@friggframework/devtools 2.0.0-next.27 → 2.0.0-next.29

package/infrastructure/serverless-template.js

@@ -1,7 +1,26 @@
 const path = require('path');
 const fs = require('fs');
+const { AWSDiscovery } = require('./aws-discovery');
 
-// Function to find the actual path to node_modules
+/**
+ * Check if AWS discovery should run based on AppDefinition
+ * @param {Object} AppDefinition - Application definition
+ * @returns {boolean} True if discovery should run
+ */
+const shouldRunDiscovery = (AppDefinition) => {
+    return AppDefinition.vpc?.enable === true ||
+        AppDefinition.encryption?.useDefaultKMSForFieldLevelEncryption === true ||
+        AppDefinition.ssm?.enable === true;
+};
+
+/**
+ * Find the actual path to node_modules directory
+ * Tries multiple methods to locate node_modules:
+ * 1. Traversing up from current directory
+ * 2. Using npm root command
+ * 3. Looking for package.json and adjacent node_modules
+ * @returns {string} Path to node_modules directory
+ */
 const findNodeModulesPath = () => {
     try {
         // Method 1: Try to find node_modules by traversing up from current directory
@@ -75,7 +94,18 @@ const findNodeModulesPath = () => {
     }
 };
 
-// Function to modify handler paths to point to the correct node_modules
+/**
+ * Modify handler paths to point to the correct node_modules location
+ * Only modifies paths when running in offline mode
+ * @param {Object} functions - Serverless functions configuration object
+ * @returns {Object} Modified functions object with updated handler paths
+ */
+/**
+ * Modify handler paths to point to the correct node_modules location
+ * Only modifies paths when running in offline mode
+ * @param {Object} functions - Serverless functions configuration object
+ * @returns {Object} Modified functions object with updated handler paths
+ */
 const modifyHandlerPaths = (functions) => {
     // Check if we're running in offline mode
     const isOffline = process.argv.includes('offline');
@@ -94,7 +124,10 @@ const modifyHandlerPaths = (functions) => {
         const functionDef = modifiedFunctions[functionName];
         if (functionDef?.handler?.includes('node_modules/')) {
             // Replace node_modules/ with the actual path to node_modules/
-            functionDef.handler = functionDef.handler.replace('node_modules/', '../node_modules/');
+            const relativePath = path.relative(process.cwd(), nodeModulesPath);
+            functionDef.handler = functionDef.handler.replace('node_modules/', `${relativePath}/`);
+            const relativePath = path.relative(process.cwd(), nodeModulesPath);
+            functionDef.handler = functionDef.handler.replace('node_modules/', `${relativePath}/`);
             console.log(`Updated handler for ${functionName}: ${functionDef.handler}`);
         }
     }
@@ -102,7 +135,22 @@ const modifyHandlerPaths = (functions) => {
     return modifiedFunctions;
 };
 
-// Helper function to create VPC infrastructure resources
+/**
+ * Create VPC infrastructure resources for CloudFormation
+ * Creates VPC, subnets, NAT gateway, route tables, and security groups
+ * @param {Object} AppDefinition - Application definition object
+ * @param {Object} AppDefinition.vpc - VPC configuration
+ * @param {string} [AppDefinition.vpc.cidrBlock='10.0.0.0/16'] - CIDR block for VPC
+ * @returns {Object} CloudFormation resources for VPC infrastructure
+ */
+/**
+ * Create VPC infrastructure resources for CloudFormation
+ * Creates VPC, subnets, NAT gateway, route tables, and security groups
+ * @param {Object} AppDefinition - Application definition object
+ * @param {Object} AppDefinition.vpc - VPC configuration
+ * @param {string} [AppDefinition.vpc.cidrBlock='10.0.0.0/16'] - CIDR block for VPC
+ * @returns {Object} CloudFormation resources for VPC infrastructure
+ */
 const createVPCInfrastructure = (AppDefinition) => {
     const vpcResources = {
         // VPC
@@ -292,13 +340,6 @@ const createVPCInfrastructure = (AppDefinition) => {
                         CidrIp: '0.0.0.0/0',
                         Description: 'HTTP outbound'
                     },
-                     {
-                         IpProtocol: 'tcp',
-                         FromPort: 27017,
-                         ToPort: 27017,
-                         CidrIp: '0.0.0.0/0',
-                         Description: 'MongoDB Atlas TLS outbound'
-                     },
                     {
                         IpProtocol: 'tcp',
                         FromPort: 53,
@@ -412,15 +453,57 @@ const createVPCInfrastructure = (AppDefinition) => {
     return vpcResources;
 };
 
