@friggframework/devtools 2.0.0--canary.517.8e1c21c.0 → 2.0.0--canary.517.559ad7e.0

package/infrastructure/domains/admin-scripts/admin-script-builder.js

@@ -70,10 +70,10 @@ class AdminScriptBuilder extends InfrastructureBuilder {
         this.createAdminScriptQueue(result);
 
         // Create Lambda function for script execution
-        this.createScriptExecutorFunction(result, usePrismaLayer);
+        this.createScriptExecutorFunction(appDefinition, result, usePrismaLayer);
 
         // Create API routes for script management
-        this.createAdminScriptRoutes(result, usePrismaLayer);
+        this.createAdminScriptRoutes(appDefinition, result, usePrismaLayer);
 
         // Phase 2: Create EventBridge Scheduler resources
         if (adminConfig.enableScheduling) {
@@ -125,11 +125,11 @@ class AdminScriptBuilder extends InfrastructureBuilder {
         console.log('  ✓ Created AdminScriptQueue');
     }
 
-    createScriptExecutorFunction(result, usePrismaLayer) {
+    createScriptExecutorFunction(appDefinition, result, usePrismaLayer) {
         result.functions.adminScriptExecutor = {
             handler: 'node_modules/@friggframework/admin-scripts/src/infrastructure/script-executor-handler.handler',
             skipEsbuild: true,
-            package: this.skipEsbuildPackageConfig(usePrismaLayer),
+            package: this.skipEsbuildPackageConfig(appDefinition, usePrismaLayer),
             ...(usePrismaLayer && { layers: [{ Ref: 'PrismaLambdaLayer' }] }),
             timeout: 900, // 15 minutes max
             memorySize: 1024,
@@ -145,11 +145,11 @@ class AdminScriptBuilder extends InfrastructureBuilder {
         console.log('  ✓ Created adminScriptExecutor function');
     }
 
-    createAdminScriptRoutes(result, usePrismaLayer) {
+    createAdminScriptRoutes(appDefinition, result, usePrismaLayer) {
         result.functions.adminScriptRouter = {
             handler: 'node_modules/@friggframework/admin-scripts/src/infrastructure/admin-script-router.handler',
             skipEsbuild: true,
-            package: this.skipEsbuildPackageConfig(usePrismaLayer),
+            package: this.skipEsbuildPackageConfig(appDefinition, usePrismaLayer),
             ...(usePrismaLayer && { layers: [{ Ref: 'PrismaLambdaLayer' }] }),
             timeout: 30,
             events: [
@@ -181,8 +181,14 @@ class AdminScriptBuilder extends InfrastructureBuilder {
 
     // Without this, the skipEsbuild functions package the whole node_modules
     // closure (aws-sdk, Prisma, dev deps) and blow past Lambda's 250 MB limit.
-    skipEsbuildPackageConfig(usePrismaLayer) {
+    // Mirrors the exclusions the framework's other node_modules handlers use.
+    skipEsbuildPackageConfig(appDefinition, usePrismaLayer) {
+        const tlsCAFile = appDefinition?.database?.documentDB?.tlsCAFile;
         return {
+            include: [
+                // Handlers connect to the DB, so ship the DocumentDB CA cert.
+                ...(tlsCAFile ? [tlsCAFile.replace(/^\.\//, '')] : []),
+            ],
             exclude: [
                 'node_modules/aws-sdk/**',
                 'node_modules/@aws-sdk/**',
@@ -212,10 +218,13 @@ class AdminScriptBuilder extends InfrastructureBuilder {
                 'node_modules/serverless-offline-sqs/**',
                 'node_modules/serverless-dotenv-plugin/**',
                 'node_modules/serverless-kms-grants/**',
+                // Never deploy secrets or the lockfile.
                 '.env',
                 '.env.*',
                 '**/.env',
                 '**/.env.*',
+                '.frigg-credentials.json',
+                'package-lock.json',
                 'test/**',
                 'layers/**',
                 'coverage/**',
@@ -268,12 +277,14 @@ class AdminScriptBuilder extends InfrastructureBuilder {
             },
         };
 
-        result.environment.SCHEDULER_PROVIDER = 'aws';
-
-        // Router-scoped, not shared provider env: broadcasting these resource
-        // references to every function creates CloudFormation circular deps.
+        // Router-scoped, not shared provider env. Two reasons: broadcasting the
+        // resource references to every function creates CloudFormation circular
+        // deps; and SCHEDULER_PROVIDER='aws' is only valid for the admin-script
+        // adapter (the router's sole consumer) — core's scheduler factory, used
+        // by integration Lambdas, rejects 'aws', so it must not leak app-wide.
         result.functions.adminScriptRouter.environment = {
             ...(result.functions.adminScriptRouter.environment || {}),
+            SCHEDULER_PROVIDER: 'aws',
             SCHEDULER_ROLE_ARN: {
                 'Fn::GetAtt': ['AdminScriptSchedulerRole', 'Arn'],
             },

package/infrastructure/domains/admin-scripts/admin-script-builder.test.js

@@ -389,12 +389,13 @@ describe('AdminScriptBuilder', () => {
             expect(result.resources.AdminScriptScheduleGroup).toBeDefined();
             expect(result.resources.AdminScriptScheduleGroup.Type).toBe('AWS::Scheduler::ScheduleGroup');
 
