@friggframework/devtools 2.0.0--canary.622.eb44ae5.0 → 2.0.0--canary.625.27a7e7a.0

package/infrastructure/domains/shared/environment-builder.test.js

@@ -1,13 +1,10 @@
 /**
  * Tests for Environment Builder Service
- *
+ * 
  * Tests environment variable extraction and building
  */
 
-const {
-    getAppEnvironmentVars,
-    buildEnvironment,
-} = require('./environment-builder');
+const { getAppEnvironmentVars, buildEnvironment } = require('./environment-builder');
 
 describe('Environment Builder', () => {
     describe('getAppEnvironmentVars()', () => {
@@ -41,7 +38,7 @@ describe('Environment Builder', () => {
             expect(result.DISABLED_VAR).toBeUndefined();
         });
 
-        it('should ignore environment variables with non-boolean values', () => {
+        it("ignores non-boolean values other than the meaningful 'ssm' marker", () => {
             const appDefinition = {
                 environment: {
                     VALID: true,
@@ -111,39 +108,99 @@ describe('Environment Builder', () => {
         });
     });
 
-    describe('telemetry env passthrough (ADR-011)', () => {
-        it('auto-adds OTLP env passthroughs when an OTLP-family exporter is configured', () => {
-            const result = getAppEnvironmentVars({
-                telemetry: { exporter: { type: 'otlp' } },
-            });
-
-            expect(result.OTEL_EXPORTER_OTLP_ENDPOINT).toBe(
-                "${env:OTEL_EXPORTER_OTLP_ENDPOINT, ''}"
-            );
-            expect(result.OTEL_EXPORTER_OTLP_HEADERS).toBe(
-                "${env:OTEL_EXPORTER_OTLP_HEADERS, ''}"
-            );
-        });
+    describe("getAppEnvironmentVars() - 'ssm' offload", () => {
+        const originalSkipDiscovery = process.env.FRIGG_SKIP_AWS_DISCOVERY;
 
-        it.each(['honeycomb', 'datadog'])(
-            'adds OTLP passthroughs for the "%s" preset',
-            (type) => {
-                const result = getAppEnvironmentVars({
-                    telemetry: { exporter: { type } },
-                });
-                expect(result.OTEL_EXPORTER_OTLP_ENDPOINT).toBeDefined();
+        afterEach(() => {
+            if (originalSkipDiscovery === undefined) {
+                delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            } else {
+                process.env.FRIGG_SKIP_AWS_DISCOVERY = originalSkipDiscovery;
             }
-        );
-
-        it('adds no OTLP env vars for console/none exporters or absent telemetry', () => {
-            expect(
-                getAppEnvironmentVars({
-                    telemetry: { exporter: { type: 'console' } },
-                }).OTEL_EXPORTER_OTLP_ENDPOINT
-            ).toBeUndefined();
-            expect(
-                getAppEnvironmentVars({}).OTEL_EXPORTER_OTLP_ENDPOINT
-            ).toBeUndefined();
+        });
+
+        it("excludes 'ssm' keys when offload is active", () => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            const appDefinition = {
+                ssm: { enable: true },
+                environment: { FOO: 'ssm', BAR: true },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.FOO).toBeUndefined();
+            expect(result.BAR).toBe("${env:BAR, ''}");
+        });
+
+        it("falls back to env reference for 'ssm' keys when FRIGG_SKIP_AWS_DISCOVERY is set", () => {
+            process.env.FRIGG_SKIP_AWS_DISCOVERY = 'true';
+            const appDefinition = {
+                ssm: { enable: true },
+                environment: { FOO: 'ssm' },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.FOO).toBe("${env:FOO, ''}");
+        });
+
+        it("falls back to env reference for 'ssm' keys when ssm is disabled", () => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            const appDefinition = {
+                ssm: { enable: false },
+                environment: { FOO: 'ssm' },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.FOO).toBe("${env:FOO, ''}");
+        });
+
+        it('falls back to env reference for a key declared only in ssm.parameters when FRIGG_SKIP_AWS_DISCOVERY is set', () => {
+            process.env.FRIGG_SKIP_AWS_DISCOVERY = 'true';
+            const appDefinition = {
+                ssm: {
+                    enable: true,
+                    parameters: { HUBSPOT_CLIENT_SECRET: { type: 'SecureString' } },
+                },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.HUBSPOT_CLIENT_SECRET).toBe("${env:HUBSPOT_CLIENT_SECRET, ''}");
+        });
+
+        it('excludes a key declared only in ssm.parameters when offload is active', () => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            const appDefinition = {
+                ssm: {
+                    enable: true,
+                    parameters: { HUBSPOT_CLIENT_SECRET: { type: 'SecureString' } },
+                },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.HUBSPOT_CLIENT_SECRET).toBeUndefined();
+        });
+
+        it("does not double-process a key present in both environment:'ssm' and ssm.parameters", () => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            const appDefinition = {
+                ssm: {
+                    enable: true,
+                    parameters: { FOO: { type: 'SecureString' } },
+                },
+                environment: { FOO: 'ssm' },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.FOO).toBeUndefined();
+
+            process.env.FRIGG_SKIP_AWS_DISCOVERY = 'true';
+            const fallbackResult = getAppEnvironmentVars(appDefinition);
+            expect(fallbackResult.FOO).toBe("${env:FOO, ''}");
         });
     });
 
