@friggframework/devtools 2.0.0--canary.490.feacde9.0 → 2.0.0--canary.497.a3f25f9.0

package/infrastructure/domains/networking/vpc-builder.test.js

@@ -398,93 +398,19 @@ describe('VpcBuilder', () => {
             expect(result.resources.FriggS3VPCEndpoint.Properties.VpcId).toBe('vpc-123');
         });
 
-        it('should add stack-managed security group back to template to prevent deletion', async () => {
+        it('should reuse stack-managed VPC endpoints without creating CloudFormation resources', async () => {
             const appDefinition = {
-                vpc: { enable: true },
-            };
-            
-            const discoveredResources = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: ['FriggLambdaSecurityGroup'],
-                defaultVpcId: 'vpc-123',
-                privateSubnetId1: 'subnet-1',
-                privateSubnetId2: 'subnet-2',
-                lambdaSecurityGroupId: 'sg-existing-stack', // Existing in stack
-            };
-
-            const result = await vpcBuilder.build(appDefinition, discoveredResources);
-
-            // CRITICAL: Must RE-ADD stack-managed SG to template or CloudFormation will DELETE it
-            expect(result.resources.FriggLambdaSecurityGroup).toBeDefined();
-            expect(result.resources.FriggLambdaSecurityGroup.Type).toBe('AWS::EC2::SecurityGroup');
-            expect(result.resources.FriggLambdaSecurityGroup.Properties.VpcId).toBe('vpc-123');
-            expect(result.resources.FriggLambdaSecurityGroup.Properties.GroupDescription).toBeDefined();
-            
-            // Should use Ref in Lambda config (not recreating)
-            expect(result.vpcConfig.securityGroupIds).toContainEqual({ Ref: 'FriggLambdaSecurityGroup' });
-        });
-
-        it('should add stack-managed subnets back to template to prevent deletion', async () => {
-            const appDefinition = {
-                vpc: { enable: true },
-            };
-            
-            const discoveredResources = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: ['FriggPrivateSubnet1', 'FriggPrivateSubnet2'],
-                defaultVpcId: 'vpc-123',
-                // Subnets exist in stack with specific IDs
-                privateSubnetId1: 'subnet-existing-1',
-                privateSubnetId2: 'subnet-existing-2',
-            };
-
-            const result = await vpcBuilder.build(appDefinition, discoveredResources);
-
-            // CRITICAL: Must RE-ADD stack-managed subnets to template or CloudFormation will DELETE them
-            expect(result.resources.FriggPrivateSubnet1).toBeDefined();
-            expect(result.resources.FriggPrivateSubnet1.Type).toBe('AWS::EC2::Subnet');
-            expect(result.resources.FriggPrivateSubnet1.Properties.VpcId).toBe('vpc-123');
-            
-            expect(result.resources.FriggPrivateSubnet2).toBeDefined();
-            expect(result.resources.FriggPrivateSubnet2.Type).toBe('AWS::EC2::Subnet');
-            expect(result.resources.FriggPrivateSubnet2.Properties.VpcId).toBe('vpc-123');
-            
-            // Should use Refs (not external IDs)
-            expect(result.vpcConfig.subnetIds).toEqual([
-                { Ref: 'FriggPrivateSubnet1' },
-                { Ref: 'FriggPrivateSubnet2' }
-            ]);
-        });
-
-        it('should add stack-managed VPC endpoints back to template to prevent deletion', async () => {
-            const appDefinition = {
-                vpc: { enable: true },
+                vpc: { enable: true, enableVPCEndpoints: true },
                 encryption: { fieldLevelEncryptionMethod: 'kms' },
+                database: { postgres: { enable: true } },
             };
-            
-            // Structured discovery from CloudFormation
             const discoveredResources = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: [
-                    'FriggLambdaSecurityGroup',
-                    'FriggLambdaRouteTable',
-                    'FriggS3VPCEndpoint',
-                    'FriggDynamoDBVPCEndpoint',
-                    'FriggKMSVPCEndpoint',
-                    'FriggSecretsManagerVPCEndpoint',
-                    'FriggSQSVPCEndpoint'
-                ],
                 defaultVpcId: 'vpc-123',
                 privateSubnetId1: 'subnet-1',
                 privateSubnetId2: 'subnet-2',
-                routeTableId: 'rtb-123',
-                lambdaSecurityGroupId: 'sg-123',
-                // VPC endpoints discovered in stack
+                // VPC endpoints from CloudFormation stack (string IDs)
                 s3VpcEndpointId: 'vpce-s3-stack',
-                dynamodbVpcEndpointId: 'vpce-ddb-stack',
+                dynamoDbVpcEndpointId: 'vpce-ddb-stack',
                 kmsVpcEndpointId: 'vpce-kms-stack',