-            // SCHEDULER_PROVIDER is a constant and stays on the shared env.
-            expect(result.environment.SCHEDULER_PROVIDER).toBe('aws');
-
-            // Resource-reference env vars are scoped to the router function (not
-            // the shared provider env) to avoid CloudFormation circular deps.
+            // Scheduler env vars are scoped to the router function (not the
+            // shared provider env): resource refs would create CloudFormation
+            // circular deps, and SCHEDULER_PROVIDER='aws' would break core's
+            // scheduler factory (rejects 'aws') for every other Lambda.
             const routerEnv = result.functions.adminScriptRouter.environment;
+            expect(routerEnv.SCHEDULER_PROVIDER).toBe('aws');
+            expect(result.environment.SCHEDULER_PROVIDER).toBeUndefined();
             expect(routerEnv.SCHEDULER_ROLE_ARN).toEqual({
                 'Fn::GetAtt': ['AdminScriptSchedulerRole', 'Arn'],
             });

package/infrastructure/domains/database/migration-builder.js

@@ -466,9 +466,23 @@ class MigrationBuilder extends InfrastructureBuilder {
                 // Note: Serverless will merge this with provider.environment
             },
             events: [
-                { httpApi: { path: '/db-migrate/status', method: 'GET' } },
-                { httpApi: { path: '/db-migrate', method: 'POST' } },
-                { httpApi: { path: '/db-migrate/{processId}', method: 'GET' } },
+                // Paths must match the Express router in core's db-migration.js,
+                // which mounts under /admin/db-migrate (consolidated with the
+                // other admin endpoints). A mismatch routes API Gateway to the
+                // Lambda but Express 404s ("Cannot POST /db-migrate").
+                {
+                    httpApi: {
+                        path: '/admin/db-migrate/status',
+                        method: 'GET',
+                    },
+                },
+                { httpApi: { path: '/admin/db-migrate', method: 'POST' } },
+                {
+                    httpApi: {
+                        path: '/admin/db-migrate/{processId}',
+                        method: 'GET',
+                    },
+                },
             ],
         };
         console.log('  ✓ Created dbMigrationRouter function');

package/infrastructure/domains/database/migration-builder.test.js

@@ -230,14 +230,15 @@ describe('MigrationBuilder', () => {
             expect(result.functions.dbMigrationRouter.timeout).toBe(30);
             expect(result.functions.dbMigrationRouter.memorySize).toBe(512);
             expect(result.functions.dbMigrationRouter.events).toHaveLength(3);
+            // Must match core's Express router mounted under /admin/db-migrate.
             expect(result.functions.dbMigrationRouter.events).toContainEqual({
-                httpApi: { path: '/db-migrate/status', method: 'GET' },
+                httpApi: { path: '/admin/db-migrate/status', method: 'GET' },
             });
             expect(result.functions.dbMigrationRouter.events).toContainEqual({
-                httpApi: { path: '/db-migrate', method: 'POST' },
+                httpApi: { path: '/admin/db-migrate', method: 'POST' },
             });
             expect(result.functions.dbMigrationRouter.events).toContainEqual({
-                httpApi: { path: '/db-migrate/{processId}', method: 'GET' },
+                httpApi: { path: '/admin/db-migrate/{processId}', method: 'GET' },
             });
         });
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.517.8e1c21c.0",
+  "version": "2.0.0--canary.517.559ad7e.0",
   "bin": {
     "frigg": "./frigg-cli/index.js"
   },
@@ -25,9 +25,9 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/core": "2.0.0--canary.517.8e1c21c.0",
-    "@friggframework/schemas": "2.0.0--canary.517.8e1c21c.0",
-    "@friggframework/test": "2.0.0--canary.517.8e1c21c.0",
+    "@friggframework/core": "2.0.0--canary.517.559ad7e.0",
+    "@friggframework/schemas": "2.0.0--canary.517.559ad7e.0",
+    "@friggframework/test": "2.0.0--canary.517.559ad7e.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.18.0",
@@ -55,8 +55,8 @@
     "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.517.8e1c21c.0",
-    "@friggframework/prettier-config": "2.0.0--canary.517.8e1c21c.0",
+    "@friggframework/eslint-config": "2.0.0--canary.517.559ad7e.0",
+    "@friggframework/prettier-config": "2.0.0--canary.517.559ad7e.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -88,5 +88,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "8e1c21cfab6708ab3456516f2e3520eeb12e8c14"
+  "gitHead": "559ad7ed62bf320273a70e2bb9e30ec67a026355"
 }