-const composeServerlessDefinition = (AppDefinition) => {
-    // Define CORS configuration to be used across all endpoints
-    const corsConfig = {
-        origin: '*',
-        headers: '*',
-        methods: ['ANY'],
-        allowCredentials: false,
-    };
-    
+/**
+ * Compose a complete serverless framework configuration from app definition
+ * @param {Object} AppDefinition - Application definition object
+ * @param {string} [AppDefinition.name] - Application name
+ * @param {string} [AppDefinition.provider='aws'] - Cloud provider
+ * @param {Array} AppDefinition.integrations - Array of integration definitions
+ * @param {Object} [AppDefinition.vpc] - VPC configuration
+ * @param {Object} [AppDefinition.encryption] - KMS encryption configuration
+ * @param {Object} [AppDefinition.ssm] - SSM parameter store configuration
+ * @param {Object} [AppDefinition.websockets] - WebSocket configuration
+ * @param {boolean} [AppDefinition.websockets.enable=false] - Enable WebSocket support for live update streaming
+ * @returns {Object} Complete serverless framework configuration
+ */
+const composeServerlessDefinition = async (AppDefinition) => {
+    // Store discovered resources
+    let discoveredResources = {};
+
+    // Run AWS discovery if needed
+    if (shouldRunDiscovery(AppDefinition)) {
+        console.log('🔍 Running AWS resource discovery for serverless template...');
+        try {
+            const region = process.env.AWS_REGION || 'us-east-1';
+            const discovery = new AWSDiscovery(region);
+
+            const config = {
+                vpc: AppDefinition.vpc || {},
+                encryption: AppDefinition.encryption || {},
+                ssm: AppDefinition.ssm || {}
+            };
+
+            discoveredResources = await discovery.discoverResources(config);
+
+            console.log('✅ AWS discovery completed successfully!');
+            if (discoveredResources.defaultVpcId) {
+                console.log(`   VPC: ${discoveredResources.defaultVpcId}`);
+            }
+            if (discoveredResources.privateSubnetId1 && discoveredResources.privateSubnetId2) {
+                console.log(`   Subnets: ${discoveredResources.privateSubnetId1}, ${discoveredResources.privateSubnetId2}`);
+            }
+            if (discoveredResources.defaultSecurityGroupId) {
+                console.log(`   Security Group: ${discoveredResources.defaultSecurityGroupId}`);
+            }
+            if (discoveredResources.defaultKmsKeyId) {
+                console.log(`   KMS Key: ${discoveredResources.defaultKmsKeyId}`);
+            }
+        } catch (error) {
+            console.error('❌ AWS discovery failed:', error.message);
+            throw new Error(`AWS discovery failed: ${error.message}`);
+        }
+    }
+
     const definition = {
         frameworkVersion: '>=3.17.0',
         service: AppDefinition.name || 'create-frigg-app',
@@ -433,11 +516,28 @@ const composeServerlessDefinition = (AppDefinition) => {
             name: AppDefinition.provider || 'aws',
             runtime: 'nodejs20.x',
             timeout: 30,
-            region: 'us-east-1',
+            region: process.env.AWS_REGION || 'us-east-1',
+            region: process.env.AWS_REGION || 'us-east-1',
             stage: '${opt:stage}',
             environment: {
-                STAGE: '${opt:stage}',
+                STAGE: '${opt:stage, "dev"}',
                 AWS_NODEJS_CONNECTION_REUSE_ENABLED: 1,
+                // Add discovered resources to environment if available
+                ...(discoveredResources.defaultVpcId && { AWS_DISCOVERY_VPC_ID: discoveredResources.defaultVpcId }),
+                ...(discoveredResources.defaultSecurityGroupId && { AWS_DISCOVERY_SECURITY_GROUP_ID: discoveredResources.defaultSecurityGroupId }),
+                ...(discoveredResources.privateSubnetId1 && { AWS_DISCOVERY_SUBNET_ID_1: discoveredResources.privateSubnetId1 }),
+                ...(discoveredResources.privateSubnetId2 && { AWS_DISCOVERY_SUBNET_ID_2: discoveredResources.privateSubnetId2 }),
+                ...(discoveredResources.publicSubnetId && { AWS_DISCOVERY_PUBLIC_SUBNET_ID: discoveredResources.publicSubnetId }),
+                ...(discoveredResources.defaultRouteTableId && { AWS_DISCOVERY_ROUTE_TABLE_ID: discoveredResources.defaultRouteTableId }),
+                ...(discoveredResources.defaultKmsKeyId && { AWS_DISCOVERY_KMS_KEY_ID: discoveredResources.defaultKmsKeyId }),
+                // Add discovered resources to environment if available
+                ...(discoveredResources.defaultVpcId && { AWS_DISCOVERY_VPC_ID: discoveredResources.defaultVpcId }),
+                ...(discoveredResources.defaultSecurityGroupId && { AWS_DISCOVERY_SECURITY_GROUP_ID: discoveredResources.defaultSecurityGroupId }),
+                ...(discoveredResources.privateSubnetId1 && { AWS_DISCOVERY_SUBNET_ID_1: discoveredResources.privateSubnetId1 }),
+                ...(discoveredResources.privateSubnetId2 && { AWS_DISCOVERY_SUBNET_ID_2: discoveredResources.privateSubnetId2 }),
+                ...(discoveredResources.publicSubnetId && { AWS_DISCOVERY_PUBLIC_SUBNET_ID: discoveredResources.publicSubnetId }),
+                ...(discoveredResources.defaultRouteTableId && { AWS_DISCOVERY_ROUTE_TABLE_ID: discoveredResources.defaultRouteTableId }),
+                ...(discoveredResources.defaultKmsKeyId && { AWS_DISCOVERY_KMS_KEY_ID: discoveredResources.defaultKmsKeyId }),
             },
             iamRoleStatements: [
                 {
@@ -470,6 +570,17 @@ const composeServerlessDefinition = (AppDefinition) => {
                     ],
                 }
             ],
+            httpApi: {
+                payload: '2.0',
+                cors: {
