@friggframework/devtools 2.0.0--canary.490.df708d7.0 → 2.0.0--canary.490.a308628.0

package/infrastructure/domains/networking/vpc-resolver.js

@@ -27,10 +27,31 @@ class VpcResourceResolver extends BaseResourceResolver {
 
         // Explicit external
         if (userIntent === 'external') {
-            this.requireExternalIds(appDefinition.vpc?.external?.vpcId, 'vpcId');
-            return this.createExternalDecision(
-                appDefinition.vpc.external.vpcId,
-                'User specified ownership=external for VPC'
+            const externalVpcId = appDefinition.vpc?.external?.vpcId;
+            
+            // If hardcoded ID provided, use it
+            if (externalVpcId) {
+                return this.createExternalDecision(
+                    externalVpcId,
+                    'User specified ownership=external with hardcoded vpcId'
+                );
+            }
+            
+            // No hardcoded ID - try discovery
+            const discoveredVpcId = discovery.defaultVpcId;
+            
+            if (discoveredVpcId) {
+                return this.createExternalDecision(
+                    discoveredVpcId,
+                    'User specified ownership=external - using discovered VPC'
+                );
+            }
+            
+            // Discovery found nothing - error
+            throw new Error(
+                "ownership='external' for VPC requires either:\n" +
+                "  1. Hardcoded external.vpcId, OR\n" +
+                "  2. A VPC discovered via AWS discovery"
             );
         }
 
@@ -81,15 +102,34 @@ class VpcResourceResolver extends BaseResourceResolver {
     resolveSecurityGroup(appDefinition, discovery) {
         const userIntent = appDefinition.vpc?.ownership?.securityGroup || 'auto';
 
-        // Explicit external - use provided SG IDs
+        // Explicit external
         if (userIntent === 'external') {
-            this.requireExternalIds(
-                appDefinition.vpc?.external?.securityGroupIds,
-                'securityGroupIds'
-            );
-            return this.createExternalDecision(
-                appDefinition.vpc.external.securityGroupIds,
-                'User specified ownership=external for security group'
+            const externalIds = appDefinition.vpc?.external?.securityGroupIds;
+            
+            // If hardcoded IDs provided, use those
+            if (externalIds && externalIds.length > 0) {
+                return this.createExternalDecision(
+                    externalIds,
+                    'User specified ownership=external with hardcoded securityGroupIds'
+                );
+            }
+            
+            // No hardcoded IDs - try discovery
+            const structured = discovery._structured || discovery;
+            const defaultSgId = structured.defaultSecurityGroupId || discovery.defaultSecurityGroupId;
+            
+            if (defaultSgId) {
+                return this.createExternalDecision(
+                    [defaultSgId],
+                    'User specified ownership=external - using discovered default security group'
+                );
+            }
+            
+            // Discovery found nothing - error
+            throw new Error(
+                "ownership='external' for securityGroup requires either:\n" +
+                "  1. Hardcoded external.securityGroupIds array, OR\n" +
+                "  2. A default security group discovered via AWS discovery"
             );
         }
 
@@ -153,13 +193,32 @@ class VpcResourceResolver extends BaseResourceResolver {
 
         // Explicit external
         if (userIntent === 'external') {
-            this.requireExternalIds(
-                appDefinition.vpc?.external?.subnetIds,
-                'subnetIds'
-            );
-            return this.createExternalDecision(
-                appDefinition.vpc.external.subnetIds,
-                'User specified ownership=external for subnets'
+            const externalSubnetIds = appDefinition.vpc?.external?.subnetIds;
+            
+            // If hardcoded IDs provided, use those
+            if (externalSubnetIds && externalSubnetIds.length >= 2) {
+                return this.createExternalDecision(
+                    externalSubnetIds,
+                    'User specified ownership=external with hardcoded subnetIds'
+                );
+            }
+            
+            // No hardcoded IDs - try discovery
+            const discoveredSubnet1 = discovery.privateSubnetId1;
+            const discoveredSubnet2 = discovery.privateSubnetId2;
+            
+            if (discoveredSubnet1 && discoveredSubnet2) {
+                return this.createExternalDecision(
+                    [discoveredSubnet1, discoveredSubnet2],
+                    'User specified ownership=external - using discovered subnets'
+                );
+            }
+            
+            // Discovery found nothing - error
+            throw new Error(
+                "ownership='external' for subnets requires either:\n" +
+                "  1. Hardcoded external.subnetIds array (minimum 2), OR\n" +
+                "  2. At least 2 subnets discovered via AWS discovery"
             );
         }
 
