@friggframework/devtools 2.0.0--canary.461.41b7566.0 → 2.0.0--canary.461.4066059.0

package/infrastructure/domains/networking/vpc-builder.js

@@ -430,13 +430,26 @@ class VpcBuilder extends InfrastructureBuilder {
      */
     async buildSubnets(appDefinition, discoveredResources, result, vpcManagement) {
         // Default subnet management depends on context:
+        // - Stack-managed subnets discovered: discover (reuse existing)
         // - use-existing mode with subnet IDs provided: use-existing
         // - create-new mode: create
-        // - discover mode: create (for stage isolation)
+        // - discover mode without stack subnets: create (for stage isolation)
         let defaultSubnetManagement = 'create';
-        if (vpcManagement === 'use-existing' && appDefinition.vpc.subnets?.ids?.length >= 2) {
+
+        // Check if stack-managed subnets were discovered from CloudFormation
+        // Only reuse if they're actual subnet IDs (strings), not CloudFormation Refs (objects)
+        const hasStackManagedSubnets =
+            discoveredResources?.privateSubnetId1 &&
+            discoveredResources?.privateSubnetId2 &&
+            typeof discoveredResources.privateSubnetId1 === 'string' &&
+            typeof discoveredResources.privateSubnetId2 === 'string';
+
+        if (hasStackManagedSubnets) {
+            defaultSubnetManagement = 'discover';
+        } else if (vpcManagement === 'use-existing' && appDefinition.vpc.subnets?.ids?.length >= 2) {
             defaultSubnetManagement = 'use-existing';
         }
+
         const subnetManagement = appDefinition.vpc.subnets?.management || defaultSubnetManagement;
 
         console.log(`  Subnet Management Mode: ${subnetManagement} (default: ${defaultSubnetManagement}, explicit: ${appDefinition.vpc.subnets?.management})`);

package/infrastructure/domains/networking/vpc-builder.test.js

@@ -241,7 +241,36 @@ describe('VpcBuilder', () => {
     });
 
     describe('build() - discover mode', () => {
-        it('should use discovered VPC but create stage-specific subnets by default', async () => {
+        it('should reuse stack-managed subnets when discovered from CloudFormation', async () => {
+            const appDefinition = {
+                vpc: { enable: true },
+            };
+
+            const discoveredResources = {
+                defaultVpcId: 'vpc-discovered',
+                privateSubnetId1: 'subnet-stack-private-1',
+                privateSubnetId2: 'subnet-stack-private-2',
+                publicSubnetId1: 'subnet-stack-public-1',
+                publicSubnetId2: 'subnet-stack-public-2',
+            };
+
+            const result = await vpcBuilder.build(appDefinition, discoveredResources);
+
+            // Should use discovered VPC
+            expect(result.vpcId).toBe('vpc-discovered');
+
+            // Should reuse stack-managed subnets (not create new ones)
+            expect(result.vpcConfig.subnetIds).toEqual([
+                'subnet-stack-private-1',
+                'subnet-stack-private-2',
+            ]);
+
+            // Should NOT create new subnet resources
+            expect(result.resources.FriggPrivateSubnet1).toBeUndefined();
+            expect(result.resources.FriggPrivateSubnet2).toBeUndefined();
+        });
+
+        it('should use discovered VPC but create stage-specific subnets when no stack subnets exist', async () => {
             const appDefinition = {
                 vpc: {
                     enable: true,
@@ -251,15 +280,13 @@ describe('VpcBuilder', () => {
 
             const discoveredResources = {
                 defaultVpcId: 'vpc-discovered',
-                // Even though subnets are discovered, we should create new ones for stage isolation
-                privateSubnetId1: 'subnet-private1',
-                privateSubnetId2: 'subnet-private2',
+                // No stack-managed subnets, so create new ones for stage isolation
                 defaultSecurityGroupId: 'sg-discovered',
             };
 
             const result = await vpcBuilder.build(appDefinition, discoveredResources);
 