+                    allowedOrigins: ['*'],
+                    allowedHeaders: ['*'],
+                    allowedMethods: ['*'],
+                    allowCredentials: false,
+                },
+                name: '${opt:stage, "dev"}-${self:service}',
+                disableDefaultEndpoint: false,
+            }
         },
         plugins: [
             'serverless-jetpack',
@@ -488,7 +599,8 @@ const composeServerlessDefinition = (AppDefinition) => {
                 autoCreate: false,
                 apiVersion: '2012-11-05',
                 endpoint: 'http://localhost:4566',
-                region: 'us-east-1',
+                region: process.env.AWS_REGION || 'us-east-1',
+                region: process.env.AWS_REGION || 'us-east-1',
                 accessKeyId: 'root',
                 secretAccessKey: 'root',
                 skipCacheInvalidation: false,
@@ -498,48 +610,25 @@ const composeServerlessDefinition = (AppDefinition) => {
             },
         },
         functions: {
-            defaultWebsocket: {
-                handler: 'node_modules/@friggframework/core/handlers/routers/websocket.handler',
-                events: [
-                    {
-                        websocket: {
-                            route: '$connect',
-                        },
-                    },
-                    {
-                        websocket: {
-                            route: '$default',
-                        },
-                    },
-                    {
-                        websocket: {
-                            route: '$disconnect',
-                        },
-                    },
-                ],
-            },
             auth: {
                 handler: 'node_modules/@friggframework/core/handlers/routers/auth.handler',
                 events: [
                     {
-                        http: {
+                        httpApi: {
                             path: '/api/integrations',
                             method: 'ANY',
-                            cors: corsConfig,
                         },
                     },
                     {
-                        http: {
+                        httpApi: {
                             path: '/api/integrations/{proxy+}',
                             method: 'ANY',
-                            cors: corsConfig,
                         },
                     },
                     {
-                        http: {
+                        httpApi: {
                             path: '/api/authorize',
                             method: 'ANY',
-                            cors: corsConfig,
                         },
                     },
                 ],
@@ -548,10 +637,9 @@ const composeServerlessDefinition = (AppDefinition) => {
                 handler: 'node_modules/@friggframework/core/handlers/routers/user.handler',
                 events: [
                     {
-                        http: {
+                        httpApi: {
                             path: '/user/{proxy+}',
                             method: 'ANY',
-                            cors: corsConfig,
                         },
                     },
                 ],
@@ -560,17 +648,15 @@ const composeServerlessDefinition = (AppDefinition) => {
                 handler: 'node_modules/@friggframework/core/handlers/routers/health.handler',
                 events: [
                     {
-                        http: {
+                        httpApi: {
                             path: '/health',
                             method: 'GET',
-                            cors: corsConfig,
                         },
                     },
                     {
-                        http: {
+                        httpApi: {
                             path: '/health/{proxy+}',
                             method: 'GET',
-                            cors: corsConfig,
                         },
                     },
                 ],
@@ -582,7 +668,8 @@ const composeServerlessDefinition = (AppDefinition) => {
                     Type: 'AWS::SQS::Queue',
                     Properties: {
                         QueueName:
-                            'internal-error-queue-${self:provider.stage}',
+                            '${self:service}-internal-error-queue-${self:provider.stage}',
+                        '${self:service}-internal-error-queue-${self:provider.stage}',
                         MessageRetentionPeriod: 300,
                     },
                 },
@@ -648,16 +735,12 @@ const composeServerlessDefinition = (AppDefinition) => {
                         AlarmActions: [{ Ref: 'InternalErrorBridgeTopic' }],
                         Dimensions: [
                             {
-                                Name: 'ApiName',
-                                Value: {
-                                    'Fn::Join': [
-                                        '-',
-                                        [
-                                            '${self:provider.stage}',
-                                            '${self:service}',
-                                        ],
-                                    ],
-                                },
+                                Name: 'ApiId',
+                                Value: { Ref: 'HttpApi' },
+                            },
+                            {
+                                Name: 'Stage',
+                                Value: '${self:provider.stage}',
                             },
                         ],
                     },
@@ -666,76 +749,7 @@ const composeServerlessDefinition = (AppDefinition) => {
         },
     };
 