                 secretsManagerVpcEndpointId: 'vpce-sm-stack',
                 sqsVpcEndpointId: 'vpce-sqs-stack',
@@ -492,30 +418,15 @@ describe('VpcBuilder', () => {
 
             const result = await vpcBuilder.build(appDefinition, discoveredResources);
 
-            // CRITICAL: Must RE-ADD stack-managed endpoints to template or CloudFormation will DELETE them
-            expect(result.resources.FriggS3VPCEndpoint).toBeDefined();
-            expect(result.resources.FriggS3VPCEndpoint.Type).toBe('AWS::EC2::VPCEndpoint');
-            expect(result.resources.FriggS3VPCEndpoint.Properties.VpcEndpointType).toBe('Gateway');
-            
-            expect(result.resources.FriggDynamoDBVPCEndpoint).toBeDefined();
-            expect(result.resources.FriggDynamoDBVPCEndpoint.Type).toBe('AWS::EC2::VPCEndpoint');
-            expect(result.resources.FriggDynamoDBVPCEndpoint.Properties.VpcEndpointType).toBe('Gateway');
-            
-            expect(result.resources.FriggKMSVPCEndpoint).toBeDefined();
-            expect(result.resources.FriggKMSVPCEndpoint.Type).toBe('AWS::EC2::VPCEndpoint');
-            expect(result.resources.FriggKMSVPCEndpoint.Properties.VpcEndpointType).toBe('Interface');
-            
-            expect(result.resources.FriggSecretsManagerVPCEndpoint).toBeDefined();
-            expect(result.resources.FriggSecretsManagerVPCEndpoint.Type).toBe('AWS::EC2::VPCEndpoint');
-            expect(result.resources.FriggSecretsManagerVPCEndpoint.Properties.VpcEndpointType).toBe('Interface');
-            
-            expect(result.resources.FriggSQSVPCEndpoint).toBeDefined();
-            expect(result.resources.FriggSQSVPCEndpoint.Type).toBe('AWS::EC2::VPCEndpoint');
-            expect(result.resources.FriggSQSVPCEndpoint.Properties.VpcEndpointType).toBe('Interface');
+            // Should NOT create CloudFormation resources (reuse stack endpoints)
+            expect(result.resources.FriggS3VPCEndpoint).toBeUndefined();
+            expect(result.resources.FriggDynamoDBVPCEndpoint).toBeUndefined();
+            expect(result.resources.FriggKMSVPCEndpoint).toBeUndefined();
+            expect(result.resources.FriggSecretsManagerVPCEndpoint).toBeUndefined();
+            expect(result.resources.FriggSQSVPCEndpoint).toBeUndefined();
 
-            // Should create VPC Endpoint Security Group for interface endpoints
-            expect(result.resources.FriggVPCEndpointSecurityGroup).toBeDefined();
-            expect(result.resources.FriggVPCEndpointSecurityGroup.Type).toBe('AWS::EC2::SecurityGroup');
+            // Should still NOT create VPC Endpoint Security Group
+            expect(result.resources.FriggVPCEndpointSecurityGroup).toBeUndefined();
         });
 
         it('should create VPC endpoints when discovered from AWS but not stack', async () => {
@@ -804,35 +715,6 @@ describe('VpcBuilder', () => {
             expect(result.resources.FriggPrivateSubnet2RouteTableAssociation.Properties.RouteTableId).toEqual({ Ref: 'FriggLambdaRouteTable' });
         });
 
-        it('should add UpdateReplacePolicy to force association recreation on updates', async () => {
-            const appDefinition = {
-                vpc: {
-                    enable: true,
-                    management: 'discover',
-                    subnets: { management: 'discover' },
-                    natGateway: { management: 'discover' },
-                },
-            };
-
-            const discoveredResources = {
-                vpcId: 'vpc-123',
-                privateSubnetId1: 'subnet-existing-1',
-                privateSubnetId2: 'subnet-existing-2',
-                natGatewayId: 'nat-existing',
-                routeTableId: 'rtb-old',
-                existingLogicalIds: ['FriggSubnet1RouteAssociation', 'FriggSubnet2RouteAssociation'],
-            };
-
-            const result = await vpcBuilder.build(appDefinition, discoveredResources);
-
-            // Verify associations have UpdateReplacePolicy to force recreation
-            expect(result.resources.FriggSubnet1RouteAssociation.UpdateReplacePolicy).toBe('Delete');
-            expect(result.resources.FriggSubnet2RouteAssociation.UpdateReplacePolicy).toBe('Delete');
-            
-            // This forces CloudFormation to delete old associations and create new ones
-            // instead of trying to update them in-place (which doesn't work)
-        });
-
         it('should not create NAT when existing NAT is properly placed', async () => {
             const appDefinition = {
                 vpc: {
@@ -1376,585 +1258,5 @@ describe('VpcBuilder', () => {
             expect(result.outputs.PrivateSubnet2Id).toBeDefined();
         });
     });
-
-    describe('External VPC with stack-managed routing infrastructure pattern', () => {
