@friggframework/devtools 2.0.0--canary.461.77c8d12.0 → 2.0.0--canary.461.5ebf96a.0

package/infrastructure/domains/networking/vpc-builder.js

@@ -233,7 +233,14 @@ class VpcBuilder extends InfrastructureBuilder {
             existingEndpoints.kms || existingEndpoints.secretsManager || existingEndpoints.sqs;
 
         if (appDefinition.vpc.enableVPCEndpoints !== false) {
-            if (vpcManagement === 'create-new') {
+            // Check if resources came from CloudFormation stack
+            const fromCfStack = discoveredResources.fromCloudFormationStack === true;
+            const existingLogicalIds = discoveredResources.existingLogicalIds || [];
+
+            if (fromCfStack && existingLogicalIds.length > 0 && allEndpointsExist) {
+                console.log('  All VPC endpoints exist in CloudFormation stack - skipping creation');
+                // Skip VPC endpoint creation entirely
+            } else if (vpcManagement === 'create-new') {
                 // Always create in create-new mode
                 this.buildVpcEndpoints(appDefinition, discoveredResources, result, existingEndpoints);
             } else if (vpcManagement === 'discover') {
@@ -418,6 +425,27 @@ class VpcBuilder extends InfrastructureBuilder {
 
         result.vpcId = discoveredResources.defaultVpcId;
 
+        // Check if resources came from CloudFormation stack
+        const fromCfStack = discoveredResources.fromCloudFormationStack === true;
+        const existingLogicalIds = discoveredResources.existingLogicalIds || [];
+
+        if (fromCfStack && existingLogicalIds.length > 0) {
+            console.log(`  ✓ VPC discovered from CloudFormation stack: ${discoveredResources.stackName}`);
+            console.log(`  ✓ Found ${existingLogicalIds.length} existing resources in stack`);
+            console.log('  ℹ Skipping resource creation - will reuse existing CloudFormation resources');
+
+            // Set security group IDs from discovered resources
+            if (discoveredResources.securityGroupId) {
+                result.vpcConfig.securityGroupIds = [discoveredResources.securityGroupId];
+            }
+
+            // Don't create any new resources - they already exist in the CF stack
+            return;
+        }
+
+        // VPC discovered from AWS API (not from CF stack) - create needed resources
+        console.log('  ℹ VPC discovered from AWS API - will create Lambda security group');
+
         // Create a Lambda security group in the discovered VPC
         // This is needed even in discover mode so other resources can reference it
         result.resources.FriggLambdaSecurityGroup = {
@@ -695,6 +723,15 @@ class VpcBuilder extends InfrastructureBuilder {
 
         console.log(`  NAT Gateway Management: ${natManagement}`);
 
+        // Check if resources came from CloudFormation stack
+        const fromCfStack = discoveredResources.fromCloudFormationStack === true;
+        const existingLogicalIds = discoveredResources.existingLogicalIds || [];
+
+        if (fromCfStack && existingLogicalIds.length > 0) {
+            console.log('    Skipping NAT Gateway - will reuse from CloudFormation stack');
+            return;
+        }
+
         // Check if we should create NAT Gateway
         const needsNatGateway = natManagement === 'createAndManage' ||
             discoveredResources.needsNewNatGateway === true;

package/infrastructure/domains/shared/cloudformation-discovery.js

@@ -22,7 +22,7 @@ class CloudFormationDiscovery {
 
     /**
      * Discover resources from an existing CloudFormation stack
-     * 
+     *
      * @param {string} stackName - Name of the CloudFormation stack
      * @returns {Promise<Object|null>} Discovered resources or null if stack doesn't exist
      */
@@ -35,7 +35,12 @@ class CloudFormationDiscovery {
             const resources = await this.provider.listStackResources(stackName);
 
             // Extract discovered resources from outputs and resources
-            const discovered = {};
+            const discovered = {
+                // Metadata to indicate resources came from CloudFormation stack
+                fromCloudFormationStack: true,
+                stackName: stackName,
+                existingLogicalIds: []
+            };
 
             // Extract from outputs
             if (stack.Outputs && stack.Outputs.length > 0) {
@@ -46,6 +51,11 @@ class CloudFormationDiscovery {
             // Always call this even if resources is empty, as it may query AWS for resources
             await this._extractFromResources(resources || [], discovered);
 
