@friggframework/devtools 2.0.0-next.101 → 2.0.0-next.103

package/infrastructure/domains/shared/environment-builder.js

@@ -1,20 +1,60 @@
 /**
  * Environment Builder Service
- * 
+ *
  * Domain Service - Hexagonal Architecture
- * 
+ *
  * Builds Lambda environment variable configuration from:
  * 1. AppDefinition environment flags
  * 2. Discovered AWS resources (VPC IDs, KMS keys, etc.)
  * 3. Generated resource references
  */
 
+const {
+    isSsmOffloadActive,
+    getOffloadedKeys,
+} = require('../parameters/offload-utils');
+
+// OTLP-family exporters read their endpoint/headers from these standard env
+// vars (ADR-011). When such an exporter is configured we auto-register them as
+// Serverless passthroughs so the deployed Lambda inherits them from the deploy
+// environment — no need for the adopter to also list them under `environment`.
+//
+// NOTE (VPC egress): a Lambda in a private subnet needs a NAT gateway or a VPC
+// endpoint to reach an external OTLP backend (Honeycomb/Datadog). Without egress
+// the exporter fails silently within its flush timeout — see the deploy docs.
+const OTLP_EXPORTER_TYPES = new Set(['otlp', 'honeycomb', 'datadog']);
+const OTEL_PASSTHROUGH_VARS = [
+    'OTEL_EXPORTER_OTLP_ENDPOINT',
+    'OTEL_EXPORTER_OTLP_HEADERS',
+];
+
+function addTelemetryEnvPassthrough(appDefinition, envVars) {
+    const exporterType = appDefinition?.telemetry?.exporter?.type;
+    if (!OTLP_EXPORTER_TYPES.has(exporterType)) return;
+
+    // Skip offloaded keys here: baking '${env:KEY, ''}' resolves to '' at
+    // deploy (the value lives only in SSM), and '' !== undefined then blocks
+    // the SSM loader from ever fetching the real value.
+    const offloadedKeys = isSsmOffloadActive(appDefinition)
+        ? new Set(getOffloadedKeys(appDefinition))
+        : null;
+    for (const key of OTEL_PASSTHROUGH_VARS) {
+        if (offloadedKeys?.has(key)) continue;
+        envVars[key] = `\${env:${key}, ''}`;
+    }
+}
+
 /**
  * Get environment variables from AppDefinition
- * 
+ *
  * Extracts environment variable definitions where value is true,
  * and creates Serverless variable references.
- * 
+ *
+ * A value of 'ssm' offloads the variable to Parameter Store when offload is
+ * active (see SsmBuilder), keeping it out of the Lambda env map. When offload
+ * is not active (local mode / ssm disabled) it falls back to the same
+ * `${env:KEY, ''}` reference as `true` so `frigg start` + dotenv keeps working.
+ *
  * @param {Object} appDefinition - Application definition
  * @returns {Object} Environment variable mappings
  */
@@ -38,16 +78,40 @@ function getAppEnvironmentVars(appDefinition) {
         'AWS_SESSION_TOKEN',
     ]);
 
-    if (!appDefinition.environment) {
-        return envVars;
-    }
+    addTelemetryEnvPassthrough(appDefinition, envVars);
+
+    const environment = appDefinition.environment || {};
 
     console.log('📋 Loading environment variables from appDefinition...');
     const envKeys = [];
     const skippedKeys = [];
+    const offloadedKeys = [];
+    const offloadActive = isSsmOffloadActive(appDefinition);
+
+    for (const [key, value] of Object.entries(environment)) {
+        if (value === 'ssm' && offloadActive) {
+            offloadedKeys.push(key);
+            continue;
+        }
+        if (value !== true && value !== 'ssm') continue;
+        if (reservedVars.has(key)) {
+            skippedKeys.push(key);
+            continue;
+        }
+        envVars[key] = `\${env:${key}, ''}`;
+        envKeys.push(key);
+    }
 
