@friggframework/devtools 2.0.0--canary.461.4860820.0 → 2.0.0--canary.461.12ba2eb.0

package/infrastructure/domains/database/aurora-builder.js

@@ -277,7 +277,7 @@ class AuroraBuilder extends InfrastructureBuilder {
         // Check if we should auto-create credentials
         if (dbConfig.autoCreateCredentials && !discoveredResources.databaseSecretArn) {
             console.log('  Creating Secrets Manager secret and rotating Aurora password...');
-            
+
             // Create Secrets Manager secret with auto-generated password
             result.resources.FriggDBSecret = {
                 Type: 'AWS::SecretsManager::Secret',
@@ -473,15 +473,15 @@ exports.handler = async (event, context) => {
             // No secret and no auto-create - set individual DB connection components
             // The application will construct DATABASE_URL at runtime from these components + DATABASE_USER + DATABASE_PASSWORD
             const dbName = dbConfig.database || 'frigg';
-            
+
             result.environment.DATABASE_HOST = discoveredResources.auroraClusterEndpoint;
             result.environment.DATABASE_PORT = String(discoveredResources.auroraPort || 5432);
             result.environment.DATABASE_NAME = dbName;
-            
+
             // Note: DATABASE_URL is NOT set here to avoid Serverless variable resolution errors
             // The application (Frigg Core) should construct it at runtime from:
             // DATABASE_HOST, DATABASE_PORT, DATABASE_NAME, DATABASE_USER, DATABASE_PASSWORD
-            
+
             console.log('  ℹ️  No Secrets Manager secret found - set DATABASE_USER and DATABASE_PASSWORD in Lambda environment');
             console.log('  ℹ️  Application will construct DATABASE_URL at runtime from DATABASE_HOST, DATABASE_PORT, DATABASE_NAME, DATABASE_USER, DATABASE_PASSWORD');
             console.log('  ℹ️  Or enable autoCreateCredentials=true to automatically create and rotate credentials');
@@ -508,14 +508,47 @@ exports.handler = async (event, context) => {
 
     /**
      * Build DATABASE_URL connection string
+     * @param {string|object} host - Database host (string or CloudFormation intrinsic function)
+     * @param {string|number|object} port - Database port (string/number or CloudFormation intrinsic function)
+     * @param {string} database - Database name
+     * @param {string|object} secretRef - Secret ARN (string) or CloudFormation Ref object
      */
     buildDatabaseUrl(host, port, database, secretRef) {
+        // Handle secretRef as either a string ARN or CloudFormation Ref object
+        const resolveSecretRef = (secretRefValue) => {
+            if (typeof secretRefValue === 'object' && secretRefValue.Ref) {
+                // CloudFormation Ref - use nested Fn::Sub to resolve it
+                return {
+                    'Fn::Sub': [
+                        '{{resolve:secretsmanager:${SecretArn}:SecretString:username}}',
+                        { SecretArn: secretRefValue },
+                    ],
+                };
+            }
+            // String ARN - use directly
+            return `{{resolve:secretsmanager:${secretRefValue}:SecretString:username}}`;
+        };
+
+        const resolveSecretPassword = (secretRefValue) => {
+            if (typeof secretRefValue === 'object' && secretRefValue.Ref) {
+                // CloudFormation Ref - use nested Fn::Sub to resolve it
+                return {
+                    'Fn::Sub': [
+                        '{{resolve:secretsmanager:${SecretArn}:SecretString:password}}',
+                        { SecretArn: secretRefValue },
+                    ],
+                };
+            }
+            // String ARN - use directly
+            return `{{resolve:secretsmanager:${secretRefValue}:SecretString:password}}`;
+        };
+
         return {
             'Fn::Sub': [
                 `postgresql://\${Username}:\${Password}@\${Host}:\${Port}/\${Database}`,
                 {
-                    Username: `{{resolve:secretsmanager:${secretRef}:SecretString:username}}`,
-                    Password: `{{resolve:secretsmanager:${secretRef}:SecretString:password}}`,
+                    Username: resolveSecretRef(secretRef),
+                    Password: resolveSecretPassword(secretRef),
                     Host: host,
                     Port: port,
                     Database: database,

