@friggframework/devtools 2.0.0--canary.490.1b7bbcb.0 → 2.0.0--canary.490.7464242.0

package/infrastructure/domains/networking/vpc-builder.js

@@ -534,6 +534,7 @@ class VpcBuilder extends InfrastructureBuilder {
             iamStatements: [],
             outputs: {},
             environment: {},
+            discovery: discoveredResources,  // Store for backwards compatibility checks
         };
 
         // Add IAM permissions for VPC-enabled Lambda functions
@@ -552,7 +553,7 @@ class VpcBuilder extends InfrastructureBuilder {
         this.buildNatGatewayFromDecision(decisions.natGateway, appDefinition, discoveredResources, result);
 
         // Build VPC Endpoints based on ownership decisions
-        this.buildVpcEndpointsFromDecisions(decisions.vpcEndpoints, decisions.securityGroup, appDefinition, result);
+        this.buildVpcEndpointsFromDecisions(decisions.vpcEndpoints, decisions.securityGroup, appDefinition, discoveredResources, result);
 
         // Set VPC_ENABLED environment variable
         result.environment.VPC_ENABLED = 'true';
@@ -920,7 +921,7 @@ class VpcBuilder extends InfrastructureBuilder {
     /**
      * Build VPC Endpoints based on ownership decisions
      */
-    buildVpcEndpointsFromDecisions(endpointDecisions, securityGroupDecision, appDefinition, result) {
+    buildVpcEndpointsFromDecisions(endpointDecisions, securityGroupDecision, appDefinition, discoveredResources, result) {
         const decisions = endpointDecisions; // For backwards compatibility with existing code
         const endpointsToCreate = [];
         const endpointsInStack = [];
@@ -940,7 +941,7 @@ class VpcBuilder extends InfrastructureBuilder {
         if (endpointsInStack.length > 0) {
             console.log(`  ✓ VPC Endpoints in stack: ${endpointsInStack.join(', ')}`);
             // CRITICAL: Must add stack-managed endpoints back to template or CloudFormation will DELETE them!
-            this._addStackManagedEndpointsToTemplate(decisions, securityGroupDecision, result);
+            this._addStackManagedEndpointsToTemplate(decisions, securityGroupDecision, discoveredResources, result);
         }
 
         if (externalEndpoints.length > 0) {
@@ -1139,19 +1140,24 @@ class VpcBuilder extends InfrastructureBuilder {
      * 
      * @private
      */
-    _addStackManagedEndpointsToTemplate(endpointDecisions, securityGroupDecision, result) {
+    _addStackManagedEndpointsToTemplate(endpointDecisions, securityGroupDecision, discoveredResources, result) {
         const decisions = endpointDecisions; // For backwards compatibility
         const vpcId = result.vpcId;
+        
+        // Determine logical IDs based on what exists in stack for backwards compatibility
+        // CRITICAL: Frontify production uses OLD naming (VPCEndpointS3, not FriggS3VPCEndpoint)
+        const existingLogicalIds = discoveredResources?.existingLogicalIds || [];
+        
         const logicalIdMap = {
-            s3: 'FriggS3VPCEndpoint',
-            dynamodb: 'FriggDynamoDBVPCEndpoint',
-            kms: 'FriggKMSVPCEndpoint',
-            secretsManager: 'FriggSecretsManagerVPCEndpoint',
-            sqs: 'FriggSQSVPCEndpoint'
+            s3: existingLogicalIds.includes('VPCEndpointS3') ? 'VPCEndpointS3' : 'FriggS3VPCEndpoint',
+            dynamodb: existingLogicalIds.includes('VPCEndpointDynamoDB') ? 'VPCEndpointDynamoDB' : 'FriggDynamoDBVPCEndpoint',
+            kms: existingLogicalIds.includes('VPCEndpointKMS') ? 'VPCEndpointKMS' : 'FriggKMSVPCEndpoint',
+            secretsManager: existingLogicalIds.includes('VPCEndpointSecretsManager') ? 'VPCEndpointSecretsManager' : 'FriggSecretsManagerVPCEndpoint',
+            sqs: existingLogicalIds.includes('VPCEndpointSQS') ? 'VPCEndpointSQS' : 'FriggSQSVPCEndpoint'
         };
 