-    for (const [key, value] of Object.entries(appDefinition.environment)) {
-        if (value !== true) continue;
+    // Keys declared only in ssm.parameters (no matching `environment` entry)
+    // get the same local-fallback treatment as `environment`-valued 'ssm' keys.
+    const ssmOnlyKeys = getOffloadedKeys(appDefinition).filter(
+        (key) => !(key in environment)
+    );
+    for (const key of ssmOnlyKeys) {
+        if (offloadActive) {
+            offloadedKeys.push(key);
+            continue;
+        }
         if (reservedVars.has(key)) {
             skippedKeys.push(key);
             continue;
@@ -65,19 +129,27 @@ function getAppEnvironmentVars(appDefinition) {
     }
     if (skippedKeys.length > 0) {
         console.log(
-            `   ⚠️  Skipped ${skippedKeys.length
+            `   ⚠️  Skipped ${
+                skippedKeys.length
             } reserved AWS Lambda variables: ${skippedKeys.join(', ')}`
         );
     }
+    if (offloadedKeys.length > 0) {
+        console.log(
+            `   🔒 Offloaded ${
+                offloadedKeys.length
+            } variables to SSM: ${offloadedKeys.join(', ')}`
+        );
+    }
 
     return envVars;
 }
 
 /**
  * Build complete environment configuration for Lambda functions
- * 
+ *
  * Combines app environment vars with discovered AWS resource references
- * 
+ *
  * @param {Object} appEnvironmentVars - Environment vars from AppDefinition
  * @param {Object} discoveredResources - Discovered AWS resources
  * @returns {Object} Complete environment configuration
@@ -85,7 +157,7 @@ function getAppEnvironmentVars(appDefinition) {
 function buildEnvironment(appEnvironmentVars, discoveredResources) {
     const environment = {
         ...appEnvironmentVars,
-        STAGE: '${self:provider.stage}',  // Used by encryption bypass logic
+        STAGE: '${self:provider.stage}', // Used by encryption bypass logic
         FRIGG_STACK: '${self:service}',
         FRIGG_STAGE: '${self:provider.stage}',
         FRIGG_REGION: '${self:provider.region}',
@@ -101,7 +173,9 @@ function buildEnvironment(appEnvironmentVars, discoveredResources) {
     // Add database connection info if discovered
     if (discoveredResources.auroraClusterEndpoint) {
         environment.DATABASE_HOST = discoveredResources.auroraClusterEndpoint;
-        environment.DATABASE_PORT = String(discoveredResources.auroraPort || 5432);
+        environment.DATABASE_PORT = String(
+            discoveredResources.auroraPort || 5432
+        );
     }
 
     // Add secrets manager secret ARN if discovered
@@ -116,4 +190,3 @@ module.exports = {
     getAppEnvironmentVars,
     buildEnvironment,
 };
-

package/infrastructure/domains/shared/environment-builder.test.js

@@ -1,10 +1,13 @@
 /**
  * Tests for Environment Builder Service
- * 
+ *
  * Tests environment variable extraction and building
  */
 
-const { getAppEnvironmentVars, buildEnvironment } = require('./environment-builder');
+const {
+    getAppEnvironmentVars,
+    buildEnvironment,
+} = require('./environment-builder');
 
 describe('Environment Builder', () => {
     describe('getAppEnvironmentVars()', () => {
@@ -38,7 +41,7 @@ describe('Environment Builder', () => {
             expect(result.DISABLED_VAR).toBeUndefined();
         });
 
-        it('should ignore environment variables with non-boolean values', () => {
+        it("ignores non-boolean values other than the meaningful 'ssm' marker", () => {
             const appDefinition = {
                 environment: {
                     VALID: true,
@@ -108,6 +111,244 @@ describe('Environment Builder', () => {
         });
     });
 
