@friggframework/core 2.0.0--canary.625.27a7e7a.0 → 2.0.0--canary.625.3f500f2.0

package/core/parameters-to-env.js

@@ -38,11 +38,11 @@ const parseKeys = (raw) =>
         .map((key) => key.trim())
         .filter(Boolean);
 
-const sendWithRetry = async (command) => {
+const sendWithRetry = async (ssmClient, command) => {
     let attempt = 0;
     for (;;) {
         try {
-            return await client.send(command);
+            return await ssmClient.send(command);
         } catch (err) {
             if (
                 err.name === 'ThrottlingException' &&
@@ -57,6 +57,47 @@ const sendWithRetry = async (command) => {
     }
 };
 
+/**
+ * Fetch offloaded parameters and return a plain { key: value } map. Fetch-only:
+ * no process.env mutation, no caching, no ownership tracking. Shared by the
+ * runtime loader and the INIT-phase preload (ssm-preload.js). Throws (listing
+ * every missing name) if any requested key is absent from SSM.
+ */
+const fetchOffloadedParameters = async (prefix, keys, { region } = {}) => {
+    const { SSMClient, GetParametersCommand } = require('@aws-sdk/client-ssm');
+    const ssmClient = new SSMClient({
+        region: region || process.env.AWS_REGION,
+    });
+    const nameFor = (key) => `${prefix}/${key}`;
+
+    const found = new Map();
+    for (const batch of chunk(keys, BATCH_SIZE)) {
+        const { Parameters = [] } = await sendWithRetry(
+            ssmClient,
+            new GetParametersCommand({
+                Names: batch.map(nameFor),
+                WithDecryption: true,
+            })
+        );
+        for (const param of Parameters) {
+            found.set(param.Name, param);
+        }
+    }
+
+    const missing = keys.map(nameFor).filter((name) => !found.has(name));
+    if (missing.length > 0) {
+        throw new Error(
+            `missing SSM parameters under ${prefix}: ${missing.join(', ')}`
+        );
+    }
+
+    const values = {};
+    for (const key of keys) {
+        values[key] = found.get(nameFor(key)).Value;
+    }
+    return values;
+};
+
 const loadParameters = async (prefix, keys) => {
     const { SSMClient, GetParametersCommand } = require('@aws-sdk/client-ssm');
     if (!client) {
@@ -80,6 +121,7 @@ const loadParameters = async (prefix, keys) => {
     try {
         for (const batch of chunk(keysToFetch, BATCH_SIZE)) {
             const { Parameters = [] } = await sendWithRetry(
+                client,
                 new GetParametersCommand({
                     Names: batch.map(nameFor),
                     WithDecryption: true,
@@ -157,6 +199,23 @@ const parametersToEnv = async () => {
     return inflight;
 };
 
+/**
+ * Adopt keys the INIT preload (ssm-preload.mjs) already populated into
+ * process.env, so the handler-time loader treats them as its own: it seeds
+ * the cache TTL and marks the keys owned so the TTL-refresh path re-fetches
+ * them. The preload runs in-process (NODE_OPTIONS=--import), sharing this
+ * module singleton. Pass ONLY the keys the preload actually set (not keys
+ * already present as real env vars) so the real-env-wins rule is preserved.
+ */
+const adoptPreloadedKeys = (keys) => {
+    for (const key of keys) {
+        ownedKeys.add(key);
+    }
+    const ttlSeconds = getCacheTtlSeconds();
+    cacheExpiresAt =
+        ttlSeconds === 0 ? Infinity : Date.now() + ttlSeconds * 1000;
+};
+
 const _resetCache = () => {
     client = null;
     cacheExpiresAt = null;
@@ -166,5 +225,7 @@ const _resetCache = () => {
 
 module.exports = {
     parametersToEnv,
+    fetchOffloadedParameters,
+    adoptPreloadedKeys,
     _resetCache,
 };

package/core/ssm-preload.mjs

@@ -0,0 +1,47 @@
+// INIT-phase SSM loader (ADR-027).
+//
+// Loaded via NODE_OPTIONS=--import BEFORE the Lambda handler and any api-module
+// is required, so SSM-offloaded values are present in process.env at
+// module-load time — when api-modules capture their OAuth client credentials
+// in a top-level `const Definition = { env: { client_secret: process.env.X } }`.
+// The runtime loader (parameters-to-env.js) runs inside the handler, which is
+// too late for those module-load reads; this preload closes that gap.
+//
+// Top-level await here is awaited by Node before the entry module loads, so the
+// fetch completes first. A fetch failure rejects the preload, failing Lambda
+// INIT loudly (fail-fast) rather than starting with undefined credentials.
+
+import { createRequire } from 'module';
+
+const require = createRequire(import.meta.url);
+
+const prefix = process.env.SSM_PARAMETER_PREFIX;
+const rawKeys = process.env.FRIGG_SSM_OFFLOADED_KEYS;
+
+if (prefix && rawKeys) {
+    const keys = rawKeys
+        .split(',')
+        .map((key) => key.trim())
+        .filter(Boolean);
+
+    if (keys.length > 0) {
+        const {
+            fetchOffloadedParameters,
+            adoptPreloadedKeys,
+        } = require('./parameters-to-env');
+        const values = await fetchOffloadedParameters(prefix, keys);
+
+        // Real env vars win over SSM (console-override debugging escape hatch).
+        const setKeys = [];
+        for (const [key, value] of Object.entries(values)) {
+            if (process.env[key] === undefined) {
+                process.env[key] = value;
+                setKeys.push(key);
+            }
+        }
+        // Hand the keys we set to the handler-time loader (same in-process
+        // module singleton) so its TTL-refresh path re-fetches them.
+        adoptPreloadedKeys(setKeys);
+        console.log(`frigg-ssm-preload: loaded ${setKeys.length} parameter(s) at INIT under ${prefix}`);
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.625.27a7e7a.0",
+    "version": "2.0.0--canary.625.3f500f2.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -39,9 +39,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.625.27a7e7a.0",
-        "@friggframework/prettier-config": "2.0.0--canary.625.27a7e7a.0",
-        "@friggframework/test": "2.0.0--canary.625.27a7e7a.0",
+        "@friggframework/eslint-config": "2.0.0--canary.625.3f500f2.0",
+        "@friggframework/prettier-config": "2.0.0--canary.625.3f500f2.0",
+        "@friggframework/test": "2.0.0--canary.625.3f500f2.0",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -81,5 +81,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "27a7e7ae02d6dc5789f5aba0fe5c4cf82320dc38"
+    "gitHead": "3f500f202c8dcf2210c07835c76abbab30e0d0ee"
 }