@friggframework/devtools 2.0.0--canary.490.3374b8f.0 → 2.0.0--canary.490.1f4f770.0

package/infrastructure/README.md

@@ -257,6 +257,34 @@ aws lambda get-function-configuration \
   --query 'Layers[*].Arn'
 ```
 
+**Disabling Prisma Layer (Bundle with Functions):**
+
+By default, Frigg uses a Lambda Layer for Prisma. You can disable this and bundle Prisma directly with each function:
+
+```javascript
+const appDefinition = {
+    name: 'my-app',
+    usePrismaLambdaLayer: false,  // Bundle Prisma with each function
+    integrations: [{ Definition: { name: 'asana' } }],
+};
+```
+
+**When to disable the Prisma Layer:**
+
+-   ✅ CI/CD IAM user lacks `lambda:PublishLayerVersion` permission
+-   ✅ Deploying to environments with Lambda layer restrictions
+-   ✅ Prefer simpler deployment without layer management
+-   ✅ Debugging Prisma client loading issues
+
+**Trade-offs:**
+
+| Mode | Function Size | Deploy Speed | IAM Permissions Required |
+|------|--------------|--------------|-------------------------|
+| **Layer (default)** | ~45MB per function | Faster (layer cached) | `lambda:PublishLayerVersion` |
+| **Bundled** | ~80MB per function | Slower (Prisma uploaded 5x) | None (layer-related) |
+
+**Note:** When `usePrismaLambdaLayer: false`, Prisma client automatically detects the bundled location at runtime. No additional configuration needed.
+
 ## Usage Examples
 
 ### Basic Deployment

package/infrastructure/domains/database/migration-builder.js

@@ -57,6 +57,9 @@ class MigrationBuilder extends InfrastructureBuilder {
         // Backwards compatibility: Translate old schema to new ownership schema
         appDefinition = this.translateLegacyConfig(appDefinition, discoveredResources);
 
+        // Determine if using Prisma Lambda Layer
+        const usePrismaLayer = appDefinition.usePrismaLambdaLayer !== false;
+
         const result = {
             functions: {}, // Lambda function definitions
             resources: {},
@@ -76,7 +79,7 @@ class MigrationBuilder extends InfrastructureBuilder {
         console.log(`     Queue: ${decisions.queue.ownership} - ${decisions.queue.reason}`);
 
         // Build resources based on ownership decisions
-        await this.buildFromDecisions(decisions, appDefinition, discoveredResources, result);
+        await this.buildFromDecisions(decisions, appDefinition, discoveredResources, result, usePrismaLayer);
 
         console.log(`[${this.name}] ✅ Migration infrastructure configuration completed`);
         return result;
@@ -207,7 +210,7 @@ class MigrationBuilder extends InfrastructureBuilder {
     /**
      * Build migration resources based on ownership decisions
      */
-    async buildFromDecisions(decisions, appDefinition, discoveredResources, result) {
+    async buildFromDecisions(decisions, appDefinition, discoveredResources, result, usePrismaLayer = true) {
         // Determine if we need to create resources or use existing ones
         const shouldCreateBucket = decisions.bucket.ownership === ResourceOwnership.STACK;
         const shouldCreateQueue = decisions.queue.ownership === ResourceOwnership.STACK;
@@ -215,12 +218,12 @@ class MigrationBuilder extends InfrastructureBuilder {
         if (shouldCreateBucket && shouldCreateQueue && !decisions.bucket.physicalId && !decisions.queue.physicalId) {
             // Create all new migration infrastructure
             console.log('  → Creating new migration infrastructure in stack');
-            await this.createMigrationInfrastructure(appDefinition, result);
+            await this.createMigrationInfrastructure(appDefinition, result, usePrismaLayer);
         } else if ((decisions.bucket.ownership === ResourceOwnership.STACK && decisions.bucket.physicalId) ||
                    (decisions.queue.ownership === ResourceOwnership.STACK && decisions.queue.physicalId)) {
             // Resources exist in stack - add definitions (CloudFormation idempotency)
             console.log('  → Adding migration definitions to template (existing in stack)');
-            await this.createMigrationInfrastructure(appDefinition, result);
+            await this.createMigrationInfrastructure(appDefinition, result, usePrismaLayer);
         } else {
             // Use external resources
             console.log('  → Using external migration resources');
