@friggframework/devtools 2.0.0--canary.490.de9ed00.0 → 2.0.0--canary.493.f8d621f.0

package/infrastructure/domains/networking/vpc-builder.js

@@ -149,7 +149,7 @@ class VpcBuilder extends InfrastructureBuilder {
                     physicalId = flatDiscovery.defaultVpcId;
                 } else if (logicalId === 'FriggLambdaSecurityGroup') {
                     resourceType = 'AWS::EC2::SecurityGroup';
-                    physicalId = flatDiscovery.lambdaSecurityGroupId || flatDiscovery.defaultSecurityGroupId || flatDiscovery.securityGroupId;
+                    physicalId = flatDiscovery.defaultSecurityGroupId || flatDiscovery.securityGroupId;
                 } else if (logicalId === 'FriggPrivateSubnet1') {
                     resourceType = 'AWS::EC2::Subnet';
                     physicalId = flatDiscovery.privateSubnetId1;
@@ -159,9 +159,6 @@ class VpcBuilder extends InfrastructureBuilder {
                 } else if (logicalId === 'FriggNATGateway') {
                     resourceType = 'AWS::EC2::NatGateway';
                     physicalId = flatDiscovery.existingNatGatewayId;
-                } else if (logicalId === 'FriggLambdaRouteTable') {
-                    resourceType = 'AWS::EC2::RouteTable';
-                    physicalId = flatDiscovery.routeTableId;
                 } else if (logicalId === 'FriggS3VPCEndpoint') {
                     resourceType = 'AWS::EC2::VPCEndpoint';
                     physicalId = flatDiscovery.s3VpcEndpointId;
@@ -187,11 +184,6 @@ class VpcBuilder extends InfrastructureBuilder {
                     });
                 }
             });
-
-            // Also check for external resources extracted via CloudFormation queries
-            // (e.g., VPC ID from security group query, subnets from route table associations)
-            // These are NOT in the stack but were discovered through stack resources
-            this._addExternalResourcesFromCloudFormationQueries(flatDiscovery, discovery, existingLogicalIds);
         } else {
             // Resources discovered from AWS API (not CloudFormation)
             // These go into external array
@@ -298,58 +290,6 @@ class VpcBuilder extends InfrastructureBuilder {
         return discovery;
     }
 
-    /**
-     * Add external resources that were discovered via CloudFormation queries
-     * (e.g., VPC ID extracted from security group, subnets from route table associations)
-     * 
-     * @private
-     */
-    _addExternalResourcesFromCloudFormationQueries(flatDiscovery, discovery, existingLogicalIds) {
-        // VPC ID extracted from SG or route table (NOT a stack resource)
-        if (flatDiscovery.defaultVpcId && 
-            typeof flatDiscovery.defaultVpcId === 'string' &&
-            !existingLogicalIds.includes('FriggVPC')) {
-            discovery.external.push({
-                physicalId: flatDiscovery.defaultVpcId,
-                resourceType: 'AWS::EC2::VPC',
-                source: 'cloudformation-query'
-            });
-        }
-
-        // Subnets extracted from route table associations (NOT stack resources)
-        if (flatDiscovery.privateSubnetId1 && 
-            typeof flatDiscovery.privateSubnetId1 === 'string' &&
-            !existingLogicalIds.includes('FriggPrivateSubnet1')) {
-            discovery.external.push({
-                physicalId: flatDiscovery.privateSubnetId1,
-                resourceType: 'AWS::EC2::Subnet',
-                source: 'cloudformation-query'
-            });
-        }
-
-        if (flatDiscovery.privateSubnetId2 && 
-            typeof flatDiscovery.privateSubnetId2 === 'string' &&
-            !existingLogicalIds.includes('FriggPrivateSubnet2')) {
-            discovery.external.push({
-                physicalId: flatDiscovery.privateSubnetId2,
-                resourceType: 'AWS::EC2::Subnet',
-                source: 'cloudformation-query'
-            });
-        }
-
-        // NAT Gateway extracted from route table routes
-        if (flatDiscovery.existingNatGatewayId && 
-            typeof flatDiscovery.existingNatGatewayId === 'string' &&
-            !existingLogicalIds.includes('FriggNATGateway') &&
-            !existingLogicalIds.includes('FriggNatGateway')) {
-            discovery.external.push({
-                physicalId: flatDiscovery.existingNatGatewayId,
-                resourceType: 'AWS::EC2::NatGateway',
-                source: 'cloudformation-query'
-            });
-        }
-    }
-
     /**
      * Translate legacy configuration (management modes) to new ownership-based configuration
      * Provides backwards compatibility for existing app definitions
@@ -932,8 +872,6 @@ class VpcBuilder extends InfrastructureBuilder {
 