-    // Configure BASE_URL based on custom domain or API Gateway
-    if (process.env.CUSTOM_DOMAIN) {
-        
-        // Configure custom domain
-        definition.custom.customDomain = {
-            domainName: process.env.CUSTOM_DOMAIN,
-            basePath: process.env.CUSTOM_BASE_PATH || '',
-            stage: '${self:provider.stage}',
-            createRoute53Record: process.env.CREATE_ROUTE53_RECORD !== 'false', // Default true
-            certificateName: process.env.CERTIFICATE_NAME || process.env.CUSTOM_DOMAIN,
-            endpointType: process.env.ENDPOINT_TYPE || 'edge', // edge, regional, or private
-            securityPolicy: process.env.SECURITY_POLICY || 'tls_1_2',
-            apiType: 'rest',
-            autoDomain: process.env.AUTO_DOMAIN === 'true', // Auto create domain if it doesn't exist
-        };
-        
-        // Set BASE_URL to custom domain
-        definition.provider.environment.BASE_URL = `https://${process.env.CUSTOM_DOMAIN}`;
-    } else {
-        // Default BASE_URL using API Gateway generated URL
-        definition.provider.environment.BASE_URL = {
-            'Fn::Join': [
-                '',
-                [
-                    'https://',
-                    { Ref: 'ApiGatewayRestApi' },
-                    '.execute-api.',
-                    { Ref: 'AWS::Region' },
-                    '.amazonaws.com/',
-                    '${self:provider.stage}',
-                ],
-            ],
-        };
-    }
-    
-    // REDIRECT_PATH is required for OAuth integrations
-    if (!process.env.REDIRECT_PATH) {
-        throw new Error(
-            'REDIRECT_PATH environment variable is required. ' +
-            'Please set REDIRECT_PATH in your .env file (e.g., REDIRECT_PATH=/oauth/callback)'
-        );
-    }
-    
-    // Set REDIRECT_URI based on domain configuration
-    if (process.env.CUSTOM_DOMAIN) {
-        definition.provider.environment.REDIRECT_URI = `https://${process.env.CUSTOM_DOMAIN}${process.env.REDIRECT_PATH}`;
-    } else {
-        definition.provider.environment.REDIRECT_URI = {
-            'Fn::Join': [
-                '',
-                [
-                    'https://',
-                    { Ref: 'ApiGatewayRestApi' },
-                    '.execute-api.',
-                    { Ref: 'AWS::Region' },
-                    '.amazonaws.com/',
-                    '${self:provider.stage}',
-                    process.env.REDIRECT_PATH,
-                ],
-            ],
-        };
-    }
-    
-    // Add REDIRECT_URI to CloudFormation outputs
-    definition.resources.Outputs = {
-        RedirectURI: {
-            Description: 'OAuth Redirect URI to register with providers',
-            Value: definition.provider.environment.REDIRECT_URI,
-        },
-    };
+
 