+    describe('telemetry env passthrough (ADR-011)', () => {
+        it('auto-adds OTLP env passthroughs when an OTLP-family exporter is configured', () => {
+            const result = getAppEnvironmentVars({
+                telemetry: { exporter: { type: 'otlp' } },
+            });
+
+            expect(result.OTEL_EXPORTER_OTLP_ENDPOINT).toBe(
+                "${env:OTEL_EXPORTER_OTLP_ENDPOINT, ''}"
+            );
+            expect(result.OTEL_EXPORTER_OTLP_HEADERS).toBe(
+                "${env:OTEL_EXPORTER_OTLP_HEADERS, ''}"
+            );
+        });
+
+        it.each(['honeycomb', 'datadog'])(
+            'adds OTLP passthroughs for the "%s" preset',
+            (type) => {
+                const result = getAppEnvironmentVars({
+                    telemetry: { exporter: { type } },
+                });
+                expect(result.OTEL_EXPORTER_OTLP_ENDPOINT).toBeDefined();
+            }
+        );
+
+        it('adds no OTLP env vars for console/none exporters or absent telemetry', () => {
+            expect(
+                getAppEnvironmentVars({
+                    telemetry: { exporter: { type: 'console' } },
+                }).OTEL_EXPORTER_OTLP_ENDPOINT
+            ).toBeUndefined();
+            expect(
+                getAppEnvironmentVars({}).OTEL_EXPORTER_OTLP_ENDPOINT
+            ).toBeUndefined();
+        });
+    });
+
+    describe("getAppEnvironmentVars() - 'ssm' offload", () => {
+        const originalSkipDiscovery = process.env.FRIGG_SKIP_AWS_DISCOVERY;
+
+        afterEach(() => {
+            if (originalSkipDiscovery === undefined) {
+                delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            } else {
+                process.env.FRIGG_SKIP_AWS_DISCOVERY = originalSkipDiscovery;
+            }
+        });
+
+        it("excludes 'ssm' keys when offload is active", () => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            const appDefinition = {
+                ssm: { enable: true },
+                environment: { FOO: 'ssm', BAR: true },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.FOO).toBeUndefined();
+            expect(result.BAR).toBe("${env:BAR, ''}");
+        });
+
+        it("falls back to env reference for 'ssm' keys when FRIGG_SKIP_AWS_DISCOVERY is set", () => {
+            process.env.FRIGG_SKIP_AWS_DISCOVERY = 'true';
+            const appDefinition = {
+                ssm: { enable: true },
+                environment: { FOO: 'ssm' },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.FOO).toBe("${env:FOO, ''}");
+        });
+
+        it("falls back to env reference for 'ssm' keys when ssm is disabled", () => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            const appDefinition = {
+                ssm: { enable: false },
+                environment: { FOO: 'ssm' },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.FOO).toBe("${env:FOO, ''}");
+        });
+
+        it('falls back to env reference for a key declared only in ssm.parameters when FRIGG_SKIP_AWS_DISCOVERY is set', () => {
+            process.env.FRIGG_SKIP_AWS_DISCOVERY = 'true';
+            const appDefinition = {
+                ssm: {
+                    enable: true,
+                    parameters: {
+                        HUBSPOT_CLIENT_SECRET: { type: 'SecureString' },
+                    },
+                },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.HUBSPOT_CLIENT_SECRET).toBe(
+                "${env:HUBSPOT_CLIENT_SECRET, ''}"
+            );
+        });
+
+        it('excludes a key declared only in ssm.parameters when offload is active', () => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            const appDefinition = {
+                ssm: {
+                    enable: true,
+                    parameters: {
+                        HUBSPOT_CLIENT_SECRET: { type: 'SecureString' },
+                    },
+                },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.HUBSPOT_CLIENT_SECRET).toBeUndefined();
+        });
+
+        it("does not double-process a key present in both environment:'ssm' and ssm.parameters", () => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            const appDefinition = {
+                ssm: {
+                    enable: true,
+                    parameters: { FOO: { type: 'SecureString' } },
