@friggframework/devtools 2.0.0--canary.474.edb48ba.0 → 2.0.0--canary.482.c063a2a.0

package/infrastructure/domains/database/migration-builder.js

@@ -237,10 +237,21 @@ class MigrationBuilder extends InfrastructureBuilder {
         console.log('  🔍 DEBUG: result.functions is:', typeof result.functions, result.functions);
         // Migration WORKER package config (needs Prisma CLI WASM files)
         const migrationWorkerPackageConfig = {
+            individually: true,
             exclude: [
+                // Exclude Prisma runtime client - it's in the Lambda Layer
+                'node_modules/@prisma/client/**',
+                'node_modules/.prisma/**',
+                'node_modules/@friggframework/core/generated/**',
+                // But KEEP node_modules/prisma/** (the CLI with WASM)
+
+                // Exclude ALL nested node_modules
+                'node_modules/**/node_modules/**',
+
                 // Exclude AWS SDK (provided by Lambda runtime)
                 'node_modules/aws-sdk/**',
                 'node_modules/@aws-sdk/**',
+
                 // Exclude build tools
                 'node_modules/esbuild/**',
                 'node_modules/@esbuild/**',
@@ -253,6 +264,8 @@ class MigrationBuilder extends InfrastructureBuilder {
                 'node_modules/serverless-offline-sqs/**',
                 'node_modules/serverless-dotenv-plugin/**',
                 'node_modules/serverless-kms-grants/**',
+
+                // Exclude dev dependencies
                 'node_modules/@friggframework/test/**',
                 'node_modules/@friggframework/eslint-config/**',
                 'node_modules/@friggframework/prettier-config/**',
@@ -261,23 +274,39 @@ class MigrationBuilder extends InfrastructureBuilder {
                 'node_modules/jest/**',
                 'node_modules/prettier/**',
                 'node_modules/eslint/**',
+
+                // Exclude non-essential Frigg core modules
                 'node_modules/@friggframework/core/generated/prisma-mongodb/**',
                 'node_modules/@friggframework/core/integrations/**',
                 'node_modules/@friggframework/core/user/**',
+
+                // Exclude other handlers we don't need (keep db-migration worker)
+                'node_modules/@friggframework/core/handlers/routers/auth.js',
+                'node_modules/@friggframework/core/handlers/routers/health.js',
+                'node_modules/@friggframework/core/handlers/routers/user.js',
+                'node_modules/@friggframework/core/handlers/routers/websocket.js',
+                'node_modules/@friggframework/core/handlers/routers/integration-*.js',
+                'node_modules/@friggframework/core/handlers/workers/integration-*.js',
+
+                // Exclude wrong OS binaries
                 '**/query-engine-darwin*',
                 '**/schema-engine-darwin*',
                 '**/libquery_engine-darwin*',
                 '**/*-darwin-arm64*',
                 '**/*-darwin*',
+
                 // Migration worker DOES need Prisma CLI WASM files (for migrate deploy)
                 // Only exclude runtime engine WASM (query engine internals)
                 '**/runtime/*.wasm',
+
                 // Additional size optimizations
                 '**/*.map',
                 '**/*.md',
+                '**/LICENSE*',
+                '**/*.d.ts',
+                '**/*.d.mts',
                 '**/examples/**',
                 '**/docs/**',
-                '**/*.d.ts',
                 'src/**',
                 'test/**',
                 'layers/**',
@@ -297,21 +326,37 @@ class MigrationBuilder extends InfrastructureBuilder {
 