@@ -232,18 +235,21 @@ class MigrationBuilder extends InfrastructureBuilder {
      * Create Lambda function definitions for database migrations
      * Based on refactor/add-better-support-for-commands branch implementation
      */
-    async createFunctionDefinitions(result) {
+    async createFunctionDefinitions(result, usePrismaLayer = true) {
         console.log('  🔍 DEBUG: createFunctionDefinitions called');
         console.log('  🔍 DEBUG: result.functions is:', typeof result.functions, result.functions);
         // Migration WORKER package config (needs Prisma CLI WASM files)
         const migrationWorkerPackageConfig = {
             individually: true,
             exclude: [
-                // Exclude Prisma runtime client - it's in the Lambda Layer
-                'node_modules/@prisma/client/**',
-                'node_modules/.prisma/**',
-                'node_modules/@friggframework/core/generated/**',
-                // But KEEP node_modules/prisma/** (the CLI with WASM)
+                // Conditionally exclude Prisma (only if using layer)
+                ...(usePrismaLayer ? [
+                    // Exclude Prisma runtime client - it's in the Lambda Layer
+                    'node_modules/@prisma/client/**',
+                    'node_modules/.prisma/**',
+                    'node_modules/@friggframework/core/generated/**',
+                    // But KEEP node_modules/prisma/** (the CLI with WASM)
+                ] : []),
 
                 // Exclude ALL nested node_modules
                 'node_modules/**/node_modules/**',
@@ -422,7 +428,7 @@ class MigrationBuilder extends InfrastructureBuilder {
         console.log('  🔍 DEBUG: About to create dbMigrationWorker...');
         result.functions.dbMigrationWorker = {
             handler: 'node_modules/@friggframework/core/handlers/workers/db-migration.handler',
-            layers: [{ Ref: 'PrismaLambdaLayer' }], // Use layer for Prisma client runtime
+            ...(usePrismaLayer && { layers: [{ Ref: 'PrismaLambdaLayer' }] }), // Conditionally use layer
             skipEsbuild: true,
             timeout: 900, // 15 minutes for long migrations
             memorySize: 1024, // Extra memory for Prisma operations
@@ -484,12 +490,12 @@ class MigrationBuilder extends InfrastructureBuilder {
      * Create migration infrastructure CloudFormation resources
      * Creates S3 bucket, SQS queue, and Lambda function definitions
      */
-    async createMigrationInfrastructure(appDefinition, result) {
+    async createMigrationInfrastructure(appDefinition, result, usePrismaLayer = true) {
         console.log('  🔍 DEBUG: createMigrationInfrastructure called');
         console.log('  🔍 DEBUG: result object before createFunctionDefinitions:', Object.keys(result));
 
         // Create Lambda function definitions first (they reference the queue)
-        await this.createFunctionDefinitions(result);
+        await this.createFunctionDefinitions(result, usePrismaLayer);
 
         console.log('  🔍 DEBUG: result.functions after createFunctionDefinitions:', Object.keys(result.functions || {}));
 

package/infrastructure/domains/database/migration-builder.test.js

@@ -290,5 +290,62 @@ describe('MigrationBuilder', () => {
             expect(builder.getName()).toBe('MigrationBuilder');
         });
     });
+
+    describe('usePrismaLayer configuration', () => {
+        it('should include Prisma layer in migration worker when usePrismaLayer=true (default)', async () => {
+            const appDef = {
+                database: {
+                    postgres: { enable: true },
+                },
+                usePrismaLambdaLayer: true,
+            };
+
+            const result = await builder.build(appDef, {});
+
+            expect(result.functions.dbMigrationWorker.layers).toEqual([{ Ref: 'PrismaLambdaLayer' }]);
+            
+            // Prisma client should be excluded from package (but not CLI)
+            expect(result.functions.dbMigrationWorker.package.exclude).toEqual(
+                expect.arrayContaining([
+                    'node_modules/@prisma/client/**',
+                    'node_modules/.prisma/**',
+                    'node_modules/@friggframework/core/generated/**',
+                ])
+            );
+        });
+