+                },
+                environment: { FOO: 'ssm' },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.FOO).toBeUndefined();
+
+            process.env.FRIGG_SKIP_AWS_DISCOVERY = 'true';
+            const fallbackResult = getAppEnvironmentVars(appDefinition);
+            expect(fallbackResult.FOO).toBe("${env:FOO, ''}");
+        });
+    });
+
+    describe('telemetry env passthrough + SSM offload interaction', () => {
+        const originalSkipDiscovery = process.env.FRIGG_SKIP_AWS_DISCOVERY;
+
+        afterEach(() => {
+            if (originalSkipDiscovery === undefined) {
+                delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            } else {
+                process.env.FRIGG_SKIP_AWS_DISCOVERY = originalSkipDiscovery;
+            }
+        });
+
+        it("does not bake an OTEL passthrough var that is marked 'ssm' when offload is active", () => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            const appDefinition = {
+                telemetry: { exporter: { type: 'datadog' } },
+                ssm: { enable: true },
+                environment: {
+                    OTEL_EXPORTER_OTLP_ENDPOINT: 'ssm',
+                    OTEL_EXPORTER_OTLP_HEADERS: 'ssm',
+                },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.OTEL_EXPORTER_OTLP_ENDPOINT).toBeUndefined();
+            expect(result.OTEL_EXPORTER_OTLP_HEADERS).toBeUndefined();
+        });
+
+        it("keeps the direct passthrough for an OTEL var not marked 'ssm' while offloading its sibling", () => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            const appDefinition = {
+                telemetry: { exporter: { type: 'otlp' } },
+                ssm: { enable: true },
+                environment: {
+                    OTEL_EXPORTER_OTLP_ENDPOINT: 'ssm',
+                },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.OTEL_EXPORTER_OTLP_ENDPOINT).toBeUndefined();
+            expect(result.OTEL_EXPORTER_OTLP_HEADERS).toBe(
+                "${env:OTEL_EXPORTER_OTLP_HEADERS, ''}"
+            );
+        });
+
+        it("falls back to the env passthrough for an 'ssm'-marked OTEL var in local mode", () => {
+            process.env.FRIGG_SKIP_AWS_DISCOVERY = 'true';
+            const appDefinition = {
+                telemetry: { exporter: { type: 'datadog' } },
+                ssm: { enable: true },
+                environment: {
+                    OTEL_EXPORTER_OTLP_ENDPOINT: 'ssm',
+                },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.OTEL_EXPORTER_OTLP_ENDPOINT).toBe(
+                "${env:OTEL_EXPORTER_OTLP_ENDPOINT, ''}"
+            );
+        });
+
+        it("leaves a 'true'-marked OTEL var as a direct passthrough even when offload is active for another key", () => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            const appDefinition = {
+                telemetry: { exporter: { type: 'datadog' } },
+                ssm: { enable: true },
+                environment: {
+                    OTEL_EXPORTER_OTLP_ENDPOINT: true,
+                    SOME_OFFLOADED_SECRET: 'ssm',
+                },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.OTEL_EXPORTER_OTLP_ENDPOINT).toBe(
+                "${env:OTEL_EXPORTER_OTLP_ENDPOINT, ''}"
+            );
+            expect(result.SOME_OFFLOADED_SECRET).toBeUndefined();
+        });
+
+        it('does not bake an OTEL passthrough var offloaded only via ssm.parameters', () => {
+            delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+            const appDefinition = {
+                telemetry: { exporter: { type: 'datadog' } },
+                ssm: {
+                    enable: true,
+                    parameters: {
+                        OTEL_EXPORTER_OTLP_ENDPOINT: { type: 'SecureString' },
+                    },
+                },
+            };
+
+            const result = getAppEnvironmentVars(appDefinition);
+
+            expect(result.OTEL_EXPORTER_OTLP_ENDPOINT).toBeUndefined();
+        });
+    });
+
     describe('buildEnvironment()', () => {
         it('should combine app vars with standard Frigg variables', () => {
             const appEnvironmentVars = {
@@ -115,7 +356,10 @@ describe('Environment Builder', () => {
             };
             const discoveredResources = {};
 