         Object.entries(decisions).forEach(([type, decision]) => {
-            if (decision.ownership === ResourceOwnership.STACK && decision.physicalId) {
+            if (decision.ownership === ResourceOwnership.STACK) {
                 const logicalId = logicalIdMap[type];
                 
                 // Determine endpoint type and properties based on service
@@ -1757,12 +1763,30 @@ class VpcBuilder extends InfrastructureBuilder {
     /**
      * Create route table and associations for NAT Gateway
      * Always adds to template - CloudFormation handles idempotency
+     * Uses existing logical IDs from stack to prevent AlreadyExists errors
      */
     createNatGatewayRouting(appDefinition, discoveredResources, result, natGatewayId) {
         // Note: We always add routing resources to the template.
         // CloudFormation's idempotency ensures existing resources are updated, not recreated.
         // Removing resources from the template causes CloudFormation to try CREATE on next deploy → AlreadyExists error
 
+        // Determine which logical ID to use for the NAT route based on what exists in stack
+        // Older stacks use 'FriggNATRoute', newer ones use 'FriggPrivateRoute'
+        // CRITICAL: Must check existingLogicalIds to avoid AlreadyExists errors on logical ID mismatch
+        const existingLogicalIds = discoveredResources?.existingLogicalIds || [];
+        
+        const routeLogicalId = existingLogicalIds.includes('FriggNATRoute') 
+            ? 'FriggNATRoute'  // Use existing logical ID from stack (backwards compatibility)
+            : 'FriggPrivateRoute';  // Default for new stacks
+
+        // Determine logical IDs for subnet associations (similar backwards compatibility)
+        const subnet1AssocLogicalId = existingLogicalIds.includes('FriggSubnet1RouteAssociation')
+            ? 'FriggSubnet1RouteAssociation'  // Use existing (backwards compatibility)
+            : 'FriggPrivateSubnet1RouteTableAssociation';  // Default for new stacks
+        const subnet2AssocLogicalId = existingLogicalIds.includes('FriggSubnet2RouteAssociation')
+            ? 'FriggSubnet2RouteAssociation'  // Use existing (backwards compatibility)
+            : 'FriggPrivateSubnet2RouteTableAssociation';  // Default for new stacks
+
         // Private route table with NAT Gateway route
         if (!result.resources.FriggLambdaRouteTable) {
             result.resources.FriggLambdaRouteTable = {
@@ -1777,7 +1801,7 @@ class VpcBuilder extends InfrastructureBuilder {
             };
         }
 
-        result.resources.FriggPrivateRoute = {
+        result.resources[routeLogicalId] = {
             Type: 'AWS::EC2::Route',
             Properties: {
                 RouteTableId: { Ref: 'FriggLambdaRouteTable' },
@@ -1791,7 +1815,7 @@ class VpcBuilder extends InfrastructureBuilder {
         const subnet1Id = discoveredResources.privateSubnetId1 || { Ref: 'FriggPrivateSubnet1' };
         const subnet2Id = discoveredResources.privateSubnetId2 || { Ref: 'FriggPrivateSubnet2' };
 
-        result.resources.FriggPrivateSubnet1RouteTableAssociation = {
+        result.resources[subnet1AssocLogicalId] = {
             Type: 'AWS::EC2::SubnetRouteTableAssociation',
             Properties: {
                 SubnetId: subnet1Id,
@@ -1799,7 +1823,7 @@ class VpcBuilder extends InfrastructureBuilder {
             },
         };
 
-        result.resources.FriggPrivateSubnet2RouteTableAssociation = {
+        result.resources[subnet2AssocLogicalId] = {
             Type: 'AWS::EC2::SubnetRouteTableAssociation',
             Properties: {
                 SubnetId: subnet2Id,
@@ -1816,7 +1840,9 @@ class VpcBuilder extends InfrastructureBuilder {
      */
     ensureSubnetAssociations(appDefinition, discoveredResources, result) {
         // Skip if associations already created (by NAT Gateway routing)
-        if (result.resources.FriggPrivateSubnet1RouteTableAssociation) {
+        // Check for both old and new logical ID patterns
+        if (result.resources.FriggPrivateSubnet1RouteTableAssociation ||
+            result.resources.FriggSubnet1RouteAssociation) {
             return; // Already handled by NAT Gateway routing
         }
 

