@friggframework/core 2.0.0--canary.689.386395c.0 → 2.0.0--canary.690.d043f23.0

package/CLAUDE.md

@@ -206,41 +206,11 @@ packages/core/
 - `delete-integration-for-user.js` - Remove integration
 - `get-integration-instance.js` - Load integration with modules
 - `load-integration-context.js` - Full integration context loading
-- `add-entities-to-integration.js` / `remove-entities-from-integration.js` - Attach or detach entities on an existing integration
 
 **Repositories**:
 - `integration-repository-factory.js` - Creates database-specific repositories
 - `integration-repository-mongo.js` - MongoDB implementation
 - `integration-repository-postgres.js` - PostgreSQL implementation
-- `addEntitiesToIntegration(integrationId, entityIds)` /
-  `removeEntitiesFromIntegration(integrationId, entityIds)` change the entity
-  set of an existing integration (all three adapters; `null` for an unknown
-  integration). Reach them through the `addEntitiesToIntegration` /
-  `removeEntitiesFromIntegration` commands: the add use case
-  (`add-entities-to-integration.js`) rejects unknown entities
-  (`ENTITIES_NOT_FOUND`, 404) and entities of another user
-  (`ENTITY_USER_MISMATCH`, 403). Re-adding an attached entity or removing a
-  detached one changes nothing; a detached entity is not deleted.
-  `integration-repository-entities-parity.test.js` runs every adapter against
-  real databases when `INTEGRATION_ENTITIES_PARITY_MONGO_URL` /
-  `INTEGRATION_ENTITIES_PARITY_POSTGRES_URL` are set. The DocumentDB adapter
-  writes only `Integration.entityIds` (as its `createIntegration` does), not
-  `Entity.integrationIds`.
-  **One credential, many accounts**: when one credential covers several
-  provider accounts, give each account its own entity (externalId = account
-  id) and attach them all to one integration; webhooks then route with
-  `findIntegrationByEntityExternalId`. Three traps:
-  (1) `IntegrationBase` keys modules by module name, so `this.<moduleKey>`
-  holds only the last entity's module: pick the account's entity from
-  `this.entities` by `externalId`.
-  (2) `findIntegrationByEntityExternalId` counts every entity with that
-  externalId, attached or not: reuse an existing entity (`findEntity`) when an
-  account comes back, or delete it when it is revoked, never create a second
-  one.
-  (3) `createIntegration` reuses an integration only for the exact same entity
-  set, so after an attach a second `createIntegration` with the original
-  entities creates a new integration: re-authorization must update the
-  existing integration, not create one.
 - `integration-mapping-repository-*.js` - Mapping data persistence.
   `queryMappings(integrationId, { where, orderBy, skip, take, omit })`
   returns `{ mappings, total }`: one filtered, ordered page of an
@@ -362,12 +332,14 @@ class MyIntegration extends IntegrationBase {
 - Password-based (bcrypt hashed)
 - Token-based (Bearer tokens)
 - App-based (external app user IDs)
+- Adopter JWT (`authModes.adopterJwt`, `jwtConfig`; `jose`, JWKS or HMAC; see `README.md`)
 
 **Use Cases**:
 - `login-user.js` - User authentication
 - `create-individual-user.js` - Create personal account
 - `create-organization-user.js` - Create business account
 - `get-user-from-bearer-token.js` - Token authentication
+- `get-user-from-adopter-jwt.js` - Adopter JWT verification, find-or-create (ADR-056 §2); `adopter-jwt-config.js` validates `jwtConfig` at load
 
 **Repositories**:
 - `user-repository-factory.js` - Creates database-specific repositories
@@ -530,6 +502,29 @@ The single source of the max receive count is
 devtools integration builder uses it for the queue's `RedrivePolicy` and sets
 it as `FRIGG_QUEUE_MAX_RECEIVE_COUNT` on the queue worker function.
 