-            // NEW BEHAVIOR: Create stage-specific subnets for isolation (prevent route table conflicts)
+            // Should create new stage-specific subnets for isolation (prevent route table conflicts)
             expect(result.vpcConfig.subnetIds).toEqual([
                 { Ref: 'FriggPrivateSubnet1' },
                 { Ref: 'FriggPrivateSubnet2' },

package/infrastructure/domains/shared/cloudformation-discovery.js

@@ -164,6 +164,47 @@ class CloudFormationDiscovery {
                     discovered.defaultKmsKeyId = PhysicalResourceId;
                 }
             }
+
+            // Subnets
+            if (LogicalResourceId === 'FriggPrivateSubnet1' && ResourceType === 'AWS::EC2::Subnet') {
+                discovered.privateSubnetId1 = PhysicalResourceId;
+            }
+            if (LogicalResourceId === 'FriggPrivateSubnet2' && ResourceType === 'AWS::EC2::Subnet') {
+                discovered.privateSubnetId2 = PhysicalResourceId;
+            }
+            if (LogicalResourceId === 'FriggPublicSubnet' && ResourceType === 'AWS::EC2::Subnet') {
+                discovered.publicSubnetId1 = PhysicalResourceId;
+            }
+            if (LogicalResourceId === 'FriggPublicSubnet2' && ResourceType === 'AWS::EC2::Subnet') {
+                discovered.publicSubnetId2 = PhysicalResourceId;
+            }
+
+            // Route Tables
+            if (LogicalResourceId === 'FriggLambdaRouteTable' && ResourceType === 'AWS::EC2::RouteTable') {
+                discovered.routeTableId = PhysicalResourceId;
+            }
+
+            // VPC Endpoint Security Group
+            if (LogicalResourceId === 'FriggVPCEndpointSecurityGroup' && ResourceType === 'AWS::EC2::SecurityGroup') {
+                discovered.vpcEndpointSecurityGroupId = PhysicalResourceId;
+            }
+
+            // VPC Endpoints
+            if (LogicalResourceId === 'FriggS3VPCEndpoint' && ResourceType === 'AWS::EC2::VPCEndpoint') {
+                discovered.s3VpcEndpointId = PhysicalResourceId;
+            }
+            if (LogicalResourceId === 'FriggDynamoDBVPCEndpoint' && ResourceType === 'AWS::EC2::VPCEndpoint') {
+                discovered.dynamoDbVpcEndpointId = PhysicalResourceId;
+            }
+            if (LogicalResourceId === 'FriggKMSVPCEndpoint' && ResourceType === 'AWS::EC2::VPCEndpoint') {
+                discovered.kmsVpcEndpointId = PhysicalResourceId;
+            }
+            if (LogicalResourceId === 'FriggSecretsManagerVPCEndpoint' && ResourceType === 'AWS::EC2::VPCEndpoint') {
+                discovered.secretsManagerVpcEndpointId = PhysicalResourceId;
+            }
+            if (LogicalResourceId === 'FriggSQSVPCEndpoint' && ResourceType === 'AWS::EC2::VPCEndpoint') {
+                discovered.sqsVpcEndpointId = PhysicalResourceId;
+            }
         }
     }
 }

package/infrastructure/domains/shared/cloudformation-discovery.test.js

@@ -73,6 +73,50 @@ describe('CloudFormationDiscovery', () => {
             });
         });
 
