@friggframework/core 2.0.0--canary.686.219e1e7.0 → 2.0.0--canary.686.00d79d8.0

package/modules/module.js

@@ -21,9 +21,17 @@ class Module extends Delegate {
      * @param {string} params.userId The user id
      * @param {Object} params.entity The entity record from the database
      * @param {string} [params.state] Optional OAuth state value forwarded to the API client (round-trips through the OAuth provider).
-     * @param {Object} [params.resolvedEnv] definition.env already resolved by Module.create(); defaults to the static definition.env.
+     * @param {Object} [params.resolvedEnv] definition.env as Module.create() resolved it (may be undefined).
+     * @param {boolean} [params.envResolved=false] true when resolvedEnv carries the resolved env, even an undefined one; otherwise the static definition.env is used.
      */
-    constructor({ definition, userId = null, entity: entityObj = null, state = null, resolvedEnv = null }) {
+    constructor({
+        definition,
+        userId = null,
+        entity: entityObj = null,
+        state = null,
+        resolvedEnv,
+        envResolved = false,
+    }) {
         super({ definition, userId, entity: entityObj });
 
         this.validateDefinition(definition);
@@ -58,9 +66,10 @@ class Module extends Delegate {
         // A pre-resolved env (Module.create()) supports definition.env as an
         // async function, e.g. OAuth app credentials loaded from the database
         // by the db-credentials extension; otherwise the static object.
-        // No resolved env (the null default; an explicit undefined takes it
-        // too) means the static definition.env applies.
-        const envValues = resolvedEnv ?? this.definition.env;
+        // "Resolved" is an explicit flag, not a non-null value: a function env
+        // may legitimately resolve to undefined (no static env, no DB row),
+        // and falling back to definition.env would then read the function.
+        const envValues = envResolved ? resolvedEnv : this.definition.env;
         if (typeof envValues === 'function') {
             // Spreading a function yields no keys, so the API client would
             // silently get no client_id / client_secret.
@@ -106,7 +115,7 @@ class Module extends Delegate {
      */
     static async create({ definition, userId = null, entity = null, state = null }) {
         const resolvedEnv = await Module.resolveEnv(definition);
-        return new Module({ definition, userId, entity, state, resolvedEnv });
+        return new Module({ definition, userId, entity, state, resolvedEnv, envResolved: true });
     }
 
     getName() {

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@friggframework/core",
     "prettier": "@friggframework/prettier-config",
-    "version": "2.0.0--canary.686.219e1e7.0",
+    "version": "2.0.0--canary.686.00d79d8.0",
     "dependencies": {
         "@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
         "@aws-sdk/client-kms": "^3.588.0",
@@ -48,9 +48,9 @@
         }
     },
     "devDependencies": {
-        "@friggframework/eslint-config": "2.0.0--canary.686.219e1e7.0",
-        "@friggframework/prettier-config": "2.0.0--canary.686.219e1e7.0",
-        "@friggframework/test": "2.0.0--canary.686.219e1e7.0",
+        "@friggframework/eslint-config": "2.0.0--canary.686.00d79d8.0",
+        "@friggframework/prettier-config": "2.0.0--canary.686.00d79d8.0",
+        "@friggframework/test": "2.0.0--canary.686.00d79d8.0",
         "@prisma/client": "^6.19.3",
         "@types/lodash": "4.17.15",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
@@ -90,5 +90,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "219e1e7c2a387b3ddf1fa20ca10d0b87093bd38e"
+    "gitHead": "00d79d89a9657b62bf89544cbfdf3338e84aea0c"
 }

package/queues/providers/netlify-background-provider.js

@@ -51,6 +51,8 @@ class NetlifyBackgroundProvider extends QueueProvider {
         this.signingSecret = options.signingSecret;
         this.env = options.env || process.env;
         this.now = options.now || Date.now;
+        // verifyEvent() proves an HTTP delivery came from Frigg.
+        this.verifiesHttpDelivery = true;
     }
 
     // Read on every call, not in the constructor: secrets may be loaded into

package/queues/providers/qstash-queue-provider.js

@@ -50,6 +50,8 @@ class QStashQueueProvider extends QueueProvider {
         this.destinationUrl = options.destinationUrl;
         this.env = options.env || process.env;
         this.clockToleranceSeconds = options.clockToleranceSeconds || 0;
+        // verifyEvent() proves an HTTP delivery came from QStash.
+        this.verifiesHttpDelivery = true;
     }
 
     // Read per call: secrets may reach the environment after construction.

package/queues/queue-provider.js

@@ -49,7 +49,10 @@ class QueueProvider {
      *
      * The default refuses: an adapter that does not know how to verify its
      * events must not have them run. An adapter whose transport already
-     * authenticates the caller (SQS triggering a Lambda) overrides this.
+     * authenticates the caller (SQS triggering a Lambda) overrides this, and
+     * must not set `verifiesHttpDelivery`: an HTTP entry point (Netlify's
+     * worker-background) consults only adapters that set it to true, since
+     * a transport-trust answer says nothing about an HTTP caller.
      *
      * @param {Object} event - Raw event from the runtime
      * @returns {Promise<{ ok: boolean, reason?: string, unsigned?: boolean }>}