         // Migration ROUTER package config (lighter, no Prisma CLI needed)
         const migrationRouterPackageConfig = {
+            individually: true,
             exclude: [
+                // Exclude Prisma runtime client - it's in the Lambda Layer
+                'node_modules/@prisma/client/**',
+                'node_modules/.prisma/**',
+                'node_modules/@friggframework/core/generated/**',
+
+                // Router doesn't need Prisma CLI at all
+                'node_modules/prisma/**',
+
+                // Exclude ALL nested node_modules
+                'node_modules/**/node_modules/**',
+
                 // Exclude AWS SDK (provided by Lambda runtime)
                 'node_modules/aws-sdk/**',
                 'node_modules/@aws-sdk/**',
+
                 // Exclude build tools
                 'node_modules/esbuild/**',
                 'node_modules/@esbuild/**',
                 'node_modules/typescript/**',
                 'node_modules/webpack/**',
+                'node_modules/osls/**',
                 'node_modules/serverless-esbuild/**',
                 'node_modules/serverless-jetpack/**',
                 'node_modules/serverless-offline/**',
                 'node_modules/serverless-offline-sqs/**',
                 'node_modules/serverless-dotenv-plugin/**',
                 'node_modules/serverless-kms-grants/**',
+
+                // Exclude dev dependencies
                 'node_modules/@friggframework/test/**',
                 'node_modules/@friggframework/eslint-config/**',
                 'node_modules/@friggframework/prettier-config/**',
@@ -320,25 +365,42 @@ class MigrationBuilder extends InfrastructureBuilder {
                 'node_modules/jest/**',
                 'node_modules/prettier/**',
                 'node_modules/eslint/**',
+
+                // Exclude non-essential Frigg core modules
                 'node_modules/@friggframework/core/generated/prisma-mongodb/**',
+                'node_modules/@friggframework/core/integrations/**',
                 'node_modules/@friggframework/core/user/**',
+
+                // Exclude other handlers we don't need (keep db-migration router)
+                'node_modules/@friggframework/core/handlers/routers/auth.js',
+                'node_modules/@friggframework/core/handlers/routers/health.js',
+                'node_modules/@friggframework/core/handlers/routers/user.js',
+                'node_modules/@friggframework/core/handlers/routers/websocket.js',
+                'node_modules/@friggframework/core/handlers/routers/integration-*.js',
+                'node_modules/@friggframework/core/handlers/workers/**',
+
+                // Exclude wrong OS binaries
                 '**/query-engine-darwin*',
                 '**/schema-engine-darwin*',
                 '**/libquery_engine-darwin*',
                 '**/*-darwin-arm64*',
                 '**/*-darwin*',
+
                 // Router doesn't run migrations - exclude ALL WASM files
                 '**/runtime/*.wasm',
                 '**/*.wasm*',
+
                 // Additional size optimizations
                 '**/*.map',
                 '**/*.md',
+                '**/LICENSE*',
+                '**/*.d.ts',
+                '**/*.d.mts',
                 '**/test/**',
                 '**/tests/**',
                 '**/__tests__/**',
                 '**/examples/**',
                 '**/docs/**',
-                '**/*.d.ts',
                 'src/**',
                 'test/**',
                 'layers/**',