@@ -247,13 +306,31 @@ class VpcResourceResolver extends BaseResourceResolver {
 
         // Explicit external
         if (userIntent === 'external') {
-            this.requireExternalIds(
-                appDefinition.vpc?.external?.natGatewayId,
-                'natGatewayId'
-            );
-            return this.createExternalDecision(
-                appDefinition.vpc.external.natGatewayId,
-                'User specified ownership=external for NAT gateway'
+            const externalNatId = appDefinition.vpc?.external?.natGatewayId;
+            
+            // If hardcoded ID provided, use it
+            if (externalNatId) {
+                return this.createExternalDecision(
+                    externalNatId,
+                    'User specified ownership=external with hardcoded natGatewayId'
+                );
+            }
+            
+            // No hardcoded ID - try discovery
+            const discoveredNatId = discovery.natGatewayId;
+            
+            if (discoveredNatId) {
+                return this.createExternalDecision(
+                    discoveredNatId,
+                    'User specified ownership=external - using discovered NAT gateway'
+                );
+            }
+            
+            // Discovery found nothing - error
+            throw new Error(
+                "ownership='external' for NAT gateway requires either:\n" +
+                "  1. Hardcoded external.natGatewayId, OR\n" +
+                "  2. A NAT gateway discovered via AWS discovery"
             );
         }
 
@@ -302,21 +379,14 @@ class VpcResourceResolver extends BaseResourceResolver {
 
         // DynamoDB endpoint only needed if using DynamoDB (not MongoDB or PostgreSQL)
         // Currently framework only supports MongoDB (via Prisma) and PostgreSQL (via Aurora)
-        // DynamoDB support is not implemented, so endpoint is not needed
+        // If not using DynamoDB, skip the endpoint (CloudFormation will delete if it exists)
         const usesDynamoDB = appDefinition.database?.dynamodb?.enable === true;
-        
-        // Special case: If DynamoDB endpoint exists in stack but not needed, preserve it
-        // to avoid deletion (user may have enabled it previously)
-        const dynamoDbInStack = this.isInStack('FriggDynamoDBVPCEndpoint', discovery);
-        const shouldPreserveDynamoDB = !usesDynamoDB && dynamoDbInStack;
 
         const endpoints = {
             s3: this._resolveEndpoint('FriggS3VPCEndpoint', 's3', userIntent, appDefinition, discovery),
             dynamodb: usesDynamoDB
                 ? this._resolveEndpoint('FriggDynamoDBVPCEndpoint', 'dynamodb', userIntent, appDefinition, discovery)
-                : shouldPreserveDynamoDB
-                    ? this._resolveEndpoint('FriggDynamoDBVPCEndpoint', 'dynamodb', userIntent, appDefinition, discovery)
-                    : { ownership: null, reason: 'DynamoDB endpoint not needed (application uses MongoDB/PostgreSQL, not DynamoDB)' },
+                : { ownership: null, reason: 'DynamoDB endpoint not needed (application uses MongoDB/PostgreSQL, not DynamoDB)' },
             kms: needsKms
                 ? this._resolveEndpoint('FriggKMSVPCEndpoint', 'kms', userIntent, appDefinition, discovery)
                 : { ownership: null, reason: 'KMS endpoint not needed (encryption method is not KMS)' },

package/infrastructure/domains/networking/vpc-resolver.test.js

@@ -9,7 +9,7 @@ describe('VpcResourceResolver', () => {
     });
 
     describe('resolveVpc', () => {
-        it('should resolve to EXTERNAL when user specifies external', () => {
+        it('should resolve to EXTERNAL with hardcoded vpcId', () => {
             const appDefinition = {
                 vpc: {
                     ownership: { vpc: 'external' },
@@ -22,20 +22,46 @@ describe('VpcResourceResolver', () => {
 
             expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
             expect(decision.physicalId).toBe('vpc-external-123');
-            expect(decision.reason).toContain('User specified ownership=external');
+            expect(decision.reason).toContain('hardcoded vpcId');
         });
 
