@friggframework/devtools 2.0.0--canary.490.10eff0a.0 → 2.0.0--canary.493.f8d621f.0

package/infrastructure/domains/networking/vpc-builder.js

@@ -149,7 +149,7 @@ class VpcBuilder extends InfrastructureBuilder {
                     physicalId = flatDiscovery.defaultVpcId;
                 } else if (logicalId === 'FriggLambdaSecurityGroup') {
                     resourceType = 'AWS::EC2::SecurityGroup';
-                    physicalId = flatDiscovery.lambdaSecurityGroupId || flatDiscovery.defaultSecurityGroupId || flatDiscovery.securityGroupId;
+                    physicalId = flatDiscovery.defaultSecurityGroupId || flatDiscovery.securityGroupId;
                 } else if (logicalId === 'FriggPrivateSubnet1') {
                     resourceType = 'AWS::EC2::Subnet';
                     physicalId = flatDiscovery.privateSubnetId1;
@@ -159,9 +159,6 @@ class VpcBuilder extends InfrastructureBuilder {
                 } else if (logicalId === 'FriggNATGateway') {
                     resourceType = 'AWS::EC2::NatGateway';
                     physicalId = flatDiscovery.existingNatGatewayId;
-                } else if (logicalId === 'FriggLambdaRouteTable') {
-                    resourceType = 'AWS::EC2::RouteTable';
-                    physicalId = flatDiscovery.routeTableId;
                 } else if (logicalId === 'FriggS3VPCEndpoint') {
                     resourceType = 'AWS::EC2::VPCEndpoint';
                     physicalId = flatDiscovery.s3VpcEndpointId;
@@ -187,11 +184,6 @@ class VpcBuilder extends InfrastructureBuilder {
                     });
                 }
             });
-
-            // Also check for external resources extracted via CloudFormation queries
-            // (e.g., VPC ID from security group query, subnets from route table associations)
-            // These are NOT in the stack but were discovered through stack resources
-            this._addExternalResourcesFromCloudFormationQueries(flatDiscovery, discovery, existingLogicalIds);
         } else {
             // Resources discovered from AWS API (not CloudFormation)
             // These go into external array
@@ -298,58 +290,6 @@ class VpcBuilder extends InfrastructureBuilder {
         return discovery;
     }
 
-    /**
-     * Add external resources that were discovered via CloudFormation queries
-     * (e.g., VPC ID extracted from security group, subnets from route table associations)
-     * 
-     * @private
-     */
-    _addExternalResourcesFromCloudFormationQueries(flatDiscovery, discovery, existingLogicalIds) {
-        // VPC ID extracted from SG or route table (NOT a stack resource)
-        if (flatDiscovery.defaultVpcId && 
-            typeof flatDiscovery.defaultVpcId === 'string' &&
-            !existingLogicalIds.includes('FriggVPC')) {
-            discovery.external.push({
-                physicalId: flatDiscovery.defaultVpcId,
-                resourceType: 'AWS::EC2::VPC',
-                source: 'cloudformation-query'
-            });
-        }
-
-        // Subnets extracted from route table associations (NOT stack resources)
-        if (flatDiscovery.privateSubnetId1 && 
-            typeof flatDiscovery.privateSubnetId1 === 'string' &&
-            !existingLogicalIds.includes('FriggPrivateSubnet1')) {
-            discovery.external.push({
-                physicalId: flatDiscovery.privateSubnetId1,
-                resourceType: 'AWS::EC2::Subnet',
-                source: 'cloudformation-query'
-            });
-        }
-
-        if (flatDiscovery.privateSubnetId2 && 
-            typeof flatDiscovery.privateSubnetId2 === 'string' &&
-            !existingLogicalIds.includes('FriggPrivateSubnet2')) {
-            discovery.external.push({
-                physicalId: flatDiscovery.privateSubnetId2,
-                resourceType: 'AWS::EC2::Subnet',
-                source: 'cloudformation-query'
-            });
-        }
-
-        // NAT Gateway extracted from route table routes
-        if (flatDiscovery.existingNatGatewayId && 
-            typeof flatDiscovery.existingNatGatewayId === 'string' &&
-            !existingLogicalIds.includes('FriggNATGateway') &&
-            !existingLogicalIds.includes('FriggNatGateway')) {
-            discovery.external.push({
-                physicalId: flatDiscovery.existingNatGatewayId,
-                resourceType: 'AWS::EC2::NatGateway',
-                source: 'cloudformation-query'
-            });
-        }
-    }
-
     /**
      * Translate legacy configuration (management modes) to new ownership-based configuration
      * Provides backwards compatibility for existing app definitions
@@ -1721,7 +1661,7 @@ class VpcBuilder extends InfrastructureBuilder {
         // Stack-managed resources should be reused, not recreated
         const stackManagedEndpoints = {
             s3: discoveredResources.s3VpcEndpointId && typeof discoveredResources.s3VpcEndpointId === 'string',
-            dynamodb: discoveredResources.dynamodbVpcEndpointId && typeof discoveredResources.dynamodbVpcEndpointId === 'string',
+            dynamodb: discoveredResources.dynamoDbVpcEndpointId && typeof discoveredResources.dynamoDbVpcEndpointId === 'string',
             kms: discoveredResources.kmsVpcEndpointId && typeof discoveredResources.kmsVpcEndpointId === 'string',
             secretsManager: discoveredResources.secretsManagerVpcEndpointId && typeof discoveredResources.secretsManagerVpcEndpointId === 'string',
             sqs: discoveredResources.sqsVpcEndpointId && typeof discoveredResources.sqsVpcEndpointId === 'string',

