upstash
diff --git a/‎.github/workflows/test.yaml‎
Lines changed: 34 additions & 7 deletions b/‎.github/workflows/test.yaml‎
Lines changed: 34 additions & 7 deletions
diff --git a/‎bun.lockb‎
6.95 KB b/‎bun.lockb‎
6.95 KB
diff --git a/‎eslint.config.mjs‎
Lines changed: 2 additions & 0 deletions b/‎eslint.config.mjs‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎examples/nextjs/app/ci/route.ts‎
Lines changed: 3 additions & 0 deletions b/‎examples/nextjs/app/ci/route.ts‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎examples/nextjs/app/dev/receive/route.ts‎
Lines changed: 22 additions & 0 deletions b/‎examples/nextjs/app/dev/receive/route.ts‎
Lines changed: 22 additions & 0 deletions
diff --git a/‎examples/nextjs/app/dev/route.ts‎
Lines changed: 15 additions & 0 deletions b/‎examples/nextjs/app/dev/route.ts‎
Lines changed: 15 additions & 0 deletions
diff --git a/‎examples/nextjs/app/dev/send/route.ts‎
Lines changed: 16 additions & 0 deletions b/‎examples/nextjs/app/dev/send/route.ts‎
Lines changed: 16 additions & 0 deletions
diff --git a/‎examples/nextjs/app/edge/route.ts‎
Lines changed: 2 additions & 2 deletions b/‎examples/nextjs/app/edge/route.ts‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎examples/nextjs/app/serverless/route.ts‎
Lines changed: 3 additions & 3 deletions b/‎examples/nextjs/app/serverless/route.ts‎
Lines changed: 3 additions & 3 deletions
diff --git a/‎examples/nextjs/dev.test.ts‎
Lines changed: 45 additions & 0 deletions b/‎examples/nextjs/dev.test.ts‎
Lines changed: 45 additions & 0 deletions
@@ -134,10 +134,15 @@ jobs:
 
   nextjs-local-build:
     runs-on: ubuntu-latest
-    # disabled because of a local build issue. Will be tested properly in
-    # the deployment test
-    if: false
     name: NextJS Local Build
+    # The /serverless and /edge example routes call verifySignatureAppRouter()
+    # at module load (page-data collection at build, route compile at dev).
+    # Without keys in env it throws synchronously, so provide dummies. Real
+    # signature verification isn't exercised on these paths in CI; /dev/receive
+    # uses devMode: true and supplies its own dev keys.
+    env:
+      QSTASH_CURRENT_SIGNING_KEY: sig_dummy_for_local_build
+      QSTASH_NEXT_SIGNING_KEY: sig_dummy_for_local_build
     steps:
       - name: Setup repo
         uses: actions/checkout@v4
@@ -168,7 +173,12 @@ jobs:
         working-directory: examples/nextjs
 
       - name: Install local package
-        run: pnpm install @upstash/qstash@../../dist
+        # `file:../../dist` (with the `file:` prefix) tells pnpm to install the
+        # dist folder as if it were a real package, not as a symlink. A plain
+        # `pnpm install ../../dist` symlinks instead, which leaves two copies
+        # of `next` resolvable (one in the qstash-js root, one in the example)
+        # and TS sees them as distinct types, breaking the build.
+        run: pnpm add @upstash/qstash@file:../../dist
         working-directory: examples/nextjs
 
       - name: Local build
@@ -179,12 +189,29 @@ jobs:
         run: pnpm dev &
         working-directory: examples/nextjs
 
-      - name: Test
+      - name: Wait for next dev to be ready
+        run: |
+          for i in $(seq 1 30); do
+            if curl -sf http://localhost:3000/ > /dev/null; then exit 0; fi
+            sleep 1
+          done
+          echo "next dev never became ready"; exit 1
+
+      - name: Test (production routes)
         run: bun test ci.test.ts
         working-directory: examples/nextjs
         env:
           DEPLOYMENT_URL: http://localhost:3000
 
+      - name: Test (devMode round-trip)
+        # Exercises the SDK auto-spawning the QStash dev binary inside the
+        # Next.js process, publishing a signed message, and the receiver
+        # verifying it. This is the only CI coverage of devMode end-to-end.
+        run: bun test dev.test.ts
+        working-directory: examples/nextjs
+        env:
+          DEPLOYMENT_URL: http://localhost:3000
+
   nextjs-deployed:
     concurrency: nextjs-deployed
     runs-on: ubuntu-latest
@@ -206,7 +233,7 @@ jobs:
 
       - uses: pnpm/action-setup@v4
         with:
-          version: latest
+          version: 9
 
       - name: Deploy
         run: |
@@ -228,7 +255,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
     needs:
       - cloudflare-workers-local-build
-      # - nextjs-local-build
+      - nextjs-local-build
       - local-tests
 
     name: Release
 
@@ -85,6 +85,8 @@ export default [
             args: false,
             props: false,
             db: false,
+            dev: false,
+            env: false,
           },
         },
       ],
 
@@ -1,6 +1,9 @@
 import { Client } from "@upstash/qstash"
 import { CRON, DESTINATION } from "./constants";
 
+// Without this, `next build` pre-renders the GET and would call the live QStash API.
+export const dynamic = "force-dynamic";
+
 export const GET = async () => {
   if (!process.env.QSTASH_TOKEN) {
     throw new Error("CI test failed. QSTASH_TOKEN is missing.")
 