         if (endpointsInStack.length > 0) {
             console.log(`  ✓ VPC Endpoints in stack: ${endpointsInStack.join(', ')}`);
-            // CRITICAL: Must add stack-managed endpoints back to template or CloudFormation will DELETE them!
-            this._addStackManagedEndpointsToTemplate(decisions, result);
         }
 
         if (externalEndpoints.length > 0) {
@@ -1114,101 +1052,6 @@ class VpcBuilder extends InfrastructureBuilder {
         return healingReport;
     }
 
-    /**
-     * Add stack-managed VPC endpoints back to template
-     * 
-     * CRITICAL: CloudFormation will DELETE resources that exist in the previous template
-     * but are missing from the new template. We must re-add discovered stack-managed
-     * endpoints to prevent CloudFormation from deleting them.
-     * 
-     * @private
-     */
-    _addStackManagedEndpointsToTemplate(decisions, result) {
-        const vpcId = result.vpcId;
-        const logicalIdMap = {
-            s3: 'FriggS3VPCEndpoint',
-            dynamodb: 'FriggDynamoDBVPCEndpoint',
-            kms: 'FriggKMSVPCEndpoint',
-            secretsManager: 'FriggSecretsManagerVPCEndpoint',
-            sqs: 'FriggSQSVPCEndpoint'
-        };
-
-        Object.entries(decisions).forEach(([type, decision]) => {
-            if (decision.ownership === ResourceOwnership.STACK && decision.physicalId) {
-                const logicalId = logicalIdMap[type];
-                
-                // Determine endpoint type and properties based on service
-                if (type === 's3') {
-                    result.resources[logicalId] = {
-                        Type: 'AWS::EC2::VPCEndpoint',
-                        Properties: {
-                            VpcId: vpcId,
-                            ServiceName: 'com.amazonaws.${self:provider.region}.s3',
-                            VpcEndpointType: 'Gateway',
-                            RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }]
-                        }
-                    };
-                } else if (type === 'dynamodb') {
-                    result.resources[logicalId] = {
-                        Type: 'AWS::EC2::VPCEndpoint',
-                        Properties: {
-                            VpcId: vpcId,
-                            ServiceName: 'com.amazonaws.${self:provider.region}.dynamodb',
-                            VpcEndpointType: 'Gateway',
-                            RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }]
-                        }
-                    };
-                } else {
-                    // Interface endpoints (KMS, Secrets Manager, SQS)
-                    const serviceMap = {
-                        kms: 'kms',
-                        secretsManager: 'secretsmanager',
-                        sqs: 'sqs'
-                    };
-                    
-                    result.resources[logicalId] = {
-                        Type: 'AWS::EC2::VPCEndpoint',
-                        Properties: {
-                            VpcId: vpcId,
-                            ServiceName: `com.amazonaws.\${self:provider.region}.${serviceMap[type]}`,
-                            VpcEndpointType: 'Interface',
-                            SubnetIds: result.vpcConfig.subnetIds,
-                            SecurityGroupIds: [{ Ref: 'FriggVPCEndpointSecurityGroup' }],
-                            PrivateDnsEnabled: true
-                        }
-                    };
-                }
-            }
-        });
-
-        // If any interface endpoints exist, ensure security group is in template
-        const hasInterfaceEndpoints = ['kms', 'secretsManager', 'sqs'].some(
-            type => decisions[type]?.ownership === ResourceOwnership.STACK && decisions[type]?.physicalId
-        );
-
-        if (hasInterfaceEndpoints && !result.resources.FriggVPCEndpointSecurityGroup) {
-            result.resources.FriggVPCEndpointSecurityGroup = {
-                Type: 'AWS::EC2::SecurityGroup',
-                Properties: {
-                    GroupDescription: 'Security group for VPC Endpoints',
-                    VpcId: vpcId,
-                    SecurityGroupIngress: [
-                        {
-                            IpProtocol: 'tcp',
-                            FromPort: 443,
-                            ToPort: 443,
-                            SourceSecurityGroupId: { Ref: 'FriggLambdaSecurityGroup' }
-                        }
-                    ],
-                    Tags: [
-                        { Key: 'Name', Value: '${self:service}-${self:provider.stage}-vpc-endpoint-sg' },
-                        { Key: 'ManagedBy', Value: 'Frigg' }
-                    ]
-                }
-            };
-        }
-    }
-
     /**
      * Build new VPC from scratch
      */
@@ -1818,7 +1661,7 @@ class VpcBuilder extends InfrastructureBuilder {
         // Stack-managed resources should be reused, not recreated
         const stackManagedEndpoints = {
             s3: discoveredResources.s3VpcEndpointId && typeof discoveredResources.s3VpcEndpointId === 'string',
-            dynamodb: discoveredResources.dynamodbVpcEndpointId && typeof discoveredResources.dynamodbVpcEndpointId === 'string',
+            dynamodb: discoveredResources.dynamoDbVpcEndpointId && typeof discoveredResources.dynamoDbVpcEndpointId === 'string',
             kms: discoveredResources.kmsVpcEndpointId && typeof discoveredResources.kmsVpcEndpointId === 'string',
             secretsManager: discoveredResources.secretsManagerVpcEndpointId && typeof discoveredResources.secretsManagerVpcEndpointId === 'string',
             sqs: discoveredResources.sqsVpcEndpointId && typeof discoveredResources.sqsVpcEndpointId === 'string',