-        it('should correctly handle external VPC with NEW logical IDs (FriggPrivateRoute pattern)', async () => {
-            // This pattern occurs when VPC/subnets/NAT are external but routing (route tables,
-            // VPC endpoints, security groups) are managed by CloudFormation stack
-            // This tests the NEWER naming convention
-            const appDefinition = {
-                vpc: { enable: true },
-                encryption: { fieldLevelEncryptionMethod: 'kms' },
-                database: {
-                    dynamodb: { enable: true }  // Enable DynamoDB to create DynamoDB VPC endpoint
-                }
-            };
-            
-            // Discovery results from real-world production scenario (newer stack)
-            const discoveredResources = {
-                fromCloudFormationStack: true,
-                stackName: 'test-production-stack',
-                existingLogicalIds: [
-                    'FriggLambdaSecurityGroup',
-                    'FriggLambdaRouteTable',
-                    'FriggPrivateRoute',  // NEW naming
-                    'FriggPrivateSubnet1RouteTableAssociation',  // NEW naming
-                    'FriggPrivateSubnet2RouteTableAssociation',  // NEW naming
-                    'FriggS3VPCEndpoint',  // NEW naming
-                    'FriggDynamoDBVPCEndpoint',  // NEW naming
-                    'FriggKMSVPCEndpoint'  // NEW naming
-                ],
-                // Stack resources (from CloudFormation)
-                lambdaSecurityGroupId: 'sg-01002240c6a446202',
-                routeTableId: 'rtb-08af43bbf0775602d',
-                s3VpcEndpointId: 'vpce-0d1ecb2c53ce9b4b8',
-                dynamodbVpcEndpointId: 'vpce-0fb749b207f1020b0',
-                kmsVpcEndpointId: 'vpce-0e38c25155b86de22',
-                // External resources (discovered via queries)
-                defaultVpcId: 'vpc-0cd17c0e06cb28b28',
-                privateSubnetId1: 'subnet-034f6562dbbc16348',
-                privateSubnetId2: 'subnet-0b8be2b82aeb5cdec',
-                existingNatGatewayId: 'nat-022660c36a47e2d79'
-            };
-
-            const result = await vpcBuilder.build(appDefinition, discoveredResources);
-
-            // === ASSERTIONS: Template Structure ===
-            
-            // 1. VPC should be external (not in template)
-            expect(result.resources.FriggVPC).toBeUndefined();
-            expect(result.vpcId).toBe('vpc-0cd17c0e06cb28b28');
-            
-            // 2. Security Group MUST be in template (stack-managed)
-            expect(result.resources.FriggLambdaSecurityGroup).toBeDefined();
-            expect(result.resources.FriggLambdaSecurityGroup.Type).toBe('AWS::EC2::SecurityGroup');
-            expect(result.vpcConfig.securityGroupIds).toEqual([{ Ref: 'FriggLambdaSecurityGroup' }]);
-            
-            // 3. Subnets should be external (use hardcoded IDs, not in template)
-            expect(result.resources.FriggPrivateSubnet1).toBeUndefined();
-            expect(result.resources.FriggPrivateSubnet2).toBeUndefined();
-            expect(result.vpcConfig.subnetIds).toEqual([
-                'subnet-034f6562dbbc16348',
-                'subnet-0b8be2b82aeb5cdec'
-            ]);
-            
-            // 4. NAT Gateway should be external (not in template)
-            expect(result.resources.FriggNATGateway).toBeUndefined();
-            expect(result.resources.FriggNATGatewayEIP).toBeUndefined();
-            expect(result.natGatewayId).toBe('nat-022660c36a47e2d79');
-            
-            // 5. Route table MUST be in template (stack-managed)
-            expect(result.resources.FriggLambdaRouteTable).toBeDefined();
-            expect(result.resources.FriggLambdaRouteTable.Type).toBe('AWS::EC2::RouteTable');
-            
-            // 6. Route table associations MUST be in template
-            expect(result.resources.FriggPrivateSubnet1RouteTableAssociation).toBeDefined();
-            expect(result.resources.FriggPrivateSubnet2RouteTableAssociation).toBeDefined();
-            
-            // 7. VPC Endpoints MUST be in template (stack-managed, prevents deletion)
-            expect(result.resources.FriggS3VPCEndpoint).toBeDefined();
-            expect(result.resources.FriggS3VPCEndpoint.Properties.VpcEndpointType).toBe('Gateway');
-            
-            expect(result.resources.FriggDynamoDBVPCEndpoint).toBeDefined();
-            expect(result.resources.FriggDynamoDBVPCEndpoint.Properties.VpcEndpointType).toBe('Gateway');
-            
-            expect(result.resources.FriggKMSVPCEndpoint).toBeDefined();
-            expect(result.resources.FriggKMSVPCEndpoint.Properties.VpcEndpointType).toBe('Interface');
-            