+        it('should NOT include Prisma layer when usePrismaLayer=false', async () => {
+            const appDef = {
+                database: {
+                    postgres: { enable: true },
+                },
+                usePrismaLambdaLayer: false,
+            };
+
+            const result = await builder.build(appDef, {});
+
+            expect(result.functions.dbMigrationWorker.layers).toBeUndefined();
+        });
+
+        it('should bundle Prisma CLI with migration worker when usePrismaLayer=false', async () => {
+            const appDef = {
+                database: {
+                    postgres: { enable: true },
+                },
+                usePrismaLambdaLayer: false,
+            };
+
+            const result = await builder.build(appDef, {});
+
+            // Prisma should NOT be excluded from package (will be bundled)
+            expect(result.functions.dbMigrationWorker.package.exclude).not.toEqual(
+                expect.arrayContaining([
+                    'node_modules/@prisma/client/**',
+                    'node_modules/.prisma/**',
+                    'node_modules/@friggframework/core/generated/**',
+                ])
+            );
+        });
+    });
 });
 

package/infrastructure/domains/integration/integration-builder.js

@@ -62,6 +62,9 @@ class IntegrationBuilder extends InfrastructureBuilder {
         console.log(`\n[${this.name}] Configuring integrations...`);
         console.log(`  Processing ${appDefinition.integrations.length} integrations...`);
 
+        // Determine if using Prisma Lambda Layer
+        const usePrismaLayer = appDefinition.usePrismaLambdaLayer !== false;
+
         const result = {
             functions: {},
             resources: {},
@@ -87,7 +90,7 @@ class IntegrationBuilder extends InfrastructureBuilder {
         });
 
         // Build resources based on ownership decisions
-        await this.buildFromDecisions(decisions, appDefinition, result);
+        await this.buildFromDecisions(decisions, appDefinition, result, usePrismaLayer);
 
         console.log(`[${this.name}] ✅ Integration configuration completed`);
         return result;
@@ -142,7 +145,7 @@ class IntegrationBuilder extends InfrastructureBuilder {
     /**
      * Build integration resources based on ownership decisions
      */
-    async buildFromDecisions(decisions, appDefinition, result) {
+    async buildFromDecisions(decisions, appDefinition, result, usePrismaLayer = true) {
         // Create InternalErrorQueue if ownership = STACK
         const shouldCreateInternalErrorQueue = decisions.internalErrorQueue.ownership === ResourceOwnership.STACK;
 
@@ -155,7 +158,7 @@ class IntegrationBuilder extends InfrastructureBuilder {
         }
 
         // Create Lambda function definitions and queue resources for each integration
-        const functionPackageConfig = this.createFunctionPackageConfig();
+        const functionPackageConfig = this.createFunctionPackageConfig(usePrismaLayer);
 
         for (const integration of appDefinition.integrations) {
             const integrationName = integration.Definition.name;
@@ -164,7 +167,7 @@ class IntegrationBuilder extends InfrastructureBuilder {
             console.log(`\n    Adding integration: ${integrationName}`);
 
             // Create Lambda function definitions (serverless template code)
-            await this.createFunctionDefinitions(integration, functionPackageConfig, result);
+            await this.createFunctionDefinitions(integration, functionPackageConfig, result, usePrismaLayer);
 
             // Create or reference SQS queue based on ownership decision
             const shouldCreateQueue = queueDecision.ownership === ResourceOwnership.STACK;
@@ -182,18 +185,20 @@ class IntegrationBuilder extends InfrastructureBuilder {
     /**
      * Create function package exclusion configuration
      */
-    createFunctionPackageConfig() {
+    createFunctionPackageConfig(usePrismaLayer = true) {
         return {
             exclude: [
                 // Exclude AWS SDK (provided by Lambda runtime)
                 'node_modules/aws-sdk/**',
                 'node_modules/@aws-sdk/**',
 
-                // Exclude Prisma (provided via Lambda Layer)
-                'node_modules/@prisma/**',