-        it('should throw when external specified but vpcId missing', () => {
+        it('should resolve to EXTERNAL using discovered VPC when no hardcoded ID', () => {
             const appDefinition = {
                 vpc: {
-                    ownership: { vpc: 'external' },
-                    external: {}
+                    ownership: { vpc: 'external' }
+                    // No external.vpcId provided
                 }
             };
-            const discovery = { stackManaged: [], external: [], fromCloudFormation: false };
+            const discovery = {
+                stackManaged: [],
+                external: [],
+                fromCloudFormation: false,
+                defaultVpcId: 'vpc-discovered-123'
+            };
+
+            const decision = resolver.resolveVpc(appDefinition, discovery);
+
+            expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
+            expect(decision.physicalId).toBe('vpc-discovered-123');
+            expect(decision.reason).toContain('discovered VPC');
+        });
+
+        it('should throw when external specified but no vpcId and no discovery', () => {
+            const appDefinition = {
+                vpc: {
+                    ownership: { vpc: 'external' }
+                    // No external.vpcId provided
+                }
+            };
+            const discovery = {
+                stackManaged: [],
+                external: [],
+                fromCloudFormation: false
+                // No defaultVpcId discovered
+            };
 
             expect(() => resolver.resolveVpc(appDefinition, discovery)).toThrow(
-                "ownership='external' for vpcId requires external.vpcId"
+                /ownership='external' for VPC requires either/
             );
         });
 
@@ -97,17 +123,17 @@ describe('VpcResourceResolver', () => {
             expect(decision.physicalId).toBe('vpc-external');
         });
 
-        it('should auto-resolve to STACK when not found (create new)', () => {
+        it('should throw error when auto mode finds no VPC (changed behavior)', () => {
             const appDefinition = {
                 vpc: { ownership: { vpc: 'auto' } }
+                // No management specified - defaults to discover
             };
             const discovery = { stackManaged: [], external: [], fromCloudFormation: false };
 
-            const decision = resolver.resolveVpc(appDefinition, discovery);
-
-            expect(decision.ownership).toBe(ResourceOwnership.STACK);
-            expect(decision.physicalId).toBeUndefined();
-            expect(decision.reason).toContain('No existing resource found');
+            // NEW BEHAVIOR: Auto mode with no VPC found should throw error (prevent accidental VPC creation)
+            expect(() => resolver.resolveVpc(appDefinition, discovery)).toThrow(
+                'VPC discovery failed: No VPC found'
+            );
         });
 
         it('should throw error when auto mode finds no VPC and management is not create-new', () => {
@@ -134,7 +160,8 @@ describe('VpcResourceResolver', () => {
             const appDefinition = {
                 vpc: {
                     enable: true,
-                    management: 'create-new'
+                    management: 'create-new',
+                    ownership: { vpc: 'auto' }
                 }
             };
             const discovery = { 
@@ -147,12 +174,12 @@ describe('VpcResourceResolver', () => {
             const decision = resolver.resolveVpc(appDefinition, discovery);
             
             expect(decision.ownership).toBe(ResourceOwnership.STACK);
-            expect(decision.physicalId).toBeNull();
+            expect(decision.physicalId).toBeUndefined(); // resolveResourceOwnership returns undefined, not null
         });
     });
 
     describe('resolveSecurityGroup', () => {
-        it('should resolve to EXTERNAL with user-provided IDs', () => {
+        it('should resolve to EXTERNAL with user-provided hardcoded IDs', () => {
             const appDefinition = {
                 vpc: {
                     ownership: { securityGroup: 'external' },
@@ -165,6 +192,47 @@ describe('VpcResourceResolver', () => {
 
             expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
             expect(decision.physicalIds).toEqual(['sg-1', 'sg-2']);
+            expect(decision.reason).toContain('hardcoded');
+        });
+
+        it('should resolve to EXTERNAL using discovered default SG when no hardcoded IDs', () => {
+            const appDefinition = {
+                vpc: {
+                    ownership: { securityGroup: 'external' }
+                    // No external.securityGroupIds provided
+                }
+            };
+            const discovery = {
+                stackManaged: [],
+                external: [],
+                fromCloudFormation: false,
+                defaultSecurityGroupId: 'sg-discovered-default'
+            };
+
+            const decision = resolver.resolveSecurityGroup(appDefinition, discovery);
+
+            expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
+            expect(decision.physicalIds).toEqual(['sg-discovered-default']);
+            expect(decision.reason).toContain('discovered default security group');
+        });
+
+        it('should throw error when ownership=external but no IDs and no discovery', () => {
+            const appDefinition = {
+                vpc: {
+                    ownership: { securityGroup: 'external' }
+                    // No external.securityGroupIds provided
+                }
+            };
+            const discovery = {
+                stackManaged: [],
+                external: [],
+                fromCloudFormation: false
+                // No defaultSecurityGroupId discovered
+            };
+
+            expect(() => resolver.resolveSecurityGroup(appDefinition, discovery)).toThrow(
+                /ownership='external' for securityGroup requires either/
+            );
         });
 