@@ -154,10 +211,7 @@ describe('Environment Builder', () => {
             };
             const discoveredResources = {};
 
-            const result = buildEnvironment(
-                appEnvironmentVars,
-                discoveredResources
-            );
+            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
 
             expect(result.API_KEY).toBe("${env:API_KEY, ''}");
             expect(result.STAGE).toBe('${self:provider.stage}');
@@ -172,14 +226,9 @@ describe('Environment Builder', () => {
                 kmsKeyId: 'arn:aws:kms:us-east-1:123456:key/abc-123',
             };
 
-            const result = buildEnvironment(
-                appEnvironmentVars,
-                discoveredResources
-            );
+            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
 
-            expect(result.KMS_KEY_ARN).toBe(
-                'arn:aws:kms:us-east-1:123456:key/abc-123'
-            );
+            expect(result.KMS_KEY_ARN).toBe('arn:aws:kms:us-east-1:123456:key/abc-123');
         });
 
         it('should prefer kmsKeyId over kmsKeyArn if both present', () => {
@@ -189,33 +238,22 @@ describe('Environment Builder', () => {
                 kmsKeyArn: 'arn:aws:kms:us-east-1:123456:key/secondary',
             };
 
-            const result = buildEnvironment(
-                appEnvironmentVars,
-                discoveredResources
-            );
+            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
 
             // Implementation uses if/else-if, so kmsKeyId takes priority
-            expect(result.KMS_KEY_ARN).toBe(
-                'arn:aws:kms:us-east-1:123456:key/primary'
-            );
+            expect(result.KMS_KEY_ARN).toBe('arn:aws:kms:us-east-1:123456:key/primary');
         });
 
         it('should add database connection info if discovered', () => {
             const appEnvironmentVars = {};
             const discoveredResources = {
-                auroraClusterEndpoint:
-                    'cluster.abc.us-east-1.rds.amazonaws.com',
+                auroraClusterEndpoint: 'cluster.abc.us-east-1.rds.amazonaws.com',
                 auroraPort: 5432,
             };
 
-            const result = buildEnvironment(
-                appEnvironmentVars,
-                discoveredResources
-            );
+            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
 
-            expect(result.DATABASE_HOST).toBe(
-                'cluster.abc.us-east-1.rds.amazonaws.com'
-            );
+            expect(result.DATABASE_HOST).toBe('cluster.abc.us-east-1.rds.amazonaws.com');
             expect(result.DATABASE_PORT).toBe('5432');
         });
 
@@ -225,10 +263,7 @@ describe('Environment Builder', () => {
                 auroraClusterEndpoint: 'cluster.example.com',
             };
 
-            const result = buildEnvironment(
-                appEnvironmentVars,
-                discoveredResources
-            );
+            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
 
             expect(result.DATABASE_HOST).toBe('cluster.example.com');
             expect(result.DATABASE_PORT).toBe('5432');
@@ -237,18 +272,12 @@ describe('Environment Builder', () => {
         it('should add database secret ARN if discovered', () => {
             const appEnvironmentVars = {};
             const discoveredResources = {
-                databaseSecretArn:
-                    'arn:aws:secretsmanager:us-east-1:123456:secret:db-secret',
+                databaseSecretArn: 'arn:aws:secretsmanager:us-east-1:123456:secret:db-secret',
             };
 