package/infrastructure/domains/database/aurora-builder.test.js

@@ -388,8 +388,14 @@ describe('AuroraBuilder', () => {
                 // Check DATABASE_URL uses the secret
                 expect(result.environment.DATABASE_URL).toBeDefined();
                 expect(result.environment.DATABASE_URL['Fn::Sub']).toBeDefined();
-                expect(result.environment.DATABASE_URL['Fn::Sub'][1].Username).toContain('resolve:secretsmanager');
-                expect(result.environment.DATABASE_URL['Fn::Sub'][1].Password).toContain('resolve:secretsmanager');
+
+                // Username and Password should use nested Fn::Sub to resolve the Ref
+                expect(result.environment.DATABASE_URL['Fn::Sub'][1].Username['Fn::Sub']).toBeDefined();
+                expect(result.environment.DATABASE_URL['Fn::Sub'][1].Password['Fn::Sub']).toBeDefined();
+
+                // Should contain secretsmanager resolution
+                expect(result.environment.DATABASE_URL['Fn::Sub'][1].Username['Fn::Sub'][0]).toContain('resolve:secretsmanager');
+                expect(result.environment.DATABASE_URL['Fn::Sub'][1].Password['Fn::Sub'][0]).toContain('resolve:secretsmanager');
 
                 // Check IAM permissions for secret access
                 const secretPermission = result.iamStatements.find(stmt =>
@@ -426,11 +432,11 @@ describe('AuroraBuilder', () => {
                 expect(result.environment.DATABASE_HOST).toBe('cluster.abc.us-east-1.rds.amazonaws.com');
                 expect(result.environment.DATABASE_PORT).toBe('5432');
                 expect(result.environment.DATABASE_NAME).toBe('frigg');
-                
+
                 // DATABASE_URL should NOT be set (to avoid Serverless variable resolution errors)
                 // The application should construct it at runtime from DATABASE_HOST, DATABASE_PORT, DATABASE_NAME, DATABASE_USER, DATABASE_PASSWORD
                 expect(result.environment.DATABASE_URL).toBeUndefined();
-                
+
                 // DATABASE_USER and DATABASE_PASSWORD should come from appDefinition.environment
                 // and will be set by the environment-builder, not here
             });
@@ -523,15 +529,49 @@ describe('AuroraBuilder', () => {
                 const result = await auroraBuilder.build(appDefinition, discoveredResources);
 
                 const zipFileCode = result.resources.PasswordRotatorLambda.Properties.Code.ZipFile;
-                
+
                 // Should not contain template literals that would conflict with CloudFormation ${} substitution
                 // CloudFormation uses ${} for parameter substitution, so we should avoid `${variable}` in ZipFile
                 expect(zipFileCode).not.toMatch(/`.*\$\{(?!env:).*\}`/); // No template literals with ${} except ${env:...}
-                
+
                 // Should use string concatenation instead
                 expect(zipFileCode).toContain("'Successfully rotated password for cluster: ' + ClusterIdentifier");
             });
 