package/infrastructure/domains/networking/vpc-builder.test.js

@@ -1258,145 +1258,5 @@ describe('VpcBuilder', () => {
             expect(result.outputs.PrivateSubnet2Id).toBeDefined();
         });
     });
-
-    describe('convertFlatDiscoveryToStructured - CloudFormation query results', () => {
-        it('should add VPC from CloudFormation query to external array', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: ['FriggLambdaRouteTable', 'FriggLambdaSecurityGroup'],
-                // VPC ID was extracted from security group query (NOT a stack resource)
-                defaultVpcId: 'vpc-extracted-from-sg',
-                lambdaSecurityGroupId: 'sg-123',
-                routeTableId: 'rtb-123'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // VPC should be in external array (discovered via query, not in stack)
-            const vpcExternal = result.external.find(r => r.resourceType === 'AWS::EC2::VPC');
-            expect(vpcExternal).toBeDefined();
-            expect(vpcExternal.physicalId).toBe('vpc-extracted-from-sg');
-            expect(vpcExternal.source).toBe('cloudformation-query');
-
-            // Security group SHOULD be in stackManaged (is in stack)
-            const sgStack = result.stackManaged.find(r => r.logicalId === 'FriggLambdaSecurityGroup');
-            expect(sgStack).toBeDefined();
-            expect(sgStack.physicalId).toBe('sg-123');
-        });
-
-        it('should add subnets from route table associations to external array', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: ['FriggLambdaRouteTable'],
-                routeTableId: 'rtb-123',
-                // Subnets extracted from route table associations (NOT stack resources)
-                privateSubnetId1: 'subnet-1',
-                privateSubnetId2: 'subnet-2'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // Subnets should be in external array
-            const subnet1 = result.external.find(r => r.physicalId === 'subnet-1');
-            const subnet2 = result.external.find(r => r.physicalId === 'subnet-2');
-            
-            expect(subnet1).toBeDefined();
-            expect(subnet1.resourceType).toBe('AWS::EC2::Subnet');
-            expect(subnet1.source).toBe('cloudformation-query');
-            
-            expect(subnet2).toBeDefined();
-            expect(subnet2.resourceType).toBe('AWS::EC2::Subnet');
-            expect(subnet2.source).toBe('cloudformation-query');
-        });
-
-        it('should add NAT Gateway from route table queries to external array', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: ['FriggLambdaRouteTable', 'FriggPrivateRoute'],
-                routeTableId: 'rtb-123',
-                // NAT Gateway extracted from route table routes (NOT a stack resource)
-                existingNatGatewayId: 'nat-extracted'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // NAT should be in external array
-            const natExternal = result.external.find(r => r.resourceType === 'AWS::EC2::NatGateway');
-            expect(natExternal).toBeDefined();
-            expect(natExternal.physicalId).toBe('nat-extracted');
-            expect(natExternal.source).toBe('cloudformation-query');
-        });
-
-        it('should NOT add resources to external if they are in stack', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: ['FriggVPC', 'FriggPrivateSubnet1'],
-                // These ARE in the stack
-                defaultVpcId: 'vpc-in-stack',
-                privateSubnetId1: 'subnet-in-stack'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // Should be in stackManaged, NOT external
-            expect(result.stackManaged.some(r => r.logicalId === 'FriggVPC')).toBe(true);
-            expect(result.stackManaged.some(r => r.logicalId === 'FriggPrivateSubnet1')).toBe(true);
-            
-            // Should NOT be in external
-            expect(result.external.some(r => r.physicalId === 'vpc-in-stack')).toBe(false);
-            expect(result.external.some(r => r.physicalId === 'subnet-in-stack')).toBe(false);
-        });
-
-        it('should handle Frontify pattern: stack resources + queried external references', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'create-frigg-app-production',
-                existingLogicalIds: [
-                    'FriggLambdaSecurityGroup',
-                    'FriggLambdaRouteTable',
-                    'FriggPrivateRoute',
-                    'FriggPrivateSubnet1RouteTableAssociation',
-                    'FriggPrivateSubnet2RouteTableAssociation',
-                    'FriggS3VPCEndpoint',
-                    'FriggDynamoDBVPCEndpoint',
-                    'FriggKMSVPCEndpoint'
-                ],
-                // Stack resources
-                lambdaSecurityGroupId: 'sg-01002240c6a446202',
-                routeTableId: 'rtb-08af43bbf0775602d',
-                s3VpcEndpointId: 'vpce-s3',
-                // External resources (discovered via queries)
-                defaultVpcId: 'vpc-0cd17c0e06cb28b28',
-                privateSubnetId1: 'subnet-034f6562dbbc16348',
-                privateSubnetId2: 'subnet-0b8be2b82aeb5cdec',
-                existingNatGatewayId: 'nat-022660c36a47e2d79'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // Stack resources should be in stackManaged
-            expect(result.stackManaged).toEqual(
-                expect.arrayContaining([
-                    expect.objectContaining({ logicalId: 'FriggLambdaSecurityGroup', physicalId: 'sg-01002240c6a446202' }),
-                    expect.objectContaining({ logicalId: 'FriggLambdaRouteTable', physicalId: 'rtb-08af43bbf0775602d' }),
-                    expect.objectContaining({ logicalId: 'FriggS3VPCEndpoint' })
-                ])
-            );
-
-            // External resources should be in external array
-            expect(result.external).toEqual(
-                expect.arrayContaining([
-                    expect.objectContaining({ physicalId: 'vpc-0cd17c0e06cb28b28', resourceType: 'AWS::EC2::VPC', source: 'cloudformation-query' }),
-                    expect.objectContaining({ physicalId: 'subnet-034f6562dbbc16348', resourceType: 'AWS::EC2::Subnet', source: 'cloudformation-query' }),
-                    expect.objectContaining({ physicalId: 'subnet-0b8be2b82aeb5cdec', resourceType: 'AWS::EC2::Subnet', source: 'cloudformation-query' }),
-                    expect.objectContaining({ physicalId: 'nat-022660c36a47e2d79', resourceType: 'AWS::EC2::NatGateway', source: 'cloudformation-query' })
-                ])
-            );
-        });
-    });
 });
 

package/infrastructure/domains/networking/vpc-resolver.js

@@ -23,7 +23,6 @@ class VpcResourceResolver extends BaseResourceResolver {
      */
     resolveVpc(appDefinition, discovery) {
         const userIntent = appDefinition.vpc?.ownership?.vpc || 'auto';
-        const vpcManagement = appDefinition.vpc?.management; // Legacy config
 
         // Explicit external
         if (userIntent === 'external') {
@@ -44,35 +43,20 @@ class VpcResourceResolver extends BaseResourceResolver {
         }
 
         // Auto-decide
-        const decision = this.resolveResourceOwnership(
+        return this.resolveResourceOwnership(
             'auto',
             'FriggVPC',
             'AWS::EC2::VPC',
             discovery
         );
-
-        // CRITICAL: If auto-resolution wants to create a VPC but management mode is 'discover' (or undefined),
-        // throw an error instead. Creating a VPC is expensive and should be explicit.
-        if (decision.ownership === ResourceOwnership.STACK && 
-            !decision.physicalId && 
-            vpcManagement !== 'create-new' &&
-            userIntent === 'auto') {
-            throw new Error(
-                'VPC discovery failed: No VPC found. ' +
-                'Either set vpc.management to "create-new" or provide vpc.vpcId with vpc.management "use-existing".'
-            );
-        }
-
-        return decision;
     }
 
     /**
      * Resolve Security Group ownership
      *
-     * Logic:
-     * - If FriggLambdaSecurityGroup exists in stack → STACK (keep it)
-     * - If default SG discovered from VPC → EXTERNAL (use it)
-     * - Otherwise → STACK (create FriggLambdaSecurityGroup)
+     * Special logic: We ALWAYS create our own FriggLambdaSecurityGroup with specific
+     * rules unless the user explicitly provides external SG IDs. The discovered
+     * defaultSecurityGroupId is the VPC's default SG, but we need our own Lambda SG.
      *
      * @param {Object} appDefinition - App definition
      * @param {Object} discovery - Discovery result
@@ -81,7 +65,7 @@ class VpcResourceResolver extends BaseResourceResolver {
     resolveSecurityGroup(appDefinition, discovery) {
         const userIntent = appDefinition.vpc?.ownership?.securityGroup || 'auto';
 
-        // Explicit external - use provided SG IDs
+        // Explicit external - only use external SGs if user explicitly provides them
         if (userIntent === 'external') {
             this.requireExternalIds(
                 appDefinition.vpc?.external?.securityGroupIds,
@@ -93,52 +77,21 @@ class VpcResourceResolver extends BaseResourceResolver {
             );
         }
 