+### Management API v2 notes (`/management-api`)
+
+- Handlers in `management-api/v2/handlers/` call use cases only; dependencies are wired in
+  `management-api/v2/dependencies.js`. Errors are `{ error: { code, message, details? } }`.
+- `appDefinition.managementApi` is resolved by `resolveManagementApiConfig`, which `loadAppDefinition`
+  also calls so a bad value stops the app at load. Numeric proxy limits fall back to their defaults;
+  `proxy.scopes` (ADR-056 §3.5, default `['individual']`) never does: an unknown scope, `'global'`, a
+  non-list, an empty list or a repeated scope throws `ManagementApiConfigError`
+  (`MANAGEMENT_API_CONFIG_INVALID`).
+- **Entity proxy** (`ExecuteEntityProxyRequest`): visibility in the active organization comes from
+  `GetEntityModuleForUser` (404), then `assertProxyable` reads the same `{ scope, access }` description
+  the v2 lists return: `grantsUse(access)` (`use` or `manage`, from `modules/scope-visibility.js`) or 403
+  `PROXY_NOT_ALLOWED` `reason: 'access'`, and the scope must be in `proxy.scopes` or 403 `reason: 'scope'`.
+  Do not add a second ownership rule for the proxy; change the description instead.
+- **Not visible is 404, and so is missing.** Module repositories throw `entityNotFoundError(id)`
+  (`modules/repositories/entity-not-found.js`) for a missing row and use cases match it with
+  `isEntityNotFound`. A 500 for a missing id next to a 404 for another tenant's id tells a caller which
+  ids exist. A test double that resolves `findEntityById` to `null` hides this: no adapter does that.
+- **Tenant isolation on real PostgreSQL**: `management-api/v2/tenant-isolation.postgres.test.js`, run with
+  `FRIGG_TEST_POSTGRES_URL=<a database it may wipe>`. It applies the migrations, truncates every table
+  before each test, and drives real adopter-JWT auth through the real router and Prisma repositories.
+  Without the variable it is skipped (and says so), not passed. See `docs/guides/entity-scopes.md`.
+
 ### 8. Error Handling (`/errors`)
 
 **Purpose**: Standardized error types with proper HTTP semantics.
@@ -780,6 +775,9 @@ Use test doubles from `@friggframework/test` package for consistent mocking.
 - `SECRET_ARN` - AWS Secrets Manager ARN for auto-injection
 - `FRIGG_LOG_LEVEL` - Minimum log level (`TRACE` … `FATAL`, default `INFO`; `DEBUG` on local runs)
 - `FRIGG_QUEUE_MAX_RECEIVE_COUNT` - Set by devtools on integration queue workers whose queue the stack owns; feeds `delivery.maxReceiveCount`
+- `FRIGG_QUEUE_SIGNING_SECRET` - Required for HTTP-delivered queues (Netlify Background Functions). `NetlifyBackgroundProvider` signs each message (HMAC-SHA256 over `timestamp.rawBody`, `x-frigg-queue-signature` / `x-frigg-queue-timestamp`) and `verifyEvent()` refuses anything unsigned, tampered, signed with another secret or older than 5 minutes. Unset → `send()` throws and every event is refused (`queues/queue-message-auth.js`)
+- `FRIGG_QUEUE_ALLOW_UNSIGNED` - `true` accepts unsigned queue messages when no secret is set, outside production only (`STAGE` dev/test/local, `NODE_ENV` development/test, or `NETLIFY_DEV`); ignored in production
+- `QSTASH_CURRENT_SIGNING_KEY` / `QSTASH_NEXT_SIGNING_KEY` - Required with the QStash queue: `QStashQueueProvider.verifyEvent()` checks the `Upstash-Signature` JWT with them
 
 ## Version Information
 

package/README.md

@@ -305,6 +305,7 @@ Comprehensive user authentication and authorization system supporting both indiv
 - **Password-based**: Traditional username/password authentication
 - **Token-based**: Bearer token authentication with session management
 - **App-based**: External app user ID authentication (passwordless)
+- **Adopter token (JWT)**: A token issued by your own identity system, verified by Frigg and safe to send from a browser (see below)
 