package/infrastructure/domains/networking/vpc-builder.test.js

@@ -1349,27 +1349,31 @@ describe('VpcBuilder', () => {
     });
 
     describe('External VPC with stack-managed routing infrastructure pattern', () => {
-        it('should correctly handle external VPC with stack-managed routing infrastructure', async () => {
+        it('should correctly handle external VPC with NEW logical IDs (FriggPrivateRoute pattern)', async () => {
             // This pattern occurs when VPC/subnets/NAT are external but routing (route tables,
             // VPC endpoints, security groups) are managed by CloudFormation stack
+            // This tests the NEWER naming convention
             const appDefinition = {
                 vpc: { enable: true },
                 encryption: { fieldLevelEncryptionMethod: 'kms' },
+                database: {
+                    dynamodb: { enable: true }  // Enable DynamoDB to create DynamoDB VPC endpoint
+                }
             };
             
-            // Discovery results from real-world production scenario
+            // Discovery results from real-world production scenario (newer stack)
             const discoveredResources = {
                 fromCloudFormationStack: true,
                 stackName: 'test-production-stack',
                 existingLogicalIds: [
                     'FriggLambdaSecurityGroup',
                     'FriggLambdaRouteTable',
-                    'FriggPrivateRoute',
-                    'FriggPrivateSubnet1RouteTableAssociation',
-                    'FriggPrivateSubnet2RouteTableAssociation',
-                    'FriggS3VPCEndpoint',
-                    'FriggDynamoDBVPCEndpoint',
-                    'FriggKMSVPCEndpoint'
+                    'FriggPrivateRoute',  // NEW naming
+                    'FriggPrivateSubnet1RouteTableAssociation',  // NEW naming
+                    'FriggPrivateSubnet2RouteTableAssociation',  // NEW naming
+                    'FriggS3VPCEndpoint',  // NEW naming
+                    'FriggDynamoDBVPCEndpoint',  // NEW naming
+                    'FriggKMSVPCEndpoint'  // NEW naming
                 ],
                 // Stack resources (from CloudFormation)
                 lambdaSecurityGroupId: 'sg-01002240c6a446202',
@@ -1446,6 +1450,91 @@ describe('VpcBuilder', () => {
             expect(friggResources).not.toContain('FriggPrivateSubnet1');
             expect(friggResources).not.toContain('FriggNATGateway');
         });
+
+        it('should use OLD logical IDs for backwards compatibility (FriggNATRoute, VPCEndpointS3 pattern)', async () => {
+            // CRITICAL TEST: Real Frontify production stack uses OLD naming convention
+            // Stack currently has: FriggNATRoute, VPCEndpointS3, VPCEndpointDynamoDB
+            // We MUST use these same logical IDs to avoid AlreadyExists errors
+            const appDefinition = {
+                vpc: { 
+                    enable: true,
+                    ownership: {
+                        securityGroup: 'external'
+                    },
+                    external: {
+                        securityGroupIds: ['sg-0c5e0d0e4a2f5efcf']
+                    }
+                },
+                encryption: { fieldLevelEncryptionMethod: 'kms' },
+                database: {
+                    dynamodb: { enable: true }
+                }
+            };
+            
+            // Discovery results matching ACTUAL Frontify production stack
+            const discoveredResources = {
+                fromCloudFormationStack: true,
+                stackName: 'create-frigg-app-production',
+                existingLogicalIds: [
+                    'FriggLambdaRouteTable',
