@friggframework/devtools 2.0.0--canary.490.581e175.0 → 2.0.0--canary.490.e01df69.0

package/infrastructure/domains/networking/vpc-builder.js

@@ -295,6 +295,15 @@ class VpcBuilder extends InfrastructureBuilder {
             }
         }
 
+        // Add flat discovery properties directly to discovery object for resolver access
+        // The resolver checks both discovery.defaultSecurityGroupId and discovery.external array
+        discovery.defaultVpcId = flatDiscovery.defaultVpcId;
+        discovery.defaultSecurityGroupId = flatDiscovery.defaultSecurityGroupId;
+        discovery.privateSubnetId1 = flatDiscovery.privateSubnetId1;
+        discovery.privateSubnetId2 = flatDiscovery.privateSubnetId2;
+        discovery.natGatewayId = flatDiscovery.natGatewayId;
+        discovery.lambdaSecurityGroupId = flatDiscovery.lambdaSecurityGroupId;
+
         return discovery;
     }
 

package/infrastructure/domains/networking/vpc-builder.test.js

@@ -1448,6 +1448,30 @@ describe('VpcBuilder', () => {
         });
     });
 
+    describe('convertFlatDiscoveryToStructured - Direct Properties', () => {
+        it('should copy flat discovery properties to structured discovery for resolver access', () => {
+            const flatDiscovery = {
+                fromCloudFormationStack: true,
+                defaultVpcId: 'vpc-123',
+                defaultSecurityGroupId: 'sg-default-456',
+                lambdaSecurityGroupId: 'sg-lambda-789',
+                privateSubnetId1: 'subnet-1',
+                privateSubnetId2: 'subnet-2',
+                natGatewayId: 'nat-123'
+            };
+
+            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
+
+            // Direct properties should be copied for resolver access
+            expect(result.defaultVpcId).toBe('vpc-123');
+            expect(result.defaultSecurityGroupId).toBe('sg-default-456');
+            expect(result.lambdaSecurityGroupId).toBe('sg-lambda-789');
+            expect(result.privateSubnetId1).toBe('subnet-1');
+            expect(result.privateSubnetId2).toBe('subnet-2');
+            expect(result.natGatewayId).toBe('nat-123');
+        });
+    });
+
     describe('convertFlatDiscoveryToStructured - VPC Endpoints from CloudFormation', () => {
         it('should add VPC endpoints to stackManaged when in existingLogicalIds', () => {
             const flatDiscovery = {

package/infrastructure/domains/networking/vpc-resolver.js

@@ -116,9 +116,22 @@ class VpcResourceResolver extends BaseResourceResolver {
             
             // No hardcoded IDs - try discovery
             const structured = discovery._structured || discovery;
+            
+            // When ownership='external', use ONLY the default SG, not the stack-managed lambda SG
+            // Check for lambdaSecurityGroupId first to avoid using it
+            const lambdaSgId = structured.lambdaSecurityGroupId || discovery.lambdaSecurityGroupId;
             const defaultSgId = structured.defaultSecurityGroupId || discovery.defaultSecurityGroupId;
             
-            if (defaultSgId) {
+            // If we have a default SG AND it's different from the lambda SG, use the default
+            if (defaultSgId && defaultSgId !== lambdaSgId) {
+                return this.createExternalDecision(
+                    [defaultSgId],
+                    'User specified ownership=external - using discovered default security group'
+                );
+            }
+            
+            // If only lambdaSgId exists, that means defaultSgId wasn't discovered
+            if (defaultSgId && !lambdaSgId) {
                 return this.createExternalDecision(
                     [defaultSgId],
                     'User specified ownership=external - using discovered default security group'

package/infrastructure/domains/networking/vpc-resolver.test.js

@@ -235,6 +235,30 @@ describe('VpcResourceResolver', () => {
             );
         });
 
+        it('should prefer default SG over stack-managed SG when ownership=external and both discovered', () => {
+            const appDefinition = {
+                vpc: {
+                    ownership: { securityGroup: 'external' }
+                }
+            };
+            const discovery = {
+                stackManaged: [
+                    { logicalId: 'FriggLambdaSecurityGroup', physicalId: 'sg-stack-managed', resourceType: 'AWS::EC2::SecurityGroup' }
+                ],
+                external: [],
+                fromCloudFormation: true,
+                lambdaSecurityGroupId: 'sg-stack-managed', // Stack-managed SG
+                defaultSecurityGroupId: 'sg-default-vpc'   // Default VPC SG
+            };
+
+            const decision = resolver.resolveSecurityGroup(appDefinition, discovery);
+
+            // Should use default SG, NOT the stack-managed one
+            expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
+            expect(decision.physicalIds).toEqual(['sg-default-vpc']);
+            expect(decision.reason).toContain('discovered default security group');
+        });
+
         it('should auto-resolve to STACK when FriggLambdaSecurityGroup in stack', () => {
             const appDefinition = { vpc: { ownership: { securityGroup: 'auto' } } };
             const discovery = {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.490.581e175.0",
+  "version": "2.0.0--canary.490.e01df69.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -16,9 +16,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.490.581e175.0",
-    "@friggframework/schemas": "2.0.0--canary.490.581e175.0",
-    "@friggframework/test": "2.0.0--canary.490.581e175.0",
+    "@friggframework/core": "2.0.0--canary.490.e01df69.0",
+    "@friggframework/schemas": "2.0.0--canary.490.e01df69.0",
+    "@friggframework/test": "2.0.0--canary.490.e01df69.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -46,8 +46,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.490.581e175.0",
-    "@friggframework/prettier-config": "2.0.0--canary.490.581e175.0",
+    "@friggframework/eslint-config": "2.0.0--canary.490.e01df69.0",
+    "@friggframework/prettier-config": "2.0.0--canary.490.e01df69.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -79,5 +79,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "581e17591e9029cfc6326cdfc4b647b625ed8572"
+  "gitHead": "e01df6929184675de7553c9bb7388c31976988cb"
 }