 **Usage:**
 ```javascript
@@ -352,6 +353,110 @@ console.log('Individual user:', user.getIndividualUser());
 console.log('Organization user:', user.getOrganizationUser());
 ```
 
+#### Adopter token (JWT) authentication
+
+For a multi-tenant product (ADR-056 §2), let the browser send the token your identity system
+already issues. Frigg verifies the signature and claims, then finds or creates the individual
+user and the organization user the token names. Unlike `sharedSecret` (`x-frigg-*` headers), a
+token cannot name a user other than the one it was issued for, so it is safe in a browser.
+
+```javascript
+// backend/index.js
+const appDefinition = {
+    user: {
+        primary: 'organization',
+        individualUserRequired: true,
+        organizationUserRequired: true,
+        authModes: { adopterJwt: true, friggToken: false, sharedSecret: false },
+        jwtConfig: {
+            jwksUri: 'https://login.example.com/.well-known/jwks.json',
+            issuer: 'https://login.example.com/',
+            audience: 'my-frigg-api', // required with jwksUri
+        },
+    },
+};
+```
+
+The client sends `Authorization: Bearer <token>`. `x-frigg-appuserid` / `x-frigg-apporgid`, if
+also sent, must match the token or the request is refused with 403. That match rule lives in
+`user/use-cases/authenticate-user.js` (`validateUserMatch`), not in the token verifier. A bearer
+value that is not a three-part JWT is not offered to the verifier at all; it falls through to
+`friggToken` (or is a 401 when that mode is off).
+
+| `jwtConfig` field | Default | Meaning |
+|---|---|---|
+| `jwksUri` | | Remote JWKS (rotating keys, one per verifier, cached by jose). Must be `https`; `http` only for `localhost`, `127.0.0.0/8` or `::1`. Set exactly one of this and `secret`. |
+| `secret` | | Shared HMAC secret. Read it from an environment variable. |
+| `issuer` | not checked | Required `iss`. With `jwksUri`, a startup warning is logged when it is unset. |
+| `audience` | not checked with `secret`; **required with `jwksUri`** | Accepted `aud` (a string or a list). |
+| `algorithms` | `['ES256','RS256']` with `jwksUri`, `['HS256']` with `secret` | Allow-list. HS* is only accepted with `secret`, never with `jwksUri`. The older single `algorithm` is a deprecated alias; setting both is an error. |
+| `clockToleranceSec` | `30` | Skew allowed on `exp` and `nbf`. |
+| `userIdClaim` | `sub` | App user id (required in the token). |
+| `orgIdClaim` | `org_id` | App organization id (optional). |
+| `roleClaim` | `org_role` | Exposed as `user.getOrgRole()` for the request, and stored as the `orgRole` of a person's membership the first time they join that organization (`MEMBER` when the token names none). For permissions the token's role wins; a token with none uses the role stored on the person's membership of the active organization, and is a member when there is none: it cannot create or change organization-level entities or integrations. `user.orgAdminRoles` (default `['ADMIN']`) names the roles that can. Frigg bearer tokens are not gated unless `user.orgAdminGateBearerTokens: true`. |
+
+Rules worth knowing:
+
+- Tokens must carry `exp`. `alg: none` and any algorithm outside the allow-list are refused.
+- Startup fails (`loadAppDefinition` throws) when `adopterJwt` is on and the config is unusable:
+  neither or both of `jwksUri` and `secret`, a `jwksUri` that is not https (or loopback http),
+  no `audience` with `jwksUri`, or an algorithm list that does not fit the key type.
+- Failures are `401` with a stable `data.reason`: `token_expired`, `token_not_yet_valid`,
+  `token_invalid_signature`, `token_wrong_issuer`, `token_wrong_audience`,