     // KMS Configuration based on App Definition
     if (AppDefinition.encryption?.useDefaultKMSForFieldLevelEncryption === true) {
@@ -768,36 +782,17 @@ const composeServerlessDefinition = (AppDefinition) => {
         definition.provider.environment.KMS_KEY_ARN = { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] };
 
         definition.plugins.push('serverless-kms-grants');
-        definition.custom.kmsGrants = { kmsKeyId: { 'Fn::GetAtt': ['FriggKMSKey', 'Arn'] } };
+
+        // Configure KMS grants with discovered default key
+        // Configure KMS grants with discovered default key
+        definition.custom.kmsGrants = {
+            kmsKeyId: discoveredResources.defaultKmsKeyId || '${env:AWS_DISCOVERY_KMS_KEY_ID}'
+            kmsKeyId: discoveredResources.defaultKmsKeyId || '${env:AWS_DISCOVERY_KMS_KEY_ID}'
+        };
     }
 
     // VPC Configuration based on App Definition
     if (AppDefinition.vpc?.enable === true) {
-        // Create VPC config from App Definition or use auto-created resources
-        const vpcConfig = {};
-
-        if (AppDefinition.vpc.securityGroupIds) {
-            // User provided custom security groups
-            vpcConfig.securityGroupIds = AppDefinition.vpc.securityGroupIds;
-        } else {
-            // Use auto-created security group
-            vpcConfig.securityGroupIds = [{ Ref: 'FriggLambdaSecurityGroup' }];
-        }
-
-        if (AppDefinition.vpc.subnetIds) {
-            // User provided custom subnets
-            vpcConfig.subnetIds = AppDefinition.vpc.subnetIds;
-        } else {
-            // Use auto-created private subnets
-            vpcConfig.subnetIds = [
-                { Ref: 'FriggPrivateSubnet1' },
-                { Ref: 'FriggPrivateSubnet2' }
-            ];
-        }
-
-        // Set VPC config for Lambda functions
-        definition.provider.vpc = vpcConfig;
-
         // Add VPC-related IAM permissions
         definition.provider.iamRoleStatements.push({
             Effect: 'Allow',
@@ -811,75 +806,405 @@ const composeServerlessDefinition = (AppDefinition) => {
             Resource: '*'
         });
 