         it('should auto-resolve to STACK when FriggLambdaSecurityGroup in stack', () => {
@@ -186,7 +254,7 @@ describe('VpcResourceResolver', () => {
     });
 
     describe('resolveSubnets', () => {
-        it('should resolve to EXTERNAL with user-provided subnet IDs', () => {
+        it('should resolve to EXTERNAL with user-provided hardcoded subnet IDs', () => {
             const appDefinition = {
                 vpc: {
                     ownership: { subnets: 'external' },
@@ -199,6 +267,48 @@ describe('VpcResourceResolver', () => {
 
             expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
             expect(decision.physicalIds).toEqual(['subnet-1', 'subnet-2', 'subnet-3']);
+            expect(decision.reason).toContain('hardcoded');
+        });
+
+        it('should resolve to EXTERNAL using discovered subnets when no hardcoded IDs', () => {
+            const appDefinition = {
+                vpc: {
+                    ownership: { subnets: 'external' }
+                    // No external.subnetIds provided
+                }
+            };
+            const discovery = {
+                stackManaged: [],
+                external: [],
+                fromCloudFormation: false,
+                privateSubnetId1: 'subnet-discovered-1',
+                privateSubnetId2: 'subnet-discovered-2'
+            };
+
+            const decision = resolver.resolveSubnets(appDefinition, discovery);
+
+            expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
+            expect(decision.physicalIds).toEqual(['subnet-discovered-1', 'subnet-discovered-2']);
+            expect(decision.reason).toContain('discovered subnets');
+        });
+
+        it('should throw error when ownership=external but no IDs and no discovery', () => {
+            const appDefinition = {
+                vpc: {
+                    ownership: { subnets: 'external' }
+                    // No external.subnetIds provided
+                }
+            };
+            const discovery = {
+                stackManaged: [],
+                external: [],
+                fromCloudFormation: false
+                // No privateSubnetId1/2 discovered
+            };
+
+            expect(() => resolver.resolveSubnets(appDefinition, discovery)).toThrow(
+                /ownership='external' for subnets requires either/
+            );
         });
 
         it('should resolve to STACK when subnets found in stack', () => {
@@ -267,7 +377,7 @@ describe('VpcResourceResolver', () => {
             expect(decision.reason).toContain('NAT Gateway disabled');
         });
 
-        it('should resolve to EXTERNAL with user-provided ID', () => {
+        it('should resolve to EXTERNAL with user-provided hardcoded ID', () => {
             const appDefinition = {
                 vpc: {
                     ownership: { natGateway: 'external' },
@@ -280,6 +390,47 @@ describe('VpcResourceResolver', () => {
 
             expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
             expect(decision.physicalId).toBe('nat-external-123');
+            expect(decision.reason).toContain('hardcoded');
+        });
+
+        it('should resolve to EXTERNAL using discovered NAT when no hardcoded ID', () => {
+            const appDefinition = {
+                vpc: {
+                    ownership: { natGateway: 'external' }
+                    // No external.natGatewayId provided
+                }
+            };
+            const discovery = {
+                stackManaged: [],
+                external: [],
+                fromCloudFormation: false,
+                natGatewayId: 'nat-discovered-123'
+            };
+
+            const decision = resolver.resolveNatGateway(appDefinition, discovery);
+
+            expect(decision.ownership).toBe(ResourceOwnership.EXTERNAL);
+            expect(decision.physicalId).toBe('nat-discovered-123');
+            expect(decision.reason).toContain('discovered NAT gateway');
+        });
+
+        it('should throw error when ownership=external but no ID and no discovery', () => {
+            const appDefinition = {
+                vpc: {
+                    ownership: { natGateway: 'external' }
+                    // No external.natGatewayId provided
+                }
+            };
+            const discovery = {
+                stackManaged: [],
+                external: [],
+                fromCloudFormation: false
+                // No natGatewayId discovered
+            };
+
+            expect(() => resolver.resolveNatGateway(appDefinition, discovery)).toThrow(
+                /ownership='external' for NAT gateway requires either/
+            );
         });
 
         it('should auto-resolve to STACK when found in stack', () => {
@@ -355,7 +506,7 @@ describe('VpcResourceResolver', () => {
             expect(decisions.dynamodb.ownership).toBe('stack'); // DynamoDB needed
         });
 