-                'node_modules/.prisma/**',
-                'node_modules/prisma/**',
-                'node_modules/@friggframework/core/generated/**',
+                // Conditionally exclude Prisma (only if using Lambda Layer)
+                ...(usePrismaLayer ? [
+                    'node_modules/@prisma/**',
+                    'node_modules/.prisma/**',
+                    'node_modules/prisma/**',
+                    'node_modules/@friggframework/core/generated/**',
+                ] : []),
 
                 // Exclude ALL nested node_modules
                 'node_modules/**/node_modules/**',
@@ -249,7 +254,7 @@ class IntegrationBuilder extends InfrastructureBuilder {
      * Create Lambda function definitions for an integration
      * These are serverless framework template function definitions
      */
-    async createFunctionDefinitions(integration, functionPackageConfig, result) {
+    async createFunctionDefinitions(integration, functionPackageConfig, result, usePrismaLayer = true) {
         const integrationName = integration.Definition.name;
 
         // Add webhook handler if enabled (BEFORE catch-all proxy route)
@@ -261,6 +266,7 @@ class IntegrationBuilder extends InfrastructureBuilder {
 
             result.functions[webhookFunctionName] = {
                 handler: `node_modules/@friggframework/core/handlers/routers/integration-webhook-routers.handlers.${integrationName}Webhook.handler`,
+                ...(usePrismaLayer && { layers: [{ Ref: 'PrismaLambdaLayer' }] }),
                 skipEsbuild: true,  // Nested exports in node_modules - skip esbuild bundling
                 package: functionPackageConfig,
                 events: [
@@ -284,6 +290,7 @@ class IntegrationBuilder extends InfrastructureBuilder {
         // Create HTTP API handler for integration (catch-all route AFTER webhooks)
         result.functions[integrationName] = {
             handler: `node_modules/@friggframework/core/handlers/routers/integration-defined-routers.handlers.${integrationName}.handler`,
+            ...(usePrismaLayer && { layers: [{ Ref: 'PrismaLambdaLayer' }] }),
             skipEsbuild: true,  // Nested exports in node_modules - skip esbuild bundling
             package: functionPackageConfig,
             events: [
@@ -301,6 +308,7 @@ class IntegrationBuilder extends InfrastructureBuilder {
         const queueWorkerName = `${integrationName}QueueWorker`;
         result.functions[queueWorkerName] = {
             handler: `node_modules/@friggframework/core/handlers/workers/integration-defined-workers.handlers.${integrationName}.queueWorker`,
+            ...(usePrismaLayer && { layers: [{ Ref: 'PrismaLambdaLayer' }] }),
             skipEsbuild: true,  // Nested exports in node_modules - skip esbuild bundling
             package: functionPackageConfig,
             reservedConcurrency: 5,

package/infrastructure/domains/networking/vpc-builder.js

@@ -552,7 +552,7 @@ class VpcBuilder extends InfrastructureBuilder {
         this.buildNatGatewayFromDecision(decisions.natGateway, appDefinition, discoveredResources, result);
 
         // Build VPC Endpoints based on ownership decisions
-        this.buildVpcEndpointsFromDecisions(decisions.vpcEndpoints, appDefinition, result);
+        this.buildVpcEndpointsFromDecisions(decisions.vpcEndpoints, decisions.securityGroup, appDefinition, result);
 
         // Set VPC_ENABLED environment variable
         result.environment.VPC_ENABLED = 'true';
@@ -920,7 +920,8 @@ class VpcBuilder extends InfrastructureBuilder {
     /**
      * Build VPC Endpoints based on ownership decisions
      */
-    buildVpcEndpointsFromDecisions(decisions, appDefinition, result) {
+    buildVpcEndpointsFromDecisions(endpointDecisions, securityGroupDecision, appDefinition, result) {
+        const decisions = endpointDecisions; // For backwards compatibility with existing code
         const endpointsToCreate = [];
         const endpointsInStack = [];
         const externalEndpoints = [];
@@ -939,7 +940,7 @@ class VpcBuilder extends InfrastructureBuilder {
         if (endpointsInStack.length > 0) {
             console.log(`  ✓ VPC Endpoints in stack: ${endpointsInStack.join(', ')}`);
             // CRITICAL: Must add stack-managed endpoints back to template or CloudFormation will DELETE them!