@@ -0,0 +1,22 @@
+import { NextResponse } from "next/server";
+import { verifySignatureAppRouter } from "@upstash/qstash/nextjs";
+
+// Don't run at build time — devMode talks to a local QStash binary.
+export const dynamic = "force-dynamic";
+
+// Module-scoped set so the test can poll for delivery via GET ?check=<id>.
+const received = new Set<string>();
+
+export const POST = verifySignatureAppRouter(
+  async (request: Request) => {
+    const messageId = request.headers.get("upstash-message-id");
+    if (messageId) received.add(messageId);
+    return NextResponse.json({ ok: true, messageId });
+  },
+  { devMode: true }
+);
+
+export const GET = (request: Request) => {
+  const id = new URL(request.url).searchParams.get("check");
+  return NextResponse.json({ received: id ? received.has(id) : false });
+};
@@ -0,0 +1,15 @@
+import { NextResponse } from "next/server";
+import { Client } from "@upstash/qstash";
+
+// Don't run at build time — devMode talks to a local QStash binary.
+export const dynamic = "force-dynamic";
+
+const client = new Client({ token: "dev-token", devMode: true });
+
+export const GET = async () => {
+  const { messageId } = await client.publishJSON({
+    url: "https://example.com",
+    body: { hello: "from /dev route" },
+  });
+  return NextResponse.json({ ok: true, messageId });
+};
@@ -0,0 +1,16 @@
+import { NextResponse } from "next/server";
+import { Client } from "@upstash/qstash";
+
+// Don't run at build time — devMode talks to a local QStash binary.
+export const dynamic = "force-dynamic";
+
+const client = new Client({ token: "dev-token", devMode: true });
+
+export const GET = async (request: Request) => {
+  const origin = new URL(request.url).origin;
+  const { messageId } = await client.publishJSON({
+    url: `${origin}/dev/receive`,
+    body: { hello: "from /dev/send" },
+  });
+  return NextResponse.json({ ok: true, messageId });
+};
@@ -1,7 +1,7 @@
-import { NextRequest, NextResponse } from "next/server";
+import { NextResponse } from "next/server";
 import { verifySignatureAppRouter } from "@upstash/qstash/nextjs";
 
-async function handler(_req: NextRequest) {
+async function handler(_req: Request) {
   // simulate work
   await new Promise((r) => setTimeout(r, 1000));
 
 
@@ -1,7 +1,7 @@
-import { verifySignatureAppRouter } from "@upstash/qstash/dist/nextjs";
-import { NextRequest, NextResponse } from "next/server";
+import { verifySignatureAppRouter } from "@upstash/qstash/nextjs";
+import { NextResponse } from "next/server";
 
-async function handler(_req: NextRequest) {
+async function handler(_req: Request) {
   // simulate work
   await new Promise((r) => setTimeout(r, 1000));
 
 
@@ -0,0 +1,45 @@
+import { test, expect } from "bun:test";
+
+// Hits the /dev routes which use devMode: true. That triggers the qstash
+// CLI dev server to spawn inside the Next.js process. Run after starting the
+// example with `bun dev`. Also runs in CI via the nextjs-local-build job.
+const deploymentURL = process.env.DEPLOYMENT_URL;
+if (!deploymentURL) {
+  throw new Error("DEPLOYMENT_URL not set");
+}
+
+test("/dev publishes via dev server", async () => {
+  const res = await fetch(`${deploymentURL}/dev`);
+  if (res.status !== 200) console.log(await res.text());
+  expect(res.status).toBe(200);
+
+  const body = (await res.json()) as { ok: boolean; messageId?: string };
+  expect(body.ok).toBe(true);
+  expect(body.messageId).toBeTruthy();
+}, 60_000);
+
+test("/dev/send → /dev/receive round trip with signature verification", async () => {
+  const sendRes = await fetch(`${deploymentURL}/dev/send`);
+  expect(sendRes.status).toBe(200);
+  const { messageId } = (await sendRes.json()) as { messageId: string };
+  expect(messageId).toBeTruthy();
+
+  // Dev server delivers asynchronously; poll the receive route for arrival.
+  const deadline = Date.now() + 10_000;
+  while (Date.now() < deadline) {
+    const checkRes = await fetch(`${deploymentURL}/dev/receive?check=${messageId}`);
+    const { received } = (await checkRes.json()) as { received: boolean };
+    if (received) return;
+    await Bun.sleep(250);
+  }
+  throw new Error(`message ${messageId} never delivered to /dev/receive within 10s`);
+}, 60_000);
+
+test("/dev/receive rejects unsigned requests", async () => {
+  const res = await fetch(`${deploymentURL}/dev/receive`, {
+    method: "POST",
+    body: JSON.stringify({ hello: "no signature" }),
+  });
+  // verifySignatureAppRouter returns 403 when the signature header is missing.
+  expect(res.status).toBe(403);
+});