+                    'FriggNATRoute',  // OLD naming
+                    'FriggSubnet1RouteAssociation',  // OLD naming
+                    'FriggSubnet2RouteAssociation',  // OLD naming
+                    'VPCEndpointS3',  // OLD naming
+                    'VPCEndpointDynamoDB'  // OLD naming
+                ],
+                // Structured discovery (what resolver needs)
+                _structured: {
+                    stackManaged: [
+                        { logicalId: 'FriggLambdaRouteTable', physicalId: 'rtb-08af43bbf0775602d', resourceType: 'AWS::EC2::RouteTable' },
+                        { logicalId: 'FriggNATRoute', physicalId: 'rtb-08af43bbf0775602d|0.0.0.0/0', resourceType: 'AWS::EC2::Route' },
+                        { logicalId: 'VPCEndpointS3', physicalId: 'vpce-0352ceac2124c14be', resourceType: 'AWS::EC2::VPCEndpoint' },
+                        { logicalId: 'VPCEndpointDynamoDB', physicalId: 'vpce-0b06c4f631199ea68', resourceType: 'AWS::EC2::VPCEndpoint' }
+                    ],
+                    external: [
+                        { physicalId: 'vpc-01cd124575c683a17', resourceType: 'AWS::EC2::VPC' },
+                        { physicalId: 'sg-0c5e0d0e4a2f5efcf', resourceType: 'AWS::EC2::SecurityGroup' },
+                        { physicalId: 'subnet-0bbca02e9981df72c', resourceType: 'AWS::EC2::Subnet' },
+                        { physicalId: 'subnet-005f7092b91efaaeb', resourceType: 'AWS::EC2::Subnet' },
+                        { physicalId: 'nat-05a536cbe7056325f', resourceType: 'AWS::EC2::NatGateway' }
+                    ]
+                },
+                // Flat discovery (for backwards compatibility)
+                routeTableId: 'rtb-08af43bbf0775602d',
+                natRoute: 'rtb-08af43bbf0775602d|0.0.0.0/0',
+                s3VpcEndpointId: 'vpce-0352ceac2124c14be',
+                dynamodbVpcEndpointId: 'vpce-0b06c4f631199ea68',
+                // External resources
+                defaultVpcId: 'vpc-01cd124575c683a17',
+                defaultSecurityGroupId: 'sg-0c5e0d0e4a2f5efcf',
+                privateSubnetId1: 'subnet-0bbca02e9981df72c',
+                privateSubnetId2: 'subnet-005f7092b91efaaeb',
+                existingNatGatewayId: 'nat-05a536cbe7056325f'
+            };
+
+            const result = await vpcBuilder.build(appDefinition, discoveredResources);
+
+            // CRITICAL: Must use OLD logical IDs to match existing stack
+            expect(result.resources.FriggNATRoute).toBeDefined();
+            expect(result.resources.FriggNATRoute.Type).toBe('AWS::EC2::Route');
+            expect(result.resources.FriggPrivateRoute).toBeUndefined();  // Should NOT create new ID
+
+            expect(result.resources.FriggSubnet1RouteAssociation).toBeDefined();
+            expect(result.resources.FriggSubnet2RouteAssociation).toBeDefined();
+            expect(result.resources.FriggPrivateSubnet1RouteTableAssociation).toBeUndefined();
+            expect(result.resources.FriggPrivateSubnet2RouteTableAssociation).toBeUndefined();
+
+            expect(result.resources.VPCEndpointS3).toBeDefined();
+            expect(result.resources.VPCEndpointS3.Type).toBe('AWS::EC2::VPCEndpoint');
+            expect(result.resources.FriggS3VPCEndpoint).toBeUndefined();  // Should NOT create new ID
+
+            expect(result.resources.VPCEndpointDynamoDB).toBeDefined();
+            expect(result.resources.VPCEndpointDynamoDB.Type).toBe('AWS::EC2::VPCEndpoint');
+            expect(result.resources.FriggDynamoDBVPCEndpoint).toBeUndefined();  // Should NOT create new ID
+
+            // Route table should still be created
+            expect(result.resources.FriggLambdaRouteTable).toBeDefined();
+        });
     });
 