-            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
+            const result = buildEnvironment(
+                appEnvironmentVars,
+                discoveredResources
+            );
 
             expect(result.API_KEY).toBe("${env:API_KEY, ''}");
             expect(result.STAGE).toBe('${self:provider.stage}');
@@ -130,9 +374,14 @@ describe('Environment Builder', () => {
                 kmsKeyId: 'arn:aws:kms:us-east-1:123456:key/abc-123',
             };
 
-            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
+            const result = buildEnvironment(
+                appEnvironmentVars,
+                discoveredResources
+            );
 
-            expect(result.KMS_KEY_ARN).toBe('arn:aws:kms:us-east-1:123456:key/abc-123');
+            expect(result.KMS_KEY_ARN).toBe(
+                'arn:aws:kms:us-east-1:123456:key/abc-123'
+            );
         });
 
         it('should prefer kmsKeyId over kmsKeyArn if both present', () => {
@@ -142,22 +391,33 @@ describe('Environment Builder', () => {
                 kmsKeyArn: 'arn:aws:kms:us-east-1:123456:key/secondary',
             };
 
-            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
+            const result = buildEnvironment(
+                appEnvironmentVars,
+                discoveredResources
+            );
 
             // Implementation uses if/else-if, so kmsKeyId takes priority
-            expect(result.KMS_KEY_ARN).toBe('arn:aws:kms:us-east-1:123456:key/primary');
+            expect(result.KMS_KEY_ARN).toBe(
+                'arn:aws:kms:us-east-1:123456:key/primary'
+            );
         });
 
         it('should add database connection info if discovered', () => {
             const appEnvironmentVars = {};
             const discoveredResources = {
-                auroraClusterEndpoint: 'cluster.abc.us-east-1.rds.amazonaws.com',
+                auroraClusterEndpoint:
+                    'cluster.abc.us-east-1.rds.amazonaws.com',
                 auroraPort: 5432,
             };
 
-            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
+            const result = buildEnvironment(
+                appEnvironmentVars,
+                discoveredResources
+            );
 
-            expect(result.DATABASE_HOST).toBe('cluster.abc.us-east-1.rds.amazonaws.com');
+            expect(result.DATABASE_HOST).toBe(
+                'cluster.abc.us-east-1.rds.amazonaws.com'
+            );
             expect(result.DATABASE_PORT).toBe('5432');
         });
 
@@ -167,7 +427,10 @@ describe('Environment Builder', () => {
                 auroraClusterEndpoint: 'cluster.example.com',
             };
 
-            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
+            const result = buildEnvironment(
+                appEnvironmentVars,
+                discoveredResources
+            );
 
             expect(result.DATABASE_HOST).toBe('cluster.example.com');
             expect(result.DATABASE_PORT).toBe('5432');
@@ -176,12 +439,18 @@ describe('Environment Builder', () => {
         it('should add database secret ARN if discovered', () => {
             const appEnvironmentVars = {};
             const discoveredResources = {
-                databaseSecretArn: 'arn:aws:secretsmanager:us-east-1:123456:secret:db-secret',
+                databaseSecretArn:
+                    'arn:aws:secretsmanager:us-east-1:123456:secret:db-secret',
             };
 
-            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
+            const result = buildEnvironment(
+                appEnvironmentVars,
+                discoveredResources
+            );
 
-            expect(result.DATABASE_SECRET_ARN).toBe('arn:aws:secretsmanager:us-east-1:123456:secret:db-secret');
+            expect(result.DATABASE_SECRET_ARN).toBe(
+                'arn:aws:secretsmanager:us-east-1:123456:secret:db-secret'
+            );
         });
 
         it('should combine all discovered resources', () => {
@@ -192,19 +461,27 @@ describe('Environment Builder', () => {
                 kmsKeyArn: 'arn:aws:kms:us-east-1:123456:key/abc',
                 auroraClusterEndpoint: 'db.example.com',
                 auroraPort: 3306,
-                databaseSecretArn: 'arn:aws:secretsmanager:us-east-1:123456:secret:db',
+                databaseSecretArn:
+                    'arn:aws:secretsmanager:us-east-1:123456:secret:db',
             };
 
-            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
+            const result = buildEnvironment(
+                appEnvironmentVars,
+                discoveredResources
+            );
 
             expect(result.CUSTOM_VAR).toBe("${env:CUSTOM_VAR, ''}");
             expect(result.FRIGG_STACK).toBe('${self:service}');
             expect(result.FRIGG_STAGE).toBe('${self:provider.stage}');
             expect(result.FRIGG_REGION).toBe('${self:provider.region}');
-            expect(result.KMS_KEY_ARN).toBe('arn:aws:kms:us-east-1:123456:key/abc');
+            expect(result.KMS_KEY_ARN).toBe(
+                'arn:aws:kms:us-east-1:123456:key/abc'
+            );
             expect(result.DATABASE_HOST).toBe('db.example.com');
             expect(result.DATABASE_PORT).toBe('3306');
-            expect(result.DATABASE_SECRET_ARN).toBe('arn:aws:secretsmanager:us-east-1:123456:secret:db');
+            expect(result.DATABASE_SECRET_ARN).toBe(
+                'arn:aws:secretsmanager:us-east-1:123456:secret:db'
+            );
         });
 
         it('should handle empty discoveredResources', () => {
@@ -213,7 +490,10 @@ describe('Environment Builder', () => {
             };
             const discoveredResources = {};
 