+  `token_missing_user_claim`, `token_malformed`. The message never contains the token or its claims.
+  Any other verification failure, such as an unreachable or unresolvable JWKS, is `503`
+  `jwks_unavailable`, not a 401, so clients do not drop good sessions.
+- **The token's organization is the request's active organization**, and a person can belong to
+  several (ADR-056 §3.6). The first time a person presents a token for an organization they are
+  not a member of, Frigg adds an `OrganizationMembership` and the request runs as that
+  organization (`user.getActiveOrganizationId()`; `user.getId()` under `primary: 'organization'`).
+  Nothing is moved: `IndividualUser.organizationId` is a legacy pointer, set only on a person's
+  first link and read as an implicit membership. The same applies to `x-frigg-apporgid` with
+  `sharedSecret`. With `user.strictMembership: true` those headers cannot add anyone to an organization
+  that already existed (400 for a non-member, a brand-new `appUserId` included); only an organization
+  the request itself creates is allowed. `strictUserValidation` is a deprecated alias with that same
+  meaning. See
+  [Organization memberships](../../docs/guides/organization-memberships.md). A token naming a second
+  organization is no longer a `403` (`multi_org_unsupported` is gone).
+- Two first logins for the same new person or organization, even in different organizations, both
+  succeed: a create that loses to a unique constraint finds the winner's row.
+
+#### Entity scopes and ownership (ADR-056 §3)
+
+Who owns an entity (a connected account) or an integration follows its **scope**, not `user.primary`:
+
+| Scope | Owned by | Created with |
+|---|---|---|
+| `individual` | the person (`individualUser`) | the active organization (`organizationId`), or none under `individualAcross: 'all'` |
+| `organization` | the active organization's user | that organization |
+| `global` | nobody (the app owner) | none; refused by the tenant API (admin routes only) |
+
+The scope of a new connection is the first of: the request (`scope` on `POST /api/v2/authorize`, only from
+the deciding level's `allow` list), the integration binding (`Definition.modules[key].scope` or
+`Definition.entities[key].scope`), `Definition.ownership.scope`, the entity type
+(`appDefinition.entities[name].scope`), `appDefinition.ownership.scope`, then `organization` for an
+organization-primary app and `individual` otherwise. A setting is `'organization'` or
+`{ default: 'individual', allow: ['individual', 'organization'] }`.
+
+```javascript
+const appDefinition = {
+    user: { primary: 'individual', authModes: { adopterJwt: true } },
+    ownership: { scope: 'individual', individualAcross: 'organization' }, // the defaults
+    entities: {
+        google: { definition: google, scope: 'individual' },
+        xero: { definition: xero, scope: { default: 'organization', allow: ['organization', 'individual'] } },
+    },
+    integrations: [Sync], // Sync.Definition.ownership = { owner: 'derive' }
+};
+```
+
+`GET /api/v2/entities` and `/integrations` return, for the active organization, its own
+rows and the caller's, each with `scope`, `owner`, `organizationId` and `access`, and take `?scope=` and
+`?owner=me|org`. An individual entity is only visible and usable in the organization it was connected in
+(or in all of them, with `individualAcross: 'all'`). Rows written before this existed keep working: see
+[Entity scopes](../../docs/guides/entity-scopes.md), which also covers the schema (`organizationId` on
+`Entity` and `Integration`, no `scope` column) and what is deferred.
+
 ### 8. Lambda Utilities (`/lambda`)
 
