@friggframework/devtools 2.0.0-next.101 → 2.0.0-next.102

package/frigg-cli/ssm-command/index.test.js

@@ -0,0 +1,318 @@
+const { mockClient } = require('aws-sdk-client-mock');
+const {
+    SSMClient,
+    PutParameterCommand,
+    GetParametersCommand,
+} = require('@aws-sdk/client-ssm');
+const { pushOffloadedParameters, resolvePushRegion } = require('./index');
+
+describe('ssm-command pushOffloadedParameters', () => {
+    let ssmMock;
+    const originalEnv = process.env;
+
+    const appDefinition = {
+        name: 'my-app',
+        ssm: {
+            enable: true,
+            parameters: {
+                MY_SECRET: { type: 'SecureString' },
+            },
+        },
+        environment: {
+            MY_CONFIG: 'ssm',
+            PLAIN: true,
+        },
+    };
+
+    beforeEach(() => {
+        ssmMock = mockClient(SSMClient);
+        ssmMock.on(PutParameterCommand).resolves({ Version: 1 });
+        process.env = {
+            ...originalEnv,
+            MY_SECRET: 'shh',
+            MY_CONFIG: 'value-1',
+        };
+    });
+
+    afterEach(() => {
+        ssmMock.restore();
+        process.env = originalEnv;
+    });
+
+    it('pushes each offloaded key with resolved name, type, and overwrite', async () => {
+        const result = await pushOffloadedParameters(appDefinition, 'prod');
+
+        const calls = ssmMock.commandCalls(PutParameterCommand);
+        expect(calls).toHaveLength(2);
+
+        const byName = Object.fromEntries(
+            calls.map((c) => [c.args[0].input.Name, c.args[0].input])
+        );
+        expect(byName['/frigg/my-app/prod/MY_SECRET']).toMatchObject({
+            Value: 'shh',
+            Type: 'SecureString',
+            Overwrite: true,
+        });
+        expect(byName['/frigg/my-app/prod/MY_CONFIG']).toMatchObject({
+            Value: 'value-1',
+            Type: 'String',
+            Overwrite: true,
+        });
+        expect(result.pushed).toHaveLength(2);
+    });
+
+    it('passes KeyId for SecureString when ssm.kmsKeyArn is set', async () => {
+        const withKey = {
+            ...appDefinition,
+            ssm: {
+                ...appDefinition.ssm,
+                kmsKeyArn: 'arn:aws:kms:us-east-1:1:key/k',
+            },
+        };
+        await pushOffloadedParameters(withKey, 'dev');
+
+        const inputs = ssmMock
+            .commandCalls(PutParameterCommand)
+            .map((c) => c.args[0].input);
+        const secure = inputs.find((i) => i.Type === 'SecureString');
+        const plain = inputs.find((i) => i.Type === 'String');
+        expect(secure.KeyId).toBe('arn:aws:kms:us-east-1:1:key/k');
+        expect(plain.KeyId).toBeUndefined();
+    });
+
+    it('is a silent no-op when nothing is offloaded', async () => {
+        const result = await pushOffloadedParameters(
+            { name: 'x', environment: { PLAIN: true } },
+            'dev'
+        );
+        expect(result.pushed).toHaveLength(0);
+        expect(ssmMock.commandCalls(PutParameterCommand)).toHaveLength(0);
+    });
+
+    it('throws listing keys with missing or empty values', async () => {
+        delete process.env.MY_SECRET;
+        process.env.MY_CONFIG = '';
+
+        await expect(
+            pushOffloadedParameters(appDefinition, 'dev')
+        ).rejects.toThrow(/MY_SECRET.*MY_CONFIG|MY_CONFIG.*MY_SECRET/s);
+        expect(ssmMock.commandCalls(PutParameterCommand)).toHaveLength(0);
+    });
+
+    it('skips missing values with allowEmpty when the parameter already exists', async () => {
+        delete process.env.MY_SECRET;
+        ssmMock.on(GetParametersCommand).resolves({
+            Parameters: [{ Name: '/frigg/my-app/dev/MY_SECRET' }],
+        });
+