-            const result = buildEnvironment(
-                appEnvironmentVars,
-                discoveredResources
-            );
+            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
 
-            expect(result.DATABASE_SECRET_ARN).toBe(
-                'arn:aws:secretsmanager:us-east-1:123456:secret:db-secret'
-            );
+            expect(result.DATABASE_SECRET_ARN).toBe('arn:aws:secretsmanager:us-east-1:123456:secret:db-secret');
         });
 
         it('should combine all discovered resources', () => {
@@ -259,27 +288,19 @@ describe('Environment Builder', () => {
                 kmsKeyArn: 'arn:aws:kms:us-east-1:123456:key/abc',
                 auroraClusterEndpoint: 'db.example.com',
                 auroraPort: 3306,
-                databaseSecretArn:
-                    'arn:aws:secretsmanager:us-east-1:123456:secret:db',
+                databaseSecretArn: 'arn:aws:secretsmanager:us-east-1:123456:secret:db',
             };
 
-            const result = buildEnvironment(
-                appEnvironmentVars,
-                discoveredResources
-            );
+            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
 
             expect(result.CUSTOM_VAR).toBe("${env:CUSTOM_VAR, ''}");
             expect(result.FRIGG_STACK).toBe('${self:service}');
             expect(result.FRIGG_STAGE).toBe('${self:provider.stage}');
             expect(result.FRIGG_REGION).toBe('${self:provider.region}');
-            expect(result.KMS_KEY_ARN).toBe(
-                'arn:aws:kms:us-east-1:123456:key/abc'
-            );
+            expect(result.KMS_KEY_ARN).toBe('arn:aws:kms:us-east-1:123456:key/abc');
             expect(result.DATABASE_HOST).toBe('db.example.com');
             expect(result.DATABASE_PORT).toBe('3306');
-            expect(result.DATABASE_SECRET_ARN).toBe(
-                'arn:aws:secretsmanager:us-east-1:123456:secret:db'
-            );
+            expect(result.DATABASE_SECRET_ARN).toBe('arn:aws:secretsmanager:us-east-1:123456:secret:db');
         });
 
         it('should handle empty discoveredResources', () => {
@@ -288,10 +309,7 @@ describe('Environment Builder', () => {
             };
             const discoveredResources = {};
 
-            const result = buildEnvironment(
-                appEnvironmentVars,
-                discoveredResources
-            );
+            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
 
             expect(result.API_KEY).toBe("${env:API_KEY, ''}");
             expect(result.FRIGG_STACK).toBe('${self:service}');
@@ -315,13 +333,11 @@ describe('Environment Builder', () => {
                 auroraPort: 3306, // Number
             };
 
-            const result = buildEnvironment(
-                appEnvironmentVars,
-                discoveredResources
-            );
+            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
 
             expect(result.DATABASE_PORT).toBe('3306'); // String
             expect(typeof result.DATABASE_PORT).toBe('string');
         });
     });
 });
+