 AWS Lambda-specific utilities and helpers.

package/application/commands/integration-commands.js

@@ -18,7 +18,7 @@ const {
     ListIntegrationsByEntityExternalIdUseCase,
 } = require('../../integrations/use-cases/list-integrations-by-entity-external-id');
 const {
-    GetIntegrationsForUser,
+    GetIntegrationsByUserId,
 } = require('../../integrations/use-cases/get-integrations-for-user');
 const {
     CreateIntegration,
@@ -30,14 +30,9 @@ const {
     PatchIntegrationConfig,
 } = require('../../integrations/use-cases/patch-integration-config');
 const {
-    AddEntitiesToIntegration,
-} = require('../../integrations/use-cases/add-entities-to-integration');
-const {
-    RemoveEntitiesFromIntegration,
-} = require('../../integrations/use-cases/remove-entities-from-integration');
-const {
-    getModulesDefinitionFromIntegrationClasses,
-} = require('../../integrations/utils/map-integration-dto');
+    getEntityTypeRegistry,
+    getEntityTypeDefinitions,
+} = require('../../modules/entity-type-registry');
 
 const ERROR_CODE_MAP = {
     ENTITY_NOT_FOUND: 401,
@@ -46,9 +41,6 @@ const ERROR_CODE_MAP = {
     EXTERNAL_ID_REQUIRED: 400,
     TYPE_REQUIRED: 400,
     INTEGRATION_RECORD_NOT_FOUND: 404,
-    INVALID_INTEGRATION_DATA: 400,
-    ENTITIES_NOT_FOUND: 404,
-    ENTITY_USER_MISMATCH: 403,
 };
 
 function mapErrorToResponse(error) {
@@ -60,7 +52,16 @@ function mapErrorToResponse(error) {
     };
 }
 
-function createIntegrationCommands({ integrationClass } = {}) {
+/**
+ * @param {Object} [params]
+ * @param {Function} [params.integrationClass]
+ * @param {Array<object>} [params.moduleDefinitions] - the app's offered module
+ *   definitions (`loadAppDefinition().moduleDefinitions`). Integration code
+ *   calls this from a constructor with no app definition in hand, so when it
+ *   is omitted the commands hydrate with this integration's own modules only
+ *   (a registry built from `{ integrations: [integrationClass] }`).
+ */
+function createIntegrationCommands({ integrationClass, moduleDefinitions } = {}) {
     // Always use Frigg's default repositories and use cases
     const integrationRepository = createIntegrationRepository();
 
@@ -117,13 +118,13 @@ function createIntegrationCommands({ integrationClass } = {}) {
 
     const moduleRepository = createModuleRepository();
 
-    const moduleDefinitions = getModulesDefinitionFromIntegrationClasses([
-        integrationClass,
-    ]);
-
     const moduleFactory = new ModuleFactory({
         moduleRepository,
-        moduleDefinitions,
+        moduleDefinitions:
+            moduleDefinitions ??
+            getEntityTypeDefinitions(
+                getEntityTypeRegistry({ integrations: [integrationClass] })
+            ),
     });
 
     const loadIntegrationContextUseCase = new LoadIntegrationContextUseCase({
@@ -151,7 +152,7 @@ function createIntegrationCommands({ integrationClass } = {}) {
             moduleRepository,
         });
 
-    const getIntegrationsForUserUseCase = new GetIntegrationsForUser({
+    const getIntegrationsForUserUseCase = new GetIntegrationsByUserId({
         integrationRepository,
         integrationClasses: [integrationClass],
         moduleFactory,
@@ -172,16 +173,6 @@ function createIntegrationCommands({ integrationClass } = {}) {
         integrationRepository,
     });
 
-    const addEntitiesToIntegrationUseCase = new AddEntitiesToIntegration({
-        integrationRepository,
-        moduleRepository,
-    });
-
-    const removeEntitiesFromIntegrationUseCase =
-        new RemoveEntitiesFromIntegration({
-            integrationRepository,
-        });
-
     return {
         findIntegrationById,
         listIntegrations,
@@ -326,45 +317,6 @@ function createIntegrationCommands({ integrationClass } = {}) {
             }
         },
 