+            // Clean up metadata if no resources were discovered
+            if (discovered.existingLogicalIds.length === 0) {
+                delete discovered.existingLogicalIds;
+            }
+
             return discovered;
         } catch (error) {
             // Stack doesn't exist - return null to trigger fallback discovery
@@ -103,16 +113,26 @@ class CloudFormationDiscovery {
 
     /**
      * Extract discovered resources from CloudFormation stack resources
-     * 
+     *
      * @private
      * @param {Array} resources - CloudFormation stack resources
      * @param {Object} discovered - Object to populate with discovered resources
      */
     async _extractFromResources(resources, discovered) {
         console.log(`  DEBUG: Processing ${resources.length} CloudFormation resources...`);
+
+        // Initialize existingLogicalIds array if not present
+        if (!discovered.existingLogicalIds) {
+            discovered.existingLogicalIds = [];
+        }
         for (const resource of resources) {
             const { LogicalResourceId, PhysicalResourceId, ResourceType } = resource;
 
+            // Track Frigg-managed resources by logical ID
+            if (LogicalResourceId.startsWith('Frigg') || LogicalResourceId.includes('Migration')) {
+                discovered.existingLogicalIds.push(LogicalResourceId);
+            }
+
             // Debug Aurora detection
             if (LogicalResourceId.includes('Aurora')) {
                 console.log(`  DEBUG: Found Aurora resource: ${LogicalResourceId} (${ResourceType})`);
@@ -122,18 +142,21 @@ class CloudFormationDiscovery {
             if (LogicalResourceId === 'FriggLambdaSecurityGroup' && ResourceType === 'AWS::EC2::SecurityGroup') {
                 discovered.securityGroupId = PhysicalResourceId;
                 console.log(`  ✓ Found security group in stack: ${PhysicalResourceId}`);
-                // Query security group to get VPC ID
-                if (this.provider && !discovered.defaultVpcId) {
+
+                // Query security group to get VPC ID (required because SG resource doesn't include VPC ID)
+                if (this.provider && this.provider.getEC2Client && !discovered.defaultVpcId) {
                     try {
-                        console.log(`  Querying security group to get VPC ID...`);
+                        console.log(`  Querying EC2 to get VPC ID from security group...`);
                         const { DescribeSecurityGroupsCommand } = require('@aws-sdk/client-ec2');
-                        const sgDetails = await this.provider.getEC2Client().send(
+                        const ec2Client = this.provider.getEC2Client();
+                        const sgDetails = await ec2Client.send(
                             new DescribeSecurityGroupsCommand({
                                 GroupIds: [PhysicalResourceId]
                             })
                         );
+
                         if (sgDetails.SecurityGroups && sgDetails.SecurityGroups.length > 0) {
-                            discovered.defaultVpcId = sgDetails.SecurityGroups[0].VpcId; // VpcBuilder expects 'defaultVpcId'
+                            discovered.defaultVpcId = sgDetails.SecurityGroups[0].VpcId;
                             console.log(`  ✓ Extracted VPC ID from security group: ${discovered.defaultVpcId}`);
                         } else {
                             console.warn(`  ⚠️  Security group query returned no results`);
@@ -193,6 +216,12 @@ class CloudFormationDiscovery {
                 discovered.natGatewayId = PhysicalResourceId;
             }
 
+            // VPC - direct extraction (primary method)
+            if (LogicalResourceId === 'FriggVPC' && ResourceType === 'AWS::EC2::VPC') {
+                discovered.defaultVpcId = PhysicalResourceId;
+                console.log(`  ✓ Found VPC in stack: ${PhysicalResourceId}`);
+            }
+
             // KMS Key (alternative to output)
             if (LogicalResourceId === 'FriggKMSKey' && ResourceType === 'AWS::KMS::Key') {
                 // Note: For KMS, we prefer the ARN from outputs, but this is a fallback

package/infrastructure/domains/shared/cloudformation-discovery.test.js

@@ -253,6 +253,30 @@ describe('CloudFormationDiscovery', () => {
             });
         });
 
