@friggframework/devtools 2.0.0--canary.461.35d292b.0 → 2.0.0--canary.461.fa25c10.0

package/infrastructure/domains/database/aurora-builder.js

@@ -83,7 +83,36 @@ class AuroraBuilder extends InfrastructureBuilder {
         console.log(`\n[${this.name}] Configuring Aurora PostgreSQL...`);
 
         const dbConfig = appDefinition.database.postgres;
-        const management = dbConfig.management || 'discover';
+        
+        // Normalize top-level managementMode
+        const globalMode = appDefinition.managementMode || 'discover';
+        const vpcIsolation = appDefinition.vpcIsolation || 'shared';
+
+        let management = dbConfig.management;
+
+        if (globalMode === 'managed') {
+            // Warn about ignored granular options
+            if (dbConfig.management) {
+                console.log(`  ⚠️  managementMode='managed' ignoring: database.postgres.management`);
+            }
+            
+            // Clear granular option to prevent conflicts
+            delete appDefinition.database.postgres.management;
+            
+            // Set management based on isolation strategy
+            if (vpcIsolation === 'isolated') {
+                management = 'managed';  // New VPC = new Aurora
+                console.log(`  managementMode='managed' + vpcIsolation='isolated' → creating new Aurora`);
+            } else {
+                management = 'discover';  // Shared VPC = reuse Aurora
+                appDefinition.database.postgres.autoCreateCredentials = true;
+                console.log(`  managementMode='managed' + vpcIsolation='shared' → discovering Aurora`);
+            }
+        } else if (globalMode === 'existing') {
+            management = 'existing';
+        } else {
+            management = management || 'discover';
+        }
 
         console.log(`  PostgreSQL Management Mode: ${management}`);
 

package/infrastructure/domains/database/aurora-builder.test.js

@@ -749,6 +749,102 @@ describe('AuroraBuilder', () => {
         });
     });
 
+    describe('Top-Level Management Mode', () => {
+        it('should use managementMode=managed with vpcIsolation=isolated to create new Aurora', async () => {
+            const appDefinition = {
+                managementMode: 'managed',
+                vpcIsolation: 'isolated',
+                database: {
+                    postgres: {
+                        enable: true,
+                        management: 'discover',  // Should be IGNORED
+                        minCapacity: 0.5,
+                        maxCapacity: 1,
+                    },
+                },
+            };
+
+            const discoveredResources = {
+                auroraClusterEndpoint: 'existing-cluster.us-east-1.rds.amazonaws.com',
+                privateSubnetId1: 'subnet-1',
+                privateSubnetId2: 'subnet-2',
+            };
+
+            const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation();
+
+            const result = await auroraBuilder.build(appDefinition, discoveredResources);
+
+            // Should warn about ignored options
+            expect(consoleLogSpy).toHaveBeenCalledWith(
+                expect.stringContaining("managementMode='managed' ignoring")
+            );
+
+            // Should create new Aurora cluster (isolated mode)
+            expect(result.resources.FriggAuroraCluster).toBeDefined();
+            expect(result.environment.DATABASE_URL).toBeDefined();
+
+            consoleLogSpy.mockRestore();
+        });
+
+        it('should use managementMode=managed with vpcIsolation=shared to discover Aurora', async () => {
+            const appDefinition = {
+                managementMode: 'managed',
+                vpcIsolation: 'shared',
+                database: {
+                    postgres: {
+                        enable: true,
+                        management: 'managed',  // Should be IGNORED
+                    },
+                },
+            };
+
+            const discoveredResources = {
+                auroraClusterEndpoint: 'existing-cluster.us-east-1.rds.amazonaws.com',
+                auroraClusterPort: 5432,
+                auroraClusterIdentifier: 'existing-cluster',
+                privateSubnetId1: 'subnet-1',
+                privateSubnetId2: 'subnet-2',
+            };
+
+            const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation();
+
+            const result = await auroraBuilder.build(appDefinition, discoveredResources);
+
+            // Should warn about ignored options
+            expect(consoleLogSpy).toHaveBeenCalledWith(
+                expect.stringContaining("ignoring")
+            );
+
+            // Should discover existing Aurora
+            expect(result.resources.FriggAuroraCluster).toBeUndefined();
+            expect(result.environment.DATABASE_URL).toBeDefined();
+
+            consoleLogSpy.mockRestore();
+        });
+
+        it('should respect granular management when no managementMode specified', async () => {
+            const appDefinition = {
+                // No managementMode
+                database: {
+                    postgres: {
+                        enable: true,
+                        management: 'managed',  // Should be RESPECTED
+                    },
+                },
+            };
+
+            const discoveredResources = {
+                privateSubnetId1: 'subnet-1',
+                privateSubnetId2: 'subnet-2',
+            };
+
+            const result = await auroraBuilder.build(appDefinition, discoveredResources);
+
+            // Should create Aurora cluster
+            expect(result.resources.FriggAuroraCluster).toBeDefined();
+        });
+    });
+
     describe('build() - use-existing mode', () => {
         it('should use provided database endpoint', async () => {
             const appDefinition = {

