@friggframework/devtools 2.0.0--canary.461.4c872e7.0 → 2.0.0--canary.461.9f988ca.0

package/infrastructure/domains/database/migration-builder.js

@@ -65,7 +65,11 @@ class MigrationBuilder extends InfrastructureBuilder {
             DeletionPolicy: 'Retain', // Protect migration history during stack rollbacks/deletions
             UpdateReplacePolicy: 'Retain', // Protect during stack updates that require replacement
             Properties: {
-                BucketName: '${self:service}-${self:provider.stage}-migration-status',
+                // Let CloudFormation auto-generate bucket name for global uniqueness
+                // Result: ${StackName}-friggmigrationstatusbucket-${randomHash}
+                // Example: quo-integrations-prod-friggmigrationstatusbucket-abc123xyz
+                // This ensures no conflicts across accounts/regions/stages
+                // BucketName: undefined (CloudFormation generates unique name)
                 VersioningConfiguration: {
                     Status: 'Enabled', // Enable versioning for audit trail
                 },
@@ -182,7 +186,7 @@ class MigrationBuilder extends InfrastructureBuilder {
                 'node_modules/@prisma/**', // Prisma engines
                 'node_modules/.prisma/**',
                 'node_modules/@friggframework/core/generated/**', // Generated clients
-                
+
                 // Base exclusions
                 'node_modules/**/node_modules/**',
                 'node_modules/aws-sdk/**',
@@ -320,7 +324,7 @@ class MigrationBuilder extends InfrastructureBuilder {
         // Add IAM permissions for S3 (migration status storage)
         // Migration functions need to read/write migration status in S3
         // to avoid chicken-and-egg dependency on User/Process tables
-        
+
         // Object-level permissions (put, get, delete)
         result.iamStatements.push({
             Effect: 'Allow',

package/infrastructure/domains/networking/vpc-builder.js

@@ -147,11 +147,12 @@ class VpcBuilder extends InfrastructureBuilder {
             dynamodb: discoveredResources.dynamodbVpcEndpointId,
             kms: discoveredResources.kmsVpcEndpointId,
             secretsManager: discoveredResources.secretsManagerVpcEndpointId,
+            sqs: discoveredResources.sqsVpcEndpointId,
         };
         const allEndpointsExist = existingEndpoints.s3 && existingEndpoints.dynamodb &&
-            existingEndpoints.kms && existingEndpoints.secretsManager;
+            existingEndpoints.kms && existingEndpoints.secretsManager && existingEndpoints.sqs;
         const someEndpointsExist = existingEndpoints.s3 || existingEndpoints.dynamodb ||
-            existingEndpoints.kms || existingEndpoints.secretsManager;
+            existingEndpoints.kms || existingEndpoints.secretsManager || existingEndpoints.sqs;
 
         if (appDefinition.vpc.enableVPCEndpoints !== false) {
             if (vpcManagement === 'create-new') {
@@ -682,6 +683,8 @@ class VpcBuilder extends InfrastructureBuilder {
         if (!existingEndpoints.dynamodb) missing.push('DynamoDB');
         if (!existingEndpoints.kms && appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms') missing.push('KMS');
         if (!existingEndpoints.secretsManager) missing.push('Secrets Manager');
+        // SQS endpoint needed for database migrations (migration queue)
+        if (!existingEndpoints.sqs && appDefinition.database?.postgres?.enable) missing.push('SQS');
 
         if (missing.length > 0) {
             console.log(`  Creating missing VPC Endpoints: ${missing.join(', ')}...`);
@@ -733,8 +736,8 @@ class VpcBuilder extends InfrastructureBuilder {
             };
         }
 
-        // VPC Endpoint Security Group (only if KMS or Secrets Manager are missing)
-        if (!existingEndpoints.kms || !existingEndpoints.secretsManager) {
+        // VPC Endpoint Security Group (only if KMS, Secrets Manager, or SQS are missing)
+        if (!existingEndpoints.kms || !existingEndpoints.secretsManager || (!existingEndpoints.sqs && appDefinition.database?.postgres?.enable)) {
             result.resources.FriggVPCEndpointSecurityGroup = {
                 Type: 'AWS::EC2::SecurityGroup',
                 Properties: {
@@ -787,6 +790,21 @@ class VpcBuilder extends InfrastructureBuilder {
             };
         }
 