+        it('should extract VPC directly from stack resources', async () => {
+            const mockStack = {
+                StackName: 'test-stack',
+                Outputs: [],
+            };
+
+            const mockResources = [
+                {
+                    LogicalResourceId: 'FriggVPC',
+                    PhysicalResourceId: 'vpc-037ec55fe87aec1e7',
+                    ResourceType: 'AWS::EC2::VPC',
+                },
+            ];
+
+            mockProvider.describeStack.mockResolvedValue(mockStack);
+            mockProvider.listStackResources.mockResolvedValue(mockResources);
+
+            const result = await cfDiscovery.discoverFromStack('test-stack');
+
+            expect(result).toEqual({
+                defaultVpcId: 'vpc-037ec55fe87aec1e7',
+            });
+        });
+
         it('should combine outputs and resources correctly', async () => {
             const mockStack = {
                 StackName: 'test-stack',

package/infrastructure/domains/shared/resource-discovery.js

@@ -85,19 +85,26 @@ async function gatherDiscoveredResources(appDefinition) {
         const hasAuroraData = stackResources?.auroraClusterId;
         const hasSomeUsefulData = hasVpcData || hasKmsData || hasAuroraData;
 
+        // Check if we're in isolated mode (each stage gets its own VPC/Aurora)
+        const isIsolatedMode = appDefinition.managementMode === 'managed' &&
+                               appDefinition.vpcIsolation === 'isolated';
+
         if (stackResources && hasSomeUsefulData) {
             console.log('  ✓ Discovered resources from existing CloudFormation stack');
             console.log('✅ Cloud resource discovery completed successfully!');
             return stackResources;
         }
 
-        // In isolated mode, ONLY use CloudFormation discovery for VPC/Aurora
-        // But still discover KMS (encryption keys can be safely shared across stages)
-        if (appDefinition.managementMode === 'managed' && appDefinition.vpcIsolation === 'isolated') {
-            console.log('  ℹ Isolated mode: discovering KMS (shareable) but not VPC/Aurora (isolated)');
+        // In isolated mode, NEVER fall back to AWS discovery for VPC/Aurora
+        // These resources must be isolated per stage, so we either:
+        // 1. Use resources from THIS stage's CloudFormation stack (handled above)
+        // 2. Return empty to CREATE fresh isolated resources for this stage
+        if (isIsolatedMode) {
+            console.log('  ℹ Isolated mode: No CloudFormation stack or no VPC/Aurora in stack');
+            console.log('  ℹ Will create fresh isolated VPC/Aurora for this stage');
+            console.log('  ℹ Checking for shared KMS key...');
 
-            // Still run KMS discovery - encryption keys are safe to share
-            // Pass serviceName and stage to search for stage-specific alias
+            // KMS keys CAN be shared across stages (encryption keys are safe to reuse)
             const kmsDiscovery = new KmsDiscovery(provider);
             const kmsConfig = {
                 serviceName: appDefinition.name || 'create-frigg-app',
@@ -108,12 +115,12 @@ async function gatherDiscoveredResources(appDefinition) {
 
             if (kmsResult?.defaultKmsKeyId) {
                 console.log('  ✓ Found shared KMS key (can be reused across stages)');
-                console.log('✅ Cloud resource discovery completed successfully!');
+                console.log('✅ Cloud resource discovery completed - will create isolated VPC/Aurora!');
                 return kmsResult;
             }
 
             console.log('  ℹ No existing KMS key found - will create new one');
-            console.log('✅ Cloud resource discovery completed successfully!');
+            console.log('✅ Cloud resource discovery completed - will create fresh isolated resources!');
             return {};
         }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.77c8d12.0",
+  "version": "2.0.0--canary.461.5ebf96a.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.77c8d12.0",
-    "@friggframework/test": "2.0.0--canary.461.77c8d12.0",
+    "@friggframework/schemas": "2.0.0--canary.461.5ebf96a.0",
+    "@friggframework/test": "2.0.0--canary.461.5ebf96a.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.77c8d12.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.77c8d12.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.5ebf96a.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.5ebf96a.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "77c8d12f6a33bb2d66e19b43b6d96ee27d6f5e06"
+  "gitHead": "5ebf96a4b08d18a165c8451176b92705a1dcbb4f"
 }