@friggframework/devtools 2.0.0--canary.461.2d5ab00.0 → 2.0.0--canary.461.ea64a60.0

package/infrastructure/domains/database/migration-builder.js

@@ -182,7 +182,7 @@ class MigrationBuilder extends InfrastructureBuilder {
                 'node_modules/@prisma/**', // Prisma engines
                 'node_modules/.prisma/**',
                 'node_modules/@friggframework/core/generated/**', // Generated clients
-                
+
                 // Base exclusions
                 'node_modules/**/node_modules/**',
                 'node_modules/aws-sdk/**',
@@ -320,6 +320,8 @@ class MigrationBuilder extends InfrastructureBuilder {
         // Add IAM permissions for S3 (migration status storage)
         // Migration functions need to read/write migration status in S3
         // to avoid chicken-and-egg dependency on User/Process tables
+
+        // Object-level permissions (put, get, delete)
         result.iamStatements.push({
             Effect: 'Allow',
             Action: [
@@ -338,6 +340,13 @@ class MigrationBuilder extends InfrastructureBuilder {
             },
         });
 
+        // Bucket-level permissions (list objects, needed to check if migration status exists)
+        result.iamStatements.push({
+            Effect: 'Allow',
+            Action: ['s3:ListBucket'],
+            Resource: { 'Fn::GetAtt': ['FriggMigrationStatusBucket', 'Arn'] },
+        });
+
         console.log('  ✓ Added S3 IAM permissions for migration status tracking');
 
         console.log(`[${this.name}] ✅ Migration infrastructure configuration completed`);

package/infrastructure/domains/database/migration-builder.test.js

@@ -246,6 +246,42 @@ describe('MigrationBuilder', () => {
             });
         });
 
+        it('should add S3 IAM permissions including ListBucket', async () => {
+            const appDef = {
+                database: {
+                    postgres: {
+                        enable: true,
+                    },
+                },
+            };
+
+            const result = await builder.build(appDef, {});
+
+            // Should have object-level permissions
+            expect(result.iamStatements).toContainEqual(
+                expect.objectContaining({
+                    Effect: 'Allow',
+                    Action: expect.arrayContaining([
+                        's3:PutObject',
+                        's3:GetObject',
+                        's3:DeleteObject',
+                    ]),
+                    Resource: expect.objectContaining({
+                        'Fn::Join': expect.anything(),
+                    }),
+                })
+            );
+
+            // Should have bucket-level ListBucket permission (needed to check if objects exist)
+            expect(result.iamStatements).toContainEqual(
+                expect.objectContaining({
+                    Effect: 'Allow',
+                    Action: ['s3:ListBucket'],
+                    Resource: { 'Fn::GetAtt': ['FriggMigrationStatusBucket', 'Arn'] },
+                })
+            );
+        });
+
         it('should only include Prisma layer in worker (router doesn\'t need database)', async () => {
             const appDef = {
                 database: {

package/infrastructure/domains/networking/vpc-builder.js

@@ -147,11 +147,12 @@ class VpcBuilder extends InfrastructureBuilder {
             dynamodb: discoveredResources.dynamodbVpcEndpointId,
             kms: discoveredResources.kmsVpcEndpointId,
             secretsManager: discoveredResources.secretsManagerVpcEndpointId,
+            sqs: discoveredResources.sqsVpcEndpointId,
         };
         const allEndpointsExist = existingEndpoints.s3 && existingEndpoints.dynamodb &&
-            existingEndpoints.kms && existingEndpoints.secretsManager;
+            existingEndpoints.kms && existingEndpoints.secretsManager && existingEndpoints.sqs;
         const someEndpointsExist = existingEndpoints.s3 || existingEndpoints.dynamodb ||
-            existingEndpoints.kms || existingEndpoints.secretsManager;
+            existingEndpoints.kms || existingEndpoints.secretsManager || existingEndpoints.sqs;
 
         if (appDefinition.vpc.enableVPCEndpoints !== false) {
             if (vpcManagement === 'create-new') {
@@ -682,6 +683,8 @@ class VpcBuilder extends InfrastructureBuilder {
         if (!existingEndpoints.dynamodb) missing.push('DynamoDB');
         if (!existingEndpoints.kms && appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') missing.push('KMS');
         if (!existingEndpoints.secretsManager) missing.push('Secrets Manager');
+        // SQS endpoint needed for database migrations (migration queue)
+        if (!existingEndpoints.sqs && appDefinition.database?.postgres?.enable) missing.push('SQS');
 
         if (missing.length > 0) {
             console.log(`  Creating missing VPC Endpoints: ${missing.join(', ')}...`);
@@ -733,8 +736,8 @@ class VpcBuilder extends InfrastructureBuilder {
             };
         }
 