-        // Explicit stack - always create FriggLambdaSecurityGroup
-        if (userIntent === 'stack') {
-            const inStack = this.findInStack('FriggLambdaSecurityGroup', discovery);
-            return this.createStackDecision(
-                inStack?.physicalId,
-                inStack 
-                    ? 'Found FriggLambdaSecurityGroup in CloudFormation stack'
-                    : 'User specified ownership=stack - will create FriggLambdaSecurityGroup'
-            );
-        }
-
-        // Auto mode: Check stack first, then check for discovered default SG
+        // For stack or auto: check if FriggLambdaSecurityGroup exists in stack
+        // If it does, reuse it. If not, create it. Never use discovered default SG.
         const inStack = this.findInStack('FriggLambdaSecurityGroup', discovery);
 
         if (inStack) {
             return this.createStackDecision(
                 inStack.physicalId,
-                'Found FriggLambdaSecurityGroup in CloudFormation stack - must keep in template'
-            );
-        }
-
-        // Also check flat discovery for lambdaSecurityGroupId (from CloudFormation extraction)
-        const structured = discovery._structured || discovery;
-        const lambdaSgId = structured.lambdaSecurityGroupId || discovery.lambdaSecurityGroupId;
-        
-        if (lambdaSgId) {
-            return this.createStackDecision(
-                lambdaSgId,
-                'Found FriggLambdaSecurityGroup in CloudFormation stack - must keep in template'
-            );
-        }
-
-        // Check for discovered default security group (from external VPC pattern)
-        const defaultSgId = structured.defaultSecurityGroupId || discovery.defaultSecurityGroupId;
-        
-        if (defaultSgId) {
-            return this.createExternalDecision(
-                [defaultSgId],
-                'Found default security group via discovery - will reuse (matches canary behavior)'
+                'Found FriggLambdaSecurityGroup in CloudFormation stack'
             );
         }
 
-        // No SG found anywhere - create new FriggLambdaSecurityGroup
+        // Create new FriggLambdaSecurityGroup in stack
         return this.createStackDecision(
             null,
-            'No security group found - will create FriggLambdaSecurityGroup in stack'
+            'No existing FriggLambdaSecurityGroup - will create in stack'
         );
     }
 

package/infrastructure/domains/networking/vpc-resolver.test.js

@@ -109,46 +109,6 @@ describe('VpcResourceResolver', () => {
             expect(decision.physicalId).toBeUndefined();
             expect(decision.reason).toContain('No existing resource found');
         });
-
-        it('should throw error when auto mode finds no VPC and management is not create-new', () => {
-            const appDefinition = {
-                vpc: {
-                    enable: true,
-                    // No management specified - defaults to discover
-                    // No ownership specified - defaults to auto
-                }
-            };
-            const discovery = { 
-                stackManaged: [], 
-                external: [], 
-                fromCloudFormation: false 
-            };
-
-            // Should throw error instead of trying to create VPC
-            expect(() => resolver.resolveVpc(appDefinition, discovery)).toThrow(
-                'VPC discovery failed: No VPC found'
-            );
-        });
-
-        it('should allow creating VPC when management is create-new', () => {
-            const appDefinition = {
-                vpc: {
-                    enable: true,
-                    management: 'create-new'
-                }
-            };
-            const discovery = { 
-                stackManaged: [], 
-                external: [], 
-                fromCloudFormation: false 
-            };
-
-            // Should NOT throw - create-new explicitly allows VPC creation
-            const decision = resolver.resolveVpc(appDefinition, discovery);
-            
-            expect(decision.ownership).toBe(ResourceOwnership.STACK);
-            expect(decision.physicalId).toBeNull();
-        });
     });
 
     describe('resolveSecurityGroup', () => {

package/infrastructure/domains/shared/cloudformation-discovery.js

@@ -28,9 +28,6 @@ class CloudFormationDiscovery {
      */
     async discoverFromStack(stackName) {
         try {
-            // Store stack name for use in helper methods
-            this.currentStackName = stackName;
-            
             // Try to get the stack
             const stack = await this.provider.describeStack(stackName);
 
@@ -114,93 +111,6 @@ class CloudFormationDiscovery {
         }
     }
 
-    /**
-     * Extract external resource references from stack resource properties
-     * 
-     * When VPC/subnets/NAT are external, they're referenced in routing resources' properties.
-     * We query EC2 to get the actual VPC ID, NAT Gateway ID, and subnet IDs from the route table.
-     * 
-     * @private
-     * @param {Array} resources - CloudFormation stack resources
-     * @param {Object} discovered - Object to populate with discovered resources
-     */
-    async _extractExternalReferencesFromStackResources(resources, discovered) {
-        if (!this.provider || !this.provider.getEC2Client) {
-            console.log('  ℹ Skipping external reference extraction (EC2 client not available)');
-            return;
-        }
-
-        try {
-            // If we found a route table in the stack, query EC2 for its details
-            // This gives us VPC ID, NAT Gateway ID, and subnet IDs
-            if (discovered.routeTableId) {
-                try {
-                    console.log(`  ℹ Querying route table ${discovered.routeTableId} for external references...`);
-                    const { DescribeRouteTablesCommand } = require('@aws-sdk/client-ec2');
-                    const ec2 = this.provider.getEC2Client();
-                    const rtResponse = await ec2.send(new DescribeRouteTablesCommand({
-                        RouteTableIds: [discovered.routeTableId]
-                    }));
-                    
-                    if (rtResponse.RouteTables && rtResponse.RouteTables.length > 0) {
-                        const routeTable = rtResponse.RouteTables[0];
-                        
-                        // Extract VPC ID
-                        if (routeTable.VpcId && !discovered.defaultVpcId) {
-                            discovered.defaultVpcId = routeTable.VpcId;
-                            console.log(`  ✓ Extracted VPC ID from route table: ${routeTable.VpcId}`);
-                        }
-                        
-                        // Extract NAT Gateway ID from routes
-                        const natRoute = routeTable.Routes?.find(r => r.NatGatewayId);
-                        if (natRoute && natRoute.NatGatewayId && !discovered.natGatewayId) {
-                            discovered.natGatewayId = natRoute.NatGatewayId;
-                            discovered.existingNatGatewayId = natRoute.NatGatewayId;
-                            console.log(`  ✓ Extracted NAT Gateway ID from routes: ${natRoute.NatGatewayId}`);
-                        }
-                        
-                        // Extract subnet IDs from route table associations
-                        const associations = routeTable.Associations || [];
-                        const subnetAssociations = associations.filter(a => a.SubnetId);
-                        
-                        if (subnetAssociations.length >= 1 && !discovered.privateSubnetId1) {
-                            discovered.privateSubnetId1 = subnetAssociations[0].SubnetId;
-                            console.log(`  ✓ Extracted private subnet 1 from associations: ${subnetAssociations[0].SubnetId}`);
-                        }
-                        if (subnetAssociations.length >= 2 && !discovered.privateSubnetId2) {
-                            discovered.privateSubnetId2 = subnetAssociations[1].SubnetId;
-                            console.log(`  ✓ Extracted private subnet 2 from associations: ${subnetAssociations[1].SubnetId}`);
-                        }
-
-                        // Query for default security group in the VPC (matches canary behavior)
-                        if (routeTable.VpcId && !discovered.defaultSecurityGroupId) {
-                            try {
-                                const { DescribeSecurityGroupsCommand } = require('@aws-sdk/client-ec2');
-                                const sgResponse = await ec2.send(new DescribeSecurityGroupsCommand({
-                                    Filters: [
-                                        { Name: 'vpc-id', Values: [routeTable.VpcId] },
-                                        { Name: 'group-name', Values: ['default'] }
-                                    ]
-                                }));
-                                
-                                if (sgResponse.SecurityGroups && sgResponse.SecurityGroups.length > 0) {
-                                    discovered.defaultSecurityGroupId = sgResponse.SecurityGroups[0].GroupId;
-                                    console.log(`  ✓ Extracted default security group: ${discovered.defaultSecurityGroupId}`);
-                                }
-                            } catch (error) {
-                                console.warn(`  ⚠️  Could not query default security group: ${error.message}`);
-                            }
-                        }
-                    }
-                } catch (error) {
-                    console.warn(`  ⚠️  Could not query route table for external references: ${error.message}`);
-                }
-            }
-        } catch (error) {
-            console.warn(`  ⚠️  Error extracting external references: ${error.message}`);
-        }
-    }
-
     /**
      * Extract discovered resources from CloudFormation stack resources
      *
@@ -306,30 +216,6 @@ class CloudFormationDiscovery {
                 discovered.natGatewayId = PhysicalResourceId;
             }
 