package/infrastructure/domains/shared/resource-discovery.enhanced.test.js

@@ -0,0 +1,306 @@
+/**
+ * AWS Discovery Configuration Tests
+ *
+ * Tests for AppDefinition-level discovery control options
+ * addressing GitHub Issue #481 - Issue 5
+ */
+
+const { shouldRunDiscovery, gatherDiscoveredResources } = require('./resource-discovery');
+
+// Mock dependencies
+jest.mock('./providers/provider-factory');
+jest.mock('./cloudformation-discovery');
+jest.mock('../networking/vpc-discovery');
+jest.mock('../security/kms-discovery');
+jest.mock('../database/aurora-discovery');
+jest.mock('../parameters/ssm-discovery');
+
+describe('AWS Discovery Configuration (Issue #481 - Issue 5)', () => {
+    beforeEach(() => {
+        delete process.env.FRIGG_SKIP_AWS_DISCOVERY;
+        jest.clearAllMocks();
+    });
+
+    describe('shouldRunDiscovery - Priority Order', () => {
+        it('should use AppDefinition.aws.discovery.enabled when explicitly set to true', () => {
+            const appDefinition = {
+                aws: { discovery: { enabled: true } },
+                vpc: { enable: false }, // Would normally skip
+            };
+
+            const result = shouldRunDiscovery(appDefinition);
+
+            expect(result).toBe(true);
+        });
+
+        it('should use AppDefinition.aws.discovery.enabled when explicitly set to false', () => {
+            const appDefinition = {
+                aws: { discovery: { enabled: false } },
+                vpc: { enable: true }, // Would normally run
+            };
+
+            const result = shouldRunDiscovery(appDefinition);
+
+            expect(result).toBe(false);
+        });
+
+        it('should fall back to env var when AppDefinition not set', () => {
+            process.env.FRIGG_SKIP_AWS_DISCOVERY = 'true';
+
+            const appDefinition = {
+                vpc: { enable: true }, // Would normally run
+            };
+
+            const result = shouldRunDiscovery(appDefinition);
+
+            expect(result).toBe(false);
+        });
+
+        it('should auto-detect when neither AppDefinition nor env var is set', () => {
+            const appDefinition = {
+                vpc: { enable: true },
+            };
+
+            const result = shouldRunDiscovery(appDefinition);
+
+            expect(result).toBe(true);
+        });
+
+        it('should prioritize AppDefinition over env var', () => {
+            process.env.FRIGG_SKIP_AWS_DISCOVERY = 'true';
+
+            const appDefinition = {
+                aws: { discovery: { enabled: true } }, // Explicit override
+            };
+
+            const result = shouldRunDiscovery(appDefinition);
+
+            expect(result).toBe(true); // AppDefinition wins
+        });
+    });
+
+    describe('AppDefinition.aws.discovery.enabled', () => {
+        it('should log when using AppDefinition configuration', () => {
+            const consoleSpy = jest.spyOn(console, 'log').mockImplementation();
+
+            const appDefinition = {
+                aws: { discovery: { enabled: true } },
+            };
+
+            shouldRunDiscovery(appDefinition);
+
+            expect(consoleSpy).toHaveBeenCalledWith(
+                expect.stringContaining('AppDefinition.aws.discovery.enabled: true')
+            );
+
+            consoleSpy.mockRestore();
+        });
+
+        it('should handle explicit false value', () => {
+            const appDefinition = {
+                aws: { discovery: { enabled: false } },
+                vpc: { enable: true },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
+            };
+
+            const result = shouldRunDiscovery(appDefinition);
+
+            expect(result).toBe(false);
+        });
+
+        it('should handle undefined correctly (fall through to next priority)', () => {
+            const appDefinition = {
+                aws: { discovery: { enabled: undefined } },
+                vpc: { enable: true },
+            };
+
+            const result = shouldRunDiscovery(appDefinition);
+
+            // Should skip when undefined (fall through to env var check)
+            expect(result).toBe(true); // Auto-detect kicks in
+        });
+    });
+
+    describe('Auto-detection based on features', () => {
+        it('should run discovery when VPC is enabled', () => {
+            const appDefinition = {
+                vpc: { enable: true },
+            };
+
+            expect(shouldRunDiscovery(appDefinition)).toBe(true);
+        });
+
+        it('should run discovery when KMS encryption is enabled', () => {
+            const appDefinition = {
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
+            };
+
+            expect(shouldRunDiscovery(appDefinition)).toBe(true);
+        });
+
+        it('should run discovery when SSM is enabled', () => {
+            const appDefinition = {
+                ssm: { enable: true },
+            };
+
+            expect(shouldRunDiscovery(appDefinition)).toBe(true);
+        });
+
+        it('should run discovery when PostgreSQL is enabled', () => {
+            const appDefinition = {
+                database: { postgres: { enable: true } },
+            };
+
+            expect(shouldRunDiscovery(appDefinition)).toBe(true);
+        });
+
+        it('should not run discovery when no features are enabled', () => {
+            const appDefinition = {
+                vpc: { enable: false },
+                encryption: { fieldLevelEncryptionMethod: 'aes' },
+            };
+
+            expect(shouldRunDiscovery(appDefinition)).toBe(false);
+        });
+    });
+
+    describe('gatherDiscoveredResources - failOnError behavior', () => {
+        const { CloudProviderFactory } = require('./providers/provider-factory');
+        const { CloudFormationDiscovery } = require('./cloudformation-discovery');
+
+        beforeEach(() => {
+            const mockProvider = {
+                getVpcs: jest.fn(),
+                getKmsKeys: jest.fn(),
+            };
+
+            CloudProviderFactory.create = jest.fn().mockReturnValue(mockProvider);
+
+            // Mock CloudFormation discovery to throw error
+            CloudFormationDiscovery.mockImplementation(() => ({
+                discoverFromStack: jest.fn().mockRejectedValue(
+                    new Error('User is not authorized to perform: ec2:DescribeVpcs')
+                ),
+            }));
+        });
+
+        it('should throw error when failOnError is true', async () => {
+            const appDefinition = {
+                name: 'test-app',
+                vpc: { enable: true },
+                aws: {
+                    discovery: {
+                        enabled: true,
+                        failOnError: true,
+                    },
+                },
+            };
+
+            await expect(gatherDiscoveredResources(appDefinition)).rejects.toThrow(
+                'User is not authorized'
+            );
+        });
+
+        it('should return empty object when failOnError is false', async () => {
+            const appDefinition = {
+                name: 'test-app',
+                vpc: { enable: true },
+                aws: {
+                    discovery: {
+                        enabled: true,
+                        failOnError: false,
+                    },
+                },
+            };
+
+            const result = await gatherDiscoveredResources(appDefinition);
+
+            expect(result).toEqual({});
+        });
+
+        it('should default to false when failOnError is not set', async () => {
+            const appDefinition = {
+                name: 'test-app',
+                vpc: { enable: true },
+            };
+
+            const result = await gatherDiscoveredResources(appDefinition);
+
+            expect(result).toEqual({});
+        });
+
+        it('should log helpful message when failing gracefully', async () => {
+            const consoleWarnSpy = jest.spyOn(console, 'warn').mockImplementation();
+
+            const appDefinition = {
+                name: 'test-app',
+                vpc: { enable: true },
+                aws: { discovery: { failOnError: false } },
+            };
+
+            await gatherDiscoveredResources(appDefinition);
+
+            expect(consoleWarnSpy).toHaveBeenCalledWith(
+                expect.stringContaining('Set aws.discovery.failOnError = true')
+            );
+
+            consoleWarnSpy.mockRestore();
+        });
+    });
+
+    describe('Real-world scenarios', () => {
+        it('should handle restrictive IAM with explicit disable', () => {
+            const appDefinition = {
+                vpc: { enable: true },
+                aws: {
+                    discovery: {
+                        enabled: false, // Explicit disable for restrictive IAM
+                    },
+                },
+            };
+
+            const result = shouldRunDiscovery(appDefinition);
+
+            expect(result).toBe(false);
+        });
+
+        it('should allow strict mode for production deployments', async () => {
+            const { CloudProviderFactory } = require('./providers/provider-factory');
+            const { CloudFormationDiscovery } = require('./cloudformation-discovery');
+
+            CloudFormationDiscovery.mockImplementation(() => ({
+                discoverFromStack: jest.fn().mockRejectedValue(new Error('IAM error')),
+            }));
+
+            const appDefinition = {
+                name: 'prod-app',
+                vpc: { enable: true },
+                aws: {
+                    discovery: {
+                        enabled: true,
+                        failOnError: true, // Strict mode for production
+                    },
+                },
+            };
+
+            await expect(gatherDiscoveredResources(appDefinition)).rejects.toThrow();
+        });
+
+        it('should allow graceful degradation for dev environments', async () => {
+            const appDefinition = {
+                name: 'dev-app',
+                vpc: { enable: true },
+                aws: {
+                    discovery: {
+                        enabled: true,
+                        failOnError: false, // Graceful for dev
+                    },
+                },
+            };
+
+            const result = await gatherDiscoveredResources(appDefinition);
+
+            expect(result).toEqual({});
+        });
+    });
+});