+        // SQS Interface Endpoint (only if missing AND database migrations are enabled)
+        if (!existingEndpoints.sqs && appDefinition.database?.postgres?.enable) {
+            result.resources.FriggSQSVPCEndpoint = {
+                Type: 'AWS::EC2::VPCEndpoint',
+                Properties: {
+                    VpcId: vpcId,
+                    ServiceName: 'com.amazonaws.${self:provider.region}.sqs',
+                    VpcEndpointType: 'Interface',
+                    SubnetIds: result.vpcConfig.subnetIds,
+                    SecurityGroupIds: [{ Ref: 'FriggVPCEndpointSecurityGroup' }],
+                    PrivateDnsEnabled: true,
+                },
+            };
+        }
+
         console.log(`    ✅ Created ${missing.length} VPC endpoint(s): ${missing.join(', ')}`);
     }
 }

package/infrastructure/domains/networking/vpc-discovery.js

@@ -120,6 +120,9 @@ class VpcDiscovery {
                 const secretsManagerEndpoint = rawResources.vpcEndpoints.find(
                     ep => ep.ServiceName && ep.ServiceName.includes('.secretsmanager')
                 );
+                const sqsEndpoint = rawResources.vpcEndpoints.find(
+                    ep => ep.ServiceName && ep.ServiceName.includes('.sqs')
+                );
 
                 if (s3Endpoint) {
                     result.s3VpcEndpointId = s3Endpoint.VpcEndpointId;
@@ -133,6 +136,9 @@ class VpcDiscovery {
                 if (secretsManagerEndpoint) {
                     result.secretsManagerVpcEndpointId = secretsManagerEndpoint.VpcEndpointId;
                 }
+                if (sqsEndpoint) {
+                    result.sqsVpcEndpointId = sqsEndpoint.VpcEndpointId;
+                }
             }
 
             console.log(`  ✓ Found VPC: ${result.defaultVpcId}`);
@@ -145,8 +151,8 @@ class VpcDiscovery {
             if (result.existingNatGatewayId) {
                 console.log(`  ✓ Found NAT Gateway: ${result.existingNatGatewayId}`);
             }
-            if (result.s3VpcEndpointId || result.dynamodbVpcEndpointId || result.kmsVpcEndpointId || result.secretsManagerVpcEndpointId) {
-                console.log(`  ✓ Found VPC Endpoints: S3=${result.s3VpcEndpointId ? 'Yes' : 'No'}, DynamoDB=${result.dynamodbVpcEndpointId ? 'Yes' : 'No'}, KMS=${result.kmsVpcEndpointId ? 'Yes' : 'No'}, SecretsManager=${result.secretsManagerVpcEndpointId ? 'Yes' : 'No'}`);
+            if (result.s3VpcEndpointId || result.dynamodbVpcEndpointId || result.kmsVpcEndpointId || result.secretsManagerVpcEndpointId || result.sqsVpcEndpointId) {
+                console.log(`  ✓ Found VPC Endpoints: S3=${result.s3VpcEndpointId ? 'Yes' : 'No'}, DynamoDB=${result.dynamodbVpcEndpointId ? 'Yes' : 'No'}, KMS=${result.kmsVpcEndpointId ? 'Yes' : 'No'}, SecretsManager=${result.secretsManagerVpcEndpointId ? 'Yes' : 'No'}, SQS=${result.sqsVpcEndpointId ? 'Yes' : 'No'}`);
             }
 
             return result;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.4c872e7.0",
+  "version": "2.0.0--canary.461.9f988ca.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.4c872e7.0",
-    "@friggframework/test": "2.0.0--canary.461.4c872e7.0",
+    "@friggframework/schemas": "2.0.0--canary.461.9f988ca.0",
+    "@friggframework/test": "2.0.0--canary.461.9f988ca.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.4c872e7.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.4c872e7.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.9f988ca.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.9f988ca.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "4c872e770d1fddbd8689bf5ec2e26b6d21ae1d2f"
+  "gitHead": "9f988cad38fe00d1953292ea77dbcd46da275f23"
 }