package/infrastructure/domains/networking/vpc-builder.test.js

@@ -1258,145 +1258,5 @@ describe('VpcBuilder', () => {
             expect(result.outputs.PrivateSubnet2Id).toBeDefined();
         });
     });
-
-    describe('convertFlatDiscoveryToStructured - CloudFormation query results', () => {
-        it('should add VPC from CloudFormation query to external array', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: ['FriggLambdaRouteTable', 'FriggLambdaSecurityGroup'],
-                // VPC ID was extracted from security group query (NOT a stack resource)
-                defaultVpcId: 'vpc-extracted-from-sg',
-                lambdaSecurityGroupId: 'sg-123',
-                routeTableId: 'rtb-123'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // VPC should be in external array (discovered via query, not in stack)
-            const vpcExternal = result.external.find(r => r.resourceType === 'AWS::EC2::VPC');
-            expect(vpcExternal).toBeDefined();
-            expect(vpcExternal.physicalId).toBe('vpc-extracted-from-sg');
-            expect(vpcExternal.source).toBe('cloudformation-query');
-
-            // Security group SHOULD be in stackManaged (is in stack)
-            const sgStack = result.stackManaged.find(r => r.logicalId === 'FriggLambdaSecurityGroup');
-            expect(sgStack).toBeDefined();
-            expect(sgStack.physicalId).toBe('sg-123');
-        });
-
-        it('should add subnets from route table associations to external array', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: ['FriggLambdaRouteTable'],
-                routeTableId: 'rtb-123',
-                // Subnets extracted from route table associations (NOT stack resources)
-                privateSubnetId1: 'subnet-1',
-                privateSubnetId2: 'subnet-2'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // Subnets should be in external array
-            const subnet1 = result.external.find(r => r.physicalId === 'subnet-1');
-            const subnet2 = result.external.find(r => r.physicalId === 'subnet-2');
-            
-            expect(subnet1).toBeDefined();
-            expect(subnet1.resourceType).toBe('AWS::EC2::Subnet');
-            expect(subnet1.source).toBe('cloudformation-query');
-            
-            expect(subnet2).toBeDefined();
-            expect(subnet2.resourceType).toBe('AWS::EC2::Subnet');
-            expect(subnet2.source).toBe('cloudformation-query');
-        });
-
-        it('should add NAT Gateway from route table queries to external array', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: ['FriggLambdaRouteTable', 'FriggPrivateRoute'],
-                routeTableId: 'rtb-123',
-                // NAT Gateway extracted from route table routes (NOT a stack resource)
-                existingNatGatewayId: 'nat-extracted'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // NAT should be in external array
-            const natExternal = result.external.find(r => r.resourceType === 'AWS::EC2::NatGateway');
-            expect(natExternal).toBeDefined();
-            expect(natExternal.physicalId).toBe('nat-extracted');
-            expect(natExternal.source).toBe('cloudformation-query');
-        });
-
-        it('should NOT add resources to external if they are in stack', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: ['FriggVPC', 'FriggPrivateSubnet1'],
-                // These ARE in the stack
-                defaultVpcId: 'vpc-in-stack',
-                privateSubnetId1: 'subnet-in-stack'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // Should be in stackManaged, NOT external
-            expect(result.stackManaged.some(r => r.logicalId === 'FriggVPC')).toBe(true);
-            expect(result.stackManaged.some(r => r.logicalId === 'FriggPrivateSubnet1')).toBe(true);
-            
-            // Should NOT be in external
-            expect(result.external.some(r => r.physicalId === 'vpc-in-stack')).toBe(false);
-            expect(result.external.some(r => r.physicalId === 'subnet-in-stack')).toBe(false);
-        });
-
-        it('should handle Frontify pattern: stack resources + queried external references', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'create-frigg-app-production',
-                existingLogicalIds: [
-                    'FriggLambdaSecurityGroup',
-                    'FriggLambdaRouteTable',
-                    'FriggPrivateRoute',
-                    'FriggPrivateSubnet1RouteTableAssociation',
-                    'FriggPrivateSubnet2RouteTableAssociation',
-                    'FriggS3VPCEndpoint',
-                    'FriggDynamoDBVPCEndpoint',
-                    'FriggKMSVPCEndpoint'
-                ],
-                // Stack resources
-                lambdaSecurityGroupId: 'sg-01002240c6a446202',
-                routeTableId: 'rtb-08af43bbf0775602d',
-                s3VpcEndpointId: 'vpce-s3',
-                // External resources (discovered via queries)
-                defaultVpcId: 'vpc-0cd17c0e06cb28b28',
-                privateSubnetId1: 'subnet-034f6562dbbc16348',
-                privateSubnetId2: 'subnet-0b8be2b82aeb5cdec',
-                existingNatGatewayId: 'nat-022660c36a47e2d79'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // Stack resources should be in stackManaged
-            expect(result.stackManaged).toEqual(
-                expect.arrayContaining([
-                    expect.objectContaining({ logicalId: 'FriggLambdaSecurityGroup', physicalId: 'sg-01002240c6a446202' }),
-                    expect.objectContaining({ logicalId: 'FriggLambdaRouteTable', physicalId: 'rtb-08af43bbf0775602d' }),
-                    expect.objectContaining({ logicalId: 'FriggS3VPCEndpoint' })
-                ])
-            );
-
-            // External resources should be in external array
-            expect(result.external).toEqual(
-                expect.arrayContaining([
-                    expect.objectContaining({ physicalId: 'vpc-0cd17c0e06cb28b28', resourceType: 'AWS::EC2::VPC', source: 'cloudformation-query' }),
-                    expect.objectContaining({ physicalId: 'subnet-034f6562dbbc16348', resourceType: 'AWS::EC2::Subnet', source: 'cloudformation-query' }),
-                    expect.objectContaining({ physicalId: 'subnet-0b8be2b82aeb5cdec', resourceType: 'AWS::EC2::Subnet', source: 'cloudformation-query' }),
-                    expect.objectContaining({ physicalId: 'nat-022660c36a47e2d79', resourceType: 'AWS::EC2::NatGateway', source: 'cloudformation-query' })
-                ])
-            );
-        });
-    });
 });
 

