@friggframework/devtools 2.0.0--canary.625.0de0db4.0 → 2.0.0--canary.625.eaeb79b.0

package/frigg-cli/ssm-command/index.js

@@ -163,21 +163,59 @@ async function pushOffloadedParameters(appDefinition, stage, options = {}) {
         options
     );
 
-    for (const key of skipped) {
-        console.warn(
-            `⚠️  Skipping ${key}: no value in the environment (--allow-empty)`
-        );
-    }
-
-    if (specs.length === 0) {
+    if (specs.length === 0 && skipped.length === 0) {
         return { pushed: [], skipped };
     }
 
-    const { SSMClient, PutParameterCommand } = require('@aws-sdk/client-ssm');
+    const {
+        SSMClient,
+        PutParameterCommand,
+        GetParametersCommand,
+    } = require('@aws-sdk/client-ssm');
     const client = new SSMClient({
         region: resolvePushRegion(options),
     });
 
+    // --allow-empty only rotates keys that already exist. A skipped key still
+    // ships in FRIGG_SSM_OFFLOADED_KEYS, so if its parameter does not exist the
+    // runtime fails fast at cold start on every function — a green deploy that
+    // bricks the fleet. Verify existence and abort instead.
+    if (skipped.length > 0) {
+        const prefix = resolveParameterPrefix(appDefinition, stage);
+        const names = skipped.map((key) => `${prefix}/${key}`);
+        const existing = new Set();
+        for (let i = 0; i < names.length; i += 10) {
+            const { Parameters = [] } = await client.send(
+                new GetParametersCommand({ Names: names.slice(i, i + 10) })
+            );
+            for (const param of Parameters) {
+                existing.add(param.Name);
+            }
+        }
+        const orphaned = skipped.filter(
+            (key) => !existing.has(`${prefix}/${key}`)
+        );
+        if (orphaned.length > 0) {
+            throw new Error(
+                `--allow-empty skipped ${orphaned.join(
+                    ', '
+                )}, but no such parameter exists in Parameter Store. --allow-empty ` +
+                    `only rotates keys that already have a value; a skipped key with no ` +
+                    `parameter stays in FRIGG_SSM_OFFLOADED_KEYS and fails every function ` +
+                    `at cold start. Set a value and push without --allow-empty.`
+            );
+        }
+        for (const key of skipped) {
+            console.warn(
+                `⚠️  Skipping ${key}: no value in the environment; keeping the existing Parameter Store value (--allow-empty)`
+            );
+        }
+    }
+
+    if (specs.length === 0) {
+        return { pushed: [], skipped };
+    }
+
     const pushed = [];
     for (const spec of specs) {
         const input = {

package/frigg-cli/ssm-command/index.test.js

@@ -1,5 +1,9 @@
 const { mockClient } = require('aws-sdk-client-mock');
-const { SSMClient, PutParameterCommand } = require('@aws-sdk/client-ssm');
+const {
+    SSMClient,
+    PutParameterCommand,
+    GetParametersCommand,
+} = require('@aws-sdk/client-ssm');
 const { pushOffloadedParameters, resolvePushRegion } = require('./index');
 
 describe('ssm-command pushOffloadedParameters', () => {
@@ -95,8 +99,11 @@ describe('ssm-command pushOffloadedParameters', () => {
         expect(ssmMock.commandCalls(PutParameterCommand)).toHaveLength(0);
     });
 
-    it('skips missing values with allowEmpty instead of throwing', async () => {
+    it('skips missing values with allowEmpty when the parameter already exists', async () => {
         delete process.env.MY_SECRET;
+        ssmMock.on(GetParametersCommand).resolves({
+            Parameters: [{ Name: '/frigg/my-app/dev/MY_SECRET' }],
+        });
 
         const result = await pushOffloadedParameters(appDefinition, 'dev', {
             allowEmpty: true,
@@ -105,6 +112,16 @@ describe('ssm-command pushOffloadedParameters', () => {
         expect(ssmMock.commandCalls(PutParameterCommand)).toHaveLength(1);
     });
 