-            this._addStackManagedEndpointsToTemplate(decisions, result);
+            this._addStackManagedEndpointsToTemplate(decisions, securityGroupDecision, result);
         }
 
         if (externalEndpoints.length > 0) {
@@ -1002,6 +1003,15 @@ class VpcBuilder extends InfrastructureBuilder {
         // Create security group for interface endpoints if needed
         const needsInterfaceEndpoints = endpointsToCreate.some(type => ['kms', 'secretsManager', 'sqs'].includes(type));
         if (needsInterfaceEndpoints) {
+            // Determine source security group for ingress rule
+            let sourceSgId;
+            if (securityGroupDecision.ownership === ResourceOwnership.STACK) {
+                sourceSgId = { Ref: 'FriggLambdaSecurityGroup' };
+            } else {
+                // External - use the physical ID
+                sourceSgId = securityGroupDecision.physicalIds[0];
+            }
+
             result.resources.FriggVPCEndpointSecurityGroup = {
                 Type: 'AWS::EC2::SecurityGroup',
                 Properties: {
@@ -1012,7 +1022,7 @@ class VpcBuilder extends InfrastructureBuilder {
                             IpProtocol: 'tcp',
                             FromPort: 443,
                             ToPort: 443,
-                            SourceSecurityGroupId: { Ref: 'FriggLambdaSecurityGroup' },
+                            SourceSecurityGroupId: sourceSgId,
                             Description: 'HTTPS from Lambda',
                         },
                     ],
@@ -1129,7 +1139,8 @@ class VpcBuilder extends InfrastructureBuilder {
      * 
      * @private
      */
-    _addStackManagedEndpointsToTemplate(decisions, result) {
+    _addStackManagedEndpointsToTemplate(endpointDecisions, securityGroupDecision, result) {
+        const decisions = endpointDecisions; // For backwards compatibility
         const vpcId = result.vpcId;
         const logicalIdMap = {
             s3: 'FriggS3VPCEndpoint',
@@ -1197,11 +1208,11 @@ class VpcBuilder extends InfrastructureBuilder {
             // If Lambda SG is stack-managed, use CloudFormation Ref
             // If Lambda SG is external, use the physical ID directly
             let sourceSgId;
-            if (decisions.securityGroup.ownership === ResourceOwnership.STACK) {
+            if (securityGroupDecision.ownership === ResourceOwnership.STACK) {
                 sourceSgId = { Ref: 'FriggLambdaSecurityGroup' };
             } else {
                 // External - use the physical ID
-                sourceSgId = decisions.securityGroup.physicalIds[0];
+                sourceSgId = securityGroupDecision.physicalIds[0];
             }
 
             result.resources.FriggVPCEndpointSecurityGroup = {

package/infrastructure/domains/networking/vpc-builder.test.js

@@ -1472,6 +1472,76 @@ describe('VpcBuilder', () => {
         });
     });
 
+    describe('VPC Endpoint Security Group with External Lambda SG', () => {
+        it('should use external Lambda SG ID (not Ref) for VPC endpoint SG when Lambda SG is external', async () => {
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    enableVPCEndpoints: true,
+                    ownership: {
+                        securityGroup: 'external' // External Lambda SG
+                    }
+                },
+                encryption: { fieldLevelEncryptionMethod: 'kms' }
+            };
+            const discoveredResources = {
+                fromCloudFormationStack: true,
+                defaultVpcId: 'vpc-123',
+                defaultSecurityGroupId: 'sg-default-456', // Default VPC SG
+                lambdaSecurityGroupId: 'sg-stack-789',    // Stack-managed SG (will be ignored)
+                privateSubnetId1: 'subnet-1',
+                privateSubnetId2: 'subnet-2',
+                natGatewayId: 'nat-123',
+                existingLogicalIds: ['FriggS3VPCEndpoint', 'FriggKMSVPCEndpoint'],
+                s3VpcEndpointId: 'vpce-s3-stack',
+                kmsVpcEndpointId: 'vpce-kms-stack'
+            };
+
+            const result = await vpcBuilder.build(appDefinition, discoveredResources);
+
+            // VPC Endpoint SG should be created
+            expect(result.resources.FriggVPCEndpointSecurityGroup).toBeDefined();
+            
+            // CRITICAL: Should use external Lambda SG ID directly, NOT a CloudFormation Ref
+            const ingressRule = result.resources.FriggVPCEndpointSecurityGroup.Properties.SecurityGroupIngress[0];