-            // Route Table (Lambda route table for external VPC pattern)
-            if (LogicalResourceId === 'FriggLambdaRouteTable' && ResourceType === 'AWS::EC2::RouteTable') {
-                discovered.routeTableId = PhysicalResourceId;
-                discovered.privateRouteTableId = PhysicalResourceId;
-                console.log(`  ✓ Found route table in stack: ${PhysicalResourceId}`);
-            }
-
-            // NAT Route (proves NAT configuration exists) - support both naming patterns
-            if ((LogicalResourceId === 'FriggNATRoute' || LogicalResourceId === 'FriggPrivateRoute') && 
-                ResourceType === 'AWS::EC2::Route') {
-                discovered.natRoute = PhysicalResourceId;
-                console.log(`  ✓ Found NAT route in stack: ${LogicalResourceId}`);
-            }
-
-            // Route Table Associations (links subnets to route table)
-            if (LogicalResourceId.includes('RouteAssociation') && 
-                ResourceType === 'AWS::EC2::SubnetRouteTableAssociation') {
-                if (!discovered.routeTableAssociations) {
-                    discovered.routeTableAssociations = [];
-                }
-                discovered.routeTableAssociations.push(PhysicalResourceId);
-                console.log(`  ✓ Found route table association: ${LogicalResourceId}`);
-            }
-
             // VPC - direct extraction (primary method)
             if (LogicalResourceId === 'FriggVPC' && ResourceType === 'AWS::EC2::VPC') {
                 discovered.defaultVpcId = PhysicalResourceId;
@@ -390,64 +276,26 @@ class CloudFormationDiscovery {
             // VPC Endpoint Security Group
             if (LogicalResourceId === 'FriggVPCEndpointSecurityGroup' && ResourceType === 'AWS::EC2::SecurityGroup') {
                 discovered.vpcEndpointSecurityGroupId = PhysicalResourceId;
-                console.log(`  ✓ Found VPC endpoint security group in stack: ${PhysicalResourceId}`);
-            }
-            
-            // Lambda Security Group (if created in stack)
-            if (LogicalResourceId === 'FriggLambdaSecurityGroup' && ResourceType === 'AWS::EC2::SecurityGroup') {
-                discovered.lambdaSecurityGroupId = PhysicalResourceId;
-                // Also set as defaultSecurityGroupId so converter recognizes it
-                discovered.defaultSecurityGroupId = PhysicalResourceId;
-                console.log(`  ✓ Found Lambda security group in stack: ${PhysicalResourceId}`);
-            }
-
-            // VPC Endpoints - support both old and new naming conventions
-            // Initialize vpcEndpoints object for structured access
-            if (!discovered.vpcEndpoints) {
-                discovered.vpcEndpoints = {};
             }
 
-            // S3 Endpoint (both naming patterns)
-            if ((LogicalResourceId === 'FriggS3VPCEndpoint' || LogicalResourceId === 'VPCEndpointS3') && 
-                ResourceType === 'AWS::EC2::VPCEndpoint') {
+            // VPC Endpoints
+            if (LogicalResourceId === 'FriggS3VPCEndpoint' && ResourceType === 'AWS::EC2::VPCEndpoint') {
                 discovered.s3VpcEndpointId = PhysicalResourceId;
-                discovered.vpcEndpoints.s3 = PhysicalResourceId;
-                console.log(`  ✓ Found S3 VPC endpoint in stack: ${PhysicalResourceId}`);
             }
-            
-            // DynamoDB Endpoint (both naming patterns)
-            if ((LogicalResourceId === 'FriggDynamoDBVPCEndpoint' || LogicalResourceId === 'VPCEndpointDynamoDB') && 
-                ResourceType === 'AWS::EC2::VPCEndpoint') {
-                discovered.dynamodbVpcEndpointId = PhysicalResourceId; // Note: all lowercase for consistency
-                discovered.vpcEndpoints.dynamodb = PhysicalResourceId;
-                console.log(`  ✓ Found DynamoDB VPC endpoint in stack: ${PhysicalResourceId}`);
+            if (LogicalResourceId === 'FriggDynamoDBVPCEndpoint' && ResourceType === 'AWS::EC2::VPCEndpoint') {
+                discovered.dynamoDbVpcEndpointId = PhysicalResourceId;
             }
-            
-            // KMS Endpoint (both naming patterns)
-            if ((LogicalResourceId === 'FriggKMSVPCEndpoint' || LogicalResourceId === 'VPCEndpointKMS') && 
-                ResourceType === 'AWS::EC2::VPCEndpoint') {
+            if (LogicalResourceId === 'FriggKMSVPCEndpoint' && ResourceType === 'AWS::EC2::VPCEndpoint') {
                 discovered.kmsVpcEndpointId = PhysicalResourceId;
-                discovered.vpcEndpoints.kms = PhysicalResourceId;
-                console.log(`  ✓ Found KMS VPC endpoint in stack: ${PhysicalResourceId}`);
             }
-            
-            // Secrets Manager Endpoint
             if (LogicalResourceId === 'FriggSecretsManagerVPCEndpoint' && ResourceType === 'AWS::EC2::VPCEndpoint') {
                 discovered.secretsManagerVpcEndpointId = PhysicalResourceId;
-                discovered.vpcEndpoints.secretsManager = PhysicalResourceId;
             }
-            
-            // SQS Endpoint
             if (LogicalResourceId === 'FriggSQSVPCEndpoint' && ResourceType === 'AWS::EC2::VPCEndpoint') {
                 discovered.sqsVpcEndpointId = PhysicalResourceId;
-                discovered.vpcEndpoints.sqs = PhysicalResourceId;
             }
         }
 