package/infrastructure/domains/shared/function-environments.js

@@ -0,0 +1,97 @@
+/**
+ * Per-function environment scoping (ADR-027)
+ *
+ * Builders emit `result.functionEnvironments` — a map of function name to
+ * env vars — instead of broadcasting framework vars app-wide through
+ * `result.environment`. The composer applies the merged map onto the final
+ * function definitions after every function (base + builder) exists.
+ */
+
+/**
+ * Whether builders should scope framework env vars per function. Skipped in
+ * local mode: the serverless-plugin injects LocalStack queue URLs at
+ * provider level only, and function-level values would shadow them.
+ *
+ * @param {Object} appDefinition
+ * @returns {boolean}
+ */
+function isScopedEnvironmentActive(appDefinition = {}) {
+    if (process.env.FRIGG_SKIP_AWS_DISCOVERY === 'true') return false;
+    return appDefinition.lambda?.scopedEnvironment === true;
+}
+
+/**
+ * Apply a merged functionEnvironments map onto the composed functions.
+ * A key a builder already set directly on a function wins (e.g. the
+ * admin-script router's own SCHEDULER_ROLE_ARN must not be clobbered by
+ * the integration-scheduler value). An unknown function name is a hard
+ * error — silently dropping a var would surface as a runtime failure.
+ *
+ * @param {Object} functions - definition.functions (mutated)
+ * @param {Object} functionEnvironments - { fnName: { KEY: value } }
+ */
+function applyFunctionEnvironments(functions, functionEnvironments = {}) {
+    for (const [fnName, env] of Object.entries(functionEnvironments)) {
+        const fn = functions[fnName];
+        if (!fn) {
+            throw new Error(
+                `functionEnvironments targets unknown function '${fnName}' (known: ${Object.keys(
+                    functions
+                ).join(', ')})`
+            );
+        }
+        fn.environment = { ...env, ...(fn.environment || {}) };
+    }
+}
+
+/**
+ * Function names the integration builder creates for one integration.
+ * Wire contract: must stay in sync with
+ * IntegrationBuilder.createFunctionDefinitions — a drift here surfaces as a
+ * hard unknown-function error at compose time, not a silent var drop.
+ *
+ * @param {Object} integration - entry from appDefinition.integrations
+ * @returns {string[]}
+ */
+function getIntegrationFunctionNames(integration) {
+    const name = integration.Definition.name;
+    const names = [name, `${name}QueueWorker`];
+
+    const webhooks = integration.Definition.webhooks;
+    if (webhooks === true || webhooks?.enabled === true) {
+        names.splice(1, 0, `${name}Webhook`);
+    }
+
+    for (const [bindingKey, binding] of Object.entries(
+        integration.Definition.extensions || {}
+    )) {
+        const routes = binding?.extension?.routes || [];
+        if (routes.length === 0) continue;
+        names.push(`${name}__${String(bindingKey).replace(/[^A-Za-z0-9]/g, '')}`);
+    }
+
+    return names;
+}
+
+/**
+ * Admin-script functions, when the feature is on (mirrors
+ * AdminScriptBuilder.shouldExecute). Both can instantiate arbitrary
+ * integrations, so they belong in every integration's queue-URL consumer
+ * set.
+ *
+ * @param {Object} appDefinition
+ * @returns {string[]}
+ */
+function getAdminFunctionNames(appDefinition = {}) {
+    return Array.isArray(appDefinition.adminScripts) &&
+        appDefinition.adminScripts.length > 0
+        ? ['adminScriptRouter', 'adminScriptExecutor']
+        : [];
+}
+
+module.exports = {
+    isScopedEnvironmentActive,
+    applyFunctionEnvironments,
+    getIntegrationFunctionNames,
+    getAdminFunctionNames,
+};