+            expect(ingressRule.SourceSecurityGroupId).toBe('sg-default-456'); // Direct ID, not { Ref: 'FriggLambdaSecurityGroup' }
+            expect(typeof ingressRule.SourceSecurityGroupId).toBe('string');
+            
+            // Verify FriggLambdaSecurityGroup is NOT in the template
+            expect(result.resources.FriggLambdaSecurityGroup).toBeUndefined();
+        });
+
+        it('should use CloudFormation Ref when Lambda SG is stack-managed', async () => {
+            const appDefinition = {
+                vpc: {
+                    enable: true,
+                    enableVPCEndpoints: true,
+                    ownership: {
+                        securityGroup: 'stack' // Stack-managed Lambda SG
+                    }
+                },
+                encryption: { fieldLevelEncryptionMethod: 'kms' }
+            };
+            const discoveredResources = {
+                defaultVpcId: 'vpc-123',
+                privateSubnetId1: 'subnet-1',
+                privateSubnetId2: 'subnet-2'
+            };
+
+            const result = await vpcBuilder.build(appDefinition, discoveredResources);
+
+            // VPC Endpoint SG should be created
+            expect(result.resources.FriggVPCEndpointSecurityGroup).toBeDefined();
+            
+            // Should use CloudFormation Ref when Lambda SG is in stack
+            const ingressRule = result.resources.FriggVPCEndpointSecurityGroup.Properties.SecurityGroupIngress[0];
+            expect(ingressRule.SourceSecurityGroupId).toEqual({ Ref: 'FriggLambdaSecurityGroup' });
+            
+            // Verify FriggLambdaSecurityGroup IS in the template
+            expect(result.resources.FriggLambdaSecurityGroup).toBeDefined();
+        });
+    });
+
     describe('convertFlatDiscoveryToStructured - VPC Endpoints from CloudFormation', () => {
         it('should add VPC endpoints to stackManaged when in existingLogicalIds', () => {
             const flatDiscovery = {

package/infrastructure/domains/shared/utilities/base-definition-factory.js

@@ -16,18 +16,20 @@ const { buildEnvironment } = require('../environment-builder');
  * Frigg applications need, including:
  * - Core Lambda functions (auth, user, health, dbMigrate)
  * - Error handling infrastructure (SQS, SNS, CloudWatch)
- * - Prisma Lambda Layer
+ * - Prisma Lambda Layer (optional, controlled by usePrismaLayer)
  * - Base plugins and esbuild configuration
  * 
  * @param {Object} AppDefinition - Application definition
  * @param {Object} appEnvironmentVars - Environment variables from app definition
  * @param {Object} discoveredResources - AWS resources discovered during build
+ * @param {boolean} usePrismaLayer - Whether to use Prisma Lambda Layer (default true)
  * @returns {Object} Base serverless definition
  */
 function createBaseDefinition(
     AppDefinition,
     appEnvironmentVars,
-    discoveredResources
+    discoveredResources,
+    usePrismaLayer = true
 ) {
     const region = process.env.AWS_REGION || 'us-east-1';
 
@@ -42,11 +44,13 @@ function createBaseDefinition(
                 : []),
         ],
         exclude: [
-            // Exclude Prisma (provided via Lambda Layer)
-            'node_modules/@prisma/**',
-            'node_modules/.prisma/**',
-            'node_modules/prisma/**',
-            'node_modules/@friggframework/core/generated/**',
+            // Conditionally exclude Prisma (only if using Lambda Layer)
+            ...(usePrismaLayer ? [
+                'node_modules/@prisma/**',
+                'node_modules/.prisma/**',
+                'node_modules/prisma/**',
+                'node_modules/@friggframework/core/generated/**',
+            ] : []),
 
             // Exclude AWS SDK (provided by Lambda runtime)
             'node_modules/aws-sdk/**',
@@ -218,9 +222,12 @@ function createBaseDefinition(
                 external: [
                     '@aws-sdk/*',
                     'aws-sdk',
-                    '@prisma/client',
-                    'prisma',
-                    '.prisma/*',
+                    // Conditionally mark Prisma as external (only if using layer)
+                    ...(usePrismaLayer ? [
+                        '@prisma/client',
+                        'prisma',
+                        '.prisma/*',
+                    ] : []),
                 ],
                 packager: 'npm',
                 keepNames: true,
@@ -228,8 +235,11 @@ function createBaseDefinition(
                 exclude: [
                     'aws-sdk',