-            // 8. VPC Endpoint Security Group needed for interface endpoints
-            expect(result.resources.FriggVPCEndpointSecurityGroup).toBeDefined();
-            
-            // === ASSERTIONS: Resource Count ===
-            const resourceKeys = Object.keys(result.resources);
-            const friggResources = resourceKeys.filter(k => k.startsWith('Frigg') || k.startsWith('VPC'));
-            
-            // Should have routing infrastructure + endpoints + security groups
-            // NOT full VPC (no FriggVPC, FriggPrivateSubnet1/2, FriggNATGateway)
-            expect(friggResources).toContain('FriggLambdaSecurityGroup');
-            expect(friggResources).toContain('FriggLambdaRouteTable');
-            expect(friggResources).toContain('FriggS3VPCEndpoint');
-            expect(friggResources).toContain('FriggDynamoDBVPCEndpoint');
-            expect(friggResources).toContain('FriggKMSVPCEndpoint');
-            expect(friggResources).not.toContain('FriggVPC');
-            expect(friggResources).not.toContain('FriggPrivateSubnet1');
-            expect(friggResources).not.toContain('FriggNATGateway');
-        });
-
-        it('should use OLD logical IDs for backwards compatibility (FriggNATRoute, VPCEndpointS3 pattern)', async () => {
-            // CRITICAL TEST: Real Frontify production stack uses OLD naming convention
-            // Stack currently has: FriggNATRoute, VPCEndpointS3, VPCEndpointDynamoDB
-            // We MUST use these same logical IDs to avoid AlreadyExists errors
-            const appDefinition = {
-                vpc: { 
-                    enable: true,
-                    ownership: {
-                        securityGroup: 'external'
-                    },
-                    external: {
-                        securityGroupIds: ['sg-0c5e0d0e4a2f5efcf']
-                    }
-                },
-                encryption: { fieldLevelEncryptionMethod: 'kms' },
-                database: {
-                    dynamodb: { enable: true }
-                }
-            };
-            
-            // Discovery results matching ACTUAL Frontify production stack
-            const discoveredResources = {
-                fromCloudFormationStack: true,
-                stackName: 'create-frigg-app-production',
-                existingLogicalIds: [
-                    'FriggLambdaRouteTable',
-                    'FriggNATRoute',  // OLD naming
-                    'FriggSubnet1RouteAssociation',  // OLD naming
-                    'FriggSubnet2RouteAssociation',  // OLD naming
-                    'VPCEndpointS3',  // OLD naming
-                    'VPCEndpointDynamoDB'  // OLD naming
-                ],
-                // Structured discovery (what resolver needs)
-                _structured: {
-                    stackManaged: [
-                        { logicalId: 'FriggLambdaRouteTable', physicalId: 'rtb-08af43bbf0775602d', resourceType: 'AWS::EC2::RouteTable' },
-                        { logicalId: 'FriggNATRoute', physicalId: 'rtb-08af43bbf0775602d|0.0.0.0/0', resourceType: 'AWS::EC2::Route' },
-                        { logicalId: 'VPCEndpointS3', physicalId: 'vpce-0352ceac2124c14be', resourceType: 'AWS::EC2::VPCEndpoint' },
-                        { logicalId: 'VPCEndpointDynamoDB', physicalId: 'vpce-0b06c4f631199ea68', resourceType: 'AWS::EC2::VPCEndpoint' }
-                    ],
-                    external: [
-                        { physicalId: 'vpc-01cd124575c683a17', resourceType: 'AWS::EC2::VPC' },
-                        { physicalId: 'sg-0c5e0d0e4a2f5efcf', resourceType: 'AWS::EC2::SecurityGroup' },
-                        { physicalId: 'subnet-0bbca02e9981df72c', resourceType: 'AWS::EC2::Subnet' },
-                        { physicalId: 'subnet-005f7092b91efaaeb', resourceType: 'AWS::EC2::Subnet' },
-                        { physicalId: 'nat-05a536cbe7056325f', resourceType: 'AWS::EC2::NatGateway' }
-                    ]
-                },
-                // Flat discovery (for backwards compatibility)
-                routeTableId: 'rtb-08af43bbf0775602d',
-                natRoute: 'rtb-08af43bbf0775602d|0.0.0.0/0',
-                s3VpcEndpointId: 'vpce-0352ceac2124c14be',
-                dynamodbVpcEndpointId: 'vpce-0b06c4f631199ea68',
-                // External resources
-                defaultVpcId: 'vpc-01cd124575c683a17',
-                defaultSecurityGroupId: 'sg-0c5e0d0e4a2f5efcf',
-                privateSubnetId1: 'subnet-0bbca02e9981df72c',
-                privateSubnetId2: 'subnet-005f7092b91efaaeb',
-                existingNatGatewayId: 'nat-05a536cbe7056325f'
-            };
-
-            const result = await vpcBuilder.build(appDefinition, discoveredResources);
-