-        // VPC Endpoint Security Group (only if KMS or Secrets Manager are missing)
-        if (!existingEndpoints.kms || !existingEndpoints.secretsManager) {
+        // VPC Endpoint Security Group (only if KMS, Secrets Manager, or SQS are missing)
+        if (!existingEndpoints.kms || !existingEndpoints.secretsManager || (!existingEndpoints.sqs && appDefinition.database?.postgres?.enable)) {
             result.resources.FriggVPCEndpointSecurityGroup = {
                 Type: 'AWS::EC2::SecurityGroup',
                 Properties: {
@@ -787,6 +790,21 @@ class VpcBuilder extends InfrastructureBuilder {
             };
         }
 
+        // SQS Interface Endpoint (only if missing AND database migrations are enabled)
+        if (!existingEndpoints.sqs && appDefinition.database?.postgres?.enable) {
+            result.resources.FriggSQSVPCEndpoint = {
+                Type: 'AWS::EC2::VPCEndpoint',
+                Properties: {
+                    VpcId: vpcId,
+                    ServiceName: 'com.amazonaws.${self:provider.region}.sqs',
+                    VpcEndpointType: 'Interface',
+                    SubnetIds: result.vpcConfig.subnetIds,
+                    SecurityGroupIds: [{ Ref: 'FriggVPCEndpointSecurityGroup' }],
+                    PrivateDnsEnabled: true,
+                },
+            };
+        }
+
         console.log(`    ✅ Created ${missing.length} VPC endpoint(s): ${missing.join(', ')}`);
     }
 }

package/infrastructure/domains/networking/vpc-discovery.js

@@ -120,6 +120,9 @@ class VpcDiscovery {
                 const secretsManagerEndpoint = rawResources.vpcEndpoints.find(
                     ep => ep.ServiceName && ep.ServiceName.includes('.secretsmanager')
                 );
+                const sqsEndpoint = rawResources.vpcEndpoints.find(
+                    ep => ep.ServiceName && ep.ServiceName.includes('.sqs')
+                );
 
                 if (s3Endpoint) {
                     result.s3VpcEndpointId = s3Endpoint.VpcEndpointId;
@@ -133,6 +136,9 @@ class VpcDiscovery {
                 if (secretsManagerEndpoint) {
                     result.secretsManagerVpcEndpointId = secretsManagerEndpoint.VpcEndpointId;
                 }
+                if (sqsEndpoint) {
+                    result.sqsVpcEndpointId = sqsEndpoint.VpcEndpointId;
+                }
             }
 
             console.log(`  ✓ Found VPC: ${result.defaultVpcId}`);
@@ -145,8 +151,8 @@ class VpcDiscovery {
             if (result.existingNatGatewayId) {
                 console.log(`  ✓ Found NAT Gateway: ${result.existingNatGatewayId}`);
             }
-            if (result.s3VpcEndpointId || result.dynamodbVpcEndpointId || result.kmsVpcEndpointId || result.secretsManagerVpcEndpointId) {
-                console.log(`  ✓ Found VPC Endpoints: S3=${result.s3VpcEndpointId ? 'Yes' : 'No'}, DynamoDB=${result.dynamodbVpcEndpointId ? 'Yes' : 'No'}, KMS=${result.kmsVpcEndpointId ? 'Yes' : 'No'}, SecretsManager=${result.secretsManagerVpcEndpointId ? 'Yes' : 'No'}`);
+            if (result.s3VpcEndpointId || result.dynamodbVpcEndpointId || result.kmsVpcEndpointId || result.secretsManagerVpcEndpointId || result.sqsVpcEndpointId) {
+                console.log(`  ✓ Found VPC Endpoints: S3=${result.s3VpcEndpointId ? 'Yes' : 'No'}, DynamoDB=${result.dynamodbVpcEndpointId ? 'Yes' : 'No'}, KMS=${result.kmsVpcEndpointId ? 'Yes' : 'No'}, SecretsManager=${result.secretsManagerVpcEndpointId ? 'Yes' : 'No'}, SQS=${result.sqsVpcEndpointId ? 'Yes' : 'No'}`);
             }
 
             return result;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.2d5ab00.0",
+  "version": "2.0.0--canary.461.ea64a60.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.2d5ab00.0",
-    "@friggframework/test": "2.0.0--canary.461.2d5ab00.0",
+    "@friggframework/schemas": "2.0.0--canary.461.ea64a60.0",
+    "@friggframework/test": "2.0.0--canary.461.ea64a60.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.2d5ab00.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.2d5ab00.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.ea64a60.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.ea64a60.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "2d5ab0050ff82c5337c813367541b12f8489d427"
+  "gitHead": "ea64a60d6ba9a69e06cd06dd4a3eace9b71f466b"
 }