-        // Add VPC infrastructure resources to CloudFormation
-        const vpcResources = createVPCInfrastructure(AppDefinition);
-        Object.assign(definition.resources.Resources, vpcResources);
+        // Default approach: Use AWS Discovery to find existing VPC resources
+        if (AppDefinition.vpc.createNew === true) {
+            // Option 1: Create new VPC infrastructure (explicit opt-in)
+            const vpcConfig = {};
+            // Add VPC-related IAM permissions
+            definition.provider.iamRoleStatements.push({
+                Effect: 'Allow',
+                Action: [
+                    'ec2:CreateNetworkInterface',
+                    'ec2:DescribeNetworkInterfaces',
+                    'ec2:DeleteNetworkInterface',
+                    'ec2:AttachNetworkInterface',
+                    'ec2:DetachNetworkInterface'
+                ],
+                Resource: '*'
+            });
+
+            // Default approach: Use AWS Discovery to find existing VPC resources
+            if (AppDefinition.vpc.createNew === true) {
+                // Option 1: Create new VPC infrastructure (explicit opt-in)
+                const vpcConfig = {};
+
+                if (AppDefinition.vpc.securityGroupIds) {
+                    // User provided custom security groups
+                    vpcConfig.securityGroupIds = AppDefinition.vpc.securityGroupIds;
+                } else {
+                    // Use auto-created security group
+                    vpcConfig.securityGroupIds = [{ Ref: 'FriggLambdaSecurityGroup' }];
+                }
+                if (AppDefinition.vpc.securityGroupIds) {
+                    // User provided custom security groups
+                    vpcConfig.securityGroupIds = AppDefinition.vpc.securityGroupIds;
+                } else {
+                    // Use auto-created security group
+                    vpcConfig.securityGroupIds = [{ Ref: 'FriggLambdaSecurityGroup' }];
+                }
+
+                if (AppDefinition.vpc.subnetIds) {
+                    // User provided custom subnets
+                    vpcConfig.subnetIds = AppDefinition.vpc.subnetIds;
+                } else {
+                    // Use auto-created private subnets
+                    vpcConfig.subnetIds = [
+                        { Ref: 'FriggPrivateSubnet1' },
+                        { Ref: 'FriggPrivateSubnet2' }
+                    ];
+                }
+                if (AppDefinition.vpc.subnetIds) {
+                    // User provided custom subnets
+                    vpcConfig.subnetIds = AppDefinition.vpc.subnetIds;
+                } else {
+                    // Use auto-created private subnets
+                    vpcConfig.subnetIds = [
+                        { Ref: 'FriggPrivateSubnet1' },
+                        { Ref: 'FriggPrivateSubnet2' }
+                    ];
+                }
+
+                // Set VPC config for Lambda functions
+                definition.provider.vpc = vpcConfig;
+                // Set VPC config for Lambda functions
+                definition.provider.vpc = vpcConfig;
+
+                // Add VPC infrastructure resources to CloudFormation
+                const vpcResources = createVPCInfrastructure(AppDefinition);
+                Object.assign(definition.resources.Resources, vpcResources);
+            } else {
+                // Option 2: Use AWS Discovery (default behavior)
+                // VPC configuration using discovered or explicitly provided resources
+                const vpcConfig = {
+                    securityGroupIds: AppDefinition.vpc.securityGroupIds ||
+                        (discoveredResources.defaultSecurityGroupId ? [discoveredResources.defaultSecurityGroupId] : []),
+                    subnetIds: AppDefinition.vpc.subnetIds ||
+                        (discoveredResources.privateSubnetId1 && discoveredResources.privateSubnetId2 ?
+                            [discoveredResources.privateSubnetId1, discoveredResources.privateSubnetId2] :
+                            [])
+                };
+
+                // Set VPC config for Lambda functions only if we have valid subnet IDs
+                if (vpcConfig.subnetIds.length >= 2 && vpcConfig.securityGroupIds.length > 0) {
+                    definition.provider.vpc = vpcConfig;
+
+                    // Check if we have an existing NAT Gateway to use
+                    if (!discoveredResources.existingNatGatewayId) {
+                        // No existing NAT Gateway, create new resources
+
+                        // Only create EIP if we don't have an existing one available
+                        if (!discoveredResources.existingElasticIpAllocationId) {
+                            definition.resources.Resources.FriggNATGatewayEIP = {
+                                Type: 'AWS::EC2::EIP',
+                                Properties: {
+                                    Domain: 'vpc',
+                                    Tags: [
+                                        { Key: 'Name', Value: '${self:service}-${self:provider.stage}-nat-eip' }
+                                    ]
+                                }
+                            };
+                        }
+
+                        definition.resources.Resources.FriggNATGateway = {
+                            Type: 'AWS::EC2::NatGateway',
+                            Properties: {
+                                AllocationId: discoveredResources.existingElasticIpAllocationId ||
+                                    { 'Fn::GetAtt': ['FriggNATGatewayEIP', 'AllocationId'] },
+                                SubnetId: discoveredResources.publicSubnetId || discoveredResources.privateSubnetId1, // Use first discovered subnet if no public subnet found
+                                Tags: [
+                                    { Key: 'Name', Value: '${self:service}-${self:provider.stage}-nat-gateway' }
+                                ]
+                            }
+                        };
+                    }
+
+                    // Create route table for Lambda subnets to use NAT Gateway
+                    definition.resources.Resources.FriggLambdaRouteTable = {
+                        Type: 'AWS::EC2::RouteTable',
+                        Properties: {
+                            VpcId: discoveredResources.defaultVpcId || { Ref: 'FriggVPC' },
+                            Tags: [
+                                { Key: 'Name', Value: '${self:service}-${self:provider.stage}-lambda-rt' }
+                            ]
+                        }
+                    };
+
+                    definition.resources.Resources.FriggNATRoute = {
+                        Type: 'AWS::EC2::Route',
+                        Properties: {
+                            RouteTableId: { Ref: 'FriggLambdaRouteTable' },
+                            DestinationCidrBlock: '0.0.0.0/0',
+                            NatGatewayId: discoveredResources.existingNatGatewayId || { Ref: 'FriggNATGateway' }
+                        }
+                    };
+
+                    // Associate Lambda subnets with NAT Gateway route table
+                    definition.resources.Resources.FriggSubnet1RouteAssociation = {
+                        Type: 'AWS::EC2::SubnetRouteTableAssociation',
+                        Properties: {
+                            SubnetId: vpcConfig.subnetIds[0],
+                            RouteTableId: { Ref: 'FriggLambdaRouteTable' }
+                        }
+                    };
+
+                    definition.resources.Resources.FriggSubnet2RouteAssociation = {
+                        Type: 'AWS::EC2::SubnetRouteTableAssociation',
+                        Properties: {
+                            SubnetId: vpcConfig.subnetIds[1],
+                            RouteTableId: { Ref: 'FriggLambdaRouteTable' }
+                        }
+                    };
+
+                    // Add VPC endpoints for AWS service optimization (optional but recommended)
+                    if (AppDefinition.vpc.enableVPCEndpoints !== false) {
+                        definition.resources.Resources.VPCEndpointS3 = {
+                            Type: 'AWS::EC2::VPCEndpoint',
+                            Properties: {
+                                VpcId: discoveredResources.defaultVpcId,
+                                ServiceName: 'com.amazonaws.${self:provider.region}.s3',
+                                VpcEndpointType: 'Gateway',
+                                RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }]
+                            }
+                        };
+
+                        definition.resources.Resources.VPCEndpointDynamoDB = {
+                            Type: 'AWS::EC2::VPCEndpoint',
+                            Properties: {
+                                VpcId: discoveredResources.defaultVpcId,
+                                ServiceName: 'com.amazonaws.${self:provider.region}.dynamodb',
+                                VpcEndpointType: 'Gateway',
+                                RouteTableIds: [{ Ref: 'FriggLambdaRouteTable' }]
+                            }
+                        };
+                    }
+                }
+            }
+        }
+
+        // SSM Parameter Store Configuration based on App Definition  
+        if (AppDefinition.ssm?.enable === true) {
+            // Add AWS Parameters and Secrets Lambda Extension layer
+            definition.provider.layers = [
+                'arn:aws:lambda:${self:provider.region}:177933569100:layer:AWS-Parameters-and-Secrets-Lambda-Extension:11'
+            ];
+
+            // Add SSM IAM permissions
+            definition.provider.iamRoleStatements.push({
+                Effect: 'Allow',
+                Action: [
+                    'ssm:GetParameter',
+                    'ssm:GetParameters',
+                    'ssm:GetParametersByPath'
+                ],
+                Resource: [
+                    'arn:aws:ssm:${self:provider.region}:*:parameter/${self:service}/${self:provider.stage}/*'
+                ]
+                'ssm:GetParameter',
+                'ssm:GetParameters',
+                'ssm:GetParametersByPath'
+            ],
+Resource: [
+    'arn:aws:ssm:${self:provider.region}:*:parameter/${self:service}/${self:provider.stage}/*'
+]
+        });
+
+// Add environment variable for SSM parameter prefix
+definition.provider.environment.SSM_PARAMETER_PREFIX = '/${self:service}/${self:provider.stage}';
+// Add environment variable for SSM parameter prefix
+definition.provider.environment.SSM_PARAMETER_PREFIX = '/${self:service}/${self:provider.stage}';
     }
 