-            // CRITICAL: Must use OLD logical IDs to match existing stack
-            expect(result.resources.FriggNATRoute).toBeDefined();
-            expect(result.resources.FriggNATRoute.Type).toBe('AWS::EC2::Route');
-            expect(result.resources.FriggPrivateRoute).toBeUndefined();  // Should NOT create new ID
-
-            expect(result.resources.FriggSubnet1RouteAssociation).toBeDefined();
-            expect(result.resources.FriggSubnet2RouteAssociation).toBeDefined();
-            expect(result.resources.FriggPrivateSubnet1RouteTableAssociation).toBeUndefined();
-            expect(result.resources.FriggPrivateSubnet2RouteTableAssociation).toBeUndefined();
-
-            expect(result.resources.VPCEndpointS3).toBeDefined();
-            expect(result.resources.VPCEndpointS3.Type).toBe('AWS::EC2::VPCEndpoint');
-            expect(result.resources.FriggS3VPCEndpoint).toBeUndefined();  // Should NOT create new ID
-
-            expect(result.resources.VPCEndpointDynamoDB).toBeDefined();
-            expect(result.resources.VPCEndpointDynamoDB.Type).toBe('AWS::EC2::VPCEndpoint');
-            expect(result.resources.FriggDynamoDBVPCEndpoint).toBeUndefined();  // Should NOT create new ID
-
-            // Route table should still be created
-            expect(result.resources.FriggLambdaRouteTable).toBeDefined();
-        });
-
-        it('should convert OLD logical IDs to structured discovery stackManaged array', () => {
-            // TDD test: Verify that VPCEndpointS3 in existingLogicalIds gets added to stackManaged
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'create-frigg-app-production',
-                existingLogicalIds: [
-                    'VPCEndpointS3',        // OLD naming
-                    'VPCEndpointDynamoDB',  // OLD naming
-                    'FriggNATRoute'         // OLD naming
-                ],
-                s3VpcEndpointId: 'vpce-0352ceac2124c14be',
-                dynamodbVpcEndpointId: 'vpce-0b06c4f631199ea68',
-                natRoute: 'rtb-xxx|0.0.0.0/0'
-            };
-
-            const structured = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // CRITICAL: Old logical IDs should be in stackManaged array
-            expect(structured.stackManaged).toContainEqual(
-                expect.objectContaining({
-                    logicalId: 'VPCEndpointS3',
-                    physicalId: 'vpce-0352ceac2124c14be',
-                    resourceType: 'AWS::EC2::VPCEndpoint'
-                })
-            );
-            expect(structured.stackManaged).toContainEqual(
-                expect.objectContaining({
-                    logicalId: 'VPCEndpointDynamoDB',
-                    physicalId: 'vpce-0b06c4f631199ea68',
-                    resourceType: 'AWS::EC2::VPCEndpoint'
-                })
-            );
-            expect(structured.stackManaged).toContainEqual(
-                expect.objectContaining({
-                    logicalId: 'FriggNATRoute',
-                    physicalId: 'rtb-xxx|0.0.0.0/0',
-                    resourceType: 'AWS::EC2::Route'
-                })
-            );
-        });
-    });
-
-    describe('convertFlatDiscoveryToStructured - Direct Properties', () => {
-        it('should copy flat discovery properties to structured discovery for resolver access', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                defaultVpcId: 'vpc-123',
-                defaultSecurityGroupId: 'sg-default-456',
-                lambdaSecurityGroupId: 'sg-lambda-789',
-                privateSubnetId1: 'subnet-1',
-                privateSubnetId2: 'subnet-2',
-                natGatewayId: 'nat-123'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // Direct properties should be copied for resolver access
-            expect(result.defaultVpcId).toBe('vpc-123');
-            expect(result.defaultSecurityGroupId).toBe('sg-default-456');
-            expect(result.lambdaSecurityGroupId).toBe('sg-lambda-789');
-            expect(result.privateSubnetId1).toBe('subnet-1');
-            expect(result.privateSubnetId2).toBe('subnet-2');
-            expect(result.natGatewayId).toBe('nat-123');
-        });
-    });
-
-    describe('VPC Endpoint Security Group with External Lambda SG', () => {
-        it('should use external Lambda SG ID (not Ref) for VPC endpoint SG when Lambda SG is external', async () => {
-            const appDefinition = {
-                vpc: {
-                    enable: true,
-                    enableVPCEndpoints: true,
-                    ownership: {
-                        securityGroup: 'external' // External Lambda SG
-                    }
-                },
-                encryption: { fieldLevelEncryptionMethod: 'kms' }
-            };
-            const discoveredResources = {
