@friggframework/devtools 2.0.0--canary.490.9c3f667.0 → 2.0.0--canary.490.5a16b80.0

package/infrastructure/domains/networking/vpc-builder.js

@@ -149,7 +149,7 @@ class VpcBuilder extends InfrastructureBuilder {
                     physicalId = flatDiscovery.defaultVpcId;
                 } else if (logicalId === 'FriggLambdaSecurityGroup') {
                     resourceType = 'AWS::EC2::SecurityGroup';
-                    physicalId = flatDiscovery.defaultSecurityGroupId || flatDiscovery.securityGroupId;
+                    physicalId = flatDiscovery.lambdaSecurityGroupId || flatDiscovery.defaultSecurityGroupId || flatDiscovery.securityGroupId;
                 } else if (logicalId === 'FriggPrivateSubnet1') {
                     resourceType = 'AWS::EC2::Subnet';
                     physicalId = flatDiscovery.privateSubnetId1;

package/infrastructure/domains/networking/vpc-resolver.js

@@ -99,8 +99,18 @@ class VpcResourceResolver extends BaseResourceResolver {
             );
         }
 
-        // Check for discovered default security group (from old canary pattern)
+        // Also check flat discovery for lambdaSecurityGroupId (from CloudFormation extraction)
         const structured = discovery._structured || discovery;
+        const lambdaSgId = structured.lambdaSecurityGroupId || discovery.lambdaSecurityGroupId;
+        
+        if (lambdaSgId) {
+            return this.createStackDecision(
+                lambdaSgId,
+                'Found FriggLambdaSecurityGroup in CloudFormation stack - must keep in template'
+            );
+        }
+
+        // Check for discovered default security group (from external VPC pattern)
         const defaultSgId = structured.defaultSecurityGroupId || discovery.defaultSecurityGroupId;
         
         if (defaultSgId) {

package/infrastructure/domains/shared/cloudformation-discovery.js

@@ -311,18 +311,21 @@ class CloudFormationDiscovery {
                 console.log(`  ✓ Found route table in stack: ${PhysicalResourceId}`);
             }
 
-            // NAT Route (proves NAT configuration exists)
-            if (LogicalResourceId === 'FriggNATRoute' && ResourceType === 'AWS::EC2::Route') {
+            // NAT Route (proves NAT configuration exists) - support both naming patterns
+            if ((LogicalResourceId === 'FriggNATRoute' || LogicalResourceId === 'FriggPrivateRoute') && 
+                ResourceType === 'AWS::EC2::Route') {
                 discovered.natRoute = PhysicalResourceId;
-                console.log(`  ✓ Found NAT route in stack`);
+                console.log(`  ✓ Found NAT route in stack: ${LogicalResourceId}`);
             }
 
             // Route Table Associations (links subnets to route table)
-            if (LogicalResourceId.includes('RouteAssociation') && ResourceType === 'AWS::EC2::SubnetRouteTableAssociation') {
+            if (LogicalResourceId.includes('RouteAssociation') && 
+                ResourceType === 'AWS::EC2::SubnetRouteTableAssociation') {
                 if (!discovered.routeTableAssociations) {
                     discovered.routeTableAssociations = [];
                 }
                 discovered.routeTableAssociations.push(PhysicalResourceId);
+                console.log(`  ✓ Found route table association: ${LogicalResourceId}`);
             }
 
             // VPC - direct extraction (primary method)
@@ -385,6 +388,15 @@ class CloudFormationDiscovery {
             // VPC Endpoint Security Group
             if (LogicalResourceId === 'FriggVPCEndpointSecurityGroup' && ResourceType === 'AWS::EC2::SecurityGroup') {
                 discovered.vpcEndpointSecurityGroupId = PhysicalResourceId;
+                console.log(`  ✓ Found VPC endpoint security group in stack: ${PhysicalResourceId}`);
+            }
+            
+            // Lambda Security Group (if created in stack)
+            if (LogicalResourceId === 'FriggLambdaSecurityGroup' && ResourceType === 'AWS::EC2::SecurityGroup') {
+                discovered.lambdaSecurityGroupId = PhysicalResourceId;
+                // Also set as defaultSecurityGroupId so converter recognizes it
+                discovered.defaultSecurityGroupId = PhysicalResourceId;
+                console.log(`  ✓ Found Lambda security group in stack: ${PhysicalResourceId}`);
             }
 
             // VPC Endpoints - support both old and new naming conventions

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.490.9c3f667.0",
+  "version": "2.0.0--canary.490.5a16b80.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -16,9 +16,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.490.9c3f667.0",
-    "@friggframework/schemas": "2.0.0--canary.490.9c3f667.0",
-    "@friggframework/test": "2.0.0--canary.490.9c3f667.0",
+    "@friggframework/core": "2.0.0--canary.490.5a16b80.0",
+    "@friggframework/schemas": "2.0.0--canary.490.5a16b80.0",
+    "@friggframework/test": "2.0.0--canary.490.5a16b80.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -46,8 +46,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.490.9c3f667.0",
-    "@friggframework/prettier-config": "2.0.0--canary.490.9c3f667.0",
+    "@friggframework/eslint-config": "2.0.0--canary.490.5a16b80.0",
+    "@friggframework/prettier-config": "2.0.0--canary.490.5a16b80.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -79,5 +79,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "9c3f667631d39587db81c825f526dc7d2177aaa6"
+  "gitHead": "5a16b8073706ae42c15a9b983a9cee83968af058"
 }