+        const result = await pushOffloadedParameters(appDefinition, 'dev', {
+            allowEmpty: true,
+        });
+        expect(result.skipped).toEqual(['MY_SECRET']);
+        expect(ssmMock.commandCalls(PutParameterCommand)).toHaveLength(1);
+    });
+
+    it('aborts when allowEmpty skips a key that does not exist in Parameter Store', async () => {
+        delete process.env.MY_SECRET;
+        ssmMock.on(GetParametersCommand).resolves({ Parameters: [] });
+
+        await expect(
+            pushOffloadedParameters(appDefinition, 'dev', { allowEmpty: true })
+        ).rejects.toThrow(/MY_SECRET.*no such parameter|--allow-empty/s);
+        expect(ssmMock.commandCalls(PutParameterCommand)).toHaveLength(0);
+    });
+
+    it('rejects values over the standard tier limit and suggests advanced', async () => {
+        process.env.MY_CONFIG = 'x'.repeat(4097);
+
+        await expect(
+            pushOffloadedParameters(appDefinition, 'dev')
+        ).rejects.toThrow(/advanced/i);
+    });
+
+    it('accepts large values with the advanced tier', async () => {
+        process.env.MY_CONFIG = 'x'.repeat(4097);
+
+        await pushOffloadedParameters(appDefinition, 'dev', {
+            tier: 'advanced',
+        });
+        const inputs = ssmMock
+            .commandCalls(PutParameterCommand)
+            .map((c) => c.args[0].input);
+        expect(
+            inputs.find((i) => i.Name.endsWith('/MY_CONFIG')).Tier
+        ).toBe('Advanced');
+    });
+
+    it('rejects values over the advanced tier limit', async () => {
+        process.env.MY_CONFIG = 'x'.repeat(8193);
+
+        await expect(
+            pushOffloadedParameters(appDefinition, 'dev', {
+                tier: 'advanced',
+            })
+        ).rejects.toThrow(/8192|8 ?KB/i);
+    });
+
+    describe('per-key tier resolution', () => {
+        const withKeyTier = {
+            ...appDefinition,
+            ssm: {
+                ...appDefinition.ssm,
+                parameters: {
+                    MY_SECRET: { type: 'SecureString' },
+                    MY_CONFIG: { tier: 'advanced' },
+                },
+            },
+        };
+
+        it('accepts a large value when the key is configured advanced in the app definition', async () => {
+            process.env.MY_CONFIG = 'x'.repeat(4097);
+
+            await pushOffloadedParameters(withKeyTier, 'dev');
+
+            const config = ssmMock
+                .commandCalls(PutParameterCommand)
+                .map((c) => c.args[0].input)
+                .find((i) => i.Name.endsWith('/MY_CONFIG'));
+            expect(config.Tier).toBe('Advanced');
+        });
+
+        it('validates each key against its own configured tier', async () => {
+            // MY_CONFIG (advanced) tolerates 5000 bytes; MY_SECRET (standard) does not
+            process.env.MY_CONFIG = 'x'.repeat(5000);
+            process.env.MY_SECRET = 'y'.repeat(5000);
+
+            await expect(
+                pushOffloadedParameters(withKeyTier, 'dev')
+            ).rejects.toThrow(/MY_SECRET/);
+            expect(ssmMock.commandCalls(PutParameterCommand)).toHaveLength(0);
+        });
+
+        it('does not tag standard-tier keys with an Advanced tier', async () => {
+            await pushOffloadedParameters(withKeyTier, 'dev');
+
+            const secret = ssmMock
+                .commandCalls(PutParameterCommand)
+                .map((c) => c.args[0].input)
+                .find((i) => i.Name.endsWith('/MY_SECRET'));
+            expect(secret.Tier).toBeUndefined();
+        });
+
+        it('lets the --tier CLI option override per-key config for all keys', async () => {
+            process.env.MY_CONFIG = 'x'.repeat(4097);
+
+            await expect(