-                fromCloudFormationStack: true,
-                defaultVpcId: 'vpc-123',
-                defaultSecurityGroupId: 'sg-default-456', // Default VPC SG
-                lambdaSecurityGroupId: 'sg-stack-789',    // Stack-managed SG (will be ignored)
-                privateSubnetId1: 'subnet-1',
-                privateSubnetId2: 'subnet-2',
-                natGatewayId: 'nat-123',
-                existingLogicalIds: ['FriggS3VPCEndpoint', 'FriggKMSVPCEndpoint'],
-                s3VpcEndpointId: 'vpce-s3-stack',
-                kmsVpcEndpointId: 'vpce-kms-stack'
-            };
-
-            const result = await vpcBuilder.build(appDefinition, discoveredResources);
-
-            // VPC Endpoint SG should be created
-            expect(result.resources.FriggVPCEndpointSecurityGroup).toBeDefined();
-            
-            // CRITICAL: Should use external Lambda SG ID directly, NOT a CloudFormation Ref
-            const ingressRule = result.resources.FriggVPCEndpointSecurityGroup.Properties.SecurityGroupIngress[0];
-            expect(ingressRule.SourceSecurityGroupId).toBe('sg-default-456'); // Direct ID, not { Ref: 'FriggLambdaSecurityGroup' }
-            expect(typeof ingressRule.SourceSecurityGroupId).toBe('string');
-            
-            // Verify FriggLambdaSecurityGroup is NOT in the template
-            expect(result.resources.FriggLambdaSecurityGroup).toBeUndefined();
-        });
-
-        it('should use CloudFormation Ref when Lambda SG is stack-managed', async () => {
-            const appDefinition = {
-                vpc: {
-                    enable: true,
-                    enableVPCEndpoints: true,
-                    ownership: {
-                        securityGroup: 'stack' // Stack-managed Lambda SG
-                    }
-                },
-                encryption: { fieldLevelEncryptionMethod: 'kms' }
-            };
-            const discoveredResources = {
-                defaultVpcId: 'vpc-123',
-                privateSubnetId1: 'subnet-1',
-                privateSubnetId2: 'subnet-2'
-            };
-
-            const result = await vpcBuilder.build(appDefinition, discoveredResources);
-
-            // VPC Endpoint SG should be created
-            expect(result.resources.FriggVPCEndpointSecurityGroup).toBeDefined();
-            
-            // Should use CloudFormation Ref when Lambda SG is in stack
-            const ingressRule = result.resources.FriggVPCEndpointSecurityGroup.Properties.SecurityGroupIngress[0];
-            expect(ingressRule.SourceSecurityGroupId).toEqual({ Ref: 'FriggLambdaSecurityGroup' });
-            
-            // Verify FriggLambdaSecurityGroup IS in the template
-            expect(result.resources.FriggLambdaSecurityGroup).toBeDefined();
-        });
-    });
-
-    describe('convertFlatDiscoveryToStructured - VPC Endpoints from CloudFormation', () => {
-        it('should add VPC endpoints to stackManaged when in existingLogicalIds', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: [
-                    'FriggS3VPCEndpoint',
-                    'FriggDynamoDBVPCEndpoint',
-                    'FriggKMSVPCEndpoint'
-                ],
-                s3VpcEndpointId: 'vpce-s3-stack',
-                dynamodbVpcEndpointId: 'vpce-ddb-stack',
-                kmsVpcEndpointId: 'vpce-kms-stack'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // VPC endpoints should be in stackManaged (not external)
-            expect(result.stackManaged).toContainEqual(
-                expect.objectContaining({
-                    logicalId: 'FriggS3VPCEndpoint',
-                    physicalId: 'vpce-s3-stack',
-                    resourceType: 'AWS::EC2::VPCEndpoint'
-                })
-            );
-            expect(result.stackManaged).toContainEqual(
-                expect.objectContaining({
-                    logicalId: 'FriggDynamoDBVPCEndpoint',
-                    physicalId: 'vpce-ddb-stack',
-                    resourceType: 'AWS::EC2::VPCEndpoint'
-                })
-            );
-            expect(result.stackManaged).toContainEqual(
-                expect.objectContaining({
-                    logicalId: 'FriggKMSVPCEndpoint',
-                    physicalId: 'vpce-kms-stack',
-                    resourceType: 'AWS::EC2::VPCEndpoint'
-                })
-            );
-
-            // Should NOT be in external array
-            expect(result.external.some(r => r.physicalId === 'vpce-s3-stack')).toBe(false);
-            expect(result.external.some(r => r.physicalId === 'vpce-ddb-stack')).toBe(false);
-            expect(result.external.some(r => r.physicalId === 'vpce-kms-stack')).toBe(false);
-        });
-