+            it('should properly handle Ref objects in buildDatabaseUrl when autoCreateCredentials is enabled', async () => {
+                const appDefinition = {
+                    database: {
+                        postgres: {
+                            enable: true,
+                            management: 'discover',
+                            autoCreateCredentials: true,
+                            database: 'testdb',
+                        },
+                    },
+                };
+
+                const discoveredResources = {
+                    auroraClusterEndpoint: 'cluster.abc.us-east-1.rds.amazonaws.com',
+                    auroraPort: 5432,
+                };
+
+                const result = await auroraBuilder.build(appDefinition, discoveredResources);
+
+                const dbUrl = result.environment.DATABASE_URL;
+
+                // Should use Fn::Sub with nested Fn::Sub to resolve the Ref
+                expect(dbUrl['Fn::Sub']).toBeDefined();
+                expect(dbUrl['Fn::Sub'][0]).toBe('postgresql://${Username}:${Password}@${Host}:${Port}/${Database}');
+
+                // The Username and Password should use Fn::Sub to resolve the secret Ref, not literal "[object Object]"
+                expect(dbUrl['Fn::Sub'][1].Username['Fn::Sub']).toBeDefined();
+                expect(dbUrl['Fn::Sub'][1].Password['Fn::Sub']).toBeDefined();
+
+                // Should not contain the literal string "[object Object]"
+                const jsonOutput = JSON.stringify(dbUrl);
+                expect(jsonOutput).not.toContain('[object Object]');
+            });
+
             it('should properly escape ExcludeCharacters for valid JSON in CloudFormation template', async () => {
                 const appDefinition = {
                     database: {
@@ -551,15 +591,15 @@ describe('AuroraBuilder', () => {
                 const result = await auroraBuilder.build(appDefinition, discoveredResources);
 
                 const excludeChars = result.resources.FriggDBSecret.Properties.GenerateSecretString.ExcludeCharacters;
-                
+
                 // Should properly escape the backslash so it's valid JSON
                 // In JavaScript string: '"@/\\' represents the string: "@/\
                 // When serialized to JSON, backslash must be doubled: '"@/\\'
                 expect(excludeChars).toBe('"@/\\\\');
-                
+
                 // Verify it can be JSON-stringified without errors
                 expect(() => JSON.stringify(result.resources.FriggDBSecret)).not.toThrow();
-                
+
                 // Verify the JSON output has the correct escape sequence
                 const jsonOutput = JSON.stringify(result.resources.FriggDBSecret);
                 expect(jsonOutput).toContain('\\"@/\\\\\\\\');  // In JSON string: "\"@/\\\\"

package/infrastructure/domains/database/migration-builder.js

@@ -72,6 +72,61 @@ class MigrationBuilder extends InfrastructureBuilder {
 
         console.log('  ✓ Created DbMigrationQueue resource');
 
+        // Package configuration for migration functions (reuse from base-definition-factory)
+        const migrationPackageConfig = {
+            individually: true,
+            exclude: [
+                // Exclude ALL nested node_modules
+                'node_modules/**/node_modules/**',
+                'node_modules/aws-sdk/**',
+                'node_modules/@aws-sdk/**',
+                'node_modules/esbuild/**',
+                'node_modules/@esbuild/**',
+                'node_modules/typescript/**',
+                'node_modules/webpack/**',
+                'node_modules/osls/**',
+                'node_modules/serverless-esbuild/**',
+                'node_modules/serverless-jetpack/**',
+                'node_modules/serverless-offline/**',
+                'node_modules/serverless-offline-sqs/**',
+                'node_modules/serverless-dotenv-plugin/**',
+                'node_modules/serverless-kms-grants/**',
+                'node_modules/@friggframework/test/**',
+                'node_modules/@friggframework/eslint-config/**',
+                'node_modules/@friggframework/prettier-config/**',
+                'node_modules/@friggframework/devtools/**',
+                'node_modules/@friggframework/serverless-plugin/**',
+                'node_modules/jest/**',
+                'node_modules/prettier/**',
+                'node_modules/eslint/**',
+                'node_modules/@friggframework/core/generated/prisma-mongodb/**',
+                'node_modules/@friggframework/core/integrations/**',
+                'node_modules/@friggframework/core/user/**',
+                'node_modules/@friggframework/core/handlers/routers/**',
+                '**/query-engine-darwin*',
+                '**/schema-engine-darwin*',
+                '**/libquery_engine-darwin*',
+                '**/*-darwin-arm64*',
+                '**/*-darwin*',
+                '**/runtime/*.wasm',
+                '**/*.wasm*',
+                'src/**',
+                'test/**',
+                'layers/**',
+                'coverage/**',
+                'deploy.log',
+                '.env.backup',
+                'docker-compose.yml',
+                'jest.config.js',
+                'jest.unit.config.js',
+                'package-lock.json',
+                '**/*.test.js',
+                '**/*.spec.js',
+                '**/.claude-flow/**',
+                '**/.swarm/**',
+            ],
+        };
+
         // Create migration worker Lambda (triggered by SQS)
         result.functions.dbMigrationWorker = {
             handler: 'node_modules/@friggframework/core/handlers/workers/db-migration.handler',
@@ -81,6 +136,7 @@ class MigrationBuilder extends InfrastructureBuilder {
             memorySize: 1024, // Extra memory for Prisma operations
             reservedConcurrency: 1, // Process one migration at a time (critical for safety)
             description: 'Database migration worker (triggered by SQS queue)',
+            package: migrationPackageConfig,
             events: [
                 {
                     sqs: {
@@ -101,6 +157,7 @@ class MigrationBuilder extends InfrastructureBuilder {
             timeout: 30, // Router just queues jobs, doesn't run migrations
             memorySize: 512,
             description: 'Database migration HTTP API (POST to trigger, GET to check status)',
+            package: migrationPackageConfig,
             events: [
                 { httpApi: { path: '/db-migrate', method: 'POST' } },
                 { httpApi: { path: '/db-migrate/{processId}', method: 'GET' } },

