@friggframework/devtools 2.0.0--canary.461.ab0a628.0 → 2.0.0--canary.461.630a739.0

package/infrastructure/domains/database/migration-builder.js

@@ -59,6 +59,38 @@ class MigrationBuilder extends InfrastructureBuilder {
             environment: {},
         };
 
+        // Create S3 bucket for migration status tracking
+        result.resources.FriggMigrationStatusBucket = {
+            Type: 'AWS::S3::Bucket',
+            Properties: {
+                BucketName: '${self:service}-${self:provider.stage}-migration-status',
+                VersioningConfiguration: {
+                    Status: 'Enabled', // Enable versioning for audit trail
+                },
+                LifecycleConfiguration: {
+                    Rules: [
+                        {
+                            Id: 'DeleteOldMigrations',
+                            Status: 'Enabled',
+                            ExpirationInDays: 90, // Keep migration history for 90 days
+                        },
+                    ],
+                },
+                PublicAccessBlockConfiguration: {
+                    BlockPublicAcls: true,
+                    BlockPublicPolicy: true,
+                    IgnorePublicAcls: true,
+                    RestrictPublicBuckets: true,
+                },
+                Tags: [
+                    { Key: 'ManagedBy', Value: 'Frigg' },
+                    { Key: 'Purpose', Value: 'MigrationStatusTracking' },
+                ],
+            },
+        };
+
+        console.log('  ✓ Created FriggMigrationStatusBucket resource');
+
         // Create SQS queue for migration jobs
         result.resources.DbMigrationQueue = {
             Type: 'AWS::SQS::Queue',
@@ -108,10 +140,9 @@ class MigrationBuilder extends InfrastructureBuilder {
                 '**/libquery_engine-darwin*',
                 '**/*-darwin-arm64*',
                 '**/*-darwin*',
-                // Exclude ALL WASM files - migration worker/router don't need Prisma CLI
-                // Only dbMigrate function needs Prisma CLI WASM files
+                // Note: Migration worker DOES need Prisma CLI WASM files (for migrate deploy)
+                // Only exclude runtime engine WASM (query engine internals)
                 '**/runtime/*.wasm',
-                '**/*.wasm*',
                 'src/**',
                 'test/**',
                 'layers/**',
@@ -176,6 +207,10 @@ class MigrationBuilder extends InfrastructureBuilder {
 
         console.log('  ✓ Created dbMigrationRouter function');
 
+        // Add S3 bucket name to environment (for migration status tracking)
+        result.environment.S3_BUCKET_NAME = { Ref: 'FriggMigrationStatusBucket' };
+        result.environment.MIGRATION_STATUS_BUCKET = { Ref: 'FriggMigrationStatusBucket' };
+
         // Add queue URL to environment
         result.environment.DB_MIGRATION_QUEUE_URL = { Ref: 'DbMigrationQueue' };
 
@@ -183,7 +218,7 @@ class MigrationBuilder extends InfrastructureBuilder {
         // Avoids Prisma needing to load app definition to determine database type
         result.environment.DB_TYPE = 'postgresql';
 
-        console.log('  ✓ Added DB_MIGRATION_QUEUE_URL and DB_TYPE environment variables');
+        console.log('  ✓ Added S3_BUCKET_NAME, DB_MIGRATION_QUEUE_URL, and DB_TYPE environment variables');
 
         // Add IAM permissions for SQS
         result.iamStatements.push({
@@ -201,7 +236,6 @@ class MigrationBuilder extends InfrastructureBuilder {
         // Add IAM permissions for S3 (migration status storage)
         // Migration functions need to read/write migration status in S3
         // to avoid chicken-and-egg dependency on User/Process tables
-        // Note: Uses wildcard for bucket as S3_BUCKET_NAME is set at runtime via environment
         result.iamStatements.push({
             Effect: 'Allow',
             Action: [
@@ -209,7 +243,15 @@ class MigrationBuilder extends InfrastructureBuilder {
                 's3:GetObject',
                 's3:DeleteObject',
             ],
-            Resource: 'arn:aws:s3:::*/migrations/*', // Wildcard allows any S3 bucket
+            Resource: {
+                'Fn::Join': [
+                    '',
+                    [
+                        { 'Fn::GetAtt': ['FriggMigrationStatusBucket', 'Arn'] },
+                        '/migrations/*',
+                    ],
+                ],
+            },
         });
 
         console.log('  ✓ Added S3 IAM permissions for migration status tracking');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.461.ab0a628.0",
+  "version": "2.0.0--canary.461.630a739.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.461.ab0a628.0",
-    "@friggframework/test": "2.0.0--canary.461.ab0a628.0",
+    "@friggframework/schemas": "2.0.0--canary.461.630a739.0",
+    "@friggframework/test": "2.0.0--canary.461.630a739.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.461.ab0a628.0",
-    "@friggframework/prettier-config": "2.0.0--canary.461.ab0a628.0",
+    "@friggframework/eslint-config": "2.0.0--canary.461.630a739.0",
+    "@friggframework/prettier-config": "2.0.0--canary.461.630a739.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "ab0a628208fba30774e2d6b3a797e379bc28b89b"
+  "gitHead": "630a73931d2634f7e732ab37c28d762c89213822"
 }