-        /**
-         * Attach entities to an existing integration. Every entity must
-         * exist and belong to the integration's user; entities that are
-         * already attached are left as they are.
-         * @param {Object} params
-         * @param {string} params.integrationId - Integration ID
-         * @param {Array<string>} params.entityIds - Entity IDs to attach
-         * @returns {Promise<Object>} Updated integration
-         */
-        async addEntitiesToIntegration({ integrationId, entityIds }) {
-            try {
-                return await addEntitiesToIntegrationUseCase.execute(
-                    integrationId,
-                    entityIds
-                );
-            } catch (error) {
-                return mapErrorToResponse(error);
-            }
-        },
-
-        /**
-         * Detach entities from an integration. Entities that are not
-         * attached are ignored; detached entities are not deleted.
-         * @param {Object} params
-         * @param {string} params.integrationId - Integration ID
-         * @param {Array<string>} params.entityIds - Entity IDs to detach
-         * @returns {Promise<Object>} Updated integration
-         */
-        async removeEntitiesFromIntegration({ integrationId, entityIds }) {
-            try {
-                return await removeEntitiesFromIntegrationUseCase.execute(
-                    integrationId,
-                    entityIds
-                );
-            } catch (error) {
-                return mapErrorToResponse(error);
-            }
-        },
-
         /**
          * Delete an integration by ID
          * @param {string} integrationId - Integration ID to delete

package/application/commands/scheduler-commands.js

@@ -121,17 +121,19 @@ function createSchedulerCommands({ integrationName, schedulerService }) {
                     throw error;
                 }
 
-                if (!queueUrl) {
+                // An adapter with its own notion of a queue target (Netlify:
+                // the worker function) resolves it; otherwise the target is
+                // an SQS queue and its URL is required.
+                const service = getSchedulerService();
+                const resolvesOwnTarget =
+                    typeof service?.toQueueResourceId === 'function';
+
+                if (!queueUrl && !resolvesOwnTarget) {
                     const error = new Error('queueUrl is required');
                     error.code = 'INVALID_JOB_DATA';
                     throw error;
                 }
 
-                // Derive ARN from URL (business logic - transformation)
-                const queueArn = deriveArnFromQueueUrl(queueUrl);
-
-                // Get scheduler service (via DI or factory)
-                const service = getSchedulerService();
                 if (!service) {
                     console.warn(
                         `[${integrationName}] Scheduler not configured, skipping job schedule`
@@ -157,7 +159,9 @@ function createSchedulerCommands({ integrationName, schedulerService }) {
                 const result = await service.scheduleOneTime({
                     scheduleName: jobId,
                     scheduleAt: scheduledAt,
-                    queueResourceId: queueArn,
+                    queueResourceId: resolvesOwnTarget
+                        ? service.toQueueResourceId(queueUrl)
+                        : deriveArnFromQueueUrl(queueUrl),
                     payload: sqsPayload,
                 });
 

package/application/commands/user-commands.js

@@ -1,6 +1,12 @@
 const {
     createUserRepository,
 } = require('../../user/repositories/user-repository-factory');
+const {
+    createOrganizationMembershipRepository,
+} = require('../../user/repositories/organization-membership-repository-factory');
+const {
+    FindIndividualUsersByOrganization,
+} = require('../../user/use-cases/find-individual-users-by-organization');
 
 const ERROR_CODE_MAP = {
     USER_NOT_FOUND: 404,
@@ -26,6 +32,12 @@ function mapErrorToResponse(error) {
  */
 function createUserCommands() {
     const userRepository = createUserRepository();
+    const findIndividualUsersByOrganization =
+        new FindIndividualUsersByOrganization({
+            userRepository,
+            organizationMembershipRepository:
+                createOrganizationMembershipRepository(),
+        });
 
     return {
         /**
@@ -170,7 +182,8 @@ function createUserCommands() {
         },
 
         /**
-         * Find all individual users linked to an organization user
+         * Find all individual users who belong to an organization user: those with
+         * a membership and those the legacy organizationId pointer places there.
          * @param {string} organizationUserId - Organization user ID to search for
          * @returns {Promise<Object[]>} Array of individual user objects (empty if none)
          */
@@ -182,10 +195,9 @@ function createUserCommands() {
                     throw error;
                 }
 