-        // Extract VPC ID and other external references from routing resource properties
-        // This handles the pattern where VPC is external but routing is in the stack
-        await this._extractExternalReferencesFromStackResources(resources, discovered);
-
         // If we have a VPC ID but no subnet IDs, query EC2 for Frigg-managed subnets
         if (discovered.defaultVpcId && this.provider &&
             !discovered.privateSubnetId1 && !discovered.publicSubnetId1) {

package/infrastructure/domains/shared/cloudformation-discovery.test.js

@@ -586,223 +586,5 @@ describe('CloudFormationDiscovery', () => {
             expect(mockProvider.describeKmsKey).toHaveBeenCalledWith('alias/test-service-dev-frigg-kms');
         });
     });
-
-    describe('External VPC with routing infrastructure pattern', () => {
-        it('should discover routing resources when VPC is external', async () => {
-            // This tests the Frontify pattern: external VPC/subnets/KMS,
-            // but stack creates routing infrastructure (route table, NAT route, VPC endpoints)
-            const mockStack = {
-                StackName: 'create-frigg-app-production',
-                Outputs: [],
-            };
-
-            const mockResources = [
-                {
-                    LogicalResourceId: 'FriggLambdaRouteTable',
-                    PhysicalResourceId: 'rtb-0b83aca77ccde20a6',
-                    ResourceType: 'AWS::EC2::RouteTable',
-                    ResourceStatus: 'UPDATE_COMPLETE',
-                },
-                {
-                    LogicalResourceId: 'FriggNATRoute',
-                    PhysicalResourceId: 'rtb-0b83aca77ccde20a6|0.0.0.0/0',
-                    ResourceType: 'AWS::EC2::Route',
-                    ResourceStatus: 'UPDATE_COMPLETE',
-                },
-                {
-                    LogicalResourceId: 'FriggSubnet1RouteAssociation',
-                    PhysicalResourceId: 'rtbassoc-07245da0b447ca469',
-                    ResourceType: 'AWS::EC2::SubnetRouteTableAssociation',
-                    ResourceStatus: 'CREATE_COMPLETE',
-                },
-                {
-                    LogicalResourceId: 'FriggSubnet2RouteAssociation',
-                    PhysicalResourceId: 'rtbassoc-0806f9783c4ea181f',
-                    ResourceType: 'AWS::EC2::SubnetRouteTableAssociation',
-                    ResourceStatus: 'CREATE_COMPLETE',
-                },
-                {
-                    LogicalResourceId: 'VPCEndpointS3',
-                    PhysicalResourceId: 'vpce-0352ceac2124c14be',
-                    ResourceType: 'AWS::EC2::VPCEndpoint',
-                    ResourceStatus: 'CREATE_COMPLETE',
-                },
-                {
-                    LogicalResourceId: 'VPCEndpointDynamoDB',
-                    PhysicalResourceId: 'vpce-0b06c4f631199ea68',
-                    ResourceType: 'AWS::EC2::VPCEndpoint',
-                    ResourceStatus: 'CREATE_COMPLETE',
-                },
-            ];
-
-            mockProvider.describeStack.mockResolvedValue(mockStack);
-            mockProvider.listStackResources.mockResolvedValue(mockResources);
-
-            const result = await cfDiscovery.discoverFromStack('create-frigg-app-production');
-
-            // Verify routing infrastructure was discovered
-            expect(result.routeTableId).toBe('rtb-0b83aca77ccde20a6');
-            expect(result.privateRouteTableId).toBe('rtb-0b83aca77ccde20a6');
-            expect(result.natRoute).toBe('rtb-0b83aca77ccde20a6|0.0.0.0/0');
-            expect(result.routeTableAssociations).toEqual([
-                'rtbassoc-07245da0b447ca469',
-                'rtbassoc-0806f9783c4ea181f',
-            ]);
-
-            // Verify VPC endpoints were discovered (both naming conventions)
-            expect(result.vpcEndpoints).toBeDefined();
-            expect(result.vpcEndpoints.s3).toBe('vpce-0352ceac2124c14be');
-            expect(result.vpcEndpoints.dynamodb).toBe('vpce-0b06c4f631199ea68');
-            expect(result.s3VpcEndpointId).toBe('vpce-0352ceac2124c14be');
-            expect(result.dynamoDbVpcEndpointId).toBe('vpce-0b06c4f631199ea68');
-
-            // Verify NO VPC/KMS resources (they're external)
-            expect(result.defaultVpcId).toBeUndefined();
-            expect(result.defaultKmsKeyId).toBeUndefined();
-        });
-
-        it('should work with legacy VPC endpoint naming (FriggS3VPCEndpoint)', async () => {
-            const mockStack = {
-                StackName: 'test-stack',
-                Outputs: [],
-            };
-
-            const mockResources = [
-                {
-                    LogicalResourceId: 'FriggS3VPCEndpoint',
-                    PhysicalResourceId: 'vpce-legacy-s3',
-                    ResourceType: 'AWS::EC2::VPCEndpoint',
-                    ResourceStatus: 'CREATE_COMPLETE',
-                },
-                {
-                    LogicalResourceId: 'FriggDynamoDBVPCEndpoint',
-                    PhysicalResourceId: 'vpce-legacy-ddb',
-                    ResourceType: 'AWS::EC2::VPCEndpoint',
-                    ResourceStatus: 'CREATE_COMPLETE',
-                },
-            ];
-
-            mockProvider.describeStack.mockResolvedValue(mockStack);
-            mockProvider.listStackResources.mockResolvedValue(mockResources);
-
-            const result = await cfDiscovery.discoverFromStack('test-stack');
-
-            // Both naming conventions should work
-            expect(result.vpcEndpoints.s3).toBe('vpce-legacy-s3');
-            expect(result.vpcEndpoints.dynamodb).toBe('vpce-legacy-ddb');
-            expect(result.s3VpcEndpointId).toBe('vpce-legacy-s3');
-            expect(result.dynamoDbVpcEndpointId).toBe('vpce-legacy-ddb');
-        });
-
-        it('should extract FriggLambdaSecurityGroup from stack', async () => {
-            const mockStack = {
-                StackName: 'test-stack',
-                Outputs: [],
-            };
-
-            const mockResources = [
-                {
-                    LogicalResourceId: 'FriggLambdaSecurityGroup',
-                    PhysicalResourceId: 'sg-01002240c6a446202',
-                    ResourceType: 'AWS::EC2::SecurityGroup',
-                    ResourceStatus: 'UPDATE_COMPLETE',
-                },
-                {
-                    LogicalResourceId: 'FriggLambdaRouteTable',
-                    PhysicalResourceId: 'rtb-08af43bbf0775602d',
-                    ResourceType: 'AWS::EC2::RouteTable',
-                    ResourceStatus: 'UPDATE_COMPLETE',
-                },
-            ];
-
-            mockProvider.describeStack.mockResolvedValue(mockStack);
-            mockProvider.listStackResources.mockResolvedValue(mockResources);
-
-            const result = await cfDiscovery.discoverFromStack('test-stack');
-
-            // Lambda security group should be extracted
-            expect(result.lambdaSecurityGroupId).toBe('sg-01002240c6a446202');
-            expect(result.defaultSecurityGroupId).toBe('sg-01002240c6a446202');
-            expect(result.existingLogicalIds).toContain('FriggLambdaSecurityGroup');
-        });
-
-        it('should support FriggPrivateRoute naming for NAT routes', async () => {
-            const mockStack = {
-                StackName: 'test-stack',
-                Outputs: [],
-            };
-
-            const mockResources = [
-                {
-                    LogicalResourceId: 'FriggLambdaRouteTable',
-                    PhysicalResourceId: 'rtb-123',
-                    ResourceType: 'AWS::EC2::RouteTable',
-                    ResourceStatus: 'UPDATE_COMPLETE',
-                },
-                {
-                    LogicalResourceId: 'FriggPrivateRoute',
-                    PhysicalResourceId: 'rtb-123|0.0.0.0/0',
-                    ResourceType: 'AWS::EC2::Route',
-                    ResourceStatus: 'UPDATE_COMPLETE',
-                },
-            ];
-
-            mockProvider.describeStack.mockResolvedValue(mockStack);
-            mockProvider.listStackResources.mockResolvedValue(mockResources);
-
-            const result = await cfDiscovery.discoverFromStack('test-stack');
-
-            // Both FriggNATRoute and FriggPrivateRoute should be recognized
-            expect(result.natRoute).toBe('rtb-123|0.0.0.0/0');
-            expect(result.routeTableId).toBe('rtb-123');
-        });
-
-        it('should extract external references from route table without stackName error', async () => {
-            const mockStack = {
-                StackName: 'test-stack',
-                Outputs: [],
-            };
-
-            const mockResources = [
-                {
-                    LogicalResourceId: 'FriggLambdaRouteTable',
-                    PhysicalResourceId: 'rtb-real-id',
-                    ResourceType: 'AWS::EC2::RouteTable',
-                    ResourceStatus: 'UPDATE_COMPLETE',
-                },
-            ];
-
-            mockProvider.describeStack.mockResolvedValue(mockStack);
-            mockProvider.listStackResources.mockResolvedValue(mockResources);
-            
-            // Mock EC2 DescribeRouteTables to return route table with VPC info
-            mockProvider.getEC2Client = jest.fn().mockReturnValue({
-                send: jest.fn().mockResolvedValue({
-                    RouteTables: [{
-                        RouteTableId: 'rtb-real-id',
-                        VpcId: 'vpc-extracted',
-                        Routes: [
-                            { NatGatewayId: 'nat-extracted', DestinationCidrBlock: '0.0.0.0/0' }
-                        ],
-                        Associations: [
-                            { SubnetId: 'subnet-1' },
-                            { SubnetId: 'subnet-2' }
-                        ]
-                    }]
-                })
-            });
-
-            const result = await cfDiscovery.discoverFromStack('test-stack');
-
-            // Should extract VPC, NAT, and subnets from route table
-            expect(result.defaultVpcId).toBe('vpc-extracted');
-            expect(result.existingNatGatewayId).toBe('nat-extracted');
-            expect(result.privateSubnetId1).toBe('subnet-1');
-            expect(result.privateSubnetId2).toBe('subnet-2');
-            
-            // Should NOT throw 'stackName is not defined' error
-            expect(result).toBeDefined();
-        });
-    });
 });
 