+    it('aborts when allowEmpty skips a key that does not exist in Parameter Store', async () => {
+        delete process.env.MY_SECRET;
+        ssmMock.on(GetParametersCommand).resolves({ Parameters: [] });
+
+        await expect(
+            pushOffloadedParameters(appDefinition, 'dev', { allowEmpty: true })
+        ).rejects.toThrow(/MY_SECRET.*no such parameter|--allow-empty/s);
+        expect(ssmMock.commandCalls(PutParameterCommand)).toHaveLength(0);
+    });
+
     it('rejects values over the standard tier limit and suggests advanced', async () => {
         process.env.MY_CONFIG = 'x'.repeat(4097);
 

package/infrastructure/infrastructure-composer.js

@@ -32,17 +32,30 @@ const {
  * present at /var/task. esbuild-bundled functions (e.g. defaultWebsocket,
  * adopter custom functions) do NOT ship it — and a missing --import target is a
  * fatal Node startup error — so they are left with the handler-time loader
- * fallback instead. Set at function scope (function env wins over provider env).
+ * fallback instead.
+ *
+ * Set at function scope (function env wins over provider env), APPENDED to any
+ * NODE_OPTIONS already on the function or provider — so an app's own flags
+ * (OTel auto-instrumentation, source maps, memory tuning) survive instead of
+ * being clobbered. A function-level assignment shadows provider env in Lambda,
+ * so the provider value must be folded in here. Only a value already in the
+ * definition is appended — never a synthesized ${env:NODE_OPTIONS}, which would
+ * leak the deploy host's shell into every Lambda.
  */
-function applySsmPreloadNodeOptions(appDefinition, functions) {
+function applySsmPreloadNodeOptions(appDefinition, functions, providerEnvironment = {}) {
     if (!isSsmOffloadActive(appDefinition)) {
         return;
     }
     for (const fn of Object.values(functions)) {
-        if (fn.skipEsbuild) {
-            fn.environment = fn.environment || {};
-            fn.environment.NODE_OPTIONS = SSM_PRELOAD_NODE_OPTIONS;
+        if (!fn.skipEsbuild) {
+            continue;
         }
+        fn.environment = fn.environment || {};
+        const existing =
+            fn.environment.NODE_OPTIONS ?? providerEnvironment.NODE_OPTIONS;
+        fn.environment.NODE_OPTIONS = existing
+            ? `${existing} ${SSM_PRELOAD_NODE_OPTIONS}`
+            : SSM_PRELOAD_NODE_OPTIONS;
     }
 }
 const { modifyHandlerPaths } = require('./domains/shared/utilities/handler-path-resolver');
@@ -104,7 +117,11 @@ const composeServerlessDefinition = async (AppDefinition) => {
         definition.functions,
         merged.functionEnvironments
     );
-    applySsmPreloadNodeOptions(AppDefinition, definition.functions);
+    applySsmPreloadNodeOptions(
+        AppDefinition,
+        definition.functions,
+        definition.provider.environment
+    );
 
     if (merged.vpcConfig) {
         definition.provider.vpc = merged.vpcConfig;
@@ -147,5 +164,5 @@ const composeServerlessDefinition = async (AppDefinition) => {
     return definition;
 };
 
-module.exports = { composeServerlessDefinition };
+module.exports = { composeServerlessDefinition, applySsmPreloadNodeOptions };
 

package/infrastructure/infrastructure-composer.test.js

@@ -1,4 +1,10 @@
-const { composeServerlessDefinition } = require('./infrastructure-composer');
+const {
+    composeServerlessDefinition,
+    applySsmPreloadNodeOptions,
+} = require('./infrastructure-composer');
+const {
+    SSM_PRELOAD_NODE_OPTIONS,
+} = require('./domains/parameters/offload-utils');
 