package/infrastructure/domains/networking/vpc-builder.js

@@ -81,6 +81,21 @@ class VpcBuilder extends InfrastructureBuilder {
         return result;
     }
 
+    /**
+     * Warn about ignored options when managementMode='managed'
+     */
+    warnIgnoredOptions(appDefinition) {
+        const ignoredOptions = [];
+        if (appDefinition.vpc?.management) ignoredOptions.push('vpc.management');
+        if (appDefinition.vpc?.subnets?.management) ignoredOptions.push('vpc.subnets.management');
+        if (appDefinition.vpc?.natGateway?.management) ignoredOptions.push('vpc.natGateway.management');
+        if (appDefinition.vpc?.shareAcrossStages !== undefined) ignoredOptions.push('vpc.shareAcrossStages');
+        
+        if (ignoredOptions.length > 0) {
+            console.log(`  ⚠️  managementMode='managed' ignoring: ${ignoredOptions.join(', ')}`);
+        }
+    }
+
     /**
      * Build complete VPC infrastructure based on management mode
      */
@@ -110,23 +125,49 @@ class VpcBuilder extends InfrastructureBuilder {
             Resource: '*',
         });
 
-        // Normalize shareAcrossStages into management mode
-        // This provides a simpler API for users while maintaining backwards compatibility
+        // Normalize top-level managementMode (simplified API)
+        const globalMode = appDefinition.managementMode || 'discover';
+        const vpcIsolation = appDefinition.vpcIsolation || 'shared';
+
         let management = appDefinition.vpc.management;
-        if (!management && appDefinition.vpc.shareAcrossStages !== undefined) {
-            // Explicit shareAcrossStages setting overrides default
+
+        if (globalMode === 'managed') {
+            // Warn about ignored granular options
+            this.warnIgnoredOptions(appDefinition);
+            
+            // Clear granular options to prevent conflicts
+            delete appDefinition.vpc.management;
+            if (appDefinition.vpc.subnets) delete appDefinition.vpc.subnets.management;
+            if (appDefinition.vpc.natGateway) delete appDefinition.vpc.natGateway.management;
+            delete appDefinition.vpc.shareAcrossStages;
+            
+            // Set management based on isolation strategy
+            if (vpcIsolation === 'isolated') {
+                management = 'create-new';
+                appDefinition.vpc.natGateway = appDefinition.vpc.natGateway || {};
+                appDefinition.vpc.natGateway.management = 'createAndManage';
+                console.log(`  managementMode='managed' + vpcIsolation='isolated' → creating new VPC`);
+            } else {
+                management = 'discover';
+                appDefinition.vpc.selfHeal = true;
+                console.log(`  managementMode='managed' + vpcIsolation='shared' → discovering VPC`);
+            }
+        } else if (globalMode === 'existing') {
+            management = 'use-existing';
+        } else if (!management && appDefinition.vpc.shareAcrossStages !== undefined) {
+            // Legacy shareAcrossStages support (backwards compatibility)
             management = appDefinition.vpc.shareAcrossStages ? 'discover' : 'create-new';
             console.log(`  VPC Sharing: ${appDefinition.vpc.shareAcrossStages ? 'shared' : 'isolated'} (translated to ${management})`);
             