                     '@aws-sdk/*',
-                    '@prisma/client',
-                    'prisma',
+                    // Conditionally exclude Prisma (only if using layer)
+                    ...(usePrismaLayer ? [
+                        '@prisma/client',
+                        'prisma',
+                    ] : []),
                 ],
             },
             'serverless-offline': {
@@ -252,7 +262,7 @@ function createBaseDefinition(
         functions: {
             auth: {
                 handler: 'node_modules/@friggframework/core/handlers/routers/auth.handler',
-                layers: [{ Ref: 'PrismaLambdaLayer' }],
+                ...(usePrismaLayer && { layers: [{ Ref: 'PrismaLambdaLayer' }] }),
                 skipEsbuild: true,  // Handlers in node_modules don't need bundling
                 package: skipEsbuildPackageConfig,
                 events: [
@@ -268,14 +278,14 @@ function createBaseDefinition(
             },
             user: {
                 handler: 'node_modules/@friggframework/core/handlers/routers/user.handler',
-                layers: [{ Ref: 'PrismaLambdaLayer' }],
+                ...(usePrismaLayer && { layers: [{ Ref: 'PrismaLambdaLayer' }] }),
                 skipEsbuild: true,  // Handlers in node_modules don't need bundling
                 package: skipEsbuildPackageConfig,
                 events: [{ httpApi: { path: '/user/{proxy+}', method: 'ANY' } }],
             },
             health: {
                 handler: 'node_modules/@friggframework/core/handlers/routers/health.handler',
-                layers: [{ Ref: 'PrismaLambdaLayer' }],
+                ...(usePrismaLayer && { layers: [{ Ref: 'PrismaLambdaLayer' }] }),
                 skipEsbuild: true,  // Handlers in node_modules don't need bundling
                 package: skipEsbuildPackageConfig,
                 events: [
@@ -286,7 +296,7 @@ function createBaseDefinition(
             // Note: dbMigrate removed - MigrationBuilder now handles migration infrastructure
             // See: packages/devtools/infrastructure/domains/database/migration-builder.js
         },
-        layers: {
+        layers: usePrismaLayer ? {
             prisma: {
                 path: 'layers/prisma',
                 name: '${self:service}-prisma-${sls:stage}',
@@ -294,7 +304,7 @@ function createBaseDefinition(
                 compatibleRuntimes: ['nodejs20.x', 'nodejs22.x'],
                 retain: false,
             },
-        },
+        } : {},
         resources: {
             Resources: {
                 InternalErrorQueue: {

package/infrastructure/domains/shared/utilities/base-definition-factory.test.js

@@ -243,6 +243,79 @@ describe('Base Definition Factory', () => {
             expect(result.useDotenv).toBeDefined();
             expect(typeof result.useDotenv).toBe('boolean');
         });
+
+        describe('usePrismaLayer configuration', () => {
+            it('should include Prisma layer by default (usePrismaLayer=true)', () => {
+                const result = createBaseDefinition({}, {}, {}, true);
+
+                // Layer definition should exist
+                expect(result.layers.prisma).toBeDefined();
+                expect(result.layers.prisma.path).toBe('layers/prisma');
+
+                // Functions should reference the layer
+                expect(result.functions.auth.layers).toEqual([{ Ref: 'PrismaLambdaLayer' }]);
+                expect(result.functions.user.layers).toEqual([{ Ref: 'PrismaLambdaLayer' }]);
+                expect(result.functions.health.layers).toEqual([{ Ref: 'PrismaLambdaLayer' }]);
+
+                // Prisma should be excluded from packages
+                expect(result.functions.auth.package.exclude).toEqual(
+                    expect.arrayContaining([
+                        'node_modules/@prisma/**',
+                        'node_modules/.prisma/**',
+                        'node_modules/prisma/**',
+                        'node_modules/@friggframework/core/generated/**',
+                    ])
+                );
+
+                // Prisma should be external in esbuild
+                expect(result.custom.esbuild.external).toContain('@prisma/client');
+                expect(result.custom.esbuild.external).toContain('prisma');
+                expect(result.custom.esbuild.exclude).toContain('@prisma/client');
+                expect(result.custom.esbuild.exclude).toContain('prisma');
+            });
+