+                pushOffloadedParameters(withKeyTier, 'dev', {
+                    tier: 'standard',
+                })
+            ).rejects.toThrow(/advanced/i);
+        });
+    });
+
+    it('throws on invalid offload config (markers without ssm.enable)', async () => {
+        await expect(
+            pushOffloadedParameters(
+                { name: 'x', environment: { FOO: 'ssm' } },
+                'dev'
+            )
+        ).rejects.toThrow(/ssm\.enable/);
+    });
+
+    it('wraps AWS errors with the parameter name', async () => {
+        ssmMock
+            .on(PutParameterCommand, {
+                Name: '/frigg/my-app/dev/MY_SECRET',
+            })
+            .rejects(new Error('boom'));
+
+        await expect(
+            pushOffloadedParameters(appDefinition, 'dev')
+        ).rejects.toThrow(/MY_SECRET/);
+    });
+
+    it('retries a throttled PutParameter and succeeds', async () => {
+        const throttle = Object.assign(new Error('Rate exceeded'), {
+            name: 'ThrottlingException',
+        });
+        ssmMock
+            .on(PutParameterCommand, {
+                Name: '/frigg/my-app/dev/MY_SECRET',
+            })
+            .rejectsOnce(throttle)
+            .resolves({ Version: 2 });
+
+        const result = await pushOffloadedParameters(appDefinition, 'dev');
+
+        expect(result.pushed).toHaveLength(2);
+        const secretCalls = ssmMock
+            .commandCalls(PutParameterCommand)
+            .filter(
+                (c) => c.args[0].input.Name === '/frigg/my-app/dev/MY_SECRET'
+            );
+        expect(secretCalls).toHaveLength(2);
+    });
+
+    it('exposes keys pushed so far on a mid-batch failure', async () => {
+        // MY_CONFIG (sorted before MY_SECRET) succeeds; MY_SECRET fails.
+        ssmMock
+            .on(PutParameterCommand, {
+                Name: '/frigg/my-app/dev/MY_CONFIG',
+            })
+            .resolves({ Version: 1 });
+        ssmMock
+            .on(PutParameterCommand, {
+                Name: '/frigg/my-app/dev/MY_SECRET',
+            })
+            .rejects(new Error('boom'));
+
+        let caught;
+        try {
+            await pushOffloadedParameters(appDefinition, 'dev');
+        } catch (error) {
+            caught = error;
+        }
+
+        expect(caught).toBeDefined();
+        expect(caught.pushed).toEqual([
+            { name: '/frigg/my-app/dev/MY_CONFIG', version: 1 },
+        ]);
+    });
+
+    it('honors a custom parameterPrefix', async () => {
+        const custom = {
+            ...appDefinition,
+            ssm: { ...appDefinition.ssm, parameterPrefix: '/team/x' },
+        };
+        await pushOffloadedParameters(custom, 'dev');
+
+        const names = ssmMock
+            .commandCalls(PutParameterCommand)
+            .map((c) => c.args[0].input.Name);
+        expect(names).toEqual(
+            expect.arrayContaining([
+                '/team/x/MY_SECRET',
+                '/team/x/MY_CONFIG',
+            ])
+        );
+    });
+
+    describe('resolvePushRegion', () => {
+        it('prefers an explicit --region option over the environment', () => {
+            process.env.AWS_REGION = 'us-west-2';
+            expect(resolvePushRegion({ region: 'eu-central-1' })).toBe(
+                'eu-central-1'
+            );
+        });
+
+        it('falls back to AWS_REGION when no option is given', () => {
+            process.env.AWS_REGION = 'us-west-2';
+            expect(resolvePushRegion({})).toBe('us-west-2');
+        });
+
+        it('defaults to us-east-1 when neither option nor AWS_REGION is set', () => {
+            delete process.env.AWS_REGION;
+            expect(resolvePushRegion({})).toBe('us-east-1');
+        });
+    });
+});