package/infrastructure/domains/networking/vpc-resolver.js

@@ -23,7 +23,6 @@ class VpcResourceResolver extends BaseResourceResolver {
      */
     resolveVpc(appDefinition, discovery) {
         const userIntent = appDefinition.vpc?.ownership?.vpc || 'auto';
-        const vpcManagement = appDefinition.vpc?.management; // Legacy config
 
         // Explicit external
         if (userIntent === 'external') {
@@ -44,35 +43,20 @@ class VpcResourceResolver extends BaseResourceResolver {
         }
 
         // Auto-decide
-        const decision = this.resolveResourceOwnership(
+        return this.resolveResourceOwnership(
             'auto',
             'FriggVPC',
             'AWS::EC2::VPC',
             discovery
         );
-
-        // CRITICAL: If auto-resolution wants to create a VPC but management mode is 'discover' (or undefined),
-        // throw an error instead. Creating a VPC is expensive and should be explicit.
-        if (decision.ownership === ResourceOwnership.STACK && 
-            !decision.physicalId && 
-            vpcManagement !== 'create-new' &&
-            userIntent === 'auto') {
-            throw new Error(
-                'VPC discovery failed: No VPC found. ' +
-                'Either set vpc.management to "create-new" or provide vpc.vpcId with vpc.management "use-existing".'
-            );
-        }
-
-        return decision;
     }
 