-            // When creating isolated VPC, also create isolated NAT Gateway
             if (!appDefinition.vpc.shareAcrossStages && !appDefinition.vpc.natGateway?.management) {
                 appDefinition.vpc.natGateway = appDefinition.vpc.natGateway || {};
                 appDefinition.vpc.natGateway.management = 'createAndManage';
                 console.log(`  NAT Gateway: creating isolated NAT (shareAcrossStages=false)`);
             }
         } else {
-            management = management || 'discover'; // Default to sharing for backwards compatibility
+            management = management || 'discover';
         }
+        
         console.log(`  VPC Management Mode: ${management}`);
 
         // Handle self-healing if enabled
@@ -148,8 +189,8 @@ class VpcBuilder extends InfrastructureBuilder {
                 break;
         }
 
-        // Build subnets
-        await this.buildSubnets(appDefinition, discoveredResources, result);
+        // Build subnets - pass normalized management mode for correct CIDR generation
+        await this.buildSubnets(appDefinition, discoveredResources, result, management);
 
         // Build NAT Gateway if needed
         await this.buildNatGateway(appDefinition, discoveredResources, result);
@@ -385,9 +426,9 @@ class VpcBuilder extends InfrastructureBuilder {
 
     /**
      * Build subnet infrastructure
+     * @param {Object} vpcManagement - Normalized VPC management mode (passed from build() to ensure consistency)
      */
-    async buildSubnets(appDefinition, discoveredResources, result) {
-        const vpcManagement = appDefinition.vpc.management || 'discover';
+    async buildSubnets(appDefinition, discoveredResources, result, vpcManagement) {
         // Default subnet management depends on context:
         // - use-existing mode with subnet IDs provided: use-existing
         // - create-new mode: create

package/infrastructure/domains/networking/vpc-builder.test.js

@@ -809,6 +809,96 @@ describe('VpcBuilder', () => {
         });
     });
 