-                const users =
-                    await userRepository.findIndividualUsersByOrganizationId(
-                        organizationUserId
-                    );
+                const users = await findIndividualUsersByOrganization.execute(
+                    organizationUserId
+                );
 
                 return (users || []).map((user) => ({
                     id: user._id?.toString() || user.id,

package/application/index.js

@@ -17,6 +17,7 @@ const { createUsageCommands } = require('./commands/usage-commands');
  *
  * @param {Object} params
  * @param {Object} params.integrationClass - Integration class (required)
+ * @param {Array<object>} [params.moduleDefinitions] - the app's offered module definitions; defaults to the integration's own modules
  * @returns {Object} Unified commands object with all CRUD operations
  *
  * @example
@@ -24,9 +25,12 @@ const { createUsageCommands } = require('./commands/usage-commands');
  * const user = await commands.createUser({ username: 'user@example.com' });
  * const credential = await commands.createCredential({ userId: user.id, ... });
  */
-function createFriggCommands({ integrationClass }) {
+function createFriggCommands({ integrationClass, moduleDefinitions }) {
     // All commands use Frigg's default repositories and use cases
-    const integrationCommands = createIntegrationCommands({ integrationClass });
+    const integrationCommands = createIntegrationCommands({
+        integrationClass,
+        moduleDefinitions,
+    });
 
     const userCommands = createUserCommands();
 

package/core/Worker.js

@@ -1,4 +1,3 @@
-const { SQSClient, GetQueueUrlCommand, SendMessageCommand } = require('@aws-sdk/client-sqs');
 const _ = require('lodash');
 const { RequiredPropertyError } = require('../errors');
 const { get } = require('../assertions');
@@ -6,18 +5,44 @@ const { readQueueDelivery } = require('../queues/queue-delivery');
 const { runMessageScope } = require('./invocation-scope');
 const { getLogger } = require('../logs');
 
-const sqs = new SQSClient({ region: process.env.AWS_REGION });
 const log = getLogger('frigg.worker');
 
+/**
+ * Worker - queue message producer/consumer base class.
+ *
+ * Subclass and override _run(). The queue transport is behind
+ * QueueClientInterface and can be injected (friggframework/frigg#545):
+ * `new MyWorker({ queueClient })`. Unlike #545 it is not required: without
+ * one the worker uses an SqsQueueClient configured exactly as before
+ * (AWS_REGION), created on first use rather than at module load, so
+ * requiring core constructs no AWS client and a Netlify/QStash worker that
+ * only calls _run() never touches SQS.
+ */
 class Worker {
+    /**
+     * @param {Object} [options]
+     * @param {import('../queues/queue-client-interface').QueueClientInterface} [options.queueClient]
+     */
+    constructor(options = {}) {
+        this._queueClient = options.queueClient || null;
+    }
+
+    _getQueueClient() {
+        if (!this._queueClient) {
+            const { SqsQueueClient } = require('../queues/sqs-queue-client');
+            this._queueClient = new SqsQueueClient({
+                clientConfig: { region: process.env.AWS_REGION },
+            });
+        }
+        return this._queueClient;
+    }
+
     async getQueueURL(params) {
         // Passing params in because there will be multiple QueueNames
         // let params = {
         //     QueueName:  process.env.QueueName
         // };
-        const command = new GetQueueUrlCommand(params);
-        const data = await sqs.send(command);
-        return data.QueueUrl;
+        return this._getQueueClient().getQueueUrl(params);
     }
 
     async run(params, context = {}) {
@@ -91,8 +116,7 @@ class Worker {
     }
 
     async sendAsyncSQSMessage(params) {
-        const command = new SendMessageCommand(params);
-        const data = await sqs.send(command);
+        const data = await this._getQueueClient().sendMessage(params);
         return data.MessageId;
     }
 

