+ manifests store underscores.
- When a customer synced v1.0.0 -> v2, the diff treated every doc type
  on every control as an add-underscore + remove-hyphen pair. The
  remove path called `controlDocumentType.findUnique({ formType:
  "infrastructure-inventory" })`; Prisma 7's strict enum validator
  rejected the hyphen form and 500'd the whole sync transaction.

Fix normalizes to the Prisma-client (underscored) form:
- new form-type-normalize.ts maps hyphens -> underscores for every
  @Map'd EvidenceFormType value
- framework-diff.sanitizeManifestEdges applies it before diffing, so
  the diff doesn't spuriously report identical types as add+remove
- framework-sync-apply normalizes edge.formType before every Prisma
  call (belt-and-suspenders)
- framework-rollback defensively normalizes stored undo payloads in
  case an older sync persisted the raw hyphen value

Existing backfilled manifests don't need to be rewritten - they're
normalized at read time.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Marfuen

apps/api/src/frameworks/framework-versioning/form-type-normalize.ts

@@ -0,0 +1,24 @@
+/**
+ * EvidenceFormType has `@map` directives that expose hyphenated labels at the
+ * DB level (e.g. `"infrastructure-inventory"`) while the Prisma client uses
+ * underscored names (e.g. `"infrastructure_inventory"`).
+ *
+ * The one-shot backfill data migration
+ * (20260423121434_backfill_framework_versions) serialized doc types via
+ * `to_jsonb(ct."documentTypes"::text[])`, which renders the DB @map'd form.
+ * So every backfilled v1.0.0 manifest stored hyphens. Newer manifests built
+ * through the TS manifest builder store underscores (what Prisma client
+ * returns).
+ *
+ * Any code that passes `formType` from a manifest into the Prisma client
+ * must normalize first, otherwise Prisma throws
+ * `PrismaClientValidationError: Invalid value for argument `formType`` on
+ * the hyphen form.
+ *
+ * Every `@map` in the schema just swaps `_` → `-`, so hyphens-to-underscores
+ * covers all existing values and any future ones CX adds — no hardcoded list
+ * to keep in sync.
+ */
+export function normalizeFormType(value: string): string {
+  return value.replace(/-/g, '_');
+}

apps/api/src/frameworks/framework-versioning/framework-diff.ts

@@ -1,3 +1,4 @@
+import { normalizeFormType } from './form-type-normalize';
 import type {
   FrameworkManifest,
   ManifestControl,
@@ -67,6 +68,15 @@ function sanitizeManifestEdges(m: FrameworkManifest): FrameworkManifest {
       requirementIds: c.requirementIds.filter((id) => reqIds.has(id)),
       policyIds: c.policyIds.filter((id) => policyIds.has(id)),
       taskIds: c.taskIds.filter((id) => taskIds.has(id)),
+      // Normalize formTypes to the Prisma-client form (underscored). Backfilled
+      // v1.0.0 manifests stored DB-mapped hyphen forms; collapsing both forms
+      // to the canonical name here means the diff doesn't spuriously report
+      // an add+remove for identical types, and downstream callers never see
+      // the hyphenated shape. Preserve undefined-ness when the input didn't
+      // carry documentTypes at all (older manifest shape).
+      ...(c.documentTypes === undefined
+        ? {}
+        : { documentTypes: c.documentTypes.map(normalizeFormType) }),
     })),
   };
 }

apps/api/src/frameworks/framework-versioning/framework-rollback.service.ts

@@ -1,6 +1,7 @@
 import { BadRequestException, ForbiddenException, Injectable, NotFoundException } from '@nestjs/common';
 import { db, Prisma, Frequency, Departments } from '@db';
 import { lockOrganizationForSync } from './org-advisory-lock';
+import { normalizeFormType } from './form-type-normalize';
 import type { UndoPayload } from './undo-payload.types';
 
 export interface RollbackParams {
@@ -129,7 +130,9 @@ async function replayUndo(
   }
   for (const d of cdtDeleted) {
     await tx.controlDocumentType.create({
-      data: { controlId: d.controlId, formType: d.formType as never },
+      // Defensive normalization — older undo payloads may have stored the
+      // DB-mapped hyphen form before the sync-apply normalization was added.
+      data: { controlId: d.controlId, formType: normalizeFormType(d.formType) as never },
     });
   }
 

apps/api/src/frameworks/framework-versioning/framework-sync-apply.ts

@@ -2,6 +2,7 @@ import { Prisma, Frequency, Departments, type FrameworkInstance, type FrameworkV
 import { diffManifests } from './framework-diff';
 import { isControlEdited, isPolicyEdited, isTaskEdited } from './framework-drift';
 import { buildCrossFrameworkRefs } from './cross-framework-refs';
+import { normalizeFormType } from './form-type-normalize';
 import type { FrameworkManifest } from './manifest.types';
 import type { UndoPayload, SyncSummary } from './undo-payload.types';
 
@@ -325,28 +326,30 @@ export async function applySync(
   for (const edge of diff.controlDocumentTypeEdges.added) {
     const ctlInst = ctlByTemplate.get(edge.controlTemplateId);
     if (!ctlInst) continue;
+    const formType = normalizeFormType(edge.formType);
     // Idempotent create: skip if already present (shared-entity case).
     const existing = await tx.controlDocumentType.findUnique({
-      where: { controlId_formType: { controlId: ctlInst.id, formType: edge.formType as never } },
+      where: { controlId_formType: { controlId: ctlInst.id, formType: formType as never } },
       select: { id: true },
     });
     if (existing) continue;
     const created = await tx.controlDocumentType.create({
-      data: { controlId: ctlInst.id, formType: edge.formType as never },
+      data: { controlId: ctlInst.id, formType: formType as never },
     });
     undo.controlDocumentTypes.created.push(created.id);
     summary.controlDocumentTypesAdded += 1;
   }
   for (const edge of diff.controlDocumentTypeEdges.removed) {
     const ctlInst = ctlByTemplate.get(edge.controlTemplateId);
     if (!ctlInst) continue;
+    const formType = normalizeFormType(edge.formType);
     const existing = await tx.controlDocumentType.findUnique({
-      where: { controlId_formType: { controlId: ctlInst.id, formType: edge.formType as never } },
+      where: { controlId_formType: { controlId: ctlInst.id, formType: formType as never } },
       select: { id: true },
     });
     if (!existing) continue;
     await tx.controlDocumentType.delete({ where: { id: existing.id } });
-    undo.controlDocumentTypes.deleted.push({ controlId: ctlInst.id, formType: edge.formType });
+    undo.controlDocumentTypes.deleted.push({ controlId: ctlInst.id, formType });
     summary.controlDocumentTypesArchived += 1;
   }