fix(deploy): stop MAPLE_ENVIRONMENT being overridable by a stray env var

[Makisuo]

The bug

Both email-capable workers passed MAPLE_ENVIRONMENT through optionalPlain:

const optionalPlain = (key: string, fallback?: string) => {
    const value = process.env[key]?.trim() || fallback   // ← process.env wins
    return value ? { [key]: value } : {}
}

So optionalPlain("MAPLE_ENVIRONMENT", resolveDeploymentEnvironment(stage)) doesn't mean "use the stage" — it means "use process.env if present, otherwise the stage." The stage-derived value is the fallback, not the source of truth.

Why it matters

Both non-production email gates derive from that one variable:

• apps/alerting/src/worker.ts — the scheduled() early return that skips all crons off production
• apps/api/src/lib/EmailService.ts — emailAllowed, which isConfigured depends on

A stray MAPLE_ENVIRONMENT=production reaching a pr-N or stg deploy environment opens both at once. Preview and staging stages run the same digest and onboarding crons against branched databases that still hold real Clerk members, so at that point the only remaining guard is the absence of the prd-only EMAIL binding — one config line away from a duplicate mailing to real users.

The fix

Derive it from the stage, non-overridable, in both workers. The prd-only binding gating stays as defence in depth; it's just no longer load-bearing on its own.

chat-flue and electric-sync use the same optionalPlain pattern but have no EMAIL binding and no email gate, so they're left alone — worth a follow-up only if consistency is wanted for its own sake.

Provenance

Found while designing non-prod containment for a third-party email vendor, which needed an equivalent guard and had no Cloudflare binding to lean on. That vendor work has been dropped — onboarding will instead move to a Cloudflare Workflow with durable step.sleep, since the machinery is largely already there. This bug predates that whole exercise and stands on its own.

Verification

Config-only change, no runtime code touched. tsc --noEmit clean on apps/api and apps/alerting.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[pullfrog]

Your Pullfrog Router balance is exhausted.

You have a payment method on file but auto-reload is disabled, so runs paused once your balance went past the overdraft buffer.

Top up balance → · Enable auto-reload →

  ^{｜ ⚠️ this action is pinned to a commit SHA, which freezes the cleanup step — switch to @v0 or keep the SHA fresh with Dependabot ｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[github-actions]

🍁 Maple PR preview

Note

Preview resources were removed when this pull request closed.

Final commit 9ab7e72 · View workflow run