package/infrastructure/domains/shared/providers/aws-provider-adapter.js

@@ -536,29 +536,6 @@ class AWSProviderAdapter extends CloudProviderAdapter {
             return [];
         }
     }
-
-    /**
-     * Describe a specific stack resource to get its full details including properties
-     * @param {string} stackName - Stack name
-     * @param {string} logicalResourceId - Logical resource ID
-     * @returns {Promise<Object>} Resource details
-     */
-    async describeStackResource(stackName, logicalResourceId) {
-        const cf = this.getCloudFormationClient();
-        
-        try {
-            const { DescribeStackResourceCommand } = require('@aws-sdk/client-cloudformation');
-            const response = await cf.send(new DescribeStackResourceCommand({
-                StackName: stackName,
-                LogicalResourceId: logicalResourceId,
-            }));
-            
-            return response.StackResourceDetail || null;
-        } catch (error) {
-            console.warn(`Failed to describe stack resource ${logicalResourceId}:`, error.message);
-            return null;
-        }
-    }
 }
 
 module.exports = {

package/infrastructure/domains/shared/resource-discovery.js

@@ -95,23 +95,11 @@ async function gatherDiscoveredResources(appDefinition) {
         const cfDiscovery = new CloudFormationDiscovery(provider, { serviceName, stage });
         const stackResources = await cfDiscovery.discoverFromStack(stackName);
 
-        // Validate CF discovery results - check for ANY useful infrastructure
-        const hasVpcData = stackResources?.defaultVpcId;  // VPC resource in stack
-        const hasKmsData = stackResources?.defaultKmsKeyId;  // KMS resource in stack
-        const hasAuroraData = stackResources?.auroraClusterId;  // Aurora in stack
-        
-        // Check for routing infrastructure (proves VPC config exists even with external VPC)
-        const hasRoutingInfra = stackResources?.routeTableId ||  // FriggLambdaRouteTable
-                               stackResources?.natRoute ||        // FriggNATRoute
-                               stackResources?.vpcEndpoints?.s3 || // VPC endpoints
-                               stackResources?.vpcEndpoints?.dynamodb;
-        
-        // Stack is useful if it has EITHER actual resources OR routing infrastructure
-        const hasSomeUsefulData = hasVpcData || hasKmsData || hasAuroraData || hasRoutingInfra;
-        
-        if (hasRoutingInfra && !hasVpcData) {
-            console.log('  ✓ Found VPC routing infrastructure in stack (external VPC pattern)');
-        }
+        // Validate CF discovery results - only use if contains useful data
+        const hasVpcData = stackResources?.defaultVpcId;
+        const hasKmsData = stackResources?.defaultKmsKeyId;
+        const hasAuroraData = stackResources?.auroraClusterId;
+        const hasSomeUsefulData = hasVpcData || hasKmsData || hasAuroraData;
 
         // Check if we're in isolated mode (each stage gets its own VPC/Aurora)
         const isIsolatedMode = appDefinition.managementMode === 'managed' &&

package/infrastructure/domains/shared/resource-discovery.test.js

@@ -415,42 +415,6 @@ describe('Resource Discovery', () => {
             delete process.env.SLS_STAGE;
         });
 