-            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
+            const result = buildEnvironment(
+                appEnvironmentVars,
+                discoveredResources
+            );
 
             expect(result.API_KEY).toBe("${env:API_KEY, ''}");
             expect(result.FRIGG_STACK).toBe('${self:service}');
@@ -237,11 +517,13 @@ describe('Environment Builder', () => {
                 auroraPort: 3306, // Number
             };
 
-            const result = buildEnvironment(appEnvironmentVars, discoveredResources);
+            const result = buildEnvironment(
+                appEnvironmentVars,
+                discoveredResources
+            );
 
             expect(result.DATABASE_PORT).toBe('3306'); // String
             expect(typeof result.DATABASE_PORT).toBe('string');
         });
     });
 });
-

package/infrastructure/domains/shared/function-environments.js

@@ -0,0 +1,97 @@
+/**
+ * Per-function environment scoping (ADR-027)
+ *
+ * Builders emit `result.functionEnvironments` — a map of function name to
+ * env vars — instead of broadcasting framework vars app-wide through
+ * `result.environment`. The composer applies the merged map onto the final
+ * function definitions after every function (base + builder) exists.
+ */
+
+/**
+ * Whether builders should scope framework env vars per function. Skipped in
+ * local mode: the serverless-plugin injects LocalStack queue URLs at
+ * provider level only, and function-level values would shadow them.
+ *
+ * @param {Object} appDefinition
+ * @returns {boolean}
+ */
+function isScopedEnvironmentActive(appDefinition = {}) {
+    if (process.env.FRIGG_SKIP_AWS_DISCOVERY === 'true') return false;
+    return appDefinition.lambda?.scopedEnvironment === true;
+}
+
+/**
+ * Apply a merged functionEnvironments map onto the composed functions.
+ * A key a builder already set directly on a function wins (e.g. the
+ * admin-script router's own SCHEDULER_ROLE_ARN must not be clobbered by
+ * the integration-scheduler value). An unknown function name is a hard
+ * error — silently dropping a var would surface as a runtime failure.
+ *
+ * @param {Object} functions - definition.functions (mutated)
+ * @param {Object} functionEnvironments - { fnName: { KEY: value } }
+ */
+function applyFunctionEnvironments(functions, functionEnvironments = {}) {
+    for (const [fnName, env] of Object.entries(functionEnvironments)) {
+        const fn = functions[fnName];
+        if (!fn) {
+            throw new Error(
+                `functionEnvironments targets unknown function '${fnName}' (known: ${Object.keys(
+                    functions
+                ).join(', ')})`
+            );
+        }
+        fn.environment = { ...env, ...(fn.environment || {}) };
+    }
+}
+
+/**
+ * Function names the integration builder creates for one integration.
+ * Wire contract: must stay in sync with
+ * IntegrationBuilder.createFunctionDefinitions — a drift here surfaces as a
+ * hard unknown-function error at compose time, not a silent var drop.
+ *
+ * @param {Object} integration - entry from appDefinition.integrations
+ * @returns {string[]}
+ */
+function getIntegrationFunctionNames(integration) {
+    const name = integration.Definition.name;
+    const names = [name, `${name}QueueWorker`];
+
+    const webhooks = integration.Definition.webhooks;
+    if (webhooks === true || webhooks?.enabled === true) {
+        names.splice(1, 0, `${name}Webhook`);
+    }
+
+    for (const [bindingKey, binding] of Object.entries(
+        integration.Definition.extensions || {}
+    )) {
+        const routes = binding?.extension?.routes || [];
+        if (routes.length === 0) continue;
+        names.push(`${name}__${String(bindingKey).replace(/[^A-Za-z0-9]/g, '')}`);
+    }
+
+    return names;
+}
+
+/**
+ * Admin-script functions, when the feature is on (mirrors
+ * AdminScriptBuilder.shouldExecute). Both can instantiate arbitrary
+ * integrations, so they belong in every integration's queue-URL consumer
+ * set.
+ *
+ * @param {Object} appDefinition
+ * @returns {string[]}
+ */
+function getAdminFunctionNames(appDefinition = {}) {
+    return Array.isArray(appDefinition.adminScripts) &&
+        appDefinition.adminScripts.length > 0
+        ? ['adminScriptRouter', 'adminScriptExecutor']
+        : [];
+}
+
+module.exports = {
+    isScopedEnvironmentActive,
+    applyFunctionEnvironments,
+    getIntegrationFunctionNames,
+    getAdminFunctionNames,
+};