-        it('should preserve DynamoDB endpoint if exists in stack even when not needed', () => {
+        it('should allow deletion of DynamoDB endpoint when not needed', () => {
             const appDefinition = {
                 vpc: { ownership: { vpcEndpoints: 'auto' } },
                 database: { mongoDB: { enable: true } }, // Using MongoDB (DynamoDB not needed)
@@ -370,9 +521,9 @@ describe('VpcResourceResolver', () => {
 
             const decisions = resolver.resolveVpcEndpoints(appDefinition, discovery);
 
-            // Should preserve (not delete) even though not actively needed
-            expect(decisions.dynamodb.ownership).toBe('stack');
-            expect(decisions.dynamodb.physicalId).toBe('vpce-ddb-legacy');
+            // Should return null (allow CloudFormation to delete it since not needed)
+            expect(decisions.dynamodb.ownership).toBeNull();
+            expect(decisions.dynamodb.reason).toContain('MongoDB/PostgreSQL');
         });
 
 
@@ -404,7 +555,8 @@ describe('VpcResourceResolver', () => {
                             dynamodb: 'vpce-ddb-456'
                         }
                     }
-                }
+                },
+                database: { dynamodb: { enable: true } } // Enable DynamoDB
             };
             const discovery = { stackManaged: [], external: [], fromCloudFormation: false };
 
@@ -418,7 +570,10 @@ describe('VpcResourceResolver', () => {
         });
 
         it('should auto-resolve to STACK when endpoints found in stack', () => {
-            const appDefinition = { vpc: { ownership: { vpcEndpoints: 'auto' } } };
+            const appDefinition = {
+                vpc: { ownership: { vpcEndpoints: 'auto' } },
+                database: { dynamodb: { enable: true } } // Enable DynamoDB
+            };
             const discovery = {
                 stackManaged: [
                     { logicalId: 'FriggS3VPCEndpoint', physicalId: 'vpce-s3-stack', resourceType: 'AWS::EC2::VPCEndpoint' },
@@ -439,7 +594,8 @@ describe('VpcResourceResolver', () => {
         it('should auto-resolve mixed: some in stack, some new', () => {
             const appDefinition = {
                 vpc: { ownership: { vpcEndpoints: 'auto' } },
-                encryption: { fieldLevelEncryptionMethod: 'kms' }  // Enable KMS endpoint
+                encryption: { fieldLevelEncryptionMethod: 'kms' },  // Enable KMS endpoint
+                database: { dynamodb: { enable: true } }  // Enable DynamoDB
             };
             const discovery = {
                 stackManaged: [
@@ -536,7 +692,11 @@ describe('VpcResourceResolver', () => {
     describe('real-world scenarios', () => {
         it('scenario: fresh deploy, no resources exist', () => {
             const appDefinition = {
-                vpc: { enable: true, ownership: {} }
+                vpc: { 
+                    enable: true, 
+                    ownership: {},
+                    management: 'create-new' // Explicitly allow VPC creation
+                }
             };
             const discovery = { stackManaged: [], external: [], fromCloudFormation: false };
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.490.df708d7.0",
+  "version": "2.0.0--canary.490.a308628.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -16,9 +16,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.490.df708d7.0",
-    "@friggframework/schemas": "2.0.0--canary.490.df708d7.0",
-    "@friggframework/test": "2.0.0--canary.490.df708d7.0",
+    "@friggframework/core": "2.0.0--canary.490.a308628.0",
+    "@friggframework/schemas": "2.0.0--canary.490.a308628.0",
+    "@friggframework/test": "2.0.0--canary.490.a308628.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -46,8 +46,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.490.df708d7.0",
-    "@friggframework/prettier-config": "2.0.0--canary.490.df708d7.0",
+    "@friggframework/eslint-config": "2.0.0--canary.490.a308628.0",
+    "@friggframework/prettier-config": "2.0.0--canary.490.a308628.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -79,5 +79,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "df708d7b3a84f180a3edc5267375f9210e6a585a"
+  "gitHead": "a308628470332edb561e569dc860fcc8f20b83ff"
 }