package/infrastructure/domains/database/migration-builder.test.js

@@ -172,6 +172,44 @@ describe('MigrationBuilder', () => {
             });
         });
 
+        it('should configure package exclusions for migration functions to reduce Lambda size', async () => {
+            const appDef = {
+                database: {
+                    postgres: {
+                        enable: true,
+                    },
+                },
+            };
+
+            const result = await builder.build(appDef, {});
+
+            // Both migration functions should have package configs
+            expect(result.functions.dbMigrationWorker.package).toBeDefined();
+            expect(result.functions.dbMigrationRouter.package).toBeDefined();
+
+            // Check worker package config
+            const workerPackage = result.functions.dbMigrationWorker.package;
+            expect(workerPackage.individually).toBe(true);
+            expect(workerPackage.exclude).toBeDefined();
+            expect(Array.isArray(workerPackage.exclude)).toBe(true);
+            
+            // Verify critical exclusions for size optimization
+            expect(workerPackage.exclude).toContain('test/**');
+            expect(workerPackage.exclude).toContain('**/*.test.js');
+            expect(workerPackage.exclude).toContain('node_modules/**/node_modules/**');
+            expect(workerPackage.exclude).toContain('node_modules/esbuild/**');
+            expect(workerPackage.exclude).toContain('node_modules/typescript/**');
+            expect(workerPackage.exclude).toContain('node_modules/@friggframework/devtools/**');
+            expect(workerPackage.exclude).toContain('src/**'); // Migration handlers don't need backend source
+
+            // Check router package config
+            const routerPackage = result.functions.dbMigrationRouter.package;
+            expect(routerPackage.individually).toBe(true);
+            expect(routerPackage.exclude).toBeDefined();
+            expect(routerPackage.exclude).toContain('test/**');
+            expect(routerPackage.exclude).toContain('node_modules/**/node_modules/**');
+        });
+
         it('should add queue URL to environment', async () => {
             const appDef = {
                 database: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.4860820.0",
+  "version": "2.0.0--canary.461.12ba2eb.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.4860820.0",
-    "@friggframework/test": "2.0.0--canary.461.4860820.0",
+    "@friggframework/schemas": "2.0.0--canary.461.12ba2eb.0",
+    "@friggframework/test": "2.0.0--canary.461.12ba2eb.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.4860820.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.4860820.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.12ba2eb.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.12ba2eb.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "486082018ba9bc219bf266048eb4c846bd9a45fb"
+  "gitHead": "12ba2eb2888f4999e52cf4b8f6eadc9f1beacfb0"
 }