     /**
      * Resolve Security Group ownership
      *
-     * Logic:
-     * - If FriggLambdaSecurityGroup exists in stack → STACK (keep it)
-     * - If default SG discovered from VPC → EXTERNAL (use it)
-     * - Otherwise → STACK (create FriggLambdaSecurityGroup)
+     * Special logic: We ALWAYS create our own FriggLambdaSecurityGroup with specific
+     * rules unless the user explicitly provides external SG IDs. The discovered
+     * defaultSecurityGroupId is the VPC's default SG, but we need our own Lambda SG.
      *
      * @param {Object} appDefinition - App definition
      * @param {Object} discovery - Discovery result
@@ -81,7 +65,7 @@ class VpcResourceResolver extends BaseResourceResolver {
     resolveSecurityGroup(appDefinition, discovery) {
         const userIntent = appDefinition.vpc?.ownership?.securityGroup || 'auto';
 
-        // Explicit external - use provided SG IDs
+        // Explicit external - only use external SGs if user explicitly provides them
         if (userIntent === 'external') {
             this.requireExternalIds(
                 appDefinition.vpc?.external?.securityGroupIds,
@@ -93,52 +77,21 @@ class VpcResourceResolver extends BaseResourceResolver {
             );
         }
 
-        // Explicit stack - always create FriggLambdaSecurityGroup
-        if (userIntent === 'stack') {
-            const inStack = this.findInStack('FriggLambdaSecurityGroup', discovery);
-            return this.createStackDecision(
-                inStack?.physicalId,
-                inStack 
-                    ? 'Found FriggLambdaSecurityGroup in CloudFormation stack'
-                    : 'User specified ownership=stack - will create FriggLambdaSecurityGroup'
-            );
-        }
-
-        // Auto mode: Check stack first, then check for discovered default SG
+        // For stack or auto: check if FriggLambdaSecurityGroup exists in stack
+        // If it does, reuse it. If not, create it. Never use discovered default SG.
         const inStack = this.findInStack('FriggLambdaSecurityGroup', discovery);
 
         if (inStack) {
             return this.createStackDecision(
                 inStack.physicalId,
-                'Found FriggLambdaSecurityGroup in CloudFormation stack - must keep in template'
-            );
-        }
-
-        // Also check flat discovery for lambdaSecurityGroupId (from CloudFormation extraction)
-        const structured = discovery._structured || discovery;
-        const lambdaSgId = structured.lambdaSecurityGroupId || discovery.lambdaSecurityGroupId;
-        
-        if (lambdaSgId) {
-            return this.createStackDecision(
-                lambdaSgId,
-                'Found FriggLambdaSecurityGroup in CloudFormation stack - must keep in template'
-            );
-        }
-
-        // Check for discovered default security group (from external VPC pattern)
-        const defaultSgId = structured.defaultSecurityGroupId || discovery.defaultSecurityGroupId;
-        
-        if (defaultSgId) {
-            return this.createExternalDecision(
-                [defaultSgId],
-                'Found default security group via discovery - will reuse (matches canary behavior)'
+                'Found FriggLambdaSecurityGroup in CloudFormation stack'
             );
         }
 
-        // No SG found anywhere - create new FriggLambdaSecurityGroup
+        // Create new FriggLambdaSecurityGroup in stack
         return this.createStackDecision(
             null,
-            'No security group found - will create FriggLambdaSecurityGroup in stack'
+            'No existing FriggLambdaSecurityGroup - will create in stack'
         );
     }
 

package/infrastructure/domains/networking/vpc-resolver.test.js

@@ -109,46 +109,6 @@ describe('VpcResourceResolver', () => {
             expect(decision.physicalId).toBeUndefined();
             expect(decision.reason).toContain('No existing resource found');
         });
-
-        it('should throw error when auto mode finds no VPC and management is not create-new', () => {
-            const appDefinition = {
-                vpc: {
-                    enable: true,
-                    // No management specified - defaults to discover
-                    // No ownership specified - defaults to auto
-                }
-            };
-            const discovery = { 
-                stackManaged: [], 
-                external: [], 
-                fromCloudFormation: false 
-            };
-
-            // Should throw error instead of trying to create VPC
-            expect(() => resolver.resolveVpc(appDefinition, discovery)).toThrow(
-                'VPC discovery failed: No VPC found'
-            );
-        });
-
-        it('should allow creating VPC when management is create-new', () => {
-            const appDefinition = {
-                vpc: {
-                    enable: true,
-                    management: 'create-new'
-                }
-            };
-            const discovery = { 
-                stackManaged: [], 
-                external: [], 
-                fromCloudFormation: false 
-            };
-
-            // Should NOT throw - create-new explicitly allows VPC creation
-            const decision = resolver.resolveVpc(appDefinition, discovery);
-            
-            expect(decision.ownership).toBe(ResourceOwnership.STACK);
-            expect(decision.physicalId).toBeNull();
-        });
     });
 
     describe('resolveSecurityGroup', () => {