+            it('should NOT include Prisma layer when usePrismaLayer=false', () => {
+                const result = createBaseDefinition({}, {}, {}, false);
+
+                // Layer definition should NOT exist
+                expect(result.layers).toEqual({});
+
+                // Functions should NOT have layer references
+                expect(result.functions.auth.layers).toBeUndefined();
+                expect(result.functions.user.layers).toBeUndefined();
+                expect(result.functions.health.layers).toBeUndefined();
+            });
+
+            it('should bundle Prisma with functions when usePrismaLayer=false', () => {
+                const result = createBaseDefinition({}, {}, {}, false);
+
+                // Prisma should NOT be excluded from packages
+                expect(result.functions.auth.package.exclude).not.toEqual(
+                    expect.arrayContaining([
+                        'node_modules/@prisma/**',
+                        'node_modules/.prisma/**',
+                        'node_modules/prisma/**',
+                        'node_modules/@friggframework/core/generated/**',
+                    ])
+                );
+
+                // Prisma should NOT be external in esbuild
+                expect(result.custom.esbuild.external).not.toContain('@prisma/client');
+                expect(result.custom.esbuild.external).not.toContain('prisma');
+                expect(result.custom.esbuild.external).not.toContain('.prisma/*');
+                expect(result.custom.esbuild.exclude).not.toContain('@prisma/client');
+                expect(result.custom.esbuild.exclude).not.toContain('prisma');
+            });
+
+            it('should default to usePrismaLayer=true when parameter not provided', () => {
+                // Call without 4th parameter
+                const result = createBaseDefinition({}, {}, {});
+
+                // Should behave as if usePrismaLayer=true
+                expect(result.layers.prisma).toBeDefined();
+                expect(result.functions.auth.layers).toEqual([{ Ref: 'PrismaLambdaLayer' }]);
+            });
+        });
     });
 });
 

package/infrastructure/infrastructure-composer.js

@@ -32,8 +32,15 @@ const { validateAndCleanPlugins, validatePackagingConfiguration } = require('./d
 const composeServerlessDefinition = async (AppDefinition) => {
     console.log('🏗️  Composing serverless definition with domain builders...');
 
-    // Ensure Prisma layer exists (minimal, runtime only)
-    await ensurePrismaLayerExists(AppDefinition.database || {});
+    // Determine if using Prisma Lambda Layer (default true)
+    const usePrismaLayer = AppDefinition.usePrismaLambdaLayer !== false;
+
+    // Ensure Prisma layer exists only if using layer mode
+    if (usePrismaLayer) {
+        await ensurePrismaLayerExists(AppDefinition.database || {});
+    } else {
+        console.log('📦 Skipping Prisma Lambda Layer (usePrismaLambdaLayer=false - will bundle with functions)');
+    }
 
     // Create orchestrator with all domain builders
     const orchestrator = new BuilderOrchestrator([
@@ -55,7 +62,8 @@ const composeServerlessDefinition = async (AppDefinition) => {
     const definition = createBaseDefinition(
         AppDefinition,
         appEnvironmentVars,
-        discoveredResources
+        discoveredResources,
+        usePrismaLayer
     );
 
     // Merge builder results into definition

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.490.3374b8f.0",
+  "version": "2.0.0--canary.490.1f4f770.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -16,9 +16,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.490.3374b8f.0",
-    "@friggframework/schemas": "2.0.0--canary.490.3374b8f.0",
-    "@friggframework/test": "2.0.0--canary.490.3374b8f.0",
+    "@friggframework/core": "2.0.0--canary.490.1f4f770.0",
+    "@friggframework/schemas": "2.0.0--canary.490.1f4f770.0",
+    "@friggframework/test": "2.0.0--canary.490.1f4f770.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -46,8 +46,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.490.3374b8f.0",
-    "@friggframework/prettier-config": "2.0.0--canary.490.3374b8f.0",
+    "@friggframework/eslint-config": "2.0.0--canary.490.1f4f770.0",
+    "@friggframework/prettier-config": "2.0.0--canary.490.1f4f770.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -79,5 +79,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "3374b8f9b30c6c9d5dad4492ca5dc7d804d1e124"
+  "gitHead": "1f4f7704d573f1fe0295cd1d421d5e6b164214e2"
 }