package/infrastructure/domains/shared/function-environments.test.js

@@ -0,0 +1,146 @@
+const {
+    isScopedEnvironmentActive,
+    applyFunctionEnvironments,
+} = require('./function-environments');
+
+describe('function-environments', () => {
+    const originalSkipDiscovery = process.env.FRIGG_SKIP_AWS_DISCOVERY;
+
+    afterEach(() => {
+        if (originalSkipDiscovery === undefined) {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+        } else {
+            process.env.FRIGG_SKIP_AWS_DISCOVERY = originalSkipDiscovery;
+        }
+    });
+
+    describe('isScopedEnvironmentActive', () => {
+        it('is true only when lambda.scopedEnvironment is set', () => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            expect(
+                isScopedEnvironmentActive({
+                    lambda: { scopedEnvironment: true },
+                })
+            ).toBe(true);
+            expect(isScopedEnvironmentActive({})).toBe(false);
+            expect(
+                isScopedEnvironmentActive({
+                    lambda: { scopedEnvironment: false },
+                })
+            ).toBe(false);
+        });
+
+        it('is false in local mode: the serverless-plugin injects LocalStack queue URLs at provider level only', () => {
+            process.env.FRIGG_SKIP_AWS_DISCOVERY = 'true';
+            expect(
+                isScopedEnvironmentActive({
+                    lambda: { scopedEnvironment: true },
+                })
+            ).toBe(false);
+        });
+    });
+
+    describe('getIntegrationFunctionNames', () => {
+        const { getIntegrationFunctionNames } = require('./function-environments');
+
+        it('always includes the router and queue worker', () => {
+            expect(
+                getIntegrationFunctionNames({ Definition: { name: 'hubspot' } })
+            ).toEqual(['hubspot', 'hubspotQueueWorker']);
+        });
+
+        it('includes the webhook handler when webhooks are enabled', () => {
+            expect(
+                getIntegrationFunctionNames({
+                    Definition: { name: 'hubspot', webhooks: true },
+                })
+            ).toContain('hubspotWebhook');
+            expect(
+                getIntegrationFunctionNames({
+                    Definition: { name: 'hubspot', webhooks: { enabled: true } },
+                })
+            ).toContain('hubspotWebhook');
+            expect(
+                getIntegrationFunctionNames({
+                    Definition: { name: 'hubspot', webhooks: { enabled: false } },
+                })
+            ).not.toContain('hubspotWebhook');
+        });
+
+        it('includes one function per routed extension binding, sanitized', () => {
+            const names = getIntegrationFunctionNames({
+                Definition: {
+                    name: 'hubspot',
+                    extensions: {
+                        'my-ext': { extension: { routes: [{ path: '/x', method: 'GET' }] } },
+                        routeless: { extension: { routes: [] } },
+                    },
+                },
+            });
+            expect(names).toContain('hubspot__myext');
+            expect(names).not.toContain('hubspot__routeless');
+        });
+    });
+
+    describe('getAdminFunctionNames', () => {
+        const { getAdminFunctionNames } = require('./function-environments');
+
+        it('returns the admin functions only when admin scripts are configured', () => {
+            expect(
+                getAdminFunctionNames({ adminScripts: [{ Definition: { name: 'x' } }] })
+            ).toEqual(['adminScriptRouter', 'adminScriptExecutor']);
+            expect(getAdminFunctionNames({})).toEqual([]);
+            expect(getAdminFunctionNames({ adminScripts: [] })).toEqual([]);
+        });
+    });
+
+    describe('applyFunctionEnvironments', () => {
+        const makeFunctions = () => ({
+            auth: { handler: 'auth.handler' },
+            hubspot: {
+                handler: 'hubspot.handler',
+                environment: { EXISTING: 'builder-set' },
+            },
+        });
+
+        it('assigns scoped env vars onto the target functions', () => {
+            const functions = makeFunctions();
+            applyFunctionEnvironments(functions, {
+                auth: { HUBSPOT_QUEUE_URL: 'url-1' },
+                hubspot: { HUBSPOT_QUEUE_URL: 'url-1' },
+            });
+
+            expect(functions.auth.environment).toEqual({
+                HUBSPOT_QUEUE_URL: 'url-1',
+            });
+            expect(functions.hubspot.environment).toEqual({
+                EXISTING: 'builder-set',
+                HUBSPOT_QUEUE_URL: 'url-1',
+            });
+        });
+
+        it('never clobbers a key a builder already set directly on the function', () => {
+            const functions = makeFunctions();
+            applyFunctionEnvironments(functions, {
+                hubspot: { EXISTING: 'scoped-value', OTHER: 'x' },
+            });
+
+            expect(functions.hubspot.environment.EXISTING).toBe('builder-set');
+            expect(functions.hubspot.environment.OTHER).toBe('x');
+        });
+
+        it('throws on an unknown function name instead of silently dropping vars', () => {
+            expect(() =>
+                applyFunctionEnvironments(makeFunctions(), {
+                    typoFunction: { A: '1' },
+                })
+            ).toThrow(/typoFunction/);
+        });
+
+        it('is a no-op for an empty map', () => {
+            const functions = makeFunctions();
+            applyFunctionEnvironments(functions, {});
+            expect(functions.auth.environment).toBeUndefined();
+        });
+    });
+});

package/infrastructure/infrastructure-composer.js

@@ -20,6 +20,7 @@ const { SchedulerBuilder } = require('./domains/scheduler/scheduler-builder');
 const { AdminScriptBuilder } = require('./domains/admin-scripts/admin-script-builder');
 
 // Utilities
+const { applyFunctionEnvironments } = require('./domains/shared/function-environments');
 const { modifyHandlerPaths } = require('./domains/shared/utilities/handler-path-resolver');
 const { createBaseDefinition } = require('./domains/shared/utilities/base-definition-factory');
 const { ensurePrismaLayerExists } = require('./domains/shared/utilities/prisma-layer-manager');
@@ -75,6 +76,10 @@ const composeServerlessDefinition = async (AppDefinition) => {
     definition.provider.iamRoleStatements.push(...merged.iamStatements);
     Object.assign(definition.provider.environment, merged.environment);
     Object.assign(definition.functions, merged.functions);
+    applyFunctionEnvironments(
+        definition.functions,
+        merged.functionEnvironments
+    );
 
     if (merged.vpcConfig) {
         definition.provider.vpc = merged.vpcConfig;