 // Helper to build discovery responses with overridable fields
 const createDiscoveryResponse = (overrides = {}) => ({
@@ -1949,3 +1955,88 @@ describe('composeServerlessDefinition', () => {
         });
     });
 });
+
+describe('applySsmPreloadNodeOptions', () => {
+    const appDefinition = {
+        ssm: { enable: true },
+        environment: { FOO: 'ssm' },
+    };
+    const savedSkip = process.env.FRIGG_SKIP_AWS_DISCOVERY;
+
+    beforeEach(() => {
+        delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+    });
+
+    afterEach(() => {
+        if (savedSkip === undefined) {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+        } else {
+            process.env.FRIGG_SKIP_AWS_DISCOVERY = savedSkip;
+        }
+    });
+
+    it('sets the preload NODE_OPTIONS on a skipEsbuild function with no existing value', () => {
+        const functions = { auth: { skipEsbuild: true } };
+        applySsmPreloadNodeOptions(appDefinition, functions);
+        expect(functions.auth.environment.NODE_OPTIONS).toBe(
+            SSM_PRELOAD_NODE_OPTIONS
+        );
+    });
+
+    it('appends to an existing function-level NODE_OPTIONS instead of clobbering it', () => {
+        const functions = {
+            auth: {
+                skipEsbuild: true,
+                environment: { NODE_OPTIONS: '--enable-source-maps' },
+            },
+        };
+        applySsmPreloadNodeOptions(appDefinition, functions);
+        expect(functions.auth.environment.NODE_OPTIONS).toBe(
+            `--enable-source-maps ${SSM_PRELOAD_NODE_OPTIONS}`
+        );
+    });
+
+    it('folds in a provider-level NODE_OPTIONS (which the function env would otherwise shadow)', () => {
+        const functions = { auth: { skipEsbuild: true } };
+        applySsmPreloadNodeOptions(appDefinition, functions, {
+            NODE_OPTIONS: '--require ./otel.js',
+        });
+        expect(functions.auth.environment.NODE_OPTIONS).toBe(
+            `--require ./otel.js ${SSM_PRELOAD_NODE_OPTIONS}`
+        );
+    });
+
+    it('prefers a function-level value over the provider-level one', () => {
+        const functions = {
+            auth: {
+                skipEsbuild: true,
+                environment: { NODE_OPTIONS: '--fn-flag' },
+            },
+        };
+        applySsmPreloadNodeOptions(appDefinition, functions, {
+            NODE_OPTIONS: '--provider-flag',
+        });
+        expect(functions.auth.environment.NODE_OPTIONS).toBe(
+            `--fn-flag ${SSM_PRELOAD_NODE_OPTIONS}`
+        );
+    });
+
+    it('never touches esbuild-bundled functions', () => {
+        const functions = {
+            websocket: { environment: { NODE_OPTIONS: '--keep-me' } },
+        };
+        applySsmPreloadNodeOptions(appDefinition, functions, {
+            NODE_OPTIONS: '--provider',
+        });
+        expect(functions.websocket.environment.NODE_OPTIONS).toBe('--keep-me');
+    });
+
+    it('is a no-op when offload is inactive', () => {
+        const functions = { auth: { skipEsbuild: true } };
+        applySsmPreloadNodeOptions(
+            { ssm: { enable: true } }, // no offloaded keys → inactive
+            functions
+        );
+        expect(functions.auth.environment).toBeUndefined();
+    });
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.625.0de0db4.0",
+  "version": "2.0.0--canary.625.eaeb79b.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -26,9 +26,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.625.0de0db4.0",
-    "@friggframework/schemas": "2.0.0--canary.625.0de0db4.0",
-    "@friggframework/test": "2.0.0--canary.625.0de0db4.0",
+    "@friggframework/core": "2.0.0--canary.625.eaeb79b.0",
+    "@friggframework/schemas": "2.0.0--canary.625.eaeb79b.0",
+    "@friggframework/test": "2.0.0--canary.625.eaeb79b.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.18.0",
@@ -56,8 +56,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.625.0de0db4.0",
-    "@friggframework/prettier-config": "2.0.0--canary.625.0de0db4.0",
+    "@friggframework/eslint-config": "2.0.0--canary.625.eaeb79b.0",
+    "@friggframework/prettier-config": "2.0.0--canary.625.eaeb79b.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -89,5 +89,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "0de0db43a6403eb99de205e24fcde7e9761ba4f6"
+  "gitHead": "eaeb79b0e8f8bbe466ac40f389d603e86bd806b7"
 }