package/core/create-handler.js

@@ -81,6 +81,15 @@ const createHandler = (optionByName = {}) => {
                     if (shouldUseDatabase) {
                         const { connectPrisma } = require('../database/prisma');
                         await connectPrisma();
+
+                        // Extension bootstraps (e.g. db-credentials swapping a
+                        // module's env for its DB loader) run once per
+                        // process, after the connect and before any request
+                        // builds a module. AWS and Netlify both reach here.
+                        const {
+                            initializeApp,
+                        } = require('../extensions/initialize-app');
+                        await initializeApp();
                     }
 
                     // Helps reuse the database connection.  Lowers response times.

package/credential/repositories/credential-repository-documentdb.js

@@ -186,6 +186,40 @@ class CredentialRepositoryDocumentDB extends CredentialRepositoryInterface {
         return this._mapCredential(decryptedCredential);
     }
 
+    /**
+     * All credentials owned by a user, newest first.
+     *
+     * @param {string} userId - User ID
+     * @returns {Promise<Array<Object>>} Credentials with string IDs
+     */
+    async findCredentialsByUserId(userId) {
+        const userObjectId = toObjectId(userId);
+        if (!userObjectId) return [];
+        const docs = await findManyDrained(
+            this.prisma,
+            'Credential',
+            { userId: userObjectId },
+            { sort: { createdAt: -1 } }
+        );
+        const credentials = [];
+        for (const doc of docs) {
+            const decrypted = await this.encryptionService.decryptFields(
+                'Credential',
+                doc
+            );
+            credentials.push({
+                ...this._mapCredential(decrypted),
+                id: fromObjectId(doc._id),
+                userId: fromObjectId(doc.userId) ?? doc.userId,
+                externalId: doc.externalId ?? null,
+                authIsValid: doc.authIsValid ?? null,
+                createdAt: doc.createdAt ?? null,
+                updatedAt: doc.updatedAt ?? null,
+            });
+        }
+        return credentials;
+    }
+
     async updateCredential(credentialId, updates) {
         const objectId = toObjectId(credentialId);
         if (!objectId) return null;

package/credential/repositories/credential-repository-interface.js

@@ -80,6 +80,21 @@ class CredentialRepositoryInterface {
         );
     }
 
+    /**
+     * All credentials owned by a user, newest first.
+     *
+     * @param {string|number} userId - User ID (string from application layer)
+     * @returns {Promise<Array<Object>>} Credentials with string IDs, `createdAt`
+     *   and `updatedAt`, and the (decrypted) data fields spread in, as
+     *   findCredentialById returns them. Empty when the user has none.
+     * @abstract
+     */
+    async findCredentialsByUserId(userId) {
+        throw new Error(
+            'Method findCredentialsByUserId must be implemented by subclass'
+        );
+    }
+
     /**
      * Update a credential by ID
      *

package/credential/repositories/credential-repository-mongo.js

@@ -188,6 +188,29 @@ class CredentialRepositoryMongo extends CredentialRepositoryInterface {
         };
     }
 
+    /**
+     * All credentials owned by a user, newest first.
+     *
+     * @param {string} userId - User ID
+     * @returns {Promise<Array<Object>>} Credentials with string IDs
+     */
+    async findCredentialsByUserId(userId) {
+        if (!userId) return [];
+        const credentials = await this.prisma.credential.findMany({
+            where: { userId: String(userId) },
+            orderBy: { createdAt: 'desc' },
+        });
+        return credentials.map((credential) => ({
+            ...(credential.data || {}),
+            id: credential.id,
+            userId: credential.userId,
+            externalId: credential.externalId,
+            authIsValid: credential.authIsValid,
+            createdAt: credential.createdAt,
+            updatedAt: credential.updatedAt,
+        }));
+    }
+
     /**
      * Update a credential by ID
      * Replaces: Credential.findByIdAndUpdate(credentialId, { $set: updates })