@friggframework/devtools 2.0.0--canary.490.81a6847.0 → 2.0.0--canary.490.e01df69.0

package/infrastructure/domains/networking/vpc-resolver.js

@@ -116,9 +116,22 @@ class VpcResourceResolver extends BaseResourceResolver {
             
             // No hardcoded IDs - try discovery
             const structured = discovery._structured || discovery;
+            
+            // When ownership='external', use ONLY the default SG, not the stack-managed lambda SG
+            // Check for lambdaSecurityGroupId first to avoid using it
+            const lambdaSgId = structured.lambdaSecurityGroupId || discovery.lambdaSecurityGroupId;
             const defaultSgId = structured.defaultSecurityGroupId || discovery.defaultSecurityGroupId;
             
-            if (defaultSgId) {
+            // If we have a default SG AND it's different from the lambda SG, use the default
+            if (defaultSgId && defaultSgId !== lambdaSgId) {
+                return this.createExternalDecision(
+                    [defaultSgId],
+                    'User specified ownership=external - using discovered default security group'
+                );
+            }
+            
+            // If only lambdaSgId exists, that means defaultSgId wasn't discovered
+            if (defaultSgId && !lambdaSgId) {
                 return this.createExternalDecision(
                     [defaultSgId],
                     'User specified ownership=external - using discovered default security group'

package/infrastructure/domains/networking/vpc-resolver.test.js

@@ -235,6 +235,30 @@ describe('VpcResourceResolver', () => {
             );
         });
 
+        it('should prefer default SG over stack-managed SG when ownership=external and both discovered', () => {
+            const appDefinition = {
+                vpc: {
+                    ownership: { securityGroup: 'external' }
+                }
+            };
+            const discovery = {
+                stackManaged: [
+                    { logicalId: 'FriggLambdaSecurityGroup', physicalId: 'sg-stack-managed', resourceType: 'AWS::EC2::SecurityGroup' }
+                ],
+                external: [],
+                fromCloudFormation: true,
+                lambdaSecurityGroupId: 'sg-stack-managed', // Stack-managed SG
+                defaultSecurityGroupId: 'sg-default-vpc'   // Default VPC SG
+            };
+
+            const decision = resolver.resolveSecurityGroup(appDefinition, discovery);
+
+            // Should use default SG, NOT the stack-managed one
+            expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
+            expect(decision.physicalIds).toEqual(['sg-default-vpc']);
+            expect(decision.reason).toContain('discovered default security group');
+        });
+
         it('should auto-resolve to STACK when FriggLambdaSecurityGroup in stack', () => {
             const appDefinition = { vpc: { ownership: { securityGroup: 'auto' } } };
             const discovery = {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.490.81a6847.0",
+  "version": "2.0.0--canary.490.e01df69.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -16,9 +16,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.490.81a6847.0",
-    "@friggframework/schemas": "2.0.0--canary.490.81a6847.0",
-    "@friggframework/test": "2.0.0--canary.490.81a6847.0",
+    "@friggframework/core": "2.0.0--canary.490.e01df69.0",
+    "@friggframework/schemas": "2.0.0--canary.490.e01df69.0",
+    "@friggframework/test": "2.0.0--canary.490.e01df69.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -46,8 +46,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.490.81a6847.0",
-    "@friggframework/prettier-config": "2.0.0--canary.490.81a6847.0",
+    "@friggframework/eslint-config": "2.0.0--canary.490.e01df69.0",
+    "@friggframework/prettier-config": "2.0.0--canary.490.e01df69.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -79,5 +79,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "81a684747fa412f872340aaefde6d5661a01b903"
+  "gitHead": "e01df6929184675de7553c9bb7388c31976988cb"
 }