+        it('should extract VPC subnets from stack resources', async () => {
+            const mockStack = { StackName: 'test-stack', Outputs: [] };
+            const mockResources = [
+                { LogicalResourceId: 'FriggPrivateSubnet1', PhysicalResourceId: 'subnet-priv-1', ResourceType: 'AWS::EC2::Subnet' },
+                { LogicalResourceId: 'FriggPrivateSubnet2', PhysicalResourceId: 'subnet-priv-2', ResourceType: 'AWS::EC2::Subnet' },
+                { LogicalResourceId: 'FriggPublicSubnet', PhysicalResourceId: 'subnet-pub-1', ResourceType: 'AWS::EC2::Subnet' },
+                { LogicalResourceId: 'FriggPublicSubnet2', PhysicalResourceId: 'subnet-pub-2', ResourceType: 'AWS::EC2::Subnet' },
+            ];
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+
+            const result = await cfDiscovery.discoverFromStack('test-stack');
+
+            expect(result.privateSubnetId1).toBe('subnet-priv-1');
+            expect(result.privateSubnetId2).toBe('subnet-priv-2');
+            expect(result.publicSubnetId1).toBe('subnet-pub-1');
+            expect(result.publicSubnetId2).toBe('subnet-pub-2');
+        });
+
+        it('should extract route tables and VPC endpoints from stack resources', async () => {
+            const mockStack = { StackName: 'test-stack', Outputs: [] };
+            const mockResources = [
+                { LogicalResourceId: 'FriggLambdaRouteTable', PhysicalResourceId: 'rtb-123', ResourceType: 'AWS::EC2::RouteTable' },
+                { LogicalResourceId: 'FriggVPCEndpointSecurityGroup', PhysicalResourceId: 'sg-vpce-123', ResourceType: 'AWS::EC2::SecurityGroup' },
+                { LogicalResourceId: 'FriggS3VPCEndpoint', PhysicalResourceId: 'vpce-s3-123', ResourceType: 'AWS::EC2::VPCEndpoint' },
+                { LogicalResourceId: 'FriggDynamoDBVPCEndpoint', PhysicalResourceId: 'vpce-ddb-123', ResourceType: 'AWS::EC2::VPCEndpoint' },
+                { LogicalResourceId: 'FriggKMSVPCEndpoint', PhysicalResourceId: 'vpce-kms-123', ResourceType: 'AWS::EC2::VPCEndpoint' },
+                { LogicalResourceId: 'FriggSecretsManagerVPCEndpoint', PhysicalResourceId: 'vpce-sm-123', ResourceType: 'AWS::EC2::VPCEndpoint' },
+            ];
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+
+            const result = await cfDiscovery.discoverFromStack('test-stack');
+
+            expect(result.routeTableId).toBe('rtb-123');
+            expect(result.vpcEndpointSecurityGroupId).toBe('sg-vpce-123');
+            expect(result.s3VpcEndpointId).toBe('vpce-s3-123');
+            expect(result.dynamoDbVpcEndpointId).toBe('vpce-ddb-123');
+            expect(result.kmsVpcEndpointId).toBe('vpce-kms-123');
+            expect(result.secretsManagerVpcEndpointId).toBe('vpce-sm-123');
+        });
+
         it('should extract Aurora cluster from stack resources', async () => {
             const mockStack = {
                 StackName: 'test-stack',
@@ -97,6 +141,46 @@ describe('CloudFormationDiscovery', () => {
             });
         });
 
+        it('should extract subnets from stack resources', async () => {
+            const mockStack = {
+                StackName: 'test-stack',
+                Outputs: [],
+            };
+
+            const mockResources = [
+                {
+                    LogicalResourceId: 'FriggPrivateSubnet1',
+                    PhysicalResourceId: 'subnet-private-1',
+                    ResourceType: 'AWS::EC2::Subnet',
+                },
+                {
+                    LogicalResourceId: 'FriggPrivateSubnet2',
+                    PhysicalResourceId: 'subnet-private-2',
+                    ResourceType: 'AWS::EC2::Subnet',
+                },
+                {
+                    LogicalResourceId: 'FriggPublicSubnet',
+                    PhysicalResourceId: 'subnet-public-1',
+                    ResourceType: 'AWS::EC2::Subnet',
+                },
+                {
+                    LogicalResourceId: 'FriggPublicSubnet2',
+                    PhysicalResourceId: 'subnet-public-2',
+                    ResourceType: 'AWS::EC2::Subnet',
+                },
+            ];
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+
+            const result = await cfDiscovery.discoverFromStack('test-stack');
+
+            expect(result.privateSubnetId1).toBe('subnet-private-1');
+            expect(result.privateSubnetId2).toBe('subnet-private-2');
+            expect(result.publicSubnetId1).toBe('subnet-public-1');
+            expect(result.publicSubnetId2).toBe('subnet-public-2');
+        });
+
         it('should extract S3 migration bucket from stack resources', async () => {
             const mockStack = {
                 StackName: 'test-stack',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.41b7566.0",
+  "version": "2.0.0--canary.461.4066059.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.41b7566.0",
-    "@friggframework/test": "2.0.0--canary.461.41b7566.0",
+    "@friggframework/schemas": "2.0.0--canary.461.4066059.0",
+    "@friggframework/test": "2.0.0--canary.461.4066059.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.41b7566.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.41b7566.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.4066059.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.4066059.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "41b7566abaa46939705d52e01904022e52cdd06a"
+  "gitHead": "4066059afecf11231ca7ff94cc4483b47f5b6e74"
 }