-    // Add integration-specific functions and resources
+// Add integration-specific functions and resources
+if (AppDefinition.integrations && Array.isArray(AppDefinition.integrations)) {
     for (const integration of AppDefinition.integrations) {
+        if (!integration || !integration.Definition || !integration.Definition.name) {
+            throw new Error('Invalid integration: missing Definition or name');
+        }
         const integrationName = integration.Definition.name;
+        if (AppDefinition.integrations && Array.isArray(AppDefinition.integrations)) {
+            for (const integration of AppDefinition.integrations) {
+                if (!integration || !integration.Definition || !integration.Definition.name) {
+                    throw new Error('Invalid integration: missing Definition or name');
+                }
+                const integrationName = integration.Definition.name;
+
+                // Add function for the integration
+                definition.functions[integrationName] = {
+                    handler: `node_modules/@friggframework/core/handlers/routers/integration-defined-routers.handlers.${integrationName}.handler`,
+                    events: [
+                        {
+                            httpApi: {
+                                path: `/api/${integrationName}-integration/{proxy+}`,
+                                method: 'ANY',
+                            },
+                        },
+                    ],
+                };
+
+                // Add SQS Queue for the integration
+                const queueReference = `${integrationName.charAt(0).toUpperCase() + integrationName.slice(1)
+                    }Queue`;
+                const queueName = `\${self:service}--\${self:provider.stage}-${queueReference}`;
+                definition.resources.Resources[queueReference] = {
+                    Type: 'AWS::SQS::Queue',
+                    Properties: {
+                        QueueName: `\${self:custom.${queueReference}}`,
+                        MessageRetentionPeriod: 60,
+                        VisibilityTimeout: 1800,  // 30 minutes
+                        RedrivePolicy: {
+                            maxReceiveCount: 1,
+                            deadLetterTargetArn: {
+                                'Fn::GetAtt': ['InternalErrorQueue', 'Arn'],
+                            },
+                        },
+                    },
+                };
+
+                // Add Queue Worker for the integration
+                const queueWorkerName = `${integrationName}QueueWorker`;
+                definition.functions[queueWorkerName] = {
+                    handler: `node_modules/@friggframework/core/handlers/workers/integration-defined-workers.handlers.${integrationName}.queueWorker`,
+                    reservedConcurrency: 5,
+                    events: [
+                        {
+                            sqs: {
+                                arn: {
+                                    'Fn::GetAtt': [queueReference, 'Arn'],
+                                },
+                                batchSize: 1,
+                            },
+                        },
+                    ],
+                    timeout: 600,
+                };
+
+                // Add Queue URL for the integration to the ENVironment variables
+                definition.provider.environment = {
+                    ...definition.provider.environment,
+                    [`${integrationName.toUpperCase()}_QUEUE_URL`]: {
+                        Ref: queueReference,
+                    },
+                };
+                // Add Queue URL for the integration to the ENVironment variables
+                definition.provider.environment = {
+                    ...definition.provider.environment,
+                    [`${integrationName.toUpperCase()}_QUEUE_URL`]: {
+                        Ref: queueReference,
+                    },
+                };
+
+                definition.custom[queueReference] = queueName;
+            }
+        }
+
+        // Discovery has already run successfully at this point if needed
+        // The discoveredResources object contains all the necessary AWS resources
+
+        // Add websocket function if enabled
+        if (AppDefinition.websockets?.enable === true) {
+            definition.functions.defaultWebsocket = {
+                handler: 'node_modules/@friggframework/core/handlers/routers/websocket.handler',
+                events: [
+                    {
+                        websocket: {
+                            route: '$connect',
+                        },
+                    },
+                    {
+                        websocket: {
+                            route: '$default',
+                        },
+                    },
+                    {
+                        websocket: {
+                            route: '$disconnect',
+                        },
+                    },
+                ],
+            };
+        }
+
+        // Discovery has already run successfully at this point if needed
+        // The discoveredResources object contains all the necessary AWS resources
+
+        // Add websocket function if enabled
+        if (AppDefinition.websockets?.enable === true) {
+            definition.functions.defaultWebsocket = {
+                handler: 'node_modules/@friggframework/core/handlers/routers/websocket.handler',
+                events: [
+                    {
+                        websocket: {
+                            route: '$connect',
+                        },
+                    },
+                    {
+                        websocket: {
+                            route: '$default',
+                        },
+                    },
+                    {
+                        websocket: {
+                            route: '$disconnect',
+                        },
+                    },
+                ],
+            };
+            definition.custom[queueReference] = queueName;
+        }
+    }
+
+    // Discovery has already run successfully at this point if needed
+    // The discoveredResources object contains all the necessary AWS resources
 