-        it('should recognize routing infrastructure as useful data', async () => {
-            const appDefinition = {
-                name: 'test-app',
-                vpc: { enable: true },
-            };
-
-            process.env.SLS_STAGE = 'production';
-
-            // Mock CloudFormation discovery to return routing infrastructure but no VPC resource
-            const mockCloudFormationDiscovery = {
-                discoverFromStack: jest.fn().mockResolvedValue({
-                    fromCloudFormationStack: true,
-                    routeTableId: 'rtb-123',
-                    natRoute: 'rtb-123|0.0.0.0/0',
-                    vpcEndpoints: {
-                        s3: 'vpce-s3',
-                        dynamodb: 'vpce-ddb'
-                    },
-                    existingLogicalIds: ['FriggLambdaRouteTable', 'FriggNATRoute']
-                    // NO defaultVpcId, NO defaultKmsKeyId, NO auroraClusterId
-                })
-            };
-
-            const { CloudFormationDiscovery } = require('./cloudformation-discovery');
-            CloudFormationDiscovery.mockImplementation(() => mockCloudFormationDiscovery);
-
-            const result = await gatherDiscoveredResources(appDefinition);
-
-            // Should use CloudFormation data without falling back to AWS API
-            expect(result.routeTableId).toBe('rtb-123');
-            expect(result.vpcEndpoints.s3).toBe('vpce-s3');
-            
-            // Should NOT call AWS API discovery
-            expect(mockVpcDiscovery.discover).not.toHaveBeenCalled();
-        });
-
         it('should include secrets in SSM discovery by default', async () => {
             const appDefinition = {
                 ssm: { enable: true },

package/infrastructure/scripts/build-prisma-layer.js

@@ -10,8 +10,8 @@
  * The CLI is only needed for migrations and is packaged separately with the dbMigrate function.
  *
  * The layer is configured based on AppDefinition database settings:
- * - PostgreSQL: Includes PostgreSQL client + query engine only
- * - MongoDB: Includes MongoDB client + query engine only (if needed)
+ * - PostgreSQL: Includes PostgreSQL client + query engine + migrations
+ * - MongoDB: Includes MongoDB client + query engine + migrations (if needed)
  * - Defaults to PostgreSQL only if not specified
  *
  * Usage:
@@ -22,7 +22,11 @@
  *   layers/prisma/nodejs/node_modules/
  *   ├── @prisma/client (runtime only, ~10-15MB)
  *   ├── generated/prisma-postgresql (if PostgreSQL enabled)
+ *   │   ├── schema.prisma
+ *   │   └── migrations/
  *   └── generated/prisma-mongodb (if MongoDB enabled)
+ *       ├── schema.prisma
+ *       └── migrations/
  *
  * See: LAMBDA-LAYER-PRISMA.md for complete documentation
  */
@@ -85,6 +89,27 @@ function getGeneratedClientPackages(databaseConfig = {}) {
     return packages;
 }
 
+function getMigrationsPackages(clientPackages) {
+    return clientPackages.map(pkg => ({
+        dbType: pkg.replace('generated/prisma-', ''),
+        clientPackage: pkg
+    }));
+}
+
+function getMigrationSourcePath(searchPaths, dbType) {
+    for (const searchPath of searchPaths) {
+        const candidatePath = path.join(searchPath, `prisma-${dbType}`, 'migrations');
+        if (fs.existsSync(candidatePath)) {
+            return candidatePath;
+        }
+    }
+    return null;
+}
+
+function getMigrationDestinationPath(layerNodeModules, clientPackage) {
+    return path.join(layerNodeModules, clientPackage, 'migrations');
+}
+
 // Configuration
 // Script runs from integration project root (e.g., backend/)
 // and reads Prisma packages from @friggframework/core
@@ -299,11 +324,47 @@ async function copyPrismaPackages(clientPackages) {
     logSuccess(`Copied ${copiedCount} generated client packages from @friggframework/core`);
 }
 
+async function copyMigrations(clientPackages) {
+    logStep(5, 'Copying migrations from @friggframework/core');
+
+    const workspaceNodeModules = path.join(path.dirname(CORE_PACKAGE_PATH), '..');
+    const searchPaths = [
+        path.join(CORE_PACKAGE_PATH, 'node_modules'),
+        path.join(PROJECT_ROOT, 'node_modules'),
+        workspaceNodeModules,
+        CORE_PACKAGE_PATH,
+    ];
+
+    const migrations = getMigrationsPackages(clientPackages);
+    let copiedCount = 0;
+
+    for (const { dbType, clientPackage } of migrations) {
+        const sourcePath = getMigrationSourcePath(searchPaths, dbType);
+
+        if (sourcePath) {
+            const destPath = getMigrationDestinationPath(LAYER_NODE_MODULES, clientPackage);
+            await fs.copy(sourcePath, destPath, { dereference: true });
+            
+            const fromLocation = sourcePath.includes('@friggframework/core/prisma')
+                ? 'core package'
+                : 'workspace';
+            logSuccess(`Copied migrations for ${dbType} (from ${fromLocation})`);
+            copiedCount++;
+        } else {
+            logWarning(`Migrations not found for ${dbType} - this may cause migration failures`);
+        }
+    }
+
+    if (copiedCount > 0) {
+        logSuccess(`Copied migrations for ${copiedCount} database ${copiedCount === 1 ? 'type' : 'types'}`);
+    }
+}
+
 /**
  * Remove unnecessary files to reduce layer size
  */
 async function removeUnnecessaryFiles() {
-    logStep(5, 'Removing unnecessary files (source maps, docs, tests)');
+    logStep(6, 'Removing unnecessary files (source maps, docs, tests)');
 
     let removedCount = 0;
     let totalSize = 0;
@@ -341,7 +402,7 @@ async function removeUnnecessaryFiles() {
  * Remove non-rhel engine binaries to reduce layer size
  */
 async function removeNonRhelBinaries() {
-    logStep(6, 'Removing non-rhel engine binaries');
+    logStep(7, 'Removing non-rhel engine binaries');
 
     let removedCount = 0;
     let totalSize = 0;
@@ -380,7 +441,7 @@ async function removeNonRhelBinaries() {
  * @param {Array} expectedClients - List of client packages that should have binaries
  */
 async function verifyRhelBinaries(expectedClients) {
-    logStep(7, 'Verifying rhel-openssl-3.0.x binaries are present');
+    logStep(8, 'Verifying rhel-openssl-3.0.x binaries are present');
 
     try {
         const findCmd = `find "${LAYER_NODE_MODULES}" -name "*rhel-openssl-3.0.x*" 2>/dev/null || true`;
@@ -414,7 +475,7 @@ async function verifyRhelBinaries(expectedClients) {
  * @param {Array} clientPackages - Generated client packages that were included
  */
 async function verifyLayerStructure(clientPackages) {
-    logStep(8, 'Verifying layer structure (runtime only)');
+    logStep(9, 'Verifying layer structure (runtime only)');
 
     const requiredPaths = [
         '@prisma/client/runtime',
@@ -426,6 +487,11 @@ async function verifyLayerStructure(clientPackages) {
         requiredPaths.push(`${pkg}/schema.prisma`);
     }
 
+    // Add migrations directory for each included client
+    for (const pkg of clientPackages) {
+        requiredPaths.push(`${pkg}/migrations/migration_lock.toml`);
+    }
+
     // Verify CLI is NOT present (keeps layer small)
     const forbiddenPaths = [
         'prisma/build',
@@ -463,7 +529,7 @@ async function verifyLayerStructure(clientPackages) {
  * Calculate and display final layer size
  */
 async function displayLayerSummary() {
-    logStep(9, 'Layer build summary');
+    logStep(10, 'Layer build summary');
 
     const layerSizeMB = getDirectorySize(LAYER_OUTPUT_PATH);
 