-        it('should add VPC endpoints to external when NOT in existingLogicalIds', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: false, // AWS API discovery
-                s3VpcEndpointId: 'vpce-s3-external',
-                dynamodbVpcEndpointId: 'vpce-ddb-external'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // Should be in external (AWS discovery)
-            expect(result.external).toContainEqual(
-                expect.objectContaining({
-                    physicalId: 'vpce-s3-external',
-                    resourceType: 'AWS::EC2::VPCEndpoint',
-                    source: 'aws-discovery'
-                })
-            );
-
-            // Should NOT be in stackManaged
-            expect(result.stackManaged.some(r => r.physicalId === 'vpce-s3-external')).toBe(false);
-        });
-
-        it('should preserve existing VPC endpoints and only create missing ones', async () => {
-            const appDefinition = {
-                vpc: { enable: true },
-                encryption: { fieldLevelEncryptionMethod: 'kms' },
-            };
-            
-            const discoveredResources = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: [
-                    'FriggS3VPCEndpoint',      // In stack
-                    'FriggDynamoDBVPCEndpoint', // In stack
-                    'FriggKMSVPCEndpoint'       // In stack
-                    // SecretsManager and SQS NOT in stack (were deleted)
-                ],
-                defaultVpcId: 'vpc-123',
-                privateSubnetId1: 'subnet-1',
-                privateSubnetId2: 'subnet-2',
-                lambdaSecurityGroupId: 'sg-123',
-                routeTableId: 'rtb-123',
-                // Endpoints in stack
-                s3VpcEndpointId: 'vpce-s3-existing',
-                dynamodbVpcEndpointId: 'vpce-ddb-existing',
-                kmsVpcEndpointId: 'vpce-kms-existing'
-                // secretsManagerVpcEndpointId and sqsVpcEndpointId NOT present
-            };
-
-            const result = await vpcBuilder.build(appDefinition, discoveredResources);
-
-            // Existing endpoints MUST be in template (re-added)
-            expect(result.resources.FriggS3VPCEndpoint).toBeDefined();
-            expect(result.resources.FriggS3VPCEndpoint.Properties.VpcId).toBe('vpc-123');
-            
-            expect(result.resources.FriggDynamoDBVPCEndpoint).toBeDefined();
-            expect(result.resources.FriggDynamoDBVPCEndpoint.Properties.VpcId).toBe('vpc-123');
-            
-            expect(result.resources.FriggKMSVPCEndpoint).toBeDefined();
-            expect(result.resources.FriggKMSVPCEndpoint.Properties.VpcId).toBe('vpc-123');
-
-            // Missing endpoints should also be created
-            expect(result.resources.FriggSecretsManagerVPCEndpoint).toBeDefined();
-            expect(result.resources.FriggSQSVPCEndpoint).toBeDefined();
-            
-            // VPC Endpoint Security Group should be created
-            expect(result.resources.FriggVPCEndpointSecurityGroup).toBeDefined();
-        });
-    });
-
-    describe('convertFlatDiscoveryToStructured - CloudFormation query results', () => {
-        it('should add VPC from CloudFormation query to external array', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: ['FriggLambdaRouteTable', 'FriggLambdaSecurityGroup'],
-                // VPC ID was extracted from security group query (NOT a stack resource)
-                defaultVpcId: 'vpc-extracted-from-sg',
-                lambdaSecurityGroupId: 'sg-123',
-                routeTableId: 'rtb-123'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // VPC should be in external array (discovered via query, not in stack)
-            const vpcExternal = result.external.find(r => r.resourceType === 'AWS::EC2::VPC');
-            expect(vpcExternal).toBeDefined();
-            expect(vpcExternal.physicalId).toBe('vpc-extracted-from-sg');
-            expect(vpcExternal.source).toBe('cloudformation-query');
-
-            // Security group SHOULD be in stackManaged (is in stack)
-            const sgStack = result.stackManaged.find(r => r.logicalId === 'FriggLambdaSecurityGroup');
-            expect(sgStack).toBeDefined();
-            expect(sgStack.physicalId).toBe('sg-123');
-        });
-
-        it('should add subnets from route table associations to external array', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: ['FriggLambdaRouteTable'],
-                routeTableId: 'rtb-123',
-                // Subnets extracted from route table associations (NOT stack resources)
-                privateSubnetId1: 'subnet-1',
-                privateSubnetId2: 'subnet-2'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // Subnets should be in external array
-            const subnet1 = result.external.find(r => r.physicalId === 'subnet-1');