package/infrastructure/__tests__/helpers/test-utils.js

@@ -166,12 +166,10 @@ function verifyKmsConfiguration(config) {
  * @param {Object} config - Serverless configuration
  */
 function verifySsmConfiguration(config) {
-    expect(config.provider.layers).toEqual([
-        'arn:aws:lambda:${self:provider.region}:177933569100:layer:AWS-Parameters-and-Secrets-Lambda-Extension:11'
-    ]);
-    expect(config.provider.environment.SSM_PARAMETER_PREFIX).toBe('/${self:service}/${self:provider.stage}');
+    // The framework does NOT use the AWS Parameters-and-Secrets extension layer
+    expect(config.provider.layers).toBeUndefined();
 
-    // Verify SSM IAM permissions
+    // Verify SSM IAM permissions (broad read grant added whenever SSM is enabled)
     const ssmPermission = config.provider.iamRoleStatements.find(
         statement => statement.Action.includes('ssm:GetParameter')
     );

package/infrastructure/__tests__/scoped-environment.test.js

@@ -0,0 +1,126 @@
+/**
+ * End-to-end composer tests for per-function environment scoping
+ * (lambda.scopedEnvironment, ADR-027).
+ */
+
+const { composeServerlessDefinition } = require('../infrastructure-composer');
+
+jest.mock('../domains/shared/resource-discovery', () => {
+    const originalModule = jest.requireActual(
+        '../domains/shared/resource-discovery'
+    );
+    return {
+        ...originalModule,
+        gatherDiscoveredResources: jest.fn().mockResolvedValue({
+            defaultVpcId: 'vpc-123456',
+            defaultSecurityGroupId: 'sg-123456',
+            privateSubnetId1: 'subnet-123456',
+            privateSubnetId2: 'subnet-789012',
+            defaultKmsKeyId:
+                'arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012',
+            auroraClusterEndpoint:
+                'test-cluster.cluster-abc123.us-east-1.rds.amazonaws.com',
+            auroraPort: 5432,
+        }),
+    };
+});
+
+const buildApp = (overrides = {}) => ({
+    name: 'scoped-test-app',
+    provider: 'aws',
+    usePrismaLambdaLayer: false,
+    encryption: { fieldLevelEncryptionMethod: 'aes' },
+    vpc: { enable: false },
+    database: { postgres: { enable: true } },
+    adminScripts: [{ Definition: { name: 'fixThings' } }],
+    integrations: [
+        { Definition: { name: 'hubspot', webhooks: true } },
+        { Definition: { name: 'slack' } },
+    ],
+    ...overrides,
+});
+
+const SCOPED_VARS = [
+    'HUBSPOT_QUEUE_URL',
+    'SLACK_QUEUE_URL',
+    'SCHEDULER_ROLE_ARN',
+    'SCHEDULE_GROUP_NAME',
+    'S3_BUCKET_NAME',
+    'MIGRATION_STATUS_BUCKET',
+    'DB_MIGRATION_QUEUE_URL',
+    'ADMIN_SCRIPT_QUEUE_URL',
+];
+
+describe('lambda.scopedEnvironment composer e2e', () => {
+    beforeEach(() => {
+        process.argv = ['node', 'test'];
+        delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+    });
+
+    afterEach(() => {
+        delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+    });
+
+    it('removes scoped vars from provider.environment and lands them on exact consumer sets', async () => {
+        const definition = await composeServerlessDefinition(
+            buildApp({ lambda: { scopedEnvironment: true } })
+        );
+
+        for (const key of SCOPED_VARS) {
+            expect(definition.provider.environment[key]).toBeUndefined();
+        }
+        // DB_TYPE deliberately stays global
+        expect(definition.provider.environment.DB_TYPE).toBe('postgresql');
+
+        const env = (fnName) => definition.functions[fnName].environment || {};
+
+        // auth + admin functions can reach every integration queue
+        for (const fnName of [
+            'auth',
+            'adminScriptRouter',
+            'adminScriptExecutor',
+        ]) {
+            expect(env(fnName).HUBSPOT_QUEUE_URL).toBeDefined();
+            expect(env(fnName).SLACK_QUEUE_URL).toBeDefined();
+        }
+
+        // owning integration set, cross-integration isolation
+        expect(env('hubspot').HUBSPOT_QUEUE_URL).toBeDefined();
+        expect(env('hubspotWebhook').HUBSPOT_QUEUE_URL).toBeDefined();
+        expect(env('hubspotQueueWorker').HUBSPOT_QUEUE_URL).toBeDefined();
+        expect(env('hubspotQueueWorker').SLACK_QUEUE_URL).toBeUndefined();
+        expect(env('slackQueueWorker').HUBSPOT_QUEUE_URL).toBeUndefined();
+
+        // scheduler vars on integration functions and the executor, but the
+        // router keeps its own admin-scheduler role reference untouched
+        expect(env('hubspot').SCHEDULER_ROLE_ARN).toEqual({
+            'Fn::GetAtt': ['SchedulerExecutionRole', 'Arn'],
+        });
+        expect(env('adminScriptExecutor').SCHEDULER_ROLE_ARN).toEqual({
+            'Fn::GetAtt': ['SchedulerExecutionRole', 'Arn'],
+        });
+
+        // migration vars only on the migration functions
+        expect(env('dbMigrationRouter').DB_MIGRATION_QUEUE_URL).toBeDefined();
+        expect(env('dbMigrationWorker').S3_BUCKET_NAME).toBeDefined();
+
+        // base functions that consume none of this carry none of it
+        for (const fnName of ['user', 'health']) {
+            for (const key of SCOPED_VARS) {
+                expect(env(fnName)[key]).toBeUndefined();
+            }
+        }
+    });
+
+    it('keeps full broadcast when the flag is off, byte-identical to omitting the lambda key', async () => {
+        const withoutKey = await composeServerlessDefinition(buildApp());
+        const withFlagOff = await composeServerlessDefinition(
+            buildApp({ lambda: { scopedEnvironment: false } })
+        );
+
+        expect(withFlagOff).toEqual(withoutKey);
+        for (const key of SCOPED_VARS) {
+            expect(withoutKey.provider.environment[key]).toBeDefined();
+        }
+    });
+});

