@friggframework/devtools 2.0.0--canary.490.aa04da7.0 → 2.0.0--canary.490.3374b8f.0

package/infrastructure/domains/networking/vpc-builder.js

@@ -1193,6 +1193,17 @@ class VpcBuilder extends InfrastructureBuilder {
         );
 
         if (hasInterfaceEndpoints && !result.resources.FriggVPCEndpointSecurityGroup) {
+            // Determine source security group for ingress rule
+            // If Lambda SG is stack-managed, use CloudFormation Ref
+            // If Lambda SG is external, use the physical ID directly
+            let sourceSgId;
+            if (decisions.securityGroup.ownership === ResourceOwnership.STACK) {
+                sourceSgId = { Ref: 'FriggLambdaSecurityGroup' };
+            } else {
+                // External - use the physical ID
+                sourceSgId = decisions.securityGroup.physicalIds[0];
+            }
+
             result.resources.FriggVPCEndpointSecurityGroup = {
                 Type: 'AWS::EC2::SecurityGroup',
                 Properties: {
@@ -1203,7 +1214,7 @@ class VpcBuilder extends InfrastructureBuilder {
                             IpProtocol: 'tcp',
                             FromPort: 443,
                             ToPort: 443,
-                            SourceSecurityGroupId: { Ref: 'FriggLambdaSecurityGroup' }
+                            SourceSecurityGroupId: sourceSgId
                         }
                     ],
                     Tags: [

package/infrastructure/domains/networking/vpc-resolver.js

@@ -118,17 +118,9 @@ class VpcResourceResolver extends BaseResourceResolver {
             const structured = discovery._structured || discovery;
             
             // When ownership='external', use ONLY the default SG, not the stack-managed lambda SG
-            // Check for lambdaSecurityGroupId first to avoid using it
             const lambdaSgId = structured.lambdaSecurityGroupId || discovery.lambdaSecurityGroupId;
             const defaultSgId = structured.defaultSecurityGroupId || discovery.defaultSecurityGroupId;
             
-            // Debug logging to understand what's happening
-            console.log(`  DEBUG: resolveSecurityGroup - ownership='external'`);
-            console.log(`    lambdaSgId: ${lambdaSgId}`);
-            console.log(`    defaultSgId: ${defaultSgId}`);
-            console.log(`    discovery keys: ${Object.keys(discovery).join(', ')}`);
-            console.log(`    structured keys: ${Object.keys(structured).join(', ')}`);
-            
             // If we have a default SG AND it's different from the lambda SG, use the default
             if (defaultSgId && defaultSgId !== lambdaSgId) {
                 return this.createExternalDecision(

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.490.aa04da7.0",
+  "version": "2.0.0--canary.490.3374b8f.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -16,9 +16,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.490.aa04da7.0",
-    "@friggframework/schemas": "2.0.0--canary.490.aa04da7.0",
-    "@friggframework/test": "2.0.0--canary.490.aa04da7.0",
+    "@friggframework/core": "2.0.0--canary.490.3374b8f.0",
+    "@friggframework/schemas": "2.0.0--canary.490.3374b8f.0",
+    "@friggframework/test": "2.0.0--canary.490.3374b8f.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -46,8 +46,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.490.aa04da7.0",
-    "@friggframework/prettier-config": "2.0.0--canary.490.aa04da7.0",
+    "@friggframework/eslint-config": "2.0.0--canary.490.3374b8f.0",
+    "@friggframework/prettier-config": "2.0.0--canary.490.3374b8f.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -79,5 +79,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "aa04da7877661300be820bbe4b08f71984db82c7"
+  "gitHead": "3374b8f9b30c6c9d5dad4492ca5dc7d804d1e124"
 }