-            const subnet2 = result.external.find(r => r.physicalId === 'subnet-2');
-            
-            expect(subnet1).toBeDefined();
-            expect(subnet1.resourceType).toBe('AWS::EC2::Subnet');
-            expect(subnet1.source).toBe('cloudformation-query');
-            
-            expect(subnet2).toBeDefined();
-            expect(subnet2.resourceType).toBe('AWS::EC2::Subnet');
-            expect(subnet2.source).toBe('cloudformation-query');
-        });
-
-        it('should add NAT Gateway from route table queries to external array', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: ['FriggLambdaRouteTable', 'FriggPrivateRoute'],
-                routeTableId: 'rtb-123',
-                // NAT Gateway extracted from route table routes (NOT a stack resource)
-                existingNatGatewayId: 'nat-extracted'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // NAT should be in external array
-            const natExternal = result.external.find(r => r.resourceType === 'AWS::EC2::NatGateway');
-            expect(natExternal).toBeDefined();
-            expect(natExternal.physicalId).toBe('nat-extracted');
-            expect(natExternal.source).toBe('cloudformation-query');
-        });
-
-        it('should NOT add resources to external if they are in stack', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'test-stack',
-                existingLogicalIds: ['FriggVPC', 'FriggPrivateSubnet1'],
-                // These ARE in the stack
-                defaultVpcId: 'vpc-in-stack',
-                privateSubnetId1: 'subnet-in-stack'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // Should be in stackManaged, NOT external
-            expect(result.stackManaged.some(r => r.logicalId === 'FriggVPC')).toBe(true);
-            expect(result.stackManaged.some(r => r.logicalId === 'FriggPrivateSubnet1')).toBe(true);
-            
-            // Should NOT be in external
-            expect(result.external.some(r => r.physicalId === 'vpc-in-stack')).toBe(false);
-            expect(result.external.some(r => r.physicalId === 'subnet-in-stack')).toBe(false);
-        });
-
-        it('should handle external VPC pattern: stack resources + queried external references', () => {
-            const flatDiscovery = {
-                fromCloudFormationStack: true,
-                stackName: 'test-production-stack',
-                existingLogicalIds: [
-                    'FriggLambdaSecurityGroup',
-                    'FriggLambdaRouteTable',
-                    'FriggPrivateRoute',
-                    'FriggPrivateSubnet1RouteTableAssociation',
-                    'FriggPrivateSubnet2RouteTableAssociation',
-                    'FriggS3VPCEndpoint',
-                    'FriggDynamoDBVPCEndpoint',
-                    'FriggKMSVPCEndpoint'
-                ],
-                // Stack resources
-                lambdaSecurityGroupId: 'sg-stack-123',
-                routeTableId: 'rtb-stack-456',
-                s3VpcEndpointId: 'vpce-s3-stack',
-                // External resources (discovered via queries)
-                defaultVpcId: 'vpc-external-123',
-                privateSubnetId1: 'subnet-external-1',
-                privateSubnetId2: 'subnet-external-2',
-                existingNatGatewayId: 'nat-external-789'
-            };
-
-            const result = vpcBuilder.convertFlatDiscoveryToStructured(flatDiscovery);
-
-            // Stack resources should be in stackManaged
-            expect(result.stackManaged).toEqual(
-                expect.arrayContaining([
-                    expect.objectContaining({ logicalId: 'FriggLambdaSecurityGroup', physicalId: 'sg-stack-123' }),
-                    expect.objectContaining({ logicalId: 'FriggLambdaRouteTable', physicalId: 'rtb-stack-456' }),
-                    expect.objectContaining({ logicalId: 'FriggS3VPCEndpoint', physicalId: 'vpce-s3-stack' })
-                ])
-            );
-
-            // External resources should be in external array
-            expect(result.external).toEqual(
-                expect.arrayContaining([
-                    expect.objectContaining({ physicalId: 'vpc-external-123', resourceType: 'AWS::EC2::VPC', source: 'cloudformation-query' }),
-                    expect.objectContaining({ physicalId: 'subnet-external-1', resourceType: 'AWS::EC2::Subnet', source: 'cloudformation-query' }),
-                    expect.objectContaining({ physicalId: 'subnet-external-2', resourceType: 'AWS::EC2::Subnet', source: 'cloudformation-query' }),
-                    expect.objectContaining({ physicalId: 'nat-external-789', resourceType: 'AWS::EC2::NatGateway', source: 'cloudformation-query' })
-                ])
-            );
-        });
-    });
 });