package/infrastructure/__tests__/ssm-preload-node-options.test.js

@@ -0,0 +1,79 @@
+/**
+ * The SSM INIT preload (NODE_OPTIONS=--import) must be scoped to skipEsbuild
+ * functions only. esbuild-bundled functions (e.g. defaultWebsocket) do not
+ * package the preload .mjs, and a missing --import target fatally aborts Node
+ * startup — so a global NODE_OPTIONS would brick them (ADR-027 review finding).
+ */
+
+const { composeServerlessDefinition } = require('../infrastructure-composer');
+
+jest.mock('../domains/shared/resource-discovery', () => {
+    const original = jest.requireActual('../domains/shared/resource-discovery');
+    return {
+        ...original,
+        gatherDiscoveredResources: jest.fn().mockResolvedValue({
+            defaultVpcId: 'vpc-123456',
+            defaultSecurityGroupId: 'sg-123456',
+            privateSubnetId1: 'subnet-1',
+            privateSubnetId2: 'subnet-2',
+            defaultKmsKeyId:
+                'arn:aws:kms:us-east-1:123456789012:key/abc-123',
+            auroraClusterEndpoint: 'c.cluster-x.us-east-1.rds.amazonaws.com',
+            auroraPort: 5432,
+        }),
+    };
+});
+
+const buildApp = (overrides = {}) => ({
+    name: 'preload-test',
+    provider: 'aws',
+    usePrismaLambdaLayer: false,
+    encryption: { fieldLevelEncryptionMethod: 'aes' },
+    vpc: { enable: false },
+    database: { postgres: { enable: true } },
+    websockets: { enable: true },
+    integrations: [{ Definition: { name: 'hubspot' } }],
+    ...overrides,
+});
+
+const IMPORT_FRAGMENT = '--import file:///var/task/node_modules/@friggframework/core/core/ssm-preload.mjs';
+
+describe('SSM preload NODE_OPTIONS scoping', () => {
+    beforeEach(() => {
+        process.argv = ['node', 'test'];
+        delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+    });
+
+    it('sets NODE_OPTIONS --import on skipEsbuild functions and NOT on esbuild-bundled ones when offload is active', async () => {
+        const definition = await composeServerlessDefinition(
+            buildApp({
+                ssm: { enable: true },
+                environment: { HUBSPOT_SECRET: 'ssm' },
+            })
+        );
+        const fns = definition.functions;
+
+        // skipEsbuild handlers (auth/user/health + integration) package the
+        // preload → they get the flag.
+        expect(fns.auth.skipEsbuild).toBe(true);
+        expect(fns.auth.environment.NODE_OPTIONS).toBe(IMPORT_FRAGMENT);
+        expect(fns.hubspot.environment.NODE_OPTIONS).toBe(IMPORT_FRAGMENT);
+
+        // defaultWebsocket is esbuild-bundled (no skipEsbuild) → MUST NOT get it.
+        expect(fns.defaultWebsocket.skipEsbuild).toBeFalsy();
+        expect(fns.defaultWebsocket.environment?.NODE_OPTIONS).toBeUndefined();
+
+        // Never global.
+        expect(definition.provider.environment.NODE_OPTIONS).toBeUndefined();
+    });
+
+    it('sets no NODE_OPTIONS anywhere when offload is inactive', async () => {
+        const definition = await composeServerlessDefinition(
+            buildApp({ ssm: { enable: true } }) // enabled, but no 'ssm' keys
+        );
+        for (const fn of Object.values(definition.functions)) {
+            expect(fn.environment?.NODE_OPTIONS).toBeUndefined();
+        }
+        expect(definition.provider.environment.NODE_OPTIONS).toBeUndefined();
+    });
+});