+    describe('Management Mode (Simplified API)', () => {
+        it('should use managementMode=managed with vpcIsolation=isolated to create new VPC', async () => {
+            const appDefinition = {
+                managementMode: 'managed',
+                vpcIsolation: 'isolated',
+                vpc: {
+                    enable: true,
+                    management: 'discover',  // Should be IGNORED
+                },
+            };
+
+            const discoveredResources = {
+                defaultVpcId: 'vpc-existing',
+                natGatewayId: 'nat-existing',
+            };
+
+            const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation();
+
+            const result = await vpcBuilder.build(appDefinition, discoveredResources);
+
+            // Should warn about ignored options
+            expect(consoleLogSpy).toHaveBeenCalledWith(
+                expect.stringContaining("managementMode='managed' ignoring")
+            );
+            expect(consoleLogSpy).toHaveBeenCalledWith(
+                expect.stringContaining("vpc.management")
+            );
+
+            // Should create new isolated VPC
+            expect(result.vpcId).toEqual({ Ref: 'FriggVPC' });
+            expect(result.resources.FriggVPC).toBeDefined();
+            
+            // Subnets should use CloudFormation Fn::Cidr
+            expect(result.resources.FriggPrivateSubnet1.Properties.CidrBlock).toEqual({
+                'Fn::Select': [0, { 'Fn::Cidr': ['10.0.0.0/16', 4, 8] }]
+            });
+
+            consoleLogSpy.mockRestore();
+        });
+
+        it('should use managementMode=managed with vpcIsolation=shared to discover VPC', async () => {
+            const appDefinition = {
+                managementMode: 'managed',
+                vpcIsolation: 'shared',
+                vpc: {
+                    enable: true,
+                    subnets: { management: 'use-existing' },  // Should be IGNORED
+                },
+            };
+
+            const discoveredResources = {
+                defaultVpcId: 'vpc-existing',
+            };
+
+            const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation();
+
+            const result = await vpcBuilder.build(appDefinition, discoveredResources);
+
+            // Should warn about ignored options
+            expect(consoleLogSpy).toHaveBeenCalledWith(
+                expect.stringContaining("ignoring")
+            );
+
+            // Should discover existing VPC
+            expect(result.vpcId).toBe('vpc-existing');
+            expect(result.resources.FriggVPC).toBeUndefined();
+            
+            // Should create new stage-specific subnets
+            expect(result.resources.FriggPrivateSubnet1).toBeDefined();
+
+            consoleLogSpy.mockRestore();
+        });
+
+        it('should default to discover mode for backwards compatibility', async () => {
+            const appDefinition = {
+                // No managementMode specified
+                vpc: {
+                    enable: true,
+                    management: 'create-new',  // Should be RESPECTED
+                },
+            };
+
+            const result = await vpcBuilder.build(appDefinition, {});
+
+            // Should respect legacy vpc.management
+            expect(result.vpcId).toEqual({ Ref: 'FriggVPC' });
+            expect(result.resources.FriggVPC).toBeDefined();
+        });
+    });
+
     describe('VPC Sharing Control', () => {
         it('should share VPC across stages when shareAcrossStages is true (default)', async () => {
             const appDefinition = {
@@ -828,11 +918,11 @@ describe('VpcBuilder', () => {
             // Should use discovered VPC (not create new one)
             expect(result.vpcId).toBe('vpc-shared');
             expect(result.resources.FriggVPC).toBeUndefined();
-            
+
             // Should create stage-specific subnets for isolation
             expect(result.resources.FriggPrivateSubnet1).toBeDefined();
             expect(result.resources.FriggPrivateSubnet2).toBeDefined();
-            
+
             // Should reuse discovered NAT Gateway
             expect(result.resources.FriggNATGateway).toBeUndefined();
         });
@@ -855,11 +945,20 @@ describe('VpcBuilder', () => {
             // Should create new VPC (ignore discovered resources)
             expect(result.vpcId).toEqual({ Ref: 'FriggVPC' });
             expect(result.resources.FriggVPC).toBeDefined();
-            
-            // Should create stage-specific subnets
+            expect(result.resources.FriggVPC.Properties.CidrBlock).toBe('10.0.0.0/16');
+
+            // Should create stage-specific subnets with Fn::Cidr (dynamic from VPC CIDR)
             expect(result.resources.FriggPrivateSubnet1).toBeDefined();
             expect(result.resources.FriggPrivateSubnet2).toBeDefined();
-            
+
+            // Subnets should use CloudFormation Fn::Cidr, NOT hardcoded 172.31.x.x
+            expect(result.resources.FriggPrivateSubnet1.Properties.CidrBlock).toEqual({
+                'Fn::Select': [0, { 'Fn::Cidr': ['10.0.0.0/16', 4, 8] }]
+            });
+            expect(result.resources.FriggPrivateSubnet2.Properties.CidrBlock).toEqual({
+                'Fn::Select': [1, { 'Fn::Cidr': ['10.0.0.0/16', 4, 8] }]
+            });
+
             // Should create new NAT Gateway
             expect(result.resources.FriggNATGateway).toBeDefined();
         });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.35d292b.0",
+  "version": "2.0.0--canary.461.fa25c10.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.35d292b.0",
-    "@friggframework/test": "2.0.0--canary.461.35d292b.0",
+    "@friggframework/schemas": "2.0.0--canary.461.fa25c10.0",
+    "@friggframework/test": "2.0.0--canary.461.fa25c10.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.35d292b.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.35d292b.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.fa25c10.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.fa25c10.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "35d292ba0c73d3a112e8fda3c930ba0dcfeb4c4f"
+  "gitHead": "fa25c1040b8fa112874e8ab729844b5ccfd8ae3d"
 }