package/infrastructure/domains/shared/resource-discovery.js

@@ -18,11 +18,26 @@ const { SsmDiscovery } = require('../parameters/ssm-discovery');
 
 /**
  * Determine if AWS discovery should run
- * 
+ *
+ * Checks in priority order:
+ * 1. AppDefinition.aws.discovery.enabled (explicit opt-in/out)
+ * 2. FRIGG_SKIP_AWS_DISCOVERY environment variable
+ * 3. Auto-detection based on features enabled (VPC, KMS, SSM, PostgreSQL)
+ *
  * @param {Object} appDefinition - Application definition
  * @returns {boolean} True if discovery is needed
  */
 function shouldRunDiscovery(appDefinition) {
+    // Priority 1: Check AppDefinition-level configuration
+    if (appDefinition.aws?.discovery?.enabled !== undefined) {
+        const enabled = appDefinition.aws.discovery.enabled;
+        console.log(
+            `⚙️  Using AppDefinition.aws.discovery.enabled: ${enabled}`
+        );
+        return enabled;
+    }
+
+    // Priority 2: Check environment variable
     console.log(
         '⚙️  Checking FRIGG_SKIP_AWS_DISCOVERY:',
         process.env.FRIGG_SKIP_AWS_DISCOVERY
@@ -35,6 +50,7 @@ function shouldRunDiscovery(appDefinition) {
         return false;
     }
 
+    // Priority 3: Auto-detect based on enabled features
     return (
         appDefinition.vpc?.enable === true ||
         appDefinition.encryption?.fieldLevelEncryptionMethod === 'kms' ||
@@ -177,10 +193,23 @@ async function gatherDiscoveredResources(appDefinition) {
         console.error('❌ Cloud resource discovery failed:', error.message);
         console.error('Stack:', error.stack);
 
-        // Don't fail the build - return empty resources and let validation handle it
+        // Check if discovery failures should fail the deployment
+        const failOnError = appDefinition.aws?.discovery?.failOnError ?? false;
+
+        if (failOnError) {
+            console.error(
+                '❌ Discovery failure blocking deployment (aws.discovery.failOnError = true)'
+            );
+            throw error;
+        }
+
+        // Graceful degradation - return empty resources and let validation handle it
         console.warn(
             '⚠️  Continuing with empty discovered resources. This may cause deployment issues if resources are required.'
         );
+        console.warn(
+            '💡 Set aws.discovery.failOnError = true in AppDefinition to fail on discovery errors.'
+        );
         return {};
     }
 }