     describe('convertFlatDiscoveryToStructured - Direct Properties', () => {

package/infrastructure/domains/networking/vpc-resolver.js

@@ -411,9 +411,20 @@ class VpcResourceResolver extends BaseResourceResolver {
 
     /**
      * Resolve individual VPC endpoint
+     * Checks both old and new logical ID patterns for backwards compatibility
      * @private
      */
     _resolveEndpoint(logicalId, endpointType, userIntent, appDefinition, discovery) {
+        // Map of old logical IDs (for backwards compatibility with stacks created before naming standardization)
+        const oldLogicalIdMap = {
+            'FriggS3VPCEndpoint': 'VPCEndpointS3',
+            'FriggDynamoDBVPCEndpoint': 'VPCEndpointDynamoDB',
+            'FriggKMSVPCEndpoint': 'VPCEndpointKMS',
+            'FriggSecretsManagerVPCEndpoint': 'VPCEndpointSecretsManager',
+            'FriggSQSVPCEndpoint': 'VPCEndpointSQS'
+        };
+        const oldLogicalId = oldLogicalIdMap[logicalId];
+
         // Explicit external
         if (userIntent === 'external') {
             const externalId = appDefinition.vpc?.external?.vpcEndpointIds?.[endpointType];
@@ -427,22 +438,35 @@ class VpcResourceResolver extends BaseResourceResolver {
             return { ownership: null, reason: `External ${endpointType} endpoint ID not provided` };
         }
 
-        // Explicit stack
+        // Explicit stack - check both old and new logical IDs
         if (userIntent === 'stack') {
-            const inStack = this.findInStack(logicalId, discovery);
+            let inStack = this.findInStack(logicalId, discovery);
+            if (!inStack && oldLogicalId) {
+                inStack = this.findInStack(oldLogicalId, discovery);
+            }
             return this.createStackDecision(
                 inStack?.physicalId,
                 `User specified ownership=stack for ${endpointType} endpoint`
             );
         }
 
-        // Auto-decide - check if in stack first for more informative logging
-        const inStack = this.isInStack(logicalId, discovery);
-        const stackResource = inStack ? this.findInStack(logicalId, discovery) : null;
+        // Auto-decide - check if in stack first (try both old and new logical IDs)
+        let inStack = this.isInStack(logicalId, discovery);
+        let stackResource = inStack ? this.findInStack(logicalId, discovery) : null;
+        let actualLogicalId = logicalId;  // Track which ID we found
+        
+        // If not found with new ID, try old ID pattern
+        if (!inStack && oldLogicalId) {
+            inStack = this.isInStack(oldLogicalId, discovery);
+            stackResource = inStack ? this.findInStack(oldLogicalId, discovery) : null;
+            if (inStack) {
+                actualLogicalId = oldLogicalId;  // Found with old ID - use that for resolution
+            }
+        }
         
         const decision = this.resolveResourceOwnership(
             'auto',
-            logicalId,
+            actualLogicalId,  // Use the actual ID we found (old or new)
             'AWS::EC2::VPCEndpoint',
             discovery
         );

package/infrastructure/domains/shared/cloudformation-discovery.js

@@ -219,7 +219,10 @@ class CloudFormationDiscovery {
             const { LogicalResourceId, PhysicalResourceId, ResourceType } = resource;
 
             // Track Frigg-managed resources by logical ID
-            if (LogicalResourceId.startsWith('Frigg') || LogicalResourceId.includes('Migration')) {
+            // Include VPC endpoints with legacy naming (VPCEndpointS3, VPCEndpointDynamoDB, etc.)
+            if (LogicalResourceId.startsWith('Frigg') || 
+                LogicalResourceId.includes('Migration') ||
+                LogicalResourceId.startsWith('VPCEndpoint')) {
                 discovered.existingLogicalIds.push(LogicalResourceId);
             }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.490.1b7bbcb.0",
+  "version": "2.0.0--canary.490.7464242.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -16,9 +16,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.490.1b7bbcb.0",
-    "@friggframework/schemas": "2.0.0--canary.490.1b7bbcb.0",
-    "@friggframework/test": "2.0.0--canary.490.1b7bbcb.0",
+    "@friggframework/core": "2.0.0--canary.490.7464242.0",
+    "@friggframework/schemas": "2.0.0--canary.490.7464242.0",
+    "@friggframework/test": "2.0.0--canary.490.7464242.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -46,8 +46,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.490.1b7bbcb.0",
-    "@friggframework/prettier-config": "2.0.0--canary.490.1b7bbcb.0",
+    "@friggframework/eslint-config": "2.0.0--canary.490.7464242.0",
+    "@friggframework/prettier-config": "2.0.0--canary.490.7464242.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -79,5 +79,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "1b7bbcb96b98d3a5a6cb2fb0fcfa06fb5235433e"
+  "gitHead": "74642426e7abdfded0cf0f124e18864341b11b1f"
 }