-        // Add function for the integration
-        definition.functions[integrationName] = {
-            handler: `node_modules/@friggframework/core/handlers/routers/integration-defined-routers.handlers.${integrationName}.handler`,
+    // Add websocket function if enabled
+    if (AppDefinition.websockets?.enable === true) {
+        definition.functions.defaultWebsocket = {
+            handler: 'node_modules/@friggframework/core/handlers/routers/websocket.handler',
             events: [
                 {
-                    http: {
-                        path: `/api/${integrationName}-integration/{proxy+}`,
-                        method: 'ANY',
-                        cors: corsConfig,
+                    websocket: {
+                        route: '$connect',
                     },
                 },
-            ],
-        };
-
-        // Add SQS Queue for the integration
-        const queueReference = `${integrationName.charAt(0).toUpperCase() + integrationName.slice(1)
-            }Queue`;
-        const queueName = `\${self:service}--\${self:provider.stage}-${queueReference}`;
-        definition.resources.Resources[queueReference] = {
-            Type: 'AWS::SQS::Queue',
-            Properties: {
-                QueueName: `\${self:custom.${queueReference}}`,
-                MessageRetentionPeriod: 60,
-                VisibilityTimeout: 1800,  // 30 minutes
-                RedrivePolicy: {
-                    maxReceiveCount: 1,
-                    deadLetterTargetArn: {
-                        'Fn::GetAtt': ['InternalErrorQueue', 'Arn'],
+                {
+                    websocket: {
+                        route: '$default',
                     },
                 },
-            },
+                {
+                    websocket: {
+                        route: '$disconnect',
+                    },
+                },
+            ],
         };
+    }
 
-        // Add Queue Worker for the integration
-        const queueWorkerName = `${integrationName}QueueWorker`;
-        definition.functions[queueWorkerName] = {
-            handler: `node_modules/@friggframework/core/handlers/workers/integration-defined-workers.handlers.${integrationName}.queueWorker`,
-            reservedConcurrency: 5,
+    // Discovery has already run successfully at this point if needed
+    // The discoveredResources object contains all the necessary AWS resources
+
+    // Add websocket function if enabled
+    if (AppDefinition.websockets?.enable === true) {
+        definition.functions.defaultWebsocket = {
+            handler: 'node_modules/@friggframework/core/handlers/routers/websocket.handler',
             events: [
                 {
-                    sqs: {
-                        arn: {
-                            'Fn::GetAtt': [queueReference, 'Arn'],
-                        },
-                        batchSize: 1,
+                    websocket: {
+                        route: '$connect',
+                    },
+                },
+                {
+                    websocket: {
+                        route: '$default',
+                    },
+                },
+                {
+                    websocket: {
+                        route: '$disconnect',
                     },
                 },
             ],
-            timeout: 600,
-        };
-
-        // Add Queue URL for the integration to the ENVironment variables
-        definition.provider.environment = {
-            ...definition.provider.environment,
-            [`${integrationName.toUpperCase()}_QUEUE_URL`]: {
-                Ref: queueReference,
-            },
         };
-
-        definition.custom[queueReference] = queueName;
     }
 
     // Modify handler paths to point to the correct node_modules location