@@ -514,6 +580,7 @@ async function buildPrismaLayer(databaseConfig = {}) {
         await createLayerStructure();
         await installPrismaPackages();              // Install runtime client only (NO CLI)
         await copyPrismaPackages(clientPackages);   // Copy generated clients from core
+        await copyMigrations(clientPackages);       // Copy migrations from core
         await removeUnnecessaryFiles();             // Remove source maps, docs, tests (37MB+)
         await removeNonRhelBinaries();              // Remove non-Linux binaries
         await verifyRhelBinaries(clientPackages);   // Verify query engines present
@@ -550,4 +617,10 @@ if (require.main === module) {
         .catch(() => process.exit(1));
 }
 
-module.exports = { buildPrismaLayer, getGeneratedClientPackages };
+module.exports = { 
+    buildPrismaLayer, 
+    getGeneratedClientPackages,
+    getMigrationsPackages,
+    getMigrationSourcePath,
+    getMigrationDestinationPath
+};

package/infrastructure/scripts/build-prisma-layer.test.js

@@ -3,7 +3,12 @@
  * Validates database client selection logic
  */
 
-const { getGeneratedClientPackages } = require('./build-prisma-layer');
+const { 
+    getGeneratedClientPackages,
+    getMigrationsPackages,
+    getMigrationSourcePath,
+    getMigrationDestinationPath
+} = require('./build-prisma-layer');
 
 // Mock the log function
 jest.mock('./build-prisma-layer', () => {
@@ -11,6 +16,9 @@ jest.mock('./build-prisma-layer', () => {
     return {
         ...actual,
         getGeneratedClientPackages: actual.getGeneratedClientPackages,
+        getMigrationsPackages: actual.getMigrationsPackages,
+        getMigrationSourcePath: actual.getMigrationSourcePath,
+        getMigrationDestinationPath: actual.getMigrationDestinationPath,
     };
 });
 
@@ -99,4 +107,48 @@ describe('getGeneratedClientPackages()', () => {
     });
 });
 
+describe('getMigrationsPackages()', () => {
+    it('should extract database types from client packages', () => {
+        const clientPackages = ['generated/prisma-postgresql', 'generated/prisma-mongodb'];
+        const migrations = getMigrationsPackages(clientPackages);
 
+        expect(migrations).toEqual([
+            { dbType: 'postgresql', clientPackage: 'generated/prisma-postgresql' },
+            { dbType: 'mongodb', clientPackage: 'generated/prisma-mongodb' }
+        ]);
+    });
+
+    it('should handle single client package', () => {
+        const clientPackages = ['generated/prisma-postgresql'];
+        const migrations = getMigrationsPackages(clientPackages);
+
+        expect(migrations).toEqual([
+            { dbType: 'postgresql', clientPackage: 'generated/prisma-postgresql' }
+        ]);
+    });
+
+    it('should handle empty array', () => {
+        const migrations = getMigrationsPackages([]);
+        expect(migrations).toEqual([]);
+    });
+});
+
+describe('getMigrationSourcePath()', () => {
+    it('should return correct source path for database type', () => {
+        const searchPaths = ['/workspace/packages/core'];
+        const dbType = 'postgresql';
+        
+        const sourcePath = getMigrationSourcePath(searchPaths, dbType);
+        expect(sourcePath).toBe('/workspace/packages/core/prisma-postgresql/migrations');
+    });
+});
+
+describe('getMigrationDestinationPath()', () => {
+    it('should return correct destination path for client package', () => {
+        const layerNodeModules = '/layers/prisma/nodejs/node_modules';
+        const clientPackage = 'generated/prisma-postgresql';
+        
+        const destPath = getMigrationDestinationPath(layerNodeModules, clientPackage);
+        expect(destPath).toBe('/layers/prisma/nodejs/node_modules/generated/prisma-postgresql/migrations');
+    });
+});

package/infrastructure/scripts/verify-prisma-layer.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+
+const fs = require('fs-extra');
+const path = require('path');
+
+const PROJECT_ROOT = process.cwd();
+const LAYER_PATH = path.join(PROJECT_ROOT, 'layers/prisma/nodejs/node_modules');
+
+async function verifyLayerStructure() {
+    console.log('Verifying Prisma layer structure...\n');
+
+    const checks = [
+        {
+            name: 'PostgreSQL schema',
+            path: 'generated/prisma-postgresql/schema.prisma'
+        },
+        {
+            name: 'PostgreSQL migrations directory',
+            path: 'generated/prisma-postgresql/migrations'
+        },
+        {
+            name: 'PostgreSQL migration_lock.toml',
+            path: 'generated/prisma-postgresql/migrations/migration_lock.toml'
+        },
+        {
+            name: '@prisma/client runtime',
+            path: '@prisma/client/runtime'
+        }
+    ];
+
+    let allPassed = true;
+
+    for (const check of checks) {
+        const fullPath = path.join(LAYER_PATH, check.path);
+        const exists = await fs.pathExists(fullPath);
+        
+        if (exists) {
+            console.log(`✓ ${check.name}`);
+        } else {
+            console.log(`✗ ${check.name} (missing)`);
+            allPassed = false;
+        }
+    }
+
+    console.log('\n');
+
+    if (allPassed) {
+        console.log('✓ All checks passed!');
+        const migrationsPath = path.join(LAYER_PATH, 'generated/prisma-postgresql/migrations');
+        const migrationFiles = await fs.readdir(migrationsPath);
+        console.log(`\nFound ${migrationFiles.length} items in migrations directory:`);
+        migrationFiles.forEach(file => {
+            console.log(`  - ${file}`);
+        });
+        return 0;
+    } else {
+        console.log('✗ Some checks failed!');
+        return 1;
+    }
+}
+
+if (require.main === module) {
+    verifyLayerStructure()
+        .then(code => process.exit(code))
+        .catch(err => {
+            console.error('Error:', err.message);
+            process.exit(1);
+        });
+}
+
+module.exports = { verifyLayerStructure };
+

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.490.10eff0a.0",
+  "version": "2.0.0--canary.493.f8d621f.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -16,9 +16,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.490.10eff0a.0",
-    "@friggframework/schemas": "2.0.0--canary.490.10eff0a.0",
-    "@friggframework/test": "2.0.0--canary.490.10eff0a.0",
+    "@friggframework/core": "2.0.0--canary.493.f8d621f.0",
+    "@friggframework/schemas": "2.0.0--canary.493.f8d621f.0",
+    "@friggframework/test": "2.0.0--canary.493.f8d621f.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -46,8 +46,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.490.10eff0a.0",
-    "@friggframework/prettier-config": "2.0.0--canary.490.10eff0a.0",
+    "@friggframework/eslint-config": "2.0.0--canary.493.f8d621f.0",
+    "@friggframework/prettier-config": "2.0.0--canary.493.f8d621f.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -79,5 +79,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "10eff0ae7ff87794900048cb0cc357714232e4cf"
+  "gitHead": "f8d621f5fdc06756c1351e99a4686767a46f7064"
 }