package/infrastructure/domains/admin-scripts/admin-script-builder.js

@@ -14,6 +14,7 @@
  */
 
 const { InfrastructureBuilder, ValidationResult } = require('../shared/base-builder');
+const { isScopedEnvironmentActive } = require('../shared/function-environments');
 
 class AdminScriptBuilder extends InfrastructureBuilder {
     constructor() {
@@ -67,7 +68,7 @@ class AdminScriptBuilder extends InfrastructureBuilder {
         };
 
         // Create admin script queue
-        this.createAdminScriptQueue(result);
+        this.createAdminScriptQueue(result, appDefinition);
 
         // Create Lambda function for script execution
         this.createScriptExecutorFunction(appDefinition, result, usePrismaLayer);
@@ -90,7 +91,7 @@ class AdminScriptBuilder extends InfrastructureBuilder {
         return result;
     }
 
-    createAdminScriptQueue(result) {
+    createAdminScriptQueue(result, appDefinition) {
         result.resources.AdminScriptQueue = {
             Type: 'AWS::SQS::Queue',
             Properties: {
@@ -106,7 +107,20 @@ class AdminScriptBuilder extends InfrastructureBuilder {
             },
         };
 
-        result.environment.ADMIN_SCRIPT_QUEUE_URL = { Ref: 'AdminScriptQueue' };
+        if (isScopedEnvironmentActive(appDefinition)) {
+            // Only the admin functions read this queue URL
+            result.functionEnvironments = result.functionEnvironments || {};
+            for (const fnName of ['adminScriptRouter', 'adminScriptExecutor']) {
+                result.functionEnvironments[fnName] = {
+                    ...result.functionEnvironments[fnName],
+                    ADMIN_SCRIPT_QUEUE_URL: { Ref: 'AdminScriptQueue' },
+                };
+            }
+        } else {
+            result.environment.ADMIN_SCRIPT_QUEUE_URL = {
+                Ref: 'AdminScriptQueue',
+            };
+        }
 
         // The router enqueues async executions and scripts enqueue continuations
         // via queueScript()/queueScriptBatch(). The base role's wildcard does not

package/infrastructure/domains/admin-scripts/admin-script-builder.test.js

@@ -625,4 +625,49 @@ describe('AdminScriptBuilder', () => {
             expect(adminScriptBuilder.getName()).toBe('AdminScriptBuilder');
         });
     });
+
+    describe('scoped environment (lambda.scopedEnvironment)', () => {
+        const originalSkipDiscovery = process.env.FRIGG_SKIP_AWS_DISCOVERY;
+
+        beforeEach(() => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+        });
+
+        afterEach(() => {
+            if (originalSkipDiscovery === undefined) {
+                delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            } else {
+                process.env.FRIGG_SKIP_AWS_DISCOVERY = originalSkipDiscovery;
+            }
+        });
+
+        it('scopes ADMIN_SCRIPT_QUEUE_URL to the admin functions only', async () => {
+            const result = await adminScriptBuilder.build(
+                {
+                    lambda: { scopedEnvironment: true },
+                    adminScripts: [{ Definition: { name: 'fix-things' } }],
+                },
+                {}
+            );
+
+            expect(result.environment.ADMIN_SCRIPT_QUEUE_URL).toBeUndefined();
+            for (const fnName of ['adminScriptRouter', 'adminScriptExecutor']) {
+                expect(
+                    result.functionEnvironments[fnName].ADMIN_SCRIPT_QUEUE_URL
+                ).toEqual({ Ref: 'AdminScriptQueue' });
+            }
+        });
+
+        it('broadcasts app-wide when the flag is off', async () => {
+            const result = await adminScriptBuilder.build(
+                { adminScripts: [{ Definition: { name: 'fix-things' } }] },
+                {}
+            );
+
+            expect(result.environment.ADMIN_SCRIPT_QUEUE_URL).toEqual({
+                Ref: 'AdminScriptQueue',
+            });
+            expect(result.functionEnvironments).toBeUndefined();
+        });
+    });
 });